[core] differentiate array_get_* for ro and rw

array_get_element_klen() is now intended for read-only access
array_get_data_unset() is used by config processing for r/w access
array_get_buf_ptr() is used for r/w access to ds->value (string buffer)

28 files changed, 108 insertions, 96 deletions

diff --git a/src/array.c b/src/array.c
index d71624d5..9da4be82 100644
--- a/src/array.c
+++ b/src/array.c
@@ -142,7 +142,13 @@ static int32_t array_get_index(const array * const a, const char * const k, cons
 }
 
 __attribute_hot__
-data_unset *array_get_element_klen(const array * const a, const char *key, const size_t klen) {
+const data_unset *array_get_element_klen(const array * const a, const char *key, const size_t klen) {
+    const int32_t ipos = array_get_index(a, key, klen);
+    return ipos >= 0 ? a->data[ipos] : NULL;
+}
+
+/* non-const (data_config *) for configparser.y (not array_get_element_klen())*/
+data_unset *array_get_data_unset(const array * const a, const char *key, const size_t klen) {
     const int32_t ipos = array_get_index(a, key, klen);
     return ipos >= 0 ? a->data[ipos] : NULL;
 }
diff --git a/src/array.h b/src/array.h
index 2574fef7..21778351 100644
--- a/src/array.h
+++ b/src/array.h
@@ -87,9 +87,12 @@ __attribute_cold__
 __attribute_pure__
 int array_is_kvstring(const array *a);
 
-#define array_get_element(a, key) array_get_element_klen((a), (key), sizeof(key)-1)
 __attribute_pure__
-data_unset *array_get_element_klen(const array *a, const char *key, size_t klen);
+const data_unset *array_get_element_klen(const array *a, const char *key, size_t klen);
+
+__attribute_cold__
+__attribute_pure__
+data_unset *array_get_data_unset(const array *a, const char *key, size_t klen);
 
 __attribute_cold__
 data_unset *array_extract_element_klen(array *a, const char *key, size_t klen); /* removes found entry from array */
diff --git a/src/configfile-glue.c b/src/configfile-glue.c
index 2375c6c8..9cbee38d 100644
--- a/src/configfile-glue.c
+++ b/src/configfile-glue.c
@@ -30,7 +30,7 @@
 /* parse config array */
 int config_insert_values_internal(server *srv, array *ca, const config_values_t cv[], config_scope_type_t scope) {
 	size_t i;
-	data_unset *du;
+	const data_unset *du;
 
 	for (i = 0; cv[i].key; i++) {
 
@@ -52,7 +52,7 @@ int config_insert_values_internal(server *srv, array *ca, const config_values_t
 		case T_CONFIG_ARRAY:
 			if (du->type == TYPE_ARRAY) {
 				size_t j;
-				data_array *da = (data_array *)du;
+				const data_array *da = (const data_array *)du;
 
 				for (j = 0; j < da->value->used; j++) {
 					data_unset *ds = da->value->data[j];
@@ -74,7 +74,7 @@ int config_insert_values_internal(server *srv, array *ca, const config_values_t
 			break;
 		case T_CONFIG_STRING:
 			if (du->type == TYPE_STRING) {
-				data_string *ds = (data_string *)du;
+				const data_string *ds = (const data_string *)du;
 
 				buffer_copy_buffer(cv[i].destination, ds->value);
 			} else {
@@ -86,13 +86,13 @@ int config_insert_values_internal(server *srv, array *ca, const config_values_t
 		case T_CONFIG_SHORT:
 			switch(du->type) {
 			case TYPE_INTEGER: {
-				data_integer *di = (data_integer *)du;
+				const data_integer *di = (const data_integer *)du;
 
 				*((unsigned short *)(cv[i].destination)) = di->value;
 				break;
 			}
 			case TYPE_STRING: {
-				data_string *ds = (data_string *)du;
+				const data_string *ds = (const data_string *)du;
 
 				/* If the value came from an environment variable, then it is a
 				 * data_string, although it may contain a number in ASCII
@@ -121,13 +121,13 @@ int config_insert_values_internal(server *srv, array *ca, const config_values_t
 		case T_CONFIG_INT:
 			switch(du->type) {
 			case TYPE_INTEGER: {
-				data_integer *di = (data_integer *)du;
+				const data_integer *di = (const data_integer *)du;
 
 				*((unsigned int *)(cv[i].destination)) = di->value;
 				break;
 			}
 			case TYPE_STRING: {
-				data_string *ds = (data_string *)du;
+				const data_string *ds = (const data_string *)du;
 
 				if (ds->value->ptr && *ds->value->ptr) {
 					char *e;
@@ -149,7 +149,7 @@ int config_insert_values_internal(server *srv, array *ca, const config_values_t
 			break;
 		case T_CONFIG_BOOLEAN:
 			if (du->type == TYPE_STRING) {
-				data_string *ds = (data_string *)du;
+				const data_string *ds = (const data_string *)du;
 
 				if (buffer_is_equal_string(ds->value, CONST_STR_LEN("enable"))) {
 					*((unsigned short *)(cv[i].destination)) = 1;
@@ -189,7 +189,7 @@ int config_insert_values_internal(server *srv, array *ca, const config_values_t
 
