More const fixes for compiler warnings from the waf build.

27 files changed, 122 insertions, 114 deletions

diff --git a/nsswitch/libwbclient/tests/wbclient.c b/nsswitch/libwbclient/tests/wbclient.c
index c6ee5314817..12fc31ea5e3 100644
--- a/nsswitch/libwbclient/tests/wbclient.c
+++ b/nsswitch/libwbclient/tests/wbclient.c
@@ -395,7 +395,7 @@ static bool test_wbc_lookup_rids(struct torture_context *tctx)
 	torture_assert_str_equal(
 		tctx, names[1], "Users", "S-1-5-32-545 not mapped to 'Users'");
 
-	wbcFreeMemory((char *)domain_name);
+	wbcFreeMemory(discard_const_p(char ,domain_name));
 	wbcFreeMemory(names);
 	wbcFreeMemory(types);
 
diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c
index 7005c25fae4..a385e744cc7 100644
--- a/nsswitch/pam_winbind.c
+++ b/nsswitch/pam_winbind.c
@@ -412,51 +412,51 @@ static int _pam_parse(const pam_handle_t *pamh,
 		config_file = PAM_WINBIND_CONFIG_FILE;
 	}
 
-	d = iniparser_load(CONST_DISCARD(char *, config_file));
+	d = iniparser_load(discard_const_p(char, config_file));
 	if (d == NULL) {
 		goto config_from_pam;
 	}
 
-	if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:debug"), false)) {
+	if (iniparser_getboolean(d, discard_const_p(char, "global:debug"), false)) {
 		ctrl |= WINBIND_DEBUG_ARG;
 	}
 
-	if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:debug_state"), false)) {
+	if (iniparser_getboolean(d, discard_const_p(char, "global:debug_state"), false)) {
 		ctrl |= WINBIND_DEBUG_STATE;
 	}
 
-	if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:cached_login"), false)) {
+	if (iniparser_getboolean(d, discard_const_p(char, "global:cached_login"), false)) {
 		ctrl |= WINBIND_CACHED_LOGIN;
 	}
 
-	if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:krb5_auth"), false)) {
+	if (iniparser_getboolean(d, discard_const_p(char, "global:krb5_auth"), false)) {
 		ctrl |= WINBIND_KRB5_AUTH;
 	}
 
-	if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:silent"), false)) {
+	if (iniparser_getboolean(d, discard_const_p(char, "global:silent"), false)) {
 		ctrl |= WINBIND_SILENT;
 	}
 
-	if (iniparser_getstr(d, CONST_DISCARD(char *, "global:krb5_ccache_type")) != NULL) {
+	if (iniparser_getstr(d, discard_const_p(char, "global:krb5_ccache_type")) != NULL) {
 		ctrl |= WINBIND_KRB5_CCACHE_TYPE;
 	}
 
-	if ((iniparser_getstr(d, CONST_DISCARD(char *, "global:require-membership-of"))
+	if ((iniparser_getstr(d, discard_const_p(char, "global:require-membership-of"))
 	     != NULL) ||
-	    (iniparser_getstr(d, CONST_DISCARD(char *, "global:require_membership_of"))
+	    (iniparser_getstr(d, discard_const_p(char, "global:require_membership_of"))
 	     != NULL)) {
 		ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
 	}
 
-	if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:try_first_pass"), false)) {
+	if (iniparser_getboolean(d, discard_const_p(char, "global:try_first_pass"), false)) {
 		ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
 	}
 
-	if (iniparser_getint(d, CONST_DISCARD(char *, "global:warn_pwd_expire"), 0)) {
+	if (iniparser_getint(d, discard_const_p(char, "global:warn_pwd_expire"), 0)) {
 		ctrl |= WINBIND_WARN_PWD_EXPIRE;
 	}
 
-	if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:mkhomedir"), false)) {
+	if (iniparser_getboolean(d, discard_const_p(char, "global:mkhomedir"), false)) {
 		ctrl |= WINBIND_MKHOMEDIR;
 	}
 
