Several (internal) cleanups. Const flags are better used now.

22 files changed, 64 insertions, 56 deletions

diff --git a/lib/gnutls_alert.c b/lib/gnutls_alert.c
index db51754523..c3f5d3fcd3 100644
--- a/lib/gnutls_alert.c
+++ b/lib/gnutls_alert.c
@@ -27,7 +27,7 @@
 
 typedef struct {
 	AlertDescription alert;
-	char *desc;
+	const char *desc;
 } gnutls_alert_entry;
 
 static const gnutls_alert_entry sup_alerts[] = {
@@ -73,7 +73,7 @@ static const gnutls_alert_entry sup_alerts[] = {
   *
   **/
 const char* gnutls_alert_get_name( int alert) {
-char* ret = NULL;
+const char* ret = NULL;
 
 	GNUTLS_ALERT_ID_LOOP( ret = p->desc);
 
diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c
index 67cc817dd1..17d7e64e39 100644
--- a/lib/gnutls_algorithms.c
+++ b/lib/gnutls_algorithms.c
@@ -51,7 +51,7 @@ static const gnutls_cred_map cred_mappings[] = {
 /* TLS Versions */
 
 typedef struct {
-	char *name;
+	const char *name;
 	GNUTLS_Version id;	/* gnutls internal version number */
 	int major;		/* defined by the protocol */
 	int minor;		/* defined by the protocol */
@@ -74,7 +74,7 @@ static const gnutls_version_entry sup_versions[] = {
 
 
 struct gnutls_cipher_entry {
-	char *name;
+	const char *name;
 	BulkCipherAlgorithm id;
 	size_t blocksize;
 	size_t keysize;
@@ -107,7 +107,7 @@ static const gnutls_cipher_entry algorithms[] = {
 
 
 struct gnutls_hash_entry {
-	char *name;
+	const char *name;
 	MACAlgorithm id;
 	size_t digestsize;
 };
@@ -133,7 +133,7 @@ static const gnutls_hash_entry hash_algorithms[] = {
 	{ #name, name, id }
 
 struct gnutls_compression_entry {
-	char *name;
+	const char *name;
 	CompressionMethod id;
 	int num; /* the number reserved in TLS for the specific compression method */
 };
@@ -192,7 +192,7 @@ gnutls_kx_algo_entry _gnutls_kx_algorithms[MAX_KX_ALGOS] = {
 	{ #name, {name}, block_algorithm, kx_algorithm, mac_algorithm, version }
 
 typedef struct {
-	char *name;
+	const char *name;
 	GNUTLS_CipherSuite id;
 	BulkCipherAlgorithm block_algorithm;
 	KXAlgorithm kx_algorithm;
@@ -424,7 +424,7 @@ inline int _gnutls_mac_priority(GNUTLS_STATE state, MACAlgorithm algorithm)
   **/
 const char *gnutls_mac_get_name( GNUTLS_MACAlgorithm algorithm)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	/* avoid prefix */
 	GNUTLS_HASH_ALG_LOOP(ret =
@@ -471,7 +471,7 @@ inline
   **/
 const char *gnutls_compression_get_name( GNUTLS_CompressionMethod algorithm)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	/* avoid prefix */
 	GNUTLS_COMPRESSION_ALG_LOOP(ret =
@@ -588,7 +588,7 @@ int _gnutls_cipher_get_iv_size(BulkCipherAlgorithm algorithm)
   **/
 const char *gnutls_cipher_get_name( GNUTLS_BulkCipherAlgorithm algorithm)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	/* avoid prefix */
 	GNUTLS_ALG_LOOP(ret = p->name);
@@ -639,7 +639,7 @@ inline int _gnutls_kx_priority(GNUTLS_STATE state, KXAlgorithm algorithm)
   **/
 const char *gnutls_kx_get_name( GNUTLS_KXAlgorithm algorithm)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	/* avoid prefix */
 	GNUTLS_KX_ALG_LOOP(ret = p->name);
@@ -725,7 +725,7 @@ GNUTLS_Version _gnutls_version_max(GNUTLS_STATE state)
   **/
 const char *gnutls_protocol_get_name( GNUTLS_Version version)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	/* avoid prefix */
 	GNUTLS_VERSION_ALG_LOOP(ret =
@@ -831,7 +831,7 @@ _gnutls_cipher_suite_get_mac_algo(const GNUTLS_CipherSuite suite)
 
