diff --git a/.gitignore b/.gitignore
index 3fdff78bc..f07392d0d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 **/obj
 **/tags
+**/CVS
diff --git a/bin/ksh/main.c b/bin/ksh/main.c
index 5ab581eca..b011b22bf 100644
--- a/bin/ksh/main.c
+++ b/bin/ksh/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.99 2023/02/08 17:22:10 kn Exp $	*/
+/*	$OpenBSD: main.c,v 1.100 2023/07/23 23:42:03 kn Exp $	*/
 
 /*
  * startup, main loop, environments and error handling
@@ -87,7 +87,11 @@ static const char *initcoms [] = {
 	"typeset", "-x", "SHELL", "PATH", "HOME", "PWD", "OLDPWD", NULL,
 	"typeset", "-ir", "PPID", NULL,
 	"typeset", "-i", "OPTIND=1", NULL,
+#ifndef SMALL
 	"eval", "typeset -i RANDOM MAILCHECK=\"${MAILCHECK-600}\" SECONDS=\"${SECONDS-0}\" TMOUT=\"${TMOUT-0}\"", NULL,
+#else
+	"eval", "typeset -i RANDOM SECONDS=\"${SECONDS-0}\" TMOUT=\"${TMOUT-0}\"", NULL,
+#endif /* SMALL */
 	"alias",
 	 /* Standard ksh aliases */
 	  "hash=alias -t",	/* not "alias -t --": hash -r needs to work */
@@ -615,7 +619,9 @@ shell(Source *volatile s, volatile int toplevel)
 		if (interactive) {
 			got_sigwinch = 1;
 			j_notify();
+#ifndef SMALL
 			mcheck();
+#endif /* SMALL */
 			set_prompt(PS1);
 		}
 
diff --git a/bin/ksh/var.c b/bin/ksh/var.c
index 9dbba0731..0757440ed 100644
--- a/bin/ksh/var.c
+++ b/bin/ksh/var.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: var.c,v 1.72 2021/03/05 15:22:03 zhuk Exp $	*/
+/*	$OpenBSD: var.c,v 1.73 2023/07/23 23:42:03 kn Exp $	*/
 
 #include <sys/stat.h>
 #include <sys/time.h>
@@ -108,9 +108,11 @@ initvar(void)
 		{ "HISTSIZE",		V_HISTSIZE },
 		{ "EDITOR",		V_EDITOR },
 		{ "VISUAL",		V_VISUAL },
+#ifndef SMALL
 		{ "MAIL",		V_MAIL },
 		{ "MAILCHECK",		V_MAILCHECK },
 		{ "MAILPATH",		V_MAILPATH },
+#endif /* SMALL */
 		{ "RANDOM",		V_RANDOM },
 		{ "SECONDS",		V_SECONDS },
 		{ "TMOUT",		V_TMOUT },
@@ -1029,6 +1031,7 @@ setspec(struct tbl *vp)
 				x_cols = l;
 		}
 		break;
+#ifndef SMALL
 	case V_MAIL:
 		mbset(str_val(vp));
 		break;
@@ -1040,6 +1043,7 @@ setspec(struct tbl *vp)
 		mcset(intval(vp));
 		vp->flag |= SPECIAL;
 		break;
+#endif /* SMALL */
 	case V_RANDOM:
 		vp->flag &= ~SPECIAL;
 		srand_deterministic((unsigned int)intval(vp));
@@ -1099,17 +1103,21 @@ unsetspec(struct tbl *vp)
 		afree(tmpdir, APERM);
 		tmpdir = NULL;
 		break;
+#ifndef SMALL
 	case V_MAIL:
 		mbset(NULL);
 		break;
 	case V_MAILPATH:
 		mpset(NULL);
 		break;
+#endif /* SMALL */
 	case V_HISTCONTROL:
 		sethistcontrol(NULL);
 		break;
 	case V_LINENO:
+#ifndef SMALL
 	case V_MAILCHECK:	/* at&t ksh leaves previous value in place */
+#endif /* SMALL */
 	case V_RANDOM:
 	case V_SECONDS:
 	case V_TMOUT:		/* at&t ksh leaves previous value in place */
diff --git a/distrib/sets/lists/comp/mi b/distrib/sets/lists/comp/mi
index bc7442fd2..3f02e8d38 100644
--- a/distrib/sets/lists/comp/mi
+++ b/distrib/sets/lists/comp/mi
@@ -1786,7 +1786,6 @@
 ./usr/share/man/man3/BIO_ctrl.3
 ./usr/share/man/man3/BIO_dump.3
 ./usr/share/man/man3/BIO_dup_chain.3
-./usr/share/man/man3/BIO_f_asn1.3
 ./usr/share/man/man3/BIO_f_base64.3
 ./usr/share/man/man3/BIO_f_buffer.3
 ./usr/share/man/man3/BIO_f_cipher.3
@@ -1813,7 +1812,6 @@
 ./usr/share/man/man3/BIO_s_socket.3
 ./usr/share/man/man3/BIO_set_callback.3
 ./usr/share/man/man3/BIO_should_retry.3
-./usr/share/man/man3/BN_BLINDING_new.3
 ./usr/share/man/man3/BN_CTX_new.3
 ./usr/share/man/man3/BN_CTX_start.3
 ./usr/share/man/man3/BN_add.3
@@ -1967,8 +1965,8 @@
 ./usr/share/man/man3/MD5Init.3
 ./usr/share/man/man3/NAME_CONSTRAINTS_new.3
 ./usr/share/man/man3/OBJ_NAME_add.3
-./usr/share/man/man3/OBJ_add_sigid.3
 ./usr/share/man/man3/OBJ_create.3
+./usr/share/man/man3/OBJ_find_sigid_algs.3
 ./usr/share/man/man3/OBJ_nid2obj.3
 ./usr/share/man/man3/OCSP_CRLID_new.3
 ./usr/share/man/man3/OCSP_REQUEST_new.3
diff --git a/distrib/special/Makefile b/distrib/special/Makefile
index 787f6d181..738cb6c06 100644
--- a/distrib/special/Makefile
+++ b/distrib/special/Makefile
@@ -1,7 +1,7 @@
-#	$OpenBSD: Makefile,v 1.47 2021/05/19 17:25:10 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.48 2023/07/25 14:51:38 kn Exp $
 
 SUBDIR=	libstubs \
-	arch bioctl cat chmod chroot cp date dd df dhclient dhcpleased disklabel \
+	arch bioctl cat chmod chroot cp date dd df dhcpleased disklabel \
 	dmesg doas ed eeprom encrypt fdisk fsck fsck_ext2fs fsck_ffs fsck_msdos ftp \
 	ftp-ssl grep growfs gzip hostname ifconfig init installboot kbd ksh ln \
 	ls md5 mkdir mknod mkuboot more mount mount_cd9660 mount_ext2fs \
diff --git a/distrib/special/dhclient/Makefile b/distrib/special/dhclient/Makefile
deleted file mode 100644
index a54f3143a..000000000
--- a/distrib/special/dhclient/Makefile
+++ /dev/null
@@ -1,16 +0,0 @@
-#	$OpenBSD: Makefile,v 1.17 2019/11/11 05:39:04 deraadt Exp $
-
-.include <bsd.own.mk>
-
-.PATH:	${.CURDIR}/../../../sbin/dhclient
-
-CPPFLAGS+= -I${.CURDIR}/../../../sbin/dhclient
-SRCS=	dhclient.c clparse.c dispatch.c bpf.c options.c \
-	conflex.c log.c kroute.c packet.c \
-	parse.c privsep.c
-PROG=	dhclient
-LDADD+=	-lutil
-DPADD+= ${LIBUTIL}
-
-.include <bsd.prog.mk>
-.include <bsd.subdir.mk>
diff --git a/distrib/special/ksh/Makefile b/distrib/special/ksh/Makefile
index 9aced4e29..c4b76dbc6 100644
--- a/distrib/special/ksh/Makefile
+++ b/distrib/special/ksh/Makefile
@@ -1,8 +1,8 @@
-#	$OpenBSD: Makefile,v 1.6 2023/02/08 17:22:10 kn Exp $
+#	$OpenBSD: Makefile,v 1.7 2023/07/23 23:42:03 kn Exp $
 
 PROG=	ksh
 SRCS=	alloc.c c_ksh.c c_sh.c c_test.c c_ulimit.c edit.c emacs.c eval.c \
-	exec.c expr.c history.c io.c jobs.c lex.c mail.c main.c \
+	exec.c expr.c history.c io.c jobs.c lex.c main.c \
 	misc.c path.c shf.c syn.c table.c trap.c tree.c tty.c var.c \
 	vi.c
 
diff --git a/distrib/special/mount/Makefile b/distrib/special/mount/Makefile
index ef62add6d..05cc7cc94 100644
--- a/distrib/special/mount/Makefile
+++ b/distrib/special/mount/Makefile
@@ -1,7 +1,8 @@
-#	$OpenBSD: Makefile,v 1.1 2014/12/23 17:16:02 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.2 2023/07/23 23:21:19 kn Exp $
 
 PROG=	mount
 SRCS=	mount.c
+COPTS+=	-DSMALL
 DPADD=	${LIBUTIL}
 LDADD=	-lutil
 MAN=	mount.8
diff --git a/etc/root/root.mail b/etc/root/root.mail
index 28b166bbc..cdc26b4f4 100644
--- a/etc/root/root.mail
+++ b/etc/root/root.mail
@@ -1,6 +1,6 @@
-From purplerain@secbsd.org Sat Jul 22 00:00:00 UTC 2023
+From purplerain@secbsd.org Wed Jul 26 00:00:00 UTC 2023
 Return-Path: root
-Date: Jul 22 00:00:00 UTC 2023
+Date: Jul 26 00:00:00 UTC 2023
 From: purplerain@secbsd.org (Purple Rain)
 To: root
 Subject: Welcome to SecBSD 1.3!
diff --git a/etc/skel/dot.version b/etc/skel/dot.version
index dfa7aec85..892eb2e90 100644
--- a/etc/skel/dot.version
+++ b/etc/skel/dot.version
@@ -1 +1 @@
-# SecBSD 1.3-91d9be7: Sat Jul 22 00:00:00 UTC 2023 (Tezcatlipoca)
+# SecBSD 1.3-6971d2f: Thu Jul 27 00:00:00 UTC 2023 (Tezcatlipoca)
diff --git a/gnu/usr.bin/cvs/diff/analyze.c b/gnu/usr.bin/cvs/diff/analyze.c
index 3262444e6..cec7acccc 100644
--- a/gnu/usr.bin/cvs/diff/analyze.c
+++ b/gnu/usr.bin/cvs/diff/analyze.c
@@ -319,7 +319,7 @@ diag (xoff, xlim, yoff, ylim, minimal, part)
 	}
     }
 }
-
+
 /* Compare in detail contiguous subsequences of the two files
    which are known, as a whole, to match each other.
 
@@ -330,7 +330,7 @@ diag (xoff, xlim, yoff, ylim, minimal, part)
 
    Note that XLIM, YLIM are exclusive bounds.
    All line numbers are origin-0 and discarded lines are not counted.
- 
+
    If MINIMAL is nonzero, find a minimal difference no matter how
    expensive it is.  */
 
@@ -388,7 +388,7 @@ compareseq (xoff, xlim, yoff, ylim, minimal)
 	}
     }
 }
-
+
 /* Discard lines from one file that have no matches in the other file.
 
    A line which is discarded will not be considered by the actual
@@ -603,7 +603,7 @@ discard_confusing_lines (filevec)
   free (discarded[0]);
   free (equiv_count[0]);
 }
-
+
 /* Adjust inserts/deletes of identical lines to join changes
    as much as possible.
 
@@ -716,7 +716,7 @@ shift_boundaries (filevec)
 	}
     }
 }
-
+
 /* Cons an additional entry onto the front of an edit script OLD.
    LINE0 and LINE1 are the first affected lines in the two files (origin 0).
    DELETED is the number of lines deleted here from file 0.
@@ -812,7 +812,7 @@ build_script (filevec)
 
   return script;
 }
-
+
 /* If CHANGES, briefly report that two files differed.  */
 static void
 briefly_report (changes, filevec)
diff --git a/lib/libcrypto/arch/aarch64/arm64cap.c b/lib/libcrypto/arch/aarch64/arm64cap.c
index 9d75daba0..23ff8b8dd 100644
--- a/lib/libcrypto/arch/aarch64/arm64cap.c
+++ b/lib/libcrypto/arch/aarch64/arm64cap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: arm64cap.c,v 1.2 2022/03/25 17:42:07 robert Exp $ */
+/* $OpenBSD: arm64cap.c,v 1.3 2023/07/26 09:57:34 jsing Exp $ */
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -30,10 +30,6 @@
 
 unsigned int OPENSSL_armcap_P;
 
-#if defined(__GNUC__) && __GNUC__ >= 2
-void OPENSSL_cpuid_setup(void) __attribute__((constructor));
-#endif
-
 #if defined(CPU_ID_AA64ISAR0)
 void
 OPENSSL_cpuid_setup(void)
diff --git a/lib/libcrypto/arch/arm/armcap.c b/lib/libcrypto/arch/arm/armcap.c
index e1a721b71..9d93d11ee 100644
--- a/lib/libcrypto/arch/arm/armcap.c
+++ b/lib/libcrypto/arch/arm/armcap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: armcap.c,v 1.1 2022/03/23 15:13:31 tb Exp $ */
+/* $OpenBSD: armcap.c,v 1.2 2023/07/26 09:57:34 jsing Exp $ */
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -28,10 +28,6 @@ void _armv8_sha256_probe(void);
 void _armv8_pmull_probe(void);
 #endif
 
-#if defined(__GNUC__) && __GNUC__>=2
-void OPENSSL_cpuid_setup(void) __attribute__((constructor));
-#endif
-
 void
 OPENSSL_cpuid_setup(void)
 {
diff --git a/lib/libcrypto/asn1/x_name.c b/lib/libcrypto/asn1/x_name.c
index eb544596a..dc9f21789 100644
--- a/lib/libcrypto/asn1/x_name.c
+++ b/lib/libcrypto/asn1/x_name.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_name.c,v 1.40 2023/07/07 19:37:52 beck Exp $ */
+/* $OpenBSD: x_name.c,v 1.41 2023/07/24 06:56:54 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -189,13 +189,13 @@ const ASN1_ITEM X509_NAME_INTERNAL_it = {
  */
 
 const ASN1_EXTERN_FUNCS x509_name_ff = {
-	NULL,
-	x509_name_ex_new,
-	x509_name_ex_free,
-	0,	/* Default clear behaviour is OK */
-	x509_name_ex_d2i,
-	x509_name_ex_i2d,
-	x509_name_ex_print
+	.app_data = NULL,
+	.asn1_ex_new = x509_name_ex_new,
+	.asn1_ex_free = x509_name_ex_free,
+	.asn1_ex_clear = NULL,
+	.asn1_ex_d2i = x509_name_ex_d2i,
+	.asn1_ex_i2d = x509_name_ex_i2d,
+	.asn1_ex_print = x509_name_ex_print,
 };
 
 const ASN1_ITEM X509_NAME_it = {
diff --git a/lib/libcrypto/bn/arch/aarch64/bn_arch.h b/lib/libcrypto/bn/arch/aarch64/bn_arch.h
index 66de3682d..fe6f8a3ae 100644
--- a/lib/libcrypto/bn/arch/aarch64/bn_arch.h
+++ b/lib/libcrypto/bn/arch/aarch64/bn_arch.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bn_arch.h,v 1.12 2023/06/21 07:56:43 jsing Exp $ */
+/*	$OpenBSD: bn_arch.h,v 1.13 2023/07/24 10:21:29 jsing Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -241,7 +241,7 @@ bn_qwmulw_addw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0, BN_ULONG b,
 	    "mul     %[c], %[a3], %[b] \n"
 	    "adcs   %[r3], %[r3], %[c] \n"
 	    "adc    %[r4], %[r4], xzr  \n"
-	    : [c]"+r"(c), [r4]"=&r"(r4), [r3]"=&r"(r3), [r2]"=&r"(r2),
+	    : [c]"+&r"(c), [r4]"=&r"(r4), [r3]"=&r"(r3), [r2]"=&r"(r2),
 		[r1]"=&r"(r1), [r0]"=&r"(r0)
 	    : [a3]"r"(a3), [a2]"r"(a2), [a1]"r"(a1), [a0]"r"(a0), [b]"r"(b)
 	    : "cc");
@@ -282,7 +282,7 @@ bn_qwmulw_addqw_addw(BN_ULONG a3, BN_ULONG a2, BN_ULONG a1, BN_ULONG a0,
 	    "adcs   %[r2], %[r2], %[c2] \n"
 	    "adcs   %[r3], %[r3], %[c3] \n"
 	    "adc    %[r4], %[r4], xzr   \n"
-	    : [d]"+r"(d), [r4]"=&r"(r4), [r3]"=&r"(r3), [r2]"=&r"(r2),
+	    : [d]"+&r"(d), [r4]"=&r"(r4), [r3]"=&r"(r3), [r2]"=&r"(r2),
 		[r1]"=&r"(r1), [r0]"=&r"(r0)
 	    : [a3]"r"(a3), [a2]"r"(a2), [a1]"r"(a1), [a0]"r"(a0), [b]"r"(b),
 		[c3]"r"(c3), [c2]"r"(c2), [c1]"r"(c1), [c0]"r"(c0)
diff --git a/lib/libcrypto/bn/bn_print.c b/lib/libcrypto/bn/bn_print.c
index afcb82396..e7678f7a9 100644
--- a/lib/libcrypto/bn/bn_print.c
+++ b/lib/libcrypto/bn/bn_print.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bn_print.c,v 1.45 2023/07/10 02:29:28 tb Exp $ */
+/*	$OpenBSD: bn_print.c,v 1.46 2023/07/22 17:14:08 tb Exp $ */
 
 /*
  * Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
@@ -17,7 +17,6 @@
  */
 
 #include <ctype.h>
-#include <limits.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdint.h>
@@ -73,11 +72,9 @@ bn_print_bignum(BIO *bio, const BIGNUM *bn, int indent)
 		goto err;
 
 	/* Secondary indent is 4 spaces, capped at 128. */
-	if (indent > INT_MAX - 4)
-		goto err;
+	if (indent > 124)
+		indent = 124;
 	indent += 4;
-	if (indent > 128)
-		indent = 128;
 	if (indent < 0)
 		indent = 0;
 
diff --git a/lib/libcrypto/ct/ct_sct.c b/lib/libcrypto/ct/ct_sct.c
index 16ee8d557..4b2716e73 100644
--- a/lib/libcrypto/ct/ct_sct.c
+++ b/lib/libcrypto/ct/ct_sct.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ct_sct.c,v 1.9 2023/07/08 07:22:58 beck Exp $ */
+/*	$OpenBSD: ct_sct.c,v 1.10 2023/07/22 17:02:49 tb Exp $ */
 /*
  * Written by Rob Stradling (rob@comodo.com), Stephen Henson (steve@openssl.org)
  * and Adam Eijdenberg (adam.eijdenberg@gmail.com) for the OpenSSL project 2016.
@@ -61,14 +61,16 @@
 # error "CT disabled"
 #endif
 
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/asn1.h>
 #include <openssl/ct.h>
 #include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/tls1.h>
+#include <openssl/objects.h>
 #include <openssl/x509.h>
 
-#include <string.h>
-
 #include "ct_local.h"
 
 SCT *
diff --git a/lib/libcrypto/dh/dh_check.c b/lib/libcrypto/dh/dh_check.c
index f3d89f620..be79c2a04 100644
--- a/lib/libcrypto/dh/dh_check.c
+++ b/lib/libcrypto/dh/dh_check.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_check.c,v 1.27 2023/07/08 15:29:03 beck Exp $ */
+/* $OpenBSD: dh_check.c,v 1.28 2023/07/24 16:25:02 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -289,7 +289,7 @@ DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *flags)
 		if (!BN_mod_exp_ct(residue, pub_key, dh->q, dh->p, ctx))
 			goto err;
 		if (!BN_is_one(residue))
-			*flags = DH_CHECK_PUBKEY_INVALID;
+			*flags |= DH_CHECK_PUBKEY_INVALID;
 	}
 
 	ok = 1;
diff --git a/lib/libcrypto/ec/ec_lib.c b/lib/libcrypto/ec/ec_lib.c
index b5788492c..00a4a703f 100644
--- a/lib/libcrypto/ec/ec_lib.c
+++ b/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.64 2023/07/07 19:37:53 beck Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.65 2023/07/25 06:57:26 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -1062,7 +1062,7 @@ EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
     BN_CTX *ctx_in)
 {
 	BN_CTX *ctx;
-	int ret = 0;
+	int ret = -1;
 
 	if ((ctx = ctx_in) == NULL)
 		ctx = BN_CTX_new();
diff --git a/lib/libcrypto/ec/ecp_smpl.c b/lib/libcrypto/ec/ecp_smpl.c
index 9aa9af11f..de1f9a347 100644
--- a/lib/libcrypto/ec/ecp_smpl.c
+++ b/lib/libcrypto/ec/ecp_smpl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecp_smpl.c,v 1.46 2023/07/07 13:54:45 beck Exp $ */
+/* $OpenBSD: ecp_smpl.c,v 1.55 2023/07/26 17:15:25 tb Exp $ */
 /* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
  * for the OpenSSL project.
  * Includes code written by Bodo Moeller for the OpenSSL project.
@@ -114,11 +114,52 @@ ec_GFp_simple_group_copy(EC_GROUP *dest, const EC_GROUP *src)
 	return 1;
 }
 
+static int
+ec_decode_scalar(const EC_GROUP *group, BIGNUM *bn, const BIGNUM *x, BN_CTX *ctx)
+{
+	if (bn == NULL)
+		return 1;
+
+	if (group->meth->field_decode != NULL)
+		return group->meth->field_decode(group, bn, x, ctx);
+
+	return bn_copy(bn, x);
+}
+
+static int
+ec_encode_scalar(const EC_GROUP *group, BIGNUM *bn, const BIGNUM *x, BN_CTX *ctx)
+{
+	if (!BN_nnmod(bn, x, &group->field, ctx))
+		return 0;
+
+	if (group->meth->field_encode != NULL)
+		return group->meth->field_encode(group, bn, bn, ctx);
+
+	return 1;
+}
+
+static int
+ec_encode_z_coordinate(const EC_GROUP *group, BIGNUM *bn, int *is_one,
+    const BIGNUM *z, BN_CTX *ctx)
+{
+	if (!BN_nnmod(bn, z, &group->field, ctx))
+		return 0;
+
+	*is_one = BN_is_one(bn);
+	if (*is_one && group->meth->field_set_to_one != NULL)
+		return group->meth->field_set_to_one(group, bn, ctx);
+
+	if (group->meth->field_encode != NULL)
+		return group->meth->field_encode(group, bn, bn, ctx);
+
+	return 1;
+}
+
 int
 ec_GFp_simple_group_set_curve(EC_GROUP *group,
     const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
 {
-	BIGNUM *tmp_a;
+	BIGNUM *a_plus_3;
 	int ret = 0;
 
 	/* p must be a prime > 3 */
@@ -129,34 +170,24 @@ ec_GFp_simple_group_set_curve(EC_GROUP *group,
 
 	BN_CTX_start(ctx);
 
-	if ((tmp_a = BN_CTX_get(ctx)) == NULL)
+	if ((a_plus_3 = BN_CTX_get(ctx)) == NULL)
 		goto err;
 
-	/* group->field */
 	if (!bn_copy(&group->field, p))
 		goto err;
 	BN_set_negative(&group->field, 0);
 
-	/* group->a */
-	if (!BN_nnmod(tmp_a, a, p, ctx))
+	if (!ec_encode_scalar(group, &group->a, a, ctx))
 		goto err;
-	if (group->meth->field_encode) {
-		if (!group->meth->field_encode(group, &group->a, tmp_a, ctx))
-			goto err;
-	} else if (!bn_copy(&group->a, tmp_a))
+	if (!ec_encode_scalar(group, &group->b, b, ctx))
 		goto err;
 
-	/* group->b */
-	if (!BN_nnmod(&group->b, b, p, ctx))
+	if (!BN_set_word(a_plus_3, 3))
+		goto err;
+	if (!BN_mod_add(a_plus_3, a_plus_3, a, &group->field, ctx))
 		goto err;
-	if (group->meth->field_encode)
-		if (!group->meth->field_encode(group, &group->b, &group->b, ctx))
-			goto err;
 
-	/* group->a_is_minus3 */
-	if (!BN_add_word(tmp_a, 3))
-		goto err;
-	group->a_is_minus3 = (0 == BN_cmp(tmp_a, &group->field));
+	group->a_is_minus3 = BN_is_zero(a_plus_3);
 
 	ret = 1;
 
@@ -167,31 +198,17 @@ ec_GFp_simple_group_set_curve(EC_GROUP *group,
 }
 
 int
-ec_GFp_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
+ec_GFp_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
+    BIGNUM *b, BN_CTX *ctx)
 {
 	if (p != NULL) {
 		if (!bn_copy(p, &group->field))
 			return 0;
 	}
-	if (group->meth->field_decode != NULL) {
-		if (a != NULL) {
-			if (!group->meth->field_decode(group, a, &group->a, ctx))
-				return 0;
-		}
-		if (b != NULL) {
-			if (!group->meth->field_decode(group, b, &group->b, ctx))
-				return 0;
-		}
-	} else {
-		if (a != NULL) {
-			if (!bn_copy(a, &group->a))
-				return 0;
-		}
-		if (b != NULL) {
-			if (!bn_copy(b, &group->b))
-				return 0;
-		}
-	}
+	if (!ec_decode_scalar(group, a, &group->a, ctx))
+		return 0;
+	if (!ec_decode_scalar(group, b, &group->b, ctx))
+		return 0;
 
 	return 1;
 }
@@ -205,62 +222,52 @@ ec_GFp_simple_group_get_degree(const EC_GROUP *group)
 int
 ec_GFp_simple_group_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
 {
-	BIGNUM *a, *b, *order, *tmp_1, *tmp_2;
-	const BIGNUM *p = &group->field;
+	BIGNUM *p, *a, *b, *discriminant;
 	int ret = 0;
 
 	BN_CTX_start(ctx);
 
+	if ((p = BN_CTX_get(ctx)) == NULL)
+		goto err;
 	if ((a = BN_CTX_get(ctx)) == NULL)
 		goto err;
 	if ((b = BN_CTX_get(ctx)) == NULL)
 		goto err;
-	if ((tmp_1 = BN_CTX_get(ctx)) == NULL)
-		goto err;
-	if ((tmp_2 = BN_CTX_get(ctx)) == NULL)
-		goto err;
-	if ((order = BN_CTX_get(ctx)) == NULL)
+	if ((discriminant = BN_CTX_get(ctx)) == NULL)
 		goto err;
 
-	if (group->meth->field_decode) {
-		if (!group->meth->field_decode(group, a, &group->a, ctx))
-			goto err;
-		if (!group->meth->field_decode(group, b, &group->b, ctx))
-			goto err;
-	} else {
-		if (!bn_copy(a, &group->a))
-			goto err;
-		if (!bn_copy(b, &group->b))
-			goto err;
-	}
+	if (!EC_GROUP_get_curve(group, p, a, b, ctx))
+		goto err;
 
 	/*
-	 * check the discriminant: y^2 = x^3 + a*x + b is an elliptic curve
-	 * <=> 4*a^3 + 27*b^2 != 0 (mod p) 0 =< a, b < p
+	 * Check that the discriminant 4a^3 + 27b^2 is non-zero modulo p.
 	 */
-	if (BN_is_zero(a)) {
-		if (BN_is_zero(b))
-			goto err;
-	} else if (!BN_is_zero(b)) {
-		if (!BN_mod_sqr(tmp_1, a, p, ctx))
-			goto err;
-		if (!BN_mod_mul(tmp_2, tmp_1, a, p, ctx))
-			goto err;
-		if (!BN_lshift(tmp_1, tmp_2, 2))
-			goto err;
-		/* tmp_1 = 4*a^3 */
 
-		if (!BN_mod_sqr(tmp_2, b, p, ctx))
-			goto err;
-		if (!BN_mul_word(tmp_2, 27))
-			goto err;
-		/* tmp_2 = 27*b^2 */
+	if (BN_is_zero(a) && BN_is_zero(b))
+		goto err;
+	if (BN_is_zero(a) || BN_is_zero(b))
+		goto done;
 
-		if (!BN_mod_add(a, tmp_1, tmp_2, p, ctx))
-			goto err;
-		if (BN_is_zero(a))
-			goto err;
-	}
+	/* Compute the discriminant: first 4a^3, then 27b^2, then their sum. */
+	if (!BN_mod_sqr(discriminant, a, p, ctx))
+		goto err;
+	if (!BN_mod_mul(discriminant, discriminant, a, p, ctx))
+		goto err;
+	if (!BN_lshift(discriminant, discriminant, 2))
+		goto err;
+
+	if (!BN_mod_sqr(b, b, p, ctx))
+		goto err;
+	if (!BN_mul_word(b, 27))
+		goto err;
+
+	if (!BN_mod_add(discriminant, discriminant, b, p, ctx))
+		goto err;
+
+	if (BN_is_zero(discriminant))
+		goto err;
+
+ done:
 	ret = 1;
 
  err:
@@ -318,39 +325,25 @@ ec_GFp_simple_set_Jprojective_coordinates(const EC_GROUP *group,
 {
 	int ret = 0;
 
+	/*
+	 * Setting individual coordinates allows the creation of bad points.
+	 * EC_POINT_set_Jprojective_coordinates() checks at the API boundary.
+	 */
+
 	if (x != NULL) {
-		if (!BN_nnmod(&point->X, x, &group->field, ctx))
+		if (!ec_encode_scalar(group, &point->X, x, ctx))
 			goto err;
-		if (group->meth->field_encode != NULL) {
-			if (!group->meth->field_encode(group, &point->X, &point->X, ctx))
-				goto err;
-		}
 	}
 	if (y != NULL) {
-		if (!BN_nnmod(&point->Y, y, &group->field, ctx))
+		if (!ec_encode_scalar(group, &point->Y, y, ctx))
 			goto err;
-		if (group->meth->field_encode != NULL) {
-			if (!group->meth->field_encode(group, &point->Y, &point->Y, ctx))
-				goto err;
-		}
 	}
 	if (z != NULL) {
-		int Z_is_one;
-
-		if (!BN_nnmod(&point->Z, z, &group->field, ctx))
+		if (!ec_encode_z_coordinate(group, &point->Z, &point->Z_is_one,
+		    z, ctx))
 			goto err;
-		Z_is_one = BN_is_one(&point->Z);
-		if (group->meth->field_encode != NULL) {
-			if (Z_is_one && (group->meth->field_set_to_one != 0)) {
-				if (!group->meth->field_set_to_one(group, &point->Z, ctx))
-					goto err;
-			} else {
-				if (!group->meth->field_encode(group, &point->Z, &point->Z, ctx))
-					goto err;
-			}
-		}
-		point->Z_is_one = Z_is_one;
 	}
+
 	ret = 1;
 
  err:
@@ -363,33 +356,12 @@ ec_GFp_simple_get_Jprojective_coordinates(const EC_GROUP *group,
 {
 	int ret = 0;
 
-	if (group->meth->field_decode != NULL) {
-		if (x != NULL) {
-			if (!group->meth->field_decode(group, x, &point->X, ctx))
-				goto err;
-		}
-		if (y != NULL) {
-			if (!group->meth->field_decode(group, y, &point->Y, ctx))
-				goto err;
-		}
-		if (z != NULL) {
-			if (!group->meth->field_decode(group, z, &point->Z, ctx))
-				goto err;
-		}
-	} else {
-		if (x != NULL) {
-			if (!bn_copy(x, &point->X))
-				goto err;
-		}
-		if (y != NULL) {
-			if (!bn_copy(y, &point->Y))
-				goto err;
-		}
-		if (z != NULL) {
-			if (!bn_copy(z, &point->Z))
-				goto err;
-		}
-	}
+	if (!ec_decode_scalar(group, x, &point->X, ctx))
+		goto err;
+	if (!ec_decode_scalar(group, y, &point->Y, ctx))
+		goto err;
+	if (!ec_decode_scalar(group, z, &point->Z, ctx))
+		goto err;
 
 	ret = 1;
 
@@ -411,11 +383,10 @@ ec_GFp_simple_point_set_affine_coordinates(const EC_GROUP *group, EC_POINT *poin
 }
 
 int
-ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
-    BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
+ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group,
+    const EC_POINT *point, BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
 {
-	BIGNUM *Z, *Z_1, *Z_2, *Z_3;
-	const BIGNUM *Z_;
+	BIGNUM *z, *Z, *Z_1, *Z_2, *Z_3;
 	int ret = 0;
 
 	if (EC_POINT_is_at_infinity(group, point) > 0) {
@@ -425,6 +396,8 @@ ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT
 
 	BN_CTX_start(ctx);
 
+	if ((z = BN_CTX_get(ctx)) == NULL)
+		goto err;
 	if ((Z = BN_CTX_get(ctx)) == NULL)
 		goto err;
 	if ((Z_1 = BN_CTX_get(ctx)) == NULL)
@@ -434,77 +407,59 @@ ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT
 	if ((Z_3 = BN_CTX_get(ctx)) == NULL)
 		goto err;
 
-	/* transform  (X, Y, Z)  into  (x, y) := (X/Z^2, Y/Z^3) */
+	/* Convert from projective coordinates (X, Y, Z) into (X/Z^2, Y/Z^3). */
 
-	if (group->meth->field_decode) {
-		if (!group->meth->field_decode(group, Z, &point->Z, ctx))
+	if (!ec_decode_scalar(group, z, &point->Z, ctx))
+		goto err;
+
+	if (BN_is_one(z)) {
+		if (!ec_decode_scalar(group, x, &point->X, ctx))
 			goto err;
-		Z_ = Z;
-	} else {
-		Z_ = &point->Z;
+		if (!ec_decode_scalar(group, y, &point->Y, ctx))
+			goto err;
+		goto done;
 	}
 
-	if (BN_is_one(Z_)) {
-		if (group->meth->field_decode) {
-			if (x != NULL) {
-				if (!group->meth->field_decode(group, x, &point->X, ctx))
-					goto err;
-			}
-			if (y != NULL) {
-				if (!group->meth->field_decode(group, y, &point->Y, ctx))
-					goto err;
-			}
-		} else {
-			if (x != NULL) {
-				if (!bn_copy(x, &point->X))
-					goto err;
-			}
-			if (y != NULL) {
-				if (!bn_copy(y, &point->Y))
-					goto err;
-			}
-		}
-	} else {
-		if (BN_mod_inverse_ct(Z_1, Z_, &group->field, ctx) == NULL) {
-			ECerror(ERR_R_BN_LIB);
+	if (BN_mod_inverse_ct(Z_1, z, &group->field, ctx) == NULL) {
+		ECerror(ERR_R_BN_LIB);
+		goto err;
+	}
+	if (group->meth->field_encode == NULL) {
+		/* field_sqr works on standard representation */
+		if (!group->meth->field_sqr(group, Z_2, Z_1, ctx))
+			goto err;
+	} else {
+		if (!BN_mod_sqr(Z_2, Z_1, &group->field, ctx))
 			goto err;
-		}
-		if (group->meth->field_encode == 0) {
-			/* field_sqr works on standard representation */
-			if (!group->meth->field_sqr(group, Z_2, Z_1, ctx))
-				goto err;
-		} else {
-			if (!BN_mod_sqr(Z_2, Z_1, &group->field, ctx))
-				goto err;
-		}
-
-		if (x != NULL) {
-			/*
-			 * in the Montgomery case, field_mul will cancel out
-			 * Montgomery factor in X:
-			 */
-			if (!group->meth->field_mul(group, x, &point->X, Z_2, ctx))
-				goto err;
-		}
-		if (y != NULL) {
-			if (group->meth->field_encode == 0) {
-				/* field_mul works on standard representation */
-				if (!group->meth->field_mul(group, Z_3, Z_2, Z_1, ctx))
-					goto err;
-			} else {
-				if (!BN_mod_mul(Z_3, Z_2, Z_1, &group->field, ctx))
-					goto err;
-			}
-
-			/*
-			 * in the Montgomery case, field_mul will cancel out
-			 * Montgomery factor in Y:
-			 */
-			if (!group->meth->field_mul(group, y, &point->Y, Z_3, ctx))
-				goto err;
-		}
 	}
 
+	if (x != NULL) {
+		/*
+		 * in the Montgomery case, field_mul will cancel out
+		 * Montgomery factor in X:
+		 */
+		if (!group->meth->field_mul(group, x, &point->X, Z_2, ctx))
+			goto err;
+	}
+	if (y != NULL) {
+		if (group->meth->field_encode == NULL) {
+			/* field_mul works on standard representation */
+			if (!group->meth->field_mul(group, Z_3, Z_2, Z_1, ctx))
+				goto err;
+		} else {
+			if (!BN_mod_mul(Z_3, Z_2, Z_1, &group->field, ctx))
+				goto err;
+		}
+
+		/*
+		 * in the Montgomery case, field_mul will cancel out
+		 * Montgomery factor in Y:
+		 */
+		if (!group->meth->field_mul(group, y, &point->Y, Z_3, ctx))
+			goto err;
+	}
+
+ done:
 	ret = 1;
 
  err:
@@ -704,11 +659,9 @@ ec_GFp_simple_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, BN_CTX
 	BIGNUM *n0, *n1, *n2, *n3;
 	int ret = 0;
 
-	if (EC_POINT_is_at_infinity(group, a) > 0) {
-		BN_zero(&r->Z);
-		r->Z_is_one = 0;
-		return 1;
-	}
+	if (EC_POINT_is_at_infinity(group, a) > 0)
+		return EC_POINT_set_to_infinity(group, r);
+
 	field_mul = group->meth->field_mul;
 	field_sqr = group->meth->field_sqr;
 	p = &group->field;
@@ -1162,7 +1115,7 @@ ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT *po
 			goto err;
 		}
 	}
-	if (group->meth->field_encode != 0) {
+	if (group->meth->field_encode != NULL) {
 		/*
 		 * in the Montgomery case, we just turned  R*H  (representing
 		 * H) into  1/(R*H),  but we need  R*(1/H)  (representing
@@ -1212,7 +1165,7 @@ ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT *po
 			if (!group->meth->field_mul(group, &p->Y, &p->Y, tmp1, ctx))
 				goto err;
 
-			if (group->meth->field_set_to_one != 0) {
+			if (group->meth->field_set_to_one != NULL) {
 				if (!group->meth->field_set_to_one(group, &p->Z, ctx))
 					goto err;
 			} else {
@@ -1273,7 +1226,7 @@ ec_GFp_simple_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx)
 	if ((tmp = BN_CTX_get(ctx)) == NULL)
 		goto err;
 
-	/* Generate lambda in [1, group->field - 1] */
+	/* Generate lambda in [1, group->field). */
 	if (!bn_rand_interval(lambda, BN_value_one(), &group->field))
 		goto err;
 
diff --git a/lib/libcrypto/ec/ecx_methods.c b/lib/libcrypto/ec/ecx_methods.c
index 1040ee6fc..4bb8b786a 100644
--- a/lib/libcrypto/ec/ecx_methods.c
+++ b/lib/libcrypto/ec/ecx_methods.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ecx_methods.c,v 1.7 2023/07/05 20:56:29 bcook Exp $ */
+/*	$OpenBSD: ecx_methods.c,v 1.9 2023/07/22 19:33:25 tb Exp $ */
 /*
  * Copyright (c) 2022 Joel Sing <jsing@openbsd.org>
  *
@@ -292,6 +292,42 @@ ecx_pub_cmp(const EVP_PKEY *pkey1, const EVP_PKEY *pkey2)
 	    pkey1->pkey.ecx->pub_key_len) == 0;
 }
 
+/* Reimplementation of ASN1_buf_print() that adds a secondary indent of 4. */
+static int
+ecx_buf_print(BIO *bio, const uint8_t *buf, size_t buf_len, int indent)
+{
+	uint8_t u8;
+	size_t octets = 0;
+	const char *sep = ":", *nl = "";
+	CBS cbs;
+
+	if (indent > 60)
+		indent = 60;
+	indent += 4;
+	if (indent < 0)
+		indent = 0;
+
+	CBS_init(&cbs, buf, buf_len);
+	while (CBS_len(&cbs) > 0) {
+		if (!CBS_get_u8(&cbs, &u8))
+			return 0;
+		if (octets++ % 15 == 0) {
+			if (BIO_printf(bio, "%s%*s", nl, indent, "") < 0)
+				return 0;
+			nl = "\n";
+		}
+		if (CBS_len(&cbs) == 0)
+			sep = "";
+		if (BIO_printf(bio, "%02x%s", u8, sep) <= 0)
+			return 0;
+	}
+
+	if (BIO_printf(bio, "\n") <= 0)
+		return 0;
+
+	return 1;
+}
+
 static int
 ecx_pub_print(BIO *bio, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
 {
@@ -309,8 +345,7 @@ ecx_pub_print(BIO *bio, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
 		return 0;
 	if (BIO_printf(bio, "%*spub:\n", indent, "") <= 0)
 		return 0;
-	if (ASN1_buf_print(bio, ecx_key->pub_key, ecx_key->pub_key_len,
-	    indent + 4) == 0)
+	if (!ecx_buf_print(bio, ecx_key->pub_key, ecx_key->pub_key_len, indent))
 		return 0;
 
 	return 1;
@@ -422,13 +457,11 @@ ecx_priv_print(BIO *bio, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
 		return 0;
 	if (BIO_printf(bio, "%*spriv:\n", indent, "") <= 0)
 		return 0;
-	if (ASN1_buf_print(bio, ecx_key->priv_key, ecx_key->priv_key_len,
-	    indent + 4) == 0)
+	if (!ecx_buf_print(bio, ecx_key->priv_key, ecx_key->priv_key_len, indent))
 		return 0;
 	if (BIO_printf(bio, "%*spub:\n", indent, "") <= 0)
 		return 0;
-	if (ASN1_buf_print(bio, ecx_key->pub_key, ecx_key->pub_key_len,
-	    indent + 4) == 0)
+	if (!ecx_buf_print(bio, ecx_key->pub_key, ecx_key->pub_key_len, indent))
 		return 0;
 
 	return 1;
diff --git a/lib/libcrypto/ecdh/ecdh.c b/lib/libcrypto/ecdh/ecdh.c
index ecb849c13..6ab4ff838 100644
--- a/lib/libcrypto/ecdh/ecdh.c
+++ b/lib/libcrypto/ecdh/ecdh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecdh.c,v 1.5 2023/07/12 08:54:18 tb Exp $ */
+/* $OpenBSD: ecdh.c,v 1.6 2023/07/24 17:08:53 tb Exp $ */
 /* ====================================================================
  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
  *
@@ -176,7 +176,7 @@ ecdh_compute_key(void *out, size_t outlen, const EC_POINT *pub_key, EC_KEY *ecdh
 	if ((group = EC_KEY_get0_group(ecdh)) == NULL)
 		goto err;
 
-	if (!EC_POINT_is_on_curve(group, pub_key, ctx))
+	if (EC_POINT_is_on_curve(group, pub_key, ctx) <= 0)
 		goto err;
 
 	if ((point = EC_POINT_new(group)) == NULL) {
diff --git a/lib/libcrypto/evp/c_all.c b/lib/libcrypto/evp/c_all.c
index 10e35dd7a..871abe6e9 100644
--- a/lib/libcrypto/evp/c_all.c
+++ b/lib/libcrypto/evp/c_all.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: c_all.c,v 1.31 2023/07/07 19:37:53 beck Exp $ */
+/* $OpenBSD: c_all.c,v 1.32 2023/07/24 10:24:58 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -317,7 +317,6 @@ OpenSSL_add_all_digests(void)
 void
 OPENSSL_add_all_algorithms_noconf(void)
 {
-	OPENSSL_cpuid_setup();
 	OpenSSL_add_all_ciphers();
 	OpenSSL_add_all_digests();
 }
diff --git a/lib/libcrypto/evp/names.c b/lib/libcrypto/evp/names.c
index f7864f595..4931c92e2 100644
--- a/lib/libcrypto/evp/names.c
+++ b/lib/libcrypto/evp/names.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: names.c,v 1.19 2023/07/07 19:37:54 beck Exp $ */
+/* $OpenBSD: names.c,v 1.20 2023/07/22 18:12:55 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -152,7 +152,6 @@ EVP_cleanup(void)
 		obj_cleanup_defer = 0;
 		OBJ_cleanup();
 	}
-	OBJ_sigid_free();
 }
 
 struct doall_cipher {
diff --git a/lib/libcrypto/gost/gostr341001_key.c b/lib/libcrypto/gost/gostr341001_key.c
index efc9e5745..0170ab44b 100644
--- a/lib/libcrypto/gost/gostr341001_key.c
+++ b/lib/libcrypto/gost/gostr341001_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gostr341001_key.c,v 1.13 2023/07/08 14:30:44 beck Exp $ */
+/* $OpenBSD: gostr341001_key.c,v 1.14 2023/07/24 17:08:53 tb Exp $ */
 /*
  * Copyright (c) 2014 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
  * Copyright (c) 2005-2006 Cryptocom LTD
@@ -132,7 +132,7 @@ GOST_KEY_check_key(const GOST_KEY *key)
 		goto err;
 
 	/* testing whether the pub_key is on the elliptic curve */
-	if (EC_POINT_is_on_curve(key->group, key->pub_key, ctx) == 0) {
+	if (EC_POINT_is_on_curve(key->group, key->pub_key, ctx) <= 0) {
 		GOSTerror(EC_R_POINT_IS_NOT_ON_CURVE);
 		goto err;
 	}
diff --git a/lib/libcrypto/man/BIO_ctrl.3 b/lib/libcrypto/man/BIO_ctrl.3
index b77c69b5b..d4515ea9a 100644
--- a/lib/libcrypto/man/BIO_ctrl.3
+++ b/lib/libcrypto/man/BIO_ctrl.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: BIO_ctrl.3,v 1.23 2023/05/01 07:28:11 tb Exp $
+.\" $OpenBSD: BIO_ctrl.3,v 1.24 2023/07/26 20:01:04 tb Exp $
 .\" full merge up to: OpenSSL 24a535eaf Tue Sep 22 13:14:20 2020 +0100
 .\" selective merge up to: OpenSSL 0c5bc96f Tue Mar 15 13:57:22 2022 +0000
 .\"
@@ -66,7 +66,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: May 1 2023 $
+.Dd $Mdocdate: July 26 2023 $
 .Dt BIO_CTRL 3
 .Os
 .Sh NAME
@@ -430,12 +430,10 @@ They are documented in the following manual pages:
 .Bl -column BIO_CTRL_DGRAM_SET_RECV_TIMEOUT BIO_dgram_recv_timedout(3)\
  -offset 3n
 .It Fa cmd No constant                 Ta manual page
-.It Dv BIO_C_GET_EX_ARG                Ta Xr BIO_f_asn1 3
-.It Dv BIO_C_GET_PREFIX                Ta Xr BIO_asn1_get_prefix 3
-.It Dv BIO_C_GET_SUFFIX                Ta Xr BIO_asn1_get_suffix 3
-.It Dv BIO_C_SET_EX_ARG                Ta Xr BIO_f_asn1 3
-.It Dv BIO_C_SET_PREFIX                Ta Xr BIO_asn1_set_prefix 3
-.It Dv BIO_C_SET_SUFFIX                Ta Xr BIO_asn1_set_suffix 3
+.\" The following constants are intentionally undocumented because
+.\" BIO_f_asn1 has been removed from the public API.
+.\" .It Dv BIO_C_GET_EX_ARG                Ta Xr BIO_f_asn1 3
+.\" .It Dv BIO_C_SET_EX_ARG                Ta Xr BIO_f_asn1 3
 .It Dv BIO_CTRL_DGRAM_GET_FALLBACK_MTU Ta Xr BIO_dgram_set_peer 3
 .It Dv BIO_CTRL_DGRAM_GET_MTU          Ta Xr BIO_dgram_set_peer 3
 .It Dv BIO_CTRL_DGRAM_GET_RECV_TIMEOUT Ta Xr BIO_dgram_recv_timedout 3
diff --git a/lib/libcrypto/man/BIO_f_asn1.3 b/lib/libcrypto/man/BIO_f_asn1.3
deleted file mode 100644
index 19aa1f1ba..000000000
--- a/lib/libcrypto/man/BIO_f_asn1.3
+++ /dev/null
@@ -1,228 +0,0 @@
-.\" $OpenBSD: BIO_f_asn1.3,v 1.3 2023/05/01 07:28:11 tb Exp $
-.\"
-.\" Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org>
-.\"
-.\" Permission to use, copy, modify, and distribute this software for any
-.\" purpose with or without fee is hereby granted, provided that the above
-.\" copyright notice and this permission notice appear in all copies.
-.\"
-.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-.\"
-.Dd $Mdocdate: May 1 2023 $
-.Dt BIO_F_ASN1 3
-.Os
-.Sh NAME
-.Nm BIO_f_asn1 ,
-.Nm asn1_ps_func ,
-.Nm BIO_asn1_set_prefix ,
-.Nm BIO_asn1_get_prefix ,
-.Nm BIO_asn1_set_suffix ,
-.Nm BIO_asn1_get_suffix
-.Nd BER-encoding filter BIO
-.Sh SYNOPSIS
-.In openssl/asn1.h
-.Ft const BIO_METHOD *
-.Fn BIO_f_asn1 void
-.In openssl/bio.h
-.Ft typedef int
-.Fo asn1_ps_func
-.Fa "BIO *bio"
-.Fa "unsigned char **pbuf"
-.Fa "int *plen"
-.Fa "void *parg"
-.Fc
-.Ft int
-.Fo BIO_asn1_set_prefix
-.Fa "BIO *chain"
-.Fa "asn1_ps_func *prefix"
-.Fa "asn1_ps_func *prefix_free"
-.Fc
-.Ft int
-.Fo BIO_asn1_get_prefix
-.Fa "BIO *chain"
-.Fa "asn1_ps_func **pprefix"
-.Fa "asn1_ps_func **pprefix_free"
-.Fc
-.Ft int
-.Fo BIO_asn1_set_suffix
-.Fa "BIO *chain"
-.Fa "asn1_ps_func *suffix"
-.Fa "asn1_ps_func *suffix_free"
-.Fc
-.Ft int
-.Fo BIO_asn1_get_suffix
-.Fa "BIO *chain"
-.Fa "asn1_ps_func **psuffix"
-.Fa "asn1_ps_func **psuffix_free"
-.Fc
-.Sh DESCRIPTION
-.Fn BIO_f_asn1
-returns the
-.Qq asn1
-BIO method.
-BIOs created from it with
-.Xr BIO_new 3
-are filter BIOs intended to BER-encode data written to them
-and pass the encoded data on to the next BIO in the chain.
-Such BIOs operate as follows:
-.Bl -hang -width 1n
-.It Xr BIO_method_type 3
-returns
-.Dv BIO_TYPE_ASN1 .
-.It Xr BIO_method_name 3
-returns a pointer to the static string
-.Qq asn1 .
-.It Xr BIO_write 3
-writes the DER encoding of an ASN.1 OCTET STRING with the
-.Fa len
-content octets in
-.Fa buf
-to the next BIO in the chain.
-.Pp
-If a
-.Fa prefix
-function was installed with
-.Fn BIO_asn1_set_prefix ,
-that function is called before writing the object.
-It may for example produce additional output.
-If it fails, writing fails.
-.Pp
-If a
-.Fa prefix_free
-function was installed as well, that function is called
-after writing any output produced by
-.Fa prefix
-but before writing the object.
-Failure of
-.Fa prefix_free
-is silently ignored.
-.It Xr BIO_puts 3
-operates like
-.Xr BIO_write 3
-but uses the
-.Xr strlen 3
-of
-.Fa buf
-instead of a
-.Fa len
-argument.
-.It Xr BIO_flush 3
-calls the
-.Fa suffix
-callback function, if any.
-If that produces any output, it calls the
-.Fa suffix_free
-callback function, if any, silently ignoring failure.
-Finally, it calls
-.Xr BIO_flush 3
-on the next BIO in the chain.
-It fails if no data was previously written or if the
-.Fa suffix
-callback, writing, or
-.Xr BIO_flush 3
-on the next BIO fail.
-.It Xr BIO_ctrl 3
-with a
-.Fa cmd
-of
-.Dv BIO_C_SET_EX_ARG
-stores the pointer
-.Fa parg
-internally such that it will be passed to the
-.Fn asn1_ps_func
-callback functions.
-With a
-.Fa cmd
-of
-.Dv BIO_C_GET_EX_ARG ,
-it retrieves that pointer, storing it in
-.Pf * Fa parg .
-The commands
-.Dv BIO_C_SET_PREFIX ,
-.Dv BIO_C_GET_PREFIX ,
-.Dv BIO_C_SET_SUFFIX ,
-.Dv BIO_C_GET_SUFFIX ,
-and
-.Dv BIO_CTRL_FLUSH
-are used internally to implement
-.Fn BIO_asn1_set_prefix ,
-.Fn BIO_asn1_get_prefix ,
-.Fn BIO_asn1_set_suffix ,
-.Fn BIO_asn1_get_suffix
-and
-.Xr BIO_flush 3
-and are not intended for use by application programs.
-Other commands are merely forwarded to the next BIO in the chain.
-.It Xo
-.Xr BIO_read 3 ,
-.Xr BIO_gets 3 ,
-and
-.Xr BIO_callback_ctrl 3
-.Xc
-merely call the same function on the next BIO in the chain.
-.El
-.Pp
-If the above description of a function mentions the next BIO in the
-chain, that function fails if the asn1 BIO is the last BIO in the chain.
-.Pp
-.Fn BIO_asn1_set_prefix
-and
-.Fn BIO_asn1_get_prefix
-install and retrieve the
-.Fa prefix
-and
-.Fa prefix_free
-callback functions in and from the first asn1 BIO in the given
-.Fa chain .
-Similarly,
-.Fn BIO_asn1_set_suffix
-and
-.Fn BIO_asn1_get_suffix
-install and retrieve the
-.Fa suffix
-and
-.Fa suffix_free
-callback functions.
-Passing a
-.Dv NULL
-pointer for any of the
-.Fn asn1_ps_func
-arguments disables that particular callback.
-.Sh RETURN VALUES
-.Fn BIO_f_asn1
-always returns a pointer to a static built-in object.
-.Pp
-Functions of the type
-.Fn asn1_ps_func
-are supposed to return 1 on success or 0 on failure.
-.Pp
-.Fn BIO_asn1_set_prefix ,
-.Fn BIO_asn1_get_prefix ,
-.Fn BIO_asn1_set_suffix ,
-and
-.Fn BIO_asn1_get_suffix
-return 1 on success or 0 if
-.Fa chain
-is a
-.Dv NULL
-pointer or does not contain any asn1 BIO.
-They may return \-2 if a BIO is encountered in the
-.Fa chain
-that is not properly initialized.
-.Sh SEE ALSO
-.Xr ASN1_put_object 3 ,
-.Xr BIO_ctrl 3 ,
-.Xr BIO_new 3 ,
-.Xr BIO_next 3 ,
-.Xr BIO_write 3 ,
-.Xr i2d_ASN1_OCTET_STRING 3
-.Sh HISTORY
-These functions first appeared in OpenSSL 1.0.0
-and have been available since
-.Ox 4.9 .
diff --git a/lib/libcrypto/man/BIO_find_type.3 b/lib/libcrypto/man/BIO_find_type.3
index 8169ad10f..4a9eee783 100644
--- a/lib/libcrypto/man/BIO_find_type.3
+++ b/lib/libcrypto/man/BIO_find_type.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: BIO_find_type.3,v 1.11 2023/04/11 15:35:31 schwarze Exp $
+.\" $OpenBSD: BIO_find_type.3,v 1.12 2023/07/26 20:01:04 tb Exp $
 .\" full merge up to: OpenSSL 1cb7eff4 Sep 10 13:56:40 2019 +0100
 .\"
 .\" This file is a derived work.
@@ -65,7 +65,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: April 11 2023 $
+.Dd $Mdocdate: July 26 2023 $
 .Dt BIO_FIND_TYPE 3
 .Os
 .Sh NAME
@@ -180,7 +180,9 @@ and
 set in their type constant.
 .Bl -column BIO_TYPE_NULL_FILTER "datagram socket" BIO_s_datagram(3)
 .It Fa type No constant   Ta Em name No string Ta Vt BIO_METHOD
-.It Dv BIO_TYPE_ASN1        Ta asn1            Ta Xr BIO_f_asn1 3
+.\" BIO_TYPE_ASN1 is intentionally undocumented because BIO_f_asn1 was
+.\" removed from the public API.
+.\" .It Dv BIO_TYPE_ASN1        Ta asn1            Ta Xr BIO_f_asn1 3
 .It Dv BIO_TYPE_BASE64      Ta base64 encoding Ta Xr BIO_f_base64 3
 .It Dv BIO_TYPE_BUFFER      Ta buffer          Ta Xr BIO_f_buffer 3
 .It Dv BIO_TYPE_CIPHER      Ta cipher          Ta Xr BIO_f_cipher 3
diff --git a/lib/libcrypto/man/BIO_new.3 b/lib/libcrypto/man/BIO_new.3
index bce804131..f97a31482 100644
--- a/lib/libcrypto/man/BIO_new.3
+++ b/lib/libcrypto/man/BIO_new.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: BIO_new.3,v 1.27 2023/07/21 04:50:47 tb Exp $
+.\" $OpenBSD: BIO_new.3,v 1.28 2023/07/26 20:01:04 tb Exp $
 .\" full merge up to:
 .\" OpenSSL man3/BIO_new.pod fb46be03 Feb 26 11:51:31 2016 +0000
 .\" OpenSSL man7/bio.pod 631c37be Dec 12 16:56:50 2017 +0100
@@ -52,7 +52,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 21 2023 $
+.Dd $Mdocdate: July 26 2023 $
 .Dt BIO_NEW 3
 .Os
 .Sh NAME
@@ -232,7 +232,6 @@ Create a memory BIO:
 .Xr BIO_ctrl 3 ,
 .Xr BIO_dump 3 ,
 .Xr BIO_dup_chain 3 ,
-.Xr BIO_f_asn1 3 ,
 .Xr BIO_f_base64 3 ,
 .Xr BIO_f_buffer 3 ,
 .Xr BIO_f_cipher 3 ,
diff --git a/lib/libcrypto/man/BN_BLINDING_new.3 b/lib/libcrypto/man/BN_BLINDING_new.3
deleted file mode 100644
index 36521d977..000000000
--- a/lib/libcrypto/man/BN_BLINDING_new.3
+++ /dev/null
@@ -1,317 +0,0 @@
-.\"	$OpenBSD: BN_BLINDING_new.3,v 1.12 2023/04/25 20:07:55 tb Exp $
-.\"	OpenSSL a528d4f0 Oct 27 13:40:11 2015 -0400
-.\"
-.\" This file was written by Nils Larsch <nils@openssl.org>.
-.\" Copyright (c) 2005, 2008, 2013, 2015 The OpenSSL Project.
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\"
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\"
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in
-.\"    the documentation and/or other materials provided with the
-.\"    distribution.
-.\"
-.\" 3. All advertising materials mentioning features or use of this
-.\"    software must display the following acknowledgment:
-.\"    "This product includes software developed by the OpenSSL Project
-.\"    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
-.\"
-.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
-.\"    endorse or promote products derived from this software without
-.\"    prior written permission. For written permission, please contact
-.\"    openssl-core@openssl.org.
-.\"
-.\" 5. Products derived from this software may not be called "OpenSSL"
-.\"    nor may "OpenSSL" appear in their names without prior written
-.\"    permission of the OpenSSL Project.
-.\"
-.\" 6. Redistributions of any form whatsoever must retain the following
-.\"    acknowledgment:
-.\"    "This product includes software developed by the OpenSSL Project
-.\"    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
-.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
-.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
-.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-.\" OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd $Mdocdate: April 25 2023 $
-.Dt BN_BLINDING_NEW 3
-.Os
-.Sh NAME
-.Nm BN_BLINDING_new ,
-.Nm BN_BLINDING_free ,
-.Nm BN_BLINDING_update ,
-.Nm BN_BLINDING_convert ,
-.Nm BN_BLINDING_invert ,
-.Nm BN_BLINDING_convert_ex ,
-.Nm BN_BLINDING_invert_ex ,
-.Nm BN_BLINDING_thread_id ,
-.Nm BN_BLINDING_get_flags ,
-.Nm BN_BLINDING_set_flags ,
-.Nm BN_BLINDING_create_param
-.Nd blinding related BIGNUM functions
-.Sh SYNOPSIS
-.In openssl/bn.h
-.Ft BN_BLINDING *
-.Fo BN_BLINDING_new
-.Fa "const BIGNUM *A"
-.Fa "const BIGNUM *Ai"
-.Fa "BIGNUM *mod"
-.Fc
-.Ft void
-.Fo BN_BLINDING_free
-.Fa "BN_BLINDING *b"
-.Fc
-.Ft int
-.Fo BN_BLINDING_update
-.Fa "BN_BLINDING *b"
-.Fa "BN_CTX *ctx"
-.Fc
-.Ft int
-.Fo BN_BLINDING_convert
-.Fa "BIGNUM *n"
-.Fa "BN_BLINDING *b"
-.Fa "BN_CTX *ctx"
-.Fc
-.Ft int
-.Fo BN_BLINDING_invert
-.Fa "BIGNUM *n"
-.Fa "BN_BLINDING *b"
-.Fa "BN_CTX *ctx"
-.Fc
-.Ft int
-.Fo BN_BLINDING_convert_ex
-.Fa "BIGNUM *n"
-.Fa "BIGNUM *r"
-.Fa "BN_BLINDING *b"
-.Fa "BN_CTX *ctx"
-.Fc
-.Ft int
-.Fo BN_BLINDING_invert_ex
-.Fa "BIGNUM *n"
-.Fa "const BIGNUM *r"
-.Fa "BN_BLINDING *b"
-.Fa "BN_CTX *ctx"
-.Fc
-.Ft CRYPTO_THREADID *
-.Fo BN_BLINDING_thread_id
-.Fa "BN_BLINDING *"
-.Fc
-.Ft unsigned long
-.Fo BN_BLINDING_get_flags
-.Fa "const BN_BLINDING *"
-.Fc
-.Ft void
-.Fo BN_BLINDING_set_flags
-.Fa "BN_BLINDING *"
-.Fa "unsigned long"
-.Fc
-.Ft BN_BLINDING *
-.Fo BN_BLINDING_create_param
-.Fa "BN_BLINDING *b"
-.Fa "const BIGNUM *e"
-.Fa "BIGNUM *m"
-.Fa "BN_CTX *ctx"
-.Fa "int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,\
- const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)"
-.Fa "BN_MONT_CTX *m_ctx"
-.Fc
-.Sh DESCRIPTION
-.Fn BN_BLINDING_new
-allocates a new
-.Vt BN_BLINDING
-structure and copies the
-.Fa A
-and
-.Fa \&Ai
-values into the newly created
-.Vt BN_BLINDING
-object.
-.Pp
-.Fn BN_BLINDING_free
-frees the
-.Vt BN_BLINDING
-structure.
-If
-.Fa b
-is a
-.Dv NULL
-pointer, no action occurs.
-.Pp
-.Fn BN_BLINDING_update
-updates the
-.Vt BN_BLINDING
-parameters by squaring the
-.Fa A
-and
-.Fa \&Ai
-or, after a specific number of uses and if the necessary parameters are
-set, by re-creating the blinding parameters.
-.Pp
-.Fn BN_BLINDING_convert_ex
-multiplies
-.Fa n
-with the blinding factor
-.Fa A .
-If
-.Fa r
-is not
-.Dv NULL ,
-a copy of the inverse blinding factor
-.Fa \&Ai
-will be returned in
-.Fa r
-(this is useful if an
-.Vt RSA
-object is shared among several threads).
-.Fn BN_BLINDING_invert_ex
-multiplies
-.Fa n
-with the inverse blinding factor
-.Fa \&Ai .
-If
-.Fa r
-is not
-.Dv NULL ,
-it will be used as the inverse blinding.
-.Pp
-.Fn BN_BLINDING_convert
-and
-.Fn BN_BLINDING_invert
-are wrapper functions for
-.Fn BN_BLINDING_convert_ex
-and
-.Fn BN_BLINDING_invert_ex
-with
-.Fa r
-set to
-.Dv NULL .
-.Pp
-.Fn BN_BLINDING_thread_id
-provides access to the
-.Vt CRYPTO_THREADID
-object within the
-.Vt BN_BLINDING
-structure.
-This is to help users provide proper locking if needed for
-multi-threaded use.
-The thread ID object of a newly allocated
-.Vt BN_BLINDING
-structure is initialised to the thread ID in which
-.Fn BN_BLINDING_new
-was called.
-.Pp
-.Fn BN_BLINDING_get_flags
-returns the
-.Dv BN_BLINDING_*
-flags.
-Currently there are two supported flags:
-.Dv BN_BLINDING_NO_UPDATE
-and
-.Dv BN_BLINDING_NO_RECREATE .
-.Dv BN_BLINDING_NO_UPDATE
-inhibits the automatic update of the
-.Vt BN_BLINDING
-parameters after each use and
-.Dv BN_BLINDING_NO_RECREATE
-inhibits the automatic re-creation of the
-.Vt BN_BLINDING
-parameters after a fixed number of uses (currently 32).
-In newly allocated
-.Vt BN_BLINDING
-objects no flags are set.
-.Fn BN_BLINDING_set_flags
-sets the
-.Dv BN_BLINDING_*
-parameters flags.
-.Pp
-.Fn BN_BLINDING_create_param
-creates new
-.Vt BN_BLINDING
-parameters using the exponent
-.Fa e
-and the modulus
-.Fa m .
-.Fa bn_mod_exp
-and
-.Fa m_ctx
-can be used to pass special functions for exponentiation (normally
-.Xr BN_mod_exp 3
-and
-.Vt BN_MONT_CTX ) .
-.Sh RETURN VALUES
-.Fn BN_BLINDING_new
-returns the newly allocated
-.Vt BN_BLINDING
-structure or
-.Dv NULL
-in case of an error.
-.Pp
-.Fn BN_BLINDING_update ,
-.Fn BN_BLINDING_convert ,
-.Fn BN_BLINDING_invert ,
-.Fn BN_BLINDING_convert_ex
-and
-.Fn BN_BLINDING_invert_ex
-return 1 on success and 0 if an error occurred.
-.Pp
-.Fn BN_BLINDING_thread_id
-returns a pointer to the thread ID object within a
-.Vt BN_BLINDING
-object.
-.Pp
-.Fn BN_BLINDING_get_flags
-returns the currently set
-.Dv BN_BLINDING_*
-flags (an
-.Vt unsigned long
-value).
-.Pp
-.Fn BN_BLINDING_create_param
-returns the newly created
-.Vt BN_BLINDING
-parameters or
-.Dv NULL
-on error.
-.Sh SEE ALSO
-.Xr BN_new 3 ,
-.Xr RSA_blinding_on 3
-.Sh HISTORY
-.Fn BN_BLINDING_new ,
-.Fn BN_BLINDING_free ,
-.Fn BN_BLINDING_update ,
-.Fn BN_BLINDING_convert ,
-and
-.Fn BN_BLINDING_invert
-first appeared in SSLeay 0.9.0 and have been available since
-.Ox 2.4 .
-.Pp
-.Fn BN_BLINDING_convert_ex ,
-.Fn BN_BLINDIND_invert_ex ,
-.Fn BN_BLINDING_get_flags ,
-.Fn BN_BLINDING_set_flags ,
-and
-.Fn BN_BLINDING_create_param
-first appeared in OpenSSL 0.9.8 and have been available since
-.Ox 4.5 .
-.Pp
-.Fn BN_BLINDING_thread_id
-first appeared in OpenSSL 1.0.0 and has been available since
-.Ox 4.9 .
-.Sh AUTHORS
-.An Nils Larsch Aq Mt nils@openssl.org
diff --git a/lib/libcrypto/man/BN_new.3 b/lib/libcrypto/man/BN_new.3
index 22bb77c17..088048c62 100644
--- a/lib/libcrypto/man/BN_new.3
+++ b/lib/libcrypto/man/BN_new.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: BN_new.3,v 1.30 2023/07/21 05:04:48 tb Exp $
+.\" $OpenBSD: BN_new.3,v 1.31 2023/07/26 20:08:59 tb Exp $
 .\" full merge up to: OpenSSL man3/BN_new 2457c19d Mar 6 08:43:36 2004 +0000
 .\" selective merge up to: man3/BN_new 681acb31 Sep 29 13:10:34 2017 +0200
 .\" full merge up to: OpenSSL man7/bn 05ea606a May 20 20:52:46 2016 -0400
@@ -50,7 +50,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 21 2023 $
+.Dd $Mdocdate: July 26 2023 $
 .Dt BN_NEW 3
 .Os
 .Sh NAME
@@ -135,7 +135,6 @@ and sets an error code that can be obtained by
 .Sh SEE ALSO
 .Xr BN_add 3 ,
 .Xr BN_add_word 3 ,
-.Xr BN_BLINDING_new 3 ,
 .Xr BN_bn2bin 3 ,
 .Xr BN_cmp 3 ,
 .Xr BN_copy 3 ,
diff --git a/lib/libcrypto/man/BUF_MEM_new.3 b/lib/libcrypto/man/BUF_MEM_new.3
index 904e6f2a8..3b2f20d21 100644
--- a/lib/libcrypto/man/BUF_MEM_new.3
+++ b/lib/libcrypto/man/BUF_MEM_new.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: BUF_MEM_new.3,v 1.16 2019/06/06 01:06:58 schwarze Exp $
+.\"	$OpenBSD: BUF_MEM_new.3,v 1.18 2023/07/27 06:20:45 tb Exp $
 .\"	OpenSSL doc/crypto/buffer.pod 18edda0f Sep 20 03:28:54 2000 +0000
 .\"	not merged: 74924dcb, 58e3457a, 21b0fa91, 7644a9ae
 .\"	OpenSSL doc/crypto/BUF_MEM_new.pod 53934822 Jun 9 16:39:19 2016 -0400
@@ -52,16 +52,14 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 6 2019 $
+.Dd $Mdocdate: July 27 2023 $
 .Dt BUF_MEM_NEW 3
 .Os
 .Sh NAME
 .Nm BUF_MEM_new ,
 .Nm BUF_MEM_free ,
 .Nm BUF_MEM_grow ,
-.Nm BUF_MEM_grow_clean ,
-.Nm BUF_reverse ,
-.Nm BUF_strdup
+.Nm BUF_MEM_grow_clean
 .Nd simple character arrays structure
 .Sh SYNOPSIS
 .In openssl/buffer.h
@@ -83,16 +81,6 @@
 .Fa "BUF_MEM *str"
 .Fa "size_t len"
 .Fc
-.Ft void
-.Fo BUF_reverse
-.Fa "unsigned char *out"
-.Fa "const unsigned char *in"
-.Fa "size_t len"
-.Fc
-.Ft char *
-.Fo BUF_strdup
-.Fa "const char *str"
-.Fc
 .Sh DESCRIPTION
 The buffer library handles simple character arrays.
 Buffers are used for various purposes in the library, most notably
@@ -138,40 +126,6 @@ Any data already in the buffer is preserved if it increases in size.
 is similar to
 .Fn BUF_MEM_grow ,
 but it sets any freed or additionally allocated memory to zero.
-.Pp
-.Fn BUF_reverse
-reverses
-.Fa len
-bytes at
-.Fa in
-into
-.Fa out .
-If
-.Fa in
-is
-.Dv NULL ,
-.Fa out
-is reversed in place.
-.Pp
-.Fn BUF_strdup
-copies a NUL terminated string into a block of allocated memory and
-returns a pointer to the allocated block.
-Unlike the system
-.Xr strdup 3
-function,
-.Fn BUF_strdup
-will accept a
-.Dv NULL
-argument and will return
-.Dv NULL
-in that case.
-Its use in new programs is discouraged.
-.Pp
-The memory allocated from
-.Fn BUF_strdup
-should be freed up using the
-.Xr free 3
-function.
 .Sh RETURN VALUES
 .Fn BUF_MEM_new
 returns the buffer or
@@ -192,15 +146,9 @@ return zero on error or the new size (i.e.\&
 and
 .Fn BUF_MEM_grow
 first appeared in SSLeay 0.6.0.
-.Fn BUF_strdup
-first appeared in SSLeay 0.8.0.
 All these functions  have been available since
 .Ox 2.4 .
 .Pp
 .Fn BUF_MEM_grow_clean
 first appeared in OpenSSL 0.9.7 and has been available since
 .Ox 3.2 .
-.Pp
-.Fn BUF_reverse
-first appeared in OpenSSL 1.0.0 and has been available since
-.Ox 4.9 .
diff --git a/lib/libcrypto/man/CMS_get0_SignerInfos.3 b/lib/libcrypto/man/CMS_get0_SignerInfos.3
index faf20c49d..0be92d800 100644
--- a/lib/libcrypto/man/CMS_get0_SignerInfos.3
+++ b/lib/libcrypto/man/CMS_get0_SignerInfos.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: CMS_get0_SignerInfos.3,v 1.7 2019/11/02 15:39:46 schwarze Exp $
+.\" $OpenBSD: CMS_get0_SignerInfos.3,v 1.8 2023/07/26 19:30:43 tb Exp $
 .\" full merge up to: OpenSSL 83cf7abf May 29 13:07:08 2018 +0100
 .\"
 .\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
@@ -48,11 +48,12 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: November 2 2019 $
+.Dd $Mdocdate: July 26 2023 $
 .Dt CMS_GET0_SIGNERINFOS 3
 .Os
 .Sh NAME
 .Nm CMS_get0_SignerInfos ,
+.Nm CMS_SignerInfo_get_version ,
 .Nm CMS_SignerInfo_get0_signer_id ,
 .Nm CMS_SignerInfo_get0_signature ,
 .Nm CMS_SignerInfo_cert_cmp ,
@@ -65,6 +66,11 @@
 .Fa "CMS_ContentInfo *cms"
 .Fc
 .Ft int
+.Fo CMS_SignerInfo_get_version
+.Fa "CMS_SignerInfo *si"
+.Fa "long *version"
+.Fc
+.Ft int
 .Fo CMS_SignerInfo_get0_signer_id
 .Fa "CMS_SignerInfo *si"
 .Fa "ASN1_OCTET_STRING **keyid"
@@ -94,6 +100,14 @@ structures associated with the
 structure
 .Fa cms .
 .Pp
+.Fn CMS_SignerInfo_get_version
+sets
+.Pf * Fa version
+to the syntax version number of the
+.Vt SignerInfo
+structure
+.Fa si .
+.Pp
 .Fn CMS_SignerInfo_get0_signer_id
 retrieves the certificate
 .Vt SignerIdentifier
@@ -157,6 +171,9 @@ if there are no signers or if
 is not of the type
 .Vt SignedData .
 .Pp
+.Fn CMS_SignerInfo_get_version
+always succeeds and returns 1.
+.Pp
 .Fn CMS_SignerInfo_get0_signer_id
 returns 1 for success or 0 for failure.
 .Pp
@@ -190,3 +207,7 @@ first appeared in OpenSSL 0.9.8h and
 in OpenSSL 1.0.2.
 These functions have been available since
 .Ox 6.7 .
+.Pp
+.Fn CMS_SignerInfo_get_version
+first appeared in
+.Ox 7.4 .
diff --git a/lib/libcrypto/man/CMS_get0_type.3 b/lib/libcrypto/man/CMS_get0_type.3
index 45ed3167b..55adacd86 100644
--- a/lib/libcrypto/man/CMS_get0_type.3
+++ b/lib/libcrypto/man/CMS_get0_type.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: CMS_get0_type.3,v 1.7 2019/11/02 15:39:46 schwarze Exp $
+.\" $OpenBSD: CMS_get0_type.3,v 1.9 2023/07/27 05:31:28 tb Exp $
 .\" full merge up to: OpenSSL 72a7a702 Feb 26 14:05:09 2019 +0000
 .\"
 .\" This file is a derived work.
@@ -65,11 +65,12 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: November 2 2019 $
+.Dd $Mdocdate: July 27 2023 $
 .Dt CMS_GET0_TYPE 3
 .Os
 .Sh NAME
 .Nm CMS_get0_type ,
+.Nm CMS_get_version ,
 .Nm CMS_set1_eContentType ,
 .Nm CMS_get0_eContentType ,
 .Nm CMS_get0_content
@@ -81,6 +82,11 @@
 .Fa "const CMS_ContentInfo *cms"
 .Fc
 .Ft int
+.Fo CMS_get_version
+.Fa "const CMS_ContentInfo *cms"
+.Fa "long *version"
+.Fc
+.Ft int
 .Fo CMS_set1_eContentType
 .Fa "CMS_ContentInfo *cms"
 .Fa "const ASN1_OBJECT *oid"
@@ -149,6 +155,21 @@ copies the supplied
 .Fa oid ,
 so it should be freed up after use.
 .Pp
+.Fn CMS_get_version
+sets
+.Pf * Fa version
+to the syntax version number of the
+.Vt ContentInfo
+structure
+.Fa cms .
+The version is a number between 0 and 5 and is defined for all the
+above content types except for arbitrary data.
+For arbitrary data and unsupported content types
+.Fn CMS_get_version
+fails and the content of
+.Pf * Fa version
+is unspecified.
+.Pp
 .Fn CMS_get0_eContentType
 returns the type of the embedded content.
 .Pp
@@ -176,6 +197,9 @@ return internal pointers to
 .Vt OBJECT IDENTIFIER
 structures.
 .Pp
+.Fn CMS_get_version
+returns 1 on success and 0 on failure.
+.Pp
 .Fn CMS_get0_content
 returns an internal pointer to the storage location where the pointer
 to the embedded content is stored.
@@ -196,3 +220,7 @@ RFC 3274: Compressed Data Content Type for Cryptographic Message Syntax (CMS)
 These functions first appeared in OpenSSL 0.9.8h
 and have been available since
 .Ox 6.7 .
+.Pp
+.Fn CMS_get_version
+first appeared in
+.Ox 7.4 .
diff --git a/lib/libcrypto/man/ERR.3 b/lib/libcrypto/man/ERR.3
index e6b1031a1..8f17e7a32 100644
--- a/lib/libcrypto/man/ERR.3
+++ b/lib/libcrypto/man/ERR.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ERR.3,v 1.10 2022/09/06 10:22:31 kn Exp $
+.\"	$OpenBSD: ERR.3,v 1.11 2023/07/26 20:15:51 tb Exp $
 .\"	OpenSSL 186bb907 Apr 13 11:05:13 2015 -0700
 .\"
 .\" This file was written by Ulf Moeller <ulf@openssl.org> and
@@ -49,7 +49,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: September 6 2022 $
+.Dd $Mdocdate: July 26 2023 $
 .Dt ERR 3
 .Os
 .Sh NAME
@@ -136,10 +136,6 @@ When more error codes are added, the old ones are overwritten, on the
 assumption that the most recent errors are most important.
 .Pp
 Error strings are also stored in a hash table.
-The hash tables can be obtained by calling
-.Fn ERR_get_err_state_table
-and
-.Fn ERR_get_string_table .
 .Sh SEE ALSO
 .Xr crypto 3 ,
 .Xr ERR_asprintf_error_data 3 ,
diff --git a/lib/libcrypto/man/Makefile b/lib/libcrypto/man/Makefile
index 1039aa0bf..1697357f6 100644
--- a/lib/libcrypto/man/Makefile
+++ b/lib/libcrypto/man/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.255 2023/07/21 04:50:47 tb Exp $
+# $OpenBSD: Makefile,v 1.258 2023/07/26 20:08:59 tb Exp $
 
 .include <bsd.own.mk>
 
@@ -37,7 +37,6 @@ MAN=	\
 	BIO_ctrl.3 \
 	BIO_dump.3 \
 	BIO_dup_chain.3 \
-	BIO_f_asn1.3 \
 	BIO_f_base64.3 \
 	BIO_f_buffer.3 \
 	BIO_f_cipher.3 \
@@ -63,7 +62,6 @@ MAN=	\
 	BIO_s_socket.3 \
 	BIO_set_callback.3 \
 	BIO_should_retry.3 \
-	BN_BLINDING_new.3 \
 	BN_CTX_new.3 \
 	BN_CTX_start.3 \
 	BN_add.3 \
@@ -214,8 +212,8 @@ MAN=	\
 	MD5.3 \
 	NAME_CONSTRAINTS_new.3 \
 	OBJ_NAME_add.3 \
-	OBJ_add_sigid.3 \
 	OBJ_create.3 \
+	OBJ_find_sigid_algs.3 \
 	OBJ_nid2obj.3 \
 	OCSP_CRLID_new.3 \
 	OCSP_REQUEST_new.3 \
diff --git a/lib/libcrypto/man/OBJ_add_sigid.3 b/lib/libcrypto/man/OBJ_find_sigid_algs.3
similarity index 94%
rename from lib/libcrypto/man/OBJ_add_sigid.3
rename to lib/libcrypto/man/OBJ_find_sigid_algs.3
index 685fbfa07..9aeb54c90 100644
--- a/lib/libcrypto/man/OBJ_add_sigid.3
+++ b/lib/libcrypto/man/OBJ_find_sigid_algs.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: OBJ_add_sigid.3,v 1.2 2023/07/21 05:02:53 tb Exp $
+.\" $OpenBSD: OBJ_find_sigid_algs.3,v 1.1 2023/07/22 06:35:26 tb Exp $
 .\"
 .\" Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org>
 .\"
@@ -14,8 +14,8 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: July 21 2023 $
-.Dt OBJ_ADD_SIGID 3
+.Dd $Mdocdate: July 22 2023 $
+.Dt OBJ_FIND_SIGID_ALGS 3
 .Os
 .Sh NAME
 .Nm OBJ_find_sigid_algs ,
diff --git a/lib/libcrypto/man/RSA_blinding_on.3 b/lib/libcrypto/man/RSA_blinding_on.3
index 5d4b4ab25..bd2a30137 100644
--- a/lib/libcrypto/man/RSA_blinding_on.3
+++ b/lib/libcrypto/man/RSA_blinding_on.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: RSA_blinding_on.3,v 1.6 2019/06/06 01:06:59 schwarze Exp $
+.\"	$OpenBSD: RSA_blinding_on.3,v 1.7 2023/07/26 20:08:59 tb Exp $
 .\"	OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
 .\"
 .\" This file was written by Ulf Moeller <ulf@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 6 2019 $
+.Dd $Mdocdate: July 26 2023 $
 .Dt RSA_BLINDING_ON 3
 .Os
 .Sh NAME
@@ -88,7 +88,6 @@ turns blinding off and frees the memory used for the blinding factor.
 .Fn RSA_blinding_on
 returns 1 on success, and 0 if an error occurred.
 .Sh SEE ALSO
-.Xr BN_BLINDING_new 3 ,
 .Xr RSA_new 3
 .Sh HISTORY
 .Fn RSA_blinding_on
diff --git a/lib/libcrypto/objects/obj_xref.c b/lib/libcrypto/objects/obj_xref.c
index 2318c86ce..ae18d69af 100644
--- a/lib/libcrypto/objects/obj_xref.c
+++ b/lib/libcrypto/objects/obj_xref.c
@@ -1,241 +1,325 @@
-/* $OpenBSD: obj_xref.c,v 1.9 2023/07/08 12:27:51 beck Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2006.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+/*	$OpenBSD: obj_xref.c,v 1.12 2023/07/22 19:08:03 tb Exp $ */
+
+/*
+ * Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
  *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
 #include <openssl/objects.h>
-#include "obj_xref.h"
 
-DECLARE_STACK_OF(nid_triple)
-STACK_OF(nid_triple) *sig_app, *sigx_app;
+/*
+ * Map between signature nids and pairs of (hash, pkey) nids. If the hash nid
+ * is NID_undef, this indicates to ASN1_item_{sign,verify}() that the pkey's
+ * ASN.1 method needs to handle algorithm identifiers and part of the message
+ * digest.
+ */
 
-static int
-sig_cmp(const nid_triple *a, const nid_triple *b)
-{
-	return a->sign_id - b->sign_id;
-}
+static const struct {
+	int sign_nid;
+	int hash_nid;
+	int pkey_nid;
+} nid_triple[] = {
+	{
+		.sign_nid = NID_md2WithRSAEncryption,
+		.hash_nid = NID_md2,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_md5WithRSAEncryption,
+		.hash_nid = NID_md5,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_shaWithRSAEncryption,
+		.hash_nid = NID_sha,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_sha1WithRSAEncryption,
+		.hash_nid = NID_sha1,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_dsaWithSHA,
+		.hash_nid = NID_sha,
+		.pkey_nid = NID_dsa,
+	},
+	{
+		.sign_nid = NID_dsaWithSHA1_2,
+		.hash_nid = NID_sha1,
+		.pkey_nid = NID_dsa_2,
+	},
+	{
+		.sign_nid = NID_mdc2WithRSA,
+		.hash_nid = NID_mdc2,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_md5WithRSA,
+		.hash_nid = NID_md5,
+		.pkey_nid = NID_rsa,
+	},
+	{
+		.sign_nid = NID_dsaWithSHA1,
+		.hash_nid = NID_sha1,
+		.pkey_nid = NID_dsa,
+	},
+	{
+		.sign_nid = NID_sha1WithRSA,
+		.hash_nid = NID_sha1,
+		.pkey_nid = NID_rsa,
+	},
+	{
+		.sign_nid = NID_ripemd160WithRSA,
+		.hash_nid = NID_ripemd160,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_md4WithRSAEncryption,
+		.hash_nid = NID_md4,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_ecdsa_with_SHA1,
+		.hash_nid = NID_sha1,
+		.pkey_nid = NID_X9_62_id_ecPublicKey,
+	},
+	{
+		.sign_nid = NID_sha256WithRSAEncryption,
+		.hash_nid = NID_sha256,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_sha384WithRSAEncryption,
+		.hash_nid = NID_sha384,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_sha512WithRSAEncryption,
+		.hash_nid = NID_sha512,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_sha224WithRSAEncryption,
+		.hash_nid = NID_sha224,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_ecdsa_with_Recommended,
+		.hash_nid = NID_undef,
+		.pkey_nid = NID_X9_62_id_ecPublicKey,
+	},
+	{
+		.sign_nid = NID_ecdsa_with_Specified,
+		.hash_nid = NID_undef,
+		.pkey_nid = NID_X9_62_id_ecPublicKey,
+	},
+	{
+		.sign_nid = NID_ecdsa_with_SHA224,
+		.hash_nid = NID_sha224,
+		.pkey_nid = NID_X9_62_id_ecPublicKey,
+	},
+	{
+		.sign_nid = NID_ecdsa_with_SHA256,
+		.hash_nid = NID_sha256,
+		.pkey_nid = NID_X9_62_id_ecPublicKey,
+	},
+	{
+		.sign_nid = NID_ecdsa_with_SHA384,
+		.hash_nid = NID_sha384,
+		.pkey_nid = NID_X9_62_id_ecPublicKey,
+	},
+	{
+		.sign_nid = NID_ecdsa_with_SHA512,
+		.hash_nid = NID_sha512,
+		.pkey_nid = NID_X9_62_id_ecPublicKey,
+	},
+	{
+		.sign_nid = NID_dsa_with_SHA224,
+		.hash_nid = NID_sha224,
+		.pkey_nid = NID_dsa,
+	},
+	{
+		.sign_nid = NID_dsa_with_SHA256,
+		.hash_nid = NID_sha256,
+		.pkey_nid = NID_dsa,
+	},
+	{
+		.sign_nid = NID_id_GostR3411_94_with_GostR3410_2001,
+		.hash_nid = NID_id_GostR3411_94,
+		.pkey_nid = NID_id_GostR3410_2001,
+	},
+	{
+		.sign_nid = NID_id_GostR3411_94_with_GostR3410_94,
+		.hash_nid = NID_id_GostR3411_94,
+		.pkey_nid = NID_id_GostR3410_94,
+	},
+	{
+		.sign_nid = NID_id_GostR3411_94_with_GostR3410_94_cc,
+		.hash_nid = NID_id_GostR3411_94,
+		.pkey_nid = NID_id_GostR3410_94_cc,
+	},
+	{
+		.sign_nid = NID_id_GostR3411_94_with_GostR3410_2001_cc,
+		.hash_nid = NID_id_GostR3411_94,
+		.pkey_nid = NID_id_GostR3410_2001_cc,
+	},
+	{
+		.sign_nid = NID_rsassaPss,
+		.hash_nid = NID_undef,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_id_tc26_signwithdigest_gost3410_2012_256,
+		.hash_nid = NID_id_tc26_gost3411_2012_256,
+		.pkey_nid = NID_id_GostR3410_2001,
+	},
+	{
+		.sign_nid = NID_id_tc26_signwithdigest_gost3410_2012_512,
+		.hash_nid = NID_id_tc26_gost3411_2012_512,
+		.pkey_nid = NID_id_GostR3410_2001,
+	},
+	{
+		.sign_nid = NID_Ed25519,
+		.hash_nid = NID_undef,
+		.pkey_nid = NID_Ed25519,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_stdDH_sha1kdf_scheme,
+		.hash_nid = NID_sha1,
+		.pkey_nid = NID_dh_std_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_stdDH_sha224kdf_scheme,
+		.hash_nid = NID_sha224,
+		.pkey_nid = NID_dh_std_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_stdDH_sha256kdf_scheme,
+		.hash_nid = NID_sha256,
+		.pkey_nid = NID_dh_std_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_stdDH_sha384kdf_scheme,
+		.hash_nid = NID_sha384,
+		.pkey_nid = NID_dh_std_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_stdDH_sha512kdf_scheme,
+		.hash_nid = NID_sha512,
+		.pkey_nid = NID_dh_std_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_cofactorDH_sha1kdf_scheme,
+		.hash_nid = NID_sha1,
+		.pkey_nid = NID_dh_cofactor_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_cofactorDH_sha224kdf_scheme,
+		.hash_nid = NID_sha224,
+		.pkey_nid = NID_dh_cofactor_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_cofactorDH_sha256kdf_scheme,
+		.hash_nid = NID_sha256,
+		.pkey_nid = NID_dh_cofactor_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_cofactorDH_sha384kdf_scheme,
+		.hash_nid = NID_sha384,
+		.pkey_nid = NID_dh_cofactor_kdf,
+	},
+	{
+		.sign_nid = NID_dhSinglePass_cofactorDH_sha512kdf_scheme,
+		.hash_nid = NID_sha512,
+		.pkey_nid = NID_dh_cofactor_kdf,
+	},
+	{
+		.sign_nid = NID_RSA_SHA3_224,
+		.hash_nid = NID_sha3_224,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_RSA_SHA3_256,
+		.hash_nid = NID_sha3_256,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_RSA_SHA3_384,
+		.hash_nid = NID_sha3_384,
+		.pkey_nid = NID_rsaEncryption,
+	},
+	{
+		.sign_nid = NID_RSA_SHA3_512,
+		.hash_nid = NID_sha3_512,
+		.pkey_nid = NID_rsaEncryption,
+	},
+};
 
-static int sig_cmp_BSEARCH_CMP_FN(const void *, const void *);
-static int sig_cmp(nid_triple const *, nid_triple const *);
-static nid_triple *OBJ_bsearch_sig(nid_triple *key, nid_triple const *base, int num);
-
-static int
-sig_cmp_BSEARCH_CMP_FN(const void *a_, const void *b_)
-{
-	nid_triple const *a = a_;
-	nid_triple const *b = b_;
-	return sig_cmp(a, b);
-}
-
-static nid_triple *
-OBJ_bsearch_sig(nid_triple *key, nid_triple const *base, int num)
-{
-	return (nid_triple *)OBJ_bsearch_(key, base, num, sizeof(nid_triple),
-	    sig_cmp_BSEARCH_CMP_FN);
-}
-
-static int
-sig_sk_cmp(const nid_triple * const *a, const nid_triple * const *b)
-{
-	return (*a)->sign_id - (*b)->sign_id;
-}
-
-static int sigx_cmp_BSEARCH_CMP_FN(const void *, const void *);
-static int sigx_cmp(const nid_triple * const *, const nid_triple * const *);
-static const nid_triple * *OBJ_bsearch_sigx(const nid_triple * *key, const nid_triple * const *base, int num);
-
-static int
-sigx_cmp(const nid_triple * const *a, const nid_triple * const *b)
-{
-	int ret;
-
-	ret = (*a)->hash_id - (*b)->hash_id;
-	if (ret)
-		return ret;
-	return (*a)->pkey_id - (*b)->pkey_id;
-}
-
-
-static int
-sigx_cmp_BSEARCH_CMP_FN(const void *a_, const void *b_)
-{
-	const nid_triple * const *a = a_;
-	const nid_triple * const *b = b_;
-	return sigx_cmp(a, b);
-}
-
-static const nid_triple * *
-OBJ_bsearch_sigx(const nid_triple * *key, const nid_triple * const *base, int num)
-{
-	return (const nid_triple * *)OBJ_bsearch_(key, base, num, sizeof(const nid_triple *),
-	    sigx_cmp_BSEARCH_CMP_FN);
-}
+#define N_NID_TRIPLES (sizeof(nid_triple) / sizeof(nid_triple[0]))
 
 int
-OBJ_find_sigid_algs(int signid, int *pdig_nid, int *ppkey_nid)
+OBJ_find_sigid_algs(int sign_nid, int *hash_nid, int *pkey_nid)
 {
-	nid_triple tmp;
-	const nid_triple *rv = NULL;
-	tmp.sign_id = signid;
+	size_t i;
 
-	if (sig_app) {
-		int idx = sk_nid_triple_find(sig_app, &tmp);
-		if (idx >= 0)
-			rv = sk_nid_triple_value(sig_app, idx);
+	for (i = 0; i < N_NID_TRIPLES; i++) {
+		if (sign_nid != nid_triple[i].sign_nid)
+			continue;
+
+		if (hash_nid != NULL)
+			*hash_nid = nid_triple[i].hash_nid;
+		if (pkey_nid != NULL)
+			*pkey_nid = nid_triple[i].pkey_nid;
+
+		return 1;
 	}
 
-#ifndef OBJ_XREF_TEST2
-	if (rv == NULL) {
-		rv = OBJ_bsearch_sig(&tmp, sigoid_srt,
-		    sizeof(sigoid_srt) / sizeof(nid_triple));
-	}
-#endif
-	if (rv == NULL)
-		return 0;
-	if (pdig_nid)
-		*pdig_nid = rv->hash_id;
-	if (ppkey_nid)
-		*ppkey_nid = rv->pkey_id;
-	return 1;
+	return 0;
 }
 LCRYPTO_ALIAS(OBJ_find_sigid_algs);
 
 int
-OBJ_find_sigid_by_algs(int *psignid, int dig_nid, int pkey_nid)
+OBJ_find_sigid_by_algs(int *sign_nid, int hash_nid, int pkey_nid)
 {
-	nid_triple tmp;
-	const nid_triple *t = &tmp;
-	const nid_triple **rv = NULL;
+	size_t i;
 
-	tmp.hash_id = dig_nid;
-	tmp.pkey_id = pkey_nid;
+	for (i = 0; i < N_NID_TRIPLES; i++) {
+		if (hash_nid != nid_triple[i].hash_nid)
+			continue;
+		if (pkey_nid != nid_triple[i].pkey_nid)
+			continue;
 
-	if (sigx_app) {
-		int idx = sk_nid_triple_find(sigx_app, &tmp);
-		if (idx >= 0) {
-			t = sk_nid_triple_value(sigx_app, idx);
-			rv = &t;
-		}
+		if (sign_nid != NULL)
+			*sign_nid = nid_triple[i].sign_nid;
+
+		return 1;
 	}
 
-#ifndef OBJ_XREF_TEST2
-	if (rv == NULL) {
-		rv = OBJ_bsearch_sigx(&t, sigoid_srt_xref,
-		    sizeof(sigoid_srt_xref) / sizeof(nid_triple *));
-	}
-#endif
-	if (rv == NULL)
-		return 0;
-	if (psignid)
-		*psignid = (*rv)->sign_id;
-	return 1;
+	return 0;
 }
 LCRYPTO_ALIAS(OBJ_find_sigid_by_algs);
 
 int
-OBJ_add_sigid(int signid, int dig_id, int pkey_id)
+OBJ_add_sigid(int sign_nid, int hash_nid, int pkey_nid)
 {
-	nid_triple *ntr;
-
-	if (!sig_app)
-		sig_app = sk_nid_triple_new(sig_sk_cmp);
-	if (!sig_app)
-		return 0;
-	if (!sigx_app)
-		sigx_app = sk_nid_triple_new(sigx_cmp);
-	if (!sigx_app)
-		return 0;
-	ntr = reallocarray(NULL, 3, sizeof(int));
-	if (!ntr)
-		return 0;
-	ntr->sign_id = signid;
-	ntr->hash_id = dig_id;
-	ntr->pkey_id = pkey_id;
-
-	if (!sk_nid_triple_push(sig_app, ntr)) {
-		free(ntr);
-		return 0;
-	}
-
-	if (!sk_nid_triple_push(sigx_app, ntr))
-		return 0;
-
-	sk_nid_triple_sort(sig_app);
-	sk_nid_triple_sort(sigx_app);
-
-	return 1;
+	return 0;
 }
 LCRYPTO_ALIAS(OBJ_add_sigid);
 
-static void
-sid_free(nid_triple *tt)
-{
-	free(tt);
-}
-
 void
 OBJ_sigid_free(void)
 {
-	if (sig_app) {
-		sk_nid_triple_pop_free(sig_app, sid_free);
-		sig_app = NULL;
-	}
-	if (sigx_app) {
-		sk_nid_triple_free(sigx_app);
-		sigx_app = NULL;
-	}
 }
 LCRYPTO_ALIAS(OBJ_sigid_free);
diff --git a/lib/libcrypto/objects/obj_xref.h b/lib/libcrypto/objects/obj_xref.h
deleted file mode 100644
index bff8c6857..000000000
--- a/lib/libcrypto/objects/obj_xref.h
+++ /dev/null
@@ -1,115 +0,0 @@
-/* $OpenBSD: obj_xref.h,v 1.7 2023/06/15 17:58:27 tb Exp $ */
-/* AUTOGENERATED BY objxref.pl, DO NOT EDIT */
-
-__BEGIN_HIDDEN_DECLS
-
-typedef struct
-	{
-	int sign_id;
-	int hash_id;
-	int pkey_id;
-	} nid_triple;
-
-static const nid_triple sigoid_srt[] =
-	{
-	{NID_md2WithRSAEncryption, NID_md2, NID_rsaEncryption},
-	{NID_md5WithRSAEncryption, NID_md5, NID_rsaEncryption},
-	{NID_shaWithRSAEncryption, NID_sha, NID_rsaEncryption},
-	{NID_sha1WithRSAEncryption, NID_sha1, NID_rsaEncryption},
-	{NID_dsaWithSHA, NID_sha, NID_dsa},
-	{NID_dsaWithSHA1_2, NID_sha1, NID_dsa_2},
-	{NID_mdc2WithRSA, NID_mdc2, NID_rsaEncryption},
-	{NID_md5WithRSA, NID_md5, NID_rsa},
-	{NID_dsaWithSHA1, NID_sha1, NID_dsa},
-	{NID_sha1WithRSA, NID_sha1, NID_rsa},
-	{NID_ripemd160WithRSA, NID_ripemd160, NID_rsaEncryption},
-	{NID_md4WithRSAEncryption, NID_md4, NID_rsaEncryption},
-	{NID_ecdsa_with_SHA1, NID_sha1, NID_X9_62_id_ecPublicKey},
-	{NID_sha256WithRSAEncryption, NID_sha256, NID_rsaEncryption},
-	{NID_sha384WithRSAEncryption, NID_sha384, NID_rsaEncryption},
-	{NID_sha512WithRSAEncryption, NID_sha512, NID_rsaEncryption},
-	{NID_sha224WithRSAEncryption, NID_sha224, NID_rsaEncryption},
-	{NID_ecdsa_with_Recommended, NID_undef, NID_X9_62_id_ecPublicKey},
-	{NID_ecdsa_with_Specified, NID_undef, NID_X9_62_id_ecPublicKey},
-	{NID_ecdsa_with_SHA224, NID_sha224, NID_X9_62_id_ecPublicKey},
-	{NID_ecdsa_with_SHA256, NID_sha256, NID_X9_62_id_ecPublicKey},
-	{NID_ecdsa_with_SHA384, NID_sha384, NID_X9_62_id_ecPublicKey},
-	{NID_ecdsa_with_SHA512, NID_sha512, NID_X9_62_id_ecPublicKey},
-	{NID_dsa_with_SHA224, NID_sha224, NID_dsa},
-	{NID_dsa_with_SHA256, NID_sha256, NID_dsa},
-	{NID_id_GostR3411_94_with_GostR3410_2001, NID_id_GostR3411_94, NID_id_GostR3410_2001},
-	{NID_id_GostR3411_94_with_GostR3410_94, NID_id_GostR3411_94, NID_id_GostR3410_94},
-	{NID_id_GostR3411_94_with_GostR3410_94_cc, NID_id_GostR3411_94, NID_id_GostR3410_94_cc},
-	{NID_id_GostR3411_94_with_GostR3410_2001_cc, NID_id_GostR3411_94, NID_id_GostR3410_2001_cc},
-	{NID_rsassaPss, NID_undef, NID_rsaEncryption},
-	{NID_id_tc26_signwithdigest_gost3410_2012_256, NID_id_tc26_gost3411_2012_256, NID_id_GostR3410_2001},
-	{NID_id_tc26_signwithdigest_gost3410_2012_512, NID_id_tc26_gost3411_2012_512, NID_id_GostR3410_2001},
-	{NID_Ed25519, NID_undef, NID_Ed25519},
-	{NID_dhSinglePass_stdDH_sha1kdf_scheme, NID_sha1, NID_dh_std_kdf},
-	{NID_dhSinglePass_stdDH_sha224kdf_scheme, NID_sha224, NID_dh_std_kdf},
-	{NID_dhSinglePass_stdDH_sha256kdf_scheme, NID_sha256, NID_dh_std_kdf},
-	{NID_dhSinglePass_stdDH_sha384kdf_scheme, NID_sha384, NID_dh_std_kdf},
-	{NID_dhSinglePass_stdDH_sha512kdf_scheme, NID_sha512, NID_dh_std_kdf},
-	{NID_dhSinglePass_cofactorDH_sha1kdf_scheme, NID_sha1, NID_dh_cofactor_kdf},
-	{NID_dhSinglePass_cofactorDH_sha224kdf_scheme, NID_sha224, NID_dh_cofactor_kdf},
-	{NID_dhSinglePass_cofactorDH_sha256kdf_scheme, NID_sha256, NID_dh_cofactor_kdf},
-	{NID_dhSinglePass_cofactorDH_sha384kdf_scheme, NID_sha384, NID_dh_cofactor_kdf},
-	{NID_dhSinglePass_cofactorDH_sha512kdf_scheme, NID_sha512, NID_dh_cofactor_kdf},
-	{NID_RSA_SHA3_224, NID_sha3_224, NID_rsaEncryption},
-	{NID_RSA_SHA3_256, NID_sha3_256, NID_rsaEncryption},
-	{NID_RSA_SHA3_384, NID_sha3_384, NID_rsaEncryption},
-	{NID_RSA_SHA3_512, NID_sha3_512, NID_rsaEncryption},
-	};
-
-static const nid_triple * const sigoid_srt_xref[] =
-	{
-	&sigoid_srt[29],
-	&sigoid_srt[18],
-	&sigoid_srt[17],
-	&sigoid_srt[32],
-	&sigoid_srt[0],
-	&sigoid_srt[1],
-	&sigoid_srt[7],
-	&sigoid_srt[2],
-	&sigoid_srt[4],
-	&sigoid_srt[3],
-	&sigoid_srt[9],
-	&sigoid_srt[5],
-	&sigoid_srt[8],
-	&sigoid_srt[12],
-	&sigoid_srt[33],
-	&sigoid_srt[38],
-	&sigoid_srt[6],
-	&sigoid_srt[10],
-	&sigoid_srt[11],
-	&sigoid_srt[13],
-	&sigoid_srt[24],
-	&sigoid_srt[20],
-	&sigoid_srt[35],
-	&sigoid_srt[40],
-	&sigoid_srt[14],
-	&sigoid_srt[21],
-	&sigoid_srt[36],
-	&sigoid_srt[41],
-	&sigoid_srt[15],
-	&sigoid_srt[22],
-	&sigoid_srt[37],
-	&sigoid_srt[42],
-	&sigoid_srt[16],
-	&sigoid_srt[23],
-	&sigoid_srt[19],
-	&sigoid_srt[34],
-	&sigoid_srt[39],
-	&sigoid_srt[25],
-	&sigoid_srt[26],
-	&sigoid_srt[27],
-	&sigoid_srt[28],
-	&sigoid_srt[30],
-	&sigoid_srt[31],
-	&sigoid_srt[43],
-	&sigoid_srt[44],
-	&sigoid_srt[45],
-	&sigoid_srt[46],
-	};
-
-__END_HIDDEN_DECLS
diff --git a/lib/libcrypto/objects/obj_xref.txt b/lib/libcrypto/objects/obj_xref.txt
deleted file mode 100644
index 712b21a08..000000000
--- a/lib/libcrypto/objects/obj_xref.txt
+++ /dev/null
@@ -1,68 +0,0 @@
-# OID cross reference table.
-# Links signatures OIDs to their corresponding public key algorithms
-# and digests. The digest "undef" indicates the public key's ASN.1
-# method should handle AlgorithmIdentifiers and (at least part of) the
-# message digest explicitly.
-
-md2WithRSAEncryption	md2	rsaEncryption
-md5WithRSAEncryption	md5	rsaEncryption
-shaWithRSAEncryption	sha	rsaEncryption
-sha1WithRSAEncryption	sha1	rsaEncryption
-md4WithRSAEncryption	md4	rsaEncryption
-sha256WithRSAEncryption sha256	rsaEncryption
-sha384WithRSAEncryption	sha384	rsaEncryption
-sha512WithRSAEncryption	sha512	rsaEncryption
-sha224WithRSAEncryption	sha224	rsaEncryption
-mdc2WithRSA		mdc2	rsaEncryption
-ripemd160WithRSA	ripemd160 rsaEncryption
-RSA_SHA3_224		sha3_224 rsaEncryption
-RSA_SHA3_256		sha3_256 rsaEncryption
-RSA_SHA3_384		sha3_384 rsaEncryption
-RSA_SHA3_512		sha3_512 rsaEncryption
-# For PSS the digest algorithm can vary and depends on the included
-# AlgorithmIdentifier.
-rsassaPss		undef	rsaEncryption
-
-Ed25519			undef	Ed25519
-
-# Alternative deprecated OIDs. By using the older "rsa" OID this
-# type will be recognized by not normally used.
-
-md5WithRSA		md5	rsa
-sha1WithRSA		sha1	rsa
-
-dsaWithSHA		sha	dsa
-dsaWithSHA1		sha1	dsa
-
-dsaWithSHA1_2		sha1	dsa_2
-
-ecdsa_with_SHA1		sha1	X9_62_id_ecPublicKey
-ecdsa_with_SHA224	sha224	X9_62_id_ecPublicKey
-ecdsa_with_SHA256	sha256	X9_62_id_ecPublicKey
-ecdsa_with_SHA384	sha384	X9_62_id_ecPublicKey
-ecdsa_with_SHA512	sha512	X9_62_id_ecPublicKey
-ecdsa_with_Recommended	undef	X9_62_id_ecPublicKey
-ecdsa_with_Specified	undef	X9_62_id_ecPublicKey
-
-dsa_with_SHA224		sha224	dsa
-dsa_with_SHA256		sha256	dsa
-
-id_GostR3411_94_with_GostR3410_2001	id_GostR3411_94 id_GostR3410_2001
-id_GostR3411_94_with_GostR3410_94	id_GostR3411_94 id_GostR3410_94
-id_GostR3411_94_with_GostR3410_94_cc	id_GostR3411_94 id_GostR3410_94_cc
-id_GostR3411_94_with_GostR3410_2001_cc	id_GostR3411_94 id_GostR3410_2001_cc
-id_tc26_signwithdigest_gost3410_2012_256	id_tc26_gost3411_2012_256 id_GostR3410_2001
-id_tc26_signwithdigest_gost3410_2012_512	id_tc26_gost3411_2012_512 id_GostR3410_2001
-
-# ECDH KDFs and their corresponding message digests and schemes
-dhSinglePass_stdDH_sha1kdf_scheme		sha1	dh_std_kdf
-dhSinglePass_stdDH_sha224kdf_scheme		sha224	dh_std_kdf
-dhSinglePass_stdDH_sha256kdf_scheme		sha256	dh_std_kdf
-dhSinglePass_stdDH_sha384kdf_scheme		sha384	dh_std_kdf
-dhSinglePass_stdDH_sha512kdf_scheme		sha512	dh_std_kdf
-
-dhSinglePass_cofactorDH_sha1kdf_scheme		sha1	dh_cofactor_kdf
-dhSinglePass_cofactorDH_sha224kdf_scheme	sha224	dh_cofactor_kdf
-dhSinglePass_cofactorDH_sha256kdf_scheme	sha256	dh_cofactor_kdf
-dhSinglePass_cofactorDH_sha384kdf_scheme	sha384	dh_cofactor_kdf
-dhSinglePass_cofactorDH_sha512kdf_scheme	sha512	dh_cofactor_kdf
diff --git a/lib/libcrypto/objects/objxref.pl b/lib/libcrypto/objects/objxref.pl
deleted file mode 100644
index 8873c91ad..000000000
--- a/lib/libcrypto/objects/objxref.pl
+++ /dev/null
@@ -1,111 +0,0 @@
-#!/usr/local/bin/perl
-
-use strict;
-
-my %xref_tbl;
-my %oid_tbl;
-
-my ($mac_file, $xref_file) = @ARGV;
-
-open(IN, $mac_file) || die "Can't open $mac_file";
-
-# Read in OID nid values for a lookup table.
-
-while (<IN>)
-	{
-	chomp;
-	my ($name, $num) = /^(\S+)\s+(\S+)$/;
-	$oid_tbl{$name} = $num;
-	}
-close IN;
-
-open(IN, $xref_file) || die "Can't open $xref_file";
-
-my $ln = 1;
-
-while (<IN>)
-	{
-	chomp;
-	s/#.*$//;
-	next if (/^\S*$/);
-	my ($xr, $p1, $p2) = /^(\S+)\s+(\S+)\s+(\S+)/;
-	check_oid($xr);
-	check_oid($p1);
-	check_oid($p2);
-	$xref_tbl{$xr} = [$p1, $p2, $ln];
-	}
-
-my @xrkeys = keys %xref_tbl;
-
-my @srt1 = sort { $oid_tbl{$a} <=> $oid_tbl{$b}} @xrkeys;
-
-for(my $i = 0; $i <= $#srt1; $i++)
-	{
-	$xref_tbl{$srt1[$i]}[2] = $i;
-	}
-
-my @srt2 = sort
-	{
-	my$ap1 = $oid_tbl{$xref_tbl{$a}[0]};
-	my$bp1 = $oid_tbl{$xref_tbl{$b}[0]};
-	return $ap1 - $bp1 if ($ap1 != $bp1);
-	my$ap2 = $oid_tbl{$xref_tbl{$a}[1]};
-	my$bp2 = $oid_tbl{$xref_tbl{$b}[1]};
-
-	return $ap2 - $bp2;
-	} @xrkeys;
-
-my $pname = $0;
-
-$pname =~ s|^.[^/]/||;
-
-print <<EOF;
-/* \$OpenBSD\$ */
-/* AUTOGENERATED BY $pname, DO NOT EDIT */
-
-__BEGIN_HIDDEN_DECLS
-
-typedef struct
-	{
-	int sign_id;
-	int hash_id;
-	int pkey_id;
-	} nid_triple;
-
-static const nid_triple sigoid_srt[] =
-	{
-EOF
-
-foreach (@srt1)
-	{
-	my $xr = $_;
-	my ($p1, $p2) = @{$xref_tbl{$_}};
-	print "\t{NID_$xr, NID_$p1, NID_$p2},\n";
-	}
-
-print "\t};";
-print <<EOF;
-
-
-static const nid_triple * const sigoid_srt_xref[] =
-	{
-EOF
-
-foreach (@srt2)
-	{
-	my $x = $xref_tbl{$_}[2];
-	print "\t\&sigoid_srt\[$x\],\n";
-	}
-
-print "\t};\n\n";
-print "__END_HIDDEN_DECLS\n";
-
-sub check_oid
-	{
-	my ($chk) = @_;
-	if (!exists $oid_tbl{$chk})
-		{
-		die "Not Found \"$chk\"\n";
-		}
-	}
-
diff --git a/libexec/ld.so/ldd/ldd.c b/libexec/ld.so/ldd/ldd.c
index 860f46318..9e8c5065c 100644
--- a/libexec/ld.so/ldd/ldd.c
+++ b/libexec/ld.so/ldd/ldd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ldd.c,v 1.23 2023/07/13 19:04:50 jasper Exp $	*/
+/*	$OpenBSD: ldd.c,v 1.24 2023/07/24 01:02:47 deraadt Exp $	*/
 /*
  * Copyright (c) 2001 Artur Grabowski <art@openbsd.org>
  * All rights reserved.
@@ -183,6 +183,8 @@ doit(char *name)
 			_exit(0);
 		}
 
+		if (pledge(NULL, "stdio rpath") == -1)
+			err(1, "pledge");
 		execl(name, name, (char *)NULL);
 		perror(name);
 		_exit(1);
diff --git a/regress/lib/libcrypto/bn/bn_print.c b/regress/lib/libcrypto/bn/bn_print.c
index 47def8577..a3118869f 100644
--- a/regress/lib/libcrypto/bn/bn_print.c
+++ b/regress/lib/libcrypto/bn/bn_print.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bn_print.c,v 1.4 2023/07/10 20:21:37 tb Exp $ */
+/*	$OpenBSD: bn_print.c,v 1.5 2023/07/27 06:41:39 tb Exp $ */
 
 /*
  * Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
@@ -140,6 +140,7 @@ const struct print_test {
 			"        00:80:00:00:00:00:00:00:00:00\n",
 	},
 	{
+		/* XXX - this is incorrect and should be fixed. */
 		.desc = "high bit of first nibble is set for negative number",
 		.want = "    mana mana (Negative)\n"
 			"        00:80:00:00:00:00:00:00:00:00\n",
diff --git a/regress/lib/libcrypto/ec/ectest.c b/regress/lib/libcrypto/ec/ectest.c
index f90263dc2..f0b1028f4 100644
--- a/regress/lib/libcrypto/ec/ectest.c
+++ b/regress/lib/libcrypto/ec/ectest.c
@@ -1,5 +1,4 @@
-/*	$OpenBSD: ectest.c,v 1.19 2023/04/18 15:28:17 tb Exp $	*/
-/* crypto/ec/ectest.c */
+/*	$OpenBSD: ectest.c,v 1.21 2023/07/26 22:46:06 tb Exp $	*/
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -258,7 +257,7 @@ prime_field_tests(void)
 		ABORT;
 	if (!EC_POINT_set_compressed_coordinates(group, Q, x, 1, ctx))
 		ABORT;
-	if (!EC_POINT_is_on_curve(group, Q, ctx)) {
+	if (EC_POINT_is_on_curve(group, Q, ctx) <= 0) {
 		if (!EC_POINT_get_affine_coordinates(group, Q, x, y, ctx))
 			ABORT;
 		fprintf(stderr, "Point is not on curve: x = 0x");
@@ -365,7 +364,7 @@ prime_field_tests(void)
 		ABORT;
 	if (!EC_POINT_set_affine_coordinates(group, P, x, y, ctx))
 		ABORT;
-	if (!EC_POINT_is_on_curve(group, P, ctx))
+	if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
 		ABORT;
 	if (!BN_hex2bn(&z, "0100000000000000000001F4C8F927AED3CA752257"))
 		ABORT;
@@ -415,7 +414,7 @@ prime_field_tests(void)
 		ABORT;
 	if (!EC_POINT_set_compressed_coordinates(group, P, x, 1, ctx))
 		ABORT;
-	if (!EC_POINT_is_on_curve(group, P, ctx))
+	if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
 		ABORT;
 	if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831"))
 		ABORT;
@@ -465,7 +464,7 @@ prime_field_tests(void)
 		ABORT;
 	if (!EC_POINT_set_compressed_coordinates(group, P, x, 0, ctx))
 		ABORT;
-	if (!EC_POINT_is_on_curve(group, P, ctx))
+	if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
 		ABORT;
 	if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D"))
 		ABORT;
@@ -515,7 +514,7 @@ prime_field_tests(void)
 		ABORT;
 	if (!EC_POINT_set_compressed_coordinates(group, P, x, 1, ctx))
 		ABORT;
-	if (!EC_POINT_is_on_curve(group, P, ctx))
+	if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
 		ABORT;
 	if (!BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E"
 	    "84F3B9CAC2FC632551")) ABORT;
@@ -565,7 +564,7 @@ prime_field_tests(void)
 	    "9859F741E082542A385502F25DBF55296C3A545E3872760AB7")) ABORT;
 	if (!EC_POINT_set_compressed_coordinates(group, P, x, 1, ctx))
 		ABORT;
-	if (!EC_POINT_is_on_curve(group, P, ctx))
+	if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
 		ABORT;
 	if (!BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 	    "FFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973")) ABORT;
@@ -619,7 +618,7 @@ prime_field_tests(void)
 	    "3C1856A429BF97E7E31C2E5BD66")) ABORT;
 	if (!EC_POINT_set_compressed_coordinates(group, P, x, 0, ctx))
 		ABORT;
-	if (!EC_POINT_is_on_curve(group, P, ctx))
+	if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
 		ABORT;
 	if (!BN_hex2bn(&z, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 	    "FFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5"
@@ -664,7 +663,7 @@ prime_field_tests(void)
 	/* P := 2P */
 	if (!EC_POINT_dbl(group, P, P, ctx))
 		ABORT;
-	if (!EC_POINT_is_on_curve(group, P, ctx))
+	if (EC_POINT_is_on_curve(group, P, ctx) <= 0)
 		ABORT;
 	/* Q := -P */
 	if (!EC_POINT_invert(group, Q, ctx))
diff --git a/regress/lib/libcrypto/free/freenull.c.head b/regress/lib/libcrypto/free/freenull.c.head
index ba89967b4..0dec35ba4 100644
--- a/regress/lib/libcrypto/free/freenull.c.head
+++ b/regress/lib/libcrypto/free/freenull.c.head
@@ -1,4 +1,4 @@
-/*	$OpenBSD: freenull.c.head,v 1.4 2022/01/15 02:46:12 inoguchi Exp $	*/
+/*	$OpenBSD: freenull.c.head,v 1.5 2023/07/26 22:51:01 tb Exp $	*/
 
 #include <openssl/asn1.h>
 #include <openssl/cmac.h>
@@ -6,7 +6,9 @@
 #include <openssl/comp.h>
 #include <openssl/conf_api.h>
 #include <openssl/ct.h>
+#ifndef OPENSSL_NO_DSO
 #include <openssl/dso.h>
+#endif
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
diff --git a/regress/lib/libssl/ssl/ssltest.c b/regress/lib/libssl/ssl/ssltest.c
index f3966e505..f50824d24 100644
--- a/regress/lib/libssl/ssl/ssltest.c
+++ b/regress/lib/libssl/ssl/ssltest.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ssltest.c,v 1.41 2023/07/04 08:47:01 tb Exp $ */
+/*	$OpenBSD: ssltest.c,v 1.42 2023/07/27 07:08:09 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -140,6 +140,9 @@
  * OTHERWISE.
  */
 
+/* XXX - USE_BIOPAIR code needs updating for BIO_n{read,write}{,0} removal. */
+/* #define USE_BIOPAIR */
+
 #define _BSD_SOURCE 1		/* Or gethostname won't be declared properly
 				   on Linux and GNU platforms. */
 #include <sys/types.h>
@@ -714,10 +717,12 @@ bad:
 	for (i = 0; i < number; i++) {
 		if (!reuse)
 			SSL_set_session(c_ssl, NULL);
+#ifdef USE_BIOPAIR
 		if (bio_pair)
 			ret = doit_biopair(s_ssl, c_ssl, bytes, &s_time,
 			    &c_time);
 		else
+#endif
 			ret = doit(s_ssl, c_ssl, bytes);
 	}
 
@@ -771,6 +776,7 @@ end:
 	return ret;
 }
 
+#if USE_BIOPAIR
 int
 doit_biopair(SSL *s_ssl, SSL *c_ssl, long count, clock_t *s_time,
     clock_t *c_time)
@@ -1114,6 +1120,7 @@ err:
 
 	return ret;
 }
+#endif
 
 
 #define W_READ	1
diff --git a/regress/usr.bin/openssl/appstest.sh b/regress/usr.bin/openssl/appstest.sh
index 37842ecf0..3125a424e 100755
--- a/regress/usr.bin/openssl/appstest.sh
+++ b/regress/usr.bin/openssl/appstest.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $OpenBSD: appstest.sh,v 1.57 2023/07/03 05:31:56 beck Exp $
+# $OpenBSD: appstest.sh,v 1.58 2023/07/24 05:54:12 tb Exp $
 #
 # Copyright (c) 2016 Kinichiro Inoguchi <inoguchi@openbsd.org>
 #
@@ -118,8 +118,6 @@ __EOF__
 	start_message "errstr"
 	$openssl_bin errstr 2606A074
 	check_exit_status $?
-	$openssl_bin errstr -stats 2606A074 > $user1_dir/errstr-stats.out
-	check_exit_status $?
 