@@ -1764,7 +1764,7 @@ static int winbind_auth_request(struct pwb_context *ctx,
 					     &logon.blobs,
 					     "krb5_cc_type",
 					     0,
-					     (uint8_t *)cctype,
+					     discard_const_p(uint8_t, cctype),
 					     strlen(cctype)+1);
 		if (!WBC_ERROR_IS_OK(wbc_status)) {
 			goto done;
@@ -2514,7 +2514,7 @@ static int _pam_delete_cred(pam_handle_t *pamh, int flags,
 						     &logoff.blobs,
 						     "ccfilename",
 						     0,
-						     (uint8_t *)ccname,
+						     discard_const_p(uint8_t, ccname),
 						     strlen(ccname)+1);
 			if (!WBC_ERROR_IS_OK(wbc_status)) {
 				goto out;
diff --git a/source3/include/libsmb_internal.h b/source3/include/libsmb_internal.h
index 61dc95e0ad6..7f16ab6859b 100644
--- a/source3/include/libsmb_internal.h
+++ b/source3/include/libsmb_internal.h
@@ -366,7 +366,7 @@ SMBC_close_ctx(SMBCCTX *context,
 bool
 SMBC_getatr(SMBCCTX * context,
             SMBCSRV *srv,
-            char *path,
+            const char *path,
             uint16 *mode,
             SMB_OFF_T *size,
             struct timespec *create_time_ts,
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 2305a7ac687..60a34d1164f 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -649,7 +649,7 @@ void smb_panic_s3(const char *why);
 void log_stack_trace(void);
 const char *readdirname(SMB_STRUCT_DIR *p);
 bool is_in_path(const char *name, name_compare_entry *namelist, bool case_sensitive);
-void set_namearray(name_compare_entry **ppname_array, const char *namelist);
+void set_namearray(name_compare_entry **ppname_array, char *namelist);
 void free_namearray(name_compare_entry *name_array);
 bool fcntl_lock(int fd, int op, SMB_OFF_T offset, SMB_OFF_T count, int type);
 bool fcntl_getlock(int fd, SMB_OFF_T *poffset, SMB_OFF_T *pcount, int *ptype, pid_t *ppid);
diff --git a/source3/intl/lang_tdb.c b/source3/intl/lang_tdb.c
index 8fcb9f2bfc8..15793b78285 100644
--- a/source3/intl/lang_tdb.c
+++ b/source3/intl/lang_tdb.c
@@ -236,7 +236,7 @@ const char *lang_msg(const char *msgid)
 void lang_msg_free(const char *msgstr)
 {
 	if (!tdb) return;
-	free((void *)msgstr);
+	free(discard_const_p(void, msgstr));
 }
 
 /* 
diff --git a/source3/lib/gencache.c b/source3/lib/gencache.c
index 67c37f34e73..19cc7c947c3 100644
--- a/source3/lib/gencache.c
+++ b/source3/lib/gencache.c
@@ -125,7 +125,7 @@ again:
 static TDB_DATA last_stabilize_key(void)
 {
 	TDB_DATA result;
-	result.dptr = (uint8_t *)"@LAST_STABILIZED";
+	result.dptr = discard_const_p(uint8_t, "@LAST_STABILIZED");
 	result.dsize = 17;
 	return result;
 }
diff --git a/source3/lib/interface.c b/source3/lib/interface.c
index 30e94069a52..ac68324de94 100644
--- a/source3/lib/interface.c
+++ b/source3/lib/interface.c
@@ -305,7 +305,7 @@ static void add_interface(const struct iface_struct *ifs)
 	char addr[INET6_ADDRSTRLEN];
 	struct interface *iface;
 
-	if (iface_find((struct sockaddr *)&ifs->ip, False)) {
+	if (iface_find((const struct sockaddr *)&ifs->ip, False)) {
 		DEBUG(3,("add_interface: not adding duplicate interface %s\n",
 			print_sockaddr(addr, sizeof(addr), &ifs->ip) ));
 		return;
diff --git a/source3/lib/interfaces.c b/source3/lib/interfaces.c
index e40eaa91425..a2dce97eb6e 100644
--- a/source3/lib/interfaces.c
+++ b/source3/lib/interfaces.c
@@ -81,13 +81,13 @@ static void make_bcast_or_net(struct sockaddr_storage *pss_out,
 #if defined(HAVE_IPV6)
 	if (pss_in->ss_family == AF_INET6) {
 		p = (char *)&((struct sockaddr_in6 *)pss_out)->sin6_addr;
-		pmask = (char *)&((struct sockaddr_in6 *)nmask)->sin6_addr;
+		pmask = discard_const_p(char, &((const struct sockaddr_in6 *)nmask)->sin6_addr);
 		len = 16;
 	}
 #endif
 	if (pss_in->ss_family == AF_INET) {
 		p = (char *)&((struct sockaddr_in *)pss_out)->sin_addr;
-		pmask = (char *)&((struct sockaddr_in *)nmask)->sin_addr;
+		pmask = discard_const_p(char, &((const struct sockaddr_in *)nmask)->sin_addr);
 		len = 4;
 	}
 
