diff --git a/gnu/lib/libreadline/rltty.c b/gnu/lib/libreadline/rltty.c
index b4bb9ab63..18b4caa19 100644
--- a/gnu/lib/libreadline/rltty.c
+++ b/gnu/lib/libreadline/rltty.c
@@ -700,7 +700,7 @@ rl_deprep_terminal ()
 
   release_sigint ();
 }
-
+
 /* **************************************************************** */
 /*								    */
 /*			Bogus Flow Control			    */
diff --git a/lib/libcrypto/bn/arch/aarch64/bn_arch.h b/lib/libcrypto/bn/arch/aarch64/bn_arch.h
index 708083aaf..f658510c7 100644
--- a/lib/libcrypto/bn/arch/aarch64/bn_arch.h
+++ b/lib/libcrypto/bn/arch/aarch64/bn_arch.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bn_arch.h,v 1.9 2023/05/28 17:42:30 jsing Exp $ */
+/*	$OpenBSD: bn_arch.h,v 1.10 2023/06/12 16:42:11 jsing Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -63,6 +63,35 @@ bn_addw_addw(BN_ULONG a, BN_ULONG b, BN_ULONG c, BN_ULONG *out_r1,
 	*out_r0 = r0;
 }
 
+#define HAVE_BN_QWADDQW
+
+static inline void
+bn_qwaddqw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0, BN_ULONG b3,
+    BN_ULONG b2, BN_ULONG b1, BN_ULONG b0, BN_ULONG carry, BN_ULONG *out_carry,
+    BN_ULONG *out_r3, BN_ULONG *out_r2, BN_ULONG *out_r1, BN_ULONG *out_r0)
+{
+	BN_ULONG r3, r2, r1, r0;
+
+	__asm__ (
+	    "adds  xzr, %[carry], #-1 \n"
+	    "adcs  %[r0], %[a0], %[b0] \n"
+	    "adcs  %[r1], %[a1], %[b1] \n"
+	    "adcs  %[r2], %[a2], %[b2] \n"
+	    "adcs  %[r3], %[a3], %[b3] \n"
+	    "cset  %[carry], cs \n"
+	    : [carry]"+r"(carry), [r3]"=&r"(r3), [r2]"=&r"(r2),
+		[r1]"=&r"(r1), [r0]"=&r"(r0)
+	    : [a3]"r"(a3), [a2]"r"(a2), [a1]"r"(a1), [a0]"r"(a0),
+		[b3]"r"(b3), [b2]"r"(b2), [b1]"r"(b1), [b0]"r"(b0)
+	    : "cc");
+
+	*out_carry = carry;
+	*out_r3 = r3;
+	*out_r2 = r2;
+	*out_r1 = r1;
+	*out_r0 = r0;
+}
+
 #define HAVE_BN_MULW
 
 static inline void
@@ -148,6 +177,83 @@ bn_mulw_addtw(BN_ULONG a, BN_ULONG b, BN_ULONG c2, BN_ULONG c1, BN_ULONG c0,
 	*out_r0 = r0;
 }
 
+#define HAVE_BN_QWMULW_ADDW
+
+static inline void
+bn_qwmulw_addw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0, BN_ULONG b,
+    BN_ULONG c, BN_ULONG *out_r4, BN_ULONG *out_r3, BN_ULONG *out_r2,
+    BN_ULONG *out_r1, BN_ULONG *out_r0)
+{
+	BN_ULONG r4, r3, r2, r1, r0;
+
+	__asm__ (
+	    "umulh  %[r1], %[a0], %[b] \n"
+	    "mul    %[r0], %[a0], %[b] \n"
+	    "adds   %[r0], %[r0], %[c] \n"
+	    "umulh  %[r2], %[a1], %[b] \n"
+	    "mul     %[c], %[a1], %[b] \n"
+	    "adcs   %[r1], %[r1], %[c] \n"
+	    "umulh  %[r3], %[a2], %[b] \n"
+	    "mul     %[c], %[a2], %[b] \n"
+	    "adcs   %[r2], %[r2], %[c] \n"
+	    "umulh  %[r4], %[a3], %[b] \n"
+	    "mul     %[c], %[a3], %[b] \n"
+	    "adcs   %[r3], %[r3], %[c] \n"
+	    "adc    %[r4], %[r4], xzr  \n"
+	    : [c]"+r"(c), [r4]"=&r"(r4), [r3]"=&r"(r3), [r2]"=&r"(r2),
+		[r1]"=&r"(r1), [r0]"=&r"(r0)
+	    : [a3]"r"(a3), [a2]"r"(a2), [a1]"r"(a1), [a0]"r"(a0), [b]"r"(b)
+	    : "cc");
+
+	*out_r4 = r4;
+	*out_r3 = r3;
+	*out_r2 = r2;
+	*out_r1 = r1;
+	*out_r0 = r0;
+}
+
+#define HAVE_BN_QWMULW_ADDQW_ADDW
+
+static inline void
+bn_qwmulw_addqw_addw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0,
+    BN_ULONG b, BN_ULONG c3, BN_ULONG c2, BN_ULONG c1, BN_ULONG c0, BN_ULONG d,
+    BN_ULONG *out_r4, BN_ULONG *out_r3, BN_ULONG *out_r2, BN_ULONG *out_r1,
+    BN_ULONG *out_r0)
+{
+	BN_ULONG r4, r3, r2, r1, r0;
+
+	__asm__ (
+	    "umulh  %[r1], %[a0], %[b]  \n"
+	    "mul    %[r0], %[a0], %[b]  \n"
+	    "adds   %[r0], %[r0], %[d]  \n"
+	    "umulh  %[r2], %[a1], %[b]  \n"
+	    "mul     %[d], %[a1], %[b]  \n"
+	    "adcs   %[r1], %[r1], %[d]  \n"
+	    "umulh  %[r3], %[a2], %[b]  \n"
+	    "mul     %[d], %[a2], %[b]  \n"
+	    "adcs   %[r2], %[r2], %[d]  \n"
+	    "umulh  %[r4], %[a3], %[b]  \n"
+	    "mul     %[d], %[a3], %[b]  \n"
+	    "adcs   %[r3], %[r3], %[d]  \n"
+	    "adc    %[r4], %[r4], xzr   \n"
+	    "adds   %[r0], %[r0], %[c0] \n"
+	    "adcs   %[r1], %[r1], %[c1] \n"
+	    "adcs   %[r2], %[r2], %[c2] \n"
+	    "adcs   %[r3], %[r3], %[c3] \n"
+	    "adc    %[r4], %[r4], xzr   \n"
+	    : [d]"+r"(d), [r4]"=&r"(r4), [r3]"=&r"(r3), [r2]"=&r"(r2),
+		[r1]"=&r"(r1), [r0]"=&r"(r0)
+	    : [a3]"r"(a3), [a2]"r"(a2), [a1]"r"(a1), [a0]"r"(a0), [b]"r"(b),
+		[c3]"r"(c3), [c2]"r"(c2), [c1]"r"(c1), [c0]"r"(c0)
+	    : "cc");
+
+	*out_r4 = r4;
+	*out_r3 = r3;
+	*out_r2 = r2;
+	*out_r1 = r1;
+	*out_r0 = r0;
+}
+
 #define HAVE_BN_SUBW
 
 static inline void
@@ -187,6 +293,35 @@ bn_subw_subw(BN_ULONG a, BN_ULONG b, BN_ULONG c, BN_ULONG *out_borrow,
 	*out_r0 = r0;
 }
 
+#define HAVE_BN_QWSUBQW
+
+static inline void
+bn_qwsubqw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0, BN_ULONG b3,
+    BN_ULONG b2, BN_ULONG b1, BN_ULONG b0, BN_ULONG borrow, BN_ULONG *out_borrow,
+    BN_ULONG *out_r3, BN_ULONG *out_r2, BN_ULONG *out_r1, BN_ULONG *out_r0)
+{
+	BN_ULONG r3, r2, r1, r0;
+
+	__asm__ (
+	    "subs  xzr, xzr, %[borrow] \n"
+	    "sbcs  %[r0], %[a0], %[b0] \n"
+	    "sbcs  %[r1], %[a1], %[b1] \n"
+	    "sbcs  %[r2], %[a2], %[b2] \n"
+	    "sbcs  %[r3], %[a3], %[b3] \n"
+	    "cset  %[borrow], cc \n"
+	    : [borrow]"+r"(borrow), [r3]"=&r"(r3), [r2]"=&r"(r2),
+		[r1]"=&r"(r1), [r0]"=&r"(r0)
+	    : [a3]"r"(a3), [a2]"r"(a2), [a1]"r"(a1), [a0]"r"(a0),
+		[b3]"r"(b3), [b2]"r"(b2), [b1]"r"(b1), [b0]"r"(b0)
+	    : "cc");
+
+	*out_borrow = borrow;
+	*out_r3 = r3;
+	*out_r2 = r2;
+	*out_r1 = r1;
+	*out_r0 = r0;
+}
+
 #endif /* __GNUC__ */
 
 #endif
diff --git a/lib/libcrypto/bn/bn_add.c b/lib/libcrypto/bn/bn_add.c
index 92489b7da..36f160ab5 100644
--- a/lib/libcrypto/bn/bn_add.c
+++ b/lib/libcrypto/bn/bn_add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bn_add.c,v 1.24 2023/02/22 05:46:37 jsing Exp $ */
+/* $OpenBSD: bn_add.c,v 1.25 2023/06/12 16:17:24 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -80,18 +80,14 @@ bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, int n)
 	if (n <= 0)
 		return 0;
 
-#ifndef OPENSSL_SMALL_FOOTPRINT
 	while (n & ~3) {
-		bn_addw_addw(a[0], b[0], carry, &carry, &r[0]);
-		bn_addw_addw(a[1], b[1], carry, &carry, &r[1]);
-		bn_addw_addw(a[2], b[2], carry, &carry, &r[2]);
-		bn_addw_addw(a[3], b[3], carry, &carry, &r[3]);
+		bn_qwaddqw(a[3], a[2], a[1], a[0], b[3], b[2], b[1], b[0],
+		    carry, &carry, &r[3], &r[2], &r[1], &r[0]);
 		a += 4;
 		b += 4;
 		r += 4;
 		n -= 4;
 	}
-#endif
 	while (n) {
 		bn_addw_addw(a[0], b[0], carry, &carry, &r[0]);
 		a++;
@@ -165,18 +161,14 @@ bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, int n)
 	if (n <= 0)
 		return 0;
 
-#ifndef OPENSSL_SMALL_FOOTPRINT
 	while (n & ~3) {
-		bn_subw_subw(a[0], b[0], borrow, &borrow, &r[0]);
-		bn_subw_subw(a[1], b[1], borrow, &borrow, &r[1]);
-		bn_subw_subw(a[2], b[2], borrow, &borrow, &r[2]);
-		bn_subw_subw(a[3], b[3], borrow, &borrow, &r[3]);
+		bn_qwsubqw(a[3], a[2], a[1], a[0], b[3], b[2], b[1], b[0],
+		    borrow, &borrow, &r[3], &r[2], &r[1], &r[0]);
 		a += 4;
 		b += 4;
 		r += 4;
 		n -= 4;
 	}
-#endif
 	while (n) {
 		bn_subw_subw(a[0], b[0], borrow, &borrow, &r[0]);
 		a++;
diff --git a/lib/libcrypto/bn/bn_internal.h b/lib/libcrypto/bn/bn_internal.h
index 8a729b8e4..5f86e2133 100644
--- a/lib/libcrypto/bn/bn_internal.h
+++ b/lib/libcrypto/bn/bn_internal.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bn_internal.h,v 1.11 2023/03/07 09:35:55 jsing Exp $ */
+/*	$OpenBSD: bn_internal.h,v 1.12 2023/06/12 16:17:24 jsing Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -122,6 +122,33 @@ bn_addw_addw(BN_ULONG a, BN_ULONG b, BN_ULONG c, BN_ULONG *out_r1,
 }
 #endif
 
+/*
+ * bn_qwaddqw() computes
+ * (r4:r3:r2:r1:r0) = (a3:a2:a1:a0) + (b3:b2:b1:b0) + carry, where a is a quad word,
+ * b is a quad word, and carry is a single word with value 0 or 1, producing a four
+ * word result and carry.
+ */
+#ifndef HAVE_BN_QWADDQW
+static inline void
+bn_qwaddqw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0, BN_ULONG b3,
+    BN_ULONG b2, BN_ULONG b1, BN_ULONG b0, BN_ULONG carry, BN_ULONG *out_carry,
+    BN_ULONG *out_r3, BN_ULONG *out_r2, BN_ULONG *out_r1, BN_ULONG *out_r0)
+{
+	BN_ULONG r3, r2, r1, r0;
+
+	bn_addw_addw(a0, b0, carry, &carry, &r0);
+	bn_addw_addw(a1, b1, carry, &carry, &r1);
+	bn_addw_addw(a2, b2, carry, &carry, &r2);
+	bn_addw_addw(a3, b3, carry, &carry, &r3);
+
+	*out_carry = carry;
+	*out_r3 = r3;
+	*out_r2 = r2;
+	*out_r1 = r1;
+	*out_r0 = r0;
+}
+#endif
+
 /*
  * bn_subw() computes r0 = a - b, where both inputs are single words,
  * producing a single word result and borrow.
@@ -159,6 +186,33 @@ bn_subw_subw(BN_ULONG a, BN_ULONG b, BN_ULONG c, BN_ULONG *out_borrow,
 }
 #endif
 
+/*
+ * bn_qwsubqw() computes
+ * (r3:r2:r1:r0) = (a3:a2:a1:a0) - (b3:b2:b1:b0) - borrow, where a is a quad word,
+ * b is a quad word, and borrow is a single word with value 0 or 1, producing a
+ * four word result and borrow.
+ */
+#ifndef HAVE_BN_QWSUBQW
+static inline void
+bn_qwsubqw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0, BN_ULONG b3,
+    BN_ULONG b2, BN_ULONG b1, BN_ULONG b0, BN_ULONG borrow, BN_ULONG *out_borrow,
+    BN_ULONG *out_r3, BN_ULONG *out_r2, BN_ULONG *out_r1, BN_ULONG *out_r0)
+{
+	BN_ULONG r3, r2, r1, r0;
+
+	bn_subw_subw(a0, b0, borrow, &borrow, &r0);
+	bn_subw_subw(a1, b1, borrow, &borrow, &r1);
+	bn_subw_subw(a2, b2, borrow, &borrow, &r2);
+	bn_subw_subw(a3, b3, borrow, &borrow, &r3);
+
+	*out_borrow = borrow;
+	*out_r3 = r3;
+	*out_r2 = r2;
+	*out_r1 = r1;
+	*out_r0 = r0;
+}
+#endif
+
 /*
  * bn_mulw() computes (r1:r0) = a * b, where both inputs are single words,
  * producing a double word result.
@@ -387,4 +441,58 @@ bn_mul2_mulw_addtw(BN_ULONG a, BN_ULONG b, BN_ULONG c2, BN_ULONG c1, BN_ULONG c0
 }
 #endif
 
+/*
+ * bn_qwmulw_addw() computes (r4:r3:r2:r1:r0) = (a3:a2:a1:a0) * b + c, where a
+ * is a quad word, b is a single word and c is a single word, producing a five
+ * word result.
+ */
+#ifndef HAVE_BN_QWMULW_ADDW
+static inline void
+bn_qwmulw_addw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0, BN_ULONG b,
+    BN_ULONG c, BN_ULONG *out_r4, BN_ULONG *out_r3, BN_ULONG *out_r2,
+    BN_ULONG *out_r1, BN_ULONG *out_r0)
+{
+	BN_ULONG r3, r2, r1, r0;
+
+	bn_mulw_addw(a0, b, c, &c, &r0);
+	bn_mulw_addw(a1, b, c, &c, &r1);
+	bn_mulw_addw(a2, b, c, &c, &r2);
+	bn_mulw_addw(a3, b, c, &c, &r3);
+
+	*out_r4 = c;
+	*out_r3 = r3;
+	*out_r2 = r2;
+	*out_r1 = r1;
+	*out_r0 = r0;
+}
+#endif
+
+/*
+ * bn_qwmulw_addqw_addw() computes
+ * (r4:r3:r2:r1:r0) = (a3:a2:a1:a0) * b + (c3:c2:c1:c0) + d, where a
+ * is a quad word, b is a single word, c is a quad word, and d is a single word,
+ * producing a five word result.
+ */
+#ifndef HAVE_BN_QWMULW_ADDQW_ADDW
+static inline void
+bn_qwmulw_addqw_addw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0,
+    BN_ULONG b, BN_ULONG c3, BN_ULONG c2, BN_ULONG c1, BN_ULONG c0, BN_ULONG d,
+    BN_ULONG *out_r4, BN_ULONG *out_r3, BN_ULONG *out_r2, BN_ULONG *out_r1,
+    BN_ULONG *out_r0)
+{
+	BN_ULONG r3, r2, r1, r0;
+
+	bn_mulw_addw_addw(a0, b, c0, d, &d, &r0);
+	bn_mulw_addw_addw(a1, b, c1, d, &d, &r1);
+	bn_mulw_addw_addw(a2, b, c2, d, &d, &r2);
+	bn_mulw_addw_addw(a3, b, c3, d, &d, &r3);
+
+	*out_r4 = d;
+	*out_r3 = r3;
+	*out_r2 = r2;
+	*out_r1 = r1;
+	*out_r0 = r0;
+}
+#endif
+
 #endif
diff --git a/lib/libcrypto/bn/bn_mul.c b/lib/libcrypto/bn/bn_mul.c
index 118e8cddc..65088cc5c 100644
--- a/lib/libcrypto/bn/bn_mul.c
+++ b/lib/libcrypto/bn/bn_mul.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bn_mul.c,v 1.37 2023/04/19 10:51:22 jsing Exp $ */
+/* $OpenBSD: bn_mul.c,v 1.38 2023/06/12 16:17:24 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -210,17 +210,13 @@ bn_mul_words(BN_ULONG *r, const BN_ULONG *a, int num, BN_ULONG w)
 	if (num <= 0)
 		return 0;
 
-#ifndef OPENSSL_SMALL_FOOTPRINT
 	while (num & ~3) {
-		bn_mulw_addw(a[0], w, carry, &carry, &r[0]);
-		bn_mulw_addw(a[1], w, carry, &carry, &r[1]);
-		bn_mulw_addw(a[2], w, carry, &carry, &r[2]);
-		bn_mulw_addw(a[3], w, carry, &carry, &r[3]);
+		bn_qwmulw_addw(a[3], a[2], a[1], a[0], w, carry, &carry,
+		    &r[3], &r[2], &r[1], &r[0]);
 		a += 4;
 		r += 4;
 		num -= 4;
 	}
-#endif
 	while (num) {
 		bn_mulw_addw(a[0], w, carry, &carry, &r[0]);
 		a++;
@@ -247,17 +243,14 @@ bn_mul_add_words(BN_ULONG *r, const BN_ULONG *a, int num, BN_ULONG w)
 	if (num <= 0)
 		return 0;
 
-#ifndef OPENSSL_SMALL_FOOTPRINT
 	while (num & ~3) {
-		bn_mulw_addw_addw(a[0], w, r[0], carry, &carry, &r[0]);
-		bn_mulw_addw_addw(a[1], w, r[1], carry, &carry, &r[1]);
-		bn_mulw_addw_addw(a[2], w, r[2], carry, &carry, &r[2]);
-		bn_mulw_addw_addw(a[3], w, r[3], carry, &carry, &r[3]);
+		bn_qwmulw_addqw_addw(a[3], a[2], a[1], a[0], w,
+		    r[3], r[2], r[1], r[0], carry, &carry,
+		    &r[3], &r[2], &r[1], &r[0]);
 		a += 4;
 		r += 4;
 		num -= 4;
 	}
-#endif
 	while (num) {
 		bn_mulw_addw_addw(a[0], w, r[0], carry, &carry, &r[0]);
 		a++;
diff --git a/lib/libcrypto/ec/ec_local.h b/lib/libcrypto/ec/ec_local.h
index 6e799137a..c827a8f70 100644
--- a/lib/libcrypto/ec/ec_local.h
+++ b/lib/libcrypto/ec/ec_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_local.h,v 1.13 2023/04/27 07:10:05 tb Exp $ */
+/* $OpenBSD: ec_local.h,v 1.14 2023/06/12 18:17:18 jsing Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -357,18 +357,6 @@ int ec_GFp_simple_mul_double_nonct(const EC_GROUP *, EC_POINT *r, const BIGNUM *
 
 int ec_point_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx);
 
-int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *, EC_POINT *,
-	const BIGNUM *x, int y_bit, BN_CTX *);
-size_t ec_GF2m_simple_point2oct(const EC_GROUP *, const EC_POINT *, point_conversion_form_t form,
-	unsigned char *buf, size_t len, BN_CTX *);
-int ec_GF2m_simple_oct2point(const EC_GROUP *, EC_POINT *,
-	const unsigned char *buf, size_t len, BN_CTX *);
-
-int ec_GF2m_simple_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
-	size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
-int ec_GF2m_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
-int ec_GF2m_have_precompute_mult(const EC_GROUP *group);
-
 /* EC_METHOD definitions */
 
 struct ec_key_method_st {
diff --git a/regress/usr.bin/Makefile b/regress/usr.bin/Makefile
index 8b8937d27..52d71cd16 100644
--- a/regress/usr.bin/Makefile
+++ b/regress/usr.bin/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.46 2021/03/09 17:38:24 martijn Exp $
+#	$OpenBSD: Makefile,v 1.47 2023/06/12 20:19:45 millert Exp $
 
 SUBDIR+= apply
 SUBDIR+= basename bc
@@ -12,7 +12,7 @@ SUBDIR+= m4 mail mandoc
 SUBDIR+= nc
 SUBDIR+= openssl
 SUBDIR+= rev
-SUBDIR+= sdiff sed signify snmp sort
+SUBDIR+= sdiff sed seq signify snmp sort
 SUBDIR+= tsort
 SUBDIR+= ul
 SUBDIR+= wc
diff --git a/regress/usr.bin/seq/Makefile b/regress/usr.bin/seq/Makefile
new file mode 100644
index 000000000..a5f3c2e34
--- /dev/null
+++ b/regress/usr.bin/seq/Makefile
@@ -0,0 +1,7 @@
+#	$OpenBSD: Makefile,v 1.1 2023/06/12 20:19:45 millert Exp $
+
+SEQ?=	/usr/bin/seq
+
+seqtest:
+	sh ${.CURDIR}/$@.sh ${SEQ} $@.out
+	diff ${.CURDIR}/$@.expected $@.out
diff --git a/regress/usr.bin/seq/seqtest.expected b/regress/usr.bin/seq/seqtest.expected
new file mode 100644
index 000000000..4178fd915
--- /dev/null
+++ b/regress/usr.bin/seq/seqtest.expected
@@ -0,0 +1,62 @@
+Test 1.1: check for invalid format string
+seq: invalid format string: `foo'
+
+Test 1.2: check for valid format string
+bar1.000000
+bar2.000000
+bar3.000000
+
+Test 1.3: check for invalid increment
+seq: zero decrement
+
+Test 1.4: check for first > last
+seq: needs negative decrement
+
+Test 1.5: check for increment mismatch
+seq: needs positive increment
+
+Test 1.6: check for increment mismatch
+seq: needs negative decrement
+
+Test 2.0: single argument (0)
+1
+0
+
+Test 2.1: single argument (1)
+1
+
+Test 2.2: single argument (-1)
+1
+0
+-1
+
+Test 2.3: two arguments (1, 1)
+1
+
+Test 2.3: two arguments (1, 2)
+1
+2
+
+Test 2.3: two arguments (1, -2)
+1
+0
+-1
+-2
+
+Test 3.0: check for missing element due to rounding
+1
+1.1
+1.2
+
+Test 3.1: check for missing element due to rounding
+0
+1e-06
+2e-06
+3e-06
+
+Test 3.2: check for extra element due to rounding
+0.1
+1.09
+
+Test 3.3: check for extra element due to rounding check
+1.05e+06
diff --git a/regress/usr.bin/seq/seqtest.sh b/regress/usr.bin/seq/seqtest.sh
new file mode 100755
index 000000000..240da3e41
--- /dev/null
+++ b/regress/usr.bin/seq/seqtest.sh
@@ -0,0 +1,94 @@
+#!/bin/sh
+#	$OpenBSD: seqtest.sh,v 1.1 2023/06/12 20:19:45 millert Exp $
+#
+# Public domain, 2023, Todd C. Miller <millert@openbsd.org>
+#
+# Usage: seqtest.sh [seq_bin log_file]
+#
+# If no log file is specified, seq.out is used.
+
+run_tests()
+{
+	SEQ=$1
+	LOG=$2
+	rm -f $LOG
+	exec >$LOG 2>&1
+
+	test_args;
+	test_simple;
+	test_rounding;
+}
+
+test_args()
+{
+	echo 'Test 1.1: check for invalid format string'
+	${SEQ} -f foo 3
+
+	echo
+	echo 'Test 1.2: check for valid format string'
+	${SEQ} -f bar%f 3
+
+	echo
+	echo 'Test 1.3: check for invalid increment'
+	${SEQ} 1 0 1
+
+	echo
+	echo 'Test 1.4: check for first > last'
+	${SEQ} 1 .1 -1
+
+	echo
+	echo 'Test 1.5: check for increment mismatch'
+	${SEQ} 0 -0.1 1
+
+	echo
+	echo 'Test 1.6: check for increment mismatch'
+	${SEQ} 1 0.1 0
+}
+
+test_simple()
+{
+	echo
+	echo 'Test 2.0: single argument (0)'
+	${SEQ} 0
+
+	echo
+	echo 'Test 2.1: single argument (1)'
+	${SEQ} 1
+
+	echo
+	echo 'Test 2.2: single argument (-1)'
+	${SEQ} -1
+
+	echo
+	echo 'Test 2.3: two arguments (1, 1)'
+	${SEQ} 1 1
+
+	echo
+	echo 'Test 2.3: two arguments (1, 2)'
+	${SEQ} 1 2
+
+	echo
+	echo 'Test 2.3: two arguments (1, -2)'
+	${SEQ} 1 -2
+}
+
+test_rounding()
+{
+	echo
+	echo 'Test 3.0: check for missing element due to rounding'
+	${SEQ} 1 0.1 1.2
+
+	echo
+	echo 'Test 3.1: check for missing element due to rounding'
+	${SEQ} 0 0.000001 0.000003
+
+	echo
+	echo 'Test 3.2: check for extra element due to rounding'
+	${SEQ} 0.1 .99 1.99
+
+	echo
+	echo 'Test 3.3: check for extra element due to rounding check'
+	${SEQ} 1050000 1050000
+}
+
+run_tests ${1:-seq} ${2:-seq.out}
diff --git a/regress/usr.sbin/pkg_add/Makefile b/regress/usr.sbin/pkg_add/Makefile
index 904488766..e06a65579 100644
--- a/regress/usr.sbin/pkg_add/Makefile
+++ b/regress/usr.sbin/pkg_add/Makefile
@@ -62,7 +62,7 @@ setsprint:
 pkgpaths:
 	${PERLSCRIPT}/check-path
 
-signatures: 
+signatures:
 	-rm -f signatures.out
 	${PERLSCRIPT}/check-sig 2>signatures.out
 	diff -u signatures.out ${.CURDIR}/signatures.ref
@@ -351,7 +351,7 @@ rep0/inta-0.tgz:
 	@${CREATE_PKG} -P't/intb:intb-*:intb-0' ${EMPTY} $@
 rep0/intb-0.tgz:
 	@${CREATE_PKG} -P't/inta:inta-*:inta-0' ${EMPTY} $@
- 
+
 rep1/o-1.tgz:
 	@${CREATE_PKG} -DREGRESSION_TESTING -P't/p:p-*:p-0' -W'coincoin.0.0' ${EMPTY} $@
 
@@ -376,10 +376,10 @@ rep0/p4-0.tgz: plist12
 rep1/p4-1.tgz: plist12
 	@${WITH} -B src31 -DLIBa_VERSION=1.0 -f plist12 $@ ${CPKG}
 
