diff --git a/include/h.h b/include/h.h
index 78b94e417..63ad59ad4 100644
--- a/include/h.h
+++ b/include/h.h
@@ -31,7 +31,7 @@
 extern MODVAR char *extraflags;
 extern MODVAR int tainted;
 /* for the new s_err.c */
-extern char *getreply(int);
+extern const char *getreply(int);
 #define rpl_str(x) getreply(x)
 #define err_str(x) getreply(x)
 extern MODVAR Member *freemember;
@@ -139,8 +139,8 @@ extern void append_ListItem(ListStruct *item, ListStruct **list);
 extern void add_ListItemPrio(ListStructPrio *, ListStructPrio **, int);
 extern void del_ListItem(ListStruct *, ListStruct **);
 extern MODVAR LoopStruct loop;
-extern int del_banid(Channel *channel, char *banid);
-extern int del_exbanid(Channel *channel, char *banid);
+extern int del_banid(Channel *channel, const char *banid);
+extern int del_exbanid(Channel *channel, const char *banid);
 #define REPORT_DO_DNS	"NOTICE * :*** Looking up your hostname...\r\n"
 #define REPORT_FIN_DNS	"NOTICE * :*** Found your hostname\r\n"
 #define REPORT_FIN_DNSC "NOTICE * :*** Found your hostname (cached)\r\n"
@@ -170,7 +170,7 @@ extern int check_tkls(Client *cptr);
 /* for services */
 extern void send_user_joins(Client *, Client *);
 extern int valid_channelname(const char *);
-extern int valid_server_name(char *name);
+extern int valid_server_name(const char *name);
 extern long get_access(Client *, Channel *);
 extern int ban_check_mask(BanContext *b);
 extern int extban_is_ok_nuh_extban(BanContext *b);
@@ -191,12 +191,10 @@ extern void inittoken();
 extern void reset_help();
 
 extern MODVAR char *debugmode, *configfile, *sbrk0;
-extern char *getfield(char *);
 extern void set_sockhost(Client *, const char *);
 #ifdef _WIN32
 extern const char *sock_strerror(int);
 #endif
-extern int dgets(int, char *, int);
 
 #ifdef _WIN32
 extern MODVAR int debuglevel;
@@ -207,32 +205,29 @@ extern MODVAR int OpenFiles;  /* number of files currently open */
 extern MODVAR int debuglevel, portnum, debugtty, maxusersperchannel;
 extern MODVAR int readcalls, udpfd, resfd;
 extern Client *add_connection(ConfigItem_listen *, int);
-extern void add_local_domain(char *, int);
 extern int check_server_init(Client *);
 extern void close_connection(Client *);
 extern void close_unbound_listeners();
-extern void get_my_name(Client *, char *, int);
 extern int get_sockerr(Client *);
 extern int inetport(ConfigItem_listen *, char *, int, int);
 extern void init_sys();
 extern void check_user_limit(void);
 extern void init_modef();
-extern int verify_hostname(char *name);
+extern int verify_hostname(const char *name);
 
 extern int setup_ping();
 
 extern void set_channel_mlock(Client *, Channel *, const char *, int);
 
-extern void restart(char *);
-extern void server_reboot(char *);
+extern void restart(const char *);
+extern void server_reboot(const char *);
 extern void terminate(), write_pidfile();
 extern void *safe_alloc(size_t size);
 extern void set_socket_buffers(int fd, int rcvbuf, int sndbuf);
 extern int send_queued(Client *);
 extern void send_queued_cb(int fd, int revents, void *data);
-extern void sendto_serv_butone_nickcmd(Client *one, MessageTag *mtags, Client *client, char *umodes);
-extern void    sendto_message_one(Client *to, Client *from, char *sender,
-    char *cmd, char *nick, char *msg);
+extern void sendto_serv_butone_nickcmd(Client *one, MessageTag *mtags, Client *client, const char *umodes);
+extern void    sendto_message_one(Client *to, Client *from, const char *sender, const char *cmd, const char *nick, const char *msg);
 #define PREFIX_ALL		0
 #define PREFIX_HALFOP	0x1
 #define PREFIX_VOICE	0x2
@@ -247,7 +242,7 @@ extern void sendto_local_common_channels(Client *user, Client *skip,
                                          long clicap, MessageTag *mtags,
                                          FORMAT_STRING(const char *pattern), ...) __attribute__((format(printf,5,6)));
 extern void sendto_match_servs(Channel *, Client *, FORMAT_STRING(const char *), ...) __attribute__((format(printf,3,4)));
-extern void sendto_match_butone(Client *, Client *, char *, int, MessageTag *,
+extern void sendto_match_butone(Client *, Client *, const char *, int, MessageTag *,
     FORMAT_STRING(const char *pattern), ...) __attribute__((format(printf,6,7)));
 extern void sendto_all_butone(Client *, Client *, FORMAT_STRING(const char *), ...) __attribute__((format(printf,3,4)));
 extern void sendto_ops(FORMAT_STRING(const char *), ...) __attribute__((format(printf,1,2)));
@@ -283,7 +278,7 @@ extern const char *rfc2616_time(time_t clock);
 extern void exit_client(Client *client, MessageTag *recv_mtags, const char *comment);
 extern void exit_client_fmt(Client *client, MessageTag *recv_mtags, FORMAT_STRING(const char *pattern), ...) __attribute__((format(printf, 3, 4)));
 extern void exit_client_ex(Client *client, Client *origin, MessageTag *recv_mtags, const char *comment);
-extern void initstats(), tstats(Client *, char *);
+extern void initstats();
 extern const char *check_string(const char *);
 extern char *make_nick_user_host(const char *, const char *, const char *);
 extern char *make_nick_user_host_r(char *namebuf, size_t namebuflen, const char *nick, const char *name, const char *host);
@@ -307,28 +302,28 @@ extern void free_link(Link *);
 extern void free_ban(Ban *);
 extern void free_user(Client *);
 extern int list_length(Link *lp);
-extern int find_str_match_link(Link *, char *);
+extern int find_str_match_link(Link *, const char *);
 extern void free_str_list(Link *);
 extern Link *make_link();
 extern Ban *make_ban();
 extern User *make_user(Client *);
 extern Server *make_server();
 extern Client *make_client(Client *, Client *);
-extern Channel *make_channel(char *name);
+extern Channel *make_channel(const char *name);
 extern Member *find_channel_link(Member *, Channel *);
-extern char *pretty_mask(char *);
+extern char *pretty_mask(const char *);
 extern void add_client_to_list(Client *);
 extern void remove_client_from_list(Client *);
 extern void initlists(void);
 extern void initlist_channels(void);
-extern struct hostent *get_res(char *);
-extern struct hostent *gethost_byaddr(char *, Link *);
-extern struct hostent *gethost_byname(char *, Link *);
+extern struct hostent *get_res(const char *);
+extern struct hostent *gethost_byaddr(const char *, Link *);
+extern struct hostent *gethost_byname(const char *, Link *);
 extern void flush_cache();
 extern void init_resolver(int firsttime);
 extern time_t timeout_query_list(time_t);
 extern time_t expire_cache(time_t);
-extern void del_queries(char *);
+extern void del_queries(const char *);
 
 /* Hash stuff */
 #define NICK_HASH_TABLE_SIZE 32768
@@ -355,11 +350,6 @@ extern Channel *find_channel(const char *name);
 extern Client *hash_find_server(const char *, Client *);
 extern struct MODVAR ThrottlingBucket *ThrottlingHash[THROTTLING_HASH_TABLE_SIZE];
 
-extern char *find_by_aln(char *);
-extern char *convert2aln(int);
-extern int convertfromaln(char *);
-extern char *find_server_aln(char *);
-extern time_t atime(char *xtime);
 
 
 /* Mode externs
@@ -410,12 +400,12 @@ extern void dopacket(Client *, char *, int);
 
 extern void debug(int, FORMAT_STRING(const char *), ...) __attribute__((format(printf,2,3)));
 #if defined(DEBUGMODE)
-extern void send_usage(Client *, char *);
-extern void count_memory(Client *, char *);
-extern int checkprotoflags(Client *, int, char *, int);
+extern void send_usage(Client *, const char *);
+extern void count_memory(Client *, const char *);
+extern int checkprotoflags(Client *, int, const char *, int);
 #endif
 
