--- a/src/context.cpp	Wed Apr 30 13:11:32 2008 -0700
+++ b/src/context.cpp	Tue Jun 10 08:58:42 2008 -0700
@@ -18,52 +18,53 @@
 #include <sys/stat.h>
 #include <sys/un.h>
 #include <unistd.h>
+#include <climits>
 
-char *token_autowhite;
-char *token_black;
-char *token_cctld;
-char *token_content;
-char *token_context;
-char *token_dccbulk;
-char *token_dccfrom;
-char *token_dccgrey;
-char *token_dccto;
-char *token_default;
-char *token_dnsbl;
-char *token_dnsbll;
-char *token_envfrom;
-char *token_envto;
-char *token_filter;
-char *token_generic;
-char *token_host_limit;
-char *token_html_limit;
-char *token_html_tags;
-char *token_ignore;
-char *token_include;
-char *token_inherit;
-char *token_lbrace;
-char *token_mailhost;
-char *token_many;
-char *token_no;
-char *token_off;
-char *token_ok;
-char *token_ok2;
-char *token_on;
-char *token_rate;
-char *token_rbrace;
-char *token_require;
-char *token_semi;
-char *token_soft;
-char *token_spamassassin;
-char *token_substitute;
-char *token_tld;
-char *token_unknown;
-char *token_uribl;
-char *token_verify;
-char *token_white;
-char *token_yes;
+const char *token_autowhite;
+const char *token_black;
+const char *token_cctld;
+const char *token_content;
+const char *token_context;
+const char *token_dccbulk;
+const char *token_dccfrom;
+const char *token_dccgrey;
+const char *token_dccto;
+const char *token_default;
+const char *token_dnsbl;
+const char *token_dnsbll;
+const char *token_envfrom;
+const char *token_envto;
+const char *token_filter;
+const char *token_generic;
+const char *token_host_limit;
+const char *token_html_limit;
+const char *token_html_tags;
+const char *token_ignore;
+const char *token_include;
+const char *token_inherit;
+const char *token_lbrace;
+const char *token_mailhost;
+const char *token_many;
+const char *token_no;
+const char *token_off;
+const char *token_ok;
+const char *token_ok2;
+const char *token_on;
+const char *token_rate;
+const char *token_rbrace;
+const char *token_require;
+const char *token_semi;
+const char *token_soft;
+const char *token_spamassassin;
+const char *token_substitute;
+const char *token_tld;
+const char *token_unknown;
+const char *token_uribl;
+const char *token_verify;
+const char *token_white;
+const char *token_yes;
 
-char *token_myhostname;
+const char *token_myhostname;
 #ifndef HOST_NAME_MAX
     #define HOST_NAME_MAX 255
 #endif
@@ -174,7 +175,7 @@
 }
 
 
-int SMTP::cmd(char *c) {
+int SMTP::cmd(const char *c) {
     if (c) {
         init();
         append(c);
@@ -201,7 +202,7 @@
 }
 
 
-int SMTP::from(char *f) {
+int SMTP::from(const char *f) {
     // the mail from address was originally passed in from sendmail enclosed in
     // <>. to_lower_string() removed the <> and converted the rest to lowercase,
     // except in the case of an empty return path, which was left as the two
@@ -219,7 +220,7 @@
 }
 
 
-int SMTP::rcpt(char *t) {
+int SMTP::rcpt(const char *t) {
     init();
     append("RCPT TO:<");
     append(t);
@@ -240,14 +241,14 @@
 
 
 #ifdef VERIFY_DEBUG
-    void SMTP::log(char *m, int v) {
+    void SMTP::log(const char *m, int v) {
         char buf[maxlen];
         snprintf(buf, maxlen, m, v);
         my_syslog(buf);
     }
 