-rep0/boost-0.tgz: 
+rep0/boost-0.tgz:
 	@${CREATE_PKG} -DREGRESSION_TESTING -W'a.0.0' -P't/p4:p4-*:p4-0' ${EMPTY} $@
-	
-rep1/boost-0.tgz: 
+
+rep1/boost-0.tgz:
 	@${CREATE_PKG} -DREGRESSION_TESTING -W'a.1.0' -P't/p4:p4-*:p4-1' ${EMPTY} $@
 
 rep0/Imath-0.tgz:
@@ -489,10 +489,10 @@ rep0/g-0.tgz: plist4
 rep1/g-0.tgz: plist4
 	@PACKAGE_COMMENT=updated ${CREATE_PKG} -f plist4 $@
 
-rep0/gg-0.tgz: plist4 
+rep0/gg-0.tgz: plist4
 	@${CREATE_PKG} -P't/g:g-*:g-1' -f plist4 $@
 
-rep1/gg-0.tgz: plist4 
+rep1/gg-0.tgz: plist4
 	@PACKAGE_COMMENT=updated ${CREATE_PKG} -P't/g:g-*:g-0' -f plist4 $@
 
 rep1/gd-1.tgz rep1/ge-1.tgz: plist5
@@ -540,7 +540,7 @@ plist-rep1-$n:
 	@${MKPLIST} "@conflict q1-0" "@conflict q2-0" "@conflict q3-0" "@conflict q4-0" "@exec echo 1>&2 'XXXrep1 $n'" >$@
 
 .endfor
-	
+
 rep0/q6-0.tgz:
 	@${CREATE_PKG} -P't/q3:q3-*:q3-0' ${EMPTY} $@
 
@@ -713,12 +713,12 @@ temp-error1: rep0/a-0.tgz rep0/b-0.tgz temp1.ref
 	@{ INJECT=inject-temp1 ROOT=${D40} SILENT=1 ${ADD_PKG} rep0/a-0.tgz 1>/dev/null|| echo $$? ; } 2>&1|${SED_PIPE} >temp1.out
 	@diff -u temp1.out ${.CURDIR}/temp1.ref
 
-temp-error2: 
+temp-error2:
 	@-rm -rf ${XXXD}
 	@{ INJECT=inject-temp2 ROOT=${XXXD} SILENT=1 PKG_PATH=https://www.google.com/ ${ADD_PKG} rep0/a-0.tgz 1>/dev/null|| echo $$? ; } 2>&1|${SED_PIPE2} >${XXXBASE}.out
 	@diff -u ${XXXBASE}.out ${.CURDIR}/temp2.ref
 
-temp-error2-as-root: 
+temp-error2-as-root:
 	@# XXX thx tedu for not allowing env thru
 	@${SUDO} make -C ${.CURDIR} temp-error2 XXXBASE=temp2bis XXXD=${D41}
 
@@ -768,7 +768,7 @@ rep6/avahi-0.tgz: plist25
 rep6/cups-0.tgz:
 	@${CREATE_PKG} -DREGRESSION_TESTING -P't/avahi:avahi-*:avahi-0' -W avahi.0.0 ${EMPTY} $@
 
-rep7/avahi-1.tgz: 
+rep7/avahi-1.tgz:
 	@${CREATE_PKG} -DREGRESSION_TESTING -P't/avahi-libs:avahi-libs-*:avahi-libs-1' ${EMPTY} $@
 
 rep7/avahi-libs-1.tgz: plist27
diff --git a/regress/usr.sbin/pkg_add/Wrapper.pm b/regress/usr.sbin/pkg_add/Wrapper.pm
index 3f75dff0b..c228a158b 100644
--- a/regress/usr.sbin/pkg_add/Wrapper.pm
+++ b/regress/usr.sbin/pkg_add/Wrapper.pm
@@ -30,7 +30,7 @@ sub wrap
 	my ($name, $sub) = @_;
 	my $typeglob = caller()."::$name";
 	my $original;
-	{ 	
+	{
 		no strict qw(refs);
 		$original = *$typeglob{CODE};
 	}
@@ -38,7 +38,7 @@ sub wrap
 		return &$sub($original, @_);
 	};
 
-	{ 
+	{
 		no strict qw(refs);
 		no warnings qw(redefine);
 		*{$typeglob} = $imposter;
diff --git a/regress/usr.sbin/pkg_add/check-beautify b/regress/usr.sbin/pkg_add/check-beautify
index 3ce9cbec7..4f572ad09 100644
--- a/regress/usr.sbin/pkg_add/check-beautify
+++ b/regress/usr.sbin/pkg_add/check-beautify
@@ -57,7 +57,7 @@ sub check_print
 
 my $u1 = create_set([qw(cups-2.9 cups-libs-2.9 mupdf-2.5)], [qw(mupdf-2.5 cups-3.1 cups-libs-3.1)]);
 
-ok(check_print($u1, 
+ok(check_print($u1,
     'cups-2.9+cups-libs-2.9+mupdf-2.5->cups-3.1+cups-libs-3.1+mupdf-2.5'));
 
 $u1->move_kept(OpenBSD::Handle->create_old('mupdf-2.5', $state));
diff --git a/regress/usr.sbin/pkg_add/check-cfl b/regress/usr.sbin/pkg_add/check-cfl
index ab4d0486c..54efc3501 100644
--- a/regress/usr.sbin/pkg_add/check-cfl
+++ b/regress/usr.sbin/pkg_add/check-cfl
@@ -17,7 +17,7 @@ sub check_list
 	my @r = sort(@$expected);
 	@_ = sort(@_);
 	if (@r != @_) {
-		print STDERR "length: ", scalar(@r)," vs. ", 
+		print STDERR "length: ", scalar(@r)," vs. ",
 		    scalar(@_), "\n";
 		    print STDERR "Expected: ", join(',', @r), "\n";
 		    print STDERR "Result: ", join(',', @_), "\n";
diff --git a/regress/usr.sbin/pkg_add/check-name b/regress/usr.sbin/pkg_add/check-name
index d10f974c1..63257ba95 100644
--- a/regress/usr.sbin/pkg_add/check-name
+++ b/regress/usr.sbin/pkg_add/check-name
@@ -12,7 +12,7 @@ sub check_list
 	my $expected = shift;
 	@_ = sort(@_);
 	if (@$expected != @_) {
-		print STDERR "length: ", scalar(@$expected)," vs. ", 
+		print STDERR "length: ", scalar(@$expected)," vs. ",
 		    scalar(@_), "\n";
 		    print STDERR join(',', @$expected), "\n";
 		    print STDERR join(',', @_), "\n";
@@ -62,29 +62,29 @@ sub check_order
 }
 
 @list = qw(py-MxDateTime-2.0.1-py2.1);
-ok(check_list(\@list, 
+ok(check_list(\@list,
     check_pkgspec('py-MxDateTime->=2.0-py2.1', @list)),
 	'flavor with number');
 @list = qw(foo-1.0 foo-1.0p0 foo-1.0p25);
-ok(check_list([qw(foo-1.0)], 
+ok(check_list([qw(foo-1.0)],
     check_pkgspec('foo-<1.0p0', @list)),
 	'before 1.0p0 came 1.0');
-ok(check_list([qw(foo-1.0 foo-1.0p0)], 
+ok(check_list([qw(foo-1.0 foo-1.0p0)],
     check_pkgspec('foo-<=1.0p0', @list)),
-	'1.0 and 1.0p0 both match <=1.0p0'); 
+	'1.0 and 1.0p0 both match <=1.0p0');
 ok(check_list([qw(foo-1.0 foo-1.0p0 foo-1.0p25)],
     check_pkgspec('foo-1.0', @list)),
 	'any 1.0p* matches 1.0');
 @list = qw(foo-1.0rc2);
 ok(check_list(\@list,
-    check_pkgspec('foo-<1.0', @list)),                                         
-       'before 1.0 came 1.0rc2');                                              
+    check_pkgspec('foo-<1.0', @list)),
+       'before 1.0 came 1.0rc2');
 @list = qw(foo-1.0);
 ok(check_list(\@list,
-    check_pkgspec('foo-<1.0pl1', @list)),                                      
-       'before 1.0pl1 came 1.0');                                              
+    check_pkgspec('foo-<1.0pl1', @list)),
+       'before 1.0pl1 came 1.0');
 
-my @pkglist=qw(foo-1.0 bar-2.0 foo-2.5 foobar-2.3-pouet hugs-noversion baz-0.0 
+my @pkglist=qw(foo-1.0 bar-2.0 foo-2.5 foobar-2.3-pouet hugs-noversion baz-0.0
 	baz-1.1 baz-25.3 pouet-1.0 pouet-zoinx-1.0 pouet-0.0-foo);
 
 my $hash = OpenBSD::PackageName::compile_stemlist(@pkglist);
@@ -111,9 +111,9 @@ ok(check_list([qw(hugs-noversion)],
     $hash->find('hugs-noversion')),
     	'stem matching with no version');
 ok(OpenBSD::PackageName->from_string('foo-1.0-f2-f1')->to_string
-    eq 'foo-1.0-f1-f2', 
+    eq 'foo-1.0-f1-f2',
     	'canonical names');
-ok(!OpenBSD::Search::PkgSpec->new('foo-<>1.5')->is_valid, 
+ok(!OpenBSD::Search::PkgSpec->new('foo-<>1.5')->is_valid,
 	'invalid spec');
 
 ok(check_list(["is a stem"], check_name("pkgname-without-version")),
diff --git a/regress/usr.sbin/pkg_add/check-path b/regress/usr.sbin/pkg_add/check-path
index 2b1f05851..847a28e92 100644
--- a/regress/usr.sbin/pkg_add/check-path
+++ b/regress/usr.sbin/pkg_add/check-path
@@ -39,7 +39,7 @@ my @p = (
 	make_plist('p1'), 			# 1
 	make_plist('p2'), 			# 2
 	make_plist('p2', 'p1'),			# 3
-	make_plist('p3', 'p1'),			# 4 
+	make_plist('p3', 'p1'),			# 4
 	make_plist('p4,flavor'),		# 5
 	make_plist('newp4', 'p4,flavor'),	# 6
 	make_plist('newp4', 'p4,otherflavor'),	# 7
diff --git a/regress/usr.sbin/pkg_add/inject-temp1 b/regress/usr.sbin/pkg_add/inject-temp1
index f1542696d..91bce5749 100644
--- a/regress/usr.sbin/pkg_add/inject-temp1
+++ b/regress/usr.sbin/pkg_add/inject-temp1
@@ -8,7 +8,7 @@ use OpenBSD::Temp;
 package OpenBSD::Temp;
 use Wrapper;
 
-wrap('permanent_dir', 
+wrap('permanent_dir',
     sub {
 	my $original = shift;
 	$_[0] = "/nonexistent";
diff --git a/regress/usr.sbin/pkg_add/inject-temp2 b/regress/usr.sbin/pkg_add/inject-temp2
index 0fad2b1e8..c7ceff496 100644
--- a/regress/usr.sbin/pkg_add/inject-temp2
+++ b/regress/usr.sbin/pkg_add/inject-temp2
@@ -8,7 +8,7 @@ use OpenBSD::Temp;
 package OpenBSD::Temp;
 use Wrapper;
 
-wrap('permanent_file', 
+wrap('permanent_file',
     sub {
 	my $original = shift;
 	$_[0] = "/nonexistent";
diff --git a/regress/usr.sbin/pkg_add/inject-temp3 b/regress/usr.sbin/pkg_add/inject-temp3
index 493e59e0d..ac8b2cf3f 100644
--- a/regress/usr.sbin/pkg_add/inject-temp3
+++ b/regress/usr.sbin/pkg_add/inject-temp3
@@ -8,7 +8,7 @@ use OpenBSD::Temp;
 package OpenBSD::Temp;
 use Wrapper;
 
-wrap('permanent_file', 
+wrap('permanent_file',
     sub {
 	my $original = shift;
 	$_[0] = "/nonexistent";
diff --git a/regress/usr.sbin/pkg_add/mycreate b/regress/usr.sbin/pkg_add/mycreate
index 13bb8925c..a283e9c73 100644
--- a/regress/usr.sbin/pkg_add/mycreate
+++ b/regress/usr.sbin/pkg_add/mycreate
@@ -32,7 +32,7 @@ if (!defined $pkgpath) {
 }
 
 my @l;
-push(@l, 
+push(@l,
 	'-p', $ENV{'PACKAGE_BASE'} || '/usr/local',
 	"-DFULLPKGPATH=$pkgpath",
 	'-DMAINTAINER=regress-tests',
@@ -40,7 +40,7 @@ push(@l,
 	'-DSHARED_LIBS=1',
 	'-d', $ENV{'PACKAGE_DESCR'} || '-descr',
 	'-A', $ENV{'PACKAGE_ARCH'} || '*');
-	
+
 
 my @args = ('pkg_create', @l, @ARGV, $target);
 print join(' ', @args), "\n" if $ENV{'VERBOSE'};
diff --git a/sbin/iked/iked.h b/sbin/iked/iked.h
index 2a26b93a5..31734b54c 100644
--- a/sbin/iked/iked.h
+++ b/sbin/iked/iked.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: iked.h,v 1.214 2023/05/30 08:41:15 claudio Exp $	*/
+/*	$OpenBSD: iked.h,v 1.215 2023/06/12 09:02:31 claudio Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -1270,8 +1270,7 @@ struct ibuf *
 int	 ibuf_cat(struct ibuf *, struct ibuf *);
 size_t	 ibuf_length(struct ibuf *);
 int	 ibuf_setsize(struct ibuf *, size_t);
-uint8_t *
-	 ibuf_data(struct ibuf *);
+void	*ibuf_data(struct ibuf *);
 void	*ibuf_getdata(struct ibuf *, size_t);
 struct ibuf *
 	 ibuf_get(struct ibuf *, size_t);
@@ -1279,8 +1278,6 @@ struct ibuf *
 	 ibuf_dup(struct ibuf *);
 struct ibuf *
 	 ibuf_random(size_t);
-int	 ibuf_strcat(struct ibuf **, const char *);
-int	 ibuf_strlen(struct ibuf *);
 
 /* log.c */
 void	log_init(int, int);
diff --git a/sbin/iked/ikev2.c b/sbin/iked/ikev2.c
index 9a63edff5..8c6106509 100644
--- a/sbin/iked/ikev2.c
+++ b/sbin/iked/ikev2.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ikev2.c,v 1.367 2023/05/23 13:57:14 claudio Exp $	*/
+/*	$OpenBSD: ikev2.c,v 1.368 2023/06/12 09:02:31 claudio Exp $	*/
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -3019,18 +3019,24 @@ ikev2_handle_delete(struct iked *env, struct iked_message *msg,
 	struct iked_childsa	**peersas = NULL;
 	struct iked_sa		*sa = msg->msg_sa;
 	struct ikev2_delete	*localdel;
-	struct ibuf		*spibuf = NULL;
+	FILE			*spif;
+	char			*spibuf = NULL;
 	uint64_t		*localspi = NULL;
 	uint64_t		 spi64, spi = 0;
 	uint32_t		 spi32;
 	uint8_t			*buf;
 	size_t			 found = 0;
 	int			 ret = -1;
-	size_t			 i, sz, cnt, len;
+	size_t			 i, sz, cnt, len, dummy;
 
 	if (!msg->msg_del_protoid)
 		return (0);
 
+	if ((spif = open_memstream(&spibuf, &dummy)) == NULL) {
+		log_warn("%s", __func__);
+		return (0);
+	}
+
 	sz = msg->msg_del_spisize;
 
 	switch (sz) {
@@ -3093,11 +3099,10 @@ ikev2_handle_delete(struct iked *env, struct iked_message *msg,
 		if (ikev2_childsa_delete(env, sa, msg->msg_del_protoid, spi,
 		    &localspi[i], 0) != -1) {
 			found++;
-
 			/* append SPI to log buffer */
-			if (ibuf_strlen(spibuf))
-				ibuf_strcat(&spibuf, ", ");
-			ibuf_strcat(&spibuf, print_spi(spi, sz));
+			if (ftello(spif) > 0)
+				fputs(", ", spif);
+			fputs(print_spi(spi, sz), spif);
 		}
 
 		/*
@@ -3143,11 +3148,12 @@ ikev2_handle_delete(struct iked *env, struct iked_message *msg,
 				break;
 			}
 		}
-		log_info("%sdeleted %zu SPI%s: %.*s",
-		    SPI_SA(sa, NULL), found,
-		    found == 1 ? "" : "s",
-		    spibuf ? ibuf_strlen(spibuf) : 0,
-		    spibuf ? (char *)ibuf_data(spibuf) : "");
+		fflush(spif);
+		if (!ferror(spif)) {
+			log_info("%sdeleted %zu SPI%s: %s",
+			    SPI_SA(sa, NULL), found, found == 1 ? "" : "s",
+			    spibuf);
+		}
 	} else {
 		/* XXX should we send an INVALID_SPI notification? */
 		ret = 0;
@@ -3156,7 +3162,8 @@ ikev2_handle_delete(struct iked *env, struct iked_message *msg,
  done:
 	free(localspi);
 	free(peersas);
-	ibuf_free(spibuf);
+	fclose(spif);
+	free(spibuf);
 
 	return (ret);
 }
@@ -6414,15 +6421,21 @@ ikev2_childsa_enable(struct iked *env, struct iked_sa *sa)
 	struct iked_childsa	*csa, *ocsa, *ipcomp;
 	struct iked_flow	*flow, *oflow;
 	int			 peer_changed, reload;
-	struct ibuf		*spibuf = NULL;
-	struct ibuf		*flowbuf = NULL;
-	char			*buf;
+	FILE			*spif, *flowf;
+	char			*spibuf = NULL, *flowbuf = NULL;
 	char			 prenat_mask[10];
 	uint16_t		 encrid = 0, integrid = 0, groupid = 0;
-	size_t			 encrlen = 0, integrlen = 0;
+	size_t			 encrlen = 0, integrlen = 0, spisz, flowsz;
 	int			 esn = 0;
 	int			 ret = -1;
 
+	spif = open_memstream(&spibuf, &spisz);
+	flowf = open_memstream(&flowbuf, &flowsz);
+	if (spif == NULL || flowf == NULL) {
+		log_warn("%s", __func__);
+		return (ret);
+	}
+
 	TAILQ_FOREACH(csa, &sa->sa_childsas, csa_entry) {
 		if (csa->csa_rekey || csa->csa_loaded)
 			continue;
@@ -6466,16 +6479,12 @@ ikev2_childsa_enable(struct iked *env, struct iked_sa *sa)
 		    print_spi(csa->csa_spi.spi, csa->csa_spi.spi_size));
 
 		/* append SPI to log buffer */
-		if (ibuf_strlen(spibuf))
-			ibuf_strcat(&spibuf, ", ");
-		ibuf_strcat(&spibuf, print_spi(csa->csa_spi.spi,
-		    csa->csa_spi.spi_size));
-		if (ipcomp) {
-			ibuf_strcat(&spibuf, "(");
-			ibuf_strcat(&spibuf, print_spi(ipcomp->csa_spi.spi,
+		if (ftello(spif) > 0)
+			fputs(", ", spif);
+		fputs(print_spi(csa->csa_spi.spi, csa->csa_spi.spi_size), spif);
+		if (ipcomp)
+			fprintf(spif, "(%s)", print_spi(ipcomp->csa_spi.spi,
 			    ipcomp->csa_spi.spi_size));
-			ibuf_strcat(&spibuf, ")");
-		}
 		if (!encrid) {
 			encrid = csa->csa_encrid;
 			encrlen = ibuf_length(csa->csa_encrkey);
@@ -6538,25 +6547,26 @@ ikev2_childsa_enable(struct iked *env, struct iked_sa *sa)
 			    flow->flow_prenat.addr_mask);
 		else
 			prenat_mask[0] = '\0';
-		if (flow->flow_dir == IPSP_DIRECTION_OUT &&
-		    asprintf(&buf, "%s-%s/%d%s%s%s%s%s=%s/%d(%u)%s",
-		    print_map(flow->flow_saproto, ikev2_saproto_map),
-		    print_host((struct sockaddr *)&flow->flow_src.addr, NULL, 0),
-		    flow->flow_src.addr_mask,
-		    flow->flow_prenat.addr_af != 0 ? "[": "",
-		    flow->flow_prenat.addr_af != 0 ? print_host((struct sockaddr *)
-		    &flow->flow_prenat.addr, NULL, 0) : "",
-		    flow->flow_prenat.addr_af != 0 ? "/" : "",
-		    flow->flow_prenat.addr_af != 0 ? prenat_mask : "",
-		    flow->flow_prenat.addr_af != 0 ? "]": "",
-		    print_host((struct sockaddr *)&flow->flow_dst.addr, NULL, 0),
-		    flow->flow_dst.addr_mask,
-		    flow->flow_ipproto,
-		    reload ? "-R" : "") != -1) {
-			if (ibuf_strlen(flowbuf))
-				ibuf_strcat(&flowbuf, ", ");
-			ibuf_strcat(&flowbuf, buf);
-			free(buf);
+		if (flow->flow_dir == IPSP_DIRECTION_OUT) {
+			if (ftello(flowf) > 0)
+				fputs(", ", flowf);
+			fprintf(flowf, "%s-%s/%d%s%s%s%s%s=%s/%d(%u)%s",
+			    print_map(flow->flow_saproto, ikev2_saproto_map),
+			    print_host((struct sockaddr *)&flow->flow_src.addr,
+			    NULL, 0),
+			    flow->flow_src.addr_mask,
+			    flow->flow_prenat.addr_af != 0 ? "[": "",
+			    flow->flow_prenat.addr_af != 0 ?
+			    print_host((struct sockaddr *)
+			    &flow->flow_prenat.addr, NULL, 0) : "",
+			    flow->flow_prenat.addr_af != 0 ? "/" : "",
+			    flow->flow_prenat.addr_af != 0 ? prenat_mask : "",
+			    flow->flow_prenat.addr_af != 0 ? "]": "",
+			    print_host((struct sockaddr *)&flow->flow_dst.addr,
+			    NULL, 0),
+			    flow->flow_dst.addr_mask,
+			    flow->flow_ipproto,
+			    reload ? "-R" : "");
 		}
 	}
 
@@ -6569,10 +6579,10 @@ ikev2_childsa_enable(struct iked *env, struct iked_sa *sa)
 		    NULL, 0));
 	}
 
-	if (ibuf_strlen(spibuf)) {
-		log_info("%s: loaded SPIs: %.*s (enc %s%s%s%s%s%s)",
-		    SPI_SA(sa, __func__),
-		    ibuf_strlen(spibuf), ibuf_data(spibuf),
+	fflush(spif);
+	if (ftello(spif) > 0 && !ferror(spif)) {
+		log_info("%s: loaded SPIs: %s (enc %s%s%s%s%s%s)",
+		    SPI_SA(sa, __func__), spibuf,
 		    print_xf(encrid, encrlen, ipsecencxfs),
 		    integrid ? " auth " : "",
 		    integrid ? print_xf(integrid, integrlen, authxfs) : "",
@@ -6580,14 +6590,17 @@ ikev2_childsa_enable(struct iked *env, struct iked_sa *sa)
 		    groupid ? print_xf(groupid, 0, groupxfs) : "",
 		    esn ? " esn" : "");
 	}
-	if (ibuf_strlen(flowbuf))
-		log_info("%s: loaded flows: %.*s", SPI_SA(sa, __func__),
-		    ibuf_strlen(flowbuf), ibuf_data(flowbuf));
+	fflush(flowf);
+	if (ftello(flowf) > 0 && !ferror(flowf)) {
+		log_info("%s: loaded flows: %s", SPI_SA(sa, __func__), flowbuf);
+	}
 
 	ret = 0;
  done:
-	ibuf_free(spibuf);
-	ibuf_free(flowbuf);
+	fclose(spif);
+	fclose(flowf);
+	free(spibuf);
+	free(flowbuf);
 	return (ret);
 }
 
diff --git a/sbin/iked/imsg_util.c b/sbin/iked/imsg_util.c
index 67ba8a276..cf83b5c98 100644
--- a/sbin/iked/imsg_util.c
+++ b/sbin/iked/imsg_util.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg_util.c,v 1.17 2023/05/30 08:41:15 claudio Exp $	*/
+/*	$OpenBSD: imsg_util.c,v 1.18 2023/06/12 09:02:32 claudio Exp $	*/
 
 /*
  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
@@ -83,7 +83,7 @@ ibuf_length(struct ibuf *buf)
 	return (ibuf_size(buf));
 }
 
-uint8_t *
+void *
 ibuf_data(struct ibuf *buf)
 {
 	return (ibuf_seek(buf, 0, 0));
@@ -144,27 +144,3 @@ ibuf_setsize(struct ibuf *buf, size_t len)
 	buf->wpos = len;
 	return (0);
 }
-
-int
-ibuf_strcat(struct ibuf **buf, const char *s)
-{
-	size_t slen;
-
-	if (buf == NULL)
-		return (-1);
-	slen = strlen(s);
-	if (*buf == NULL) {
-		if ((*buf = ibuf_new(s, slen)) == NULL)
-			return (-1);
-		return (0);
-	}
-	return (ibuf_add(*buf, s, slen));
-}
-
-int
-ibuf_strlen(struct ibuf *buf)
-{
-	if (ibuf_length(buf) > INT_MAX)
-		return (INT_MAX);
-	return ((int)ibuf_length(buf));
-}
diff --git a/share/man/man4/urtwn.4 b/share/man/man4/urtwn.4
index 17522017b..967bd69e0 100644
--- a/share/man/man4/urtwn.4
+++ b/share/man/man4/urtwn.4
@@ -1,4 +1,4 @@
-.\" $OpenBSD: urtwn.4,v 1.55 2023/04/28 06:21:42 jmc Exp $
+.\" $OpenBSD: urtwn.4,v 1.56 2023/06/12 11:30:55 jsg Exp $
 .\"
 .\" Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: April 28 2023 $
+.Dd $Mdocdate: June 12 2023 $
 .Dt URTWN 4
 .Os
 .Sh NAME
@@ -122,6 +122,7 @@ The following adapters should work:
 .It Hercules Wireless N USB Pico HWNUp-150
 .It IO-DATA WN-G150UM
 .It ISY IWL4000 USB Wireless Micro Adapter
+.It Mercusys MW150US V2
 .It Netgear WNA1000A
 .It Netgear WNA1000M
 .It Netgear WNA1000Mv2
diff --git a/sys/dev/usb/if_urtwn.c b/sys/dev/usb/if_urtwn.c
index f1ab054e2..a44868558 100644
--- a/sys/dev/usb/if_urtwn.c
+++ b/sys/dev/usb/if_urtwn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_urtwn.c,v 1.107 2023/04/28 01:24:14 kevlo Exp $	*/
+/*	$OpenBSD: if_urtwn.c,v 1.108 2023/06/12 11:27:30 jsg Exp $	*/
 
 /*-
  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -333,6 +333,7 @@ static const struct urtwn_type {
 	URTWN_DEV_8188EU(DLINK,		DWA125D1),
 	URTWN_DEV_8188EU(EDIMAX,	EW7811UNV2),
 	URTWN_DEV_8188EU(ELECOM,	WDC150SU2M),
+	URTWN_DEV_8188EU(MERCUSYS,	MW150USV2),
 	URTWN_DEV_8188EU(REALTEK,	RTL8188ETV),
 	URTWN_DEV_8188EU(REALTEK,	RTL8188EU),
 	URTWN_DEV_8188EU(TPLINK,	RTL8188EUS),
diff --git a/sys/dev/usb/usbdevs b/sys/dev/usb/usbdevs
index edb86ebbf..ec94e2bbf 100644
--- a/sys/dev/usb/usbdevs
+++ b/sys/dev/usb/usbdevs
@@ -1,4 +1,4 @@
-$OpenBSD: usbdevs,v 1.756 2023/05/10 18:26:05 miod Exp $
+$OpenBSD: usbdevs,v 1.757 2023/06/12 11:26:24 jsg Exp $
 /* $NetBSD: usbdevs,v 1.322 2003/05/10 17:47:14 hamajima Exp $ */
 