-extern char *inetntop(int af, const void *in, char *local_dummy, size_t the_size);
+extern const char *inetntop(int af, const void *in, char *local_dummy, size_t the_size);
 
 /* Internal command stuff - not for modules */
 extern MODVAR RealCommand *CommandHash[256];
@@ -446,15 +436,9 @@ extern int   		Auth_CheckError(ConfigEntry *ce);
 extern int              Auth_AutoDetectHashType(const char *hash);
 
 extern void make_cloakedhost(Client *client, const char *curr, char *buf, size_t buflen);
-extern int  channel_canjoin(Client *client, char *name);
+extern int  channel_canjoin(Client *client, const char *name);
 extern char *collapse(char *pattern);
 extern void dcc_sync(Client *client);
-extern void report_flines(Client *client);
-extern void report_network(Client *client);
-extern void report_dynconf(Client *client);
-extern void count_memory(Client *cptr, char *nick);
-extern void list_scache(Client *client);
-extern char *oflagstr(long oflag);
 extern void request_rehash(Client *client);
 extern void s_die();
 extern int match_simple(const char *mask, const char *name);
@@ -463,7 +447,6 @@ extern int add_listener(ConfigItem_listen *conf);
 extern void link_cleanup(ConfigItem_link *link_ptr);
 extern void       listen_cleanup();
 extern int  numeric_collides(long numeric);
-extern u_long cres_mem(Client *client, char *nick);
 extern void      flag_add(char ch);
 extern void      flag_del(char ch);
 extern void init_dynconf(void);
@@ -477,8 +460,6 @@ extern void send_proto(Client *, ConfigItem_link *);
 extern void unload_all_modules(void);
 extern void set_sock_opts(int fd, Client *cptr, int ipv6);
 extern void stripcrlf(char *line);
-extern time_t rfc2time(char *s);
-extern char *rfctime(time_t t, char *buf);
 extern int strnatcmp(char const *a, char const *b);
 extern int strnatcasecmp(char const *a, char const *b);
 extern void outofmemory(size_t bytes);
@@ -591,7 +572,7 @@ extern void extcmode_duplicate_paramlist(void **xi, void **xo);
 extern void extcmode_free_paramlist(void **ar);
 