 	#---------#---------#---------#---------#---------#---------#---------
 
diff --git a/regress/usr.sbin/vmd/diskfmt/vioscribble.c b/regress/usr.sbin/vmd/diskfmt/vioscribble.c
index 606730104..a318935af 100644
--- a/regress/usr.sbin/vmd/diskfmt/vioscribble.c
+++ b/regress/usr.sbin/vmd/diskfmt/vioscribble.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vioscribble.c,v 1.3 2021/06/13 21:43:35 dv Exp $	*/
+/*	$OpenBSD: vioscribble.c,v 1.4 2023/07/26 05:50:45 anton Exp $	*/
 
 /*
  * Copyright (c) 2018 Ori Bernstein <ori@eigenstate.org>
@@ -50,6 +50,8 @@
 #include <unistd.h>
 #include <assert.h>
 #include <err.h>
+#include <stdarg.h>
+#include <syslog.h>
 
 #include "vmd.h"
 #include "vmm.h"
@@ -57,7 +59,6 @@
 
 #define CLUSTERSZ 65536
 
-int verbose;
 struct virtio_backing qcowfile;
 struct virtio_backing rawfile;
 
@@ -81,7 +82,8 @@ main(int argc, char **argv)
 	char buf[64*1024], cmp[64*1024];
 	off_t len, off, qcsz, rawsz;
 
-	verbose = !!getenv("VERBOSE");
+	log_init(1, LOG_DAEMON);
+
 	qcfd = open("scribble.qcow2", O_RDWR);
 	rawfd = open("scribble.raw", O_RDWR);
 	if (qcfd == -1)
diff --git a/sbin/mount/mount.c b/sbin/mount/mount.c
index aa55d96d6..7de836360 100644
--- a/sbin/mount/mount.c
+++ b/sbin/mount/mount.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mount.c,v 1.76 2022/12/04 23:50:46 cheloha Exp $	*/
+/*	$OpenBSD: mount.c,v 1.77 2023/07/23 23:21:19 kn Exp $	*/
 /*	$NetBSD: mount.c,v 1.24 1995/11/18 03:34:29 cgd Exp $	*/
 
 /*
@@ -565,6 +565,7 @@ prmount(struct statfs *sf)
 			(void)printf(", %s=%d",
 			    "acdirmax", nfs_args->acdirmax);
 		}
+#ifndef SMALL
 	} else if (strcmp(sf->f_fstypename, MOUNT_MFS) == 0) {
 		int headerlen;
 		long blocksize;
@@ -573,6 +574,7 @@ prmount(struct statfs *sf)
 		header = getbsize(&headerlen, &blocksize);
 		(void)printf("%s%s=%lu %s", !f++ ? " (" : ", ",
 		    "size", sf->mount_info.mfs_args.size / blocksize, header);
+#endif /* SMALL */
 	} else if (strcmp(sf->f_fstypename, MOUNT_MSDOS) == 0) {
 		struct msdosfs_args *msdosfs_args = &sf->mount_info.msdosfs_args;
 
@@ -597,6 +599,7 @@ prmount(struct statfs *sf)
 			(void)printf("%s%s", !f++ ? " (" : ", ", "gens");
 		if (iso_args->flags & ISOFSMNT_EXTATT)
 			(void)printf("%s%s", !f++ ? " (" : ", ", "extatt");
+#ifndef SMALL
 	} else if (strcmp(sf->f_fstypename, MOUNT_TMPFS) == 0) {
 		struct tmpfs_args *tmpfs_args = &sf->mount_info.tmpfs_args;
 
@@ -612,6 +615,7 @@ prmount(struct statfs *sf)
 		if (verbose || tmpfs_args->ta_nodes_max)
 			(void)printf("%s%s=%lu", !f++ ? " (" : ", ",
 			    "inodes", (unsigned long)tmpfs_args->ta_nodes_max);
+#endif /* SMALL */
 	}
 	(void)printf(f ? ")\n" : "\n");
 }
diff --git a/share/man/man4/eoip.4 b/share/man/man4/eoip.4
index 47508ec83..30d0462a5 100644
--- a/share/man/man4/eoip.4
+++ b/share/man/man4/eoip.4
@@ -1,4 +1,4 @@
-.\" $OpenBSD: eoip.4,v 1.6 2020/12/05 18:44:35 jmc Exp $
+.\" $OpenBSD: eoip.4,v 1.8 2023/07/26 20:23:22 jmc Exp $
 .\" $NetBSD: gre.4,v 1.10 1999/12/22 14:55:49 kleink Exp $
 .\"
 .\" Copyright 1998 (c) The NetBSD Foundation, Inc.
@@ -28,7 +28,7 @@
 .\" ARISING IN ANY WAY  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: December 5 2020 $
+.Dd $Mdocdate: July 26 2023 $
 .Dt EOIP 4
 .Os
 .Sh NAME
diff --git a/share/mk/bsd.README b/share/mk/bsd.README
index 0be59ae5f..ce23a826a 100644
--- a/share/mk/bsd.README
+++ b/share/mk/bsd.README
@@ -1,4 +1,4 @@
-#	$OpenBSD: bsd.README,v 1.85 2020/09/22 10:31:46 martijn Exp $
+#	$OpenBSD: bsd.README,v 1.86 2023/07/25 20:19:14 asou Exp $
 #	$NetBSD: bsd.README,v 1.17 1996/04/13 02:08:08 thorpej Exp $
 #	@(#)bsd.README	5.1 (Berkeley) 5/11/90
 
@@ -302,6 +302,8 @@ CLEANFILES	Additional files to remove for the clean and cleandir targets.
 
 COPTS		Additional flags to the compiler when creating C objects.
 
+CXXOPTS		Additional flags to the compiler when creating C++ objects.
+
 LDADD		Additional linker objects.  Usually used for libraries.
 		For example, to link with the crypto and utility
 		libraries, use:
diff --git a/sys/.gitignore b/sys/.gitignore
index 3fdff78bc..f07392d0d 100644
--- a/sys/.gitignore
+++ b/sys/.gitignore
@@ -1,2 +1,3 @@
 **/obj
 **/tags
+**/CVS
diff --git a/sys/arch/amd64/amd64/cpu.c b/sys/arch/amd64/amd64/cpu.c
index f1c5a0d5e..7ede9ddfd 100644
--- a/sys/arch/amd64/amd64/cpu.c
+++ b/sys/arch/amd64/amd64/cpu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.c,v 1.171 2023/07/21 04:04:51 guenther Exp $	*/
+/*	$OpenBSD: cpu.c,v 1.173 2023/07/25 04:42:00 deraadt Exp $	*/
 /* $NetBSD: cpu.c,v 1.1 2003/04/26 18:39:26 fvdl Exp $ */
 
 /*-
@@ -1168,7 +1168,7 @@ void
 cpu_fix_msrs(struct cpu_info *ci)
 {
 	int family = ci->ci_family;
-	uint64_t msr;
+	uint64_t msr, nmsr;
 
 	if (!strcmp(cpu_vendor, "GenuineIntel")) {
 		if ((family > 6 || (family == 6 && ci->ci_model >= 0xd)) &&
@@ -1211,11 +1211,17 @@ cpu_fix_msrs(struct cpu_info *ci)
 		 * where LFENCE is always serializing.
 		 */
 		if (family >= 0x10 && family != 0x11) {
-			msr = rdmsr(MSR_DE_CFG);
-			if ((msr & DE_CFG_SERIALIZE_LFENCE) == 0) {
-				msr |= DE_CFG_SERIALIZE_LFENCE;
-				wrmsr(MSR_DE_CFG, msr);
-			}
+			nmsr = msr = rdmsr(MSR_DE_CFG);
+			nmsr |= DE_CFG_SERIALIZE_LFENCE;
+			if (msr != nmsr)
+				wrmsr(MSR_DE_CFG, nmsr);
+		}
+		if (family == 0x17 && ci->ci_model >= 0x31 &&
+		    (cpu_ecxfeature & CPUIDECX_HV) == 0) {
+			nmsr = msr = rdmsr(MSR_DE_CFG);
+			nmsr |= DE_CFG_SERIALIZE_9;
+			if (msr != nmsr)
+				wrmsr(MSR_DE_CFG, nmsr);
 		}
 	}
 
diff --git a/sys/arch/amd64/amd64/identcpu.c b/sys/arch/amd64/amd64/identcpu.c
index 7904058a8..ed8701172 100644
--- a/sys/arch/amd64/amd64/identcpu.c
+++ b/sys/arch/amd64/amd64/identcpu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: identcpu.c,v 1.134 2023/07/21 04:04:51 guenther Exp $	*/
+/*	$OpenBSD: identcpu.c,v 1.135 2023/07/27 01:51:35 guenther Exp $	*/
 /*	$NetBSD: identcpu.c,v 1.1 2003/04/26 18:39:28 fvdl Exp $	*/
 
 /*
@@ -230,18 +230,47 @@ const struct {
 }, cpu_cpuid_apmi_edx[] = {
 	{ CPUIDEDX_ITSC,	"ITSC" },
 }, cpu_amdspec_ebxfeatures[] = {
-	{ CPUIDEBX_IBPB,	"IBPB" },
-	{ CPUIDEBX_IBRS,	"IBRS" },
-	{ CPUIDEBX_STIBP,	"STIBP" },
-	{ CPUIDEBX_SSBD,	"SSBD" },
-	{ CPUIDEBX_VIRT_SSBD,	"VIRTSSBD" },
-	{ CPUIDEBX_SSBD_NOTREQ,	"SSBDNR" },
+	{ CPUIDEBX_INVLPGB,		"INVLPGB" },
+	{ CPUIDEBX_IBPB,		"IBPB" },
+	{ CPUIDEBX_IBRS,		"IBRS" },
+	{ CPUIDEBX_STIBP,		"STIBP" },
+	{ CPUIDEBX_IBRS_ALWAYSON,	"IBRS_ALL" },
+	{ CPUIDEBX_STIBP_ALWAYSON,	"STIBP_ALL" },
+	{ CPUIDEBX_IBRS_PREF,		"IBRS_PREF" },
+	{ CPUIDEBX_IBRS_SAME_MODE,	"IBRS_SM" },
+	{ CPUIDEBX_SSBD,		"SSBD" },
+	{ CPUIDEBX_VIRT_SSBD,		"VIRTSSBD" },
+	{ CPUIDEBX_SSBD_NOTREQ,		"SSBDNR" },
 }, cpu_xsave_extfeatures[] = {
 	{ XSAVE_XSAVEOPT,	"XSAVEOPT" },
 	{ XSAVE_XSAVEC,		"XSAVEC" },
 	{ XSAVE_XGETBV1,	"XGETBV1" },
 	{ XSAVE_XSAVES,		"XSAVES" },
 	{ XSAVE_XFD,		"XFD" },
+}, cpu_arch_cap_features[] = {
+	/* ARCH_CAP_RDCL_NO (not printed) == !MELTDOWN */
+	{ ARCH_CAP_IBRS_ALL,		"IBRS_ALL" },
+	{ ARCH_CAP_RSBA,		"RSBA" },
+	{ ARCH_CAP_SKIP_L1DFL_VMENTRY,	"SKIP_L1DFL" },
+	{ ARCH_CAP_SSB_NO,		"SSB_NO" },
+	{ ARCH_CAP_MDS_NO,		"MDS_NO" },
+	{ ARCH_CAP_IF_PSCHANGE_MC_NO,	"IF_PSCHANGE" },
+	{ ARCH_CAP_TSX_CTRL,		"TSX_CTRL" },
+	{ ARCH_CAP_TAA_NO,		"TAA_NO" },
+	{ ARCH_CAP_MCU_CONTROL,		"MCU_CONTROL" },
+	{ ARCH_CAP_MISC_PACKAGE_CTLS,	"MISC_PKG_CT" },
+	{ ARCH_CAP_ENERGY_FILTERING_CTL, "ENERGY_FILT" },
+	{ ARCH_CAP_DOITM,		"DOITM" },
+	{ ARCH_CAP_SBDR_SSDP_NO,	"SBDR_SSDP_N" },
+	{ ARCH_CAP_FBSDP_NO,		"FBSDP_NO" },
+	{ ARCH_CAP_PSDP_NO,		"PSDP_NO" },
+	{ ARCH_CAP_FB_CLEAR,		"FB_CLEAR" },
+	{ ARCH_CAP_FB_CLEAR_CTRL,	"FB_CLEAR_CT" },
+	{ ARCH_CAP_RRSBA,		"RRSBA" },
+	{ ARCH_CAP_BHI_NO,		"BHI_NO" },
+	{ ARCH_CAP_XAPIC_DISABLE_STATUS, "XAPIC_DIS" },
+	{ ARCH_CAP_OVERCLOCKING_STATUS,	"OVERCLOCK" },
+	{ ARCH_CAP_PBRSB_NO,		"PBRSB_NO" },
 };
 
 int
@@ -674,7 +703,7 @@ identifycpu(struct cpu_info *ci)
 			ci->ci_feature_tpmflags |= TPM_ARAT;
 	}
 
-	/* AMD speculation control features */
+	/* speculation control features */
 	if (!strcmp(cpu_vendor, "AuthenticAMD")) {
 		if (ci->ci_pnfeatset >= 0x80000008) {
 			CPUID(0x80000008, dummy, ci->ci_feature_amdspec_ebx,
@@ -685,6 +714,13 @@ identifycpu(struct cpu_info *ci)
 					printf(",%s",
 					    cpu_amdspec_ebxfeatures[i].str);
 		}
+	} else if (!strcmp(cpu_vendor, "GenuineIntel") &&
+	    (ci->ci_feature_sefflags_edx & SEFF0EDX_ARCH_CAP)) {
+		uint64_t msr = rdmsr(MSR_ARCH_CAPABILITIES);
+
+		for (i = 0; i < nitems(cpu_arch_cap_features); i++)
+			if (msr & cpu_arch_cap_features[i].bit)
+				printf(",%s", cpu_arch_cap_features[i].str);
 	}
 
 	/* xsave subfeatures */
diff --git a/sys/arch/amd64/amd64/locore.S b/sys/arch/amd64/amd64/locore.S
index c87098e3b..a444ca197 100644
--- a/sys/arch/amd64/amd64/locore.S
+++ b/sys/arch/amd64/amd64/locore.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: locore.S,v 1.136 2023/07/10 03:32:10 guenther Exp $	*/
+/*	$OpenBSD: locore.S,v 1.138 2023/07/27 00:28:24 guenther Exp $	*/
 /*	$NetBSD: locore.S,v 1.13 2004/03/25 18:33:17 drochner Exp $	*/
 
 /*
@@ -473,31 +473,17 @@ bogus_proc_pmap:
 #endif /* DIAGNOSTIC */
 END(cpu_switchto)
 
-ENTRY(cpu_idle_enter)
-	ret
-	lfence
-END(cpu_idle_enter)
-
-ENTRY(cpu_idle_leave)
-	ret
-	lfence
-END(cpu_idle_leave)
-
-/* placed here for correct static branch prediction in cpu_idle_* */
 NENTRY(retpoline_rax)
 	JMP_RETPOLINE(rax)
 
-ENTRY(cpu_idle_cycle)
-	RETGUARD_SETUP(cpu_idle_cycle, r11)
-	movq	cpu_idle_cycle_fcn,%rax
-	cmpq	$0,%rax
-	jne	retpoline_rax
+ENTRY(cpu_idle_cycle_hlt)
+	RETGUARD_SETUP(cpu_idle_cycle_hlt, r11)
 	sti
 	hlt
-	RETGUARD_CHECK(cpu_idle_cycle, r11)
+	RETGUARD_CHECK(cpu_idle_cycle_hlt, r11)
 	ret
 	lfence
-END(cpu_idle_cycle)
+END(cpu_idle_cycle_hlt)
 
 /*
  * savectx(struct pcb *pcb);
diff --git a/sys/arch/amd64/amd64/machdep.c b/sys/arch/amd64/amd64/machdep.c
index ddbeedb12..453de13fb 100644
--- a/sys/arch/amd64/amd64/machdep.c
+++ b/sys/arch/amd64/amd64/machdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: machdep.c,v 1.285 2023/07/10 03:32:10 guenther Exp $	*/
+/*	$OpenBSD: machdep.c,v 1.286 2023/07/27 00:28:25 guenther Exp $	*/
 /*	$NetBSD: machdep.c,v 1.3 2003/05/07 22:58:18 fvdl Exp $	*/
 
 /*-
@@ -160,7 +160,8 @@ char machine[] = MACHINE;
 /*
  * switchto vectors
  */
-void (*cpu_idle_cycle_fcn)(void) = NULL;
+void cpu_idle_cycle_hlt(void);
+void (*cpu_idle_cycle_fcn)(void) = &cpu_idle_cycle_hlt;
 
 /* the following is used externally for concurrent handlers */
 int setperf_prio = 0;
diff --git a/sys/arch/amd64/amd64/spl.S b/sys/arch/amd64/amd64/spl.S
index b2327d0a7..078d84063 100644
--- a/sys/arch/amd64/amd64/spl.S
+++ b/sys/arch/amd64/amd64/spl.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: spl.S,v 1.19 2022/12/01 00:26:15 guenther Exp $	*/
+/*	$OpenBSD: spl.S,v 1.20 2023/07/27 00:30:07 guenther Exp $	*/
 /*	$NetBSD: spl.S,v 1.3 2004/06/28 09:13:11 fvdl Exp $	*/
 
 /*
@@ -122,7 +122,8 @@ KIDTVEC(spllower)
 	RETGUARD_PUSH(r11)
 	movl	%edi,%ebx
 	leaq	1f(%rip),%r13		# address to resume loop at
-1:	movl	%ebx,%eax		# get cpl
+1:	endbr64
+	movl	%ebx,%eax		# get cpl
 	movq	CPUVAR(IUNMASK)(,%rax,8),%rax
 	cli
 	andq	CPUVAR(IPENDING),%rax		# any non-masked bits left?
@@ -153,7 +154,8 @@ KIDTVEC(doreti)
 	movq	IF_PPL(%rsp),%rbx	# get previous priority
 	decl	CPUVAR(IDEPTH)
 	leaq	1f(%rip),%r13
-1:	movl	%ebx,%eax
+1:	endbr64
+	movl	%ebx,%eax
 	movq	CPUVAR(IUNMASK)(,%rax,8),%rax
 	cli
 	andq	CPUVAR(IPENDING),%rax
diff --git a/sys/arch/amd64/amd64/ucode.c b/sys/arch/amd64/amd64/ucode.c
index 21da99578..1cb21e9c8 100644
--- a/sys/arch/amd64/amd64/ucode.c
+++ b/sys/arch/amd64/amd64/ucode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ucode.c,v 1.5 2019/06/28 21:54:05 bluhm Exp $	*/
+/*	$OpenBSD: ucode.c,v 1.6 2023/07/23 01:46:37 jsg Exp $	*/
 /*
  * Copyright (c) 2018 Stefan Fritsch <fritsch@genua.de>
  * Copyright (c) 2018 Patrick Wildt <patrick@blueri.se>
@@ -72,6 +72,8 @@ size_t	 cpu_ucode_size;
 void	 cpu_ucode_setup(void);
 void	 cpu_ucode_apply(struct cpu_info *);
 
+struct mutex	cpu_ucode_mtx = MUTEX_INITIALIZER(IPL_HIGH);
+
 /* Intel */
 void	 cpu_ucode_intel_apply(struct cpu_info *);
 struct intel_ucode_header *
@@ -82,7 +84,8 @@ int	 cpu_ucode_intel_match(struct intel_ucode_header *, uint32_t, uint32_t,
 uint32_t cpu_ucode_intel_rev(void);
 
 struct intel_ucode_header	*cpu_ucode_intel_applied;
-struct mutex			 cpu_ucode_intel_mtx = MUTEX_INITIALIZER(IPL_HIGH);
+
+void cpu_ucode_amd_apply(struct cpu_info *);
 
 void
 cpu_ucode_setup(void)
@@ -107,6 +110,99 @@ cpu_ucode_apply(struct cpu_info *ci)
 {
 	if (strcmp(cpu_vendor, "GenuineIntel") == 0)
 		cpu_ucode_intel_apply(ci);
+	else if (strcmp(cpu_vendor, "AuthenticAMD") == 0)
+		cpu_ucode_amd_apply(ci);
+}
+
+#define AMD_MAGIC 0x00414d44
+
+struct amd_equiv {
+	uint32_t id;
+	uint32_t a;
+	uint32_t b;
+	uint16_t eid;
+	uint16_t c;
+} __packed;
+
+struct amd_patch {
+	uint32_t type;
+	uint32_t len;
+	uint32_t a;
+	uint32_t level;
+	uint8_t c[16];
+	uint16_t eid;
+} __packed;
+
+void
+cpu_ucode_amd_apply(struct cpu_info *ci)
+{
+	uint64_t level;
+	uint32_t magic, tlen, i;
+	uint16_t eid = 0;
+	uint32_t sig, ebx, ecx, edx;
+	uint64_t start = 0;
+
+	if (cpu_ucode_data == NULL || cpu_ucode_size == 0) {
+		DPRINTF(("%s: no microcode provided\n", __func__));
+		return;
+	}
+
+	/*
+	 * Grab a mutex, because we are not allowed to run updates
+	 * simultaneously on HT siblings.
+	 */
+	mtx_enter(&cpu_ucode_mtx);
+
+	CPUID(1, sig, ebx, ecx, edx);
+
+	level = rdmsr(MSR_PATCH_LEVEL);
+	DPRINTF(("%s: cur patch level 0x%llx\n", __func__, level));
+
+	memcpy(&magic, cpu_ucode_data, 4);
+	if (magic != AMD_MAGIC) {
+		DPRINTF(("%s: bad magic %x\n", __func__, magic));
+		goto out;
+	}
+
+	memcpy(&tlen, &cpu_ucode_data[8], 4);
+
+	/* find equivalence id matching our cpu signature */
+	for (i = 12; i < 12 + tlen;) {
+		struct amd_equiv ae;
+		if (i + sizeof(ae) > cpu_ucode_size) {
+			DPRINTF(("%s: truncated etable\n", __func__));
+			goto out;
+		}
+		memcpy(&ae, &cpu_ucode_data[i], sizeof(ae));
+		i += sizeof(ae);
+		if (ae.id == sig)
+			eid = ae.eid;
+	}
+
+	/* look for newer patch with the equivalence id */
+	while (i < cpu_ucode_size) {
+		struct amd_patch ap;
+		if (i + sizeof(ap) > cpu_ucode_size) {
+			DPRINTF(("%s: truncated ptable\n", __func__));
+			goto out;
+		}
+		memcpy(&ap, &cpu_ucode_data[i], sizeof(ap));
+		if (ap.type == 1 && ap.eid == eid && ap.level > level)
+			start = (uint64_t)&cpu_ucode_data[i + 8];
+		if (i + ap.len + 8 > cpu_ucode_size) {
+			DPRINTF(("%s: truncated patch\n", __func__));
+			goto out;
+		}
+		i += ap.len + 8;
+	}
+
+	if (start != 0) {
+		wrmsr(MSR_PATCH_LOADER, start);
+		level = rdmsr(MSR_PATCH_LEVEL);
+		DPRINTF(("%s: new patch level 0x%llx\n", __func__, level));
+	}
+out:
+	mtx_leave(&cpu_ucode_mtx);
 }
 
 void
@@ -125,7 +221,7 @@ cpu_ucode_intel_apply(struct cpu_info *ci)
 	 * Grab a mutex, because we are not allowed to run updates
 	 * simultaneously on HT siblings.
 	 */
-	mtx_enter(&cpu_ucode_intel_mtx);
+	mtx_enter(&cpu_ucode_mtx);
 
 	old_rev = cpu_ucode_intel_rev();
 	update = cpu_ucode_intel_applied;
@@ -159,7 +255,7 @@ cpu_ucode_intel_apply(struct cpu_info *ci)
 	}
 
 out:
-	mtx_leave(&cpu_ucode_intel_mtx);
+	mtx_leave(&cpu_ucode_mtx);
 }
 
 struct intel_ucode_header *
diff --git a/sys/arch/amd64/amd64/vector.S b/sys/arch/amd64/amd64/vector.S
index a7c1d5dd7..d3b31c761 100644
--- a/sys/arch/amd64/amd64/vector.S
+++ b/sys/arch/amd64/amd64/vector.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vector.S,v 1.92 2023/04/17 00:02:14 deraadt Exp $	*/
+/*	$OpenBSD: vector.S,v 1.93 2023/07/27 00:30:07 guenther Exp $	*/
 /*	$NetBSD: vector.S,v 1.5 2004/06/28 09:13:11 fvdl Exp $	*/
 
 /*
@@ -551,6 +551,7 @@ IDTVEC(intr_lapic_ipi)
 	jae	2f
 END(INTRENTRY_LABEL(intr_lapic_ipi))
 KIDTVEC_FALLTHROUGH(resume_lapic_ipi)
+	endbr64
 1:
 	incl	CPUVAR(IDEPTH)
 	movl	$IPL_IPI,CPUVAR(ILEVEL)
@@ -757,6 +758,7 @@ IDTVEC(intr_lapic_ltimer)
 	jae	2f
 END(INTRENTRY_LABEL(intr_lapic_ltimer))
 KIDTVEC_FALLTHROUGH(resume_lapic_ltimer)
+	endbr64
 1:
 	incl	CPUVAR(IDEPTH)
 	movl	$IPL_CLOCK,CPUVAR(ILEVEL)
@@ -790,6 +792,7 @@ IDTVEC(intr_xen_upcall)
 	jae	2f
 END(INTRENTRY_LABEL(intr_xen_upcall))
 KIDTVEC_FALLTHROUGH(resume_xen_upcall)
+	endbr64
 1:
 	incl	CPUVAR(IDEPTH)
 	movl	$IPL_NET,CPUVAR(ILEVEL)
@@ -822,6 +825,7 @@ IDTVEC(intr_hyperv_upcall)
 	jae	2f
 END(INTRENTRY_LABEL(intr_hyperv_upcall))
 KIDTVEC_FALLTHROUGH(resume_hyperv_upcall)
+	endbr64
 1:
 	incl	CPUVAR(IDEPTH)
 	movl	$IPL_NET,CPUVAR(ILEVEL)
@@ -852,6 +856,7 @@ KIDTVEC(recurse_##name##num)						;\
 	INTR_RECURSE							;\
 END(Xrecurse_##name##num)						;\
 KIDTVEC_FALLTHROUGH(resume_##name##num)					\
+	endbr64								;\
 	movq	$IREENT_MAGIC,TF_ERR(%rsp)				;\
 	movl	%ebx,%r13d						;\
 	movq	CPUVAR(ISOURCES) + (num) * 8, %r14			;\
@@ -1268,6 +1273,7 @@ NENTRY(retpoline_r13)
 END(retpoline_r13)
 
 KIDTVEC(softtty)
+	endbr64
 	movl	$IPL_SOFTTTY, CPUVAR(ILEVEL)
 	sti
 	incl	CPUVAR(IDEPTH)
@@ -1278,6 +1284,7 @@ KIDTVEC(softtty)
 END(Xsofttty)
 
 KIDTVEC(softnet)
+	endbr64
 	movl	$IPL_SOFTNET, CPUVAR(ILEVEL)
 	sti
 	incl	CPUVAR(IDEPTH)
@@ -1288,6 +1295,7 @@ KIDTVEC(softnet)
 END(Xsoftnet)
 
 KIDTVEC(softclock)
+	endbr64
 	movl	$IPL_SOFTCLOCK, CPUVAR(ILEVEL)
 	sti
 	incl	CPUVAR(IDEPTH)
diff --git a/sys/arch/amd64/include/cpu.h b/sys/arch/amd64/include/cpu.h
index d99801766..cf3228862 100644
--- a/sys/arch/amd64/include/cpu.h
+++ b/sys/arch/amd64/include/cpu.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.h,v 1.155 2023/07/04 17:29:32 cheloha Exp $	*/
+/*	$OpenBSD: cpu.h,v 1.158 2023/07/27 00:28:24 guenther Exp $	*/
 /*	$NetBSD: cpu.h,v 1.1 2003/04/26 18:39:39 fvdl Exp $	*/
 
 /*-
@@ -208,6 +208,7 @@ struct cpu_info {
 	u_int64_t		ci_hz_aperf;
 #if defined(GPROF) || defined(DDBPROF)
 	struct gmonparam	*ci_gmon;
+	struct clockintr	*ci_gmonclock;
 #endif
 	u_int32_t	ci_vmm_flags;
 #define	CI_VMM_VMX	(1 << 0)
@@ -403,7 +404,10 @@ void	cpu_reset(void);
 void	x86_64_proc0_tss_ldt_init(void);
 void	cpu_proc_fork(struct proc *, struct proc *);
 int	amd64_pa_used(paddr_t);
+#define	cpu_idle_enter()	do { /* nothing */ } while (0)
 extern void (*cpu_idle_cycle_fcn)(void);
+#define	cpu_idle_cycle()	(*cpu_idle_cycle_fcn)()
+#define	cpu_idle_leave()	do { /* nothing */ } while (0)
 
 struct region_descriptor;
 void	lgdt(struct region_descriptor *);
diff --git a/sys/arch/amd64/include/frameasm.h b/sys/arch/amd64/include/frameasm.h
index 325d1c605..1142414bb 100644
--- a/sys/arch/amd64/include/frameasm.h
+++ b/sys/arch/amd64/include/frameasm.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: frameasm.h,v 1.26 2023/04/17 00:02:14 deraadt Exp $	*/
+/*	$OpenBSD: frameasm.h,v 1.27 2023/07/27 00:30:07 guenther Exp $	*/
 /*	$NetBSD: frameasm.h,v 1.1 2003/04/26 18:39:40 fvdl Exp $	*/
 
 #ifndef _AMD64_MACHINE_FRAMEASM_H
@@ -111,6 +111,7 @@ _ENTRY(INTRENTRY_LABEL(label)) /* from kernel */ \
  * to return to.  %r10 and %r11 are scratch.
  */
 #define	INTR_RECURSE \
+	endbr64				; \
 	/* fake the iretq_frame */	; \
 	movq	%rsp,%r10		; \
 	movl	%ss,%r11d		; \
diff --git a/sys/arch/amd64/include/specialreg.h b/sys/arch/amd64/include/specialreg.h
index f639379a0..a5c516a8d 100644
--- a/sys/arch/amd64/include/specialreg.h
+++ b/sys/arch/amd64/include/specialreg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: specialreg.h,v 1.104 2023/07/21 04:04:51 guenther Exp $	*/
+/*	$OpenBSD: specialreg.h,v 1.106 2023/07/27 01:51:35 guenther Exp $	*/
 /*	$NetBSD: specialreg.h,v 1.1 2003/04/26 18:39:48 fvdl Exp $	*/
 /*	$NetBSD: x86/specialreg.h,v 1.2 2003/04/25 21:54:30 fvdl Exp $	*/
 
@@ -334,12 +334,14 @@
 /*
  * AMD CPUID function 0x80000008 EBX bits
  */
+#define CPUIDEBX_INVLPGB	(1ULL <<  3)	/* INVLPG w/broadcast */
 #define CPUIDEBX_IBPB		(1ULL << 12)	/* Speculation Control IBPB */
 #define CPUIDEBX_IBRS		(1ULL << 14)	/* Speculation Control IBRS */
 #define CPUIDEBX_STIBP		(1ULL << 15)	/* Speculation Control STIBP */
 #define CPUIDEBX_IBRS_ALWAYSON	(1ULL << 16)	/* IBRS always on mode */
 #define CPUIDEBX_STIBP_ALWAYSON	(1ULL << 17)	/* STIBP always on mode */
 #define CPUIDEBX_IBRS_PREF	(1ULL << 18)	/* IBRS preferred */
+#define CPUIDEBX_IBRS_SAME_MODE	(1ULL << 19)	/* IBRS not mode-specific */
 #define CPUIDEBX_SSBD		(1ULL << 24)	/* Speculation Control SSBD */
 #define CPUIDEBX_VIRT_SSBD	(1ULL << 25)	/* Virt Spec Control SSBD */
 #define CPUIDEBX_SSBD_NOTREQ	(1ULL << 26)	/* SSBD not required */
@@ -590,6 +592,7 @@
 #define MSR_DE_CFG	0xc0011029	/* Decode Configuration */
 #define	DE_CFG_721	0x00000001	/* errata 721 */
 #define DE_CFG_SERIALIZE_LFENCE	(1 << 1)	/* Enable serializing lfence */
+#define DE_CFG_SERIALIZE_9 (1 << 9)	/* Zenbleed chickenbit */
 
 #define IPM_C1E_CMP_HLT	0x10000000
 #define IPM_SMI_CMP_HLT	0x08000000
diff --git a/sys/arch/amd64/isa/clock.c b/sys/arch/amd64/isa/clock.c
index 44b221a11..019259ffd 100644
--- a/sys/arch/amd64/isa/clock.c
+++ b/sys/arch/amd64/isa/clock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: clock.c,v 1.39 2023/02/04 19:19:36 cheloha Exp $	*/
+/*	$OpenBSD: clock.c,v 1.40 2023/07/25 18:16:19 cheloha Exp $	*/
 /*	$NetBSD: clock.c,v 1.1 2003/04/26 18:39:50 fvdl Exp $	*/
 
 /*-
@@ -519,7 +519,6 @@ setstatclockrate(int arg)
 			mc146818_write(NULL, MC_REGA,
 			    MC_BASE_32_KHz | MC_RATE_1024_Hz);
 	}
-	clockintr_setstatclockrate(arg);
 }
 
 void
diff --git a/sys/arch/amd64/stand/boot/conf.c b/sys/arch/amd64/stand/boot/conf.c
index 00176599d..9e8a4a70d 100644
--- a/sys/arch/amd64/stand/boot/conf.c
+++ b/sys/arch/amd64/stand/boot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.56 2023/04/25 10:06:12 kn Exp $	*/
+/*	$OpenBSD: conf.c,v 1.57 2023/07/22 10:11:19 jsg Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -41,7 +41,7 @@
 #include <biosdev.h>
 #include <dev/cons.h>
 
-const char version[] = "3.56";
+const char version[] = "3.65";
 int	debug = 1;
 
 
diff --git a/sys/arch/amd64/stand/cdboot/conf.c b/sys/arch/amd64/stand/cdboot/conf.c
index 654825fd6..e8272bc42 100644
--- a/sys/arch/amd64/stand/cdboot/conf.c
+++ b/sys/arch/amd64/stand/cdboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.50 2023/04/25 10:06:12 kn Exp $	*/
+/*	$OpenBSD: conf.c,v 1.51 2023/07/22 10:11:19 jsg Exp $	*/
 
 /*
  * Copyright (c) 2004 Tom Cosgrove
@@ -42,7 +42,7 @@
 #include <biosdev.h>
 #include <dev/cons.h>
 
-const char version[] = "3.56";
+const char version[] = "3.65";
 int	debug = 1;
 
 
diff --git a/sys/arch/amd64/stand/efiboot/conf.c b/sys/arch/amd64/stand/efiboot/conf.c
index ff714754c..a7d10203b 100644
--- a/sys/arch/amd64/stand/efiboot/conf.c
+++ b/sys/arch/amd64/stand/efiboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.41 2023/04/25 10:11:20 kn Exp $	*/
+/*	$OpenBSD: conf.c,v 1.42 2023/07/22 10:11:19 jsg Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -40,7 +40,7 @@
 #include "efidev.h"
 #include "efipxe.h"
 
-const char version[] = "3.64";
+const char version[] = "3.65";
 
 #ifdef EFI_DEBUG
 int	debug = 0;
diff --git a/sys/arch/amd64/stand/efiboot/exec_i386.c b/sys/arch/amd64/stand/efiboot/exec_i386.c
index e5b410472..b84476a22 100644
--- a/sys/arch/amd64/stand/efiboot/exec_i386.c
+++ b/sys/arch/amd64/stand/efiboot/exec_i386.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exec_i386.c,v 1.10 2023/02/23 19:48:21 miod Exp $	*/
+/*	$OpenBSD: exec_i386.c,v 1.11 2023/07/22 10:11:19 jsg Exp $	*/
 
 /*
  * Copyright (c) 1997-1998 Michael Shalayeff
@@ -180,7 +180,8 @@ ucode_load(void)
 
 	CPUID(0, dummy, vendor[0], vendor[2], vendor[1]);
 	vendor[3] = 0; /* NULL-terminate */
-	if (strcmp((char *)vendor, "GenuineIntel") != 0)
+	if (strcmp((char *)vendor, "GenuineIntel") != 0 &&
+	    strcmp((char *)vendor, "AuthenticAMD") != 0)
 		return;
 
 	CPUID(1, signature, dummy, dummy, dummy);
@@ -192,8 +193,22 @@ ucode_load(void)
 	}
 	stepping = (signature >> 0) & 0x0f;
 
-	snprintf(path, sizeof(path), "%s:/etc/firmware/intel/%02x-%02x-%02x",
-	    cmd.bootdev, family, model, stepping);
+	if (strcmp((char *)vendor, "GenuineIntel") == 0) {
+		snprintf(path, sizeof(path),
+		    "%s:/etc/firmware/intel/%02x-%02x-%02x",
+		    cmd.bootdev, family, model, stepping);
+	} else if (strcmp((char *)vendor, "AuthenticAMD") == 0) {
+		if (family < 0x10)
+			return;
+		else if (family <= 0x14)
+			snprintf(path, sizeof(path),
+			    "%s:/etc/firmware/amd/microcode_amd.bin",
+			    cmd.bootdev);
+		else
+			snprintf(path, sizeof(path),
+			    "%s:/etc/firmware/amd/microcode_amd_fam%02xh.bin",
+			    cmd.bootdev, family);
+	}
 
 	fd = open(path, O_RDONLY);
 	if (fd == -1)
diff --git a/sys/arch/amd64/stand/libsa/exec_i386.c b/sys/arch/amd64/stand/libsa/exec_i386.c
index 1d2e14bf9..8dc0b924f 100644
--- a/sys/arch/amd64/stand/libsa/exec_i386.c
+++ b/sys/arch/amd64/stand/libsa/exec_i386.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exec_i386.c,v 1.37 2022/07/11 19:45:02 kettenis Exp $	*/
+/*	$OpenBSD: exec_i386.c,v 1.38 2023/07/22 10:11:19 jsg Exp $	*/
 
 /*
  * Copyright (c) 1997-1998 Michael Shalayeff
@@ -202,7 +202,8 @@ ucode_load(void)
 
 	CPUID(0, dummy, vendor[0], vendor[2], vendor[1]);
 	vendor[3] = 0; /* NULL-terminate */
-	if (strcmp((char *)vendor, "GenuineIntel") != 0)
+	if (strcmp((char *)vendor, "GenuineIntel") != 0 &&
+	    strcmp((char *)vendor, "AuthenticAMD") != 0)
 		return;
 
 	CPUID(1, signature, dummy, dummy, dummy);
@@ -214,8 +215,22 @@ ucode_load(void)
 	}
 	stepping = (signature >> 0) & 0x0f;
 
-	snprintf(path, sizeof(path), "%s:/etc/firmware/intel/%02x-%02x-%02x",
-	    cmd.bootdev, family, model, stepping);
+	if (strcmp((char *)vendor, "GenuineIntel") == 0) {
+		snprintf(path, sizeof(path),
+		    "%s:/etc/firmware/intel/%02x-%02x-%02x",
+		    cmd.bootdev, family, model, stepping);
+	} else if (strcmp((char *)vendor, "AuthenticAMD") == 0) {
+		if (family < 0x10)
+			return;
+		else if (family <= 0x14)
+			snprintf(path, sizeof(path),
+			    "%s:/etc/firmware/amd/microcode_amd.bin",
+			    cmd.bootdev);
+		else
+			snprintf(path, sizeof(path),
+			    "%s:/etc/firmware/amd/microcode_amd_fam%02xh.bin",
+			    cmd.bootdev, family);
+	}
 
 	fd = open(path, O_RDONLY);
 	if (fd == -1)
diff --git a/sys/arch/amd64/stand/pxeboot/conf.c b/sys/arch/amd64/stand/pxeboot/conf.c
index 290d50f00..791ba5f6b 100644
--- a/sys/arch/amd64/stand/pxeboot/conf.c
+++ b/sys/arch/amd64/stand/pxeboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.55 2023/04/25 10:06:12 kn Exp $	*/
+/*	$OpenBSD: conf.c,v 1.56 2023/07/22 10:11:20 jsg Exp $	*/
 
 /*
  * Copyright (c) 2004 Tom Cosgrove
@@ -44,7 +44,7 @@
 #include "pxeboot.h"
 #include "pxe_net.h"
 
-const char version[] = "3.56";
+const char version[] = "3.65";
 int	debug = 0;
 
 void (*sa_cleanup)(void) = pxe_shutdown;
diff --git a/sys/arch/arm/cortex/agtimer.c b/sys/arch/arm/cortex/agtimer.c
index 9ccf56fc3..13b0af6f8 100644
--- a/sys/arch/arm/cortex/agtimer.c
+++ b/sys/arch/arm/cortex/agtimer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: agtimer.c,v 1.17 2023/02/04 19:19:36 cheloha Exp $ */
+/* $OpenBSD: agtimer.c,v 1.18 2023/07/25 18:16:19 cheloha Exp $ */
 /*
  * Copyright (c) 2011 Dale Rahn <drahn@openbsd.org>
  * Copyright (c) 2013 Patrick Wildt <patrick@blueri.se>
@@ -288,7 +288,6 @@ agtimer_delay(u_int usecs)
 void
 agtimer_setstatclockrate(int newhz)
 {
-	clockintr_setstatclockrate(newhz);
 }
 
 void
diff --git a/sys/arch/arm/cortex/amptimer.c b/sys/arch/arm/cortex/amptimer.c
index 455d75e2a..6fcf49579 100644
--- a/sys/arch/arm/cortex/amptimer.c
+++ b/sys/arch/arm/cortex/amptimer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: amptimer.c,v 1.16 2023/02/04 19:19:36 cheloha Exp $ */
+/* $OpenBSD: amptimer.c,v 1.17 2023/07/25 18:16:19 cheloha Exp $ */
 /*
  * Copyright (c) 2011 Dale Rahn <drahn@openbsd.org>
  *
@@ -343,7 +343,6 @@ amptimer_delay(u_int usecs)
 void
 amptimer_setstatclockrate(int newhz)
 {
-	clockintr_setstatclockrate(newhz);
 }
 
 void
diff --git a/sys/arch/arm/include/cpu.h b/sys/arch/arm/include/cpu.h
index 84447cc52..9bc162dcc 100644
--- a/sys/arch/arm/include/cpu.h
+++ b/sys/arch/arm/include/cpu.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.h,v 1.62 2023/01/17 02:27:14 cheloha Exp $	*/
+/*	$OpenBSD: cpu.h,v 1.63 2023/07/25 18:16:19 cheloha Exp $	*/
 /*	$NetBSD: cpu.h,v 1.34 2003/06/23 11:01:08 martin Exp $	*/
 
 /*
@@ -198,6 +198,7 @@ struct cpu_info {
 
 #ifdef GPROF
 	struct gmonparam *ci_gmon;
+	struct clockintr *ci_gmonclock;
 #endif
 	struct clockintr_queue	ci_queue;
 	char			ci_panicbuf[512];
diff --git a/sys/arch/arm64/conf/GENERIC b/sys/arch/arm64/conf/GENERIC
index faa9ffb03..1f9b08cac 100644
--- a/sys/arch/arm64/conf/GENERIC
+++ b/sys/arch/arm64/conf/GENERIC
@@ -1,4 +1,4 @@
-# $OpenBSD: GENERIC,v 1.276 2023/07/19 20:27:20 kettenis Exp $
+# $OpenBSD: GENERIC,v 1.277 2023/07/22 22:43:53 patrick Exp $
 #
 # GENERIC machine description file
 #
@@ -346,6 +346,7 @@ qcpon*		at qcpmic?
 qcpwm*		at qcpmic?
 qcrng*		at fdt?
 qcrtc*		at qcpmic?
+qcsdam*		at qcpmic?
 
 # Sunxi SoCs
 sxipio*		at fdt? early 1	# GPIO pins for leds & PHYs
diff --git a/sys/arch/arm64/conf/RAMDISK b/sys/arch/arm64/conf/RAMDISK
index d278b8d83..8e49d98bb 100644
--- a/sys/arch/arm64/conf/RAMDISK
+++ b/sys/arch/arm64/conf/RAMDISK
@@ -1,4 +1,4 @@
-# $OpenBSD: RAMDISK,v 1.208 2023/07/19 20:27:20 kettenis Exp $
+# $OpenBSD: RAMDISK,v 1.209 2023/07/22 22:43:53 patrick Exp $
 
 machine		arm64
 maxusers	4
@@ -269,6 +269,7 @@ qcpon*		at qcpmic?
 qcpwm*		at qcpmic?
 qcrng*		at fdt?
 qcrtc*		at qcpmic?
+qcsdam*		at qcpmic?
 
 # Sunxi SoCs
 sxipio*		at fdt? early 1	# GPIO pins for leds & PHYs
diff --git a/sys/arch/arm64/dev/agtimer.c b/sys/arch/arm64/dev/agtimer.c
index d7909051d..08e93b4b0 100644
--- a/sys/arch/arm64/dev/agtimer.c
+++ b/sys/arch/arm64/dev/agtimer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: agtimer.c,v 1.22 2023/02/04 19:19:36 cheloha Exp $ */
+/* $OpenBSD: agtimer.c,v 1.23 2023/07/25 18:16:19 cheloha Exp $ */
 /*
  * Copyright (c) 2011 Dale Rahn <drahn@openbsd.org>
  * Copyright (c) 2013 Patrick Wildt <patrick@blueri.se>
@@ -354,7 +354,6 @@ agtimer_delay(u_int usecs)
 void
 agtimer_setstatclockrate(int newhz)
 {
-	clockintr_setstatclockrate(newhz);
 }
 
 void
diff --git a/sys/arch/arm64/dev/apldart.c b/sys/arch/arm64/dev/apldart.c
index b22ca3d3e..cc8c4b83e 100644
--- a/sys/arch/arm64/dev/apldart.c
+++ b/sys/arch/arm64/dev/apldart.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: apldart.c,v 1.16 2022/07/21 18:24:24 kettenis Exp $	*/
+/*	$OpenBSD: apldart.c,v 1.17 2023/07/23 11:47:20 kettenis Exp $	*/
 /*
  * Copyright (c) 2021 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -28,6 +28,7 @@
 
 #include <dev/ofw/openfirm.h>
 #include <dev/ofw/ofw_misc.h>
+#include <dev/ofw/ofw_power.h>
 #include <dev/ofw/fdt.h>
 
 /*
@@ -161,6 +162,8 @@ struct apldart_softc {
 
 	struct machine_bus_dma_tag sc_bus_dmat;
 	struct iommu_device	sc_id;
+
+	int			sc_do_suspend;
 };
 
 struct apldart_map_state {
@@ -187,9 +190,11 @@ void	apldart_dmamem_free(bus_dma_tag_t, struct apldart_dmamem *);
 
 int	apldart_match(struct device *, void *, void *);
 void	apldart_attach(struct device *, struct device *, void *);
+int	apldart_activate(struct device *, int);
 
 const struct cfattach apldart_ca = {
-	sizeof (struct apldart_softc), apldart_match, apldart_attach
+	sizeof (struct apldart_softc), apldart_match, apldart_attach, NULL,
+	apldart_activate
 };
 
 struct cfdriver apldart_cd = {
@@ -255,8 +260,10 @@ apldart_attach(struct device *parent, struct device *self, void *aux)
 	}
 
 	sc->sc_dmat = faa->fa_dmat;
-
 	sc->sc_node = faa->fa_node;
+
+	power_domain_enable(sc->sc_node);
+
 	if (OF_is_compatible(sc->sc_node, "apple,t8110-dart")) {
 		params4 = HREAD4(sc, DART_T8110_PARAMS4);
 		sc->sc_nsid = params4 & DART_T8110_PARAMS4_NSID_MASK;
@@ -321,6 +328,11 @@ apldart_attach(struct device *parent, struct device *self, void *aux)
 		}
 	}
 
+	/*
+	 * We have full control over this DART, so do suspend it.
+	 */
+	sc->sc_do_suspend = 1;
+
 	/*
 	 * Use bypass mode if supported.  This avoids an issue with
 	 * the USB3 controllers which need mappings entered into two
@@ -433,6 +445,83 @@ apldart_attach(struct device *parent, struct device *self, void *aux)
 	iommu_device_register(&sc->sc_id);
 }
 
+void
+apldart_suspend(struct apldart_softc *sc)
+{
+	if (!sc->sc_do_suspend)
+		return;
+
+	power_domain_disable(sc->sc_node);
+}
+
+void
+apldart_resume(struct apldart_softc *sc)
+{
+	paddr_t pa;
+	int ntte, nl1, nl2;
+	uint32_t params2;
+	int sid, idx;
+
+	if (!sc->sc_do_suspend)
+		return;
+
+	power_domain_enable(sc->sc_node);
+
+	params2 = HREAD4(sc, DART_PARAMS2);
+	if (params2 & DART_PARAMS2_BYPASS_SUPPORT) {
+		for (sid = 0; sid < sc->sc_nsid; sid++)
+			HWRITE4(sc, DART_TCR(sc, sid), sc->sc_tcr_bypass);
+		return;
+	}
+
+	ntte = howmany(sc->sc_dvaend, DART_PAGE_SIZE);
+	nl2 = howmany(ntte, DART_PAGE_SIZE / sizeof(uint64_t));
+	nl1 = howmany(nl2, DART_PAGE_SIZE / sizeof(uint64_t));
+
+	/* Install page tables. */
+	for (sid = 0; sid < sc->sc_nsid; sid++) {
+		pa = APLDART_DMA_DVA(sc->sc_l1);
+		for (idx = 0; idx < nl1; idx++) {
+			HWRITE4(sc, DART_TTBR(sc, sid, idx),
+			    (pa >> DART_TTBR_SHIFT) | sc->sc_ttbr_valid);
+			pa += DART_PAGE_SIZE;
+		}
+	}
+	sc->sc_flush_tlb(sc);
+
+	/* Enable all streams. */
+	for (idx = 0; idx < howmany(sc->sc_nsid, 32); idx++)
+		HWRITE4(sc, DART_SID_ENABLE(sc, idx), ~0);
+
+	/* Enable translations. */
+	for (sid = 0; sid < sc->sc_nsid; sid++)
+		HWRITE4(sc, DART_TCR(sc, sid), sc->sc_tcr_translate_enable);
+
+	if (OF_is_compatible(sc->sc_node, "apple,t8110-dart")) {
+		HWRITE4(sc, DART_T8110_ERROR, HREAD4(sc, DART_T8110_ERROR));
+		HWRITE4(sc, DART_T8110_ERROR_MASK, 0);
+	} else {
+		HWRITE4(sc, DART_T8020_ERROR, HREAD4(sc, DART_T8020_ERROR));
+	}
+}
+
+int
+apldart_activate(struct device *self, int act)
+{
+	struct apldart_softc *sc = (struct apldart_softc *)self;
+
+	switch (act) {
+	case DVACT_SUSPEND:
+		apldart_suspend(sc);
+		break;
+	case DVACT_RESUME:
+		apldart_resume(sc);
+		break;
+	}
+
+	return 0;
+}
+
 bus_dma_tag_t
 apldart_map(void *cookie, uint32_t *cells, bus_dma_tag_t dmat)
 {
diff --git a/sys/arch/arm64/dev/apldma.c b/sys/arch/arm64/dev/apldma.c
index d672488dc..62a36a20f 100644
--- a/sys/arch/arm64/dev/apldma.c
+++ b/sys/arch/arm64/dev/apldma.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: apldma.c,v 1.5 2022/11/26 21:35:22 kettenis Exp $	*/
+/*	$OpenBSD: apldma.c,v 1.6 2023/07/26 11:09:24 kettenis Exp $	*/
 /*
  * Copyright (c) 2022 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -110,9 +110,11 @@ struct apldma_softc *apldma_sc;
 
 int	apldma_match(struct device *, void *, void *);
 void	apldma_attach(struct device *, struct device *, void *);
+int	apldma_activate(struct device *, int);
 
 const struct cfattach apldma_ca = {
-	sizeof (struct apldma_softc), apldma_match, apldma_attach
+	sizeof (struct apldma_softc), apldma_match, apldma_attach, NULL,
+	apldma_activate
 };
 
 struct cfdriver apldma_cd = {
@@ -197,6 +199,23 @@ unmap:
 	bus_space_unmap(sc->sc_iot, sc->sc_ioh, faa->fa_reg[0].size);
 }
 
+int
+apldma_activate(struct device *self, int act)
+{
+	struct apldma_softc *sc = (struct apldma_softc *)self;
+
+	switch (act) {
+	case DVACT_SUSPEND:
+		power_domain_disable(sc->sc_node);
+		break;
+	case DVACT_RESUME:
+		power_domain_enable(sc->sc_node);
+		break;
+	}
+
+	return 0;
+}
+
 void
 apldma_fill_descriptors(struct apldma_channel *ac)
 {
diff --git a/sys/arch/arm64/dev/aplmbox.c b/sys/arch/arm64/dev/aplmbox.c
index 343730039..86dccd247 100644
--- a/sys/arch/arm64/dev/aplmbox.c
+++ b/sys/arch/arm64/dev/aplmbox.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aplmbox.c,v 1.5 2022/12/21 22:30:42 kettenis Exp $	*/
+/*	$OpenBSD: aplmbox.c,v 1.6 2023/07/23 11:17:49 kettenis Exp $	*/
 /*
  * Copyright (c) 2021 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -25,6 +25,7 @@
 
 #include <dev/ofw/openfirm.h>
 #include <dev/ofw/ofw_misc.h>
+#include <dev/ofw/ofw_power.h>
 #include <dev/ofw/fdt.h>
 
 #include <arm64/dev/aplmbox.h>
@@ -111,6 +112,8 @@ aplmbox_attach(struct device *parent, struct device *self, void *aux)
 
 	printf("\n");
 
+	power_domain_enable(faa->fa_node);
+
 	sc->sc_md.md_node = faa->fa_node;
 	sc->sc_md.md_cookie = sc;
 	sc->sc_md.md_channel = aplmbox_channel;
diff --git a/sys/arch/arm64/dev/aplmca.c b/sys/arch/arm64/dev/aplmca.c
index 88cb4358b..95da05e47 100644
--- a/sys/arch/arm64/dev/aplmca.c
+++ b/sys/arch/arm64/dev/aplmca.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aplmca.c,v 1.6 2023/02/03 13:20:21 kettenis Exp $	*/
+/*	$OpenBSD: aplmca.c,v 1.7 2023/07/26 11:09:24 kettenis Exp $	*/
 /*
  * Copyright (c) 2022 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -152,9 +152,11 @@ const struct audio_hw_if aplmca_hw_if = {
 
 int	aplmca_match(struct device *, void *, void *);
 void	aplmca_attach(struct device *, struct device *, void *);
+int	aplmca_activate(struct device *, int);
 
 const struct cfattach aplmca_ca = {
-	sizeof (struct aplmca_softc), aplmca_match, aplmca_attach
+	sizeof (struct aplmca_softc), aplmca_match, aplmca_attach, NULL,
+	aplmca_activate
 };
 
 struct cfdriver aplmca_cd = {
@@ -223,6 +225,32 @@ aplmca_attach(struct device *parent, struct device *self, void *aux)
 	}
 }
 
+int
+aplmca_activate(struct device *self, int act)
+{
+	struct aplmca_softc *sc = (struct aplmca_softc *)self;
+	int i;
+
+	switch (act) {
+	case DVACT_SUSPEND:
+		for (i = 0; i < sc->sc_nclusters; i++) {
+			if (sc->sc_ad[i].ad_ac)
+				power_domain_disable_idx(sc->sc_node, i + 1);
+		}
+		power_domain_disable_idx(sc->sc_node, 0);
+		break;
+	case DVACT_RESUME:
+		power_domain_enable_idx(sc->sc_node, 0);
+		for (i = 0; i < sc->sc_nclusters; i++) {
+			if (sc->sc_ad[i].ad_ac)
+				power_domain_enable_idx(sc->sc_node, i + 1);
+		}
+		break;
+	}
+
+	return 0;
+}
+
 int
 aplmca_dai_init(struct aplmca_softc *sc, int port)
 {
diff --git a/sys/arch/arm64/dev/aplpinctrl.c b/sys/arch/arm64/dev/aplpinctrl.c
index e6c680cd0..9f65bca8b 100644
--- a/sys/arch/arm64/dev/aplpinctrl.c
+++ b/sys/arch/arm64/dev/aplpinctrl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aplpinctrl.c,v 1.7 2023/03/23 11:40:42 jsg Exp $	*/
+/*	$OpenBSD: aplpinctrl.c,v 1.8 2023/07/23 11:17:50 kettenis Exp $	*/
 /*
  * Copyright (c) 2021 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -28,6 +28,7 @@
 #include <dev/ofw/openfirm.h>
 #include <dev/ofw/ofw_gpio.h>
 #include <dev/ofw/ofw_pinctrl.h>
+#include <dev/ofw/ofw_power.h>
 #include <dev/ofw/fdt.h>
 
 #define APPLE_PIN(pinmux) ((pinmux) & 0xffff)
@@ -136,6 +137,8 @@ aplpinctrl_attach(struct device *parent, struct device *self, void *aux)
 		return;
 	}
 
+	power_domain_enable(faa->fa_node);
+
 	pinctrl_register(faa->fa_node, aplpinctrl_pinctrl, sc);
 
 	OF_getpropintarray(faa->fa_node, "gpio-ranges",
diff --git a/sys/arch/arm64/dev/aplspi.c b/sys/arch/arm64/dev/aplspi.c
index 248bf28ed..4ac110de2 100644
--- a/sys/arch/arm64/dev/aplspi.c
+++ b/sys/arch/arm64/dev/aplspi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aplspi.c,v 1.4 2022/04/06 18:59:26 naddy Exp $	*/
+/*	$OpenBSD: aplspi.c,v 1.5 2023/07/23 11:17:50 kettenis Exp $	*/
 /*
  * Copyright (c) 2021 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -30,6 +30,7 @@
 #include <dev/ofw/ofw_clock.h>
 #include <dev/ofw/ofw_gpio.h>
 #include <dev/ofw/ofw_pinctrl.h>
+#include <dev/ofw/ofw_power.h>
 #include <dev/ofw/fdt.h>
 
 #define SPI_CLKCFG		0x00
@@ -147,6 +148,7 @@ aplspi_attach(struct device *parent, struct device *self, void *aux)
 
 	sc->sc_pfreq = clock_get_frequency(sc->sc_node, NULL);
 
+	power_domain_enable(sc->sc_node);
 	pinctrl_byname(sc->sc_node, "default");
 
 	/* Configure CS# pin for manual control. */
diff --git a/sys/arch/arm64/include/cpu.h b/sys/arch/arm64/include/cpu.h
index 36d2d40ac..ab9fdcb37 100644
--- a/sys/arch/arm64/include/cpu.h
+++ b/sys/arch/arm64/include/cpu.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: cpu.h,v 1.37 2023/07/13 08:33:36 kettenis Exp $ */
+/* $OpenBSD: cpu.h,v 1.38 2023/07/25 18:16:20 cheloha Exp $ */
 /*
  * Copyright (c) 2016 Dale Rahn <drahn@dalerahn.com>
  *
@@ -172,6 +172,7 @@ struct cpu_info {
 
 #ifdef GPROF
 	struct gmonparam	*ci_gmon;
+	struct clockintr	*ci_gmonclock;
 #endif
 	struct clockintr_queue	ci_queue;
 	char			ci_panicbuf[512];
diff --git a/sys/arch/armv7/omap/dmtimer.c b/sys/arch/armv7/omap/dmtimer.c
index e6ed6beeb..b1dfcb48c 100644
--- a/sys/arch/armv7/omap/dmtimer.c
+++ b/sys/arch/armv7/omap/dmtimer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dmtimer.c,v 1.18 2023/02/04 19:19:36 cheloha Exp $	*/
+/*	$OpenBSD: dmtimer.c,v 1.19 2023/07/25 18:16:19 cheloha Exp $	*/
 /*
  * Copyright (c) 2007,2009 Dale Rahn <drahn@openbsd.org>
  * Copyright (c) 2013 Raphael Graf <r@undefined.ch>
@@ -317,7 +317,6 @@ dmtimer_delay(u_int usecs)
 void
 dmtimer_setstatclockrate(int newhz)
 {
-	clockintr_setstatclockrate(newhz);
 }
 
 
diff --git a/sys/arch/armv7/omap/gptimer.c b/sys/arch/armv7/omap/gptimer.c
index 8a5f1be62..ee9fa842a 100644
--- a/sys/arch/armv7/omap/gptimer.c
+++ b/sys/arch/armv7/omap/gptimer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gptimer.c,v 1.19 2023/02/04 19:19:36 cheloha Exp $ */
+/* $OpenBSD: gptimer.c,v 1.20 2023/07/25 18:16:19 cheloha Exp $ */
 /*
  * Copyright (c) 2007,2009 Dale Rahn <drahn@openbsd.org>
  *
@@ -326,7 +326,6 @@ gptimer_delay(u_int usecs)
 void
 gptimer_setstatclockrate(int newhz)
 {
-	clockintr_setstatclockrate(newhz);
 }
 
 
diff --git a/sys/arch/armv7/sunxi/sxitimer.c b/sys/arch/armv7/sunxi/sxitimer.c
index 94af5c85f..a0db9b62d 100644
--- a/sys/arch/armv7/sunxi/sxitimer.c
+++ b/sys/arch/armv7/sunxi/sxitimer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sxitimer.c,v 1.20 2023/02/04 19:19:36 cheloha Exp $	*/
+/*	$OpenBSD: sxitimer.c,v 1.21 2023/07/25 18:16:19 cheloha Exp $	*/
 /*
  * Copyright (c) 2007,2009 Dale Rahn <drahn@openbsd.org>
  * Copyright (c) 2013 Raphael Graf <r@undefined.ch>
@@ -299,7 +299,6 @@ sxitimer_delay(u_int usecs)
 void
 sxitimer_setstatclockrate(int newhz)
 {
-	clockintr_setstatclockrate(newhz);
 }
 
 u_int
diff --git a/sys/arch/i386/i386/machdep.c b/sys/arch/i386/i386/machdep.c
index 483d4bfd9..164ee8bd1 100644
--- a/sys/arch/i386/i386/machdep.c
+++ b/sys/arch/i386/i386/machdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: machdep.c,v 1.663 2023/01/30 10:49:05 jsg Exp $	*/
+/*	$OpenBSD: machdep.c,v 1.665 2023/07/25 04:42:02 deraadt Exp $	*/
 /*	$NetBSD: machdep.c,v 1.214 1996/11/10 03:16:17 thorpej Exp $	*/
 
 /*-
@@ -1639,6 +1639,7 @@ identifycpu(struct cpu_info *ci)
 	char *cpu_device = ci->ci_dev->dv_xname;
 	int skipspace;
 	extern uint32_t cpu_meltdown;
+	uint64_t msr, nmsr;
 
 	if (cpuid_level == -1) {
 		name = "486DX";
@@ -1987,13 +1988,17 @@ identifycpu(struct cpu_info *ci)
 	 */
 	if (!strcmp(cpu_vendor, "AuthenticAMD")) {
 		if (ci->ci_family >= 0x10 && ci->ci_family != 0x11) {
-			uint64_t msr;
-
-			msr = rdmsr(MSR_DE_CFG);
-			if ((msr & DE_CFG_SERIALIZE_LFENCE) == 0) {
-				msr |= DE_CFG_SERIALIZE_LFENCE;
-				wrmsr(MSR_DE_CFG, msr);
-			}
+			nmsr = msr = rdmsr(MSR_DE_CFG);
+			nmsr |= DE_CFG_SERIALIZE_LFENCE;
+			if (msr != nmsr)
+				wrmsr(MSR_DE_CFG, nmsr);
+		}
+		if (family == 0x17 && ci->ci_model >= 0x31 &&
+		    (cpu_ecxfeature & CPUIDECX_HV) == 0) {
+			nmsr = msr = rdmsr(MSR_DE_CFG);
+			nmsr |= DE_CFG_SERIALIZE_9;
+			if (msr != nmsr)
+				wrmsr(MSR_DE_CFG, nmsr);
 		}
 	}
 
diff --git a/sys/arch/i386/i386/ucode.c b/sys/arch/i386/i386/ucode.c
index 7a0060ca7..53f76211e 100644
--- a/sys/arch/i386/i386/ucode.c
+++ b/sys/arch/i386/i386/ucode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ucode.c,v 1.3 2020/12/15 22:51:34 kettenis Exp $	*/
+/*	$OpenBSD: ucode.c,v 1.4 2023/07/23 02:59:53 jsg Exp $	*/
 /*
  * Copyright (c) 2018 Stefan Fritsch <fritsch@genua.de>
  * Copyright (c) 2018 Patrick Wildt <patrick@blueri.se>
@@ -72,6 +72,8 @@ size_t	 cpu_ucode_size;
 void	 cpu_ucode_setup(void);
 void	 cpu_ucode_apply(struct cpu_info *);
 
+struct mutex	cpu_ucode_mtx = MUTEX_INITIALIZER(IPL_HIGH);
+
 /* Intel */
 void	 cpu_ucode_intel_apply(struct cpu_info *);
 struct intel_ucode_header *
@@ -82,7 +84,8 @@ int	 cpu_ucode_intel_match(struct intel_ucode_header *, uint32_t, uint32_t,
 uint32_t cpu_ucode_intel_rev(void);
 
 struct intel_ucode_header	*cpu_ucode_intel_applied;
-struct mutex			 cpu_ucode_intel_mtx = MUTEX_INITIALIZER(IPL_HIGH);
+
+void cpu_ucode_amd_apply(struct cpu_info *);
 
 void
 cpu_ucode_setup(void)
@@ -130,6 +133,99 @@ cpu_ucode_apply(struct cpu_info *ci)
 {
 	if (strcmp(cpu_vendor, "GenuineIntel") == 0)
 		cpu_ucode_intel_apply(ci);
+	else if (strcmp(cpu_vendor, "AuthenticAMD") == 0)
+		cpu_ucode_amd_apply(ci);
+}
+
+#define AMD_MAGIC 0x00414d44
+
+struct amd_equiv {
+	uint32_t id;
+	uint32_t a;
+	uint32_t b;
+	uint16_t eid;
+	uint16_t c;
+} __packed;
+
+struct amd_patch {
+	uint32_t type;
+	uint32_t len;
+	uint32_t a;
+	uint32_t level;
+	uint8_t c[16];
+	uint16_t eid;
+} __packed;
+
+void
+cpu_ucode_amd_apply(struct cpu_info *ci)
+{
+	uint64_t level;
+	uint32_t magic, tlen, i;
+	uint16_t eid = 0;
+	uint32_t sig, ebx, ecx, edx;
+	uint64_t start = 0;
+
+	if (cpu_ucode_data == NULL || cpu_ucode_size == 0) {
+		DPRINTF(("%s: no microcode provided\n", __func__));
+		return;
+	}
+
+	/*
+	 * Grab a mutex, because we are not allowed to run updates
+	 * simultaneously on HT siblings.
+	 */
+	mtx_enter(&cpu_ucode_mtx);
+
+	CPUID(1, sig, ebx, ecx, edx);
+
+	level = rdmsr(MSR_PATCH_LEVEL);
+	DPRINTF(("%s: cur patch level 0x%llx\n", __func__, level));
+
+	memcpy(&magic, cpu_ucode_data, 4);
+	if (magic != AMD_MAGIC) {
+		DPRINTF(("%s: bad magic %x\n", __func__, magic));
+		goto out;
+	}
+
+	memcpy(&tlen, &cpu_ucode_data[8], 4);
+
+	/* find equivalence id matching our cpu signature */
+	for (i = 12; i < 12 + tlen;) {
+		struct amd_equiv ae;
+		if (i + sizeof(ae) > cpu_ucode_size) {
+			DPRINTF(("%s: truncated etable\n", __func__));
+			goto out;
+		}
+		memcpy(&ae, &cpu_ucode_data[i], sizeof(ae));
+		i += sizeof(ae);
+		if (ae.id == sig)
+			eid = ae.eid;
+	}
+
+	/* look for newer patch with the equivalence id */
+	while (i < cpu_ucode_size) {
+		struct amd_patch ap;
+		if (i + sizeof(ap) > cpu_ucode_size) {
+			DPRINTF(("%s: truncated ptable\n", __func__));
+			goto out;
+		}
+		memcpy(&ap, &cpu_ucode_data[i], sizeof(ap));
+		if (ap.type == 1 && ap.eid == eid && ap.level > level)
+			start = (uint64_t)&cpu_ucode_data[i + 8];
+		if (i + ap.len + 8 > cpu_ucode_size) {
+			DPRINTF(("%s: truncated patch\n", __func__));
+			goto out;
+		}
+		i += ap.len + 8;
+	}
+
+	if (start != 0) {
+		wrmsr(MSR_PATCH_LOADER, start);
+		level = rdmsr(MSR_PATCH_LEVEL);
+		DPRINTF(("%s: new patch level 0x%llx\n", __func__, level));
+	}
+out:
+	mtx_leave(&cpu_ucode_mtx);
 }
 
 void
@@ -148,7 +244,7 @@ cpu_ucode_intel_apply(struct cpu_info *ci)
 	 * Grab a mutex, because we are not allowed to run updates
 	 * simultaneously on HT siblings.
 	 */
-	mtx_enter(&cpu_ucode_intel_mtx);
+	mtx_enter(&cpu_ucode_mtx);
 
 	old_rev = cpu_ucode_intel_rev();
 	update = cpu_ucode_intel_applied;
@@ -182,7 +278,7 @@ cpu_ucode_intel_apply(struct cpu_info *ci)
 	}
 
 out:
-	mtx_leave(&cpu_ucode_intel_mtx);
+	mtx_leave(&cpu_ucode_mtx);
 }
 
 struct intel_ucode_header *
diff --git a/sys/arch/i386/include/cpu.h b/sys/arch/i386/include/cpu.h
index 34d2a625f..6f068fa5a 100644
--- a/sys/arch/i386/include/cpu.h
+++ b/sys/arch/i386/include/cpu.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.h,v 1.181 2022/12/06 01:56:44 cheloha Exp $	*/
+/*	$OpenBSD: cpu.h,v 1.182 2023/07/25 18:16:20 cheloha Exp $	*/
 /*	$NetBSD: cpu.h,v 1.35 1996/05/05 19:29:26 christos Exp $	*/
 
 /*-
@@ -168,6 +168,7 @@ struct cpu_info {
 	struct ksensor		ci_sensor;
 #if defined(GPROF) || defined(DDBPROF)
 	struct gmonparam	*ci_gmon;
+	struct clockintr	*ci_gmonclock;
 #endif
 	struct clockintr_queue	ci_queue;
 	char			ci_panicbuf[512];
diff --git a/sys/arch/i386/include/specialreg.h b/sys/arch/i386/include/specialreg.h
index fd039fd31..5b8edc0f9 100644
--- a/sys/arch/i386/include/specialreg.h
+++ b/sys/arch/i386/include/specialreg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: specialreg.h,v 1.82 2023/07/21 04:04:52 guenther Exp $	*/
+/*	$OpenBSD: specialreg.h,v 1.83 2023/07/24 14:54:00 deraadt Exp $	*/
 /*	$NetBSD: specialreg.h,v 1.7 1994/10/27 04:16:26 cgd Exp $	*/
 
 /*-
@@ -529,6 +529,7 @@
 #define MSR_DE_CFG	0xc0011029		/* Decode Configuration */
 #define	DE_CFG_721	0x00000001	/* errata 721 */
 #define	DE_CFG_SERIALIZE_LFENCE	(1 << 1)	/* Enable serializing lfence */
+#define DE_CFG_SERIALIZE_9 (1 << 9)		/* Zenbleed chickenbit */
 
 #define IPM_C1E_CMP_HLT	0x10000000
 #define IPM_SMI_CMP_HLT	0x08000000
diff --git a/sys/arch/i386/isa/clock.c b/sys/arch/i386/isa/clock.c
index c449323e7..1472623d5 100644
--- a/sys/arch/i386/isa/clock.c
+++ b/sys/arch/i386/isa/clock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: clock.c,v 1.64 2023/02/04 19:19:36 cheloha Exp $	*/
+/*	$OpenBSD: clock.c,v 1.65 2023/07/25 18:16:20 cheloha Exp $	*/
 /*	$NetBSD: clock.c,v 1.39 1996/05/12 23:11:54 mycroft Exp $	*/
 
 /*-
@@ -663,7 +663,6 @@ setstatclockrate(int arg)
 			mc146818_write(NULL, MC_REGA,
 			    MC_BASE_32_KHz | MC_RATE_1024_Hz);
 	}
-	clockintr_setstatclockrate(arg);
 }
 
 void
diff --git a/sys/arch/i386/stand/boot/conf.c b/sys/arch/i386/stand/boot/conf.c
index 28524e55a..082480a01 100644
--- a/sys/arch/i386/stand/boot/conf.c
+++ b/sys/arch/i386/stand/boot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.77 2023/04/25 14:48:16 kn Exp $	*/
+/*	$OpenBSD: conf.c,v 1.78 2023/07/22 10:11:20 jsg Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -42,7 +42,7 @@
 #include <dev/cons.h>
 #include "debug.h"
 
-const char version[] = "3.45";
+const char version[] = "3.65";
 int	debug = 1;
 
 
diff --git a/sys/arch/i386/stand/cdboot/conf.c b/sys/arch/i386/stand/cdboot/conf.c
index aa2e9a360..77af9c8a3 100644
--- a/sys/arch/i386/stand/cdboot/conf.c
+++ b/sys/arch/i386/stand/cdboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.44 2023/04/25 14:48:17 kn Exp $	*/
+/*	$OpenBSD: conf.c,v 1.45 2023/07/22 10:11:20 jsg Exp $	*/
 
 /*
  * Copyright (c) 2004 Tom Cosgrove
@@ -43,7 +43,7 @@
 #include <dev/cons.h>
 #include "debug.h"
 
-const char version[] = "3.45";
+const char version[] = "3.65";
 int	debug = 1;
 
 void (*sa_cleanup)(void) = NULL;
diff --git a/sys/arch/i386/stand/libsa/exec_i386.c b/sys/arch/i386/stand/libsa/exec_i386.c
index d9e4da9db..9bf8463ed 100644
--- a/sys/arch/i386/stand/libsa/exec_i386.c
+++ b/sys/arch/i386/stand/libsa/exec_i386.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exec_i386.c,v 1.52 2022/07/07 00:56:47 daniel Exp $	*/
+/*	$OpenBSD: exec_i386.c,v 1.53 2023/07/22 10:11:20 jsg Exp $	*/
 
 /*
  * Copyright (c) 1997-1998 Michael Shalayeff
@@ -190,7 +190,8 @@ ucode_load(void)
 
 	CPUID(0, dummy, vendor[0], vendor[2], vendor[1]);
 	vendor[3] = 0; /* NULL-terminate */
-	if (strcmp((char *)vendor, "GenuineIntel") != 0)
+	if (strcmp((char *)vendor, "GenuineIntel") != 0 &&
+	    strcmp((char *)vendor, "AuthenticAMD") != 0)
 		return;
 
 	CPUID(1, signature, dummy, dummy, dummy);
@@ -202,8 +203,22 @@ ucode_load(void)
 	}
 	stepping = (signature >> 0) & 0x0f;
 
-	snprintf(path, sizeof(path), "%s:/etc/firmware/intel/%02x-%02x-%02x",
-	    cmd.bootdev, family, model, stepping);
+	if (strcmp((char *)vendor, "GenuineIntel") == 0) {
+		snprintf(path, sizeof(path),
+		    "%s:/etc/firmware/intel/%02x-%02x-%02x",
+		    cmd.bootdev, family, model, stepping);
+	} else if (strcmp((char *)vendor, "AuthenticAMD") == 0) {
+		if (family < 0x10)
+			return;
+		else if (family <= 0x14)
+			snprintf(path, sizeof(path),
+			    "%s:/etc/firmware/amd/microcode_amd.bin",
+			    cmd.bootdev);
+		else
+			snprintf(path, sizeof(path),
+			    "%s:/etc/firmware/amd/microcode_amd_fam%02xh.bin",
+			    cmd.bootdev, family);
+	}
 
 	fd = open(path, O_RDONLY);
 	if (fd == -1)
diff --git a/sys/arch/i386/stand/libsa/pciprobe.c b/sys/arch/i386/stand/libsa/pciprobe.c
index 6ce15036d..0874d904e 100644
--- a/sys/arch/i386/stand/libsa/pciprobe.c
+++ b/sys/arch/i386/stand/libsa/pciprobe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pciprobe.c,v 1.10 2014/03/29 18:09:29 guenther Exp $	*/
+/*	$OpenBSD: pciprobe.c,v 1.11 2023/07/24 14:02:36 jsg Exp $	*/
 
 /*
  * Copyright (c) 1997 Tobias Weingartner
@@ -39,12 +39,12 @@ pciprobe(void)
 {
 	bios_pciinfo_t bpi;
 	u_int32_t hw_chars, rev, rc, sig;
-	u_int32_t entry32;
+	u_int32_t entry32, lastbus;
 
 	/* PCI BIOS v2.0c+ - Installation Check */
-	__asm volatile(DOINT(0x1A) "; shll $8,%2; setc %b2"
-		: "=a" (hw_chars), "=b" (rev), "=c" (rc),
-		  "=d" (sig), "=D" (entry32)
+	__asm volatile(DOINT(0x1A)
+		: "=a" (hw_chars), "=b" (rev), "=c" (lastbus),
+		  "=d" (sig), "=D" (entry32), "=@ccc" (rc)
 		: "0" (0xB101), "4" (0x0)
 		: "cc");
 
@@ -62,7 +62,7 @@ pciprobe(void)
 	bpi.pci_chars = hw_chars & 0xFFFF;
 	bpi.pci_rev = rev & 0xFFFF;
 	bpi.pci_entry32 = entry32;
-	bpi.pci_lastbus = (rc>>8) & 0xFF;
+	bpi.pci_lastbus = lastbus & 0xFF;
 
 	addbootarg(BOOTARG_PCIINFO, sizeof(bios_pciinfo_t), &bpi);
 }
diff --git a/sys/arch/i386/stand/pxeboot/conf.c b/sys/arch/i386/stand/pxeboot/conf.c
index 90c7f797e..145db61c5 100644
--- a/sys/arch/i386/stand/pxeboot/conf.c
+++ b/sys/arch/i386/stand/pxeboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.49 2023/04/25 14:48:17 kn Exp $	*/
+/*	$OpenBSD: conf.c,v 1.50 2023/07/22 10:11:20 jsg Exp $	*/
 
 /*
  * Copyright (c) 2004 Tom Cosgrove
@@ -45,7 +45,7 @@
 #include "pxeboot.h"
 #include "pxe_net.h"
 
-const char version[] = "3.45";
+const char version[] = "3.65";
 int	debug = 1;
 
 void (*sa_cleanup)(void) = pxe_shutdown;
diff --git a/sys/dev/fdt/exuart.c b/sys/dev/fdt/exuart.c
index 34d5df599..a48060eb7 100644
--- a/sys/dev/fdt/exuart.c
+++ b/sys/dev/fdt/exuart.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: exuart.c,v 1.11 2022/07/02 08:50:42 visa Exp $ */
+/* $OpenBSD: exuart.c,v 1.12 2023/07/23 11:16:36 kettenis Exp $ */
 /*
  * Copyright (c) 2005 Dale Rahn <drahn@motorola.com>
  *
@@ -40,6 +40,7 @@
 #include <dev/fdt/exuartreg.h>
 
 #include <dev/ofw/openfirm.h>
+#include <dev/ofw/ofw_power.h>
 #include <dev/ofw/fdt.h>
 
 #define DEVUNIT(x)      (minor(x) & 0x7f)
@@ -210,6 +211,10 @@ exuart_attach(struct device *parent, struct device *self, void *aux)
 		printf(": console");
 	}
 
+	printf("\n");
+
+	power_domain_enable(faa->fa_node);
+
 	if (OF_is_compatible(faa->fa_node, "apple,s5l-uart")) {
 		sc->sc_type = EXUART_TYPE_S5L;
 		sc->sc_rx_fifo_cnt_mask = EXUART_S5L_UFSTAT_RX_FIFO_CNT_MASK;
@@ -270,8 +275,6 @@ exuart_attach(struct device *parent, struct device *self, void *aux)
 	if(sc->sc_si == NULL)
 		panic("%s: can't establish soft interrupt.",
 		    sc->sc_dev.dv_xname);
-
-	printf("\n");
 }
 
 void
diff --git a/sys/dev/fdt/files.fdt b/sys/dev/fdt/files.fdt
index 911997b96..cc77f757d 100644
--- a/sys/dev/fdt/files.fdt
+++ b/sys/dev/fdt/files.fdt
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.fdt,v 1.195 2023/07/01 16:34:30 drahn Exp $
+#	$OpenBSD: files.fdt,v 1.196 2023/07/22 22:43:53 patrick Exp $
 #
 # Config file and device description for machine-independent FDT code.
 # Included by ports that need it.
@@ -761,6 +761,11 @@ device	qcrtc
 attach	qcrtc at spmi
 file	dev/fdt/qcrtc.c			qcrtc
 
+# Qualcomm PMIC Shared Direct Access Memory
+device	qcsdam
+attach	qcsdam at spmi
+file	dev/fdt/qcsdam.c		qcsdam
+
 # TI TPS6598x Type-C controller
 device	tipd
 attach	tipd at i2c
diff --git a/sys/dev/fdt/qcrtc.c b/sys/dev/fdt/qcrtc.c
index bc1e78dbc..22783cd82 100644
--- a/sys/dev/fdt/qcrtc.c
+++ b/sys/dev/fdt/qcrtc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qcrtc.c,v 1.2 2023/01/16 20:12:38 patrick Exp $	*/
+/*	$OpenBSD: qcrtc.c,v 1.3 2023/07/22 22:48:35 patrick Exp $	*/
 /*
  * Copyright (c) 2022 Patrick Wildt <patrick@blueri.se>
  *
@@ -25,6 +25,7 @@
 #include <dev/fdt/spmivar.h>
 
 #include <dev/ofw/openfirm.h>
+#include <dev/ofw/ofw_misc.h>
 #include <dev/ofw/fdt.h>
 
 #include <dev/clock_subr.h>
@@ -114,12 +115,14 @@ qcrtc_gettime(struct todr_chip_handle *handle, struct timeval *tv)
 		return error;
 	}
 
-	/* Retrieve RTC offset stored in UEFI. */
-	if (qcscm_uefi_rtc_get(&off) != 0)
-		return EIO;
+	/* Retrieve RTC offset from either NVRAM or UEFI. */
+	error = nvmem_read_cell(sc->sc_node, "offset", &off, sizeof(off));
+	if (error == ENXIO || (!error && off == 0))
+		error = qcscm_uefi_rtc_get(&off);
+	if (error)
+		return error;
 
-	/* Add RTC counter and 10y+1w to get seconds from epoch. */
-	tv->tv_sec = off + (reg + (10 * 365 * 86400 + 7 * 86400));
+	tv->tv_sec = off + reg;
 	tv->tv_usec = 0;
 	return 0;
 }
@@ -138,9 +141,11 @@ qcrtc_settime(struct todr_chip_handle *handle, struct timeval *tv)
 		return error;
 	}
 
-	/* Subtract RTC counter and 10y+1w to get offset for UEFI. */
-	off = tv->tv_sec - (reg + (10 * 365 * 86400 + 7 * 86400));
+	/* Store RTC offset in either NVRAM or UEFI. */
+	off = tv->tv_sec - reg;
+	error = nvmem_write_cell(sc->sc_node, "offset", &off, sizeof(off));
+	if (error == ENXIO)
+		error = qcscm_uefi_rtc_set(off);
 
-	/* Store offset in UEFI. */
-	return qcscm_uefi_rtc_set(off);
+	return error;
 }
diff --git a/sys/dev/fdt/qcscm.c b/sys/dev/fdt/qcscm.c
index c5d2daa9d..1e39742e3 100644
--- a/sys/dev/fdt/qcscm.c
+++ b/sys/dev/fdt/qcscm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: qcscm.c,v 1.4 2023/05/17 23:12:04 patrick Exp $ */
+/* $OpenBSD: qcscm.c,v 1.5 2023/07/22 22:48:35 patrick Exp $ */
 /*
  * Copyright (c) 2022 Patrick Wildt <patrick@blueri.se>
  *
@@ -90,6 +90,8 @@
 #define EFI_VARIABLE_BOOTSERVICE_ACCESS	0x00000002
 #define EFI_VARIABLE_RUNTIME_ACCESS	0x00000004
 
+#define UNIX_GPS_EPOCH_OFFSET		315964800
+
 struct qcscm_dmamem {
 	bus_dmamap_t		qdm_map;
 	bus_dma_segment_t	qdm_seg;
@@ -703,7 +705,8 @@ qcscm_uefi_rtc_get(uint32_t *off)
 	    &rtcinfosize) != 0)
 		return EIO;
 
-	*off = rtcinfo[0];
+	/* UEFI stores the offset based on GPS epoch */
+	*off = rtcinfo[0] + UNIX_GPS_EPOCH_OFFSET;
 	return 0;
 }
 
@@ -722,6 +725,9 @@ qcscm_uefi_rtc_set(uint32_t off)
 	    &rtcinfosize) != 0)
 		return EIO;
 
+	/* UEFI stores the offset based on GPS epoch */
+	off -= UNIX_GPS_EPOCH_OFFSET;
+
 	/* No need to set if we're not changing anything */
 	if (rtcinfo[0] == off)
 		return 0;
diff --git a/sys/dev/fdt/qcsdam.c b/sys/dev/fdt/qcsdam.c
new file mode 100644
index 000000000..309c889b3
--- /dev/null
+++ b/sys/dev/fdt/qcsdam.c
@@ -0,0 +1,119 @@
+/*	$OpenBSD: qcsdam.c,v 1.1 2023/07/22 22:43:53 patrick Exp $	*/
+/*
+ * Copyright (c) 2023 Patrick Wildt <patrick@blueri.se>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/device.h>
+
+#include <machine/bus.h>
+#include <machine/fdt.h>
+
+#include <dev/fdt/spmivar.h>
+
+#include <dev/ofw/openfirm.h>
+#include <dev/ofw/ofw_misc.h>
+#include <dev/ofw/fdt.h>
+
+struct qcsdam_softc {
+	struct device		sc_dev;
+	spmi_tag_t		sc_tag;
+	int8_t			sc_sid;
+	uint16_t		sc_addr;
+
+	struct nvmem_device	sc_nd;
+};
+
+int qcsdam_match(struct device *, void *, void *);
+void qcsdam_attach(struct device *, struct device *, void *);
+
+const struct cfattach	qcsdam_ca = {
+	sizeof (struct qcsdam_softc), qcsdam_match, qcsdam_attach
+};
+
+struct cfdriver qcsdam_cd = {
+	NULL, "qcsdam", DV_DULL
+};
+
+int	qcsdam_nvmem_read(void *, bus_addr_t, void *, bus_size_t);
+int	qcsdam_nvmem_write(void *, bus_addr_t, const void *, bus_size_t);
+
+int
+qcsdam_match(struct device *parent, void *match, void *aux)
+{
+	struct spmi_attach_args *saa = aux;
+
+	return OF_is_compatible(saa->sa_node, "qcom,spmi-sdam");
+}
+
+void
+qcsdam_attach(struct device *parent, struct device *self, void *aux)
+{
+	struct qcsdam_softc *sc = (struct qcsdam_softc *)self;
+	struct spmi_attach_args *saa = aux;
+	uint32_t reg;
+
+	if (OF_getpropintarray(saa->sa_node, "reg",
+	    &reg, sizeof(reg)) != sizeof(reg)) {
+		printf(": can't find registers\n");
+		return;
+	}
+
+	sc->sc_tag = saa->sa_tag;
+	sc->sc_sid = saa->sa_sid;
+	sc->sc_addr = reg;
+
+	printf("\n");
+
+	sc->sc_nd.nd_node = saa->sa_node;
+	sc->sc_nd.nd_cookie = sc;
+	sc->sc_nd.nd_read = qcsdam_nvmem_read;
+	sc->sc_nd.nd_write = qcsdam_nvmem_write;
+	nvmem_register(&sc->sc_nd);
+}
+
+int
+qcsdam_nvmem_read(void *cookie, bus_addr_t addr, void *data, bus_size_t size)
+{
+	struct qcsdam_softc *sc = cookie;
+	int error;
+
+	error = spmi_cmd_read(sc->sc_tag, sc->sc_sid, SPMI_CMD_EXT_READL,
+	    sc->sc_addr + addr, data, size);
+	if (error) {
+		printf("%s: error reading NVMEM\n", sc->sc_dev.dv_xname);
+		return error;
+	}
+
+	return 0;
+}
+
+int
+qcsdam_nvmem_write(void *cookie, bus_addr_t addr, const void *data,
+    bus_size_t size)
+{
+	struct qcsdam_softc *sc = cookie;
+	int error;
+
+	error = spmi_cmd_write(sc->sc_tag, sc->sc_sid, SPMI_CMD_EXT_WRITEL,
+	    sc->sc_addr + addr, data, size);
+	if (error) {
+		printf("%s: error reading NVMEM\n", sc->sc_dev.dv_xname);
+		return error;
+	}
+
+	return 0;
+}
diff --git a/sys/dev/fdt/tipd.c b/sys/dev/fdt/tipd.c
index 70bb7ca15..5d5ad2e13 100644
--- a/sys/dev/fdt/tipd.c
+++ b/sys/dev/fdt/tipd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tipd.c,v 1.2 2023/07/17 17:50:22 kettenis Exp $	*/
+/*	$OpenBSD: tipd.c,v 1.3 2023/07/23 11:42:44 kettenis Exp $	*/
 /*
  * Copyright (c) 2022 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -42,6 +42,7 @@
 #define TPS_SYSTEM_POWER_STATE	0x20
 #define  TPS_SYSTEM_POWER_STATE_S0	0
 #define  TPS_SYSTEM_POWER_STATE_S5	5
+#define TPS_POWER_STATUS	0x3f
 
 #define TPS_CMD(s)	((s[3] << 24) | (s[2] << 16) | (s[1] << 8) | s[0])
 
@@ -59,6 +60,7 @@ struct tipd_softc {
 	void			*sc_ih;
 
 	struct device_ports	sc_ports;
+	uint32_t		sc_status;
 };
 
 int	tipd_match(struct device *, void *, void *);
@@ -110,6 +112,7 @@ tipd_attach(struct device *parent, struct device *self, void *aux)
 
 	printf("\n");
 
+	tipd_read_4(sc, TPS_STATUS, &sc->sc_status);
 	tipd_write_8(sc, TPS_INT_MASK_1, CD_INT_PLUG_EVENT);
 
 	node = OF_getnodebyname(node, "connector");
@@ -127,6 +130,9 @@ tipd_activate(struct device *self, int act)
 	int error;
 
 	switch (act) {
+	case DVACT_QUIESCE:
+		tipd_write_8(sc, TPS_INT_MASK_1, 0);
+		break;
 	case DVACT_SUSPEND:
 		state = TPS_SYSTEM_POWER_STATE_S5;
 		error = tipd_exec(sc, "SSPS", &state, sizeof(state), NULL, 0);
@@ -139,6 +145,10 @@ tipd_activate(struct device *self, int act)
 		if (error)
 			printf("%s: powerup failed\n", sc->sc_dev.dv_xname);
 		break;
+	case DVACT_WAKEUP:
+		tipd_read_4(sc, TPS_STATUS, &sc->sc_status);
+		tipd_write_8(sc, TPS_INT_MASK_1, CD_INT_PLUG_EVENT);
+		break;
 	}
 
 	return 0;
@@ -198,10 +208,18 @@ tipd_intr(void *arg)
 		if (error)
 			goto fail;
 