 const char *_gnutls_cipher_suite_get_name(GNUTLS_CipherSuite suite)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	/* avoid prefix */
 	GNUTLS_CIPHER_SUITE_ALG_LOOP(ret =
@@ -845,7 +845,7 @@ inline
 static int _gnutls_cipher_suite_is_ok(GNUTLS_CipherSuite suite)
 {
 	size_t ret;
-	char *name = NULL;
+	const char *name = NULL;
 
 	GNUTLS_CIPHER_SUITE_ALG_LOOP(name = p->name);
 	if (name != NULL)
@@ -936,20 +936,20 @@ _gnutls_compare_algo(GNUTLS_STATE state, const void *i_A1,
 		     const void *i_A2)
 {
 	KXAlgorithm kA1 =
-	    _gnutls_cipher_suite_get_kx_algo(*(GNUTLS_CipherSuite *) i_A1);
+	    _gnutls_cipher_suite_get_kx_algo(*(const GNUTLS_CipherSuite *) i_A1);
 	KXAlgorithm kA2 =
-	    _gnutls_cipher_suite_get_kx_algo(*(GNUTLS_CipherSuite *) i_A2);
+	    _gnutls_cipher_suite_get_kx_algo(*(const GNUTLS_CipherSuite *) i_A2);
 	BulkCipherAlgorithm cA1 =
-	    _gnutls_cipher_suite_get_cipher_algo(*(GNUTLS_CipherSuite *)
+	    _gnutls_cipher_suite_get_cipher_algo(*(const GNUTLS_CipherSuite *)
 						 i_A1);
 	BulkCipherAlgorithm cA2 =
-	    _gnutls_cipher_suite_get_cipher_algo(*(GNUTLS_CipherSuite *)
+	    _gnutls_cipher_suite_get_cipher_algo(*(const GNUTLS_CipherSuite *)
 						 i_A2);
 	MACAlgorithm mA1 =
-	    _gnutls_cipher_suite_get_mac_algo(*(GNUTLS_CipherSuite *)
+	    _gnutls_cipher_suite_get_mac_algo(*(const GNUTLS_CipherSuite *)
 					      i_A1);
 	MACAlgorithm mA2 =
-	    _gnutls_cipher_suite_get_mac_algo(*(GNUTLS_CipherSuite *)
+	    _gnutls_cipher_suite_get_mac_algo(*(const GNUTLS_CipherSuite *)
 					      i_A2);
 
 	int p1 = (_gnutls_kx_priority(state, kA1) + 1) * 64;
@@ -1163,7 +1163,7 @@ _gnutls_supported_compression_methods(GNUTLS_STATE state, uint8 ** comp)
   **/
 const char *gnutls_cert_type_get_name( GNUTLS_CertificateType type)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	if (type==GNUTLS_CRT_X509) ret = "X.509";
 	if (type==GNUTLS_CRT_OPENPGP) ret = "OPENPGP";
diff --git a/lib/gnutls_algorithms.h b/lib/gnutls_algorithms.h
index bc095369a1..4a5ae8e623 100644
--- a/lib/gnutls_algorithms.h
+++ b/lib/gnutls_algorithms.h
@@ -76,7 +76,7 @@ KXAlgorithm _gnutls_map_kx_get_kx(CredType type);
 CredType _gnutls_map_kx_get_cred(KXAlgorithm algorithm);
 