diff --git a/source3/lib/messages.c b/source3/lib/messages.c
index 4335554c2a0..7b2b8c1c17e 100644
--- a/source3/lib/messages.c
+++ b/source3/lib/messages.c
@@ -112,7 +112,7 @@ static int traverse_fn(struct db_record *rec, const struct server_id *id,
 	 * the msg has already been deleted from the messages.tdb.*/
 
 	status = messaging_send_buf(msg_all->msg_ctx, *id, msg_all->msg_type,
-				    (uint8 *)msg_all->buf, msg_all->len);
+				    (const uint8 *)msg_all->buf, msg_all->len);
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
 		
diff --git a/source3/lib/netapi/samr.c b/source3/lib/netapi/samr.c
index 544698004a0..1c3a94ee9cd 100644
--- a/source3/lib/netapi/samr.c
+++ b/source3/lib/netapi/samr.c
@@ -240,7 +240,7 @@ WERROR libnetapi_samr_open_builtin_domain(struct libnetapi_ctx *mem_ctx,
 	status = dcerpc_samr_OpenDomain(b, mem_ctx,
 					connect_handle,
 					builtin_mask,
-					CONST_DISCARD(struct dom_sid *, &global_sid_Builtin),
+					discard_const_p(struct dom_sid, &global_sid_Builtin),
 					builtin_handle,
 					&result);
 	if (!NT_STATUS_IS_OK(status)) {
diff --git a/source3/lib/netapi/user.c b/source3/lib/netapi/user.c
index 653ece13854..7831e20a0a8 100644
--- a/source3/lib/netapi/user.c
+++ b/source3/lib/netapi/user.c
@@ -575,7 +575,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 	status = dcerpc_samr_OpenDomain(b, talloc_tos(),
 					&connect_handle,
 					SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
-					CONST_DISCARD(struct dom_sid *, &global_sid_Builtin),
+					discard_const_p(struct dom_sid, &global_sid_Builtin),
 					&builtin_handle,
 					&result);
 	if (!NT_STATUS_IS_OK(status)) {
diff --git a/source3/lib/smbldap.c b/source3/lib/smbldap.c
index fe432374641..002b1706b25 100644
--- a/source3/lib/smbldap.c
+++ b/source3/lib/smbldap.c
@@ -1562,7 +1562,7 @@ int smbldap_search_paged(struct smbldap_state *ldap_state,
 	}
 	ber_flatten(cookie_be, &cookie_bv);
 
-	pr.ldctl_oid = CONST_DISCARD(char *, ADS_PAGE_CTL_OID);
+	pr.ldctl_oid = discard_const_p(char, ADS_PAGE_CTL_OID);
 	pr.ldctl_iscritical = (char) critical;
 	pr.ldctl_value.bv_len = cookie_bv->bv_len;
 	pr.ldctl_value.bv_val = cookie_bv->bv_val;
diff --git a/source3/lib/tallocmsg.c b/source3/lib/tallocmsg.c
index da380c93355..9a0ce8ada18 100644
--- a/source3/lib/tallocmsg.c
+++ b/source3/lib/tallocmsg.c
@@ -65,7 +65,7 @@ static void msg_pool_usage_helper(const void *ptr, int depth, int max_depth, int
 			       (unsigned long)talloc_total_blocks(ptr),
 			       talloc_reference_count(ptr),
 			       MIN(50, talloc_get_size(ptr)),
-			       (char *)ptr);
+			       (const char *)ptr);
 		return;
 	}
 
diff --git a/source3/lib/util.c b/source3/lib/util.c
index cd856ee3556..b0b63770878 100644
--- a/source3/lib/util.c
+++ b/source3/lib/util.c
@@ -335,7 +335,7 @@ void show_msg(const char *buf)
 	if (DEBUGLEVEL < 50)
 		bcc = MIN(bcc, 512);
 
