19 files changed, 96 insertions, 92 deletions

diff --git a/src/lib/libcrypto/asn1/a_bitstr.c b/src/lib/libcrypto/asn1/a_bitstr.c
index 9ba77d6958..8a4a68dbb3 100644
--- a/src/lib/libcrypto/asn1/a_bitstr.c
+++ b/src/lib/libcrypto/asn1/a_bitstr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_bitstr.c,v 1.24 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: a_bitstr.c,v 1.25 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -222,7 +222,7 @@ ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value)
 }
 
 int
-ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n)
+ASN1_BIT_STRING_get_bit(const ASN1_BIT_STRING *a, int n)
 {
         int w, v;
 
@@ -240,7 +240,8 @@ ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n)
  * 'len' is the length of 'flags'.
  */
 int
-ASN1_BIT_STRING_check(ASN1_BIT_STRING *a, unsigned char *flags, int flags_len)
+ASN1_BIT_STRING_check(const ASN1_BIT_STRING *a, const unsigned char *flags,
+    int flags_len)
 {
         int i, ok;
 
diff --git a/src/lib/libcrypto/asn1/a_enum.c b/src/lib/libcrypto/asn1/a_enum.c
index 23875958bf..c7d3a9a0ac 100644
--- a/src/lib/libcrypto/asn1/a_enum.c
+++ b/src/lib/libcrypto/asn1/a_enum.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_enum.c,v 1.18 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: a_enum.c,v 1.19 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -104,7 +104,7 @@ ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v)
 }
 
 long
-ASN1_ENUMERATED_get(ASN1_ENUMERATED *a)
+ASN1_ENUMERATED_get(const ASN1_ENUMERATED *a)
 {
         int neg = 0, i;
         long r = 0;
@@ -134,7 +134,7 @@ ASN1_ENUMERATED_get(ASN1_ENUMERATED *a)
 }
 
 ASN1_ENUMERATED *
-BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
+BN_to_ASN1_ENUMERATED(const BIGNUM *bn, ASN1_ENUMERATED *ai)
 {
         ASN1_ENUMERATED *ret;
         int len, j;
@@ -177,7 +177,7 @@ err:
 }
 
 BIGNUM *
-ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai, BIGNUM *bn)
+ASN1_ENUMERATED_to_BN(const ASN1_ENUMERATED *ai, BIGNUM *bn)
 {
         BIGNUM *ret;
 
diff --git a/src/lib/libcrypto/asn1/a_object.c b/src/lib/libcrypto/asn1/a_object.c
index e10af97d36..16c3a1c0fd 100644
--- a/src/lib/libcrypto/asn1/a_object.c
+++ b/src/lib/libcrypto/asn1/a_object.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_object.c,v 1.30 2017/05/02 03:59:44 deraadt Exp $ */
+/* $OpenBSD: a_object.c,v 1.31 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -67,7 +67,7 @@
 #include <openssl/objects.h>
 
 int
-i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp)
+i2d_ASN1_OBJECT(const ASN1_OBJECT *a, unsigned char **pp)
 {
         unsigned char *p;
         int objsize;
@@ -213,13 +213,13 @@ err:
 }
 
 int
-i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
+i2t_ASN1_OBJECT(char *buf, int buf_len, const ASN1_OBJECT *a)
 {
         return OBJ_obj2txt(buf, buf_len, a, 0);
 }
 
 int
-i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT *a)
+i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *a)
 {
         char *tmp = NULL;
         size_t tlen = 256;
diff --git a/src/lib/libcrypto/asn1/a_strex.c b/src/lib/libcrypto/asn1/a_strex.c
index f60a70d94d..c0f0d7634d 100644
--- a/src/lib/libcrypto/asn1/a_strex.c
+++ b/src/lib/libcrypto/asn1/a_strex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_strex.c,v 1.25 2015/02/07 13:19:15 doug Exp $ */
+/* $OpenBSD: a_strex.c,v 1.26 2018/04/25 11:48:21 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -289,7 +289,7 @@ do_hex_dump(char_io *io_ch, void *arg, unsigned char *buf, int buflen)
  */
 