 int config_insert_values_global(server *srv, array *ca, const config_values_t cv[], config_scope_type_t scope) {
 	size_t i;
-	data_unset *du;
+	const data_unset *du;
 
 	for (i = 0; cv[i].key; i++) {
 		if (NULL == (du = array_get_element_klen(ca, cv[i].key, strlen(cv[i].key)))) {
diff --git a/src/configfile.c b/src/configfile.c
index a7ac53bc..2e99af8c 100644
--- a/src/configfile.c
+++ b/src/configfile.c
@@ -32,7 +32,7 @@
 static void config_warn_authn_module (server *srv, const char *module, size_t len) {
 	for (size_t i = 0; i < srv->config_context->used; ++i) {
 		const data_config *config = (data_config const*)srv->config_context->data[i];
-		const data_unset *du = array_get_element(config->value, "auth.backend");
+		const data_unset *du = array_get_element_klen(config->value, CONST_STR_LEN("auth.backend"));
 		if (NULL != du && du->type == TYPE_STRING) {
 			data_string *ds = (data_string *)du;
 			if (buffer_is_equal_string(ds->value, module, len)) {
diff --git a/src/configparser.y b/src/configparser.y
index 39b54236..18561a6b 100644
--- a/src/configparser.y
+++ b/src/configparser.y
@@ -16,6 +16,10 @@
 #include <stdio.h>
 #include <string.h>
 
+static data_config * configparser_get_data_config(const array *a, const char *k, const size_t klen) {
+  return (data_config *)array_get_data_unset(a, k, klen);
+}
+
 static void configparser_push(config_t *ctx, data_config *dc, int isnew) {
   if (isnew) {
     dc->context_ndx = ctx->all_configs->used;
@@ -40,7 +44,7 @@ static data_config *configparser_pop(config_t *ctx) {
 
 /* return a copied variable */
 static data_unset *configparser_get_variable(config_t *ctx, const buffer *key) {
-  data_unset *du;
+  const data_unset *du;
   data_config *dc;
 
 #if 0
@@ -52,9 +56,9 @@ static data_unset *configparser_get_variable(config_t *ctx, const buffer *key) {
     array_print(dc->value, 0);
 #endif
     if (NULL != (du = array_get_element_klen(dc->value, CONST_BUF_LEN(key)))) {
-      du = du->fn->copy(du);
-      buffer_clear(du->key);
-      return du;
+      data_unset *du_copy = du->fn->copy(du);
+      buffer_clear(du_copy->key);
+      return du_copy;
     }
   }
   return NULL;
@@ -414,7 +418,7 @@ eols ::= .
 
 globalstart ::= GLOBAL. {
   data_config *dc;
-  dc = (data_config *)array_get_element_klen(ctx->srv->config_context, CONST_STR_LEN("global"));
+  dc = configparser_get_data_config(ctx->srv->config_context, CONST_STR_LEN("global"));
   force_assert(dc);
   configparser_push(ctx, dc, 0);
 }
@@ -487,7 +491,7 @@ condlines(A) ::= condlines(B) eols ELSE cond_else(C). {
       force_assert(0);
     }
 
-    if (NULL == (dc = (data_config *)array_get_element_klen(ctx->all_configs, CONST_BUF_LEN(C->key)))) {
+    if (NULL == (dc = configparser_get_data_config(ctx->all_configs, CONST_BUF_LEN(C->key)))) {
       /* re-insert into ctx->all_configs with new C->key */
       array_insert_unique(ctx->all_configs, (data_unset *)C);
       C->prev = B;
@@ -575,7 +579,7 @@ context ::= DOLLAR SRVVARNAME(B) LBRACKET stringop(C) RBRACKET cond(E) expressio
     rvalue = ((data_string*)D)->value;
     buffer_append_string_buffer(b, rvalue);
 
-    if (NULL != (dc = (data_config *)array_get_element_klen(ctx->all_configs, CONST_BUF_LEN(b)))) {
+    if (NULL != (dc = configparser_get_data_config(ctx->all_configs, CONST_BUF_LEN(b)))) {
       configparser_push(ctx, dc, 0);
     } else {
       static const struct {
diff --git a/src/gw_backend.c b/src/gw_backend.c
index bd1fee6d..9aa97389 100644
--- a/src/gw_backend.c
+++ b/src/gw_backend.c
@@ -1173,12 +1173,12 @@ handler_t gw_free(server *srv, void *p_d) {
     return HANDLER_GO_ON;
 }
 
-int gw_set_defaults_backend(server *srv, gw_plugin_data *p, data_unset *du, size_t i, int sh_exec) {
+int gw_set_defaults_backend(server *srv, gw_plugin_data *p, const data_unset *du, size_t i, int sh_exec) {
     /* per-module plugin_config MUST have common "base class" gw_plugin_config*/
     /* per-module plugin_data MUST have pointer-compatible common "base class"
      * with gw_plugin_data (stemming from gw_plugin_config compatibility) */
 