-	dump_data(10, (const uint8 *)smb_buf(buf), bcc);
+	dump_data(10, (const uint8 *)smb_buf_const(buf), bcc);
 }
 
 /*******************************************************************
@@ -1321,10 +1321,10 @@ bool is_in_path(const char *name, name_compare_entry *namelist, bool case_sensit
  if possible.
 ********************************************************************/
 
-void set_namearray(name_compare_entry **ppname_array, const char *namelist)
+void set_namearray(name_compare_entry **ppname_array, char *namelist)
 {
 	char *name_end;
-	char *nameptr = (char *)namelist;
+	char *nameptr = namelist;
 	int num_entries = 0;
 	int i;
 
@@ -1367,7 +1367,7 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist)
 	}
 
 	/* Now copy out the names */
-	nameptr = (char *)namelist;
+	nameptr = namelist;
 	i = 0;
 	while(*nameptr) {
 		if ( *nameptr == '/' ) {
diff --git a/source3/lib/util_sock.c b/source3/lib/util_sock.c
index 0e1bfc04d11..ca355c27096 100644
--- a/source3/lib/util_sock.c
+++ b/source3/lib/util_sock.c
@@ -306,7 +306,7 @@ ssize_t write_data(int fd, const char *buffer, size_t N)
 {
 	struct iovec iov;
 
-	iov.iov_base = CONST_DISCARD(void *, buffer);
+	iov.iov_base = discard_const_p(void, buffer);
 	iov.iov_len = N;
 	return write_data_iov(fd, &iov, 1);
 }
@@ -960,7 +960,7 @@ static bool matchname(const char *remotehost,
 			continue;
 		}
 		if (sockaddr_equal((const struct sockaddr *)res->ai_addr,
-					(struct sockaddr *)pss)) {
+					(const struct sockaddr *)pss)) {
 			freeaddrinfo(ailist);
 			return true;
 		}
diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c
index d496ade71b0..0b62ebf4e4b 100644
--- a/source3/libads/kerberos.c
+++ b/source3/libads/kerberos.c
@@ -223,8 +223,8 @@ int kerberos_kinit_password_ext(const char *principal,
 		krb5_get_init_creds_opt_set_address_list(opt, addr->addrs);
 	}
 
-	if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password), 
-						 kerb_prompter, CONST_DISCARD(char *,password),
+	if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, discard_const_p(char,password), 
+						 kerb_prompter, discard_const_p(char, password),
 						 0, NULL, opt))) {
 		goto out;
 	}
diff --git a/source3/libgpo/gpo_filesync.c b/source3/libgpo/gpo_filesync.c
index e3d3ae6c043..be656eea7eb 100644
--- a/source3/libgpo/gpo_filesync.c
+++ b/source3/libgpo/gpo_filesync.c
@@ -226,8 +226,8 @@ NTSTATUS gpo_sync_directories(TALLOC_CTX *mem_ctx,
 
 	ctx.mem_ctx 	= mem_ctx;
 	ctx.cli 	= cli;
-	ctx.remote_path	= CONST_DISCARD(char *, nt_path);
-	ctx.local_path	= CONST_DISCARD(char *, local_path);
+	ctx.remote_path	= discard_const_p(char, nt_path);
+	ctx.local_path	= discard_const_p(char, local_path);
 	ctx.attribute 	= (FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY);
 
 	ctx.mask = talloc_asprintf(mem_ctx,
diff --git a/source3/libsmb/async_smb.c b/source3/libsmb/async_smb.c
index ea3ca2d3235..0a7697291e4 100644
--- a/source3/libsmb/async_smb.c
+++ b/source3/libsmb/async_smb.c
@@ -546,7 +546,7 @@ struct tevent_req *cli_smb_send(TALLOC_CTX *mem_ctx,
 	struct iovec iov;
 	NTSTATUS status;
 