 static int
-do_dump(unsigned long lflags, char_io *io_ch, void *arg, ASN1_STRING *str)
+do_dump(unsigned long lflags, char_io *io_ch, void *arg, const ASN1_STRING *str)
 {
         /* Placing the ASN1_STRING in a temp ASN1_TYPE allows
          * the DER encoding to readily obtained
@@ -346,7 +346,8 @@ static const signed char tag2nbyte[] = {
  */
 
 static int
-do_print_ex(char_io *io_ch, void *arg, unsigned long lflags, ASN1_STRING *str)
+do_print_ex(char_io *io_ch, void *arg, unsigned long lflags,
+    const ASN1_STRING *str)
 {
         int outlen, len;
         int type;
@@ -605,13 +606,13 @@ X509_NAME_print_ex_fp(FILE *fp, X509_NAME *nm, int indent, unsigned long flags)
 }
 
 int
-ASN1_STRING_print_ex(BIO *out, ASN1_STRING *str, unsigned long flags)
+ASN1_STRING_print_ex(BIO *out, const ASN1_STRING *str, unsigned long flags)
 {
         return do_print_ex(send_bio_chars, out, flags, str);
 }
 
 int
-ASN1_STRING_print_ex_fp(FILE *fp, ASN1_STRING *str, unsigned long flags)
+ASN1_STRING_print_ex_fp(FILE *fp, const ASN1_STRING *str, unsigned long flags)
 {
         return do_print_ex(send_fp_chars, fp, flags, str);
 }
diff --git a/src/lib/libcrypto/asn1/a_time_tm.c b/src/lib/libcrypto/asn1/a_time_tm.c
index b13f7c767f..b6e22cbd27 100644
--- a/src/lib/libcrypto/asn1/a_time_tm.c
+++ b/src/lib/libcrypto/asn1/a_time_tm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_time_tm.c,v 1.14 2017/08/28 17:42:47 jsing Exp $ */
+/* $OpenBSD: a_time_tm.c,v 1.15 2018/04/25 11:48:21 tb Exp $ */
 /*
  * Copyright (c) 2015 Bob Beck <beck@openbsd.org>
  *
@@ -337,7 +337,7 @@ ASN1_TIME_adj(ASN1_TIME *s, time_t t, int offset_day, long offset_sec)
 }
 
 int
-ASN1_TIME_check(ASN1_TIME *t)
+ASN1_TIME_check(const ASN1_TIME *t)
 {
         if (t->type != V_ASN1_GENERALIZEDTIME && t->type != V_ASN1_UTCTIME)
                 return (0);
@@ -345,7 +345,7 @@ ASN1_TIME_check(ASN1_TIME *t)
 }
 
 ASN1_GENERALIZEDTIME *
-ASN1_TIME_to_generalizedtime(ASN1_TIME *t, ASN1_GENERALIZEDTIME **out)
+ASN1_TIME_to_generalizedtime(const ASN1_TIME *t, ASN1_GENERALIZEDTIME **out)
 {
         ASN1_GENERALIZEDTIME *tmp = NULL;
         struct tm tm;
@@ -386,7 +386,7 @@ ASN1_TIME_set_string(ASN1_TIME *s, const char *str)
  */
 
 int
-ASN1_UTCTIME_check(ASN1_UTCTIME *d)
+ASN1_UTCTIME_check(const ASN1_UTCTIME *d)
 {
         if (d->type != V_ASN1_UTCTIME)
                 return (0);
@@ -442,7 +442,7 @@ ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t2)
  */
 
 int
-ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *d)
+ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *d)
 {
         if (d->type != V_ASN1_GENERALIZEDTIME)
                 return (0);
diff --git a/src/lib/libcrypto/asn1/a_type.c b/src/lib/libcrypto/asn1/a_type.c
index ed1dec0671..11d38300d6 100644
--- a/src/lib/libcrypto/asn1/a_type.c
+++ b/src/lib/libcrypto/asn1/a_type.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_type.c,v 1.19 2016/05/04 15:00:24 tedu Exp $ */
+/* $OpenBSD: a_type.c,v 1.20 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -62,7 +62,7 @@
 #include <openssl/objects.h>
 
 int
-ASN1_TYPE_get(ASN1_TYPE *a)
+ASN1_TYPE_get(const ASN1_TYPE *a)
 {
         if ((a->value.ptr != NULL) || (a->type == V_ASN1_NULL))
                 return (a->type);
@@ -108,7 +108,7 @@ ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value)
 