 
-    void SMTP::log(char *m, char *v) {
+    void SMTP::log(const char *m, const char *v) {
         char buf[maxlen];
         snprintf(buf, maxlen, m, v);
         my_syslog(buf);
@@ -258,7 +259,7 @@
 ////////////////////////////////////////////////
 // smtp verifier so backup mx machines can see the valid users
 //
-VERIFY::VERIFY(char *h) {
+VERIFY::VERIFY(const char *h) {
     host     = h;
     last_err = 0;
     pthread_mutex_init(&mutex, 0);
@@ -364,7 +365,7 @@
 }
 
 
-bool VERIFY::ok(char *from, char *to) {
+bool VERIFY::ok(const char *from, const char *to) {
     if (host == token_myhostname) return true;
     SMTP *conn = get_connection();
     if (!conn) return true;    // cannot verify right now, we have socket errors
@@ -390,8 +391,8 @@
 ////////////////////////////////////////////////
 // setup a new smtp verify host
 //
-VERIFYP add_verify_host(char *host);
-VERIFYP add_verify_host(char *host) {
+VERIFYP add_verify_host(const char *host);
+VERIFYP add_verify_host(const char *host) {
     VERIFYP rc = NULL;
     pthread_mutex_lock(&verifier_mutex);
         verify_map::iterator i = verifiers.find(host);
@@ -425,7 +426,7 @@
 ////////////////////////////////////////////////
 // automatic whitelister
 //
-WHITELISTER::WHITELISTER(char *f, int d) {
+WHITELISTER::WHITELISTER(const char *f, int d) {
     fn       = f;
     days     = d;
     pthread_mutex_init(&mutex, 0);
@@ -482,8 +483,8 @@
         for (autowhite_sent::iterator i=rcpts.begin(); i!=rcpts.end();) {
             time_t when = (*i).second;
             if (when < limit) {
-                char *who = (*i).first;
-                free(who);
+                const char *who = (*i).first;
+                free((void*)who);
                 rcpts.erase(i++);
                 need = true;
             }
@@ -496,7 +497,7 @@
             ofs.open(fn);
             if (!ofs.fail()) {
                 for (autowhite_sent::iterator i=rcpts.begin(); i!=rcpts.end(); i++) {
-                    char *who = (*i).first;
+                    const char *who = (*i).first;
                     int  when = (*i).second;
                     if (!strchr(who, ' ')) {
                         ofs << who << " " << when << endl;
@@ -511,7 +512,7 @@
 }
 
 
-void WHITELISTER::sent(char *to) {
+void WHITELISTER::sent(const char *to) {
     // we take ownership of the string
     pthread_mutex_lock(&mutex);
         need = true;
@@ -521,13 +522,13 @@
         }
         else {
             (*i).second = time(NULL);
-            free(to);
+            free((void*)to);
         }
     pthread_mutex_unlock(&mutex);
 }
 
 
-bool WHITELISTER::is_white(char *from) {
+bool WHITELISTER::is_white(const char *from) {
     pthread_mutex_lock(&mutex);
         autowhite_sent::iterator i = rcpts.find(from);
         bool rc = (i != rcpts.end());
@@ -539,8 +540,8 @@
 ////////////////////////////////////////////////
 // setup a new auto whitelister file
 //
-WHITELISTERP add_whitelister_file(char *fn, int days);
-WHITELISTERP add_whitelister_file(char *fn, int days) {
+WHITELISTERP add_whitelister_file(const char *fn, int days);
+WHITELISTERP add_whitelister_file(const char *fn, int days) {
     WHITELISTERP rc = NULL;
     pthread_mutex_lock(&whitelister_mutex);
         whitelister_map::iterator i = whitelisters.find(fn);
@@ -574,14 +575,14 @@
 }
 
 
-DELAYWHITE::DELAYWHITE(char *loto_, WHITELISTERP w_, CONTEXTP con_) {
+DELAYWHITE::DELAYWHITE(const char *loto_, WHITELISTERP w_, CONTEXTP con_) {
     loto = loto_;
     w    = w_;
     con  = con_;
 }
 