-	iov.iov_base = CONST_DISCARD(void *, bytes);
+	iov.iov_base = discard_const_p(void, bytes);
 	iov.iov_len = num_bytes;
 
 	req = cli_smb_req_create(mem_ctx, ev, cli, smb_command,
diff --git a/source3/libsmb/clidgram.c b/source3/libsmb/clidgram.c
index f133fe06078..b699b9df55b 100644
--- a/source3/libsmb/clidgram.c
+++ b/source3/libsmb/clidgram.c
@@ -321,7 +321,7 @@ struct tevent_req *nbt_getdc_send(TALLOC_CTX *mem_ctx,
 		return tevent_req_post(req, ev);
 	}
 	state->my_mailslot = mailslot_name(
-		state, ((struct sockaddr_in *)dc_addr)->sin_addr);
+		state, ((const struct sockaddr_in *)dc_addr)->sin_addr);
 	if (tevent_req_nomem(state->my_mailslot, req)) {
 		return tevent_req_post(req, ev);
 	}
diff --git a/source3/libsmb/clifsinfo.c b/source3/libsmb/clifsinfo.c
index 4b3383a1d24..4701b0317bf 100644
--- a/source3/libsmb/clifsinfo.c
+++ b/source3/libsmb/clifsinfo.c
@@ -693,7 +693,7 @@ static NTSTATUS make_cli_gss_blob(TALLOC_CTX *ctx,
 	NTSTATUS status = NT_STATUS_OK;
 
 	gss_OID_desc nt_hostbased_service =
-	{10, CONST_DISCARD(char *,"\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x04")};
+	{10, discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x04")};
 
 	memset(&tok_out, '\0', sizeof(tok_out));
 
diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c
index a872d2df61e..df8ba0ac40d 100644
--- a/source3/libsmb/clikrb5.c
+++ b/source3/libsmb/clikrb5.c
@@ -538,6 +538,7 @@ static krb5_error_code setup_auth_context(krb5_context context,
 	return retval;
 }
 
+#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
 static krb5_error_code create_gss_checksum(krb5_data *in_data, /* [inout] */
 						uint32_t gss_flags)
 {
@@ -589,6 +590,7 @@ static krb5_error_code create_gss_checksum(krb5_data *in_data, /* [inout] */
 	in_data->length = base_cksum_size + orig_length;
 	return 0;
 }
+#endif
 
 /*
   we can't use krb5_mk_req because w2k wants the service to be in a particular format
@@ -610,7 +612,6 @@ static krb5_error_code ads_krb5_mk_req(krb5_context context,
 	krb5_data in_data;
 	bool creds_ready = False;
 	int i = 0, maxtries = 3;
-	uint32_t gss_flags = 0;
 
 	ZERO_STRUCT(in_data);
 
@@ -690,32 +691,35 @@ static krb5_error_code ads_krb5_mk_req(krb5_context context,
 	}
 
 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
-	if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
-		/* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
-		 as part of the kerberos exchange. */
+	{
+		uint32_t gss_flags = 0;
 
-		DEBUG( 3, ("ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT\n")  );
+		if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
+			/* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
+			 as part of the kerberos exchange. */
 
-		retval = krb5_auth_con_setuseruserkey(context,
+			DEBUG( 3, ("ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT\n")  );
+
+			retval = krb5_auth_con_setuseruserkey(context,
 					*auth_context,
 					&credsp->keyblock );
-		if (retval) {
-			DEBUG(1,("krb5_auth_con_setuseruserkey failed (%s)\n",
-				error_message(retval)));
-			goto cleanup_creds;
-		}
+			if (retval) {
+				DEBUG(1,("krb5_auth_con_setuseruserkey failed (%s)\n",
+					error_message(retval)));
+				goto cleanup_creds;
+			}
 
-		/* Must use a subkey for forwarded tickets. */
-		retval = krb5_auth_con_setflags(context,
+			/* Must use a subkey for forwarded tickets. */
+			retval = krb5_auth_con_setflags(context,
 				*auth_context,
 				KRB5_AUTH_CONTEXT_USE_SUBKEY);
-		if (retval) {
-			DEBUG(1,("krb5_auth_con_setflags failed (%s)\n",
-				error_message(retval)));
-			goto cleanup_creds;
-		}
+			if (retval) {
+				DEBUG(1,("krb5_auth_con_setflags failed (%s)\n",
+					error_message(retval)));
+				goto cleanup_creds;
+			}
 