 /* Returns 0 if they are equal, != 0 otherwise. */
 int
-ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b)
+ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b)
 {
         int result = -1;
 
diff --git a/src/lib/libcrypto/asn1/asn1.h b/src/lib/libcrypto/asn1/asn1.h
index 3a2da6463e..a20471a7ec 100644
--- a/src/lib/libcrypto/asn1/asn1.h
+++ b/src/lib/libcrypto/asn1/asn1.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1.h,v 1.45 2018/03/29 02:29:24 inoguchi Exp $ */
+/* $OpenBSD: asn1.h,v 1.46 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -754,14 +754,14 @@ ASN1_TYPE *d2i_ASN1_TYPE(ASN1_TYPE **a, const unsigned char **in, long len);
 int i2d_ASN1_TYPE(ASN1_TYPE *a, unsigned char **out);
 extern const ASN1_ITEM ASN1_ANY_it;
 
-int ASN1_TYPE_get(ASN1_TYPE *a);
+int ASN1_TYPE_get(const ASN1_TYPE *a);
 void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
 int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value);
-int ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b);
+int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b);
 
 ASN1_OBJECT *ASN1_OBJECT_new(void );
 void ASN1_OBJECT_free(ASN1_OBJECT *a);
-int i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp);
+int i2d_ASN1_OBJECT(const ASN1_OBJECT *a, unsigned char **pp);
 ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
     long length);
 ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
@@ -783,7 +783,7 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
 void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len);
 int ASN1_STRING_length(const ASN1_STRING *x);
 void ASN1_STRING_length_set(ASN1_STRING *x, int n);
-int ASN1_STRING_type(ASN1_STRING *x);
+int ASN1_STRING_type(const ASN1_STRING *x);
 unsigned char *ASN1_STRING_data(ASN1_STRING *x);
 const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x);
 
@@ -797,16 +797,16 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
     const unsigned char **pp, long length);
 int ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d, int length );
 int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value);
-int ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n);
-int ASN1_BIT_STRING_check(ASN1_BIT_STRING *a,
-    unsigned char *flags, int flags_len);
+int ASN1_BIT_STRING_get_bit(const ASN1_BIT_STRING *a, int n);
+int ASN1_BIT_STRING_check(const ASN1_BIT_STRING *a,
+    const unsigned char *flags, int flags_len);
 
 #ifndef OPENSSL_NO_BIO
 int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
     BIT_STRING_BITNAME *tbl, int indent);
 #endif
-int ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl);
-int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
+int ASN1_BIT_STRING_num_asc(const char *name, BIT_STRING_BITNAME *tbl);
+int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, const char *name, int value,
     BIT_STRING_BITNAME *tbl);
 
 int i2d_ASN1_BOOLEAN(int a, unsigned char **pp);
@@ -831,7 +831,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, const unsigned char **
 int i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a, unsigned char **out);
 extern const ASN1_ITEM ASN1_ENUMERATED_it;
 
-int ASN1_UTCTIME_check(ASN1_UTCTIME *a);
+int ASN1_UTCTIME_check(const ASN1_UTCTIME *a);
 ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t);
 ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t,
     int offset_day, long offset_sec);
@@ -841,7 +841,7 @@ int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str);
 int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t);
 #endif /* !LIBRESSL_INTERNAL */
 