 /*
@@ -645,6 +645,7 @@ vendor THINGM		0x27b8	ThingM
 vendor ASUSTEK		0x2821	ASUSTeK Computer
 vendor PIONEERDJ	0x2b73	Pioneer DJ
 vendor PLANEX		0x2c02	Planex Communications
+vendor MERCUSYS		0x2c4e	Mercusys
 vendor QUECTEL		0x2c7c	Quectel
 vendor CLUB3D		0x2d1c	Club 3D
 vendor AQUANTIA		0x2eca	Aquantia
@@ -3099,6 +3100,9 @@ product MELCO UWABR100		0x017f	SONY UWA-BR100
 product MELCO WLIUCGNM		0x01a2	WLI-UC-GNM
 product MELCO WLIUCGNM2		0x01ee	WLI-UC-GNM2
 
+/* Mercusys products */
+product MERCUSYS MW150USV2	0x0102	MW150US V2
+
 /* MetaGeek products */
 product METAGEEK WISPY24I	0x2400	Wi-Spy 2.4i
 
diff --git a/sys/dev/usb/usbdevs.h b/sys/dev/usb/usbdevs.h
index 022a71013..1f562a8d7 100644
--- a/sys/dev/usb/usbdevs.h
+++ b/sys/dev/usb/usbdevs.h
@@ -1,10 +1,10 @@
-/*	$OpenBSD: usbdevs.h,v 1.768 2023/05/10 18:26:43 miod Exp $	*/
+/*	$OpenBSD: usbdevs.h,v 1.769 2023/06/12 11:26:54 jsg Exp $	*/
 
 /*
  * THIS FILE IS AUTOMATICALLY GENERATED.  DO NOT EDIT.
  *
  * generated from:
- *	OpenBSD: usbdevs,v 1.756 2023/05/10 18:26:05 miod Exp 
+ *	OpenBSD: usbdevs,v 1.757 2023/06/12 11:26:24 jsg Exp 
  */
 /* $NetBSD: usbdevs,v 1.322 2003/05/10 17:47:14 hamajima Exp $ */
 
@@ -652,6 +652,7 @@
 #define	USB_VENDOR_ASUSTEK	0x2821		/* ASUSTeK Computer */
 #define	USB_VENDOR_PIONEERDJ	0x2b73		/* Pioneer DJ */
 #define	USB_VENDOR_PLANEX	0x2c02		/* Planex Communications */
+#define	USB_VENDOR_MERCUSYS	0x2c4e		/* Mercusys */
 #define	USB_VENDOR_QUECTEL	0x2c7c		/* Quectel */
 #define	USB_VENDOR_CLUB3D	0x2d1c		/* Club 3D */
 #define	USB_VENDOR_AQUANTIA	0x2eca		/* Aquantia */
@@ -3106,6 +3107,9 @@
 #define	USB_PRODUCT_MELCO_WLIUCGNM	0x01a2		/* WLI-UC-GNM */
 #define	USB_PRODUCT_MELCO_WLIUCGNM2	0x01ee		/* WLI-UC-GNM2 */
 
+/* Mercusys products */
+#define	USB_PRODUCT_MERCUSYS_MW150USV2	0x0102		/* MW150US V2 */
+
 /* MetaGeek products */
 #define	USB_PRODUCT_METAGEEK_WISPY24I	0x2400		/* Wi-Spy 2.4i */
 
diff --git a/sys/dev/usb/usbdevs_data.h b/sys/dev/usb/usbdevs_data.h
index 92c80f0ce..8632a0c1c 100644
--- a/sys/dev/usb/usbdevs_data.h
+++ b/sys/dev/usb/usbdevs_data.h
@@ -1,10 +1,10 @@
-/*	$OpenBSD: usbdevs_data.h,v 1.762 2023/05/10 18:26:43 miod Exp $	*/
+/*	$OpenBSD: usbdevs_data.h,v 1.763 2023/06/12 11:26:54 jsg Exp $	*/
 
 /*
  * THIS FILE IS AUTOMATICALLY GENERATED.  DO NOT EDIT.
  *
  * generated from:
- *	OpenBSD: usbdevs,v 1.756 2023/05/10 18:26:05 miod Exp 
+ *	OpenBSD: usbdevs,v 1.757 2023/06/12 11:26:24 jsg Exp 
  */
 /* $NetBSD: usbdevs,v 1.322 2003/05/10 17:47:14 hamajima Exp $ */
 
@@ -7513,6 +7513,10 @@ const struct usb_known_product usb_known_products[] = {
 	    USB_VENDOR_MELCO, USB_PRODUCT_MELCO_WLIUCGNM2,
 	    "WLI-UC-GNM2",
 	},
+	{
+	    USB_VENDOR_MERCUSYS, USB_PRODUCT_MERCUSYS_MW150USV2,
+	    "MW150US V2",
+	},
 	{
 	    USB_VENDOR_METAGEEK, USB_PRODUCT_METAGEEK_WISPY24I,
 	    "Wi-Spy 2.4i",
@@ -14681,6 +14685,10 @@ const struct usb_known_vendor usb_known_vendors[] = {
 	    USB_VENDOR_PLANEX,
 	    "Planex Communications",
 	},
+	{
+	    USB_VENDOR_MERCUSYS,
+	    "Mercusys",
+	},
 	{
 	    USB_VENDOR_QUECTEL,
 	    "Quectel",
diff --git a/sys/net/if.c b/sys/net/if.c
index 208dd4483..a4755f6b9 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if.c,v 1.699 2023/06/05 11:35:46 bluhm Exp $	*/
+/*	$OpenBSD: if.c,v 1.700 2023/06/12 21:19:54 mvs Exp $	*/
 /*	$NetBSD: if.c,v 1.35 1996/05/07 05:26:04 thorpej Exp $	*/
 
 /*
@@ -1170,6 +1170,8 @@ if_detach(struct ifnet *ifp)
 			ifafree(ifa);
 		}
 	}
+	splx(s);
+	NET_UNLOCK();
 
 	KASSERT(TAILQ_EMPTY(&ifp->if_addrhooks));
 	KASSERT(TAILQ_EMPTY(&ifp->if_linkstatehooks));
@@ -1178,8 +1180,6 @@ if_detach(struct ifnet *ifp)
 #ifdef INET6
 	nd6_ifdetach(ifp);
 #endif
-	splx(s);
-	NET_UNLOCK();
 
 	/* Announce that the interface is gone. */
 	rtm_ifannounce(ifp, IFAN_DEPARTURE);
diff --git a/usr.bin/seq/seq.c b/usr.bin/seq/seq.c
index 56f678a6d..be0717607 100644
--- a/usr.bin/seq/seq.c
+++ b/usr.bin/seq/seq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: seq.c,v 1.6 2022/02/25 16:00:39 tb Exp $	*/
+/*	$OpenBSD: seq.c,v 1.7 2023/06/12 20:15:06 millert Exp $	*/
 
 /*-
  * Copyright (c) 2005 The NetBSD Foundation, Inc.
@@ -89,13 +89,13 @@ main(int argc, char *argv[])
 	double first = 1.0;
 	double last = 0.0;
 	double incr = 0.0;
-	double last_shown_value = 0.0;
+	double prev = 0.0;
 	double cur, step;
 	struct lconv *locale;
 	char *fmt = NULL;
 	const char *sep = "\n";
 	const char *term = "\n";
-	char *cur_print, *last_print;
+	char *cur_print, *last_print, *prev_print;
 	char pad = ZERO;
 
 	if (pledge("stdio", NULL) == -1)
@@ -176,34 +176,37 @@ main(int argc, char *argv[])
 	} else
 		fmt = generate_format(first, incr, last, equalize, pad);
 
+	warnx("first: %f, incr: %f", first, incr);
 	for (step = 1, cur = first; incr > 0 ? cur <= last : cur >= last;
 	    cur = first + incr * step++) {
 		if (cur != first)
 			fputs(sep, stdout);
 		printf(fmt, cur);
-		last_shown_value = cur;
+		prev = cur;
 	}
 
 	/*
 	 * Did we miss the last value of the range in the loop above?
 	 *
 	 * We might have, so check if the printable version of the last
-	 * computed value ('cur') and desired 'last' value are equal.  If they
-	 * are equal after formatting truncation, but 'cur' and
-	 * 'last_shown_value' are not equal, it means the exit condition of the
-	 * loop held true due to a rounding error and we still need to print
-	 * 'last'.
+	 * computed value ('cur') and desired 'last' value are equal.  If
+	 * they are equal after formatting truncation, but 'cur' and 'prev'
+	 * are different, it means the exit condition of the loop held true
+	 * due to a rounding error and we still need to print 'last'.
 	 */
 	if (asprintf(&cur_print, fmt, cur) == -1 ||
-	    asprintf(&last_print, fmt, last) == -1)
+	    asprintf(&last_print, fmt, last) == -1 ||
+	    asprintf(&prev_print, fmt, prev) == -1)
 		err(1, "asprintf");
-	if (strcmp(cur_print, last_print) == 0 && cur != last_shown_value) {
+	if (strcmp(cur_print, last_print) == 0 &&
+	    strcmp(cur_print, prev_print) != 0) {
 		if (cur != first)
 			fputs(sep, stdout);
 		fputs(last_print, stdout);
 	}
 	free(cur_print);
 	free(last_print);
+	free(prev_print);
 
 	fputs(term, stdout);
 
diff --git a/usr.sbin/bgpd/rde.c b/usr.sbin/bgpd/rde.c
index 8d51ec20b..894e541f5 100644
--- a/usr.sbin/bgpd/rde.c
+++ b/usr.sbin/bgpd/rde.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.c,v 1.605 2023/04/20 15:44:45 claudio Exp $ */
+/*	$OpenBSD: rde.c,v 1.606 2023/06/12 12:48:07 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -2828,7 +2828,6 @@ rde_dump_rib_as(struct prefix *p, struct rde_aspath *asp, pid_t pid, int flags,
 	struct rib_entry	*re;
 	struct prefix		*xp;
 	struct rde_peer		*peer;
-	void			*bp;
 	time_t			 staletime;
 	size_t			 aslen;
 	uint8_t			 l;
@@ -2931,15 +2930,10 @@ rde_dump_rib_as(struct prefix *p, struct rde_aspath *asp, pid_t pid, int flags,
 			if ((a = asp->others[l]) == NULL)
 				break;
 			if ((wbuf = imsg_create(ibuf_se_ctl,
-			    IMSG_CTL_SHOW_RIB_ATTR, 0, pid,
-			    attr_optlen(a))) == NULL)
+			    IMSG_CTL_SHOW_RIB_ATTR, 0, pid, 0)) == NULL)
 				return;
-			if ((bp = ibuf_reserve(wbuf, attr_optlen(a))) == NULL) {
-				ibuf_free(wbuf);
-				return;
-			}
-			if (attr_write(bp, attr_optlen(a), a->flags,
-			    a->type, a->data, a->len) == -1) {
+			if (attr_writebuf(wbuf, a->flags, a->type, a->data,
+			    a->len) == -1) {
 				ibuf_free(wbuf);
 				return;
 			}
diff --git a/usr.sbin/bgpd/rde.h b/usr.sbin/bgpd/rde.h
index 1ed3e15d2..d7a0aebba 100644
--- a/usr.sbin/bgpd/rde.h
+++ b/usr.sbin/bgpd/rde.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.h,v 1.293 2023/04/19 13:23:33 claudio Exp $ */
+/*	$OpenBSD: rde.h,v 1.294 2023/06/12 12:48:07 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Claudio Jeker <claudio@openbsd.org> and
@@ -401,8 +401,6 @@ void		 attr_copy(struct rde_aspath *, const struct rde_aspath *);
 int		 attr_compare(struct rde_aspath *, struct rde_aspath *);
 void		 attr_freeall(struct rde_aspath *);
 void		 attr_free(struct rde_aspath *, struct attr *);
-#define		 attr_optlen(x)	\
-    ((x)->len > 255 ? (x)->len + 4 : (x)->len + 3)
 
 struct aspath	*aspath_get(void *, uint16_t);
 struct aspath	*aspath_copy(struct aspath *);
diff --git a/usr.sbin/bgpd/rde_attr.c b/usr.sbin/bgpd/rde_attr.c
index f6e24baff..982f5cdac 100644
--- a/usr.sbin/bgpd/rde_attr.c
+++ b/usr.sbin/bgpd/rde_attr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde_attr.c,v 1.132 2022/12/14 12:37:15 claudio Exp $ */
+/*	$OpenBSD: rde_attr.c,v 1.133 2023/06/12 12:10:17 claudio Exp $ */
 
 /*
  * Copyright (c) 2004 Claudio Jeker <claudio@openbsd.org>
@@ -85,7 +85,7 @@ attr_writebuf(struct ibuf *buf, uint8_t flags, uint8_t type, void *data,
 
 	if (ibuf_add(buf, hdr, flags & ATTR_EXTLEN ? 4 : 3) == -1)
 		return (-1);
-	if (data && ibuf_add(buf, data, data_len) == -1)
+	if (data != NULL && ibuf_add(buf, data, data_len) == -1)
 		return (-1);
 	return (0);
 }
diff --git a/usr.sbin/rpki-client/Makefile b/usr.sbin/rpki-client/Makefile
index 13a5a710c..1b5b3308e 100644
--- a/usr.sbin/rpki-client/Makefile
+++ b/usr.sbin/rpki-client/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.30 2023/04/27 07:57:25 claudio Exp $
+#	$OpenBSD: Makefile,v 1.31 2023/06/12 14:56:38 claudio Exp $
 
 PROG=	rpki-client
 SRCS=	as.c aspa.c cert.c cms.c crl.c encoding.c filemode.c gbr.c geofeed.c \
@@ -9,8 +9,8 @@ SRCS=	as.c aspa.c cert.c cms.c crl.c encoding.c filemode.c gbr.c geofeed.c \
 	tal.c validate.c x509.c
 MAN=	rpki-client.8
 
-LDADD+= -lexpat -ltls -lssl -lcrypto -lutil
-DPADD+= ${LIBEXPAT} ${LIBTLS} ${LIBSSL} ${LIBCRYPTO} ${LIBUTIL}
+LDADD+= -lexpat -ltls -lssl -lcrypto -lutil -lz
+DPADD+= ${LIBEXPAT} ${LIBTLS} ${LIBSSL} ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 
 CFLAGS+= -Wall -I${.CURDIR}
 CFLAGS+= -Wstrict-prototypes -Wmissing-prototypes
diff --git a/usr.sbin/rpki-client/cms.c b/usr.sbin/rpki-client/cms.c
index eb8a20165..e78d2fb53 100644
--- a/usr.sbin/rpki-client/cms.c
+++ b/usr.sbin/rpki-client/cms.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cms.c,v 1.34 2023/05/30 11:09:08 tb Exp $ */
+/*	$OpenBSD: cms.c,v 1.35 2023/06/12 18:22:02 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -315,11 +315,9 @@ cms_parse_validate_internal(X509 **xp, const char *fn, const unsigned char *der,
 
 	if (!x509_get_notafter(*xp, fn, &notafter))
 		goto out;
-	if (*signtime > notafter) {
+	if (*signtime > notafter)
 		warnx("%s: dating issue: CMS signing-time after X.509 notAfter",
 		    fn);
-		goto out;
-	}
 
 	if (CMS_SignerInfo_get0_signer_id(si, &kid, NULL, NULL) != 1 ||
 	    kid == NULL) {
diff --git a/usr.sbin/rpki-client/http.c b/usr.sbin/rpki-client/http.c
index 700f06b5b..c1927529e 100644
--- a/usr.sbin/rpki-client/http.c
+++ b/usr.sbin/rpki-client/http.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: http.c,v 1.74 2023/05/10 15:24:41 claudio Exp $ */
+/*	$OpenBSD: http.c,v 1.76 2023/06/12 15:27:52 claudio Exp $ */
 /*
  * Copyright (c) 2020 Nils Fisher <nils_fisher@hotmail.com>
  * Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
@@ -52,6 +52,7 @@
 #include <ctype.h>
 #include <err.h>
 #include <errno.h>
+#include <imsg.h>
 #include <limits.h>
 #include <netdb.h>
 #include <poll.h>
@@ -61,7 +62,7 @@
 #include <string.h>
 #include <unistd.h>
 #include <vis.h>
-#include <imsg.h>
+#include <zlib.h>
 
 #include <tls.h>
 
@@ -70,7 +71,7 @@
 #define HTTP_USER_AGENT		"OpenBSD rpki-client"
 #define HTTP_BUF_SIZE		(32 * 1024)
 #define HTTP_IDLE_TIMEOUT	10
-#define MAX_CONTENTLEN		(2 * 1024 * 1024 * 1024LL)
+#define MAX_CONTENTLEN		(2 * 1024 * 1024 * 1024UL)
 #define NPFDS			(MAX_HTTP_REQUESTS + 1)
 
 enum res {
@@ -104,6 +105,15 @@ struct http_proxy {
 	char	*proxyauth;
 } proxy;
 
+struct http_zlib {
+	z_stream		 zs;
+	char			*zbuf;
+	size_t			 zbufsz;
+	size_t			 zbufpos;
+	size_t			 zinsz;
+	int			 zdone;
+};
+
 struct http_connection {
 	LIST_ENTRY(http_connection)	entry;
 	char			*host;
@@ -116,15 +126,17 @@ struct http_connection {
 	struct addrinfo		*res;
 	struct tls		*tls;
 	char			*buf;
+	struct http_zlib	*zlibctx;
 	size_t			bufsz;
 	size_t			bufpos;
-	off_t			iosz;
-	off_t			totalsz;
+	size_t			iosz;
+	size_t			totalsz;
 	time_t			idle_time;
 	time_t			io_time;
 	int			status;
 	int			fd;
 	int			chunked;
+	int			gzipped;
 	int			keep_alive;
 	short			events;
 	enum http_state		state;
@@ -164,6 +176,13 @@ static void	http_req_done(unsigned int, enum http_result, const char *);
 static void	http_req_fail(unsigned int);
 static int	http_req_schedule(struct http_request *);
 
+/* HTTP decompression helper */
+static int	http_inflate_new(struct http_connection *);
+static void	http_inflate_free(struct http_connection *);
+static void	http_inflate_done(struct http_connection *);
+static int	http_inflate_data(struct http_connection *);
+static enum res	http_inflate_advance(struct http_connection *);
+
 /* HTTP connection API */
 static void	http_new(struct http_request *);
 static void	http_free(struct http_connection *);
@@ -191,6 +210,7 @@ static enum res	http_write(struct http_connection *);
 static enum res	proxy_read(struct http_connection *);
 static enum res	proxy_write(struct http_connection *);
 static enum res	data_write(struct http_connection *);
+static enum res	data_inflate_write(struct http_connection *);
 
 /*
  * Return a string that can be used in error message to identify the
@@ -666,6 +686,141 @@ http_req_schedule(struct http_request *req)
 	return 0;
 }
 
+/*
+ * Allocate everything to allow inline decompression during write out.
+ * Returns 0 on success, -1 on failure.
+ */
+static int
+http_inflate_new(struct http_connection *conn)
+{
+	struct http_zlib *zctx;
+
+	if (conn->zlibctx != NULL)
+		return 0;
+
+	if ((zctx = calloc(1, sizeof(*zctx))) == NULL)
+		goto fail;
+	zctx->zbufsz = HTTP_BUF_SIZE;
+	if ((zctx->zbuf = malloc(zctx->zbufsz)) == NULL)
+		goto fail;
+	if (inflateInit2(&zctx->zs, MAX_WBITS + 32) != Z_OK)
+		goto fail;
+	conn->zlibctx = zctx;
+	return 0;
+
+ fail:
+	warnx("%s: decompression initalisation failed", conn_info(conn));
+	if (zctx != NULL)
+		free(zctx->zbuf);
+	free(zctx);
+	return -1;
+}
+
+/* Free all memory used by the decompression API */
+static void
+http_inflate_free(struct http_connection *conn)
+{
+	if (conn->zlibctx == NULL)
+		return;
+	inflateEnd(&conn->zlibctx->zs);
+	free(conn->zlibctx->zbuf);
+	free(conn->zlibctx);
+	conn->zlibctx = NULL;
+}
+
+/* Reset the decompression state to allow a new request to use it */
+static void
+http_inflate_done(struct http_connection *conn)
+{
+	if (inflateReset(&conn->zlibctx->zs) != Z_OK)
+		http_inflate_free(conn);
+}
+
+/*
+ * Inflate the data from conn->buf into zctx->zbuf. The number of bytes
+ * available in zctx->zbuf is stored in zctx->zbufpos.
+ * Returns -1 on failure.
+ */
+static int
+http_inflate_data(struct http_connection *conn)
+{
+	struct http_zlib *zctx = conn->zlibctx;
+	size_t bsz = conn->bufpos;
+	int rv;
+
+	if (conn->iosz < bsz)
+		bsz = conn->iosz;
+
+	zctx->zdone = 0;
+	zctx->zbufpos = 0;
+	zctx->zinsz = bsz;
+	zctx->zs.next_in = conn->buf;
+	zctx->zs.avail_in = bsz;
+	zctx->zs.next_out = zctx->zbuf;
+	zctx->zs.avail_out = zctx->zbufsz;
+
+	switch ((rv = inflate(&zctx->zs, Z_NO_FLUSH))) {
+	case Z_OK:
+		break;
+	case Z_STREAM_END:
+		zctx->zdone = 1;
+		break;
+	default:
+		if (zctx->zs.msg != NULL)
+			warnx("%s: inflate failed: %s", conn_info(conn),
+			    zctx->zs.msg);
+		else
+			warnx("%s: inflate failed error %d", conn_info(conn),
+			    rv);
+		return -1;
+	}
+
+	/* calculate how much can be written out */
+	zctx->zbufpos = zctx->zbufsz - zctx->zs.avail_out;
+	return 0;
+}
+
+/*
+ * Advance the input buffer after the output buffer has been fully written.
+ * If compression is done finish the transaction else read more data.
+ */
+static enum res
+http_inflate_advance(struct http_connection *conn)
+{
+	struct http_zlib *zctx = conn->zlibctx;
+	size_t bsz = zctx->zinsz - zctx->zs.avail_in;
+
+	/* adjust compressed input buffer */
+	conn->bufpos -= bsz;
+	conn->iosz -= bsz;
+	memmove(conn->buf, conn->buf + bsz, conn->bufpos);
+
+	if (zctx->zdone) {
+		/* all compressed data processed */
+		conn->gzipped = 0;
+		http_inflate_done(conn);
+
+		if (conn->iosz == 0) {
+			if (!conn->chunked) {
+				return http_done(conn, HTTP_OK);
+			} else {
+				conn->state = STATE_RESPONSE_CHUNKED_CRLF;
+				return http_read(conn);
+			}
+		} else {
+			warnx("%s: inflate extra data after end",
+			    conn_info(conn));
+			return http_failed(conn);
+		}
+	}
+
+	if (conn->chunked && conn->iosz == 0)
+		conn->state = STATE_RESPONSE_CHUNKED_CRLF;
+	else
+		conn->state = STATE_RESPONSE_DATA;
+	return http_read(conn);
+}
+
 /*
  * Create a new HTTP connection which will be used for the HTTP request req.
  * On errors a req faulure is issued and both connection and request are freed.
@@ -722,6 +877,7 @@ http_free(struct http_connection *conn)
 	http_conn_count--;
 
 	http_req_free(conn->req);
+	http_inflate_free(conn);
 	free(conn->host);
 	free(conn->port);
 	free(conn->last_modified);
@@ -752,6 +908,11 @@ http_done(struct http_connection *conn, enum http_result res)
 	assert(conn->chunked == 0);
 	assert(conn->redir_uri == NULL);
 
+	if (conn->gzipped) {
+		conn->gzipped = 0;
+		http_inflate_done(conn);
+	}
+
 	conn->state = STATE_IDLE;
 	conn->idle_time = getmonotime() + HTTP_IDLE_TIMEOUT;
 
@@ -945,12 +1106,12 @@ http_tls_connect(struct http_connection *conn)
 		return http_failed(conn);
 	}
 	if (tls_configure(conn->tls, tls_config) == -1) {
-		warnx("%s: TLS configuration: %s\n", conn_info(conn),
+		warnx("%s: TLS configuration: %s", conn_info(conn),
 		    tls_error(conn->tls));
 		return http_failed(conn);
 	}
 	if (tls_connect_socket(conn->tls, conn->fd, conn->host) == -1) {
-		warnx("%s: TLS connect: %s\n", conn_info(conn),
+		warnx("%s: TLS connect: %s", conn_info(conn),
 		    tls_error(conn->tls));
 		return http_failed(conn);
 	}
@@ -1060,7 +1221,7 @@ http_request(struct http_connection *conn)
 	if ((r = asprintf(&conn->buf,
 	    "GET /%s HTTP/1.1\r\n"
 	    "Host: %s\r\n"
-	    "Accept-Encoding: identity\r\n"
+	    "Accept-Encoding: gzip, deflate\r\n"
 	    "User-Agent: " HTTP_USER_AGENT "\r\n"
 	    "%s\r\n",
 	    epath, host,
@@ -1195,6 +1356,7 @@ http_parse_header(struct http_connection *conn, char *buf)
 #define LOCATION "Location:"
 #define CONNECTION "Connection:"
 #define TRANSFER_ENCODING "Transfer-Encoding:"
+#define CONTENT_ENCODING "Content-Encoding:"
 #define LAST_MODIFIED "Last-Modified:"
 	const char *errstr;
 	char *cp, *redirurl;
@@ -1263,6 +1425,17 @@ http_parse_header(struct http_connection *conn, char *buf)
 		cp[strcspn(cp, " \t")] = '\0';
 		if (strcasecmp(cp, "chunked") == 0)
 			conn->chunked = 1;
+	} else if (strncasecmp(cp, CONTENT_ENCODING,
+	    sizeof(CONTENT_ENCODING) - 1) == 0) {
+		cp += sizeof(CONTENT_ENCODING) - 1;
+		cp += strspn(cp, " \t");
+		cp[strcspn(cp, " \t")] = '\0';
+		if (strcasecmp(cp, "gzip") == 0 ||
+		    strcasecmp(cp, "deflate") == 0) {
+			if (http_inflate_new(conn) == -1)
+				return -1;
+			conn->gzipped = 1;
+		}
 	} else if (strncasecmp(cp, CONNECTION, sizeof(CONNECTION) - 1) == 0) {
 		cp += sizeof(CONNECTION) - 1;
 		cp += strspn(cp, " \t");
@@ -1332,7 +1505,7 @@ http_parse_chunked(struct http_connection *conn, char *buf)
 	errno = 0;
 	chunksize = strtoul(header, &end, 16);
 	if (header[0] == '\0' || *end != '\0' || (errno == ERANGE &&
-	    chunksize == ULONG_MAX) || chunksize > INT_MAX)
+	    chunksize == ULONG_MAX) || chunksize > MAX_CONTENTLEN)
 		return -1;
 
 	conn->iosz = chunksize;
@@ -1452,7 +1625,7 @@ again:
 		return http_failed(conn);
 	case STATE_RESPONSE_DATA:
 		if (conn->bufpos != conn->bufsz &&
-		    conn->iosz > (off_t)conn->bufpos)
+		    conn->iosz > conn->bufpos)
 			goto read_more;
 
 		/* got a buffer full of data */
@@ -1460,7 +1633,7 @@ again:
 			/*
 			 * After redirects all data needs to be discarded.
 			 */
-			if (conn->iosz < (off_t)conn->bufpos) {
+			if (conn->iosz < conn->bufpos) {
 				conn->bufpos -= conn->iosz;
 				conn->iosz = 0;
 			} else {
@@ -1696,7 +1869,7 @@ data_write(struct http_connection *conn)
 
 	assert(conn->state == STATE_WRITE_DATA);
 
-	if (conn->iosz < (off_t)bsz)
+	if (conn->iosz < bsz)
 		bsz = conn->iosz;
 
 	s = write(conn->req->outfd, conn->buf, bsz);
@@ -1732,6 +1905,49 @@ data_write(struct http_connection *conn)
 	return WANT_POLLOUT;
 }
 