 
-DNSBL::DNSBL(char *n, char *s, char *m) {
+DNSBL::DNSBL(const char *n, const char *s, const char *m) {
     name    = n;
     suffix  = s;
     message = m;
@@ -625,7 +626,7 @@
 }
 
 
-void CONFIG::add_to(char *to, CONTEXTP con) {
+void CONFIG::add_to(const char *to, CONTEXTP con) {
     context_map::iterator i = env_to.find(to);
     if (i != env_to.end()) {
         CONTEXTP  c = (*i).second;
@@ -633,8 +634,8 @@
             if (debug_syslog) {
                 char oldname[maxlen];
                 char newname[maxlen];
-                char *oldn = c->get_full_name(oldname, maxlen);
-                char *newn = con->get_full_name(newname, maxlen);
+                const char *oldn = c->get_full_name(oldname, maxlen);
+                const char *newn = con->get_full_name(newname, maxlen);
                 char buf[maxlen*3];
                 snprintf(buf, maxlen*3, "both %s and %s claim envelope to %s, the second one wins", oldn, newn, to);
                 my_syslog(buf);
@@ -645,18 +646,19 @@
 }
 
 
-CONTEXTP CONFIG::find_context(char *to) {
+CONTEXTP CONFIG::find_context(const char *to) {
     context_map::iterator i = env_to.find(to);
     if (i != env_to.end()) return (*i).second;      // found user@domain key
-    char *x = strchr(to, '@');
+    const char *x = strchr(to, '@');
     if (x) {
         x++;
         i = env_to.find(x);
         if (i != env_to.end()) return (*i).second;  // found domain key
-        char y = *x;
-        *x = '\0';
-        i = env_to.find(to);
-        *x = y;
+        size_t len = x - to;
+        char user[len+1];
+        memcpy(user, to, len);
+        user[len] = '\0';
+        i = env_to.find(user);
         if (i != env_to.end()) return (*i).second;  // found user@ key
     }
     return default_context;
@@ -673,7 +675,7 @@
     }
     char buf[maxlen];
     for (context_map::iterator i=env_to.begin(); i!=env_to.end(); i++) {
-        char     *to = (*i).first;
+        const char *to = (*i).first;
         CONTEXTP con = (*i).second;
         printf("// envelope to %s \t-> context %s \n", to, con->get_full_name(buf,maxlen));
     }
@@ -683,7 +685,7 @@
 }
 
 
-CONTEXT::CONTEXT(CONTEXTP parent_, char *name_) {
+CONTEXT::CONTEXT(CONTEXTP parent_, const char *name_) {
     parent              = parent_;
     name                = name_;
     verify_host         = NULL;
@@ -728,7 +730,7 @@
 }
 
 
-char *CONTEXT::get_full_name(char *buffer, int size) {
+const char *CONTEXT::get_full_name(char *buffer, int size) {
     if (!parent) return name;
     char buf[maxlen];
     snprintf(buffer, size, "%s.%s", parent->get_full_name(buf, maxlen), name);
@@ -736,7 +738,7 @@
 }
 
 
-bool CONTEXT::set_generic(char *regx, char *msg)
+bool CONTEXT::set_generic(const char *regx, const char *msg)
 {
     int rc = 0;
     if (generic_regx) regfree(&generic_pattern);
@@ -749,7 +751,7 @@
 }
 
 
-char *CONTEXT::generic_match(char *client)
+const char *CONTEXT::generic_match(const char *client)
 {
     if (!client) return NULL;   // allow missing _ macro, which will disable generic checking
     if (parent && !generic_regx) return parent->generic_match(client);
@@ -761,9 +763,8 @@
 }
 
 
-bool CONTEXT::cover_env_to(char *to) {
-    char buffer[maxlen];
-    char *x = strchr(to, '@');
+bool CONTEXT::cover_env_to(const char *to) {
+    const char *x = strchr(to, '@');
     if (x) x++;
     else   x = to;
     if (*x == '\0') return true;                // always allow covering addresses with no domain name, eg abuse@
@@ -778,7 +779,7 @@
 }
 