-		retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
+			retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
 				*auth_context,  /* Authentication context [in] */
 				CONST_DISCARD(char *, KRB5_TGS_NAME),  /* Ticket service name ("krbtgt") [in] */
 				credsp->client, /* Client principal for the tgt [in] */
@@ -724,46 +728,47 @@ static krb5_error_code ads_krb5_mk_req(krb5_context context,
 				1,              /* Turn on for "Forwardable ticket" [in] */
 				&in_data );     /* Resulting response [out] */
 
-		if (retval) {
-			DEBUG( 3, ("krb5_fwd_tgt_creds failed (%s)\n",
-				   error_message( retval ) ) );
-
-			/*
-			 * This is not fatal. Delete the *auth_context and continue
-			 * with krb5_mk_req_extended to get a non-forwardable ticket.
-			 */
-
-			if (in_data.data) {
-				free( in_data.data );
-				in_data.data = NULL;
-				in_data.length = 0;
-			}
-			krb5_auth_con_free(context, *auth_context);
-			*auth_context = NULL;
-			retval = setup_auth_context(context, auth_context);
 			if (retval) {
-				DEBUG(1,("setup_auth_context failed (%s)\n",
-					error_message(retval)));
-				goto cleanup_creds;
+				DEBUG( 3, ("krb5_fwd_tgt_creds failed (%s)\n",
+					   error_message( retval ) ) );
+
+				/*
+				 * This is not fatal. Delete the *auth_context and continue
+				 * with krb5_mk_req_extended to get a non-forwardable ticket.
+				 */
+
+				if (in_data.data) {
+					free( in_data.data );
+					in_data.data = NULL;
+					in_data.length = 0;
+				}
+				krb5_auth_con_free(context, *auth_context);
+				*auth_context = NULL;
+				retval = setup_auth_context(context, auth_context);
+				if (retval) {
+					DEBUG(1,("setup_auth_context failed (%s)\n",
+						error_message(retval)));
+					goto cleanup_creds;
+				}
+			} else {
+				/* We got a delegated ticket. */
+				gss_flags |= GSS_C_DELEG_FLAG;
 			}
-		} else {
-			/* We got a delegated ticket. */
-			gss_flags |= GSS_C_DELEG_FLAG;
 		}
-	}
 
-	/* Frees and reallocates in_data into a GSS checksum blob. */
-	retval = create_gss_checksum(&in_data, gss_flags);
-	if (retval) {
-		goto cleanup_data;
-	}
+		/* Frees and reallocates in_data into a GSS checksum blob. */
+		retval = create_gss_checksum(&in_data, gss_flags);
+		if (retval) {
+			goto cleanup_data;
+		}
 
-	/* We always want GSS-checksum types. */
-	retval = krb5_auth_con_set_req_cksumtype(context, *auth_context, GSSAPI_CHECKSUM );
-	if (retval) {
-		DEBUG(1,("krb5_auth_con_set_req_cksumtype failed (%s)\n",
-			error_message(retval)));
-		goto cleanup_data;
+		/* We always want GSS-checksum types. */
+		retval = krb5_auth_con_set_req_cksumtype(context, *auth_context, GSSAPI_CHECKSUM );
+		if (retval) {
+			DEBUG(1,("krb5_auth_con_set_req_cksumtype failed (%s)\n",
+				error_message(retval)));
+			goto cleanup_data;
+		}
 	}
 #endif
 
@@ -774,7 +779,10 @@ static krb5_error_code ads_krb5_mk_req(krb5_context context,
 			 error_message(retval)));
 	}
 
+#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
 cleanup_data:
+#endif
+
 	if (in_data.data) {
 		free( in_data.data );
 		in_data.length = 0;
@@ -919,7 +927,7 @@ done:
 {
 	static krb5_data kdata;
 
-	kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
+	kdata.data = discard_const_p(char, krb5_principal_get_comp_string(context, principal, i));
 	kdata.length = strlen((const char *)kdata.data);
 	return &kdata;
 }
@@ -1131,7 +1139,7 @@ out:
 	DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
 
 	/* FIXME: we should not fall back to defaults */
-	ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
+	ret = krb5_cc_resolve(context, discard_const_p(char, ccache_string), &ccache);
 	if (ret) {
 		goto done;
 	}
@@ -1150,7 +1158,7 @@ out:
 