+/*
+ * Inflate and write data into provided file descriptor.
+ * This is a simplified version of data_write() that just writes out the
+ * decompressed file stream. All the buffer handling is done by
+ * http_inflate_data() and http_inflate_advance().
+ */
+static enum res
+data_inflate_write(struct http_connection *conn)
+{
+	struct http_zlib *zctx = conn->zlibctx;
+	ssize_t s;
+
+	assert(conn->state == STATE_WRITE_DATA);
+
+	/* no decompressed data, get more */
+	if (zctx->zbufpos == 0)
+		if (http_inflate_data(conn) == -1)
+			return http_failed(conn);
+
+	s = write(conn->req->outfd, zctx->zbuf, zctx->zbufpos);
+	if (s == -1) {
+		warn("%s: data write", conn_info(conn));
+		return http_failed(conn);
+	}
+
+	conn->totalsz += s;
+	if (conn->totalsz > MAX_CONTENTLEN) {
+		warn("%s: too much decompressed data offered", conn_info(conn));
+		return http_failed(conn);
+	}
+
+	/* adjust output buffer */
+	zctx->zbufpos -= s;
+	memmove(zctx->zbuf, zctx->zbuf + s, zctx->zbufpos);
+
+	/* all decompressed data written, progress input */
+	if (zctx->zbufpos == 0)
+		return http_inflate_advance(conn);
+
+	/* still more data to write in buffer */
+	return WANT_POLLOUT;
+}
+
 /*
  * Do one IO call depending on the connection state.
  * Return WANT_POLLIN or WANT_POLLOUT to poll for more data.
@@ -1765,7 +1981,10 @@ http_handle(struct http_connection *conn)
 	case STATE_RESPONSE_CHUNKED_TRAILER:
 		return http_read(conn);
 	case STATE_WRITE_DATA:
-		return data_write(conn);
+		if (conn->gzipped)
+			return data_inflate_write(conn);
+		else
+			return data_write(conn);
 	case STATE_CLOSE:
 		return http_close(conn);
 	case STATE_IDLE:
diff --git a/usr.sbin/smtpd/envelope.c b/usr.sbin/smtpd/envelope.c
index c9611beb4..0cdf9b5fb 100644
--- a/usr.sbin/smtpd/envelope.c
+++ b/usr.sbin/smtpd/envelope.c
@@ -275,7 +275,7 @@ ascii_load_sockaddr(struct sockaddr_storage *ss, char *buf)
 	}
 	else if (buf[0] == '[' && buf[strlen(buf)-1] == ']') {
 		struct addrinfo hints, *res0;
-		
+
 		buf[strlen(buf)-1] = '\0';
 
 		/* getaddrinfo() is used to support scoped addresses. */
diff --git a/usr.sbin/smtpd/lka.c b/usr.sbin/smtpd/lka.c
index 764130d60..49a18d6d2 100644
--- a/usr.sbin/smtpd/lka.c
+++ b/usr.sbin/smtpd/lka.c
@@ -333,7 +333,7 @@ lka_imsg(struct mproc *p, struct imsg *imsg)
 		if (table == NULL) {
 			log_warnx("warn: Lookup table not found: "
 			    "\"%s\"", (char *)imsg->data);
-		} else 
+		} else
 			ret = table_update(table);
 
 		m_compose(p_control,
diff --git a/usr.sbin/smtpd/lka_filter.c b/usr.sbin/smtpd/lka_filter.c
index 0c63657be..7eabb178f 100644
--- a/usr.sbin/smtpd/lka_filter.c
+++ b/usr.sbin/smtpd/lka_filter.c
@@ -71,7 +71,7 @@ struct filter_session {
 	char *helo;
 	char *username;
 	char *mail_from;
-	
+
 	enum filter_phase	phase;
 };
 
@@ -290,7 +290,7 @@ processor_io(struct io *io, int evt, void *arg)
 				processor_register(name, line);
 				continue;
 			}
-			
+
 			processor = dict_xget(&processors, name);
 			if (!processor->ready)
 				fatalx("Non-register message before register|"
@@ -849,7 +849,7 @@ filter_protocol(uint64_t reqid, enum filter_phase phase, const char *param)
 	struct filter_session  *fs;
 	uint64_t		token = 0;
 	char		       *nparam = NULL;
-	
+
 	fs = tree_xget(&sessions, reqid);
 
 	switch (phase) {
@@ -927,7 +927,7 @@ filter_protocol_query(struct filter *filter, uint64_t token, uint64_t reqid, con
 	struct timeval	tv;
 
 	gettimeofday(&tv, NULL);
-	
+
 	fs = tree_xget(&sessions, reqid);
 	if (strcmp(phase, "connect") == 0)
 		n = io_printf(lka_proc_get_io(filter->proc),
@@ -1021,7 +1021,7 @@ filter_check_rdns_table(struct filter *filter, enum table_service kind, const ch
 
 	if (filter->config->rdns_table == NULL)
 		return 0;
-	
+
 	if (table_match(filter->config->rdns_table, kind, key) > 0)
 		ret = 1;
 
@@ -1113,7 +1113,7 @@ filter_check_auth_table(struct filter *filter, enum table_service kind, const ch
 
 	if (filter->config->auth_table == NULL)
 		return 0;
-	
+
 	if (key && table_match(filter->config->auth_table, kind, key) > 0)
 		ret = 1;
 
diff --git a/usr.sbin/smtpd/mail.lmtp.c b/usr.sbin/smtpd/mail.lmtp.c
index d460f4ca8..fb76d4797 100644
--- a/usr.sbin/smtpd/mail.lmtp.c
+++ b/usr.sbin/smtpd/mail.lmtp.c
@@ -49,7 +49,7 @@ struct session {
 static int lmtp_connect(const char *);
 static void lmtp_engine(int, struct session *);
 static void stream_file(FILE *);
-	
+
 int
 main(int argc, char *argv[])
 {
@@ -109,7 +109,7 @@ main(int argc, char *argv[])
 
 	conn = lmtp_connect(destination);
 	lmtp_engine(conn, &session);
-	
+
 	return (0);
 }
 
@@ -155,7 +155,7 @@ lmtp_connect_inet(const char *destination)
 		*p++ = '\0';
 		servname = p;
 	}
-	
+
 	memset(&hints, 0, sizeof hints);
 	hints.ai_family = PF_UNSPEC;
 	hints.ai_socktype = SOCK_STREAM;
@@ -198,7 +198,7 @@ lmtp_connect_unix(const char *destination)
 
 	if (*destination != '/')
 		errx(EX_TEMPFAIL, "unix: path must be absolute");
-	
+
 	if ((s = socket(PF_LOCAL, SOCK_STREAM, 0)) == -1)
 		err(EX_TEMPFAIL, NULL);
 
@@ -263,7 +263,7 @@ lmtp_engine(int fd_read, struct session *session)
 
 		if (line[0] != (phase == PHASE_DATA ? '3' : '2'))
 			errx(EX_TEMPFAIL, "LMTP server error: %s", line);
-		
+
 		if (line[3] == '-')
 			continue;
 
@@ -302,7 +302,7 @@ lmtp_engine(int fd_read, struct session *session)
 		case PHASE_EOM:
 			fprintf(file_write, "QUIT\r\n");
 			phase++;
-			break;						
+			break;
 
 		case PHASE_QUIT:
 			exit(0);
diff --git a/usr.sbin/smtpd/mda.c b/usr.sbin/smtpd/mda.c
index bdc695f1b..b131f9d20 100644
--- a/usr.sbin/smtpd/mda.c
+++ b/usr.sbin/smtpd/mda.c
@@ -335,7 +335,7 @@ mda_imsg(struct mproc *p, struct imsg *imsg)
 		syserror = NULL;
 		if (mda_sysexit)
 			syserror = mda_sysexit_to_str(mda_sysexit);
-		
+
 		/* update queue entry */
 		switch (mda_status) {
 		case MDA_TEMPFAIL:
diff --git a/usr.sbin/smtpd/mta_session.c b/usr.sbin/smtpd/mta_session.c
index 160b41d30..4528927c9 100644
--- a/usr.sbin/smtpd/mta_session.c
+++ b/usr.sbin/smtpd/mta_session.c
@@ -271,7 +271,7 @@ mta_session_imsg(struct mproc *p, struct imsg *imsg)
 	const char		*name;
 	int			 status;
 	struct stat		 sb;
-	
+
 	switch (imsg->hdr.type) {
 
 	case IMSG_MTA_OPEN_MESSAGE:
@@ -312,7 +312,7 @@ mta_session_imsg(struct mproc *p, struct imsg *imsg)
 				return;
 			}
 		}
-		
+
 		s->datafp = fdopen(imsg->fd, "r");
 		if (s->datafp == NULL)
 			fatal("mta: fdopen");
diff --git a/usr.sbin/smtpd/parse.y b/usr.sbin/smtpd/parse.y
index 42d396868..7025011a3 100644
--- a/usr.sbin/smtpd/parse.y
+++ b/usr.sbin/smtpd/parse.y
@@ -168,7 +168,7 @@ typedef struct {
 %token	BACKUP BOUNCE BYPASS
 %token	CA CERT CHAIN CHROOT CIPHERS COMMIT COMPRESSION CONNECT
 %token	DATA DATA_LINE DHE DISCONNECT DOMAIN
-%token	EHLO ENABLE ENCRYPTION ERROR EXPAND_ONLY 
+%token	EHLO ENABLE ENCRYPTION ERROR EXPAND_ONLY
 %token	FCRDNS FILTER FOR FORWARD_ONLY FROM
 %token	GROUP
 %token	HELO HELO_SRC HOST HOSTNAME HOSTNAMES
@@ -408,7 +408,7 @@ PKI STRING {
 	}
 } pki_params
 ;
- 
+
 pki_params_opt:
 CERT STRING {
 	pki->pki_cert_file = $2;
@@ -3356,7 +3356,7 @@ config_listener(struct listener *h,  struct listen_opts *lo)
 
 	if (lo->ssl & F_STARTTLS_REQUIRE)
 		h->flags |= F_STARTTLS_REQUIRE;
-	
+
 	if (h != conf->sc_sock_listener)
 		TAILQ_INSERT_TAIL(conf->sc_listeners, h, entry);
 }
diff --git a/usr.sbin/smtpd/ruleset.c b/usr.sbin/smtpd/ruleset.c
index 5a268c9ae..9eca85671 100644
--- a/usr.sbin/smtpd/ruleset.c
+++ b/usr.sbin/smtpd/ruleset.c
@@ -56,7 +56,7 @@ ruleset_match_from(struct rule *r, const struct envelope *evp)
 
 	if (evp->flags & EF_INTERNAL) {
 		/* if expanded from an empty table_from, skip rule
-		 * if no table 
+		 * if no table
 		 */
 		if (r->table_from == NULL)
 			return 0;
diff --git a/usr.sbin/smtpd/smtp_session.c b/usr.sbin/smtpd/smtp_session.c
index 1686f03e9..222d87579 100644
--- a/usr.sbin/smtpd/smtp_session.c
+++ b/usr.sbin/smtpd/smtp_session.c
@@ -1338,25 +1338,25 @@ smtp_command(struct smtp_session *s, char *line)
 	 */
 	case CMD_QUIT:
 		if (!smtp_check_noparam(s, args))
-			break;		
+			break;
 		smtp_filter_phase(FILTER_QUIT, s, NULL);
 		break;
 
 	case CMD_NOOP:
 		if (!smtp_check_noparam(s, args))
-			break;		
+			break;
 		smtp_filter_phase(FILTER_NOOP, s, NULL);
 		break;
 
 	case CMD_HELP:
 		if (!smtp_check_noparam(s, args))
-			break;		
+			break;
 		smtp_proceed_help(s, NULL);
 		break;
 
 	case CMD_WIZ:
 		if (!smtp_check_noparam(s, args))
-			break;		
+			break;
 		smtp_proceed_wiz(s, NULL);
 		break;
 
@@ -1527,7 +1527,7 @@ smtp_check_mail_from(struct smtp_session *s, const char *args)
 	struct mailaddr	sender;
 
 	(void)strlcpy(tmp, args, sizeof tmp);
-	copy = tmp;  
+	copy = tmp;
 
 	if (s->helo[0] == '\0' || s->tx) {
 		smtp_reply(s, "503 %s %s: Command not allowed at this point.",
@@ -1579,7 +1579,7 @@ smtp_check_rcpt_to(struct smtp_session *s, const char *args)
 	char tmp[SMTP_LINE_MAX];
 
 	(void)strlcpy(tmp, args, sizeof tmp);
-	copy = tmp; 
+	copy = tmp;
 
 	if (s->tx == NULL) {
 		smtp_reply(s, "503 %s %s: Command not allowed at this point.",
@@ -1831,7 +1831,7 @@ smtp_proceed_mail_from(struct smtp_session *s, const char *args)
 	char tmp[SMTP_LINE_MAX];
 
 	(void)strlcpy(tmp, args, sizeof tmp);
-	copy = tmp;  
+	copy = tmp;
 
        	if (!smtp_tx(s)) {
 		smtp_reply(s, "421 %s Temporary Error",
@@ -2340,7 +2340,7 @@ smtp_tx_mail_from(struct smtp_tx *tx, const char *line)
 	char tmp[SMTP_LINE_MAX];
 
 	(void)strlcpy(tmp, line, sizeof tmp);
-	copy = tmp;  
+	copy = tmp;
 
 	if (smtp_mailaddr(&tx->evp.sender, copy, 1, &copy,
 		tx->session->smtpname) == 0) {
@@ -2421,7 +2421,7 @@ smtp_tx_rcpt_to(struct smtp_tx *tx, const char *line)
 	char tmp[SMTP_LINE_MAX];
 
 	(void)strlcpy(tmp, line, sizeof tmp);
-	copy = tmp; 
+	copy = tmp;
 
 	if (tx->rcptcount >= env->sc_session_max_rcpt) {
 		smtp_reply(tx->session, "451 %s %s: Too many recipients",
@@ -2745,8 +2745,8 @@ smtp_message_begin(struct smtp_tx *tx)
 	log_debug("smtp: %p: message begin", s);
 
 	smtp_reply(s, "354 Enter mail, end with \".\""
-	    " on a line by itself");	
-	
+	    " on a line by itself");
+
 	if (s->junk || (s->tx && s->tx->junk))
 		m_printf(tx, "X-Spam: Yes\n");
 
@@ -2809,7 +2809,7 @@ smtp_message_end(struct smtp_tx *tx)
 	switch(tx->error) {
 	case TX_OK:
 		smtp_tx_commit(tx);
-		return;		
+		return;
 
 	case TX_ERROR_SIZE:
 		smtp_reply(s, "554 %s %s: Transaction failed, message too big",
diff --git a/usr.sbin/smtpd/smtpd.c b/usr.sbin/smtpd/smtpd.c
index 0bd24de8a..df569963a 100644
--- a/usr.sbin/smtpd/smtpd.c
+++ b/usr.sbin/smtpd/smtpd.c
@@ -344,7 +344,7 @@ parent_sig_handler(int sig, short event, void *p)
 			int len;
 			enum mda_resp_status mda_status;
 			int mda_sysexit;
-			
+
 			pid = waitpid(-1, &status, WNOHANG);
 			if (pid <= 0)
 				continue;
@@ -1355,7 +1355,7 @@ fork_filter_process(const char *name, const char *command, const char *user, con
 	if (command[0] == '/')
 		execr = snprintf(exec, sizeof(exec), "exec %s", command);
 	else
-		execr = snprintf(exec, sizeof(exec), "exec %s/%s", 
+		execr = snprintf(exec, sizeof(exec), "exec %s/%s",
 		    PATH_LIBEXEC, command);
 	if (execr >= (int) sizeof(exec))
 		fatalx("%s: exec path too long", name);
diff --git a/usr.sbin/smtpd/table_static.c b/usr.sbin/smtpd/table_static.c
index af57038f2..d563fc8be 100644
--- a/usr.sbin/smtpd/table_static.c
+++ b/usr.sbin/smtpd/table_static.c
@@ -219,7 +219,7 @@ table_static_config(struct table *t)
 		return 0;
 	priv->type = t->t_type;
 	dict_init(&priv->dict);
-	
+
 	if (*t->t_config) {
 		/* load the config file */
 		if (table_static_priv_load(priv, t->t_config) == 0) {
diff --git a/usr.sbin/snmpd/application.c b/usr.sbin/snmpd/application.c
index dd9286478..1ef4027e6 100644
--- a/usr.sbin/snmpd/application.c
+++ b/usr.sbin/snmpd/application.c
@@ -378,7 +378,7 @@ appl_register(const char *ctxname, uint32_t timeout, uint8_t priority,
 	search.ar_oid = *oid;
 	if (search.ar_oid.bo_id[range_subid] == lower_bound)
 		return error;
-	
+
 	for (search.ar_oid.bo_id[range_subid]--;
 	    search.ar_oid.bo_id[range_subid] != lower_bound;
 	    search.ar_oid.bo_id[range_subid]--) {
diff --git a/usr.sbin/snmpd/application_agentx.c b/usr.sbin/snmpd/application_agentx.c
index c7a2a2691..c1a9a5587 100644
--- a/usr.sbin/snmpd/application_agentx.c
+++ b/usr.sbin/snmpd/application_agentx.c
@@ -467,7 +467,7 @@ appl_agentx_open(struct appl_agentx_connection *conn, struct ax_pdu *pdu)
 			goto fail;
 		}
 	}
-	    
+
 	/* RFC 2742 agentxSessionIndex: chances of reuse, slim to none */
 	do {
 		session->sess_id = arc4random();
@@ -584,7 +584,7 @@ appl_agentx_register(struct appl_agentx_session *session, struct ax_pdu *pdu)
 	}
 
 	error = appl_register(pdu->ap_context.aos_string, timeout,
-	    pdu->ap_payload.ap_register.ap_priority, &oid, 
+	    pdu->ap_payload.ap_register.ap_priority, &oid,
 	    pdu->ap_header.aph_flags & AX_PDU_FLAG_INSTANCE_REGISTRATION,
 	    subtree, pdu->ap_payload.ap_register.ap_range_subid,
 	    pdu->ap_payload.ap_register.ap_upper_bound,
@@ -611,8 +611,8 @@ appl_agentx_unregister(struct appl_agentx_session *session, struct ax_pdu *pdu)
 		goto fail;
 	}
 
-	error = appl_unregister(pdu->ap_context.aos_string, 
-	    pdu->ap_payload.ap_unregister.ap_priority, &oid, 
+	error = appl_unregister(pdu->ap_context.aos_string,
+	    pdu->ap_payload.ap_unregister.ap_priority, &oid,
 	    pdu->ap_payload.ap_unregister.ap_range_subid,
 	    pdu->ap_payload.ap_unregister.ap_upper_bound,
 	    &(session->sess_backend));
@@ -806,7 +806,7 @@ appl_agentx_oid2ber_oid(struct ax_oid *aoid, struct ber_oid *boid)
 		errno = EINVAL;
 		return NULL;
 	}
-	
+
 
 	boid->bo_n = aoid->aoi_idlen;
 	for (i = 0; i < boid->bo_n; i++)
diff --git a/usr.sbin/snmpd/snmpd.c b/usr.sbin/snmpd/snmpd.c
index 6a1f4e5bc..08696024d 100644
--- a/usr.sbin/snmpd/snmpd.c
+++ b/usr.sbin/snmpd/snmpd.c
@@ -96,7 +96,7 @@ snmpd_sig_handler(int sig, short event, void *arg)
 
 			if (len == -1)
 				fatal("asprintf");
-			
+
 			for (id = 0; id < PROC_MAX; id++) {
 				if (pid == ps->ps_pid[id] &&
 				    check_child(ps->ps_pid[id],
diff --git a/usr.sbin/snmpd/snmpd.h b/usr.sbin/snmpd/snmpd.h
index 7abeeea0a..0bc18d29d 100644
--- a/usr.sbin/snmpd/snmpd.h
+++ b/usr.sbin/snmpd/snmpd.h
@@ -49,7 +49,7 @@
  */
 
 #define CONF_FILE		"/etc/snmpd.conf"
-#define SNMPD_BACKEND		"/usr/libexec/snmpd"                                                                                                                                                                                                                                                                        
+#define SNMPD_BACKEND		"/usr/libexec/snmpd"
 #define SNMPD_USER		"_snmpd"
 #define SNMP_PORT		"161"
 #define SNMPTRAP_PORT		"162"
diff --git a/usr.sbin/spamdb/spamdb.c b/usr.sbin/spamdb/spamdb.c
index cb5d31efe..55f2b62b2 100644
--- a/usr.sbin/spamdb/spamdb.c
+++ b/usr.sbin/spamdb/spamdb.c
@@ -235,14 +235,14 @@ print_entry(DBT *dbk, DBT *dbd)
 		to = strchr(from, '\n');
 		if (to == NULL) {
 			/* probably old format - print it the
-			 * with an empty HELO field instead 
+			 * with an empty HELO field instead
 			 * of erroring out.
-			 */			  
+			 */
 			printf("GREY|%s|%s|%s|%s|%lld|%lld|%lld|%d|%d\n",
 			    a, "", helo, from, (long long)gd.first,
 			    (long long)gd.pass, (long long)gd.expire,
 			    gd.bcount, gd.pcount);
-		
+
 		} else {
 			*to = '\0';
 			to++;
diff --git a/usr.sbin/unbound/Makefile.in b/usr.sbin/unbound/Makefile.in
index babbe4260..df57b7f3b 100644
--- a/usr.sbin/unbound/Makefile.in
+++ b/usr.sbin/unbound/Makefile.in
@@ -198,7 +198,7 @@ CHECKCONF_OBJ=unbound-checkconf.lo worker_cb.lo
 CHECKCONF_OBJ_LINK=$(CHECKCONF_OBJ) $(COMMON_OBJ_ALL_SYMBOLS) $(SLDNS_OBJ) \
 $(COMPAT_OBJ) @WIN_CHECKCONF_OBJ_LINK@
 CONTROL_SRC=smallapp/unbound-control.c
-CONTROL_OBJ=unbound-control.lo 
+CONTROL_OBJ=unbound-control.lo
 CONTROL_OBJ_LINK=$(CONTROL_OBJ) worker_cb.lo $(COMMON_OBJ_ALL_SYMBOLS) \
 $(SLDNS_OBJ) $(COMPAT_OBJ) @WIN_CONTROL_OBJ_LINK@
 HOST_SRC=smallapp/unbound-host.c
@@ -516,7 +516,7 @@ distclean: clean
 	rm -f doc/example.conf doc/libunbound.3 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound-control.8 doc/unbound.8 doc/unbound.conf.5 doc/unbound-host.1
 	rm -f smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service
 	rm -f $(TEST_BIN)
-	rm -f Makefile 
+	rm -f Makefile
 
 maintainer-clean: distclean
 	rm -f util/configlexer.c util/configparser.c util/configparser.h
@@ -650,7 +650,7 @@ uninstall:	$(PYTHONMOD_UNINSTALL) $(PYUNBOUND_UNINSTALL) $(UNBOUND_EVENT_UNINSTA
 
 iana_update:
 	curl -o port-numbers.tmp https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml --compressed
-	if file port-numbers.tmp | grep 'gzip' >/dev/null; then zcat port-numbers.tmp; else cat port-numbers.tmp; fi | awk '/<record>/ {p=0;} /<protocol>udp/ {p=1;} /<protocol>[^u]/ {p=0;} /Decomissioned|Decommissioned|Removed|De-registered|unassigned|Unassigned|Reserved/ {u=1;} /<number>/ { if(u==1) {u=0;} else { if(p==1) { match($$0,/[0-9]+/); print substr($$0, RSTART, RLENGTH) ","}}}' | sort -nu > util/iana_ports.inc  
+	if file port-numbers.tmp | grep 'gzip' >/dev/null; then zcat port-numbers.tmp; else cat port-numbers.tmp; fi | awk '/<record>/ {p=0;} /<protocol>udp/ {p=1;} /<protocol>[^u]/ {p=0;} /Decomissioned|Decommissioned|Removed|De-registered|unassigned|Unassigned|Reserved/ {u=1;} /<number>/ { if(u==1) {u=0;} else { if(p==1) { match($$0,/[0-9]+/); print substr($$0, RSTART, RLENGTH) ","}}}' | sort -nu > util/iana_ports.inc
 	rm -f port-numbers.tmp
 
 # dependency generation
@@ -878,7 +878,7 @@ rpz.lo rpz.o: $(srcdir)/services/rpz.c config.h $(srcdir)/services/rpz.h $(srcdi
 outbound_list.lo outbound_list.o: $(srcdir)/services/outbound_list.c config.h \
  $(srcdir)/services/outbound_list.h $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
- 
+
 outside_network.lo outside_network.o: $(srcdir)/services/outside_network.c config.h \
  $(srcdir)/services/outside_network.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h \
  $(srcdir)/dnscrypt/dnscrypt.h   \
@@ -1187,7 +1187,7 @@ unitmain.lo unitmain.o: $(srcdir)/testcode/unitmain.c config.h $(srcdir)/sldns/r
  $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
   $(srcdir)/util/random.h $(srcdir)/respip/respip.h \
  $(srcdir)/services/localzone.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
- $(srcdir)/services/outside_network.h 
+ $(srcdir)/services/outside_network.h
 unitmsgparse.lo unitmsgparse.o: $(srcdir)/testcode/unitmsgparse.c config.h $(srcdir)/util/log.h \
  $(srcdir)/testcode/unitmain.h $(srcdir)/util/data/msgparse.h $(srcdir)/util/storage/lruhash.h \
  $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \
diff --git a/usr.sbin/unbound/libunbound/libunbound.c b/usr.sbin/unbound/libunbound/libunbound.c
index ea5ef24bb..9ca2c3979 100644
--- a/usr.sbin/unbound/libunbound/libunbound.c
+++ b/usr.sbin/unbound/libunbound/libunbound.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * This file contains functions to resolve DNS queries and 
+ * This file contains functions to resolve DNS queries and
  * validate the answers. Synchronously and asynchronously.
  *
  */
@@ -92,7 +92,7 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 	int r;
 	WSADATA wsa_data;
 #endif
-	
+
 	checklock_start();
 	if(!ctx_logfile_overridden)
 		log_init(NULL, 0, NULL); /* logs to stderr */
@@ -175,7 +175,7 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 	return ctx;
 }
 
-struct ub_ctx* 
+struct ub_ctx*
 ub_ctx_create(void)
 {
 	struct ub_ctx* ctx = ub_ctx_create_nopipe();
@@ -211,7 +211,7 @@ ub_ctx_create(void)
 	return ctx;
 }
 
-struct ub_ctx* 
+struct ub_ctx*
 ub_ctx_create_ub_event(struct ub_event_base* ueb)
 {
 	struct ub_ctx* ctx = ub_ctx_create_nopipe();
@@ -225,7 +225,7 @@ ub_ctx_create_ub_event(struct ub_event_base* ueb)
 	return ctx;
 }
 
-struct ub_ctx* 
+struct ub_ctx*
 ub_ctx_create_event(struct event_base* eb)
 {
 	struct ub_ctx* ctx = ub_ctx_create_nopipe();
@@ -243,7 +243,7 @@ ub_ctx_create_event(struct event_base* eb)
 	ctx->event_base_malloced = 1;
 	return ctx;
 }
-	
+
 /** delete q */
 static void
 delq(rbnode_type* n, void* ATTR_UNUSED(arg))
@@ -263,7 +263,7 @@ static void ub_stop_bg(struct ub_ctx* ctx)
 		uint32_t cmd = UB_LIBCMD_QUIT;
 		lock_basic_unlock(&ctx->cfglock);
 		lock_basic_lock(&ctx->qqpipe_lock);
-		(void)tube_write_msg(ctx->qq_pipe, (uint8_t*)&cmd, 
+		(void)tube_write_msg(ctx->qq_pipe, (uint8_t*)&cmd,
 			(uint32_t)sizeof(cmd), 0);
 		lock_basic_unlock(&ctx->qqpipe_lock);
 		lock_basic_lock(&ctx->rrpipe_lock);
@@ -298,7 +298,7 @@ static void ub_stop_bg(struct ub_ctx* ctx)
 	}
 }
 
-void 
+void
 ub_ctx_delete(struct ub_ctx* ctx)
 {
 	struct alloc_cache* a, *na;
@@ -361,7 +361,7 @@ ub_ctx_delete(struct ub_ctx* ctx)
 #endif
 }
 