 extern void chmode_str(struct ChMode *, char *, char *, size_t, size_t);
-extern char *get_client_status(Client *);
+extern const char *get_client_status(Client *);
 extern const char *get_snomask_string_raw(long);
 extern void SocketLoop(void *);
 #ifdef _WIN32
@@ -604,12 +585,11 @@ extern void CleanUp(void);
 extern int CountRTFSize(unsigned char *buffer);
 extern void IRCToRTF(unsigned char *buffer, unsigned char *string);
 #endif
-extern void sendto_chmodemucrap(Client *, Channel *, char *);
 extern void verify_opercount(Client *, const char *);
 extern int valid_host(const char *host, int strict);
 extern int count_oper_sessions(const char *);
 extern char *unreal_mktemp(const char *dir, const char *suffix);
-extern char *unreal_getpathname(char *filepath, char *path);
+extern char *unreal_getpathname(const char *filepath, char *path);
 extern const char *unreal_getfilename(const char *path);
 extern const char *unreal_getmodfilename(const char *path);
 extern int unreal_copyfile(const char *src, const char *dest);
@@ -630,7 +610,6 @@ extern BanAction banact_chartoval(char c);
 extern char banact_valtochar(BanAction val);
 extern int spamfilter_gettargets(const char *s, Client *client);
 extern char *spamfilter_target_inttostring(int v);
-extern Spamfilter *unreal_buildspamfilter(char *s);
 extern char *our_strcasestr(const char *haystack, const char *needle);
 extern int spamfilter_getconftargets(const char *s);
 extern void remove_oper_snomasks(Client *client);
@@ -640,13 +619,13 @@ extern MODVAR char backupbuf[];
 extern int is_invited(Client *client, Channel *channel);
 extern void channel_modes(Client *client, char *mbuf, char *pbuf, size_t mbuf_size, size_t pbuf_size, Channel *channel, int hide_local_modes);
 extern MODVAR char modebuf[BUFSIZE], parabuf[BUFSIZE];
-extern int op_can_override(char *acl, Client *client,Channel *channel,void* extra);
+extern int op_can_override(const char *acl, Client *client,Channel *channel,void* extra);
 extern Client *find_chasing(Client *client, const char *user, int *chasing);
 extern MODVAR long opermode;
 extern MODVAR long sajoinmode;
 extern void add_user_to_channel(Channel *channel, Client *who, int flags);
-extern int add_banid(Client *, Channel *, char *);
-extern int add_exbanid(Client *cptr, Channel *channel, char *banid);
+extern int add_banid(Client *, Channel *, const char *);
+extern int add_exbanid(Client *cptr, Channel *channel, const char *banid);
 extern int sub1_from_channel(Channel *);
 extern MODVAR CoreChannelModeTable corechannelmodetable[];
 extern char *unreal_encodespace(char *s);
@@ -658,9 +637,9 @@ extern int callbacks_check(void);
 extern void callbacks_switchover(void);
 extern int efunctions_check(void);
 extern void efunctions_switchover(void);
-extern char *encode_ip(const char *);
-extern char *decode_ip(const char *);
-extern void sendto_one_nickcmd(Client *server, MessageTag *mtags, Client *client, char *umodes);
+extern const char *encode_ip(const char *);
+extern const char *decode_ip(const char *);
+extern void sendto_one_nickcmd(Client *server, MessageTag *mtags, Client *client, const char *umodes);
 extern int on_dccallow_list(Client *to, Client *from);
 extern int add_dccallow(Client *client, Client *optr);
 extern int del_dccallow(Client *client, Client *optr);
@@ -689,23 +668,23 @@ extern MODVAR int (*register_user)(Client *client);
 extern MODVAR int (*tkl_hash)(unsigned int c);
 extern MODVAR char (*tkl_typetochar)(int type);
 extern MODVAR int (*tkl_chartotype)(char c);
-extern MODVAR char *(*tkl_type_string)(TKL *tk);
-extern MODVAR char *(*tkl_type_config_string)(TKL *tk);
-extern MODVAR TKL *(*tkl_add_serverban)(int type, char *usermask, char *hostmask, char *reason, char *setby,
+extern MODVAR const char *(*tkl_type_string)(TKL *tk);
+extern MODVAR const char *(*tkl_type_config_string)(TKL *tk);
+extern MODVAR TKL *(*tkl_add_serverban)(int type, const char *usermask, const char *hostmask, const char *reason, const char *setby,
                                             time_t expire_at, time_t set_at, int soft, int flags);
-extern MODVAR TKL *(*tkl_add_banexception)(int type, char *usermask, char *hostmask, char *reason, char *set_by,
-                                               time_t expire_at, time_t set_at, int soft, char *bantypes, int flags);
-extern MODVAR TKL *(*tkl_add_nameban)(int type, char *name, int hold, char *reason, char *setby,
+extern MODVAR TKL *(*tkl_add_banexception)(int type, const char *usermask, const char *hostmask, const char *reason, const char *set_by,
+                                               time_t expire_at, time_t set_at, int soft, const char *bantypes, int flags);
+extern MODVAR TKL *(*tkl_add_nameban)(int type, const char *name, int hold, const char *reason, const char *setby,
                                           time_t expire_at, time_t set_at, int flags);
-extern MODVAR TKL *(*tkl_add_spamfilter)(int type, unsigned short target, unsigned short action, Match *match, char *setby,
+extern MODVAR TKL *(*tkl_add_spamfilter)(int type, unsigned short target, unsigned short action, Match *match, const char *setby,
                                              time_t expire_at, time_t set_at,
-                                             time_t spamf_tkl_duration, char *spamf_tkl_reason,
+                                             time_t spamf_tkl_duration, const char *spamf_tkl_reason,
                                              int flags);
-extern MODVAR TKL *(*find_tkl_serverban)(int type, char *usermask, char *hostmask, int softban);
-extern MODVAR TKL *(*find_tkl_banexception)(int type, char *usermask, char *hostmask, int softban);
-extern MODVAR TKL *(*find_tkl_nameban)(int type, char *name, int hold);
-extern MODVAR TKL *(*find_tkl_spamfilter)(int type, char *match_string, unsigned short action, unsigned short target);
-extern MODVAR void (*sendnotice_tkl_del)(char *removed_by, TKL *tkl);
+extern MODVAR TKL *(*find_tkl_serverban)(int type, const char *usermask, const char *hostmask, int softban);
+extern MODVAR TKL *(*find_tkl_banexception)(int type, const char *usermask, const char *hostmask, int softban);
+extern MODVAR TKL *(*find_tkl_nameban)(int type, const char *name, int hold);
+extern MODVAR TKL *(*find_tkl_spamfilter)(int type, const char *match_string, unsigned short action, unsigned short target);
+extern MODVAR void (*sendnotice_tkl_del)(const char *removed_by, TKL *tkl);
 extern MODVAR void (*sendnotice_tkl_add)(TKL *tkl);
 extern MODVAR void (*free_tkl)(TKL *tkl);
 extern MODVAR TKL *(*tkl_del_line)(TKL *tkl);
@@ -713,18 +692,18 @@ extern MODVAR void (*tkl_check_local_remove_shun)(TKL *tmp);
 extern MODVAR int (*find_tkline_match)(Client *cptr, int skip_soft);
 extern MODVAR int (*find_shun)(Client *cptr);
 extern MODVAR int (*find_spamfilter_user)(Client *client, int flags);
-extern MODVAR TKL *(*find_qline)(Client *cptr, char *nick, int *ishold);
+extern MODVAR TKL *(*find_qline)(Client *cptr, const char *nick, int *ishold);
 extern MODVAR TKL *(*find_tkline_match_zap)(Client *cptr);
 extern MODVAR void (*tkl_stats)(Client *cptr, int type, const char *para, int *cnt);
 extern MODVAR void (*tkl_sync)(Client *client);
 extern MODVAR void (*cmd_tkl)(Client *client, MessageTag *recv_mtags, int parc, char *parv[]);
-extern MODVAR int (*place_host_ban)(Client *client, BanAction action, char *reason, long duration);
+extern MODVAR int (*place_host_ban)(Client *client, BanAction action, const char *reason, long duration);
 extern MODVAR int (*match_spamfilter)(Client *client, const char *str_in, int type, const char *cmd, const char *target, int flags, TKL **rettk);
-extern MODVAR int (*match_spamfilter_mtags)(Client *client, MessageTag *mtags, char *cmd);
+extern MODVAR int (*match_spamfilter_mtags)(Client *client, MessageTag *mtags, const char *cmd);
 extern MODVAR int (*join_viruschan)(Client *client, TKL *tk, int type);
 extern MODVAR const char *(*StripColors)(const char *text);
 extern MODVAR const char *(*StripControlCodes)(const char *text);
-extern MODVAR void (*spamfilter_build_user_string)(char *buf, char *nick, Client *acptr);
+extern MODVAR void (*spamfilter_build_user_string)(char *buf, const char *nick, Client *acptr);
 extern MODVAR void (*send_protoctl_servers)(Client *client, int response);
 extern MODVAR int (*verify_link)(Client *client, ConfigItem_link **link_out);
 extern MODVAR void (*send_server_message)(Client *client);
@@ -744,14 +723,14 @@ extern MODVAR void (*send_moddata_members)(Client *srv);
 extern MODVAR void (*broadcast_moddata_client)(Client *acptr);
 extern MODVAR int (*check_banned)(Client *cptr, int exitflags);
 extern MODVAR void (*introduce_user)(Client *to, Client *acptr);
-extern MODVAR int (*check_deny_version)(Client *cptr, char *software, int protocol, char *flags);