-int ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *a);
+int ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *a);
 ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
     time_t t);
 ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,
@@ -943,8 +943,8 @@ ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t);
 ASN1_TIME *ASN1_TIME_set_tm(ASN1_TIME *s, struct tm *tm);
 ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t, int offset_day,
     long offset_sec);
-int ASN1_TIME_check(ASN1_TIME *t);
-ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,
+int ASN1_TIME_check(const ASN1_TIME *t);
+ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
     ASN1_GENERALIZEDTIME **out);
 int ASN1_TIME_set_string(ASN1_TIME *s, const char *str);
 
@@ -955,15 +955,15 @@ STACK_OF(OPENSSL_BLOCK) *d2i_ASN1_SET(STACK_OF(OPENSSL_BLOCK) **a,
     void (*free_func)(OPENSSL_BLOCK), int ex_tag, int ex_class);
 
 #ifndef OPENSSL_NO_BIO
-int i2a_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *a);
+int i2a_ASN1_INTEGER(BIO *bp, const ASN1_INTEGER *a);
 int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size);
-int i2a_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *a);
+int i2a_ASN1_ENUMERATED(BIO *bp, const ASN1_ENUMERATED *a);
 int a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size);
-int i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT *a);
+int i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *a);
 int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size);
-int i2a_ASN1_STRING(BIO *bp, ASN1_STRING *a, int type);
+int i2a_ASN1_STRING(BIO *bp, const ASN1_STRING *a, int type);
 #endif
-int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a);
+int i2t_ASN1_OBJECT(char *buf, int buf_len, const ASN1_OBJECT *a);
 
 int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num);
 ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data, int len,
@@ -975,9 +975,9 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(const BIGNUM *bn, ASN1_INTEGER *ai);
 BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn);
 
 int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v);
-long ASN1_ENUMERATED_get(ASN1_ENUMERATED *a);
-ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai);
-BIGNUM *ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai, BIGNUM *bn);
+long ASN1_ENUMERATED_get(const ASN1_ENUMERATED *a);
+ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(const BIGNUM *bn, ASN1_ENUMERATED *ai);
+BIGNUM *ASN1_ENUMERATED_to_BN(const ASN1_ENUMERATED *ai, BIGNUM *bn);
 
 /* General */
 /* given a string, return the correct type, max is the maximum length */
@@ -1052,7 +1052,8 @@ int ASN1_i2d_fp(i2d_of_void *i2d, FILE *out, void *x);
                  CHECKED_PTR_OF(const type, x)))
 
 int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x);
-int ASN1_STRING_print_ex_fp(FILE *fp, ASN1_STRING *str, unsigned long flags);
+int ASN1_STRING_print_ex_fp(FILE *fp, const ASN1_STRING *str,
+    unsigned long flags);
 
 int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in);
 
@@ -1083,7 +1084,7 @@ int ASN1_UTCTIME_print(BIO *fp, const ASN1_UTCTIME *a);
 int ASN1_GENERALIZEDTIME_print(BIO *fp, const ASN1_GENERALIZEDTIME *a);
 int ASN1_TIME_print(BIO *fp, const ASN1_TIME *a);
 int ASN1_STRING_print(BIO *bp, const ASN1_STRING *v);
-int ASN1_STRING_print_ex(BIO *out, ASN1_STRING *str, unsigned long flags);
+int ASN1_STRING_print_ex(BIO *out, const ASN1_STRING *str, unsigned long flags);
 int ASN1_bn_print(BIO *bp, const char *number, const BIGNUM *num,
     unsigned char *buf, int off);
 int ASN1_parse(BIO *bp, const unsigned char *pp, long len, int indent);
@@ -1102,18 +1103,19 @@ extern const ASN1_ITEM NETSCAPE_X509_it;
 int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s);
 
 int ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len);
-int ASN1_TYPE_get_octetstring(ASN1_TYPE *a, unsigned char *data, int max_len);
+int ASN1_TYPE_get_octetstring(const ASN1_TYPE *a, unsigned char *data,
+    int max_len);
 int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, unsigned char *data,
     int len);
-int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
-    int max_len);
+int ASN1_TYPE_get_int_octetstring(const ASN1_TYPE *a, long *num,
+    unsigned char *data, int max_len);
 