-int 
+int
 ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val)
 {
 	lock_basic_lock(&ctx->cfglock);
@@ -390,7 +390,7 @@ ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str)
 	return r;
 }
 
-int 
+int
 ub_ctx_config(struct ub_ctx* ctx, const char* fname)
 {
 	lock_basic_lock(&ctx->cfglock);
@@ -406,7 +406,7 @@ ub_ctx_config(struct ub_ctx* ctx, const char* fname)
 	return UB_NOERROR;
 }
 
-int 
+int
 ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta)
 {
 	char* dup = strdup(ta);
@@ -425,7 +425,7 @@ ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta)
 	return UB_NOERROR;
 }
 
-int 
+int
 ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname)
 {
 	char* dup = strdup(fname);
@@ -463,7 +463,7 @@ int ub_ctx_add_ta_autr(struct ub_ctx* ctx, const char* fname)
 	return UB_NOERROR;
 }
 
-int 
+int
 ub_ctx_trustedkeys(struct ub_ctx* ctx, const char* fname)
 {
 	char* dup = strdup(fname);
@@ -503,7 +503,7 @@ int ub_ctx_debugout(struct ub_ctx* ctx, void* out)
 	return UB_NOERROR;
 }
 
-int 
+int
 ub_ctx_async(struct ub_ctx* ctx, int dothread)
 {
 #ifdef THREADS_DISABLED
@@ -520,14 +520,14 @@ ub_ctx_async(struct ub_ctx* ctx, int dothread)
 	return UB_NOERROR;
 }
 
-int 
+int
 ub_poll(struct ub_ctx* ctx)
 {
 	/* no need to hold lock while testing for readability. */
 	return tube_poll(ctx->rr_pipe);
 }
 
-int 
+int
 ub_fd(struct ub_ctx* ctx)
 {
 	return tube_read_fd(ctx->rr_pipe);
@@ -618,7 +618,7 @@ process_answer(struct ub_ctx* ctx, uint8_t* msg, uint32_t len)
 	return r;
 }
 
-int 
+int
 ub_process(struct ub_ctx* ctx)
 {
 	int r;
@@ -642,7 +642,7 @@ ub_process(struct ub_ctx* ctx)
 	return UB_NOERROR;
 }
 
-int 
+int
 ub_wait(struct ub_ctx* ctx)
 {
 	int err;
@@ -681,7 +681,7 @@ ub_wait(struct ub_ctx* ctx)
 				lock_basic_unlock(&ctx->rrpipe_lock);
 				continue;
 			}
-			r = process_answer_detail(ctx, msg, len, 
+			r = process_answer_detail(ctx, msg, len,
 				&cb, &cbarg, &err, &res);
 			lock_basic_unlock(&ctx->rrpipe_lock);
 			free(msg);
@@ -696,8 +696,8 @@ ub_wait(struct ub_ctx* ctx)
 	return UB_NOERROR;
 }
 
-int 
-ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, 
+int
+ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
 	int rrclass, struct ub_result** result)
 {
 	struct ctx_query* q;
@@ -740,8 +740,8 @@ ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
 	return UB_NOERROR;
 }
 
-int 
-ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype, 
+int
+ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 	int rrclass, void* mydata, ub_event_callback_type callback,
 	int* async_id)
 {
@@ -782,8 +782,8 @@ ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 }
 
 
-int 
-ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, 
+int
+ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	int rrclass, void* mydata, ub_callback_type callback, int* async_id)
 {
 	struct ctx_query* q;
@@ -833,7 +833,7 @@ ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	if(async_id)
 		*async_id = q->querynum;
 	lock_basic_unlock(&ctx->cfglock);
-	
+
 	lock_basic_lock(&ctx->qqpipe_lock);
 	if(!tube_write_msg(ctx->qq_pipe, msg, len, 0)) {
 		lock_basic_unlock(&ctx->qqpipe_lock);
@@ -845,7 +845,7 @@ ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	return UB_NOERROR;
 }
 
-int 
+int
 ub_cancel(struct ub_ctx* ctx, int async_id)
 {
 	struct ctx_query* q;
@@ -860,7 +860,7 @@ ub_cancel(struct ub_ctx* ctx, int async_id)
 	}
 	log_assert(q->async);
 	q->cancelled = 1;
-	
+
 	/* delete it */
 	if(!ctx->dothread) { /* if forked */
 		(void)rbtree_delete(&ctx->queries, q->node.key);
@@ -886,7 +886,7 @@ ub_cancel(struct ub_ctx* ctx, int async_id)
 	return UB_NOERROR;
 }
 
-void 
+void
 ub_resolve_free(struct ub_result* result)
 {
 	char** p;
@@ -904,7 +904,7 @@ ub_resolve_free(struct ub_result* result)
 	free(result);
 }
 
-const char* 
+const char*
 ub_strerror(int err)
 {
 	switch(err) {
@@ -923,7 +923,7 @@ ub_strerror(int err)
 	}
 }
 
-int 
+int
 ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 {
 	struct sockaddr_storage storage;
@@ -955,7 +955,7 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 		errno=EINVAL;
 		return UB_SYNTAX;
 	}
-	
+
 	/* it parses, add root stub in front of list */
 	lock_basic_lock(&ctx->cfglock);
 	if(!ctx->env->cfg->forwards ||
@@ -1088,7 +1088,7 @@ int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
 	return UB_NOERROR;
 }
 
-int 
+int
 ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 {
 	FILE* in;
@@ -1106,7 +1106,7 @@ ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 		IP_ADDR_STRING *ptr;
 
 		info = (FIXED_INFO *) malloc(sizeof (FIXED_INFO));
-		if (info == NULL) 
+		if (info == NULL)
 			return UB_READFILE;
 
 		if (GetNetworkParams(info, &buflen) == ERROR_BUFFER_OVERFLOW) {
@@ -1121,7 +1121,7 @@ ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 			ptr = &(info->DnsServerList);
 			while (ptr) {
 				numserv++;
-				if((retval=ub_ctx_set_fwd(ctx, 
+				if((retval=ub_ctx_set_fwd(ctx,
 					ptr->IpAddress.String))!=0) {
 					free(info);
 					return retval;
@@ -1159,7 +1159,7 @@ ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname)
 				parse++;
 			/* terminate after the address, remove newline */
 			*parse = 0;
-			
+
 			if((r = ub_ctx_set_fwd(ctx, addr)) != UB_NOERROR) {
 				fclose(in);
 				return r;
@@ -1197,10 +1197,10 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 		name = getenv("WINDIR");
 		if (name != NULL) {
 			int retval=0;
-			snprintf(buf, sizeof(buf), "%s%s", name, 
+			snprintf(buf, sizeof(buf), "%s%s", name,
 				"\\system32\\drivers\\etc\\hosts");
 			if((retval=ub_ctx_hosts(ctx, buf)) !=0 ) {
-				snprintf(buf, sizeof(buf), "%s%s", name, 
+				snprintf(buf, sizeof(buf), "%s%s", name,
 					"\\hosts");
 				retval=ub_ctx_hosts(ctx, buf);
 			}
@@ -1232,7 +1232,7 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 			parse++;
 		if(*parse == '\n' || *parse == 0)
 			continue;
-		if(*parse == '%') 
+		if(*parse == '%')
 			continue; /* ignore macOSX fe80::1%lo0 localhost */
 		if(*parse != ' ' && *parse != '\t') {
 			/* must have whitespace after address */
@@ -1264,7 +1264,7 @@ ub_ctx_hosts(struct ub_ctx* ctx, const char* fname)
 				return UB_NOMEM;
 			}
 			lock_basic_lock(&ctx->cfglock);
-			if(!cfg_strlist_insert(&ctx->env->cfg->local_data, 
+			if(!cfg_strlist_insert(&ctx->env->cfg->local_data,
 				ins)) {
 				lock_basic_unlock(&ctx->cfglock);
 				fclose(in);
@@ -1292,7 +1292,7 @@ static int ub_ctx_finalize(struct ub_ctx* ctx)
 
 /* Print local zones and RR data */
 int ub_ctx_print_local_zones(struct ub_ctx* ctx)
-{   
+{
 	int res = ub_ctx_finalize(ctx);
 	if (res) return res;
 
@@ -1302,7 +1302,7 @@ int ub_ctx_print_local_zones(struct ub_ctx* ctx)
 }
 
 /* Add a new zone */
-int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name, 
+int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
 	const char *zone_type)
 {
 	enum localzone_type t;
@@ -1323,7 +1323,7 @@ int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
 	}
 
 	lock_rw_wrlock(&ctx->local_zones->lock);
-	if((z=local_zones_find(ctx->local_zones, nm, nmlen, nmlabs, 
+	if((z=local_zones_find(ctx->local_zones, nm, nmlen, nmlabs,
 		LDNS_RR_CLASS_IN))) {
 		/* already present in tree */
 		lock_rw_wrlock(&z->lock);
@@ -1333,7 +1333,7 @@ int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
 		free(nm);
 		return UB_NOERROR;
 	}
-	if(!local_zones_add_zone(ctx->local_zones, nm, nmlen, nmlabs, 
+	if(!local_zones_add_zone(ctx->local_zones, nm, nmlen, nmlabs,
 		LDNS_RR_CLASS_IN, t)) {
 		lock_rw_unlock(&ctx->local_zones->lock);
 		return UB_NOMEM;
@@ -1344,7 +1344,7 @@ int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
 
 /* Remove zone */
 int ub_ctx_zone_remove(struct ub_ctx* ctx, const char *zone_name)
-{   
+{
 	struct local_zone* z;
 	uint8_t* nm;
 	int nmlabs;
@@ -1358,7 +1358,7 @@ int ub_ctx_zone_remove(struct ub_ctx* ctx, const char *zone_name)
 	}
 
 	lock_rw_wrlock(&ctx->local_zones->lock);
-	if((z=local_zones_find(ctx->local_zones, nm, nmlen, nmlabs, 
+	if((z=local_zones_find(ctx->local_zones, nm, nmlen, nmlabs,
 		LDNS_RR_CLASS_IN))) {
 		/* present in tree */
 		local_zones_del_zone(ctx->local_zones, z);
@@ -1387,10 +1387,10 @@ int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data)
 	int res = ub_ctx_finalize(ctx);
 	if (res) return res;
 
-	if(!parse_dname(data, &nm, &nmlen, &nmlabs)) 
+	if(!parse_dname(data, &nm, &nmlen, &nmlabs))
 		return UB_SYNTAX;
 
-	local_zones_del_data(ctx->local_zones, nm, nmlen, nmlabs, 
+	local_zones_del_data(ctx->local_zones, nm, nmlen, nmlabs,
 		LDNS_RR_CLASS_IN);
 
 	free(nm);
@@ -1402,7 +1402,7 @@ const char* ub_version(void)
 	return PACKAGE_VERSION;
 }
 
-int 
+int
 ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
 	struct ub_event_base* new_base;
 
@@ -1413,14 +1413,14 @@ ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
 		/* already set */
 		return UB_NOERROR;
 	}
-	
+
 	lock_basic_lock(&ctx->cfglock);
 	/* destroy the current worker - safe to pass in NULL */
 	libworker_delete_event(ctx->event_worker);
 	ctx->event_worker = NULL;
 	new_base = ub_libevent_event_base(base);
 	if (new_base)
-		ctx->event_base = new_base;	
+		ctx->event_base = new_base;
 	ctx->created_bg = 0;
 	ctx->dothread = 1;
 	lock_basic_unlock(&ctx->cfglock);
diff --git a/usr.sbin/unbound/libunbound/libworker.c b/usr.sbin/unbound/libunbound/libworker.c
index 11bf5f9db..5d230942e 100644
--- a/usr.sbin/unbound/libunbound/libworker.c
+++ b/usr.sbin/unbound/libunbound/libworker.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -95,7 +95,7 @@ libworker_delete_env(struct libworker* w)
 	if(w->env) {
 		outside_network_quit_prepare(w->back);
 		mesh_delete(w->env->mesh);
-		context_release_alloc(w->ctx, w->env->alloc, 
+		context_release_alloc(w->ctx, w->env->alloc,
 			!w->is_bg || w->is_bg_thread);
 		sldns_buffer_free(w->env->scratch_buffer);
 		regional_destroy(w->env->scratch);
@@ -159,12 +159,12 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 	w->env->scratch = regional_create_custom(cfg->msg_buffer_size);
 	w->env->scratch_buffer = sldns_buffer_new(cfg->msg_buffer_size);
 	w->env->fwds = forwards_create();
-	if(w->env->fwds && !forwards_apply_cfg(w->env->fwds, cfg)) { 
+	if(w->env->fwds && !forwards_apply_cfg(w->env->fwds, cfg)) {
 		forwards_delete(w->env->fwds);
 		w->env->fwds = NULL;
 	}
 	w->env->hints = hints_create();
-	if(w->env->hints && !hints_apply_cfg(w->env->hints, cfg)) { 
+	if(w->env->hints && !hints_apply_cfg(w->env->hints, cfg)) {
 		hints_delete(w->env->hints);
 		w->env->hints = NULL;
 	}
@@ -235,7 +235,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 	}
 	w->back = outside_network_create(w->base, cfg->msg_buffer_size,
 		(size_t)cfg->outgoing_num_ports, cfg->out_ifs,
-		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
+		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6,
 		cfg->do_tcp?cfg->outgoing_num_tcp:0, cfg->ip_dscp,
 		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
 		ports, numports, cfg->unwanted_threshold,
@@ -302,7 +302,7 @@ libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
 	switch(context_serial_getcmd(msg, len)) {
 		default:
 		case UB_LIBCMD_ANSWER:
-			log_err("unknown command for bg worker %d", 
+			log_err("unknown command for bg worker %d",
 				(int)context_serial_getcmd(msg, len));
 			/* and fall through to quit */
 			/* fallthrough */
@@ -320,8 +320,8 @@ libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
 }
 
 /** handle control command coming into server */
-void 
-libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), 
+void
+libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 	uint8_t* msg, size_t len, int err, void* arg)
 {
 	struct libworker* w = (struct libworker*)arg;
@@ -356,7 +356,7 @@ libworker_dobg(void* arg)
 	tube_close_write(ctx->qq_pipe);
 	tube_close_read(ctx->rr_pipe);
 #endif
-	if(!tube_setup_bg_listen(ctx->qq_pipe, w->base, 
+	if(!tube_setup_bg_listen(ctx->qq_pipe, w->base,
 		libworker_handle_control_cmd, w)) {
 		log_err("libunbound bg worker init failed, no bglisten");
 		return NULL;
@@ -375,7 +375,7 @@ libworker_dobg(void* arg)
 	tube_remove_bg_listen(w->ctx->qq_pipe);
 	tube_remove_bg_write(w->ctx->rr_pipe);
 	libworker_delete(w);
-	(void)tube_write_msg(ctx->rr_pipe, (uint8_t*)&m, 
+	(void)tube_write_msg(ctx->rr_pipe, (uint8_t*)&m,
 		(uint32_t)sizeof(m), 0);
 #ifdef THREADS_DISABLED
 	/* close pipes from forked process before exit */
@@ -425,7 +425,7 @@ int libworker_bg(struct ub_ctx* ctx)
 				tube_close_write(ctx->rr_pipe);
 				break;
 		}
-#endif /* HAVE_FORK */ 
+#endif /* HAVE_FORK */
 	}
 	return UB_NOERROR;
 }
@@ -530,7 +530,7 @@ libworker_enter_result(struct ub_result* res, sldns_buffer* buf,
 		log_err("cannot parse buf");
 		return; /* error parsing buf, or out of memory */
 	}
-	if(!fill_res(res, reply_find_answer_rrset(&rq, rep), 
+	if(!fill_res(res, reply_find_answer_rrset(&rq, rep),
 		reply_find_final_cname_target(&rq, rep), &rq, rep))
 		return; /* out of memory */
 	/* rcode, havedata, nxdomain, secure, bogus */
@@ -548,7 +548,7 @@ libworker_enter_result(struct ub_result* res, sldns_buffer* buf,
 
 /** fillup fg results */
 static void
-libworker_fillup_fg(struct ctx_query* q, int rcode, sldns_buffer* buf, 
+libworker_fillup_fg(struct ctx_query* q, int rcode, sldns_buffer* buf,
 	enum sec_status s, char* why_bogus, int was_ratelimited)
 {
 	q->res->was_ratelimited = was_ratelimited;
@@ -586,7 +586,7 @@ libworker_fg_done_cb(void* arg, int rcode, sldns_buffer* buf, enum sec_status s,
 
 /** setup qinfo and edns */
 static int
-setup_qinfo_edns(struct libworker* w, struct ctx_query* q, 
+setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	struct query_info* qinfo, struct edns_data* edns)
 {
 	qinfo->qtype = (uint16_t)q->res->qtype;
@@ -629,11 +629,11 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns, 
+	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns,
 		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
 		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
-		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
+		libworker_fillup_fg(q, LDNS_RCODE_NOERROR,
 			w->back->udp_buff, sec_status_insecure, NULL, 0);
 		libworker_delete(w);
 		free(qinfo.qname);
@@ -642,14 +642,14 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	if(ctx->env->auth_zones && auth_zones_answer(ctx->env->auth_zones,
 		w->env, &qinfo, &edns, NULL, w->back->udp_buff, w->env->scratch)) {
 		regional_free_all(w->env->scratch);
-		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
+		libworker_fillup_fg(q, LDNS_RCODE_NOERROR,
 			w->back->udp_buff, sec_status_insecure, NULL, 0);
 		libworker_delete(w);
 		free(qinfo.qname);
 		return UB_NOERROR;
 	}
 	/* process new query */
-	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
+	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns,
 		w->back->udp_buff, qid, libworker_fg_done_cb, q, 0)) {
 		free(qinfo.qname);
 		return UB_NOMEM;
@@ -709,7 +709,7 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns, 
+	if(local_zones_answer(ctx->local_zones, w->env, &qinfo, &edns,
 		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
 		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
@@ -729,7 +729,7 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	/* process new query */
 	if(async_id)
 		*async_id = q->querynum;
-	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
+	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns,
 		w->back->udp_buff, qid, libworker_event_done_cb, q, 0)) {
 		free(qinfo.qname);
 		return UB_NOMEM;
@@ -740,7 +740,7 @@ int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 
 /** add result to the bg worker result queue */
 static void
-add_bg_result(struct libworker* w, struct ctx_query* q, sldns_buffer* pkt, 
+add_bg_result(struct libworker* w, struct ctx_query* q, sldns_buffer* pkt,
 	int err, char* reason, int was_ratelimited)
 {
 	uint8_t* msg = NULL;
@@ -847,7 +847,7 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	/* see if there is a fixed answer */
 	sldns_buffer_write_u16_at(w->back->udp_buff, 0, qid);
 	sldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
-	if(local_zones_answer(w->ctx->local_zones, w->env, &qinfo, &edns, 
+	if(local_zones_answer(w->ctx->local_zones, w->env, &qinfo, &edns,
 		w->back->udp_buff, w->env->scratch, NULL, NULL, 0, NULL, 0,
 		NULL, 0, NULL, 0, NULL)) {
 		regional_free_all(w->env->scratch);
@@ -866,7 +866,7 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	}
 	q->w = w;
 	/* process new query */
-	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
+	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns,
 		w->back->udp_buff, qid, libworker_bg_done_cb, q, 0)) {
 		add_bg_result(w, q, NULL, UB_NOMEM, NULL, 0);
 	}
@@ -904,7 +904,7 @@ struct outbound_entry* libworker_send_query(struct query_info* qinfo,
 	return e;
 }
 
-int 
+int
 libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
         struct comm_reply* reply_info)
 {
@@ -922,7 +922,7 @@ libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
 		|| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
 		/* error becomes timeout for the module as if this reply
 		 * never arrived. */
-		mesh_report_reply(lw->env->mesh, e, reply_info, 
+		mesh_report_reply(lw->env->mesh, e, reply_info,
 			NETEVENT_TIMEOUT);
 		return 0;
 	}
@@ -931,14 +931,14 @@ libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
 }
 
 /* --- fake callbacks for fptr_wlist to work --- */
-void worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), 
+void worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 	uint8_t* ATTR_UNUSED(buffer), size_t ATTR_UNUSED(len),
 	int ATTR_UNUSED(error), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-int worker_handle_request(struct comm_point* ATTR_UNUSED(c), 
+int worker_handle_request(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -946,7 +946,7 @@ int worker_handle_request(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
 {
@@ -954,7 +954,7 @@ int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int remote_accept_callback(struct comm_point* ATTR_UNUSED(c), 
+int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -962,7 +962,7 @@ int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int remote_control_callback(struct comm_point* ATTR_UNUSED(c), 
+int remote_control_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -988,7 +988,7 @@ struct outbound_entry* worker_send_query(struct query_info* ATTR_UNUSED(qinfo),
 	return 0;
 }
 
-void 
+void
 worker_alloc_cleanup(void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
@@ -1040,7 +1040,7 @@ void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
 
 #ifdef UB_ON_WINDOWS
 void
-worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void* 
+worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void*
         ATTR_UNUSED(arg)) {
         log_assert(0);
 }
diff --git a/usr.sbin/unbound/libunbound/libworker.h b/usr.sbin/unbound/libunbound/libworker.h
index 42aa5bae3..0a93a1b01 100644
--- a/usr.sbin/unbound/libunbound/libworker.h
+++ b/usr.sbin/unbound/libunbound/libworker.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -61,7 +61,7 @@ struct sldns_buffer;
 struct ub_event_base;
 struct query_info;
 
-/** 
+/**
  * The library-worker status structure
  * Internal to the worker.
  */
@@ -96,7 +96,7 @@ struct libworker {
  *	a new allocation cache is obtained from ctx. It contains the
  *	threadnumber and unique id for further (shared) cache insertions.
  * @return 0 if OK, else error.
- *	Further communication is done via the pipes in ctx. 
+ *	Further communication is done via the pipes in ctx.
  */
 int libworker_bg(struct ub_ctx* ctx);
 
@@ -130,7 +130,7 @@ struct libworker* libworker_create_event(struct ub_ctx* ctx,
 int libworker_attach_mesh(struct ub_ctx* ctx, struct ctx_query* q,
 	int* async_id);
 
-/** 
+/**
  * delete worker for event-based interface.  does not free the event_base.
  * @param w: event-based worker to delete.
  */
@@ -139,13 +139,13 @@ void libworker_delete_event(struct libworker* w);
 /** cleanup the cache to remove all rrset IDs from it, arg is libworker */
 void libworker_alloc_cleanup(void* arg);
 
-/** 
- * fill result from parsed message, on error fills servfail 
+/**
+ * fill result from parsed message, on error fills servfail
  * @param res: is clear at start, filled in at end.
  * @param buf: contains DNS message.
  * @param temp: temporary buffer for parse.
  * @param msg_security: security status of the DNS message.
- *   On error, the res may contain a different status 
+ *   On error, the res may contain a different status
  *   (out of memory is not secure, not bogus).
  */
 void libworker_enter_result(struct ub_result* res, struct sldns_buffer* buf,
diff --git a/usr.sbin/unbound/libunbound/unbound-event.h b/usr.sbin/unbound/libunbound/unbound-event.h
index a5d5c038b..467eec0ba 100644
--- a/usr.sbin/unbound/libunbound/unbound-event.h
+++ b/usr.sbin/unbound/libunbound/unbound-event.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -126,10 +126,10 @@ struct ub_event_vmt {
 	/** Add event bits for this event to fire on.
 	 * The event will be deactivated before this function is called. */
 	void (*add_bits)(struct ub_event*, short);
-	/** Configure the event so it will not longer fire on given bits 
+	/** Configure the event so it will not longer fire on given bits
 	 * The event will be deactivated before this function is called. */
 	void (*del_bits)(struct ub_event*, short);
-	/** Change or set the file descriptor on the event 
+	/** Change or set the file descriptor on the event
 	 * The event will be deactivated before this function is called. */
 	void (*set_fd)(struct ub_event*, int);
 	/** Destructor for the ub_event object */
@@ -213,7 +213,7 @@ struct ub_ctx* ub_ctx_create_event(struct event_base* base);
  * @param base the new event_base to attach to the ctx
  * @return 0 if OK, else error
  */
-int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base); 
+int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base);
 
 /**
  * Perform resolution and validation of the target name.
@@ -249,11 +249,11 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base);
  * 	For localdata (etc/hosts) the callback is called immediately, before
  * 	resolve_event returns, async_id=0 is returned.
  * @param async_id: if you pass a non-NULL value, an identifier number is
- *	returned for the query as it is in progress. It can be used to 
+ *	returned for the query as it is in progress. It can be used to
  *	cancel the query.
  * @return 0 if OK, else error.
  */
-int ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype, 
+int ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype,
 	int rrclass, void* mydata, ub_event_callback_type callback,
 	int* async_id);
 
diff --git a/usr.sbin/unbound/libunbound/unbound.h b/usr.sbin/unbound/libunbound/unbound.h
index c779d183e..8775ab5b3 100644
--- a/usr.sbin/unbound/libunbound/unbound.h
+++ b/usr.sbin/unbound/libunbound/unbound.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * This file contains functions to resolve DNS queries and 
+ * This file contains functions to resolve DNS queries and
  * validate the answers. Synchronously and asynchronously.
  *
  * Several ways to use this interface from an application wishing
@@ -65,7 +65,7 @@
  *	... or process() calls my_callback() with results.
  *
  *      ... if the application has nothing more to do, wait for answer
- *      ub_wait(ctx); 
+ *      ub_wait(ctx);
  *
  * Application threaded. Blocking.
  *	Blocking, same as above. The current thread does the work.
@@ -83,7 +83,7 @@
  * CRYPTO_set_id_callback and CRYPTO_set_locking_callback.
  *
  * If no threading is compiled in, the above async example uses fork(2) to
- * create a process to perform the work. The forked process exits when the 
+ * create a process to perform the work. The forked process exits when the
  * calling process exits, or ctx_delete() is called.
  * Otherwise, for asynchronous with threading, a worker thread is created.
  *
@@ -128,10 +128,10 @@ struct ub_result {
 	/** the class asked for */
 	int qclass;
 
-	/** 
-	 * a list of network order DNS rdata items, terminated with a 
+	/**
+	 * a list of network order DNS rdata items, terminated with a
 	 * NULL pointer, so that data[0] is the first result entry,
-	 * data[1] the second, and the last entry is NULL. 
+	 * data[1] the second, and the last entry is NULL.
 	 * If there was no data, data[0] is NULL.
 	 */
 	char** data;
@@ -139,8 +139,8 @@ struct ub_result {
 	/** the length in bytes of the data items, len[i] for data[i] */
 	int* len;
 
-	/** 
-	 * canonical name for the result (the final cname). 
+	/**
+	 * canonical name for the result (the final cname).
 	 * zero terminated string.
 	 * May be NULL if no canonical name exists.
 	 */
@@ -165,9 +165,9 @@ struct ub_result {
 	 */
 	int havedata;
 
-	/** 
+	/**
 	 * If there was no data, and the domain did not exist, this is true.
-	 * If it is false, and there was no data, then the domain name 
+	 * If it is false, and there was no data, then the domain name
 	 * is purported to exist, but the requested data type is not available.
 	 */
 	int nxdomain;
@@ -182,19 +182,19 @@ struct ub_result {
 	 */
 	int secure;
 