+extern MODVAR int (*check_deny_version)(Client *cptr, const char *software, int protocol, const char *flags);
 extern MODVAR int (*match_user)(const char *rmask, Client *acptr, int options);
 extern MODVAR void (*userhost_save_current)(Client *client);
 extern MODVAR void (*userhost_changed)(Client *client);
 extern MODVAR void (*send_join_to_local_users)(Client *client, Channel *channel, MessageTag *mtags);
 extern MODVAR int (*do_nick_name)(char *nick);
 extern MODVAR int (*do_remote_nick_name)(char *nick);
-extern MODVAR char *(*charsys_get_current_languages)(void);
+extern MODVAR const char *(*charsys_get_current_languages)(void);
 extern MODVAR void (*broadcast_sinfo)(Client *acptr, Client *to, Client *except);
 extern MODVAR void (*connect_server)(ConfigItem_link *aconf, Client *by, struct hostent *hp);
 extern MODVAR void (*parse_message_tags)(Client *cptr, char **str, MessageTag **mtag_list);
@@ -759,7 +738,7 @@ extern MODVAR const char *(*mtags_to_string)(MessageTag *m, Client *acptr);
 extern MODVAR int (*can_send_to_channel)(Client *cptr, Channel *channel, const char **msgtext, const char **errmsg, int notice);
 extern MODVAR void (*broadcast_md_globalvar)(ModDataInfo *mdi, ModData *md);
 extern MODVAR void (*broadcast_md_globalvar_cmd)(Client *except, Client *sender, const char *varname, const char *value);
-extern MODVAR int (*tkl_ip_hash)(char *ip);
+extern MODVAR int (*tkl_ip_hash)(const char *ip);
 extern MODVAR int (*tkl_ip_hash_type)(int type);
 extern MODVAR int (*find_tkl_exception)(int ban_type, Client *cptr);
 extern MODVAR int (*del_silence)(Client *client, const char *mask);
@@ -768,11 +747,11 @@ extern MODVAR int (*is_silenced)(Client *client, Client *acptr);
 extern MODVAR void *(*labeled_response_save_context)(void);
 extern MODVAR void (*labeled_response_set_context)(void *ctx);
 extern MODVAR void (*labeled_response_force_end)(void);
-extern MODVAR void (*kick_user)(MessageTag *mtags, Channel *channel, Client *client, Client *victim, char *comment);
-extern MODVAR int (*watch_add)(char *nick, Client *client, int flags);
-extern MODVAR int (*watch_del)(char *nick, Client *client, int flags);
+extern MODVAR void (*kick_user)(MessageTag *mtags, Channel *channel, Client *client, Client *victim, const char *comment);
+extern MODVAR int (*watch_add)(const char *nick, Client *client, int flags);
+extern MODVAR int (*watch_del)(const char *nick, Client *client, int flags);
 extern MODVAR int (*watch_del_list)(Client *client, int flags);
-extern MODVAR Watch *(*watch_get)(char *nick);
+extern MODVAR Watch *(*watch_get)(const char *nick);
 extern MODVAR int (*watch_check)(Client *client, int reply, int (*watch_notify)(Client *client, Watch *watch, Link *lp, int event));
 extern MODVAR char *(*tkl_uhost)(TKL *tkl, char *buf, size_t buflen, int options);
 extern MODVAR void (*do_unreal_log_remote_deliver)(LogLevel loglevel, const char *subsystem, const char *event_id, MultiLine *msg, const char *json_serialized);
@@ -787,14 +766,14 @@ extern int ssl_client_handshake(Client *, ConfigItem_link *); /* and the initiat
 extern int unreal_tls_accept(Client *acptr, int fd);
 extern int unreal_tls_connect(Client *acptr, int fd);
 extern int SSL_smart_shutdown(SSL *ssl);
-extern char *ssl_error_str(int err, int my_errno);
+extern const char *ssl_error_str(int err, int my_errno);
 extern void unreal_tls_client_handshake(int, int, void *);
 extern void SSL_set_nonblocking(SSL *s);
 extern SSL_CTX *init_ctx(TLSOptions *tlsoptions, int server);
 extern const char *tls_get_cipher(Client *client);
 extern TLSOptions *get_tls_options_for_client(Client *acptr);
 extern int outdated_tls_client(Client *acptr);
-extern char *outdated_tls_client_build_string(char *pattern, Client *acptr);
+extern const char *outdated_tls_client_build_string(const char *pattern, Client *acptr);
 extern int check_certificate_expiry_ctx(SSL_CTX *ctx, char **errstr);
 extern EVENT(tls_check_expiry);
 extern MODVAR EVP_MD *sha256_function;
@@ -834,7 +813,7 @@ extern void unrealdns_delasyncconnects(void);
 extern int is_autojoin_chan(const char *chname);
 extern void unreal_free_hostent(struct hostent *he);
 extern struct hostent *unreal_create_hostent(const char *name, const char *ip);
-extern char *unreal_time_sync_error(void);
+extern const char *unreal_time_sync_error(void);
 extern int unreal_time_synch(int timeout);
 extern const char *getcloak(Client *client);
 extern MODVAR unsigned char param_to_slot_mapping[256];
@@ -851,18 +830,18 @@ extern void free_motd(MOTDFile *motd); /* s_serv.c */
 extern void fix_timers(void);
 extern const char *chfl_to_sjoin_symbol(int s);
 extern char chfl_to_chanmode(int s);
-extern void add_pending_net(Client *client, char *str);
+extern void add_pending_net(Client *client, const char *str);
 extern void free_pending_net(Client *client);
 extern Client *find_non_pending_net_duplicates(Client *cptr);
-extern PendingNet *find_pending_net_by_sid_butone(char *sid, Client *exempt);
+extern PendingNet *find_pending_net_by_sid_butone(const char *sid, Client *exempt);
 extern Client *find_pending_net_duplicates(Client *cptr, Client **srv, char **sid);
 extern MODVAR char serveropts[];
 extern MODVAR char *ISupportStrings[];
 extern void read_packet(int fd, int revents, void *data);
 extern int process_packet(Client *cptr, char *readbuf, int length, int killsafely);
 extern int parse_chanmode(ParseMode *pm, const char *modebuf_in, const char *parabuf_in);
-extern int dead_socket(Client *to, char *notice);
-extern Match *unreal_create_match(MatchType type, char *str, char **error);
+extern int dead_socket(Client *to, const char *notice);
+extern Match *unreal_create_match(MatchType type, const char *str, char **error);
 extern void unreal_delete_match(Match *m);
 extern int unreal_match(Match *m, const char *str);
 extern int unreal_match_method_strtoval(const char *str);
@@ -877,7 +856,6 @@ extern MODVAR int need_34_upgrade;
 #ifdef _WIN32
 extern MODVAR BOOL IsService;
 #endif
-extern int match_ip46(char *a, char *b);
 extern void extcmodes_check_for_changes(void);
 extern void umodes_check_for_changes(void);
 extern int config_parse_flood(const char *orig, int *times, int *period);
@@ -891,9 +869,9 @@ extern void report_crash(void);
 extern void modulemanager(int argc, char *argv[]);
 extern int inet_pton4(const char *src, unsigned char *dst);
 extern int inet_pton6(const char *src, unsigned char *dst);
-extern int unreal_bind(int fd, char *ip, int port, int ipv6);
-extern int unreal_connect(int fd, char *ip, int port, int ipv6);
-extern int is_valid_ip(char *str);
+extern int unreal_bind(int fd, const char *ip, int port, int ipv6);
+extern int unreal_connect(int fd, const char *ip, int port, int ipv6);
+extern int is_valid_ip(const char *str);
 extern int ipv6_capable(void);
 extern MODVAR Client *remote_rehash_client;
 extern MODVAR int debugfd;
@@ -930,17 +908,17 @@ extern int IsWebsocket(Client *acptr);
 extern Policy policy_strtoval(const char *s);
 extern const char *policy_valtostr(Policy policy);
 extern char policy_valtochar(Policy policy);
-extern int verify_certificate(SSL *ssl, char *hostname, char **errstr);
-extern char *certificate_name(SSL *ssl);
+extern int verify_certificate(SSL *ssl, const char *hostname, char **errstr);
+extern const char *certificate_name(SSL *ssl);
 extern void start_of_normal_client_handshake(Client *acptr);
 extern void clicap_pre_rehash(void);
 extern void clicap_post_rehash(void);
 extern void unload_all_unused_mtag_handlers(void);
-extern void send_cap_notify(int add, char *token);
+extern void send_cap_notify(int add, const char *token);
 extern void sendbufto_one(Client *to, char *msg, unsigned int quick);
 extern MODVAR int current_serial;
-extern char *spki_fingerprint(Client *acptr);
-extern char *spki_fingerprint_ex(X509 *x509_cert);
+extern const char *spki_fingerprint(Client *acptr);
+extern const char *spki_fingerprint_ex(X509 *x509_cert);
 extern int is_module_loaded(const char *name);
 extern void close_std_descriptors(void);
 extern void banned_client(Client *acptr, const char *bantype, const char *reason, int global, int noexit);
@@ -951,16 +929,16 @@ extern void setmaxtargets(const char *cmd, int limit);
 extern void freemaxtargets(void);
 extern int max_targets_for_command(const char *cmd);
 extern void set_targmax_defaults(void);
-extern void parse_chanmodes_protoctl(Client *client, char *str);
+extern void parse_chanmodes_protoctl(Client *client, const char *str);
 extern void concat_params(char *buf, int len, int parc, char *parv[]);
 extern void charsys_check_for_changes(void);
 extern MODVAR int maxclients;
-extern int fast_badword_match(ConfigItem_badword *badword, char *line);
-extern int fast_badword_replace(ConfigItem_badword *badword, char *line, char *buf, int max);