-		if (status & TPS_STATUS_PLUG_PRESENT)
-			tipd_connect(sc);
-		else
-			tipd_disconnect(sc);
+		/*
+		 * We may get a spurious plug event upon resume.  Make
+		 * sure we only signal a new connection when the plug
+		 * present state really changed.
+		 */
+		if ((status ^ sc->sc_status) & TPS_STATUS_PLUG_PRESENT) {
+			if (status & TPS_STATUS_PLUG_PRESENT)
+				tipd_connect(sc);
+			else
+				tipd_disconnect(sc);
+			sc->sc_status = status;
+		}
 	}
 
 fail:
diff --git a/sys/dev/fdt/xhci_fdt.c b/sys/dev/fdt/xhci_fdt.c
index 73b7e8ad4..878dfcea8 100644
--- a/sys/dev/fdt/xhci_fdt.c
+++ b/sys/dev/fdt/xhci_fdt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: xhci_fdt.c,v 1.23 2023/04/03 01:55:00 dlg Exp $	*/
+/*	$OpenBSD: xhci_fdt.c,v 1.24 2023/07/23 11:49:17 kettenis Exp $	*/
 /*
  * Copyright (c) 2017 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -56,13 +56,15 @@ struct xhci_fdt_softc {
 
 int	xhci_fdt_match(struct device *, void *, void *);
 void	xhci_fdt_attach(struct device *, struct device *, void *);
+int	xhci_fdt_activate(struct device *, int);
 
 const struct cfattach xhci_fdt_ca = {
 	sizeof(struct xhci_fdt_softc), xhci_fdt_match, xhci_fdt_attach, NULL,
-	xhci_activate
+	xhci_fdt_activate
 };
 
-int	xhci_cdns_init(struct xhci_fdt_softc *);
+int	xhci_cdns_attach(struct xhci_fdt_softc *);
+int	xhci_snps_attach(struct xhci_fdt_softc *);
 int	xhci_snps_init(struct xhci_fdt_softc *);
 void	xhci_init_phys(struct xhci_fdt_softc *);
 
@@ -139,9 +141,9 @@ xhci_fdt_attach(struct device *parent, struct device *self, void *aux)
 	 * functionality.
 	 */
 	if (OF_is_compatible(sc->sc_node, "cdns,usb3"))
-		error = xhci_cdns_init(sc);
+		error = xhci_cdns_attach(sc);
 	if (OF_is_compatible(sc->sc_node, "snps,dwc3"))
-		error = xhci_snps_init(sc);
+		error = xhci_snps_attach(sc);
 	if (error) {
 		printf(": can't initialize hardware\n");
 		goto disestablish_ret;
@@ -170,6 +172,31 @@ unmap:
 	bus_space_unmap(sc->sc.iot, sc->sc.ioh, sc->sc.sc_size);
 }
 
+int
+xhci_fdt_activate(struct device *self, int act)
+{
+	struct xhci_fdt_softc *sc = (struct xhci_fdt_softc *)self;
+	int rv = 0;
+
+	switch (act) {
+	case DVACT_POWERDOWN:
+		rv = xhci_activate(self, act);
+		power_domain_disable(sc->sc_node);
+		break;
+	case DVACT_RESUME:
+		power_domain_enable(sc->sc_node);
+		if (OF_is_compatible(sc->sc_node, "snps,dwc3"))
+			xhci_snps_init(sc);
+		rv = xhci_activate(self, act);
+		break;
+	default:
+		rv = xhci_activate(self, act);
+		break;
+	}
+
+	return rv;
+}
+
 /*
  * Cadence USB3 controller.
  */
@@ -183,7 +210,7 @@ unmap:
 #define  OTG_STS_XHCI_READY	(1 << 26)
 
 int
-xhci_cdns_init(struct xhci_fdt_softc *sc)
+xhci_cdns_attach(struct xhci_fdt_softc *sc)
 {
 	uint32_t did, sts;
 	int timo;
@@ -251,6 +278,27 @@ xhci_snps_ep_get_cookie(void *cookie, struct endpoint *ep)
 	return cookie;
 }
 
+int
+xhci_snps_attach(struct xhci_fdt_softc *sc)
+{
+	/*
+	 * On Apple hardware we need to reset the controller when we
+	 * see a new connection.
+	 */
+	if (OF_is_compatible(sc->sc_node, "apple,dwc3")) {
+		sc->sc_usb_controller_port.up_cookie = sc;
+		sc->sc_usb_controller_port.up_connect = xhci_snps_connect;
+		task_set(&sc->sc_snps_connect_task, xhci_snps_do_connect, sc);
+
+		sc->sc_ports.dp_node = sc->sc_node;
+		sc->sc_ports.dp_cookie = &sc->sc_usb_controller_port;
+		sc->sc_ports.dp_ep_get_cookie = xhci_snps_ep_get_cookie;
+		device_ports_register(&sc->sc_ports, EP_USB_CONTROLLER_PORT);
+	}
+
+	return xhci_snps_init(sc);
+}
+
 int
 xhci_snps_init(struct xhci_fdt_softc *sc)
 {
@@ -258,21 +306,6 @@ xhci_snps_init(struct xhci_fdt_softc *sc)
 	int node = sc->sc_node;
 	uint32_t reg;
 
-	/*
-	 * On Apple hardware we need to reset the controller when we
-	 * see a new connection.
-	 */
-	if (OF_is_compatible(node, "apple,dwc3")) {
-		sc->sc_usb_controller_port.up_cookie = sc;
-		sc->sc_usb_controller_port.up_connect = xhci_snps_connect;
-		task_set(&sc->sc_snps_connect_task, xhci_snps_do_connect, sc);
-
-		sc->sc_ports.dp_node = node;
-		sc->sc_ports.dp_cookie = &sc->sc_usb_controller_port;
-		sc->sc_ports.dp_ep_get_cookie = xhci_snps_ep_get_cookie;
-		device_ports_register(&sc->sc_ports, EP_USB_CONTROLLER_PORT);
-	}
-
 	/* We don't support device mode, so always force host mode. */
 	reg = bus_space_read_4(sc->sc.iot, sc->sc.ioh, USB3_GCTL);
 	reg &= ~USB3_GCTL_PRTCAPDIR_MASK;
diff --git a/sys/dev/ic/pckbc.c b/sys/dev/ic/pckbc.c
index a6d7ad333..52f634139 100644
--- a/sys/dev/ic/pckbc.c
+++ b/sys/dev/ic/pckbc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pckbc.c,v 1.53 2019/11/30 18:18:34 cheloha Exp $ */
+/* $OpenBSD: pckbc.c,v 1.54 2023/07/25 10:00:44 miod Exp $ */
 /* $NetBSD: pckbc.c,v 1.5 2000/06/09 04:58:35 soda Exp $ */
 
 /*
@@ -514,12 +514,20 @@ pckbc_poll_data(pckbc_tag_t self, pckbc_slot_t slot)
  * set scancode translation on
  */
 int
-pckbc_xt_translation(pckbc_tag_t self)
+pckbc_xt_translation(pckbc_tag_t self, int *table)
 {
 	struct pckbc_internal *t = self;
 
-	if (ISSET(t->t_flags, PCKBC_CANT_TRANSLATE))
+#ifdef __sparc64__ /* only pckbc@ebus on sparc64 uses this */
+	if ((t->t_flags & PCKBC_CANT_TRANSLATE) != 0) {
+		/* Hardware lacks translation capability. Nothing to do! */
+		if (t->t_flags & PCKBC_FIXED_SET2)
+			*table = 2;
+		else /* PCKBC_FIXED_SET3 */
+			*table = 3;
 		return (-1);
+	}
+#endif
 
 	if (t->t_cmdbyte & KC8_TRANS)
 		return (0);
diff --git a/sys/dev/ic/pckbcvar.h b/sys/dev/ic/pckbcvar.h
index 4b8ec57bd..c39f97f17 100644
--- a/sys/dev/ic/pckbcvar.h
+++ b/sys/dev/ic/pckbcvar.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: pckbcvar.h,v 1.16 2017/03/11 11:55:03 mpi Exp $ */
+/* $OpenBSD: pckbcvar.h,v 1.17 2023/07/25 10:00:44 miod Exp $ */
 /* $NetBSD: pckbcvar.h,v 1.4 2000/06/09 04:58:35 soda Exp $ */
 
 /*
@@ -52,9 +52,14 @@ struct pckbc_internal {
 	u_char t_cmdbyte; /* shadow */
 
 	int t_flags;
-#define	PCKBC_CANT_TRANSLATE	0x0001	/* can't translate to XT scancodes */
-#define	PCKBC_NEED_AUXWRITE	0x0002	/* need auxwrite command to find aux */
-	int t_haveaux; /* controller has an aux port */
+	/* need auxwrite command to find aux */
+#define	PCKBC_NEED_AUXWRITE	0x0001
+	/* can't translate to XT scancodes, stuck to set #2 */
+#define	PCKBC_FIXED_SET2	0x0002
+	/* can't translate to XT scancodes, stuck to set #3 */
+#define	PCKBC_FIXED_SET3	0x0004
+#define	PCKBC_CANT_TRANSLATE	(PCKBC_FIXED_SET2 | PCKBC_FIXED_SET3)
+	int t_haveaux;	/* controller has an aux port */
 
 	struct pckbc_slotdata *t_slotdata[PCKBC_NSLOTS];
 
@@ -100,7 +105,7 @@ int pckbc_poll_data(pckbc_tag_t, pckbc_slot_t);
 int pckbc_poll_data1(bus_space_tag_t, bus_space_handle_t,
 			  bus_space_handle_t, pckbc_slot_t, int);
 void pckbc_set_poll(pckbc_tag_t, pckbc_slot_t, int);
-int pckbc_xt_translation(pckbc_tag_t);
+int pckbc_xt_translation(pckbc_tag_t, int *);
 void pckbc_slot_enable(pckbc_tag_t, pckbc_slot_t, int);
 
 void pckbc_attach(struct pckbc_softc *, int);
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 2d8e849e1..388b1e23b 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -2737,6 +2737,9 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence **ef)
 			if (!attachment->is_mapped)
 				continue;
 
+			if (attachment->bo_va->base.bo->tbo.pin_count)
+				continue;
+
 			kfd_mem_dmaunmap_attachment(mem, attachment);
 			ret = update_gpuvm_pte(mem, attachment, &sync_obj);
 			if (ret) {
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c
index 1d6ff4db9..54e47f300 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_vm.c
@@ -1730,18 +1730,30 @@ int amdgpu_vm_bo_clear_mappings(struct amdgpu_device *adev,
 
 	/* Insert partial mapping before the range */
 	if (!list_empty(&before->list)) {
+		struct amdgpu_bo *bo = before->bo_va->base.bo;
+
 		amdgpu_vm_it_insert(before, &vm->va);
 		if (before->flags & AMDGPU_PTE_PRT)
 			amdgpu_vm_prt_get(adev);
+
+		if (bo && bo->tbo.base.resv == vm->root.bo->tbo.base.resv &&
+		    !before->bo_va->base.moved)
+			amdgpu_vm_bo_moved(&before->bo_va->base);
 	} else {
 		kfree(before);
 	}
 
 	/* Insert partial mapping after the range */
 	if (!list_empty(&after->list)) {
+		struct amdgpu_bo *bo = after->bo_va->base.bo;
+
 		amdgpu_vm_it_insert(after, &vm->va);
 		if (after->flags & AMDGPU_PTE_PRT)
 			amdgpu_vm_prt_get(adev);
+
+		if (bo && bo->tbo.base.resv == vm->root.bo->tbo.base.resv &&
+		    !after->bo_va->base.moved)
+			amdgpu_vm_bo_moved(&after->bo_va->base);
 	} else {
 		kfree(after);
 	}
diff --git a/sys/dev/pci/drm/amd/amdgpu/nbio_v2_3.c b/sys/dev/pci/drm/amd/amdgpu/nbio_v2_3.c
index aa761ff3a..7ba47fc19 100644
--- a/sys/dev/pci/drm/amd/amdgpu/nbio_v2_3.c
+++ b/sys/dev/pci/drm/amd/amdgpu/nbio_v2_3.c
@@ -346,7 +346,7 @@ static void nbio_v2_3_init_registers(struct amdgpu_device *adev)
 
 #define NAVI10_PCIE__LC_L0S_INACTIVITY_DEFAULT		0x00000000 // off by default, no gains over L1
 #define NAVI10_PCIE__LC_L1_INACTIVITY_DEFAULT		0x00000009 // 1=1us, 9=1ms
-#define NAVI10_PCIE__LC_L1_INACTIVITY_TBT_DEFAULT	0x0000000E // 4ms
+#define NAVI10_PCIE__LC_L1_INACTIVITY_TBT_DEFAULT	0x0000000E // 400ms
 
 static void nbio_v2_3_enable_aspm(struct amdgpu_device *adev,
 				  bool enable)
@@ -479,9 +479,12 @@ static void nbio_v2_3_program_aspm(struct amdgpu_device *adev)
 		WREG32_SOC15(NBIO, 0, mmRCC_BIF_STRAP5, data);
 
 	def = data = RREG32_PCIE(smnPCIE_LC_CNTL);
-	data &= ~PCIE_LC_CNTL__LC_L0S_INACTIVITY_MASK;
-	data |= 0x9 << PCIE_LC_CNTL__LC_L1_INACTIVITY__SHIFT;
-	data |= 0x1 << PCIE_LC_CNTL__LC_PMI_TO_L1_DIS__SHIFT;
+	data |= NAVI10_PCIE__LC_L0S_INACTIVITY_DEFAULT << PCIE_LC_CNTL__LC_L0S_INACTIVITY__SHIFT;
+	if (pci_is_thunderbolt_attached(adev->pdev))
+		data |= NAVI10_PCIE__LC_L1_INACTIVITY_TBT_DEFAULT  << PCIE_LC_CNTL__LC_L1_INACTIVITY__SHIFT;
+	else
+		data |= NAVI10_PCIE__LC_L1_INACTIVITY_DEFAULT << PCIE_LC_CNTL__LC_L1_INACTIVITY__SHIFT;
+	data &= ~PCIE_LC_CNTL__LC_PMI_TO_L1_DIS_MASK;
 	if (def != data)
 		WREG32_PCIE(smnPCIE_LC_CNTL, data);
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/sdma_v4_0.c b/sys/dev/pci/drm/amd/amdgpu/sdma_v4_0.c
index ec8a202b6..cf817e098 100644
--- a/sys/dev/pci/drm/amd/amdgpu/sdma_v4_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/sdma_v4_0.c
@@ -2330,7 +2330,7 @@ const struct amd_ip_funcs sdma_v4_0_ip_funcs = {
 
 static const struct amdgpu_ring_funcs sdma_v4_0_ring_funcs = {
 	.type = AMDGPU_RING_TYPE_SDMA,
-	.align_mask = 0xf,
+	.align_mask = 0xff,
 	.nop = SDMA_PKT_NOP_HEADER_OP(SDMA_OP_NOP),
 	.support_64bit_ptrs = true,
 	.secure_submission_supported = true,
@@ -2400,7 +2400,7 @@ static const struct amdgpu_ring_funcs sdma_v4_0_ring_funcs_2nd_mmhub = {
 
 static const struct amdgpu_ring_funcs sdma_v4_0_page_ring_funcs = {
 	.type = AMDGPU_RING_TYPE_SDMA,
-	.align_mask = 0xf,
+	.align_mask = 0xff,
 	.nop = SDMA_PKT_NOP_HEADER_OP(SDMA_OP_NOP),
 	.support_64bit_ptrs = true,
 	.secure_submission_supported = true,
diff --git a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 188708ec0..21e07a101 100644
--- a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -6974,7 +6974,13 @@ static int amdgpu_dm_connector_get_modes(struct drm_connector *connector)
 				drm_add_modes_noedid(connector, 640, 480);
 	} else {
 		amdgpu_dm_connector_ddc_get_modes(connector, edid);
-		amdgpu_dm_connector_add_common_modes(encoder, connector);
+		/* most eDP supports only timings from its edid,
+		 * usually only detailed timings are available
+		 * from eDP edid. timings which are not from edid
+		 * may damage eDP
+		 */
+		if (connector->connector_type != DRM_MODE_CONNECTOR_eDP)
+			amdgpu_dm_connector_add_common_modes(encoder, connector);
 		amdgpu_dm_connector_add_freesync_modes(connector, edid);
 	}
 	amdgpu_dm_fbc_init(connector);
diff --git a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index e32153150..9933a30cc 100644
--- a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -42,6 +42,30 @@
 #include "dm_helpers.h"
 #include "ddc_service_types.h"
 
+static u32 edid_extract_panel_id(struct edid *edid)
+{
+	return (u32)edid->mfg_id[0] << 24   |
+	       (u32)edid->mfg_id[1] << 16   |
+	       (u32)EDID_PRODUCT_ID(edid);
+}
+
+static void apply_edid_quirks(struct edid *edid, struct dc_edid_caps *edid_caps)
+{
+	uint32_t panel_id = edid_extract_panel_id(edid);
+
+	switch (panel_id) {
+	/* Workaround for some monitors which does not work well with FAMS */
+	case drm_edid_encode_panel_id('S', 'A', 'M', 0x0E5E):
+	case drm_edid_encode_panel_id('S', 'A', 'M', 0x7053):
+	case drm_edid_encode_panel_id('S', 'A', 'M', 0x71AC):
+		DRM_DEBUG_DRIVER("Disabling FAMS on monitor with panel id %X\n", panel_id);
+		edid_caps->panel_patch.disable_fams = true;
+		break;
+	default:
+		return;
+	}
+}
+
 /* dm_helpers_parse_edid_caps
  *
  * Parse edid caps
@@ -113,6 +137,8 @@ enum dc_edid_status dm_helpers_parse_edid_caps(
 	else
 		edid_caps->speaker_flags = DEFAULT_SPEAKER_LOCATION;
 
+	apply_edid_quirks(edid_buf, edid_caps);
+
 	kfree(sads);
 	kfree(sadb);
 
diff --git a/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c b/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
index b405f2e86..cca014344 100644
--- a/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
+++ b/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
@@ -1539,6 +1539,9 @@ bool dc_validate_boot_timing(const struct dc *dc,
 		return false;
 	}
 
+	if (dc->debug.force_odm_combine)
+		return false;
+
 	/* Check for enabled DIG to identify enabled display */
 	if (!link->link_enc->funcs->is_dig_enabled(link->link_enc))
 		return false;
diff --git a/sys/dev/pci/drm/amd/display/dc/dce112/dce112_resource.c b/sys/dev/pci/drm/amd/display/dc/dce112/dce112_resource.c
index e179e8066..19d7cfa53 100644
--- a/sys/dev/pci/drm/amd/display/dc/dce112/dce112_resource.c
+++ b/sys/dev/pci/drm/amd/display/dc/dce112/dce112_resource.c
@@ -970,10 +970,12 @@ enum dc_status resource_map_phy_clock_resources(
 		|| dc_is_virtual_signal(pipe_ctx->stream->signal))
 		pipe_ctx->clock_source =
 				dc->res_pool->dp_clock_source;
-	else
-		pipe_ctx->clock_source = find_matching_pll(
-			&context->res_ctx, dc->res_pool,
-			stream);
+	else {
+		if (stream && stream->link && stream->link->link_enc)
+			pipe_ctx->clock_source = find_matching_pll(
+				&context->res_ctx, dc->res_pool,
+				stream);
+	}
 
 	if (pipe_ctx->clock_source == NULL)
 		return DC_NO_CLOCK_SOURCE_RESOURCE;
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 2d49e99a1..622efa556 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1678,6 +1678,17 @@ static void dcn20_program_pipe(
 
 		if (hws->funcs.setup_vupdate_interrupt)
 			hws->funcs.setup_vupdate_interrupt(dc, pipe_ctx);
+
+		if (hws->funcs.calculate_dccg_k1_k2_values && dc->res_pool->dccg->funcs->set_pixel_rate_div) {
+			unsigned int k1_div, k2_div;
+
+			hws->funcs.calculate_dccg_k1_k2_values(pipe_ctx, &k1_div, &k2_div);
+
+			dc->res_pool->dccg->funcs->set_pixel_rate_div(
+				dc->res_pool->dccg,
+				pipe_ctx->stream_res.tg->inst,
+				k1_div, k2_div);
+		}
 	}
 
 	if (pipe_ctx->update_flags.bits.odm)
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_hwseq.c
index 74530e2e7..601b65483 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_hwseq.c
@@ -1165,10 +1165,6 @@ unsigned int dcn32_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsign
 	unsigned int odm_combine_factor = 0;
 	bool two_pix_per_container = false;
 
-	// For phantom pipes, use the same programming as the main pipes
-	if (pipe_ctx->stream->mall_stream_config.type == SUBVP_PHANTOM) {
-		stream = pipe_ctx->stream->mall_stream_config.paired_stream;
-	}
 	two_pix_per_container = optc2_is_two_pixels_per_containter(&stream->timing);
 	odm_combine_factor = get_odm_config(pipe_ctx, NULL);
 
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.c b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.c
index 2b33eeb21..fe941b103 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.c
@@ -98,7 +98,7 @@ static void optc32_set_odm_combine(struct timing_generator *optc, int *opp_id, i
 	optc1->opp_count = opp_cnt;
 }
 
-static void optc32_set_h_timing_div_manual_mode(struct timing_generator *optc, bool manual_mode)
+void optc32_set_h_timing_div_manual_mode(struct timing_generator *optc, bool manual_mode)
 {
 	struct optc *optc1 = DCN10TG_FROM_TG(optc);
 
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.h b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.h
index 5e57c3923..e5c5343e5 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.h
+++ b/sys/dev/pci/drm/amd/display/dc/dcn32/dcn32_optc.h
@@ -250,5 +250,6 @@
 	SF(OTG0_OTG_DRR_CONTROL, OTG_V_TOTAL_LAST_USED_BY_DRR, mask_sh)
 
 void dcn32_timing_generator_init(struct optc *optc1);
+void optc32_set_h_timing_div_manual_mode(struct timing_generator *optc, bool manual_mode);
 
 #endif /* __DC_OPTC_DCN32_H__ */
diff --git a/sys/dev/pci/drm/amd/display/dmub/dmub_srv.h b/sys/dev/pci/drm/amd/display/dmub/dmub_srv.h
index eb5b7eb29..b53468aca 100644
--- a/sys/dev/pci/drm/amd/display/dmub/dmub_srv.h
+++ b/sys/dev/pci/drm/amd/display/dmub/dmub_srv.h
@@ -471,7 +471,7 @@ struct dmub_notification {
  * of a firmware to know if feature or functionality is supported or present.
  */
 #define DMUB_FW_VERSION(major, minor, revision) \
-	((((major) & 0xFF) << 24) | (((minor) & 0xFF) << 16) | ((revision) & 0xFFFF))
+	((((major) & 0xFF) << 24) | (((minor) & 0xFF) << 16) | (((revision) & 0xFF) << 8))
 
 /**
  * dmub_srv_create() - creates the DMUB service.
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/inc/amdgpu_smu.h b/sys/dev/pci/drm/amd/pm/swsmu/inc/amdgpu_smu.h
index adcf99148..1bb953c97 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+++ b/sys/dev/pci/drm/amd/pm/swsmu/inc/amdgpu_smu.h
@@ -168,6 +168,7 @@ struct smu_temperature_range {
 	int mem_crit_max;
 	int mem_emergency_max;
 	int software_shutdown_temp;
+	int software_shutdown_temp_offset;
 };
 
 struct smu_state_validation_block {
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/inc/smu_v13_0.h b/sys/dev/pci/drm/amd/pm/swsmu/inc/smu_v13_0.h
index bffa6247c..d6479a808 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/inc/smu_v13_0.h
+++ b/sys/dev/pci/drm/amd/pm/swsmu/inc/smu_v13_0.h
@@ -297,5 +297,9 @@ int smu_v13_0_get_pptable_from_firmware(struct smu_context *smu,
 					uint32_t *size,
 					uint32_t pptable_id);
 
+int smu_v13_0_update_pcie_parameters(struct smu_context *smu,
+				     uint32_t pcie_gen_cap,
+				     uint32_t pcie_width_cap);
+
 #endif
 #endif
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index d829f9525..ee8b01003 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -1381,6 +1381,7 @@ static int smu_v13_0_irq_process(struct amdgpu_device *adev,
 	 */
 	uint32_t ctxid = entry->src_data[0];
 	uint32_t data;
+	uint32_t high;
 
 	if (client_id == SOC15_IH_CLIENTID_THM) {
 		switch (src_id) {
@@ -1437,6 +1438,36 @@ static int smu_v13_0_irq_process(struct amdgpu_device *adev,
 					schedule_work(&smu->throttling_logging_work);
 
 				break;
+			case 0x8:
+				high = smu->thermal_range.software_shutdown_temp +
+					smu->thermal_range.software_shutdown_temp_offset;
+				high = min_t(typeof(high),
+					     SMU_THERMAL_MAXIMUM_ALERT_TEMP,
+					     high);
+				dev_emerg(adev->dev, "Reduce soft CTF limit to %d (by an offset %d)\n",
+							high,
+							smu->thermal_range.software_shutdown_temp_offset);
+
+				data = RREG32_SOC15(THM, 0, regTHM_THERMAL_INT_CTRL);
+				data = REG_SET_FIELD(data, THM_THERMAL_INT_CTRL,
+							DIG_THERM_INTH,
+							(high & 0xff));
+				data = data & (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK);
+				WREG32_SOC15(THM, 0, regTHM_THERMAL_INT_CTRL, data);
+				break;
+			case 0x9:
+				high = min_t(typeof(high),
+					     SMU_THERMAL_MAXIMUM_ALERT_TEMP,
+					     smu->thermal_range.software_shutdown_temp);
+				dev_emerg(adev->dev, "Recover soft CTF limit to %d\n", high);
+
+				data = RREG32_SOC15(THM, 0, regTHM_THERMAL_INT_CTRL);
+				data = REG_SET_FIELD(data, THM_THERMAL_INT_CTRL,
+							DIG_THERM_INTH,
+							(high & 0xff));
+				data = data & (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK);
+				WREG32_SOC15(THM, 0, regTHM_THERMAL_INT_CTRL, data);
+				break;
 			}
 		}
 	}
@@ -2458,3 +2489,74 @@ int smu_v13_0_mode1_reset(struct smu_context *smu)
 
 	return ret;
 }
+
+/*
+ * Intel hosts such as Raptor Lake and Sapphire Rapids don't support dynamic
+ * speed switching. Until we have confirmation from Intel that a specific host
+ * supports it, it's safer that we keep it disabled for all.
+ *
+ * https://edc.intel.com/content/www/us/en/design/products/platforms/details/raptor-lake-s/13th-generation-core-processors-datasheet-volume-1-of-2/005/pci-express-support/
+ * https://gitlab.freedesktop.org/drm/amd/-/issues/2663
+ */
+static bool smu_v13_0_is_pcie_dynamic_switching_supported(void)
+{
+#if IS_ENABLED(CONFIG_X86)
+#ifdef __linux__
+	struct cpuinfo_x86 *c = &cpu_data(0);
+
+	if (c->x86_vendor == X86_VENDOR_INTEL)
+#else
+	if (strcmp(cpu_vendor, "GenuineIntel") == 0)
+#endif
+		return false;
+#endif
+	return true;
+}
+
+int smu_v13_0_update_pcie_parameters(struct smu_context *smu,
+				     uint32_t pcie_gen_cap,
+				     uint32_t pcie_width_cap)
+{
+	struct smu_13_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
+	struct smu_13_0_pcie_table *pcie_table =
+				&dpm_context->dpm_tables.pcie_table;
+	int num_of_levels = pcie_table->num_of_link_levels;
+	uint32_t smu_pcie_arg;
+	int ret, i;
+
+	if (!smu_v13_0_is_pcie_dynamic_switching_supported()) {
+		if (pcie_table->pcie_gen[num_of_levels - 1] < pcie_gen_cap)
+			pcie_gen_cap = pcie_table->pcie_gen[num_of_levels - 1];
+
+		if (pcie_table->pcie_lane[num_of_levels - 1] < pcie_width_cap)
+			pcie_width_cap = pcie_table->pcie_lane[num_of_levels - 1];
+
+		/* Force all levels to use the same settings */
+		for (i = 0; i < num_of_levels; i++) {
+			pcie_table->pcie_gen[i] = pcie_gen_cap;
+			pcie_table->pcie_lane[i] = pcie_width_cap;
+		}
+	} else {
+		for (i = 0; i < num_of_levels; i++) {
+			if (pcie_table->pcie_gen[i] > pcie_gen_cap)
+				pcie_table->pcie_gen[i] = pcie_gen_cap;
+			if (pcie_table->pcie_lane[i] > pcie_width_cap)
+				pcie_table->pcie_lane[i] = pcie_width_cap;
+		}
+	}
+
+	for (i = 0; i < num_of_levels; i++) {
+		smu_pcie_arg = i << 16;
+		smu_pcie_arg |= pcie_table->pcie_gen[i] << 8;
+		smu_pcie_arg |= pcie_table->pcie_lane[i];
+
+		ret = smu_cmn_send_smc_msg_with_param(smu,
+						      SMU_MSG_OverridePcieParameters,
+						      smu_pcie_arg,
+						      NULL);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
index d30fdd86b..58f9e1cd5 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
@@ -1216,37 +1216,6 @@ static int smu_v13_0_0_force_clk_levels(struct smu_context *smu,
 	return ret;
 }
 
-static int smu_v13_0_0_update_pcie_parameters(struct smu_context *smu,
-					      uint32_t pcie_gen_cap,
-					      uint32_t pcie_width_cap)
-{
-	struct smu_13_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
-	struct smu_13_0_pcie_table *pcie_table =
-				&dpm_context->dpm_tables.pcie_table;
-	uint32_t smu_pcie_arg;
-	int ret, i;
-
-	for (i = 0; i < pcie_table->num_of_link_levels; i++) {
-		if (pcie_table->pcie_gen[i] > pcie_gen_cap)
-			pcie_table->pcie_gen[i] = pcie_gen_cap;
-		if (pcie_table->pcie_lane[i] > pcie_width_cap)
-			pcie_table->pcie_lane[i] = pcie_width_cap;
-
-		smu_pcie_arg = i << 16;
-		smu_pcie_arg |= pcie_table->pcie_gen[i] << 8;
-		smu_pcie_arg |= pcie_table->pcie_lane[i];
-
-		ret = smu_cmn_send_smc_msg_with_param(smu,
-						      SMU_MSG_OverridePcieParameters,
-						      smu_pcie_arg,
-						      NULL);
-		if (ret)
-			return ret;
-	}
-
-	return 0;
-}
-
 static const struct smu_temperature_range smu13_thermal_policy[] = {
 	{-273150,  99000, 99000, -273150, 99000, 99000, -273150, 99000, 99000},
 	{ 120000, 120000, 120000, 120000, 120000, 120000, 120000, 120000, 120000},
@@ -1281,6 +1250,7 @@ static int smu_v13_0_0_get_thermal_temperature_range(struct smu_context *smu,
 	range->mem_emergency_max = (pptable->SkuTable.TemperatureLimit[TEMP_MEM] + CTF_OFFSET_MEM)*
 		SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
 	range->software_shutdown_temp = powerplay_table->software_shutdown_temp;
+	range->software_shutdown_temp_offset = pptable->SkuTable.FanAbnormalTempLimitOffset;
 
 	return 0;
 }
@@ -2036,7 +2006,7 @@ static const struct pptable_funcs smu_v13_0_0_ppt_funcs = {
 	.feature_is_enabled = smu_cmn_feature_is_enabled,
 	.print_clk_levels = smu_v13_0_0_print_clk_levels,
 	.force_clk_levels = smu_v13_0_0_force_clk_levels,
-	.update_pcie_parameters = smu_v13_0_0_update_pcie_parameters,
+	.update_pcie_parameters = smu_v13_0_update_pcie_parameters,
 	.get_thermal_temperature_range = smu_v13_0_0_get_thermal_temperature_range,
 	.register_irq_handler = smu_v13_0_register_irq_handler,
 	.enable_thermal_alert = smu_v13_0_enable_thermal_alert,
diff --git a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
index 57579f5e0..17a7b4823 100644
--- a/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+++ b/sys/dev/pci/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
@@ -1225,37 +1225,6 @@ static int smu_v13_0_7_force_clk_levels(struct smu_context *smu,
 	return ret;
 }
 
-static int smu_v13_0_7_update_pcie_parameters(struct smu_context *smu,
-					      uint32_t pcie_gen_cap,
-					      uint32_t pcie_width_cap)
-{
-	struct smu_13_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
-	struct smu_13_0_pcie_table *pcie_table =
-				&dpm_context->dpm_tables.pcie_table;
-	uint32_t smu_pcie_arg;
-	int ret, i;
-
-	for (i = 0; i < pcie_table->num_of_link_levels; i++) {
-		if (pcie_table->pcie_gen[i] > pcie_gen_cap)
-			pcie_table->pcie_gen[i] = pcie_gen_cap;
-		if (pcie_table->pcie_lane[i] > pcie_width_cap)
-			pcie_table->pcie_lane[i] = pcie_width_cap;
-
-		smu_pcie_arg = i << 16;
-		smu_pcie_arg |= pcie_table->pcie_gen[i] << 8;
-		smu_pcie_arg |= pcie_table->pcie_lane[i];
-
-		ret = smu_cmn_send_smc_msg_with_param(smu,
-						      SMU_MSG_OverridePcieParameters,
-						      smu_pcie_arg,
-						      NULL);
-		if (ret)
-			return ret;
-	}
-
-	return 0;
-}
-
 static const struct smu_temperature_range smu13_thermal_policy[] =
 {
 	{-273150,  99000, 99000, -273150, 99000, 99000, -273150, 99000, 99000},
@@ -1288,6 +1257,7 @@ static int smu_v13_0_7_get_thermal_temperature_range(struct smu_context *smu,
 	range->mem_emergency_max = (pptable->SkuTable.TemperatureLimit[TEMP_MEM] + CTF_OFFSET_MEM)*
 		SMU_TEMPERATURE_UNITS_PER_CENTIGRADES;
 	range->software_shutdown_temp = powerplay_table->software_shutdown_temp;
+	range->software_shutdown_temp_offset = pptable->SkuTable.FanAbnormalTempLimitOffset;
 
 	return 0;
 }
@@ -1751,7 +1721,7 @@ static const struct pptable_funcs smu_v13_0_7_ppt_funcs = {
 	.feature_is_enabled = smu_cmn_feature_is_enabled,
 	.print_clk_levels = smu_v13_0_7_print_clk_levels,
 	.force_clk_levels = smu_v13_0_7_force_clk_levels,
-	.update_pcie_parameters = smu_v13_0_7_update_pcie_parameters,
+	.update_pcie_parameters = smu_v13_0_update_pcie_parameters,
 	.get_thermal_temperature_range = smu_v13_0_7_get_thermal_temperature_range,
 	.register_irq_handler = smu_v13_0_register_irq_handler,
 	.enable_thermal_alert = smu_v13_0_enable_thermal_alert,
diff --git a/sys/dev/pci/drm/drm_atomic.c b/sys/dev/pci/drm/drm_atomic.c
index 5b1afb8f1..b876b2dc7 100644
--- a/sys/dev/pci/drm/drm_atomic.c
+++ b/sys/dev/pci/drm/drm_atomic.c
@@ -140,6 +140,12 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state)
 	if (!state->planes)
 		goto fail;
 
+	/*
+	 * Because drm_atomic_state can be committed asynchronously we need our
+	 * own reference and cannot rely on the on implied by drm_file in the
+	 * ioctl call.
+	 */
+	drm_dev_get(dev);
 	state->dev = dev;
 
 	drm_dbg_atomic(dev, "Allocated atomic state %p\n", state);
@@ -299,7 +305,8 @@ EXPORT_SYMBOL(drm_atomic_state_clear);
 void __drm_atomic_state_free(struct kref *ref)
 {
 	struct drm_atomic_state *state = container_of(ref, typeof(*state), ref);
-	struct drm_mode_config *config = &state->dev->mode_config;
+	struct drm_device *dev = state->dev;
+	struct drm_mode_config *config = &dev->mode_config;
 
 	drm_atomic_state_clear(state);
 
@@ -311,6 +318,8 @@ void __drm_atomic_state_free(struct kref *ref)
 		drm_atomic_state_default_release(state);
 		kfree(state);
 	}
+
+	drm_dev_put(dev);
 }
 EXPORT_SYMBOL(__drm_atomic_state_free);
 
diff --git a/sys/dev/pci/drm/drm_atomic_helper.c b/sys/dev/pci/drm/drm_atomic_helper.c
index 934390848..801ebd69a 100644
--- a/sys/dev/pci/drm/drm_atomic_helper.c
+++ b/sys/dev/pci/drm/drm_atomic_helper.c
@@ -1231,7 +1231,16 @@ disable_outputs(struct drm_device *dev, struct drm_atomic_state *old_state)
 			continue;
 
 		ret = drm_crtc_vblank_get(crtc);
-		WARN_ONCE(ret != -EINVAL, "driver forgot to call drm_crtc_vblank_off()\n");
+		/*
+		 * Self-refresh is not a true "disable"; ensure vblank remains
+		 * enabled.
+		 */
+		if (new_crtc_state->self_refresh_active)
+			WARN_ONCE(ret != 0,
+				  "driver disabled vblank in self-refresh\n");
+		else
+			WARN_ONCE(ret != -EINVAL,
+				  "driver forgot to call drm_crtc_vblank_off()\n");
 		if (ret == 0)
 			drm_crtc_vblank_put(crtc);
 	}
diff --git a/sys/dev/pci/drm/drm_client.c b/sys/dev/pci/drm/drm_client.c
index 2b230b4d6..dcbeeb68c 100644
--- a/sys/dev/pci/drm/drm_client.c
+++ b/sys/dev/pci/drm/drm_client.c
@@ -122,13 +122,34 @@ EXPORT_SYMBOL(drm_client_init);
  * drm_client_register() it is no longer permissible to call drm_client_release()
  * directly (outside the unregister callback), instead cleanup will happen
  * automatically on driver unload.
+ *
+ * Registering a client generates a hotplug event that allows the client
+ * to set up its display from pre-existing outputs. The client must have
+ * initialized its state to able to handle the hotplug event successfully.
  */
 void drm_client_register(struct drm_client_dev *client)
 {
 	struct drm_device *dev = client->dev;
+	int ret;
 
 	mutex_lock(&dev->clientlist_mutex);
 	list_add(&client->list, &dev->clientlist);
+
+	if (client->funcs && client->funcs->hotplug) {
+		/*
+		 * Perform an initial hotplug event to pick up the
+		 * display configuration for the client. This step
+		 * has to be performed *after* registering the client
+		 * in the list of clients, or a concurrent hotplug
+		 * event might be lost; leaving the display off.
+		 *
+		 * Hold the clientlist_mutex as for a regular hotplug
+		 * event.
+		 */
+		ret = client->funcs->hotplug(client);
+		if (ret)
+			drm_dbg_kms(dev, "client hotplug ret=%d\n", ret);
+	}
 	mutex_unlock(&dev->clientlist_mutex);
 }
 EXPORT_SYMBOL(drm_client_register);
diff --git a/sys/dev/pci/drm/drm_drv.c b/sys/dev/pci/drm/drm_drv.c
index 02b0e50c7..90500b5f0 100644
--- a/sys/dev/pci/drm/drm_drv.c
+++ b/sys/dev/pci/drm/drm_drv.c
@@ -1309,6 +1309,7 @@ drm_attach(struct device *parent, struct device *self, void *aux)
 
 	sc->sc_drm = dev;
 
+	kref_init(&dev->ref);
 	dev->dev = self;
 	dev->dev_private = parent;
 	dev->driver = da->driver;
diff --git a/sys/dev/pci/drm/drm_fb_helper.c b/sys/dev/pci/drm/drm_fb_helper.c
index 449ee168a..d334a77f7 100644
--- a/sys/dev/pci/drm/drm_fb_helper.c
+++ b/sys/dev/pci/drm/drm_fb_helper.c
@@ -2717,10 +2717,6 @@ void drm_fbdev_generic_setup(struct drm_device *dev,
 		preferred_bpp = 32;
 	fb_helper->preferred_bpp = preferred_bpp;
 
-	ret = drm_fbdev_client_hotplug(&fb_helper->client);
-	if (ret)
-		drm_dbg_kms(dev, "client hotplug ret=%d\n", ret);
-
 	drm_client_register(&fb_helper->client);
 }
 EXPORT_SYMBOL(drm_fbdev_generic_setup);
diff --git a/sys/dev/pci/drm/i915/display/intel_display.c b/sys/dev/pci/drm/i915/display/intel_display.c
index 83fe57121..1acfc87e6 100644
--- a/sys/dev/pci/drm/i915/display/intel_display.c
+++ b/sys/dev/pci/drm/i915/display/intel_display.c
@@ -5133,7 +5133,6 @@ copy_bigjoiner_crtc_state_modeset(struct intel_atomic_state *state,
 	saved_state->uapi = slave_crtc_state->uapi;
 	saved_state->scaler_state = slave_crtc_state->scaler_state;
 	saved_state->shared_dpll = slave_crtc_state->shared_dpll;
-	saved_state->dpll_hw_state = slave_crtc_state->dpll_hw_state;
 	saved_state->crc_enabled = slave_crtc_state->crc_enabled;
 
 	intel_crtc_free_hw_state(slave_crtc_state);
diff --git a/sys/dev/pci/drm/i915/gt/intel_gtt.c b/sys/dev/pci/drm/i915/gt/intel_gtt.c
index 3e4a53fbc..b08965a98 100644
--- a/sys/dev/pci/drm/i915/gt/intel_gtt.c
+++ b/sys/dev/pci/drm/i915/gt/intel_gtt.c
@@ -611,7 +611,7 @@ __vm_create_scratch_for_read(struct i915_address_space *vm, unsigned long size)
 	if (IS_ERR(obj))
 		return ERR_CAST(obj);
 
-	i915_gem_object_set_cache_coherency(obj, I915_CACHING_CACHED);
+	i915_gem_object_set_cache_coherency(obj, I915_CACHE_LLC);
 
 	vma = i915_vma_instance(obj, vm, NULL);
 	if (IS_ERR(vma)) {
diff --git a/sys/dev/pci/drm/ttm/ttm_bo.c b/sys/dev/pci/drm/ttm/ttm_bo.c
index 994c67f6c..ca0d0bfcf 100644
--- a/sys/dev/pci/drm/ttm/ttm_bo.c
+++ b/sys/dev/pci/drm/ttm/ttm_bo.c
@@ -1191,6 +1191,7 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct ttm_operation_ctx *ctx,
 		ret = ttm_bo_handle_move_mem(bo, evict_mem, true, &ctx, &hop);
 		if (unlikely(ret != 0)) {
 			WARN(ret == -EMULTIHOP, "Unexpected multihop in swaput - likely driver bug.\n");
+			ttm_resource_free(bo, &evict_mem);
 			goto out;
 		}
 	}
diff --git a/sys/dev/pckbc/pckbd.c b/sys/dev/pckbc/pckbd.c
index d81fd30f1..71ccf5147 100644
--- a/sys/dev/pckbc/pckbd.c
+++ b/sys/dev/pckbc/pckbd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pckbd.c,v 1.48 2023/03/08 04:43:08 guenther Exp $ */
+/* $OpenBSD: pckbd.c,v 1.50 2023/07/25 10:00:44 miod Exp $ */
 /* $NetBSD: pckbd.c,v 1.24 2000/06/05 22:20:57 sommerfeld Exp $ */
 
 /*-
@@ -81,6 +81,7 @@
 #include <dev/pckbc/pmsreg.h>
 
 #include <dev/wscons/wsconsio.h>
+#include <dev/wscons/wskbdraw.h>
 #include <dev/wscons/wskbdvar.h>
 #include <dev/wscons/wsksymdef.h>
 #include <dev/wscons/wsksymvar.h>
@@ -92,8 +93,8 @@ struct pckbd_internal {
 	pckbc_tag_t t_kbctag;
 	pckbc_slot_t t_kbcslot;
 
-	int t_translating;
-	int t_table;
+	int t_translating;	/* nonzero if hardware performs translation */
+	int t_table;		/* scan code set in use */
 
 	int t_lastchar;
 	int t_extended;
@@ -214,11 +215,22 @@ int
 pckbd_set_xtscancode(pckbc_tag_t kbctag, pckbc_slot_t kbcslot,
     struct pckbd_internal *id)
 {
-	int table = 3;
+	int table = 0;
 
-	if (pckbc_xt_translation(kbctag)) {
+	if (pckbc_xt_translation(kbctag, &table)) {
 #ifdef DEBUG
 		printf("pckbd: enabling of translation failed\n");
+#endif
+#ifdef __sparc64__ /* only pckbc@ebus on sparc64 uses this */
+		/*
+		 * If hardware lacks translation capability, stick to the
+		 * table it is using.
+		 */
+		if (table != 0) {
+			id->t_translating = 0;
+			id->t_table = table;
+			return 0;
+		}
 #endif
 		/*
 		 * Since the keyboard controller can not translate scan
@@ -233,6 +245,7 @@ pckbd_set_xtscancode(pckbc_tag_t kbctag, pckbc_slot_t kbcslot,
 		if (id != NULL)
 			id->t_translating = 0;
 	} else {
+		table = 3;
 		if (id != NULL) {
 			id->t_translating = 1;
 			if (id->t_table == 0) {
@@ -493,107 +506,111 @@ pckbd_enable(void *v, int on)
 	return (0);
 }
 
-const u_int8_t pckbd_xtbl[] = {
+/*
+ * Scan code set #2 translation tables
+ */
+
+const u_int8_t pckbd_xtbl2[] = {
 /* 0x00 */
 	0,
-	0x43,		/* F9 */
+	RAWKEY_f9,
 	0,
-	0x3f,		/* F5 */
-	0x3d,		/* F3 */
-	0x3b,		/* F1 */
-	0x3c,		/* F2 */
-	0x58,		/* F12 */
-	0x40,		/* F6 according to documentation */
-	0x44,		/* F10 */
-	0x42,		/* F8 */
-	0x40,		/* F6 according to experimentation */
-	0x3e,		/* F4 */
-	0x0f,		/* Tab */
-	0x29,		/* ` ~ */
+	RAWKEY_f5,
+	RAWKEY_f3,
+	RAWKEY_f1,
+	RAWKEY_f2,
+	RAWKEY_f12,
+	RAWKEY_f6,	/* F6 according to documentation */
+	RAWKEY_f10,
+	RAWKEY_f8,
+	RAWKEY_f6,	/* F6 according to experimentation */
+	RAWKEY_f4,
+	RAWKEY_Tab,
+	RAWKEY_grave,
 	0,
 /* 0x10 */
 	0,
-	0x38,		/* Left Alt */
-	0x2a,		/* Left Shift */
+	RAWKEY_Alt_L,
+	RAWKEY_Shift_L,
 	0,
-	0x1d,		/* Left Ctrl */
-	0x10,		/* q */
-	0x02,		/* 1 ! */
+	RAWKEY_Control_L,
+	RAWKEY_q,
+	RAWKEY_1,
 	0,
 	0,
 	0,
-	0x2c,		/* z */
-	0x1f,		/* s */
-	0x1e,		/* a */
-	0x11,		/* w */
-	0x03,		/* 2 @ */
-	0,
+	RAWKEY_z,
+	RAWKEY_s,
+	RAWKEY_a,
+	RAWKEY_w,
+	RAWKEY_2,
+	RAWKEY_Meta_L,
 /* 0x20 */	
 	0,
-	0x2e,		/* c */
-	0x2d,		/* x */
-	0x20,		/* d */
-	0x12,		/* e */
-	0x05,		/* 4 $ */
-	0x04,		/* 3 # */
+	RAWKEY_c,
+	RAWKEY_x,
+	RAWKEY_d,
+	RAWKEY_e,
+	RAWKEY_4,
+	RAWKEY_3,
 	0,
-	0,
-	0x39,		/* Space */
-	0x2f,		/* v */
-	0x21,		/* f */
-	0x14,		/* t */
-	0x13,		/* r */
-	0x06,		/* 5 % */
+	RAWKEY_Meta_R,
+	RAWKEY_space,
+	RAWKEY_v,
+	RAWKEY_f,
+	RAWKEY_t,
+	RAWKEY_r,
+	RAWKEY_5,
 	0,
 /* 0x30 */
 	0,
-	0x31,		/* n */
-	0x30,		/* b */
-	0x23,		/* h */
-	0x22,		/* g */
-	0x15,		/* y */
-	0x07,		/* 6 ^ */
+	RAWKEY_n,
+	RAWKEY_b,
+	RAWKEY_h,
+	RAWKEY_g,
+	RAWKEY_y,
+	RAWKEY_6,
 	0,
 	0,
 	0,
-	0x32,		/* m */
-	0x24,		/* j */
-	0x16,		/* u */
-	0x08,		/* 7 & */
-	0x09,		/* 8 * */
+	RAWKEY_m,
+	RAWKEY_j,
+	RAWKEY_u,
+	RAWKEY_7,
+	RAWKEY_8,
 	0,
 /* 0x40 */
 	0,
-	0x33,		/* , < */
-	0x25,		/* k */
-	0x17,		/* i */
-	0x18,		/* o */
-	0x0b,		/* 0 ) */
-	0x0a,		/* 9 ( */
+	RAWKEY_comma,
+	RAWKEY_k,
+	RAWKEY_i,
+	RAWKEY_o,
+	RAWKEY_0,
+	RAWKEY_9,
 	0,
 	0,
-	0x34,		/* . > */
-	0x35,		/* / ? */
-	0x26,		/* l */
-	0x27,		/* ; : */
-	0x19,		/* p */
-	0x0c,		/* - _ */
+	RAWKEY_period,
+	RAWKEY_slash,
+	RAWKEY_l,
+	RAWKEY_semicolon,
+	RAWKEY_p,
+	RAWKEY_minus,
 	0,
 /* 0x50 */
 	0,
 	0,
-	0x28,		/* ' " */
+	RAWKEY_apostrophe,
 	0,
-	0x1a,		/* [ { */
-	0x0d,		/* = + */
+	RAWKEY_bracketleft,
+	RAWKEY_equal,
 	0,
 	0,
-	0x3a,		/* Caps Lock */
-	0x36,		/* Right Shift */
-	0x1c,		/* Return */
-	0x1b,		/* ] } */
+	RAWKEY_Caps_Lock,
+	RAWKEY_Shift_R,
+	RAWKEY_Return,
+	RAWKEY_bracketright,
 	0,
-	0x2b,		/* \ | */
+	RAWKEY_backslash,
 	0,
 	0,
 /* 0x60 */
@@ -603,42 +620,42 @@ const u_int8_t pckbd_xtbl[] = {
 	0,
 	0,
 	0,
-	0x0e,		/* Back Space */
+	RAWKEY_BackSpace,
 	0,
 	0,
-	0x4f,		/* KP 1 */
+	RAWKEY_KP_End,
 	0,
-	0x4b,		/* KP 4 */
-	0x47,		/* KP 7 */
+	RAWKEY_KP_Left,
+	RAWKEY_KP_Home,
 	0,
 	0,
 	0,
 /* 0x70 */
-	0x52,		/* KP 0 */
-	0x53,		/* KP . */
-	0x50,		/* KP 2 */
-	0x4c,		/* KP 5 */
-	0x4d,		/* KP 6 */
-	0x48,		/* KP 8 */
-	0x01,		/* Escape */
-	0x45,		/* Num Lock */
-	0x57,		/* F11 */
-	0x4e,		/* KP + */
-	0x51,		/* KP 3 */
-	0x4a,		/* KP - */
-	0x37,		/* KP * */
-	0x49,		/* KP 9 */
-	0x46,		/* Scroll Lock */
+	RAWKEY_KP_Insert,
+	RAWKEY_KP_Delete,
+	RAWKEY_KP_Down,
+	RAWKEY_KP_Begin,
+	RAWKEY_KP_Right,
+	RAWKEY_KP_Up,
+	RAWKEY_Escape,
+	RAWKEY_Num_Lock,
+	RAWKEY_f11,
+	RAWKEY_KP_Add,
+	RAWKEY_KP_Next,
+	RAWKEY_KP_Subtract,
+	RAWKEY_KP_Multiply,
+	RAWKEY_KP_Prior,
+	RAWKEY_Hold_Screen,
 	0,
 /* 0x80 */
 	0,
 	0,
 	0,
-	0x41,		/* F7 (produced as an actual 8 bit code) */
+	RAWKEY_f7,
 	0		/* Alt-Print Screen */
 };
 
-const u_int8_t pckbd_xtbl_ext[] = {
+const u_int8_t pckbd_xtbl2_ext[] = {
 /* 0x00 */
 	0,
 	0,
@@ -657,10 +674,10 @@ const u_int8_t pckbd_xtbl_ext[] = {
 	0,
 /* 0x10 */
 	0,
-	0x38,		/* Right Alt */
+	RAWKEY_Alt_R,
 	0,		/* E0 12, to be ignored */
 	0,
-	0x1d,		/* Right Ctrl */
+	RAWKEY_Control_R,
 	0,
 	0,
 	0,
@@ -717,7 +734,7 @@ const u_int8_t pckbd_xtbl_ext[] = {
 	0,
 	0,
 	0,
-	0x55,		/* KP / */
+	RAWKEY_KP_Divide,
 	0,
 	0,
 	0,
@@ -734,7 +751,7 @@ const u_int8_t pckbd_xtbl_ext[] = {
 	0,
 	0,
 	0,
-	0x1c,		/* KP Return */
+	RAWKEY_KP_Enter,
 	0,
 	0,
 	0,
@@ -750,34 +767,195 @@ const u_int8_t pckbd_xtbl_ext[] = {
 	0,
 	0,
 	0,
-	0x4f,		/* End */
+	RAWKEY_End,
 	0,
-	0x4b,		/* Left */
-	0x47,		/* Home */
+	RAWKEY_Left,
+	RAWKEY_Home,
 	0,
 	0,
 	0,
 /* 0x70 */
-	0x52,		/* Insert */
-	0x53,		/* Delete */
-	0x50,		/* Down */
+	RAWKEY_Insert,
+	RAWKEY_Delete,
+	RAWKEY_Down,
 	0,
-	0x4d,		/* Right */
-	0x48,		/* Up */
+	RAWKEY_Right,
+	RAWKEY_Up,
 	0,
 	0,
 	0,
 	0,
-	0x51,		/* Page Down */
+	RAWKEY_Next,
 	0,
-	0x37,		/* Print Screen */
-	0x49,		/* Page Up */
-	0x46,		/* Ctrl-Break */
+	RAWKEY_Print_Screen,
+	RAWKEY_Prior,
+	0xc6,		/* Ctrl-Break */
 	0
 };
 
+#ifdef __sparc64__ /* only pckbc@ebus on sparc64 uses this */
+
 /*
- * Translate scan codes from set 2 to set 1
+ * Scan code set #3 translation table
+ */
+
+const u_int8_t pckbd_xtbl3[] = {
+/* 0x00 */
+	0,
+	RAWKEY_L5,	/* Front */
+	RAWKEY_L1,	/* Stop */
+	RAWKEY_L3,	/* Props */
+	0,
+	RAWKEY_L7,	/* Open */
+	RAWKEY_L9,	/* Find */
+	RAWKEY_f1,
+	RAWKEY_Escape,
+	RAWKEY_L10,	/* Cut */
+	0,
+	0,
+	0,
+	RAWKEY_Tab,
+	RAWKEY_grave,
+	RAWKEY_f2,
+/* 0x10 */
+	RAWKEY_Help,
+	RAWKEY_Control_L,
+	RAWKEY_Shift_L,
+	0,
+	RAWKEY_Caps_Lock,
+	RAWKEY_q,
+	RAWKEY_1,
+	RAWKEY_f3,
+	0,
+	RAWKEY_Alt_L,
+	RAWKEY_z,
+	RAWKEY_s,
+	RAWKEY_a,
+	RAWKEY_w,
+	RAWKEY_2,
+	RAWKEY_f4,
+/* 0x20 */	
+	0,
+	RAWKEY_c,
+	RAWKEY_x,
+	RAWKEY_d,
+	RAWKEY_e,
+	RAWKEY_4,
+	RAWKEY_3,
+	RAWKEY_f5,
+	RAWKEY_L4,	/* Undo */
+	RAWKEY_space,
+	RAWKEY_v,
+	RAWKEY_f,
+	RAWKEY_t,
+	RAWKEY_r,
+	RAWKEY_5,
+	RAWKEY_f6,
+/* 0x30 */
+	RAWKEY_L2,	/* Again */
+	RAWKEY_n,
+	RAWKEY_b,
+	RAWKEY_h,
+	RAWKEY_g,
+	RAWKEY_y,
+	RAWKEY_6,
+	RAWKEY_f7,
+	0,
+	RAWKEY_Alt_R,
+	RAWKEY_m,
+	RAWKEY_j,
+	RAWKEY_u,
+	RAWKEY_7,
+	RAWKEY_8,
+	RAWKEY_f8,
+/* 0x40 */
+	0,
+	RAWKEY_comma,
+	RAWKEY_k,
+	RAWKEY_i,
+	RAWKEY_o,
+	RAWKEY_0,
+	RAWKEY_9,
+	RAWKEY_f9,
+	RAWKEY_L6,	/* Copy */
+	RAWKEY_period,
+	RAWKEY_slash,
+	RAWKEY_l,
+	RAWKEY_semicolon,
+	RAWKEY_p,
+	RAWKEY_minus,
+	RAWKEY_f10,
+/* 0x50 */
+	0,
+	0,
+	RAWKEY_apostrophe,
+	0,
+	RAWKEY_bracketleft,
+	RAWKEY_equal,
+	RAWKEY_f11,
+	RAWKEY_Print_Screen,
+	RAWKEY_Control_R,
+	RAWKEY_Shift_R,
+	RAWKEY_Return,
+	RAWKEY_bracketright,
+	RAWKEY_backslash,
+	0,
+	RAWKEY_f12,
+	RAWKEY_Hold_Screen,
+/* 0x60 */
+	RAWKEY_Down,
+	RAWKEY_Left,
+	RAWKEY_Pause,
+	RAWKEY_Up,
+	RAWKEY_Delete,
+	RAWKEY_End,
+	RAWKEY_BackSpace,
+	RAWKEY_Insert,
+	RAWKEY_L8,	/* Paste */
+	RAWKEY_KP_End,
+	RAWKEY_Right,
+	RAWKEY_KP_Left,
+	RAWKEY_KP_Home,
+	RAWKEY_Next,
+	RAWKEY_Home,
+	RAWKEY_Prior,
+/* 0x70 */
+	RAWKEY_KP_Insert,
+	RAWKEY_KP_Delete,
+	RAWKEY_KP_Down,
+	RAWKEY_KP_Begin,
+	RAWKEY_KP_Right,
+	RAWKEY_KP_Up,
+	RAWKEY_Num_Lock,
+	RAWKEY_KP_Divide,
+	0,
+	RAWKEY_KP_Enter,
+	RAWKEY_KP_Next,
+	0,
+	RAWKEY_KP_Add,
+	RAWKEY_KP_Prior,
+	RAWKEY_KP_Multiply,
+	0,
+/* 0x80 */
+	0,
+	0,
+	0,
+	0,
+	RAWKEY_KP_Subtract,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	RAWKEY_Meta_L,
+	RAWKEY_Meta_R
+};
+
+#endif
+
+/*
+ * Translate scan codes from set 2 or 3 to set 1
  */
 int
 pckbd_scancode_translate(struct pckbd_internal *id, int datain)
@@ -790,24 +968,38 @@ pckbd_scancode_translate(struct pckbd_internal *id, int datain)
 		return 0;	/* consume scancode */
 	}
 
-	/*
-	 * Convert BREAK sequence (14 77 -> 1D 45)
-	 */
-	if (id->t_extended1 == 2 && datain == 0x14)
-		return 0x1d | id->t_releasing;
-	else if (id->t_extended1 == 1 && datain == 0x77)
-		return 0x45 | id->t_releasing;
+	switch (id->t_table) {
+	case 2:
+		/*
+	 	* Convert BREAK sequence (14 77 -> 1D 45)
+	 	*/
+		if (id->t_extended1 == 2 && datain == 0x14)
+			return 0x1d | id->t_releasing;
+		else if (id->t_extended1 == 1 && datain == 0x77)
+			return 0x45 | id->t_releasing;
 
-	if (id->t_extended != 0) {
-		if (datain >= sizeof pckbd_xtbl_ext)
+		if (id->t_extended != 0) {
+			if (datain >= sizeof pckbd_xtbl2_ext)
+				datain = 0;
+			else
+				datain = pckbd_xtbl2_ext[datain];
+			/* xtbl2_ext already has the upper bit set */
+			id->t_extended = 0;
+		} else {
+			if (datain >= sizeof pckbd_xtbl2)
+				datain = 0;
+			else
+				datain = pckbd_xtbl2[datain] & ~0x80;
+		}
+		break;
+#ifdef __sparc64__ /* only pckbc@ebus on sparc64 uses this */
+	case 3:
+		if (datain >= sizeof pckbd_xtbl3)
 			datain = 0;
 		else
-			datain = pckbd_xtbl_ext[datain];
-	} else {
-		if (datain >= sizeof pckbd_xtbl)
-			datain = 0;
-		else
-			datain = pckbd_xtbl[datain];
+			datain = pckbd_xtbl3[datain] & ~0x80;
+		break;
+#endif
 	}
 
 	if (datain == 0) {
@@ -1021,11 +1213,8 @@ pckbd_hookup_bell(void (*fn)(void *, u_int, u_int, u_int, int), void *arg)
 int
 pckbd_cnattach(pckbc_tag_t kbctag)
 {
-
 	pckbd_init(&pckbd_consdata, kbctag, PCKBC_KBD_SLOT, 1);
-
 	wskbd_cnattach(&pckbd_consops, &pckbd_consdata, &pckbd_keymapdata);
-
 	return (0);
 }
 
diff --git a/sys/dev/wscons/wsemul_sun.c b/sys/dev/wscons/wsemul_sun.c
index 40871af46..e14c32dae 100644
--- a/sys/dev/wscons/wsemul_sun.c
+++ b/sys/dev/wscons/wsemul_sun.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsemul_sun.c,v 1.36 2023/03/06 20:34:35 miod Exp $ */
+/* $OpenBSD: wsemul_sun.c,v 1.37 2023/07/24 17:03:32 miod Exp $ */
 /* $NetBSD: wsemul_sun.c,v 1.11 2000/01/05 11:19:36 drochner Exp $ */
 
 /*
@@ -617,13 +617,14 @@ wsemul_sun_output_control(struct wsemul_sun_emuldata *edp,
 		break;
 
 	case ';':		/* argument terminator */
-		edp->nargs++;
+		if (edp->nargs < SUN_EMUL_NARGS)
+			edp->nargs++;
 		break;
 
 	default:		/* end of escape sequence */
-		oargs = edp->nargs++;
-		if (edp->nargs > SUN_EMUL_NARGS)
-			edp->nargs = SUN_EMUL_NARGS;
+		oargs = edp->nargs;
+		if (edp->nargs < SUN_EMUL_NARGS)
+			edp->nargs++;
 		rc = wsemul_sun_control(edp, instate);
 		if (rc != 0) {
 			/* undo nargs progress */
diff --git a/sys/dev/wscons/wsemul_vt100.c b/sys/dev/wscons/wsemul_vt100.c
index 1f976bd82..afea00b46 100644
--- a/sys/dev/wscons/wsemul_vt100.c
+++ b/sys/dev/wscons/wsemul_vt100.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsemul_vt100.c,v 1.45 2023/03/06 20:34:35 miod Exp $ */
+/* $OpenBSD: wsemul_vt100.c,v 1.46 2023/07/24 17:03:32 miod Exp $ */
 /* $NetBSD: wsemul_vt100.c,v 1.13 2000/04/28 21:56:16 mycroft Exp $ */
 
 /*
@@ -868,16 +868,12 @@ wsemul_vt100_output_dcs(struct wsemul_vt100_emuldata *edp,
 		    (instate->inchar - '0');
 		break;
 	case ';': /* argument terminator */
-		edp->nargs++;
+		if (edp->nargs < VT100_EMUL_NARGS)
+			edp->nargs++;
 		break;
 	default:
-		edp->nargs++;
-		if (edp->nargs > VT100_EMUL_NARGS) {
-#ifdef VT100_DEBUG
-			printf("vt100: too many arguments\n");
-#endif
-			edp->nargs = VT100_EMUL_NARGS;
-		}
+		if (edp->nargs < VT100_EMUL_NARGS)
+			edp->nargs++;
 		newstate = VT100_EMUL_STATE_STRING;
 		switch (instate->inchar) {
 		case '$':
@@ -1069,7 +1065,8 @@ wsemul_vt100_output_csi(struct wsemul_vt100_emuldata *edp,
 		    (instate->inchar - '0');
 		break;
 	case ';': /* argument terminator */
-		edp->nargs++;
+		if (edp->nargs < VT100_EMUL_NARGS)
+			edp->nargs++;
 		break;
 	case '?': /* DEC specific */
 	case '>': /* DA query */
@@ -1082,13 +1079,9 @@ wsemul_vt100_output_csi(struct wsemul_vt100_emuldata *edp,
 		edp->modif2 = (char)instate->inchar;
 		break;
 	default: /* end of escape sequence */
-		oargs = edp->nargs++;
-		if (edp->nargs > VT100_EMUL_NARGS) {
-#ifdef VT100_DEBUG
-			printf("vt100: too many arguments\n");
-#endif
-			edp->nargs = VT100_EMUL_NARGS;
-		}
+		oargs = edp->nargs;
+		if (edp->nargs < VT100_EMUL_NARGS)
+			edp->nargs++;
 		rc = wsemul_vt100_handle_csi(edp, instate);
 		if (rc != 0) {
 			edp->nargs = oargs;
diff --git a/sys/dev/wscons/wskbdraw.h b/sys/dev/wscons/wskbdraw.h
index d1bc9cb01..b5c96ec04 100644
--- a/sys/dev/wscons/wskbdraw.h
+++ b/sys/dev/wscons/wskbdraw.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wskbdraw.h,v 1.3 2011/01/30 16:21:05 miod Exp $	*/
+/*	$OpenBSD: wskbdraw.h,v 1.4 2023/07/24 19:28:40 miod Exp $	*/
 
 /*
  * Copyright (c) 2005, Miodrag Vallat
@@ -120,7 +120,6 @@
 #define	RAWKEY_less			0x56	/* < > on European keyboards */
 #define	RAWKEY_f11			0x57
 #define	RAWKEY_f12			0x58
-#define	RAWKEY_Print_Screen		0x67
 #define	RAWKEY_Pause			0x6a
 #define	RAWKEY_Meta_L			0x73
 #define	RAWKEY_Meta_R			0x74
@@ -128,6 +127,7 @@
 #define	RAWKEY_KP_Enter			0x9c
 #define	RAWKEY_Control_R		0x9d
 #define	RAWKEY_KP_Divide		0xb5
+#define	RAWKEY_Print_Screen		0xb7
 #define	RAWKEY_Alt_R			0xb8
 #define	RAWKEY_Home			0xc7
 #define	RAWKEY_Up			0xc8
diff --git a/sys/kern/init_sysent.c b/sys/kern/init_sysent.c
index c2e4c2950..fedc9a178 100644
--- a/sys/kern/init_sysent.c
+++ b/sys/kern/init_sysent.c
@@ -1,10 +1,10 @@
-/*	$OpenBSD: init_sysent.c,v 1.266 2023/05/18 10:24:28 mvs Exp $	*/
+/*	$OpenBSD: init_sysent.c,v 1.267 2023/07/24 19:33:29 miod Exp $	*/
 
 /*
  * System call switch table.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.248 2023/05/18 10:23:19 mvs Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.249 2023/07/24 19:32:23 miod Exp 
  */
 
 #include <sys/param.h>
diff --git a/sys/kern/kern_clock.c b/sys/kern/kern_clock.c
index 4bc588d03..dfe8dbe74 100644
--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_clock.c,v 1.108 2023/04/25 00:58:47 cheloha Exp $	*/
+/*	$OpenBSD: kern_clock.c,v 1.109 2023/07/25 18:16:19 cheloha Exp $	*/
 /*	$NetBSD: kern_clock.c,v 1.34 1996/06/09 04:51:03 briggs Exp $	*/
 
 /*-
@@ -49,10 +49,6 @@
 #include <sys/sched.h>
 #include <sys/timetc.h>
 
-#if defined(GPROF) || defined(DDBPROF)
-#include <sys/gmon.h>
-#endif
-
 #include "dt.h"
 #if NDT > 0
 #include <dev/dt/dtvar.h>
@@ -87,8 +83,6 @@ int	schedhz;
 int	profhz;
 int	profprocs;
 int	ticks = INT_MAX - (15 * 60 * HZ);
-static int psdiv, pscnt;		/* prof => stat divider */
-int	psratio;			/* ratio: prof / stat */
 
 volatile unsigned long jiffies = ULONG_MAX - (10 * 60 * HZ);
 
@@ -99,16 +93,13 @@ void
 initclocks(void)
 {
 	/*
-	 * Set divisors to 1 (normal case) and let the machine-specific
-	 * code do its bit.
+	 * Let the machine-specific code do its bit.
 	 */
-	psdiv = pscnt = 1;
 	cpu_initclocks();
 
-	/*
-	 * Compute profhz/stathz.
-	 */
-	psratio = profhz / stathz;
+	KASSERT(profhz >= stathz && profhz <= 1000000000);
+	KASSERT(profhz % stathz == 0);
+	profclock_period = 1000000000 / profhz;
 
 	inittimecounter();
 }
@@ -256,7 +247,6 @@ startprofclock(struct process *pr)
 		atomic_setbits_int(&pr->ps_flags, PS_PROFIL);
 		if (++profprocs == 1) {
 			s = splstatclock();
-			psdiv = pscnt = psratio;
 			setstatclockrate(profhz);
 			splx(s);
 		}
@@ -275,7 +265,6 @@ stopprofclock(struct process *pr)
 		atomic_clearbits_int(&pr->ps_flags, PS_PROFIL);
 		if (--profprocs == 0) {
 			s = splstatclock();
-			psdiv = pscnt = 1;
 			setstatclockrate(stathz);
 			splx(s);
 		}
@@ -289,35 +278,13 @@ stopprofclock(struct process *pr)
 void
 statclock(struct clockframe *frame)
 {
-#if defined(GPROF) || defined(DDBPROF)
-	struct gmonparam *g;
-	u_long i;
-#endif
 	struct cpu_info *ci = curcpu();
 	struct schedstate_percpu *spc = &ci->ci_schedstate;
 	struct proc *p = curproc;
 	struct process *pr;
 
-	/*
-	 * Notice changes in divisor frequency, and adjust clock
-	 * frequency accordingly.
-	 */
-	if (spc->spc_psdiv != psdiv) {
-		spc->spc_psdiv = psdiv;
-		spc->spc_pscnt = psdiv;
-		if (psdiv == 1) {
-			setstatclockrate(stathz);
-		} else {
-			setstatclockrate(profhz);
-		}
-	}
-
 	if (CLKF_USERMODE(frame)) {
 		pr = p->p_p;
-		if (pr->ps_flags & PS_PROFIL)
-			addupc_intr(p, CLKF_PC(frame), 1);
-		if (--spc->spc_pscnt > 0)
-			return;
 		/*
 		 * Came from user mode; CPU was in user state.
 		 * If this process is being profiled record the tick.
@@ -328,23 +295,6 @@ statclock(struct clockframe *frame)
 		else
 			spc->spc_cp_time[CP_USER]++;
 	} else {
-#if defined(GPROF) || defined(DDBPROF)
-		/*
-		 * Kernel statistics are just like addupc_intr, only easier.
-		 */
-		g = ci->ci_gmon;
-		if (g != NULL && g->state == GMON_PROF_ON) {
-			i = CLKF_PC(frame) - g->lowpc;
-			if (i < g->textsize) {
-				i /= HISTFRACTION * sizeof(*g->kcount);
-				g->kcount[i]++;
-			}
-		}
-#endif
-		if (p != NULL && p->p_p->ps_flags & PS_PROFIL)
-			addupc_intr(p, PROC_PC(p), 1);
-		if (--spc->spc_pscnt > 0)
-			return;
 		/*
 		 * Came from kernel mode, so we were:
 		 * - spinning on a lock
@@ -371,7 +321,6 @@ statclock(struct clockframe *frame)
 			spc->spc_cp_time[spc->spc_spinning ?
 			    CP_SPIN : CP_IDLE]++;
 	}
-	spc->spc_pscnt = psdiv;
 
 	if (p != NULL) {
 		p->p_cpticks++;
diff --git a/sys/kern/kern_clockintr.c b/sys/kern/kern_clockintr.c
index ee66e4f4a..9a9d912f1 100644
--- a/sys/kern/kern_clockintr.c
+++ b/sys/kern/kern_clockintr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kern_clockintr.c,v 1.27 2023/07/02 19:02:27 cheloha Exp $ */
+/* $OpenBSD: kern_clockintr.c,v 1.28 2023/07/25 18:16:19 cheloha Exp $ */
 /*
  * Copyright (c) 2003 Dale Rahn <drahn@openbsd.org>
  * Copyright (c) 2020 Mark Kettenis <kettenis@openbsd.org>
@@ -32,39 +32,23 @@
 /*
  * Protection for global variables in this file:
  *
- *	C	Global clockintr configuration mutex (clockintr_mtx).
  *	I	Immutable after initialization.
  */
-struct mutex clockintr_mtx = MUTEX_INITIALIZER(IPL_CLOCK);
-
 u_int clockintr_flags;			/* [I] global state + behavior flags */
 uint32_t hardclock_period;		/* [I] hardclock period (ns) */
 uint32_t schedclock_period;		/* [I] schedclock period (ns) */
-volatile u_int statclock_gen = 1;	/* [C] statclock update generation */
-volatile uint32_t statclock_avg;	/* [C] average statclock period (ns) */
-uint32_t statclock_min;			/* [C] minimum statclock period (ns) */
-uint32_t statclock_mask;		/* [C] set of allowed offsets */
-uint32_t stat_avg;			/* [I] average stathz period (ns) */
-uint32_t stat_min;			/* [I] set of allowed offsets */
-uint32_t stat_mask;			/* [I] max offset from minimum (ns) */
-uint32_t prof_avg;			/* [I] average profhz period (ns) */
-uint32_t prof_min;			/* [I] minimum profhz period (ns) */
-uint32_t prof_mask;			/* [I] set of allowed offsets */
+uint32_t statclock_avg;			/* [I] average statclock period (ns) */
+uint32_t statclock_min;			/* [I] minimum statclock period (ns) */
+uint32_t statclock_mask;		/* [I] set of allowed offsets */
 
-uint64_t clockintr_advance(struct clockintr *, uint64_t);
-void clockintr_cancel(struct clockintr *);
 void clockintr_cancel_locked(struct clockintr *);
-struct clockintr *clockintr_establish(struct clockintr_queue *,
-    void (*)(struct clockintr *, void *));
 uint64_t clockintr_expiration(const struct clockintr *);
 void clockintr_hardclock(struct clockintr *, void *);
 uint64_t clockintr_nsecuptime(const struct clockintr *);
 void clockintr_schedclock(struct clockintr *, void *);
 void clockintr_schedule(struct clockintr *, uint64_t);
 void clockintr_schedule_locked(struct clockintr *, uint64_t);
-void clockintr_stagger(struct clockintr *, uint64_t, u_int, u_int);
 void clockintr_statclock(struct clockintr *, void *);
-void clockintr_statvar_init(int, uint32_t *, uint32_t *, uint32_t *);
 uint64_t clockqueue_next(const struct clockintr_queue *);
 void clockqueue_reset_intrclock(struct clockintr_queue *);
 uint64_t nsec_advance(uint64_t *, uint64_t, uint64_t);
@@ -75,6 +59,8 @@ uint64_t nsec_advance(uint64_t *, uint64_t, uint64_t);
 void
 clockintr_init(u_int flags)
 {
+	uint32_t half_avg, var;
+
 	KASSERT(CPU_IS_PRIMARY(curcpu()));
 	KASSERT(clockintr_flags == 0);
 	KASSERT(!ISSET(flags, ~CL_FLAG_MASK));
@@ -83,12 +69,22 @@ clockintr_init(u_int flags)
 	hardclock_period = 1000000000 / hz;
 
 	KASSERT(stathz >= 1 && stathz <= 1000000000);
-	KASSERT(profhz >= stathz && profhz <= 1000000000);
-	KASSERT(profhz % stathz == 0);
-	clockintr_statvar_init(stathz, &stat_avg, &stat_min, &stat_mask);
-	clockintr_statvar_init(profhz, &prof_avg, &prof_min, &prof_mask);
-	SET(clockintr_flags, CL_STATCLOCK);
-	clockintr_setstatclockrate(stathz);
+
+	/*
+	 * Compute the average statclock() period.  Then find var, the
+	 * largest power of two such that var <= statclock_avg / 2.
+	 */
+	statclock_avg = 1000000000 / stathz;
+	half_avg = statclock_avg / 2;
+	for (var = 1U << 31; var > half_avg; var /= 2)
+		continue;
+
+	/*
+	 * Set a lower bound for the range using statclock_avg and var.
+	 * The mask for that range is just (var - 1).
+	 */
+	statclock_min = statclock_avg - (var / 2);
+	statclock_mask = var - 1;
 
 	KASSERT(schedhz >= 0 && schedhz <= 1000000000);
 	if (schedhz != 0)
@@ -479,70 +475,6 @@ clockintr_stagger(struct clockintr *cl, uint64_t period, u_int n, u_int count)
 	mtx_leave(&cq->cq_mtx);
 }
 
-/*
- * Compute the period (avg) for the given frequency and a range around
- * that period.  The range is [min + 1, min + mask].  The range is used
- * during dispatch to choose a new pseudorandom deadline for each statclock
- * event.
- */
-void
-clockintr_statvar_init(int freq, uint32_t *avg, uint32_t *min, uint32_t *mask)
-{
-	uint32_t half_avg, var;
-
-	KASSERT(!ISSET(clockintr_flags, CL_INIT | CL_STATCLOCK));
-	KASSERT(freq > 0 && freq <= 1000000000);
-
-	/* Compute avg, the average period. */
-	*avg = 1000000000 / freq;
-
-	/* Find var, the largest power of two such that var <= avg / 2. */
-	half_avg = *avg / 2;
-	for (var = 1U << 31; var > half_avg; var /= 2)
-		continue;
-
-	/* Using avg and var, set a lower bound for the range. */
-	*min = *avg - (var / 2);
-
-	/* The mask is just (var - 1). */
-	*mask = var - 1;
-}
-
-/*
- * Update the statclock_* variables according to the given frequency.
- * Must only be called after clockintr_statvar_init() initializes both
- * stathz_* and profhz_*.
- */
-void
-clockintr_setstatclockrate(int freq)
-{
-	u_int ogen;
-
-	KASSERT(ISSET(clockintr_flags, CL_STATCLOCK));
-
-	mtx_enter(&clockintr_mtx);
-
-	ogen = statclock_gen;
-	statclock_gen = 0;
-	membar_producer();
-	if (freq == stathz) {
-		statclock_avg = stat_avg;
-		statclock_min = stat_min;
-		statclock_mask = stat_mask;
-	} else if (freq == profhz) {
-		statclock_avg = prof_avg;
-		statclock_min = prof_min;
-		statclock_mask = prof_mask;
-	} else {
-		panic("%s: frequency is not stathz (%d) or profhz (%d): %d",
-		    __func__, stathz, profhz, freq);
-	}
-	membar_producer();
-	statclock_gen = MAX(1, ogen + 1);
-
-	mtx_leave(&clockintr_mtx);
-}
-
 uint64_t
 clockintr_nsecuptime(const struct clockintr *cl)
 {
@@ -577,24 +509,16 @@ void
 clockintr_statclock(struct clockintr *cl, void *frame)
 {
 	uint64_t count, expiration, i, uptime;
-	uint32_t mask, min, off;
-	u_int gen;
+	uint32_t off;
 
 	if (ISSET(clockintr_flags, CL_RNDSTAT)) {
-		do {
-			gen = statclock_gen;
-			membar_consumer();
-			min = statclock_min;
-			mask = statclock_mask;
-			membar_consumer();
-		} while (gen == 0 || gen != statclock_gen);
 		count = 0;
 		expiration = clockintr_expiration(cl);
 		uptime = clockintr_nsecuptime(cl);
 		while (expiration <= uptime) {
-			while ((off = (random() & mask)) == 0)
+			while ((off = (random() & statclock_mask)) == 0)
 				continue;
-			expiration += min + off;
+			expiration += statclock_min + off;
 			count++;
 		}
 		clockintr_schedule(cl, expiration);
diff --git a/sys/kern/kern_sched.c b/sys/kern/kern_sched.c
index f92bcec38..e1fb8c4fb 100644
--- a/sys/kern/kern_sched.c
+++ b/sys/kern/kern_sched.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sched.c,v 1.79 2023/07/14 07:07:08 claudio Exp $	*/
+/*	$OpenBSD: kern_sched.c,v 1.80 2023/07/25 18:16:19 cheloha Exp $	*/
 /*
  * Copyright (c) 2007, 2008 Artur Grabowski <art@openbsd.org>
  *
@@ -21,6 +21,8 @@
 #include <sys/proc.h>
 #include <sys/kthread.h>
 #include <sys/systm.h>
+#include <sys/clockintr.h>
+#include <sys/resourcevar.h>
 #include <sys/task.h>
 #include <sys/smr.h>
 #include <sys/tracepoint.h>
@@ -85,6 +87,15 @@ sched_init_cpu(struct cpu_info *ci)
 
 	spc->spc_idleproc = NULL;
 
+	if (spc->spc_profclock == NULL) {
+		spc->spc_profclock = clockintr_establish(&ci->ci_queue,
+		    profclock);
+		if (spc->spc_profclock == NULL)
+			panic("%s: clockintr_establish profclock", __func__);
+		clockintr_stagger(spc->spc_profclock, profclock_period,
+		    CPU_INFO_UNIT(ci), MAXCPUS);
+	}
+
 	kthread_create_deferred(sched_kthreads_create, ci);
 
 	LIST_INIT(&spc->spc_deadproc);
@@ -214,6 +225,11 @@ sched_exit(struct proc *p)
 	timespecsub(&ts, &spc->spc_runtime, &ts);
 	timespecadd(&p->p_rtime, &ts, &p->p_rtime);
 
+	if (ISSET(spc->spc_schedflags, SPCF_PROFCLOCK)) {
+		atomic_clearbits_int(&spc->spc_schedflags, SPCF_PROFCLOCK);
+		clockintr_cancel(spc->spc_profclock);
+	}
+
 	LIST_INSERT_HEAD(&spc->spc_deadproc, p, p_hash);
 
 #ifdef MULTIPROCESSOR
diff --git a/sys/kern/sched_bsd.c b/sys/kern/sched_bsd.c
index cdb208272..784e7fde9 100644
--- a/sys/kern/sched_bsd.c
+++ b/sys/kern/sched_bsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched_bsd.c,v 1.77 2023/07/11 07:02:43 claudio Exp $	*/
+/*	$OpenBSD: sched_bsd.c,v 1.78 2023/07/25 18:16:19 cheloha Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*-
@@ -39,6 +39,7 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
+#include <sys/clockintr.h>
 #include <sys/proc.h>
 #include <sys/kernel.h>
 #include <sys/malloc.h>
@@ -349,6 +350,12 @@ mi_switch(void)
 	/* add the time counts for this thread to the process's total */
 	tuagg_unlocked(pr, p);
 
+	/* Stop the profclock if it's running. */
+	if (ISSET(spc->spc_schedflags, SPCF_PROFCLOCK)) {
+		atomic_clearbits_int(&spc->spc_schedflags, SPCF_PROFCLOCK);
+		clockintr_cancel(spc->spc_profclock);
+	}
+
 	/*
 	 * Process is about to yield the CPU; clear the appropriate
 	 * scheduling flags.
@@ -393,6 +400,14 @@ mi_switch(void)
 	 */
 	KASSERT(p->p_cpu == curcpu());
 
+	/* Start the profclock if profil(2) is enabled. */
+	if (ISSET(p->p_p->ps_flags, PS_PROFIL)) {
+		atomic_setbits_int(&p->p_cpu->ci_schedstate.spc_schedflags,
+		    SPCF_PROFCLOCK);
+		clockintr_advance(p->p_cpu->ci_schedstate.spc_profclock,
+		    profclock_period);
+	}
+
 	nanouptime(&p->p_cpu->ci_schedstate.spc_runtime);
 
 #ifdef MULTIPROCESSOR
diff --git a/sys/kern/subr_prof.c b/sys/kern/subr_prof.c
index a93b6df98..850e0fb3b 100644
--- a/sys/kern/subr_prof.c
+++ b/sys/kern/subr_prof.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: subr_prof.c,v 1.35 2023/06/02 17:44:29 cheloha Exp $	*/
+/*	$OpenBSD: subr_prof.c,v 1.36 2023/07/25 18:16:19 cheloha Exp $	*/
 /*	$NetBSD: subr_prof.c,v 1.12 1996/04/22 01:38:50 christos Exp $	*/
 
 /*-
@@ -34,13 +34,17 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
+#include <sys/atomic.h>
+#include <sys/clockintr.h>
 #include <sys/pledge.h>
 #include <sys/proc.h>
 #include <sys/resourcevar.h>
 #include <sys/mount.h>
 #include <sys/sysctl.h>
 #include <sys/syscallargs.h>
+#include <sys/user.h>
 
+uint32_t profclock_period;
 
 #if defined(GPROF) || defined(DDBPROF)
 #include <sys/malloc.h>
@@ -60,6 +64,8 @@ u_int gmon_cpu_count;		/* [K] number of CPUs with profiling enabled */
 
 extern char etext[];
 
+void gmonclock(struct clockintr *, void *);
+
 void
 prof_init(void)
 {
@@ -95,6 +101,14 @@ prof_init(void)
 
 	/* Allocate and initialize one profiling buffer per CPU. */
 	CPU_INFO_FOREACH(cii, ci) {
+		ci->ci_gmonclock = clockintr_establish(&ci->ci_queue,
+		    gmonclock);
+		if (ci->ci_gmonclock == NULL) {
+			printf("%s: clockintr_establish gmonclock\n", __func__);
+			return;
+		}
+		clockintr_stagger(ci->ci_gmonclock, profclock_period,
+		    CPU_INFO_UNIT(ci), MAXCPUS);
 		cp = km_alloc(round_page(size), &kv_any, &kp_zero, &kd_nowait);
 		if (cp == NULL) {
 			printf("No memory for profiling.\n");
@@ -124,8 +138,9 @@ prof_init(void)
 }
 
 int
-prof_state_toggle(struct gmonparam *gp, int oldstate)
+prof_state_toggle(struct cpu_info *ci, int oldstate)
 {
+	struct gmonparam *gp = ci->ci_gmon;
 	int error = 0;
 
 	KERNEL_ASSERT_LOCKED();
@@ -145,6 +160,7 @@ prof_state_toggle(struct gmonparam *gp, int oldstate)
 		if (error == 0) {
 			if (++gmon_cpu_count == 1)
 				startprofclock(&process0);
+			clockintr_advance(ci->ci_gmonclock, profclock_period);
 		}
 		break;
 	default:
@@ -152,6 +168,7 @@ prof_state_toggle(struct gmonparam *gp, int oldstate)
 		gp->state = GMON_PROF_OFF;
 		/* FALLTHROUGH */
 	case GMON_PROF_OFF:
+		clockintr_cancel(ci->ci_gmonclock);
 		if (--gmon_cpu_count == 0)
 			stopprofclock(&process0);
 #if !defined(GPROF)
@@ -201,7 +218,7 @@ sysctl_doprof(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 		error = sysctl_int(oldp, oldlenp, newp, newlen, &gp->state);
 		if (error)
 			return (error);
-		return (prof_state_toggle(gp, state));
+		return prof_state_toggle(ci, state);
 	case GPROF_COUNT:
 		return (sysctl_struct(oldp, oldlenp, newp, newlen,
 		    gp->kcount, gp->kcountsize));
@@ -218,6 +235,31 @@ sysctl_doprof(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
 	}
 	/* NOTREACHED */
 }
+
+void
+gmonclock(struct clockintr *cl, void *cf)
+{
+	uint64_t count;
+	struct clockframe *frame = cf;
+	struct gmonparam *g = curcpu()->ci_gmon;
+	u_long i;
+
+	count = clockintr_advance(cl, profclock_period);
+	if (count > ULONG_MAX)
+		count = ULONG_MAX;
+
+	/*
+	 * Kernel statistics are just like addupc_intr(), only easier.
+	 */
+	if (!CLKF_USERMODE(frame) && g != NULL && g->state == GMON_PROF_ON) {
+		i = CLKF_PC(frame) - g->lowpc;
+		if (i < g->textsize) {
+			i /= HISTFRACTION * sizeof(*g->kcount);
+			g->kcount[i] += (u_long)count;
+		}
+	}
+}
+
 #endif /* GPROF || DDBPROF */
 
 /*
@@ -247,6 +289,7 @@ sys_profil(struct proc *p, void *v, register_t *retval)
 		return (EINVAL);
 	if (SCARG(uap, scale) == 0) {
 		stopprofclock(pr);
+		need_resched(curcpu());
 		return (0);
 	}
 	upp = &pr->ps_prof;
@@ -259,10 +302,31 @@ sys_profil(struct proc *p, void *v, register_t *retval)
 	upp->pr_size = SCARG(uap, size);
 	startprofclock(pr);
 	splx(s);
+	need_resched(curcpu());
 
 	return (0);
 }
 
+void
+profclock(struct clockintr *cl, void *cf)
+{
+	uint64_t count;
+	struct clockframe *frame = cf;
+	struct proc *p = curproc;
+
+	count = clockintr_advance(cl, profclock_period);
+	if (count > ULONG_MAX)
+		count = ULONG_MAX;
+
+	if (CLKF_USERMODE(frame)) {
+		if (ISSET(p->p_p->ps_flags, PS_PROFIL))
+			addupc_intr(p, CLKF_PC(frame), (u_long)count);
+	} else {
+		if (p != NULL && ISSET(p->p_p->ps_flags, PS_PROFIL))
+			addupc_intr(p, PROC_PC(p), (u_long)count);
+	}
+}
+
 /*
  * Scale is a fixed-point number with the binary point 16 bits
  * into the value, and is <= 1.0.  pc is at most 32 bits, so the
diff --git a/sys/kern/syscalls.c b/sys/kern/syscalls.c
index 92387f661..2667a351c 100644
--- a/sys/kern/syscalls.c
+++ b/sys/kern/syscalls.c
@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscalls.c,v 1.264 2023/05/18 10:24:28 mvs Exp $	*/
+/*	$OpenBSD: syscalls.c,v 1.265 2023/07/24 19:33:29 miod Exp $	*/
 
 /*
  * System call names.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.248 2023/05/18 10:23:19 mvs Exp 
+ * created from;	OpenBSD: syscalls.master,v 1.249 2023/07/24 19:32:23 miod Exp 
  */
 
 const char *const syscallnames[] = {
diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master
index 34bef2ba6..d6278aeb7 100644
--- a/sys/kern/syscalls.master
+++ b/sys/kern/syscalls.master
@@ -1,4 +1,4 @@
-;	$OpenBSD: syscalls.master,v 1.248 2023/05/18 10:23:19 mvs Exp $
+;	$OpenBSD: syscalls.master,v 1.249 2023/07/24 19:32:23 miod Exp $
 ;	$NetBSD: syscalls.master,v 1.32 1996/04/23 10:24:21 mycroft Exp $
 
 ;	@(#)syscalls.master	8.2 (Berkeley) 1/13/94
@@ -279,7 +279,7 @@
 139	OBSOL		4.2 sigreturn
 140	STD NOLOCK	{ int sys_adjtime(const struct timeval *delta, \
 			    struct timeval *olddelta); }
-141	STD		{ int sys_getlogin_r(char *namebuf, u_int namelen); }
+141	STD		{ int sys_getlogin_r(char *namebuf, size_t namelen); }
 142	STD		{ int sys_getthrname(pid_t tid, char *name, size_t len); }
 143	STD		{ int sys_setthrname(pid_t tid, const char *name); }
 144	OBSOL		ogetrlimit
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index da37b31f7..9824d161c 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_socket.c,v 1.305 2023/07/04 22:28:24 mvs Exp $	*/
+/*	$OpenBSD: uipc_socket.c,v 1.306 2023/07/22 14:30:39 mvs Exp $	*/
 /*	$NetBSD: uipc_socket.c,v 1.21 1996/02/04 02:17:52 christos Exp $	*/
 
 /*
@@ -2366,7 +2366,8 @@ sobuf_print(struct sockbuf *sb,
 	(*pr)("\tsb_mbtail: %p\n", sb->sb_mbtail);
 	(*pr)("\tsb_lastrecord: %p\n", sb->sb_lastrecord);
 	(*pr)("\tsb_sel: ...\n");
-	(*pr)("\tsb_flags: %i\n", sb->sb_flags);
+	(*pr)("\tsb_flags: %04x\n", sb->sb_flags);
+	(*pr)("\tsb_state: %04x\n", sb->sb_state);
 	(*pr)("\tsb_timeo_nsecs: %llu\n", sb->sb_timeo_nsecs);
 }
 
diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c
index 7610ac61c..1c771d1bf 100644
--- a/sys/net/if_loop.c
+++ b/sys/net/if_loop.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_loop.c,v 1.96 2023/07/18 16:01:20 bluhm Exp $	*/
+/*	$OpenBSD: if_loop.c,v 1.97 2023/07/21 22:24:41 bluhm Exp $	*/
 /*	$NetBSD: if_loop.c,v 1.15 1996/05/07 02:40:33 thorpej Exp $	*/
 
 /*
@@ -146,6 +146,7 @@ void	lortrequest(struct ifnet *, int, struct rtentry *);
 void	loinput(struct ifnet *, struct mbuf *);
 int	looutput(struct ifnet *,
 	    struct mbuf *, struct sockaddr *, struct rtentry *);
+int	lo_bpf_mtap(caddr_t, const struct mbuf *, u_int);
 
 int	loop_clone_create(struct if_clone *, int);
 int	loop_clone_destroy(struct ifnet *);
@@ -177,6 +178,7 @@ loop_clone_create(struct if_clone *ifc, int unit)
 	    IFCAP_CSUM_TCPv4 | IFCAP_CSUM_UDPv4 |
 	    IFCAP_CSUM_TCPv6 | IFCAP_CSUM_UDPv6 |
 	    IFCAP_LRO | IFCAP_TSOv4 | IFCAP_TSOv6;
+	ifp->if_bpf_mtap = lo_bpf_mtap;
 	ifp->if_rtrequest = lortrequest;
 	ifp->if_ioctl = loioctl;
 	ifp->if_input = loinput;
@@ -231,6 +233,13 @@ loop_clone_destroy(struct ifnet *ifp)
 	return (0);
 }
 
+int
+lo_bpf_mtap(caddr_t if_bpf, const struct mbuf *m, u_int dir)
+{
+	/* loopback dumps on output, disable input bpf */
+	return (0);
+}
+
 void
 loinput(struct ifnet *ifp, struct mbuf *m)
 {
diff --git a/sys/sys/clockintr.h b/sys/sys/clockintr.h
index 6bd3d34e9..4a546a564 100644
--- a/sys/sys/clockintr.h
+++ b/sys/sys/clockintr.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: clockintr.h,v 1.8 2023/06/15 22:18:06 cheloha Exp $ */
+/* $OpenBSD: clockintr.h,v 1.9 2023/07/25 18:16:19 cheloha Exp $ */
 /*
  * Copyright (c) 2020-2022 Scott Cheloha <cheloha@openbsd.org>
  *
@@ -112,8 +112,7 @@ struct clockintr_queue {
 
 /* Global state flags. */
 #define CL_INIT			0x00000001	/* global init done */
-#define CL_STATCLOCK		0x00000002	/* statclock variables set */
-#define CL_STATE_MASK		0x00000003
+#define CL_STATE_MASK		0x00000001
 
 /* Global behavior flags. */
 #define CL_RNDSTAT		0x80000000	/* randomized statclock */
@@ -122,13 +121,17 @@ struct clockintr_queue {
 void clockintr_cpu_init(const struct intrclock *);
 int clockintr_dispatch(void *);
 void clockintr_init(u_int);
-void clockintr_setstatclockrate(int);
 void clockintr_trigger(void);
 
 /*
  * Kernel API
  */
 
+uint64_t clockintr_advance(struct clockintr *, uint64_t);
+void clockintr_cancel(struct clockintr *);
+struct clockintr *clockintr_establish(struct clockintr_queue *,
+    void (*)(struct clockintr *, void *));
+void clockintr_stagger(struct clockintr *, uint64_t, u_int, u_int);
 void clockqueue_init(struct clockintr_queue *);
 int sysctl_clockintr(int *, u_int, void *, size_t *, void *, size_t);
 
diff --git a/sys/sys/resourcevar.h b/sys/sys/resourcevar.h
index a17302d93..d25840445 100644
--- a/sys/sys/resourcevar.h
+++ b/sys/sys/resourcevar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: resourcevar.h,v 1.26 2023/04/25 00:58:47 cheloha Exp $	*/
+/*	$OpenBSD: resourcevar.h,v 1.27 2023/07/25 18:16:19 cheloha Exp $	*/
 /*	$NetBSD: resourcevar.h,v 1.12 1995/11/22 23:01:53 cgd Exp $	*/
 
 /*
@@ -60,8 +60,13 @@ do {									\
 
 #include <lib/libkern/libkern.h>	/* for KASSERT() */
 
+struct clockintr;
+
+extern uint32_t profclock_period;
+
 void	 addupc_intr(struct proc *, u_long, u_long);
 void	 addupc_task(struct proc *, u_long, u_int);
+void	 profclock(struct clockintr *, void *);
 void	 tuagg_unlocked(struct process *, struct proc *);
 void	 tuagg(struct process *, struct proc *);
 struct tusage;
diff --git a/sys/sys/sched.h b/sys/sys/sched.h
index ff1fb20a9..8673205dc 100644
--- a/sys/sys/sched.h
+++ b/sys/sys/sched.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched.h,v 1.57 2020/12/25 12:49:31 visa Exp $	*/
+/*	$OpenBSD: sched.h,v 1.58 2023/07/25 18:16:19 cheloha Exp $	*/
 /* $NetBSD: sched.h,v 1.2 1999/02/28 18:14:58 ross Exp $ */
 
 /*-
@@ -90,6 +90,7 @@
 
 #define	SCHED_NQS	32			/* 32 run queues. */
 
+struct clockintr;
 struct smr_entry;
 
 /*
@@ -105,8 +106,8 @@ struct schedstate_percpu {
 	u_int64_t spc_cp_time[CPUSTATES]; /* CPU state statistics */
 	u_char spc_curpriority;		/* usrpri of curproc */
 	int spc_rrticks;		/* ticks until roundrobin() */
-	int spc_pscnt;			/* prof/stat counter */
-	int spc_psdiv;			/* prof/stat divisor */
+
+	struct clockintr *spc_profclock; /* [o] profclock handle */
 
 	u_int spc_nrun;			/* procs on the run queues */
 	fixpt_t spc_ldavg;		/* shortest load avg. for this cpu */
@@ -137,6 +138,7 @@ struct cpustats {
 #define SPCF_SWITCHCLEAR        (SPCF_SEENRR|SPCF_SHOULDYIELD)
 #define SPCF_SHOULDHALT		0x0004	/* CPU should be vacated */
 #define SPCF_HALTED		0x0008	/* CPU has been halted */
+#define SPCF_PROFCLOCK		0x0010	/* profclock() was started */
 
 #define	SCHED_PPQ	(128 / SCHED_NQS)	/* priorities per queue */
 #define NICE_WEIGHT 2			/* priorities per nice level */
diff --git a/sys/sys/syscall.h b/sys/sys/syscall.h
index 0b84800e3..6c6988893 100644
--- a/sys/sys/syscall.h
+++ b/sys/sys/syscall.h
@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscall.h,v 1.263 2023/05/18 10:24:28 mvs Exp $	*/
+/*	$OpenBSD: syscall.h,v 1.264 2023/07/24 19:33:29 miod Exp $	*/
 
 /*
  * System call numbers.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.248 2023/05/18 10:23:19 mvs Exp
+ * created from;	OpenBSD: syscalls.master,v 1.249 2023/07/24 19:32:23 miod Exp
  */
 
 /* syscall: "syscall" ret: "int" args: "int" "..." */
@@ -417,7 +417,7 @@
 /* syscall: "adjtime" ret: "int" args: "const struct timeval *" "struct timeval *" */
 #define	SYS_adjtime	140
 
-/* syscall: "getlogin_r" ret: "int" args: "char *" "u_int" */
+/* syscall: "getlogin_r" ret: "int" args: "char *" "size_t" */
 #define	SYS_getlogin_r	141
 
 /* syscall: "getthrname" ret: "int" args: "pid_t" "char *" "size_t" */
diff --git a/sys/sys/syscallargs.h b/sys/sys/syscallargs.h
index e4cc02016..b352dae8f 100644
--- a/sys/sys/syscallargs.h
+++ b/sys/sys/syscallargs.h
@@ -1,10 +1,10 @@
-/*	$OpenBSD: syscallargs.h,v 1.266 2023/05/18 10:24:28 mvs Exp $	*/
+/*	$OpenBSD: syscallargs.h,v 1.267 2023/07/24 19:33:29 miod Exp $	*/
 
 /*
  * System call argument lists.
  *
  * DO NOT EDIT-- this file is automatically generated.
- * created from;	OpenBSD: syscalls.master,v 1.248 2023/05/18 10:23:19 mvs Exp
+ * created from;	OpenBSD: syscalls.master,v 1.249 2023/07/24 19:32:23 miod Exp
  */
 
 #ifdef	syscallarg
@@ -714,7 +714,7 @@ struct sys_adjtime_args {
 
 struct sys_getlogin_r_args {
 	syscallarg(char *) namebuf;
-	syscallarg(u_int) namelen;
+	syscallarg(size_t) namelen;
 };
 
 struct sys_getthrname_args {
diff --git a/usr.bin/openssl/apps.c b/usr.bin/openssl/apps.c
index 44b304a98..70857e042 100644
--- a/usr.bin/openssl/apps.c
+++ b/usr.bin/openssl/apps.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: apps.c,v 1.65 2023/06/11 12:35:00 jsg Exp $ */
+/* $OpenBSD: apps.c,v 1.66 2023/07/23 11:39:29 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -1064,7 +1064,7 @@ load_config(BIO *err, CONF *cnf)
 }
 
 char *
-make_config_name()
+make_config_name(void)
 {
 	const char *t = X509_get_default_cert_area();
 	char *p;
diff --git a/usr.bin/openssl/asn1pars.c b/usr.bin/openssl/asn1pars.c
index 3eac72cb6..6b9984233 100644
--- a/usr.bin/openssl/asn1pars.c
+++ b/usr.bin/openssl/asn1pars.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1pars.c,v 1.15 2023/03/10 09:44:54 tb Exp $ */
+/* $OpenBSD: asn1pars.c,v 1.16 2023/07/23 11:39:29 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -221,7 +221,7 @@ static const struct option asn1pars_options[] = {
 };
 
 static void
-asn1pars_usage()
+asn1pars_usage(void)
 {
 	fprintf(stderr,
 	    "usage: asn1parse [-i] [-dlimit num] [-dump] [-genconf file] "
diff --git a/usr.bin/openssl/dhparam.c b/usr.bin/openssl/dhparam.c
index 0542464d7..00bf69726 100644
--- a/usr.bin/openssl/dhparam.c
+++ b/usr.bin/openssl/dhparam.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dhparam.c,v 1.17 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: dhparam.c,v 1.18 2023/07/23 11:39:29 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -222,7 +222,7 @@ static const struct option dhparam_options[] = {
 };
 
 static void
-dhparam_usage()
+dhparam_usage(void)
 {
 	fprintf(stderr,
 	    "usage: dhparam [-2 | -5] [-C] [-check] [-dsaparam]\n"
diff --git a/usr.bin/openssl/errstr.c b/usr.bin/openssl/errstr.c
index cb7cf1d5a..d4ffd70c3 100644
--- a/usr.bin/openssl/errstr.c
+++ b/usr.bin/openssl/errstr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: errstr.c,v 1.10 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: errstr.c,v 1.11 2023/07/23 11:20:11 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -68,25 +68,14 @@
 #include <openssl/lhash.h>
 #include <openssl/ssl.h>
 
-static struct {
-	int stats;
-} cfg;
-
 static const struct option errstr_options[] = {
-	{
-		.name = "stats",
-		.desc = "Print debugging statistics for the hash table",
-		.type = OPTION_FLAG,
-		.opt.flag = &cfg.stats,
-	},
 	{ NULL },
 };
 
 static void
-errstr_usage()
+errstr_usage(void)
 {
-	fprintf(stderr, "usage: errstr [-stats] errno ...\n");
-	options_usage(errstr_options);
+	fprintf(stderr, "usage: errstr errno ...\n");
 }
 
 int
@@ -103,29 +92,11 @@ errstr_main(int argc, char **argv)
 		exit(1);
 	}
 
-	memset(&cfg, 0, sizeof(cfg));
-
 	if (options_parse(argc, argv, errstr_options, NULL, &argsused) != 0) {
 		errstr_usage();
 		return (1);
 	}
 