-	/** 
-	 * If the result was not secure (secure==0), and this result is due 
+	/**
+	 * If the result was not secure (secure==0), and this result is due
 	 * to a security failure, bogus is true.
 	 * This means the data has been actively tampered with, signatures
-	 * failed, expected signatures were not present, timestamps on 
+	 * failed, expected signatures were not present, timestamps on
 	 * signatures were out of date and so on.
 	 *
-	 * If !secure and !bogus, this can happen if the data is not secure 
-	 * because security is disabled for that domain name. 
+	 * If !secure and !bogus, this can happen if the data is not secure
+	 * because security is disabled for that domain name.
 	 * This means the data is from a domain where data is not signed.
 	 */
 	int bogus;
-	
+
 	/**
 	 * If the result is bogus this contains a string (zero terminated)
 	 * that describes the failure.  There may be other errors as well
@@ -222,7 +222,7 @@ struct ub_result {
  * The readable function definition looks like:
  * void my_callback(void* my_arg, int err, struct ub_result* result);
  * It is called with
- *	void* my_arg: your pointer to a (struct of) data of your choice, 
+ *	void* my_arg: your pointer to a (struct of) data of your choice,
  *		or NULL.
  *	int err: if 0 all is OK, otherwise an error occurred and no results
  *	     are forthcoming.
@@ -301,8 +301,8 @@ int ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val);
  * 	This is a power-users interface that lets you specify all sorts
  * 	of options.
  * @param str: the string is malloced and returned here. NULL on error.
- * 	The caller must free() the string.  In cases with multiple 
- * 	entries (auto-trust-anchor-file), a newline delimited list is 
+ * 	The caller must free() the string.  In cases with multiple
+ * 	entries (auto-trust-anchor-file), a newline delimited list is
  * 	returned in the string.
  * @return 0 if OK else an error code (malloc failure, syntax error).
  */
@@ -321,10 +321,10 @@ int ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str);
 int ub_ctx_config(struct ub_ctx* ctx, const char* fname);
 
 /**
- * Set machine to forward DNS queries to, the caching resolver to use. 
- * IP4 or IP6 address. Forwards all DNS requests to that machine, which 
- * is expected to run a recursive resolver. If the proxy is not 
- * DNSSEC-capable, validation may fail. Can be called several times, in 
+ * Set machine to forward DNS queries to, the caching resolver to use.
+ * IP4 or IP6 address. Forwards all DNS requests to that machine, which
+ * is expected to run a recursive resolver. If the proxy is not
+ * DNSSEC-capable, validation may fail. Can be called several times, in
  * that case the addresses are used as backup servers.
  *
  * To read the list of nameservers from /etc/resolv.conf (from DHCP or so),
@@ -389,7 +389,7 @@ int ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname);
 
 /**
  * Read list of hosts from the filename given.
- * Usually "/etc/hosts". 
+ * Usually "/etc/hosts".
  * These addresses are not flagged as DNSSEC secure when queried for.
  *
  * @param ctx: context.
@@ -403,7 +403,7 @@ int ub_ctx_hosts(struct ub_ctx* ctx, const char* fname);
 /**
  * Add a trust anchor to the given context.
  * The trust anchor is a string, on one line, that holds a valid DNSKEY or
- * DS RR. 
+ * DS RR.
  * @param ctx: context.
  *	At this time it is only possible to add trusted keys before the
  *	first resolve is done.
@@ -465,7 +465,7 @@ int ub_ctx_debugout(struct ub_ctx* ctx, void* out);
  * Set debug verbosity for the context
  * Output is directed to stderr.
  * @param ctx: context.
- * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed, 
+ * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed,
  *	and 3 is lots.
  * @return 0 if OK, else error.
  */
@@ -474,10 +474,10 @@ int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);
 /**
  * Set a context behaviour for asynchronous action.
  * @param ctx: context.
- * @param dothread: if true, enables threading and a call to resolve_async() 
+ * @param dothread: if true, enables threading and a call to resolve_async()
  *	creates a thread to handle work in the background.
  *	If false, a process is forked to handle work in the background.
- *	Changes to this setting after async() calls have been made have 
+ *	Changes to this setting after async() calls have been made have
  *	no effect (delete and re-create the context to change).
  * @return 0 if OK, else error.
  */
@@ -495,7 +495,7 @@ int ub_poll(struct ub_ctx* ctx);
 
 /**
  * Wait for a context to finish with results. Calls ub_process() after
- * the wait for you. After the wait, there are no more outstanding 
+ * the wait for you. After the wait, there are no more outstanding
  * asynchronous queries.
  * @param ctx: context.
  * @return: 0 if OK, else error.
@@ -530,11 +530,11 @@ int ub_process(struct ub_ctx* ctx);
  * @param rrtype: type of RR in host order, 1 is A (address).
  * @param rrclass: class of RR in host order, 1 is IN (for internet).
  * @param result: the result data is returned in a newly allocated result
- * 	structure. May be NULL on return, return value is set to an error 
+ * 	structure. May be NULL on return, return value is set to an error
  * 	in that case (out of memory).
  * @return 0 if OK, else error.
  */
-int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, 
+int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
 	int rrclass, struct ub_result** result);
 
 /**
@@ -561,11 +561,11 @@ int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
  * 	If an error happens during processing, your callback will be called
  * 	with error set to a nonzero value (and result==NULL).
  * @param async_id: if you pass a non-NULL value, an identifier number is
- *	returned for the query as it is in progress. It can be used to 
+ *	returned for the query as it is in progress. It can be used to
  *	cancel the query.
  * @return 0 if OK, else error.
  */
-int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, 
+int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
 	int rrclass, void* mydata, ub_callback_type callback, int* async_id);
 
 /**
@@ -589,7 +589,7 @@ int ub_cancel(struct ub_ctx* ctx, int async_id);
  */
 void ub_resolve_free(struct ub_result* result);
 
-/** 
+/**
  * Convert error value to a human readable string.
  * @param err: error code from one of the libunbound functions.
  * 	The error codes are from the type enum ub_ctx_err.
@@ -605,7 +605,7 @@ const char* ub_strerror(int err);
 int ub_ctx_print_local_zones(struct ub_ctx* ctx);
 
 /**
- * Add a new zone with the zonetype to the local authority info of the 
+ * Add a new zone with the zonetype to the local authority info of the
  * library.
  * @param ctx: context.  Is finalized by the routine.
  * @param zone_name: name of the zone in text, "example.com"
@@ -613,7 +613,7 @@ int ub_ctx_print_local_zones(struct ub_ctx* ctx);
  * @param zone_type: type of the zone (like for unbound.conf) in text.
  * @return 0 if OK, else error.
  */
-int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name, 
+int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
 	const char *zone_type);
 
 /**
@@ -649,7 +649,7 @@ int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data);
  */
 const char* ub_version(void);
 
-/** 
+/**
  * Some global statistics that are not in struct stats_info,
  * this struct is shared on a shm segment (shm-key in unbound.conf)
  */
@@ -701,7 +701,7 @@ struct ub_server_stats {
 	long long num_queries_prefetch;
 
 	/**
-	 * Sum of the querylistsize of the worker for 
+	 * Sum of the querylistsize of the worker for
 	 * every query that missed cache. To calculate average.
 	 */
 	long long sum_query_list_size;
@@ -773,12 +773,12 @@ struct ub_server_stats {
 	long long tcp_accept_usage;
 	/** expired answers served from cache */
 	long long ans_expired;
-	/** histogram data exported to array 
+	/** histogram data exported to array
 	 * if the array is the same size, no data is lost, and
 	 * if all histograms are same size (is so by default) then
 	 * adding up works well. */
 	long long hist[UB_STATS_BUCKET_NUM];
-	
+
 	/** number of message cache entries */
 	long long msg_cache_count;
 	/** number of rrset cache entries */
@@ -831,7 +831,7 @@ struct ub_server_stats {
 	long long rpz_action[UB_STATS_RPZ_ACTION_NUM];
 };
 
-/** 
+/**
  * Statistics to send over the control pipe when asked
  * This struct is made to be memcopied, sent in binary.
  * shm mapped with (number+1) at num_threads+1, with first as total
diff --git a/usr.sbin/unbound/libunbound/worker.h b/usr.sbin/unbound/libunbound/worker.h
index 0fa5bfa99..244b588db 100644
--- a/usr.sbin/unbound/libunbound/worker.h
+++ b/usr.sbin/unbound/libunbound/worker.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
@@ -89,15 +89,15 @@ void libworker_handle_control_cmd(struct tube* tube, uint8_t* msg, size_t len,
 	int err, void* arg);
 
 /** mesh callback with fg results */
-void libworker_fg_done_cb(void* arg, int rcode, sldns_buffer* buf, 
+void libworker_fg_done_cb(void* arg, int rcode, sldns_buffer* buf,
 	enum sec_status s, char* why_bogus, int was_ratelimited);
 
 /** mesh callback with bg results */
-void libworker_bg_done_cb(void* arg, int rcode, sldns_buffer* buf, 
+void libworker_bg_done_cb(void* arg, int rcode, sldns_buffer* buf,
 	enum sec_status s, char* why_bogus, int was_ratelimited);
 
 /** mesh callback with event results */
-void libworker_event_done_cb(void* arg, int rcode, struct sldns_buffer* buf, 
+void libworker_event_done_cb(void* arg, int rcode, struct sldns_buffer* buf,
 	enum sec_status s, char* why_bogus, int was_ratelimited);
 
 /**
@@ -136,8 +136,8 @@ struct outbound_entry* worker_send_query(struct query_info* qinfo,
 	size_t zonelen, int tcp_upstream, int ssl_upstream, char* tls_auth_name,
 	struct module_qstate* q, int* was_ratelimited);
 
-/** 
- * process control messages from the main thread. Frees the control 
+/**
+ * process control messages from the main thread. Frees the control
  * command message.
  * @param tube: tube control message came on.
  * @param msg: message contents.  Is freed.
@@ -153,7 +153,7 @@ int worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct comm_reply* repinfo);
 
 /** process incoming serviced query replies from the network */
-int worker_handle_service_reply(struct comm_point* c, void* arg, int error, 
+int worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	struct comm_reply* reply_info);
 
 /** cleanup the cache to remove all rrset IDs from it, arg is worker */
diff --git a/usr.sbin/unbound/respip/respip.c b/usr.sbin/unbound/respip/respip.c
index 942e082b9..2613e80bf 100644
--- a/usr.sbin/unbound/respip/respip.c
+++ b/usr.sbin/unbound/respip/respip.c
@@ -128,7 +128,7 @@ void
 respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node)
 {
 	struct resp_addr* prev;
-	prev = (struct resp_addr*)rbtree_previous((struct rbnode_type*)node);	
+	prev = (struct resp_addr*)rbtree_previous((struct rbnode_type*)node);
 	lock_rw_destroy(&node->lock);
 	(void)rbtree_delete(&set->ip_tree, node);
 	/* no free'ing, all allocated in region */
@@ -943,7 +943,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	for(a = az->rpz_first; a && !raddr && !(rpz_passthru && *rpz_passthru); a = a->rpz_az_next) {
 		lock_rw_rdlock(&a->lock);
 		r = a->rpz;
-		if(!r->taglist || taglist_intersect(r->taglist, 
+		if(!r->taglist || taglist_intersect(r->taglist,
 			r->taglistlen, ctaglist, ctaglen)) {
 			if((raddr = respip_addr_lookup(rep,
 				r->respip_set, &rrset_id, &rr_id))) {
diff --git a/usr.sbin/unbound/respip/respip.h b/usr.sbin/unbound/respip/respip.h
index e4ab5cc9c..b520673c6 100644
--- a/usr.sbin/unbound/respip/respip.h
+++ b/usr.sbin/unbound/respip/respip.h
@@ -139,7 +139,7 @@ int respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
  * reply is assumed to be faked due to a response-ip action and can't be
  * considered secure in terms of DNSSEC.
  * The caller must ensure that neither 'base_rep' nor 'tgt_rep' can be modified
- * until this function returns. 
+ * until this function returns.
  * @param base_rep: the reply info containing an incomplete CNAME.
  * @param qinfo: query info corresponding to 'base_rep'.
  * @param tgt_rep: the reply info that completes the CNAME chain.
diff --git a/usr.sbin/unbound/services/authzone.c b/usr.sbin/unbound/services/authzone.c
index 6de1e4319..4c06a32d6 100644
--- a/usr.sbin/unbound/services/authzone.c
+++ b/usr.sbin/unbound/services/authzone.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2017, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -517,7 +517,7 @@ auth_zones_find_zone(struct auth_zones* az, uint8_t* name, size_t name_len,
 	return NULL;
 }
 
-/** find or create zone with name str. caller must have lock on az. 
+/** find or create zone with name str. caller must have lock on az.
  * returns a wrlocked zone */
 static struct auth_zone*
 auth_zones_find_or_add_zone(struct auth_zones* az, char* name)
@@ -540,7 +540,7 @@ auth_zones_find_or_add_zone(struct auth_zones* az, char* name)
 	return z;
 }
 
-/** find or create xfer zone with name str. caller must have lock on az. 
+/** find or create xfer zone with name str. caller must have lock on az.
  * returns a locked xfer */
 static struct auth_xfer*
 auth_zones_find_or_add_xfer(struct auth_zones* az, struct auth_zone* z)
@@ -767,7 +767,7 @@ rrset_remove_rr(struct auth_rrset* rrset, size_t index)
 	if(index+1 < old->count+old->rrsig_count)
 		memmove(&d->rr_ttl[index], &old->rr_ttl[index+1],
 		(old->count+old->rrsig_count - (index+1))*sizeof(time_t));
-	
+
 	/* move over rr_data */
 	for(i=0; i<d->count+d->rrsig_count; i++) {
 		size_t oldi;
@@ -789,7 +789,7 @@ rrset_remove_rr(struct auth_rrset* rrset, size_t index)
 	return 1;
 }
 
-/** add RR to existing RRset. If insert_sig is true, add to rrsigs. 
+/** add RR to existing RRset. If insert_sig is true, add to rrsigs.
  * This reallocates the packed rrset for a new one */
 static int
 rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
@@ -1373,7 +1373,7 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 					uncompressed_len))
 					/* dname too long for buffer */
 					return 0;
-				dname_pkt_copy(&pktbuf, 
+				dname_pkt_copy(&pktbuf,
 					sldns_buffer_current(buf), rd);
 				sldns_buffer_skip(buf, (ssize_t)uncompressed_len);
 				compressed_len = sldns_buffer_position(
@@ -1456,7 +1456,7 @@ az_remove_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen,
 	return az_remove_rr(z, rr, rr_len, dname_len, nonexist);
 }
 
-/** 
+/**
  * Parse zonefile
  * @param z: zone to read in.
  * @param in: file to read from (just opened).
@@ -1572,7 +1572,7 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 	FILE* in;
 	if(!z || !z->zonefile || z->zonefile[0]==0)
 		return 1; /* no file, or "", nothing to read */
-	
+
 	zfilename = z->zonefile;
 	if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
 		cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
@@ -2034,7 +2034,7 @@ xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr)
 	return 1;
 }
 
-/** 
+/**
  * Setup auth_xfer zone
  * This populates the have_zone, soa values, and so on times.
  * Doesn't do network traffic yet, can set option flags.
@@ -2499,7 +2499,7 @@ az_find_ce(struct auth_zone* z, struct query_info* qinfo,
 		if(n->namelen != z->namelen &&
 			(*rrset=az_domain_rrset(n, LDNS_RR_TYPE_NS)) &&
 			/* delegate here, but DS at exact the dp has notype */
-			(qinfo->qtype != LDNS_RR_TYPE_DS || 
+			(qinfo->qtype != LDNS_RR_TYPE_DS ||
 			n->namelen != qinfo->qname_len)) {
 			/* referral */
 			/* this is ce and the lowernode is nonexisting */
@@ -3276,7 +3276,7 @@ az_generate_dname_answer(struct auth_zone* z, struct query_info* qinfo,
 	if(msg->rep->rrset_count == 0 ||
 		!msg->rep->rrsets[msg->rep->rrset_count-1])
 		return 0;
-	if(!follow_cname_chain(z, qinfo->qtype, region, msg, 
+	if(!follow_cname_chain(z, qinfo->qtype, region, msg,
 		(struct packed_rrset_data*)msg->rep->rrsets[
 		msg->rep->rrset_count-1]->entry.data))
 		return 0;
@@ -3694,7 +3694,7 @@ addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr,
 	int net = 0;
 	if(addr_in_list(master->list, addr, addrlen)) {
 		*fromhost = master;
-		return 1;	
+		return 1;
 	}
 	/* compare address (but not port number, that is the destination
 	 * port of the master, the port number of the received notify is
@@ -3813,7 +3813,7 @@ int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	}
 	lock_basic_lock(&xfr->lock);
 	lock_rw_unlock(&az->lock);
-	
+
 	/* check access list for notifies */
 	if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost)) {
 		lock_basic_unlock(&xfr->lock);
@@ -4008,7 +4008,7 @@ xfr_transfer_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env)
 		xfr->task_transfer->lookup_aaaa = 1;
 		return;
 	}
-	xfr->task_transfer->lookup_target = 
+	xfr->task_transfer->lookup_target =
 		xfr->task_transfer->lookup_target->next;
 	xfr->task_transfer->lookup_aaaa = 0;
 	if(!env->cfg->do_ip4 && xfr->task_transfer->lookup_target!=NULL)
@@ -4047,7 +4047,7 @@ xfr_probe_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env)
 
 /** start the iteration of the task_transfer list of masters */
 static void
-xfr_transfer_start_list(struct auth_xfer* xfr, struct auth_master* spec) 
+xfr_transfer_start_list(struct auth_xfer* xfr, struct auth_master* spec)
 {
 	if(spec) {
 		xfr->task_transfer->scan_specific = find_master_by_host(
@@ -4074,7 +4074,7 @@ xfr_transfer_start_list(struct auth_xfer* xfr, struct auth_master* spec)
 
 /** start the iteration of the task_probe list of masters */
 static void
-xfr_probe_start_list(struct auth_xfer* xfr, struct auth_master* spec) 
+xfr_probe_start_list(struct auth_xfer* xfr, struct auth_master* spec)
 {
 	if(spec) {
 		xfr->task_probe->scan_specific = find_master_by_host(
@@ -4195,7 +4195,7 @@ xfr_probe_nextmaster(struct auth_xfer* xfr)
 
 /** create SOA probe packet for xfr */
 static void
-xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf, 
+xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf,
 	uint16_t id)
 {
 	struct query_info qinfo;
@@ -4914,7 +4914,7 @@ apply_ixfr(struct auth_xfer* xfr, struct auth_zone* z,
 			delmode = !delmode;
 		}
 		/* process this RR */
-		/* if the RR is deleted twice or added twice, then we 
+		/* if the RR is deleted twice or added twice, then we
 		 * softfail, and continue with the rest of the IXFR, so
 		 * that we serve something fairly nice during the refetch */
 		if(verbosity>=7) log_rrlist_position((delmode?"del":"add"),
@@ -5542,7 +5542,7 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 		char zname[255+1], as[256];
  		dname_str(xfr->name, zname);
 		addr_to_str(&addr, addrlen, as, sizeof(as));
-		verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname, 
+		verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname,
 			(xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as);
 	}
 	return 1;
@@ -5620,7 +5620,7 @@ xfr_master_add_addrs(struct auth_master* m, struct ub_packed_rrset_key* rrset,
 			continue; /* wrong length for A */
 		if(rrtype == LDNS_RR_TYPE_AAAA && len != INET6_SIZE)
 			continue; /* wrong length for AAAA */
-		
+
 		/* add and alloc it */
 		a = (struct auth_addr*)calloc(1, sizeof(*a));
 		if(!a) {
@@ -6056,7 +6056,7 @@ process_list_end_transfer(struct auth_xfer* xfr, struct module_env* env)
 		xfr_transfer_disown(xfr);
 
 		if(xfr->notify_received && (!xfr->notify_has_serial ||
-			(xfr->notify_has_serial && 
+			(xfr->notify_has_serial &&
 			xfr_serial_means_update(xfr, xfr->notify_serial)))) {
 			uint32_t sr = xfr->notify_serial;
 			int has_sr = xfr->notify_has_serial;
@@ -6155,7 +6155,7 @@ auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
 
 	if(err != NETEVENT_NOERROR) {
 		/* connection failed, closed, or timeout */
-		/* stop this transfer, cleanup 
+		/* stop this transfer, cleanup
 		 * and continue task_transfer*/
 		verbose(VERB_ALGO, "xfr stopped, connection lost to %s",
 			xfr->task_transfer->master->host);
@@ -6237,7 +6237,7 @@ auth_xfer_transfer_http_callback(struct comm_point* c, void* arg, int err,
 
 	if(err != NETEVENT_NOERROR && err != NETEVENT_DONE) {
 		/* connection failed, closed, or timeout */
-		/* stop this transfer, cleanup 
+		/* stop this transfer, cleanup
 		 * and continue task_transfer*/
 		verbose(VERB_ALGO, "http stopped, connection lost to %s",
 			xfr->task_transfer->master->host);
@@ -6371,7 +6371,7 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 	 * this means we'll accept replies to previous retries to same ip */
 	if(timeout == AUTH_PROBE_TIMEOUT)
 		xfr->task_probe->id = GET_RANDOM_ID(env->rnd);
-	xfr_create_soa_probe_packet(xfr, env->scratch_buffer, 
+	xfr_create_soa_probe_packet(xfr, env->scratch_buffer,
 		xfr->task_probe->id);
 	/* we need to remove the cp if we have a different ip4/ip6 type now */
 	if(xfr->task_probe->cp &&
@@ -6546,7 +6546,7 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
 			verbose(VERB_ALGO, "auth zone %s: soa probe failed", buf);
 		}
 	}
-	
+
 	/* failed lookup or not an update */
 	/* delete commpoint so a new one is created, with a fresh port nr */
 	comm_point_delete(xfr->task_probe->cp);
@@ -6901,7 +6901,7 @@ xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env,
 	xfr->task_nextprobe->next_probe = *env->now;
 	if(xfr->lease_time && !failure)
 		xfr->task_nextprobe->next_probe = xfr->lease_time;
-	
+
 	if(!failure) {
 		xfr->task_nextprobe->backoff = 0;
 	} else {
@@ -6949,7 +6949,7 @@ xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env,
 	xfr->task_nextprobe->worker = env->worker;
 	xfr->task_nextprobe->env = env;
 	if(*(xfr->task_nextprobe->env->now) <= xfr->task_nextprobe->next_probe)
-		tv.tv_sec = xfr->task_nextprobe->next_probe - 
+		tv.tv_sec = xfr->task_nextprobe->next_probe -
 			*(xfr->task_nextprobe->env->now);
 	else	tv.tv_sec = 0;
 	if(tv.tv_sec != 0 && lookup_only && xfr->task_probe->masters) {
diff --git a/usr.sbin/unbound/services/authzone.h b/usr.sbin/unbound/services/authzone.h
index 07614ed82..04a8b68fc 100644
--- a/usr.sbin/unbound/services/authzone.h
+++ b/usr.sbin/unbound/services/authzone.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2017, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -194,7 +194,7 @@ struct auth_rrset {
  * The structure consists of different tasks.  Each can be unowned (-1) or
  * owner by a worker (worker-num).  A worker can pick up a task and then do
  * it.  This means the events (timeouts, sockets) are for that worker.
- * 
+ *
  * (move this to tasks).
  * They don't have locks themselves, the worker (that owns it) uses it,
  * also as part of callbacks, hence it has separate zonename pointers for
@@ -208,7 +208,7 @@ struct auth_xfer {
 	/** lock on this structure, and on the workernum elements of the
 	 * tasks.  First hold the tree-lock in auth_zones, find the auth_xfer,
 	 * lock this lock.  Then a worker can reassign itself to fill up
-	 * one of the tasks. 
+	 * one of the tasks.
 	 * Once it has the task assigned to it, the worker can access the
 	 * other elements of the task structure without a lock, because that
 	 * is necessary for the eventloop and callbacks from that. */
@@ -340,7 +340,7 @@ struct auth_probe {
 	/** once notified, or the timeout has been reached. a scan starts. */
 	/** the scan specific target (notify source), or NULL if none */
 	struct auth_master* scan_specific;
-	/** scan tries all the upstream masters. the scan current target. 
+	/** scan tries all the upstream masters. the scan current target.
 	 * or NULL if not working on sequential scan */
 	struct auth_master* scan_target;
 	/** if not NULL, the specific addr for the current master */
@@ -388,7 +388,7 @@ struct auth_transfer {
 	/** once notified, or the timeout has been reached. a scan starts. */
 	/** the scan specific target (notify source), or NULL if none */
 	struct auth_master* scan_specific;
-	/** scan tries all the upstream masters. the scan current target. 
+	/** scan tries all the upstream masters. the scan current target.
 	 * or NULL if not working on sequential scan */
 	struct auth_master* scan_target;
 	/** what address we are scanning for the master, or NULL if the
@@ -555,7 +555,7 @@ int auth_zones_answer(struct auth_zones* az, struct module_env* env,
 	struct query_info* qinfo, struct edns_data* edns,
 	struct comm_reply* repinfo, struct sldns_buffer* buf, struct regional* temp);
 
-/** 
+/**
  * Find the auth zone that is above the given qname.
  * Return NULL when there is no auth_zone above the give name, otherwise
  * returns the closest auth_zone above the qname that pertains to it.
diff --git a/usr.sbin/unbound/services/listen_dnsport.c b/usr.sbin/unbound/services/listen_dnsport.c
index 95606aff5..84fdc3d8e 100644
--- a/usr.sbin/unbound/services/listen_dnsport.c
+++ b/usr.sbin/unbound/services/listen_dnsport.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -81,7 +81,7 @@
 #endif
 
 /** number of queued TCP connections for listen() */
-#define TCP_BACKLOG 256 
+#define TCP_BACKLOG 256
 