+extern int fast_badword_match(ConfigItem_badword *badword, const char *line);
+extern int fast_badword_replace(ConfigItem_badword *badword, const char *line, char *buf, int max);
 extern const char *stripbadwords(const char *str, ConfigItem_badword *start_bw, int *blocked);
-extern int badword_config_process(ConfigItem_badword *ca, char *str);
+extern int badword_config_process(ConfigItem_badword *ca, const char *str);
 extern void badword_config_free(ConfigItem_badword *ca);
-extern char *badword_config_check_regex(char *s, int fastsupport, int check_broadness);
+extern const char *badword_config_check_regex(const char *s, int fastsupport, int check_broadness);
 extern AllowedChannelChars allowed_channelchars_strtoval(const char *str);
 extern const char *allowed_channelchars_valtostr(AllowedChannelChars v);
 extern HideIdleTimePolicy hideidletime_strtoval(const char *str);
diff --git a/src/api-efunctions.c b/src/api-efunctions.c
index 833a8d83f..c8c1cfbeb 100644
--- a/src/api-efunctions.c
+++ b/src/api-efunctions.c
@@ -45,36 +45,36 @@ int (*register_user)(Client *client);
 int (*tkl_hash)(unsigned int c);
 char (*tkl_typetochar)(int type);
 int (*tkl_chartotype)(char c);
-char *(*tkl_type_string)(TKL *tk);
-char *(*tkl_type_config_string)(TKL *tk);
+const char *(*tkl_type_string)(TKL *tk);
+const char *(*tkl_type_config_string)(TKL *tk);
 char *(*tkl_uhost)(TKL *tkl, char *buf, size_t buflen, int options);
-TKL *(*tkl_add_serverban)(int type, char *usermask, char *hostmask, char *reason, char *setby,
+TKL *(*tkl_add_serverban)(int type, const char *usermask, const char *hostmask, const char *reason, const char *setby,
                               time_t expire_at, time_t set_at, int soft, int flags);
-TKL *(*tkl_add_nameban)(int type, char *name, int hold, char *reason, char *setby,
+TKL *(*tkl_add_nameban)(int type, const char *name, int hold, const char *reason, const char *setby,
                             time_t expire_at, time_t set_at, int flags);
-TKL *(*tkl_add_spamfilter)(int type, unsigned short target, unsigned short action, Match *match, char *setby,
+TKL *(*tkl_add_spamfilter)(int type, unsigned short target, unsigned short action, Match *match, const char *setby,
                                time_t expire_at, time_t set_at,
-                               time_t spamf_tkl_duration, char *spamf_tkl_reason,
+                               time_t spamf_tkl_duration, const char *spamf_tkl_reason,
                                int flags);
-TKL *(*tkl_add_banexception)(int type, char *usermask, char *hostmask, char *reason, char *set_by,
-                                time_t expire_at, time_t set_at, int soft, char *bantypes, int flags);
+TKL *(*tkl_add_banexception)(int type, const char *usermask, const char *hostmask, const char *reason, const char *set_by,
+                                time_t expire_at, time_t set_at, int soft, const char *bantypes, int flags);
 TKL *(*tkl_del_line)(TKL *tkl);
 void (*tkl_check_local_remove_shun)(TKL *tmp);
 int (*find_tkline_match)(Client *client, int skip_soft);
 int (*find_shun)(Client *client);
 int(*find_spamfilter_user)(Client *client, int flags);
-TKL *(*find_qline)(Client *client, char *nick, int *ishold);
+TKL *(*find_qline)(Client *client, const char *nick, int *ishold);
 TKL *(*find_tkline_match_zap)(Client *client);
 void (*tkl_stats)(Client *client, int type, const char *para, int *cnt);
 void (*tkl_sync)(Client *client);
 void (*cmd_tkl)(Client *client, MessageTag *mtags, int parc, char *parv[]);
-int (*place_host_ban)(Client *client, BanAction action, char *reason, long duration);
+int (*place_host_ban)(Client *client, BanAction action, const char *reason, long duration);
 int (*match_spamfilter)(Client *client, const char *str_in, int type, const char *cmd, const char *target, int flags, TKL **rettk);
-int (*match_spamfilter_mtags)(Client *client, MessageTag *mtags, char *cmd);
+int (*match_spamfilter_mtags)(Client *client, MessageTag *mtags, const char *cmd);
 int (*join_viruschan)(Client *client, TKL *tk, int type);
 const char *(*StripColors)(const char *text);
 const char *(*StripControlCodes)(const char *text);
-void (*spamfilter_build_user_string)(char *buf, char *nick, Client *client);
+void (*spamfilter_build_user_string)(char *buf, const char *nick, Client *client);
 void (*send_protoctl_servers)(Client *client, int response);
 int (*verify_link)(Client *client, ConfigItem_link **link_out);
 void (*introduce_user)(Client *to, Client *client);
@@ -84,7 +84,7 @@ void (*broadcast_md_channel)(ModDataInfo *mdi, Channel *channel, ModData *md);
 void (*broadcast_md_member)(ModDataInfo *mdi, Channel *channel, Member *m, ModData *md);
 void (*broadcast_md_membership)(ModDataInfo *mdi, Client *client, Membership *m, ModData *md);
 int (*check_banned)(Client *client, int exitflags);
-int (*check_deny_version)(Client *client, char *software, int protocol, char *flags);
+int (*check_deny_version)(Client *client, const char *software, int protocol, const char *flags);
 void (*broadcast_md_client_cmd)(Client *except, Client *sender, Client *acptr, const char *varname, const char *value);
 void (*broadcast_md_channel_cmd)(Client *except, Client *sender, Channel *channel, const char *varname, const char *value);
 void (*broadcast_md_member_cmd)(Client *except, Client *sender, Channel *channel, Client *acptr, const char *varname, const char *value);
@@ -101,7 +101,7 @@ void (*userhost_save_current)(Client *client);
 void (*send_join_to_local_users)(Client *client, Channel *channel, MessageTag *mtags);
 int (*do_nick_name)(char *nick);
 int (*do_remote_nick_name)(char *nick);
-char *(*charsys_get_current_languages)(void);
+const char *(*charsys_get_current_languages)(void);
 void (*broadcast_sinfo)(Client *client, Client *to, Client *except);
 void (*connect_server)(ConfigItem_link *aconf, Client *by, struct hostent *hp);
 void (*parse_message_tags)(Client *client, char **str, MessageTag **mtag_list);
@@ -109,15 +109,15 @@ const char *(*mtags_to_string)(MessageTag *m, Client *client);
 int (*can_send_to_channel)(Client *client, Channel *channel, const char **msgtext, const char **errmsg, int notice);
 void (*broadcast_md_globalvar)(ModDataInfo *mdi, ModData *md);
 void (*broadcast_md_globalvar_cmd)(Client *except, Client *sender, const char *varname, const char *value);
-int (*tkl_ip_hash)(char *ip);
+int (*tkl_ip_hash)(const char *ip);
 int (*tkl_ip_hash_type)(int type);
-void (*sendnotice_tkl_del)(char *removed_by, TKL *tkl);
+void (*sendnotice_tkl_del)(const char *removed_by, TKL *tkl);
 void (*sendnotice_tkl_add)(TKL *tkl);
 void (*free_tkl)(TKL *tkl);
-TKL *(*find_tkl_serverban)(int type, char *usermask, char *hostmask, int softban);
-TKL *(*find_tkl_banexception)(int type, char *usermask, char *hostmask, int softban);
-TKL *(*find_tkl_nameban)(int type, char *name, int hold);
-TKL *(*find_tkl_spamfilter)(int type, char *match_string, unsigned short action, unsigned short target);
+TKL *(*find_tkl_serverban)(int type, const char *usermask, const char *hostmask, int softban);
+TKL *(*find_tkl_banexception)(int type, const char *usermask, const char *hostmask, int softban);
+TKL *(*find_tkl_nameban)(int type, const char *name, int hold);
+TKL *(*find_tkl_spamfilter)(int type, const char *match_string, unsigned short action, unsigned short target);
 int (*find_tkl_exception)(int ban_type, Client *client);
 int (*is_silenced)(Client *client, Client *acptr);
 int (*del_silence)(Client *client, const char *mask);
@@ -125,11 +125,11 @@ int (*add_silence)(Client *client, const char *mask, int senderr);
 void *(*labeled_response_save_context)(void);
 void (*labeled_response_set_context)(void *ctx);
 void (*labeled_response_force_end)(void);
-void (*kick_user)(MessageTag *mtags, Channel *channel, Client *client, Client *victim, char *comment);
-int (*watch_add)(char *nick, Client *client, int flags);
-int (*watch_del)(char *nick, Client *client, int flags);
+void (*kick_user)(MessageTag *mtags, Channel *channel, Client *client, Client *victim, const char *comment);
+int (*watch_add)(const char *nick, Client *client, int flags);
+int (*watch_del)(const char *nick, Client *client, int flags);
 int (*watch_del_list)(Client *client, int flags);
-Watch *(*watch_get)(char *nick);
+Watch *(*watch_get)(const char *nick);
 int (*watch_check)(Client *client, int reply, int (*watch_notify)(Client *client, Watch *watch, Link *lp, int event));
 void (*do_unreal_log_remote_deliver)(LogLevel loglevel, const char *subsystem, const char *event_id, MultiLine *msg, const char *json_serialized);
 char *(*get_chmodes_for_user)(Client *client, int flags);
diff --git a/src/auth.c b/src/auth.c
index 857a7290d..8cde40a19 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -391,7 +391,7 @@ static int authcheck_tls_clientcert_fingerprint(Client *client, AuthConfig *as,
 