-    data_array *da = (data_array *)du;
+    const data_array *da = (const data_array *)du;
     gw_plugin_config *s = p->config_storage[i];
     buffer *gw_mode;
     gw_host *host = NULL;
@@ -1590,12 +1590,12 @@ error:
     return 0;
 }
 
-int gw_set_defaults_balance(server *srv, gw_plugin_config *s, data_unset *du) {
+int gw_set_defaults_balance(server *srv, gw_plugin_config *s, const data_unset *du) {
     buffer *b;
     if (NULL == du) {
         b = NULL;
     } else if (du->type == TYPE_STRING) {
-        b = ((data_string *)du)->value;
+        b = ((const data_string *)du)->value;
     } else {
         log_error_write(srv, __FILE__, __LINE__, "s",
                         "unexpected type for xxxxx.balance; expected string");
diff --git a/src/gw_backend.h b/src/gw_backend.h
index 79af5a00..c84035ef 100644
--- a/src/gw_backend.h
+++ b/src/gw_backend.h
@@ -335,8 +335,8 @@ typedef struct gw_handler_ctx {
 void * gw_init(void);
 void gw_plugin_config_free(gw_plugin_config *s);
 handler_t gw_free(server *srv, void *p_d);
-int gw_set_defaults_backend(server *srv, gw_plugin_data *p, data_unset *du, size_t i, int sh_exec);
-int gw_set_defaults_balance(server *srv, gw_plugin_config *s, data_unset *du);
+int gw_set_defaults_backend(server *srv, gw_plugin_data *p, const data_unset *du, size_t i, int sh_exec);
+int gw_set_defaults_balance(server *srv, gw_plugin_config *s, const data_unset *du);
 handler_t gw_check_extension(server *srv, connection *con, gw_plugin_data *p, int uri_path_handler, size_t hctx_sz);
 handler_t gw_connection_reset(server *srv, connection *con, void *p_d);
 handler_t gw_handle_subrequest(server *srv, connection *con, void *p_d);
diff --git a/src/http_header.c b/src/http_header.c
index 5dba6b22..3d30c4cf 100644
--- a/src/http_header.c
+++ b/src/http_header.c
@@ -86,7 +86,7 @@ static inline void http_header_token_append(buffer * const vb, const char * cons
 __attribute_pure__
 static inline buffer * http_header_generic_get_ifnotempty(const array * const a, const char * const k, const size_t klen) {
     const data_string * const ds =
-      (data_string *)array_get_element_klen(a, k, klen);
+      (const data_string *)array_get_element_klen(a, k, klen);
     return ds && !buffer_string_is_empty(ds->value) ? ds->value : NULL;
 }
 
diff --git a/src/mod_auth.c b/src/mod_auth.c
index 3800a7fa..36f77c11 100644
--- a/src/mod_auth.c
+++ b/src/mod_auth.c
@@ -286,7 +286,7 @@ SETDEFAULTS_FUNC(mod_auth_set_defaults) {
 		data_config const* config = (data_config const*)srv->config_context->data[i];
 		plugin_config *s;
 		size_t n;
-		data_array *da;
+		const data_array *da;
 
 		s = calloc(1, sizeof(plugin_config));
 		s->auth_backend_conf = buffer_init();
@@ -313,7 +313,7 @@ SETDEFAULTS_FUNC(mod_auth_set_defaults) {
 		}
 
 		/* no auth.require for this section */
-		if (NULL == (da = (data_array *)array_get_element(config->value, "auth.require"))) continue;
+		if (NULL == (da = (const data_array *)array_get_element_klen(config->value, CONST_STR_LEN("auth.require")))) continue;
 
 		if (da->type != TYPE_ARRAY || !array_is_kvarray(da->value)) {
 			log_error_write(srv, __FILE__, __LINE__, "ss",
diff --git a/src/mod_authn_pam.c b/src/mod_authn_pam.c
index eddba69b..621712ed 100644
--- a/src/mod_authn_pam.c
+++ b/src/mod_authn_pam.c
@@ -75,7 +75,7 @@ SETDEFAULTS_FUNC(mod_authn_pam_set_defaults) {
 
     for (size_t i = 0; i < srv->config_context->used; ++i) {
         data_config const *config = (data_config const*)srv->config_context->data[i];
-        data_string *ds;
+        const data_string *ds;
         plugin_config *s = calloc(1, sizeof(plugin_config));
         s->opts = array_init();
 
@@ -89,7 +89,7 @@ SETDEFAULTS_FUNC(mod_authn_pam_set_defaults) {
 
         if (0 == s->opts->used) continue;
 
-        ds = (data_string *)
+        ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("service"));
         s->service = (NULL != ds) ? ds->value->ptr : "http";
     }
diff --git a/src/mod_authn_sasl.c b/src/mod_authn_sasl.c
index 7ea00b8e..344cf561 100644
--- a/src/mod_authn_sasl.c
+++ b/src/mod_authn_sasl.c
@@ -86,7 +86,7 @@ SETDEFAULTS_FUNC(mod_authn_sasl_set_defaults) {
 
     for (i = 0; i < srv->config_context->used; i++) {
         data_config const *config = (data_config const*)srv->config_context->data[i];
-        data_string *ds;
+        const data_string *ds;
         plugin_config *s = calloc(1, sizeof(plugin_config));
         s->opts = array_init();
 