-	if (cfg.stats) {
-		BIO *out;
-
-		if ((out = BIO_new_fp(stdout, BIO_NOCLOSE)) == NULL) {
-			fprintf(stderr, "Out of memory");
-			return (1);
-		}
-
-		lh_ERR_STRING_DATA_node_stats_bio(ERR_get_string_table(), out);
-		lh_ERR_STRING_DATA_stats_bio(ERR_get_string_table(), out);
-		lh_ERR_STRING_DATA_node_usage_stats_bio(
-			    ERR_get_string_table(), out);
-
-		BIO_free_all(out);
-	}
-
 	for (i = argsused; i < argc; i++) {
 		errno = 0;
 		ularg = argv[i];
diff --git a/usr.bin/openssl/genpkey.c b/usr.bin/openssl/genpkey.c
index e2445c143..10c5b0f66 100644
--- a/usr.bin/openssl/genpkey.c
+++ b/usr.bin/openssl/genpkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: genpkey.c,v 1.16 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: genpkey.c,v 1.17 2023/07/23 11:39:29 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006
  */
@@ -206,7 +206,7 @@ static const struct option genpkey_options[] = {
 };
 
 static void
-genpkey_usage()
+genpkey_usage(void)
 {
 	fprintf(stderr,
 	    "usage: genpkey [-algorithm alg] [cipher] [-genparam] [-out file]\n"
diff --git a/usr.bin/openssl/openssl.1 b/usr.bin/openssl/openssl.1
index 4023061d1..be060a3e5 100644
--- a/usr.bin/openssl/openssl.1
+++ b/usr.bin/openssl/openssl.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: openssl.1,v 1.150 2023/07/03 08:37:22 jmc Exp $
+.\" $OpenBSD: openssl.1,v 1.152 2023/07/27 07:01:50 tb Exp $
 .\" ====================================================================
 .\" Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 .\"
@@ -110,7 +110,7 @@
 .\" copied and put under another distribution licence
 .\" [including the GNU Public Licence.]
 .\"
-.Dd $Mdocdate: July 3 2023 $
+.Dd $Mdocdate: July 27 2023 $
 .Dt OPENSSL 1
 .Os
 .Sh NAME
@@ -2300,7 +2300,6 @@ Print extra details about the processing.
 .Tg errstr
 .Sh ERRSTR
 .Nm openssl errstr
-.Op Fl stats
 .Ar errno ...
 .Pp
 The
@@ -2322,12 +2321,6 @@ The remaining fields
 and
 .Bq reason string
 are all ASCII text.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl stats
-Print debugging statistics about various aspects of the hash table.
-.El
 .Tg gendsa
 .Sh GENDSA
 .Bl -hang -width "openssl gendsa"
@@ -6056,7 +6049,7 @@ itself, then 1 for the CA that signed the certificate and so on.
 .Tg version
 .Sh VERSION
 .Nm openssl version
-.Op Fl abdfopv
+.Op Fl abdfpv
 .Pp
 The
 .Nm version
@@ -6076,8 +6069,6 @@ was built.
 setting.
 .It Fl f
 Compilation flags.
-.It Fl o
-Option information: various options set when the library was built.
 .It Fl p
 Platform setting.
 .It Fl v
diff --git a/usr.bin/openssl/pkcs7.c b/usr.bin/openssl/pkcs7.c
index 4e66855a8..da30e23e6 100644
--- a/usr.bin/openssl/pkcs7.c
+++ b/usr.bin/openssl/pkcs7.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkcs7.c,v 1.14 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: pkcs7.c,v 1.15 2023/07/23 11:39:29 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -138,7 +138,7 @@ static const struct option pkcs7_options[] = {
 };
 
 static void
-pkcs7_usage()
+pkcs7_usage(void)
 {
 	fprintf(stderr, "usage: pkcs7 [-in file] "
 	    "[-inform DER | PEM] [-noout]\n"
diff --git a/usr.bin/openssl/pkcs8.c b/usr.bin/openssl/pkcs8.c
index d78202e03..9776b9105 100644
--- a/usr.bin/openssl/pkcs8.c
+++ b/usr.bin/openssl/pkcs8.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkcs8.c,v 1.16 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: pkcs8.c,v 1.17 2023/07/23 11:39:29 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999-2004.
  */
@@ -184,7 +184,7 @@ static const struct option pkcs8_options[] = {
 };
 
 static void
-pkcs8_usage()
+pkcs8_usage(void)
 {
 	fprintf(stderr, "usage: pkcs8 [-in file] [inform der | pem] "
 	    "[-nocrypt] [-noiter]\n"
diff --git a/usr.bin/openssl/pkey.c b/usr.bin/openssl/pkey.c
index cb558f5ac..47fa2dd36 100644
--- a/usr.bin/openssl/pkey.c
+++ b/usr.bin/openssl/pkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkey.c,v 1.19 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: pkey.c,v 1.20 2023/07/23 11:39:29 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006
  */
@@ -195,7 +195,7 @@ static const struct option pkey_options[] = {
 };
 
 static void
-pkey_usage()
+pkey_usage(void)
 {
 	int n = 0;
 
diff --git a/usr.bin/openssl/pkeyparam.c b/usr.bin/openssl/pkeyparam.c
index 946195640..543715e52 100644
--- a/usr.bin/openssl/pkeyparam.c
+++ b/usr.bin/openssl/pkeyparam.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkeyparam.c,v 1.17 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: pkeyparam.c,v 1.18 2023/07/23 11:39:29 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006
  */
@@ -110,7 +110,7 @@ static const struct option pkeyparam_options[] = {
 };
 
 static void
-pkeyparam_usage()
+pkeyparam_usage(void)
 {
 	fprintf(stderr,
 	    "usage: pkeyparam [-check] [-in file] [-noout] [-out file] "
diff --git a/usr.bin/openssl/pkeyutl.c b/usr.bin/openssl/pkeyutl.c
index 5320ba543..2f046396e 100644
--- a/usr.bin/openssl/pkeyutl.c
+++ b/usr.bin/openssl/pkeyutl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkeyutl.c,v 1.19 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: pkeyutl.c,v 1.20 2023/07/23 11:39:29 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -239,7 +239,7 @@ static const struct option pkeyutl_options[] = {
 };
 
 static void
-pkeyutl_usage()
+pkeyutl_usage(void)
 {
 	fprintf(stderr,
 	    "usage: pkeyutl [-asn1parse] [-certin] [-decrypt] [-derive] "
diff --git a/usr.bin/openssl/prime.c b/usr.bin/openssl/prime.c
index d704d882f..36703c574 100644
--- a/usr.bin/openssl/prime.c
+++ b/usr.bin/openssl/prime.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: prime.c,v 1.17 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: prime.c,v 1.18 2023/07/23 11:39:29 tb Exp $ */
 /* ====================================================================
  * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
  *
@@ -101,7 +101,7 @@ static const struct option prime_options[] = {
 };
 
 static void
-prime_usage()
+prime_usage(void)
 {
 	fprintf(stderr,
 	    "usage: prime [-bits n] [-checks n] [-generate] [-hex] [-safe] "
diff --git a/usr.bin/openssl/rand.c b/usr.bin/openssl/rand.c
index a0f3b4466..26003224c 100644
--- a/usr.bin/openssl/rand.c
+++ b/usr.bin/openssl/rand.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rand.c,v 1.17 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: rand.c,v 1.18 2023/07/23 11:39:29 tb Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
  *
@@ -92,7 +92,7 @@ static const struct option rand_options[] = {
 };
 
 static void
-rand_usage()
+rand_usage(void)
 {
 	fprintf(stderr,
 	    "usage: rand [-base64 | -hex] [-out file] num\n");
diff --git a/usr.bin/openssl/rsa.c b/usr.bin/openssl/rsa.c
index 953daaacf..5492cd616 100644
--- a/usr.bin/openssl/rsa.c
+++ b/usr.bin/openssl/rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa.c,v 1.18 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: rsa.c,v 1.19 2023/07/23 11:39:29 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -228,7 +228,7 @@ static const struct option rsa_options[] = {
 };
 
 static void
-rsa_usage()
+rsa_usage(void)
 {
 	int n = 0;
 
diff --git a/usr.bin/openssl/rsautl.c b/usr.bin/openssl/rsautl.c
index d67e78807..6d8069cd7 100644
--- a/usr.bin/openssl/rsautl.c
+++ b/usr.bin/openssl/rsautl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsautl.c,v 1.23 2023/05/05 18:01:27 tb Exp $ */
+/* $OpenBSD: rsautl.c,v 1.24 2023/07/23 11:39:29 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -218,7 +218,7 @@ static const struct option rsautl_options[] = {
 };
 
 static void
-rsautl_usage()
+rsautl_usage(void)
 {
 	fprintf(stderr,
 	    "usage: rsautl [-asn1parse] [-certin] [-decrypt] [-encrypt] "
diff --git a/usr.bin/openssl/speed.c b/usr.bin/openssl/speed.c
index a1a69c267..f50d22406 100644
--- a/usr.bin/openssl/speed.c
+++ b/usr.bin/openssl/speed.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: speed.c,v 1.33 2023/05/20 12:03:02 tb Exp $ */
+/* $OpenBSD: speed.c,v 1.34 2023/07/27 07:01:50 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1746,24 +1746,7 @@ show_res:
 	if (!mr) {
 		fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION));
 		fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON));
-		printf("options:");
-		printf("%s ", BN_options());
-#ifndef OPENSSL_NO_RC4
-		printf("%s ", RC4_options());
-#endif
-#ifndef OPENSSL_NO_DES
-		printf("%s ", DES_options());
-#endif
-#ifndef OPENSSL_NO_AES
-		printf("%s ", AES_options());
-#endif
-#ifndef OPENSSL_NO_IDEA
-		printf("%s ", idea_options());
-#endif
-#ifndef OPENSSL_NO_BF
-		printf("%s ", BF_options());
-#endif
-		fprintf(stdout, "\n%s\n", SSLeay_version(SSLEAY_CFLAGS));
+		fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_CFLAGS));
 	}
 	if (pr_header) {
 		if (mr)
diff --git a/usr.bin/openssl/version.c b/usr.bin/openssl/version.c
index 6ff1860ea..991e213b8 100644
--- a/usr.bin/openssl/version.c
+++ b/usr.bin/openssl/version.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: version.c,v 1.11 2023/03/06 14:32:06 tb Exp $ */
+/* $OpenBSD: version.c,v 1.12 2023/07/27 07:01:50 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -184,7 +184,6 @@ static const struct option version_options[] = {
 	},
 	{
 		.name = "o",
-		.desc = "Option information",
 		.type = OPTION_FLAG,
 		.opt.flag = &cfg.options,
 	},
@@ -206,7 +205,7 @@ static const struct option version_options[] = {
 static void
 version_usage(void)
 {
-	fprintf(stderr, "usage: version [-abdfopv]\n");
+	fprintf(stderr, "usage: version [-abdfpv]\n");
 	options_usage(version_options);
 }
 
@@ -241,23 +240,6 @@ version_main(int argc, char **argv)
 		printf("%s\n", SSLeay_version(SSLEAY_BUILT_ON));
 	if (cfg.platform)
 		printf("%s\n", SSLeay_version(SSLEAY_PLATFORM));
-	if (cfg.options) {
-		printf("options:  ");
-		printf("%s ", BN_options());
-#ifndef OPENSSL_NO_RC4
-		printf("%s ", RC4_options());
-#endif
-#ifndef OPENSSL_NO_DES
-		printf("%s ", DES_options());
-#endif
-#ifndef OPENSSL_NO_IDEA
-		printf("%s ", idea_options());
-#endif
-#ifndef OPENSSL_NO_BF
-		printf("%s ", BF_options());
-#endif
-		printf("\n");
-	}
 	if (cfg.cflags)
 		printf("%s\n", SSLeay_version(SSLEAY_CFLAGS));
 	if (cfg.dir)
diff --git a/usr.bin/ssh/mux.c b/usr.bin/ssh/mux.c
index 9968bf926..d2a8e24bd 100644
--- a/usr.bin/ssh/mux.c
+++ b/usr.bin/ssh/mux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mux.c,v 1.97 2023/06/20 23:59:33 djm Exp $ */
+/* $OpenBSD: mux.c,v 1.98 2023/07/26 23:06:00 djm Exp $ */
 /*
  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
  *
@@ -1862,7 +1862,7 @@ mux_client_request_session(int fd)
 	const char *term = NULL;
 	u_int i, echar, rid, sid, esid, exitval, type, exitval_seen;
 	extern char **environ;
-	int r, rawmode;
+	int r, rawmode = 0;
 
 	debug3_f("entering");
 
@@ -1971,9 +1971,15 @@ mux_client_request_session(int fd)
 	ssh_signal(SIGTERM, control_client_sighandler);
 	ssh_signal(SIGWINCH, control_client_sigrelay);
 
-	rawmode = tty_flag;
-	if (tty_flag)
-		enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
+	if (options.fork_after_authentication)
+		daemon(1, 1);
+	else {
+		rawmode = tty_flag;
+		if (tty_flag) {
+			enter_raw_mode(
+			    options.request_tty == REQUEST_TTY_FORCE);
+		}
+	}
 
 	/*
 	 * Stick around until the controlee closes the client_fd.
diff --git a/usr.bin/ssh/ssh-agent.1 b/usr.bin/ssh/ssh-agent.1
index 0c8979498..327f0e196 100644
--- a/usr.bin/ssh/ssh-agent.1
+++ b/usr.bin/ssh/ssh-agent.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-agent.1,v 1.77 2023/07/20 05:43:39 jmc Exp $
+.\" $OpenBSD: ssh-agent.1,v 1.78 2023/07/23 20:04:45 naddy Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 20 2023 $
+.Dd $Mdocdate: July 23 2023 $
 .Dt SSH-AGENT 1
 .Os
 .Sh NAME
@@ -118,9 +118,9 @@ option allows clients of a forwarded
 .Nm
 to load PKCS#11 or FIDO provider libraries.
 By default only local clients may perform this operation.
-Note that signalling that a
+Note that signalling that an
 .Nm
-client remote is performed by
+client is remote is performed by
 .Xr ssh 1 ,
 and use of other tools to forward access to the agent socket, may circumvent
 this restriction.
diff --git a/usr.bin/ssh/ssh-keygen.1 b/usr.bin/ssh/ssh-keygen.1
index 1be082282..c760f91be 100644
--- a/usr.bin/ssh/ssh-keygen.1
+++ b/usr.bin/ssh/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keygen.1,v 1.228 2023/02/10 06:40:48 jmc Exp $
+.\"	$OpenBSD: ssh-keygen.1,v 1.229 2023/07/23 20:04:45 naddy Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: February 10 2023 $
+.Dd $Mdocdate: July 23 2023 $
 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME
@@ -733,7 +733,7 @@ Successful testing of the signature is signalled by
 .Nm
 returning a zero exit status.
 .It Fl Y Cm sign
-Cryptographically sign a file or some data using a SSH key.
+Cryptographically sign a file or some data using an SSH key.
 When signing,
 .Nm
 accepts zero or more files to sign on the command-line - if no files
diff --git a/usr.bin/ssh/ssh.1 b/usr.bin/ssh/ssh.1
index 0a65f57bb..bd8c2ff6a 100644
--- a/usr.bin/ssh/ssh.1
+++ b/usr.bin/ssh/ssh.1
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh.1,v 1.436 2023/07/17 05:38:10 jmc Exp $
-.Dd $Mdocdate: July 17 2023 $
+.\" $OpenBSD: ssh.1,v 1.437 2023/07/23 20:04:45 naddy Exp $
+.Dd $Mdocdate: July 23 2023 $
 .Dt SSH 1
 .Os
 .Sh NAME
@@ -323,7 +323,7 @@ by appending
 to identity filenames.
 .Pp
 .It Fl J Ar destination
-Connect to the target host by first making a
+Connect to the target host by first making an
 .Nm
 connection to the jump host described by
 .Ar destination
diff --git a/usr.bin/ssh/ssh.c b/usr.bin/ssh/ssh.c
index 448e99d58..5933b0a15 100644
--- a/usr.bin/ssh/ssh.c
+++ b/usr.bin/ssh/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.592 2023/07/17 05:41:53 jmc Exp $ */
+/* $OpenBSD: ssh.c,v 1.593 2023/07/26 23:06:00 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -114,10 +114,11 @@ int tty_flag = 0;
  * Flag indicating that the current process should be backgrounded and
  * a new mux-client launched in the foreground for ControlPersist.
  */
-int need_controlpersist_detach = 0;
+static int need_controlpersist_detach = 0;
 
 /* Copies of flags for ControlPersist foreground mux-client */
-int ostdin_null_flag, osession_type, otty_flag, orequest_tty;
+static int ostdin_null_flag, osession_type, otty_flag, orequest_tty;
+static int ofork_after_authentication;
 
 /*
  * General data structure for command line options and options configurable
@@ -1736,11 +1737,15 @@ control_persist_detach(void)
 		/* Child: master process continues mainloop */
 		break;
 	default:
-		/* Parent: set up mux client to connect to backgrounded master */
+		/*
+		 * Parent: set up mux client to connect to backgrounded
+		 * master.
+		 */
 		debug2_f("background process is %ld", (long)pid);
 		options.stdin_null = ostdin_null_flag;
 		options.request_tty = orequest_tty;
 		tty_flag = otty_flag;
+		options.fork_after_authentication = ofork_after_authentication;
 		options.session_type = osession_type;
 		close(muxserver_sock);
 		muxserver_sock = -1;
@@ -2152,11 +2157,11 @@ ssh_session2(struct ssh *ssh, const struct ssh_conn_info *cinfo)
 		osession_type = options.session_type;
 		orequest_tty = options.request_tty;
 		otty_flag = tty_flag;
+		ofork_after_authentication = options.fork_after_authentication;
 		options.stdin_null = 1;
 		options.session_type = SESSION_TYPE_NONE;
 		tty_flag = 0;
-		if (!options.fork_after_authentication &&
-		    (osession_type != SESSION_TYPE_NONE ||
+		if ((osession_type != SESSION_TYPE_NONE ||
 		    options.stdio_forward_host != NULL))
 			need_controlpersist_detach = 1;
 		options.fork_after_authentication = 1;
diff --git a/usr.sbin/bgpctl/mrtparser.c b/usr.sbin/bgpctl/mrtparser.c
index 77fb54c61..a231f3d0d 100644
--- a/usr.sbin/bgpctl/mrtparser.c
+++ b/usr.sbin/bgpctl/mrtparser.c
@@ -435,7 +435,7 @@ mrt_parse_v2_rib(struct mrt_hdr *hdr, void *msg, int verbose)
 
 		if ((aid = mrt_afi2aid(afi, safi, verbose)) == AID_UNSPEC)
 			goto fail;
-		
+
 		/* prefix */
 		ret = mrt_extract_prefix(b, len, aid, &r->prefix,
 		    &r->prefixlen, verbose);
diff --git a/usr.sbin/bgpctl/output_json.c b/usr.sbin/bgpctl/output_json.c
index 40b48c017..f1617a88a 100644
--- a/usr.sbin/bgpctl/output_json.c
+++ b/usr.sbin/bgpctl/output_json.c
@@ -392,7 +392,7 @@ json_fib(struct kroute_full *kf)
 
 	if (kf->flags & F_MPLS) {
 		json_do_array("mplslabel");
-		json_do_uint("mplslabel", 
+		json_do_uint("mplslabel",
 		    ntohl(kf->mplslabel) >> MPLS_LABEL_OFFSET);
 		json_do_end();
 	}
@@ -956,7 +956,7 @@ json_rib_mem(struct rde_memstats *stats)
 	    stats->attr_cnt * sizeof(struct attr), stats->attr_refs);
 	json_rib_mem_element("attributes", stats->attr_dcnt,
 	    stats->attr_data, UINT64_MAX);
-	json_rib_mem_element("total", UINT64_MAX, 
+	json_rib_mem_element("total", UINT64_MAX,
 	    pts + stats->prefix_cnt * sizeof(struct prefix) +
 	    stats->rib_cnt * sizeof(struct rib_entry) +
 	    stats->path_cnt * sizeof(struct rde_aspath) +
@@ -971,7 +971,7 @@ json_rib_mem(struct rde_memstats *stats)
 	    UINT64_MAX);
 	json_rib_mem_element("prefix_set", stats->pset_cnt, stats->pset_size,
 	    UINT64_MAX);
-	json_rib_mem_element("total", UINT64_MAX, 
+	json_rib_mem_element("total", UINT64_MAX,
 	    stats->aset_size + stats->pset_size, UINT64_MAX);
 	json_do_end();
 }
diff --git a/usr.sbin/bgpctl/output_ometric.c b/usr.sbin/bgpctl/output_ometric.c
index 2b0b9be6c..3648da22b 100644
--- a/usr.sbin/bgpctl/output_ometric.c
+++ b/usr.sbin/bgpctl/output_ometric.c
@@ -297,7 +297,7 @@ ometric_rib_mem(struct rde_memstats *stats)
 	ometric_rib_mem_element("attributes", stats->attr_dcnt,
 	    stats->attr_data, UINT64_MAX);
 
-	ometric_rib_mem_element("total", UINT64_MAX, 
+	ometric_rib_mem_element("total", UINT64_MAX,
 	    pts + stats->prefix_cnt * sizeof(struct prefix) +
 	    stats->rib_cnt * sizeof(struct rib_entry) +
 	    stats->path_cnt * sizeof(struct rde_aspath) +
@@ -314,7 +314,7 @@ ometric_rib_mem(struct rde_memstats *stats)
 	    OKV("type"), OKV("prefix_set"), NULL);
 	ometric_set_int_with_labels(rde_set_count, stats->pset_cnt,
 	    OKV("type"), OKV("prefix_set"), NULL);
-	ometric_rib_mem_element("set_total", UINT64_MAX, 
+	ometric_rib_mem_element("set_total", UINT64_MAX,
 	    stats->aset_size + stats->pset_size, UINT64_MAX);
 }
 
diff --git a/usr.sbin/bgpd/rde_update.c b/usr.sbin/bgpd/rde_update.c
index 70d3fa27d..c529e61fc 100644
--- a/usr.sbin/bgpd/rde_update.c
+++ b/usr.sbin/bgpd/rde_update.c
@@ -330,7 +330,7 @@ up_generate_addpath(struct rde_peer *peer, struct rib_entry *re)
 /*
  * Generate updates for the add-path send all case. Since all prefixes
  * are distributed just remove old and add new.
- */ 
+ */
 void
 up_generate_addpath_all(struct rde_peer *peer, struct rib_entry *re,
     struct prefix *new, struct prefix *old)
@@ -959,7 +959,7 @@ up_generate_mp_reach(struct ibuf *buf, struct rde_peer *peer,
  *    |   Network Layer Reachability Information (variable) |
  *    +-----------------------------------------------------+
  *
- * Multiprotocol messages use MP_REACH_NLRI and MP_UNREACH_NLRI 
+ * Multiprotocol messages use MP_REACH_NLRI and MP_UNREACH_NLRI
  * the latter will be the only path attribute in a message.
  */
 
@@ -1012,7 +1012,7 @@ up_dump_withdraws(struct ibuf *buf, struct rde_peer *peer, uint8_t aid)
 		return -1;
 
 	if (aid != AID_INET) {
-		/* write MP_UNREACH_NLRI attribute length (always extended) */ 
+		/* write MP_UNREACH_NLRI attribute length (always extended) */
 		len -= 4; /* skip attribute header */
 		if (ibuf_set_n16(buf, off + sizeof(len) + 2, len) == -1)
 			return -1;
diff --git a/usr.sbin/eeprom/defs.h b/usr.sbin/eeprom/defs.h
index 1ae5fe523..c3ee813f4 100644
--- a/usr.sbin/eeprom/defs.h
+++ b/usr.sbin/eeprom/defs.h
@@ -48,7 +48,7 @@
 #define EE_BANNER_ENABLE_LOC	0x20
 
 /*
- * Keyword table entry.  Contains a pointer to the keyword, the 
+ * Keyword table entry.  Contains a pointer to the keyword, the
  * offset into the prom where the value lives, and a pointer to
  * the function that handles that value.
  */
diff --git a/usr.sbin/fw_update/patterns.c b/usr.sbin/fw_update/patterns.c
index 2bbbe9f24..ec61f61ee 100644
--- a/usr.sbin/fw_update/patterns.c
+++ b/usr.sbin/fw_update/patterns.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: patterns.c,v 1.9 2023/06/27 22:31:27 patrick Exp $	*/
+/*	$OpenBSD: patterns.c,v 1.10 2023/07/22 03:46:09 jsg Exp $	*/
 
 /*
  * Copyright (c) 1995, 1996 Christopher G. Demetriou.  All rights reserved.
@@ -88,6 +88,8 @@ int
 main(void)
 {
 	printf("%s\n", "acx");
+	printf("%s\n", "amd");
+	printf("%s\n", "amd ^cpu0:* AMD");
 	printf("%s\n", "amdgpu");
 	print_devices("amdgpu", amdgpu_devices, nitems(amdgpu_devices));
 	printf("%s\n", "amdgpu ^vga*vendor \"ATI\", unknown product");
diff --git a/usr.sbin/kvm_mkdb/kvm_mkdb.c b/usr.sbin/kvm_mkdb/kvm_mkdb.c
index c784855bd..821d00066 100644
--- a/usr.sbin/kvm_mkdb/kvm_mkdb.c
+++ b/usr.sbin/kvm_mkdb/kvm_mkdb.c
@@ -142,7 +142,7 @@ main(int argc, char *argv[])
 		if ((fd = open((nlistpath = _PATH_KSYMS), O_RDONLY)) == -1 ||
 		    (rval = kvm_mkdb(fd, dbdir, nlistpath, nlistname, kvm_gid,
 		    verbose)) != 0) {
-			if (fd == -1) 
+			if (fd == -1)
 				warnx("can't open %s", _PATH_KSYMS);
 			else
 				warnx("will try again using %s instead", _PATH_UNIX);
@@ -156,7 +156,7 @@ main(int argc, char *argv[])
 }
 
 int
-kvm_mkdb(int fd, const char *dbdir, char *nlistpath, char *nlistname, gid_t gid, 
+kvm_mkdb(int fd, const char *dbdir, char *nlistpath, char *nlistname, gid_t gid,
     int verbose)
 {
 	DB *db;
diff --git a/usr.sbin/ldapd/conn.c b/usr.sbin/ldapd/conn.c
index 821ac336a..5409aa1e6 100644
--- a/usr.sbin/ldapd/conn.c
+++ b/usr.sbin/ldapd/conn.c
@@ -382,7 +382,7 @@ conn_tls_init(struct conn *conn)
 		log_debug("tls_accept_socket failed");
 		return -1;
 	}
-	
+
 	conn->s_flags |= F_SECURE;
 	buffertls_set(&conn->buftls, conn->bev, conn->tls, conn->fd);
 	buffertls_accept(&conn->buftls, conn->fd);
diff --git a/usr.sbin/ldapd/ldapd.c b/usr.sbin/ldapd/ldapd.c
index d5713cc6d..8a0058645 100644
--- a/usr.sbin/ldapd/ldapd.c
+++ b/usr.sbin/ldapd/ldapd.c
@@ -212,7 +212,7 @@ main(int argc, char *argv[])
 	if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK,
 	    PF_UNSPEC, pipe_parent2ldap) != 0)
 		fatal("socketpair");
-	
+
 	ldape_pid = start_child(PROC_LDAP_SERVER, saved_argv0,
 	    pipe_parent2ldap[1], debug, verbose, csockpath, conffile);
 
diff --git a/usr.sbin/ldapd/ldape.c b/usr.sbin/ldapd/ldape.c
index be3a81a03..a3ef91c45 100644
--- a/usr.sbin/ldapd/ldape.c
+++ b/usr.sbin/ldapd/ldape.c
@@ -345,7 +345,7 @@ ldape(int debug, int verbose, char *csockpath)
 	struct passwd		*pw;
 	char			 host[128];
 	mode_t			old_umask = 0;
-	
+
 	TAILQ_INIT(&conn_list);
 
 	ldap_loginit("ldap server", debug, verbose);
diff --git a/usr.sbin/ldapd/schema.c b/usr.sbin/ldapd/schema.c
index 9d5ec991e..3e5577438 100644
--- a/usr.sbin/ldapd/schema.c
+++ b/usr.sbin/ldapd/schema.c
@@ -844,7 +844,7 @@ schema_parse_attributetype(struct schema *schema)
 	while (attr->syntax == NULL && sup != NULL) {
 		attr->syntax = sup->syntax;
 		sup = sup->sup;
-	} 
+	}
 	if (attr->syntax == NULL) {
 		schema_err(schema, "%s: no syntax defined", ATTR_NAME(attr));
 		goto fail;
@@ -857,19 +857,19 @@ schema_parse_attributetype(struct schema *schema)
 	while (attr->equality == NULL && sup != NULL) {
 		attr->equality = sup->equality;
 		sup = sup->sup;
-	} 
+	}
 	/* Same thing with ordering matching rule. */
 	sup = attr->sup;
 	while (attr->ordering == NULL && sup != NULL) {
 		attr->ordering = sup->ordering;
 		sup = sup->sup;
-	} 
+	}
 	/* ...and substring matching rule. */
 	sup = attr->sup;
 	while (attr->substr == NULL && sup != NULL) {
 		attr->substr = sup->substr;
 		sup = sup->sup;
-	} 
+	}
 
 	if (schema_validate_match_rule(schema, attr, attr->equality, MATCH_EQUALITY) != 0 ||
 	    schema_validate_match_rule(schema, attr, attr->ordering, MATCH_ORDERING) != 0 ||
diff --git a/usr.sbin/ldapd/schema/bsd.schema b/usr.sbin/ldapd/schema/bsd.schema
index b21fabacb..814a076f8 100644
--- a/usr.sbin/ldapd/schema/bsd.schema
+++ b/usr.sbin/ldapd/schema/bsd.schema
@@ -12,5 +12,5 @@ objectclass ( 1.3.6.1.4.1.30155.115.1 NAME 'bsdAccount'
 	SUP top
 	AUXILIARY
 	DESC 'Abstraction of an account with OpenBSD attributes'
-	MAY ( uid $ shadowPassword $ shadowExpire $ modifyTimestamp $ 
+	MAY ( uid $ shadowPassword $ shadowExpire $ modifyTimestamp $
 		userClass $ sshPublicKey ))
diff --git a/usr.sbin/ldomctl/config.c b/usr.sbin/ldomctl/config.c
index 3539363d8..65476b82d 100644
--- a/usr.sbin/ldomctl/config.c
+++ b/usr.sbin/ldomctl/config.c
@@ -2199,7 +2199,7 @@ guest_match_path(struct guest *guest, const char *path)
 	TAILQ_FOREACH(subdevice, &guest->subdevice_list, link) {
 		const char *path2 = subdevice->path;
 		size_t len2 = strlen(path2);
-		
+
 		if (strncmp(path, path2, len < len2 ? len : len2) == 0)
 			return 1;
 	}
@@ -2299,7 +2299,7 @@ guest_add_vpcie(struct guest *guest, uint64_t cfghandle)
 	}
 	if (phys_device == NULL)
 		errx(1, "no matching physical device");
-			
+
 	for (resource_id = 0; resource_id < max_devices; resource_id++) {
 		if (pcie_busses[resource_id] == NULL)
 			break;
@@ -2502,7 +2502,7 @@ guest_add_cpu(struct guest *guest, uint64_t stride)
 
 	cpu = pri_alloc_cpu(-1);
 
-	/* 
+	/*
 	 * Allocate (but don't assign) additional virtual CPUs if the
 	 * specified stride is bigger than one.
 	 */
diff --git a/usr.sbin/ldpd/pfkey.c b/usr.sbin/ldpd/pfkey.c
index 0a4a9124d..afceafbbf 100644
--- a/usr.sbin/ldpd/pfkey.c
+++ b/usr.sbin/ldpd/pfkey.c
@@ -434,7 +434,7 @@ pfkey_establish(struct ldpd_conf *conf, struct nbr *nbr)
 	if (auth == NULL || /* no policy */
 	    auth->md5key_len == 0) /* "no tcpmd5 sig" */
 		return (0);
-	
+
 	return (pfkey_md5sig_establish(nbr, auth));
 }
 
diff --git a/usr.sbin/unbound/acx_nlnetlabs.m4 b/usr.sbin/unbound/acx_nlnetlabs.m4
index cf436ec54..a84fe3f8f 100644
--- a/usr.sbin/unbound/acx_nlnetlabs.m4
+++ b/usr.sbin/unbound/acx_nlnetlabs.m4
@@ -1,5 +1,5 @@
 # acx_nlnetlabs.m4 - common macros for configure checks
-# Copyright 2009, Wouter Wijngaards, NLnet Labs.   
+# Copyright 2009, Wouter Wijngaards, NLnet Labs.
 # BSD licensed.
 #
 # Version 44
@@ -119,7 +119,7 @@
 
 dnl Escape backslashes as \\, for C:\ paths, for the C preprocessor defines.
 dnl for example, ACX_ESCAPE_BACKSLASH($from_var, to_var)
-dnl $1: the text to change. 
+dnl $1: the text to change.
 dnl $2: the result.
 AC_DEFUN([ACX_ESCAPE_BACKSLASH], [$2="`echo $1 | sed -e 's/\\\\/\\\\\\\\/g'`"
 ])
@@ -127,7 +127,7 @@ AC_DEFUN([ACX_ESCAPE_BACKSLASH], [$2="`echo $1 | sed -e 's/\\\\/\\\\\\\\/g'`"
 dnl Calculate comma separated windows-resource numbers from package version.
 dnl Picks the first three(,0) or four numbers out of the name.
 dnl $1: variable for the result
-AC_DEFUN([ACX_RSRC_VERSION], 
+AC_DEFUN([ACX_RSRC_VERSION],
 [$1=[`echo $PACKAGE_VERSION | sed -e 's/^[^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\).*$/\1,\2,\3,\4/' -e 's/^[^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\)[^0-9]*$/\1,\2,\3,0/' `]
 ])
 
@@ -136,7 +136,7 @@ dnl Checks if the compiler will accept the flag.
 dnl $1: the flag without a - in front, so g to check -g.
 dnl $2: executed if yes
 dnl $3: executed if no
-AC_DEFUN([ACX_CHECK_COMPILER_FLAG], 
+AC_DEFUN([ACX_CHECK_COMPILER_FLAG],
 [
 AC_REQUIRE([AC_PROG_CC])
 AC_MSG_CHECKING(whether $CC supports -$1)
@@ -236,12 +236,12 @@ AC_MSG_CHECKING([$CC dependency flag])
 echo 'void f(){}' >conftest.c
 if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then
 	DEPFLAG="-MM"
-else 
+else
   if test "`$CC -xM1 conftest.c 2>&1`" = "conftest.o: conftest.c"; then
 	DEPFLAG="-xM1"
   else
 	DEPFLAG="-MM"  # dunno do something
-  fi 
+  fi
 fi
 AC_MSG_RESULT($DEPFLAG)
 rm -f conftest.c
@@ -451,7 +451,7 @@ AC_DEFUN([ACX_CHECK_FLTO], [
 ])
 
 dnl Check the printf-format attribute (if any)
-dnl result in HAVE_ATTR_FORMAT.  
+dnl result in HAVE_ATTR_FORMAT.
 dnl Make sure you also include the AHX_CONFIG_FORMAT_ATTRIBUTE.
 AC_DEFUN([ACX_CHECK_FORMAT_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -475,7 +475,7 @@ fi
 dnl Setup ATTR_FORMAT config.h parts.
 dnl make sure you call ACX_CHECK_FORMAT_ATTRIBUTE also.
 AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE],
-[ 
+[
 #ifdef HAVE_ATTR_FORMAT
 #  define ATTR_FORMAT(archetype, string_index, first_to_check) \
     __attribute__ ((format (archetype, string_index, first_to_check)))
@@ -485,7 +485,7 @@ AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE],
 ])
 
 dnl Check how to mark function arguments as unused.
-dnl result in HAVE_ATTR_UNUSED.  
+dnl result in HAVE_ATTR_UNUSED.
 dnl Make sure you include AHX_CONFIG_UNUSED_ATTRIBUTE also.
 AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -557,7 +557,7 @@ LT_INIT
 ])
 
 dnl Detect if u_char type is defined, otherwise define it.
-AC_DEFUN([ACX_TYPE_U_CHAR], 
+AC_DEFUN([ACX_TYPE_U_CHAR],
 [AC_CHECK_TYPE([u_char], ,
 	[AC_DEFINE([u_char], [unsigned char], [Define to 'unsigned char if not defined])], [
 AC_INCLUDES_DEFAULT
@@ -568,7 +568,7 @@ AC_INCLUDES_DEFAULT
 
 dnl Detect if rlim_t type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_RLIM_T],
-[AC_CHECK_TYPE(rlim_t, , 
+[AC_CHECK_TYPE(rlim_t, ,
 	[AC_DEFINE([rlim_t], [unsigned long], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_RESOURCE_H
@@ -579,7 +579,7 @@ AC_INCLUDES_DEFAULT
 dnl Detect if socklen_t type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_SOCKLEN_T],
 [
-AC_CHECK_TYPE(socklen_t, , 
+AC_CHECK_TYPE(socklen_t, ,
 	[AC_DEFINE([socklen_t], [int], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_SOCKET_H
@@ -705,7 +705,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
 		    LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir_lib"
 	    	    ACX_RUNTIME_PATH_ADD([$ssldir_lib])
 	    fi
-        
+
             AC_MSG_CHECKING([for EVP_sha256 in -lcrypto])
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
@@ -718,7 +718,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                           [If you have EVP_sha256])
               ],[
                 AC_MSG_RESULT(no)
-                # check if -lwsock32 or -lgdi32 are needed.	
+                # check if -lwsock32 or -lgdi32 are needed.
                 BAKLIBS="$LIBS"
                 BAKSSLLIBS="$LIBSSL_LIBS"
 		LIBS="$LIBS -lgdi32 -lws2_32"
@@ -730,7 +730,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                   ]])],[
                     AC_DEFINE([HAVE_EVP_SHA256], 1,
                         [If you have EVP_sha256])
-                    AC_MSG_RESULT(yes) 
+                    AC_MSG_RESULT(yes)
                   ],[
                     AC_MSG_RESULT(no)
                     LIBS="$BAKLIBS"
@@ -744,7 +744,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                       ]])],[
                         AC_DEFINE([HAVE_EVP_SHA256], 1,
                             [If you have EVP_sha256])
-                        AC_MSG_RESULT(yes) 
+                        AC_MSG_RESULT(yes)
                       ],[
                         AC_MSG_RESULT(no)
                         LIBS="$BAKLIBS"
@@ -758,7 +758,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                           ]])],[
                             AC_DEFINE([HAVE_EVP_SHA256], 1,
                                 [If you have EVP_sha256])
-                            AC_MSG_RESULT(yes) 
+                            AC_MSG_RESULT(yes)
                           ],[
                             AC_MSG_RESULT(no)
                             AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
@@ -777,7 +777,7 @@ AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT])
 
 dnl Check for SSL, where SSL is mandatory
 dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found
-dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS. 
+dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS.
 dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL],
@@ -795,7 +795,7 @@ AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl=pathname],[enable SSL (will check /u
 
 dnl Check for SSL, where ssl is optional (--without-ssl is allowed)
 dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found
-dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS. 
+dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS.
 dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL_OPTIONAL],
@@ -1035,7 +1035,7 @@ int main(void)
 	/* send and receive on the socket */
 	if((p=fork()) == 0) {
 		for(i=0; i<num; i++) {
-			if(sendto(cfd, &i, sizeof(i), 0, 
+			if(sendto(cfd, &i, sizeof(i), 0,
 				(struct sockaddr*)&a, sizeof(a)) < 0) {
 				perror("sendto");
 				return 1;
@@ -1317,7 +1317,7 @@ AC_DEFUN([AHX_CONFIG_W32_FD_SET_T],
 #ifdef HAVE_WINSOCK2_H
 #define FD_SET_T (u_int)
 #else
-#define FD_SET_T 
+#define FD_SET_T
 #endif
 ])
 
@@ -1396,7 +1396,7 @@ int main(void)
   AC_LIBOBJ([memcmp])
 ], [ AC_MSG_RESULT([cross-compile no])
   AC_DEFINE([MEMCMP_IS_BROKEN], [1], [Define if memcmp() does not compare unsigned bytes])
-  AC_LIBOBJ([memcmp]) 
+  AC_LIBOBJ([memcmp])
 ]) ])
 
 dnl define memcmp to its replacement, pass unique id for program as arg
diff --git a/usr.sbin/unbound/cachedb/cachedb.c b/usr.sbin/unbound/cachedb/cachedb.c
index b07743d85..8b912ec4d 100644
--- a/usr.sbin/unbound/cachedb/cachedb.c
+++ b/usr.sbin/unbound/cachedb/cachedb.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2016, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -228,7 +228,7 @@ cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg)
 	return 1;
 }
 
-int 
+int
 cachedb_init(struct module_env* env, int id)
 {
 	struct cachedb_env* cachedb_env = (struct cachedb_env*)calloc(1,
@@ -267,7 +267,7 @@ cachedb_init(struct module_env* env, int id)
 	return 1;
 }
 
-void 
+void
 cachedb_deinit(struct module_env* env, int id)
 {
 	struct cachedb_env* cachedb_env;
@@ -291,7 +291,7 @@ cachedb_new(struct module_qstate* qstate, int id)
 	struct cachedb_qstate* iq = (struct cachedb_qstate*)regional_alloc(
 		qstate->region, sizeof(struct cachedb_qstate));
 	qstate->minfo[id] = iq;
-	if(!iq) 
+	if(!iq)
 		return 0;
 	memset(iq, 0, sizeof(*iq));
 	/* initialise it */
@@ -306,12 +306,12 @@ cachedb_new(struct module_qstate* qstate, int id)
  * @param id: module id
  * @param rcode: error code (DNS errcode).
  * @return: 0 for use by caller, to make notation easy, like:
- * 	return error_response(..). 
+ * 	return error_response(..).
  */
 static int
 error_response(struct module_qstate* qstate, int id, int rcode)
 {
-	verbose(VERB_QUERY, "return error response %s", 
+	verbose(VERB_QUERY, "return error response %s",
 		sldns_lookup_by_id(sldns_rcodes, rcode)?
 		sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
 	qstate->return_rcode = rcode;
@@ -354,7 +354,7 @@ calc_hash(struct module_qstate* qstate, char* buf, size_t len)
 		memmove(clear+clen, secret, strlen(secret));
 		clen += strlen(secret);
 	}
-	
+
 	/* hash the buffer */
 	secalgo_hash_sha256(clear, clen, hash);
 #ifdef HAVE_EXPLICIT_BZERO
@@ -529,7 +529,7 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf)
 	sldns_buffer_set_limit(buf, lim);
 	if(!qstate->return_msg)
 		return 0;
-	
+
 	qstate->return_rcode = LDNS_RCODE_NOERROR;
 
 	/* see how much of the TTL expired, and remove it */
@@ -603,7 +603,7 @@ cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
 	/* prepare data in scratch buffer */
 	if(!prep_data(qstate, qstate->env->scratch_buffer))
 		return;
-	
+
 	/* call backend */
 	(*ie->backend->store)(qstate->env, ie, key,
 		sldns_buffer_begin(qstate->env->scratch_buffer),
@@ -632,7 +632,7 @@ cachedb_intcache_lookup(struct module_qstate* qstate)
 		);
 	if(!msg && qstate->env->neg_cache &&
 		iter_qname_indicates_dnssec(qstate->env, &qstate->qinfo)) {
-		/* lookup in negative cache; may result in 
+		/* lookup in negative cache; may result in
 		 * NOERROR/NODATA or NXDOMAIN answers that need validation */
 		msg = val_neg_getmsg(qstate->env->neg_cache, &qstate->qinfo,
 			qstate->region, qstate->env->rrset_cache,
@@ -767,19 +767,19 @@ cachedb_handle_response(struct module_qstate* qstate,
 	qstate->ext_state[id] = module_finished;
 }
 
-void 
+void
 cachedb_operate(struct module_qstate* qstate, enum module_ev event, int id,
 	struct outbound_entry* outbound)
 {
 	struct cachedb_env* ie = (struct cachedb_env*)qstate->env->modinfo[id];
 	struct cachedb_qstate* iq = (struct cachedb_qstate*)qstate->minfo[id];
-	verbose(VERB_QUERY, "cachedb[module %d] operate: extstate:%s event:%s", 
+	verbose(VERB_QUERY, "cachedb[module %d] operate: extstate:%s event:%s",
 		id, strextstate(qstate->ext_state[id]), strmodulevent(event));
-	if(iq) log_query_info(VERB_QUERY, "cachedb operate: query", 
+	if(iq) log_query_info(VERB_QUERY, "cachedb operate: query",
 		&qstate->qinfo);
 
 	/* perform cachedb state machine */
-	if((event == module_event_new || event == module_event_pass) && 
+	if((event == module_event_new || event == module_event_pass) &&
 		iq == NULL) {
 		if(!cachedb_new(qstate, id)) {
 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -825,7 +825,7 @@ cachedb_inform_super(struct module_qstate* ATTR_UNUSED(qstate),
 	verbose(VERB_ALGO, "cachedb inform_super was called");
 }
 
-void 
+void
 cachedb_clear(struct module_qstate* qstate, int id)
 {
 	struct cachedb_qstate* iq;
@@ -839,7 +839,7 @@ cachedb_clear(struct module_qstate* qstate, int id)
 	qstate->minfo[id] = NULL;
 }
 
-size_t 
+size_t
 cachedb_get_mem(struct module_env* env, int id)
 {
 	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
@@ -849,7 +849,7 @@ cachedb_get_mem(struct module_env* env, int id)
 }
 
 /**
- * The cachedb function block 
+ * The cachedb function block
  */
 static struct module_func_block cachedb_block = {
 	"cachedb",
@@ -857,7 +857,7 @@ static struct module_func_block cachedb_block = {
 	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
 };
 
-struct module_func_block* 
+struct module_func_block*
 cachedb_get_funcblock(void)
 {
 	return &cachedb_block;
diff --git a/usr.sbin/unbound/cachedb/cachedb.h b/usr.sbin/unbound/cachedb/cachedb.h
index 05c4368e6..cca4390cd 100644
--- a/usr.sbin/unbound/cachedb/cachedb.h
+++ b/usr.sbin/unbound/cachedb/cachedb.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2016, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -81,7 +81,7 @@ struct cachedb_backend {
 	/** Lookup (env, cachedb_env, key, result_buffer): true if found */
 	int (*lookup)(struct module_env*, struct cachedb_env*, char*,
 		struct sldns_buffer*);
-	
+
 	/** Store (env, cachedb_env, key, data, data_len) */
 	void (*store)(struct module_env*, struct cachedb_env*, char*,
 		uint8_t*, size_t, time_t);
diff --git a/usr.sbin/unbound/cachedb/redis.c b/usr.sbin/unbound/cachedb/redis.c
index 16c3741f7..91bc64b72 100644
--- a/usr.sbin/unbound/cachedb/redis.c
+++ b/usr.sbin/unbound/cachedb/redis.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2018, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/cachedb/redis.h b/usr.sbin/unbound/cachedb/redis.h
index 2da2a64f2..ea6b2c27a 100644
--- a/usr.sbin/unbound/cachedb/redis.h
+++ b/usr.sbin/unbound/cachedb/redis.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2018, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/configure.ac b/usr.sbin/unbound/configure.ac
index 1fe44a2c8..7c5b1e99e 100644
--- a/usr.sbin/unbound/configure.ac
+++ b/usr.sbin/unbound/configure.ac
@@ -1529,7 +1529,7 @@ if test x_$enable_fully_static = x_yes; then
 fi
 
 # set lock checking if requested
-AC_ARG_ENABLE(lock_checks, AS_HELP_STRING([--enable-lock-checks],[ enable to check lock and unlock calls, for debug purposes ]), 
+AC_ARG_ENABLE(lock_checks, AS_HELP_STRING([--enable-lock-checks],[ enable to check lock and unlock calls, for debug purposes ]),
 	, )
 if test x_$enable_lock_checks = x_yes; then
 	AC_DEFINE(ENABLE_LOCK_CHECKS, 1, [Define if you want to use debug lock checking (slow).])
diff --git a/usr.sbin/unbound/daemon/acl_list.c b/usr.sbin/unbound/daemon/acl_list.c
index f3961dbbb..49f9e02b0 100644
--- a/usr.sbin/unbound/daemon/acl_list.c
+++ b/usr.sbin/unbound/daemon/acl_list.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/daemon/acl_list.h b/usr.sbin/unbound/daemon/acl_list.h
index c717179ba..72f86d763 100644
--- a/usr.sbin/unbound/daemon/acl_list.h
+++ b/usr.sbin/unbound/daemon/acl_list.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/daemon/cachedump.c b/usr.sbin/unbound/daemon/cachedump.c
index baf8008ea..a85dd62a9 100644
--- a/usr.sbin/unbound/daemon/cachedump.c
+++ b/usr.sbin/unbound/daemon/cachedump.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -75,7 +75,7 @@ dump_rrset_line(RES* ssl, struct ub_packed_rrset_key* k, time_t now, size_t i)
 
 /** dump rrset key and data info */
 static int
-dump_rrset(RES* ssl, struct ub_packed_rrset_key* k, 
+dump_rrset(RES* ssl, struct ub_packed_rrset_key* k,
 	struct packed_rrset_data* d, time_t now)
 {
 	size_t i;
@@ -90,7 +90,7 @@ dump_rrset(RES* ssl, struct ub_packed_rrset_key* k,
 		(long long)(d->ttl - now),
 		(unsigned)d->count, (unsigned)d->rrsig_count,
 		(int)d->trust, (int)d->security
-		)) 
+		))
 		return 0;
 	for(i=0; i<d->count + d->rrsig_count; i++) {
 		if(!dump_rrset_line(ssl, k, now, i))
@@ -166,14 +166,14 @@ dump_msg_ref(RES* ssl, struct ub_packed_rrset_key* k)
 
 /** dump message entry */
 static int
-dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, 
+dump_msg(RES* ssl, struct query_info* k, struct reply_info* d,
 	time_t now)
 {
 	size_t i;
 	char* nm, *tp, *cl;
 	if(!k || !d) return 1;
 	if(d->ttl < now) return 1; /* expired */
-	
+
 	nm = sldns_wire2str_dname(k->qname, k->qname_len);
 	tp = sldns_wire2str_type(k->qtype);
 	cl = sldns_wire2str_class(k->qclass);
@@ -190,13 +190,13 @@ dump_msg(RES* ssl, struct query_info* k, struct reply_info* d,
 		free(cl);
 		return 1; /* skip this entry */
 	}
-	
+
 	/* meta line */
 	if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u\n",
 			nm, cl, tp,
-			(int)d->flags, (int)d->qdcount, 
+			(int)d->flags, (int)d->qdcount,
 			(long long)(d->ttl-now), (int)d->security,
-			(unsigned)d->an_numrrsets, 
+			(unsigned)d->an_numrrsets,
 			(unsigned)d->ns_numrrsets,
 			(unsigned)d->ar_numrrsets)) {
 		free(nm);
@@ -208,7 +208,7 @@ dump_msg(RES* ssl, struct query_info* k, struct reply_info* d,
 	free(nm);
 	free(tp);
 	free(cl);
-	
+
 	for(i=0; i<d->rrset_count; i++) {
 		if(!dump_msg_ref(ssl, d->rrsets[i])) {
 			rrset_array_unlock(d->ref, d->rrset_count);
@@ -222,26 +222,26 @@ dump_msg(RES* ssl, struct query_info* k, struct reply_info* d,
 
 /** copy msg to worker pad */
 static int
-copy_msg(struct regional* region, struct lruhash_entry* e, 
+copy_msg(struct regional* region, struct lruhash_entry* e,
 	struct query_info** k, struct reply_info** d)
 {
 	struct reply_info* rep = (struct reply_info*)e->data;
 	if(rep->rrset_count > RR_COUNT_MAX)
 		return 0; /* to protect against integer overflow */
 	*d = (struct reply_info*)regional_alloc_init(region, e->data,
-		sizeof(struct reply_info) + 
+		sizeof(struct reply_info) +
 		sizeof(struct rrset_ref) * (rep->rrset_count-1) +
 		sizeof(struct ub_packed_rrset_key*) * rep->rrset_count);
 	if(!*d)
 		return 0;
 	(*d)->rrsets = (struct ub_packed_rrset_key**)(void *)(
-		(uint8_t*)(&((*d)->ref[0])) + 
+		(uint8_t*)(&((*d)->ref[0])) +
 		sizeof(struct rrset_ref) * rep->rrset_count);
-	*k = (struct query_info*)regional_alloc_init(region, 
+	*k = (struct query_info*)regional_alloc_init(region,
 		e->key, sizeof(struct query_info));
 	if(!*k)
 		return 0;
-	(*k)->qname = regional_alloc_init(region, 
+	(*k)->qname = regional_alloc_init(region,
 		(*k)->qname, (*k)->qname_len);
 	return (*k)->qname != NULL;
 }
@@ -265,7 +265,7 @@ dump_msg_lruhash(RES* ssl, struct worker* worker, struct lruhash* h)
 			return 0;
 		}
 		lock_rw_unlock(&e->lock);
-		/* release lock so we can lookup the rrset references 
+		/* release lock so we can lookup the rrset references
 		 * in the rrset cache */
 		if(!dump_msg(ssl, k, d, *worker->env.now)) {
 			return 0;
@@ -306,7 +306,7 @@ dump_cache(RES* ssl, struct worker* worker)
 static int
 ssl_read_buf(RES* ssl, sldns_buffer* buf)
 {
-	return ssl_read_line(ssl, (char*)sldns_buffer_begin(buf), 
+	return ssl_read_line(ssl, (char*)sldns_buffer_begin(buf),
 		sldns_buffer_capacity(buf));
 }
 
@@ -354,7 +354,7 @@ load_rr(RES* ssl, sldns_buffer* buf, struct regional* region,
 	d->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len) + now;
 	sldns_buffer_clear(buf);
 	d->rr_len[i] = sldns_wirerr_get_rdatalen(rr, rr_len, dname_len)+2;
-	d->rr_data[i] = (uint8_t*)regional_alloc_init(region, 
+	d->rr_data[i] = (uint8_t*)regional_alloc_init(region,
 		sldns_wirerr_get_rdatawl(rr, rr_len, dname_len), d->rr_len[i]);
 	if(!d->rr_data[i]) {
 		log_warn("error out of memory");
@@ -378,7 +378,7 @@ load_rr(RES* ssl, sldns_buffer* buf, struct regional* region,
 
 /** move entry into cache */
 static int
-move_into_cache(struct ub_packed_rrset_key* k, 
+move_into_cache(struct ub_packed_rrset_key* k,
 	struct packed_rrset_data* d, struct worker* worker)
 {
 	struct ub_packed_rrset_key* ak;
@@ -401,7 +401,7 @@ move_into_cache(struct ub_packed_rrset_key* k,
 		ub_packed_rrset_parsedelete(ak, &worker->alloc);
 		return 0;
 	}
-	s = sizeof(*ad) + (sizeof(size_t) + sizeof(uint8_t*) + 
+	s = sizeof(*ad) + (sizeof(size_t) + sizeof(uint8_t*) +
 		sizeof(time_t))* num;
 	for(i=0; i<num; i++)
 		s += d->rr_len[i];
@@ -449,7 +449,7 @@ load_rrset(RES* ssl, sldns_buffer* buf, struct worker* worker)
 	int go_on = 1;
 	regional_free_all(region);
 
-	rk = (struct ub_packed_rrset_key*)regional_alloc_zero(region, 
+	rk = (struct ub_packed_rrset_key*)regional_alloc_zero(region,
 		sizeof(*rk));
 	d = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*d));
 	if(!rk || !d) {
@@ -485,27 +485,27 @@ load_rrset(RES* ssl, sldns_buffer* buf, struct worker* worker)
 	d->trust = (enum rrset_trust)trust;
 	d->ttl = (time_t)ttl + *worker->env.now;
 
-	d->rr_len = regional_alloc_zero(region, 
+	d->rr_len = regional_alloc_zero(region,
 		sizeof(size_t)*(d->count+d->rrsig_count));
-	d->rr_ttl = regional_alloc_zero(region, 
+	d->rr_ttl = regional_alloc_zero(region,
 		sizeof(time_t)*(d->count+d->rrsig_count));
-	d->rr_data = regional_alloc_zero(region, 
+	d->rr_data = regional_alloc_zero(region,
 		sizeof(uint8_t*)*(d->count+d->rrsig_count));
 	if(!d->rr_len || !d->rr_ttl || !d->rr_data) {
 		log_warn("error out of memory");
 		return 0;
 	}
-	
+
 	/* read the rr's themselves */
 	for(i=0; i<rr_count; i++) {
-		if(!load_rr(ssl, buf, region, rk, d, i, 0, 
+		if(!load_rr(ssl, buf, region, rk, d, i, 0,
 			&go_on, *worker->env.now)) {
 			log_warn("could not read rr %u", i);
 			return 0;
 		}
 	}
 	for(i=0; i<rrsig_count; i++) {
-		if(!load_rr(ssl, buf, region, rk, d, i+rr_count, 1, 
+		if(!load_rr(ssl, buf, region, rk, d, i+rr_count, 1,
 			&go_on, *worker->env.now)) {
 			log_warn("could not read rrsig %u", i);
 			return 0;
@@ -525,7 +525,7 @@ load_rrset_cache(RES* ssl, struct worker* worker)
 {
 	sldns_buffer* buf = worker->env.scratch_buffer;
 	if(!read_fixed(ssl, buf, "START_RRSET_CACHE")) return 0;
-	while(ssl_read_buf(ssl, buf) && 
+	while(ssl_read_buf(ssl, buf) &&
 		strcmp((char*)sldns_buffer_begin(buf), "END_RRSET_CACHE")!=0) {
 		if(!load_rrset(ssl, buf, worker))
 			return 0;
@@ -577,8 +577,8 @@ load_qinfo(char* str, struct query_info* qinfo, struct regional* region)
 
 /** load a msg rrset reference */
 static int
-load_ref(RES* ssl, sldns_buffer* buf, struct worker* worker, 
-	struct regional *region, struct ub_packed_rrset_key** rrset, 
+load_ref(RES* ssl, sldns_buffer* buf, struct worker* worker,
+	struct regional *region, struct ub_packed_rrset_key** rrset,
 	int* go_on)
 {
 	char* s = (char*)sldns_buffer_begin(buf);
@@ -646,7 +646,7 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 	}
 
 	/* read remainder of line */
-	if(sscanf(s, " %u %u " ARG_LL "d %u %u %u %u", &flags, &qdcount, &ttl, 
+	if(sscanf(s, " %u %u " ARG_LL "d %u %u %u %u", &flags, &qdcount, &ttl,
 		&security, &an, &ns, &ar) != 7) {
 		log_warn("error cannot parse numbers: %s", s);
 		return 0;
@@ -670,13 +670,13 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker)
 
 	/* fill repinfo with references */
 	for(i=0; i<rep.rrset_count; i++) {
-		if(!load_ref(ssl, buf, worker, region, &rep.rrsets[i], 
+		if(!load_ref(ssl, buf, worker, region, &rep.rrsets[i],
 			&go_on)) {
 			return 0;
 		}
 	}
 
-	if(!go_on) 
+	if(!go_on)
 		return 1; /* skip this one, not all references satisfied */
 
 	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0, 0, NULL, flags,
@@ -693,7 +693,7 @@ load_msg_cache(RES* ssl, struct worker* worker)
 {
 	sldns_buffer* buf = worker->env.scratch_buffer;
 	if(!read_fixed(ssl, buf, "START_MSG_CACHE")) return 0;
-	while(ssl_read_buf(ssl, buf) && 
+	while(ssl_read_buf(ssl, buf) &&
 		strcmp((char*)sldns_buffer_begin(buf), "END_MSG_CACHE")!=0) {
 		if(!load_msg(ssl, buf, worker))
 			return 0;
@@ -727,7 +727,7 @@ print_dp_details(RES* ssl, struct worker* worker, struct delegpt* dp)
 		if(!ssl_printf(ssl, "%-16s\t", buf))
 			return;
 		if(a->bogus) {
-			if(!ssl_printf(ssl, "Address is BOGUS. ")) 
+			if(!ssl_printf(ssl, "Address is BOGUS. "))
 				return;
 		}
 		/* lookup in infra cache */
@@ -750,7 +750,7 @@ print_dp_details(RES* ssl, struct worker* worker, struct delegpt* dp)
 
 		/* uses type_A because most often looked up, but other
 		 * lameness won't be reported then */
-		if(!infra_get_lame_rtt(worker->env.infra_cache, 
+		if(!infra_get_lame_rtt(worker->env.infra_cache,
 			&a->addr, a->addrlen, dp->name, dp->namelen,
 			LDNS_RR_TYPE_A, &lame, &dlame, &rlame, &rto,
 			*worker->env.now)) {
@@ -797,7 +797,7 @@ print_dp_main(RES* ssl, struct delegpt* dp, struct dns_msg* msg)
 	if(msg)
 	    for(i=0; i<msg->rep->rrset_count; i++) {
 		struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
-		struct packed_rrset_data* d = 
+		struct packed_rrset_data* d =
 			(struct packed_rrset_data*)k->entry.data;
 		if(d->security == sec_status_bogus) {
 			if(!ssl_printf(ssl, "Address is BOGUS:\n"))
@@ -811,7 +811,7 @@ print_dp_main(RES* ssl, struct delegpt* dp, struct dns_msg* msg)
 	/* since dp has not been used by iterator, all are available*/
 	if(!ssl_printf(ssl, "Delegation with %d names, of which %d "
 		"can be examined to query further addresses.\n"
-		"%sIt provides %d IP addresses.\n", 
+		"%sIt provides %d IP addresses.\n",
 		(int)n_ns, (int)n_miss, (dp->bogus?"It is BOGUS. ":""),
 		(int)n_addr))
 		return;
@@ -836,9 +836,9 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 
 	dname_str(nm, b);
 	if(!ssl_printf(ssl, "The following name servers are used for lookup "
-		"of %s\n", b)) 
+		"of %s\n", b))
 		return 0;
-	
+
 	dp = forwards_lookup(worker->env.fwds, nm, qinfo.qclass);
 	if(dp) {
 		if(!ssl_printf(ssl, "forwarding request:\n"))
@@ -847,10 +847,10 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 		print_dp_details(ssl, worker, dp);
 		return 1;
 	}
-	
+
 	while(1) {
-		dp = dns_cache_find_delegation(&worker->env, nm, nmlen, 
-			qinfo.qtype, qinfo.qclass, region, &msg, 
+		dp = dns_cache_find_delegation(&worker->env, nm, nmlen,
+			qinfo.qtype, qinfo.qclass, region, &msg,
 			*worker->env.now, 0, NULL, 0);
 		if(!dp) {
 			return ssl_printf(ssl, "no delegation from "
@@ -879,7 +879,7 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm,
 					return 0;
 				continue;
 			}
-		} 
+		}
 		stub = hints_lookup_stub(worker->env.hints, nm, qinfo.qclass,
 			dp);
 		if(stub) {
diff --git a/usr.sbin/unbound/daemon/cachedump.h b/usr.sbin/unbound/daemon/cachedump.h
index 72c172d44..40c6239fe 100644
--- a/usr.sbin/unbound/daemon/cachedump.h
+++ b/usr.sbin/unbound/daemon/cachedump.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -77,16 +77,16 @@ struct worker;
 /**
  * Dump cache(s) to text
  * @param ssl: to print to
- * @param worker: worker that is available (buffers, etc) and has 
+ * @param worker: worker that is available (buffers, etc) and has
  * 	ptrs to the caches.
  * @return false on ssl print error.
  */
 int dump_cache(RES* ssl, struct worker* worker);
 
 /**
- * Load cache(s) from text 
- * @param ssl: to read from 
- * @param worker: worker that is available (buffers, etc) and has 
+ * Load cache(s) from text
+ * @param ssl: to read from
+ * @param worker: worker that is available (buffers, etc) and has
  * 	ptrs to the caches.
  * @return false on ssl error.
  */
@@ -94,8 +94,8 @@ int load_cache(RES* ssl, struct worker* worker);
 
 /**
  * Print the delegation used to lookup for this name.
- * @param ssl: to read from 
- * @param worker: worker that is available (buffers, etc) and has 
+ * @param ssl: to read from
+ * @param worker: worker that is available (buffers, etc) and has
  * 	ptrs to the caches.
  * @param nm: name to lookup
  * @param nmlen: length of name.
diff --git a/usr.sbin/unbound/daemon/daemon.c b/usr.sbin/unbound/daemon/daemon.c
index 71091133a..0d7af8644 100644
--- a/usr.sbin/unbound/daemon/daemon.c
+++ b/usr.sbin/unbound/daemon/daemon.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -113,7 +113,7 @@ static void* comp_meth = NULL;
 int ub_c_lex_destroy(void);
 
 /** used when no other sighandling happens, so we don't die
-  * when multiple signals in quick succession are sent to us. 
+  * when multiple signals in quick succession are sent to us.
   * @param sig: signal number.
   * @return signal handler return type (void or int).
   */
@@ -121,10 +121,10 @@ static RETSIGTYPE record_sigh(int sig)
 {
 #ifdef LIBEVENT_SIGNAL_PROBLEM
 	/* cannot log, verbose here because locks may be held */
-	/* quit on signal, no cleanup and statistics, 
+	/* quit on signal, no cleanup and statistics,
 	   because installed libevent version is not threadsafe */
 	exit(0);
-#endif 
+#endif
 	switch(sig)
 	{
 		case SIGTERM:
@@ -152,7 +152,7 @@ static RETSIGTYPE record_sigh(int sig)
 	}
 }
 
-/** 
+/**
  * Signal handling during the time when netevent is disabled.
  * Stores signals to replay later.
  */
@@ -194,10 +194,10 @@ signal_handling_playback(struct worker* wrk)
 	sig_record_reload = 0;
 }
 
-struct daemon* 
+struct daemon*
 daemon_init(void)
 {
-	struct daemon* daemon = (struct daemon*)calloc(1, 
+	struct daemon* daemon = (struct daemon*)calloc(1,
 		sizeof(struct daemon));
 #ifdef USE_WINSOCK
 	int r;
@@ -255,7 +255,7 @@ daemon_init(void)
 #endif
 	daemon->need_to_exit = 0;
 	modstack_init(&daemon->mods);
-	if(!(daemon->env = (struct module_env*)calloc(1, 
+	if(!(daemon->env = (struct module_env*)calloc(1,
 		sizeof(*daemon->env)))) {
 		free(daemon);
 		return NULL;
@@ -314,7 +314,7 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
-	return daemon;	
+	return daemon;
 }
 
 static int setup_acl_for_ports(struct acl_list* list,
@@ -340,7 +340,7 @@ static int setup_acl_for_ports(struct acl_list* list,
 	return 1;
 }
 
-int 
+int
 daemon_open_shared_ports(struct daemon* daemon)
 {
 	log_assert(daemon);
@@ -430,7 +430,7 @@ daemon_open_shared_ports(struct daemon* daemon)
 		daemon->rc_ports = NULL;
 		daemon->rc_port = 0;
 	}
-	if(daemon->cfg->remote_control_enable && 
+	if(daemon->cfg->remote_control_enable &&
 		daemon->cfg->control_port != daemon->rc_port) {
 		listening_ports_free(daemon->rc_ports);
 		if(!(daemon->rc_ports=daemon_remote_open_ports(daemon->cfg)))
@@ -450,7 +450,7 @@ static void daemon_setup_modules(struct daemon* daemon)
 	daemon->env->alloc = &daemon->superalloc;
 	daemon->env->worker = NULL;
 	daemon->env->need_to_validate = 0; /* set by module init below */
-	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf, 
+	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf,
 		daemon->env)) {
 		fatal_exit("failed to setup modules");
 	}
@@ -495,7 +495,7 @@ static int daemon_get_shufport(struct daemon* daemon, int* shufport)
  * The random generator stays existing between reloads with a unique state.
  * @param daemon: the daemon with (new) config settings.
  */
-static void 
+static void
 daemon_create_workers(struct daemon* daemon)
 {
 	int i, numport;
@@ -512,7 +512,7 @@ daemon_create_workers(struct daemon* daemon)
 		fatal_exit("out of memory during daemon init");
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-	
+
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
 	if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
 		log_warn("cannot reduce num-threads to %d because so-reuseport "
@@ -520,7 +520,7 @@ daemon_create_workers(struct daemon* daemon)
 			(int)daemon->num_ports);
 		daemon->num = (int)daemon->num_ports;
 	}
-	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
+	daemon->workers = (struct worker**)calloc((size_t)daemon->num,
 		sizeof(struct worker*));
 	if(!daemon->workers)
 		fatal_exit("out of memory during daemon init");
@@ -535,7 +535,7 @@ daemon_create_workers(struct daemon* daemon)
 	}
 	for(i=0; i<daemon->num; i++) {
 		if(!(daemon->workers[i] = worker_create(daemon, i,
-			shufport+numport*i/daemon->num, 
+			shufport+numport*i/daemon->num,
 			numport*(i+1)/daemon->num - numport*i/daemon->num)))
 			/* the above is not ports/numthr, due to rounding */
 			fatal_exit("could not create worker");
@@ -567,11 +567,11 @@ static void close_other_pipes(struct daemon* daemon, int thr)
 #endif /* THREADS_DISABLED */
 
 /**
- * Function to start one thread. 
+ * Function to start one thread.
  * @param arg: user argument.
  * @return: void* user return value could be used for thread_join results.
  */
-static void* 
+static void*
 thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
@@ -642,7 +642,7 @@ daemon_stop_others(struct daemon* daemon)
 	}
 }
 
-void 
+void
 daemon_fork(struct daemon* daemon)
 {
 	int have_view_respip_cfg = 0;
@@ -718,7 +718,7 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("RPZ requires the respip module");
 
 	/* first create all the worker structures, so we can pass
-	 * them to the newly created threads. 
+	 * them to the newly created threads.
 	 */
 	daemon_create_workers(daemon);
 
@@ -727,7 +727,7 @@ daemon_fork(struct daemon* daemon)
 	if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
 		fatal_exit("Could not initialize main thread");
 #endif
-	
+
 	/* Now create the threads and init the workers.
 	 * By the way, this is thread #0 (the main thread).
 	 */
@@ -774,7 +774,7 @@ daemon_fork(struct daemon* daemon)
 	daemon->need_to_exit = daemon->workers[0]->need_to_exit;
 }
 
-void 
+void
 daemon_cleanup(struct daemon* daemon)
 {
 	int i;
@@ -815,7 +815,7 @@ daemon_cleanup(struct daemon* daemon)
 	daemon->cfg = NULL;
 }
 
-void 
+void
 daemon_delete(struct daemon* daemon)
 {
 	size_t i;
@@ -892,7 +892,7 @@ daemon_delete(struct daemon* daemon)
 	checklock_stop();
 #ifdef USE_WINSOCK
 	if(WSACleanup() != 0) {
-		log_err("Could not WSACleanup: %s", 
+		log_err("Could not WSACleanup: %s",
 			wsa_strerror(WSAGetLastError()));
 	}
 #endif
diff --git a/usr.sbin/unbound/daemon/daemon.h b/usr.sbin/unbound/daemon/daemon.h
index 58713e9ce..efd9f745e 100644
--- a/usr.sbin/unbound/daemon/daemon.h
+++ b/usr.sbin/unbound/daemon/daemon.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/daemon/remote.c b/usr.sbin/unbound/daemon/remote.c
index 7d4a41400..96ef69d9e 100644
--- a/usr.sbin/unbound/daemon/remote.c
+++ b/usr.sbin/unbound/daemon/remote.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -38,7 +38,7 @@
  *
  * This file contains the remote control functionality for the daemon.
  * The remote control can be performed using either the commandline
- * unbound-control tool, or a TLS capable web browser. 
+ * unbound-control tool, or a TLS capable web browser.
  * The channel is secured using TLSv1, and certificates.
  * Both the server and the client(control tool) have their own keys.
  */
@@ -110,7 +110,7 @@ static const int inhibit_zero = 1;
 
 /** subtract timers and the values do not overflow or become negative */
 static void
-timeval_subtract(struct timeval* d, const struct timeval* end, 
+timeval_subtract(struct timeval* d, const struct timeval* end,
 	const struct timeval* start)
 {
 #ifndef S_SPLINT_S
@@ -203,7 +203,7 @@ remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
 struct daemon_remote*
 daemon_remote_create(struct config_file* cfg)
 {
-	struct daemon_remote* rc = (struct daemon_remote*)calloc(1, 
+	struct daemon_remote* rc = (struct daemon_remote*)calloc(1,
 		sizeof(*rc));
 	if(!rc) {
 		log_err("out of memory in daemon_remote_create");
@@ -412,7 +412,7 @@ accept_open(struct daemon_remote* rc, int fd)
 	n->next = rc->accept_list;
 	rc->accept_list = n;
 	/* open commpt */
-	n->com = comm_point_create_raw(rc->worker->base, fd, 0, 
+	n->com = comm_point_create_raw(rc->worker->base, fd, 0,
 		&remote_accept_callback, rc);
 	if(!n->com)
 		return 0;
@@ -421,7 +421,7 @@ accept_open(struct daemon_remote* rc, int fd)
 	return 1;
 }
 
-int daemon_remote_open_accept(struct daemon_remote* rc, 
+int daemon_remote_open_accept(struct daemon_remote* rc,
 	struct listen_port* ports, struct worker* worker)
 {
 	struct listen_port* p;
@@ -439,7 +439,7 @@ void daemon_remote_stop_accept(struct daemon_remote* rc)
 {
 	struct listen_list* p;
 	for(p=rc->accept_list; p; p=p->next) {
-		comm_point_stop_listening(p->com);	
+		comm_point_stop_listening(p->com);
 	}
 }
 
@@ -447,11 +447,11 @@ void daemon_remote_start_accept(struct daemon_remote* rc)
 {
 	struct listen_list* p;
 	for(p=rc->accept_list; p; p=p->next) {
-		comm_point_start_listening(p->com, -1, -1);	
+		comm_point_start_listening(p->com, -1, -1);
 	}
 }
 
-int remote_accept_callback(struct comm_point* c, void* arg, int err, 
+int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	struct comm_reply* ATTR_UNUSED(rep))
 {
 	struct daemon_remote* rc = (struct daemon_remote*)arg;
@@ -483,7 +483,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	}
 	n->fd = newfd;
 	/* start in reading state */
-	n->c = comm_point_create_raw(rc->worker->base, newfd, 0, 
+	n->c = comm_point_create_raw(rc->worker->base, newfd, 0,
 		&remote_control_callback, n);
 	if(!n->c) {
 		log_err("out of memory");
@@ -523,7 +523,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	rc->busy_list = n;
 	rc->active ++;
 
-	/* perform the first nonblocking read already, for windows, 
+	/* perform the first nonblocking read already, for windows,
 	 * so it can return wouldblock. could be faster too. */
 	(void)remote_control_callback(n->c, n, NETEVENT_NOERROR, NULL);
 	return 0;
@@ -560,7 +560,7 @@ int
 ssl_print_text(RES* res, const char* text)
 {
 	int r;
-	if(!res) 
+	if(!res)
 		return 0;
 	if(res->ssl) {
 		ERR_clear_error();
@@ -662,7 +662,7 @@ static char*
 skipwhite(char* str)
 {
 	/* EOS \0 is not a space */
-	while( isspace((unsigned char)*str) ) 
+	while( isspace((unsigned char)*str) )
 		str++;
 	return str;
 }
@@ -709,20 +709,20 @@ static int
 print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 {
 	struct timeval sumwait, avg;
-	if(!ssl_printf(ssl, "%s.num.queries"SQ"%lu\n", nm, 
+	if(!ssl_printf(ssl, "%s.num.queries"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries)) return 0;
 	if(!ssl_printf(ssl, "%s.num.queries_ip_ratelimited"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_ip_ratelimited)) return 0;
-	if(!ssl_printf(ssl, "%s.num.cachehits"SQ"%lu\n", nm, 
-		(unsigned long)(s->svr.num_queries 
+	if(!ssl_printf(ssl, "%s.num.cachehits"SQ"%lu\n", nm,
+		(unsigned long)(s->svr.num_queries
 			- s->svr.num_queries_missed_cache))) return 0;
-	if(!ssl_printf(ssl, "%s.num.cachemiss"SQ"%lu\n", nm, 
+	if(!ssl_printf(ssl, "%s.num.cachemiss"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_missed_cache)) return 0;
-	if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%lu\n", nm, 
+	if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_prefetch)) return 0;
 	if(!ssl_printf(ssl, "%s.num.expired"SQ"%lu\n", nm,
 		(unsigned long)s->svr.ans_expired)) return 0;
-	if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%lu\n", nm, 
+	if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%lu\n", nm,
 		(unsigned long)s->mesh_replies_sent)) return 0;
 #ifdef USE_DNSCRYPT
 	if(!ssl_printf(ssl, "%s.num.dnscrypt.crypted"SQ"%lu\n", nm,
@@ -756,7 +756,7 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 	timeval_divide(&avg, &sumwait, s->mesh_replies_sent);
 	if(!ssl_printf(ssl, "%s.recursion.time.avg"SQ ARG_LL "d.%6.6d\n", nm,
 		(long long)avg.tv_sec, (int)avg.tv_usec)) return 0;
-	if(!ssl_printf(ssl, "%s.recursion.time.median"SQ"%g\n", nm, 
+	if(!ssl_printf(ssl, "%s.recursion.time.median"SQ"%g\n", nm,
 		s->mesh_time_median)) return 0;
 	if(!ssl_printf(ssl, "%s.tcpusage"SQ"%lu\n", nm,
 		(unsigned long)s->svr.tcp_accept_usage)) return 0;
@@ -781,7 +781,7 @@ print_longnum(RES* ssl, const char* desc, size_t x)
 		/* more than a Gb */
 		size_t front = x / (size_t)1000000;
 		size_t back = x % (size_t)1000000;
-		return ssl_printf(ssl, "%s%u%6.6u\n", desc, 
+		return ssl_printf(ssl, "%s%u%6.6u\n", desc,
 			(unsigned)front, (unsigned)back);
 	} else {
 		return ssl_printf(ssl, "%s%lu\n", desc, (unsigned long)x);
@@ -881,11 +881,11 @@ print_uptime(RES* ssl, struct worker* worker, int reset)
 	timeval_subtract(&dt, &now, &worker->daemon->time_last_stat);
 	if(reset)
 		worker->daemon->time_last_stat = now;
-	if(!ssl_printf(ssl, "time.now"SQ ARG_LL "d.%6.6d\n", 
+	if(!ssl_printf(ssl, "time.now"SQ ARG_LL "d.%6.6d\n",
 		(long long)now.tv_sec, (unsigned)now.tv_usec)) return 0;
-	if(!ssl_printf(ssl, "time.up"SQ ARG_LL "d.%6.6d\n", 
+	if(!ssl_printf(ssl, "time.up"SQ ARG_LL "d.%6.6d\n",
 		(long long)up.tv_sec, (unsigned)up.tv_usec)) return 0;
-	if(!ssl_printf(ssl, "time.elapsed"SQ ARG_LL "d.%6.6d\n", 
+	if(!ssl_printf(ssl, "time.elapsed"SQ ARG_LL "d.%6.6d\n",
 		(long long)dt.tv_sec, (unsigned)dt.tv_usec)) return 0;
 	return 1;
 }
@@ -903,7 +903,7 @@ print_hist(RES* ssl, struct ub_stats_info* s)
 	}
 	timehist_import(hist, s->svr.hist, NUM_BUCKETS_HIST);
 	for(i=0; i<hist->num; i++) {
-		if(!ssl_printf(ssl, 
+		if(!ssl_printf(ssl,
 			"histogram.%6.6d.%6.6d.to.%6.6d.%6.6d=%lu\n",
 			(int)hist->buckets[i].lower.tv_sec,
 			(int)hist->buckets[i].lower.tv_usec,
@@ -946,11 +946,11 @@ print_ext(RES* ssl, struct ub_stats_info* s)
 		} else {
 			snprintf(nm, sizeof(nm), "TYPE%d", i);
 		}
-		if(!ssl_printf(ssl, "num.query.type.%s"SQ"%lu\n", 
+		if(!ssl_printf(ssl, "num.query.type.%s"SQ"%lu\n",
 			nm, (unsigned long)s->svr.qtype[i])) return 0;
 	}
 	if(!inhibit_zero || s->svr.qtype_big) {
-		if(!ssl_printf(ssl, "num.query.type.other"SQ"%lu\n", 
+		if(!ssl_printf(ssl, "num.query.type.other"SQ"%lu\n",
 			(unsigned long)s->svr.qtype_big)) return 0;
 	}
 	/* CLASS */
@@ -963,11 +963,11 @@ print_ext(RES* ssl, struct ub_stats_info* s)
 		} else {
 			snprintf(nm, sizeof(nm), "CLASS%d", i);
 		}
-		if(!ssl_printf(ssl, "num.query.class.%s"SQ"%lu\n", 
+		if(!ssl_printf(ssl, "num.query.class.%s"SQ"%lu\n",
 			nm, (unsigned long)s->svr.qclass[i])) return 0;
 	}
 	if(!inhibit_zero || s->svr.qclass_big) {
-		if(!ssl_printf(ssl, "num.query.class.other"SQ"%lu\n", 
+		if(!ssl_printf(ssl, "num.query.class.other"SQ"%lu\n",
 			(unsigned long)s->svr.qclass_big)) return 0;
 	}
 	/* OPCODE */
@@ -980,44 +980,44 @@ print_ext(RES* ssl, struct ub_stats_info* s)
 		} else {
 			snprintf(nm, sizeof(nm), "OPCODE%d", i);
 		}
-		if(!ssl_printf(ssl, "num.query.opcode.%s"SQ"%lu\n", 
+		if(!ssl_printf(ssl, "num.query.opcode.%s"SQ"%lu\n",
 			nm, (unsigned long)s->svr.qopcode[i])) return 0;
 	}
 	/* transport */
-	if(!ssl_printf(ssl, "num.query.tcp"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.tcp"SQ"%lu\n",
 		(unsigned long)s->svr.qtcp)) return 0;
-	if(!ssl_printf(ssl, "num.query.tcpout"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.tcpout"SQ"%lu\n",
 		(unsigned long)s->svr.qtcp_outgoing)) return 0;
 	if(!ssl_printf(ssl, "num.query.udpout"SQ"%lu\n",
 		(unsigned long)s->svr.qudp_outgoing)) return 0;
-	if(!ssl_printf(ssl, "num.query.tls"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.tls"SQ"%lu\n",
 		(unsigned long)s->svr.qtls)) return 0;
-	if(!ssl_printf(ssl, "num.query.tls.resume"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.tls.resume"SQ"%lu\n",
 		(unsigned long)s->svr.qtls_resume)) return 0;
-	if(!ssl_printf(ssl, "num.query.ipv6"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.ipv6"SQ"%lu\n",
 		(unsigned long)s->svr.qipv6)) return 0;
 	if(!ssl_printf(ssl, "num.query.https"SQ"%lu\n",
 		(unsigned long)s->svr.qhttps)) return 0;
 	/* flags */
-	if(!ssl_printf(ssl, "num.query.flags.QR"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.flags.QR"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_QR)) return 0;
-	if(!ssl_printf(ssl, "num.query.flags.AA"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.flags.AA"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_AA)) return 0;
-	if(!ssl_printf(ssl, "num.query.flags.TC"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.flags.TC"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_TC)) return 0;
-	if(!ssl_printf(ssl, "num.query.flags.RD"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.flags.RD"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_RD)) return 0;
-	if(!ssl_printf(ssl, "num.query.flags.RA"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.flags.RA"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_RA)) return 0;
-	if(!ssl_printf(ssl, "num.query.flags.Z"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.flags.Z"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_Z)) return 0;
-	if(!ssl_printf(ssl, "num.query.flags.AD"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.flags.AD"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_AD)) return 0;
-	if(!ssl_printf(ssl, "num.query.flags.CD"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.flags.CD"SQ"%lu\n",
 		(unsigned long)s->svr.qbit_CD)) return 0;
-	if(!ssl_printf(ssl, "num.query.edns.present"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.edns.present"SQ"%lu\n",
 		(unsigned long)s->svr.qEDNS)) return 0;
-	if(!ssl_printf(ssl, "num.query.edns.DO"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.edns.DO"SQ"%lu\n",
 		(unsigned long)s->svr.qEDNS_DO)) return 0;
 
 	/* RCODE */
@@ -1031,31 +1031,31 @@ print_ext(RES* ssl, struct ub_stats_info* s)
 		} else {
 			snprintf(nm, sizeof(nm), "RCODE%d", i);
 		}
-		if(!ssl_printf(ssl, "num.answer.rcode.%s"SQ"%lu\n", 
+		if(!ssl_printf(ssl, "num.answer.rcode.%s"SQ"%lu\n",
 			nm, (unsigned long)s->svr.ans_rcode[i])) return 0;
 	}
 	if(!inhibit_zero || s->svr.ans_rcode_nodata) {
-		if(!ssl_printf(ssl, "num.answer.rcode.nodata"SQ"%lu\n", 
+		if(!ssl_printf(ssl, "num.answer.rcode.nodata"SQ"%lu\n",
 			(unsigned long)s->svr.ans_rcode_nodata)) return 0;
 	}
 	/* iteration */
-	if(!ssl_printf(ssl, "num.query.ratelimited"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.ratelimited"SQ"%lu\n",
 		(unsigned long)s->svr.queries_ratelimited)) return 0;
 	/* validation */
-	if(!ssl_printf(ssl, "num.answer.secure"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.answer.secure"SQ"%lu\n",
 		(unsigned long)s->svr.ans_secure)) return 0;
-	if(!ssl_printf(ssl, "num.answer.bogus"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.answer.bogus"SQ"%lu\n",
 		(unsigned long)s->svr.ans_bogus)) return 0;
-	if(!ssl_printf(ssl, "num.rrset.bogus"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.rrset.bogus"SQ"%lu\n",
 		(unsigned long)s->svr.rrset_bogus)) return 0;
-	if(!ssl_printf(ssl, "num.query.aggressive.NOERROR"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.aggressive.NOERROR"SQ"%lu\n",
 		(unsigned long)s->svr.num_neg_cache_noerror)) return 0;
-	if(!ssl_printf(ssl, "num.query.aggressive.NXDOMAIN"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "num.query.aggressive.NXDOMAIN"SQ"%lu\n",
 		(unsigned long)s->svr.num_neg_cache_nxdomain)) return 0;
 	/* threat detection */
-	if(!ssl_printf(ssl, "unwanted.queries"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "unwanted.queries"SQ"%lu\n",
 		(unsigned long)s->svr.unwanted_queries)) return 0;
-	if(!ssl_printf(ssl, "unwanted.replies"SQ"%lu\n", 
+	if(!ssl_printf(ssl, "unwanted.replies"SQ"%lu\n",
 		(unsigned long)s->svr.unwanted_replies)) return 0;
 	/* cache counts */
 	if(!ssl_printf(ssl, "msg.cache.count"SQ"%u\n",
@@ -1120,7 +1120,7 @@ do_stats(RES* ssl, struct worker* worker, int reset)
 	}
 	/* print the thread statistics */
 	total.mesh_time_median /= (double)daemon->num;
-	if(!print_stats(ssl, "total", &total)) 
+	if(!print_stats(ssl, "total", &total))
 		return;
 	if(!print_uptime(ssl, worker, reset))
 		return;
@@ -1209,7 +1209,7 @@ perform_zone_add(RES* ssl, struct local_zones* zones, char* arg)
 		return 0;
 	}
 	lock_rw_wrlock(&zones->lock);
-	if((z=local_zones_find(zones, nm, nmlen, 
+	if((z=local_zones_find(zones, nm, nmlen,
 		nmlabs, LDNS_RR_CLASS_IN))) {
 		/* already present in tree */
 		lock_rw_wrlock(&z->lock);
@@ -1219,7 +1219,7 @@ perform_zone_add(RES* ssl, struct local_zones* zones, char* arg)
 		lock_rw_unlock(&zones->lock);
 		return 1;
 	}
-	if(!local_zones_add_zone(zones, nm, nmlen, 
+	if(!local_zones_add_zone(zones, nm, nmlen,
 		nmlabs, LDNS_RR_CLASS_IN, t)) {
 		lock_rw_unlock(&zones->lock);
 		ssl_printf(ssl, "error out of memory\n");
@@ -1268,7 +1268,7 @@ perform_zone_remove(RES* ssl, struct local_zones* zones, char* arg)
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return 0;
 	lock_rw_wrlock(&zones->lock);
-	if((z=local_zones_find(zones, nm, nmlen, 
+	if((z=local_zones_find(zones, nm, nmlen,
 		nmlabs, LDNS_RR_CLASS_IN))) {
 		/* present in tree */
 		local_zones_del_zone(zones, z);
@@ -1610,7 +1610,7 @@ do_flush_type(RES* ssl, struct worker* worker, char* arg)
 		return;
 	t = sldns_get_rr_type_by_name(arg2);
 	do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN);
-	
+
 	free(nm);
 	send_ok(ssl);
 }
@@ -1720,7 +1720,7 @@ zone_del_rrset(struct lruhash_entry* e, void* arg)
 	struct del_info* inf = (struct del_info*)arg;
 	struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key;
 	if(dname_subdomain_c(k->rk.dname, inf->name)) {
-		struct packed_rrset_data* d = 
+		struct packed_rrset_data* d =
 			(struct packed_rrset_data*)e->data;
 		if(d->ttl > inf->expired) {
 			d->ttl = inf->expired;
@@ -1784,21 +1784,21 @@ do_flush_zone(RES* ssl, struct worker* worker, char* arg)
 	inf.num_rrsets = 0;
 	inf.num_msgs = 0;
 	inf.num_keys = 0;
-	slabhash_traverse(&worker->env.rrset_cache->table, 1, 
+	slabhash_traverse(&worker->env.rrset_cache->table, 1,
 		&zone_del_rrset, &inf);
 
 	slabhash_traverse(worker->env.msg_cache, 1, &zone_del_msg, &inf);
 
 	/* and validator cache */
 	if(worker->env.key_cache) {
-		slabhash_traverse(worker->env.key_cache->slab, 1, 
+		slabhash_traverse(worker->env.key_cache->slab, 1,
 			&zone_del_kcache, &inf);
 	}
 
 	free(nm);
 
 	(void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages "
-		"and %lu key entries\n", (unsigned long)inf.num_rrsets, 
+		"and %lu key entries\n", (unsigned long)inf.num_rrsets,
 		(unsigned long)inf.num_msgs, (unsigned long)inf.num_keys);
 }
 
@@ -1853,19 +1853,19 @@ do_flush_bogus(RES* ssl, struct worker* worker)
 	inf.num_rrsets = 0;
 	inf.num_msgs = 0;
 	inf.num_keys = 0;
-	slabhash_traverse(&worker->env.rrset_cache->table, 1, 
+	slabhash_traverse(&worker->env.rrset_cache->table, 1,
 		&bogus_del_rrset, &inf);
 
 	slabhash_traverse(worker->env.msg_cache, 1, &bogus_del_msg, &inf);
 
 	/* and validator cache */
 	if(worker->env.key_cache) {
-		slabhash_traverse(worker->env.key_cache->slab, 1, 
+		slabhash_traverse(worker->env.key_cache->slab, 1,
 			&bogus_del_kcache, &inf);
 	}
 
 	(void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages "
-		"and %lu key entries\n", (unsigned long)inf.num_rrsets, 
+		"and %lu key entries\n", (unsigned long)inf.num_rrsets,
 		(unsigned long)inf.num_msgs, (unsigned long)inf.num_keys);
 }
 
@@ -1928,19 +1928,19 @@ do_flush_negative(RES* ssl, struct worker* worker)
 	inf.num_rrsets = 0;
 	inf.num_msgs = 0;
 	inf.num_keys = 0;
-	slabhash_traverse(&worker->env.rrset_cache->table, 1, 
+	slabhash_traverse(&worker->env.rrset_cache->table, 1,
 		&negative_del_rrset, &inf);
 
 	slabhash_traverse(worker->env.msg_cache, 1, &negative_del_msg, &inf);
 
 	/* and validator cache */
 	if(worker->env.key_cache) {
-		slabhash_traverse(worker->env.key_cache->slab, 1, 
+		slabhash_traverse(worker->env.key_cache->slab, 1,
 			&negative_del_kcache, &inf);
 	}
 
 	(void)ssl_printf(ssl, "ok removed %lu rrsets, %lu messages "
-		"and %lu key entries\n", (unsigned long)inf.num_rrsets, 
+		"and %lu key entries\n", (unsigned long)inf.num_rrsets,
 		(unsigned long)inf.num_msgs, (unsigned long)inf.num_keys);
 }
 
@@ -1963,7 +1963,7 @@ do_flush_name(RES* ssl, struct worker* w, char* arg)
 	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN);
 	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN);
 	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN);
-	
+
 	free(nm);
 	send_ok(ssl);
 }
@@ -2333,7 +2333,7 @@ do_status(RES* ssl, struct worker* worker)
 	uptime = (time_t)time(NULL) - (time_t)worker->daemon->time_boot.tv_sec;
 	if(!ssl_printf(ssl, "uptime: " ARG_LL "d seconds\n", (long long)uptime))
 		return;
-	if(!ssl_printf(ssl, "options:%s%s%s%s\n" , 
+	if(!ssl_printf(ssl, "options:%s%s%s%s\n" ,
 		(worker->daemon->reuseport?" reuseport":""),
 		(worker->daemon->rc->accept_list?" control":""),
 		(worker->daemon->rc->accept_list && worker->daemon->rc->use_cert?"(ssl)":""),
@@ -2347,7 +2347,7 @@ do_status(RES* ssl, struct worker* worker)
 
 /** get age for the mesh state */
 static void
-get_mesh_age(struct mesh_state* m, char* buf, size_t len, 
+get_mesh_age(struct mesh_state* m, char* buf, size_t len,
 	struct module_env* env)
 {
 	if(m->reply_list) {
@@ -2366,7 +2366,7 @@ get_mesh_age(struct mesh_state* m, char* buf, size_t len,
 
 /** get status of a mesh state */
 static void
-get_mesh_status(struct mesh_area* mesh, struct mesh_state* m, 
+get_mesh_status(struct mesh_area* mesh, struct mesh_state* m,
 	char* buf, size_t len)
 {
 	enum module_ext_state s = m->s.ext_state[m->s.curmod];
@@ -2388,7 +2388,7 @@ get_mesh_status(struct mesh_area* mesh, struct mesh_state* m,
 			snprintf(buf, len, " ");
 			l = strlen(buf);
 			buf += l; len -= l;
-			addr_to_str(&e->qsent->addr, e->qsent->addrlen, 
+			addr_to_str(&e->qsent->addr, e->qsent->addrlen,
 				buf, len);
 			l = strlen(buf);
 			buf += l; len -= l;
@@ -2441,7 +2441,7 @@ do_dump_requestlist(RES* ssl, struct worker* worker)
 		dname_str(m->s.qinfo.qname, buf);
 		get_mesh_age(m, timebuf, sizeof(timebuf), &worker->env);
 		get_mesh_status(mesh, m, statbuf, sizeof(statbuf));
-		if(!ssl_printf(ssl, "%3d %4s %2s %s %s %s\n", 
+		if(!ssl_printf(ssl, "%3d %4s %2s %s %s %s\n",
 			num, (t?t:"TYPE??"), (c?c:"CLASS??"), buf, timebuf,
 			statbuf)) {
 			free(t);
@@ -2631,7 +2631,7 @@ do_auth_zone_transfer(RES* ssl, struct worker* worker, char* arg)
 	free(nm);
 	send_ok(ssl);
 }
-	
+
 /** do the set_option command */
 static void
 do_set_option(RES* ssl, struct worker* worker, char* arg)
@@ -2769,7 +2769,7 @@ do_list_local_zones(RES* ssl, struct local_zones* zones)
 	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
 		lock_rw_rdlock(&z->lock);
 		dname_str(z->name, buf);
-		if(!ssl_printf(ssl, "%s %s\n", buf, 
+		if(!ssl_printf(ssl, "%s %s\n", buf,
 			local_zone_type2str(z->type))) {
 			/* failure to print */
 			lock_rw_unlock(&z->lock);
@@ -2998,7 +2998,7 @@ static void
 distribute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd)
 {
 	int i;
-	if(!cmd || !ssl) 
+	if(!cmd || !ssl)
 		return;
 	/* skip i=0 which is me */
 	for(i=1; i<rc->worker->daemon->num; i++) {
@@ -3021,7 +3021,7 @@ cmdcmp(char* p, const char* cmd, size_t len)
 
 /** execute a remote control command */
 static void
-execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd, 
+execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 	struct worker* worker)
 {
 	char* p = skipwhite(cmd);
@@ -3202,7 +3202,7 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 	}
 }
 
-void 
+void
 daemon_remote_exec(struct worker* worker)
 {
 	/* read the cmd string */
@@ -3311,7 +3311,7 @@ remote_handshake_later(struct daemon_remote* rc, struct rc_state* s,
 	return 0;
 }
 
-int remote_control_callback(struct comm_point* c, void* arg, int err, 
+int remote_control_callback(struct comm_point* c, void* arg, int err,
 	struct comm_reply* ATTR_UNUSED(rep))
 {
 	RES res;
@@ -3319,7 +3319,7 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
 	struct daemon_remote* rc = s->rc;
 	int r;
 	if(err != NETEVENT_NOERROR) {
-		if(err==NETEVENT_TIMEOUT) 
+		if(err==NETEVENT_TIMEOUT)
 			log_err("remote control timed out");
 		clean_point(rc, s);
 		return 0;
diff --git a/usr.sbin/unbound/daemon/remote.h b/usr.sbin/unbound/daemon/remote.h
index 217ea21e8..ce9d36d3e 100644
--- a/usr.sbin/unbound/daemon/remote.h
+++ b/usr.sbin/unbound/daemon/remote.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -38,7 +38,7 @@
  *
  * This file contains the remote control functionality for the daemon.
  * The remote control can be performed using either the commandline
- * unbound-control tool, or a SSLv3/TLS capable web browser. 
+ * unbound-control tool, or a SSLv3/TLS capable web browser.
  * The channel is secured using SSLv3 or TLSv1, and certificates.
  * Both the server and the client(control tool) have their own keys.
  */
@@ -153,7 +153,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg);
  * @param worker: worker with communication base. and links to command channels.
  * @return false on error.
  */
-int daemon_remote_open_accept(struct daemon_remote* rc, 
+int daemon_remote_open_accept(struct daemon_remote* rc,
 	struct listen_port* ports, struct worker* worker);
 
 /**
@@ -175,7 +175,7 @@ void daemon_remote_start_accept(struct daemon_remote* rc);
 void daemon_remote_exec(struct worker* worker);
 
 #ifdef HAVE_SSL
-/** 
+/**
  * Print fixed line of text over ssl connection in blocking mode
  * @param ssl: print to
  * @param text: the text.
@@ -183,7 +183,7 @@ void daemon_remote_exec(struct worker* worker);
  */
 int ssl_print_text(RES* ssl, const char* text);
 
-/** 
+/**
  * printf style printing to the ssl connection
  * @param ssl: the RES connection to print to. Blocking.
  * @param format: printf style format string.
diff --git a/usr.sbin/unbound/daemon/stats.c b/usr.sbin/unbound/daemon/stats.c
index 6b3834977..ee40543a9 100644
--- a/usr.sbin/unbound/daemon/stats.c
+++ b/usr.sbin/unbound/daemon/stats.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -116,8 +116,8 @@ void server_stats_log(struct ub_server_stats* stats, struct worker* worker,
 	log_info("server stats for thread %d: %u queries, "
 		"%u answers from cache, %u recursions, %u prefetch, %u rejected by "
 		"ip ratelimiting",
-		threadnum, (unsigned)stats->num_queries, 
-		(unsigned)(stats->num_queries - 
+		threadnum, (unsigned)stats->num_queries,
+		(unsigned)(stats->num_queries -
 			stats->num_queries_missed_cache),
 		(unsigned)stats->num_queries_missed_cache,
 		(unsigned)stats->num_queries_prefetch,
@@ -279,7 +279,7 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		s->svr.ans_rcode[i] += (long long)worker->env.mesh->ans_rcode[i];
 	for(i=0; i<UB_STATS_RPZ_ACTION_NUM; i++)
 		s->svr.rpz_action[i] += (long long)worker->env.mesh->rpz_action[i];
-	timehist_export(worker->env.mesh->histogram, s->svr.hist, 
+	timehist_export(worker->env.mesh->histogram, s->svr.hist,
 		NUM_BUCKETS_HIST);
 	/* values from outside network */
 	s->svr.unwanted_replies = (long long)worker->back->unwanted_replies;
@@ -419,7 +419,7 @@ void server_stats_reply(struct worker* worker, int reset)
 	struct ub_stats_info s;
 	server_stats_compile(worker, &s, reset);
 	verbose(VERB_ALGO, "write stats replymsg");
-	if(!tube_write_msg(worker->daemon->workers[0]->cmd, 
+	if(!tube_write_msg(worker->daemon->workers[0]->cmd,
 		(uint8_t*)&s, sizeof(s), 0))
 		fatal_exit("could not write stat values over cmd channel");
 }
@@ -514,7 +514,7 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
 		if(c->ssl != NULL) {
 			stats->qtls++;
 #ifdef HAVE_SSL
-			if(SSL_session_reused(c->ssl)) 
+			if(SSL_session_reused(c->ssl))
 				stats->qtls_resume++;
 #endif
 			if(c->type == comm_http)
diff --git a/usr.sbin/unbound/daemon/stats.h b/usr.sbin/unbound/daemon/stats.h
index 4e5e6cf8a..5756f38a1 100644
--- a/usr.sbin/unbound/daemon/stats.h
+++ b/usr.sbin/unbound/daemon/stats.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -53,7 +53,7 @@ struct sldns_buffer;
 /* stats struct */
 #include "libunbound/unbound.h"
 
-/** 
+/**
  * Initialize server stats to 0.
  * @param stats: what to init (this is alloced by the caller).
  * @param cfg: with extended statistics option.
@@ -88,7 +88,7 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
  * @param reset: if true, depending on config stats are reset.
  * 	if false, statistics are not reset.
  */
-void server_stats_compile(struct worker* worker, struct ub_stats_info* s, 
+void server_stats_compile(struct worker* worker, struct ub_stats_info* s,
 	int reset);
 
 /**
@@ -116,7 +116,7 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a);
  * @param repinfo: reply info with remote address
  */
 void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c,
-	uint16_t qtype, uint16_t qclass, struct edns_data* edns, 
+	uint16_t qtype, uint16_t qclass, struct edns_data* edns,
 	struct comm_reply* repinfo);
 
 /**
diff --git a/usr.sbin/unbound/daemon/unbound.c b/usr.sbin/unbound/daemon/unbound.c
index 457a08032..9e40d1ae3 100644
--- a/usr.sbin/unbound/daemon/unbound.c
+++ b/usr.sbin/unbound/daemon/unbound.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -176,17 +176,17 @@ checkrlimits(struct config_file* cfg)
 #ifndef S_SPLINT_S
 #ifdef HAVE_GETRLIMIT
 	/* list has number of ports to listen to, ifs number addresses */
-	int list = ((cfg->do_udp?1:0) + (cfg->do_tcp?1 + 
+	int list = ((cfg->do_udp?1:0) + (cfg->do_tcp?1 +
 			(int)cfg->incoming_num_tcp:0));
 	size_t listen_ifs = (size_t)(cfg->num_ifs==0?
-		((cfg->do_ip4 && !cfg->if_automatic?1:0) + 
+		((cfg->do_ip4 && !cfg->if_automatic?1:0) +
 		 (cfg->do_ip6?1:0)):cfg->num_ifs);
 	size_t listen_num = list*listen_ifs;
 	size_t outudpnum = (size_t)cfg->outgoing_num_ports;
 	size_t outtcpnum = cfg->outgoing_num_tcp;
 	size_t misc = 4; /* logfile, pidfile, stdout... */
-	size_t perthread_noudp = listen_num + outtcpnum + 
-		2/*cmdpipe*/ + 2/*libevent*/ + misc; 
+	size_t perthread_noudp = listen_num + outtcpnum +
+		2/*cmdpipe*/ + 2/*libevent*/ + misc;
 	size_t perthread = perthread_noudp + outudpnum;
 
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
@@ -227,29 +227,29 @@ checkrlimits(struct config_file* cfg)
 		}
 	}
 
-	if(total > 1024 && 
+	if(total > 1024 &&
 		strncmp(ub_event_get_version(), "mini-event", 10) == 0) {
 		log_warn("too many file descriptors requested. The builtin"
 			"mini-event cannot handle more than 1024. Config "
 			"for less fds or compile with libevent");
 		if(numthread*perthread_noudp+15 > 1024)
 			fatal_exit("too much tcp. not enough fds.");
-		cfg->outgoing_num_ports = (int)((1024 
-			- numthread*perthread_noudp 
+		cfg->outgoing_num_ports = (int)((1024
+			- numthread*perthread_noudp
 			- 10 /* safety margin */) /numthread);
 		log_warn("continuing with less udp ports: %u",
 			cfg->outgoing_num_ports);
 		total = 1024;
 	}
-	if(perthread > 64 && 
+	if(perthread > 64 &&
 		strncmp(ub_event_get_version(), "winsock-event", 13) == 0) {
 		log_err("too many file descriptors requested. The winsock"
 			" event handler cannot handle more than 64 per "
 			" thread. Config for less fds");
 		if(perthread_noudp+2 > 64)
 			fatal_exit("too much tcp. not enough fds.");
-		cfg->outgoing_num_ports = (int)((64 
-			- perthread_noudp 
+		cfg->outgoing_num_ports = (int)((64
+			- perthread_noudp
 			- 2/* safety margin */));
 		log_warn("continuing with less udp ports: %u",
 			cfg->outgoing_num_ports);
@@ -276,8 +276,8 @@ checkrlimits(struct config_file* cfg)
 			 * with 15 as margin */
 			if(numthread*perthread_noudp+15 > avail)
 				fatal_exit("too much tcp. not enough fds.");
-			cfg->outgoing_num_ports = (int)((avail 
-				- numthread*perthread_noudp 
+			cfg->outgoing_num_ports = (int)((avail
+				- numthread*perthread_noudp
 				- 10 /* safety margin */) /numthread);
 			log_warn("continuing with less udp ports: %u",
 				cfg->outgoing_num_ports);
@@ -290,7 +290,7 @@ checkrlimits(struct config_file* cfg)
 		verbose(VERB_ALGO, "increased limit(open files) from %u to %u",
 			(unsigned)avail, (unsigned)total+10);
 	}
-#else	
+#else
 	(void)cfg;
 #endif /* HAVE_GETRLIMIT */
 #endif /* S_SPLINT_S */
@@ -319,7 +319,7 @@ apply_settings(struct daemon* daemon, struct config_file* cfg,
 }
 
 #ifdef HAVE_KILL
-/** Read existing pid from pidfile. 
+/** Read existing pid from pidfile.
  * @param file: file name of pid file.
  * @return: the pid from the file or -1 if none.
  */
@@ -356,14 +356,14 @@ readpid (const char* file)
 
 	pidbuf[sizeof(pidbuf)-1] = 0;
 	pid = (pid_t)strtol(pidbuf, &t, 10);
-	
+
 	if (*t && *t != '\n') {
 		return -1;
 	}
 	return pid;
 }
 