 #ifndef THREADS_DISABLED
 /** lock on the counter of stream buffer memory */
@@ -187,7 +187,7 @@ systemd_get_activated(int family, int socktype, int listen,
 			log_err("systemd sd_listen_fds(): %s", strerror(-r));
 		return -1;
 	}
-	
+
 	for(i = 0; i < r; i++) {
 		if(sd_is_socket(SD_LISTEN_FDS_START + i, family, socktype, listen)) {
 			s = SD_LISTEN_FDS_START + i;
@@ -253,7 +253,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			return -1;
 		}
 #else
-		if(WSAGetLastError() == WSAEAFNOSUPPORT || 
+		if(WSAGetLastError() == WSAEAFNOSUPPORT ||
 			WSAGetLastError() == WSAEPROTONOSUPPORT) {
 			*noproto = 1;
 			return -1;
@@ -270,7 +270,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #endif
 	if(listen) {
 #ifdef SO_REUSEADDR
-		if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 
+		if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
 			(socklen_t)sizeof(on)) < 0) {
 			log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
 				sock_strerror(errno));
@@ -368,9 +368,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		socklen_t slen = (socklen_t)sizeof(got);
 #  ifdef SO_RCVBUFFORCE
 		/* Linux specific: try to use root permission to override
-		 * system limits on rcvbuf. The limit is stored in 
+		 * system limits on rcvbuf. The limit is stored in
 		 * /proc/sys/net/core/rmem_max or sysctl net.core.rmem_max */
-		if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv, 
+		if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv,
 			(socklen_t)sizeof(rcv)) < 0) {
 			if(errno != EPERM) {
 				log_err("setsockopt(..., SO_RCVBUFFORCE, "
@@ -381,7 +381,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 				return -1;
 			}
 #  endif /* SO_RCVBUFFORCE */
-			if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv, 
+			if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv,
 				(socklen_t)sizeof(rcv)) < 0) {
 				log_err("setsockopt(..., SO_RCVBUF, "
 					"...) failed: %s", sock_strerror(errno));
@@ -392,7 +392,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			}
 			/* check if we got the right thing or if system
 			 * reduced to some system max.  Warn if so */
-			if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got, 
+			if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got,
 				&slen) >= 0 && got < rcv/2) {
 				log_warn("so-rcvbuf %u was not granted. "
 					"Got %u. To fix: start with "
@@ -413,9 +413,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		socklen_t slen = (socklen_t)sizeof(got);
 #  ifdef SO_SNDBUFFORCE
 		/* Linux specific: try to use root permission to override
-		 * system limits on sndbuf. The limit is stored in 
+		 * system limits on sndbuf. The limit is stored in
 		 * /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */
-		if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd, 
+		if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd,
 			(socklen_t)sizeof(snd)) < 0) {
 			if(errno != EPERM) {
 				log_err("setsockopt(..., SO_SNDBUFFORCE, "
@@ -426,7 +426,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 				return -1;
 			}
 #  endif /* SO_SNDBUFFORCE */
-			if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd, 
+			if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd,
 				(socklen_t)sizeof(snd)) < 0) {
 				log_err("setsockopt(..., SO_SNDBUF, "
 					"...) failed: %s", sock_strerror(errno));
@@ -437,7 +437,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			}
 			/* check if we got the right thing or if system
 			 * reduced to some system max.  Warn if so */
-			if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got, 
+			if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got,
 				&slen) >= 0 && got < snd/2) {
 				log_warn("so-sndbuf %u was not granted. "
 					"Got %u. To fix: start with "
@@ -469,7 +469,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #   endif
 			) {
 			int val=(v6only==2)?0:1;
-			if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
+			if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
 				(void*)&val, (socklen_t)sizeof(val)) < 0) {
 				log_err("setsockopt(..., IPV6_V6ONLY"
 					", ...) failed: %s", sock_strerror(errno));
@@ -576,7 +576,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		int action;
 #   if defined(IP_PMTUDISC_OMIT)
 		action = IP_PMTUDISC_OMIT;
-		if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, 
+		if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER,
 			&action, (socklen_t)sizeof(action)) < 0) {
 
 			if (errno != EINVAL) {
@@ -609,7 +609,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		/* the IP_DONTFRAG option if defined in the 11.0 OSX headers,
 		 * but does not work on that version, so we exclude it */
 		int off = 0;
-		if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG, 
+		if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG,
 			&off, (socklen_t)sizeof(off)) < 0) {
 			log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s",
 				strerror(errno));
@@ -647,7 +647,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		if(WSAGetLastError() != WSAEADDRINUSE &&
 			WSAGetLastError() != WSAEADDRNOTAVAIL &&
 			!(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) {
-			log_err_addr("can't bind socket", 
+			log_err_addr("can't bind socket",
 				wsa_strerror(WSAGetLastError()),
 				(struct sockaddr_storage*)addr, addrlen);
 		}
@@ -749,7 +749,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
     }
 #endif
 #ifdef SO_REUSEADDR
-	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 
+	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on,
 		(socklen_t)sizeof(on)) < 0) {
 		log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
 			sock_strerror(errno));
@@ -793,7 +793,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 		&& !got_fd_from_systemd
 #  endif
 		) {
-		if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
+		if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
 			log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
 				sock_strerror(errno));
@@ -845,7 +845,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 				addr->ai_addrlen);
 		}
 #else
-		log_err_addr("can't bind socket", 
+		log_err_addr("can't bind socket",
 			wsa_strerror(WSAGetLastError()),
 			(struct sockaddr_storage*)addr->ai_addr,
 			addr->ai_addrlen);
@@ -873,7 +873,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto,
 	/* 5 is recommended on linux */
 	qlen = 5;
 #endif
-	if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen, 
+	if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen,
 		  sizeof(qlen))) == -1 ) {
 #ifdef ENOPROTOOPT
 		/* squelch ENOPROTOOPT: freebsd server mode with kernel support
@@ -999,7 +999,7 @@ err:
  * Create socket from getaddrinfo results
  */
 static int
-make_sock(int stype, const char* ifname, const char* port, 
+make_sock(int stype, const char* ifname, const char* port,
 	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
 	int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind,
 	int use_systemd, int dscp, struct unbound_socket* ub_sock)
@@ -1015,7 +1015,7 @@ make_sock(int stype, const char* ifname, const char* port,
 			return -1;
 		}
 #endif
-		log_err("node %s:%s getaddrinfo: %s %s", 
+		log_err("node %s:%s getaddrinfo: %s %s",
 			ifname?ifname:"default", port, gai_strerror(r),
 #ifdef EAI_SYSTEM
 			r==EAI_SYSTEM?(char*)strerror(errno):""
@@ -1055,7 +1055,7 @@ make_sock(int stype, const char* ifname, const char* port,
 
 /** make socket and first see if ifname contains port override info */
 static int
-make_sock_port(int stype, const char* ifname, const char* port, 
+make_sock_port(int stype, const char* ifname, const char* port,
 	struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,
 	int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind,
 	int use_systemd, int dscp, struct unbound_socket* ub_sock)
@@ -1116,7 +1116,7 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype,
 
 /** set fd to receive source address packet info */
 static int
-set_recvpktinfo(int s, int family) 
+set_recvpktinfo(int s, int family)
 {
 #if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO)
 	int on = 1;
@@ -1338,7 +1338,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	return 1;
 }
 
-/** 
+/**
  * Add items to commpoint list in front.
  * @param c: commpoint to add.
  * @param front: listen struct.
@@ -1389,7 +1389,7 @@ void listen_desetup_locks(void)
 	}
 }
 
-struct listen_dnsport* 
+struct listen_dnsport*
 listen_create(struct comm_base* base, struct listen_port* ports,
 	size_t bufsize, int tcp_accept_count, int tcp_idle_timeout,
 	int harden_large_queries, uint32_t http_max_streams,
@@ -1525,10 +1525,10 @@ listen_list_delete(struct listen_list* list)
 	}
 }
 
-void 
+void
 listen_delete(struct listen_dnsport* front)
 {
-	if(!front) 
+	if(!front)
 		return;
 	listen_list_delete(front->cps);
 #ifdef USE_DNSCRYPT
@@ -1919,8 +1919,8 @@ void listening_ports_free(struct listen_port* list)
 size_t listen_get_mem(struct listen_dnsport* listen)
 {
 	struct listen_list* p;
-	size_t s = sizeof(*listen) + sizeof(*listen->base) + 
-		sizeof(*listen->udp_buff) + 
+	size_t s = sizeof(*listen) + sizeof(*listen->base) +
+		sizeof(*listen->udp_buff) +
 		sldns_buffer_capacity(listen->udp_buff);
 #ifdef USE_DNSCRYPT
 	s += sizeof(*listen->dnscrypt_udp_buff);
@@ -2001,7 +2001,7 @@ void tcp_req_info_clear(struct tcp_req_info* req)
 	}
 	req->open_req_list = NULL;
 	req->num_open_req = 0;
-	
+
 	/* free pending writable result packets */
 	item = req->done_req_list;
 	while(item) {
@@ -2060,7 +2060,7 @@ tcp_req_info_setup_listen(struct tcp_req_info* req)
 		wr = 1;
 	if(!req->read_is_closed)
 		rd = 1;
-	
+
 	if(wr) {
 		req->cp->tcp_is_reading = 0;
 		comm_point_stop_listening(req->cp);
@@ -2196,7 +2196,7 @@ tcp_req_info_handle_readdone(struct tcp_req_info* req)
 	}
 	req->in_worker_handle = 0;
 	/* it should be waiting in the mesh for recursion.
-	 * If mesh failed to add a new entry and called commpoint_drop_reply. 
+	 * If mesh failed to add a new entry and called commpoint_drop_reply.
 	 * Then the mesh state has been cleared. */
 	if(req->is_drop) {
 		/* the reply has been dropped, stream has been closed. */
@@ -2256,7 +2256,7 @@ tcp_req_info_add_result(struct tcp_req_info* req, uint8_t* buf, size_t len)
 	last = req->done_req_list;
 	while(last && last->next)
 		last = last->next;
-	
+
 	/* create new element */
 	item = (struct tcp_req_done_item*)malloc(sizeof(*item));
 	if(!item) {
@@ -2615,7 +2615,7 @@ static int http2_query_read_done(struct http2_session* h2_session,
 			"buffer already assigned to stream");
 		return -1;
 	}
-    
+
     /* the c->buffer might be used by mesh_send_reply and no be cleard
 	 * need to be cleared before use */
 	sldns_buffer_clear(h2_session->c->buffer);
diff --git a/usr.sbin/unbound/services/listen_dnsport.h b/usr.sbin/unbound/services/listen_dnsport.h
index 816d79aea..31ca8af85 100644
--- a/usr.sbin/unbound/services/listen_dnsport.h
+++ b/usr.sbin/unbound/services/listen_dnsport.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -118,7 +118,7 @@ struct unbound_socket {
 };
 
 /**
- * Single linked list to store shared ports that have been 
+ * Single linked list to store shared ports that have been
  * opened for use by all threads.
  */
 struct listen_port {
@@ -137,7 +137,7 @@ struct listen_port {
 
 /**
  * Create shared listening ports
- * Getaddrinfo, create socket, bind and listen to zero or more 
+ * Getaddrinfo, create socket, bind and listen to zero or more
  * interfaces for IP4 and/or IP6, for UDP and/or TCP.
  * On the given port number. It creates the sockets.
  * @param cfg: settings on what ports to open.
@@ -176,7 +176,7 @@ int resolve_interface_names(char** ifs, int num_ifs,
  *	for default all ifs.
  * @param ports: the list of shared ports.
  * @param bufsize: size of datagram buffer.
- * @param tcp_accept_count: max number of simultaneous TCP connections 
+ * @param tcp_accept_count: max number of simultaneous TCP connections
  * 	from clients.
  * @param tcp_idle_timeout: idle timeout for TCP connections in msec.
  * @param harden_large_queries: whether query size should be limited.
@@ -249,7 +249,7 @@ void listen_start_accept(struct listen_dnsport* listen);
 	IPv6 proto (family) is not available.
  * @param rcv: set size on rcvbuf with socket option, if 0 it is not set.
  * @param snd: set size on sndbuf with socket option, if 0 it is not set.
- * @param listen: if true, this is a listening UDP port, eg port 53, and 
+ * @param listen: if true, this is a listening UDP port, eg port 53, and
  * 	set SO_REUSEADDR on it.
  * @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
  * 	listening UDP port.  Set to false on return if it failed to do so.
@@ -259,7 +259,7 @@ void listen_start_accept(struct listen_dnsport* listen);
  * @param dscp: DSCP to use.
  * @return: the socket. -1 on error.
  */
-int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
+int create_udp_sock(int family, int socktype, struct sockaddr* addr,
 	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv,
 	int snd, int listen, int* reuseport, int transparent, int freebind, int use_systemd, int dscp);
 
@@ -271,7 +271,7 @@ int create_udp_sock(int family, int socktype, struct sockaddr* addr,
  * @param reuseport: if nonNULL and true, try to set SO_REUSEPORT on
  * 	listening UDP port.  Set to false on return if it failed to do so.
  * @param transparent: set IP_TRANSPARENT socket option.
- * @param mss: maximum segment size of the socket. if zero, leaves the default. 
+ * @param mss: maximum segment size of the socket. if zero, leaves the default.
  * @param nodelay: if true set TCP_NODELAY and TCP_QUICKACK socket options.
  * @param freebind: set IP_FREEBIND socket option.
  * @param use_systemd: if true, fetch sockets from systemd.
@@ -414,7 +414,7 @@ int tcp_req_info_add_meshstate(struct tcp_req_info* req,
 void tcp_req_info_send_reply(struct tcp_req_info* req);
 
 /** the read channel has closed
- * @param req: request. remaining queries are looked up and answered. 
+ * @param req: request. remaining queries are looked up and answered.
  * @return zero if nothing to do, just close the tcp.
  */
 int tcp_req_info_handle_read_close(struct tcp_req_info* req);
@@ -428,7 +428,7 @@ size_t http2_get_query_buffer_size(void);
 size_t http2_get_response_buffer_size(void);
 
 #ifdef HAVE_NGHTTP2
-/** 
+/**
  * Create nghttp2 callbacks to handle HTTP2 requests.
  * @return malloc'ed struct, NULL on failure
  */
diff --git a/usr.sbin/unbound/services/localzone.c b/usr.sbin/unbound/services/localzone.c
index 3536b7aaa..4e42eb46a 100644
--- a/usr.sbin/unbound/services/localzone.c
+++ b/usr.sbin/unbound/services/localzone.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -94,10 +94,10 @@ void local_zones_print(struct local_zones* zones)
 	lock_rw_unlock(&zones->lock);
 }
 
-struct local_zones* 
+struct local_zones*
 local_zones_create(void)
 {
-	struct local_zones* zones = (struct local_zones*)calloc(1, 
+	struct local_zones* zones = (struct local_zones*)calloc(1,
 		sizeof(*zones));
 	if(!zones)
 		return NULL;
@@ -109,14 +109,14 @@ local_zones_create(void)
 }
 
 /** helper traverse to delete zones */
-static void 
+static void
 lzdel(rbnode_type* n, void* ATTR_UNUSED(arg))
 {
 	struct local_zone* z = (struct local_zone*)n->key;
 	local_zone_delete(z);
 }
 
-void 
+void
 local_zones_delete(struct local_zones* zones)
 {
 	if(!zones)
@@ -127,7 +127,7 @@ local_zones_delete(struct local_zones* zones)
 	free(zones);
 }
 
-void 
+void
 local_zone_delete(struct local_zone* z)
 {
 	if(!z)
@@ -139,7 +139,7 @@ local_zone_delete(struct local_zone* z)
 	free(z);
 }
 
-int 
+int
 local_zone_cmp(const void* z1, const void* z2)
 {
 	/* first sort on class, so that hierarchy can be maintained within
@@ -155,13 +155,13 @@ local_zone_cmp(const void* z1, const void* z2)
 	return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m);
 }
 
-int 
+int
 local_data_cmp(const void* d1, const void* d2)
 {
 	struct local_data* a = (struct local_data*)d1;
 	struct local_data* b = (struct local_data*)d2;
 	int m;
-	return dname_canon_lab_cmp(a->name, a->namelabs, b->name, 
+	return dname_canon_lab_cmp(a->name, a->namelabs, b->name,
 		b->namelabs, &m);
 }
 
@@ -181,7 +181,7 @@ parse_dname(const char* str, uint8_t** res, size_t* len, int* labs)
 
 /** create a new localzone */
 static struct local_zone*
-local_zone_create(uint8_t* nm, size_t len, int labs, 
+local_zone_create(uint8_t* nm, size_t len, int labs,
 	enum localzone_type t, uint16_t dclass)
 {
 	struct local_zone* z = (struct local_zone*)calloc(1, sizeof(*z));
@@ -208,7 +208,7 @@ local_zone_create(uint8_t* nm, size_t len, int labs,
 
 /** enter a new zone with allocated dname returns with WRlock */
 static struct local_zone*
-lz_enter_zone_dname(struct local_zones* zones, uint8_t* nm, size_t len, 
+lz_enter_zone_dname(struct local_zones* zones, uint8_t* nm, size_t len,
 	int labs, enum localzone_type t, uint16_t c)
 {
 	struct local_zone* z = local_zone_create(nm, len, labs, t, c);
@@ -415,11 +415,11 @@ rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
 		return 0;
 	}
 	if(pd->count > 1) {
-		memcpy(pd->rr_len+1, oldlen, 
+		memcpy(pd->rr_len+1, oldlen,
 			sizeof(*pd->rr_len)*(pd->count-1));
-		memcpy(pd->rr_ttl+1, oldttl, 
+		memcpy(pd->rr_ttl+1, oldttl,
 			sizeof(*pd->rr_ttl)*(pd->count-1));
-		memcpy(pd->rr_data+1, olddata, 
+		memcpy(pd->rr_data+1, olddata,
 			sizeof(*pd->rr_data)*(pd->count-1));
 	}
 	pd->rr_len[0] = rdata_len;
@@ -454,7 +454,7 @@ local_rrset_remove_rr(struct packed_rrset_data* pd, size_t index)
 	return 1;
 }
 
-struct local_data* 
+struct local_data*
 local_zone_find_data(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs)
 {
 	struct local_data key;
@@ -467,7 +467,7 @@ local_zone_find_data(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs
 
 /** find a node, create it if not and all its empty nonterminal parents */
 static int
-lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen, 
+lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen,
 	int nmlabs, struct local_data** res)
 {
 	struct local_data* ld = local_zone_find_data(z, nm, nmlen, nmlabs);
@@ -587,7 +587,7 @@ local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
 					rrstr))
 				return 0;
 		}
-	} 
+	}
 	pd = (struct packed_rrset_data*)rrset->rrset->entry.data;
 	log_assert(rrset && pd);
 
@@ -595,7 +595,7 @@ local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
 	if(rr_is_duplicate(pd, rdata, rdata_len)) {
 		verbose(VERB_ALGO, "ignoring duplicate RR: %s", rrstr);
 		return 1;
-	} 
+	}
 	return rrset_insert_rr(z->region, pd, rdata, rdata_len, ttl, rrstr);
 }
 
@@ -676,7 +676,7 @@ lz_enter_zone_tag(struct local_zones* zones, char* zname, uint8_t* list,
 		return 0;
 	}
 	dname_labs = dname_count_labels(dname);
-	
+
 	lock_rw_rdlock(&zones->lock);
 	z = local_zones_find(zones, dname, dname_len, dname_labs, rr_class);
 	if(!z) {
@@ -832,7 +832,7 @@ lz_nodefault(struct config_file* cfg, const char* name)
 
 	for(p = cfg->local_zones_nodefault; p; p = p->next) {
 		/* compare zone name, lowercase, compare without ending . */
-		if(strncasecmp(p->str, name, len) == 0 && 
+		if(strncasecmp(p->str, name, len) == 0 &&
 			(strlen(p->str) == len || (strlen(p->str)==len+1 &&
 			p->str[len] == '.')))
 			return 1;
@@ -883,7 +883,7 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 	/* localhost. zone */
 	if(!lz_exists(zones, "localhost.") &&
 		!lz_nodefault(cfg, "localhost.")) {
-		if(!(z=lz_enter_zone(zones, "localhost.", "redirect", 
+		if(!(z=lz_enter_zone(zones, "localhost.", "redirect",
 			LDNS_RR_CLASS_IN)) ||
 		   !lz_enter_rr_into_zone(z,
 			"localhost. 10800 IN NS localhost.") ||
@@ -903,7 +903,7 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 	/* reverse ip4 zone */
 	if(!lz_exists(zones, "127.in-addr.arpa.") &&
 		!lz_nodefault(cfg, "127.in-addr.arpa.")) {
-		if(!(z=lz_enter_zone(zones, "127.in-addr.arpa.", "static", 
+		if(!(z=lz_enter_zone(zones, "127.in-addr.arpa.", "static",
 			LDNS_RR_CLASS_IN)) ||
 		   !lz_enter_rr_into_zone(z,
 			"127.in-addr.arpa. 10800 IN NS localhost.") ||
@@ -921,7 +921,7 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 	/* reverse ip6 zone */
 	if(!lz_exists(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.") &&
 		!lz_nodefault(cfg, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.")) {
-		if(!(z=lz_enter_zone(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", "static", 
+		if(!(z=lz_enter_zone(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", "static",
 			LDNS_RR_CLASS_IN)) ||
 		   !lz_enter_rr_into_zone(z,
 			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost.") ||
@@ -1097,7 +1097,7 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
 					continue;
 				}
 				/* find smallest shared topdomain */
-				(void)dname_lab_cmp(nm, nmlabs, 
+				(void)dname_lab_cmp(nm, nmlabs,
 					rr_name, labs, &m);
 				free(rr_name);
 				if(m < match)
@@ -1120,7 +1120,7 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
 			log_err("out of memory");
 			return 0;
 		}
-		log_nametypeclass(VERB_ALGO, "implicit transparent local-zone", 
+		log_nametypeclass(VERB_ALGO, "implicit transparent local-zone",
 			n2, 0, dclass);
 		if(!(
 #ifndef THREADS_DISABLED
@@ -1132,7 +1132,7 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
 		}
 		lock_rw_unlock(&z->lock);
 	}
-	if(have_other_classes) { 
+	if(have_other_classes) {
 		/* restart to setup other class */
 		return lz_setup_implicit(zones, cfg);
 	}
@@ -1154,7 +1154,7 @@ lz_enter_zone_tags(struct local_zones* zones, struct config_file* cfg)
 	if(c) verbose(VERB_ALGO, "applied tags to %d local zones", c);
 	return 1;
 }
-	
+
 /** enter auth data */
 static int
 lz_enter_data(struct local_zones* zones, struct config_file* cfg)
@@ -1179,7 +1179,7 @@ lz_freeup_cfg(struct config_file* cfg)
 	cfg->local_data = NULL;
 }
 
-int 
+int
 local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 {
 	/* create zones from zone statements. */
@@ -1214,7 +1214,7 @@ local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 	return 1;
 }
 
-struct local_zone* 
+struct local_zone*
 local_zones_lookup(struct local_zones* zones,
         uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype)
 {
@@ -1222,7 +1222,7 @@ local_zones_lookup(struct local_zones* zones,
 		dclass, dtype, NULL, 0, 1);
 }
 
-struct local_zone* 
+struct local_zone*
 local_zones_tags_lookup(struct local_zones* zones,
         uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
 	uint8_t* taglist, size_t taglen, int ignoretags)
@@ -1252,7 +1252,7 @@ local_zones_tags_lookup(struct local_zones* zones,
 	while(result) { /* go up until qname is zone or subdomain of zone */
 		if(result->namelabs <= m)
 			if(ignoretags || !result->taglist ||
-				taglist_intersect(result->taglist, 
+				taglist_intersect(result->taglist,
 				result->taglen, taglist, taglen))
 				break;
 		result = result->parent;
@@ -1260,7 +1260,7 @@ local_zones_tags_lookup(struct local_zones* zones,
 	return result;
 }
 
-struct local_zone* 
+struct local_zone*
 local_zones_find(struct local_zones* zones,
         uint8_t* name, size_t len, int labs, uint16_t dclass)
 {
@@ -1378,7 +1378,7 @@ local_data_find_tag_datas(const struct query_info* qinfo,
 		rdr_type = sldns_wirerr_get_type(rr, len, 1);
 		if(rdr_type != qinfo->qtype && rdr_type != LDNS_RR_TYPE_CNAME)
 			continue;
-		
+
 		/* do we have entries already? if not setup key */
 		if(r->rk.dname == NULL) {
 			r->entry.key = r;
@@ -1762,7 +1762,7 @@ lz_type(uint8_t *taglist, size_t taglen, uint8_t *taglist2, size_t taglen2,
 	struct comm_reply* repinfo, struct rbtree_type* override_tree,
 	int* tag, char** tagname, int num_tags)
 {
-	struct local_zone_override* lzo;	
+	struct local_zone_override* lzo;
 	if(repinfo && override_tree) {
 		lzo = (struct local_zone_override*)addr_tree_lookup(
 			override_tree, &repinfo->client_addr,
@@ -1807,13 +1807,13 @@ local_data_find_tag_action(const uint8_t* taglist, size_t taglen,
 				}
 				return lzt;
 			}
-			tagmatch >>= 1;	
+			tagmatch >>= 1;
 		}
 	}
 	return lzt;
 }
 
-int 
+int
 local_zones_answer(struct local_zones* zones, struct module_env* env,
 	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
 	struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist,
@@ -1822,7 +1822,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 	char** tagname, int num_tags, struct view* view)
 {
 	/* see if query is covered by a zone,
-	 * 	if so:	- try to match (exact) local data 
+	 * 	if so:	- try to match (exact) local data
 	 * 		- look at zone type for negative response. */
 	int labs = dname_count_labels(qinfo->qname);
 	struct local_data* ld = NULL;
@@ -1858,7 +1858,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		if(z && verbosity >= VERB_ALGO) {
 			char zname[255+1];
 			dname_str(z->name, zname);
-			verbose(VERB_ALGO, "using localzone %s %s from view %s", 
+			verbose(VERB_ALGO, "using localzone %s %s from view %s",
 				zname, local_zone_type2str(lzt), view->name);
 		}
 		lock_rw_unlock(&view->lock);
@@ -1933,7 +1933,7 @@ const char* local_zone_type2str(enum localzone_type t)
 		case local_zone_truncate: return "truncate";
 		case local_zone_invalid: return "invalid";
 	}
-	return "badtyped"; 
+	return "badtyped";
 }
 
 int local_zone_str2type(const char* type, enum localzone_type* t)
@@ -1980,7 +1980,7 @@ int local_zone_str2type(const char* type, enum localzone_type* t)
 
 /** iterate over the kiddies of the given name and set their parent ptr */
 static void
-set_kiddo_parents(struct local_zone* z, struct local_zone* match, 
+set_kiddo_parents(struct local_zone* z, struct local_zone* match,
 	struct local_zone* newp)
 {
 	/* both zones and z are locked already */
@@ -2088,7 +2088,7 @@ static int
 is_terminal(struct local_data* d)
 {
 	/* for empty nonterminals, the deeper domain names are sorted
-	 * right after them, so simply check the next name in the tree 
+	 * right after them, so simply check the next name in the tree
 	 */
 	struct local_data* n = (struct local_data*)rbtree_next(&d->node);
 	if(n == (struct local_data*)RBTREE_NULL)
@@ -2099,8 +2099,8 @@ is_terminal(struct local_data* d)
 }
 
 /** delete empty terminals from tree when final data is deleted */
-static void 
-del_empty_term(struct local_zone* z, struct local_data* d, 
+static void
+del_empty_term(struct local_zone* z, struct local_data* d,
 	uint8_t* name, size_t len, int labs)
 {
 	while(d && d->rrsets == NULL && is_terminal(d)) {
@@ -2126,7 +2126,7 @@ del_local_rrset(struct local_data* d, uint16_t dtype)
 		prev = p;
 		p = p->next;
 	}
-	if(!p) 
+	if(!p)
 		return; /* rrset type not found */
 	/* unlink it */
 	if(prev) prev->next = p->next;
@@ -2134,7 +2134,7 @@ del_local_rrset(struct local_data* d, uint16_t dtype)
 	/* no memory recycling for zone deletions ... */
 }
 
-void local_zones_del_data(struct local_zones* zones, 
+void local_zones_del_data(struct local_zones* zones,
 	uint8_t* name, size_t len, int labs, uint16_t dclass)
 {
 	/* find zone */
diff --git a/usr.sbin/unbound/services/localzone.h b/usr.sbin/unbound/services/localzone.h
index 19534f750..52dffae48 100644
--- a/usr.sbin/unbound/services/localzone.h
+++ b/usr.sbin/unbound/services/localzone.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -86,9 +86,9 @@ enum localzone_type {
 	local_zone_inform_deny,
 	/** log client address, and direct */
 	local_zone_inform_redirect,
-	/** resolve normally, even when there is local data */	
+	/** resolve normally, even when there is local data */
 	local_zone_always_transparent,
-	/** answer with error, even when there is local data */	
+	/** answer with error, even when there is local data */
 	local_zone_always_refuse,
 	/** answer with nxdomain, even when there is local data */
 	local_zone_always_nxdomain,
@@ -132,7 +132,7 @@ struct local_zone {
 	size_t namelen;
 	/** number of labels in zone name */
 	int namelabs;
-	/** the class of this zone. 
+	/** the class of this zone.
 	 * uses 'dclass' to not conflict with c++ keyword class. */
 	uint16_t dclass;
 
@@ -216,7 +216,7 @@ struct local_zones* local_zones_create(void);
 void local_zones_delete(struct local_zones* zones);
 
 /**
- * Apply config settings; setup the local authoritative data. 
+ * Apply config settings; setup the local authoritative data.
  * Takes care of locking.
  * @param zones: is set up.
  * @param cfg: config data.
@@ -262,7 +262,7 @@ void local_zone_delete(struct local_zone* z);
  * local-zone's tags.
  * @return closest local_zone or NULL if no covering zone is found.
  */
-struct local_zone* local_zones_tags_lookup(struct local_zones* zones, 
+struct local_zone* local_zones_tags_lookup(struct local_zones* zones,
 	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
 	uint8_t* taglist, size_t taglen, int ignoretags);
 
@@ -278,11 +278,11 @@ struct local_zone* local_zones_tags_lookup(struct local_zones* zones,
  *   pass 0 to just plain find a zone for a name.
  * @return closest local_zone or NULL if no covering zone is found.
  */
-struct local_zone* local_zones_lookup(struct local_zones* zones, 
+struct local_zone* local_zones_lookup(struct local_zones* zones,
 	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype);
 
 /**
- * Debug helper. Print all zones 
+ * Debug helper. Print all zones
  * Takes care of locking.
  * @param zones: the zones tree
  */
@@ -307,8 +307,8 @@ void local_zones_print(struct local_zones* zones);
  * @param tagname: array of tag name strings (for debug output).
  * @param num_tags: number of items in tagname array.
  * @param view: answer using this view. May be NULL.
- * @return true if answer is in buffer. false if query is not answered 
- * by authority data. If the reply should be dropped altogether, the return 
+ * @return true if answer is in buffer. false if query is not answered
+ * by authority data. If the reply should be dropped altogether, the return
  * value is true, but the buffer is cleared (empty).
  * It can also return true if a non-exact alias answer is found.  In this
  * case qinfo->local_alias points to the corresponding alias RRset but the
@@ -326,7 +326,7 @@ int local_zones_answer(struct local_zones* zones, struct module_env* env,
 	struct config_strlist** tag_datas, size_t tag_datas_size,
 	char** tagname, int num_tags, struct view* view);
 