 
-VERIFYP CONTEXT::find_verify(char *to) {
+VERIFYP CONTEXT::find_verify(const char *to) {
     if (verifier && (verify_host != token_myhostname) && cover_env_to(to))
         return verifier;
     else if (parent)
@@ -788,7 +789,7 @@
 }
 
 
-WHITELISTERP CONTEXT::find_autowhite(char *from, char *to) {
+WHITELISTERP CONTEXT::find_autowhite(const char *from, const char *to) {
     if (whitelister && cover_env_to(to) && !cover_env_to(from))
         return whitelister;
     else if (parent)
@@ -798,14 +799,14 @@
 }
 
 
-int CONTEXT::find_rate(char *user) {
+int CONTEXT::find_rate(const char *user) {
     if (rcpt_per_hour.empty()) return default_rcpt_rate;
     rcpt_rates::iterator i = rcpt_per_hour.find(user);
     return (i == rcpt_per_hour.end()) ? default_rcpt_rate : (*i).second;
 }
 
 
-char *CONTEXT::find_from(char *from, bool update_white) {
+const char *CONTEXT::find_from(const char *from, bool update_white) {
     WHITELISTERP w = whitelister;
     CONTEXTP     p = parent;
     while (!w && p) {
@@ -825,7 +826,7 @@
         }
         return token_white;
     }
-    char *rc = env_from_default;
+    const char *rc = env_from_default;
     string_map::iterator i = env_from.find(from);
     if (i != env_from.end()) rc = (*i).second;  // found user@domain key
     else {
@@ -848,7 +849,7 @@
 }
 
 
-CONTEXTP CONTEXT::find_context(char *from) {
+CONTEXTP CONTEXT::find_context(const char *from) {
     context_map::iterator i = env_from_context.find(from);
     if (i != env_from_context.end()) return (*i).second;        // found user@domain key
     char *x = strchr(from, '@');
@@ -866,14 +867,14 @@
 }
 
 
-CONTEXTP CONTEXT::find_from_context_name(char *name) {
+CONTEXTP CONTEXT::find_from_context_name(const char *name) {
     context_map::iterator i = children.find(name);
     if (i != children.end()) return (*i).second;
     return NULL;
 }
 
 
-DNSBLP CONTEXT::find_dnsbl(char *name) {
+DNSBLP CONTEXT::find_dnsbl(const char *name) {
     dnsblp_map::iterator i = dnsbl_names.find(name);
     if (i != dnsbl_names.end()) return (*i).second;
     if (parent) return parent->find_dnsbl(name);
@@ -881,25 +882,25 @@
 }
 
 
-char* CONTEXT::get_content_suffix() {
+const char* CONTEXT::get_content_suffix() {
     if (!content_suffix && parent) return parent->get_content_suffix();
     return content_suffix;
 }
 
 
-char* CONTEXT::get_uribl_suffix() {
+const char* CONTEXT::get_uribl_suffix() {
     if (!uribl_suffix && parent) return parent->get_uribl_suffix();
     return uribl_suffix;
 }
 
 
-char* CONTEXT::get_content_message() {
+const char* CONTEXT::get_content_message() {
     if (!content_message && parent) return parent->get_content_message();
     return content_message;
 }
 