-/** write pid to file. 
+/** write pid to file.
  * @param pidfile: file name of pid file.
  * @param pid: pid to write to file.
  * @return false on failure
@@ -381,7 +381,7 @@ writepid (const char* pidfile, pid_t pid)
 		| O_NOFOLLOW
 #endif
 		, 0644)) == -1) {
-		log_err("cannot open pidfile %s: %s", 
+		log_err("cannot open pidfile %s: %s",
 			pidfile, strerror(errno));
 		return 0;
 	}
@@ -419,10 +419,10 @@ checkoldpid(char* pidfile, int inchroot)
 	if((old = readpid(pidfile)) != -1) {
 		/* see if it is still alive */
 		if(kill(old, 0) == 0 || errno == EPERM)
-			log_warn("unbound is already running as pid %u.", 
+			log_warn("unbound is already running as pid %u.",
 				(unsigned)old);
 		else	if(inchroot)
-			log_warn("did not exit gracefully last time (%u)", 
+			log_warn("did not exit gracefully last time (%u)",
 				(unsigned)old);
 	}
 }
@@ -541,7 +541,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 		/* calculate position of pidfile */
 		if(cfg->pidfile[0] == '/')
 			daemon->pidfile = strdup(cfg->pidfile);
-		else	daemon->pidfile = fname_after_chroot(cfg->pidfile, 
+		else	daemon->pidfile = fname_after_chroot(cfg->pidfile,
 				cfg, 1);
 		if(!daemon->pidfile)
 			fatal_exit("pidfile alloc: out of memory");
@@ -601,18 +601,18 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 		}
 		verbose(VERB_QUERY, "chdir to %s", cfg->chrootdir);
 		if(chroot(cfg->chrootdir))
-			fatal_exit("unable to chroot to %s: %s", 
+			fatal_exit("unable to chroot to %s: %s",
 				cfg->chrootdir, strerror(errno));
 		if(chdir("/"))
 			fatal_exit("unable to chdir to / in chroot %s: %s",
 				cfg->chrootdir, strerror(errno));
 		verbose(VERB_QUERY, "chroot to %s", cfg->chrootdir);
-		if(strncmp(*cfgfile, cfg->chrootdir, 
-			strlen(cfg->chrootdir)) == 0) 
+		if(strncmp(*cfgfile, cfg->chrootdir,
+			strlen(cfg->chrootdir)) == 0)
 			(*cfgfile) += strlen(cfg->chrootdir);
 
 		/* adjust stored pidfile for chroot */
-		if(daemon->pidfile && daemon->pidfile[0] && 
+		if(daemon->pidfile && daemon->pidfile[0] &&
 			strncmp(daemon->pidfile, cfg->chrootdir,
 			strlen(cfg->chrootdir))==0) {
 			char* old = daemon->pidfile;
@@ -632,7 +632,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	if(cfg->directory && cfg->directory[0]) {
 		char* dir = cfg->directory;
 		if(cfg->chrootdir && cfg->chrootdir[0] &&
-			strncmp(dir, cfg->chrootdir, 
+			strncmp(dir, cfg->chrootdir,
 			strlen(cfg->chrootdir)) == 0)
 			dir += strlen(cfg->chrootdir);
 		if(dir[0]) {
@@ -663,7 +663,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #else /* use setgid */
 		if(setgid(cfg_gid) != 0)
 #endif /* HAVE_SETRESGID */
-			fatal_exit("unable to set group id of %s: %s", 
+			fatal_exit("unable to set group id of %s: %s",
 				cfg->username, strerror(errno));
 #ifdef HAVE_SETRESUID
 		if(setresuid(cfg_uid,cfg_uid,cfg_uid) != 0)
@@ -672,27 +672,27 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #else /* use setuid */
 		if(setuid(cfg_uid) != 0)
 #endif /* HAVE_SETRESUID */
-			fatal_exit("unable to set user id of %s: %s", 
+			fatal_exit("unable to set user id of %s: %s",
 				cfg->username, strerror(errno));
-		verbose(VERB_QUERY, "drop user privileges, run as %s", 
+		verbose(VERB_QUERY, "drop user privileges, run as %s",
 			cfg->username);
 	}
 #endif /* HAVE_GETPWNAM */
-	/* file logging inited after chroot,chdir,setuid is done so that 
+	/* file logging inited after chroot,chdir,setuid is done so that
 	 * it would succeed on SIGHUP as well */
 	if(!cfg->use_syslog)
 		log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
 }
 
 /**
- * Run the daemon. 
+ * Run the daemon.
  * @param cfgfile: the config file name.
  * @param cmdline_verbose: verbosity resulting from commandline -v.
  *    These increase verbosity as specified in the config file.
  * @param debug_mode: if set, do not daemonize.
  * @param need_pidfile: if false, no pidfile is checked or created.
  */
-static void 
+static void
 run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, int need_pidfile)
 {
 	struct config_file* cfg = NULL;
@@ -720,13 +720,13 @@ run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode, int need_pi
 		apply_settings(daemon, cfg, cmdline_verbose, debug_mode);
 		if(!done_setup)
 			config_lookup_uid(cfg);
-	
+
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
-		if(!done_setup) { 
+		if(!done_setup) {
 			perform_setup(daemon, cfg, debug_mode, &cfgfile, need_pidfile);
-			done_setup = 1; 
+			done_setup = 1;
 		} else {
 			/* reopen log after HUP to facilitate log rotation */
 			if(!cfg->use_syslog)
@@ -766,7 +766,7 @@ extern char* optarg;
  * @param argv: array of commandline arguments.
  * @return: exit status of the program.
  */
-int 
+int
 main(int argc, char* argv[])
 {
 	int c;
@@ -823,7 +823,7 @@ main(int argc, char* argv[])
 
 	if(winopt) {
 #ifdef UB_ON_WINDOWS
-		wsvc_command_option(winopt, cfgfile, cmdline_verbose, 
+		wsvc_command_option(winopt, cfgfile, cmdline_verbose,
 			cmdline_cfg);
 #else
 		fatal_exit("option not supported");
diff --git a/usr.sbin/unbound/daemon/worker.c b/usr.sbin/unbound/daemon/worker.c
index caefad621..2d629a810 100644
--- a/usr.sbin/unbound/daemon/worker.c
+++ b/usr.sbin/unbound/daemon/worker.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -112,7 +112,7 @@
 
 /** Report on memory usage by this thread and global */
 static void
-worker_mem_report(struct worker* ATTR_UNUSED(worker), 
+worker_mem_report(struct worker* ATTR_UNUSED(worker),
 	struct serviced_query* ATTR_UNUSED(cur_serv))
 {
 #ifdef UNBOUND_ALLOC_STATS
@@ -125,7 +125,7 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 #ifdef CLIENT_SUBNET
 	size_t subnet = 0;
 #endif /* CLIENT_SUBNET */
-	if(verbosity < VERB_ALGO) 
+	if(verbosity < VERB_ALGO)
 		return;
 	front = listen_get_mem(worker->front);
 	back = outnet_get_mem(worker->back);
@@ -154,10 +154,10 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 				(&worker->env, i);
 	}
 	me = sizeof(*worker) + sizeof(*worker->base) + sizeof(*worker->comsig)
-		+ comm_point_get_mem(worker->cmd_com) 
-		+ sizeof(worker->rndstate) 
-		+ regional_get_mem(worker->scratchpad) 
-		+ sizeof(*worker->env.scratch_buffer) 
+		+ comm_point_get_mem(worker->cmd_com)
+		+ sizeof(worker->rndstate)
+		+ regional_get_mem(worker->scratchpad)
+		+ sizeof(*worker->env.scratch_buffer)
 		+ sldns_buffer_capacity(worker->env.scratch_buffer)
 		+ forwards_get_mem(worker->env.fwds)
 		+ hints_get_mem(worker->env.hints);
@@ -172,7 +172,7 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 	log_info("Memory conditions: %u front=%u back=%u mesh=%u msg=%u "
 		"rrset=%u infra=%u iter=%u val=%u subnet=%u anchors=%u "
 		"alloccache=%u globalalloccache=%u me=%u",
-		(unsigned)total, (unsigned)front, (unsigned)back, 
+		(unsigned)total, (unsigned)front, (unsigned)back,
 		(unsigned)mesh, (unsigned)msg, (unsigned)rrset, (unsigned)infra,
 		(unsigned)iter, (unsigned)val,
 		(unsigned)subnet, (unsigned)anch, (unsigned)ac,
@@ -181,13 +181,13 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 	log_info("Memory conditions: %u front=%u back=%u mesh=%u msg=%u "
 		"rrset=%u infra=%u iter=%u val=%u anchors=%u "
 		"alloccache=%u globalalloccache=%u me=%u",
-		(unsigned)total, (unsigned)front, (unsigned)back, 
-		(unsigned)mesh, (unsigned)msg, (unsigned)rrset, 
+		(unsigned)total, (unsigned)front, (unsigned)back,
+		(unsigned)mesh, (unsigned)msg, (unsigned)rrset,
 		(unsigned)infra, (unsigned)iter, (unsigned)val, (unsigned)anch,
 		(unsigned)ac, (unsigned)superac, (unsigned)me);
 #endif /* CLIENT_SUBNET */
 	log_info("Total heap memory estimate: %u  total-alloc: %u  "
-		"total-free: %u", (unsigned)total, 
+		"total-free: %u", (unsigned)total,
 		(unsigned)unbound_mem_alloc, (unsigned)unbound_mem_freed);
 #else /* no UNBOUND_ALLOC_STATS */
 	size_t val = 0;
@@ -227,7 +227,7 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 #endif /* UNBOUND_ALLOC_STATS */
 }
 
-void 
+void
 worker_send_cmd(struct worker* worker, enum worker_commands cmd)
 {
 	uint32_t c = (uint32_t)htonl(cmd);
@@ -236,8 +236,8 @@ worker_send_cmd(struct worker* worker, enum worker_commands cmd)
 	}
 }
 
-int 
-worker_handle_service_reply(struct comm_point* c, void* arg, int error, 
+int
+worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	struct comm_reply* reply_info)
 {
 	struct outbound_entry* e = (struct outbound_entry*)arg;
@@ -252,13 +252,13 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	}
 	/* sanity check. */
 	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
-		|| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) != 
+		|| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
 			LDNS_PACKET_QUERY
 		|| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
 		/* error becomes timeout for the module as if this reply
 		 * never arrived. */
 		verbose(VERB_ALGO, "worker: bad reply handled as timeout");
-		mesh_report_reply(worker->env.mesh, e, reply_info, 
+		mesh_report_reply(worker->env.mesh, e, reply_info,
 			NETEVENT_TIMEOUT);
 		worker_mem_report(worker, sq);
 		return 0;
@@ -293,14 +293,14 @@ worker_err_ratelimit(struct worker* worker, int err)
  * @param worker: parameters for checking.
  * @return error code, 0 OK, or -1 discard.
 */
-static int 
+static int
 worker_check_request(sldns_buffer* pkt, struct worker* worker)
 {
 	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
 		verbose(VERB_QUERY, "request too short, discarded");
 		return -1;
 	}
-	if(sldns_buffer_limit(pkt) > NORMAL_UDP_SIZE && 
+	if(sldns_buffer_limit(pkt) > NORMAL_UDP_SIZE &&
 		worker->daemon->cfg->harden_large_queries) {
 		verbose(VERB_QUERY, "request too large, discarded");
 		return -1;
@@ -316,36 +316,36 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker)
 	}
 	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY &&
 		LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_NOTIFY) {
-		verbose(VERB_QUERY, "request unknown opcode %d", 
+		verbose(VERB_QUERY, "request unknown opcode %d",
 			LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)));
 		return worker_err_ratelimit(worker, LDNS_RCODE_NOTIMPL);
 	}
 	if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) {
-		verbose(VERB_QUERY, "request wrong nr qd=%d", 
+		verbose(VERB_QUERY, "request wrong nr qd=%d",
 			LDNS_QDCOUNT(sldns_buffer_begin(pkt)));
 		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
-	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 0 && 
+	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 0 &&
 		(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 1 ||
 		LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_NOTIFY)) {
-		verbose(VERB_QUERY, "request wrong nr an=%d", 
+		verbose(VERB_QUERY, "request wrong nr an=%d",
 			LDNS_ANCOUNT(sldns_buffer_begin(pkt)));
 		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
 	if(LDNS_NSCOUNT(sldns_buffer_begin(pkt)) != 0) {
-		verbose(VERB_QUERY, "request wrong nr ns=%d", 
+		verbose(VERB_QUERY, "request wrong nr ns=%d",
 			LDNS_NSCOUNT(sldns_buffer_begin(pkt)));
 		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
 	if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 1) {
-		verbose(VERB_QUERY, "request wrong nr ar=%d", 
+		verbose(VERB_QUERY, "request wrong nr ar=%d",
 			LDNS_ARCOUNT(sldns_buffer_begin(pkt)));
 		return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 	}
 	return 0;
 }
 
-void 
+void
 worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), uint8_t* msg,
 	size_t len, int error, void* arg)
 {
@@ -388,7 +388,7 @@ worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube), uint8_t* msg,
 
 /** check if a delegation is secure */
 static enum sec_status
-check_delegation_secure(struct reply_info *rep) 
+check_delegation_secure(struct reply_info *rep)
 {
 	/* return smallest security status */
 	size_t i;
@@ -424,10 +424,10 @@ deleg_remove_nonsecure_additional(struct reply_info* rep)
 		s = ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
 			->security;
 		if(s != sec_status_secure) {
-			memmove(rep->rrsets+i, rep->rrsets+i+1, 
-				sizeof(struct ub_packed_rrset_key*)* 
+			memmove(rep->rrsets+i, rep->rrsets+i+1,
+				sizeof(struct ub_packed_rrset_key*)*
 				(rep->rrset_count - i - 1));
-			rep->ar_numrrsets--; 
+			rep->ar_numrrsets--;
 			rep->rrset_count--;
 			i--;
 		}
@@ -437,15 +437,15 @@ deleg_remove_nonsecure_additional(struct reply_info* rep)
 /** answer nonrecursive query from the cache */
 static int
 answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
-	uint16_t id, uint16_t flags, struct comm_reply* repinfo, 
+	uint16_t id, uint16_t flags, struct comm_reply* repinfo,
 	struct edns_data* edns)
 {
 	/* for a nonrecursive query return either:
 	 * 	o an error (servfail; we try to avoid this)
 	 * 	o a delegation (closest we have; this routine tries that)
-	 * 	o the answer (checked by answer_from_cache) 
+	 * 	o the answer (checked by answer_from_cache)
 	 *
-	 * So, grab a delegation from the rrset cache. 
+	 * So, grab a delegation from the rrset cache.
 	 * Then check if it needs validation, if so, this routine fails,
 	 * so that iterator can prime and validator can verify rrsets.
 	 */
@@ -457,7 +457,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	struct dns_msg *msg = NULL;
 	struct delegpt *dp;
 
-	dp = dns_cache_find_delegation(&worker->env, qinfo->qname, 
+	dp = dns_cache_find_delegation(&worker->env, qinfo->qname,
 		qinfo->qname_len, qinfo->qtype, qinfo->qclass,
 		worker->scratchpad, &msg, timenow, 0, NULL, 0);
 	if(!dp) { /* no delegation, need to reprime */
@@ -470,7 +470,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	if(must_validate) {
 		switch(check_delegation_secure(msg->rep)) {
 		case sec_status_unchecked:
-			/* some rrsets have not been verified yet, go and 
+			/* some rrsets have not been verified yet, go and
 			 * let validator do that */
 			return 0;
 		case sec_status_bogus:
@@ -490,7 +490,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 				EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out,
 					worker->scratchpad, LDNS_EDE_DNSSEC_BOGUS, "");
 			}
-			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
+			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
 				&msg->qinfo, id, flags, edns);
 			if(worker->stats.extended) {
 				worker->stats.ans_bogus++;
@@ -529,7 +529,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
 			worker->env.now_tv))
 				edns->opt_list_inplace_cb_out = NULL;
-		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
+		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
 			&msg->qinfo, id, flags, edns);
 	}
 	if(worker->stats.extended) {
@@ -757,7 +757,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	return 1;
 
 bail_out:
-	rrset_array_unlock_touch(worker->env.rrset_cache, 
+	rrset_array_unlock_touch(worker->env.rrset_cache,
 		worker->scratchpad, rep->ref, rep->rrset_count);
 	return 0;
 }
@@ -941,12 +941,12 @@ answer_chaos(struct worker* w, struct query_info* qinfo,
 	struct config_file* cfg = w->env.cfg;
 	if(qinfo->qtype != LDNS_RR_TYPE_ANY && qinfo->qtype != LDNS_RR_TYPE_TXT)
 		return 0;
-	if(query_dname_compare(qinfo->qname, 
+	if(query_dname_compare(qinfo->qname,
 		(uint8_t*)"\002id\006server") == 0 ||
-		query_dname_compare(qinfo->qname, 
+		query_dname_compare(qinfo->qname,
 		(uint8_t*)"\010hostname\004bind") == 0)
 	{
-		if(cfg->hide_identity) 
+		if(cfg->hide_identity)
 			return 0;
 		if(cfg->identity==NULL || cfg->identity[0]==0) {
 			char buf[MAXHOSTNAMELEN+1];
@@ -961,12 +961,12 @@ answer_chaos(struct worker* w, struct query_info* qinfo,
 		else 	chaos_replyonestr(pkt, cfg->identity, edns, w, repinfo);
 		return 1;
 	}
-	if(query_dname_compare(qinfo->qname, 
+	if(query_dname_compare(qinfo->qname,
 		(uint8_t*)"\007version\006server") == 0 ||
-		query_dname_compare(qinfo->qname, 
+		query_dname_compare(qinfo->qname,
 		(uint8_t*)"\007version\004bind") == 0)
 	{
-		if(cfg->hide_version) 
+		if(cfg->hide_version)
 			return 0;
 		if(cfg->version==NULL || cfg->version[0]==0)
 			chaos_replyonestr(pkt, PACKAGE_STRING, edns, w, repinfo);
@@ -1125,7 +1125,7 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			return 1;
 		}
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 			LDNS_RCODE_REFUSED);
 
 		sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qtype */
@@ -1140,7 +1140,7 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		/* Skip through the RR records */
 		if(LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)) != 0 ||
 			LDNS_NSCOUNT(sldns_buffer_begin(c->buffer)) != 0) {
-			if(!skip_pkt_rrs(c->buffer, 
+			if(!skip_pkt_rrs(c->buffer,
 				((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
 				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
 				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
@@ -1410,7 +1410,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		}
 		sldns_buffer_rewind(c->buffer);
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 			LDNS_RCODE_FORMERR);
 		goto send_reply;
 	}
@@ -1419,21 +1419,21 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		addr_to_str(&repinfo->client_addr, repinfo->client_addrlen, ip, sizeof(ip));
 		log_query_in(ip, qinfo.qname, qinfo.qtype, qinfo.qclass);
 	}
-	if(qinfo.qtype == LDNS_RR_TYPE_AXFR || 
+	if(qinfo.qtype == LDNS_RR_TYPE_AXFR ||
 		qinfo.qtype == LDNS_RR_TYPE_IXFR) {
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
 		sldns_buffer_rewind(c->buffer);
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 			LDNS_RCODE_REFUSED);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
 		goto send_reply;
 	}
-	if(qinfo.qtype == LDNS_RR_TYPE_OPT || 
+	if(qinfo.qtype == LDNS_RR_TYPE_OPT ||
 		qinfo.qtype == LDNS_RR_TYPE_TSIG ||
 		qinfo.qtype == LDNS_RR_TYPE_TKEY ||
 		qinfo.qtype == LDNS_RR_TYPE_MAILA ||
@@ -1448,7 +1448,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		}
 		sldns_buffer_rewind(c->buffer);
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 			LDNS_RCODE_FORMERR);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
@@ -1517,10 +1517,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			repinfo->client_addrlen);
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_TC_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), 
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 			LDNS_RCODE_SERVFAIL);
 		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-		sldns_buffer_write_at(c->buffer, 4, 
+		sldns_buffer_write_at(c->buffer, 4,
 			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
 		sldns_buffer_flip(c->buffer);
 		regional_free_all(worker->scratchpad);
@@ -1739,8 +1739,8 @@ lookup_cache:
 
 		if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
 			if(answer_norec_from_cache(worker, &qinfo,
-				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer), 
-				sldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
+				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
+				sldns_buffer_read_u16_at(c->buffer, 2), repinfo,
 				&edns)) {
 				regional_free_all(worker->scratchpad);
 				goto send_reply;
@@ -1819,10 +1819,10 @@ send_reply_rc:
 	return rc;
 }
 
-void 
+void
 worker_sighandler(int sig, void* arg)
 {
-	/* note that log, print, syscalls here give race conditions. 
+	/* note that log, print, syscalls here give race conditions.
 	 * And cause hangups if the log-lock is held by the application. */
 	struct worker* worker = (struct worker*)arg;
 	switch(sig) {
@@ -1897,13 +1897,13 @@ void worker_probe_timer_cb(void* arg)
 		comm_timer_set(worker->env.probe_timer, &tv);
 }
 
-struct worker* 
+struct worker*
 worker_create(struct daemon* daemon, int id, int* ports, int n)
 {
 	unsigned int seed;
-	struct worker* worker = (struct worker*)calloc(1, 
+	struct worker* worker = (struct worker*)calloc(1,
 		sizeof(struct worker));
-	if(!worker) 
+	if(!worker)
 		return NULL;
 	worker->numports = n;
 	worker->ports = (int*)memdup(ports, sizeof(int)*n);
@@ -1931,7 +1931,7 @@ worker_create(struct daemon* daemon, int id, int* ports, int n)
 }
 
 int
-worker_init(struct worker* worker, struct config_file *cfg, 
+worker_init(struct worker* worker, struct config_file *cfg,
 	struct listen_port* ports, int do_sigs)
 {
 #ifdef USE_DNSTAP
@@ -1964,9 +1964,9 @@ worker_init(struct worker* worker, struct config_file *cfg,
 #endif
 		ub_thread_sig_unblock(SIGTERM);
 #ifndef LIBEVENT_SIGNAL_PROBLEM
-		worker->comsig = comm_signal_create(worker->base, 
+		worker->comsig = comm_signal_create(worker->base,
 			worker_sighandler, worker);
-		if(!worker->comsig 
+		if(!worker->comsig
 #ifdef SIGHUP
 			|| !comm_signal_bind(worker->comsig, SIGHUP)
 #endif
@@ -1983,7 +1983,7 @@ worker_init(struct worker* worker, struct config_file *cfg,
 			return 0;
 		}
 #endif /* LIBEVENT_SIGNAL_PROBLEM */
-		if(!daemon_remote_open_accept(worker->daemon->rc, 
+		if(!daemon_remote_open_accept(worker->daemon->rc,
 			worker->daemon->rc_ports, worker)) {
 			worker_delete(worker);
 			return 0;
@@ -2017,8 +2017,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		return 0;
 	}
 	worker->back = outside_network_create(worker->base,
-		cfg->msg_buffer_size, (size_t)cfg->outgoing_num_ports, 
-		cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
+		cfg->msg_buffer_size, (size_t)cfg->outgoing_num_ports,
+		cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6,
 		cfg->do_tcp?cfg->outgoing_num_tcp:0, cfg->ip_dscp,
 		worker->daemon->env->infra_cache, worker->rndstate,
 		cfg->use_caps_bits_for_id, worker->ports, worker->numports,
@@ -2043,13 +2043,13 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker_delete(worker);
 		return 0;
 	}
-	worker->stat_timer = comm_timer_create(worker->base, 
+	worker->stat_timer = comm_timer_create(worker->base,
 		worker_stat_timer_cb, worker);
 	if(!worker->stat_timer) {
 		log_err("could not create statistics timer");
 	}
 
-	/* we use the msg_buffer_size as a good estimate for what the 
+	/* we use the msg_buffer_size as a good estimate for what the
 	 * user wants for memory usage sizes */
 	worker->scratchpad = regional_create_custom(cfg->msg_buffer_size);
 	if(!worker->scratchpad) {
@@ -2059,7 +2059,7 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	}
 
 	server_stats_init(&worker->stats, cfg);
-	alloc_init(&worker->alloc, &worker->daemon->superalloc, 
+	alloc_init(&worker->alloc, &worker->daemon->superalloc,
 		worker->thread_num);
 	alloc_set_id_cleanup(&worker->alloc, &worker_alloc_cleanup, worker);
 	worker->env = *worker->daemon->env;
@@ -2159,23 +2159,23 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	worker_mem_report(worker, NULL);
 	/* if statistics enabled start timer */
 	if(worker->env.cfg->stat_interval > 0) {
-		verbose(VERB_ALGO, "set statistics interval %d secs", 
+		verbose(VERB_ALGO, "set statistics interval %d secs",
 			worker->env.cfg->stat_interval);
 		worker_restart_timer(worker);
 	}
 	return 1;
 }
 
-void 
+void
 worker_work(struct worker* worker)
 {
 	comm_base_dispatch(worker->base);
 }
 
-void 
+void
 worker_delete(struct worker* worker)
 {
-	if(!worker) 
+	if(!worker)
 		return;
 	if(worker->env.mesh && verbosity >= VERB_OPS) {
 		server_stats_log(&worker->stats, worker, worker->thread_num);
@@ -2227,7 +2227,7 @@ worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec,
 	struct worker* worker = q->env->worker;
 	struct outbound_entry* e = (struct outbound_entry*)regional_alloc(
 		q->region, sizeof(*e));
-	if(!e) 
+	if(!e)
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qinfo, flags, dnssec,
@@ -2241,7 +2241,7 @@ worker_send_query(struct query_info* qinfo, uint16_t flags, int dnssec,
 	return e;
 }
 
-void 
+void
 worker_alloc_cleanup(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
@@ -2289,7 +2289,7 @@ struct outbound_entry* libworker_send_query(
 	return 0;
 }
 
-int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
 {
diff --git a/usr.sbin/unbound/daemon/worker.h b/usr.sbin/unbound/daemon/worker.h
index 3fb52abd9..d4d337a7a 100644
--- a/usr.sbin/unbound/daemon/worker.h
+++ b/usr.sbin/unbound/daemon/worker.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * This file describes the worker structure that holds a list of 
+ * This file describes the worker structure that holds a list of
  * pending requests and handles them.
  */
 
@@ -153,7 +153,7 @@ struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);
  * @param do_sigs: if true, worker installs signal handlers.
  * @return: false on error.
  */
-int worker_init(struct worker* worker, struct config_file *cfg, 
+int worker_init(struct worker* worker, struct config_file *cfg,
 	struct listen_port* ports, int do_sigs);
 
 /**
diff --git a/usr.sbin/unbound/dns64/dns64.c b/usr.sbin/unbound/dns64/dns64.c
index 4b98b609e..7010662a4 100644
--- a/usr.sbin/unbound/dns64/dns64.c
+++ b/usr.sbin/unbound/dns64/dns64.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2009, Viagénie. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of Viagénie nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
@@ -714,10 +714,10 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 }
 
 static void
-dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk, 
-		      const struct packed_rrset_data* fd, 
-		      struct ub_packed_rrset_key *dk, 
-		      struct packed_rrset_data **dd_out, struct regional *region, 
+dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
+		      const struct packed_rrset_data* fd,
+		      struct ub_packed_rrset_key *dk,
+		      struct packed_rrset_data **dd_out, struct regional *region,
 		      struct dns64_env* dns64_env )
 {
 	struct packed_rrset_data *dd;
@@ -865,8 +865,8 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate
 				return;
 			/* Delete negative AAAA record from cache stored by
 			 * the iterator module */
-			rrset_cache_remove(super->env->rrset_cache, dk->rk.dname, 
-					   dk->rk.dname_len, LDNS_RR_TYPE_AAAA, 
+			rrset_cache_remove(super->env->rrset_cache, dk->rk.dname,
+					   dk->rk.dname_len, LDNS_RR_TYPE_AAAA,
 					   LDNS_RR_CLASS_IN, 0);
 			/* Delete negative AAAA in msg cache for CNAMEs,
 			 * stored by the iterator module */
diff --git a/usr.sbin/unbound/dns64/dns64.h b/usr.sbin/unbound/dns64/dns64.h
index 2f0c01a22..fcfc27b4b 100644
--- a/usr.sbin/unbound/dns64/dns64.h
+++ b/usr.sbin/unbound/dns64/dns64.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2009, Viagénie. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
diff --git a/usr.sbin/unbound/dnstap/dnstap_fstrm.c b/usr.sbin/unbound/dnstap/dnstap_fstrm.c
index 289e78bdf..4ed0736b9 100644
--- a/usr.sbin/unbound/dnstap/dnstap_fstrm.c
+++ b/usr.sbin/unbound/dnstap/dnstap_fstrm.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2020, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/dnstap/dnstap_fstrm.h b/usr.sbin/unbound/dnstap/dnstap_fstrm.h
index 8b37d5f9e..e8b7bc789 100644
--- a/usr.sbin/unbound/dnstap/dnstap_fstrm.h
+++ b/usr.sbin/unbound/dnstap/dnstap_fstrm.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2020, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/dnstap/dtstream.c b/usr.sbin/unbound/dnstap/dtstream.c
index 9153f0404..907c871c9 100644
--- a/usr.sbin/unbound/dnstap/dtstream.c
+++ b/usr.sbin/unbound/dnstap/dtstream.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2020, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/dnstap/dtstream.h b/usr.sbin/unbound/dnstap/dtstream.h
index f87d6dc8d..2b01c35cc 100644
--- a/usr.sbin/unbound/dnstap/dtstream.h
+++ b/usr.sbin/unbound/dnstap/dtstream.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2020, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -324,7 +324,7 @@ void dt_io_thread_unregister_queue(struct dt_io_thread* dtio,
 int dt_io_thread_start(struct dt_io_thread* dtio, void* event_base_nothr,
 	int numworkers);
 
-/** 
+/**
  * Stop the io thread
  * @param dtio: the io thread.
  */
diff --git a/usr.sbin/unbound/dnstap/unbound-dnstap-socket.c b/usr.sbin/unbound/dnstap/unbound-dnstap-socket.c
index 3bf889463..2a995bc13 100644
--- a/usr.sbin/unbound/dnstap/unbound-dnstap-socket.c
+++ b/usr.sbin/unbound/dnstap/unbound-dnstap-socket.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2020, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -546,7 +546,7 @@ static void log_data_frame(uint8_t* pkt, size_t len)
 	} else {
 		mtype = "nomessage";
 	}
-	
+
 	printf("%s%s%s%s%s\n", mtype, (maddr?" ":""), (maddr?maddr:""),
 		(qinf?" ":""), (qinf?qinf:""));
 	free(maddr);
@@ -1099,7 +1099,7 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 			log_info("accepted new dnstap client");
 		}
 	}
-	
+
 	data = calloc(1, sizeof(*data));
 	if(!data) fatal_exit("out of memory");
 	data->fd = s;
@@ -1232,7 +1232,7 @@ extern int optind;
 extern char* optarg;
 
 /** main program for streamtcp */
-int main(int argc, char** argv) 
+int main(int argc, char** argv)
 {
 	int c;
 	int usessl = 0;
@@ -1373,7 +1373,7 @@ void worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 	log_assert(0);
 }
 
-int worker_handle_request(struct comm_point* ATTR_UNUSED(c), 
+int worker_handle_request(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -1381,7 +1381,7 @@ int worker_handle_request(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
 {
@@ -1389,7 +1389,7 @@ int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int remote_accept_callback(struct comm_point* ATTR_UNUSED(c), 
+int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -1397,7 +1397,7 @@ int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int remote_control_callback(struct comm_point* ATTR_UNUSED(c), 
+int remote_control_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -1426,7 +1426,7 @@ struct outbound_entry* worker_send_query(
 
 #ifdef UB_ON_WINDOWS
 void
-worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void* 
+worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void*
 	ATTR_UNUSED(arg)) {
 	log_assert(0);
 }
@@ -1438,7 +1438,7 @@ wsvc_cron_cb(void* ATTR_UNUSED(arg))
 }
 #endif /* UB_ON_WINDOWS */
 
-void 
+void
 worker_alloc_cleanup(void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
@@ -1458,7 +1458,7 @@ struct outbound_entry* libworker_send_query(
 	return 0;
 }
 
-int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
 {
@@ -1473,21 +1473,21 @@ void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
         log_assert(0);
 }
 
-void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
+void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	struct sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
 	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
 {
 	log_assert(0);
 }
 
-void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
+void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	struct sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
 	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
 {
 	log_assert(0);
 }
 
-void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
+void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	struct sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
 	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
 {
diff --git a/usr.sbin/unbound/doc/CREDITS b/usr.sbin/unbound/doc/CREDITS
index 805327ad6..9489a5b50 100644
--- a/usr.sbin/unbound/doc/CREDITS
+++ b/usr.sbin/unbound/doc/CREDITS
@@ -1,13 +1,13 @@
 Unbound was developed at NLnet Labs by Wouter Wijngaards.
 
-Unbound was architected in January of 2004 by Jakob Schlyter of Kirei 
-and Roy Arends of Nominet. VeriSign and EP.Net funded development of 
-the prototype, which was built by David Blacka and Matt Larson of VeriSign. 
-Late in 2006, NLnet Labs joined the effort, writing an implementation in C 
+Unbound was architected in January of 2004 by Jakob Schlyter of Kirei
+and Roy Arends of Nominet. VeriSign and EP.Net funded development of
+the prototype, which was built by David Blacka and Matt Larson of VeriSign.
+Late in 2006, NLnet Labs joined the effort, writing an implementation in C
 based on the existing prototype and using experience NLnet Labs gained
 during the development of NSD, an authoritative DNS server.
 
-At NLnet Labs, Jelte Jansen, Mark Santcroos and Matthijs Mekking 
+At NLnet Labs, Jelte Jansen, Mark Santcroos and Matthijs Mekking
 reviewed the unbound C sources.
 
 Jakob Schlyter - for advice on secure settings, random numbers and blacklists.
diff --git a/usr.sbin/unbound/doc/FEATURES b/usr.sbin/unbound/doc/FEATURES
index 8d69aba9b..47b99c22c 100644
--- a/usr.sbin/unbound/doc/FEATURES
+++ b/usr.sbin/unbound/doc/FEATURES
@@ -3,7 +3,7 @@ Unbound Features
 (C) Copyright 2008, Wouter Wijngaards, NLnet Labs.
 
 
-This document describes the features and RFCs that unbound 
+This document describes the features and RFCs that unbound
 adheres to, and which ones are decided to be out of scope.
 
 
@@ -25,14 +25,14 @@ RFC 1034-1035: as a recursive, caching server. Not authoritative.
   AAAA type, and IP6 dual stack support.
   type ANY queries are supported, class ANY queries are supported.
 RFC 1123, 6.1 Requirements for DNS of internet hosts.
-RFC 4033-4035: as a validating caching server (unbound daemon). 
+RFC 4033-4035: as a validating caching server (unbound daemon).
   as a validating stub (libunbound).
 RFC 1918.
 RFC 1995, 1996, 2136: not authoritative, so no AXFR, IXFR, NOTIFY or
   dynamic update services are appropriate.
 RFC 2181: completely, including the trust model, keeping rrsets together.
 RFC 2308: TTL directive, and the rest of the RFC too.
-RFC 2671: EDNS0 support, default advertisement 4Kb size. 
+RFC 2671: EDNS0 support, default advertisement 4Kb size.
 RFC 2672: DNAME support.
 RFC 3597: Unknown RR type support.
 RFC 4343: case insensitive handling of domain names.
@@ -45,7 +45,7 @@ RFC 5155: NSEC3, NSEC3PARAM types
 RFC 5358: reflectors-are-evil: access control list for recursive
   service. In fact for all DNS service so cache snooping is halted.
 RFC 5452: forgery resilience. all recommendations followed.
-RFC 5702: RSASHA256 signature algorithm. 
+RFC 5702: RSASHA256 signature algorithm.
 RFC 5933: GOST signature algorithm.
 RFC 6303: default local zones.
   It is possible to block zones or return an address for localhost.
@@ -71,9 +71,9 @@ TXT RRs from the Chaos class (id.server, hostname.bind, ...) are supported.
 
 draft-0x20: implemented, use caps-for-id option to enable use.
   Also implements bitwise echo of the query to support downstream 0x20.
-draft-ietf-dnsop-resolver-priming(-00): can prime and can fallback to 
+draft-ietf-dnsop-resolver-priming(-00): can prime and can fallback to
   a safety belt list.
-draft-ietf-dnsop-dnssec-trust-anchor(-01): DS records can be configured 
+draft-ietf-dnsop-dnssec-trust-anchor(-01): DS records can be configured
   as trust anchors. Also DNSKEYs are allowed, by the way.
 draft-ietf-dnsext-dnssec-bis-updates: supported.
 
diff --git a/usr.sbin/unbound/doc/README b/usr.sbin/unbound/doc/README
index 88444a5e3..7b49c206c 100644
--- a/usr.sbin/unbound/doc/README
+++ b/usr.sbin/unbound/doc/README
@@ -6,12 +6,12 @@ This software is under BSD license, see LICENSE for details.
 The DNS64 module has BSD license in dns64/dns64.c.
 The DNSTAP code has BSD license in dnstap/dnstap.c.
 
-* Download the latest release version of this software from 
-  	http://unbound.net 
-  or get a beta version from the svn repository at 
+* Download the latest release version of this software from
+  	http://unbound.net
+  or get a beta version from the svn repository at
   	http://unbound.net/svn/
 
-* Uses the following libraries; 
+* Uses the following libraries;
   * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
     (optional) can use builtin alternative instead.
   * libexpat	(for the unbound-anchor helper program)		(MIT license)
@@ -19,15 +19,15 @@ The DNSTAP code has BSD license in dnstap/dnstap.c.
 * Make and install: ./configure; make; make install
   * --with-libevent=/path/to/libevent
   	Can be set to either the system install or the build directory.
-	--with-libevent=no (default) gives a builtin alternative 
-	implementation. libevent is useful when having many (thousands) 
-	of outgoing ports. This improves randomization and spoof 
-	resistance. For the default of 16 ports the builtin alternative 
+	--with-libevent=no (default) gives a builtin alternative
+	implementation. libevent is useful when having many (thousands)
+	of outgoing ports. This improves randomization and spoof
+	resistance. For the default of 16 ports the builtin alternative
 	works well and is a little faster.
   * --with-libexpat=/path/to/libexpat
   	Can be set to the install directory of libexpat.
-  * --without-pthreads 
-	This disables pthreads. Without this option the pthreads library 
+  * --without-pthreads
+	This disables pthreads. Without this option the pthreads library
 	is detected automatically. Use this option to disable threading
 	altogether, or, on Solaris, also use --with(out)-solaris-threads.
   * --enable-checking
@@ -43,10 +43,10 @@ The DNSTAP code has BSD license in dnstap/dnstap.c.
   * --enable-alloc-checks
 	This enables a debug option to check malloc (calloc, realloc, free).
 	The server periodically checks if the amount of memory used fits with
-	the amount of memory it thinks it should be using, and reports 
+	the amount of memory it thinks it should be using, and reports
 	memory usage in detail.
   * --with-conf-file=filename
-  	Set default location of config file, 
+  	Set default location of config file,
 	the default is /usr/local/etc/unbound/unbound.conf.
   * --with-pidfile=filename
   	Set default location of pidfile,
@@ -88,8 +88,8 @@ o If there are no replies for a forward or stub zone, for a reverse zone,
   server: section of the config file to unblock the reverse zone.
   Only happens for (sub)zones that are blocked by default; e.g. 10.in-addr.arpa
 o If libevent is older (before 1.3c), unbound will exit instead of reload
-  on sighup. On a restart 'did not exit gracefully last time' warning is 
-  printed. Perform ./configure --with-libevent=no or update libevent, rerun 
+  on sighup. On a restart 'did not exit gracefully last time' warning is
+  printed. Perform ./configure --with-libevent=no or update libevent, rerun
   configure and recompile unbound to make sighup work correctly.
   It is strongly suggested to use a recent version of libevent.
 o If you are not receiving the correct source IP address on replies (e.g.
@@ -98,14 +98,14 @@ o If you are not receiving the correct source IP address on replies (e.g.
   source IP address on UDP replies. Listing all IP addresses explicitly in
   the config file is an alternative. The interface-automatic option uses
   non portable socket options, Linux and FreeBSD should work fine.
-o The warning 'openssl has no entropy, seeding with time', with chroot 
+o The warning 'openssl has no entropy, seeding with time', with chroot
   enabled, may be solved with a symbolic link to /dev/urandom from <chrootdir>.
 o On Solaris 5.10 some libtool packages from repositories do not work with
   gcc, showing errors gcc: unrecognized option `-KPIC'
   To solve this do ./configure libtool=./libtool [your options...].
   On Solaris you may pass CFLAGS="-xO4 -xtarget=generic" if you use sun-cc.
 o If unbound-control (or munin graphs) do not work, this can often be because
-  the unbound-control-setup script creates the keys with restricted 
+  the unbound-control-setup script creates the keys with restricted
   permissions, and the files need to be made readable or ownered by both the
   unbound daemon and unbound-control.
 o Crosscompile seems to hang.  You tried to install unbound under wine.
diff --git a/usr.sbin/unbound/doc/README.tests b/usr.sbin/unbound/doc/README.tests
index 376f01717..311f2924b 100644
--- a/usr.sbin/unbound/doc/README.tests
+++ b/usr.sbin/unbound/doc/README.tests
@@ -23,7 +23,7 @@ You can also use prepared Dockerfile to run tests inside docker based on latest
 * run long tests: make longtest
 It is worth to mention that you need to enable [ipv6 in your docker daemon configuration](https://docs.docker.com/config/daemon/ipv6/) because some tests need ipv6 network stack.
 
-testdata/ contains the data for tests. 
+testdata/ contains the data for tests.
 testcode/ contains scripts and c code for the tests.
 
 do-tests.sh : runs all the tests in the testdata directory.
diff --git a/usr.sbin/unbound/doc/TODO b/usr.sbin/unbound/doc/TODO
index 839656154..85cc6d688 100644
--- a/usr.sbin/unbound/doc/TODO
+++ b/usr.sbin/unbound/doc/TODO
@@ -1,6 +1,6 @@
 TODO items. These are interesting todo items.
 o understand synthesized DNAMEs, so those TTL=0 packets are cached properly.
-o NSEC/NSEC3 aggressive negative caching, so that updates to NSEC/NSEC3 
+o NSEC/NSEC3 aggressive negative caching, so that updates to NSEC/NSEC3
   will result in proper negative responses.
 o (option) where port 53 is used for send and receive, no other ports are used.
 o (option) to not send replies to clients after a timeout of (say 5 secs) has
@@ -12,7 +12,7 @@ o (option) reprime and refresh oft used data before timeout.
 o (option) retain prime results in a overlaid roothints file.
 o (option) store primed key data in a overlaid keyhints file (sort of like drafttimers).
 o windows version, auto update feature, a query to check for the version.
-o command the server with TSIG inband. get-config, clearcache, 
+o command the server with TSIG inband. get-config, clearcache,
 	get stats, get memstats, get ..., reload, clear one zone from cache
 o timers rfc 5011 support.
 o Treat YXDOMAIN from a DNAME properly, in iterator (not throwaway), validator.
@@ -24,7 +24,7 @@ o library add convenience functions for A, AAAA, PTR, getaddrinfo, libresolve.
 o library add function to validate input from app that is signed.
 o add dynamic-update requests (making a dynupd request) to libunbound api.
 o SIG(0) and TSIG.
-o support OPT record placement on recv anywhere in the additional section. 
+o support OPT record placement on recv anywhere in the additional section.
 o add local-file: config with authority features.
 o (option) to make local-data answers be secure for libunbound (default=no)
 o (option) to make chroot: copy all needed files into jail (or make jail)
@@ -55,7 +55,7 @@ o winevent - do not go more than 64 fds (by polling with select one by
   not create packet storms with operator errors.
 o on windows version, implement that OS ancillary data capabilities for
   interface-automatic. IPPKTINFO, IP6PKTINFO for WSARecvMsg, WSASendMsg.
-o local-zone directive with authority service, full authority server 
+o local-zone directive with authority service, full authority server
   is a non-goal.
 o infra and lame cache: easier size config (in Mb), show usage in graphs.
 - store time of dump in cachedumps, so that on a load the ttls can be
diff --git a/usr.sbin/unbound/doc/control_proto_spec.txt b/usr.sbin/unbound/doc/control_proto_spec.txt
index d26258f1e..901625f27 100644
--- a/usr.sbin/unbound/doc/control_proto_spec.txt
+++ b/usr.sbin/unbound/doc/control_proto_spec.txt
@@ -2,7 +2,7 @@
 Specification for the unbound-control protocol.
 
 Server listens on 8953 TCP (localhost by default). Client connects,
-SSLv3 or TLSv1 connection setup (server selfsigned certificate, 
+SSLv3 or TLSv1 connection setup (server selfsigned certificate,
 client has cert signed by server certificate).
 
 Port 8953 is registered with IANA as:
@@ -12,16 +12,16 @@ On may 11 2011, ticket [IANA #442315].
 
 Query and Response
 ------------------
-Client sends 
+Client sends
 	UBCT[version] [commandline] \n
 	fixed string UBCT1 (for version 1), then an ascii text line,
 	with a command, some whitespace allowed. Line ends with '\n'.
 
-Server executes command. And sends reply in ascii text over channel, 
+Server executes command. And sends reply in ascii text over channel,
 closes the channel when done.
 	in case of error the first line of the response is:
 		error <descriptive text possible> \n
-	or the remainder is data of the response, for many commands the 
+	or the remainder is data of the response, for many commands the
 	response is 'ok\n'.
 
 Queries and responses
@@ -39,7 +39,7 @@ dump_cache
 	output is a text representation of the cache contents.
 	data ends with a line 'EOF' before connection close.
 load_cache
-	client sends cache contents (like from dump_cache), which is stored 
+	client sends cache contents (like from dump_cache), which is stored
 	in the cache. end of data indicated with a line with 'EOF' on it.
 	The data is sent after the query line.
 flush <name>
diff --git a/usr.sbin/unbound/doc/libunbound.3.in b/usr.sbin/unbound/doc/libunbound.3.in
index b87289e0d..0a673baa8 100644
--- a/usr.sbin/unbound/doc/libunbound.3.in
+++ b/usr.sbin/unbound/doc/libunbound.3.in
@@ -115,14 +115,14 @@
 \fBub_process\fR(\fIstruct ub_ctx*\fR ctx);
 .LP
 \fIint\fR
-\fBub_resolve\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
+\fBub_resolve\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name,
 .br
            \fIint\fR rrtype, \fIint\fR rrclass, \fIstruct ub_result**\fR result);
 .LP
 \fIint\fR
-\fBub_resolve_async\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
+\fBub_resolve_async\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name,
 .br
-                 \fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata, 
+                 \fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata,
 .br
                  \fIub_callback_type\fR callback, \fIint*\fR async_id);
 .LP
@@ -150,8 +150,8 @@
 \fIint\fR
 \fBub_ctx_data_remove\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR data);
 .SH "DESCRIPTION"
-.B Unbound 
-is an implementation of a DNS resolver, that does caching and 
+.B Unbound
+is an implementation of a DNS resolver, that does caching and
 DNSSEC validation. This is the library API, for using the \-lunbound library.
 The server daemon is described in \fIunbound\fR(8).
 The library works independent from a running unbound server, and
@@ -164,22 +164,22 @@ between calls. The user must maintain it, creating it with
 .B ub_ctx_create
 and deleting it with
 .B ub_ctx_delete\fR.
-It can be created and deleted at any time. Creating it anew removes any 
+It can be created and deleted at any time. Creating it anew removes any
 previous configuration (such as trusted keys) and clears any cached results.
 .P
-The functions are thread\-safe, and a context can be used in a threaded (as 
-well as in a non\-threaded) environment. Also resolution (and validation) 
-can be performed blocking and non\-blocking (also called asynchronous). 
-The async method returns from the call immediately, so that processing 
-can go on, while the results become available later. 
+The functions are thread\-safe, and a context can be used in a threaded (as
+well as in a non\-threaded) environment. Also resolution (and validation)
+can be performed blocking and non\-blocking (also called asynchronous).
+The async method returns from the call immediately, so that processing
+can go on, while the results become available later.
 .P
 The functions are discussed in turn below.
 .SH "FUNCTIONS"
-.TP 
+.TP
 .B ub_ctx_create
 Create a new context, initialised with defaults.
-The information from /etc/resolv.conf and /etc/hosts is not utilised 
-by default. Use 
+The information from /etc/resolv.conf and /etc/hosts is not utilised
+by default. Use
 .B ub_ctx_resolvconf
 and
 .B ub_ctx_hosts
@@ -214,10 +214,10 @@ application has to ensure that ub_ctx_config is not called in parallel by
 the different instances.
 .TP
 .B ub_ctx_set_fwd
-Set machine to forward DNS queries to, the caching resolver to use. 
-IP4 or IP6 address. Forwards all DNS requests to that machine, which 
-is expected to run a recursive resolver. If the proxy is not 
-DNSSEC capable, validation may fail. Can be called several times, in 
+Set machine to forward DNS queries to, the caching resolver to use.
+IP4 or IP6 address. Forwards all DNS requests to that machine, which
+is expected to run a recursive resolver. If the proxy is not
+DNSSEC capable, validation may fail. Can be called several times, in
 that case the addresses are used as backup servers.
 At this time it is only possible to set configuration before the
 first resolve is done.
@@ -232,7 +232,7 @@ At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
 .B ub_ctx_set_tls
-Enable DNS over TLS (DoT) for machines set with 
+Enable DNS over TLS (DoT) for machines set with
 .B ub_ctx_set_fwd.
 At this time it is only possible to set configuration before the
 first resolve is done.
@@ -245,15 +245,15 @@ Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
 If they do not support DNSSEC, validation may fail.
 Only nameservers are picked up, the searchdomain, ndots and other
 settings from \fIresolv.conf\fR(5) are ignored.
-If fname NULL is passed, "/etc/resolv.conf" is used (if on Windows, 
+If fname NULL is passed, "/etc/resolv.conf" is used (if on Windows,
 the system\-wide configured nameserver is picked instead).
 At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
 .B ub_ctx_hosts
 Read list of hosts from the filename given.
-Usually "/etc/hosts". When queried for, these addresses are not marked 
-DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used 
+Usually "/etc/hosts". When queried for, these addresses are not marked
+DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used
 (if on Windows, etc/hosts from WINDIR is picked instead).
 At this time it is only possible to set configuration before the
 first resolve is done.
@@ -298,13 +298,13 @@ Higher debug level gives more output.
 .TP
 .B ub_ctx_async
 Set a context behaviour for asynchronous action.
-if set to true, enables threading and a call to 
-.B ub_resolve_async 
+if set to true, enables threading and a call to
+.B ub_resolve_async
 creates a thread to handle work in the background.
 If false, a process is forked to handle work in the background.
-Changes to this setting after 
-.B ub_resolve_async 
-calls have been made have no effect (delete and re\-create the context 
+Changes to this setting after
+.B ub_resolve_async
+calls have been made have no effect (delete and re\-create the context
 to change).
 .TP
 .B ub_poll
@@ -312,14 +312,14 @@ Poll a context to see if it has any new results.
 Do not poll in a loop, instead extract the fd below to poll for readiness,
 and then check, or wait using the wait routine.
 Returns 0 if nothing to read, or nonzero if a result is available.
-If nonzero, call 
-.B ub_process 
+If nonzero, call
+.B ub_process
 to do callbacks.
 .TP
 .B ub_wait
-Wait for a context to finish with results. Calls 
-.B ub_process 
-after the wait for you. After the wait, there are no more outstanding 
+Wait for a context to finish with results. Calls
+.B ub_process
+after the wait for you. After the wait, there are no more outstanding
 asynchronous queries.
 .TP
 .B ub_fd
@@ -346,31 +346,31 @@ The callback receives a copy of the mydata pointer, that you can use to pass
 information to the callback. The callback type is a function pointer to
 a function declared as
 .IP
-void my_callback_function(void* my_arg, int err, 
+void my_callback_function(void* my_arg, int err,
 .br
                   struct ub_result* result);
 .IP
 The async_id is returned so you can (at your option) decide to track it
 and cancel the request if needed.  If you pass a NULL pointer the async_id
-is not returned. 
+is not returned.
 .TP
 .B ub_cancel
 Cancel an async query in progress.  This may return an error if the query
-does not exist, or the query is already being delivered, in that case you 
+does not exist, or the query is already being delivered, in that case you
 may still get a callback for the query.
 .TP
 .B ub_resolve_free
 Free struct ub_result contents after use.
 .TP
 .B ub_strerror
-Convert error value from one of the unbound library functions 
+Convert error value from one of the unbound library functions
 to a human readable string.
 .TP
 .B ub_ctx_print_local_zones
 Debug printout the local authority information to debug output.
 .TP
 .B ub_ctx_zone_add
-Add new zone to local authority info, like local\-zone \fIunbound.conf\fR(5) 
+Add new zone to local authority info, like local\-zone \fIunbound.conf\fR(5)
 statement.
 .TP
 .B ub_ctx_zone_remove
@@ -383,7 +383,7 @@ Add resource record data to local authority info, like local\-data
 .B ub_ctx_data_remove
 Delete local authority data from the name given.
 .SH "RESULT DATA STRUCTURE"
-The result of the DNS resolution and validation is returned as 
+The result of the DNS resolution and validation is returned as
 \fIstruct ub_result\fR. The result structure contains the following entries.
 .P
 .nf
@@ -407,7 +407,7 @@ The result of the DNS resolution and validation is returned as
 	};
 .fi
 .P
-If both secure and bogus are false, security was not enabled for the 
+If both secure and bogus are false, security was not enabled for the
 domain of the query.  Else, they are not both true, one of them is true.
 .SH "RETURN VALUES"
 Many routines return an error code. The value 0 (zero) denotes no error
@@ -427,7 +427,7 @@ and
 .B ub_ctx_resolvconf
 attempt to leave errno informative on a function return with file read failure.
 .SH "SEE ALSO"
-\fIunbound.conf\fR(5), 
+\fIunbound.conf\fR(5),
 \fIunbound\fR(8).
 .SH "AUTHORS"
 .B Unbound
diff --git a/usr.sbin/unbound/doc/requirements.txt b/usr.sbin/unbound/doc/requirements.txt
index b643cec17..e1c6dbd81 100644
--- a/usr.sbin/unbound/doc/requirements.txt
+++ b/usr.sbin/unbound/doc/requirements.txt
@@ -1,4 +1,4 @@
-Requirements for Recursive Caching Resolver 
+Requirements for Recursive Caching Resolver
 	(a.k.a. Treeshrew, Unbound-C)
 By W.C.A. Wijngaards, NLnet Labs, October 2006.
 
@@ -20,7 +20,7 @@ Data in the DNS is stored in Resource Record sets (RR sets), and has a
 time to live (TTL).  During this time the data can be cached.  It is
 thus useful to cache data to speed up future lookups.  A server that
 looks up data in the DNS for clients and caches previous answers to
-speed up processing is called a caching, recursive nameserver.  
+speed up processing is called a caching, recursive nameserver.
 
 This project aims to develop such a nameserver in modular components, so
 that also DNSSEC (secure DNS) validation and stub-resolvers (that do not
@@ -66,7 +66,7 @@ o Used as
 o Elegant design of validator, resolver, cache modules.
 	* provide the ability to pick and choose modules.
 o Robust.
-o In C, open source: The BSD license. 
+o In C, open source: The BSD license.
 o Highly portable, targets include modern Unix systems, such as *BSD,
 solaris, linux, and maybe also the windows platform.
 o Smallest as possible component that does the job.
@@ -87,13 +87,13 @@ o rfc2181 discourages duplicates RRs in RRsets. unbound does not create
   It does do some rrsig duplicate removal, in the msgparser, for dnssec qtype
   rrsig and any, because of special rrsig processing in the msgparser.
 o The harden-glue feature, when yes all out of zone glue is deleted, when
-  no out of zone glue is used for further resolving, is more complicated 
+  no out of zone glue is used for further resolving, is more complicated
   than that, see below.
   Main points:
-  	* rfc2182 trust handling is used. 
+  	* rfc2182 trust handling is used.
 	* data is let through only in very specific cases
 	* spoofability remains possible.
-  Not all glue is let through (despite the name of the option). Only glue 
+  Not all glue is let through (despite the name of the option). Only glue
   which is present in a delegation, of type A and AAAA, where the name is
   present in the NS record in the authority section is let through.
   The glue that is let through is stored in the cache (marked as 'from the
@@ -103,15 +103,15 @@ o The harden-glue feature, when yes all out of zone glue is deleted, when
   cache. Since A and AAAA queries are not synthesized by the unbound cache,
   this query will be (eventually) sent to the authoritative server and its
   answer will be put in the cache, marked as 'from the answer section' and
-  thus remove the 'from the additional section' data, and this record is 
+  thus remove the 'from the additional section' data, and this record is
   returned to the client.
   The message has a TTL smaller or equal to the TTL of the answer RR.
   If the cache memory is low; the answer RR may be dropped, and a glue
   RR may be inserted, within the message TTL time, and thus return the
   spoofed glue to a client. When the message expires, it is refetched and
   the cached RR is updated with the correct content.
-  The server can be spoofed by getting it to visit a especially prepared 
-  domain. This domain then inserts an address for another authoritative 
+  The server can be spoofed by getting it to visit a especially prepared
+  domain. This domain then inserts an address for another authoritative
   server into the cache, when visiting that other domain, this address may
   then be used to send queries to. And fake answers may be returned.
   If the other domain is signed by DNSSEC, the fakes will be detected.
@@ -119,34 +119,34 @@ o The harden-glue feature, when yes all out of zone glue is deleted, when
   In summary, the harden glue feature presents a security risk if
   disabled. Disabling the feature leads to possible better performance
   as more glue is present for the recursive service to use. The feature
-  is implemented so as to minimise the security risk, while trying to 
+  is implemented so as to minimise the security risk, while trying to
   keep this performance gain.
 o The method by which dnssec-lameness is detected is not secure. DNSSEC lame
   is when a server has the zone in question, but lacks dnssec data, such as
-  signatures. The method to detect dnssec lameness looks at nonvalidated 
+  signatures. The method to detect dnssec lameness looks at nonvalidated
   data from the parent of a zone. This can be used, by spoofing the parent,
   to create a false sense of dnssec-lameness in the child, or a false sense
   or dnssec-non-lameness in the child. The first results in the server marked
-  lame, and not used for 900 seconds, and the second will result in a 
+  lame, and not used for 900 seconds, and the second will result in a
   validator failure (SERVFAIL again), when the query is validated later on.
 
   Concluding, a spoof of the parent delegation can be used for many cases
   of denial of service. I.e. a completely different NS set could be returned,
   or the information withheld. All of these alterations can be caught by
-  the validator if the parent is signed, and result in 900 seconds bogus. 
-  The dnssec-lameness detection is used to detect operator failures, 
+  the validator if the parent is signed, and result in 900 seconds bogus.
+  The dnssec-lameness detection is used to detect operator failures,
   before the validator will properly verify the messages.
 
   Also for zones for which no chain of trust exists, but a DS is given by the
-  parent, dnssec-lameness detection enables. This delivers dnssec to our 
+  parent, dnssec-lameness detection enables. This delivers dnssec to our
   clients when possible (for client validators).
 
   The following issue needs to be resolved:
 	a server that serves both a parent and child zone, where
-	parent is signed, but child is not. The server must not be marked 
-	lame for the parent zone, because the child answer is not signed. 
-  Instead of a false positive, we want false negatives; failure to 
-  detect dnssec-lameness is less of a problem than marking honest 
+	parent is signed, but child is not. The server must not be marked
+	lame for the parent zone, because the child answer is not signed.
+  Instead of a false positive, we want false negatives; failure to
+  detect dnssec-lameness is less of a problem than marking honest
   servers lame. dnssec-lameness is a config error and deserves the trouble.
   So, only messages that identify the zone are used to mark the zone
   lame. The zone is identified by SOA or NS RRsets in the answer/auth.
@@ -155,8 +155,8 @@ o The method by which dnssec-lameness is detected is not secure. DNSSEC lame
   For referrals, delegations that add a single label can be checked to be
   from their zone, this covers most delegation-centric zones.
 
-  So possibly, for complicated setups, with multiple (parent-child) zones 
-  on a server, dnssec-lameness detection does not work - no dnssec-lameness 
+  So possibly, for complicated setups, with multiple (parent-child) zones
+  on a server, dnssec-lameness detection does not work - no dnssec-lameness
   is detected. Instead the zone that is dnssec-lame becomes bogus.
 
 o authority features.
@@ -172,8 +172,8 @@ o authority features.
   The limited support allows adding some static data (for localhost and so),
   and to respond with a fixed rcode (NXDOMAIN) for domains (such as AS112).
 
-  You can put authority data on a separate server, and set the server in 
-  unbound.conf as stub for those zones, this allows clients to access data 
+  You can put authority data on a separate server, and set the server in
+  unbound.conf as stub for those zones, this allows clients to access data
   from the server without making unbound authoritative for the zones.
 
 o the access control denies queries before any other processing.
@@ -181,10 +181,10 @@ o the access control denies queries before any other processing.
   And thus prevents cache-snooping (denied hosts cannot make non-recursive
   queries and get answers from the cache).
 
-o If a client makes a query without RD bit, in the case of a returned 
+o If a client makes a query without RD bit, in the case of a returned
   message from cache which is:
 	answer section: empty
-	auth section: NS record present, no SOA record, no DS record, 
+	auth section: NS record present, no SOA record, no DS record,
 		maybe NSEC or NSEC3 records present.
 	additional: A records or other relevant records.
   A SOA record would indicate that this was a NODATA answer.
@@ -194,19 +194,19 @@ o If a client makes a query without RD bit, in the case of a returned
   Then the receiver does not know whether this was a referral
   with attempt at no-DS proof) or a nodata answer with attempt
   at no-data proof. It could be determined by attempting to prove
-  either condition; and looking if only one is valid, but both 
+  either condition; and looking if only one is valid, but both
   proofs could be valid, or neither could be valid, which creates
   doubt. This case is validated by unbound as a 'referral' which
   ascertains that RRSIGs are OK (and not omitted), but does not
-  check NSEC/NSEC3. 
+  check NSEC/NSEC3.
 
 o Case preservation
-  Unbound preserves the casing received from authority servers as best 
+  Unbound preserves the casing received from authority servers as best
   as possible. It compresses without case, so case can get lost there.
   The casing from the query name is used in preference to the casing
-  of the authority server. This is the same as BIND. RFC4343 allows either 
+  of the authority server. This is the same as BIND. RFC4343 allows either
   behaviour.
- 
+
 o Denial of service protection
   If many queries are made, and they are made to names for which the
   authority servers do not respond, then the requestlist for unbound
@@ -230,10 +230,10 @@ o EDNS fallback. Is done according to the EDNS RFC (and update draft-00).
   if the server responds (quickly) without EDNS, this is cached for 15 min.
   This works very well when detecting an address that you use much - like
   a forwarder address - which is where the middleboxes need to be detected.
-  Otherwise, it results in a 5 second wait time before EDNS timeout is 
-  detected, which is slow but it works at least. 
+  Otherwise, it results in a 5 second wait time before EDNS timeout is
+  detected, which is slow but it works at least.
   It minimizes the chances of a dropped query making a (DNSSEC) EDNS server
-  falsely EDNS-nonsupporting, and thus DNSSEC-bogus, works well with 
+  falsely EDNS-nonsupporting, and thus DNSSEC-bogus, works well with
   middleboxes, and can detect the occasional authority that drops EDNS.
   For some boxes it is necessary to probe for every failing query, a
   reassurance that the DNS server does EDNS does not mean that path can
diff --git a/usr.sbin/unbound/dynlibmod/dynlibmod.h b/usr.sbin/unbound/dynlibmod/dynlibmod.h
index 321f4f693..f208301ac 100644
--- a/usr.sbin/unbound/dynlibmod/dynlibmod.h
+++ b/usr.sbin/unbound/dynlibmod/dynlibmod.h
@@ -1,21 +1,21 @@
 /*
  * dynlibmod.h: module header file
- * 
+ *
  * Copyright (c) 2019, Peter Munch-Ellingsen (peterme AT peterme.net)
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  *    * Redistributions of source code must retain the above copyright notice,
  *      this list of conditions and the following disclaimer.
- * 
+ *
  *    * Redistributions in binary form must reproduce the above copyright notice,
  *      this list of conditions and the following disclaimer in the documentation
  *      and/or other materials provided with the distribution.
- * 
+ *
  *    * Neither the name of the organization nor the names of its
  *      contributors may be used to endorse or promote products derived from this
  *      software without specific prior written permission.
diff --git a/usr.sbin/unbound/edns-subnet/addrtree.c b/usr.sbin/unbound/edns-subnet/addrtree.c
index ebe71b970..0228d43d0 100644
--- a/usr.sbin/unbound/edns-subnet/addrtree.c
+++ b/usr.sbin/unbound/edns-subnet/addrtree.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2013, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -32,7 +32,7 @@
  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-/** \file 
+/** \file
  * addrtree -- radix tree for edns subnet cache.
  */
 
@@ -42,7 +42,7 @@
 #include "util/module.h"
 #include "addrtree.h"
 
-/** 
+/**
  * Create a new edge
  * @param node: Child node this edge will connect to.
  * @param addr: full key to this edge.
@@ -51,8 +51,8 @@
  * @param parent_index: Index of child node at parent node
  * @return new addredge or NULL on failure
  */
-static struct addredge * 
-edge_create(struct addrnode *node, const addrkey_t *addr, 
+static struct addredge *
+edge_create(struct addrnode *node, const addrkey_t *addr,
 	addrlen_t addrlen, struct addrnode *parent_node, int parent_index)
 {
 	size_t n;
@@ -78,7 +78,7 @@ edge_create(struct addrnode *node, const addrkey_t *addr,
 	return edge;
 }
 
-/** 
+/**
  * Create a new node
  * @param tree: Tree the node lives in.
  * @param elem: Element to store at this node
@@ -86,8 +86,8 @@ edge_create(struct addrnode *node, const addrkey_t *addr,
  * @param ttl: Element is valid up to this time. Absolute, seconds
  * @return new addrnode or NULL on failure
  */
-static struct addrnode * 
-node_create(struct addrtree *tree, void *elem, addrlen_t scope, 
+static struct addrnode *
+node_create(struct addrtree *tree, void *elem, addrlen_t scope,
 	time_t ttl)
 {
 	struct addrnode* node = (struct addrnode *)malloc( sizeof (*node) );
@@ -108,18 +108,18 @@ node_create(struct addrtree *tree, void *elem, addrlen_t scope,
 
 /** Size in bytes of node and parent edge
  * @param tree: tree the node lives in
- * @param n: node which size must be calculated 
+ * @param n: node which size must be calculated
  * @return size in bytes.
  **/
-static inline size_t 
+static inline size_t
 node_size(const struct addrtree *tree, const struct addrnode *n)
 {
-	return sizeof *n + sizeof *n->parent_edge + n->parent_edge->len + 
+	return sizeof *n + sizeof *n->parent_edge + n->parent_edge->len +
 		(n->elem?tree->sizefunc(n->elem):0);
 }
 
-struct addrtree * 
-addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *), 
+struct addrtree *
+addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *),
 	size_t (*sizefunc)(void *), void *env, uint32_t max_node_count)
 {
 	struct addrtree *tree;
@@ -145,7 +145,7 @@ addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *),
 	return tree;
 }
 
-/** 
+/**
  * Scrub a node clean of elem
  * @param tree: tree the node lives in.
  * @param node: node to be cleaned.
@@ -205,8 +205,8 @@ lru_update(struct addrtree *tree, struct addrnode *node)
 	lru_push(tree, node);
 }
 
-/** 
- * Purge a node from the tree. Node and parentedge are cleaned and 
+/**
+ * Purge a node from the tree. Node and parentedge are cleaned and
  * free'd.
  * @param tree: Tree the node lives in.
  * @param node: Node to be freed
@@ -217,7 +217,7 @@ purge_node(struct addrtree *tree, struct addrnode *node)
 	struct addredge *parent_edge, *child_edge = NULL;
 	int index;
 	int keep = node->edge[0] && node->edge[1];
-	
+
 	clean_node(tree, node);
 	parent_edge = node->parent_edge;
 	if (keep || !parent_edge) return;
@@ -294,13 +294,13 @@ void addrtree_delete(struct addrtree *tree)
 }
 
 /**
- * Get N'th bit from address 
+ * Get N'th bit from address
  * @param addr: address to inspect
  * @param addrlen: length of addr in bits
  * @param n: index of bit to test. Must be in range [0, addrlen)
  * @return 0 or 1
  */
-static int 
+static int
 getbit(const addrkey_t *addr, addrlen_t addrlen, addrlen_t n)
 {
 	log_assert(addrlen > n);
@@ -310,9 +310,9 @@ getbit(const addrkey_t *addr, addrlen_t addrlen, addrlen_t n)
 
 /**
  * Test for equality on N'th bit.
- * @return 0 for equal, 1 otherwise 
+ * @return 0 for equal, 1 otherwise
  */
-static inline int 
+static inline int
 cmpbit(const addrkey_t *key1, const addrkey_t *key2, addrlen_t n)
 {
 	addrkey_t c = key1[n/KEYWIDTH] ^ key2[n/KEYWIDTH];
@@ -328,8 +328,8 @@ cmpbit(const addrkey_t *key1, const addrkey_t *key2, addrlen_t n)
  * @param skip: nr of bits already checked.
  * @return common number of bits.
  */
-static addrlen_t 
-bits_common(const addrkey_t *s1, addrlen_t l1, 
+static addrlen_t
+bits_common(const addrkey_t *s1, addrlen_t l1,
 	const addrkey_t *s2, addrlen_t l2, addrlen_t skip)
 {
 	addrlen_t len, i;
@@ -339,7 +339,7 @@ bits_common(const addrkey_t *s1, addrlen_t l1,
 		if (cmpbit(s1, s2, i)) return i;
 	}
 	return len;
-} 
+}
 
 /**
  * Tests if s1 is a substring of s2
@@ -348,18 +348,18 @@ bits_common(const addrkey_t *s1, addrlen_t l1,
  * @param s2: second prefix.
  * @param l2: length of s2 in bits.
  * @param skip: nr of bits already checked.
- * @return 1 for substring, 0 otherwise 
+ * @return 1 for substring, 0 otherwise
  */
-static int 
-issub(const addrkey_t *s1, addrlen_t l1, 
+static int
+issub(const addrkey_t *s1, addrlen_t l1,
 	const addrkey_t *s2, addrlen_t l2,  addrlen_t skip)
 {
 	return bits_common(s1, l1, s2, l2, skip) == l1;
 }
 
 void
-addrtree_insert(struct addrtree *tree, const addrkey_t *addr, 
-	addrlen_t sourcemask, addrlen_t scope, void *elem, time_t ttl, 
+addrtree_insert(struct addrtree *tree, const addrkey_t *addr,
+	addrlen_t sourcemask, addrlen_t scope, void *elem, time_t ttl,
 	time_t now, int only_match_scope_zero)
 {
 	struct addrnode *newnode, *node;
@@ -444,15 +444,15 @@ addrtree_insert(struct addrtree *tree, const addrkey_t *addr,
 		newnode->edge[index] = edge;
 		edge->parent_node = newnode;
 		edge->parent_index = (int)index;
-		
+
 		if (common == sourcemask) {
 			/* Data is stored in the node */
 			newnode->elem = elem;
 			newnode->scope = scope;
 			newnode->ttl = ttl;
 			newnode->only_match_scope_zero = only_match_scope_zero;
-		} 
-		
+		}
+
 		tree->size_bytes += node_size(tree, newnode);
 
 		if (common != sourcemask) {
@@ -475,7 +475,7 @@ addrtree_insert(struct addrtree *tree, const addrkey_t *addr,
 }
 
 struct addrnode *
-addrtree_find(struct addrtree *tree, const addrkey_t *addr, 
+addrtree_find(struct addrtree *tree, const addrkey_t *addr,
 	addrlen_t sourcemask, time_t now)
 {
 	struct addrnode *node = tree->root;
@@ -519,19 +519,19 @@ addrtree_find(struct addrtree *tree, const addrkey_t *addr,
 }
 
 /** Wrappers for static functions to unit test */
-int unittest_wrapper_addrtree_cmpbit(const addrkey_t *key1, 
+int unittest_wrapper_addrtree_cmpbit(const addrkey_t *key1,
 	const addrkey_t *key2, addrlen_t n) {
 	return cmpbit(key1, key2, n);
 }
-addrlen_t unittest_wrapper_addrtree_bits_common(const addrkey_t *s1, 
+addrlen_t unittest_wrapper_addrtree_bits_common(const addrkey_t *s1,
 	addrlen_t l1, const addrkey_t *s2, addrlen_t l2, addrlen_t skip) {
 	return bits_common(s1, l1, s2, l2, skip);
 }
-int unittest_wrapper_addrtree_getbit(const addrkey_t *addr, 
+int unittest_wrapper_addrtree_getbit(const addrkey_t *addr,
 	addrlen_t addrlen, addrlen_t n) {
 	return getbit(addr, addrlen, n);
 }
-int unittest_wrapper_addrtree_issub(const addrkey_t *s1, addrlen_t l1, 
+int unittest_wrapper_addrtree_issub(const addrkey_t *s1, addrlen_t l1,
 	const addrkey_t *s2, addrlen_t l2,  addrlen_t skip) {
 	return issub(s1, l1, s2, l2, skip);
 }
diff --git a/usr.sbin/unbound/edns-subnet/addrtree.h b/usr.sbin/unbound/edns-subnet/addrtree.h
index 0bc1837cd..e64429c6f 100644
--- a/usr.sbin/unbound/edns-subnet/addrtree.h
+++ b/usr.sbin/unbound/edns-subnet/addrtree.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2013, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -64,7 +64,7 @@ typedef uint8_t addrkey_t;
 
 struct addrtree {
 	struct addrnode *root;
-	/** Number of elements in the tree (not always equal to number of 
+	/** Number of elements in the tree (not always equal to number of
 	 * nodes) */
 	uint32_t node_count;
 	/** Maximum number of allowed nodes, will be enforced by LRU list.
@@ -74,7 +74,7 @@ struct addrtree {
 	size_t size_bytes;
 	/** Maximum prefix length we are willing to cache. */
 	addrlen_t max_depth;
-	/** External function to delete elem. Called as 
+	/** External function to delete elem. Called as
 	 * delfunc(addrnode->elem, addrtree->env) */
 	void (*delfunc)(void *, void *);
 	/** Environment for delfunc */
@@ -129,21 +129,21 @@ struct addredge {
  */
 size_t addrtree_size(const struct addrtree *tree);
 
-/** 
+/**
  * Create a new tree.
  * @param max_depth: Tree will cap keys to this length.
  * @param delfunc: f(element, env) delete element.
  * @param sizefunc: f(element) returning the size of element.
  * @param env: Module environment for alloc information.
- * @param max_node_count: Maximum size of this data structure in nodes. 
+ * @param max_node_count: Maximum size of this data structure in nodes.
  * 			0 for unlimited.
  * @return new addrtree or NULL on failure.
  */
-struct addrtree * 
-addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *), 
+struct addrtree *
+addrtree_create(addrlen_t max_depth, void (*delfunc)(void *, void *),
 	size_t (*sizefunc)(void *), void *env, uint32_t max_node_count);
 
-/** 
+/**
  * Free tree and all nodes below.
  * @param tree: Tree to be freed.
  */
@@ -151,10 +151,10 @@ void addrtree_delete(struct addrtree *tree);
 
 /**
  * Insert an element in the tree. Failures are silent. Sourcemask and
- * scope might be changed according to local policy. Caller should no 
+ * scope might be changed according to local policy. Caller should no
  * longer access elem, it could be free'd now or later during future
  * inserts.
- * 
+ *
  * @param tree: Tree insert elem in.
  * @param addr: key for element lookup.
  * @param sourcemask: Length of addr in bits.
@@ -164,29 +164,29 @@ void addrtree_delete(struct addrtree *tree);
  * @param only_match_scope_zero: set for when query /0 has scope /0 answer.
  * @param now: Current time in seconds.
  */
-void addrtree_insert(struct addrtree *tree, const addrkey_t *addr, 
-	addrlen_t sourcemask, addrlen_t scope, void *elem, time_t ttl, 
+void addrtree_insert(struct addrtree *tree, const addrkey_t *addr,
+	addrlen_t sourcemask, addrlen_t scope, void *elem, time_t ttl,
 	time_t now, int only_match_scope_zero);
 
 /**
  * Find a node containing an element in the tree.
- * 
+ *
  * @param tree: Tree to search.
  * @param addr: key for element lookup.
  * @param sourcemask: Length of addr in bits.
  * @param now: Current time in seconds.
  * @return addrnode or NULL on miss.
  */
-struct addrnode * addrtree_find(struct addrtree *tree, 
+struct addrnode * addrtree_find(struct addrtree *tree,
 	const addrkey_t *addr, addrlen_t sourcemask, time_t now);
 
 /** Wrappers for static functions to unit test */
-int unittest_wrapper_addrtree_cmpbit(const addrkey_t *key1, 
+int unittest_wrapper_addrtree_cmpbit(const addrkey_t *key1,
 	const addrkey_t *key2, addrlen_t n);
-addrlen_t unittest_wrapper_addrtree_bits_common(const addrkey_t *s1, 
+addrlen_t unittest_wrapper_addrtree_bits_common(const addrkey_t *s1,
 	addrlen_t l1, const addrkey_t *s2, addrlen_t l2, addrlen_t skip);
-int unittest_wrapper_addrtree_getbit(const addrkey_t *addr, 
+int unittest_wrapper_addrtree_getbit(const addrkey_t *addr,
 	addrlen_t addrlen, addrlen_t n);
-int unittest_wrapper_addrtree_issub(const addrkey_t *s1, addrlen_t l1, 
+int unittest_wrapper_addrtree_issub(const addrkey_t *s1, addrlen_t l1,
 	const addrkey_t *s2, addrlen_t l2,  addrlen_t skip);
 #endif /* ADDRTREE_H */
diff --git a/usr.sbin/unbound/edns-subnet/edns-subnet.c b/usr.sbin/unbound/edns-subnet/edns-subnet.c
index 4c93192fa..b3c04f266 100644
--- a/usr.sbin/unbound/edns-subnet/edns-subnet.c
+++ b/usr.sbin/unbound/edns-subnet/edns-subnet.c
@@ -1,25 +1,25 @@
 /*
- * edns-subnet/edns-subnet.c - Subnet option related constants 
+ * edns-subnet/edns-subnet.c - Subnet option related constants
  *
  * Copyright (c) 2013, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -34,7 +34,7 @@
  */
 /**
  * \file
- * Subnet option related constants. 
+ * Subnet option related constants.
  */
 
 #include "config.h"
diff --git a/usr.sbin/unbound/edns-subnet/edns-subnet.h b/usr.sbin/unbound/edns-subnet/edns-subnet.h
index 6ab541de9..67ce6e654 100644
--- a/usr.sbin/unbound/edns-subnet/edns-subnet.h
+++ b/usr.sbin/unbound/edns-subnet/edns-subnet.h
@@ -1,25 +1,25 @@
 /*
- * edns-subnet/edns-subnet.h - Subnet option related constants 
+ * edns-subnet/edns-subnet.h - Subnet option related constants
  *
  * Copyright (c) 2013, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -34,7 +34,7 @@
  */
 /**
  * \file
- * Subnet option related constants. 
+ * Subnet option related constants.
  */
 
 #include "util/net_help.h"
@@ -57,8 +57,8 @@ struct ecs_data {
 	int subnet_validdata;
 };
 
-/** 
- * copy the first n BITS from src to dst iff both src and dst 
+/**
+ * copy the first n BITS from src to dst iff both src and dst
  * are large enough, return 0 on success
  */
 int
diff --git a/usr.sbin/unbound/edns-subnet/subnet-whitelist.c b/usr.sbin/unbound/edns-subnet/subnet-whitelist.c
index 1ea7fb1b2..a5a33a522 100644
--- a/usr.sbin/unbound/edns-subnet/subnet-whitelist.c
+++ b/usr.sbin/unbound/edns-subnet/subnet-whitelist.c
@@ -5,22 +5,22 @@
  * Copyright (c) 2013, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -53,10 +53,10 @@
 #include "sldns/str2wire.h"
 #include "util/data/dname.h"
 
-struct ecs_whitelist* 
+struct ecs_whitelist*
 ecs_whitelist_create(void)
 {
-	struct ecs_whitelist* whitelist = 
+	struct ecs_whitelist* whitelist =
 		(struct ecs_whitelist*)calloc(1,
 		sizeof(struct ecs_whitelist));
 	if(!whitelist)
@@ -69,10 +69,10 @@ ecs_whitelist_create(void)
 	return whitelist;
 }
 
-void 
+void
 ecs_whitelist_delete(struct ecs_whitelist* whitelist)
 {
-	if(!whitelist) 
+	if(!whitelist)
 		return;
 	regional_destroy(whitelist->region);
 	free(whitelist);
@@ -80,7 +80,7 @@ ecs_whitelist_delete(struct ecs_whitelist* whitelist)
 
 /** insert new address into whitelist structure */
 static int
-upstream_insert(struct ecs_whitelist* whitelist, 
+upstream_insert(struct ecs_whitelist* whitelist,
 	struct sockaddr_storage* addr, socklen_t addrlen, int net)
 {
 	struct addr_tree_node* node = (struct addr_tree_node*)regional_alloc(
@@ -114,7 +114,7 @@ upstream_str_cfg(struct ecs_whitelist* whitelist, const char* str)
 }
 
 /** read client_subnet config */
-static int 
+static int
 read_upstream(struct ecs_whitelist* whitelist, struct config_file* cfg)
 {
 	struct config_strlist* p;
@@ -127,7 +127,7 @@ read_upstream(struct ecs_whitelist* whitelist, struct config_file* cfg)
 }
 
 /** read client_subnet_zone config */
-static int 
+static int
 read_names(struct ecs_whitelist* whitelist, struct config_file* cfg)
 {
 	/* parse names, report errors, insert into tree */
@@ -167,7 +167,7 @@ read_names(struct ecs_whitelist* whitelist, struct config_file* cfg)
 	return 1;
 }
 
-int 
+int
 ecs_whitelist_apply_cfg(struct ecs_whitelist* whitelist,
 	struct config_file* cfg)
 {
@@ -183,7 +183,7 @@ ecs_whitelist_apply_cfg(struct ecs_whitelist* whitelist,
 	return 1;
 }
 
-int 
+int
 ecs_is_whitelisted(struct ecs_whitelist* whitelist,
 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* qname,
 	size_t qname_len, uint16_t qclass)
@@ -197,7 +197,7 @@ ecs_is_whitelisted(struct ecs_whitelist* whitelist,
 		qclass) != NULL;
 }
 
-size_t 
+size_t
 ecs_whitelist_get_mem(struct ecs_whitelist* whitelist)
 {
 	if(!whitelist) return 0;
diff --git a/usr.sbin/unbound/edns-subnet/subnet-whitelist.h b/usr.sbin/unbound/edns-subnet/subnet-whitelist.h
index 8cd03abab..05fe701b5 100644
--- a/usr.sbin/unbound/edns-subnet/subnet-whitelist.h
+++ b/usr.sbin/unbound/edns-subnet/subnet-whitelist.h
@@ -5,22 +5,22 @@
  * Copyright (c) 2013, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -53,9 +53,9 @@ struct regional;
 struct ecs_whitelist {
 	/** regional for allocation */
 	struct regional* region;
-	/** 
+	/**
 	 * Tree of the address spans that are whitelisted.
-	 * contents of type addr_tree_node. Each node is an address span 
+	 * contents of type addr_tree_node. Each node is an address span
 	 * Unbound will append subnet option for.
 	 */
 	rbtree_type upstream;
@@ -67,7 +67,7 @@ struct ecs_whitelist {
 };
 
 /**
- * Create ecs_whitelist structure 
+ * Create ecs_whitelist structure
  * @return new structure or NULL on error.
  */
 struct ecs_whitelist* ecs_whitelist_create(void);
@@ -95,7 +95,7 @@ int ecs_whitelist_apply_cfg(struct ecs_whitelist* whitelist,
  * @param qname: dname in query
  * @param qname_len: length of dname
  * @param qclass: class in query
- * @return: true if the address is whitelisted for subnet option. 
+ * @return: true if the address is whitelisted for subnet option.
  */
 int ecs_is_whitelisted(struct ecs_whitelist* whitelist,
 	struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* qname,
diff --git a/usr.sbin/unbound/edns-subnet/subnetmod.c b/usr.sbin/unbound/edns-subnet/subnetmod.c
index 0f1df417f..f2c213768 100644
--- a/usr.sbin/unbound/edns-subnet/subnetmod.c
+++ b/usr.sbin/unbound/edns-subnet/subnetmod.c
@@ -5,22 +5,22 @@
  * Copyright (c) 2013, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -59,7 +59,7 @@
 #include "iterator/iter_utils.h"
 
 /** externally called */
-void 
+void
 subnet_data_delete(void *d, void *ATTR_UNUSED(arg))
 {
 	struct subnet_msg_cache_data *r;
@@ -70,12 +70,12 @@ subnet_data_delete(void *d, void *ATTR_UNUSED(arg))
 }
 
 /** externally called */
-size_t 
+size_t
 msg_cache_sizefunc(void *k, void *d)
 {
 	struct msgreply_entry *q = (struct msgreply_entry*)k;
 	struct subnet_msg_cache_data *r = (struct subnet_msg_cache_data*)d;
-	size_t s = sizeof(struct msgreply_entry) 
+	size_t s = sizeof(struct msgreply_entry)
 		+ sizeof(struct subnet_msg_cache_data)
 		+ q->key.qname_len + lock_get_mem(&q->entry.lock);
 	s += addrtree_size(r->tree4);
@@ -89,7 +89,7 @@ subnet_new_qstate(struct module_qstate *qstate, int id)
 {
 	struct subnet_qstate *sq = (struct subnet_qstate*)regional_alloc(
 		qstate->region, sizeof(struct subnet_qstate));
-	if(!sq) 
+	if(!sq)
 		return 0;
 	qstate->minfo[id] = sq;
 	memset(sq, 0, sizeof(*sq));
@@ -107,26 +107,26 @@ subnet_ecs_opt_list_append(struct ecs_data* ecs, struct edns_option** list,
 	sldns_buffer* buf = qstate->env->scratch_buffer;
 
 	if(ecs->subnet_validdata) {
-		log_assert(ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4 || 
+		log_assert(ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4 ||
 			ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6);
-		log_assert(ecs->subnet_addr_fam != EDNSSUBNET_ADDRFAM_IP4 || 
+		log_assert(ecs->subnet_addr_fam != EDNSSUBNET_ADDRFAM_IP4 ||
 			ecs->subnet_source_mask <=  INET_SIZE*8);
-		log_assert(ecs->subnet_addr_fam != EDNSSUBNET_ADDRFAM_IP6 || 
+		log_assert(ecs->subnet_addr_fam != EDNSSUBNET_ADDRFAM_IP6 ||
 			ecs->subnet_source_mask <= INET6_SIZE*8);
 
 		sn_octs = ecs->subnet_source_mask / 8;
 		sn_octs_remainder =
 			(size_t)((ecs->subnet_source_mask % 8)>0?1:0);
-		
+
 		log_assert(sn_octs + sn_octs_remainder <= INET6_SIZE);
-		
+
 		sldns_buffer_clear(buf);
 		sldns_buffer_write_u16(buf, ecs->subnet_addr_fam);
 		sldns_buffer_write_u8(buf, ecs->subnet_source_mask);
 		sldns_buffer_write_u8(buf, ecs->subnet_scope_mask);
 		sldns_buffer_write(buf, ecs->subnet_addr, sn_octs);
 		if(sn_octs_remainder)
-			sldns_buffer_write_u8(buf, ecs->subnet_addr[sn_octs] & 
+			sldns_buffer_write_u8(buf, ecs->subnet_addr[sn_octs] &
 				~(0xFF >> (ecs->subnet_source_mask % 8)));
 		sldns_buffer_flip(buf);
 
@@ -145,7 +145,7 @@ int ecs_whitelist_check(struct query_info* qinfo,
 {
 	struct subnet_qstate *sq;
 	struct subnet_env *sn_env;
-	
+
 	if(!(sq=(struct subnet_qstate*)qstate->minfo[id]))
 		return 1;
 	sn_env = (struct subnet_env*)qstate->env->modinfo[id];
@@ -158,7 +158,7 @@ int ecs_whitelist_check(struct query_info* qinfo,
 
 	if(sq->ecs_server_out.subnet_validdata && ((sq->subnet_downstream &&
 		qstate->env->cfg->client_subnet_always_forward) ||
-		ecs_is_whitelisted(sn_env->whitelist, 
+		ecs_is_whitelisted(sn_env->whitelist,
 		addr, addrlen, qinfo->qname, qinfo->qname_len,
 		qinfo->qclass))) {
 		/* Address on whitelist or client query contains ECS option, we
@@ -299,8 +299,8 @@ sizefunc(void *elemptr) {
  * Select tree from cache entry based on edns data.
  * If for address family not present it will create a new one.
  * NULL on failure to create. */
-static struct addrtree* 
-get_tree(struct subnet_msg_cache_data *data, struct ecs_data *edns, 
+static struct addrtree*
+get_tree(struct subnet_msg_cache_data *data, struct ecs_data *edns,
 	struct subnet_env *env, struct config_file* cfg)
 {
 	struct addrtree *tree;
@@ -385,7 +385,7 @@ update_cache(struct module_qstate *qstate, int id)
 		log_err("subnetcache: cache insertion failed");
 		return;
 	}
-	
+
 	/* store RRsets */
 	for(i=0; i<rep->rrset_count; i++) {
 		rep->ref[i].key = rep->rrsets[i];
@@ -397,7 +397,7 @@ update_cache(struct module_qstate *qstate, int id)
 	if(edns->subnet_source_mask == 0 && edns->subnet_scope_mask == 0)
 		only_match_scope_zero = 1;
 	else only_match_scope_zero = 0;
-	addrtree_insert(tree, (addrkey_t*)edns->subnet_addr, 
+	addrtree_insert(tree, (addrkey_t*)edns->subnet_addr,
 		edns->subnet_source_mask, sq->max_scope, rep,
 		rep->ttl, *qstate->env->now, only_match_scope_zero);
 
@@ -437,7 +437,7 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
-	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr, 
+	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr,
 		ecs->subnet_source_mask, *env->now);
 	if (!node) { /* plain old cache miss */
 		lock_rw_unlock(&e->lock);
@@ -449,11 +449,11 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		env->scratch);
 	scope = (uint8_t)node->scope;
 	lock_rw_unlock(&e->lock);
-	
+
 	if (!qstate->return_msg) { /* Failed allocation or expired TTL */
 		return 0;
 	}
-	
+
 	if (sq->subnet_downstream) { /* relay to interested client */
 		sq->ecs_client_out.subnet_scope_mask = scope;
 		sq->ecs_client_out.subnet_addr_fam = ecs->subnet_addr_fam;
@@ -473,7 +473,7 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
  * @param net: Number of bits to test.
  * @return: 1 if equal, 0 otherwise.
  */
-static int 
+static int
 common_prefix(uint8_t *a, uint8_t *b, uint8_t net)
 {
 	size_t n = (size_t)net / 8;
@@ -498,7 +498,7 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		 * module_finished */
 		return module_finished;
 	}
-	
+
 	/* We have not asked for subnet data */
 	if (!sq->subnet_sent) {
 		if (s_in->subnet_validdata)
@@ -507,7 +507,7 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 			cp_edns_bad_response(c_out, c_in);
 		return module_finished;
 	}
-	
+
 	/* subnet sent but nothing came back */
 	if (!s_in->subnet_validdata) {
 		/* The authority indicated no support for edns subnet. As a
@@ -524,15 +524,15 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 			cp_edns_bad_response(c_out, c_in);
 		return module_finished;
 	}
-	
-	/* Being here means we have asked for and got a subnet specific 
-	 * answer. Also, the answer from the authority is not yet cached 
+
+	/* Being here means we have asked for and got a subnet specific
+	 * answer. Also, the answer from the authority is not yet cached
 	 * anywhere. */
-	
+
 	/* can we accept response? */
 	if(s_out->subnet_addr_fam != s_in->subnet_addr_fam ||
 		s_out->subnet_source_mask != s_in->subnet_source_mask ||
-		!common_prefix(s_out->subnet_addr, s_in->subnet_addr, 
+		!common_prefix(s_out->subnet_addr, s_in->subnet_addr,
 			s_out->subnet_source_mask))
 	{
 		/* we can not accept, restart query without option */
@@ -550,7 +550,7 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 	}
 	sne->num_msg_nocache++;
 	lock_rw_unlock(&sne->biglock);
-	
+
 	if (sq->subnet_downstream) {
 		/* Client wants to see the answer, echo option back
 		 * and adjust the scope. */
@@ -588,7 +588,7 @@ parse_subnet_option(struct edns_option* ecs_option, struct ecs_data* ecs)
 	ecs->subnet_source_mask = ecs_option->opt_data[2];
 	ecs->subnet_scope_mask = ecs_option->opt_data[3];
 	/* remaining bytes indicate address */
-	
+
 	/* validate input*/
 	/* option length matches calculated length? */
 	if (ecs_option->opt_len != (size_t)((ecs->subnet_source_mask+7)/8 + 4))
@@ -604,9 +604,9 @@ parse_subnet_option(struct edns_option* ecs_option, struct ecs_data* ecs)
 			return 0;
 	} else
 		return 0;
-	
+
 	/* valid ECS data, write to ecs_data */
-	if (copy_clear(ecs->subnet_addr, INET6_SIZE, ecs_option->opt_data + 4, 
+	if (copy_clear(ecs->subnet_addr, INET6_SIZE, ecs_option->opt_data + 4,
 		ecs_option->opt_len - 4, ecs->subnet_source_mask))
 		return 0;
 	ecs->subnet_validdata = 1;
@@ -651,7 +651,7 @@ ecs_query_response(struct module_qstate* qstate, struct dns_msg* response,
 	int id, void* ATTR_UNUSED(cbargs))
 {
 	struct subnet_qstate *sq;
-	
+
 	if(!response || !(sq=(struct subnet_qstate*)qstate->minfo[id]))
 		return 1;
 
@@ -703,7 +703,7 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id,
 {
 	struct subnet_qstate *sq;
 	struct edns_option* ecs_opt;
-	
+
 	if(!(sq=(struct subnet_qstate*)qstate->minfo[id]))
 		return 1;
 	if((ecs_opt = edns_opt_list_find(
@@ -728,14 +728,14 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id,
 }
 
 void
-subnetmod_operate(struct module_qstate *qstate, enum module_ev event, 
+subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 	int id, struct outbound_entry* outbound)
 {
 	struct subnet_env *sne = qstate->env->modinfo[id];
 	struct subnet_qstate *sq = (struct subnet_qstate*)qstate->minfo[id];
-	
+
 	verbose(VERB_QUERY, "subnetcache[module %d] operate: extstate:%s "
-		"event:%s", id, strextstate(qstate->ext_state[id]), 
+		"event:%s", id, strextstate(qstate->ext_state[id]),
 		strmodulevent(event));
 	log_query_info(VERB_QUERY, "subnetcache operate: query", &qstate->qinfo);
 
@@ -768,7 +768,7 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 				&qstate->mesh_info->reply_list->query_reply.client_addr,
 				&sq->ecs_client_in, qstate->env->cfg);
 		}
-		
+
 		if(sq->ecs_client_in.subnet_validdata == 0) {
 			/* No clients are interested in result or we could not
 			 * parse it, we don't do client subnet */
@@ -811,18 +811,18 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			}
 			lock_rw_unlock(&sne->biglock);
 		}
-		
+
 		sq->ecs_server_out.subnet_addr_fam =
 			sq->ecs_client_in.subnet_addr_fam;
 		sq->ecs_server_out.subnet_source_mask =
 			sq->ecs_client_in.subnet_source_mask;
 		/* Limit source prefix to configured maximum */
-		if(sq->ecs_server_out.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4 
+		if(sq->ecs_server_out.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4
 			&& sq->ecs_server_out.subnet_source_mask >
 			qstate->env->cfg->max_client_subnet_ipv4)
 			sq->ecs_server_out.subnet_source_mask =
 				qstate->env->cfg->max_client_subnet_ipv4;
-		else if(sq->ecs_server_out.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6 
+		else if(sq->ecs_server_out.subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP6
 			&& sq->ecs_server_out.subnet_source_mask >
 			qstate->env->cfg->max_client_subnet_ipv6)
 			sq->ecs_server_out.subnet_source_mask =
@@ -840,7 +840,7 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event,
 			/* ECS specific data required, do not look at the global
 			 * cache in other modules. */
 			qstate->no_cache_lookup = 1;
-		
+
 		/* pass request to next module */
 		verbose(VERB_ALGO,
 			"subnetcache: not found in cache. pass to next module");
@@ -906,13 +906,13 @@ subnetmod_get_mem(struct module_env *env, int id)
 {
 	struct subnet_env *sn_env = env->modinfo[id];
 	if (!sn_env) return 0;
-	return sizeof(*sn_env) + 
+	return sizeof(*sn_env) +
 		slabhash_get_mem(sn_env->subnet_msg_cache) +
 		ecs_whitelist_get_mem(sn_env->whitelist);
 }
 
 /**
- * The module function block 
+ * The module function block
  */
 static struct module_func_block subnetmod_block = {
 	"subnetcache", &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
diff --git a/usr.sbin/unbound/edns-subnet/subnetmod.h b/usr.sbin/unbound/edns-subnet/subnetmod.h
index f0bcaad33..e035be272 100644
--- a/usr.sbin/unbound/edns-subnet/subnetmod.h
+++ b/usr.sbin/unbound/edns-subnet/subnetmod.h
@@ -5,22 +5,22 @@
  * Copyright (c) 2013, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/ipsecmod/ipsecmod.c b/usr.sbin/unbound/ipsecmod/ipsecmod.c
index 19549d4ee..802e86bd5 100644
--- a/usr.sbin/unbound/ipsecmod/ipsecmod.c
+++ b/usr.sbin/unbound/ipsecmod/ipsecmod.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2017, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/ipsecmod/ipsecmod.h b/usr.sbin/unbound/ipsecmod/ipsecmod.h
index 272f473c2..cffb1687b 100644
--- a/usr.sbin/unbound/ipsecmod/ipsecmod.h
+++ b/usr.sbin/unbound/ipsecmod/ipsecmod.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2017, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/ipset/ipset.c b/usr.sbin/unbound/ipset/ipset.c
index c61ebc205..fb7cca537 100644
--- a/usr.sbin/unbound/ipset/ipset.c
+++ b/usr.sbin/unbound/ipset/ipset.c
@@ -372,7 +372,7 @@ size_t ipset_get_mem(struct module_env *env, int id) {
 }
 
 /**
- * The ipset function block 
+ * The ipset function block
  */
 static struct module_func_block ipset_block = {
 	"ipset",
diff --git a/usr.sbin/unbound/iterator/iter_delegpt.c b/usr.sbin/unbound/iterator/iter_delegpt.c
index fd07aaa13..770c14d73 100644
--- a/usr.sbin/unbound/iterator/iter_delegpt.c
+++ b/usr.sbin/unbound/iterator/iter_delegpt.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -50,7 +50,7 @@
 #include "sldns/rrdef.h"
 #include "sldns/sbuffer.h"
 
-struct delegpt* 
+struct delegpt*
 delegpt_create(struct regional* region)
 {
 	struct delegpt* dp=(struct delegpt*)regional_alloc(
@@ -66,7 +66,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	struct delegpt* copy = delegpt_create(region);
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
-	if(!copy) 
+	if(!copy)
 		return NULL;
 	if(!delegpt_set_name(copy, region, dp->name))
 		return NULL;
@@ -93,7 +93,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	return copy;
 }
 
-int 
+int
 delegpt_set_name(struct delegpt* dp, struct regional* region, uint8_t* name)
 {
 	log_assert(!dp->dp_type_mlc);
@@ -102,7 +102,7 @@ delegpt_set_name(struct delegpt* dp, struct regional* region, uint8_t* name)
 	return dp->name != 0;
 }
 
-int 
+int
 delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
 	uint8_t lame, char* tls_auth_name, int port)
 {
@@ -145,7 +145,7 @@ delegpt_find_ns(struct delegpt* dp, uint8_t* name, size_t namelen)
 {
 	struct delegpt_ns* p = dp->nslist;
 	while(p) {
-		if(namelen == p->namelen && 
+		if(namelen == p->namelen &&
 			query_dname_compare(name, p->name) == 0) {
 			return p;
 		}
@@ -155,7 +155,7 @@ delegpt_find_ns(struct delegpt* dp, uint8_t* name, size_t namelen)
 }
 
 struct delegpt_addr*
-delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr, 
+delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr,
 	socklen_t addrlen)
 {
 	struct delegpt_addr* p = dp->target_list;
@@ -258,7 +258,7 @@ delegpt_count_ns(struct delegpt* dp, size_t* numns, size_t* missing)
 }
 
 void
-delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres, 
+delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres,
 	size_t* numavail)
 {
 	struct delegpt_addr* a;
@@ -292,14 +292,14 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 	delegpt_count_ns(dp, &numns, &missing);
 	delegpt_count_addr(dp, &numaddr, &numres, &numavail);
 	log_info("DelegationPoint<%s>: %u names (%u missing), "
-		"%u addrs (%u result, %u avail)%s", 
-		buf, (unsigned)numns, (unsigned)missing, 
+		"%u addrs (%u result, %u avail)%s",
+		buf, (unsigned)numns, (unsigned)missing,
 		(unsigned)numaddr, (unsigned)numres, (unsigned)numavail,
 		(dp->has_parent_side_NS?" parentNS":" cacheNS"));
 	if(verbosity >= VERB_ALGO) {
 		for(ns = dp->nslist; ns; ns = ns->next) {
 			dname_str(ns->name, buf);
-			log_info("  %s %s%s%s%s%s%s%s", buf, 
+			log_info("  %s %s%s%s%s%s%s%s", buf,
 			(ns->resolved?"*":""),
 			(ns->got4?" A":""), (ns->got6?" AAAA":""),
 			(dp->bogus?" BOGUS":""), (ns->lame?" PARENTSIDE":""),
@@ -321,7 +321,7 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 	}
 }
 
-void 
+void
 delegpt_add_unused_targets(struct delegpt* dp)
 {
 	struct delegpt_addr* usa = dp->usable_list;
@@ -343,7 +343,7 @@ delegpt_count_targets(struct delegpt* dp)
 	return n;
 }
 
-size_t 
+size_t
 delegpt_count_missing_targets(struct delegpt* dp, int* alllame)
 {
 	struct delegpt_ns* ns;
@@ -369,27 +369,27 @@ find_NS(struct reply_info* rep, size_t from, size_t to)
 	return NULL;
 }
 
-struct delegpt* 
+struct delegpt*
 delegpt_from_message(struct dns_msg* msg, struct regional* region)
 {
 	struct ub_packed_rrset_key* ns_rrset = NULL;
 	struct delegpt* dp;
 	size_t i;
 	/* look for NS records in the authority section... */
-	ns_rrset = find_NS(msg->rep, msg->rep->an_numrrsets, 
+	ns_rrset = find_NS(msg->rep, msg->rep->an_numrrsets,
 		msg->rep->an_numrrsets+msg->rep->ns_numrrsets);
 
-	/* In some cases (even legitimate, perfectly legal cases), the 
+	/* In some cases (even legitimate, perfectly legal cases), the
 	 * NS set for the "referral" might be in the answer section. */
 	if(!ns_rrset)
 		ns_rrset = find_NS(msg->rep, 0, msg->rep->an_numrrsets);
-	
-	/* If there was no NS rrset in the authority section, then this 
-	 * wasn't a referral message. (It might not actually be a 
+
+	/* If there was no NS rrset in the authority section, then this
+	 * wasn't a referral message. (It might not actually be a
 	 * referral message anyway) */
 	if(!ns_rrset)
 		return NULL;
-	
+
 	/* If we found any, then Yay! we have a delegation point. */
 	dp = delegpt_create(region);
 	if(!dp)
@@ -404,7 +404,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 	for(i=0; i<msg->rep->rrset_count; i++) {
 		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
 		/* skip auth section. FIXME really needed?*/
-		if(msg->rep->an_numrrsets <= i && 
+		if(msg->rep->an_numrrsets <= i &&
 			i < (msg->rep->an_numrrsets+msg->rep->ns_numrrsets))
 			continue;
 
@@ -419,7 +419,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 	return dp;
 }
 
-int 
+int
 delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
         struct ub_packed_rrset_key* ns_rrset, uint8_t lame)
 {
@@ -442,7 +442,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 	return 1;
 }
 
-int 
+int
 delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
 	struct ub_packed_rrset_key* ak, uint8_t lame, int* additions)
 {
@@ -465,7 +465,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
         return 1;
 }
 
-int 
+int
 delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
 	struct ub_packed_rrset_key* ak, uint8_t lame, int* additions)
 {
@@ -488,7 +488,7 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
         return 1;
 }
 
-int 
+int
 delegpt_add_rrset(struct delegpt* dp, struct regional* region,
         struct ub_packed_rrset_key* rrset, uint8_t lame, int* additions)
 {
@@ -524,7 +524,7 @@ void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg)
 
 	/* if error or no answers */
 	if(FLAGS_GET_RCODE(rep->flags) != 0 || rep->an_numrrsets == 0) {
-		struct delegpt_ns* ns = delegpt_find_ns(dp, msg->key.qname, 
+		struct delegpt_ns* ns = delegpt_find_ns(dp, msg->key.qname,
 			msg->key.qname_len);
 		delegpt_mark_neg(ns, msg->key.qtype);
 	}
diff --git a/usr.sbin/unbound/iterator/iter_delegpt.h b/usr.sbin/unbound/iterator/iter_delegpt.h
index 586597a69..ae13ee1ea 100644
--- a/usr.sbin/unbound/iterator/iter_delegpt.h
+++ b/usr.sbin/unbound/iterator/iter_delegpt.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -66,7 +66,7 @@ struct delegpt {
 	struct delegpt_ns* nslist;
 	/** the target addresses for delegation */
 	struct delegpt_addr* target_list;
-	/** the list of usable targets; subset of target_list 
+	/** the list of usable targets; subset of target_list
 	 * the items in this list are not part of the result list.  */
 	struct delegpt_addr* usable_list;
 	/** the list of returned targets; subset of target_list */
@@ -103,7 +103,7 @@ struct delegpt_ns {
 	size_t namelen;
 	/** number of cache lookups for the name */
 	int cache_lookup_count;
-	/** 
+	/**
 	 * If the name has been resolved. false if not queried for yet.
 	 * true if the A, AAAA queries have been generated.
 	 * marked true if those queries fail.
@@ -189,7 +189,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* regional);
  * @param name: name to use.
  * @return false on error.
  */
-int delegpt_set_name(struct delegpt* dp, struct regional* regional, 
+int delegpt_set_name(struct delegpt* dp, struct regional* regional,
 	uint8_t* name);
 