 static int authcheck_spkifp(Client *client, AuthConfig *as, const char *para)
 {
-	char *fp = spki_fingerprint(client);
+	const char *fp = spki_fingerprint(client);
 
 	if (!fp)
 		return 0; /* auth failed: not TLS or some other failure */
diff --git a/src/channel.c b/src/channel.c
index 4fad1ca97..e0bf10a04 100644
--- a/src/channel.c
+++ b/src/channel.c
@@ -68,7 +68,7 @@ CoreChannelModeTable corechannelmodetable[] = {
 char cmodestring[512];
 
 /** Returns 1 if the IRCOp can override or is a remote connection */
-inline int op_can_override(char *acl, Client *client,Channel *channel,void* extra)
+inline int op_can_override(const char *acl, Client *client, Channel *channel, void* extra)
 {
 #ifndef NO_OPEROVERRIDE
 	if (MyUser(client) && !(ValidatePermissionsForPath(acl,client,NULL,channel,extra)))
@@ -677,14 +677,16 @@ void channel_modes(Client *client, char *mbuf, char *pbuf, size_t mbuf_size, siz
 
 /** Make a pretty mask from the input string - only used by SILENCE
  */
-char *pretty_mask(char *mask)
+char *pretty_mask(const char *mask_in)
 {
-	char *cp;
-	char *user;
-	char *host;
+	char mask[512];
+	char *cp, *user, *host;
+
+	strlcpy(mask, mask_in, sizeof(mask));
 
 	if ((user = strchr((cp = mask), '!')))
 		*user++ = '\0';
+
 	if ((host = strrchr(user ? user : cp, '@')))
 	{
 		*host++ = '\0';
@@ -692,7 +694,9 @@ char *pretty_mask(char *mask)
 			return make_nick_user_host(NULL, cp, host);
 	}
 	else if (!user && strchr(cp, '.'))
+	{
 		return make_nick_user_host(NULL, NULL, cp);
+	}
 	return make_nick_user_host(cp, user, host);
 }
 
@@ -912,7 +916,7 @@ void initlist_channels(void)
  * @note Be sure to call valid_channelname() first before
  *       you blindly call this function!
  */
-Channel *make_channel(char *name)
+Channel *make_channel(const char *name)
 {
 	Channel *channel;
 	int len;
diff --git a/src/debug.c b/src/debug.c
index 2cbc13bf0..e4d763564 100644
--- a/src/debug.c
+++ b/src/debug.c
@@ -147,7 +147,7 @@ void debug(int level, FORMAT_STRING(const char *form), ...)
 	SET_ERRNO(err);
 }
 
-int checkprotoflags(Client *client, int flags, char *file, int line)
+int checkprotoflags(Client *client, int flags, const char *file, int line)
 {
 	if (!MyConnect(client))
 	{
diff --git a/src/dns.c b/src/dns.c
index f151a8d76..62f6afd4f 100644
--- a/src/dns.c
+++ b/src/dns.c
@@ -353,7 +353,7 @@ void unrealdns_cb_nametoip_link(void *arg, int status, int timeouts, struct host
 	int n;
 	struct hostent *he2;
 	char ipbuf[HOSTLEN+1];
-	char *ip = NULL;
+	const char *ip = NULL;
 
 	if (!r->linkblock)
 	{
@@ -672,7 +672,8 @@ CMD_FUNC(cmd_dns)
 		ares_get_servers(resolver_channel, &serverlist);
 		for (ns = serverlist; ns; ns = ns->next)
 		{
-			char ipbuf[128], *ip;
+			char ipbuf[128];
+			const char *ip;
 			i++;
 			
 			ip = inetntop(ns->family, &ns->addr, ipbuf, sizeof(ipbuf));
diff --git a/src/ircd.c b/src/ircd.c
index 7531a9f7b..c32834bd1 100644
--- a/src/ircd.c
+++ b/src/ircd.c
@@ -50,8 +50,8 @@ extern SERVICE_STATUS IRCDStatus;
 
 MODVAR unsigned char conf_debuglevel = 0;
 
-void server_reboot(char *);
-void restart(char *);
+void server_reboot(const char *);
+void restart(const char *);
 static void open_debugfile(), setup_signals();
 extern void init_glines(void);
 extern void tkl_init(void);
@@ -123,7 +123,7 @@ static void s_reloadcert()
 }
 #endif // #ifndef _WIN32
 
-void restart(char *mesg)
+void restart(const char *mesg)
 {
 	server_reboot(mesg);
 }
@@ -169,7 +169,7 @@ void ignore_this_signal()
 #endif /* #ifndef _WIN32 */
 
 
-void server_reboot(char *mesg)
+void server_reboot(const char *mesg)
 {
 	int i;
 	Client *client;
diff --git a/src/match.c b/src/match.c
index bbd79a19f..ca361b0de 100644
--- a/src/match.c
+++ b/src/match.c
@@ -384,7 +384,7 @@ void unreal_delete_match(Match *m)
 	safe_free(m);
 }
 
-Match *unreal_create_match(MatchType type, char *str, char **error)
+Match *unreal_create_match(MatchType type, const char *str, char **error)
 {
 	Match *m = safe_alloc(sizeof(Match));
 	static char errorbuf[512];
@@ -489,10 +489,11 @@ char *unreal_match_method_valtostr(int val)
  * Moved here from the censor channel and user mode module
  * (previously was present in both modules, code duplication)
  */
-int fast_badword_match(ConfigItem_badword *badword, char *line)
+int fast_badword_match(ConfigItem_badword *badword, const char *line)
 {
-	char *p;
+	const char *p;
 	int bwlen = strlen(badword->word);
+
 	if ((badword->type & BADW_TYPE_FAST_L) && (badword->type & BADW_TYPE_FAST_R))
 		return (our_strcasestr(line, badword->word) ? 1 : 0);
 
@@ -523,15 +524,16 @@ next:
  * buf is used for the result and max is sizeof(buf).
  * Assumptions[!]: max > 0 AND max > strlen(line)+1
  */
-int fast_badword_replace(ConfigItem_badword *badword, char *line, char *buf, int max)
+int fast_badword_replace(ConfigItem_badword *badword, const char *line, char *buf, int max)
 {
 	/* Some aliases ;P */
 	char *replacew = badword->replace ? badword->replace : REPLACEWORD;
-	char *pold = line, *pnew = buf; /* Pointers to old string and new string */
-	char *poldx = line;
+	const char *pold = line; /* pointer to the old string */
+	const char *poldx = line;
+	char *pnew = buf; /* pointer to the new string */
 	int replacen = -1; /* Only calculated if needed. w00t! saves us a few nanosecs? lol */
 	int searchn = -1;
-	char *startw, *endw;
+	const char *startw, *endw; /* start and end of the word */
 	char *c_eol = buf + max - 1; /* Cached end of (new) line */
 	int run = 1;
 	int cleaned = 0;
@@ -744,10 +746,10 @@ const char *stripbadwords(const char *str, ConfigItem_badword *start_bw, int *bl
  * if check_broadness is 1, the function will attempt to determine
  * if the given regex string is too broad (i.e. matches everything)
  */
-char *badword_config_check_regex(char *str, int fastsupport, int check_broadness)
+const char *badword_config_check_regex(const char *str, int fastsupport, int check_broadness)
 {
 	int regex=0;
-	char *tmp;
+	const char *tmp;
 	static char errorbuf[512];
 
 	if (fastsupport)
@@ -788,9 +790,9 @@ char *badword_config_check_regex(char *str, int fastsupport, int check_broadness
 	return NULL;
 }
 