 
-char* CONTEXT::get_uribl_message() {
+const char* CONTEXT::get_uribl_message() {
     if (!uribl_message && parent) return parent->get_uribl_message();
     return uribl_message;
 }
@@ -965,11 +966,11 @@
     memset(indent, ' ', i);
     indent[i] = '\0';
     char buf[maxlen];
-    char *fullname = get_full_name(buf,maxlen);
+    const char *fullname = get_full_name(buf,maxlen);
     printf("%s context %s { \t// %s\n", indent, name, fullname);
 
     for (dnsblp_map::iterator i=dnsbl_names.begin(); i!=dnsbl_names.end(); i++) {
-        char *n = (*i).first;
+        const char *n = (*i).first;
         DNSBL &d = *(*i).second;
         printf("%s     dnsbl %s %s \"%s\"; \n", indent, n, d.suffix, d.message);
     }
@@ -985,7 +986,7 @@
     }
 
     if (content_filtering) {
-        printf("%s     content on { \n", indent, env_from_default);
+        printf("%s     content on { \n", indent);
         if (content_suffix) {
             printf("%s         filter %s \"%s\"; \n", indent, content_suffix, content_message);
         }
@@ -1048,7 +1049,7 @@
         spamass |= (spamassassin_limit != 0);
         }
     else {
-        printf("%s     content off {}; \n", indent, env_from_default);
+        printf("%s     content off {}; \n", indent);
     }
 
     printf("%s     env_to { \t// %s\n", indent, fullname);
@@ -1079,15 +1080,15 @@
     if (!env_from.empty()) {
         printf("%s     // white/black/unknown \n", indent);
         for (string_map::iterator i=env_from.begin(); i!=env_from.end(); i++) {
-            char *f = (*i).first;
-            char *t = (*i).second;
+            const char *f = (*i).first;
+            const char *t = (*i).second;
             printf("%s         %s \t%s; \n", indent, f, t);
         }
     }
     if (!env_from_context.empty()) {
         printf("%s     // child contexts \n", indent);
         for (context_map::iterator j=env_from_context.begin(); j!=env_from_context.end(); j++) {
-            char    *f = (*j).first;
+            const char    *f = (*j).first;
             CONTEXTP t = (*j).second;
             printf("%s         %s \t%s; \n", indent, f, t->name);
         }
@@ -1097,7 +1098,7 @@
     if (isdefault) {
         printf("%s     rate_limit %d { \n", indent, default_rcpt_rate);
         for (rcpt_rates::iterator j=rcpt_per_hour.begin(); j!=rcpt_per_hour.end(); j++) {
-            char    *u = (*j).first;
+            const char *u = (*j).first;
             int      l = (*j).second;
             printf("%s         \"%s\" \t%d; \n", indent, u, l);
         }
@@ -1113,7 +1114,7 @@
 //
 void discard(string_set &s) {
     for (string_set::iterator i=s.begin(); i!=s.end(); i++) {
-        free(*i);
+        free((void*)*i);
     }
     s.clear();
 }
@@ -1122,7 +1123,7 @@
 ////////////////////////////////////////////////
 // helper to register a string in a string set
 //
-char* register_string(string_set &s, char *name) {
+const char* register_string(string_set &s, const char *name) {
     string_set::iterator i = s.find(name);
     if (i != s.end()) return *i;
     char *x = strdup(name);
@@ -1134,7 +1135,7 @@
 ////////////////////////////////////////////////
 // register a global string
 //
-char* register_string(char *name) {
+const char* register_string(const char *name) {
     return register_string(all_strings, name);
 }
 