 /**
@@ -230,8 +230,8 @@ int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
  * @param additions: will be set to 1 if a new address is added
  * @return false on error.
  */
-int delegpt_add_target(struct delegpt* dp, struct regional* regional, 
-	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
+int delegpt_add_target(struct delegpt* dp, struct regional* regional,
+	uint8_t* name, size_t namelen, struct sockaddr_storage* addr,
 	socklen_t addrlen, uint8_t bogus, uint8_t lame, int* additions);
 
 /**
@@ -243,7 +243,7 @@ int delegpt_add_target(struct delegpt* dp, struct regional* regional,
  * @param additions: will be set to 1 if a new address is added
  * @return 0 on alloc error.
  */
-int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional, 
+int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional,
 	struct ub_packed_rrset_key* rrset, uint8_t lame, int* additions);
 
 /**
@@ -255,7 +255,7 @@ int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional,
  * @param additions: will be set to 1 if a new address is added
  * @return 0 on alloc error.
  */
-int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional, 
+int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional,
 	struct ub_packed_rrset_key* rrset, uint8_t lame, int* additions);
 
 /**
@@ -268,7 +268,7 @@ int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional,
  * @param additions: will be set to 1 if a new address is added
  * @return 0 on alloc error.
  */
-int delegpt_add_rrset(struct delegpt* dp, struct regional* regional, 
+int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
 	struct ub_packed_rrset_key* rrset, uint8_t lame, int* additions);
 
 /**
@@ -289,24 +289,24 @@ int delegpt_add_addr(struct delegpt* dp, struct regional* regional,
 	uint8_t bogus, uint8_t lame, char* tls_auth_name, int port,
 	int* additions);
 
-/** 
+/**
  * Find NS record in name list of delegation point.
  * @param dp: delegation point.
  * @param name: name of nameserver to look for, uncompressed wireformat.
  * @param namelen: length of name.
  * @return the ns structure or NULL if not found.
  */
-struct delegpt_ns* delegpt_find_ns(struct delegpt* dp, uint8_t* name, 
+struct delegpt_ns* delegpt_find_ns(struct delegpt* dp, uint8_t* name,
 	size_t namelen);
 
-/** 
+/**
  * Find address record in total list of delegation point.
  * @param dp: delegation point.
  * @param addr: address
  * @param addrlen: length of addr
  * @return the addr structure or NULL if not found.
  */
-struct delegpt_addr* delegpt_find_addr(struct delegpt* dp, 
+struct delegpt_addr* delegpt_find_addr(struct delegpt* dp,
 	struct sockaddr_storage* addr, socklen_t addrlen);
 
 /**
@@ -320,7 +320,7 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp);
 void delegpt_count_ns(struct delegpt* dp, size_t* numns, size_t* missing);
 
 /** count addresses, and number in result and available lists, for logging */
-void delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres, 
+void delegpt_count_addr(struct delegpt* dp, size_t* numaddr, size_t* numres,
 	size_t* numavail);
 
 /**
@@ -358,7 +358,7 @@ size_t delegpt_count_targets(struct delegpt* dp);
  * @return new delegation point or NULL on alloc error, or if the
  *         message was not appropriate.
  */
-struct delegpt* delegpt_from_message(struct dns_msg* msg, 
+struct delegpt* delegpt_from_message(struct dns_msg* msg,
 	struct regional* regional);
 
 /**
@@ -377,29 +377,29 @@ void delegpt_mark_neg(struct delegpt_ns* ns, uint16_t qtype);
 void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg);
 
 /**
- * Register the fact that there is no ipv6 and thus AAAAs are not going 
+ * Register the fact that there is no ipv6 and thus AAAAs are not going
  * to be queried for or be useful.
  * @param dp: the delegation point. Updated to reflect no ipv6.
  */
 void delegpt_no_ipv6(struct delegpt* dp);
 
 /**
- * Register the fact that there is no ipv4 and thus As are not going 
+ * Register the fact that there is no ipv4 and thus As are not going
  * to be queried for or be useful.
  * @param dp: the delegation point. Updated to reflect no ipv4.
  */
 void delegpt_no_ipv4(struct delegpt* dp);
 
-/** 
- * create malloced delegation point, with the given name 
+/**
+ * create malloced delegation point, with the given name
  * @param name: uncompressed wireformat of delegpt name.
  * @return NULL on alloc failure
  */
 struct delegpt* delegpt_create_mlc(uint8_t* name);
 
-/** 
+/**
  * free malloced delegation point.
- * @param dp: must have been created with delegpt_create_mlc, free'd. 
+ * @param dp: must have been created with delegpt_create_mlc, free'd.
  */
 void delegpt_free_mlc(struct delegpt* dp);
 
@@ -413,7 +413,7 @@ int delegpt_set_name_mlc(struct delegpt* dp, uint8_t* name);
 
 /**
  * add a name to malloced delegation point.
- * @param dp: must have been created with delegpt_create_mlc. 
+ * @param dp: must have been created with delegpt_create_mlc.
  * @param name: the name to add.
  * @param lame: the name is lame, disprefer.
  * @param tls_auth_name: TLS authentication name (or NULL).
@@ -440,7 +440,7 @@ int delegpt_add_addr_mlc(struct delegpt* dp, struct sockaddr_storage* addr,
 
 /**
  * Add target address to the delegation point.
- * @param dp: must have been created with delegpt_create_mlc. 
+ * @param dp: must have been created with delegpt_create_mlc.
  * @param name: name for which target was found (must be in nslist).
  *	This name is marked resolved.
  * @param namelen: length of name.
diff --git a/usr.sbin/unbound/iterator/iter_donotq.c b/usr.sbin/unbound/iterator/iter_donotq.c
index 40ffb45c4..3fb7bdeed 100644
--- a/usr.sbin/unbound/iterator/iter_donotq.c
+++ b/usr.sbin/unbound/iterator/iter_donotq.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -48,7 +48,7 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 
-struct iter_donotq* 
+struct iter_donotq*
 donotq_create(void)
 {
 	struct iter_donotq* dq = (struct iter_donotq*)calloc(1,
@@ -63,10 +63,10 @@ donotq_create(void)
 	return dq;
 }
 
-void 
+void
 donotq_delete(struct iter_donotq* dq)
 {
-	if(!dq) 
+	if(!dq)
 		return;
 	regional_destroy(dq->region);
 	free(dq);
@@ -74,7 +74,7 @@ donotq_delete(struct iter_donotq* dq)
 
 /** insert new address into donotq structure */
 static int
-donotq_insert(struct iter_donotq* dq, struct sockaddr_storage* addr, 
+donotq_insert(struct iter_donotq* dq, struct sockaddr_storage* addr,
 	socklen_t addrlen, int net)
 {
 	struct addr_tree_node* node = (struct addr_tree_node*)regional_alloc(
@@ -107,7 +107,7 @@ donotq_str_cfg(struct iter_donotq* dq, const char* str)
 }
 
 /** read donotq config */
-static int 
+static int
 read_donotq(struct iter_donotq* dq, struct config_file* cfg)
 {
 	struct config_strlist* p;
@@ -119,7 +119,7 @@ read_donotq(struct iter_donotq* dq, struct config_file* cfg)
 	return 1;
 }
 
-int 
+int
 donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
 {
 	regional_free_all(dq->region);
@@ -138,14 +138,14 @@ donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
 	return 1;
 }
 
-int 
+int
 donotq_lookup(struct iter_donotq* donotq, struct sockaddr_storage* addr,
         socklen_t addrlen)
 {
 	return addr_tree_lookup(&donotq->tree, addr, addrlen) != NULL;
 }
 
-size_t 
+size_t
 donotq_get_mem(struct iter_donotq* donotq)
 {
 	if(!donotq) return 0;
diff --git a/usr.sbin/unbound/iterator/iter_donotq.h b/usr.sbin/unbound/iterator/iter_donotq.h
index 14105073a..591fe5fd6 100644
--- a/usr.sbin/unbound/iterator/iter_donotq.h
+++ b/usr.sbin/unbound/iterator/iter_donotq.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -53,16 +53,16 @@ struct regional;
 struct iter_donotq {
 	/** regional for allocation */
 	struct regional* region;
-	/** 
+	/**
 	 * Tree of the address spans that are blocked.
-	 * contents of type addr_tree_node. Each node is an address span 
+	 * contents of type addr_tree_node. Each node is an address span
 	 * that must not be used to send queries to.
 	 */
 	rbtree_type tree;
 };
 
 /**
- * Create donotqueryaddresses structure 
+ * Create donotqueryaddresses structure
  * @return new structure or NULL on error.
  */
 struct iter_donotq* donotq_create(void);
diff --git a/usr.sbin/unbound/iterator/iter_fwd.c b/usr.sbin/unbound/iterator/iter_fwd.c
index 151372912..e1d37382b 100644
--- a/usr.sbin/unbound/iterator/iter_fwd.c
+++ b/usr.sbin/unbound/iterator/iter_fwd.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -60,11 +60,11 @@ fwd_cmp(const void* k1, const void* k2)
 			return -1;
 		return 1;
 	}
-	return dname_lab_cmp(n1->name, n1->namelabs, n2->name, n2->namelabs, 
+	return dname_lab_cmp(n1->name, n1->namelabs, n2->name, n2->namelabs,
 		&m);
 }
 
-struct iter_forwards* 
+struct iter_forwards*
 forwards_create(void)
 {
 	struct iter_forwards* fwd = (struct iter_forwards*)calloc(1,
@@ -95,10 +95,10 @@ static void fwd_del_tree(struct iter_forwards* fwd)
 	free(fwd->tree);
 }
 
-void 
+void
 forwards_delete(struct iter_forwards* fwd)
 {
-	if(!fwd) 
+	if(!fwd)
 		return;
 	fwd_del_tree(fwd);
 	free(fwd);
@@ -106,7 +106,7 @@ forwards_delete(struct iter_forwards* fwd)
 
 /** insert info into forward structure */
 static int
-forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm, 
+forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 	size_t nmlen, int nmlabs, struct delegpt* dp)
 {
 	struct iter_forward_zone* node = (struct iter_forward_zone*)malloc(
@@ -175,7 +175,7 @@ fwd_init_parents(struct iter_forwards* fwd)
 }
 
 /** set zone name */
-static struct delegpt* 
+static struct delegpt*
 read_fwds_name(struct config_stub* s)
 {
 	struct delegpt* dp;
@@ -211,7 +211,7 @@ read_fwds_host(struct config_stub* s, struct delegpt* dp)
 		log_assert(p->str);
 		dname = authextstrtodname(p->str, &port, &tls_auth_name);
 		if(!dname) {
-			log_err("cannot parse forward %s server name: '%s'", 
+			log_err("cannot parse forward %s server name: '%s'",
 				s->name, p->str);
 			return 0;
 		}
@@ -231,7 +231,7 @@ read_fwds_host(struct config_stub* s, struct delegpt* dp)
 }
 
 /** set fwd server addresses */
-static int 
+static int
 read_fwds_addr(struct config_stub* s, struct delegpt* dp)
 {
 	struct config_strlist* p;
@@ -241,7 +241,7 @@ read_fwds_addr(struct config_stub* s, struct delegpt* dp)
 	for(p = s->addrs; p; p = p->next) {
 		log_assert(p->str);
 		if(!authextstrtoaddr(p->str, &addr, &addrlen, &tls_auth_name)) {
-			log_err("cannot parse forward %s ip address: '%s'", 
+			log_err("cannot parse forward %s ip address: '%s'",
 				s->name, p->str);
 			return 0;
 		}
@@ -260,7 +260,7 @@ read_fwds_addr(struct config_stub* s, struct delegpt* dp)
 }
 
 /** read forwards config */
-static int 
+static int
 read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
 {
 	struct config_stub* s;
@@ -329,7 +329,7 @@ make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
 	return 1;
 }
 
-int 
+int
 forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 {
 	fwd_del_tree(fwd);
@@ -346,7 +346,7 @@ forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 	return 1;
 }
 
-struct delegpt* 
+struct delegpt*
 forwards_find(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 {
 	rbnode_type* res = NULL;
@@ -360,7 +360,7 @@ forwards_find(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 	return NULL;
 }
 
-struct delegpt* 
+struct delegpt*
 forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 {
 	/* lookup the forward zone in the tree */
@@ -394,7 +394,7 @@ forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 	return NULL;
 }
 
-struct delegpt* 
+struct delegpt*
 forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass)
 {
 	uint8_t root = 0;
@@ -451,7 +451,7 @@ forwards_next_root(struct iter_forwards* fwd, uint16_t* dclass)
 	}
 }
 
-size_t 
+size_t
 forwards_get_mem(struct iter_forwards* fwd)
 {
 	struct iter_forward_zone* p;
@@ -476,7 +476,7 @@ fwd_zone_find(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
 	return (struct iter_forward_zone*)rbtree_search(fwd->tree, &key);
 }
 
-int 
+int
 forwards_add_zone(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
 {
 	struct iter_forward_zone *z;
@@ -490,7 +490,7 @@ forwards_add_zone(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
 	return 1;
 }
 
-void 
+void
 forwards_delete_zone(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
 {
 	struct iter_forward_zone *z;
diff --git a/usr.sbin/unbound/iterator/iter_fwd.h b/usr.sbin/unbound/iterator/iter_fwd.h
index e90b74c16..72dd43478 100644
--- a/usr.sbin/unbound/iterator/iter_fwd.h
+++ b/usr.sbin/unbound/iterator/iter_fwd.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -50,7 +50,7 @@ struct delegpt;
  * Iterator forward zones structure
  */
 struct iter_forwards {
-	/** 
+	/**
 	 * Zones are stored in this tree. Sort order is specially chosen.
 	 * first sorted on qclass. Then on dname in nsec-like order, so that
 	 * a lookup on class, name will return an exact match or the closest
@@ -72,9 +72,9 @@ struct iter_forward_zone {
 	size_t namelen;
 	/** number of labels in name */
 	int namelabs;
-	/** delegation point with forward server information for this zone. 
+	/** delegation point with forward server information for this zone.
 	 * If NULL then this forward entry is used to indicate that a
-	 * stub-zone with the same name exists, and should be used. 
+	 * stub-zone with the same name exists, and should be used.
 	 * This delegation point is malloced.
 	 */
 	struct delegpt* dp;
@@ -85,7 +85,7 @@ struct iter_forward_zone {
 };
 
 /**
- * Create forwards 
+ * Create forwards
  * @return new forwards or NULL on error.
  */
 struct iter_forwards* forwards_create(void);
@@ -125,7 +125,7 @@ struct delegpt* forwards_find(struct iter_forwards* fwd, uint8_t* qname,
  * @return: A delegation point if the query has to be forwarded to that list,
  *         otherwise null.
  */
-struct delegpt* forwards_lookup(struct iter_forwards* fwd, 
+struct delegpt* forwards_lookup(struct iter_forwards* fwd,
 	uint8_t* qname, uint16_t qclass);
 
 /**
@@ -134,7 +134,7 @@ struct delegpt* forwards_lookup(struct iter_forwards* fwd,
  * @param qclass: The qclass of the query.
  * @return: A delegation point if root forward exists, otherwise null.
  */
-struct delegpt* forwards_lookup_root(struct iter_forwards* fwd, 
+struct delegpt* forwards_lookup_root(struct iter_forwards* fwd,
 	uint16_t qclass);
 
 /**
@@ -156,7 +156,7 @@ size_t forwards_get_mem(struct iter_forwards* fwd);
 int fwd_cmp(const void* k1, const void* k2);
 
 /**
- * Add zone to forward structure. For external use since it recalcs 
+ * Add zone to forward structure. For external use since it recalcs
  * the tree parents.
  * @param fwd: the forward data structure
  * @param c: class of zone
@@ -164,11 +164,11 @@ int fwd_cmp(const void* k1, const void* k2);
  *	forward zone. malloced.
  * @return false on failure (out of memory);
  */
-int forwards_add_zone(struct iter_forwards* fwd, uint16_t c, 
+int forwards_add_zone(struct iter_forwards* fwd, uint16_t c,
 	struct delegpt* dp);
 
 /**
- * Remove zone from forward structure. For external use since it 
+ * Remove zone from forward structure. For external use since it
  * recalcs the tree parents.
  * @param fwd: the forward data structure
  * @param c: class of zone
diff --git a/usr.sbin/unbound/iterator/iter_hints.c b/usr.sbin/unbound/iterator/iter_hints.c
index a60d9a6b1..573c9b55b 100644
--- a/usr.sbin/unbound/iterator/iter_hints.c
+++ b/usr.sbin/unbound/iterator/iter_hints.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -50,7 +50,7 @@
 #include "sldns/str2wire.h"
 #include "sldns/wire2str.h"
 
-struct iter_hints* 
+struct iter_hints*
 hints_create(void)
 {
 	struct iter_hints* hints = (struct iter_hints*)calloc(1,
@@ -78,10 +78,10 @@ static void hints_del_tree(struct iter_hints* hints)
 	traverse_postorder(&hints->tree, &delhintnode, NULL);
 }
 
-void 
+void
 hints_delete(struct iter_hints* hints)
 {
-	if(!hints) 
+	if(!hints)
 		return;
 	hints_del_tree(hints);
 	free(hints);
@@ -111,7 +111,7 @@ ah(struct delegpt* dp, const char* sv, const char* ip)
 }
 
 /** obtain compiletime provided root hints */
-static struct delegpt* 
+static struct delegpt*
 compile_time_root_prime(int do_ip4, int do_ip6)
 {
 	/* from:
@@ -188,7 +188,7 @@ hints_insert(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 }
 
 /** set stub name */
-static struct delegpt* 
+static struct delegpt*
 read_stubs_name(struct config_stub* s)
 {
 	struct delegpt* dp;
@@ -224,7 +224,7 @@ read_stubs_host(struct config_stub* s, struct delegpt* dp)
 		log_assert(p->str);
 		dname = authextstrtodname(p->str, &port, &tls_auth_name);
 		if(!dname) {
-			log_err("cannot parse stub %s nameserver name: '%s'", 
+			log_err("cannot parse stub %s nameserver name: '%s'",
 				s->name, p->str);
 			return 0;
 		}
@@ -244,7 +244,7 @@ read_stubs_host(struct config_stub* s, struct delegpt* dp)
 }
 
 /** set stub server addresses */
-static int 
+static int
 read_stubs_addr(struct config_stub* s, struct delegpt* dp)
 {
 	struct config_strlist* p;
@@ -254,7 +254,7 @@ read_stubs_addr(struct config_stub* s, struct delegpt* dp)
 	for(p = s->addrs; p; p = p->next) {
 		log_assert(p->str);
 		if(!authextstrtoaddr(p->str, &addr, &addrlen, &auth_name)) {
-			log_err("cannot parse stub %s ip address: '%s'", 
+			log_err("cannot parse stub %s ip address: '%s'",
 				s->name, p->str);
 			return 0;
 		}
@@ -273,7 +273,7 @@ read_stubs_addr(struct config_stub* s, struct delegpt* dp)
 }
 
 /** read stubs config */
-static int 
+static int
 read_stubs(struct iter_hints* hints, struct config_file* cfg)
 {
 	struct config_stub* s;
@@ -303,7 +303,7 @@ read_stubs(struct iter_hints* hints, struct config_file* cfg)
 }
 
 /** read root hints from file */
-static int 
+static int
 read_root_hints(struct iter_hints* hints, char* fname)
 {
 	struct sldns_file_parse_state pstate;
@@ -363,11 +363,11 @@ read_root_hints(struct iter_hints* hints, char* fname)
 			memset(&sa, 0, len);
 			sa.sin_family = AF_INET;
 			sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-			memmove(&sa.sin_addr, 
+			memmove(&sa.sin_addr,
 				sldns_wirerr_get_rdata(rr, rr_len, dname_len),
 				INET_SIZE);
 			if(!delegpt_add_target_mlc(dp, rr, dname_len,
-					(struct sockaddr_storage*)&sa, len, 
+					(struct sockaddr_storage*)&sa, len,
 					0, 0)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
@@ -380,7 +380,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 			memset(&sa, 0, len);
 			sa.sin6_family = AF_INET6;
 			sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-			memmove(&sa.sin6_addr, 
+			memmove(&sa.sin6_addr,
 				sldns_wirerr_get_rdata(rr, rr_len, dname_len),
 				INET6_SIZE);
 			if(!delegpt_add_target_mlc(dp, rr, dname_len,
@@ -416,7 +416,7 @@ stop_read:
 }
 
 /** read root hints list */
-static int 
+static int
 read_root_hints_list(struct iter_hints* hints, struct config_file* cfg)
 {
 	struct config_strlist* p;
@@ -425,7 +425,7 @@ read_root_hints_list(struct iter_hints* hints, struct config_file* cfg)
 		if(p->str && p->str[0]) {
 			char* f = p->str;
 			if(cfg->chrootdir && cfg->chrootdir[0] &&
-				strncmp(p->str, cfg->chrootdir, 
+				strncmp(p->str, cfg->chrootdir,
 				strlen(cfg->chrootdir)) == 0)
 				f += strlen(cfg->chrootdir);
 			if(!read_root_hints(hints, f))
@@ -435,12 +435,12 @@ read_root_hints_list(struct iter_hints* hints, struct config_file* cfg)
 	return 1;
 }
 
-int 
+int
 hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
 {
 	hints_del_tree(hints);
 	name_tree_init(&hints->tree);
-	
+
 	/* read root hints */
 	if(!read_root_hints_list(hints, cfg))
 		return 0;
@@ -454,7 +454,7 @@ hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
 		struct delegpt* dp = compile_time_root_prime(cfg->do_ip4,
 			cfg->do_ip6);
 		verbose(VERB_ALGO, "no config, using builtin root hints.");
-		if(!dp) 
+		if(!dp)
 			return 0;
 		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp, 0))
 			return 0;
@@ -464,7 +464,7 @@ hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
 	return 1;
 }
 
-struct delegpt* 
+struct delegpt*
 hints_lookup_root(struct iter_hints* hints, uint16_t qclass)
 {
 	uint8_t rootlab = 0;
@@ -476,8 +476,8 @@ hints_lookup_root(struct iter_hints* hints, uint16_t qclass)
 	return stub->dp;
 }
 
-struct iter_hints_stub* 
-hints_lookup_stub(struct iter_hints* hints, uint8_t* qname, 
+struct iter_hints_stub*
+hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
 	uint16_t qclass, struct delegpt* cache_dp)
 {
 	size_t len;
@@ -503,8 +503,8 @@ hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
 	 */
 	if(r->noprime && query_dname_compare(cache_dp->name, r->dp->name)==0)
 		return r; /* use this stub instead of cached dp */
-	
-	/* 
+
+	/*
 	 * If our cached delegation point is above the hint, we need to prime.
 	 */
 	if(dname_strict_subdomain(r->dp->name, r->dp->namelabs,
@@ -518,7 +518,7 @@ int hints_next_root(struct iter_hints* hints, uint16_t* qclass)
 	return name_tree_next_root(&hints->tree, qclass);
 }
 
-size_t 
+size_t
 hints_get_mem(struct iter_hints* hints)
 {
 	size_t s;
@@ -531,7 +531,7 @@ hints_get_mem(struct iter_hints* hints)
 	return s;
 }
 
-int 
+int
 hints_add_stub(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 	int noprime)
 {
@@ -547,7 +547,7 @@ hints_add_stub(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 	return 1;
 }
 
-void 
+void
 hints_delete_stub(struct iter_hints* hints, uint16_t c, uint8_t* nm)
 {
 	struct iter_hints_stub *z;
diff --git a/usr.sbin/unbound/iterator/iter_hints.h b/usr.sbin/unbound/iterator/iter_hints.h
index 06b4b9667..b0b6378b1 100644
--- a/usr.sbin/unbound/iterator/iter_hints.h
+++ b/usr.sbin/unbound/iterator/iter_hints.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -51,7 +51,7 @@ struct delegpt;
  * Iterator hints structure
  */
 struct iter_hints {
-	/** 
+	/**
 	 * Hints are stored in this tree. Sort order is specially chosen.
 	 * first sorted on qclass. Then on dname in nsec-like order, so that
 	 * a lookup on class, name will return an exact match or the closest
@@ -75,7 +75,7 @@ struct iter_hints_stub {
 };
 
 /**
- * Create hints 
+ * Create hints
  * @return new hints or NULL on error.
  */
 struct iter_hints* hints_create(void);
@@ -126,7 +126,7 @@ int hints_next_root(struct iter_hints* hints, uint16_t* qclass);
  * @return: A priming delegation point if there is a stub hint that must
  *         be primed, otherwise null.
  */
-struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints, 
+struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints,
 	uint8_t* qname, uint16_t qclass, struct delegpt* dp);
 
 /**
@@ -137,7 +137,7 @@ struct iter_hints_stub* hints_lookup_stub(struct iter_hints* hints,
 size_t hints_get_mem(struct iter_hints* hints);
 
 /**
- * Add stub to hints structure. For external use since it recalcs 
+ * Add stub to hints structure. For external use since it recalcs
  * the tree parents.
  * @param hints: the hints data structure
  * @param c: class of zone
@@ -150,7 +150,7 @@ int hints_add_stub(struct iter_hints* hints, uint16_t c, struct delegpt* dp,
 	int noprime);
 
 /**
- * Remove stub from hints structure. For external use since it 
+ * Remove stub from hints structure. For external use since it
  * recalcs the tree parents.
  * @param hints: the hints data structure
  * @param c: class of stub zone
diff --git a/usr.sbin/unbound/iterator/iter_priv.c b/usr.sbin/unbound/iterator/iter_priv.c
index 90bea1746..038bc5d87 100644
--- a/usr.sbin/unbound/iterator/iter_priv.c
+++ b/usr.sbin/unbound/iterator/iter_priv.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -86,7 +86,7 @@ static int read_addrs(struct iter_priv* priv, struct config_file* cfg)
 
 	for(p = cfg->private_address; p; p = p->next) {
 		log_assert(p->str);
-		if(!netblockstrtoaddr(p->str, UNBOUND_DNS_PORT, &addr, 
+		if(!netblockstrtoaddr(p->str, UNBOUND_DNS_PORT, &addr,
 			&addrlen, &net)) {
 			log_err("cannot parse private-address: %s", p->str);
 			return 0;
@@ -170,7 +170,7 @@ int priv_apply_cfg(struct iter_priv* priv, struct config_file* cfg)
  * @param addrlen: length of addr.
  * @return: true if the address must not be queried. false if unlisted.
  */
-static int 
+static int
 priv_lookup_addr(struct iter_priv* priv, struct sockaddr_storage* addr,
 	socklen_t addrlen)
 {
@@ -186,7 +186,7 @@ priv_lookup_addr(struct iter_priv* priv, struct sockaddr_storage* addr,
  * @param dclass: class to check.
  * @return: true if the name is OK. false if unlisted.
  */
-static int 
+static int
 priv_lookup_name(struct iter_priv* priv, sldns_buffer* pkt,
 	uint8_t* name, size_t name_len, uint16_t dclass)
 {
@@ -232,7 +232,7 @@ remove_rr(const char* str, sldns_buffer* pkt, struct rrset_parse* rrset,
 int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
-	if(priv->a.count == 0) 
+	if(priv->a.count == 0)
 		return 0; /* there are no blocked addresses */
 
 	/* see if it is a private name, that is allowed to have any */
@@ -252,12 +252,12 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 			sa.sin_family = AF_INET;
 			sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
 			for(rr = rrset->rr_first; rr; rr = rr->next) {
-				if(sldns_read_uint16(rr->ttl_data+4) 
+				if(sldns_read_uint16(rr->ttl_data+4)
 					!= INET_SIZE) {
 					prev = rr;
 					continue;
 				}
-				memmove(&sa.sin_addr, rr->ttl_data+4+2, 
+				memmove(&sa.sin_addr, rr->ttl_data+4+2,
 					INET_SIZE);
 				memmove(&addr, &sa, len);
 				if(priv_lookup_addr(priv, &addr, len)) {
@@ -275,12 +275,12 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 			sa.sin6_family = AF_INET6;
 			sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
 			for(rr = rrset->rr_first; rr; rr = rr->next) {
-				if(sldns_read_uint16(rr->ttl_data+4) 
+				if(sldns_read_uint16(rr->ttl_data+4)
 					!= INET6_SIZE) {
 					prev = rr;
 					continue;
 				}
-				memmove(&sa.sin6_addr, rr->ttl_data+4+2, 
+				memmove(&sa.sin6_addr, rr->ttl_data+4+2,
 					INET6_SIZE);
 				memmove(&addr, &sa, len);
 				if(priv_lookup_addr(priv, &addr, len)) {
@@ -290,7 +290,7 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 				}
 				prev = rr;
 			}
-		} 
+		}
 	}
 	return 0;
 }
diff --git a/usr.sbin/unbound/iterator/iter_priv.h b/usr.sbin/unbound/iterator/iter_priv.h
index 0430d57e3..523f0f6fe 100644
--- a/usr.sbin/unbound/iterator/iter_priv.h
+++ b/usr.sbin/unbound/iterator/iter_priv.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -55,13 +55,13 @@ struct rrset_parse;
 struct iter_priv {
 	/** regional for allocation */
 	struct regional* region;
-	/** 
+	/**
 	 * Tree of the address spans that are blocked.
 	 * contents of type addr_tree_node.
 	 * No further data need, only presence or absence.
 	 */
 	rbtree_type a;
-	/** 
+	/**
 	 * Tree of the domains spans that are allowed to contain
 	 * the blocked address spans.
 	 * contents of type name_tree_node.
@@ -71,7 +71,7 @@ struct iter_priv {
 };
 
 /**
- * Create priv structure 
+ * Create priv structure
  * @return new structure or NULL on error.
  */
 struct iter_priv* priv_create(void);
@@ -99,7 +99,7 @@ int priv_apply_cfg(struct iter_priv* priv, struct config_file* cfg);
  * @param rrset: the rrset to examine, A or AAAA.
  * @return true if the rrset is bad and should be removed.
  */
-int priv_rrset_bad(struct iter_priv* priv, struct sldns_buffer* pkt, 
+int priv_rrset_bad(struct iter_priv* priv, struct sldns_buffer* pkt,
 	struct rrset_parse* rrset);
 
 /**
diff --git a/usr.sbin/unbound/iterator/iter_resptype.c b/usr.sbin/unbound/iterator/iter_resptype.c
index c2b824a0f..641ebb5fe 100644
--- a/usr.sbin/unbound/iterator/iter_resptype.c
+++ b/usr.sbin/unbound/iterator/iter_resptype.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -48,8 +48,8 @@
 #include "sldns/rrdef.h"
 #include "sldns/pkthdr.h"
 
-enum response_type 
-response_type_from_cache(struct dns_msg* msg, 
+enum response_type
+response_type_from_cache(struct dns_msg* msg,
 	struct query_info* request)
 {
 	/* If the message is NXDOMAIN, then it is an ANSWER. */
@@ -57,11 +57,11 @@ response_type_from_cache(struct dns_msg* msg,
 		return RESPONSE_TYPE_ANSWER;
 	if(request->qtype == LDNS_RR_TYPE_ANY)
 		return RESPONSE_TYPE_ANSWER;
-	
+
 	/* First we look at the answer section. This can tell us if this is
 	 * CNAME or positive ANSWER. */
 	if(msg->rep->an_numrrsets > 0) {
-		/* Now look at the answer section first. 3 states: 
+		/* Now look at the answer section first. 3 states:
 		 *	o our answer is there directly,
 		 *	o our answer is there after a cname,
 		 *	o or there is just a cname. */
@@ -71,10 +71,10 @@ response_type_from_cache(struct dns_msg* msg,
 		for(i=0; i<msg->rep->an_numrrsets; i++) {
 			struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
 
-			/* If we have encountered an answer (before or 
-			 * after a CNAME), then we are done! Note that 
-			 * if qtype == CNAME then this will be noted as 
-			 * an ANSWER before it gets treated as a CNAME, 
+			/* If we have encountered an answer (before or
+			 * after a CNAME), then we are done! Note that
+			 * if qtype == CNAME then this will be noted as
+			 * an ANSWER before it gets treated as a CNAME,
 			 * as it should */
 			if(ntohs(s->rk.type) == request->qtype &&
 				ntohs(s->rk.rrset_class) == request->qclass &&
@@ -82,7 +82,7 @@ response_type_from_cache(struct dns_msg* msg,
 				return RESPONSE_TYPE_ANSWER;
 			}
 
-			/* If we have encountered a CNAME, make sure that 
+			/* If we have encountered a CNAME, make sure that
 			 * it is relevant. */
 			if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
 				query_dname_compare(mname, s->rk.dname) == 0) {
@@ -90,20 +90,20 @@ response_type_from_cache(struct dns_msg* msg,
 			}
 		}
 
-		/* if we encountered a CNAME (or a bunch of CNAMEs), and 
-		 * still got to here, then it is a CNAME response. (i.e., 
+		/* if we encountered a CNAME (or a bunch of CNAMEs), and
+		 * still got to here, then it is a CNAME response. (i.e.,
 		 * the CNAME chain didn't terminate in an answer rrset.) */
 		if(mname != request->qname) {
 			return RESPONSE_TYPE_CNAME;
 		}
 	}
 
-	/* At this point, since we don't need to detect REFERRAL or LAME 
+	/* At this point, since we don't need to detect REFERRAL or LAME
 	 * messages, it can only be an ANSWER. */
 	return RESPONSE_TYPE_ANSWER;
 }
 
-enum response_type 
+enum response_type
 response_type_from_server(int rdset,
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp)
 {
@@ -135,7 +135,7 @@ response_type_from_server(int rdset,
 		}
 		return RESPONSE_TYPE_ANSWER;
 	}
-	
+
 	/* Other response codes mean (so far) to throw the response away as
 	 * meaningless and move on to the next nameserver. */
 	if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR)
@@ -153,44 +153,44 @@ response_type_from_server(int rdset,
 		uint8_t* mname = request->qname;
 		size_t mname_len = request->qname_len;
 
-		/* Now look at the answer section first. 3 states: our 
-		 * answer is there directly, our answer is there after 
+		/* Now look at the answer section first. 3 states: our
+		 * answer is there directly, our answer is there after
 		 * a cname, or there is just a cname. */
 		for(i=0; i<msg->rep->an_numrrsets; i++) {
 			s = msg->rep->rrsets[i];
-			
-			/* if the answer section has NS rrset, and qtype ANY 
+
+			/* if the answer section has NS rrset, and qtype ANY
 		 	 * and the delegation is lower, and no CNAMEs followed,
 		 	 * this is a referral where the NS went to AN section */
 			if((request->qtype == LDNS_RR_TYPE_ANY ||
 				request->qtype == LDNS_RR_TYPE_NS) &&
 				ntohs(s->rk.type) == LDNS_RR_TYPE_NS &&
 				ntohs(s->rk.rrset_class) == request->qclass &&
-				dname_strict_subdomain_c(s->rk.dname, 
+				dname_strict_subdomain_c(s->rk.dname,
 				origzone)) {
 				if((msg->rep->flags&BIT_AA))
 					return RESPONSE_TYPE_ANSWER;
 				return RESPONSE_TYPE_REFERRAL;
 			}
 
-			/* If we have encountered an answer (before or 
-			 * after a CNAME), then we are done! Note that 
+			/* If we have encountered an answer (before or
+			 * after a CNAME), then we are done! Note that
 			 * if qtype == CNAME then this will be noted as an
-			 * ANSWER before it gets treated as a CNAME, as 
+			 * ANSWER before it gets treated as a CNAME, as
 			 * it should. */
 			if(ntohs(s->rk.type) == request->qtype &&
 				ntohs(s->rk.rrset_class) == request->qclass &&
 				query_dname_compare(mname, s->rk.dname) == 0) {
 				if((msg->rep->flags&BIT_AA))
 					return RESPONSE_TYPE_ANSWER;
-				/* If the AA bit isn't on, and we've seen 
-				 * the answer, we only provisionally say 
-				 * 'ANSWER' -- it very well could be a 
+				/* If the AA bit isn't on, and we've seen
+				 * the answer, we only provisionally say
+				 * 'ANSWER' -- it very well could be a
 				 * REFERRAL. */
 				break;
 			}
 
-			/* If we have encountered a CNAME, make sure that 
+			/* If we have encountered a CNAME, make sure that
 			 * it is relevant. */
 			if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
 				query_dname_compare(mname, s->rk.dname) == 0) {
@@ -200,15 +200,15 @@ response_type_from_server(int rdset,
 		/* not a referral, and qtype any, thus an answer */
 		if(request->qtype == LDNS_RR_TYPE_ANY)
 			return RESPONSE_TYPE_ANSWER;
-		/* if we encountered a CNAME (or a bunch of CNAMEs), and 
-		 * still got to here, then it is a CNAME response. 
+		/* if we encountered a CNAME (or a bunch of CNAMEs), and
+		 * still got to here, then it is a CNAME response.
 		 * (This is regardless of the AA bit at this point) */
 		if(mname != request->qname) {
 			return RESPONSE_TYPE_CNAME;
 		}
 	}
 
-	/* Looking at the authority section, we just look and see if 
+	/* Looking at the authority section, we just look and see if
 	 * there is a SOA record, that means a NOERROR/NODATA */
 	for(i = msg->rep->an_numrrsets; i < (msg->rep->an_numrrsets +
 		msg->rep->ns_numrrsets); i++) {
@@ -224,18 +224,18 @@ response_type_from_server(int rdset,
 			return RESPONSE_TYPE_ANSWER;
 		}
 	}
-	/* Looking at the authority section, we just look and see if 
-	 * there is a delegation NS set, turning it into a delegation. 
-	 * Otherwise, we will have to conclude ANSWER (either it is 
+	/* Looking at the authority section, we just look and see if
+	 * there is a delegation NS set, turning it into a delegation.
+	 * Otherwise, we will have to conclude ANSWER (either it is
 	 * NOERROR/NODATA, or an non-authoritative answer). */
 	for(i = msg->rep->an_numrrsets; i < (msg->rep->an_numrrsets +
 		msg->rep->ns_numrrsets); i++) {
 		s = msg->rep->rrsets[i];
 
-		/* Detect REFERRAL/LAME/ANSWER based on the relationship 
+		/* Detect REFERRAL/LAME/ANSWER based on the relationship
 		 * of the NS set to the originating zone name. */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS) {
-			/* If we are getting an NS set for the zone we 
+			/* If we are getting an NS set for the zone we
 			 * thought we were contacting, then it is an answer.*/
 			if(query_dname_compare(s->rk.dname, origzone) == 0) {
 				/* see if mistakenly a recursive server was
@@ -244,7 +244,7 @@ response_type_from_server(int rdset,
 					!(msg->rep->flags&BIT_AA) && !rdset)
 					return RESPONSE_TYPE_REC_LAME;
 				/* Or if a lame server is deployed,
-				 * which gives ns==zone delegation from cache 
+				 * which gives ns==zone delegation from cache
 				 * without AA bit as well, with nodata nosoa*/
 				/* real answer must be +AA and SOA RFC(2308),
 				 * so this is wrong, and we SERVFAIL it if
@@ -256,24 +256,24 @@ response_type_from_server(int rdset,
 					return RESPONSE_TYPE_THROWAWAY;
 				return RESPONSE_TYPE_ANSWER;
 			}
-			/* If we are getting a referral upwards (or to 
+			/* If we are getting a referral upwards (or to
 			 * the same zone), then the server is 'lame'. */
 			if(dname_subdomain_c(origzone, s->rk.dname)) {
 				if(rdset) /* forward or reclame not LAME */
 					return RESPONSE_TYPE_THROWAWAY;
 				return RESPONSE_TYPE_LAME;
 			}
-			/* If the NS set is below the delegation point we 
-			 * are on, and it is non-authoritative, then it is 
+			/* If the NS set is below the delegation point we
+			 * are on, and it is non-authoritative, then it is
 			 * a referral, otherwise it is an answer. */
 			if(dname_subdomain_c(s->rk.dname, origzone)) {
-				/* NOTE: I no longer remember in what case 
-				 * we would like this to be an answer. 
-				 * NODATA should have a SOA or nothing, 
-				 * not an NS rrset. 
-				 * True, referrals should not have the AA 
+				/* NOTE: I no longer remember in what case
+				 * we would like this to be an answer.
+				 * NODATA should have a SOA or nothing,
+				 * not an NS rrset.
+				 * True, referrals should not have the AA
 				 * bit set, but... */
-				 
+
 				/* if((msg->rep->flags&BIT_AA))
 					return RESPONSE_TYPE_ANSWER; */
 				return RESPONSE_TYPE_REFERRAL;
@@ -282,7 +282,7 @@ response_type_from_server(int rdset,
 		}
 	}
 
-	/* If we've gotten this far, this is NOERROR/NODATA (which could 
+	/* If we've gotten this far, this is NOERROR/NODATA (which could
 	 * be an entirely empty message) */
 	/* check if recursive answer; saying it has empty cache */
 	if( (msg->rep->flags&BIT_RA) && !(msg->rep->flags&BIT_AA) && !rdset)
diff --git a/usr.sbin/unbound/iterator/iter_resptype.h b/usr.sbin/unbound/iterator/iter_resptype.h
index fee9ef35f..d253c0195 100644
--- a/usr.sbin/unbound/iterator/iter_resptype.h
+++ b/usr.sbin/unbound/iterator/iter_resptype.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -50,15 +50,15 @@ struct delegpt;
  * The response type is used to interpret the response.
  */
 enum response_type {
-	/** 
-	 * 'untyped' means that the type of this response hasn't been 
-	 * assigned. 
+	/**
+	 * 'untyped' means that the type of this response hasn't been
+	 * assigned.
 	 */
 	RESPONSE_TYPE_UNTYPED   = 0,
 
-	/** 
-	 * 'answer' means that the response terminates the resolution 
-	 * process. 
+	/**
+	 * 'answer' means that the response terminates the resolution
+	 * process.
 	 */
 	RESPONSE_TYPE_ANSWER,
 
@@ -66,19 +66,19 @@ enum response_type {
 	RESPONSE_TYPE_REFERRAL,
 
 	/**
-	 * 'cname' means that the response is a cname without the final 
+	 * 'cname' means that the response is a cname without the final
 	 * answer, and thus must be restarted.
 	 */
 	RESPONSE_TYPE_CNAME,
 
 	/**
-	 * 'throwaway' means that this particular response should be 
+	 * 'throwaway' means that this particular response should be
 	 * discarded and the next nameserver should be contacted
 	 */
 	RESPONSE_TYPE_THROWAWAY,
 
 	/**
-	 * 'lame' means that this particular response indicates that 
+	 * 'lame' means that this particular response indicates that
 	 * the nameserver knew nothing about the question.
 	 */
 	RESPONSE_TYPE_LAME,
@@ -102,7 +102,7 @@ enum response_type {
  * @param request: the request that generated the response.
  * @return the response type (CNAME or ANSWER).
  */
-enum response_type response_type_from_cache(struct dns_msg* msg, 
+enum response_type response_type_from_cache(struct dns_msg* msg,
 	struct query_info* request);
 
 /**
@@ -121,7 +121,7 @@ enum response_type response_type_from_cache(struct dns_msg* msg,
  *          when the response was returned.
  * @return the response type (CNAME or ANSWER).
  */
-enum response_type response_type_from_server(int rdset, 
+enum response_type response_type_from_server(int rdset,
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp);
 
 #endif /* ITERATOR_ITER_RESPTYPE_H */
diff --git a/usr.sbin/unbound/iterator/iter_scrub.c b/usr.sbin/unbound/iterator/iter_scrub.c
index f093c1bf9..53bcd761a 100644
--- a/usr.sbin/unbound/iterator/iter_scrub.c
+++ b/usr.sbin/unbound/iterator/iter_scrub.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * This file has routine(s) for cleaning up incoming DNS messages from 
+ * This file has routine(s) for cleaning up incoming DNS messages from
  * possible useless or malicious junk in it.
  */
 #include "config.h"
@@ -60,14 +60,14 @@
 
 /** remove rrset, update loop variables */
 static void
-remove_rrset(const char* str, sldns_buffer* pkt, struct msg_parse* msg, 
+remove_rrset(const char* str, sldns_buffer* pkt, struct msg_parse* msg,
 	struct rrset_parse* prev, struct rrset_parse** rrset)
 {
 	if(verbosity >= VERB_QUERY && str
 		&& (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
 		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
 		dname_pkt_copy(pkt, buf, (*rrset)->dname);
-		log_nametypeclass(VERB_QUERY, str, buf, 
+		log_nametypeclass(VERB_QUERY, str, buf,
 			(*rrset)->type, ntohs((*rrset)->rrset_class));
 	}
 	if(prev)
@@ -108,8 +108,8 @@ has_additional(uint16_t t)
 
 /** get additional name from rrset RR, return false if no name present */
 static int
-get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr, 
-	uint8_t** nm, size_t* nmlen, sldns_buffer* pkt) 
+get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr,
+	uint8_t** nm, size_t* nmlen, sldns_buffer* pkt)
 {
 	size_t offset = 0;
 	size_t len, oldpos;
@@ -148,7 +148,7 @@ get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr,
 
 /** Place mark on rrsets in additional section they are OK */
 static void
-mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg, 
+mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 	struct rrset_parse* rrset)
 {
 	/* Mark A and AAAA for NS as appropriate additional section info. */
@@ -164,16 +164,16 @@ mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 			hashvalue_type h = pkt_hash_rrset(pkt, nm,
 				LDNS_RR_TYPE_A, rrset->rrset_class, 0);
 			struct rrset_parse* r = msgparse_hashtable_lookup(
-				msg, pkt, h, 0, nm, nmlen, 
+				msg, pkt, h, 0, nm, nmlen,
 				LDNS_RR_TYPE_A, rrset->rrset_class);
 			if(r && r->section == LDNS_SECTION_ADDITIONAL) {
 				r->flags |= RRSET_SCRUB_OK;
 			}
-			
+
 			/* mark AAAA */
-			h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_AAAA, 
+			h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_AAAA,
 				rrset->rrset_class, 0);
-			r = msgparse_hashtable_lookup(msg, pkt, h, 0, nm, 
+			r = msgparse_hashtable_lookup(msg, pkt, h, 0, nm,
 				nmlen, LDNS_RR_TYPE_AAAA, rrset->rrset_class);
 			if(r && r->section == LDNS_SECTION_ADDITIONAL) {
 				r->flags |= RRSET_SCRUB_OK;
@@ -184,7 +184,7 @@ mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 
 /** Get target name of a CNAME */
 static int
-parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname, 
+parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
 	size_t* snamelen, sldns_buffer* pkt)
 {
 	size_t oldpos, dlen;
@@ -222,15 +222,15 @@ parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
 }
 
 /** Synthesize CNAME from DNAME, false if too long */
-static int 
-synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset, 
+static int
+synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
 	uint8_t* alias, size_t* aliaslen, sldns_buffer* pkt)
 {
 	/* we already know that sname is a strict subdomain of DNAME owner */
 	uint8_t* dtarg = NULL;
 	size_t dtarglen;
 	if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen, pkt))
-		return 0; 
+		return 0;
 	if(qnamelen <= dname_rrset->dname_len)
 		return 0;
 	if(qnamelen == 0)
@@ -249,8 +249,8 @@ synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
 
 /** synthesize a CNAME rrset */
 static struct rrset_parse*
-synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias, 
-	size_t aliaslen, struct regional* region, struct msg_parse* msg, 
+synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
+	size_t aliaslen, struct regional* region, struct msg_parse* msg,
 	struct rrset_parse* rrset, struct rrset_parse* prev,
 	struct rrset_parse* nx, sldns_buffer* pkt)
 {
@@ -259,7 +259,7 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 	if(!cn)
 		return NULL;
 	memset(cn, 0, sizeof(*cn));
-	cn->rr_first = (struct rr_parse*)regional_alloc(region, 
+	cn->rr_first = (struct rr_parse*)regional_alloc(region,
 		sizeof(struct rr_parse));
 	if(!cn->rr_first)
 		return NULL;
@@ -279,7 +279,7 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 	/* allocate TTL + rdatalen + uncompressed dname */
 	memset(cn->rr_first, 0, sizeof(struct rr_parse));
 	cn->rr_first->outside_packet = 1;
-	cn->rr_first->ttl_data = (uint8_t*)regional_alloc(region, 
+	cn->rr_first->ttl_data = (uint8_t*)regional_alloc(region,
 		sizeof(uint32_t)+sizeof(uint16_t)+aliaslen);
 	if(!cn->rr_first->ttl_data)
 		return NULL;
@@ -341,7 +341,7 @@ soa_in_auth(struct msg_parse* msg)
 	struct rrset_parse* rrset;
 	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
 		if(rrset->type == LDNS_RR_TYPE_SOA &&
-			rrset->section == LDNS_SECTION_AUTHORITY) 
+			rrset->section == LDNS_SECTION_AUTHORITY)
 			return 1;
 	return 0;
 }
@@ -358,7 +358,7 @@ soa_in_auth(struct msg_parse* msg)
  * @return 0 on error.
  */
 static int
-scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, 
+scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, struct regional* region)
 {
 	uint8_t* sname = qinfo->qname;
@@ -378,7 +378,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if(rrset->type == LDNS_RR_TYPE_DNAME && 
+		if(rrset->type == LDNS_RR_TYPE_DNAME &&
 			pkt_strict_sub(pkt, sname, rrset->dname)) {
 			/* check if next rrset is correct CNAME. else,
 			 * synthesize a CNAME */
@@ -387,17 +387,17 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			size_t aliaslen = 0;
 			if(rrset->rr_count != 1) {
 				verbose(VERB_ALGO, "Found DNAME rrset with "
-					"size > 1: %u", 
+					"size > 1: %u",
 					(unsigned)rrset->rr_count);
 				return 0;
 			}
-			if(!synth_cname(sname, snamelen, rrset, alias, 
+			if(!synth_cname(sname, snamelen, rrset, alias,
 				&aliaslen, pkt)) {
 				verbose(VERB_ALGO, "synthesized CNAME "
 					"too long");
 				return 0;
 			}
-			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
+			if(nx && nx->type == LDNS_RR_TYPE_CNAME &&
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
 				uint8_t* t = NULL;
@@ -413,13 +413,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				/* synth ourselves */
 			}
 			/* synth a CNAME rrset */
-			prev = synth_cname_rrset(&sname, &snamelen, alias, 
+			prev = synth_cname_rrset(&sname, &snamelen, alias,
 				aliaslen, region, msg, rrset, rrset, nx, pkt);
 			if(!prev) {
 				log_err("out of memory synthesizing CNAME");
 				return 0;
 			}
-			/* FIXME: resolve the conflict between synthesized 
+			/* FIXME: resolve the conflict between synthesized
 			 * CNAME ttls and the cache. */
 			rrset = nx;
 			continue;
@@ -428,7 +428,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 
 		/* The only records in the ANSWER section not allowed to */
 		if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
-			remove_rrset("normalize: removing irrelevant RRset:", 
+			remove_rrset("normalize: removing irrelevant RRset:",
 				pkt, msg, prev, &rrset);
 			continue;
 		}
@@ -442,7 +442,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				nx->type == LDNS_RR_TYPE_DNAME &&
 				nx->rr_count == 1 &&
 				pkt_strict_sub(pkt, sname, nx->dname)) {
-				/* there is a DNAME after this CNAME, it 
+				/* there is a DNAME after this CNAME, it
 				 * is in the ANSWER section, and the DNAME
 				 * applies to the name we cover */
 				/* check if the alias of the DNAME equals
@@ -492,9 +492,9 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 		}
 
 		/* Otherwise, make sure that the RRset matches the qtype. */
-		if(qinfo->qtype != LDNS_RR_TYPE_ANY && 
+		if(qinfo->qtype != LDNS_RR_TYPE_ANY &&
 			qinfo->qtype != rrset->type) {
-			remove_rrset("normalize: removing irrelevant RRset:", 
+			remove_rrset("normalize: removing irrelevant RRset:",
 				pkt, msg, prev, &rrset);
 			continue;
 		}
@@ -504,7 +504,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 		 * will be removed by sanitize, so no additional for them */
 		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
 			mark_additional_rrset(pkt, msg, rrset);
-		
+
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -572,13 +572,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	}
 
 	/* For each record in the additional section, remove it if it is an
-	 * address record and not in the collection of additional names 
+	 * address record and not in the collection of additional names
 	 * found in ANSWER and AUTHORITY. */
 	/* These records have not been marked OK previously */
 	while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
 		/* FIXME: what about other types? */
-		if(rrset->type==LDNS_RR_TYPE_A || 
-			rrset->type==LDNS_RR_TYPE_AAAA) 
+		if(rrset->type==LDNS_RR_TYPE_A ||
+			rrset->type==LDNS_RR_TYPE_AAAA)
 		{
 			if((rrset->flags & RRSET_SCRUB_OK)) {
 				/* remove flag to clean up flags variable */
@@ -589,7 +589,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
-		if(rrset->type==LDNS_RR_TYPE_DNAME || 
+		if(rrset->type==LDNS_RR_TYPE_DNAME ||
 			rrset->type==LDNS_RR_TYPE_CNAME ||
 			rrset->type==LDNS_RR_TYPE_NS) {
 			remove_rrset("normalize: removing irrelevant "
@@ -599,14 +599,14 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
-	
+
 	return 1;
 }
 
 /**
  * Store potential poison in the cache (only if hardening disabled).
  * The rrset is stored in the cache but removed from the message.
- * So that it will be used for infrastructure purposes, but not be 
+ * So that it will be used for infrastructure purposes, but not be
  * returned to the client.
  * @param pkt: packet
  * @param msg: message parsed
@@ -694,7 +694,7 @@ static int sanitize_nsec_is_overreach(sldns_buffer* pkt,
  * @return 0 on error.
  */
 static int
-scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, 
+scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
 	struct iter_env* ie)
 {
@@ -705,17 +705,17 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	rrset = msg->rrset_first;
 
 	/* the first DNAME is allowed to stay. It needs checking before
-	 * it can be used from the cache. After normalization, an initial 
+	 * it can be used from the cache. After normalization, an initial
 	 * DNAME will have a correctly synthesized CNAME after it. */
-	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME && 
+	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME &&
 		rrset->section == LDNS_SECTION_ANSWER &&
 		pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
 		pkt_sub(pkt, rrset->dname, zonename)) {
 		prev = rrset; /* DNAME allowed to stay in answer section */
 		rrset = rrset->rrset_all_next;
 	}
-	
-	/* remove all records from the answer section that are 
+
+	/* remove all records from the answer section that are
 	 * not the same domain name as the query domain name.
 	 * The answer section should contain rrsets with the same name
 	 * as the question. For DNAMEs a CNAME has been synthesized.
@@ -733,19 +733,19 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		rrset = rrset->rrset_all_next;
 	}
 
-	/* At this point, we brutally remove ALL rrsets that aren't 
-	 * children of the originating zone. The idea here is that, 
-	 * as far as we know, the server that we contacted is ONLY 
-	 * authoritative for the originating zone. It, of course, MAY 
-	 * be authoritative for any other zones, and of course, MAY 
-	 * NOT be authoritative for some subdomains of the originating 
+	/* At this point, we brutally remove ALL rrsets that aren't
+	 * children of the originating zone. The idea here is that,
+	 * as far as we know, the server that we contacted is ONLY
+	 * authoritative for the originating zone. It, of course, MAY
+	 * be authoritative for any other zones, and of course, MAY
+	 * NOT be authoritative for some subdomains of the originating
 	 * zone. */
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset) {
 
 		/* remove private addresses */
-		if( (rrset->type == LDNS_RR_TYPE_A || 
+		if( (rrset->type == LDNS_RR_TYPE_A ||
 			rrset->type == LDNS_RR_TYPE_AAAA)) {
 
 			/* do not set servfail since this leads to too
@@ -757,23 +757,23 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
-		
-		/* skip DNAME records -- they will always be followed by a 
+
+		/* skip DNAME records -- they will always be followed by a
 		 * synthesized CNAME, which will be relevant.
-		 * FIXME: should this do something differently with DNAME 
+		 * FIXME: should this do something differently with DNAME
 		 * rrsets NOT in Section.ANSWER? */
 		/* But since DNAME records are also subdomains of the zone,
 		 * same check can be used */
 
 		if(!pkt_sub(pkt, rrset->dname, zonename)) {
-			if(msg->an_rrsets == 0 && 
-				rrset->type == LDNS_RR_TYPE_NS && 
+			if(msg->an_rrsets == 0 &&
+				rrset->type == LDNS_RR_TYPE_NS &&
 				rrset->section == LDNS_SECTION_AUTHORITY &&
-				FLAGS_GET_RCODE(msg->flags) == 
+				FLAGS_GET_RCODE(msg->flags) ==
 				LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
 				sub_of_pkt(pkt, zonename, rrset->dname)) {
 				/* noerror, nodata and this NS rrset is above
-				 * the zone. This is LAME! 
+				 * the zone. This is LAME!
 				 * Leave in the NS for lame classification. */
 				/* remove everything from the additional
 				 * (we dont want its glue that was approved
@@ -783,7 +783,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 				rrset->type == LDNS_RR_TYPE_A ||
 				rrset->type == LDNS_RR_TYPE_AAAA)) {
 				/* store in cache! Since it is relevant
-				 * (from normalize) it will be picked up 
+				 * (from normalize) it will be picked up
 				 * from the cache to be used later */
 				store_rrset(pkt, msg, env, rrset);
 				remove_rrset("sanitize: storing potential "
@@ -814,22 +814,22 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	return 1;
 }
 
-int 
-scrub_message(sldns_buffer* pkt, struct msg_parse* msg, 
+int
+scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct regional* region,
 	struct module_env* env, struct iter_env* ie)
 {
 	/* basic sanity checks */
-	log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS, 
+	log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS,
 		qinfo->qclass);
 	if(msg->qdcount > 1)
 		return 0;
 	if( !(msg->flags&BIT_QR) )
 		return 0;
 	msg->flags &= ~(BIT_AD|BIT_Z); /* force off bit AD and Z */
-	
+
 	/* make sure that a query is echoed back when NOERROR or NXDOMAIN */
-	/* this is not required for basic operation but is a forgery 
+	/* this is not required for basic operation but is a forgery
 	 * resistance (security) feature */
 	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
 		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
diff --git a/usr.sbin/unbound/iterator/iter_scrub.h b/usr.sbin/unbound/iterator/iter_scrub.h
index cbbaf73c9..2756c1a8e 100644
--- a/usr.sbin/unbound/iterator/iter_scrub.h
+++ b/usr.sbin/unbound/iterator/iter_scrub.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * This file has routine(s) for cleaning up incoming DNS messages from 
+ * This file has routine(s) for cleaning up incoming DNS messages from
  * possible useless or malicious junk in it.
  */
 
@@ -58,11 +58,11 @@ struct iter_env;
  * @param zonename: the name of the last delegation point.
  *	Used to determine out of bailiwick information.
  * @param regional: where to allocate (new) parts of the message.
- * @param env: module environment with config settings and cache. 
+ * @param env: module environment with config settings and cache.
  * @param ie: iterator module environment data.
  * @return: false if the message is total waste. true if scrubbed with success.
  */
-int scrub_message(struct sldns_buffer* pkt, struct msg_parse* msg, 
+int scrub_message(struct sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct regional* regional,
 	struct module_env* env, struct iter_env* ie);
 
diff --git a/usr.sbin/unbound/iterator/iter_utils.h b/usr.sbin/unbound/iterator/iter_utils.h
index 850be96a6..49698bcdf 100644
--- a/usr.sbin/unbound/iterator/iter_utils.h
+++ b/usr.sbin/unbound/iterator/iter_utils.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -37,7 +37,7 @@
  * \file
  *
  * This file contains functions to assist the iterator module.
- * Configuration options. Forward zones. 
+ * Configuration options. Forward zones.
  */
 
 #ifndef ITERATOR_ITER_UTILS_H
@@ -84,7 +84,7 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  * Select a valid, nice target to send query to.
  * Sorting and removing unsuitable targets is combined.
  *
- * @param iter_env: iterator module global state, with ip6 enabled and 
+ * @param iter_env: iterator module global state, with ip6 enabled and
  *	do-not-query-addresses.
  * @param env: environment with infra cache (lameness, rtt info).
  * @param dp: delegation point with result list.
@@ -105,8 +105,8 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  * @return best target or NULL if no target.
  *	if not null, that target is removed from the result list in the dp.
  */
-struct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 
-	struct module_env* env, struct delegpt* dp, uint8_t* name, 
+struct delegpt_addr* iter_server_selection(struct iter_env* iter_env,
+	struct module_env* env, struct delegpt* dp, uint8_t* name,
 	size_t namelen, uint16_t qtype, int* dnssec_lame,
 	int* chase_to_rd, int open_target, struct sock_list* blacklist,
 	time_t prefetch);
@@ -118,7 +118,7 @@ struct delegpt_addr* iter_server_selection(struct iter_env* iter_env,
  * @param regional: regional to use for allocation.
  * @return newly allocated dns_msg, or NULL on memory error.
  */
-struct dns_msg* dns_alloc_msg(struct sldns_buffer* pkt, struct msg_parse* msg, 
+struct dns_msg* dns_alloc_msg(struct sldns_buffer* pkt, struct msg_parse* msg,
 	struct regional* regional);
 
 /**
@@ -180,7 +180,7 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
 	struct delegpt* dp);
 
 /**
- * See if delegation is useful or offers immediately no targets for 
+ * See if delegation is useful or offers immediately no targets for
  * further recursion.
  * @param qinfo: query name and type
  * @param qflags: query flags with RD flag
@@ -191,7 +191,7 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
  * 	if not, then the IPv6 addresses are useless.
  * @return true if dp is useless.
  */
-int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
+int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
 	struct delegpt* dp, int supports_ipv4, int supports_ipv6);
 
 /**
@@ -206,7 +206,7 @@ int iter_qname_indicates_dnssec(struct module_env* env,
 	struct query_info *qinfo);
 
 /**
- * See if delegation is expected to have DNSSEC information (RRSIGs) in 
+ * See if delegation is expected to have DNSSEC information (RRSIGs) in
  * its answers, or not. Inspects delegation point (name), trust anchors,
  * and delegation message (DS RRset) to determine this.
  * @param env: module env with trust anchors.
@@ -220,8 +220,8 @@ int iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
 
 /**
  * See if a message contains DNSSEC.
- * This is examined by looking for RRSIGs. With DNSSEC a valid answer, 
- * nxdomain, nodata, referral or cname reply has RRSIGs in answer or auth 
+ * This is examined by looking for RRSIGs. With DNSSEC a valid answer,
+ * nxdomain, nodata, referral or cname reply has RRSIGs in answer or auth
  * sections, sigs on answer data, SOA, DS, or NSEC/NSEC3 records.
  * @param msg: message to examine.
  * @return true if DNSSEC information was found.
@@ -240,7 +240,7 @@ int iter_msg_has_dnssec(struct dns_msg* msg);
  * @return true if message is certain to be from zone in dp->name.
  *	false if not sure (empty msg), or not from the zone.
  */
-int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp, 
+int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
 	enum response_type type, uint16_t dclass);
 
 /**
@@ -272,14 +272,14 @@ void caps_strip_reply(struct reply_info* rep);
 int caps_failed_rcode(struct reply_info* rep);
 
 /**
- * Store parent-side rrset in separate rrset cache entries for later 
- * last-resort * lookups in case the child-side versions of this information 
+ * Store parent-side rrset in separate rrset cache entries for later
+ * last-resort * lookups in case the child-side versions of this information
  * fails.
  * @param env: environment with cache, time, ...
  * @param rrset: the rrset to store (copied).
  * Failure to store is logged, but otherwise ignored.
  */
-void iter_store_parentside_rrset(struct module_env* env, 
+void iter_store_parentside_rrset(struct module_env* env,
 	struct ub_packed_rrset_key* rrset);
 
 /**
@@ -298,7 +298,7 @@ void iter_store_parentside_NS(struct module_env* env, struct reply_info* rep);
  * @param rep: delegation response or answer response, to glean TTL from.
  * (malloc) failure is logged but otherwise ignored.
  */
-void iter_store_parentside_neg(struct module_env* env, 
+void iter_store_parentside_neg(struct module_env* env,
 	struct query_info* qinfo, struct reply_info* rep);
 
 /**
@@ -310,7 +310,7 @@ void iter_store_parentside_neg(struct module_env* env,
  * @param region: region to alloc result in.
  * @param qinfo: pertinent information, the qclass.
  * @return false on malloc failure.
- *	if true, the routine worked and if such cached information 
+ *	if true, the routine worked and if such cached information
  *	existed dp->has_parent_side_NS is set true.
  */
 int iter_lookup_parent_NS_from_cache(struct module_env* env,
@@ -376,7 +376,7 @@ void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old,
 	int outbound_msg_retry);
 
 /**
- * See if a DS response (type ANSWER) is too low: a nodata answer with 
+ * See if a DS response (type ANSWER) is too low: a nodata answer with
  * a SOA record in the authority section at-or-below the qchase.qname.
  * Also returns true if we are not sure (i.e. empty message, CNAME nosig).
  * @param msg: the response.
@@ -395,7 +395,7 @@ int iter_ds_toolow(struct dns_msg* msg, struct delegpt* dp);
  */
 int iter_dp_cangodown(struct query_info* qinfo, struct delegpt* dp);
 
-/** 
+/**
  * Lookup if no_cache is set in stub or fwd.
  * @param qstate: query state with env with hints and fwds.
  * @param qinf: query name to lookup for.
diff --git a/usr.sbin/unbound/iterator/iterator.c b/usr.sbin/unbound/iterator/iterator.c
index 2f3ad06fe..09cd67c94 100644
--- a/usr.sbin/unbound/iterator/iterator.c
+++ b/usr.sbin/unbound/iterator/iterator.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -78,7 +78,7 @@ int BLACKLIST_PENALTY = (120000*4);
 
 static void target_count_increase_nx(struct iter_qstate* iq, int num);
 
-int 
+int
 iter_init(struct module_env* env, int id)
 {
 	struct iter_env* iter_env = (struct iter_env*)calloc(1,
@@ -112,7 +112,7 @@ caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d))
 	}
 }
 
-void 
+void
 iter_deinit(struct module_env* env, int id)
 {
 	struct iter_env* iter_env;
@@ -138,7 +138,7 @@ iter_new(struct module_qstate* qstate, int id)
 	struct iter_qstate* iq = (struct iter_qstate*)regional_alloc(
 		qstate->region, sizeof(struct iter_qstate));
 	qstate->minfo[id] = iq;
-	if(!iq) 
+	if(!iq)
 		return 0;
 	memset(iq, 0, sizeof(*iq));
 	iq->state = INIT_REQUEST_STATE;
@@ -171,7 +171,7 @@ iter_new(struct module_qstate* qstate, int id)
 		iq->minimisation_state = INIT_MINIMISE_STATE;
 	else
 		iq->minimisation_state = DONOT_MINIMISE_STATE;
-	
+
 	memset(&iq->qinfo_out, 0, sizeof(struct query_info));
 	return 1;
 }
@@ -235,9 +235,9 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
 		/* mark address as failed. */
 		struct delegpt_ns* dpns = NULL;
-		super_iq->num_target_queries--; 
+		super_iq->num_target_queries--;
 		if(super_iq->dp)
-			dpns = delegpt_find_ns(super_iq->dp, 
+			dpns = delegpt_find_ns(super_iq->dp,
 				qstate->qinfo.qname, qstate->qinfo.qname_len);
 		if(!dpns) {
 			/* not interested */
@@ -266,7 +266,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		super_iq->dp = NULL;
 	}
 	/* evaluate targets again */
-	super_iq->state = QUERYTARGETS_STATE; 
+	super_iq->state = QUERYTARGETS_STATE;
 	/* super becomes runnable, and will process this change */
 }
 
@@ -276,12 +276,12 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
  * @param id: module id
  * @param rcode: error code (DNS errcode).
  * @return: 0 for use by caller, to make notation easy, like:
- * 	return error_response(..). 
+ * 	return error_response(..).
  */
 static int
 error_response(struct module_qstate* qstate, int id, int rcode)
 {
-	verbose(VERB_QUERY, "return error response %s", 
+	verbose(VERB_QUERY, "return error response %s",
 		sldns_lookup_by_id(sldns_rcodes, rcode)?
 		sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
 	qstate->return_rcode = rcode;
@@ -297,7 +297,7 @@ error_response(struct module_qstate* qstate, int id, int rcode)
  * @param id: module id
  * @param rcode: error code (DNS errcode).
  * @return: 0 for use by caller, to make notation easy, like:
- * 	return error_response(..). 
+ * 	return error_response(..).
  */
 static int
 error_response_cache(struct module_qstate* qstate, int id, int rcode)
@@ -362,7 +362,7 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 				}
 				lock_rw_unlock(&msg->entry.lock);
 			}
-			
+
 		}
 		memset(&err, 0, sizeof(err));
 		err.flags = (uint16_t)(BIT_QR | BIT_RA);
@@ -399,7 +399,7 @@ prepend_is_duplicate(struct ub_packed_rrset_key** sets, size_t to,
 
 /** prepend the prepend list in the answer and authority section of dns_msg */
 static int
-iter_prepend(struct iter_qstate* iq, struct dns_msg* msg, 
+iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 	struct regional* region)
 {
 	struct iter_prep_list* p;
@@ -416,7 +416,7 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 		msg->rep->rrset_count > RR_COUNT_MAX) return 0; /* overflow */
 	sets = regional_alloc(region, (num_an+num_ns+msg->rep->rrset_count) *
 		sizeof(struct ub_packed_rrset_key*));
-	if(!sets) 
+	if(!sets)
 		return 0;
 	/* ANSWER section */
 	num_an = 0;
@@ -432,15 +432,15 @@ iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
 	for(p = iq->ns_prepend_list; p; p = p->next) {
 		if(prepend_is_duplicate(sets+msg->rep->an_numrrsets+num_an,
 			num_ns, p->rrset) || prepend_is_duplicate(
-			msg->rep->rrsets+msg->rep->an_numrrsets, 
+			msg->rep->rrsets+msg->rep->an_numrrsets,
 			msg->rep->ns_numrrsets, p->rrset))
 			continue;
 		sets[msg->rep->an_numrrsets + num_an + num_ns++] = p->rrset;
 		if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl)
 			msg->rep->ttl = ub_packed_rrset_ttl(p->rrset);
 	}
-	memcpy(sets + num_an + msg->rep->an_numrrsets + num_ns, 
-		msg->rep->rrsets + msg->rep->an_numrrsets, 
+	memcpy(sets + num_an + msg->rep->an_numrrsets + num_ns,
+		msg->rep->rrsets + msg->rep->an_numrrsets,
 		(msg->rep->ns_numrrsets + msg->rep->ar_numrrsets) *
 		sizeof(struct ub_packed_rrset_key*));
 
@@ -549,13 +549,13 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	*mname = iq->qchase.qname;
 	*mname_len = iq->qchase.qname_len;
 
-	/* Iterate over the ANSWER rrsets in order, looking for CNAMEs and 
+	/* Iterate over the ANSWER rrsets in order, looking for CNAMEs and
 	 * DNAMES. */
 	for(i=0; i<msg->rep->an_numrrsets; i++) {
 		struct ub_packed_rrset_key* r = msg->rep->rrsets[i];
 		/* If there is a (relevant) DNAME, add it to the list.
-		 * We always expect there to be CNAME that was generated 
-		 * by this DNAME following, so we don't process the DNAME 
+		 * We always expect there to be CNAME that was generated
+		 * by this DNAME following, so we don't process the DNAME
 		 * directly.  */
 		if(ntohs(r->rk.type) == LDNS_RR_TYPE_DNAME &&
 			dname_strict_subdomain_c(*mname, r->rk.dname) &&
@@ -743,9 +743,9 @@ target_count_increase_nx(struct iter_qstate* iq, int num)
  * @return false on error (malloc).
  */
 static int
-generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype, 
+generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	uint16_t qclass, struct module_qstate* qstate, int id,
-	struct iter_qstate* iq, enum iter_state initial_state, 
+	struct iter_qstate* iq, enum iter_state initial_state,
 	enum iter_state finalstate, struct module_qstate** subq_ret, int v,
 	int detached)
 {
@@ -765,15 +765,15 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	 * state. */
 	if(initial_state == INIT_REQUEST_STATE)
 		qflags |= BIT_RD;
-	/* We set the CD flag so we can send this through the "head" of 
-	 * the resolution chain, which might have a validator. We are 
-	 * uninterested in validating things not on the direct resolution 
+	/* We set the CD flag so we can send this through the "head" of
+	 * the resolution chain, which might have a validator. We are
+	 * uninterested in validating things not on the direct resolution
 	 * path.  */
 	if(!v) {
 		qflags |= BIT_CD;
 		valrec = 1;
 	}
-	
+
 	if(detached) {
 		struct mesh_state* sub = NULL;
 		fptr_ok(fptr_whitelist_modenv_add_sub(
@@ -797,7 +797,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		/* initialise the new subquery */
 		subq->curmod = id;
 		subq->ext_state[id] = module_state_initial;
-		subq->minfo[id] = regional_alloc(subq->region, 
+		subq->minfo[id] = regional_alloc(subq->region,
 			sizeof(struct iter_qstate));
 		if(!subq->minfo[id]) {
 			log_err("init subq: out of memory");
@@ -847,7 +847,7 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 {
 	struct delegpt* dp;
 	struct module_qstate* subq;
-	verbose(VERB_DETAIL, "priming . %s NS", 
+	verbose(VERB_DETAIL, "priming . %s NS",
 		sldns_lookup_by_id(sldns_rr_classes, (int)qclass)?
 		sldns_lookup_by_id(sldns_rr_classes, (int)qclass)->name:"??");
 	dp = hints_lookup_root(qstate->env->hints, qclass);
@@ -855,19 +855,19 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 		verbose(VERB_ALGO, "Cannot prime due to lack of hints");
 		return 0;
 	}
-	/* Priming requests start at the QUERYTARGETS state, skipping 
+	/* Priming requests start at the QUERYTARGETS state, skipping
 	 * the normal INIT state logic (which would cause an infloop). */
-	if(!generate_sub_request((uint8_t*)"\000", 1, LDNS_RR_TYPE_NS, 
+	if(!generate_sub_request((uint8_t*)"\000", 1, LDNS_RR_TYPE_NS,
 		qclass, qstate, id, iq, QUERYTARGETS_STATE, PRIME_RESP_STATE,
 		&subq, 0, 0)) {
 		verbose(VERB_ALGO, "could not prime root");
 		return 0;
 	}
 	if(subq) {
-		struct iter_qstate* subiq = 
+		struct iter_qstate* subiq =
 			(struct iter_qstate*)subq->minfo[id];
 		/* Set the initial delegation point to the hint.
-		 * copy dp, it is now part of the root prime query. 
+		 * copy dp, it is now part of the root prime query.
 		 * dp was part of in the fixed hints structure. */
 		subiq->dp = delegpt_copy(dp, subq->region);
 		if(!subiq->dp) {
@@ -878,11 +878,11 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 			return 0;
 		}
 		/* there should not be any target queries. */
-		subiq->num_target_queries = 0; 
+		subiq->num_target_queries = 0;
 		subiq->dnssec_expected = iter_indicates_dnssec(
 			qstate->env, subiq->dp, NULL, subq->qinfo.qclass);
 	}
-	
+
 	/* this module stops, our submodule starts, and does the query. */
 	qstate->ext_state[id] = module_wait_subquery;
 	return 1;
@@ -906,7 +906,7 @@ static int
 prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 	uint8_t* qname, uint16_t qclass)
 {
-	/* Lookup the stub hint. This will return null if the stub doesn't 
+	/* Lookup the stub hint. This will return null if the stub doesn't
 	 * need to be re-primed. */
 	struct iter_hints_stub* stub;
 	struct delegpt* stub_dp;
@@ -920,7 +920,7 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 	stub_dp = stub->dp;
 	/* if we have an auth_zone dp, and stub is equal, don't prime stub
 	 * yet, unless we want to fallback and avoid the auth_zone */
-	if(!iq->auth_zone_avoid && iq->dp && iq->dp->auth_dp && 
+	if(!iq->auth_zone_avoid && iq->dp && iq->dp->auth_dp &&
 		query_dname_compare(iq->dp->name, stub_dp->name) == 0)
 		return 0;
 
@@ -937,18 +937,18 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 			return 1; /* return 1 to make module stop, with error */
 		}
-		log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name, 
+		log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name,
 			LDNS_RR_TYPE_NS, qclass);
 		return r;
 	}
 
 	/* Otherwise, we need to (re)prime the stub. */
-	log_nametypeclass(VERB_DETAIL, "priming stub", stub_dp->name, 
+	log_nametypeclass(VERB_DETAIL, "priming stub", stub_dp->name,
 		LDNS_RR_TYPE_NS, qclass);
 
 	/* Stub priming events start at the QUERYTARGETS state to avoid the
 	 * redundant INIT state processing. */
-	if(!generate_sub_request(stub_dp->name, stub_dp->namelen, 
+	if(!generate_sub_request(stub_dp->name, stub_dp->namelen,
 		LDNS_RR_TYPE_NS, qclass, qstate, id, iq,
 		QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0, 0)) {
 		verbose(VERB_ALGO, "could not prime stub");
@@ -957,7 +957,7 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 		return 1; /* return 1 to make module stop, with error */
 	}
 	if(subq) {
-		struct iter_qstate* subiq = 
+		struct iter_qstate* subiq =
 			(struct iter_qstate*)subq->minfo[id];
 
 		/* Set the initial delegation point to the hint. */
@@ -972,15 +972,15 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id,
 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 			return 1; /* return 1 to make module stop, with error */
 		}
-		/* there should not be any target queries -- although there 
-		 * wouldn't be anyway, since stub hints never have 
+		/* there should not be any target queries -- although there
+		 * wouldn't be anyway, since stub hints never have
 		 * missing targets. */
-		subiq->num_target_queries = 0; 
+		subiq->num_target_queries = 0;
 		subiq->wait_priming_stub = 1;
 		subiq->dnssec_expected = iter_indicates_dnssec(
 			qstate->env, subiq->dp, NULL, subq->qinfo.qclass);
 	}
-	
+
 	/* this module stops, our submodule starts, and does the query. */
 	qstate->ext_state[id] = module_wait_subquery;
 	return 1;
@@ -1087,7 +1087,7 @@ auth_zone_delegpt(struct module_qstate* qstate, struct iter_qstate* iq,
  * @param id: module id.
  */
 static void
-generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq, 
+generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
 	int id)
 {
 	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
@@ -1112,17 +1112,17 @@ generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* is this query the same as the A/AAAA check for it */
 		if(qstate->qinfo.qtype == ntohs(s->rk.type) &&
 			qstate->qinfo.qclass == ntohs(s->rk.rrset_class) &&
-			query_dname_compare(qstate->qinfo.qname, 
+			query_dname_compare(qstate->qinfo.qname,
 				s->rk.dname)==0 &&
-			(qstate->query_flags&BIT_RD) && 
+			(qstate->query_flags&BIT_RD) &&
 			!(qstate->query_flags&BIT_CD))
 			continue;
 
 		/* generate subrequest for it */
-		log_nametypeclass(VERB_ALGO, "schedule addr fetch", 
-			s->rk.dname, ntohs(s->rk.type), 
+		log_nametypeclass(VERB_ALGO, "schedule addr fetch",
+			s->rk.dname, ntohs(s->rk.type),
 			ntohs(s->rk.rrset_class));
-		if(!generate_sub_request(s->rk.dname, s->rk.dname_len, 
+		if(!generate_sub_request(s->rk.dname, s->rk.dname_len,
 			ntohs(s->rk.type), ntohs(s->rk.rrset_class),
 			qstate, id, iq,
 			INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) {
@@ -1165,16 +1165,16 @@ generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS)
 		return;
 
-	log_nametypeclass(VERB_ALGO, "schedule ns fetch", 
+	log_nametypeclass(VERB_ALGO, "schedule ns fetch",
 		iq->dp->name, LDNS_RR_TYPE_NS, iq->qchase.qclass);
-	if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 
+	if(!generate_sub_request(iq->dp->name, iq->dp->namelen,
 		LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq,
 		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) {
 		verbose(VERB_ALGO, "could not generate ns check");
 		return;
 	}
 	if(subq) {
-		struct iter_qstate* subiq = 
+		struct iter_qstate* subiq =
 			(struct iter_qstate*)subq->minfo[id];
 
 		/* make copy to avoid use of stub dp by different qs/threads */
@@ -1208,7 +1208,7 @@ generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
  * @param id: module id.
  */
 static void
-generate_dnskey_prefetch(struct module_qstate* qstate, 
+generate_dnskey_prefetch(struct module_qstate* qstate,
 	struct iter_qstate* iq, int id)
 {
 	struct module_qstate* subq;
@@ -1231,9 +1231,9 @@ generate_dnskey_prefetch(struct module_qstate* qstate,
 		return;
 
 	/* if the DNSKEY is in the cache this lookup will stop quickly */
-	log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch", 
+	log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch",
 		iq->dp->name, LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass);
-	if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 
+	if(!generate_sub_request(iq->dp->name, iq->dp->namelen,
 		LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass, qstate, id, iq,
 		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0)) {
 		/* we'll be slower, but it'll work */
@@ -1241,7 +1241,7 @@ generate_dnskey_prefetch(struct module_qstate* qstate,
 		return;
 	}
 	if(subq) {
-		struct iter_qstate* subiq = 
+		struct iter_qstate* subiq =
 			(struct iter_qstate*)subq->minfo[id];
 		/* this qstate has the right delegation for the dnskey lookup*/
 		/* make copy to avoid use of stub dp by different qs/threads */
@@ -1252,7 +1252,7 @@ generate_dnskey_prefetch(struct module_qstate* qstate,
 
 /**
  * See if the query needs forwarding.
- * 
+ *
  * @param qstate: query state.
  * @param iq: iterator query state.
  * @return true if the request is forwarded, false if not.
@@ -1273,17 +1273,17 @@ forward_request(struct module_qstate* qstate, struct iter_qstate* iq)
 		&& !dname_is_root(iq->qchase.qname))
 		dname_remove_label(&delname, &delnamelen);
 	dp = forwards_lookup(qstate->env->fwds, delname, iq->qchase.qclass);
-	if(!dp) 
+	if(!dp)
 		return 0;
 	/* send recursion desired to forward addr */
-	iq->chase_flags |= BIT_RD; 
+	iq->chase_flags |= BIT_RD;
 	iq->dp = delegpt_copy(dp, qstate->region);
 	/* iq->dp checked by caller */
 	verbose(VERB_ALGO, "forwarding request");
 	return 1;
 }
 
-/** 
+/**
  * Process the initial part of the request handling. This state roughly
  * corresponds to resolver algorithms steps 1 (find answer in cache) and 2
  * (find the best servers to ask).
@@ -1324,9 +1324,9 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 
-	/* We enforce a maximum recursion/dependency depth -- in general, 
-	 * this is unnecessary for dependency loops (although it will 
-	 * catch those), but it provides a sensible limit to the amount 
+	/* We enforce a maximum recursion/dependency depth -- in general,
+	 * this is unnecessary for dependency loops (although it will
+	 * catch those), but it provides a sensible limit to the amount
 	 * of work required to answer a given query. */
 	verbose(VERB_ALGO, "request has dependency depth of %d", iq->depth);
 	if(iq->depth > ie->max_dependency_depth) {
@@ -1359,7 +1359,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* This either results in a query restart (CNAME cache response), a
 	 * terminating response (ANSWER), or a cache miss (null). */
-	
+
 	if (iter_stub_fwd_no_cache(qstate, &iq->qchase, &dpname, &dpnamelen)) {
 		/* Asked to not query cache. */
 		verbose(VERB_ALGO, "no-cache set, going to the network");
@@ -1372,8 +1372,8 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_ALGO, "cache blacklisted, going to the network");
 		msg = NULL;
 	} else if(!qstate->no_cache_lookup) {
-		msg = dns_cache_lookup(qstate->env, iq->qchase.qname, 
-			iq->qchase.qname_len, iq->qchase.qtype, 
+		msg = dns_cache_lookup(qstate->env, iq->qchase.qname,
+			iq->qchase.qname_len, iq->qchase.qtype,
 			iq->qchase.qclass, qstate->query_flags,
 			qstate->region, qstate->env->scratch, 0, dpname,
 			dpnamelen);
@@ -1383,8 +1383,8 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * NOERROR/NODATA or NXDOMAIN answers that need validation */
 			msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
 				qstate->region, qstate->env->rrset_cache,
-				qstate->env->scratch_buffer, 
-				*qstate->env->now, 1/*add SOA*/, NULL, 
+				qstate->env->scratch_buffer,
+				*qstate->env->now, 1/*add SOA*/, NULL,
 				qstate->env->cfg);
 		}
 		/* item taken from cache does not match our query name, thus
@@ -1395,13 +1395,13 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	if(msg) {
 		/* handle positive cache response */
-		enum response_type type = response_type_from_cache(msg, 
+		enum response_type type = response_type_from_cache(msg,
 			&iq->qchase);
 		if(verbosity >= VERB_ALGO) {
-			log_dns_msg("msg from cache lookup", &msg->qinfo, 
+			log_dns_msg("msg from cache lookup", &msg->qinfo,
 				msg->rep);
-			verbose(VERB_ALGO, "msg ttl is %d, prefetch ttl %d", 
-				(int)msg->rep->ttl, 
+			verbose(VERB_ALGO, "msg ttl is %d, prefetch ttl %d",
+				(int)msg->rep->ttl,
 				(int)msg->rep->prefetch_ttl);
 		}
 
@@ -1410,16 +1410,16 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			size_t slen = 0;
 			verbose(VERB_ALGO, "returning CNAME response from "
 				"cache");
-			if(!handle_cname_response(qstate, iq, msg, 
+			if(!handle_cname_response(qstate, iq, msg,
 				&sname, &slen)) {
 				errinf(qstate, "failed to prepend CNAME "
 					"components, malloc failure");
-				return error_response(qstate, id, 
+				return error_response(qstate, id,
 					LDNS_RCODE_SERVFAIL);
 			}
 			iq->qchase.qname = sname;
 			iq->qchase.qname_len = slen;
-			/* This *is* a query restart, even if it is a cheap 
+			/* This *is* a query restart, even if it is a cheap
 			 * one. */
 			iq->dp = NULL;
 			iq->refetch_glue = 0;
@@ -1454,14 +1454,14 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->refetch_glue = 0;
 		iq->minimisation_state = DONOT_MINIMISE_STATE;
 		/* the request has been forwarded.
-		 * forwarded requests need to be immediately sent to the 
+		 * forwarded requests need to be immediately sent to the
 		 * next state, QUERYTARGETS. */
 		return next_state(iq, QUERYTARGETS_STATE);
 	}
 
 	/* Resolver Algorithm Step 2 -- find the "best" servers. */
 
-	/* first, adjust for DS queries. To avoid the grandparent problem, 
+	/* first, adjust for DS queries. To avoid the grandparent problem,
 	 * we just look for the closest set of server to the parent of qname.
 	 * When re-fetching glue we also need to ask the parent.
 	 */
@@ -1493,24 +1493,24 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	/* delname is the name to lookup a delegation for. If NULL rootprime */
 	while(1) {
-		
-		/* Lookup the delegation in the cache. If null, then the 
+
+		/* Lookup the delegation in the cache. If null, then the
 		 * cache needs to be primed for the qclass. */
 		if(delname)
-		     iq->dp = dns_cache_find_delegation(qstate->env, delname, 
-			delnamelen, iq->qchase.qtype, iq->qchase.qclass, 
+		     iq->dp = dns_cache_find_delegation(qstate->env, delname,
+			delnamelen, iq->qchase.qtype, iq->qchase.qclass,
 			qstate->region, &iq->deleg_msg,
 			*qstate->env->now+qstate->prefetch_leeway, 1,
 			dpname, dpnamelen);
 		else iq->dp = NULL;
 
-		/* If the cache has returned nothing, then we have a 
+		/* If the cache has returned nothing, then we have a
 		 * root priming situation. */
 		if(iq->dp == NULL) {
 			int r;
 			/* if under auth zone, no prime needed */
 			if(!auth_zone_delegpt(qstate, iq, delname, delnamelen))
-				return error_response(qstate, id, 
+				return error_response(qstate, id,
 					LDNS_RCODE_SERVFAIL);
 			if(iq->dp) /* use auth zone dp */
 				return next_state(iq, INIT_REQUEST_2_STATE);
@@ -1521,23 +1521,23 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 				break; /* got noprime-stub-zone, continue */
 			else if(r)
 				return 0; /* stub prime request made */
-			if(forwards_lookup_root(qstate->env->fwds, 
+			if(forwards_lookup_root(qstate->env->fwds,
 				iq->qchase.qclass)) {
 				/* forward zone root, no root prime needed */
 				/* fill in some dp - safety belt */
-				iq->dp = hints_lookup_root(qstate->env->hints, 
+				iq->dp = hints_lookup_root(qstate->env->hints,
 					iq->qchase.qclass);
 				if(!iq->dp) {
 					log_err("internal error: no hints dp");
 					errinf(qstate, "no hints for this class");
-					return error_response(qstate, id, 
+					return error_response(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
 				iq->dp = delegpt_copy(iq->dp, qstate->region);
 				if(!iq->dp) {
 					log_err("out of memory in safety belt");
 					errinf(qstate, "malloc failure, in safety belt");
-					return error_response(qstate, id, 
+					return error_response(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
 				return next_state(iq, INIT_REQUEST_2_STATE);
@@ -1545,12 +1545,12 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* Note that the result of this will set a new
 			 * DelegationPoint based on the result of priming. */
 			if(!prime_root(qstate, iq, id, iq->qchase.qclass))
-				return error_response(qstate, id, 
+				return error_response(qstate, id,
 					LDNS_RCODE_REFUSED);
 
-			/* priming creates and sends a subordinate query, with 
-			 * this query as the parent. So further processing for 
-			 * this event will stop until reactivated by the 
+			/* priming creates and sends a subordinate query, with
+			 * this query as the parent. So further processing for
+			 * this event will stop until reactivated by the
 			 * results of priming. */
 			return 0;
 		}
@@ -1560,17 +1560,17 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 
 		/* see if this dp not useless.
 		 * It is useless if:
-		 *	o all NS items are required glue. 
+		 *	o all NS items are required glue.
 		 *	  or the query is for NS item that is required glue.
 		 *	o no addresses are provided.
 		 *	o RD qflag is on.
 		 * Instead, go up one level, and try to get even further
-		 * If the root was useless, use safety belt information. 
+		 * If the root was useless, use safety belt information.
 		 * Only check cache returns, because replies for servers
 		 * could be useless but lead to loops (bumping into the
 		 * same server reply) if useless-checked.
 		 */
-		if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags, 
+		if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags,
 			iq->dp, ie->supports_ipv4, ie->supports_ipv6)) {
 			struct delegpt* retdp = NULL;
 			if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, iq->qchase.qclass, &retdp)) {
@@ -1595,32 +1595,32 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 				errinf(qstate, "no useful nameservers, "
 					"and cannot go up");
 				errinf_dname(qstate, "for zone", iq->dp->name);
-				return error_response(qstate, id, 
+				return error_response(qstate, id,
 					LDNS_RCODE_SERVFAIL);
 			}
 			if(dname_is_root(iq->dp->name)) {
 				/* use safety belt */
 				verbose(VERB_QUERY, "Cache has root NS but "
 				"no addresses. Fallback to the safety belt.");
-				iq->dp = hints_lookup_root(qstate->env->hints, 
+				iq->dp = hints_lookup_root(qstate->env->hints,
 					iq->qchase.qclass);
 				/* note deleg_msg is from previous lookup,
 				 * but RD is on, so it is not used */
 				if(!iq->dp) {
 					log_err("internal error: no hints dp");
-					return error_response(qstate, id, 
+					return error_response(qstate, id,
 						LDNS_RCODE_REFUSED);
 				}
 				iq->dp = delegpt_copy(iq->dp, qstate->region);
 				if(!iq->dp) {
 					log_err("out of memory in safety belt");
 					errinf(qstate, "malloc failure, in safety belt, for root");
-					return error_response(qstate, id, 
+					return error_response(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
 				break;
 			} else {
-				verbose(VERB_ALGO, 
+				verbose(VERB_ALGO,
 					"cache delegation was useless:");
 				delegpt_log(VERB_ALGO, iq->dp);
 				/* go up */
@@ -1634,12 +1634,12 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	verbose(VERB_ALGO, "cache delegation returns delegpt");
 	delegpt_log(VERB_ALGO, iq->dp);
 
-	/* Otherwise, set the current delegation point and move on to the 
+	/* Otherwise, set the current delegation point and move on to the
 	 * next state. */
 	return next_state(iq, INIT_REQUEST_2_STATE);
 }
 
-/** 
+/**
  * Process the second part of the initial request handling. This state
  * basically exists so that queries that generate root priming events have
  * the same init processing as ones that do not. Request events that reach
@@ -1660,7 +1660,7 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
 {
 	uint8_t* delname;
 	size_t delnamelen;
-	log_query_info(VERB_QUERY, "resolving (init part 2): ", 
+	log_query_info(VERB_QUERY, "resolving (init part 2): ",
 		&qstate->qinfo);
 
 	delname = iq->qchase.qname;
@@ -1677,7 +1677,7 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
 		stub = hints_lookup_stub(
 			qstate->env->hints, iq->qchase.qname, iq->qchase.qclass,
 			iq->dp);
-		if(!stub || !stub->dp->has_parent_side_NS || 
+		if(!stub || !stub->dp->has_parent_side_NS ||
 			dname_subdomain_c(iq->dp->name, stub->dp->name)) {
 			delname = iq->dp->name;
 			delnamelen = iq->dp->namelen;
@@ -1704,7 +1704,7 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
 	return next_state(iq, INIT_REQUEST_3_STATE);
 }
 
-/** 
+/**
  * Process the third part of the initial request handling. This state exists
  * as a separate state so that queries that generate stub priming events
  * will get the tail end of the init process but not repeat the stub priming
@@ -1716,28 +1716,28 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
  * @return true, advancing the event to the QUERYTARGETS_STATE.
  */
 static int
-processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq, 
+processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq,
 	int id)
 {
-	log_query_info(VERB_QUERY, "resolving (init part 3): ", 
+	log_query_info(VERB_QUERY, "resolving (init part 3): ",
 		&qstate->qinfo);
 	/* if the cache reply dp equals a validation anchor or msg has DS,
 	 * then DNSSEC RRSIGs are expected in the reply */
-	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 
+	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp,
 		iq->deleg_msg, iq->qchase.qclass);
 
-	/* If the RD flag wasn't set, then we just finish with the 
+	/* If the RD flag wasn't set, then we just finish with the
 	 * cached referral as the response. */
 	if(!(qstate->query_flags & BIT_RD) && iq->deleg_msg) {
 		iq->response = iq->deleg_msg;
 		if(verbosity >= VERB_ALGO && iq->response)
-			log_dns_msg("no RD requested, using delegation msg", 
+			log_dns_msg("no RD requested, using delegation msg",
 				&iq->response->qinfo, iq->response->rep);
 		if(qstate->reply_origin)
 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
 		return final_state(iq);
 	}
-	/* After this point, unset the RD flag -- this query is going to 
+	/* After this point, unset the RD flag -- this query is going to
 	 * be sent to an auth. server. */
 	iq->chase_flags &= ~BIT_RD;
 
@@ -1755,7 +1755,7 @@ processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq,
 }
 
 /**
- * Given a basic query, generate a parent-side "target" query. 
+ * Given a basic query, generate a parent-side "target" query.
  * These are subordinate queries for missing delegation point target addresses,
  * for which only the parent of the delegation provides correct IP addresses.
  *
@@ -1769,16 +1769,16 @@ processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq,
  * @return true on success, false on failure.
  */
 static int
-generate_parentside_target_query(struct module_qstate* qstate, 
-	struct iter_qstate* iq, int id, uint8_t* name, size_t namelen, 
+generate_parentside_target_query(struct module_qstate* qstate,
+	struct iter_qstate* iq, int id, uint8_t* name, size_t namelen,
 	uint16_t qtype, uint16_t qclass)
 {
 	struct module_qstate* subq;
-	if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 
+	if(!generate_sub_request(name, namelen, qtype, qclass, qstate,
 		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0))
 		return 0;
 	if(subq) {
-		struct iter_qstate* subiq = 
+		struct iter_qstate* subiq =
 			(struct iter_qstate*)subq->minfo[id];
 		/* blacklist the cache - we want to fetch parent stuff */
 		sock_list_insert(&subq->blacklist, NULL, 0, subq->region);
@@ -1786,19 +1786,19 @@ generate_parentside_target_query(struct module_qstate* qstate,
 		if(dname_subdomain_c(name, iq->dp->name)) {
 			subiq->dp = delegpt_copy(iq->dp, subq->region);
 			subiq->dnssec_expected = iter_indicates_dnssec(
-				qstate->env, subiq->dp, NULL, 
+				qstate->env, subiq->dp, NULL,
 				subq->qinfo.qclass);
 			subiq->refetch_glue = 1;
 		} else {
-			subiq->dp = dns_cache_find_delegation(qstate->env, 
+			subiq->dp = dns_cache_find_delegation(qstate->env,
 				name, namelen, qtype, qclass, subq->region,
 				&subiq->deleg_msg,
 				*qstate->env->now+subq->prefetch_leeway,
 				1, NULL, 0);
 			/* if no dp, then it's from root, refetch unneeded */
-			if(subiq->dp) { 
+			if(subiq->dp) {
 				subiq->dnssec_expected = iter_indicates_dnssec(
-					qstate->env, subiq->dp, NULL, 
+					qstate->env, subiq->dp, NULL,
 					subq->qinfo.qclass);
 				subiq->refetch_glue = 1;
 			}
@@ -1826,7 +1826,7 @@ generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq,
         int id, uint8_t* name, size_t namelen, uint16_t qtype, uint16_t qclass)
 {
 	struct module_qstate* subq;
-	if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 
+	if(!generate_sub_request(name, namelen, qtype, qclass, qstate,
 		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0))
 		return 0;
 	log_nametypeclass(VERB_QUERY, "new target", name, qtype, qclass);
@@ -1843,7 +1843,7 @@ generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq,
  * @param id: module id.
  * @param maxtargets: The maximum number of targets to query for.
  *	if it is negative, there is no maximum number of targets.
- * @param num: returns the number of queries generated and processed, 
+ * @param num: returns the number of queries generated and processed,
  *	which may be zero if there were no missing targets.
  * @return false on error.
  */
@@ -1913,7 +1913,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			((ns->lame && !ns->done_pside6) ||
 			(!ns->lame && !ns->got6))) {
 			/* Send the AAAA request. */
-			if(!generate_target_query(qstate, iq, id, 
+			if(!generate_target_query(qstate, iq, id,
 				ns->name, ns->namelen,
 				LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) {
 				*num = query_count;
@@ -1935,8 +1935,8 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(ie->supports_ipv4 &&
 			((ns->lame && !ns->done_pside4) ||
 			(!ns->lame && !ns->got4))) {
-			if(!generate_target_query(qstate, iq, id, 
-				ns->name, ns->namelen, 
+			if(!generate_target_query(qstate, iq, id,
+				ns->name, ns->namelen,
 				LDNS_RR_TYPE_A, iq->qchase.qclass)) {
 				*num = query_count;
 				if(query_count > 0)
@@ -1973,7 +1973,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
  * @param ie: iterator shared global environment.
  * @param id: module id.
  * @return true if the event requires more request processing immediately,
- *         false if not. 
+ *         false if not.
  */
 static int
 processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
@@ -1986,7 +1986,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen,
 		iq->qchase.qclass, NULL)) {
-		/* fail -- no more targets, no more hope of targets, no hope 
+		/* fail -- no more targets, no more hope of targets, no hope
 		 * of a response. */
 		errinf(qstate, "all the configured stub or forward servers failed,");
 		errinf_dname(qstate, "at zone", iq->dp->name);
@@ -2014,7 +2014,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->dp->has_parent_side_NS = 1;
 	} else if(!iq->dp->has_parent_side_NS) {
 		if(!iter_lookup_parent_NS_from_cache(qstate->env, iq->dp,
-			qstate->region, &qstate->qinfo) 
+			qstate->region, &qstate->qinfo)
 			|| !iq->dp->has_parent_side_NS) {
 			/* if: malloc failure in lookup go up to try */
 			/* if: no parent NS in cache - go up one level */
@@ -2032,7 +2032,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 	}
 	/* see if that makes new names available */
-	if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
+	if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
 		qstate->region, iq->dp))
 		log_err("out of memory in cache_fill_missing");
 	if(iq->dp->usable_list) {
@@ -2098,7 +2098,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* query for parent-side A and AAAA for nameservers */
 		if(ie->supports_ipv6 && !ns->done_pside6) {
 			/* Send the AAAA request. */
-			if(!generate_parentside_target_query(qstate, iq, id, 
+			if(!generate_parentside_target_query(qstate, iq, id,
 				ns->name, ns->namelen,
 				LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) {
 				errinf_dname(qstate, "could not generate nameserver AAAA lookup for", ns->name);
@@ -2119,8 +2119,8 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		if(ie->supports_ipv4 && !ns->done_pside4) {
 			/* Send the A request. */
-			if(!generate_parentside_target_query(qstate, iq, id, 
-				ns->name, ns->namelen, 
+			if(!generate_parentside_target_query(qstate, iq, id,
+				ns->name, ns->namelen,
 				LDNS_RR_TYPE_A, iq->qchase.qclass)) {
 				errinf_dname(qstate, "could not generate nameserver A lookup for", ns->name);
 				return error_response(qstate, id,
@@ -2150,18 +2150,18 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 	errinf_dname(qstate, "at zone", iq->dp->name);
 	errinf_reply(qstate, iq);
 	verbose(VERB_QUERY, "out of query targets -- returning SERVFAIL");
-	/* fail -- no more targets, no more hope of targets, no hope 
+	/* fail -- no more targets, no more hope of targets, no hope
 	 * of a response. */
 	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 }
 
-/** 
+/**
  * Try to find the NS record set that will resolve a qtype DS query. Due
  * to grandparent/grandchild reasons we did not get a proper lookup right
  * away.  We need to create type NS queries until we get the right parent
  * for this lookup.  We remove labels from the query to find the right point.
  * If we end up at the old dp name, then there is no solution.
- * 
+ *
  * @param qstate: query state.
  * @param iq: iterator query state.
  * @param id: module id.
@@ -2198,9 +2198,9 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 	iq->state = DSNS_FIND_STATE;
 
 	/* spawn NS lookup (validation not needed, this is for DS lookup) */
-	log_nametypeclass(VERB_ALGO, "fetch nameservers", 
+	log_nametypeclass(VERB_ALGO, "fetch nameservers",
 		iq->dsns_point, LDNS_RR_TYPE_NS, iq->qchase.qclass);
-	if(!generate_sub_request(iq->dsns_point, iq->dsns_point_len, 
+	if(!generate_sub_request(iq->dsns_point, iq->dsns_point_len,
 		LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq,
 		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0)) {
 		errinf_dname(qstate, "for DS query parent-child nameserver search, could not generate NS lookup for", iq->dsns_point);
@@ -2235,8 +2235,8 @@ check_waiting_queries(struct iter_qstate* iq, struct module_qstate* qstate,
 		qstate->ext_state[id] = module_wait_reply;
 	}
 }
-	
-/** 
+
+/**
  * This is the request event state where the request will be sent to one of
  * its current query targets. This state also handles issuing target lookup
  * queries for missing target IP addresses. Queries typically iterate on
@@ -2272,7 +2272,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo);
 	verbose(VERB_ALGO, "processQueryTargets: targetqueries %d, "
-		"currentqueries %d sentcount %d", iq->num_target_queries, 
+		"currentqueries %d sentcount %d", iq->num_target_queries,
 		iq->num_current_queries, iq->sent_count);
 
 	/* Make sure that we haven't run away */
@@ -2375,7 +2375,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			}
 		}
 	}
-	
+
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
 	if(!iq->dp) {
@@ -2404,10 +2404,10 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * qinfo_out is already a subdomain of dp. This happens when
 		 * increasing by more than one label at once (QNAMEs with more
 		 * than MAX_MINIMISE_COUNT labels). */
-		if(!(iq->qinfo_out.qname_len 
-			&& dname_subdomain_c(iq->qchase.qname, 
+		if(!(iq->qinfo_out.qname_len
+			&& dname_subdomain_c(iq->qchase.qname,
 				iq->qinfo_out.qname)
-			&& dname_subdomain_c(iq->qinfo_out.qname, 
+			&& dname_subdomain_c(iq->qinfo_out.qname,
 				iq->dp->name))) {
 			iq->qinfo_out.qname = iq->dp->name;
 			iq->qinfo_out.qname_len = iq->dp->namelen;
@@ -2437,15 +2437,15 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB
 		 * labels of QNAME always individually.
 		 */
-		if(qchaselabs > MAX_MINIMISE_COUNT && labdiff > 1 && 
+		if(qchaselabs > MAX_MINIMISE_COUNT && labdiff > 1 &&
 			iq->minimise_count > MINIMISE_ONE_LAB) {
 			if(iq->minimise_count < MAX_MINIMISE_COUNT) {
-				int multilabs = qchaselabs - 1 - 
+				int multilabs = qchaselabs - 1 -
 					MINIMISE_ONE_LAB;
-				int extralabs = multilabs / 
+				int extralabs = multilabs /
 					MINIMISE_MULTIPLE_LABS;
 