 struct gnutls_kx_algo_entry {
-	char *name;
+	const char *name;
 	KXAlgorithm algorithm;
 	MOD_AUTH_STRUCT *auth_struct;
 };
diff --git a/lib/gnutls_auth.h b/lib/gnutls_auth.h
index 2a9442ce53..846b0816ee 100644
--- a/lib/gnutls_auth.h
+++ b/lib/gnutls_auth.h
@@ -2,7 +2,7 @@
 # define GNUTLS_AUTH_H
 
 typedef struct MOD_AUTH_STRUCT_INT {
-	char* name; /* null terminated */
+	const char* name; /* null terminated */
 	int (*gnutls_generate_server_certificate)( GNUTLS_STATE, opaque**);
 	int (*gnutls_generate_client_certificate)( GNUTLS_STATE, opaque**);
 	int (*gnutls_generate_server_kx)( GNUTLS_STATE, opaque**);
diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index e234eb1483..25982edf2e 100644
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -60,7 +60,7 @@ int _gnutls_encrypt(GNUTLS_STATE state, const char* headers, int headers_size,
 		const char *data, size_t data_size,
 		opaque * ciphertext, int ciphertext_size, ContentType type, int random_pad)
 {
-	gnutls_datum plain = { (char*)data, data_size };
+	const gnutls_datum plain = { data, data_size };
 	gnutls_datum comp;
 	int ret;
 	int free_comp = 1;
@@ -69,6 +69,9 @@ int _gnutls_encrypt(GNUTLS_STATE state, const char* headers, int headers_size,
 		comp = plain;
 		free_comp = 0;
 	} else {
+		/* Here comp is allocated and must be 
+		 * freed.
+		 */
 		ret = _gnutls_m_plaintext2compressed(state, &comp, plain);
 		if (ret < 0) {
 			gnutls_assert();
diff --git a/lib/gnutls_compress_int.c b/lib/gnutls_compress_int.c
index b30b8611fd..30f39663cd 100644
--- a/lib/gnutls_compress_int.c
+++ b/lib/gnutls_compress_int.c
@@ -85,6 +85,7 @@ int err;
 					err = deflateEnd( handle->handle);
 				break;
 #endif
+			default:
 		}
 		gnutls_free( handle->handle);
 		gnutls_free( handle);
@@ -97,7 +98,7 @@ int err;
 /* These functions are memory consuming 
  */
 
-int _gnutls_compress( GNUTLS_COMP_HANDLE handle, char* plain, int plain_size, char** compressed, int max_comp_size) {
+int _gnutls_compress( GNUTLS_COMP_HANDLE handle, const char* plain, int plain_size, char** compressed, int max_comp_size) {
 int compressed_size=GNUTLS_E_COMPRESSION_FAILED;
 #ifdef HAVE_LIBZ
 uLongf size;
diff --git a/lib/gnutls_compress_int.h b/lib/gnutls_compress_int.h
index 284e6a1479..037771a628 100644
--- a/lib/gnutls_compress_int.h
+++ b/lib/gnutls_compress_int.h
@@ -36,6 +36,6 @@ GNUTLS_COMP_HANDLE _gnutls_comp_init( CompressionMethod, int d);
 void _gnutls_comp_deinit(GNUTLS_COMP_HANDLE handle, int d);
 
 int _gnutls_decompress( GNUTLS_COMP_HANDLE handle, char* compressed, int compressed_size, char** plain, int max_record_size);
-int _gnutls_compress( GNUTLS_COMP_HANDLE, char* plain, int plain_size, char** compressed, int max_comp_size);
+int _gnutls_compress( GNUTLS_COMP_HANDLE, const char* plain, int plain_size, char** compressed, int max_comp_size);
 