 #ifdef HAVE_KRB5_GET_RENEWED_CREDS	/* MIT */
 	{
-		ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
+		ret = krb5_get_renewed_creds(context, &creds, client, ccache, discard_const_p(char, service_string));
 		if (ret) {
 			DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
 			goto done;
@@ -1956,11 +1964,11 @@ char *smb_krb5_principal_get_realm(krb5_context context,
 				   krb5_principal principal)
 {
 #ifdef HAVE_KRB5_PRINCIPAL_GET_REALM /* Heimdal */
-	return krb5_principal_get_realm(context, principal);
+	return discard_const_p(char, krb5_principal_get_realm(context, principal));
 #elif defined(krb5_princ_realm) /* MIT */
 	krb5_data *realm;
 	realm = krb5_princ_realm(context, principal);
-	return (char *)realm->data;
+	return discard_const_p(char, realm->data);
 #else
 	return NULL;
 #endif
diff --git a/source3/libsmb/clilist.c b/source3/libsmb/clilist.c
index 1017eb54bd8..f7ca9ac99c8 100644
--- a/source3/libsmb/clilist.c
+++ b/source3/libsmb/clilist.c
@@ -320,7 +320,7 @@ static struct tevent_req *cli_list_old_send(TALLOC_CTX *mem_ctx,
 	bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), mask,
 				   strlen(mask)+1, NULL);
 
-	bytes = smb_bytes_push_bytes(bytes, 5, (uint8_t *)&zero, 2);
+	bytes = smb_bytes_push_bytes(bytes, 5, (const uint8_t *)&zero, 2);
 	if (tevent_req_nomem(bytes, req)) {
 		return tevent_req_post(req, ev);
 	}
diff --git a/source3/libsmb/cliquota.c b/source3/libsmb/cliquota.c
index e5c8c831b73..94694e4530e 100644
--- a/source3/libsmb/cliquota.c
+++ b/source3/libsmb/cliquota.c
@@ -88,7 +88,7 @@ static bool parse_user_quota_record(const uint8_t *rdata,
 	/* the hard quotas 8 bytes (uint64_t)*/
 	qt.hardlim = BVAL(rdata,32);
 
-	if (!sid_parse((char *)rdata+40,sid_len,&qt.sid)) {
+	if (!sid_parse((const char *)rdata+40,sid_len,&qt.sid)) {
 		return false;
 	}
 
@@ -262,7 +262,7 @@ NTSTATUS cli_list_user_quota(struct cli_state *cli, int quota_fnum,
 		((curdata)&&(curdata_count>=8)&&(offset>0));
 		curdata +=offset,curdata_count -= offset) {
 		ZERO_STRUCT(qt);
-		if (!parse_user_quota_record((uint8_t *)curdata, curdata_count,
+		if (!parse_user_quota_record((const uint8_t *)curdata, curdata_count,
 					     &offset, &qt)) {
 			DEBUG(1,("Failed to parse the quota record\n"));
 			goto cleanup;
@@ -318,7 +318,7 @@ NTSTATUS cli_list_user_quota(struct cli_state *cli, int quota_fnum,
 			((curdata)&&(curdata_count>=8)&&(offset>0));
 			curdata +=offset,curdata_count -= offset) {
 			ZERO_STRUCT(qt);
-			if (!parse_user_quota_record((uint8_t *)curdata,
+			if (!parse_user_quota_record((const uint8_t *)curdata,
 						     curdata_count, &offset,
 						     &qt)) {
 				DEBUG(1,("Failed to parse the quota record\n"));
diff --git a/source3/libsmb/clireadwrite.c b/source3/libsmb/clireadwrite.c
index ff3dcff773e..fcfb01268c0 100644
--- a/source3/libsmb/clireadwrite.c
+++ b/source3/libsmb/clireadwrite.c
@@ -197,7 +197,7 @@ static void cli_read_andx_done(struct tevent_req *subreq)
 		return;
 	}
 