-				if (MAX_MINIMISE_COUNT - iq->minimise_count >= 
+				if (MAX_MINIMISE_COUNT - iq->minimise_count >=
 					multilabs % MINIMISE_MULTIPLE_LABS)
 					/* Default behaviour is to add 1 label
 					 * every iteration. Therefore, decrement
@@ -2464,25 +2464,25 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 		if(labdiff > 1) {
 			verbose(VERB_QUERY, "removing %d labels", labdiff-1);
-			dname_remove_labels(&iq->qinfo_out.qname, 
-				&iq->qinfo_out.qname_len, 
+			dname_remove_labels(&iq->qinfo_out.qname,
+				&iq->qinfo_out.qname_len,
 				labdiff-1);
 		}
-		if(labdiff < 1 || (labdiff < 2 
+		if(labdiff < 1 || (labdiff < 2
 			&& (iq->qchase.qtype == LDNS_RR_TYPE_DS
 			|| iq->qchase.qtype == LDNS_RR_TYPE_A)))
 			/* Stop minimising this query, resolve "as usual" */
 			iq->minimisation_state = DONOT_MINIMISE_STATE;
 		else if(!qstate->no_cache_lookup) {
-			struct dns_msg* msg = dns_cache_lookup(qstate->env, 
-				iq->qinfo_out.qname, iq->qinfo_out.qname_len, 
-				iq->qinfo_out.qtype, iq->qinfo_out.qclass, 
-				qstate->query_flags, qstate->region, 
+			struct dns_msg* msg = dns_cache_lookup(qstate->env,
+				iq->qinfo_out.qname, iq->qinfo_out.qname_len,
+				iq->qinfo_out.qtype, iq->qinfo_out.qclass,
+				qstate->query_flags, qstate->region,
 				qstate->env->scratch, 0, iq->dp->name,
 				iq->dp->namelen);
 			if(msg && FLAGS_GET_RCODE(msg->rep->flags) ==
 				LDNS_RCODE_NOERROR)
-				/* no need to send query if it is already 
+				/* no need to send query if it is already
 				 * cached as NOERROR */
 				return 1;
 			if(msg && FLAGS_GET_RCODE(msg->rep->flags) ==
@@ -2519,7 +2519,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	if(iq->minimisation_state == SKIP_MINIMISE_STATE) {
 		if(iq->timeout_count < MAX_MINIMISE_TIMEOUT_COUNT)
-			/* Do not increment qname, continue incrementing next 
+			/* Do not increment qname, continue incrementing next
 			 * iteration */
 			iq->minimisation_state = MINIMISE_STATE;
 		else if(!qstate->env->cfg->qname_minimisation_strict)
@@ -2634,7 +2634,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* *2 on sentcount check because ipv6 may fail */
 			/* we're done, process the response */
 			verbose(VERB_ALGO, "0x20 fallback had %d responses "
-				"match for %d wanted, done.", 
+				"match for %d wanted, done.",
 				(int)iq->caps_server+1, (int)naddr*3);
 			iq->response = iq->caps_response;
 			iq->caps_fallback = 0;
@@ -2646,16 +2646,16 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->state = QUERY_RESP_STATE;
 			return 1;
 		}
-		verbose(VERB_ALGO, "0x20 fallback number %d", 
+		verbose(VERB_ALGO, "0x20 fallback number %d",
 			(int)iq->caps_server);
 
-	/* if there is a policy to fetch missing targets 
-	 * opportunistically, do it. we rely on the fact that once a 
-	 * query (or queries) for a missing name have been issued, 
+	/* if there is a policy to fetch missing targets
+	 * opportunistically, do it. we rely on the fact that once a
+	 * query (or queries) for a missing name have been issued,
 	 * they will not show up again. */
 	} else if(tf_policy != 0) {
 		int extra = 0;
-		verbose(VERB_ALGO, "attempt to get extra %d targets", 
+		verbose(VERB_ALGO, "attempt to get extra %d targets",
 			tf_policy);
 		(void)query_for_targets(qstate, iq, ie, id, tf_policy, &extra);
 		/* errors ignored, these targets are not strictly necessary for
@@ -2693,31 +2693,31 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* If no usable target was selected... */
 	if(!target) {
-		/* Here we distinguish between three states: generate a new 
+		/* Here we distinguish between three states: generate a new
 		 * target query, just wait, or quit (with a SERVFAIL).
-		 * We have the following information: number of active 
-		 * target queries, number of active current queries, 
-		 * the presence of missing targets at this delegation 
+		 * We have the following information: number of active
+		 * target queries, number of active current queries,
+		 * the presence of missing targets at this delegation
 		 * point, and the given query target policy. */
-		
-		/* Check for the wait condition. If this is true, then 
+
+		/* Check for the wait condition. If this is true, then
 		 * an action must be taken. */
 		if(iq->num_target_queries==0 && iq->num_current_queries==0) {
-			/* If there is nothing to wait for, then we need 
-			 * to distinguish between generating (a) new target 
+			/* If there is nothing to wait for, then we need
+			 * to distinguish between generating (a) new target
 			 * query, or failing. */
 			if(delegpt_count_missing_targets(iq->dp, NULL) > 0) {
 				int qs = 0;
 				verbose(VERB_ALGO, "querying for next "
 					"missing target");
-				if(!query_for_targets(qstate, iq, ie, id, 
+				if(!query_for_targets(qstate, iq, ie, id,
 					1, &qs)) {
 					errinf(qstate, "could not fetch nameserver");
 					errinf_dname(qstate, "at zone", iq->dp->name);
 					return error_response(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
-				if(qs == 0 && 
+				if(qs == 0 &&
 				   delegpt_count_missing_targets(iq->dp, NULL) == 0){
 					/* it looked like there were missing
 					 * targets, but they did not turn up.
@@ -2729,7 +2729,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->num_target_queries += qs;
 				target_count_increase(iq, qs);
 			}
-			/* Since a target query might have been made, we 
+			/* Since a target query might have been made, we
 			 * need to check again. */
 			if(iq->num_target_queries == 0) {
 				/* if in capsforid fallback, instead of last
@@ -2739,7 +2739,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 					/* we're done, process the response */
 					verbose(VERB_ALGO, "0x20 fallback had %d responses, "
 						"but no more servers except "
-						"last resort, done.", 
+						"last resort, done.",
 						(int)iq->caps_server+1);
 					iq->response = iq->caps_response;
 					iq->caps_fallback = 0;
@@ -2755,7 +2755,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			}
 		}
 
-		/* otherwise, we have no current targets, so submerge 
+		/* otherwise, we have no current targets, so submerge
 		 * until one of the target or direct queries return. */
 		verbose(VERB_ALGO, "no current targets");
 		check_waiting_queries(iq, qstate, id);
@@ -2806,7 +2806,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* We have a valid target. */
 	if(verbosity >= VERB_QUERY) {
 		log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
-		log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
+		log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name,
 			&target->addr, target->addrlen);
 		verbose(VERB_ALGO, "dnssec status: %s%s",
 			iq->dnssec_expected?"expected": "not expected",
@@ -2865,12 +2865,12 @@ find_NS(struct reply_info* rep, size_t from, size_t to)
 }
 
 
-/** 
+/**
  * Process the query response. All queries end up at this state first. This
  * process generally consists of analyzing the response and routing the
  * event to the next state (either bouncing it back to a request state, or
  * terminating the processing for this event).
- * 
+ *
  * @param qstate: query state.
  * @param iq: iterator query state.
  * @param ie: iterator shared global environment.
@@ -2911,17 +2911,17 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	iq->response->rep->flags &= ~BIT_TC;
 	if(type == RESPONSE_TYPE_REFERRAL && (iq->chase_flags&BIT_RD) &&
 		!iq->auth_zone_response) {
-		/* When forwarding (RD bit is set), we handle referrals 
+		/* When forwarding (RD bit is set), we handle referrals
 		 * differently. No queries should be sent elsewhere */
 		type = RESPONSE_TYPE_ANSWER;
 	}
-	if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected 
+	if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected
                 && !iq->dnssec_lame_query &&
-		!(iq->chase_flags&BIT_RD) 
+		!(iq->chase_flags&BIT_RD)
 		&& iq->sent_count < DNSSEC_LAME_DETECT_COUNT
-		&& type != RESPONSE_TYPE_LAME 
-		&& type != RESPONSE_TYPE_REC_LAME 
-		&& type != RESPONSE_TYPE_THROWAWAY 
+		&& type != RESPONSE_TYPE_LAME
+		&& type != RESPONSE_TYPE_REC_LAME
+		&& type != RESPONSE_TYPE_THROWAWAY
 		&& type != RESPONSE_TYPE_UNTYPED) {
 		/* a possible answer, see if it is missing DNSSEC */
 		/* but not when forwarding, so we dont mark fwder lame */
@@ -2950,11 +2950,11 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	if(type == RESPONSE_TYPE_REFERRAL) {
 		struct ub_packed_rrset_key* ns = find_NS(
 			iq->response->rep, iq->response->rep->an_numrrsets,
-			iq->response->rep->an_numrrsets 
+			iq->response->rep->an_numrrsets
 			+ iq->response->rep->ns_numrrsets);
-		if(!ns) ns = find_NS(iq->response->rep, 0, 
+		if(!ns) ns = find_NS(iq->response->rep, 0,
 				iq->response->rep->an_numrrsets);
-		if(!ns || !dname_strict_subdomain_c(ns->rk.dname, iq->dp->name) 
+		if(!ns || !dname_strict_subdomain_c(ns->rk.dname, iq->dp->name)
 			|| !dname_subdomain_c(iq->qchase.qname, ns->rk.dname)){
 			verbose(VERB_ALGO, "bad referral, throwaway");
 			type = RESPONSE_TYPE_THROWAWAY;
@@ -2989,7 +2989,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* handle each of the type cases */
 	if(type == RESPONSE_TYPE_ANSWER) {
-		/* ANSWER type responses terminate the query algorithm, 
+		/* ANSWER type responses terminate the query algorithm,
 		 * so they sent on their */
 		if(verbosity >= VERB_DETAIL) {
 			verbose(VERB_DETAIL, "query response was %s",
@@ -3034,7 +3034,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				qstate->reply->remote_addrlen, qstate->region);
 		if(iq->minimisation_state != DONOT_MINIMISE_STATE
 			&& !(iq->chase_flags & BIT_RD)) {
-			if(FLAGS_GET_RCODE(iq->response->rep->flags) != 
+			if(FLAGS_GET_RCODE(iq->response->rep->flags) !=
 				LDNS_RCODE_NOERROR) {
 				if(qstate->env->cfg->qname_minimisation_strict) {
 					if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
@@ -3045,7 +3045,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 					return error_response(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
-				/* Best effort qname-minimisation. 
+				/* Best effort qname-minimisation.
 				 * Stop minimising and send full query when
 				 * RCODE is not NOERROR. */
 				iq->minimisation_state = DONOT_MINIMISE_STATE;
@@ -3084,15 +3084,15 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 		return final_state(iq);
 	} else if(type == RESPONSE_TYPE_REFERRAL) {
-		/* REFERRAL type responses get a reset of the 
+		/* REFERRAL type responses get a reset of the
 		 * delegation point, and back to the QUERYTARGETS_STATE. */
 		verbose(VERB_DETAIL, "query response was REFERRAL");
 
 		/* if hardened, only store referral if we asked for it */
 		if(!qstate->no_cache_store &&
 		(!qstate->env->cfg->harden_referral_path ||
-		    (  qstate->qinfo.qtype == LDNS_RR_TYPE_NS 
-			&& (qstate->query_flags&BIT_RD) 
+		    (  qstate->qinfo.qtype == LDNS_RR_TYPE_NS
+			&& (qstate->query_flags&BIT_RD)
 			&& !(qstate->query_flags&BIT_CD)
 			   /* we know that all other NS rrsets are scrubbed
 			    * away, thus on referral only one is left.
@@ -3112,17 +3112,17 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->response->rep, 1, 0, 0, NULL, 0,
 				qstate->qstarttime);
 			if(iq->store_parent_NS)
-				iter_store_parentside_NS(qstate->env, 
+				iter_store_parentside_NS(qstate->env,
 					iq->response->rep);
 			if(qstate->env->neg_cache)
-				val_neg_addreferral(qstate->env->neg_cache, 
+				val_neg_addreferral(qstate->env->neg_cache,
 					iq->response->rep, iq->dp->name);
 		}
 		/* store parent-side-in-zone-glue, if directly queried for */
 		if(!qstate->no_cache_store && iq->query_for_pside_glue
 			&& !iq->pside_glue) {
-				iq->pside_glue = reply_find_rrset(iq->response->rep, 
-					iq->qchase.qname, iq->qchase.qname_len, 
+				iq->pside_glue = reply_find_rrset(iq->response->rep,
+					iq->qchase.qname, iq->qchase.qname_len,
 					iq->qchase.qtype, iq->qchase.qclass);
 				if(iq->pside_glue) {
 					log_rrset_key(VERB_ALGO, "found parent-side "
@@ -3132,7 +3132,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				}
 		}
 
-		/* Reset the event state, setting the current delegation 
+		/* Reset the event state, setting the current delegation
 		 * point to the referral. */
 		iq->deleg_msg = iq->response;
 		iq->dp = delegpt_from_message(iq->response, qstate->region);
@@ -3142,7 +3142,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			errinf(qstate, "malloc failure, for delegation point");
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
-		if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
+		if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
 			qstate->region, iq->dp)) {
 			errinf(qstate, "malloc failure, copy extra info into delegation point");
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -3158,7 +3158,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->dp_target_count = 0;
 		/* see if the next dp is a trust anchor, or a DS was sent
 		 * along, indicating dnssec is expected for next zone */
-		iq->dnssec_expected = iter_indicates_dnssec(qstate->env, 
+		iq->dnssec_expected = iter_indicates_dnssec(qstate->env,
 			iq->dp, iq->response, iq->qchase.qclass);
 		/* if dnssec, validating then also fetch the key for the DS */
 		if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
@@ -3167,12 +3167,12 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 
 		/* spawn off NS and addr to auth servers for the NS we just
 		 * got in the referral. This gets authoritative answer
-		 * (answer section trust level) rrset. 
+		 * (answer section trust level) rrset.
 		 * right after, we detach the subs, answer goes to cache. */
 		if(qstate->env->cfg->harden_referral_path)
 			generate_ns_check(qstate, iq, id);
 
-		/* stop current outstanding queries. 
+		/* stop current outstanding queries.
 		 * FIXME: should the outstanding queries be waited for and
 		 * handled? Say by a subquery that inherits the outbound_entry.
 		 */
@@ -3189,12 +3189,12 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	} else if(type == RESPONSE_TYPE_CNAME) {
 		uint8_t* sname = NULL;
 		size_t snamelen = 0;
-		/* CNAME type responses get a query restart (i.e., get a 
+		/* CNAME type responses get a query restart (i.e., get a
 		 * reset of the query state and go back to INIT_REQUEST_STATE).
 		 */
 		verbose(VERB_DETAIL, "query response was CNAME");
 		if(verbosity >= VERB_ALGO)
-			log_dns_msg("cname msg", &iq->response->qinfo, 
+			log_dns_msg("cname msg", &iq->response->qinfo,
 				iq->response->rep);
 		/* if qtype is DS, check we have the right level of answer,
 		 * like grandchild answer but we need the middle, reject it */
@@ -3211,13 +3211,13 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			return processDSNSFind(qstate, iq, id);
 		}
 		/* Process the CNAME response. */
-		if(!handle_cname_response(qstate, iq, iq->response, 
+		if(!handle_cname_response(qstate, iq, iq->response,
 			&sname, &snamelen)) {
 			errinf(qstate, "malloc failure, CNAME info");
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		/* cache the CNAME response under the current query */
-		/* NOTE : set referral=1, so that rrsets get stored but not 
+		/* NOTE : set referral=1, so that rrsets get stored but not
 		 * the partial query answer (CNAME only). */
 		/* prefetchleeway applied because this updates answer parts */
 		if(!qstate->no_cache_store)
@@ -3275,7 +3275,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(qstate->env->cfg->qname_minimisation)
 			iq->minimisation_state = INIT_MINIMISE_STATE;
 
-		/* stop current outstanding queries. 
+		/* stop current outstanding queries.
 		 * FIXME: should the outstanding queries be waited for and
 		 * handled? Say by a subquery that inherits the outbound_entry.
 		 */
@@ -3321,17 +3321,17 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* need addr for lameness cache, but we may have
 			 * gotten this from cache, so test to be sure */
 			verbose(VERB_DETAIL, "mark as REC_LAME");
-			if(!infra_set_lame(qstate->env->infra_cache, 
+			if(!infra_set_lame(qstate->env->infra_cache,
 				&qstate->reply->remote_addr,
 				qstate->reply->remote_addrlen,
 				iq->dp->name, iq->dp->namelen,
 				*qstate->env->now, 0, 1, iq->qchase.qtype))
 				log_err("mark host lame: out of memory");
-		} 
+		}
 	} else if(type == RESPONSE_TYPE_THROWAWAY) {
-		/* LAME and THROWAWAY responses are handled the same way. 
-		 * In this case, the event is just sent directly back to 
-		 * the QUERYTARGETS_STATE without resetting anything, 
+		/* LAME and THROWAWAY responses are handled the same way.
+		 * In this case, the event is just sent directly back to
+		 * the QUERYTARGETS_STATE without resetting anything,
 		 * because, clearly, the next target must be tried. */
 		verbose(VERB_DETAIL, "query response was THROWAWAY");
 	} else {
@@ -3340,7 +3340,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 
 	/* LAME, THROWAWAY and "unknown" all end up here.
-	 * Recycle to the QUERYTARGETS state to hopefully try a 
+	 * Recycle to the QUERYTARGETS state to hopefully try a
 	 * different target. */
 	if (qstate->env->cfg->qname_minimisation &&
 		!qstate->env->cfg->qname_minimisation_strict)
@@ -3371,7 +3371,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 
 /**
  * Return priming query results to interested super querystates.
- * 
+ *
  * Sets the delegation point and delegation message (not nonRD queries).
  * This is a callback from walk_supers.
  *
@@ -3390,7 +3390,7 @@ prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq)
 	/* Convert our response to a delegation point */
 	dp = delegpt_from_message(qstate->return_msg, forq->region);
 	if(!dp) {
-		/* if there is no convertible delegation point, then 
+		/* if there is no convertible delegation point, then
 		 * the ANSWER type was (presumably) a negative answer. */
 		verbose(VERB_ALGO, "prime response was not a positive "
 			"ANSWER; failing");
@@ -3410,7 +3410,7 @@ prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq)
 		return;
 	}
 
-	/* root priming responses go to init stage 2, priming stub 
+	/* root priming responses go to init stage 2, priming stub
 	 * responses to to stage 3. */
 	if(foriq->wait_priming_stub) {
 		foriq->state = INIT_REQUEST_3_STATE;
@@ -3419,7 +3419,7 @@ prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq)
 	/* because we are finished, the parent will be reactivated */
 }
 
-/** 
+/**
  * This handles the response to a priming query. This is used to handle both
  * root and stub priming responses. This is basically the equivalent of the
  * QUERY_RESP_STATE, but will not handle CNAME responses and will treat
@@ -3438,7 +3438,7 @@ processPrimeResponse(struct module_qstate* qstate, int id)
 	enum response_type type;
 	iq->response->rep->flags &= ~(BIT_RD|BIT_RA); /* ignore rec-lame */
 	type = response_type_from_server(
-		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd), 
+		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd),
 		iq->response, &iq->qchase, iq->dp);
 	if(type == RESPONSE_TYPE_ANSWER) {
 		qstate->return_rcode = LDNS_RCODE_NOERROR;
@@ -3456,10 +3456,10 @@ processPrimeResponse(struct module_qstate* qstate, int id)
 	 * may need can be resolved. */
 	if(qstate->env->cfg->harden_referral_path) {
 		struct module_qstate* subq = NULL;
-		log_nametypeclass(VERB_ALGO, "schedule prime validation", 
+		log_nametypeclass(VERB_ALGO, "schedule prime validation",
 			qstate->qinfo.qname, qstate->qinfo.qtype,
 			qstate->qinfo.qclass);
-		if(!generate_sub_request(qstate->qinfo.qname, 
+		if(!generate_sub_request(qstate->qinfo.qname,
 			qstate->qinfo.qname_len, qstate->qinfo.qtype,
 			qstate->qinfo.qclass, qstate, id, iq,
 			INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) {
@@ -3473,13 +3473,13 @@ processPrimeResponse(struct module_qstate* qstate, int id)
 	return 0;
 }
 
-/** 
+/**
  * Do final processing on responses to target queries. Events reach this
  * state after the iterative resolution algorithm terminates. This state is
  * responsible for reactivating the original event, and housekeeping related
  * to received target responses (caching, updating the current delegation
  * point, etc).
- * Callback from walk_supers for every super state that is interested in 
+ * Callback from walk_supers for every super state that is interested in
  * the results from this query.
  *
  * @param qstate: query state.
@@ -3525,9 +3525,9 @@ processTargetResponse(struct module_qstate* qstate, int id,
 		/* if the pside_glue is NULL, then it could not be found,
 		 * the done_pside is already set when created and a cache
 		 * entry created in processFinished so nothing to do here */
-		log_rrset_key(VERB_ALGO, "add parentside glue to dp", 
+		log_rrset_key(VERB_ALGO, "add parentside glue to dp",
 			iq->pside_glue);
-		if(!delegpt_add_rrset(foriq->dp, forq->region, 
+		if(!delegpt_add_rrset(foriq->dp, forq->region,
 			iq->pside_glue, 1, NULL))
 			log_err("out of memory adding pside glue");
 	}
@@ -3551,7 +3551,7 @@ processTargetResponse(struct module_qstate* qstate, int id,
 				log_err("out of memory adding cnamed-ns");
 		}
 		/* if dpns->lame then set the address(es) lame too */
-		if(!delegpt_add_rrset(foriq->dp, forq->region, rrset, 
+		if(!delegpt_add_rrset(foriq->dp, forq->region, rrset,
 			dpns->lame, &additions))
 			log_err("out of memory adding targets");
 		if(!additions) {
@@ -3639,13 +3639,13 @@ processClassResponse(struct module_qstate* qstate, int id,
 		/* allocate the response: copy RCODE, sec_state */
 		foriq->response = dns_copy_msg(from, forq->region);
 		if(!foriq->response) {
-			log_err("malloc failed for qclass ANY response"); 
+			log_err("malloc failed for qclass ANY response");
 			foriq->state = FINISHED_STATE;
 			return;
 		}
 		foriq->response->qinfo.qclass = forq->qinfo.qclass;
 		/* qclass ANY does not receive the AA flag on replies */
-		foriq->response->rep->authoritative = 0; 
+		foriq->response->rep->authoritative = 0;
 	} else {
 		struct dns_msg* to = foriq->response;
 		/* add _from_ this response _to_ existing collection */
@@ -3659,13 +3659,13 @@ processClassResponse(struct module_qstate* qstate, int id,
 			/* copy rrsets */
 			if(from->rep->rrset_count > RR_COUNT_MAX ||
 				to->rep->rrset_count > RR_COUNT_MAX) {
-				log_err("malloc failed (too many rrsets) in collect ANY"); 
+				log_err("malloc failed (too many rrsets) in collect ANY");
 				foriq->state = FINISHED_STATE;
 				return; /* integer overflow protection */
 			}
 			dest = regional_alloc(forq->region, sizeof(dest[0])*n);
 			if(!dest) {
-				log_err("malloc failed in collect ANY"); 
+				log_err("malloc failed in collect ANY");
 				foriq->state = FINISHED_STATE;
 				return;
 			}
@@ -3715,8 +3715,8 @@ processClassResponse(struct module_qstate* qstate, int id,
 	if(foriq->num_current_queries == 0)
 		foriq->state = FINISHED_STATE;
 }
-	
-/** 
+
+/**
  * Collect class ANY responses and make them into one response.  This
  * state is started and it creates queries for all classes (that have
  * root hints).  The answers are then collected.
@@ -3745,11 +3745,11 @@ processCollectClass(struct module_qstate* qstate, int id)
 			if(!generate_sub_request(qstate->qinfo.qname,
 				qstate->qinfo.qname_len, qstate->qinfo.qtype,
 				c, qstate, id, iq, INIT_REQUEST_STATE,
-				FINISHED_STATE, &subq, 
+				FINISHED_STATE, &subq,
 				(int)!(qstate->query_flags&BIT_CD), 0)) {
 				errinf(qstate, "could not generate class ANY"
 					" lookup query");
-				return error_response(qstate, id, 
+				return error_response(qstate, id,
 					LDNS_RCODE_SERVFAIL);
 			}
 			/* ignore subq, no special init required */
@@ -3770,7 +3770,7 @@ processCollectClass(struct module_qstate* qstate, int id)
 	return 0;
 }
 
-/** 
+/**
  * This handles the final state for first-tier responses (i.e., responses to
  * externally generated queries).
  *
@@ -3784,7 +3784,7 @@ static int
 processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 	int id)
 {
-	log_query_info(VERB_QUERY, "finishing processing for", 
+	log_query_info(VERB_QUERY, "finishing processing for",
 		&qstate->qinfo);
 
 	/* store negative cache element for parent side glue. */
@@ -3799,7 +3799,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 
-	/* Make sure that the RA flag is set (since the presence of 
+	/* Make sure that the RA flag is set (since the presence of
 	 * this module means that recursion is available) */
 	iq->response->rep->flags |= BIT_RA;
 
@@ -3830,7 +3830,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * but only if we did recursion. The nonrecursion referral
 		 * from cache does not need to be stored in the msg cache. */
 		if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
-			iter_dns_store(qstate->env, &qstate->qinfo, 
+			iter_dns_store(qstate->env, &qstate->qinfo,
 				iq->response->rep, 0, qstate->prefetch_leeway,
 				iq->dp&&iq->dp->has_parent_side_NS,
 				qstate->region, qstate->query_flags,
@@ -3844,7 +3844,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 
 /*
  * Return priming query results to interested super querystates.
- * 
+ *
  * Sets the delegation point and delegation message (not nonRD queries).
  * This is a callback from walk_supers.
  *
@@ -3853,7 +3853,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
  * @param super: the qstate to inform.
  */
 void
-iter_inform_super(struct module_qstate* qstate, int id, 
+iter_inform_super(struct module_qstate* qstate, int id,
 	struct module_qstate* super)
 {
 	if(!qstate->is_priming && super->qinfo.qclass == LDNS_RR_CLASS_ANY)
@@ -3925,7 +3925,7 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 }
 
-/** 
+/**
  * This is the primary entry point for processing request events. Note that
  * this method should only be used by external modules.
  * @param qstate: query state.
@@ -3947,7 +3947,7 @@ process_request(struct module_qstate* qstate, struct iter_qstate* iq,
 
 /** process authoritative server reply */
 static void
-process_response(struct module_qstate* qstate, struct iter_qstate* iq, 
+process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	struct iter_env* ie, int id, struct outbound_entry* outbound,
 	enum module_ev event)
 {
@@ -3989,7 +3989,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* parse message */
 	iq->fail_reply = qstate->reply;
-	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch, 
+	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch,
 		sizeof(struct msg_parse));
 	if(!prs) {
 		log_err("out of memory on incoming message");
@@ -4031,7 +4031,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	prs->flags &= ~BIT_CD;
 
 	/* normalize and sanitize: easy to delete items from linked lists */
-	if(!scrub_message(pkt, prs, &iq->qinfo_out, iq->dp->name, 
+	if(!scrub_message(pkt, prs, &iq->qinfo_out, iq->dp->name,
 		qstate->env->scratch, qstate->env, ie)) {
 		/* if 0x20 enabled, start fallback, but we have no message */
 		if(event == module_event_capsfail && !iq->caps_fallback) {
@@ -4056,9 +4056,9 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	log_name_addr(VERB_DETAIL, "reply from", iq->dp->name,
 		&qstate->reply->remote_addr, qstate->reply->remote_addrlen);
 	if(verbosity >= VERB_ALGO)
-		log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo, 
+		log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo,
 			iq->response->rep);
-	
+
 	if(event == module_event_capsfail || iq->caps_fallback) {
 		if(qstate->env->cfg->qname_minimisation &&
 			iq->minimisation_state != DONOT_MINIMISE_STATE) {
@@ -4102,7 +4102,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->caps_response = iq->response;
 			} else if(!caps_failed_rcode(iq->caps_reply) &&
 				caps_failed_rcode(iq->response->rep)) {
-				/* if we have non-SERVFAIL as answer then 
+				/* if we have non-SERVFAIL as answer then
 				 * we can ignore SERVFAILs for the equality
 				 * comparison */
 				/* no instructions here, skip other else */
@@ -4116,7 +4116,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 					"getting different replies, failed");
 				outbound_list_remove(&iq->outlist, outbound);
 				errinf(qstate, "0x20 failed, then got different replies in fallback");
-				(void)error_response(qstate, id, 
+				(void)error_response(qstate, id,
 					LDNS_RCODE_SERVFAIL);
 				return;
 			}
@@ -4136,22 +4136,22 @@ handle_it:
 	iter_handle(qstate, iq, ie, id);
 }
 
-void 
+void
 iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
 	struct outbound_entry* outbound)
 {
 	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
 	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
-	verbose(VERB_QUERY, "iterator[module %d] operate: extstate:%s event:%s", 
+	verbose(VERB_QUERY, "iterator[module %d] operate: extstate:%s event:%s",
 		id, strextstate(qstate->ext_state[id]), strmodulevent(event));
-	if(iq) log_query_info(VERB_QUERY, "iterator operate: query", 
+	if(iq) log_query_info(VERB_QUERY, "iterator operate: query",
 		&qstate->qinfo);
 	if(iq && qstate->qinfo.qname != iq->qchase.qname)
-		log_query_info(VERB_QUERY, "iterator operate: chased to", 
+		log_query_info(VERB_QUERY, "iterator operate: chased to",
 			&iq->qchase);
 
 	/* perform iterator state machine */
-	if((event == module_event_new || event == module_event_pass) && 
+	if((event == module_event_new || event == module_event_pass) &&
 		iq == NULL) {
 		if(!iter_new(qstate, id)) {
 			errinf(qstate, "malloc failure, new iterator module allocation");
@@ -4182,7 +4182,7 @@ iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
 	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 }
 
-void 
+void
 iter_clear(struct module_qstate* qstate, int id)
 {
 	struct iter_qstate* iq;
@@ -4201,7 +4201,7 @@ iter_clear(struct module_qstate* qstate, int id)
 	qstate->minfo[id] = NULL;
 }
 
-size_t 
+size_t
 iter_get_mem(struct module_env* env, int id)
 {
 	struct iter_env* ie = (struct iter_env*)env->modinfo[id];
@@ -4212,21 +4212,21 @@ iter_get_mem(struct module_env* env, int id)
 }
 
 /**
- * The iterator function block 
+ * The iterator function block
  */
 static struct module_func_block iter_block = {
 	"iterator",
-	&iter_init, &iter_deinit, &iter_operate, &iter_inform_super, 
+	&iter_init, &iter_deinit, &iter_operate, &iter_inform_super,
 	&iter_clear, &iter_get_mem
 };
 
-struct module_func_block* 
+struct module_func_block*
 iter_get_funcblock(void)
 {
 	return &iter_block;
 }
 
-const char* 
+const char*
 iter_state_to_string(enum iter_state state)
 {
 	switch (state)
@@ -4254,7 +4254,7 @@ iter_state_to_string(enum iter_state state)
 	}
 }
 
-int 
+int
 iter_state_is_responsestate(enum iter_state s)
 {
 	switch(s) {
diff --git a/usr.sbin/unbound/iterator/iterator.h b/usr.sbin/unbound/iterator/iterator.h
index e35718cf3..592c10bfc 100644
--- a/usr.sbin/unbound/iterator/iterator.h
+++ b/usr.sbin/unbound/iterator/iterator.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -88,12 +88,12 @@ struct rbtree_type;
 #define MINIMISE_MULTIPLE_LABS	(MAX_MINIMISE_COUNT - MINIMISE_ONE_LAB)
 /** at what query-sent-count to stop target fetch policy */
 #define TARGET_FETCH_STOP	3
-/** how nice is a server without further information, in msec 
+/** how nice is a server without further information, in msec
  * Equals rtt initial timeout value.
  */
 extern int UNKNOWN_SERVER_NICENESS;
-/** maximum timeout before a host is deemed unsuitable, in msec. 
- * After host_ttl this will be timed out and the host will be tried again. 
+/** maximum timeout before a host is deemed unsuitable, in msec.
+ * After host_ttl this will be timed out and the host will be tried again.
  * Equals RTT_MAX_TIMEOUT, and thus when RTT_MAX_TIMEOUT is overwritten by
  * config infra_cache_max_rtt, it will be overwritten as well. */
 extern int USEFUL_SERVER_TOP_TIMEOUT;
@@ -102,12 +102,12 @@ extern int USEFUL_SERVER_TOP_TIMEOUT;
  * overwritten by config infra_cache_max_rtt, it will be overwritten as well. */
 extern int BLACKLIST_PENALTY;
 /** RTT band, within this amount from the best, servers are chosen randomly.
- * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
+ * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a
  * fast server, this causes server exploration as a side benefit. msec. */
 #define RTT_BAND 400
 
 /**
- * Global state for the iterator. 
+ * Global state for the iterator.
  */
 struct iter_env {
 	/** A flag to indicate whether or not we have an IPv6 route */
@@ -129,10 +129,10 @@ struct iter_env {
 	int max_dependency_depth;
 
 	/**
-	 * The target fetch policy for each dependency level. This is 
-	 * described as a simple number (per dependency level): 
-	 *	negative numbers (usually just -1) mean fetch-all, 
-	 *	0 means only fetch on demand, and 
+	 * The target fetch policy for each dependency level. This is
+	 * described as a simple number (per dependency level):
+	 *	negative numbers (usually just -1) mean fetch-all,
+	 *	0 means only fetch on demand, and
 	 *	positive numbers mean to fetch at most that many targets.
 	 * array of max_dependency_depth+1 size.
 	 */
@@ -181,27 +181,27 @@ enum iter_state {
 	INIT_REQUEST_STATE = 0,
 
 	/**
-	 * Root priming events reactivate here, most other events pass 
+	 * Root priming events reactivate here, most other events pass
 	 * through this naturally as the 2nd part of the INIT_REQUEST_STATE.
 	 */
 	INIT_REQUEST_2_STATE,
 
 	/**
-	 * Stub priming events reactivate here, most other events pass 
+	 * Stub priming events reactivate here, most other events pass
 	 * through this naturally as the 3rd part of the INIT_REQUEST_STATE.
 	 */
 	INIT_REQUEST_3_STATE,
 
 	/**
-	 * Each time a delegation point changes for a given query or a 
-	 * query times out and/or wakes up, this state is (re)visited. 
-	 * This state is responsible for iterating through a list of 
+	 * Each time a delegation point changes for a given query or a
+	 * query times out and/or wakes up, this state is (re)visited.
+	 * This state is responsible for iterating through a list of
 	 * nameserver targets.
 	 */
 	QUERYTARGETS_STATE,
 
 	/**
-	 * Responses to queries start at this state. This state handles 
+	 * Responses to queries start at this state. This state handles
 	 * the decision tree associated with handling responses.
 	 */
 	QUERY_RESP_STATE,
@@ -217,7 +217,7 @@ enum iter_state {
 	 * NS spot until we find it */
 	DSNS_FIND_STATE,
 
-	/** Responses that are to be returned upstream end at this state. 
+	/** Responses that are to be returned upstream end at this state.
 	 * As well as responses to target queries. */
 	FINISHED_STATE
 };
@@ -241,25 +241,25 @@ enum target_count_variables {
  * Per query state for the iterator module.
  */
 struct iter_qstate {
-	/** 
+	/**
 	 * State of the iterator module.
-	 * This is the state that event is in or should sent to -- all 
-	 * requests should start with the INIT_REQUEST_STATE. All 
-	 * responses should start with QUERY_RESP_STATE. Subsequent 
+	 * This is the state that event is in or should sent to -- all
+	 * requests should start with the INIT_REQUEST_STATE. All
+	 * responses should start with QUERY_RESP_STATE. Subsequent
 	 * processing of the event will change this state.
 	 */
 	enum iter_state state;
 
-	/** 
+	/**
 	 * Final state for the iterator module.
-	 * This is the state that responses should be routed to once the 
-	 * response is final. For externally initiated queries, this 
-	 * will be FINISHED_STATE, locally initiated queries will have 
+	 * This is the state that responses should be routed to once the
+	 * response is final. For externally initiated queries, this
+	 * will be FINISHED_STATE, locally initiated queries will have
 	 * different final states.
 	 */
 	enum iter_state final_state;
 
-	/** 
+	/**
 	 * The depth of this query, this means the depth of recursion.
 	 * This address is needed for another query, which is an address
 	 * needed for another query, etc. Original client query has depth 0.
@@ -271,8 +271,8 @@ struct iter_qstate {
 	 */
 	struct dns_msg* response;
 
-	/** 
-	 * This is a list of RRsets that must be prepended to the 
+	/**
+	 * This is a list of RRsets that must be prepended to the
 	 * ANSWER section of a response before being sent upstream.
 	 */
 	struct iter_prep_list* an_prepend_list;
@@ -288,7 +288,7 @@ struct iter_qstate {
 	struct iter_prep_list* ns_prepend_last;
 
 	/** query name used for chasing the results. Initially the same as
-	 * the state qinfo, but after CNAMEs this will be different. 
+	 * the state qinfo, but after CNAMEs this will be different.
 	 * The query info used to elicit the results needed. */
 	struct query_info qchase;
 	/** query flags to use when chasing the answer (i.e. RD flag) */
@@ -296,7 +296,7 @@ struct iter_qstate {
 	/** true if we set RD bit because of last resort recursion lame query*/
 	int chase_to_rd;
 
-	/** 
+	/**
 	 * This is the current delegation point for an in-progress query. This
 	 * object retains state as to which delegation targets need to be
 	 * (sub)queried for vs which ones have already been visited.
@@ -329,7 +329,7 @@ struct iter_qstate {
 
 	/** number of queries fired off */
 	int sent_count;
-	
+
 	/** malloced-array shared with this query and its subqueries. It keeps
 	 * track of the defined enum target_count_variables counters. */
 	int* target_count;
@@ -359,8 +359,8 @@ struct iter_qstate {
 	 * The query is for parent-side glue(A or AAAA) for a nameserver.
 	 * If the item is seen as glue in a referral, and pside_glue is NULL,
 	 * then it is stored in pside_glue for later.
-	 * If it was never seen, at the end, then a negative caching element 
-	 * must be created.  
+	 * If it was never seen, at the end, then a negative caching element
+	 * must be created.
 	 * The (data or negative) RR cache element then throttles retries.
 	 */
 	int query_for_pside_glue;
@@ -372,8 +372,8 @@ struct iter_qstate {
 	/** length of the dname in dsns_point */
 	size_t dsns_point_len;
 
-	/** 
-	 * expected dnssec information for this iteration step. 
+	/**
+	 * expected dnssec information for this iteration step.
 	 * If dnssec rrsigs are expected and not given, the server is marked
 	 * lame (dnssec-lame).
 	 */
@@ -386,8 +386,8 @@ struct iter_qstate {
 	int dnssec_lame_query;
 
 	/**
-	 * This is flag that, if true, means that this event is 
-	 * waiting for a stub priming query. 
+	 * This is flag that, if true, means that this event is
+	 * waiting for a stub priming query.
 	 */
 	int wait_priming_stub;
 
@@ -482,7 +482,7 @@ void iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
 
 /**
  * Return priming query results to interested super querystates.
- * 
+ *
  * Sets the delegation point and delegation message (not nonRD queries).
  * This is a callback from walk_supers.
  *
@@ -490,7 +490,7 @@ void iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
  * @param id: module id.
  * @param super: the qstate to inform.
  */
-void iter_inform_super(struct module_qstate* qstate, int id, 
+void iter_inform_super(struct module_qstate* qstate, int id,
 	struct module_qstate* super);
 
 /** iterator cleanup query state */
diff --git a/usr.sbin/unbound/libunbound/context.c b/usr.sbin/unbound/libunbound/context.c
index c8d911f13..9969ee2de 100644
--- a/usr.sbin/unbound/libunbound/context.c
+++ b/usr.sbin/unbound/libunbound/context.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -54,7 +54,7 @@
 #include "util/edns.h"
 #include "sldns/sbuffer.h"
 
-int 
+int
 context_finalize(struct ub_ctx* ctx)
 {
 	int is_rpz = 0;
@@ -117,7 +117,7 @@ int context_query_cmp(const void* a, const void* b)
 }
 
 void
-context_query_delete(struct ctx_query* q) 
+context_query_delete(struct ctx_query* q)
 {
 	if(!q) return;
 	ub_resolve_free(q->res);
@@ -142,8 +142,8 @@ find_id(struct ub_ctx* ctx, int* id)
 	return 1;
 }
 
-struct ctx_query* 
-context_new(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass, 
+struct ctx_query*
+context_new(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass,
 	ub_callback_type cb, ub_event_callback_type cb_event, void* cbarg)
 {
 	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
@@ -183,7 +183,7 @@ context_new(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass,
 	return q;
 }
 
-struct alloc_cache* 
+struct alloc_cache*
 context_obtain_alloc(struct ub_ctx* ctx, int locking)
 {
 	struct alloc_cache* a;
@@ -209,7 +209,7 @@ context_obtain_alloc(struct ub_ctx* ctx, int locking)
 	return a;
 }
 
-void 
+void
 context_release_alloc(struct ub_ctx* ctx, struct alloc_cache* alloc,
 	int locking)
 {
@@ -225,7 +225,7 @@ context_release_alloc(struct ub_ctx* ctx, struct alloc_cache* alloc,
 	}
 }
 
-uint8_t* 
+uint8_t*
 context_serialize_new_query(struct ctx_query* q, uint32_t* len)
 {
 	/* format for new query is
@@ -248,7 +248,7 @@ context_serialize_new_query(struct ctx_query* q, uint32_t* len)
 	return p;
 }
 
-struct ctx_query* 
+struct ctx_query*
 context_deserialize_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
 {
 	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
@@ -281,7 +281,7 @@ context_deserialize_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
 	return q;
 }
 
-struct ctx_query* 
+struct ctx_query*
 context_lookup_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
 {
 	struct ctx_query* q;
@@ -299,7 +299,7 @@ context_lookup_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
 	return q;
 }
 
-uint8_t* 
+uint8_t*
 context_serialize_answer(struct ctx_query* q, int err, sldns_buffer* pkt,
 	uint32_t* len)
 {
@@ -335,7 +335,7 @@ context_serialize_answer(struct ctx_query* q, int err, sldns_buffer* pkt,
 	return p;
 }
 
-struct ctx_query* 
+struct ctx_query*
 context_deserialize_answer(struct ub_ctx* ctx,
         uint8_t* p, uint32_t len, int* err)
 {
@@ -347,7 +347,7 @@ context_deserialize_answer(struct ub_ctx* ctx,
 	log_assert( sldns_read_uint32(p) == UB_LIBCMD_ANSWER);
 	id = (int)sldns_read_uint32(p+sizeof(uint32_t));
 	q = (struct ctx_query*)rbtree_search(&ctx->queries, &id);
-	if(!q) return NULL; 
+	if(!q) return NULL;
 	*err = (int)sldns_read_uint32(p+2*sizeof(uint32_t));
 	q->msg_security = sldns_read_uint32(p+3*sizeof(uint32_t));
 	q->res->was_ratelimited = (int)sldns_read_uint32(p+4*sizeof(uint32_t));
@@ -374,11 +374,11 @@ context_deserialize_answer(struct ub_ctx* ctx,
 			*err = UB_NOMEM;
 			return q;
 		}
-	} 
+	}
 	return q;
 }
 
-uint8_t* 
+uint8_t*
 context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 {
 	/* format of cancel:
@@ -404,7 +404,7 @@ struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx,
 	return q;
 }
 
-uint8_t* 
+uint8_t*
 context_serialize_quit(uint32_t* len)
 {
 	uint32_t* p = (uint32_t*)malloc(sizeof(uint32_t));
diff --git a/usr.sbin/unbound/libunbound/context.h b/usr.sbin/unbound/libunbound/context.h
index c0c86fb52..e401de77d 100644
--- a/usr.sbin/unbound/libunbound/context.h
+++ b/usr.sbin/unbound/libunbound/context.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -76,8 +76,8 @@ struct ub_ctx {
 	/* --- shared data --- */
 	/** mutex for access to env.cfg, finalized and dothread */
 	lock_basic_type cfglock;
-	/** 
-	 * The context has been finalized 
+	/**
+	 * The context has been finalized
 	 * This is after config when the first resolve is done.
 	 * The modules are inited (module-init()) and shared caches created.
 	 */
@@ -98,7 +98,7 @@ struct ub_ctx {
 	int logfile_override;
 	/** what logfile to use instead */
 	FILE* log_out;
-	/** 
+	/**
 	 * List of alloc-cache-id points per threadnum for notinuse threads.
 	 * Simply the entire struct alloc_cache with the 'super' member used
 	 * to link a simply linked list. Reset super member to the superalloc
@@ -129,13 +129,13 @@ struct ub_ctx {
 	int next_querynum;
 	/** number of async queries outstanding */
 	size_t num_async;
-	/** 
-	 * Tree of outstanding queries. Indexed by querynum 
+	/**
+	 * Tree of outstanding queries. Indexed by querynum
 	 * Used when results come in for async to lookup.
 	 * Used when cancel is done for lookup (and delete).
 	 * Used to see if querynum is free for use.
 	 * Content of type ctx_query.
-	 */ 
+	 */
 	rbtree_type queries;
 };
 
@@ -195,7 +195,7 @@ enum ub_ctx_cmd {
 	UB_LIBCMD_ANSWER
 };
 
-/** 
+/**
  * finalize a context.
  * @param ctx: context to finalize. creates shared data.
  * @return 0 if OK, or errcode.
@@ -205,7 +205,7 @@ int context_finalize(struct ub_ctx* ctx);
 /** compare two ctx_query elements */
 int context_query_cmp(const void* a, const void* b);
 
-/** 
+/**
  * delete context query
  * @param q: query to delete, including message packet and prealloc result
  */
@@ -263,7 +263,7 @@ uint8_t* context_serialize_new_query(struct ctx_query* q, uint32_t* len);
  * @param len: the length of the allocation is returned.
  * @return: an alloc, or NULL on mem error.
  */
-uint8_t* context_serialize_answer(struct ctx_query* q, int err, 
+uint8_t* context_serialize_answer(struct ctx_query* q, int err,
 	struct sldns_buffer* pkt, uint32_t* len);
 
 /**
@@ -297,7 +297,7 @@ enum ub_ctx_cmd context_serial_getcmd(uint8_t* p, uint32_t len);
  * @param len: length of buffer.
  * @return looked up ctx_query or NULL for malloc failure.
  */
-struct ctx_query* context_lookup_new_query(struct ub_ctx* ctx, 
+struct ctx_query* context_lookup_new_query(struct ub_ctx* ctx,
 	uint8_t* p, uint32_t len);
 
 /**
@@ -307,7 +307,7 @@ struct ctx_query* context_lookup_new_query(struct ub_ctx* ctx,
  * @param len: length of buffer.
  * @return new ctx_query or NULL for malloc failure.
  */
-struct ctx_query* context_deserialize_new_query(struct ub_ctx* ctx, 
+struct ctx_query* context_deserialize_new_query(struct ub_ctx* ctx,
 	uint8_t* p, uint32_t len);
 
 /**
@@ -318,7 +318,7 @@ struct ctx_query* context_deserialize_new_query(struct ub_ctx* ctx,
  * @param err: error code to be returned to client is passed.
  * @return ctx_query with answer added or NULL for malloc failure.
  */
-struct ctx_query* context_deserialize_answer(struct ub_ctx* ctx, 
+struct ctx_query* context_deserialize_answer(struct ub_ctx* ctx,
 	uint8_t* p, uint32_t len, int* err);
 
 /**
@@ -328,7 +328,7 @@ struct ctx_query* context_deserialize_answer(struct ub_ctx* ctx,
  * @param len: length of buffer.
  * @return ctx_query to cancel or NULL for failure.
  */
-struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx, 
+struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx,
 	uint8_t* p, uint32_t len);
 
 #endif /* LIBUNBOUND_CONTEXT_H */
diff --git a/usr.sbin/unbound/services/cache/dns.c b/usr.sbin/unbound/services/cache/dns.c
index b6e569734..006341355 100644
--- a/usr.sbin/unbound/services/cache/dns.c
+++ b/usr.sbin/unbound/services/cache/dns.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -55,7 +55,7 @@
 #include "util/config_file.h"
 #include "sldns/sbuffer.h"
 
-/** store rrsets in the rrset cache. 
+/** store rrsets in the rrset cache.
  * @param env: module environment with caches.
  * @param rep: contains list of rrsets to store.
  * @param now: current time.
@@ -117,7 +117,7 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 
 /** delete message from message cache */
 void
-msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen, 
+msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen,
 	uint16_t qtype, uint16_t qclass, uint16_t flags)
 {
 	struct query_info k;
@@ -157,7 +157,7 @@ msg_del_servfail(struct module_env* env, struct query_info* qinfo,
 		qinfo->qclass, flags);
 }
 
-void 
+void
 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
 	struct reply_info* qrep, uint32_t flags, struct regional* region,
@@ -243,7 +243,7 @@ rrset_expired_above(struct module_env* env, uint8_t** qname, size_t* qnamelen,
 
 /** find closest NS or DNAME and returns the rrset (locked) */
 static struct ub_packed_rrset_key*
-find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, 
+find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 	uint16_t qclass, time_t now, uint16_t searchtype, int stripfront,
 	int noexpiredabove, uint8_t* expiretop, size_t expiretoplen)
 {
@@ -259,7 +259,7 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 
 	/* snip off front part of qname until the type is found */
 	while(qnamelen > 0) {
-		if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 
+		if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
 			qnamelen, searchtype, qclass, 0, now, 0))) {
 			uint8_t* origqname = qname;
 			size_t origqnamelen = qnamelen;
@@ -308,7 +308,7 @@ static void
 addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 	struct dns_msg* msg, time_t now)
 {
-	if((msg->rep->rrsets[msg->rep->rrset_count] = 
+	if((msg->rep->rrsets[msg->rep->rrset_count] =
 		packed_rrset_copy_region(rrset, region, now))) {
 		msg->rep->ar_numrrsets++;
 		msg->rep->rrset_count++;
@@ -316,8 +316,8 @@ addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 }
 
 /** lookup message in message cache */
-struct msgreply_entry* 
-msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen, 
+struct msgreply_entry*
+msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
 	uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
 {
 	struct lruhash_entry* e;
@@ -342,15 +342,15 @@ msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
 
 /** find and add A and AAAA records for nameservers in delegpt */
 static int
-find_add_addrs(struct module_env* env, uint16_t qclass, 
-	struct regional* region, struct delegpt* dp, time_t now, 
+find_add_addrs(struct module_env* env, uint16_t qclass,
+	struct regional* region, struct delegpt* dp, time_t now,
 	struct dns_msg** msg)
 {
 	struct delegpt_ns* ns;
 	struct msgreply_entry* neg;
 	struct ub_packed_rrset_key* akey;
 	for(ns = dp->nslist; ns; ns = ns->next) {
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
 			if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) {
@@ -370,7 +370,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 				lock_rw_unlock(&neg->entry.lock);
 			}
 		}
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
 			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) {
@@ -396,7 +396,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 
 /** find and add A and AAAA records for missing nameservers in delegpt */
 int
-cache_fill_missing(struct module_env* env, uint16_t qclass, 
+cache_fill_missing(struct module_env* env, uint16_t qclass,
 	struct regional* region, struct delegpt* dp)
 {
 	struct delegpt_ns* ns;
@@ -407,7 +407,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		if(ns->cache_lookup_count > ITERATOR_NAME_CACHELOOKUP_MAX)
 			continue;
 		ns->cache_lookup_count++;
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
 			if(!delegpt_add_rrset_A(dp, region, akey, ns->lame,
@@ -428,7 +428,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 				lock_rw_unlock(&neg->entry.lock);
 			}
 		}
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name,
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
 			if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame,
@@ -455,18 +455,18 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 
 /** find and add DS or NSEC to delegation msg */
 static void
-find_add_ds(struct module_env* env, struct regional* region, 
+find_add_ds(struct module_env* env, struct regional* region,
 	struct dns_msg* msg, struct delegpt* dp, time_t now)
 {
 	/* Lookup the DS or NSEC at the delegation point. */
 	struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
-		env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS, 
+		env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
 		msg->qinfo.qclass, 0, now, 0);
 	if(!rrset) {
-		/* NOTE: this won't work for alternate NSEC schemes 
+		/* NOTE: this won't work for alternate NSEC schemes
 		 *	(opt-in, NSEC3) */
-		rrset = rrset_cache_lookup(env->rrset_cache, dp->name, 
-			dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass, 
+		rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
+			dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
 			0, now, 0);
 		/* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
 		 * since this is a referral, we need the NSEC at the parent
@@ -478,7 +478,7 @@ find_add_ds(struct module_env* env, struct regional* region,
 	}
 	if(rrset) {
 		/* add it to auth section. This is the second rrset. */
-		if((msg->rep->rrsets[msg->rep->rrset_count] = 
+		if((msg->rep->rrsets[msg->rep->rrset_count] =
 			packed_rrset_copy_region(rrset, region, now))) {
 			msg->rep->ns_numrrsets++;
 			msg->rep->rrset_count++;
@@ -488,7 +488,7 @@ find_add_ds(struct module_env* env, struct regional* region,
 }
 
 struct dns_msg*
-dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype, 
+dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	uint16_t qclass, struct regional* region, size_t capacity)
 {
 	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
@@ -503,7 +503,7 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	msg->qinfo.qclass = qclass;
 	msg->qinfo.local_alias = NULL;
 	/* non-packed reply_info, because it needs to grow the array */
-	msg->rep = (struct reply_info*)regional_alloc_zero(region, 
+	msg->rep = (struct reply_info*)regional_alloc_zero(region,
 		sizeof(struct reply_info)-sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
@@ -513,7 +513,7 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	msg->rep->qdcount = 1;
 	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
-		regional_alloc(region, 
+		regional_alloc(region,
 		capacity*sizeof(struct ub_packed_rrset_key*));
 	if(!msg->rep->rrsets)
 		return NULL;
@@ -521,10 +521,10 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 }
 
 int
-dns_msg_authadd(struct dns_msg* msg, struct regional* region, 
+dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 		packed_rrset_copy_region(rrset, region, now)))
 		return 0;
 	msg->rep->ns_numrrsets++;
@@ -532,19 +532,19 @@ dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 }
 
 int
-dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 
+dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 		packed_rrset_copy_region(rrset, region, now)))
 		return 0;
 	msg->rep->an_numrrsets++;
 	return 1;
 }
 
-struct delegpt* 
-dns_cache_find_delegation(struct module_env* env, uint8_t* qname, 
-	size_t qnamelen, uint16_t qtype, uint16_t qclass, 
+struct delegpt*
+dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
+	size_t qnamelen, uint16_t qtype, uint16_t qclass,
 	struct regional* region, struct dns_msg** msg, time_t now,
 	int noexpiredabove, uint8_t* expiretop, size_t expiretoplen)
 {
@@ -572,7 +572,7 @@ dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
 		 *	A rrset for every NS RR
 		 *	AAAA rrset for every NS RR
 		 */
-		*msg = dns_msg_create(qname, qnamelen, qtype, qclass, region, 
+		*msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
 			2 + nsdata->count*2);
 		if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) {
 			lock_rw_unlock(&nskey->entry.lock);
@@ -596,7 +596,7 @@ dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
 static struct dns_msg*
 gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 {
-	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 
+	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
 		sizeof(struct dns_msg));
 	if(!msg)
 		return NULL;
@@ -688,7 +688,7 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 		}
 	}
 	if(env)
-		rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 
+		rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
 		r->rrset_count);
 	else
 		rrset_array_unlock(r->ref, r->rrset_count);
@@ -697,7 +697,7 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 
 /** synthesize RRset-only response from cached RRset item */
 static struct dns_msg*
-rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 
+rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	time_t now, struct query_info* q)
 {
 	struct dns_msg* msg;
@@ -728,7 +728,7 @@ rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 
 /** synthesize DNAME+CNAME response from cached DNAME item */
 static struct dns_msg*
-synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 
+synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	time_t now, struct query_info* q, enum sec_status* sec_status)
 {
 	struct dns_msg* msg;
@@ -739,7 +739,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	size_t newlen, dtarglen;
 	if(now > d->ttl)
 		return NULL;
-	/* only allow validated (with DNSSEC) DNAMEs used from cache 
+	/* only allow validated (with DNSSEC) DNAMEs used from cache
 	 * for insecure DNAMEs, query again. */
 	*sec_status = d->security;
 	/* return sec status, so the status of the CNAME can be checked
@@ -779,7 +779,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
 	memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
 	/* create rest of CNAME rrset */
-	ck = (struct ub_packed_rrset_key*)regional_alloc(region, 
+	ck = (struct ub_packed_rrset_key*)regional_alloc(region,
 		sizeof(struct ub_packed_rrset_key));
 	if(!ck)
 		return NULL;
@@ -795,8 +795,8 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	ck->rk.dname_len = q->qname_len;
 	ck->entry.hash = rrset_key_hash(&ck->rk);
 	newd = (struct packed_rrset_data*)regional_alloc_zero(region,
-		sizeof(struct packed_rrset_data) + sizeof(size_t) + 
-		sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 
+		sizeof(struct packed_rrset_data) + sizeof(size_t) +
+		sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
 		+ newlen);
 	if(!newd)
 		return NULL;
@@ -805,7 +805,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	newd->count = 1;
 	newd->rrsig_count = 0;
 	newd->trust = rrset_trust_ans_noAA;
-	newd->rr_len = (size_t*)((uint8_t*)newd + 
+	newd->rr_len = (size_t*)((uint8_t*)newd +
 		sizeof(struct packed_rrset_data));
 	newd->rr_len[0] = newlen + sizeof(uint16_t);
 	packed_rrset_ptr_fixup(newd);
@@ -886,7 +886,7 @@ fill_any(struct module_env* env,
 	return msg;
 }
 
-struct dns_msg* 
+struct dns_msg*
 dns_cache_lookup(struct module_env* env,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 	uint16_t flags, struct regional* region, struct regional* scratch,
@@ -920,7 +920,7 @@ dns_cache_lookup(struct module_env* env,
 	}
 
 	/* see if a DNAME exists. Checked for first, to enforce that DNAMEs
-	 * are more important, the CNAME is resynthesized and thus 
+	 * are more important, the CNAME is resynthesized and thus
 	 * consistent with the DNAME */
 	if(!no_partial &&
 		(rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
@@ -962,7 +962,7 @@ dns_cache_lookup(struct module_env* env,
 	/* see if we have CNAME for this domain,
 	 * but not for DS records (which are part of the parent) */
 	if(!no_partial && qtype != LDNS_RR_TYPE_DS &&
-	   (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 
+	   (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 		LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
 		uint8_t* wc = NULL;
 		size_t wl;
@@ -981,7 +981,7 @@ dns_cache_lookup(struct module_env* env,
 
 	/* construct DS, DNSKEY messages from rrset cache. */
 	if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) &&
-		(rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 
+		(rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
 		qtype, qclass, 0, now, 0))) {
 		/* if the rrset is from the additional section, and the
 		 * signatures have fallen off, then do not synthesize a msg
@@ -992,10 +992,10 @@ dns_cache_lookup(struct module_env* env,
 		 */
 		struct packed_rrset_data *d = (struct packed_rrset_data*)
 			rrset->entry.data;
-		if(d->trust != rrset_trust_add_noAA && 
-			d->trust != rrset_trust_add_AA && 
-			(qtype == LDNS_RR_TYPE_DS || 
-				(d->trust != rrset_trust_auth_noAA 
+		if(d->trust != rrset_trust_add_noAA &&
+			d->trust != rrset_trust_add_AA &&
+			(qtype == LDNS_RR_TYPE_DS ||
+				(d->trust != rrset_trust_auth_noAA
 				&& d->trust != rrset_trust_auth_AA) )) {
 			struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 			if(msg) {
@@ -1079,7 +1079,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 			ref.id = rep->rrsets[i]->id;
 			/*ignore ret: it was in the cache, ref updated */
 			/* no leeway for typeNS */
-			(void)rrset_cache_update(env->rrset_cache, &ref, 
+			(void)rrset_cache_update(env->rrset_cache, &ref,
 				env->alloc,
 				((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
 				 && !pside) ? qstarttime:*env->now + leeway));
@@ -1098,21 +1098,21 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 			return 0;
 		}
 		/* fixup flags to be sensible for a reply based on the cache */
-		/* this module means that RA is available. It is an answer QR. 
+		/* this module means that RA is available. It is an answer QR.
 		 * Not AA from cache. Not CD in cache (depends on client bit). */
 		rep->flags |= (BIT_RA | BIT_QR);
 		rep->flags &= ~(BIT_AA | BIT_CD);
 		h = query_info_hash(&qinf, (uint16_t)flags);
 		dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
 			flags, region, qstarttime);
-		/* qname is used inside query_info_entrysetup, and set to 
+		/* qname is used inside query_info_entrysetup, and set to
 		 * NULL. If it has not been used, free it. free(0) is safe. */
 		free(qinf.qname);
 	}
 	return 1;
 }
 
-int 
+int
 dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
         time_t adjust, uint16_t flags)
 {
diff --git a/usr.sbin/unbound/services/cache/dns.h b/usr.sbin/unbound/services/cache/dns.h
index 147f992cb..9b39aeb7f 100644
--- a/usr.sbin/unbound/services/cache/dns.h
+++ b/usr.sbin/unbound/services/cache/dns.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -142,8 +142,8 @@ void dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
  * @param expiretoplen: length of expiretop dname.
  * @return new delegation or NULL on error or if not found in cache.
  */
-struct delegpt* dns_cache_find_delegation(struct module_env* env, 
-	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 
+struct delegpt* dns_cache_find_delegation(struct module_env* env,
+	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 	struct regional* region, struct dns_msg** msg, time_t timenow,
 	int noexpiredabove, uint8_t* expiretop, size_t expiretoplen);
 
@@ -164,8 +164,8 @@ struct dns_msg* tomsg(struct module_env* env, struct query_info* q,
 	struct reply_info* r, struct regional* region, time_t now,
 	int allow_expired, struct regional* scratch);
 
-/** 
- * Find cached message 
+/**
+ * Find cached message
  * @param env: module environment with the DNS cache.
  * @param qname: query name.
  * @param qnamelen: length of qname.
@@ -187,15 +187,15 @@ struct dns_msg* dns_cache_lookup(struct module_env* env,
 	uint16_t flags, struct regional* region, struct regional* scratch,
 	int no_partial, uint8_t* dpname, size_t dpnamelen);
 
-/** 
- * find and add A and AAAA records for missing nameservers in delegpt 
+/**
+ * find and add A and AAAA records for missing nameservers in delegpt
  * @param env: module environment with rrset cache
  * @param qclass: which class to look in.
  * @param region: where to store new dp info.
  * @param dp: delegation point to fill missing entries.
  * @return false on alloc failure.
  */
-int cache_fill_missing(struct module_env* env, uint16_t qclass, 
+int cache_fill_missing(struct module_env* env, uint16_t qclass,
 	struct regional* region, struct delegpt* dp);
 
 /**
@@ -209,7 +209,7 @@ int cache_fill_missing(struct module_env* env, uint16_t qclass,
  * @param capacity: number of rrsets space to create in the array.
  * @return new dns_msg struct or NULL on mem fail.
  */
-struct dns_msg* dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype, 
+struct dns_msg* dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	uint16_t qclass, struct regional* region, size_t capacity);
 
 /**
@@ -221,7 +221,7 @@ struct dns_msg* dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
  * @param now: now.
  * @return true if worked, false on fail
  */
-int dns_msg_authadd(struct dns_msg* msg, struct regional* region, 
+int dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now);
 
 /**
@@ -233,7 +233,7 @@ int dns_msg_authadd(struct dns_msg* msg, struct regional* region,
  * @param now: now.
  * @return true if worked, false on fail
  */
-int dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 
+int dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now);
 
 /**
diff --git a/usr.sbin/unbound/services/cache/infra.c b/usr.sbin/unbound/services/cache/infra.c
index 537cb949c..2442696a7 100644
--- a/usr.sbin/unbound/services/cache/infra.c
+++ b/usr.sbin/unbound/services/cache/infra.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -67,7 +67,7 @@ int infra_dp_ratelimit = 0;
  *  in queries per second. */
 int infra_ip_ratelimit = 0;
 
-size_t 
+size_t
 infra_sizefunc(void* k, void* ATTR_UNUSED(d))
 {
 	struct infra_key* key = (struct infra_key*)k;
@@ -75,7 +75,7 @@ infra_sizefunc(void* k, void* ATTR_UNUSED(d))
 		+ lock_get_mem(&key->entry.lock);
 }
 
-int 
+int
 infra_compfunc(void* key1, void* key2)
 {
 	struct infra_key* k1 = (struct infra_key*)key1;
@@ -91,7 +91,7 @@ infra_compfunc(void* key1, void* key2)
 	return query_dname_compare(k1->zonename, k2->zonename);
 }
 
-void 
+void
 infra_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
 {
 	struct infra_key* key = (struct infra_key*)k;
@@ -102,14 +102,14 @@ infra_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
 	free(key);
 }
 
-void 
+void
 infra_deldatafunc(void* d, void* ATTR_UNUSED(arg))
 {
 	struct infra_data* data = (struct infra_data*)d;
 	free(data);
 }
 
-size_t 
+size_t
 rate_sizefunc(void* k, void* ATTR_UNUSED(d))
 {
 	struct rate_key* key = (struct rate_key*)k;
@@ -117,7 +117,7 @@ rate_sizefunc(void* k, void* ATTR_UNUSED(d))
 		+ lock_get_mem(&key->entry.lock);
 }
 
-int 
+int
 rate_compfunc(void* key1, void* key2)
 {
 	struct rate_key* k1 = (struct rate_key*)key1;
@@ -130,7 +130,7 @@ rate_compfunc(void* key1, void* key2)
 	return query_dname_compare(k1->name, k2->name);
 }
 
-void 
+void
 rate_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
 {
 	struct rate_key* key = (struct rate_key*)k;
@@ -141,7 +141,7 @@ rate_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
 	free(key);
 }
 
-void 
+void
 rate_deldatafunc(void* d, void* ATTR_UNUSED(arg))
 {
 	struct rate_data* data = (struct rate_data*)d;
@@ -172,7 +172,7 @@ static struct domain_limit_data* domain_limit_findcreate(
 		free(nm);
 		return d;
 	}
-	
+
 	/* create it */
 	d = (struct domain_limit_data*)calloc(1, sizeof(*d));
 	if(!d) {
@@ -229,10 +229,10 @@ setup_domain_limits(struct infra_cache* infra, struct config_file* cfg)
 	return 1;
 }
 
-struct infra_cache* 
+struct infra_cache*
 infra_create(struct config_file* cfg)
 {
-	struct infra_cache* infra = (struct infra_cache*)calloc(1, 
+	struct infra_cache* infra = (struct infra_cache*)calloc(1,
 		sizeof(struct infra_cache));
 	size_t maxmem = cfg->infra_cache_numhosts * (sizeof(struct infra_key)+
 		sizeof(struct infra_data)+INFRA_BYTES_NAME);
@@ -282,7 +282,7 @@ static void domain_limit_free(rbnode_type* n, void* ATTR_UNUSED(arg))
 	}
 }
 
-void 
+void
 infra_delete(struct infra_cache* infra)
 {
 	if(!infra)
@@ -294,7 +294,7 @@ infra_delete(struct infra_cache* infra)
 	free(infra);
 }
 
-struct infra_cache* 
+struct infra_cache*
 infra_adjust(struct infra_cache* infra, struct config_file* cfg)
 {
 	size_t maxmem;
@@ -363,7 +363,7 @@ hash_infra(struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* name)
 }
 
 /** lookup version that does not check host ttl (you check it) */
-struct lruhash_entry* 
+struct lruhash_entry*
 infra_lookup_nottl(struct infra_cache* infra, struct sockaddr_storage* addr,
 	socklen_t addrlen, uint8_t* name, size_t namelen, int wr)
 {
@@ -380,7 +380,7 @@ infra_lookup_nottl(struct infra_cache* infra, struct sockaddr_storage* addr,
 
 /** init the data elements */
 static void
-data_entry_init(struct infra_cache* infra, struct lruhash_entry* e, 
+data_entry_init(struct infra_cache* infra, struct lruhash_entry* e,
 	time_t timenow)
 {
 	struct infra_data* data = (struct infra_data*)e->data;
@@ -398,8 +398,8 @@ data_entry_init(struct infra_cache* infra, struct lruhash_entry* e,
 	data->timeout_other = 0;
 }
 
-/** 
- * Create and init a new entry for a host 
+/**
+ * Create and init a new entry for a host
  * @param infra: infra structure with config parameters.
  * @param addr: host address.
  * @param addrlen: length of addr.
@@ -409,7 +409,7 @@ data_entry_init(struct infra_cache* infra, struct lruhash_entry* e,
  * @return: the new entry or NULL on malloc failure.
  */
 static struct lruhash_entry*
-new_entry(struct infra_cache* infra, struct sockaddr_storage* addr, 
+new_entry(struct infra_cache* infra, struct sockaddr_storage* addr,
 	socklen_t addrlen, uint8_t* name, size_t namelen, time_t tm)
 {
 	struct infra_data* data;
@@ -438,7 +438,7 @@ new_entry(struct infra_cache* infra, struct sockaddr_storage* addr,
 	return &key->entry;
 }
 
-int 
+int
 infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
         socklen_t addrlen, uint8_t* nm, size_t nmlen, time_t timenow,
 	int* edns_vs, uint8_t* edns_lame_known, int* to)
@@ -510,7 +510,7 @@ infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 	return 1;
 }
 
-int 
+int
 infra_set_lame(struct infra_cache* infra, struct sockaddr_storage* addr,
 	socklen_t addrlen, uint8_t* nm, size_t nmlen, time_t timenow,
 	int dnsseclame, int reclame, uint16_t qtype)
@@ -548,7 +548,7 @@ infra_set_lame(struct infra_cache* infra, struct sockaddr_storage* addr,
 	return 1;
 }
 
-void 
+void
 infra_update_tcp_works(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen, uint8_t* nm,
 	size_t nmlen)
@@ -566,7 +566,7 @@ infra_update_tcp_works(struct infra_cache* infra,
 	lock_rw_unlock(&e->lock);
 }
 
-int 
+int
 infra_rtt_update(struct infra_cache* infra, struct sockaddr_storage* addr,
 	socklen_t addrlen, uint8_t* nm, size_t nmlen, int qtype,
 	int roundtrip, int orig_rtt, time_t timenow)
@@ -654,7 +654,7 @@ long long infra_get_host_rto(struct infra_cache* infra,
 	return ttl;
 }
 
-int 
+int
 infra_edns_update(struct infra_cache* infra, struct sockaddr_storage* addr,
 	socklen_t addrlen, uint8_t* nm, size_t nmlen, int edns_version,
 	time_t timenow)
@@ -688,13 +688,13 @@ infra_edns_update(struct infra_cache* infra, struct sockaddr_storage* addr,
 int
 infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-        uint8_t* name, size_t namelen, uint16_t qtype, 
+        uint8_t* name, size_t namelen, uint16_t qtype,
 	int* lame, int* dnsseclame, int* reclame, int* rtt, time_t timenow)
 {
 	struct infra_data* host;
 	struct lruhash_entry* e = infra_lookup_nottl(infra, addr, addrlen,
 		name, namelen, 0);
-	if(!e) 
+	if(!e)
 		return 0;
 	host = (struct infra_data*)e->data;
 	*rtt = rtt_unclamped(&host->rtt);
@@ -965,7 +965,7 @@ int infra_ratelimit_inc(struct infra_cache* infra, uint8_t* name,
 	lim = infra_find_ratelimit(infra, name, namelen);
 	if(!lim)
 		return 1; /* disabled for this domain */
-	
+
 	/* find or insert ratedata */
 	entry = infra_find_ratedata(infra, name, namelen, 1);
 	if(entry) {
@@ -1041,7 +1041,7 @@ int infra_ratelimit_exceeded(struct infra_cache* infra, uint8_t* name,
 	return (max > lim);
 }
 
-size_t 
+size_t
 infra_get_mem(struct infra_cache* infra)
 {
 	size_t s = sizeof(*infra) + slabhash_get_mem(infra->hosts);
diff --git a/usr.sbin/unbound/services/cache/infra.h b/usr.sbin/unbound/services/cache/infra.h
index faf7fd2f3..32f23cc07 100644
--- a/usr.sbin/unbound/services/cache/infra.h
+++ b/usr.sbin/unbound/services/cache/infra.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -84,7 +84,7 @@ struct infra_data {
 	/** edns version that the host supports, -1 means no EDNS */
 	int edns_version;
 	/** if the EDNS lameness is already known or not.
-	 * EDNS lame is when EDNS queries or replies are dropped, 
+	 * EDNS lame is when EDNS queries or replies are dropped,
 	 * and cause a timeout */
 	uint8_t edns_lame_known;
 
@@ -107,7 +107,7 @@ struct infra_data {
 };
 
 /**
- * Infra cache 
+ * Infra cache
  */
 struct infra_cache {
 	/** The hash table with hosts */
@@ -212,7 +212,7 @@ void infra_delete(struct infra_cache* infra);
  * @param cfg: config options.
  * @return the new infra cache pointer or NULL on error.
  */
-struct infra_cache* infra_adjust(struct infra_cache* infra, 
+struct infra_cache* infra_adjust(struct infra_cache* infra,
 	struct config_file* cfg);
 
 /**
@@ -231,7 +231,7 @@ struct lruhash_entry* infra_lookup_nottl(struct infra_cache* infra,
 
 /**
  * Find host information to send a packet. Creates new entry if not found.
- * Lameness is empty. EDNS is 0 (try with first), and rtt is returned for 
+ * Lameness is empty. EDNS is 0 (try with first), and rtt is returned for
  * the first message to it.
  * Use this to send a packet only, because it also locks out others when
  * probing is restricted.
@@ -247,7 +247,7 @@ struct lruhash_entry* infra_lookup_nottl(struct infra_cache* infra,
  * @param to: timeout to use, is returned.
  * @return: 0 on error.
  */
-int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr, 
+int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 	socklen_t addrlen, uint8_t* name, size_t namelen,
 	time_t timenow, int* edns_vs, uint8_t* edns_lame_known, int* to);
 
@@ -279,7 +279,7 @@ int infra_set_lame(struct infra_cache* infra,
  * @param name: zone name
  * @param namelen: zone name length
  * @param qtype: query type.
- * @param roundtrip: estimate of roundtrip time in milliseconds or -1 for 
+ * @param roundtrip: estimate of roundtrip time in milliseconds or -1 for
  * 	timeout.
  * @param orig_rtt: original rtt for the query that timed out (roundtrip==-1).
  * 	ignored if roundtrip != -1.
@@ -337,8 +337,8 @@ int infra_edns_update(struct infra_cache* infra,
  * @return if found in cache, or false if not (or TTL bad).
  */
 int infra_get_lame_rtt(struct infra_cache* infra,
-        struct sockaddr_storage* addr, socklen_t addrlen, 
-	uint8_t* name, size_t namelen, uint16_t qtype, 
+        struct sockaddr_storage* addr, socklen_t addrlen,
+	uint8_t* name, size_t namelen, uint16_t qtype,
 	int* lame, int* dnsseclame, int* reclame, int* rtt, time_t timenow);
 
 /**
diff --git a/usr.sbin/unbound/services/cache/rrset.c b/usr.sbin/unbound/services/cache/rrset.c
index 4e3d08bda..a2330274a 100644
--- a/usr.sbin/unbound/services/cache/rrset.c
+++ b/usr.sbin/unbound/services/cache/rrset.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -57,7 +57,7 @@ rrset_markdel(void* key)
 	r->id = 0;
 }
 
-struct rrset_cache* rrset_cache_create(struct config_file* cfg, 
+struct rrset_cache* rrset_cache_create(struct config_file* cfg,
 	struct alloc_cache* alloc)
 {
 	size_t slabs = (cfg?cfg->rrset_cache_slabs:HASH_DEFAULT_SLABS);
@@ -73,13 +73,13 @@ struct rrset_cache* rrset_cache_create(struct config_file* cfg,
 
 void rrset_cache_delete(struct rrset_cache* r)
 {
-	if(!r) 
+	if(!r)
 		return;
 	slabhash_delete(&r->table);
 	/* slabhash delete also does free(r), since table is first in struct*/
 }
 
-struct rrset_cache* rrset_cache_adjust(struct rrset_cache *r, 
+struct rrset_cache* rrset_cache_adjust(struct rrset_cache *r,
 	struct config_file* cfg, struct alloc_cache* alloc)
 {
 	if(!r || !cfg || !slabhash_is_size(&r->table, cfg->rrset_cache_size,
@@ -91,13 +91,13 @@ struct rrset_cache* rrset_cache_adjust(struct rrset_cache *r,
 	return r;
 }
 
-void 
+void
 rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
         hashvalue_type hash, rrset_id_type id)
 {
 	struct lruhash* table = slabhash_gettable(&r->table, hash);
-	/* 
-	 * This leads to locking problems, deadlocks, if the caller is 
+	/*
+	 * This leads to locking problems, deadlocks, if the caller is
 	 * holding any other rrset lock.
 	 * Because a lookup through the hashtable does:
 	 *	tablelock -> entrylock  (for that entry caller holds)
@@ -127,20 +127,20 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
 {
 	struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
 	struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
-	/* 	o store if rrset has been validated 
-	 *  		everything better than bogus data 
+	/* 	o store if rrset has been validated
+	 *  		everything better than bogus data
 	 *  		secure is preferred */
 	if( newd->security == sec_status_secure &&
 		cached->security != sec_status_secure)
 		return 1;
-	if( cached->security == sec_status_bogus && 
+	if( cached->security == sec_status_bogus &&
 		newd->security != sec_status_bogus && !equal)
 		return 1;
         /*      o if current RRset is more trustworthy - insert it */
         if( newd->trust > cached->trust ) {
 		/* if the cached rrset is bogus, and this one equal,
 		 * do not update the TTL - let it expire. */
-		if(equal && cached->ttl >= timenow && 
+		if(equal && cached->ttl >= timenow &&
 			cached->security == sec_status_bogus)
 			return 0;
                 return 1;
@@ -182,7 +182,7 @@ rrset_update_id(struct rrset_ref* ref, struct alloc_cache* alloc)
 	lock_rw_unlock(&ref->key->entry.lock);
 }
 
-int 
+int
 rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 	struct alloc_cache* alloc, time_t timenow)
 {
@@ -200,7 +200,7 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 		 * the passed key in favor of the already stored key.
 		 * because of the small gap (see below) this key ptr and id
 		 * may prove later to be already deleted, which is no problem
-		 * as it only makes a cache miss. 
+		 * as it only makes a cache miss.
 		 */
 		ref->key = (struct ub_packed_rrset_key*)e->key;
 		ref->id = ref->key->id;
@@ -226,10 +226,10 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 	log_assert(ref->key->id != 0);
 	slabhash_insert(&r->table, h, &k->entry, k->entry.data, alloc);
 	if(e) {
-		/* For NSEC, NSEC3, DNAME, when rdata is updated, update 
-		 * the ID number so that proofs in message cache are 
+		/* For NSEC, NSEC3, DNAME, when rdata is updated, update
+		 * the ID number so that proofs in message cache are
 		 * invalidated */
-		if((rrset_type == LDNS_RR_TYPE_NSEC 
+		if((rrset_type == LDNS_RR_TYPE_NSEC
 			|| rrset_type == LDNS_RR_TYPE_NSEC3
 			|| rrset_type == LDNS_RR_TYPE_DNAME) && !equal) {
 			rrset_update_id(ref, alloc);
@@ -239,7 +239,7 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 	return 0;
 }
 
-void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache, 
+void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	struct ub_packed_rrset_key* rrset, uint8_t* ce, size_t ce_len,
 	struct alloc_cache* alloc, time_t timenow)
 {
@@ -272,14 +272,14 @@ void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	(void)rrset_cache_update(rrset_cache, &ref, alloc, timenow);
 }
 
-struct ub_packed_rrset_key* 
-rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen, 
+struct ub_packed_rrset_key*
+rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 	uint16_t qtype, uint16_t qclass, uint32_t flags, time_t timenow,
 	int wr)
 {
 	struct lruhash_entry* e;
 	struct ub_packed_rrset_key key;
-	
+
 	key.entry.key = &key;
 	key.entry.data = NULL;
 	key.rk.dname = qname;
@@ -292,7 +292,7 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 
 	if((e = slabhash_lookup(&r->table, key.entry.hash, &key, wr))) {
 		/* check TTL */
-		struct packed_rrset_data* data = 
+		struct packed_rrset_data* data =
 			(struct packed_rrset_data*)e->data;
 		if(timenow > data->ttl) {
 			lock_rw_unlock(&e->lock);
@@ -304,7 +304,7 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 	return NULL;
 }
 
-int 
+int
 rrset_array_lock(struct rrset_ref* ref, size_t count, time_t timenow)
 {
 	size_t i;
@@ -323,7 +323,7 @@ rrset_array_lock(struct rrset_ref* ref, size_t count, time_t timenow)
 	return 1;
 }
 
-void 
+void
 rrset_array_unlock(struct rrset_ref* ref, size_t count)
 {
 	size_t i;
@@ -334,7 +334,7 @@ rrset_array_unlock(struct rrset_ref* ref, size_t count)
 	}
 }
 
-void 
+void
 rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
 	struct rrset_ref* ref, size_t count)
 {
@@ -363,11 +363,11 @@ rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
 	}
 }
 
-void 
-rrset_update_sec_status(struct rrset_cache* r, 
+void
+rrset_update_sec_status(struct rrset_cache* r,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	struct packed_rrset_data* updata = 
+	struct packed_rrset_data* updata =
 		(struct packed_rrset_data*)rrset->entry.data;
 	struct lruhash_entry* e;
 	struct packed_rrset_data* cachedata;
@@ -403,11 +403,11 @@ rrset_update_sec_status(struct rrset_cache* r,
 	lock_rw_unlock(&e->lock);
 }
 
-void 
-rrset_check_sec_status(struct rrset_cache* r, 
+void
+rrset_check_sec_status(struct rrset_cache* r,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	struct packed_rrset_data* updata = 
+	struct packed_rrset_data* updata =
 		(struct packed_rrset_data*)rrset->entry.data;
 	struct lruhash_entry* e;
 	struct packed_rrset_data* cachedata;
@@ -431,7 +431,7 @@ rrset_check_sec_status(struct rrset_cache* r,
 			for(i=0; i<cachedata->count+cachedata->rrsig_count; i++)
 				if(cachedata->rr_ttl[i] < now)
 					updata->rr_ttl[i] = 0;
-				else updata->rr_ttl[i] = 
+				else updata->rr_ttl[i] =
 					cachedata->rr_ttl[i]-now;
 		}
 		if(cachedata->trust > updata->trust)
diff --git a/usr.sbin/unbound/services/cache/rrset.h b/usr.sbin/unbound/services/cache/rrset.h
index 7c36d4032..581445f08 100644
--- a/usr.sbin/unbound/services/cache/rrset.h
+++ b/usr.sbin/unbound/services/cache/rrset.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -64,7 +64,7 @@ struct rrset_cache {
  * @param alloc: initial default rrset key allocation.
  * @return: NULL on error.
  */
-struct rrset_cache* rrset_cache_create(struct config_file* cfg, 
+struct rrset_cache* rrset_cache_create(struct config_file* cfg,
 	struct alloc_cache* alloc);
 
 /**
@@ -82,7 +82,7 @@ void rrset_cache_delete(struct rrset_cache* r);
  * @param alloc: initial default rrset key allocation.
  * @return 0 on error, or new rrset cache pointer on success.
  */
-struct rrset_cache* rrset_cache_adjust(struct rrset_cache* r, 
+struct rrset_cache* rrset_cache_adjust(struct rrset_cache* r,
 	struct config_file* cfg, struct alloc_cache* alloc);
 
 /**
@@ -91,7 +91,7 @@ struct rrset_cache* rrset_cache_adjust(struct rrset_cache* r,
  *
  * This routine is faster than a hashtable lookup:
  *	o no bin_lock is acquired.
- *	o no walk through the bin-overflow-list. 
+ *	o no walk through the bin-overflow-list.
  *	o no comparison of the entry key to find it.
  *
  * @param r: rrset cache.
@@ -130,7 +130,7 @@ void rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
  * 	2: reference updated, item in cache is considered superior.
  *	   also the rdata is equal (but other parameters in cache are superior).
  */
-int rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref, 
+int rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 	struct alloc_cache* alloc, time_t timenow);
 
 /**
@@ -140,14 +140,14 @@ int rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
  * necessary.
  *
  * @param rrset_cache: the rrset cache.
- * @param rrset: which rrset to cache as wildcard. This rrset is left 
+ * @param rrset: which rrset to cache as wildcard. This rrset is left
  * 	untouched.
  * @param ce: the closest encloser, will be uses to generate the wildcard dname.
  * @param ce_len: the closest encloser length.
  * @param alloc: how to allocate (and deallocate) the special rrset key.
  * @param timenow: current time (to see if ttl in cache is expired).
  */
-void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache, 
+void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	struct ub_packed_rrset_key* rrset, uint8_t* ce, size_t ce_len,
 	struct alloc_cache* alloc, time_t timenow);
 
@@ -179,7 +179,7 @@ struct ub_packed_rrset_key* rrset_cache_lookup(struct rrset_cache* r,
  * @return true on success, false on a failure, which can be that some
  * 	RRsets have timed out, or that they do not exist any more, the
  *	RRsets have been purged from the cache.
- *	If true, you hold readlocks on all the ref items. 
+ *	If true, you hold readlocks on all the ref items.
  */
 int rrset_array_lock(struct rrset_ref* ref, size_t count, time_t timenow);
 
@@ -211,24 +211,24 @@ void rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
  * If found, checks if rdata is equal.
  * If so, it will update the security, trust and rrset-ttl values.
  * The values are only updated if security is increased (towards secure).
- * @param r: the rrset cache. 
- * @param rrset: which rrset to attempt to update. This rrset is left 
+ * @param r: the rrset cache.
+ * @param rrset: which rrset to attempt to update. This rrset is left
  * 	untouched. The rrset in the cache is updated in-place.
  * @param now: current time.
  */
-void rrset_update_sec_status(struct rrset_cache* r, 
+void rrset_update_sec_status(struct rrset_cache* r,
 	struct ub_packed_rrset_key* rrset, time_t now);
 
 /**
  * Looks up security status of an rrset. Looks up the rrset.
  * If found, checks if rdata is equal, and entry did not expire.
  * If so, it will update the security, trust and rrset-ttl values.
- * @param r: the rrset cache. 
+ * @param r: the rrset cache.
  * @param rrset: This rrset may change security status due to the cache.
  * 	But its status will only improve, towards secure.
  * @param now: current time.
  */
-void rrset_check_sec_status(struct rrset_cache* r, 
+void rrset_check_sec_status(struct rrset_cache* r,
 	struct ub_packed_rrset_key* rrset, time_t now);
 
 /**
diff --git a/usr.sbin/unbound/services/modstack.c b/usr.sbin/unbound/services/modstack.c
index da8e623c1..3ba6fa838 100644
--- a/usr.sbin/unbound/services/modstack.c
+++ b/usr.sbin/unbound/services/modstack.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -218,7 +218,7 @@ module_func_block* module_factory(const char** str)
         return NULL;
 }
 
-int 
+int
 modstack_setup(struct module_stack* stack, const char* module_conf,
 	struct module_env* env)
 {
@@ -243,7 +243,7 @@ modstack_setup(struct module_stack* stack, const char* module_conf,
 	return 1;
 }
 
-void 
+void
 modstack_desetup(struct module_stack* stack, struct module_env* env)
 {
         int i;
@@ -256,7 +256,7 @@ modstack_desetup(struct module_stack* stack, struct module_env* env)
         stack->mod = NULL;
 }
 
-int 
+int
 modstack_find(struct module_stack* stack, const char* name)
 {
 	int i;
diff --git a/usr.sbin/unbound/services/modstack.h b/usr.sbin/unbound/services/modstack.h
index 3ff01b54d..54c03d1e2 100644
--- a/usr.sbin/unbound/services/modstack.h
+++ b/usr.sbin/unbound/services/modstack.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -62,7 +62,7 @@ void modstack_init(struct module_stack* stack);
 
 /**
  * Read config file module settings and set up the modfunc block
- * @param stack: the stack of modules (empty before call). 
+ * @param stack: the stack of modules (empty before call).
  * @param module_conf: string what modules to insert.
  * @return false on error
  */
diff --git a/usr.sbin/unbound/services/outbound_list.c b/usr.sbin/unbound/services/outbound_list.c
index ad73380bc..3881258f1 100644
--- a/usr.sbin/unbound/services/outbound_list.c
+++ b/usr.sbin/unbound/services/outbound_list.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -44,13 +44,13 @@
 #include "services/outbound_list.h"
 #include "services/outside_network.h"
 
-void 
+void
 outbound_list_init(struct outbound_list* list)
 {
 	list->first = NULL;
 }
 
-void 
+void
 outbound_list_clear(struct outbound_list* list)
 {
 	struct outbound_entry *p, *np;
@@ -64,7 +64,7 @@ outbound_list_clear(struct outbound_list* list)
 	outbound_list_init(list);
 }
 
-void 
+void
 outbound_list_insert(struct outbound_list* list, struct outbound_entry* e)
 {
 	if(list->first)
@@ -74,7 +74,7 @@ outbound_list_insert(struct outbound_list* list, struct outbound_entry* e)
 	list->first = e;
 }
 
-void 
+void
 outbound_list_remove(struct outbound_list* list, struct outbound_entry* e)
 {
 	if(!e)
diff --git a/usr.sbin/unbound/services/outbound_list.h b/usr.sbin/unbound/services/outbound_list.h
index 73c137d50..7e26a11d2 100644
--- a/usr.sbin/unbound/services/outbound_list.h
+++ b/usr.sbin/unbound/services/outbound_list.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -90,16 +90,16 @@ void outbound_list_clear(struct outbound_list* list);
  * @param e: entry to add, it is only half initialised at call start, fully
  *	initialised at call end.
  */
-void outbound_list_insert(struct outbound_list* list, 
+void outbound_list_insert(struct outbound_list* list,
 	struct outbound_entry* e);
 
 /**
- * Remove an entry from the list, and deletes it. 
+ * Remove an entry from the list, and deletes it.
  * Deletes serviced query in the entry.
  * @param list: the list to remove from.
  * @param e: the entry to remove.
  */
-void outbound_list_remove(struct outbound_list* list, 
+void outbound_list_remove(struct outbound_list* list,
 	struct outbound_entry* e);
 
 #endif /* SERVICES_OUTBOUND_LIST_H */
diff --git a/usr.sbin/unbound/services/outside_network.c b/usr.sbin/unbound/services/outside_network.c
index a4529ade5..9e2a3f8c9 100644
--- a/usr.sbin/unbound/services/outside_network.c
+++ b/usr.sbin/unbound/services/outside_network.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -100,7 +100,7 @@ static int serviced_tcp_send(struct serviced_query* sq, sldns_buffer* buff);
 static void serviced_callbacks(struct serviced_query* sq, int error,
 	struct comm_point* c, struct comm_reply* rep);
 
-int 
+int
 pending_cmp(const void* key1, const void* key2)
 {
 	struct pending *p1 = (struct pending*)key1;
@@ -113,7 +113,7 @@ pending_cmp(const void* key1, const void* key2)
 	return sockaddr_cmp(&p1->addr, p1->addrlen, &p2->addr, p2->addrlen);
 }
 
-int 
+int
 serviced_cmp(const void* key1, const void* key2)
 {
 	struct serviced_query* q1 = (struct serviced_query*)key1;
@@ -188,7 +188,7 @@ int reuse_id_cmp(const void* key1, const void* key2)
 	return 0;
 }
 
-/** delete waiting_tcp entry. Does not unlink from waiting list. 
+/** delete waiting_tcp entry. Does not unlink from waiting list.
  * @param w: to delete.
  */
 static void
@@ -200,7 +200,7 @@ waiting_tcp_delete(struct waiting_tcp* w)
 	free(w);
 }
 
-/** 
+/**
  * Pick random outgoing-interface of that family, and bind it.
  * port set to 0 so OS picks a port number for us.
  * if it is the ANY address, do not bind.
@@ -631,7 +631,7 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 
 	fd_set_nonblock(s);
 #ifdef USE_OSX_MSG_FASTOPEN
-	/* API for fast open is different here. We use a connectx() function and 
+	/* API for fast open is different here. We use a connectx() function and
 	   then writes can happen as normal even using SSL.*/
 	/* connectx requires that the len be set in the sockaddr struct*/
 	struct sockaddr_in *addr_in = (struct sockaddr_in *)&w->addr;
@@ -642,7 +642,7 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 	endpoints.sae_srcaddrlen = 0;
 	endpoints.sae_dstaddr = (struct sockaddr *)&w->addr;
 	endpoints.sae_dstaddrlen = w->addrlen;
-	if (connectx(s, &endpoints, SAE_ASSOCID_ANY,  
+	if (connectx(s, &endpoints, SAE_ASSOCID_ANY,
 	             CONNECT_DATA_IDEMPOTENT | CONNECT_RESUME_ON_READ_WRITE,
 	             NULL, 0, NULL, NULL) == -1) {
 		/* if fails, failover to connect for OSX 10.10 */
@@ -656,7 +656,7 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 #ifdef USE_MSG_FASTOPEN
 	pend->c->tcp_do_fastopen = 1;
 	/* Only do TFO for TCP in which case no connect() is required here.
-	   Don't combine client TFO with SSL, since OpenSSL can't 
+	   Don't combine client TFO with SSL, since OpenSSL can't
 	   currently support doing a handshake on fd that already isn't connected*/
 	if (w->outnet->sslctx && w->ssl_upstream) {
 		if(connect(s, (struct sockaddr*)&w->addr, w->addrlen) == -1) {
@@ -1141,7 +1141,7 @@ void reuse_del_readwait(rbtree_type* tree_by_id)
 
 /** decommission a tcp buffer, closes commpoint and frees waiting_tcp entry */
 static void
-decommission_pending_tcp(struct outside_network* outnet, 
+decommission_pending_tcp(struct outside_network* outnet,
 	struct pending_tcp* pend)
 {
 	verbose(VERB_CLIENT, "decommission_pending_tcp");
@@ -1248,7 +1248,7 @@ reuse_tcp_setup_read_and_timeout(struct pending_tcp* pend_tcp, int tcp_reuse_tim
 	comm_point_start_listening(pend_tcp->c, -1, tcp_reuse_timeout);
 }
 
-int 
+int
 outnet_tcp_cb(struct comm_point* c, void* arg, int error,
 	struct comm_reply *reply_info)
 {
@@ -1312,7 +1312,7 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error,
 	} else {
 		/* check ID */
 		if(sldns_buffer_limit(c->buffer) < sizeof(uint16_t)) {
-			log_addr(VERB_QUERY, 
+			log_addr(VERB_QUERY,
 				"outnettcp: bad ID in reply, too short, from:",
 				&pend->reuse.addr, pend->reuse.addrlen);
 			error = NETEVENT_CLOSED;
@@ -1423,7 +1423,7 @@ outnet_send_wait_udp(struct outside_network* outnet)
 			/* callback error on pending */
 			if(pend->cb) {
 				fptr_ok(fptr_whitelist_pending_udp(pend->cb));
-				(void)(*pend->cb)(outnet->unused_fds->cp, pend->cb_arg, 
+				(void)(*pend->cb)(outnet->unused_fds->cp, pend->cb_arg,
 					NETEVENT_CLOSED, NULL);
 			}
 			pending_delete(outnet, pend);
@@ -1433,7 +1433,7 @@ outnet_send_wait_udp(struct outside_network* outnet)
 	}
 }
 
-int 
+int
 outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	struct comm_reply *reply_info)
 {
@@ -1457,7 +1457,7 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	memcpy(&key.addr, &reply_info->remote_addr, reply_info->remote_addrlen);
 	key.addrlen = reply_info->remote_addrlen;
 	verbose(VERB_ALGO, "Incoming reply id = %4.4x", key.id);
-	log_addr(VERB_ALGO, "Incoming reply addr =", 
+	log_addr(VERB_ALGO, "Incoming reply addr =",
 		&reply_info->remote_addr, reply_info->remote_addrlen);
 
 	/* find it, see if this thing is a valid query response */
@@ -1467,7 +1467,7 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 		verbose(VERB_QUERY, "received unwanted or unsolicited udp reply dropped.");
 		log_buf(VERB_ALGO, "dropped message", c->buffer);
 		outnet->unwanted_replies++;
-		if(outnet->unwanted_threshold && ++outnet->unwanted_total 
+		if(outnet->unwanted_threshold && ++outnet->unwanted_total
 			>= outnet->unwanted_threshold) {
 			log_warn("unwanted reply total reached threshold (%u)"
 				" you may be under attack."
@@ -1487,7 +1487,7 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 		verbose(VERB_QUERY, "received reply id,addr on wrong port. "
 			"dropped.");
 		outnet->unwanted_replies++;
-		if(outnet->unwanted_threshold && ++outnet->unwanted_total 
+		if(outnet->unwanted_threshold && ++outnet->unwanted_total
 			>= outnet->unwanted_threshold) {
 			log_warn("unwanted reply total reached threshold (%u)"
 				" you may be under attack."
@@ -1515,8 +1515,8 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 }
 
 /** calculate number of ip4 and ip6 interfaces*/
-static void 
-calc_num46(char** ifs, int num_ifs, int do_ip4, int do_ip6, 
+static void
+calc_num46(char** ifs, int num_ifs, int do_ip4, int do_ip6,
 	int* num_ip4, int* num_ip6)
 {
 	int i;
@@ -1552,7 +1552,7 @@ pending_udp_timer_delay_cb(void* arg)
 	outnet_send_wait_udp(outnet);
 }
 
-void 
+void
 pending_udp_timer_cb(void *arg)
 {
 	struct pending* p = (struct pending*)arg;
@@ -1589,13 +1589,13 @@ create_pending_tcp(struct outside_network* outnet, size_t bufsize)
 			outnet->num_tcp, sizeof(struct pending_tcp*))))
 		return 0;
 	for(i=0; i<outnet->num_tcp; i++) {
-		if(!(outnet->tcp_conns[i] = (struct pending_tcp*)calloc(1, 
+		if(!(outnet->tcp_conns[i] = (struct pending_tcp*)calloc(1,
 			sizeof(struct pending_tcp))))
 			return 0;
 		outnet->tcp_conns[i]->next_free = outnet->tcp_free;
 		outnet->tcp_free = outnet->tcp_conns[i];
 		outnet->tcp_conns[i]->c = comm_point_create_tcp_out(
-			outnet->base, bufsize, outnet_tcp_cb, 
+			outnet->base, bufsize, outnet_tcp_cb,
 			outnet->tcp_conns[i]);
 		if(!outnet->tcp_conns[i]->c)
 			return 0;
@@ -1604,7 +1604,7 @@ create_pending_tcp(struct outside_network* outnet, size_t bufsize)
 }
 
 /** setup an outgoing interface, ready address */
-static int setup_if(struct port_if* pif, const char* addrstr, 
+static int setup_if(struct port_if* pif, const char* addrstr,
 	int* avail, int numavail, size_t numfd)
 {
 #ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
@@ -1619,18 +1619,18 @@ static int setup_if(struct port_if* pif, const char* addrstr,
 		return 0;
 	pif->maxout = (int)numfd;
 	pif->inuse = 0;
-	pif->out = (struct port_comm**)calloc(numfd, 
+	pif->out = (struct port_comm**)calloc(numfd,
 		sizeof(struct port_comm*));
 	if(!pif->out)
 		return 0;
 	return 1;
 }
 
-struct outside_network* 
-outside_network_create(struct comm_base *base, size_t bufsize, 
-	size_t num_ports, char** ifs, int num_ifs, int do_ip4, 
+struct outside_network*
+outside_network_create(struct comm_base *base, size_t bufsize,
+	size_t num_ports, char** ifs, int num_ifs, int do_ip4,
 	int do_ip6, size_t num_tcp, int dscp, struct infra_cache* infra,
-	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
+	struct ub_randstate* rnd, int use_caps_for_id, int* availports,
 	int numavailports, size_t unwanted_threshold, int tcp_mss,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env* dtenv,
@@ -1688,7 +1688,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 #ifndef INET6
 	do_ip6 = 0;
 #endif
-	calc_num46(ifs, num_ifs, do_ip4, do_ip6, 
+	calc_num46(ifs, num_ifs, do_ip4, do_ip6,
 		&outnet->num_ip4, &outnet->num_ip6);
 	if(outnet->num_ip4 != 0) {
 		if(!(outnet->ip4_ifs = (struct port_if*)calloc(
@@ -1726,7 +1726,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 			outside_network_delete(outnet);
 			return NULL;
 		}
-		pc->cp = comm_point_create_udp(outnet->base, -1, 
+		pc->cp = comm_point_create_udp(outnet->base, -1,
 			outnet->udp_buff, 0, outnet_udp_cb, outnet, NULL);
 		if(!pc->cp) {
 			log_err("malloc failed");
@@ -1740,13 +1740,13 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 
 	/* allocate interfaces */
 	if(num_ifs == 0) {
-		if(do_ip4 && !setup_if(&outnet->ip4_ifs[0], "0.0.0.0", 
+		if(do_ip4 && !setup_if(&outnet->ip4_ifs[0], "0.0.0.0",
 			availports, numavailports, num_ports)) {
 			log_err("malloc failed");
 			outside_network_delete(outnet);
 			return NULL;
 		}
-		if(do_ip6 && !setup_if(&outnet->ip6_ifs[0], "::", 
+		if(do_ip6 && !setup_if(&outnet->ip6_ifs[0], "::",
 			availports, numavailports, num_ports)) {
 			log_err("malloc failed");
 			outside_network_delete(outnet);
@@ -1799,16 +1799,16 @@ serviced_node_del(rbnode_type* node, void* ATTR_UNUSED(arg))
 	free(sq);
 }
 
-void 
+void
 outside_network_quit_prepare(struct outside_network* outnet)
 {
 	if(!outnet)
 		return;
 	/* prevent queued items from being sent */
-	outnet->want_to_quit = 1; 
+	outnet->want_to_quit = 1;
 }
 
-void 
+void
 outside_network_delete(struct outside_network* outnet)
 {
 	if(!outnet)
@@ -1909,7 +1909,7 @@ outside_network_delete(struct outside_network* outnet)
 	free(outnet);
 }
 
-void 
+void
 pending_delete(struct outside_network* outnet, struct pending* p)
 {
 	if(!p)
@@ -1983,13 +1983,13 @@ udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int pfxlen,
 			freebind = 1;
 			sai6_putrandom(&sa, pfxlen, rnd);
 		}
-		fd = create_udp_sock(AF_INET6, SOCK_DGRAM, 
+		fd = create_udp_sock(AF_INET6, SOCK_DGRAM,
 			(struct sockaddr*)&sa, addrlen, 1, inuse, &noproto,
 			0, 0, 0, NULL, 0, freebind, 0, dscp);
 	} else {
 		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
 		sa->sin_port = (in_port_t)htons((uint16_t)port);
-		fd = create_udp_sock(AF_INET, SOCK_DGRAM, 
+		fd = create_udp_sock(AF_INET, SOCK_DGRAM,
 			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto,
 			0, 0, 0, NULL, 0, 0, 0, dscp);
 	}
@@ -2107,7 +2107,7 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 			return 0;
 		}
 		if(fd != -1) {
-			verbose(VERB_ALGO, "opened UDP if=%d port=%d", 
+			verbose(VERB_ALGO, "opened UDP if=%d port=%d",
 				my_if, portno);
 			if(outnet->udp_connect) {
 				/* connect() to the destination */
@@ -2170,11 +2170,11 @@ randomize_and_send_udp(struct pending* pend, sldns_buffer* packet, int timeout)
 
 	/* select src_if, port */
 	if(addr_is_ip6(&pend->addr, pend->addrlen)) {
-		if(!select_ifport(outnet, pend, 
+		if(!select_ifport(outnet, pend,
 			outnet->num_ip6, outnet->ip6_ifs))
 			return 0;
 	} else {
-		if(!select_ifport(outnet, pend, 
+		if(!select_ifport(outnet, pend,
 			outnet->num_ip4, outnet->ip4_ifs))
 			return 0;
 	}
@@ -2216,7 +2216,7 @@ randomize_and_send_udp(struct pending* pend, sldns_buffer* packet, int timeout)
 	return 1;
 }
 
-struct pending* 
+struct pending*
 pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet,
 	int timeout, comm_point_callback_type* cb, void* cb_arg)
 {
@@ -2251,7 +2251,7 @@ pending_udp_query(struct serviced_query* sq, struct sldns_buffer* packet,
 		/* put at end of waiting list */
 		if(sq->outnet->udp_wait_last)
 			sq->outnet->udp_wait_last->next_waiting = pend;
-		else 
+		else
 			sq->outnet->udp_wait_first = pend;
 		sq->outnet->udp_wait_last = pend;
 		return pend;
@@ -2413,7 +2413,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 	}
 
 	/* allocate space to store query */
-	w = (struct waiting_tcp*)malloc(sizeof(struct waiting_tcp) 
+	w = (struct waiting_tcp*)malloc(sizeof(struct waiting_tcp)
 		+ sldns_buffer_limit(packet));
 	if(!w) {
 		return NULL;
@@ -2508,7 +2508,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 
 /** create query for serviced queries */
 static void
-serviced_gen_query(sldns_buffer* buff, uint8_t* qname, size_t qnamelen, 
+serviced_gen_query(sldns_buffer* buff, uint8_t* qname, size_t qnamelen,
 	uint16_t qtype, uint16_t qclass, uint16_t flags)
 {
 	sldns_buffer_clear(buff);
@@ -2768,7 +2768,7 @@ serviced_perturb_qname(struct ub_randstate* rnd, uint8_t* qbuf, size_t len)
 		while(lablen--) {
 			/* only perturb A-Z, a-z */
 			if(isalpha((unsigned char)*d)) {
-				/* get a random bit */	
+				/* get a random bit */
 				if(bits == 0) {
 					random = ub_random(rnd);
 					bits = 30;
@@ -2867,8 +2867,8 @@ serviced_udp_send(struct serviced_query* sq, sldns_buffer* buff)
 	if(sq->status == serviced_initial) {
 		if(vs != -1) {
 			sq->status = serviced_query_UDP_EDNS;
-		} else { 	
-			sq->status = serviced_query_UDP; 
+		} else {
+			sq->status = serviced_query_UDP;
 		}
 	}
 	serviced_encode(sq, buff, (sq->status == serviced_query_UDP_EDNS) ||
@@ -2952,7 +2952,7 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 	 * queries that are identical to this one. */
 	rbtree_delete(sq->outnet->serviced, sq);
 	log_assert(rem); /* should have been present */
-	sq->to_be_deleted = 1; 
+	sq->to_be_deleted = 1;
 	verbose(VERB_ALGO, "svcd callbacks start");
 	if(sq->outnet->use_caps_for_id && error == NETEVENT_NOERROR && c &&
 		!sq->nocaps && sq->qtype != LDNS_RR_TYPE_PTR) {
@@ -2962,30 +2962,30 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 		/* noerror and nxdomain must have a qname in reply */
 		if(sldns_buffer_read_u16_at(c->buffer, 4) == 0 &&
 			(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
-				== LDNS_RCODE_NOERROR || 
+				== LDNS_RCODE_NOERROR ||
 			 LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
 				== LDNS_RCODE_NXDOMAIN)) {
 			verbose(VERB_DETAIL, "no qname in reply to check 0x20ID");
-			log_addr(VERB_DETAIL, "from server", 
+			log_addr(VERB_DETAIL, "from server",
 				&sq->addr, sq->addrlen);
 			log_buf(VERB_DETAIL, "for packet", c->buffer);
 			error = NETEVENT_CLOSED;
 			c = NULL;
 		} else if(sldns_buffer_read_u16_at(c->buffer, 4) > 0 &&
-			!serviced_check_qname(c->buffer, sq->qbuf, 
+			!serviced_check_qname(c->buffer, sq->qbuf,
 			sq->qbuflen)) {
 			verbose(VERB_DETAIL, "wrong 0x20-ID in reply qname");
-			log_addr(VERB_DETAIL, "from server", 
+			log_addr(VERB_DETAIL, "from server",
 				&sq->addr, sq->addrlen);
 			log_buf(VERB_DETAIL, "for packet", c->buffer);
 			error = NETEVENT_CAPSFAIL;
 			/* and cleanup too */
-			pkt_dname_tolower(c->buffer, 
+			pkt_dname_tolower(c->buffer,
 				sldns_buffer_at(c->buffer, 12));
 		} else {
 			verbose(VERB_ALGO, "good 0x20-ID in reply qname");
 			/* cleanup caps, prettier cache contents. */
-			pkt_dname_tolower(c->buffer, 
+			pkt_dname_tolower(c->buffer,
 				sldns_buffer_at(c->buffer, 12));
 		}
 	}
@@ -3023,7 +3023,7 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 	serviced_delete(sq);
 }
 