 #endif
diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index 074a69307e..0b91e5332d 100644
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -33,7 +33,7 @@ extern void (*_gnutls_log_func)( const char*);
 	{ #name, name, fatal }
 
 struct gnutls_error_entry {
-	char *name;
+	const char *name;
 	int  number;
 	int  fatal;
 };
@@ -176,7 +176,7 @@ void gnutls_perror(int error)
   **/
 const char* gnutls_strerror(int error)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	/* avoid prefix */
 	GNUTLS_ERROR_ALG_LOOP(ret =
diff --git a/lib/gnutls_extensions.c b/lib/gnutls_extensions.c
index 2a85bd2837..37028d53e7 100644
--- a/lib/gnutls_extensions.c
+++ b/lib/gnutls_extensions.c
@@ -67,7 +67,7 @@ void* _gnutls_ext_func_send(uint16 type)
 
 const char *_gnutls_extension_get_name(uint16 type)
 {
-	char *ret = NULL;
+	const char *ret = NULL;
 
 	/* avoid prefix */
 	GNUTLS_EXTENSION_LOOP(ret = p->name + sizeof("EXTENSION_") - 1);
diff --git a/lib/gnutls_extensions.h b/lib/gnutls_extensions.h
index 30243f8ca6..9c9fd5a23f 100644
--- a/lib/gnutls_extensions.h
+++ b/lib/gnutls_extensions.h
@@ -27,7 +27,7 @@ int _gnutls_parse_extensions( GNUTLS_STATE, const opaque*, int);
 int _gnutls_gen_extensions( GNUTLS_STATE state, opaque** data);
 
 typedef struct {
-	char *name;
+	const char *name;
 	uint16 type;
 	int (*gnutls_ext_func_recv)( GNUTLS_STATE, const opaque*, int); /* recv data */
 	int (*gnutls_ext_func_send)( GNUTLS_STATE, opaque*, int); /* send data */
diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 533e57cd35..155985cd3d 100644
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -134,7 +134,7 @@ static int _gnutls_ssl3_finished(GNUTLS_STATE state, int type, opaque * ret)
 	const int siz = SSL_MSG_LEN;
 	GNUTLS_MAC_HANDLE td_md5;
 	GNUTLS_MAC_HANDLE td_sha;
-	char *mesg;
+	const opaque *mesg;
 
 	td_md5 = _gnutls_hash_copy( state->gnutls_internals.handshake_mac_handle_md5);
 	if (td_md5 == NULL) {
@@ -173,7 +173,7 @@ int _gnutls_finished(GNUTLS_STATE state, int type, void *ret)
 {
 	const int siz = TLS_MSG_LEN;
 	opaque concat[36];
-	opaque *mesg;
+	const opaque *mesg;
 	GNUTLS_MAC_HANDLE td_md5;
 	GNUTLS_MAC_HANDLE td_sha;
 
@@ -1985,6 +1985,7 @@ int gnutls_handshake_client(GNUTLS_STATE state)
 		IMED_RET("send client certificate verify", ret);
 
 		STATE = STATE0;
+	default:
 	}
 
 
@@ -2038,6 +2039,7 @@ static int _gnutls_send_handshake_final(GNUTLS_STATE state, int init)
 		}
 
 		STATE = STATE0;
+	default:
 	}
 
 	return 0;
@@ -2091,6 +2093,7 @@ static int _gnutls_recv_handshake_final(GNUTLS_STATE state, int init)
 			return ret;
 		}
 		STATE = STATE0;
+	default:
 	}
 
 
@@ -2205,6 +2208,7 @@ int gnutls_handshake_server(GNUTLS_STATE state)
 		IMED_RET("recv client certificate verify", ret);
 
 		STATE = STATE0;	/* finished thus clear state */
+	default:
 	}
 
 	return 0;
diff --git a/lib/gnutls_hash_int.c b/lib/gnutls_hash_int.c
index ba5abe8eba..c12ee544d8 100644
--- a/lib/gnutls_hash_int.c
+++ b/lib/gnutls_hash_int.c
@@ -165,7 +165,7 @@ void _gnutls_hash_deinit(GNUTLS_HASH_HANDLE handle, void* digest)
 }
 