@@ -100,11 +100,11 @@ SETDEFAULTS_FUNC(mod_authn_sasl_set_defaults) {
 
         if (0 == s->opts->used) continue;
 
-        ds = (data_string *)
+        ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("service"));
         s->service = (NULL != ds) ? ds->value->ptr : "http";
 
-        ds = (data_string *)
+        ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("fqdn"));
         if (NULL != ds) s->fqdn = ds->value->ptr;
         if (NULL == s->fqdn) {
@@ -120,7 +120,7 @@ SETDEFAULTS_FUNC(mod_authn_sasl_set_defaults) {
             s->fqdn = p->fqdn->ptr;
         }
 
-        ds = (data_string *)
+        ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("pwcheck_method"));
         if (NULL != ds) {
             s->pwcheck_method = ds->value;
@@ -139,7 +139,7 @@ SETDEFAULTS_FUNC(mod_authn_sasl_set_defaults) {
             }
         }
 
-        ds = (data_string *)
+        ds = (const data_string *)
           array_get_element_klen(s->opts, CONST_STR_LEN("sasldb_path"));
         if (NULL != ds) s->sasldb_path = ds->value;
     }
diff --git a/src/mod_dirlisting.c b/src/mod_dirlisting.c
index f0991dd8..d661c14d 100644
--- a/src/mod_dirlisting.c
+++ b/src/mod_dirlisting.c
@@ -235,7 +235,7 @@ SETDEFAULTS_FUNC(mod_dirlisting_set_defaults) {
 	for (i = 0; i < srv->config_context->used; i++) {
 		data_config const* config = (data_config const*)srv->config_context->data[i];
 		plugin_config *s;
-		data_unset *du_excludes;
+		const data_unset *du_excludes;
 
 		s = calloc(1, sizeof(plugin_config));
 		s->excludes = excludes_buffer_init();
@@ -276,10 +276,10 @@ SETDEFAULTS_FUNC(mod_dirlisting_set_defaults) {
 			return HANDLER_ERROR;
 		}
 
-		if (NULL != (du_excludes = array_get_element(config->value, CONFIG_EXCLUDE))) {
+		if (NULL != (du_excludes = array_get_element_klen(config->value, CONST_STR_LEN(CONFIG_EXCLUDE)))) {
 			array *excludes_list;
 
-			excludes_list = ((data_array*)du_excludes)->value;
+			excludes_list = ((const data_array*)du_excludes)->value;
 
 			if (du_excludes->type != TYPE_ARRAY || !array_is_vlist(excludes_list)) {
 				log_error_write(srv, __FILE__, __LINE__, "s",
diff --git a/src/mod_evhost.c b/src/mod_evhost.c
index f981a1d0..1f5c1f4d 100644
--- a/src/mod_evhost.c
+++ b/src/mod_evhost.c
@@ -293,7 +293,7 @@ static void mod_evhost_build_doc_root_path(buffer *b, array *parsed_host, buffer
 	for (size_t i = 0; i < npieces; ++i) {
 		const char *ptr = path_pieces[i]->ptr;
 		if (*ptr == '%') {
-			data_string *ds;
+			const data_string *ds;
 
 			if (*(ptr+1) == '%') {
 				/* %% */
diff --git a/src/mod_expire.c b/src/mod_expire.c
index 46ac43d2..2a2b7024 100644
--- a/src/mod_expire.c
+++ b/src/mod_expire.c
@@ -79,7 +79,7 @@ FREE_FUNC(mod_expire_free) {
 	return HANDLER_GO_ON;
 }
 
-static int mod_expire_get_offset(server *srv, plugin_data *p, buffer *expire, time_t *offset) {
+static int mod_expire_get_offset(server *srv, plugin_data *p, const buffer *expire, time_t *offset) {
 	char *ts;
 	int type = -1;
 	time_t retts = 0;
@@ -326,8 +326,8 @@ static int mod_expire_patch_connection(server *srv, connection *con, plugin_data
 
 CONNECTION_FUNC(mod_expire_handler) {
 	plugin_data *p = p_d;
-	buffer *vb;
-	data_string *ds;
+	const buffer *vb;
+	const data_string *ds;
 
 	/* Add caching headers only to http_status 200 OK or 206 Partial Content */
 	if (con->http_status != 200 && con->http_status != 206) return HANDLER_GO_ON;
@@ -343,7 +343,7 @@ CONNECTION_FUNC(mod_expire_handler) {
 	mod_expire_patch_connection(srv, con, p);
 