 STACK_OF(OPENSSL_BLOCK) *ASN1_seq_unpack(const unsigned char *buf, int len,
     d2i_of_void *d2i, void (*free_func)(OPENSSL_BLOCK));
 unsigned char *ASN1_seq_pack(STACK_OF(OPENSSL_BLOCK) *safes, i2d_of_void *i2d,
     unsigned char **buf, int *len );
 void *ASN1_unpack_string(ASN1_STRING *oct, d2i_of_void *d2i);
-void *ASN1_item_unpack(ASN1_STRING *oct, const ASN1_ITEM *it);
+void *ASN1_item_unpack(const ASN1_STRING *oct, const ASN1_ITEM *it);
 ASN1_STRING *ASN1_pack_string(void *obj, i2d_of_void *i2d,
     ASN1_OCTET_STRING **oct);
 
@@ -1139,15 +1141,15 @@ void ASN1_STRING_TABLE_cleanup(void);
 /* Old API compatible functions */
 ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it);
 void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it);
-ASN1_VALUE * ASN1_item_d2i(ASN1_VALUE **val, const unsigned char **in,
+ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **val, const unsigned char **in,
     long len, const ASN1_ITEM *it);
 int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
 int ASN1_item_ndef_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
 
 void ASN1_add_oid_module(void);
 
-ASN1_TYPE *ASN1_generate_nconf(char *str, CONF *nconf);
-ASN1_TYPE *ASN1_generate_v3(char *str, X509V3_CTX *cnf);
+ASN1_TYPE *ASN1_generate_nconf(const char *str, CONF *nconf);
+ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf);
 
 /* ASN1 Print flags */
 
@@ -1174,15 +1176,15 @@ int ASN1_item_print(BIO *out, ASN1_VALUE *ifld, int indent,
     const ASN1_ITEM *it, const ASN1_PCTX *pctx);
 ASN1_PCTX *ASN1_PCTX_new(void);
 void ASN1_PCTX_free(ASN1_PCTX *p);
-unsigned long ASN1_PCTX_get_flags(ASN1_PCTX *p);
+unsigned long ASN1_PCTX_get_flags(const ASN1_PCTX *p);
 void ASN1_PCTX_set_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_nm_flags(ASN1_PCTX *p);
+unsigned long ASN1_PCTX_get_nm_flags(const ASN1_PCTX *p);
 void ASN1_PCTX_set_nm_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_cert_flags(ASN1_PCTX *p);
+unsigned long ASN1_PCTX_get_cert_flags(const ASN1_PCTX *p);
 void ASN1_PCTX_set_cert_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_oid_flags(ASN1_PCTX *p);
+unsigned long ASN1_PCTX_get_oid_flags(const ASN1_PCTX *p);
 void ASN1_PCTX_set_oid_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_str_flags(ASN1_PCTX *p);
+unsigned long ASN1_PCTX_get_str_flags(const ASN1_PCTX *p);
 void ASN1_PCTX_set_str_flags(ASN1_PCTX *p, unsigned long flags);
 
 BIO_METHOD *BIO_f_asn1(void);
diff --git a/src/lib/libcrypto/asn1/asn1_gen.c b/src/lib/libcrypto/asn1/asn1_gen.c
index f84cc6136b..ad7802cb11 100644
--- a/src/lib/libcrypto/asn1/asn1_gen.c
+++ b/src/lib/libcrypto/asn1/asn1_gen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_gen.c,v 1.16 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: asn1_gen.c,v 1.17 2018/04/25 11:48:21 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2002.
  */
@@ -121,7 +121,7 @@ static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype);
 static int asn1_str2tag(const char *tagstr, int len);
 
 ASN1_TYPE *
-ASN1_generate_nconf(char *str, CONF *nconf)
+ASN1_generate_nconf(const char *str, CONF *nconf)
 {
         X509V3_CTX cnf;
 