 
-GNUTLS_MAC_HANDLE _gnutls_hmac_init(MACAlgorithm algorithm, void *key,
+GNUTLS_MAC_HANDLE _gnutls_hmac_init(MACAlgorithm algorithm, const void *key,
 				   int keylen)
 {
 	GNUTLS_MAC_HANDLE ret;
diff --git a/lib/gnutls_hash_int.h b/lib/gnutls_hash_int.h
index f21b700769..9804f51802 100644
--- a/lib/gnutls_hash_int.h
+++ b/lib/gnutls_hash_int.h
@@ -36,7 +36,7 @@ typedef struct {
 	GCRY_MD_HD handle;
 #endif
 	MACAlgorithm algorithm;
-	void* key;
+	const void* key;
 	int keysize;
 } GNUTLS_MAC_HANDLE_INT;
 typedef GNUTLS_MAC_HANDLE_INT* GNUTLS_MAC_HANDLE;
@@ -45,7 +45,7 @@ typedef GNUTLS_MAC_HANDLE GNUTLS_HASH_HANDLE;
 #define GNUTLS_HASH_FAILED NULL
 #define GNUTLS_MAC_FAILED NULL
 
-GNUTLS_MAC_HANDLE _gnutls_hmac_init( MACAlgorithm algorithm, void* key, int keylen);
+GNUTLS_MAC_HANDLE _gnutls_hmac_init( MACAlgorithm algorithm, const void* key, int keylen);
 int _gnutls_hmac_get_algo_len(MACAlgorithm algorithm);
 int _gnutls_hmac(GNUTLS_MAC_HANDLE handle, const void* text, int textlen);
 void _gnutls_hmac_deinit( GNUTLS_MAC_HANDLE handle, void* digest);
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 75de283072..b957da7e06 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -26,7 +26,7 @@
 #include <defines.h>
 
 /*
-#define IO_DEBUG 3 // define this to check non blocking behaviour 
+#define IO_DEBUG 3 // define this to check non blocking behaviour
 #define BUFFERS_DEBUG
 #define HARD_DEBUG
 #define WRITE_DEBUG
diff --git a/lib/gnutls_mpi.c b/lib/gnutls_mpi.c
index f08f08b5a2..f8e6e8c427 100644
--- a/lib/gnutls_mpi.c
+++ b/lib/gnutls_mpi.c
@@ -54,7 +54,7 @@ int _gnutls_mpi_print_lz( opaque *buffer, size_t *nbytes, const GNUTLS_MPI a ) {
  * from asn1 structs. Combines the read and mpi_scan
  * steps.
  */
-int _gnutls_x509_read_int( ASN1_TYPE node, char* value, char* tmpstr, int tmpstr_size, GNUTLS_MPI* ret_mpi) {
+int _gnutls_x509_read_int( ASN1_TYPE node, const char* value, const char* tmpstr, int tmpstr_size, GNUTLS_MPI* ret_mpi) {
 int len, result;
 
 	len = tmpstr_size - 1;
@@ -74,8 +74,8 @@ int len, result;
 
 /* front end for asn1_create_element.
  */
-asn1_retCode _gnutls_asn1_create_element(ASN1_TYPE definitions,char *source_name,
-                                 ASN1_TYPE *element, char *dest_name) {
+asn1_retCode _gnutls_asn1_create_element(ASN1_TYPE definitions,const char *source_name,
+                                 ASN1_TYPE *element, const char *dest_name) {
 
 	*element = ASN1_TYPE_EMPTY;
 	
diff --git a/lib/gnutls_mpi.h b/lib/gnutls_mpi.h
index 0507454028..2a04816b69 100644
--- a/lib/gnutls_mpi.h
+++ b/lib/gnutls_mpi.h
@@ -31,9 +31,9 @@ int _gnutls_mpi_scan_pgp( GNUTLS_MPI *ret_mpi, const opaque *buffer, size_t *nby
 int _gnutls_mpi_print( opaque *buffer, size_t *nbytes, const GNUTLS_MPI a );
 int _gnutls_mpi_print_lz( opaque *buffer, size_t *nbytes, const GNUTLS_MPI a );
 