 	/* check expire.url */
-	ds = (data_string *)array_match_key_prefix(p->conf.expire_url, con->uri.path);
+	ds = (const data_string *)array_match_key_prefix(p->conf.expire_url, con->uri.path);
 	if (NULL != ds) {
 		vb = ds->value;
 	}
@@ -351,8 +351,8 @@ CONNECTION_FUNC(mod_expire_handler) {
 		/* check expire.mimetypes (if no match with expire.url) */
 		vb = http_header_response_get(con, HTTP_HEADER_CONTENT_TYPE, CONST_STR_LEN("Content-Type"));
 		ds = (NULL != vb)
-		   ? (data_string *)array_match_key_prefix(p->conf.expire_mimetypes, vb)
-		   : (data_string *)array_get_element_klen(p->conf.expire_mimetypes, CONST_STR_LEN(""));
+		   ? (const data_string *)array_match_key_prefix(p->conf.expire_mimetypes, vb)
+		   : (const data_string *)array_get_element_klen(p->conf.expire_mimetypes, CONST_STR_LEN(""));
 		if (NULL == ds) return HANDLER_GO_ON;
 		vb = ds->value;
 	}
diff --git a/src/mod_extforward.c b/src/mod_extforward.c
index f9d2a669..f92d5fcf 100644
--- a/src/mod_extforward.c
+++ b/src/mod_extforward.c
@@ -226,8 +226,8 @@ SETDEFAULTS_FUNC(mod_extforward_set_defaults) {
 			return HANDLER_ERROR;
 		}
 
-		if (array_get_element(config->value, "extforward.forwarder")) {
-			const data_string * const allds = (data_string *)array_get_element(s->forwarder, "all");
+		if (array_get_element_klen(config->value, CONST_STR_LEN("extforward.forwarder"))) {
+			const data_string * const allds = (const data_string *)array_get_element_klen(s->forwarder, CONST_STR_LEN("all"));
 			s->forward_all = (NULL == allds) ? 0 : buffer_eq_icase_slen(allds->value, CONST_STR_LEN("trust")) ? 1 : -1;
 			for (size_t j = 0; j < s->forwarder->used; ++j) {
 				data_string * const ds = (data_string *)s->forwarder->data[j];
@@ -278,7 +278,7 @@ SETDEFAULTS_FUNC(mod_extforward_set_defaults) {
 		}
 
 		/* default to "X-Forwarded-For" or "Forwarded-For" if extforward.headers not specified or empty */
-		if (!s->hap_PROXY && 0 == s->headers->used && (0 == i || NULL != array_get_element(config->value, "extforward.headers"))) {
+		if (!s->hap_PROXY && 0 == s->headers->used && (0 == i || NULL != array_get_element_klen(config->value, CONST_STR_LEN("extforward.headers")))) {
 			array_insert_value(s->headers, CONST_STR_LEN("X-Forwarded-For"));
 			array_insert_value(s->headers, CONST_STR_LEN("Forwarded-For"));
 		}
@@ -458,8 +458,8 @@ static array *extract_forward_array(buffer *pbuffer)
  */
 static int is_proxy_trusted(plugin_data *p, const char * const ip, size_t iplen)
 {
-    data_string *ds =
-      (data_string *)array_get_element_klen(p->conf.forwarder, ip, iplen);
+    const data_string *ds =
+      (const data_string *)array_get_element_klen(p->conf.forwarder, ip, iplen);
     if (NULL != ds) return !buffer_string_is_empty(ds->value);
 
     if (p->conf.forward_masks) {
@@ -1017,9 +1017,9 @@ URIHANDLER_FUNC(mod_extforward_uri_handler) {
 	}
 
 	if (p->conf.hap_PROXY_ssl_client_verify) {
-		data_string *ds;
+		const data_string *ds;
 		if (NULL != hctx && hctx->ssl_client_verify && NULL != hctx->env
-		    && NULL != (ds = (data_string *)array_get_element(hctx->env, "SSL_CLIENT_S_DN_CN"))) {
+		    && NULL != (ds = (const data_string *)array_get_element_klen(hctx->env, CONST_STR_LEN("SSL_CLIENT_S_DN_CN")))) {
 			http_header_env_set(con,
 					    CONST_STR_LEN("SSL_CLIENT_VERIFY"),
 					    CONST_STR_LEN("SUCCESS"));
diff --git a/src/mod_fastcgi.c b/src/mod_fastcgi.c
index 6fb01ddc..50a8e3cc 100644
--- a/src/mod_fastcgi.c
+++ b/src/mod_fastcgi.c
@@ -39,7 +39,7 @@ typedef gw_handler_ctx   handler_ctx;
 
 SETDEFAULTS_FUNC(mod_fastcgi_set_defaults) {
 	plugin_data *p = p_d;
-	data_unset *du;
+	const data_unset *du;
 	size_t i = 0;
 
 	config_values_t cv[] = {
@@ -76,12 +76,12 @@ SETDEFAULTS_FUNC(mod_fastcgi_set_defaults) {
 			return HANDLER_ERROR;
 		}
 
-		du = array_get_element(config->value, "fastcgi.server");
+		du = array_get_element_klen(config->value, CONST_STR_LEN("fastcgi.server"));
 		if (!gw_set_defaults_backend(srv, p, du, i, 0)) {
 			return HANDLER_ERROR;
 		}
 