-	state->buf = (uint8_t *)smb_base(inbuf) + SVAL(vwv+6, 0);
+	state->buf = discard_const_p(uint8_t, smb_base(inbuf)) + SVAL(vwv+6, 0);
 
 	if (trans_oob(smb_len(inbuf), SVAL(vwv+6, 0), state->received)
 	    || ((state->received != 0) && (state->buf < bytes))) {
@@ -824,7 +824,7 @@ struct tevent_req *cli_write_andx_create(TALLOC_CTX *mem_ctx,
 	state->pad = 0;
 	state->iov[0].iov_base = (void *)&state->pad;
 	state->iov[0].iov_len = 1;
-	state->iov[1].iov_base = CONST_DISCARD(void *, buf);
+	state->iov[1].iov_base = discard_const_p(void, buf);
 	state->iov[1].iov_len = size;
 
 	subreq = cli_smb_req_create(state, ev, cli, SMBwriteX, 0, wct, vwv,
diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c
index e21eff30295..74357f5eb92 100644
--- a/source3/libsmb/libsmb_file.c
+++ b/source3/libsmb/libsmb_file.c
@@ -480,7 +480,7 @@ SMBC_close_ctx(SMBCCTX *context,
 bool
 SMBC_getatr(SMBCCTX * context,
             SMBCSRV *srv,
-            char *path,
+            const char *path,
             uint16 *mode,
             SMB_OFF_T *size,
             struct timespec *create_time_ts,
diff --git a/source3/libsmb/libsmb_stat.c b/source3/libsmb/libsmb_stat.c
index 9c613508eb4..817e4a1f574 100644
--- a/source3/libsmb/libsmb_stat.c
+++ b/source3/libsmb/libsmb_stat.c
@@ -52,7 +52,7 @@ generate_inode(SMBCCTX *context,
 static int
 setup_stat(SMBCCTX *context,
            struct stat *st,
-           char *fname,
+           const char *fname,
            SMB_OFF_T size,
            int mode)
 {
@@ -180,7 +180,7 @@ SMBC_stat_ctx(SMBCCTX *context,
 
 	st->st_ino = ino;
 
-	setup_stat(context, st, (char *) fname, size, mode);
+	setup_stat(context, st, fname, size, mode);
 
 	st->st_atime = convert_timespec_to_time_t(access_time_ts);
 	st->st_ctime = convert_timespec_to_time_t(change_time_ts);
diff --git a/source3/libsmb/libsmb_xattr.c b/source3/libsmb/libsmb_xattr.c
index af2c56ad403..f8dd7fdefb9 100644
--- a/source3/libsmb/libsmb_xattr.c
+++ b/source3/libsmb/libsmb_xattr.c
@@ -567,7 +567,7 @@ dos_attr_query(SMBCCTX *context,
         }
 
         /* Obtain the DOS attributes */
-        if (!SMBC_getatr(context, srv, CONST_DISCARD(char *, filename),
+        if (!SMBC_getatr(context, srv, filename,
                          &mode, &size,
                          &create_time_ts,
                          &access_time_ts,
@@ -700,8 +700,8 @@ cacl_get(SMBCCTX *context,
          SMBCSRV *srv,
          struct cli_state *ipc_cli,
          struct policy_handle *pol,
-         char *filename,
-         char *attr_name,
+         const char *filename,
+         const char *attr_name,
          char *buf,
          int bufsize)
 {
@@ -2107,12 +2107,12 @@ SMBC_getxattr_ctx(SMBCCTX *context,
             StrCaseCmp(name, "system.dos_attr.inode") == 0) {
 
                 /* Yup. */
-                char *filename = (char *) name;
+                const char *filename = name;
                 ret = cacl_get(context, talloc_tos(), srv,
                                ipc_srv == NULL ? NULL : ipc_srv->cli, 
                                &ipc_srv->pol, path,
                                filename,
-                               CONST_DISCARD(char *, value),
+                               discard_const_p(char, value),
                                size);
                 if (ret < 0 && errno == 0) {
                         errno = SMBC_errno(context, srv->cli);
@@ -2231,7 +2231,7 @@ SMBC_removexattr_ctx(SMBCCTX *context,
                 /* Yup. */
                 ret = cacl_set(context, talloc_tos(), srv->cli,
                                ipc_srv->cli, &ipc_srv->pol, path,
-                               CONST_DISCARD(char *, name) + 19,
+                               discard_const_p(char, name) + 19,
                                SMBC_XATTR_MODE_REMOVE, 0);
 		TALLOC_FREE(frame);
                 return ret;