-/** 
+/**
  * Answer using the local zone only (not local data used).
  * @param z: zone for query.
  * @param env: module environment.
@@ -372,7 +372,7 @@ const char* local_zone_type2str(enum localzone_type t);
  * @param dclass: class to lookup.
  * @return the exact local_zone or NULL.
  */
-struct local_zone* local_zones_find(struct local_zones* zones, 
+struct local_zone* local_zones_find(struct local_zones* zones,
 	uint8_t* name, size_t len, int labs, uint16_t dclass);
 
 /**
@@ -403,8 +403,8 @@ local_zones_find_le(struct local_zones* zones,
  * @param tp: type.
  * @return local_zone or NULL on error, caller must printout memory error.
  */
-struct local_zone* local_zones_add_zone(struct local_zones* zones, 
-	uint8_t* name, size_t len, int labs, uint16_t dclass, 
+struct local_zone* local_zones_add_zone(struct local_zones* zones,
+	uint8_t* name, size_t len, int labs, uint16_t dclass,
 	enum localzone_type tp);
 
 /**
@@ -434,12 +434,12 @@ int local_zones_add_RR(struct local_zones* zones, const char* rr);
  * @param labs: labelcount of name.
  * @param dclass: class to remove.
  */
-void local_zones_del_data(struct local_zones* zones, 
+void local_zones_del_data(struct local_zones* zones,
 	uint8_t* name, size_t len, int labs, uint16_t dclass);
 
 
-/** 
- * Form wireformat from text format domain name. 
+/**
+ * Form wireformat from text format domain name.
  * @param str: the domain name in text "www.example.com"
  * @param res: resulting wireformat is stored here with malloc.
  * @param len: length of resulting wireformat.
@@ -637,6 +637,6 @@ local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
  * @param nmlabs: labs of nm
  * @return local_data on exact match, NULL otherwise.
  */
-struct local_data* 
+struct local_data*
 local_zone_find_data(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs);
 #endif /* SERVICES_LOCALZONE_H */
diff --git a/usr.sbin/unbound/services/mesh.c b/usr.sbin/unbound/services/mesh.c
index 9007b6e08..ac333f7bd 100644
--- a/usr.sbin/unbound/services/mesh.c
+++ b/usr.sbin/unbound/services/mesh.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -249,7 +249,7 @@ mesh_state_ref_compare(const void* ap, const void* bp)
 	return mesh_state_compare(a->s, b->s);
 }
 
-struct mesh_area* 
+struct mesh_area*
 mesh_create(struct module_stack* stack, struct module_env* env)
 {
 	struct mesh_area* mesh = calloc(1, sizeof(struct mesh_area));
@@ -298,7 +298,7 @@ mesh_delete_helper(rbnode_type* n)
 	 * traversal and rbtree rebalancing do not work together */
 }
 
-void 
+void
 mesh_delete(struct mesh_area* mesh)
 {
 	if(!mesh)
@@ -341,7 +341,7 @@ int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf)
 	if(m && m->reply_list && m->list_select == mesh_jostle_list) {
 		/* how old is it? */
 		struct timeval age;
-		timeval_subtract(&age, mesh->env->now_tv, 
+		timeval_subtract(&age, mesh->env->now_tv,
 			&m->reply_list->start_time);
 		if(timeval_smaller(&mesh->jostle_max, &age)) {
 			/* its a goner */
@@ -585,11 +585,11 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		/* move to either the forever or the jostle_list */
 		if(mesh->num_forever_states < mesh->max_forever_states) {
 			mesh->num_forever_states ++;
-			mesh_list_insert(s, &mesh->forever_first, 
+			mesh_list_insert(s, &mesh->forever_first,
 				&mesh->forever_last);
 			s->list_select = mesh_forever_list;
 		} else {
-			mesh_list_insert(s, &mesh->jostle_first, 
+			mesh_list_insert(s, &mesh->jostle_first,
 				&mesh->jostle_last);
 			s->list_select = mesh_jostle_list;
 		}
@@ -610,9 +610,9 @@ servfail_mem:
 	return;
 }
 
-int 
+int
 mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
-	uint16_t qflags, struct edns_data* edns, sldns_buffer* buf, 
+	uint16_t qflags, struct edns_data* edns, sldns_buffer* buf,
 	uint16_t qid, mesh_cb_func_type cb, void* cb_arg, int rpz_passthru)
 {
 	struct mesh_state* s = NULL;
@@ -900,7 +900,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	int i;
 	if(!region)
 		return NULL;
-	mstate = (struct mesh_state*)regional_alloc(region, 
+	mstate = (struct mesh_state*)regional_alloc(region,
 		sizeof(struct mesh_state));
 	if(!mstate) {
 		alloc_reg_release(env->alloc, region);
@@ -982,7 +982,7 @@ mesh_state_make_unique(struct mesh_state* mstate)
 	mstate->unique = mstate;
 }
 
-void 
+void
 mesh_state_cleanup(struct mesh_state* mstate)
 {
 	struct mesh_area* mesh;
@@ -1028,7 +1028,7 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	alloc_reg_release(mstate->s.env->alloc, mstate->s.region);
 }
 
-void 
+void
 mesh_state_delete(struct module_qstate* qstate)
 {
 	struct mesh_area* mesh;
@@ -1041,10 +1041,10 @@ mesh_state_delete(struct module_qstate* qstate)
 	mesh_detach_subs(&mstate->s);
 	if(mstate->list_select == mesh_forever_list) {
 		mesh->num_forever_states --;
-		mesh_list_remove(mstate, &mesh->forever_first, 
+		mesh_list_remove(mstate, &mesh->forever_first,
 			&mesh->forever_last);
 	} else if(mstate->list_select == mesh_jostle_list) {
-		mesh_list_remove(mstate, &mesh->jostle_first, 
+		mesh_list_remove(mstate, &mesh->jostle_first,
 			&mesh->jostle_last);
 	}
 	if(!mstate->reply_list && !mstate->cb_list
@@ -1116,7 +1116,7 @@ void mesh_detach_subs(struct module_qstate* qstate)
 		if(!ref->s->reply_list && !ref->s->cb_list
 			&& ref->s->super_set.count == 0) {
 			mesh->num_detached_states++;
-			log_assert(mesh->num_detached_states + 
+			log_assert(mesh->num_detached_states +
 				mesh->num_reply_states <= mesh->all.count);
 		}
 	}
@@ -1181,7 +1181,7 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 	if(!mesh_state_attachment(qstate->mesh_info, sub))
 		return 0;
 	/* if it was a duplicate  attachment, the count was not zero before */
-	if(!sub->reply_list && !sub->cb_list && was_detached && 
+	if(!sub->reply_list && !sub->cb_list && was_detached &&
 		sub->super_set.count == 1) {
 		/* it used to be detached, before this one got added */
 		log_assert(mesh->num_detached_states > 0);
@@ -1280,10 +1280,10 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 
 		if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
 			LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region, start_time) ||
-			!reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
-			r->qflags, r->buf, 0, 1, 
-			m->s.env->scratch, udp_size, &r->edns, 
-			(int)(r->edns.bits & EDNS_DO), secure)) 
+			!reply_info_answer_encode(&m->s.qinfo, rep, r->qid,
+			r->qflags, r->buf, 0, 1,
+			m->s.env->scratch, udp_size, &r->edns,
+			(int)(r->edns.bits & EDNS_DO), secure))
 		{
 			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
 			(*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,
@@ -1346,7 +1346,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 
 	/* examine security status */
 	if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
-		m->s.env->cfg->ignore_cd) && rep && 
+		m->s.env->cfg->ignore_cd) && rep &&
 		(rep->security <= sec_status_bogus ||
 		rep->security == sec_status_secure_sentinel_fail)) {
 		rcode = LDNS_RCODE_SERVFAIL;
@@ -1401,7 +1401,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
 				rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time))
 					r->edns.opt_list_inplace_cb_out = NULL;
-		} else { 
+		} else {
 			if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
 				&r->edns, &r->query_reply, m->s.region, &r->start_time))
 					r->edns.opt_list_inplace_cb_out = NULL;
@@ -1451,10 +1451,10 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		m->s.qinfo.local_alias = r->local_alias;
 		if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
 			LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) ||
-			!reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
+			!reply_info_answer_encode(&m->s.qinfo, rep, r->qid,
 			r->qflags, r_buffer, 0, 1, m->s.env->scratch,
 			udp_size, &r->edns, (int)(r->edns.bits & EDNS_DO),
-			secure)) 
+			secure))
 		{
 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
 			rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, &r->start_time))
@@ -1611,7 +1611,7 @@ void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
 		/* callback the function to inform super of result */
 		fptr_ok(fptr_whitelist_mod_inform_super(
 			mesh->mods.mod[ref->s->s.curmod]->inform_super));
-		(*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s, 
+		(*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s,
 			ref->s->s.curmod, &ref->s->s);
 		/* copy state that is always relevant to super */
 		copy_state_to_super(&mstate->s, ref->s->s.curmod, &ref->s->s);
@@ -1635,7 +1635,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
 	 * desire aggregation).*/
 	key.unique = NULL;
 	key.s.client_info = cinfo;
-	
+
 	result = (struct mesh_state*)rbtree_search(&mesh->all, &key);
 	return result;
 }
@@ -1644,7 +1644,7 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
         sldns_buffer* buf, mesh_cb_func_type cb, void* cb_arg,
 	uint16_t qid, uint16_t qflags)
 {
-	struct mesh_cb* r = regional_alloc(s->s.region, 
+	struct mesh_cb* r = regional_alloc(s->s.region,
 		sizeof(struct mesh_cb));
 	if(!r)
 		return 0;
@@ -1776,7 +1776,7 @@ mesh_copy_qinfo(struct mesh_state* mstate, struct query_info** qinfop,
  * Handles module finished.
  * @param mesh: the mesh area.
  * @param mstate: currently active mesh state.
- * 	Deleted if finished, calls _done and _supers to 
+ * 	Deleted if finished, calls _done and _supers to
  * 	send replies to clients and inform other mesh states.
  * 	This in turn may create additional runnable mesh states.
  * @param s: state at which the current module exited.
@@ -1810,7 +1810,7 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
 		}
 		if(s == module_restart_next) {
 			int curmod = mstate->s.curmod;
-			for(; mstate->s.curmod < mesh->mods.num; 
+			for(; mstate->s.curmod < mesh->mods.num;
 				mstate->s.curmod++) {
 				fptr_ok(fptr_whitelist_mod_clear(
 					mesh->mods.mod[mstate->s.curmod]->clear));
@@ -1888,7 +1888,7 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
 		mstate->s.reply = NULL;
 		regional_free_all(mstate->s.env->scratch);
 		s = mstate->s.ext_state[mstate->s.curmod];
-		verbose(VERB_ALGO, "mesh_run: %s module exit state is %s", 
+		verbose(VERB_ALGO, "mesh_run: %s module exit state is %s",
 			mesh->mods.mod[mstate->s.curmod]->name, strextstate(s));
 		e = NULL;
 		if(mesh_continue(mesh, mstate, s, &ev))
@@ -1908,14 +1908,14 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
 	}
 }
 
-void 
+void
 mesh_log_list(struct mesh_area* mesh)
 {
 	char buf[30];
 	struct mesh_state* m;
 	int num = 0;
 	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
-		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s", 
+		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s",
 			num++, (m->s.is_priming)?"p":"",  /* prime */
 			(m->s.is_valrec)?"v":"",  /* prime */
 			(m->s.query_flags&BIT_RD)?"RD":"",
@@ -1924,18 +1924,18 @@ mesh_log_list(struct mesh_area* mesh)
 			(m->sub_set.count!=0)?"c":"",  /* children */
 			m->s.curmod, (m->reply_list)?"rep":"", /*hasreply*/
 			(m->cb_list)?"cb":"" /* callbacks */
-			); 
+			);
 		log_query_info(VERB_ALGO, buf, &m->s.qinfo);
 	}
 }
 
-void 
+void
 mesh_stats(struct mesh_area* mesh, const char* str)
 {
 	verbose(VERB_DETAIL, "%s %u recursion states (%u with reply, "
 		"%u detached), %u waiting replies, %u recursion replies "
-		"sent, %d replies dropped, %d states jostled out", 
-		str, (unsigned)mesh->all.count, 
+		"sent, %d replies dropped, %d states jostled out",
+		str, (unsigned)mesh->all.count,
 		(unsigned)mesh->num_reply_states,
 		(unsigned)mesh->num_detached_states,
 		(unsigned)mesh->num_reply_addrs,
@@ -1944,7 +1944,7 @@ mesh_stats(struct mesh_area* mesh, const char* str)
 		(unsigned)mesh->stats_jostled);
 	if(mesh->replies_sent > 0) {
 		struct timeval avg;
-		timeval_divide(&avg, &mesh->replies_sum_wait, 
+		timeval_divide(&avg, &mesh->replies_sum_wait,
 			mesh->replies_sent);
 		log_info("average recursion processing time "
 			ARG_LL "d.%6.6d sec",
@@ -1954,7 +1954,7 @@ mesh_stats(struct mesh_area* mesh, const char* str)
 	}
 }
 
-void 
+void
 mesh_stats_clear(struct mesh_area* mesh)
 {
 	if(!mesh)
@@ -1973,7 +1973,7 @@ mesh_stats_clear(struct mesh_area* mesh)
 	mesh->ans_nodata = 0;
 }
 
-size_t 
+size_t
 mesh_get_mem(struct mesh_area* mesh)
 {
 	struct mesh_state* m;
@@ -1987,7 +1987,7 @@ mesh_get_mem(struct mesh_area* mesh)
 	return s;
 }
 
-int 
+int
 mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
 	uint16_t flags, int prime, int valrec)
 {
diff --git a/usr.sbin/unbound/services/mesh.h b/usr.sbin/unbound/services/mesh.h
index 25121a67b..42c2636e3 100644
--- a/usr.sbin/unbound/services/mesh.h
+++ b/usr.sbin/unbound/services/mesh.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -76,7 +76,7 @@ struct respip_client_info;
  */
 #define MESH_MAX_SUBSUB 1024
 
-/** 
+/**
  * Mesh of query states
  */
 struct mesh_area {
@@ -92,7 +92,7 @@ struct mesh_area {
 
 	/** count of the total number of mesh_reply entries */
 	size_t num_reply_addrs;
-	/** count of the number of mesh_states that have mesh_replies 
+	/** count of the number of mesh_states that have mesh_replies
 	 * Because a state can send results to multiple reply addresses,
 	 * this number must be equal or lower than num_reply_addrs. */
 	size_t num_reply_states;
@@ -169,14 +169,14 @@ struct mesh_state {
 	rbnode_type node;
 	/** node in mesh_area runnable tree, key is this struct */
 	rbnode_type run_node;
-	/** the query state. Note that the qinfo and query_flags 
+	/** the query state. Note that the qinfo and query_flags
 	 * may not change. */
 	struct module_qstate s;
 	/** the list of replies to clients for the results */
 	struct mesh_reply* reply_list;
 	/** the list of callbacks for the results */
 	struct mesh_cb* cb_list;
-	/** set of superstates (that want this state's result) 
+	/** set of superstates (that want this state's result)
 	 * contains struct mesh_state_ref* */
 	rbtree_type super_set;
 	/** set of substates (that this state needs to continue)
@@ -190,7 +190,7 @@ struct mesh_state {
 	/** next in linked list for reply states */
 	struct mesh_state* next;
 	/** if this state is in the forever list, jostle list, or neither */
-	enum mesh_list_select { mesh_no_list, mesh_forever_list, 
+	enum mesh_list_select { mesh_no_list, mesh_forever_list,
 		mesh_jostle_list } list_select;
 	/** pointer to this state for uniqueness or NULL */
 	struct mesh_state* unique;
@@ -201,7 +201,7 @@ struct mesh_state {
 
 /**
  * Rbtree reference to a mesh_state.
- * Used in super_set and sub_set. 
+ * Used in super_set and sub_set.
  */
 struct mesh_state_ref {
 	/** node in rbtree for set, key is this structure */
@@ -234,7 +234,7 @@ struct mesh_reply {
 	struct http2_stream* h2_stream;
 };
 
-/** 
+/**
  * Mesh result callback func.
  * called as func(cb_arg, rcode, buffer_with_reply, security, why_bogus,
  *		was_ratelimited);
@@ -272,7 +272,7 @@ struct mesh_cb {
  * @param env: environment for new queries.
  * @return mesh: the new mesh or NULL on error.
  */
-struct mesh_area* mesh_create(struct module_stack* stack, 
+struct mesh_area* mesh_create(struct module_stack* stack,
 	struct module_env* env);
 
 /**
@@ -306,7 +306,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 
 /**
  * New query with callback. Create new query state if needed, and
- * add mesh_cb to it. 
+ * add mesh_cb to it.
  * Will run the mesh area queries to process if a new query state is created.
  *
  * @param mesh: the mesh.
@@ -322,7 +322,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
  * @return 0 on error.
  */
 int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
-	uint16_t qflags, struct edns_data* edns, struct sldns_buffer* buf, 
+	uint16_t qflags, struct edns_data* edns, struct sldns_buffer* buf,
 	uint16_t qid, mesh_cb_func_type cb, void* cb_arg, int rpz_passthru);
 
 /**
@@ -434,15 +434,15 @@ int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
  *
  * @param mstate: mesh state that is done. return_rcode and return_msg
  * 	are used for replies.
- * 	return_rcode: if not 0 (NOERROR) an error is sent back (and 
+ * 	return_rcode: if not 0 (NOERROR) an error is sent back (and
  * 		return_msg is ignored).
  * 	return_msg: reply to encode and send back to clients.
  */
 void mesh_query_done(struct mesh_state* mstate);
 
 /**
- * Call inform_super for the super query states that are interested in the 
- * results from this query state. These can then be changed for error 
+ * Call inform_super for the super query states that are interested in the
+ * results from this query state. These can then be changed for error
  * or results.
  * Called when a module is module_finished or returns module_error.
  * The super query states become runnable with event module_event_pass,
@@ -494,7 +494,7 @@ int mesh_state_is_unique(struct mesh_state* mstate);
 void mesh_state_make_unique(struct mesh_state* mstate);
 
 /**
- * Cleanup a mesh state and its query state. Does not do rbtree or 
+ * Cleanup a mesh state and its query state. Does not do rbtree or
  * reference cleanup.
  * @param mstate: mesh state to cleanup. Its pointer may no longer be used
  * 	afterwards. Cleanup rbtrees before calling this function.
@@ -573,7 +573,7 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
  * @param ev: event the mstate. Others get event_pass.
  * @param e: if a reply, its outbound entry.
  */
-void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate, 
+void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
 	enum module_ev ev, struct outbound_entry* e);
 
 /**
diff --git a/usr.sbin/ypldap/aldap.c b/usr.sbin/ypldap/aldap.c
index 4efedbeff..417f6867b 100644
--- a/usr.sbin/ypldap/aldap.c
+++ b/usr.sbin/ypldap/aldap.c
@@ -301,9 +301,9 @@ aldap_search(struct aldap *ldap, char *basedn, enum scope scope, char *filter,
 		goto fail;
 	}
 
-	c = ber;	
+	c = ber;
 	ber = ober_printf_elements(ber, "sEEddb", basedn, (long long)scope,
-	                         (long long)LDAP_DEREF_NEVER, sizelimit, 
+	                         (long long)LDAP_DEREF_NEVER, sizelimit,
 				 timelimit, typesonly);
 	if (ber == NULL) {
 		ldap->err = ALDAP_ERR_OPERATION_FAILED;
@@ -375,7 +375,7 @@ aldap_create_page_control(struct ber_element *elm, int size,
 fail:
 	if (ber != NULL)
 		ober_free_elements(ber);
-	ober_free(&c);	
+	ober_free(&c);
 
 	return (-1);
 }
@@ -487,7 +487,7 @@ parsefail:
 }
 
 struct aldap_page_control *
-aldap_parse_page_control(struct ber_element *control, size_t len) 
+aldap_parse_page_control(struct ber_element *control, size_t len)
 {
 	char *oid, *s;
 	char *encoded;
diff --git a/usr.sbin/ypldap/aldap.h b/usr.sbin/ypldap/aldap.h
index 5e8486944..81049853b 100644
--- a/usr.sbin/ypldap/aldap.h
+++ b/usr.sbin/ypldap/aldap.h
@@ -78,7 +78,7 @@ struct aldap_message {
 		}			 search;
 	} body;
 	struct ber_element	*references;
-	struct aldap_page_control *page; 
+	struct aldap_page_control *page;
 };
 
 enum aldap_protocol {
diff --git a/usr.sbin/ypldap/ldapclient.c b/usr.sbin/ypldap/ldapclient.c
index 50dfedec8..eb2b80593 100644
--- a/usr.sbin/ypldap/ldapclient.c
+++ b/usr.sbin/ypldap/ldapclient.c
@@ -514,7 +514,7 @@ client_search_idm(struct env *env, struct idm *idm, struct aldap *al,
 			if (al->msgid != m->msgid) {
 				goto fail;
 			}
-			
+
 			if (m->message_type == LDAP_RES_SEARCH_RESULT) {
 				if (m->page != NULL && m->page->cookie_len != 0)
 					pg = m->page;
@@ -534,14 +534,14 @@ client_search_idm(struct env *env, struct idm *idm, struct aldap *al,
 				    &ir, sizeof(ir.ir_key) +
 				    strlen(ir.ir_line) + 1);
 
-			aldap_freemsg(m);	
+			aldap_freemsg(m);
 		}
 	} while (pg != NULL);
 
 	return (0);
 
 fail:
-	aldap_freemsg(m);	
+	aldap_freemsg(m);
 	if (pg != NULL) {
 		aldap_freepage(pg);
 	}
diff --git a/usr.sbin/ypldap/parse.y b/usr.sbin/ypldap/parse.y
index 8770a6ca0..fbe1b8bb7 100644
--- a/usr.sbin/ypldap/parse.y
+++ b/usr.sbin/ypldap/parse.y
@@ -311,7 +311,7 @@ diropt		: BINDDN STRING				{
 				YYERROR;
 			}
 			free($2);
-		} 
+		}
 		| GROUPDN STRING		{
 			if(strlcpy(idm->idm_groupdn, $2,
 			    sizeof(idm->idm_groupdn)) >=
diff --git a/usr.sbin/ypldap/yp.c b/usr.sbin/ypldap/yp.c
index 98ed3f7eb..c19307677 100644
--- a/usr.sbin/ypldap/yp.c
+++ b/usr.sbin/ypldap/yp.c
@@ -121,7 +121,7 @@ yp_init(struct env *x_env)
 
 	env = x_env;
 	env->sc_yp = yp;
-	
+
 	switch (env->sc_bind_mode) {
 	case BIND_MODE_LOCAL:
 		addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
@@ -228,7 +228,7 @@ yp_write_binding(int udpport, int tcpport)
 	memmove(&ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port,
 	    &ypserv_udp,
 	    sizeof(ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port));
-	
+
 	total = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
 	if (writev(fd, iov, sizeof(iov)/sizeof(iov[0])) !=
 	    total) {
@@ -404,7 +404,7 @@ bool_t *
 ypproc_domain_2_svc(domainname *arg, struct svc_req *req)
 {
 	static bool_t	res;
-	
+
 	res = (bool_t)1;
 	if (strcmp(*arg, env->sc_domainname) != 0)
 		res = (bool_t)0;
@@ -415,7 +415,7 @@ bool_t *
 ypproc_domain_nonack_2_svc(domainname *arg, struct svc_req *req)
 {
 	static bool_t	res;
-	
+
 	if (strcmp(*arg, env->sc_domainname) != 0)
 		return NULL;
 	res = (bool_t)1;
@@ -467,7 +467,7 @@ ypproc_match_2_svc(ypreq_key *arg, struct svc_req *req)
 		return (&res);
 	} else if (strcmp(arg->map, "passwd.byuid") == 0 ||
 		   strcmp(arg->map, "master.passwd.byuid") == 0) {
-		ukey.ue_uid = strtonum(key, 0, UID_MAX, &estr); 
+		ukey.ue_uid = strtonum(key, 0, UID_MAX, &estr);
 		if (estr) {
 			res.stat = YP_BADARGS;
 			return (&res);
@@ -482,7 +482,7 @@ ypproc_match_2_svc(ypreq_key *arg, struct svc_req *req)
 		yp_make_val(&res, ue->ue_line, 1);
 		return (&res);
 	} else if (strcmp(arg->map, "group.bygid") == 0) {
-		gkey.ge_gid = strtonum(key, 0, GID_MAX, &estr); 
+		gkey.ge_gid = strtonum(key, 0, GID_MAX, &estr);
 		if (estr) {
 			res.stat = YP_BADARGS;
 			return (&res);
@@ -530,7 +530,7 @@ ypproc_match_2_svc(ypreq_key *arg, struct svc_req *req)
 			return (&res);
 		}
 
-		ukey.ue_uid = strtonum(cp, 0, UID_MAX, &estr); 
+		ukey.ue_uid = strtonum(cp, 0, UID_MAX, &estr);
 		if (estr) {
 			res.stat = YP_BADARGS;
 			return (&res);
@@ -544,7 +544,7 @@ ypproc_match_2_svc(ypreq_key *arg, struct svc_req *req)
 
 		yp_make_val(&res, ue->ue_netid_line, 0);
 		return (&res);
-	
+
 	} else {
 		log_debug("unknown map %s", arg->map);
 		res.stat = YP_NOMAP;
@@ -614,7 +614,7 @@ ypproc_next_2_svc(ypreq_key *arg, struct svc_req *req)
 		memset(key, 0, sizeof(key));
 		(void)strncpy(key, arg->key.keydat_val,
 		    arg->key.keydat_len);
-		
+
 		gkey.ge_line = key;
 		if ((ge = RB_NFIND(group_name_tree, env->sc_group_names,
 		    &gkey)) == NULL) {
@@ -680,7 +680,7 @@ ypproc_maplist_2_svc(domainname *arg, struct svc_req *req)
 	};
 	static ypresp_maplist	 res;
 	static struct ypmaplist	 maps[sizeof(mapnames) / sizeof(mapnames[0])];
-	
+
 	if (yp_valid_domain(*arg, (struct ypresp_val *)&res) == -1)
 		return (&res);
 
@@ -724,7 +724,7 @@ yp_make_keyval(struct ypresp_key_val *res, char *key, char *line)
 
 	memset(keybuf, 0, sizeof(keybuf));
 	memset(buf, 0, sizeof(buf));
-	
+
 	(void)strlcpy(keybuf, key, sizeof(keybuf));
 	res->key.keydat_len = strlen(keybuf);
 	res->key.keydat_val = keybuf;
diff --git a/usr.sbin/ypldap/ypldap.c b/usr.sbin/ypldap/ypldap.c
index 8aa2c2b00..d2bc2a23d 100644
--- a/usr.sbin/ypldap/ypldap.c
+++ b/usr.sbin/ypldap/ypldap.c
@@ -238,7 +238,7 @@ main_create_user_groups(struct env *env)
 		if (*bp == '\0')
 			continue;
 		bp = cp;
-		for (;;) { 
+		for (;;) {
 			if (!(cp = strsep(&bp, ",")))
 				break;
 			ukey.ue_line = cp;
diff --git a/usr.sbin/ypserv/mkalias/mkalias.c b/usr.sbin/ypserv/mkalias/mkalias.c
index 94c9be129..e16a1c88f 100644
--- a/usr.sbin/ypserv/mkalias/mkalias.c
+++ b/usr.sbin/ypserv/mkalias/mkalias.c
@@ -166,7 +166,7 @@ main(int argc, char *argv[])
 		case 'n':
 			nflag = 1;	/* Capitalize name parts */
 			break;
-		case 's':		/* Ignore */ 
+		case 's':		/* Ignore */
 			break;
 		case 'u':
 			uflag = 1;	/* Don't check UUCP hostname */