-int badword_config_process(ConfigItem_badword *ca, char *str)
+int badword_config_process(ConfigItem_badword *ca, const char *str)
 {
-	char *tmp;
+	const char *tmp;
 	short regex = 0;
 	int ast_l = 0, ast_r = 0;
 
diff --git a/src/modules/chanmodes/censor.c b/src/modules/chanmodes/censor.c
index 1f76da769..5ae21a850 100644
--- a/src/modules/chanmodes/censor.c
+++ b/src/modules/chanmodes/censor.c
@@ -121,7 +121,7 @@ int censor_config_test(ConfigFile *cf, ConfigEntry *ce, int type, int *errs)
 		}
 		if (!strcmp(cep->name, "word"))
 		{
-			char *errbuf;
+			const char *errbuf;
 			if (has_word)
 			{
 				config_warn_duplicate(cep->file->filename, 
diff --git a/src/modules/nick.c b/src/modules/nick.c
index 4d8004fb8..14ad80531 100644
--- a/src/modules/nick.c
+++ b/src/modules/nick.c
@@ -485,7 +485,8 @@ CMD_FUNC(cmd_uid)
 	char nick[NICKLEN + 1];
 	long lastnick = 0;
 	int differ = 1;
-	char *hostname, *username, *sstamp, *umodes, *virthost, *ip_raw, *ip=NULL, *realname;
+	char *hostname, *username, *sstamp, *umodes, *virthost, *ip_raw, *realname;
+	const char *ip = NULL;
 
 	if (parc < 13)
 	{
@@ -1244,7 +1245,7 @@ int AllowClient(Client *client)
 
 	if (IsSecure(client) && (iConf.outdated_tls_policy_user == POLICY_DENY) && outdated_tls_client(client))
 	{
-		char *msg = outdated_tls_client_build_string(iConf.outdated_tls_policy_user_message, client);
+		const char *msg = outdated_tls_client_build_string(iConf.outdated_tls_policy_user_message, client);
 		exit_client(client, NULL, msg);
 		return 0;
 	}
diff --git a/src/modules/tkl.c b/src/modules/tkl.c
index 69a9af6a2..49b9c852c 100644
--- a/src/modules/tkl.c
+++ b/src/modules/tkl.c
@@ -3828,7 +3828,7 @@ void _sendnotice_tkl_add(TKL *tkl)
 	char buf[512];
 	char set_at[128];
 	char expire_at[128];
-	char *tkl_type_str; /**< Eg: "K-Line" */
+	const char *tkl_type_str; /**< Eg: "K-Line" */
 
 	/* Don't show notices for temporary nick holds (issued by services) */
 	if (TKLIsNameBan(tkl) && tkl->ptr.nameban->hold)
@@ -3876,7 +3876,7 @@ void _sendnotice_tkl_del(char *removed_by, TKL *tkl)
 {
 	char buf[512];
 	char set_at[128];
-	char *tkl_type_str;
+	const char *tkl_type_str;
 
 	/* Don't show notices for temporary nick holds (issued by services) */
 	if (TKLIsNameBan(tkl) && tkl->ptr.nameban->hold)
diff --git a/src/modules/usermodes/censor.c b/src/modules/usermodes/censor.c
index 65aab1d7e..fa8f29158 100644
--- a/src/modules/usermodes/censor.c
+++ b/src/modules/usermodes/censor.c
@@ -102,7 +102,7 @@ int censor_config_test(ConfigFile *cf, ConfigEntry *ce, int type, int *errs)
 		}
 		if (!strcmp(cep->name, "word"))
 		{
-			char *errbuf;
+			const char *errbuf;
 			if (has_word)
 			{
 				config_warn_duplicate(cep->file->filename, 
diff --git a/src/numeric.c b/src/numeric.c
index 3c07b375c..ce4033c79 100644
--- a/src/numeric.c
+++ b/src/numeric.c
@@ -1047,7 +1047,7 @@ static char *replies[] = {
 /* 1000 */ NULL,
 };
 
-char *getreply(int numeric)
+const char *getreply(int numeric)
 {
 	if ((numeric < 0) || (numeric > 999) || !replies[numeric])
 		return replies[ERR_NUMERICERR];
diff --git a/src/send.c b/src/send.c
index 6b49da821..dded65846 100644
--- a/src/send.c
+++ b/src/send.c
@@ -64,7 +64,7 @@ MODVAR int  current_serial;
  * @param to		Client to mark as dead
  * @param notice	The quit reason to use
  */
-int dead_socket(Client *to, char *notice)
+int dead_socket(Client *to, const char *notice)
 {
 	DBufClear(&to->local->recvQ);
 	DBufClear(&to->local->sendQ);
@@ -644,7 +644,7 @@ void sendto_local_common_channels(Client *user, Client *skip, long clicap, Messa
 ** addition -- Armin, 8jun90 (gruner@informatik.tu-muenchen.de)
 */
 
-static int match_it(Client *one, char *mask, int what)
+static int match_it(Client *one, const char *mask, int what)
 {
 	switch (what)
 	{
@@ -666,7 +666,7 @@ static int match_it(Client *one, char *mask, int what)
  * @param pattern	Format string
  * @param ...		Parameters to the format string
  */
-void sendto_match_butone(Client *one, Client *from, char *mask, int what,
+void sendto_match_butone(Client *one, Client *from, const char *mask, int what,
                          MessageTag *mtags, FORMAT_STRING(const char *pattern), ...)
 {
 	va_list vl;
@@ -913,7 +913,7 @@ void sendto_snomask_global(int snomask, FORMAT_STRING(const char *pattern), ...)
  * @param add		Whether the CAP token is added (1) or removed (0)
  * @param token		The CAP token
  */
-void send_cap_notify(int add, char *token)
+void send_cap_notify(int add, const char *token)
 {
 	Client *client;
 	ClientCapability *clicap = ClientCapabilityFindReal(token);
@@ -1052,7 +1052,7 @@ void vsendto_prefix_one(Client *to, Client *from, MessageTag *mtags, const char
  * @param client Client to introduce
  * @param umodes User modes of client
  */
-void sendto_serv_butone_nickcmd(Client *one, MessageTag *mtags, Client *client, char *umodes)
+void sendto_serv_butone_nickcmd(Client *one, MessageTag *mtags, Client *client, const char *umodes)
 {
 	Client *acptr;
 
@@ -1070,7 +1070,7 @@ void sendto_serv_butone_nickcmd(Client *one, MessageTag *mtags, Client *client,
  * @param client  Client to introduce
  * @param umodes  User modes of client
  */
-void sendto_one_nickcmd(Client *server, MessageTag *mtags, Client *client, char *umodes)
+void sendto_one_nickcmd(Client *server, MessageTag *mtags, Client *client, const char *umodes)
 {
 	char *vhost;
 	char mtags_generated = 0;
diff --git a/src/serv.c b/src/serv.c
index 12dd70d1c..d70861e23 100644
--- a/src/serv.c
+++ b/src/serv.c
@@ -353,7 +353,7 @@ CMD_FUNC(cmd_credits)
 }
 
 /** Return flags for a client (connection), eg 's' for TLS - used in STATS L/l */
-char *get_client_status(Client *client)
+const char *get_client_status(Client *client)
 {
 	static char buf[10];
 	char *p = buf;
@@ -378,7 +378,7 @@ char *get_client_status(Client *client)
 	}
 	*p++ = ']';
 	*p++ = '\0';
-	return (buf);
+	return buf;
 }
 
 /** ERROR command - used by servers to indicate errors.
@@ -875,23 +875,29 @@ CMD_FUNC(cmd_die)
 PendingNet *pendingnet = NULL;
 
 /** Add server list (network) from 'client' connection */
-void add_pending_net(Client *client, char *str)
+void add_pending_net(Client *client, const char *str)
 {
 	PendingNet *net;
 	PendingServer *srv;
 	char *p, *name;
+	char buf[512];
 
 	if (BadPtr(str) || !client)
 		return;
 
+	/* Skip any * at the beginning (indicating a reply),
+	 * and work on a copy.
+	 */
+	if (*str == '*')
+		strlcpy(buf, str+1, sizeof(buf));
+	else
+		strlcpy(buf, str, sizeof(buf));
+
 	/* Allocate */
 	net = safe_alloc(sizeof(PendingNet));
 	net->client = client;
 
-	/* Fill in */
-	if (*str == '*')
-		str++;
-	for (name = strtoken(&p, str, ","); name; name = strtoken(&p, NULL, ","))
+	for (name = strtoken(&p, buf, ","); name; name = strtoken(&p, NULL, ","))
 	{
 		if (!*name)
 			continue;
@@ -928,7 +934,7 @@ void free_pending_net(Client *client)
 }
 
 /** Find SID in any server list (network) that is pending, except 'exempt' */
-PendingNet *find_pending_net_by_sid_butone(char *sid, Client *exempt)
+PendingNet *find_pending_net_by_sid_butone(const char *sid, Client *exempt)
 {
 	PendingNet *net;
 	PendingServer *srv;
@@ -1001,7 +1007,7 @@ Client *find_non_pending_net_duplicates(Client *client)
 }
 