@@ -133,7 +133,7 @@ ASN1_generate_nconf(char *str, CONF *nconf)
 }
 
 ASN1_TYPE *
-ASN1_generate_v3(char *str, X509V3_CTX *cnf)
+ASN1_generate_v3(const char *str, X509V3_CTX *cnf)
 {
         ASN1_TYPE *ret;
         tag_exp_arg asn1_tags;
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 970102c213..ffd3ad6a46 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_lib.c,v 1.40 2018/02/14 16:46:04 jsing Exp $ */
+/* $OpenBSD: asn1_lib.c,v 1.41 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -474,7 +474,7 @@ ASN1_STRING_length_set(ASN1_STRING *x, int len)
 }
 
 int
-ASN1_STRING_type(ASN1_STRING *x)
+ASN1_STRING_type(const ASN1_STRING *x)
 {
         return (x->type);
 }
diff --git a/src/lib/libcrypto/asn1/asn_pack.c b/src/lib/libcrypto/asn1/asn_pack.c
index 09d150583a..1a5420e42b 100644
--- a/src/lib/libcrypto/asn1/asn_pack.c
+++ b/src/lib/libcrypto/asn1/asn_pack.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn_pack.c,v 1.16 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: asn_pack.c,v 1.17 2018/04/25 11:48:21 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -203,7 +203,7 @@ err:
 /* Extract an ASN1 object from an ASN1_STRING */
 
 void *
-ASN1_item_unpack(ASN1_STRING *oct, const ASN1_ITEM *it)
+ASN1_item_unpack(const ASN1_STRING *oct, const ASN1_ITEM *it)
 {
         const unsigned char *p;
         void *ret;
diff --git a/src/lib/libcrypto/asn1/evp_asn1.c b/src/lib/libcrypto/asn1/evp_asn1.c
index 5f74da1546..ec63557770 100644
--- a/src/lib/libcrypto/asn1/evp_asn1.c
+++ b/src/lib/libcrypto/asn1/evp_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_asn1.c,v 1.20 2017/11/28 16:51:21 jsing Exp $ */
+/* $OpenBSD: evp_asn1.c,v 1.21 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -79,7 +79,7 @@ ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len)
 }
 
 int
-ASN1_TYPE_get_octetstring(ASN1_TYPE *a, unsigned char *data, int max_len)
+ASN1_TYPE_get_octetstring(const ASN1_TYPE *a, unsigned char *data, int max_len)
 {
         int ret, num;
         unsigned char *p;
@@ -162,7 +162,7 @@ ASN1_TYPE_set_int_octetstring(ASN1_TYPE *at, long num, unsigned char *data,
 }
 
 int
-ASN1_TYPE_get_int_octetstring(ASN1_TYPE *at, long *num, unsigned char *data,
+ASN1_TYPE_get_int_octetstring(const ASN1_TYPE *at, long *num, unsigned char *data,
     int max_len)
 {
         ASN1_STRING *sp = at->value.sequence;
diff --git a/src/lib/libcrypto/asn1/f_enum.c b/src/lib/libcrypto/asn1/f_enum.c
index 64feb97dc4..cc4b7dfc91 100644
--- a/src/lib/libcrypto/asn1/f_enum.c
+++ b/src/lib/libcrypto/asn1/f_enum.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: f_enum.c,v 1.15 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: f_enum.c,v 1.16 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -65,7 +65,7 @@
 /* Based on a_int.c: equivalent ENUMERATED functions */
 
 int
-i2a_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *a)
+i2a_ASN1_ENUMERATED(BIO *bp, const ASN1_ENUMERATED *a)
 {
         int i, n = 0;
         static const char h[] = "0123456789ABCDEF";
diff --git a/src/lib/libcrypto/asn1/f_int.c b/src/lib/libcrypto/asn1/f_int.c
index 75168872b3..9849a7c8fc 100644
--- a/src/lib/libcrypto/asn1/f_int.c
+++ b/src/lib/libcrypto/asn1/f_int.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: f_int.c,v 1.18 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: f_int.c,v 1.19 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -63,7 +63,7 @@
 #include <openssl/err.h>
 