-		du = array_get_element(config->value, "fastcgi.balance");
+		du = array_get_element_klen(config->value, CONST_STR_LEN("fastcgi.balance"));
 		if (!gw_set_defaults_balance(srv, s, du)) {
 			return HANDLER_ERROR;
 		}
diff --git a/src/mod_magnet.c b/src/mod_magnet.c
index 70d380e0..dfdae040 100644
--- a/src/mod_magnet.c
+++ b/src/mod_magnet.c
@@ -234,7 +234,8 @@ static int magnet_array_get_element(lua_State *L, const array *a) {
     /* __index: param 1 is the (empty) table the value was not found in */
     size_t klen;
     const char * const k = luaL_checklstring(L, 2, &klen);
-    data_string * const ds = (data_string *)array_get_element_klen(a, k, klen);
+    const data_string * const ds = (const data_string *)
+      array_get_element_klen(a, k, klen);
     magnet_push_buffer(L, NULL != ds ? ds->value : NULL);
     return 1;
 }
diff --git a/src/mod_openssl.c b/src/mod_openssl.c
index 27015f9a..6feb9697 100644
--- a/src/mod_openssl.c
+++ b/src/mod_openssl.c
@@ -724,7 +724,7 @@ network_openssl_ssl_conf_cmd (server *srv, plugin_config *s)
   #ifdef SSL_CONF_FLAG_CMDLINE
 
     int rc = 0;
-    data_string *ds;
+    const data_string *ds;
     SSL_CONF_CTX * const cctx = SSL_CONF_CTX_new();
     SSL_CONF_CTX_set_ssl_ctx(cctx, s->ssl_ctx);
     SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_FILE
@@ -733,7 +733,7 @@ network_openssl_ssl_conf_cmd (server *srv, plugin_config *s)
                                | SSL_CONF_FLAG_CERTIFICATE);
 
     /* always disable null and export ciphers */
-    ds = (data_string *)
+    ds = (const data_string *)
       array_get_element_klen(s->ssl_conf_cmd,
                              CONST_STR_LEN("CipherString"));
     if (NULL != ds) {
diff --git a/src/mod_proxy.c b/src/mod_proxy.c
index 3336fab1..0b54a79d 100644
--- a/src/mod_proxy.c
+++ b/src/mod_proxy.c
@@ -108,7 +108,7 @@ FREE_FUNC(mod_proxy_free) {
 
 SETDEFAULTS_FUNC(mod_proxy_set_defaults) {
 	plugin_data *p = p_d;
-	data_unset *du;
+	const data_unset *du;
 	size_t i = 0;
 
 	config_values_t cv[] = {
@@ -150,12 +150,12 @@ SETDEFAULTS_FUNC(mod_proxy_set_defaults) {
 			return HANDLER_ERROR;
 		}
 
-		du = array_get_element(config->value, "proxy.server");
+		du = array_get_element_klen(config->value, CONST_STR_LEN("proxy.server"));
 		if (!gw_set_defaults_backend(srv, (gw_plugin_data *)p, du, i, 0)) {
 			return HANDLER_ERROR;
 		}
 
-		du = array_get_element(config->value, "proxy.balance");
+		du = array_get_element_klen(config->value, CONST_STR_LEN("proxy.balance"));
 		if (!gw_set_defaults_balance(srv, &s->gw, du)) {
 			return HANDLER_ERROR;
 		}
diff --git a/src/mod_redirect.c b/src/mod_redirect.c
index 55b431df..990c4b4b 100644
--- a/src/mod_redirect.c
+++ b/src/mod_redirect.c
@@ -66,8 +66,8 @@ SETDEFAULTS_FUNC(mod_redirect_set_defaults) {
 		data_config const* config = (data_config const*)srv->config_context->data[i];
 		plugin_config *s;
 		size_t j;
-		data_unset *du;
-		data_array *da;
+		const data_unset *du;
+		const data_array *da;
 
 		s = calloc(1, sizeof(plugin_config));
 		s->redirect   = pcre_keyvalue_buffer_init();
@@ -84,12 +84,12 @@ SETDEFAULTS_FUNC(mod_redirect_set_defaults) {
 
 		if (s->redirect_code < 100 || s->redirect_code >= 1000) s->redirect_code = 301;
 
-		if (NULL == (du = array_get_element(config->value, "url.redirect"))) {
+		if (NULL == (du = array_get_element_klen(config->value, CONST_STR_LEN("url.redirect")))) {
 			/* no url.redirect defined */
 			continue;
 		}
 
-		da = (data_array *)du;
+		da = (const data_array *)du;
 
 		if (du->type != TYPE_ARRAY || !array_is_kvstring(da->value)) {
 			log_error_write(srv, __FILE__, __LINE__, "s",
diff --git a/src/mod_rewrite.c b/src/mod_rewrite.c
index 6a352f41..3d7d35ad 100644
--- a/src/mod_rewrite.c
+++ b/src/mod_rewrite.c
@@ -70,15 +70,13 @@ FREE_FUNC(mod_rewrite_free) {
 }
 
 static int parse_config_entry(server *srv, array *ca, pcre_keyvalue_buffer *kvb, const char *option, size_t olen) {
-	data_unset *du;
+	const data_array * const da = (const data_array *)
+	  array_get_element_klen(ca, option, olen);
 
-	if (NULL != (du = array_get_element_klen(ca, option, olen))) {
-		data_array *da;
+	if (NULL != da) {
 		size_t j;
 