 /** Parse CHANMODES= in PROTOCTL */
-void parse_chanmodes_protoctl(Client *client, char *str)
+void parse_chanmodes_protoctl(Client *client, const char *str)
 {
 	char *modes, *p;
 	char copy[256];
@@ -1038,7 +1044,7 @@ static int previous_langsinuse_ready = 0;
  */
 void charsys_check_for_changes(void)
 {
-	char *langsinuse = charsys_get_current_languages();
+	const char *langsinuse = charsys_get_current_languages();
 	/* already called by charsys_finish() */
 	safe_strdup(me.server->features.nickchars, langsinuse);
 
@@ -1063,9 +1069,9 @@ void charsys_check_for_changes(void)
 }
 
 /** Check if supplied server name is valid, that is: does not contain forbidden characters etc */
-int valid_server_name(char *name)
+int valid_server_name(const char *name)
 {
-	char *p;
+	const char *p;
 	int has_dot = 0;
 
 	if (!*name)
diff --git a/src/socket.c b/src/socket.c
index 139558d13..70bbee875 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -660,7 +660,7 @@ int is_loopback_ip(char *ip)
  * @param port		Remote port (will be written)
  * @returns The IP address
  */
-char *getpeerip(Client *client, int fd, int *port)
+const char *getpeerip(Client *client, int fd, int *port)
 {
 	static char ret[HOSTLEN+1];
 
@@ -723,7 +723,7 @@ static int check_too_many_unknown_connections(Client *client)
 Client *add_connection(ConfigItem_listen *listener, int fd)
 {
 	Client *client;
-	char *ip;
+	const char *ip;
 	int port = 0;
 	
 	client = make_client(NULL, &me);
@@ -1040,7 +1040,7 @@ void process_clients(void)
  * and 6 if 'str' is a valid IPv6 IP address.
  * Zero (0) is returned in any other case (eg: hostname).
  */
-int is_valid_ip(char *str)
+int is_valid_ip(const char *str)
 {
 	char scratch[64];
 	
@@ -1161,7 +1161,7 @@ int deliver_it(Client *client, char *str, int len, int *want_read)
 }
 
 /** Initiate an outgoing connection, the actual connect() call. */
-int unreal_connect(int fd, char *ip, int port, int ipv6)
+int unreal_connect(int fd, const char *ip, int port, int ipv6)
 {
 	int n;
 	
@@ -1197,7 +1197,7 @@ int unreal_connect(int fd, char *ip, int port, int ipv6)
 /** Bind to an IP/port (port may be 0 for auto).
  * @returns 0 on failure, other on success.
  */
-int unreal_bind(int fd, char *ip, int port, int ipv6)
+int unreal_bind(int fd, const char *ip, int port, int ipv6)
 {
 	if (ipv6)
 	{
diff --git a/src/support.c b/src/support.c
index c2243232b..5ee1d01ef 100644
--- a/src/support.c
+++ b/src/support.c
@@ -90,7 +90,7 @@ char *strtoken(char **save, char *str, char *fs)
  * @returns IP address as a string (IPv4 or IPv6, in case of the latter:
  *          always the uncompressed form without ::)
  */
-char *inetntop(int af, const void *in, char *out, size_t size)
+const char *inetntop(int af, const void *in, char *out, size_t size)
 {
 	char tmp[MYDUMMY_SIZE];
 
@@ -796,9 +796,9 @@ char *unreal_mktemp(const char *dir, const char *suffix)
 /** Returns the path portion of the given path/file
  * in the specified location (must be at least PATH_MAX bytes).
  */
-char *unreal_getpathname(char *filepath, char *path)
+char *unreal_getpathname(const char *filepath, char *path)
 {
-	char *end = filepath+strlen(filepath);
+	const char *end = filepath+strlen(filepath);
 
 	while (*end != '\\' && *end != '/' && end > filepath)
 		end--;
@@ -1056,7 +1056,7 @@ time_t unreal_getfilemodtime(const char *filename)
 #endif
 
 /** Encode an IP string (eg: "1.2.3.4") to a BASE64 encoded value for S2S traffic */
-char *encode_ip(const char *ip)
+const char *encode_ip(const char *ip)
 {
 	static char retbuf[25]; /* returned string */
 	char addrbuf[16];
@@ -1089,7 +1089,7 @@ char *encode_ip(const char *ip)
 }
 
 /** Decode a BASE64 encoded string to an IP address string. Used for S2S traffic. */
-char *decode_ip(const char *buf)
+const char *decode_ip(const char *buf)
 {
 	int n;
 	char targ[25];
diff --git a/src/tls.c b/src/tls.c
index ce6632bea..417d9d858 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -87,7 +87,7 @@ LRESULT TLS_key_passwd_dialog(HWND hDlg, UINT Message, WPARAM wParam, LPARAM lPa
  * @param my_errno	The value of errno to use in case we want to call strerror().
  * @returns Error string, only valid until next call to this function.
  */
-char *ssl_error_str(int err, int my_errno)
+const char *ssl_error_str(int err, int my_errno)
 {
 	static char ssl_errbuf[256];
 	char *ssl_errstr = NULL;
@@ -857,7 +857,7 @@ static int fatal_tls_error(int ssl_error, int where, int my_errno, Client *clien
 {
 	/* don`t alter ERRNO */
 	int errtmp = ERRNO;
-	char *ssl_errstr, *ssl_func;
+	const char *ssl_errstr, *ssl_func;
 	unsigned long additional_errno = ERR_get_error();
 	char additional_info[256];
 	char buf[512];
@@ -1021,7 +1021,7 @@ TLSOptions *FindTLSOptionsForUser(Client *client)
  * @param errstr: Error will be stored in here (optional)
  * @returns Returns 1 on success and 0 on error.
  */
-int verify_certificate(SSL *ssl, char *hostname, char **errstr)
+int verify_certificate(SSL *ssl, const char *hostname, char **errstr)
 {
 	static char buf[512];
 	X509 *cert;
@@ -1086,7 +1086,7 @@ int verify_certificate(SSL *ssl, char *hostname, char **errstr)
 }
 
 /** Grab the certificate name */
-char *certificate_name(SSL *ssl)
+const char *certificate_name(SSL *ssl)
 {
 	static char buf[384];
 	X509 *cert;
@@ -1232,7 +1232,7 @@ int certificate_quality_check(SSL_CTX *ctx, char **errstr)
 	return 1;
 }
 
-char *spki_fingerprint_ex(X509 *x509_cert);
+const char *spki_fingerprint_ex(X509 *x509_cert);
 
 /** Return the SPKI Fingerprint for a client.
  *
@@ -1241,10 +1241,10 @@ char *spki_fingerprint_ex(X509 *x509_cert);
  * openssl dgst -sha256 -binary public.key | openssl enc -base64
  * ( from https://tools.ietf.org/html/draft-ietf-websec-key-pinning-21#appendix-A )
  */
-char *spki_fingerprint(Client *cptr)
+const char *spki_fingerprint(Client *cptr)
 {
 	X509 *x509_cert = NULL;
-	char *ret;
+	const char *ret;
 
 	if (!MyConnect(cptr) || !cptr->local->ssl)
 		return NULL;
@@ -1257,7 +1257,7 @@ char *spki_fingerprint(Client *cptr)
 	return ret;
 }
 
-char *spki_fingerprint_ex(X509 *x509_cert)
+const char *spki_fingerprint_ex(X509 *x509_cert)
 {
 	unsigned char *der_cert = NULL, *p;
 	int der_cert_len, n;
@@ -1318,7 +1318,7 @@ int outdated_tls_client(Client *client)
 }
 
 /** Returns the expanded string used for set::outdated-tls-policy::user-message etc. */
-char *outdated_tls_client_build_string(char *pattern, Client *client)
+const char *outdated_tls_client_build_string(const char *pattern, Client *client)
 {
 	static char buf[512];
 	const char *name[3], *value[3];