-int _gnutls_x509_read_int( ASN1_TYPE node, char* value, char* tmpstr, int tmpstr_size, MPI* ret_mpi);
+int _gnutls_x509_read_int( ASN1_TYPE node, const char* value, const char* tmpstr, int tmpstr_size, MPI* ret_mpi);
 
-asn1_retCode _gnutls_asn1_create_element(ASN1_TYPE definitions,char *source_name,
-                                 ASN1_TYPE *element, char *dest_name);
+asn1_retCode _gnutls_asn1_create_element(ASN1_TYPE definitions,const char *source_name,
+                                 ASN1_TYPE *element, const char *dest_name);
 
 #endif
diff --git a/lib/gnutls_state.c b/lib/gnutls_state.c
index 9086191302..314e85f483 100644
--- a/lib/gnutls_state.c
+++ b/lib/gnutls_state.c
@@ -471,7 +471,7 @@ void gnutls_handshake_set_rsa_pms_check(GNUTLS_STATE state, int check)
 }
 
 inline
-static void _gnutls_cal_PRF_A( MACAlgorithm algorithm, void *secret, int secret_size, void *seed, int seed_size, void* result)
+static void _gnutls_cal_PRF_A( MACAlgorithm algorithm, const void *secret, int secret_size, const void *seed, int seed_size, void* result)
 {
 	GNUTLS_MAC_HANDLE td1;
 
@@ -487,7 +487,7 @@ static void _gnutls_cal_PRF_A( MACAlgorithm algorithm, void *secret, int secret_
 /* Produces "total_bytes" bytes using the hash algorithm specified.
  * (used in the PRF function)
  */
-static int _gnutls_P_hash( MACAlgorithm algorithm, opaque * secret, int secret_size, opaque * seed, int seed_size, int total_bytes, opaque* ret)
+static int _gnutls_P_hash( MACAlgorithm algorithm, const opaque * secret, int secret_size, const opaque * seed, int seed_size, int total_bytes, opaque* ret)
 {
 
 	GNUTLS_MAC_HANDLE td2;
@@ -565,10 +565,10 @@ int modlen = _length%sizeof(unsigned long int);
  * needed by the TLS specification. ret must have a least total_bytes
  * available.
  */
-int _gnutls_PRF( opaque * secret, int secret_size, uint8 * label, int label_size, opaque * seed, int seed_size, int total_bytes, void* ret)
+int _gnutls_PRF( const opaque * secret, int secret_size, const uint8 * label, int label_size, opaque * seed, int seed_size, int total_bytes, void* ret)
 {
 	int l_s, s_seed_size;
-	char *s1, *s2;
+	const char *s1, *s2;
 	opaque s_seed[MAX_SEED_SIZE];
 	opaque o1[MAX_PRF_BYTES], o2[MAX_PRF_BYTES];
 	int result;
diff --git a/lib/gnutls_state.h b/lib/gnutls_state.h
index 1303e3cd0d..3e87691f95 100644
--- a/lib/gnutls_state.h
+++ b/lib/gnutls_state.h
@@ -29,6 +29,6 @@ void _gnutls_handshake_internal_state_clear( GNUTLS_STATE);
 
 int _gnutls_openpgp_send_fingerprint( GNUTLS_STATE state);
 
-int _gnutls_PRF( opaque * secret, int secret_size, uint8 * label, int label_size, opaque * seed, int seed_size, int total_bytes, void* ret);
+int _gnutls_PRF( const opaque * secret, int secret_size, const uint8 * label, int label_size, opaque * seed, int seed_size, int total_bytes, void* ret);
 
 #define DEFAULT_CERT_TYPE GNUTLS_CRT_X509
diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 8bef6c42ee..cb35ce1b4a 100644
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -265,7 +265,7 @@ void _gnutls_int2str(unsigned int k, char *data)
  * (they're complex enough)
  * --nmav
  */
-int _gnutls_x509_get_name_type(ASN1_TYPE rasn, char *root, gnutls_DN * dn)
+int _gnutls_x509_get_name_type(ASN1_TYPE rasn, const char *root, gnutls_DN * dn)
 {
 	int k, k2, result, len;
 	char name[128], str[1024], name2[128], counter[MAX_INT_DIGITS],
@@ -349,7 +349,7 @@ int _gnutls_x509_get_name_type(ASN1_TYPE rasn, char *root, gnutls_DN * dn)
 