 int
-i2a_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *a)
+i2a_ASN1_INTEGER(BIO *bp, const ASN1_INTEGER *a)
 {
         int i, n = 0;
         static const char h[] = "0123456789ABCDEF";
diff --git a/src/lib/libcrypto/asn1/f_string.c b/src/lib/libcrypto/asn1/f_string.c
index 138044e063..af17f43e1d 100644
--- a/src/lib/libcrypto/asn1/f_string.c
+++ b/src/lib/libcrypto/asn1/f_string.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: f_string.c,v 1.17 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: f_string.c,v 1.18 2018/04/25 11:48:21 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -63,7 +63,7 @@
 #include <openssl/err.h>
 
 int
-i2a_ASN1_STRING(BIO *bp, ASN1_STRING *a, int type)
+i2a_ASN1_STRING(BIO *bp, const ASN1_STRING *a, int type)
 {
         int i, n = 0;
         static const char h[] = "0123456789ABCDEF";
diff --git a/src/lib/libcrypto/asn1/t_bitst.c b/src/lib/libcrypto/asn1/t_bitst.c
index ea4138e0fb..51515b88e2 100644
--- a/src/lib/libcrypto/asn1/t_bitst.c
+++ b/src/lib/libcrypto/asn1/t_bitst.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t_bitst.c,v 1.7 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: t_bitst.c,v 1.8 2018/04/25 11:48:21 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -83,7 +83,7 @@ ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
 }
 
 int
-ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
+ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, const char *name, int value,
     BIT_STRING_BITNAME *tbl)
 {
         int bitnum;
@@ -99,7 +99,7 @@ ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
 }
 
 int
-ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl)
+ASN1_BIT_STRING_num_asc(const char *name, BIT_STRING_BITNAME *tbl)
 {
         BIT_STRING_BITNAME *bnam;
 
diff --git a/src/lib/libcrypto/asn1/tasn_prn.c b/src/lib/libcrypto/asn1/tasn_prn.c
index 7cccd56a16..b8f7dd5294 100644
--- a/src/lib/libcrypto/asn1/tasn_prn.c
+++ b/src/lib/libcrypto/asn1/tasn_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_prn.c,v 1.16 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: tasn_prn.c,v 1.17 2018/04/25 11:48:21 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -105,7 +105,7 @@ ASN1_PCTX_free(ASN1_PCTX *p)
 }
 
 unsigned long
-ASN1_PCTX_get_flags(ASN1_PCTX *p)
+ASN1_PCTX_get_flags(const ASN1_PCTX *p)
 {
         return p->flags;
 }
@@ -117,7 +117,7 @@ ASN1_PCTX_set_flags(ASN1_PCTX *p, unsigned long flags)
 }
 
 unsigned long
-ASN1_PCTX_get_nm_flags(ASN1_PCTX *p)
+ASN1_PCTX_get_nm_flags(const ASN1_PCTX *p)
 {
         return p->nm_flags;
 }
@@ -129,7 +129,7 @@ ASN1_PCTX_set_nm_flags(ASN1_PCTX *p, unsigned long flags)
 }
 
 unsigned long
-ASN1_PCTX_get_cert_flags(ASN1_PCTX *p)
+ASN1_PCTX_get_cert_flags(const ASN1_PCTX *p)
 {
         return p->cert_flags;
 }
@@ -141,7 +141,7 @@ ASN1_PCTX_set_cert_flags(ASN1_PCTX *p, unsigned long flags)
 }
 
 unsigned long
-ASN1_PCTX_get_oid_flags(ASN1_PCTX *p)
+ASN1_PCTX_get_oid_flags(const ASN1_PCTX *p)
 {
         return p->oid_flags;
 }
@@ -153,7 +153,7 @@ ASN1_PCTX_set_oid_flags(ASN1_PCTX *p, unsigned long flags)
 }
 
 unsigned long
-ASN1_PCTX_get_str_flags(ASN1_PCTX *p)
+ASN1_PCTX_get_str_flags(const ASN1_PCTX *p)
 {
         return p->str_flags;
 }
diff --git a/src/lib/libcrypto/x509v3/v3_sxnet.c b/src/lib/libcrypto/x509v3/v3_sxnet.c
index 14c6e5c0a4..e113d5f7e2 100644
--- a/src/lib/libcrypto/x509v3/v3_sxnet.c
+++ b/src/lib/libcrypto/x509v3/v3_sxnet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: v3_sxnet.c,v 1.19 2017/01/29 17:49:23 beck Exp $ */
+/* $OpenBSD: v3_sxnet.c,v 1.20 2018/04/25 11:48:21 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -335,7 +335,7 @@ err:
 }
 