-		da = (data_array *)du;
-
-		if (du->type != TYPE_ARRAY || !array_is_kvstring(da->value)) {
+		if (da->type != TYPE_ARRAY || !array_is_kvstring(da->value)) {
 			log_error_write(srv, __FILE__, __LINE__, "SSS",
 					"unexpected value for ", option, "; expected list of \"regex\" => \"subst\"");
 			return HANDLER_ERROR;
diff --git a/src/mod_scgi.c b/src/mod_scgi.c
index 6784a9d4..ad002546 100644
--- a/src/mod_scgi.c
+++ b/src/mod_scgi.c
@@ -22,7 +22,7 @@ enum { LI_PROTOCOL_SCGI, LI_PROTOCOL_UWSGI };
 
 SETDEFAULTS_FUNC(mod_scgi_set_defaults) {
 	plugin_data *p = p_d;
-	data_unset *du;
+	const data_unset *du;
 	size_t i = 0;
 
 	config_values_t cv[] = {
@@ -62,18 +62,18 @@ SETDEFAULTS_FUNC(mod_scgi_set_defaults) {
 			return HANDLER_ERROR;
 		}
 
-		du = array_get_element(config->value, "scgi.server");
+		du = array_get_element_klen(config->value, CONST_STR_LEN("scgi.server"));
 		if (!gw_set_defaults_backend(srv, p, du, i, 1)) {
 			return HANDLER_ERROR;
 		}
 
-		du = array_get_element(config->value, "scgi.balance");
+		du = array_get_element_klen(config->value, CONST_STR_LEN("scgi.balance"));
 		if (!gw_set_defaults_balance(srv, s, du)) {
 			return HANDLER_ERROR;
 		}
 
-		if (NULL != (du = array_get_element(config->value, "scgi.protocol"))) {
-			data_string *ds = (data_string *)du;
+		if (NULL != (du = array_get_element_klen(config->value, CONST_STR_LEN("scgi.protocol")))) {
+			const data_string *ds = (const data_string *)du;
 			if (du->type == TYPE_STRING
 			    && buffer_is_equal_string(ds->value, CONST_STR_LEN("scgi"))) {
 				s->proto = LI_PROTOCOL_SCGI;
diff --git a/src/mod_sockproxy.c b/src/mod_sockproxy.c
index 2203becc..4381491a 100644
--- a/src/mod_sockproxy.c
+++ b/src/mod_sockproxy.c
@@ -22,7 +22,7 @@ typedef gw_handler_ctx   handler_ctx;
 
 SETDEFAULTS_FUNC(mod_sockproxy_set_defaults) {
 	plugin_data *p = p_d;
-	data_unset *du;
+	const data_unset *du;
 	size_t i = 0;
 
 	config_values_t cv[] = {
@@ -56,12 +56,12 @@ SETDEFAULTS_FUNC(mod_sockproxy_set_defaults) {
 			return HANDLER_ERROR;
 		}
 
-		du = array_get_element(config->value, "sockproxy.server");
+		du = array_get_element_klen(config->value, CONST_STR_LEN("sockproxy.server"));
 		if (!gw_set_defaults_backend(srv, (gw_plugin_data *)p, du, i, 0)) {
 			return HANDLER_ERROR;
 		}
 
-		du = array_get_element(config->value, "sockproxy.balance");
+		du = array_get_element_klen(config->value, CONST_STR_LEN("sockproxy.balance"));
 		if (!gw_set_defaults_balance(srv, s, du)) {
 			return HANDLER_ERROR;
 		}
diff --git a/src/mod_ssi.c b/src/mod_ssi.c
index 5d67ee21..e63e56bf 100644
--- a/src/mod_ssi.c
+++ b/src/mod_ssi.c
@@ -450,11 +450,11 @@ static int process_ssi_stmt(server *srv, connection *con, handler_ctx *p, const
 			break;
 		}
 		default: {
-			data_string *ds;
+			const data_string *ds;
 			/* check if it is a cgi-var or a ssi-var */
 
-			if (NULL != (ds = (data_string *)array_get_element_klen(p->ssi_cgi_env, var_val, strlen(var_val))) ||
-			    NULL != (ds = (data_string *)array_get_element_klen(p->ssi_vars, var_val, strlen(var_val)))) {
+			if (NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_cgi_env, var_val, strlen(var_val))) ||
+			    NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_vars, var_val, strlen(var_val)))) {
 				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(ds->value));
 			} else {
 				chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(none)"));
diff --git a/src/mod_ssi_expr.c b/src/mod_ssi_expr.c
index 04e38898..6dd51577 100644
--- a/src/mod_ssi_expr.c
+++ b/src/mod_ssi_expr.c
@@ -53,7 +53,7 @@ static int ssi_expr_tokenizer(server *srv, connection *con, handler_ctx *p,
 
 	for (tid = 0; tid == 0 && t->offset < t->size && t->input[t->offset] ; ) {
 		char c = t->input[t->offset];
-		data_string *ds;
+		const data_string *ds;
 
 		switch (c) {
 		case '=':
@@ -219,9 +219,9 @@ static int ssi_expr_tokenizer(server *srv, connection *con, handler_ctx *p,
 
 			tid = TK_VALUE;
 