 
 #define MAX_TIME 1024
-time_t _gnutls_x509_get_time(ASN1_TYPE c2, char *root, char *when)
+time_t _gnutls_x509_get_time(ASN1_TYPE c2, const char *root, const char *when)
 {
 	opaque ttime[MAX_TIME];
 	char name[1024];
@@ -400,7 +400,7 @@ time_t _gnutls_x509_get_time(ASN1_TYPE c2, char *root, char *when)
 	return ctime;
 }
 
-int _gnutls_x509_get_version(ASN1_TYPE c2, char *root)
+int _gnutls_x509_get_version(ASN1_TYPE c2, const char *root)
 {
 	opaque gversion[5];
 	char name[1024];
@@ -1101,7 +1101,7 @@ static int parse_der_cert_mem( gnutls_cert** cert_list, int* ncerts,
 		return GNUTLS_E_MEMORY_ERROR;
 	}
 
-	tmp.data = (opaque*) input_cert;
+	tmp.data = (opaque*)input_cert;
 	tmp.size = input_cert_size;
 
 	if ((ret =
diff --git a/lib/x509_extensions.c b/lib/x509_extensions.c
index 2c38827551..175c30bea1 100644
--- a/lib/x509_extensions.c
+++ b/lib/x509_extensions.c
@@ -157,7 +157,7 @@ static int _parse_extension(gnutls_cert * cert, char *extnID,
  * If no_critical_ext is non zero, then unsupported critical extensions
  * do not lead into a fatal error.
  */
-int _gnutls_get_ext_type(ASN1_TYPE rasn, char *root, gnutls_cert * cert,
+int _gnutls_get_ext_type(ASN1_TYPE rasn, const char *root, gnutls_cert * cert,
 	int no_critical_ext)
 {
 	int k, result, len;
diff --git a/lib/x509_extensions.h b/lib/x509_extensions.h
index 755f942cbb..fc80dcca80 100644
--- a/lib/x509_extensions.h
+++ b/lib/x509_extensions.h
@@ -1,2 +1,2 @@
-int _gnutls_get_ext_type( ASN1_TYPE rasn, char *root, gnutls_cert *cert, int no_critical_ext);
+int _gnutls_get_ext_type( ASN1_TYPE rasn, const char *root, gnutls_cert *cert, int no_critical_ext);
 int _gnutls_get_extension( const gnutls_datum * cert, const char* extension_id, gnutls_datum* ret);
diff --git a/lib/x509_xml.c b/lib/x509_xml.c
index 09dc647450..f327bf9773 100644
--- a/lib/x509_xml.c
+++ b/lib/x509_xml.c
@@ -37,7 +37,7 @@
 
 static int _gnutls_x509_expand_extensions(ASN1_TYPE* rasn, const char *root);
 
-static void *find_default_value(ASN1_TYPE x)
+static const void *find_default_value(ASN1_TYPE x)
 {
 	ASN1_TYPE p = x;
 
@@ -173,7 +173,7 @@ static int normalize_name( ASN1_TYPE p, char* output, int output_size)
 
 
 static int
-_gnutls_asn1_get_structure_xml(ASN1_TYPE structure, char *name,
+_gnutls_asn1_get_structure_xml(ASN1_TYPE structure, const char *name,
 			 gnutls_datum * res)
 {
 	node_asn *p, *root;
@@ -315,7 +315,7 @@ _gnutls_asn1_get_structure_xml(ASN1_TYPE structure, char *name,
 			STR_APPEND( ">");
 
 		if (is_node_printable(p)) {
-			unsigned char *value;
+			const unsigned char *value;
 
 			if (p->value == NULL)
 				value = find_default_value(p);