 ASN1_OCTET_STRING *
-SXNET_get_id_asc(SXNET *sx, char *zone)
+SXNET_get_id_asc(SXNET *sx, const char *zone)
 {
         ASN1_INTEGER *izone = NULL;
         ASN1_OCTET_STRING *oct;
diff --git a/src/lib/libcrypto/x509v3/v3_utl.c b/src/lib/libcrypto/x509v3/v3_utl.c
index 67ecc81a44..ff3b2c3e86 100644
--- a/src/lib/libcrypto/x509v3/v3_utl.c
+++ b/src/lib/libcrypto/x509v3/v3_utl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: v3_utl.c,v 1.27 2018/03/20 16:16:59 jsing Exp $ */
+/* $OpenBSD: v3_utl.c,v 1.28 2018/04/25 11:48:21 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -180,7 +180,7 @@ i2s_ASN1_INTEGER(X509V3_EXT_METHOD *method, ASN1_INTEGER *a)
 }
 
 ASN1_INTEGER *
-s2i_ASN1_INTEGER(X509V3_EXT_METHOD *method, char *value)
+s2i_ASN1_INTEGER(X509V3_EXT_METHOD *method, const char *value)
 {
         BIGNUM *bn = NULL;
         ASN1_INTEGER *aint;
diff --git a/src/lib/libcrypto/x509v3/x509v3.h b/src/lib/libcrypto/x509v3/x509v3.h
index fbafd694ed..abf126996a 100644
--- a/src/lib/libcrypto/x509v3/x509v3.h
+++ b/src/lib/libcrypto/x509v3/x509v3.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509v3.h,v 1.22 2017/06/22 17:28:00 jsing Exp $ */
+/* $OpenBSD: x509v3.h,v 1.23 2018/04/25 11:48:21 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -528,7 +528,7 @@ int SXNET_add_id_asc(SXNET **psx, char *zone, char *user, int userlen);
 int SXNET_add_id_ulong(SXNET **psx, unsigned long lzone, char *user, int userlen); 
 int SXNET_add_id_INTEGER(SXNET **psx, ASN1_INTEGER *izone, char *user, int userlen); 
 
-ASN1_OCTET_STRING *SXNET_get_id_asc(SXNET *sx, char *zone);
+ASN1_OCTET_STRING *SXNET_get_id_asc(SXNET *sx, const char *zone);
 ASN1_OCTET_STRING *SXNET_get_id_ulong(SXNET *sx, unsigned long lzone);
 ASN1_OCTET_STRING *SXNET_get_id_INTEGER(SXNET *sx, ASN1_INTEGER *zone);
 
@@ -735,7 +735,7 @@ int X509V3_add_value_bool(const char *name, int asn1_bool,
 int X509V3_add_value_int(const char *name, ASN1_INTEGER *aint,
                                                 STACK_OF(CONF_VALUE) **extlist);
 char * i2s_ASN1_INTEGER(X509V3_EXT_METHOD *meth, ASN1_INTEGER *aint);
-ASN1_INTEGER * s2i_ASN1_INTEGER(X509V3_EXT_METHOD *meth, char *value);
+ASN1_INTEGER * s2i_ASN1_INTEGER(X509V3_EXT_METHOD *meth, const char *value);
 char * i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *meth, ASN1_ENUMERATED *aint);
 char * i2s_ASN1_ENUMERATED_TABLE(X509V3_EXT_METHOD *meth, ASN1_ENUMERATED *aint);
 int X509V3_EXT_add(X509V3_EXT_METHOD *ext);