@@ -1149,9 +1150,9 @@
 
 ////////////////////////////////////////////////
 //
-bool tsa(TOKEN &tok, char *token);
-bool tsa(TOKEN &tok, char *token) {
-    char *have = tok.next();
+bool tsa(TOKEN &tok, const char *token);
+bool tsa(TOKEN &tok, const char *token) {
+    const char *have = tok.next();
     if (have == token) return true;
     tok.token_error(token, have);
     return false;
@@ -1162,9 +1163,9 @@
 //
 bool parse_dnsbl(TOKEN &tok, CONFIG &dc, CONTEXT &me);
 bool parse_dnsbl(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
-    char *name = tok.next();
-    char *suf = tok.next();
-    char *msg = tok.next();
+    const char *name = tok.next();
+    const char *suf  = tok.next();
+    const char *msg  = tok.next();
     if (!tsa(tok, token_semi)) return false;
     DNSBLP dnsnew = new DNSBL(name, suf, msg);
     DNSBLP dnsold = me.find_dnsbl(name);
@@ -1183,7 +1184,7 @@
 bool parse_dnsbll(TOKEN &tok, CONFIG &dc, CONTEXT &me);
 bool parse_dnsbll(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
     while (true) {
-        char *have = tok.next();
+        const char *have = tok.next();
         if (!have) break;
         if (have == token_semi) break;
         DNSBLP dns = me.find_dnsbl(have);
@@ -1203,7 +1204,7 @@
 //
 bool parse_content(TOKEN &tok, CONFIG &dc, CONTEXT &me);
 bool parse_content(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
-    char *setting = tok.next();
+    const char *setting = tok.next();
     if (setting == token_on) {
         me.set_content_filtering(true);
     }
@@ -1216,18 +1217,18 @@
     }
     if (!tsa(tok, token_lbrace)) return false;
     while (true) {
-        char *have = tok.next();
+        const char *have = tok.next();
         if (!have) break;
         if (have == token_filter) {
-            char *suffix = tok.next();
-            char *messag = tok.next();
+            const char *suffix = tok.next();
+            const char *messag = tok.next();
             me.set_content_suffix(suffix);
             me.set_content_message(messag);
             if (!tsa(tok, token_semi)) return false;
         }
         else if (have == token_uribl) {
-            char *suffix = tok.next();
-            char *messag = tok.next();
+            const char *suffix = tok.next();
+            const char *messag = tok.next();
             me.set_uribl_suffix(suffix);
             me.set_uribl_message(messag);
             if (!tsa(tok, token_semi)) return false;
@@ -1236,7 +1237,7 @@
             if (!tsa(tok, token_lbrace)) return false;
             while (true) {
                 if (!have) break;
-                char *have = tok.next();
+                const char *have = tok.next();
                 if (have == token_rbrace) break;  // done
                 me.add_ignore(have);
             }
@@ -1245,7 +1246,7 @@
         else if (have == token_tld) {
             if (!tsa(tok, token_lbrace)) return false;
             while (true) {
-                char *have = tok.next();
+                const char *have = tok.next();
                 if (!have) break;
                 if (have == token_rbrace) break;  // done
                 me.add_tld(have);
@@ -1255,7 +1256,7 @@
         else if (have == token_cctld) {
             if (!tsa(tok, token_lbrace)) return false;
             while (true) {
-                char *have = tok.next();
+                const char *have = tok.next();
                 if (!have) break;
                 if (have == token_rbrace) break;  // done
                 me.add_cctld(have);
@@ -1265,7 +1266,7 @@
         else if (have == token_html_tags) {
             if (!tsa(tok, token_lbrace)) return false;
             while (true) {
-                char *have = tok.next();
+                const char *have = tok.next();
                 if (!have) break;
                 if (have == token_rbrace) {
                     break;  // done
@@ -1377,18 +1378,18 @@
 bool parse_envto(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
     if (!tsa(tok, token_lbrace)) return false;
     while (true) {
-        char *have = tok.next();
+        const char *have = tok.next();
         if (!have) break;
         if (have == token_rbrace) break;
         if (have == token_semi) {
             // optional separators
         }
         else if (have == token_dccto) {
-            char *flavor = tok.next();