-			if (NULL != (ds = (data_string *)array_get_element_klen(p->ssi_cgi_env, CONST_BUF_LEN(token)))) {
+			if (NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_cgi_env, CONST_BUF_LEN(token)))) {
 				buffer_copy_buffer(token, ds->value);
-			} else if (NULL != (ds = (data_string *)array_get_element_klen(p->ssi_vars, CONST_BUF_LEN(token)))) {
+			} else if (NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_vars, CONST_BUF_LEN(token)))) {
 				buffer_copy_buffer(token, ds->value);
 			} else {
 				buffer_copy_string_len(token, CONST_STR_LEN(""));
diff --git a/src/mod_webdav.c b/src/mod_webdav.c
index b0a1d2d2..9b219010 100644
--- a/src/mod_webdav.c
+++ b/src/mod_webdav.c
@@ -3554,7 +3554,7 @@ webdav_has_lock (connection * const con,
 
     /* XXX: maybe add config switch to require that authentication occurred? */
     buffer owner = { NULL, 0, 0 };/*owner (not authenticated)(auth_user unset)*/
-    data_string * const authn_user = (data_string *)
+    const data_string * const authn_user = (const data_string *)
       array_get_element_klen(con->environment,
                              CONST_STR_LEN("REMOTE_USER"));
     cbdata.authn_user = authn_user ? authn_user->value : &owner;
@@ -5155,7 +5155,7 @@ mod_webdav_lock (connection * const con, const plugin_config * const pconf)
 
     /* XXX: maybe add config switch to require that authentication occurred? */
     buffer owner = { NULL, 0, 0 };/*owner (not authenticated)(auth_user unset)*/
-    data_string * const authn_user = (data_string *)
+    const data_string * const authn_user = (const data_string *)
       array_get_element_klen(con->environment, CONST_STR_LEN("REMOTE_USER"));
 
     /* future: make max timeout configurable (e.g. pconf->lock_timeout_max)
@@ -5450,7 +5450,7 @@ mod_webdav_unlock (connection * const con, const plugin_config * const pconf)
     }
 
     buffer owner = { NULL, 0, 0 };/*owner (not authenticated)(auth_user unset)*/
-    data_string * const authn_user = (data_string *)
+    const data_string * const authn_user = (const data_string *)
       array_get_element_klen(con->environment, CONST_STR_LEN("REMOTE_USER"));
 
     webdav_lockdata lockdata = {
diff --git a/src/mod_wstunnel.c b/src/mod_wstunnel.c
index 00532b57..3cb4537b 100644
--- a/src/mod_wstunnel.c
+++ b/src/mod_wstunnel.c
@@ -202,7 +202,7 @@ FREE_FUNC(mod_wstunnel_free) {
 
 SETDEFAULTS_FUNC(mod_wstunnel_set_defaults) {
     plugin_data *p = p_d;
-    data_unset *du;
+    const data_unset *du;
     config_values_t cv[] = {
         { "wstunnel.server",        NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION },
         { "wstunnel.debug",         NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_CONNECTION },
@@ -241,12 +241,12 @@ SETDEFAULTS_FUNC(mod_wstunnel_set_defaults) {
             return HANDLER_ERROR;
         }
 
-        du = array_get_element(ca, "wstunnel.server");
+        du = array_get_element_klen(ca, CONST_STR_LEN("wstunnel.server"));
         if (!gw_set_defaults_backend(srv, (gw_plugin_data *)p, du, i, 0)) {
             return HANDLER_ERROR;
         }
 
-        du = array_get_element(ca, "wstunnel.balance");
+        du = array_get_element_klen(ca, CONST_STR_LEN("wstunnel.balance"));
         if (!gw_set_defaults_balance(srv, &s->gw, du)) {
             return HANDLER_ERROR;
         }
diff --git a/src/stat_cache.c b/src/stat_cache.c
index 9ea83ee7..6c0f5a13 100644
--- a/src/stat_cache.c
+++ b/src/stat_cache.c
@@ -660,24 +660,24 @@ const buffer * stat_cache_mimetype_by_ext(const connection *con, const char *nam
             s = name;
         }
         /* search for basename, then longest .ext2.ext1, then .ext1, then "" */
-        ds = (data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
+        ds = (const data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
         if (NULL != ds) return ds->value;
         while (++s < end) {
             while (*s != '.' && ++s != end) ;
             if (s == end) break;
             /* search ".ext" then "ext" */
-            ds = (data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
+            ds = (const data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
             if (NULL != ds) return ds->value;
             /* repeat search without leading '.' to handle situation where
              * admin configured mimetype.assign keys without leading '.' */
             if (++s < end) {
                 if (*s == '.') { --s; continue; }
-                ds = (data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
+                ds = (const data_string *)array_get_element_klen(con->conf.mimetypes, s, end - s);
                 if (NULL != ds) return ds->value;
             }
         }
         /* search for ""; catchall */
-        ds = (data_string *)array_get_element(con->conf.mimetypes, "");
+        ds = (const data_string *)array_get_element_klen(con->conf.mimetypes, CONST_STR_LEN(""));
         if (NULL != ds) return ds->value;
     }