+            const char *flavor = tok.next();
             if (!tsa(tok, token_lbrace)) return false;
             bool keeping = false;
             while (true) {
-                char *have = tok.next();
+                const char *have = tok.next();
                 if (!have) break;
                 if (have == token_rbrace) break;
                 if (have == flavor) {
@@ -1439,7 +1440,7 @@
 //
 bool parse_verify(TOKEN &tok, CONFIG &dc, CONTEXT &me);
 bool parse_verify(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
-    char *host = tok.next();
+    const char *host = tok.next();
     if (!tsa(tok, token_semi)) return false;
     me.set_verify(host);
     me.set_verifier(add_verify_host(host));
@@ -1451,8 +1452,8 @@
 //
 bool parse_generic(TOKEN &tok, CONFIG &dc, CONTEXT &me);
 bool parse_generic(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
-    char *regx = tok.next();
-    char *msg  = tok.next();
+    const char *regx = tok.next();
+    const char *msg  = tok.next();
     if (!tsa(tok, token_semi)) return false;
     if (me.set_generic(regx, msg)) {
         tok.token_error("invalid regular expression %s", regx, regx);
@@ -1467,7 +1468,7 @@
 bool parse_autowhite(TOKEN &tok, CONFIG &dc, CONTEXT &me);
 bool parse_autowhite(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
     int days = tok.nextint();
-    char *fn = tok.next();
+    const char *fn = tok.next();
     if (!tsa(tok, token_semi)) return false;
     me.set_autowhite(fn);
     me.set_whitelister(add_whitelister_file(fn, days));
@@ -1479,7 +1480,7 @@
 //
 bool parse_envfrom(TOKEN &tok, CONFIG &dc, CONTEXT &me);
 bool parse_envfrom(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
-    char *st = tok.next();
+    const char *st = tok.next();
     if ((st == token_black) || (st == token_white) || (st == token_unknown) || (st == token_inherit)) {
         me.set_from_default(st);
     }
@@ -1488,7 +1489,7 @@
     }
     if (!tsa(tok, token_lbrace)) return false;
     while (true) {
-        char *have = tok.next();
+        const char *have = tok.next();
         if (!have) break;
         if (have == token_rbrace) break;
         if (have == token_semi) {
@@ -1499,7 +1500,7 @@
             bool keeping = false;
             bool many = false;
             while (true) {
-                char *have = tok.next();
+                const char *have = tok.next();
                 if (!have) break;
                 if (have == token_rbrace) break;
                 if (have == token_ok) {
@@ -1533,7 +1534,7 @@
         }
         else {
             // may be a valid email address or domain name
-            char *st = tok.next();
+            const char *st = tok.next();
             if ((st == token_white) || (st == token_black) || (st == token_unknown) || (st == token_inherit)) {
                 me.add_from(have, st);
             }
@@ -1557,12 +1558,12 @@
 //
 bool parse_rate(TOKEN &tok, CONFIG &dc, CONTEXT &me);
 bool parse_rate(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
-    char *def = tok.next();
+    const char *def = tok.next();
     tok.push(def);
     if (def != token_lbrace) me.set_default_rate(tok.nextint());
     if (!tsa(tok, token_lbrace)) return false;
     while (true) {
-        char *have = tok.next();
+        const char *have = tok.next();
         if (!have) break;
         if (have == token_rbrace) break;
         if (have == token_semi) {
@@ -1580,12 +1581,12 @@
 //
 bool parse_context(TOKEN &tok, CONFIG &dc, CONTEXTP parent);
 bool parse_context(TOKEN &tok, CONFIG &dc, CONTEXTP parent) {
-    char *name = tok.next();
+    const char *name = tok.next();
     if (!tsa(tok, token_lbrace)) return false;
     CONTEXTP con = new CONTEXT(parent, name);
 
     while (true) {
-        char *have = tok.next();
+        const char *have = tok.next();
         if (!have) break;
         if (have == token_rbrace) break;  // done
         if (have == token_dnsbl) {
@@ -1638,11 +1639,11 @@
 ////////////////////////////////////////////////
 // parse a config file
 //
-bool load_conf(CONFIG &dc, char *fn) {
+bool load_conf(CONFIG &dc, const char *fn) {
     int count = 0;
     TOKEN tok(fn, &dc.config_files);
     while (true) {
-        char *have = tok.next();
+        const char *have = tok.next();
         if (!have) break;
         if (have == token_context) {
             if (!parse_context(tok, dc, NULL)) {