-int 
+int
 serviced_tcp_callback(struct comm_point* c, void* arg, int error,
         struct comm_reply* rep)
 {
@@ -3040,7 +3040,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 #endif
 	sq->pending = NULL; /* removed after this callback */
 	if(error != NETEVENT_NOERROR)
-		log_addr(VERB_QUERY, "tcp error for address", 
+		log_addr(VERB_QUERY, "tcp error for address",
 			&sq->addr, sq->addrlen);
 	if(error==NETEVENT_NOERROR)
 		infra_update_tcp_works(sq->outnet->infra, &sq->addr,
@@ -3061,25 +3061,25 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 	}
 #endif
 	if(error==NETEVENT_NOERROR && sq->status == serviced_query_TCP_EDNS &&
-		(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) == 
+		(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
 		LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(sldns_buffer_begin(
 		c->buffer)) == LDNS_RCODE_NOTIMPL) ) {
 		/* attempt to fallback to nonEDNS */
 		sq->status = serviced_query_TCP_EDNS_fallback;
 		serviced_tcp_initiate(sq, c->buffer);
 		return 0;
-	} else if(error==NETEVENT_NOERROR && 
+	} else if(error==NETEVENT_NOERROR &&
 		sq->status == serviced_query_TCP_EDNS_fallback &&
-			(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) == 
+			(LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
 			LDNS_RCODE_NOERROR || LDNS_RCODE_WIRE(
-			sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NXDOMAIN 
-			|| LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) 
+			sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NXDOMAIN
+			|| LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
 			== LDNS_RCODE_YXDOMAIN)) {
 		/* the fallback produced a result that looks promising, note
 		 * that this server should be approached without EDNS */
 		/* only store noEDNS in cache if domain is noDNSSEC */
 		if(!sq->want_dnssec)
-		  if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
+		  if(!infra_edns_update(sq->outnet->infra, &sq->addr,
 			sq->addrlen, sq->zone, sq->zonelen, -1,
 			*sq->outnet->now_secs))
 			log_err("Out of memory caching no edns for host");
@@ -3125,7 +3125,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 static void
 serviced_tcp_initiate(struct serviced_query* sq, sldns_buffer* buff)
 {
-	verbose(VERB_ALGO, "initiate TCP query %s", 
+	verbose(VERB_ALGO, "initiate TCP query %s",
 		sq->status==serviced_query_TCP_EDNS?"EDNS":"");
 	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
 	sq->last_sent_time = *sq->outnet->now_tv;
@@ -3211,7 +3211,7 @@ packet_edns_malformed(struct sldns_buffer* buf, int qtype)
 	return 0;
 }
 
-int 
+int
 serviced_udp_callback(struct comm_point* c, void* arg, int error,
         struct comm_reply* rep)
 {
@@ -3273,9 +3273,9 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			sq->outnet->now_tv, c->buffer);
 	}
 #endif
-	if( (sq->status == serviced_query_UDP_EDNS 
+	if( (sq->status == serviced_query_UDP_EDNS
 		||sq->status == serviced_query_UDP_EDNS_FRAG)
-		&& (LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) 
+		&& (LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer))
 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
 			sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL
 		    || packet_edns_malformed(c->buffer, sq->qtype)
@@ -3288,20 +3288,20 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
 		}
 		return 0;
-	} else if(sq->status == serviced_query_UDP_EDNS && 
+	} else if(sq->status == serviced_query_UDP_EDNS &&
 		!sq->edns_lame_known) {
 		/* now we know that edns queries received answers store that */
 		log_addr(VERB_ALGO, "serviced query: EDNS works for",
 			&sq->addr, sq->addrlen);
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen, 
+		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
 			sq->zone, sq->zonelen, 0, (time_t)now.tv_sec)) {
 			log_err("Out of memory caching edns works");
 		}
 		sq->edns_lame_known = 1;
 	} else if(sq->status == serviced_query_UDP_EDNS_fallback &&
 		!sq->edns_lame_known && (LDNS_RCODE_WIRE(
-		sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR || 
-		LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) == 
+		sldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR ||
+		LDNS_RCODE_WIRE(sldns_buffer_begin(c->buffer)) ==
 		LDNS_RCODE_NXDOMAIN || LDNS_RCODE_WIRE(sldns_buffer_begin(
 		c->buffer)) == LDNS_RCODE_YXDOMAIN)) {
 		/* the fallback produced a result that looks promising, note
@@ -3332,7 +3332,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		/* in case the system hibernated, do not enter a huge value,
 		 * above this value gives trouble with server selection */
 		if(roundtime < 60000) {
-		    if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen, 
+		    if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
 			sq->zone, sq->zonelen, sq->qtype, roundtime,
 			sq->last_rtt, (time_t)now.tv_sec))
 			log_err("out of memory noting rtt.");
@@ -3357,7 +3357,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 	return 0;
 }
 
-struct serviced_query* 
+struct serviced_query*
 outnet_serviced_query(struct outside_network* outnet,
 	struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
 	int nocaps, int check_ratelimit, int tcp_upstream, int ssl_upstream,
@@ -3569,7 +3569,7 @@ fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
 		} else {
 			struct sockaddr_in* sa = (struct sockaddr_in*)addr;
 			sa->sin_port = (in_port_t)htons((uint16_t)port);
-			fd = create_udp_sock(AF_INET, SOCK_DGRAM, 
+			fd = create_udp_sock(AF_INET, SOCK_DGRAM,
 				(struct sockaddr*)addr, addrlen, 1, &inuse, &noproto,
 				0, 0, 0, NULL, 0, freebind, 0, dscp);
 		}
@@ -3807,7 +3807,7 @@ if_get_mem(struct port_if* pif)
 #endif
 		sizeof(struct port_comm*)*pif->maxout;
 	for(i=0; i<pif->inuse; i++)
-		s += sizeof(*pif->out[i]) + 
+		s += sizeof(*pif->out[i]) +
 			comm_point_get_mem(pif->out[i]->cp);
 	return s;
 }
@@ -3830,8 +3830,8 @@ size_t outnet_get_mem(struct outside_network* outnet)
 	struct serviced_query* sq;
 	struct service_callback* sb;
 	struct port_comm* pc;
-	size_t s = sizeof(*outnet) + sizeof(*outnet->base) + 
-		sizeof(*outnet->udp_buff) + 
+	size_t s = sizeof(*outnet) + sizeof(*outnet->base) +
+		sizeof(*outnet->udp_buff) +
 		sldns_buffer_capacity(outnet->udp_buff);
 	/* second buffer is not ours */
 	for(pc = outnet->unused_fds; pc; pc = pc->next) {
@@ -3843,7 +3843,7 @@ size_t outnet_get_mem(struct outside_network* outnet)
 		s += if_get_mem(&outnet->ip6_ifs[k]);
 	for(u=outnet->udp_wait_first; u; u=u->next_waiting)
 		s += waiting_udp_get_mem(u);
-	
+
 	s += sizeof(struct pending_tcp*)*outnet->num_tcp;
 	for(i=0; i<outnet->num_tcp; i++) {
 		s += sizeof(struct pending_tcp);
@@ -3854,7 +3854,7 @@ size_t outnet_get_mem(struct outside_network* outnet)
 	for(w=outnet->tcp_wait_first; w; w = w->next_waiting)
 		s += waiting_tcp_get_mem(w);
 	s += sizeof(*outnet->pending);
-	s += (sizeof(struct pending) + comm_timer_get_mem(NULL)) * 
+	s += (sizeof(struct pending) + comm_timer_get_mem(NULL)) *
 		outnet->pending->count;
 	s += sizeof(*outnet->serviced);
 	s += outnet->svcd_overhead;
@@ -3866,7 +3866,7 @@ size_t outnet_get_mem(struct outside_network* outnet)
 	return s;
 }
 
-size_t 
+size_t
 serviced_get_mem(struct serviced_query* sq)
 {
 	struct service_callback* sb;
diff --git a/usr.sbin/unbound/services/outside_network.h b/usr.sbin/unbound/services/outside_network.h
index 467c81f60..11e4849ad 100644
--- a/usr.sbin/unbound/services/outside_network.h
+++ b/usr.sbin/unbound/services/outside_network.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -155,7 +155,7 @@ struct outside_network {
 	/**
 	 * Array of tcp pending used for outgoing TCP connections.
 	 * Each can be used to establish a TCP connection with a server.
-	 * The file descriptors are -1 if they are free, and need to be 
+	 * The file descriptors are -1 if they are free, and need to be
 	 * opened for the tcp connection. Can be used for ip4 and ip6.
 	 */
 	struct pending_tcp **tcp_conns;
@@ -214,7 +214,7 @@ struct port_if {
 	int avail_total;
 #endif
 
-	/** array of the commpoints currently in use. 
+	/** array of the commpoints currently in use.
 	 * allocated for max number of fds, first part in use. */
 	struct port_comm** out;
 	/** max number of fds, size of out array */
@@ -367,7 +367,7 @@ struct pending_tcp {
  * Query waiting for TCP buffer.
  */
 struct waiting_tcp {
-	/** 
+	/**
 	 * next in waiting list.
 	 * if on_tcp_waiting_list==0, this points to the pending_tcp structure.
 	 */
@@ -396,7 +396,7 @@ struct waiting_tcp {
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
 	socklen_t addrlen;
-	/** 
+	/**
 	 * The query itself, the query packet to send.
 	 * allocated after the waiting_tcp structure.
 	 */
@@ -495,8 +495,8 @@ struct serviced_query {
 		serviced_query_TCP_EDNS_fallback,
 		/** send UDP query with EDNS1480 (or 1280) */
 		serviced_query_UDP_EDNS_FRAG
-	} 	
-		/** variable with current status */ 
+	}
+		/** variable with current status */
 		status;
 	/** true if serviced_query is scheduled for deletion already */
 	int to_be_deleted;
@@ -544,7 +544,7 @@ struct serviced_query {
  * @param infra: pointer to infra cached used for serviced queries.
  * @param rnd: stored to create random numbers for serviced queries.
  * @param use_caps_for_id: enable to use 0x20 bits to encode id randomness.
- * @param availports: array of available ports. 
+ * @param availports: array of available ports.
  * @param numavailports: number of available ports in array.
  * @param unwanted_threshold: when to take defensive action.
  * @param unwanted_action: the action to take.
@@ -564,8 +564,8 @@ struct serviced_query {
  */
 struct outside_network* outside_network_create(struct comm_base* base,
 	size_t bufsize, size_t num_ports, char** ifs, int num_ifs,
-	int do_ip4, int do_ip6, size_t num_tcp, int dscp, struct infra_cache* infra, 
-	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
+	int do_ip4, int do_ip6, size_t num_tcp, int dscp, struct infra_cache* infra,
+	struct ub_randstate* rnd, int use_caps_for_id, int* availports,
 	int numavailports, size_t unwanted_threshold, int tcp_mss,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env *dtenv,
@@ -599,7 +599,7 @@ struct pending* pending_udp_query(struct serviced_query* sq,
 	void* callback_arg);
 
 /**
- * Send TCP query. May wait for TCP buffer. Selects ID to be random, and 
+ * Send TCP query. May wait for TCP buffer. Selects ID to be random, and
  * checks id.
  * @param sq: serviced query.
  * @param packet: wireformat query to send to destination. copied from.
@@ -685,7 +685,7 @@ size_t outnet_get_mem(struct outside_network* outnet);
  * Get memory size in use by serviced query while it is servicing callbacks.
  * This takes into account the pre-deleted status of it; it will be deleted
  * when the callbacks are done.
- * @param sq: serviced query. 
+ * @param sq: serviced query.
  * @return size in bytes.
  */
 size_t serviced_get_mem(struct serviced_query* sq);
diff --git a/usr.sbin/unbound/services/rpz.c b/usr.sbin/unbound/services/rpz.c
index e876f3f94..586ff03ac 100644
--- a/usr.sbin/unbound/services/rpz.c
+++ b/usr.sbin/unbound/services/rpz.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2019, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -234,7 +234,7 @@ rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 	return RPZ_LOCAL_DATA_ACTION;
 }
 
-static enum localzone_type 
+static enum localzone_type
 rpz_action_to_localzone_type(enum rpz_action a)
 {
 	switch(a) {
@@ -1257,7 +1257,7 @@ rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata,
 	if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 		if(d->count == 1) {
 			/* regional alloc'd */
-			raddr->data->entry.data = NULL; 
+			raddr->data->entry.data = NULL;
 			raddr->data = NULL;
 			return 1;
 		}
@@ -1293,11 +1293,11 @@ rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 		lock_rw_unlock(&r->local_zones->lock);
 		return;
 	}
-	lock_rw_unlock(&z->lock); 
+	lock_rw_unlock(&z->lock);
 	if(delete_zone) {
 		local_zones_del_zone(r->local_zones, z);
 	}
-	lock_rw_unlock(&r->local_zones->lock); 
+	lock_rw_unlock(&r->local_zones->lock);
 	return;
 }
 
@@ -1326,7 +1326,7 @@ rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 	lock_rw_wrlock(&node->lock);
 	if(a == RPZ_LOCAL_DATA_ACTION) {
 		/* remove RR, signal whether RR can be removed */
-		delete_respip = rpz_rrset_delete_rr(node, rr_type, rdatawl, 
+		delete_respip = rpz_rrset_delete_rr(node, rr_type, rdatawl,
 			rdatalen);
 	}
 	lock_rw_unlock(&node->lock);
diff --git a/usr.sbin/unbound/services/rpz.h b/usr.sbin/unbound/services/rpz.h
index 53781197a..cfc46c3c3 100644
--- a/usr.sbin/unbound/services/rpz.h
+++ b/usr.sbin/unbound/services/rpz.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2019, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/services/view.c b/usr.sbin/unbound/services/view.c
index 72f364318..86d314a2b 100644
--- a/usr.sbin/unbound/services/view.c
+++ b/usr.sbin/unbound/services/view.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2016, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -44,19 +44,19 @@
 #include "services/localzone.h"
 #include "util/config_file.h"
 
-int 
+int
 view_cmp(const void* v1, const void* v2)
 {
 	struct view* a = (struct view*)v1;
 	struct view* b = (struct view*)v2;
-	
+
 	return strcmp(a->name, b->name);
 }
 
-struct views* 
+struct views*
 views_create(void)
 {
-	struct views* v = (struct views*)calloc(1, 
+	struct views* v = (struct views*)calloc(1,
 		sizeof(*v));
 	if(!v)
 		return NULL;
@@ -71,7 +71,7 @@ views_create(void)
  * unnecessary dependencies */
 void respip_set_delete(struct respip_set *set);
 
-void 
+void
 view_delete(struct view* v)
 {
 	if(!v)
@@ -90,7 +90,7 @@ delviewnode(rbnode_type* n, void* ATTR_UNUSED(arg))
 	view_delete(v);
 }
 
-void 
+void
 views_delete(struct views* v)
 {
 	if(!v)
@@ -141,7 +141,7 @@ views_enter_view_name(struct views* vs, char* name)
 	return v;
 }
 
-int 
+int
 views_apply_cfg(struct views* vs, struct config_file* cfg)
 {
 	struct config_view* cv;
@@ -208,7 +208,7 @@ views_apply_cfg(struct views* vs, struct config_file* cfg)
 				lock_rw_unlock(&v->lock);
 				return 0;
 			}
-			/* local_zones, local_zones_nodefault and local_data 
+			/* local_zones, local_zones_nodefault and local_data
 			 * are free'd from config_view by local_zones_apply_cfg.
 			 * Set pointers to NULL. */
 			cv->local_zones = NULL;
diff --git a/usr.sbin/unbound/services/view.h b/usr.sbin/unbound/services/view.h
index 177781004..020e26b86 100644
--- a/usr.sbin/unbound/services/view.h
+++ b/usr.sbin/unbound/services/view.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2016, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -75,7 +75,7 @@ struct view {
 	/** response-ip configuration data for this view */
 	struct respip_set* respip_set;
 	/** Fallback to global local_zones when there is no match in the view
-	 * specific tree. 1 for yes, 0 for no */	
+	 * specific tree. 1 for yes, 0 for no */
 	int isfirst;
 	/** lock on the data in the structure
 	 * For the node and name you need to also hold the views_tree lock to
@@ -120,7 +120,7 @@ int view_cmp(const void* v1, const void* v2);
 void view_delete(struct view* v);
 
 /**
- * Debug helper. Print all views 
+ * Debug helper. Print all views
  * Takes care of locking.
  * @param v: the views tree
  */
@@ -130,7 +130,7 @@ void views_print(struct views* v);
  * @param vs: views
  * @param name: name of the view we are looking for
  * @param write: 1 for obtaining write lock on found view, 0 for read lock
- * @return: locked view or NULL. 
+ * @return: locked view or NULL.
  */
 struct view* views_find_view(struct views* vs, const char* name, int write);
 
diff --git a/usr.sbin/unbound/sldns/keyraw.c b/usr.sbin/unbound/sldns/keyraw.c
index befe1f722..6ddbfaef2 100644
--- a/usr.sbin/unbound/sldns/keyraw.c
+++ b/usr.sbin/unbound/sldns/keyraw.c
@@ -44,11 +44,11 @@ sldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
 {
 	/* for DSA keys */
 	uint8_t t;
-	
+
 	/* for RSA keys */
 	uint16_t exp;
 	uint16_t int16;
-	
+
 	switch ((sldns_algorithm)alg) {
 	case LDNS_DSA:
 	case LDNS_DSA_NSEC3:
@@ -180,10 +180,10 @@ sldns_key_EVP_load_gost_id(void)
         /* Note: do not ENGINE_finish and ENGINE_free the acquired engine
          * on some platforms this frees up the meth and unloads gost stuff */
         sldns_gost_engine = e;
-	
+
 	EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
 	return gost_id;
-} 
+}
 
 void sldns_key_EVP_unload_gost(void)
 {
@@ -535,9 +535,9 @@ EVP_PKEY*
 sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
 {
 	/* prefix header for X509 encoding */
-	uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85, 
-		0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85, 
-		0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03, 
+	uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85,
+		0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85,
+		0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03,
 		0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
 	unsigned char encoded[37+64];
 	const unsigned char* pp;
diff --git a/usr.sbin/unbound/sldns/keyraw.h b/usr.sbin/unbound/sldns/keyraw.h
index b1f19740c..3829fac79 100644
--- a/usr.sbin/unbound/sldns/keyraw.h
+++ b/usr.sbin/unbound/sldns/keyraw.h
@@ -14,9 +14,9 @@
  *
  * Since those functions heavily rely op cryptographic operations,
  * this module is dependent on openssl.
- * 
+ *
  */
- 
+
 #ifndef LDNS_KEYRAW_H
 #define LDNS_KEYRAW_H
 
@@ -47,7 +47,7 @@ size_t sldns_rr_dnskey_key_size_raw(const unsigned char *keydata,
 uint16_t sldns_calc_keytag_raw(uint8_t* key, size_t keysize);
 
 #if LDNS_BUILD_CONFIG_HAVE_SSL
-/** 
+/**
  * Get the PKEY id for GOST, loads GOST into openssl as a side effect.
  * Only available if GOST is compiled into the library and openssl.
  * \return the gost id for EVP_CTX creation.
@@ -138,7 +138,7 @@ EVP_PKEY* sldns_ed4482pkey_raw(const unsigned char* key, size_t len);
  * \param[in] md the message digest to use.
  * \return true if worked, false on failure.
  */
-int sldns_digest_evp(unsigned char* data, unsigned int len, 
+int sldns_digest_evp(unsigned char* data, unsigned int len,
 	unsigned char* dest, const EVP_MD* md);
 
 #endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
diff --git a/usr.sbin/unbound/sldns/parse.h b/usr.sbin/unbound/sldns/parse.h
index fa8f51a92..6e756674e 100644
--- a/usr.sbin/unbound/sldns/parse.h
+++ b/usr.sbin/unbound/sldns/parse.h
@@ -1,5 +1,5 @@
 /*
- * parse.h 
+ * parse.h
  *
  * a Net::DNS like library for C
  * LibDNS Team @ NLnet Labs
@@ -29,7 +29,7 @@ extern "C" {
  * Contains some low-level parsing functions, mostly used in the _frm_str
  * family of functions.
  */
- 
+
 /**
  * different type of directives in zone files
  * We now deal with $TTL, $ORIGIN and $INCLUDE.
@@ -43,7 +43,7 @@ enum sldns_enum_directive
 };
 typedef enum sldns_enum_directive sldns_directive;
 
-/** 
+/**
  * returns a token/char from the stream F.
  * This function deals with ( and ) in the stream,
  * and ignores them when encountered
@@ -55,7 +55,7 @@ typedef enum sldns_enum_directive sldns_directive;
  */
 ssize_t sldns_fget_token(FILE *f, char *token, const char *delim, size_t limit);
 
-/** 
+/**
  * returns a token/char from the stream F.
  * This function deals with ( and ) in the stream,
  * and ignores when it finds them.
@@ -81,7 +81,7 @@ ssize_t sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit
  * to zero after last bget in string (for parse error).  If you pass NULL,
  * the entire parenthesized string is read in.
  * \param[in] skipw string with whitespace to skip before the start of the
- * token, like " ", or " \t", or NULL for none.  
+ * token, like " ", or " \t", or NULL for none.
  * \returns 0 on error of EOF of b. Otherwise return the length of what is read
  */
 ssize_t sldns_bget_token_par(struct sldns_buffer *b, char *token, const char *delim, size_t limit, int* par, const char* skipw);
@@ -103,8 +103,8 @@ ssize_t sldns_bget_token(struct sldns_buffer *b, char *token, const char *delim,
  * after the keyword + k_del until we hit d_del
  * \param[in] f file pointer to read from
  * \param[in] keyword keyword to look for
- * \param[in] k_del keyword delimiter 
- * \param[out] data the data found 
+ * \param[in] k_del keyword delimiter
+ * \param[out] data the data found
  * \param[in] d_del the data delimiter
  * \param[in] data_limit maximum size the the data buffer
  * \return the number of character read
@@ -116,8 +116,8 @@ ssize_t sldns_fget_keyword_data(FILE *f, const char *keyword, const char *k_del,
  * after the keyword + k_del until we hit d_del
  * \param[in] f file pointer to read from
  * \param[in] keyword keyword to look for
- * \param[in] k_del keyword delimiter 
- * \param[out] data the data found 
+ * \param[in] k_del keyword delimiter
+ * \param[out] data the data found
  * \param[in] d_del the data delimiter
  * \param[in] data_limit maximum size the the data buffer
  * \param[in] line_nr pointer to an integer containing the current line number (for
@@ -131,8 +131,8 @@ ssize_t sldns_fget_keyword_data_l(FILE *f, const char *keyword, const char *k_de
  * after the keyword + k_del until we hit d_del
  * \param[in] b buffer pointer to read from
  * \param[in] keyword keyword to look for
- * \param[in] k_del keyword delimiter 
- * \param[out] data the data found 
+ * \param[in] k_del keyword delimiter
+ * \param[out] data the data found
  * \param[in] d_del the data delimiter
  * \param[in] data_limit maximum size the the data buffer
  * \return the number of character read
diff --git a/usr.sbin/unbound/sldns/parseutil.c b/usr.sbin/unbound/sldns/parseutil.c
index dd1f33484..c891b0b61 100644
--- a/usr.sbin/unbound/sldns/parseutil.c
+++ b/usr.sbin/unbound/sldns/parseutil.c
@@ -51,7 +51,7 @@ static const int mdays[] = {
 static int
 is_leap_year(int year)
 {
-	return LDNS_MOD(year,   4) == 0 && (LDNS_MOD(year, 100) != 0 
+	return LDNS_MOD(year,   4) == 0 && (LDNS_MOD(year, 100) != 0
 	    || LDNS_MOD(year, 400) == 0);
 }
 
@@ -60,7 +60,7 @@ leap_days(int y1, int y2)
 {
 	--y1;
 	--y2;
-	return (LDNS_DIV(y2,   4) - LDNS_DIV(y1,   4)) - 
+	return (LDNS_DIV(y2,   4) - LDNS_DIV(y1,   4)) -
 	       (LDNS_DIV(y2, 100) - LDNS_DIV(y1, 100)) +
 	       (LDNS_DIV(y2, 400) - LDNS_DIV(y1, 400));
 }
@@ -120,7 +120,7 @@ static void
 sldns_mon_and_mday_from_year_and_yday(struct tm *result)
 {
 	int idays = result->tm_yday;
-	const int *mon_lengths = is_leap_year(result->tm_year) ? 
+	const int *mon_lengths = is_leap_year(result->tm_year) ?
 					leap_year_mdays : mdays;
 
 	result->tm_mon = 0;
@@ -381,14 +381,14 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 	const char* b32 = extended_hex ?  "0123456789abcdefghijklmnopqrstuv"
 					: "abcdefghijklmnopqrstuvwxyz234567";
 
-	size_t c = 0; /* c is used to carry partial base32 character over 
+	size_t c = 0; /* c is used to carry partial base32 character over
 		       * byte boundaries for sizes with a remainder.
 		       * (i.e. src_sz % 5 != 0)
 		       */
 
 	ret_sz = add_padding ? sldns_b32_ntop_calculate_size(src_sz)
 			     : sldns_b32_ntop_calculate_size_no_padding(src_sz);
-	
+
 	/* Do we have enough space? */
 	if (dst_sz < ret_sz + 1)
 		return -1;
@@ -472,13 +472,13 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 	return (int)ret_sz;
 }
 
-int 
+int
 sldns_b32_ntop(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz)
 {
 	return sldns_b32_ntop_base(src, src_sz, dst, dst_sz, 0, 1);
 }
 
-int 
+int
 sldns_b32_ntop_extended_hex(const uint8_t* src, size_t src_sz,
 		char* dst, size_t dst_sz)
 {
@@ -632,7 +632,7 @@ sldns_b32_pton(const char* src, size_t src_sz, uint8_t* dst, size_t dst_sz)
 }
 
 int
-sldns_b32_pton_extended_hex(const char* src, size_t src_sz, 
+sldns_b32_pton_extended_hex(const char* src, size_t src_sz,
 		uint8_t* dst, size_t dst_sz)
 {
 	return sldns_b32_pton_base(src, src_sz, dst, dst_sz, 1, 1);
diff --git a/usr.sbin/unbound/sldns/parseutil.h b/usr.sbin/unbound/sldns/parseutil.h
index 683f34e23..e9c34cbb7 100644
--- a/usr.sbin/unbound/sldns/parseutil.h
+++ b/usr.sbin/unbound/sldns/parseutil.h
@@ -16,9 +16,9 @@
 #define LDNS_PARSEUTIL_H
 struct tm;
 
-/** 
+/**
  *  A general purpose lookup table
- *  
+ *
  *  Lookup tables are arrays of (id, name) pairs,
  *  So you can for instance lookup the RCODE 3, which is "NXDOMAIN",
  *  and vice versa. The lookup tables themselves are defined wherever needed,
@@ -143,7 +143,7 @@ int sldns_b32_pton_extended_hex(const char* src_text, size_t src_text_length,
  */
 int sldns_parse_escape(uint8_t *ch_p, const char** str_p);
 
-/** 
+/**
  * Parse one character, with escape codes,
  * @param ch_p: the parsed character
  * @param str_p: the string. moved along for characters read.
diff --git a/usr.sbin/unbound/sldns/pkthdr.h b/usr.sbin/unbound/sldns/pkthdr.h
index c32e7d285..ff2829605 100644
--- a/usr.sbin/unbound/sldns/pkthdr.h
+++ b/usr.sbin/unbound/sldns/pkthdr.h
@@ -14,7 +14,7 @@
  * Contains functions that translate dns data from the wire format (as sent
  * by servers and clients) to the internal structures for the packet header.
  */
- 
+
 #ifndef LDNS_PKTHDR_H
 #define LDNS_PKTHDR_H
 
diff --git a/usr.sbin/unbound/sldns/rrdef.c b/usr.sbin/unbound/sldns/rrdef.c
index 322eff096..b51dc7279 100644
--- a/usr.sbin/unbound/sldns/rrdef.c
+++ b/usr.sbin/unbound/sldns/rrdef.c
@@ -35,7 +35,7 @@ static const sldns_rdf_type type_md_wireformat[] = { LDNS_RDF_TYPE_DNAME };
 static const sldns_rdf_type type_mf_wireformat[] = { LDNS_RDF_TYPE_DNAME };
 static const sldns_rdf_type type_cname_wireformat[] = { LDNS_RDF_TYPE_DNAME };
 static const sldns_rdf_type type_soa_wireformat[] = {
-	LDNS_RDF_TYPE_DNAME, LDNS_RDF_TYPE_DNAME, LDNS_RDF_TYPE_INT32, 
+	LDNS_RDF_TYPE_DNAME, LDNS_RDF_TYPE_DNAME, LDNS_RDF_TYPE_INT32,
 	LDNS_RDF_TYPE_PERIOD, LDNS_RDF_TYPE_PERIOD, LDNS_RDF_TYPE_PERIOD,
 	LDNS_RDF_TYPE_PERIOD
 };
diff --git a/usr.sbin/unbound/sldns/rrdef.h b/usr.sbin/unbound/sldns/rrdef.h
index 999c22307..9dca9c335 100644
--- a/usr.sbin/unbound/sldns/rrdef.h
+++ b/usr.sbin/unbound/sldns/rrdef.h
@@ -346,7 +346,7 @@ enum sldns_enum_rdf_type
          */
         LDNS_RDF_TYPE_TAG,
 
-        /** A <character-string> encoding of the value field as specified 
+        /** A <character-string> encoding of the value field as specified
          * [RFC1035], Section 5.1., encoded as remaining rdata.
          * For CAA, URI.
          */
diff --git a/usr.sbin/unbound/sldns/sbuffer.c b/usr.sbin/unbound/sldns/sbuffer.c
index f0f1fbd91..030b2edb4 100644
--- a/usr.sbin/unbound/sldns/sbuffer.c
+++ b/usr.sbin/unbound/sldns/sbuffer.c
@@ -23,20 +23,20 @@ sldns_buffer_new(size_t capacity)
 	if (!buffer) {
 		return NULL;
 	}
-	
+
 	buffer->_data = (uint8_t *) malloc(capacity);
 	if (!buffer->_data) {
 		free(buffer);
 		return NULL;
 	}
-	
+
 	buffer->_position = 0;
 	buffer->_limit = buffer->_capacity = capacity;
 	buffer->_fixed = 0;
 	buffer->_status_err = 0;
-	
+
 	sldns_buffer_invariant(buffer);
-	
+
 	return buffer;
 }
 
@@ -45,7 +45,7 @@ sldns_buffer_new_frm_data(sldns_buffer *buffer, void *data, size_t size)
 {
 	assert(data != NULL);
 
-	buffer->_position = 0; 
+	buffer->_position = 0;
 	buffer->_limit = buffer->_capacity = size;
 	buffer->_fixed = 0;
 	if (!buffer->_fixed && buffer->_data)
@@ -57,7 +57,7 @@ sldns_buffer_new_frm_data(sldns_buffer *buffer, void *data, size_t size)
 	}
 	memcpy(buffer->_data, data, size);
 	buffer->_status_err = 0;
-	
+
 	sldns_buffer_invariant(buffer);
 }
 
@@ -74,7 +74,7 @@ int
 sldns_buffer_set_capacity(sldns_buffer *buffer, size_t capacity)
 {
 	void *data;
-	
+
 	sldns_buffer_invariant(buffer);
 	assert(buffer->_position <= capacity && !buffer->_fixed);
 
@@ -115,7 +115,7 @@ sldns_buffer_printf(sldns_buffer *buffer, const char *format, ...)
 	va_list args;
 	int written = 0;
 	size_t remaining;
-	
+
 	if (sldns_buffer_status_ok(buffer)) {
 		sldns_buffer_invariant(buffer);
 		assert(buffer->_limit == buffer->_capacity);
@@ -147,7 +147,7 @@ sldns_buffer_free(sldns_buffer *buffer)
 	free(buffer);
 }
 
-void 
+void
 sldns_buffer_copy(sldns_buffer* result, sldns_buffer* from)
 {
 	size_t tocopy = sldns_buffer_limit(from);
diff --git a/usr.sbin/unbound/sldns/sbuffer.h b/usr.sbin/unbound/sldns/sbuffer.h
index 1b7fe370c..6d3a2e650 100644
--- a/usr.sbin/unbound/sldns/sbuffer.h
+++ b/usr.sbin/unbound/sldns/sbuffer.h
@@ -18,7 +18,7 @@ extern "C" {
 #endif
 
 #ifdef S_SPLINT_S
-#  define INLINE 
+#  define INLINE
 #else
 #  ifdef SWIG
 #    define INLINE static
@@ -106,7 +106,7 @@ sldns_write_uint48(void *dst, uint64_t data)
  * This file contains the definition of sldns_buffer, and functions to manipulate those.
  */
 
-/** 
+/**
  * implementation of buffers to ease operations
  *
  * sldns_buffers can contain arbitrary information, per octet. You can write
@@ -115,7 +115,7 @@ sldns_write_uint48(void *dst, uint64_t data)
  */
 struct sldns_buffer
 {
-	/** The current position used for reading/writing */ 
+	/** The current position used for reading/writing */
 	size_t   _position;
 
 	/** The read/write limit */
@@ -735,7 +735,7 @@ int sldns_buffer_printf(sldns_buffer *buffer, const char *format, ...)
 void sldns_buffer_free(sldns_buffer *buffer);
 
 /**
- * Copy contents of the from buffer to the result buffer and then flips 
+ * Copy contents of the from buffer to the result buffer and then flips
  * the result buffer. Data will be silently truncated if the result buffer is
  * too small.
  * \param[out] *result resulting buffer which is copied to.
diff --git a/usr.sbin/unbound/sldns/str2wire.c b/usr.sbin/unbound/sldns/str2wire.c
index 303d49ba6..83ba58fb6 100644
--- a/usr.sbin/unbound/sldns/str2wire.c
+++ b/usr.sbin/unbound/sldns/str2wire.c
@@ -357,7 +357,7 @@ rrinternal_get_delims(sldns_rdf_type rdftype, size_t r_cnt, size_t r_max)
 					break;
 	default                       :	break;
 	}
-	return "\n\t "; 
+	return "\n\t ";
 }
 
 /* Syntactic sugar for sldns_rr_new_frm_str_internal */
@@ -448,7 +448,7 @@ rrinternal_parse_unknown(sldns_buffer* strbuf, char* token, size_t token_len,
 			sldns_buffer_position(strbuf));
 	}
 	hex_data_size = (size_t)atoi(token);
-	if(hex_data_size > LDNS_MAX_RDFLEN || 
+	if(hex_data_size > LDNS_MAX_RDFLEN ||
 		*rr_cur_len + hex_data_size > *rr_len) {
 		return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL,
 			sldns_buffer_position(strbuf));
@@ -567,7 +567,7 @@ sldns_parse_rdf_token(sldns_buffer* strbuf, char* token, size_t token_len,
 	/* check if not quoted yet, and we have encountered quotes */
 	if(!*quoted && sldns_rdf_type_maybe_quoted(rdftype) &&
 		slen >= 2 &&
-		(token[0] == '"' || token[0] == '\'') && 
+		(token[0] == '"' || token[0] == '\'') &&
 		(token[slen-1] == '"' || token[slen-1] == '\'')) {
 		/* move token two smaller (quotes) with endnull */
 		memmove(token, token+1, slen-2);
@@ -785,7 +785,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,
 			token[2]=='\t')) {
 			was_unknown_rr_format = 1;
 			if((status=rrinternal_parse_unknown(strbuf, token,
-				token_len, rr, rr_len, &rr_cur_len, 
+				token_len, rr, rr_len, &rr_cur_len,
 				pre_data_pos)) != 0)
 				return status;
 		} else if(token_strlen > 0 || quoted) {
@@ -844,7 +844,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,
 	if (rr_type == LDNS_RR_TYPE_SVCB || rr_type == LDNS_RR_TYPE_HTTPS) {
 		size_t rdata_len = rr_cur_len - dname_len - 10;
 		uint8_t *rdata = rr+dname_len + 10;
-		
+
 		/* skip 1st rdata field SvcPriority (uint16_t) */
 		if (rdata_len < sizeof(uint16_t))
 			return LDNS_WIREPARSE_ERR_OK;
@@ -1444,7 +1444,7 @@ sldns_str2wire_svcbparam_parse_next_unescaped_comma(const char *val)
 
 /* The source is already properly unescaped, this double unescaping is purely to allow for
  * comma's in comma separated alpn lists.
- * 
+ *
  * In draft-ietf-dnsop-svcb-https-06 Section 7:
  * To enable simpler parsing, this SvcParamValue MUST NOT contain escape sequences.
  */
@@ -1477,7 +1477,7 @@ sldns_str2wire_svcbparam_alpn_value(const char* val,
 	size_t      str_len;
 	size_t      dst_len;
 	size_t      val_len;
-	
+
 	val_len = strlen(val);
 
 	if (val_len > sizeof(unescaped_dst)) {
@@ -1511,7 +1511,7 @@ sldns_str2wire_svcbparam_alpn_value(const char* val,
 	sldns_write_uint16(rd + 2, dst_len);
 	memcpy(rd + 4, unescaped_dst, dst_len);
 	*rd_len = 4 + dst_len;
-	
+
 	return LDNS_WIREPARSE_ERR_OK;
 }
 
@@ -1593,7 +1593,7 @@ static int sldns_str2wire_svcparam_buf(const char* str, uint8_t* rd, size_t* rd_
 	/* case: key=value */
 	if (eq_pos != NULL && eq_pos[1]) {
 		val_in = eq_pos + 1;
-		
+
 		/* unescape characters and "" blocks */
 		if (*val_in == '"') {
 			val_in++;
@@ -1610,11 +1610,11 @@ static int sldns_str2wire_svcparam_buf(const char* str, uint8_t* rd, size_t* rd_
 		}
 		*val_out = 0;
 
-		return sldns_str2wire_svcparam_value(str, eq_pos - str, 
+		return sldns_str2wire_svcparam_value(str, eq_pos - str,
 		                                         unescaped_val[0] ? unescaped_val : NULL, rd, rd_len);
 	}
 	/* case: key= */
-	else if (eq_pos != NULL && !(eq_pos[1])) { 
+	else if (eq_pos != NULL && !(eq_pos[1])) {
 		return sldns_str2wire_svcparam_value(str, eq_pos - str, NULL, rd, rd_len);
 	}
 	/* case: key */
diff --git a/usr.sbin/unbound/sldns/wire2str.c b/usr.sbin/unbound/sldns/wire2str.c
index 74d1b62df..78618003c 100644
--- a/usr.sbin/unbound/sldns/wire2str.c
+++ b/usr.sbin/unbound/sldns/wire2str.c
@@ -159,7 +159,7 @@ static sldns_lookup_table sldns_wireparse_errors_data[] = {
 		"Mandatory SvcParamKey is missing"},
 	{ LDNS_WIREPARSE_ERR_SVCB_MANDATORY_DUPLICATE_KEY,
 		"Keys in SvcParam mandatory MUST be unique" },
-	{ LDNS_WIREPARSE_ERR_SVCB_MANDATORY_IN_MANDATORY, 
+	{ LDNS_WIREPARSE_ERR_SVCB_MANDATORY_IN_MANDATORY,
 		"mandatory MUST not be included as mandatory parameter" },
 	{ LDNS_WIREPARSE_ERR_SVCB_PORT_VALUE_SYNTAX,
 		"Could not parse port SvcParamValue" },
@@ -487,7 +487,7 @@ int sldns_wire2str_rr_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
 	uint8_t* rr = *d;
 	size_t rrlen = *dlen, dname_off, rdlen, ordlen;
 	uint16_t rrtype = 0;
-	
+
 	if(*dlen >= 3 && (*d)[0]==0 &&
 		sldns_read_uint16((*d)+1)==LDNS_RR_TYPE_OPT) {
 		/* perform EDNS OPT processing */
@@ -1119,7 +1119,7 @@ static int sldns_wire2str_svcparam_alpn2str(char** s,
 			w += sldns_str_print(s, slen, "%s", ",");
 	}
 	w += sldns_str_print(s, slen, "\"");
-	
+
 	return w;
 }
 
@@ -1139,7 +1139,7 @@ static int sldns_wire2str_svcparam_ech2str(char** s,
 	(*s) += size;
 	(*slen) -= size;
 
-	w += sldns_str_print(s, slen, "\"");	
+	w += sldns_str_print(s, slen, "\"");
 
 	return w + size;
 }
@@ -1162,7 +1162,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl
 
 	/* verify that we have data_len data */
 	if (data_len > *dlen)
-		return -1; 
+		return -1;
 
 	written_chars += sldns_print_svcparamkey(s, slen, svcparamkey);
 	if (!data_len) {
@@ -1222,7 +1222,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl
 	}
 	if (r <= 0)
 		return -1; /* wireformat error */
-	
+
 	written_chars += r;
 	*d    += data_len;
 	*dlen -= data_len;
@@ -1551,7 +1551,7 @@ int sldns_wire2str_nsec_scan(uint8_t** d, size_t* dl, char** s, size_t* sl)
 	unsigned i, bit, window, block_len;
 	uint16_t t;
 	int w = 0;
-	
+
 	/* check for errors */
 	while(pl) {
 		if(pl < 2) return -1;
diff --git a/usr.sbin/unbound/smallapp/unbound-anchor.c b/usr.sbin/unbound/smallapp/unbound-anchor.c
index 8b371e927..0dcba46f5 100644
--- a/usr.sbin/unbound/smallapp/unbound-anchor.c
+++ b/usr.sbin/unbound/smallapp/unbound-anchor.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2010, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -72,7 +72,7 @@
  * RFC5011-tracking with its builtin DS anchors; if that fails it
  * bootstraps the RFC5011-tracking using the certificate.  (again to avoid
  * https, and it is also faster).
- * 
+ *
  * It uses the XML file by converting it to DS records and writing that to the
  * key file.  Unbound can detect that the 'special comments' are gone, and
  * the file contains a list of normal DNSKEY/DS records, and uses that to
@@ -282,7 +282,7 @@ ub_ctx_error_exit(struct ub_ctx* ctx, const char* str, const char* str2)
 /**
  * Create a new unbound context with the commandline settings applied
  */
-static struct ub_ctx* 
+static struct ub_ctx*
 create_unbound_context(const char* res_conf, const char* root_hints,
 	const char* debugconf, const char* srcaddr, int ip4only, int ip6only)
 {
@@ -648,7 +648,7 @@ resolve_name(const char* host, int port, const char* res_conf,
 	if( (list=parse_ip_addr(host, port)) ) {
 		return list;
 	}
-	
+
 	/* create resolver context */
 	ctx = create_unbound_context(res_conf, root_hints, debugconf,
         	srcaddr, ip4only, ip6only);
@@ -882,7 +882,7 @@ process_one_header(char* buf, size_t* clen, int* chunked)
 	return 1;
 }
 
-/** 
+/**
  * Read one line from SSL
  * zero terminates.
  * skips "\r\n" (but not copied to buf).
@@ -1419,7 +1419,7 @@ xml_is_zone_name(BIO* zone, const char* name)
 	return (strncasecmp(buf, name, strlen(name)) == 0);
 }
 
-/** 
+/**
  * XML start of element. This callback is called whenever an XML tag starts.
  * XML_Char is UTF8.
  * @param userData: the xml_data structure.
@@ -2059,7 +2059,7 @@ write_builtin_anchor(const char* file)
 	fclose(out);
 }
 
-/** 
+/**
  * Check the root anchor file.
  * If does not exist, provide builtin and write file.
  * If empty, provide builtin and write file.
@@ -2079,7 +2079,7 @@ provide_builtin(const char* root_anchor_file, int* used_builtin)
 			*used_builtin = 1;
 			break;
 		case 1: /* revoked tp */
-			return 0;	
+			return 0;
 		case 2: /* it is fine */
 		default:
 			break;
@@ -2244,7 +2244,7 @@ static int
 do_root_update_work(const char* root_anchor_file, const char* root_cert_file,
 	const char* urlname, const char* xmlname, const char* p7sname,
 	const char* p7signer, const char* res_conf, const char* root_hints,
-	const char* debugconf, const char* srcaddr, int ip4only, int ip6only, 
+	const char* debugconf, const char* srcaddr, int ip4only, int ip6only,
 	int force, int res_conf_fallback, int port, int use_sni)
 {
 	struct ub_result* dnskey;
diff --git a/usr.sbin/unbound/smallapp/unbound-control.c b/usr.sbin/unbound/smallapp/unbound-control.c
index 34fb801bb..de3dd9af0 100644
--- a/usr.sbin/unbound/smallapp/unbound-control.c
+++ b/usr.sbin/unbound/smallapp/unbound-control.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -222,7 +222,7 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
 {
 	struct timeval sumwait, avg;
 	PR_UL_NM("num.queries", s->svr.num_queries);
-	PR_UL_NM("num.queries_ip_ratelimited", 
+	PR_UL_NM("num.queries_ip_ratelimited",
 		s->svr.num_queries_ip_ratelimited);
 	PR_UL_NM("num.cachehits",
 		s->svr.num_queries - s->svr.num_queries_missed_cache);
@@ -985,7 +985,7 @@ int main(int argc, char* argv[])
 		fatal_exit("could not exec unbound: %s",
 			strerror(ENOSYS));
 #else
-		if(execlp("unbound", "unbound", "-c", cfgfile, 
+		if(execlp("unbound", "unbound", "-c", cfgfile,
 			(char*)NULL) < 0) {
 			fatal_exit("could not exec unbound: %s",
 				strerror(errno));
diff --git a/usr.sbin/unbound/smallapp/unbound-host.c b/usr.sbin/unbound/smallapp/unbound-host.c
index d612575f3..418501487 100644
--- a/usr.sbin/unbound/smallapp/unbound-host.c
+++ b/usr.sbin/unbound/smallapp/unbound-host.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -185,7 +185,7 @@ massage_type(const char* t, int reverse, int* multi)
 {
 	if(t) {
 		int r = sldns_get_rr_type_by_name(t);
-		if(r == 0 && strcasecmp(t, "TYPE0") != 0 && 
+		if(r == 0 && strcasecmp(t, "TYPE0") != 0 &&
 			strcmp(t, "") != 0) {
 			fprintf(stderr, "error unknown type %s\n", t);
 			exit(1);
@@ -204,7 +204,7 @@ massage_class(const char* c)
 {
 	if(c) {
 		int r = sldns_get_rr_class_by_name(c);
-		if(r == 0 && strcasecmp(c, "CLASS0") != 0 && 
+		if(r == 0 && strcasecmp(c, "CLASS0") != 0 &&
 			strcmp(c, "") != 0) {
 			fprintf(stderr, "error unknown class %s\n", c);
 			exit(1);
@@ -215,7 +215,7 @@ massage_class(const char* c)
 }
 
 /** nice security status string */
-static const char* 
+static const char*
 secure_str(struct ub_result* result)
 {
 	if(result->rcode != 0 && result->rcode != 3) return "(error)";
@@ -262,7 +262,7 @@ print_rd(int t, char* data, size_t len)
 
 /** pretty line of RR data for results */
 static void
-pretty_rdata(char* q, char* cstr, char* tstr, int t, const char* sec, 
+pretty_rdata(char* q, char* cstr, char* tstr, int t, const char* sec,
 	char* data, size_t len)
 {
 	printf("%s", q);
@@ -308,7 +308,7 @@ pretty_output(char* q, int t, int c, struct ub_result* result, int docname)
 	}
 	if(docname && result->canonname &&
 		result->canonname != result->qname) {
-		printf("%s is an alias for %s", result->qname, 
+		printf("%s is an alias for %s", result->qname,
 			result->canonname);
 		if(verb > 0)
 			printf(" %s", secstatus);
@@ -429,7 +429,7 @@ int main(int argc, char* argv[])
 	char* use_syslog = NULL;
 	struct ub_ctx* ctx = NULL;
 	int debuglevel = 0;
-	
+
 	ctx = ub_ctx_create();
 	if(!ctx) {
 		fprintf(stderr, "error: out of memory\n");
@@ -458,7 +458,7 @@ int main(int argc, char* argv[])
 			break;
 		case 'd':
 			debuglevel++;
-			if(debuglevel < 2) 
+			if(debuglevel < 2)
 				debuglevel = 2; /* at least VERB_DETAIL */
 			break;
 		case 'r':
@@ -489,7 +489,7 @@ int main(int argc, char* argv[])
 		check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
 	if(ub_ctx_get_option(ctx, "use-syslog", &use_syslog) == 0) {
 		if(strcmp(use_syslog, "yes") == 0) /* disable use-syslog */
-			check_ub_res(ub_ctx_set_option(ctx, 
+			check_ub_res(ub_ctx_set_option(ctx,
 				"use-syslog:", "no"));
 		free(use_syslog);
 	}
diff --git a/usr.sbin/unbound/smallapp/worker_cb.c b/usr.sbin/unbound/smallapp/worker_cb.c
index c68981735..1f06c9c2d 100644
--- a/usr.sbin/unbound/smallapp/worker_cb.c
+++ b/usr.sbin/unbound/smallapp/worker_cb.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -57,7 +57,7 @@ void worker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 	log_assert(0);
 }
 
-int worker_handle_request(struct comm_point* ATTR_UNUSED(c), 
+int worker_handle_request(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -65,7 +65,7 @@ int worker_handle_request(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
 {
@@ -73,7 +73,7 @@ int worker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int remote_accept_callback(struct comm_point* ATTR_UNUSED(c), 
+int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -81,7 +81,7 @@ int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int remote_control_callback(struct comm_point* ATTR_UNUSED(c), 
+int remote_control_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -110,7 +110,7 @@ struct outbound_entry* worker_send_query(
 
 #ifdef UB_ON_WINDOWS
 void
-worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void* 
+worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void*
 	ATTR_UNUSED(arg)) {
 	log_assert(0);
 }
@@ -122,7 +122,7 @@ wsvc_cron_cb(void* ATTR_UNUSED(arg))
 }
 #endif /* UB_ON_WINDOWS */
 
-void 
+void
 worker_alloc_cleanup(void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
@@ -142,7 +142,7 @@ struct outbound_entry* libworker_send_query(
 	return 0;
 }
 
-int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
 {
@@ -157,21 +157,21 @@ void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
         log_assert(0);
 }
 
-void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
+void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	struct sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
 	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
 {
 	log_assert(0);
 }
 
-void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
+void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	struct sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
 	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
 {
 	log_assert(0);
 }
 
-void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
+void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	struct sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
 	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
 {
diff --git a/usr.sbin/unbound/testcode/asynclook.c b/usr.sbin/unbound/testcode/asynclook.c
index fffd14ed5..7d7a1beb7 100644
--- a/usr.sbin/unbound/testcode/asynclook.c
+++ b/usr.sbin/unbound/testcode/asynclook.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -138,7 +138,7 @@ print_result(struct lookinfo* info)
 }
 
 /** this is a function of type ub_callback_t */
-static void 
+static void
 lookup_is_done(void* mydata, int err, struct ub_result* result)
 {
 	/* cast mydata back to the correct type */
@@ -151,7 +151,7 @@ lookup_is_done(void* mydata, int err, struct ub_result* result)
 }
 
 /** check error, if bad, exit with error message */
-static void 
+static void
 checkerr(const char* desc, int err)
 {
 	if(err != 0) {
@@ -232,7 +232,7 @@ ext_check_result(const char* desc, int err, struct ub_result* result)
 			exit(1);
 		}
 		if(result->secure || result->bogus) {
-			printf("%s: error result->secure or bogus is set.\n", 
+			printf("%s: error result->secure or bogus is set.\n",
 				desc);
 			exit(1);
 		}
@@ -250,12 +250,12 @@ ext_check_result(const char* desc, int err, struct ub_result* result)
 			exit(1);
 		}
 		if(result->answer_packet == NULL) {
-			printf("%s: error result->answer_packet is NULL.\n", 
+			printf("%s: error result->answer_packet is NULL.\n",
 				desc);
 			exit(1);
 		}
 		if(result->answer_len != 54) {
-			printf("%s: error result->answer_len is wrong.\n", 
+			printf("%s: error result->answer_len is wrong.\n",
 				desc);
 			exit(1);
 		}
@@ -263,7 +263,7 @@ ext_check_result(const char* desc, int err, struct ub_result* result)
 }
 
 /** extended bg result callback, this function is ub_callback_t */
-static void 
+static void
 ext_callback(void* mydata, int err, struct ub_result* result)
 {
 	struct track_id* my_id = (struct track_id*)mydata;
@@ -271,7 +271,7 @@ ext_callback(void* mydata, int err, struct ub_result* result)
 	if(my_id) {
 		/* I have an id, make sure we are not cancelled */
 		lock_basic_lock(&my_id->lock);
-		if(doprint) 
+		if(doprint)
 			printf("cb %d: ", my_id->id);
 		if(my_id->cancel) {
 			printf("error: query id=%d returned, but was cancelled\n",
@@ -315,9 +315,9 @@ ext_thread(void* arg)
 	}
 	for(i=0; i<inf->numq; i++) {
 		if(async_ids) {
-			r = ub_resolve_async(inf->ctx, 
-				inf->argv[i%inf->argc], LDNS_RR_TYPE_A, 
-				LDNS_RR_CLASS_IN, &async_ids[i], ext_callback, 
+			r = ub_resolve_async(inf->ctx,
+				inf->argv[i%inf->argc], LDNS_RR_TYPE_A,
+				LDNS_RR_CLASS_IN, &async_ids[i], ext_callback,
 				&async_ids[i].id);
 			checkerr("ub_resolve_async", r);
 			if(i > 100) {
@@ -326,18 +326,18 @@ ext_thread(void* arg)
 				if(r != UB_NOID)
 					async_ids[i-100].cancel=1;
 				lock_basic_unlock(&async_ids[i-100].lock);
-				if(r != UB_NOID) 
+				if(r != UB_NOID)
 					checkerr("ub_cancel", r);
 			}
 		} else if(inf->thread_num > NUMTHR/2) {
 			/* async */
-			r = ub_resolve_async(inf->ctx, 
-				inf->argv[i%inf->argc], LDNS_RR_TYPE_A, 
+			r = ub_resolve_async(inf->ctx,
+				inf->argv[i%inf->argc], LDNS_RR_TYPE_A,
 				LDNS_RR_CLASS_IN, NULL, ext_callback, NULL);
 			checkerr("ub_resolve_async", r);
 		} else  {
 			/* blocking */
-			r = ub_resolve(inf->ctx, inf->argv[i%inf->argc], 
+			r = ub_resolve(inf->ctx, inf->argv[i%inf->argc],
 				LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, &result);
 			ext_check_result("ub_resolve", r, result);
 			ub_resolve_free(result);
@@ -350,7 +350,7 @@ ext_thread(void* arg)
 	/* if these locks are destroyed, or if the async_ids is freed, then
 	   a use-after-free happens in another thread.
 	   The allocation is only part of this test, though. */
-	
+
 	return NULL;
 }
 
@@ -399,7 +399,7 @@ extern int optind;
 extern char* optarg;
 
 /** main program for asynclook */
-int main(int argc, char** argv) 
+int main(int argc, char** argv)
 {
 	int c;
 	struct ub_ctx* ctx;
@@ -443,7 +443,7 @@ int main(int argc, char** argv)
 				if(r != 0) {
 					printf("ub_ctx_resolvconf "
 						"error: %s : %s\n",
-						ub_strerror(r), 
+						ub_strerror(r),
 						strerror(errno));
 					return 1;
 				}
@@ -453,7 +453,7 @@ int main(int argc, char** argv)
 				if(r != 0) {
 					printf("ub_ctx_hosts "
 						"error: %s : %s\n",
-						ub_strerror(r), 
+						ub_strerror(r),
 						strerror(errno));
 					return 1;
 				}
@@ -501,7 +501,7 @@ int main(int argc, char** argv)
 		return ext_test(ctx, argc, argv);
 
 	/* allocate array for results. */
-	lookups = (struct lookinfo*)calloc((size_t)argc, 
+	lookups = (struct lookinfo*)calloc((size_t)argc,
 		sizeof(struct lookinfo));
 	if(!lookups) {
 		printf("out of memory\n");
@@ -520,7 +520,7 @@ int main(int argc, char** argv)
 		} else {
 			fprintf(stderr, "start async lookup %s\n", argv[i]);
 			r = ub_resolve_async(ctx, argv[i], LDNS_RR_TYPE_A,
-				LDNS_RR_CLASS_IN, &lookups[i], &lookup_is_done, 
+				LDNS_RR_CLASS_IN, &lookups[i], &lookup_is_done,
 				&lookups[i].async_id);
 			checkerr("ub_resolve_async", r);
 		}
@@ -531,7 +531,7 @@ int main(int argc, char** argv)
 		for(i=0; i<argc; i++) {
 			fprintf(stderr, "cancel %s\n", argv[i]);
 			r = ub_cancel(ctx, lookups[i].async_id);
-			if(r != UB_NOID) 
+			if(r != UB_NOID)
 				checkerr("ub_cancel", r);
 		}
 		num_wait = 0;
diff --git a/usr.sbin/unbound/testcode/checklocks.c b/usr.sbin/unbound/testcode/checklocks.c
index 1b5ef282b..aaddfbafa 100644
--- a/usr.sbin/unbound/testcode/checklocks.c
+++ b/usr.sbin/unbound/testcode/checklocks.c
@@ -2,24 +2,24 @@
  * testcode/checklocks.c - wrapper on locks that checks access.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -43,10 +43,10 @@
  * Locks that are checked.
  *
  * Ugly hack: uses the fact that workers start with an int thread_num, and
- * are passed to thread_create to make the thread numbers here the same as 
+ * are passed to thread_create to make the thread numbers here the same as
  * those used for logging which is nice.
  *
- * Todo: 
+ * Todo:
  *	 - debug status print, of thread lock stacks, and current waiting.
  */
 #ifdef USE_THREAD_DEBUG
@@ -76,14 +76,14 @@ static void lock_error(struct checked_lock* lock, const char* func,
 	const char* file, int line, const char* err) ATTR_NORETURN;
 
 /** print pretty lock error and exit */
-static void lock_error(struct checked_lock* lock, 
+static void lock_error(struct checked_lock* lock,
 	const char* func, const char* file, int line, const char* err)
 {
 	log_err("lock error (description follows)");
-	log_err("Created at %s %s:%d", lock->create_func, 
+	log_err("Created at %s %s:%d", lock->create_func,
 		lock->create_file, lock->create_line);
 	if(lock->holder_func && lock->holder_file)
-		log_err("Previously %s %s:%d", lock->holder_func, 
+		log_err("Previously %s %s:%d", lock->holder_func,
 			lock->holder_file, lock->holder_line);
 	log_err("At %s %s:%d", func, file, line);
 	log_err("Error for %s lock: %s",
@@ -95,16 +95,16 @@ static void lock_error(struct checked_lock* lock,
 	fatal_exit("bailing out");
 }
 
-/** 
+/**
  * Obtain lock on debug lock structure. This could be a deadlock by the caller.
- * The debug code itself does not deadlock. Anyway, check with timeouts. 
+ * The debug code itself does not deadlock. Anyway, check with timeouts.
  * @param lock: on what to acquire lock.
  * @param func: user level caller identification.
  * @param file: user level caller identification.
  * @param line: user level caller identification.
  */
 static void
-acquire_locklock(struct checked_lock* lock, 
+acquire_locklock(struct checked_lock* lock,
 	const char* func, const char* file, int line)
 {
 	struct timespec to;
@@ -130,7 +130,7 @@ acquire_locklock(struct checked_lock* lock,
 }
 
 /** add protected region */
-void 
+void
 lock_protect(void *p, void* area, size_t size)
 {
 	struct checked_lock* lock = *(struct checked_lock**)p;
@@ -157,7 +157,7 @@ lock_unprotect(void* mangled, void* area)
 {
 	struct checked_lock* lock = *(struct checked_lock**)mangled;
 	struct protected_area* p, **prevp;
-	if(!lock) 
+	if(!lock)
 		return;
 	acquire_locklock(lock, __func__, __FILE__, __LINE__);
 	p = lock->prot;
@@ -176,14 +176,14 @@ lock_unprotect(void* mangled, void* area)
 	LOCKRET(pthread_mutex_unlock(&lock->lock));
 }
 
-/** 
- * Check protected memory region. Memory compare. Exit on error. 
+/**
+ * Check protected memory region. Memory compare. Exit on error.
  * @param lock: which lock to check.
  * @param func: location we are now (when failure is detected).
  * @param file: location we are now (when failure is detected).
  * @param line: location we are now (when failure is detected).
  */
-static void 
+static void
 prot_check(struct checked_lock* lock,
 	const char* func, const char* file, int line)
 {
@@ -192,7 +192,7 @@ prot_check(struct checked_lock* lock,
 		if(memcmp(p->hold, p->region, p->size) != 0) {
 			log_hex("memory prev", p->hold, p->size);
 			log_hex("memory here", p->region, p->size);
-			lock_error(lock, func, file, line, 
+			lock_error(lock, func, file, line,
 				"protected area modified");
 		}
 		p = p->next;
@@ -200,7 +200,7 @@ prot_check(struct checked_lock* lock,
 }
 
 /** Copy protected memory region */
-static void 
+static void
 prot_store(struct checked_lock* lock)
 {
 	struct protected_area* p = lock->prot;
@@ -211,7 +211,7 @@ prot_store(struct checked_lock* lock)
 }
 
 /** get memory held by lock */
-size_t 
+size_t
 lock_get_mem(void* pp)
 {
 	size_t s;
@@ -240,15 +240,15 @@ ordercheck_locklock(struct thr_check* thr, struct checked_lock* lock)
 	info[2] = lock->create_thread;
 	info[3] = lock->create_instance;
 	if(fwrite(info, 4*sizeof(int), 1, thr->order_info) != 1 ||
-		fwrite(lock->holder_file, strlen(lock->holder_file)+1, 1, 
+		fwrite(lock->holder_file, strlen(lock->holder_file)+1, 1,
 		thr->order_info) != 1 ||
-		fwrite(&lock->holder_line, sizeof(int), 1, 
+		fwrite(&lock->holder_line, sizeof(int), 1,
 		thr->order_info) != 1)
 		log_err("fwrite: %s", strerror(errno));
 }
 
 /** write ordercheck lock creation details to file */
-static void 
+static void
 ordercheck_lockcreate(struct thr_check* thr, struct checked_lock* lock)
 {
 	/* write: <ffff = create> <lock id> <file> <line> */
@@ -256,23 +256,23 @@ ordercheck_lockcreate(struct thr_check* thr, struct checked_lock* lock)
 	if(!check_locking_order) return;
 
 	if( fwrite(&cmd, sizeof(int), 1, thr->order_info) != 1 ||
-		fwrite(&lock->create_thread, sizeof(int), 1, 
+		fwrite(&lock->create_thread, sizeof(int), 1,
 			thr->order_info) != 1 ||
-		fwrite(&lock->create_instance, sizeof(int), 1, 
+		fwrite(&lock->create_instance, sizeof(int), 1,
 			thr->order_info) != 1 ||
-		fwrite(lock->create_file, strlen(lock->create_file)+1, 1, 
+		fwrite(lock->create_file, strlen(lock->create_file)+1, 1,
 			thr->order_info) != 1 ||
-		fwrite(&lock->create_line, sizeof(int), 1, 
+		fwrite(&lock->create_line, sizeof(int), 1,
 		thr->order_info) != 1)
 		log_err("fwrite: %s", strerror(errno));
 }
 
 /** alloc struct, init lock empty */
-void 
+void
 checklock_init(enum check_lock_type type, struct checked_lock** lock,
         const char* func, const char* file, int line)
 {
-	struct checked_lock* e = (struct checked_lock*)calloc(1, 
+	struct checked_lock* e = (struct checked_lock*)calloc(1,
 		sizeof(struct checked_lock));
 	struct thr_check *thr = (struct thr_check*)pthread_getspecific(
 		thr_debug_key);
@@ -315,7 +315,7 @@ checklock_init(enum check_lock_type type, struct checked_lock** lock,
 }
 
 /** delete prot items */
-static void 
+static void
 prot_clear(struct checked_lock* lock)
 {
 	struct protected_area* p=lock->prot, *np;
@@ -328,12 +328,12 @@ prot_clear(struct checked_lock* lock)
 }
 
 /** check if type is OK for the lock given */
-static void 
+static void
 checktype(enum check_lock_type type, struct checked_lock* lock,
         const char* func, const char* file, int line)
 {
-	if(!lock) 
-		fatal_exit("use of null/deleted lock at %s %s:%d", 
+	if(!lock)
+		fatal_exit("use of null/deleted lock at %s %s:%d",
 			func, file, line);
 	if(type != lock->type) {
 		lock_error(lock, func, file, line, "wrong lock type");
@@ -341,13 +341,13 @@ checktype(enum check_lock_type type, struct checked_lock* lock,
 }
 
 /** check if OK, free struct */
-void 
+void
 checklock_destroy(enum check_lock_type type, struct checked_lock** lock,
         const char* func, const char* file, int line)
 {
 	const size_t contention_interest = 1; /* promille contented locks */
 	struct checked_lock* e;
-	if(!lock) 
+	if(!lock)
 		return;
 	e = *lock;
 	if(!e)
@@ -369,7 +369,7 @@ checklock_destroy(enum check_lock_type type, struct checked_lock** lock,
 	   1000*e->contention_count/e->history_count > contention_interest) {
 		log_info("lock created %s %s %d has contention %u of %u (%d%%)",
 			e->create_func, e->create_file, e->create_line,
-			(unsigned int)e->contention_count, 
+			(unsigned int)e->contention_count,
 			(unsigned int)e->history_count,
 			(int)(100*e->contention_count/e->history_count));
 	}
@@ -377,7 +377,7 @@ checklock_destroy(enum check_lock_type type, struct checked_lock** lock,
 	/* delete it */
 	LOCKRET(pthread_mutex_destroy(&e->lock));
 	prot_clear(e);
-	/* since nobody holds the lock - see check above, no need to unlink 
+	/* since nobody holds the lock - see check above, no need to unlink
 	 * from the thread-held locks list. */
 	switch(e->type) {
 		case check_lock_mutex:
@@ -397,7 +397,7 @@ checklock_destroy(enum check_lock_type type, struct checked_lock** lock,
 }
 
 /** finish acquiring lock, shared between _(rd|wr||)lock() routines */
-static void 
+static void
 finish_acquire_lock(struct thr_check* thr, struct checked_lock* lock,
         const char* func, const char* file, int line)
 {
@@ -409,7 +409,7 @@ finish_acquire_lock(struct thr_check* thr, struct checked_lock* lock,
 	lock->holder_file = file;
 	lock->holder_line = line;
 	ordercheck_locklock(thr, lock);
-	
+
 	/* insert in thread lock list, as first */
 	lock->prev_held_lock[thr->num] = NULL;
 	lock->next_held_lock[thr->num] = thr->holding_first;
@@ -436,7 +436,7 @@ finish_acquire_lock(struct thr_check* thr, struct checked_lock* lock,
  * @param exclusive: if lock must be exclusive (only one allowed).
  * @param getwr: if attempts to get writelock (or readlock) for rwlocks.
  */
-static void 
+static void
 checklock_lockit(enum check_lock_type type, struct checked_lock* lock,
         const char* func, const char* file, int line,
 	int (*tryfunc)(void*), int (*timedfunc)(void*, struct timespec*),
@@ -448,11 +448,11 @@ checklock_lockit(enum check_lock_type type, struct checked_lock* lock,
 		thr_debug_key);
 	checktype(type, lock, func, file, line);
 	if(!thr) lock_error(lock, func, file, line, "no thread info");
-	
+
 	acquire_locklock(lock, func, file, line);
 	lock->wait_count ++;
 	thr->waiting = lock;
-	if(exclusive && lock->hold_count > 0 && lock->holder == thr) 
+	if(exclusive && lock->hold_count > 0 && lock->holder == thr)
 		lock_error(lock, func, file, line, "thread already owns lock");
 	if(type==check_lock_rwlock && getwr && lock->writeholder == thr)
 		lock_error(lock, func, file, line, "thread already has wrlock");
@@ -466,7 +466,7 @@ checklock_lockit(enum check_lock_type type, struct checked_lock* lock,
 		to.tv_nsec = 0;
 		if((err=timedfunc(arg, &to))) {
 			if(err == ETIMEDOUT)
-				lock_error(lock, func, file, line, 
+				lock_error(lock, func, file, line,
 					"timeout possible deadlock");
 			log_err("timedlock: %s", strerror(err));
 		}
@@ -501,7 +501,7 @@ static int timed_rd(void* arg, struct timespec* to)
 { return pthread_rwlock_timedrdlock((pthread_rwlock_t*)arg, to); }
 
 /** check if OK, lock */
-void 
+void
 checklock_rdlock(enum check_lock_type type, struct checked_lock* lock,
         const char* func, const char* file, int line)
 {
@@ -521,7 +521,7 @@ static int timed_wr(void* arg, struct timespec* to)
 { return pthread_rwlock_timedwrlock((pthread_rwlock_t*)arg, to); }
 
 /** check if OK, lock */
-void 
+void
 checklock_wrlock(enum check_lock_type type, struct checked_lock* lock,
         const char* func, const char* file, int line)
 {
@@ -558,7 +558,7 @@ static int timed_spinlock(void* arg, struct timespec* to)
 }
 
 /** check if OK, lock */
-void 
+void
 checklock_lock(enum check_lock_type type, struct checked_lock* lock,
         const char* func, const char* file, int line)
 {
@@ -573,7 +573,7 @@ checklock_lock(enum check_lock_type type, struct checked_lock* lock,
 		case check_lock_spinlock:
 			/* void* cast needed because 'volatile' on some OS */
 			checklock_lockit(type, lock, func, file, line,
-				try_spinlock, timed_spinlock, 
+				try_spinlock, timed_spinlock,
 				(void*)&lock->u.spinlock, 1, 0);
 			break;
 		default:
@@ -582,7 +582,7 @@ checklock_lock(enum check_lock_type type, struct checked_lock* lock,
 }
 
 /** check if OK, unlock */
-void 
+void
 checklock_unlock(enum check_lock_type type, struct checked_lock* lock,
         const char* func, const char* file, int line)
 {
@@ -652,7 +652,7 @@ checklock_unlock(enum check_lock_type type, struct checked_lock* lock,
 }
 
 /** open order info debug file, thr->num must be valid */
-static void 
+static void
 open_lockorder(struct thr_check* thr)
 {
 	char buf[24];
@@ -665,8 +665,8 @@ open_lockorder(struct thr_check* thr)
 	t = time(NULL);
 	/* write: <time_stamp> <runpid> <thread_num> */
 	if(fwrite(&t, sizeof(t), 1, thr->order_info) != 1 ||
-		fwrite(&thr->num, sizeof(thr->num), 1, thr->order_info) != 1 || 
-		fwrite(&check_lock_pid, sizeof(check_lock_pid), 1, 
+		fwrite(&thr->num, sizeof(thr->num), 1, thr->order_info) != 1 ||
+		fwrite(&check_lock_pid, sizeof(check_lock_pid), 1,
 		thr->order_info) != 1)
 		log_err("fwrite: %s", strerror(errno));
 }
@@ -674,7 +674,7 @@ open_lockorder(struct thr_check* thr)
 /** checklock thread main, Inits thread structure */
 static void* checklock_main(void* arg)
 {
-	struct thr_check* thr = (struct thr_check*)arg; 
+	struct thr_check* thr = (struct thr_check*)arg;
 	void* ret;
 	thr->id = pthread_self();
 	/* Hack to get same numbers as in log file */
@@ -701,7 +701,7 @@ void checklock_start(void)
 	if(key_deleted)
 		return;
 	if(!key_created) {
-		struct thr_check* thisthr = (struct thr_check*)calloc(1, 
+		struct thr_check* thisthr = (struct thr_check*)calloc(1,
 			sizeof(struct thr_check));
 		if(!thisthr)
 			fatal_exit("thrcreate: out of memory");
@@ -734,10 +734,10 @@ void checklock_stop(void)
 }
 
 /** allocate debug info and create thread */
-void 
+void
 checklock_thrcreate(pthread_t* id, void* (*func)(void*), void* arg)
 {
-	struct thr_check* thr = (struct thr_check*)calloc(1, 
+	struct thr_check* thr = (struct thr_check*)calloc(1,
 		sizeof(struct thr_check));
 	if(!thr)
 		fatal_exit("thrcreate: out of memory");
@@ -767,14 +767,14 @@ lock_debug_info(struct checked_lock* lock)
 {
 	if(!lock) return;
 	log_info("+++ Lock %llx, %d %d create %s %s %d",
-		(unsigned long long)(size_t)lock, 
-		lock->create_thread, lock->create_instance, 
+		(unsigned long long)(size_t)lock,
+		lock->create_thread, lock->create_instance,
 		lock->create_func, lock->create_file, lock->create_line);
 	log_info("lock type: %s",
 		(lock->type==check_lock_mutex)?"mutex": (
 		(lock->type==check_lock_spinlock)?"spinlock": (
 		(lock->type==check_lock_rwlock)?"rwlock": "badtype")));
-	log_info("lock contention %u, history:%u, hold:%d, wait:%d", 
+	log_info("lock contention %u, history:%u, hold:%d, wait:%d",
 		(unsigned)lock->contention_count, (unsigned)lock->history_count,
 		lock->hold_count, lock->wait_count);
 	log_info("last touch %s %s %d", lock->holder_func, lock->holder_file,
@@ -804,11 +804,11 @@ thread_debug_info(struct thr_check* thr)
 	log_info("pthread id is %x", (int)thr->id);
 	log_info("thread func is %llx", (unsigned long long)(size_t)thr->func);
 	log_info("thread arg is %llx (%d)",
-		(unsigned long long)(size_t)thr->arg, 
+		(unsigned long long)(size_t)thr->arg,
 		(thr->arg?*(int*)thr->arg:0));
 	log_info("thread num is %d", thr->num);
 	log_info("locks created %d", thr->locks_created);
-	log_info("open file for lockinfo: %s", 
+	log_info("open file for lockinfo: %s",
 		thr->order_info?"yes, flushing":"no");
 	fflush(thr->order_info);
 	w = thr->waiting;
@@ -817,7 +817,7 @@ thread_debug_info(struct thr_check* thr)
 	log_info("thread waiting for a lock: %s %llx", w?"yes":"no",
 		(unsigned long long)(size_t)w);
 	lock_debug_info(w);
-	log_info("thread holding first: %s, last: %s", f?"yes":"no", 
+	log_info("thread holding first: %s, last: %s", f?"yes":"no",
 		l?"yes":"no");
 	held_debug_info(thr, f);
 }
@@ -848,7 +848,7 @@ static RETSIGTYPE joinalarm(int ATTR_UNUSED(sig))
 }
 
 /** wait for thread with a timeout */
-void 
+void
 checklock_thrjoin(pthread_t thread)
 {
 	/* wait with a timeout */
diff --git a/usr.sbin/unbound/testcode/checklocks.h b/usr.sbin/unbound/testcode/checklocks.h
index 61cc6fb0c..51a79b448 100644
--- a/usr.sbin/unbound/testcode/checklocks.h
+++ b/usr.sbin/unbound/testcode/checklocks.h
@@ -2,24 +2,24 @@
  * testcode/checklocks.h - wrapper on locks that checks access.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -93,7 +93,7 @@ struct protected_area {
 };
 
 /**
- * Per thread information for locking debug wrappers. 
+ * Per thread information for locking debug wrappers.
  */
 struct thr_check {
 	/** thread id */
@@ -108,7 +108,7 @@ struct thr_check {
 	int locks_created;
 	/** file to write locking order information to */
 	FILE* order_info;
-	/** 
+	/**
 	 * List of locks that this thread is holding, double
 	 * linked list. The first element is the most recent lock acquired.
 	 * So it represents the stack of locks acquired. (of all types).
@@ -183,7 +183,7 @@ struct checked_lock {
  * @param size: length of area.
  * You can call it multiple times with the same lock to give several areas.
  * Call it when you are done initializing the area, since it will be copied
- * at this time and protected right away against unauthorised changes until 
+ * at this time and protected right away against unauthorised changes until
  * the next lock() call is done.
  */
 void lock_protect(void* lock, void* area, size_t size);
@@ -294,7 +294,7 @@ void checklock_thrcreate(pthread_t* thr, void* (*func)(void*), void* arg);
  */
 void checklock_thrjoin(pthread_t thread);
 
-/** structures to enable compiler type checking on the locks. 
+/** structures to enable compiler type checking on the locks.
  * Also the pointer makes it so that the lock can be part of the protected
  * region without any possible problem (since the ptr will stay the same.)
  * i.e. there can be contention and readlocks stored in checked_lock, while
diff --git a/usr.sbin/unbound/testcode/delayer.c b/usr.sbin/unbound/testcode/delayer.c
index 647a4e24c..843c671f0 100644
--- a/usr.sbin/unbound/testcode/delayer.c
+++ b/usr.sbin/unbound/testcode/delayer.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -111,7 +111,7 @@ struct tcp_send_list {
 };
 
 /**
- * List of TCP proxy fd pairs to TCP connect client to server 
+ * List of TCP proxy fd pairs to TCP connect client to server
  */
 struct tcp_proxy {
 	/** the fd to listen for client query */
@@ -155,7 +155,7 @@ static void usage(char* argv[])
 
 /** timeval compare, t1 < t2 */
 static int
-dl_tv_smaller(struct timeval* t1, const struct timeval* t2) 
+dl_tv_smaller(struct timeval* t1, const struct timeval* t2)
 {
 #ifndef S_SPLINT_S
 	if(t1->tv_sec < t2->tv_sec)
@@ -169,7 +169,7 @@ dl_tv_smaller(struct timeval* t1, const struct timeval* t2)
 
 /** timeval add, t1 += t2 */
 static void
-dl_tv_add(struct timeval* t1, const struct timeval* t2) 
+dl_tv_add(struct timeval* t1, const struct timeval* t2)
 {
 #ifndef S_SPLINT_S
 	t1->tv_sec += t2->tv_sec;
@@ -183,7 +183,7 @@ dl_tv_add(struct timeval* t1, const struct timeval* t2)
 
 /** timeval subtract, t1 -= t2 */
 static void
-dl_tv_subtract(struct timeval* t1, const struct timeval* t2) 
+dl_tv_subtract(struct timeval* t1, const struct timeval* t2)
 {
 #ifndef S_SPLINT_S
 	t1->tv_sec -= t2->tv_sec;
@@ -222,7 +222,7 @@ ring_delete(struct ringbuf* r)
 
 /** add entry to ringbuffer */
 static void
-ring_add(struct ringbuf* r, sldns_buffer* pkt, struct timeval* now, 
+ring_add(struct ringbuf* r, sldns_buffer* pkt, struct timeval* now,
 	struct timeval* delay, struct proxy* p)
 {
 	/* time -- proxy* -- 16bitlen -- message */
@@ -245,7 +245,7 @@ ring_add(struct ringbuf* r, sldns_buffer* pkt, struct timeval* now,
 			 * a completely full ringbuf */
 			if(r->size - r->high > sizeof(when)+sizeof(p)) {
 				/* zero entry at end of buffer */
-				memset(r->buf+r->high, 0, 
+				memset(r->buf+r->high, 0,
 					sizeof(when)+sizeof(p));
 			}
 			where = r->buf;
@@ -278,7 +278,7 @@ ring_add(struct ringbuf* r, sldns_buffer* pkt, struct timeval* now,
 	memmove(where, &when, sizeof(when));
 	memmove(where+sizeof(when), &p, sizeof(p));
 	memmove(where+sizeof(when)+sizeof(p), &len, sizeof(len));
-	memmove(where+sizeof(when)+sizeof(p)+sizeof(len), 
+	memmove(where+sizeof(when)+sizeof(p)+sizeof(len),
 		sldns_buffer_begin(pkt), len);
 }
 
@@ -300,7 +300,7 @@ ring_peek_time(struct ringbuf* r)
 
 /** get entry from ringbuffer */
 static int
-ring_pop(struct ringbuf* r, sldns_buffer* pkt, struct timeval* tv, 
+ring_pop(struct ringbuf* r, sldns_buffer* pkt, struct timeval* tv,
 	struct proxy** p)
 {
 	/* time -- proxy* -- 16bitlen -- message */
@@ -313,7 +313,7 @@ ring_pop(struct ringbuf* r, sldns_buffer* pkt, struct timeval* tv,
 	memmove(tv, where, sizeof(*tv));
 	memmove(p, where+sizeof(*tv), sizeof(*p));
 	memmove(&len, where+sizeof(*tv)+sizeof(*p), sizeof(len));
-	memmove(sldns_buffer_begin(pkt), 
+	memmove(sldns_buffer_begin(pkt),
 		where+sizeof(*tv)+sizeof(*p)+sizeof(len), len);
 	sldns_buffer_set_limit(pkt, (size_t)len);
 	done = sizeof(*tv)+sizeof(*p)+sizeof(len)+len;
@@ -340,7 +340,7 @@ ring_pop(struct ringbuf* r, sldns_buffer* pkt, struct timeval* tv,
 	}
 	return 1;
 }
-	
+
 /** signal handler global info */
 static volatile int do_quit = 0;
 
@@ -363,17 +363,17 @@ service_send(struct ringbuf* ring, struct timeval* now, sldns_buffer* pkt,
 	struct proxy* p;
 	struct timeval tv;
 	ssize_t sent;
-	while(!ring_empty(ring) && 
+	while(!ring_empty(ring) &&
 		dl_tv_smaller(ring_peek_time(ring), now)) {
 		/* this items needs to be sent out */
 		if(!ring_pop(ring, pkt, &tv, &p))
 			fatal_exit("ringbuf error: pop failed");
-		verbose(1, "send out query %d.%6.6d", 
+		verbose(1, "send out query %d.%6.6d",
 			(unsigned)tv.tv_sec, (unsigned)tv.tv_usec);
 		log_addr(1, "from client", &p->addr, p->addr_len);
 		/* send it */
-		sent = sendto(p->s, (void*)sldns_buffer_begin(pkt), 
-			sldns_buffer_limit(pkt), 0, 
+		sent = sendto(p->s, (void*)sldns_buffer_begin(pkt),
+			sldns_buffer_limit(pkt), 0,
 			(struct sockaddr*)srv_addr, srv_len);
 		if(sent == -1) {
 			log_err("sendto: %s", sock_strerror(errno));
@@ -392,7 +392,7 @@ do_proxy(struct proxy* p, int retsock, sldns_buffer* pkt)
 	int i;
 	ssize_t r;
 	for(i=0; i<TRIES_PER_SELECT; i++) {
-		r = recv(p->s, (void*)sldns_buffer_begin(pkt), 
+		r = recv(p->s, (void*)sldns_buffer_begin(pkt),
 			sldns_buffer_capacity(pkt), 0);
 		if(r == -1) {
 #ifndef USE_WINSOCK
@@ -410,7 +410,7 @@ do_proxy(struct proxy* p, int retsock, sldns_buffer* pkt)
 		log_addr(1, "return reply to client", &p->addr, p->addr_len);
 		/* send reply back to the real client */
 		p->numreturn++;
-		r = sendto(retsock, (void*)sldns_buffer_begin(pkt), (size_t)r, 
+		r = sendto(retsock, (void*)sldns_buffer_begin(pkt), (size_t)r,
 			0, (struct sockaddr*)&p->addr, p->addr_len);
 		if(r == -1) {
 			log_err("sendto: %s", sock_strerror(errno));
@@ -420,7 +420,7 @@ do_proxy(struct proxy* p, int retsock, sldns_buffer* pkt)
 
 /** proxy return replies to clients */
 static void
-service_proxy(fd_set* rset, int retsock, struct proxy* proxies, 
+service_proxy(fd_set* rset, int retsock, struct proxy* proxies,
 	sldns_buffer* pkt, struct timeval* now)
 {
 	struct proxy* p;
@@ -479,9 +479,9 @@ find_create_proxy(struct sockaddr_storage* from, socklen_t from_len,
 
 /** recv new waiting packets */
 static void
-service_recv(int s, struct ringbuf* ring, sldns_buffer* pkt, 
+service_recv(int s, struct ringbuf* ring, sldns_buffer* pkt,
 	fd_set* rorig, int* max, struct proxy** proxies,
-	struct sockaddr_storage* srv_addr, socklen_t srv_len, 
+	struct sockaddr_storage* srv_addr, socklen_t srv_len,
 	struct timeval* now, struct timeval* delay, struct timeval* reuse)
 {
 	int i;
@@ -499,7 +499,7 @@ service_recv(int s, struct ringbuf* ring, sldns_buffer* pkt,
 			if(errno == EAGAIN || errno == EINTR)
 				return;
 #else
-			if(WSAGetLastError() == WSAEWOULDBLOCK || 
+			if(WSAGetLastError() == WSAEWOULDBLOCK ||
 				WSAGetLastError() == WSAEINPROGRESS)
 				return;
 #endif
@@ -548,7 +548,7 @@ tcp_proxy_delete(struct tcp_proxy* p)
 /** accept new TCP connections, and set them up */
 static void
 service_tcp_listen(int s, fd_set* rorig, int* max, struct tcp_proxy** proxies,
-	struct sockaddr_storage* srv_addr, socklen_t srv_len, 
+	struct sockaddr_storage* srv_addr, socklen_t srv_len,
 	struct timeval* now, struct timeval* tcp_timeout)
 {
 	int newfd;
@@ -561,7 +561,7 @@ service_tcp_listen(int s, fd_set* rorig, int* max, struct tcp_proxy** proxies,
 		if(errno == EAGAIN || errno == EINTR)
 			return;
 #else
-		if(WSAGetLastError() == WSAEWOULDBLOCK || 
+		if(WSAGetLastError() == WSAEWOULDBLOCK ||
 			WSAGetLastError() == WSAEINPROGRESS ||
 			WSAGetLastError() == WSAECONNRESET)
 			return;
@@ -588,7 +588,7 @@ service_tcp_listen(int s, fd_set* rorig, int* max, struct tcp_proxy** proxies,
 #else
 		if(WSAGetLastError() != WSAEWOULDBLOCK &&
 			WSAGetLastError() != WSAEINPROGRESS) {
-			log_err("tcp connect: %s", 
+			log_err("tcp connect: %s",
 				wsa_strerror(WSAGetLastError()));
 #endif
 			sock_close(p->server_s);
@@ -615,19 +615,19 @@ service_tcp_listen(int s, fd_set* rorig, int* max, struct tcp_proxy** proxies,
 
 /** relay TCP, read a part */
 static int
-tcp_relay_read(int s, struct tcp_send_list** first, 
-	struct tcp_send_list** last, struct timeval* now, 
+tcp_relay_read(int s, struct tcp_send_list** first,
+	struct tcp_send_list** last, struct timeval* now,
 	struct timeval* delay, sldns_buffer* pkt)
 {
 	struct tcp_send_list* item;
-	ssize_t r = recv(s, (void*)sldns_buffer_begin(pkt), 
+	ssize_t r = recv(s, (void*)sldns_buffer_begin(pkt),
 		sldns_buffer_capacity(pkt), 0);
 	if(r == -1) {
 #ifndef USE_WINSOCK
 		if(errno == EINTR || errno == EAGAIN)
 			return 1;
 #else
-		if(WSAGetLastError() == WSAEINPROGRESS || 
+		if(WSAGetLastError() == WSAEINPROGRESS ||
 			WSAGetLastError() == WSAEWOULDBLOCK)
 			return 1;
 #endif
@@ -654,7 +654,7 @@ tcp_relay_read(int s, struct tcp_send_list** first,
 	item->wait = *now;
 	dl_tv_add(&item->wait, delay);
 	item->next = NULL;
-	
+
 	/* link in */
 	if(*first) {
 		(*last)->next = item;
@@ -667,7 +667,7 @@ tcp_relay_read(int s, struct tcp_send_list** first,
 
 /** relay TCP, write a part */
 static int
-tcp_relay_write(int s, struct tcp_send_list** first, 
+tcp_relay_write(int s, struct tcp_send_list** first,
 	struct tcp_send_list** last, struct timeval* now)
 {
 	ssize_t r;
@@ -684,7 +684,7 @@ tcp_relay_write(int s, struct tcp_send_list** first,
 			if(errno == EAGAIN || errno == EINTR)
 				return 1;
 #else
-			if(WSAGetLastError() == WSAEWOULDBLOCK || 
+			if(WSAGetLastError() == WSAEWOULDBLOCK ||
 				WSAGetLastError() == WSAEINPROGRESS)
 				return 1;
 #endif
@@ -731,7 +731,7 @@ service_tcp_relay(struct tcp_proxy** tcp_proxies, struct timeval* now,
 		if(!delete_it && FD_ISSET(p->client_s, rset)) {
 			p->timeout = tout;
 			log_addr(1, "read tcp query", &p->addr, p->addr_len);
-			if(!tcp_relay_read(p->client_s, &p->querylist, 
+			if(!tcp_relay_read(p->client_s, &p->querylist,
 				&p->querylast, now, delay, pkt))
 				delete_it = 1;
 		}
@@ -740,7 +740,7 @@ service_tcp_relay(struct tcp_proxy** tcp_proxies, struct timeval* now,
 			FD_ISSET(p->server_s, rset)) {
 			p->timeout = tout;
 			log_addr(1, "read tcp answer", &p->addr, p->addr_len);
-			if(!tcp_relay_read(p->server_s, &p->answerlist, 
+			if(!tcp_relay_read(p->server_s, &p->answerlist,
 				&p->answerlast, now, delay, pkt)) {
 				sock_close(p->server_s);
 				FD_CLR(FD_SET_T p->server_s, worig);
@@ -752,9 +752,9 @@ service_tcp_relay(struct tcp_proxy** tcp_proxies, struct timeval* now,
 		if(!delete_it && p->querylist && p->server_s != -1) {
 			p->timeout = tout;
 			if(dl_tv_smaller(&p->querylist->wait, now))
-				log_addr(1, "write tcp query", 
+				log_addr(1, "write tcp query",
 					&p->addr, p->addr_len);
-			if(!tcp_relay_write(p->server_s, &p->querylist, 
+			if(!tcp_relay_write(p->server_s, &p->querylist,
 				&p->querylast, now))
 				delete_it = 1;
 			if(p->querylist &&
@@ -767,9 +767,9 @@ service_tcp_relay(struct tcp_proxy** tcp_proxies, struct timeval* now,
 		if(!delete_it && p->answerlist) {
 			p->timeout = tout;
 			if(dl_tv_smaller(&p->answerlist->wait, now))
-				log_addr(1, "write tcp answer", 
+				log_addr(1, "write tcp answer",
 					&p->addr, p->addr_len);
-			if(!tcp_relay_write(p->client_s, &p->answerlist, 
+			if(!tcp_relay_write(p->client_s, &p->answerlist,
 				&p->answerlast, now))
 				delete_it = 1;
 			if(p->answerlist && dl_tv_smaller(&p->answerlist->wait,
@@ -805,7 +805,7 @@ service_tcp_relay(struct tcp_proxy** tcp_proxies, struct timeval* now,
 
 /** find waiting time */
 static int
-service_findwait(struct timeval* now, struct timeval* wait, 
+service_findwait(struct timeval* now, struct timeval* wait,
 	struct ringbuf* ring, struct tcp_proxy* tcplist)
 {
 	/* first item is the time to wait */
@@ -856,19 +856,19 @@ proxy_list_clear(struct proxy* p)
 		np = p->next;
 		port = (int)ntohs(((struct sockaddr_in*)&p->addr)->sin_port);
 		if(addr_is_ip6(&p->addr, p->addr_len)) {
-			if(inet_ntop(AF_INET6, 
+			if(inet_ntop(AF_INET6,
 				&((struct sockaddr_in6*)&p->addr)->sin6_addr,
 				from, (socklen_t)sizeof(from)) == 0)
 				(void)strlcpy(from, "err", sizeof(from));
 		} else {
-			if(inet_ntop(AF_INET, 
+			if(inet_ntop(AF_INET,
 				&((struct sockaddr_in*)&p->addr)->sin_addr,
 				from, (socklen_t)sizeof(from)) == 0)
 				(void)strlcpy(from, "err", sizeof(from));
 		}
 		printf("client[%d]: last %s@%d of %d : %u in, %u out, "
 			"%u returned\n", i++, from, port, (int)p->numreuse+1,
-			(unsigned)p->numwait, (unsigned)p->numsent, 
+			(unsigned)p->numwait, (unsigned)p->numsent,
 			(unsigned)p->numreturn);
 		sock_close(p->s);
 		free(p);
@@ -890,9 +890,9 @@ tcp_proxy_list_clear(struct tcp_proxy* p)
 
 /** delayer service loop */
 static void
-service_loop(int udp_s, int listen_s, struct ringbuf* ring, 
+service_loop(int udp_s, int listen_s, struct ringbuf* ring,
 	struct timeval* delay, struct timeval* reuse,
-	struct sockaddr_storage* srv_addr, socklen_t srv_len, 
+	struct sockaddr_storage* srv_addr, socklen_t srv_len,
 	sldns_buffer* pkt)
 {
 	fd_set rset, rorig;
@@ -931,7 +931,7 @@ service_loop(int udp_s, int listen_s, struct ringbuf* ring,
 				continue;
 			fatal_exit("gettimeofday: %s", strerror(errno));
 		}
-		verbose(1, "process at %u.%6.6u\n", 
+		verbose(1, "process at %u.%6.6u\n",
 			(unsigned)now.tv_sec, (unsigned)now.tv_usec);
 		/* sendout delayed queries to master server (frees up buffer)*/
 		service_send(ring, &now, pkt, srv_addr, srv_len);
@@ -944,7 +944,7 @@ service_loop(int udp_s, int listen_s, struct ringbuf* ring,
 		service_tcp_listen(listen_s, &rorig, &max, &tcp_proxies,
 			srv_addr, srv_len, &now, &tcp_timeout);
 		/* service tcp connections */
-		service_tcp_relay(&tcp_proxies, &now, delay, &tcp_timeout, 
+		service_tcp_relay(&tcp_proxies, &now, delay, &tcp_timeout,
 			pkt, &rset, &rorig, &worig);
 		/* see what next timeout is (if any) */
 		have_wait = service_findwait(&now, &wait, ring, tcp_proxies);
@@ -955,7 +955,7 @@ service_loop(int udp_s, int listen_s, struct ringbuf* ring,
 
 /** delayer main service routine */
 static void
-service(const char* bind_str, int bindport, const char* serv_str, 
+service(const char* bind_str, int bindport, const char* serv_str,
 	size_t memsize, int delay_msec)
 {
 	struct sockaddr_storage bind_addr, srv_addr;
@@ -1044,7 +1044,7 @@ service(const char* bind_str, int bindport, const char* serv_str,
 
 	/* process loop */
 	do_quit = 0;
-	service_loop(s, listen_s, ring, &delay, &reuse, &srv_addr, srv_len, 
+	service_loop(s, listen_s, ring, &delay, &reuse, &srv_addr, srv_len,
 		pkt);
 
 	/* cleanup */
@@ -1061,7 +1061,7 @@ extern int optind;
 extern char* optarg;
 
 /** main program for delayer */
-int main(int argc, char** argv) 
+int main(int argc, char** argv)
 {
 	int c;		/* defaults */
 	const char* server = "127.0.0.1@53";
@@ -1113,7 +1113,7 @@ int main(int argc, char** argv)
 	if(argc != 0)
 		usage(argv);
 
-	printf("bind to %s @ %d and forward to %s after %d msec\n", 
+	printf("bind to %s @ %d and forward to %s after %d msec\n",
 		bindto, bindport, server, delay);
 	service(bindto, bindport, server, memsize, delay);
 	return 0;
diff --git a/usr.sbin/unbound/testcode/dohclient.c b/usr.sbin/unbound/testcode/dohclient.c
index 82e522f90..1e319508c 100644
--- a/usr.sbin/unbound/testcode/dohclient.c
+++ b/usr.sbin/unbound/testcode/dohclient.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2020, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -33,7 +33,7 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/** 
+/**
  * \file
  *
  * Simple DNS-over-HTTPS client. For testing and debugging purposes.
@@ -579,7 +579,7 @@ int main(int argc, char** argv)
 	if(argc == 1) {
 		usage(argv);
 	}
-	
+
 	h2_session->authority = "127.0.0.1";
 	h2_session->post = 0;
 	h2_session->endpoint = "/dns-query";
diff --git a/usr.sbin/unbound/testcode/fake_event.c b/usr.sbin/unbound/testcode/fake_event.c
index efb22a6fb..618e739d7 100644
--- a/usr.sbin/unbound/testcode/fake_event.c
+++ b/usr.sbin/unbound/testcode/fake_event.c
@@ -2,24 +2,24 @@
  * testcode/fake_event.c - fake event handling that replays existing scenario.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -109,7 +109,7 @@ timeval_add(struct timeval* d, const struct timeval* add)
 #endif
 }
 
-void 
+void
 fake_temp_file(const char* adj, const char* id, char* buf, size_t len)
 {
 #ifdef USE_WINSOCK
@@ -121,13 +121,13 @@ fake_temp_file(const char* adj, const char* id, char* buf, size_t len)
 #endif
 }
 
-void 
+void
 fake_event_init(struct replay_scenario* scen)
 {
 	saved_scenario = scen;
 }
 
-void 
+void
 fake_event_cleanup(void)
 {
 	replay_scenario_delete(saved_scenario);
@@ -172,7 +172,7 @@ repevt_string(enum replay_event_type t)
 }
 
 /** delete a fake pending */
-static void 
+static void
 delete_fake_pending(struct fake_pending* pend)
 {
 	if(!pend)
@@ -200,8 +200,8 @@ delete_replay_answer(struct replay_answer* a)
 /**
  * return: true if pending query matches the now event.
  */
-static int 
-pending_matches_current(struct replay_runtime* runtime, 
+static int
+pending_matches_current(struct replay_runtime* runtime,
 	struct entry** entry, struct fake_pending **pend)
 {
 	struct fake_pending* p;
@@ -233,7 +233,7 @@ pending_matches_current(struct replay_runtime* runtime,
  * @return: true if a match is found.
  */
 static int
-pending_find_match(struct replay_runtime* runtime, struct entry** entry, 
+pending_find_match(struct replay_runtime* runtime, struct entry** entry,
 	struct fake_pending* pend)
 {
 	int timenow = runtime->now->time_step;
@@ -245,7 +245,7 @@ pending_find_match(struct replay_runtime* runtime, struct entry** entry,
 		  (*entry = find_match(p->match, pend->pkt, pend->pkt_len,
 		 	 pend->transport))) {
 			log_info("matched query time %d in range [%d, %d] "
-				"with entry line %d", timenow, 
+				"with entry line %d", timenow,
 				p->start_step, p->end_step, (*entry)->lineno);
 			if(p->addrlen != 0)
 				log_addr(0, "matched ip", &p->addr, p->addrlen);
@@ -266,8 +266,8 @@ pending_find_match(struct replay_runtime* runtime, struct entry** entry,
  * @param pend: if true, the outgoing message that matches is returned.
  * @return: true if pending query matches the now event.
  */
-static int 
-pending_matches_range(struct replay_runtime* runtime, 
+static int
+pending_matches_range(struct replay_runtime* runtime,
 	struct entry** entry, struct fake_pending** pend)
 {
 	struct fake_pending* p = runtime->pending_list;
@@ -405,9 +405,9 @@ answer_callback_from_entry(struct replay_runtime* runtime,
 static void
 answer_check_it(struct replay_runtime* runtime)
 {
-	struct replay_answer* ans = runtime->answer_list, 
+	struct replay_answer* ans = runtime->answer_list,
 		*prev = NULL;
-	log_assert(runtime && runtime->now && 
+	log_assert(runtime && runtime->now &&
 		runtime->now->evt_type == repevt_front_reply);
 	while(ans) {
 		enum transport_type tr = transport_tcp;
@@ -420,7 +420,7 @@ answer_check_it(struct replay_runtime* runtime)
 				ans->pkt_len, tr)) {
 			log_info("testbound matched event entry from line %d",
 				runtime->now->match->lineno);
-			log_info("testbound: do STEP %d %s", 
+			log_info("testbound: do STEP %d %s",
 				runtime->now->time_step,
 				repevt_string(runtime->now->evt_type));
 			if(prev)
@@ -474,7 +474,7 @@ fake_front_query(struct replay_runtime* runtime, struct replay_moment *todo)
 	log_pkt("query pkt", todo->match->reply_list->reply_pkt,
 		todo->match->reply_list->reply_len);
 	/* call the callback for incoming queries */
-	if((*runtime->callback_query)(repinfo.c, runtime->cb_arg, 
+	if((*runtime->callback_query)(repinfo.c, runtime->cb_arg,
 		NETEVENT_NOERROR, &repinfo)) {
 		/* send immediate reply */
 		comm_point_send_reply(&repinfo);
@@ -487,7 +487,7 @@ fake_front_query(struct replay_runtime* runtime, struct replay_moment *todo)
  * Perform callback for fake pending message.
  */
 static void
-fake_pending_callback(struct replay_runtime* runtime, 
+fake_pending_callback(struct replay_runtime* runtime,
 	struct replay_moment* todo, int error)
 {
 	struct fake_pending* p = runtime->pending_list;
@@ -566,7 +566,7 @@ time_passes(struct replay_runtime* runtime, struct replay_moment* mom)
 	timeval_add(&runtime->now_tv, &tv);
 	runtime->now_secs = (time_t)runtime->now_tv.tv_sec;
 #ifndef S_SPLINT_S
-	log_info("elapsed %d.%6.6d  now %d.%6.6d", 
+	log_info("elapsed %d.%6.6d  now %d.%6.6d",
 		(int)tv.tv_sec, (int)tv.tv_usec,
 		(int)runtime->now_tv.tv_sec, (int)runtime->now_tv.tv_usec);
 #endif
@@ -603,7 +603,7 @@ autotrust_check(struct replay_runtime* runtime, struct replay_moment* mom)
 		}
 		strip_end_white(line);
 		expanded = macro_process(runtime->vars, runtime, p->str);
-		if(!expanded) 
+		if(!expanded)
 			fatal_exit("could not expand macro line %d", lineno);
 		if(verbosity >= 7 && strcmp(p->str, expanded) != 0)
 			log_info("expanded '%s' to '%s'", p->str, expanded);
@@ -656,7 +656,7 @@ tempfile_check(struct replay_runtime* runtime, struct replay_moment* mom)
 		}
 		strip_end_white(line);
 		expanded = macro_process(runtime->vars, runtime, p->str);
-		if(!expanded) 
+		if(!expanded)
 			fatal_exit("could not expand macro line %d", lineno);
 		if(verbosity >= 7 && strcmp(p->str, expanded) != 0)
 			log_info("expanded '%s' to '%s'", p->str, expanded);
@@ -746,7 +746,7 @@ do_moment_and_advance(struct replay_runtime* runtime)
 		advance_moment(runtime);
 		return;
 	}
-	log_info("testbound: do STEP %d %s", runtime->now->time_step, 
+	log_info("testbound: do STEP %d %s", runtime->now->time_step,
 		repevt_string(runtime->now->evt_type));
 	switch(runtime->now->evt_type) {
 	case repevt_nothing:
@@ -761,7 +761,7 @@ do_moment_and_advance(struct replay_runtime* runtime)
 		fake_front_query(runtime, mom);
 		break;
 	case repevt_front_reply:
-		if(runtime->answer_list) 
+		if(runtime->answer_list)
 			log_err("testbound: There are unmatched answers.");
 		fatal_exit("testbound: query answer not matched");
 		break;
@@ -810,7 +810,7 @@ do_moment_and_advance(struct replay_runtime* runtime)
 		advance_moment(runtime);
 		break;
 	default:
-		fatal_exit("testbound: unknown event type %d", 
+		fatal_exit("testbound: unknown event type %d",
 			runtime->now->evt_type);
 	}
 }
@@ -831,15 +831,15 @@ run_scenario(struct replay_runtime* runtime)
 		/* else if precoded_range matches pending, do it */
 		/* else do the current moment */
 		if(pending_matches_current(runtime, &entry, &pending)) {
-			log_info("testbound: do STEP %d CHECK_OUT_QUERY", 
+			log_info("testbound: do STEP %d CHECK_OUT_QUERY",
 				runtime->now->time_step);
 			advance_moment(runtime);
 			if(entry->copy_id)
-				answer_callback_from_entry(runtime, entry, 
+				answer_callback_from_entry(runtime, entry,
 				pending);
-		} else if(runtime->answer_list && runtime->now && 
+		} else if(runtime->answer_list && runtime->now &&
 			runtime->now->evt_type == repevt_front_reply) {
-			answer_check_it(runtime);			
+			answer_check_it(runtime);
 			advance_moment(runtime);
 		} else if(pending_matches_range(runtime, &entry, &pending)) {
 			answer_callback_from_entry(runtime, entry, pending);
@@ -870,7 +870,7 @@ run_scenario(struct replay_runtime* runtime)
 
 /*********** Dummy routines ***********/
 
-struct listen_dnsport* 
+struct listen_dnsport*
 listen_create(struct comm_base* base, struct listen_port* ATTR_UNUSED(ports),
 	size_t bufsize, int ATTR_UNUSED(tcp_accept_count),
 	int ATTR_UNUSED(tcp_idle_timeout),
@@ -898,7 +898,7 @@ listen_create(struct comm_base* base, struct listen_port* ATTR_UNUSED(ports),
 	return l;
 }
 
-void 
+void
 listen_delete(struct listen_dnsport* listen)
 {
 	if(!listen)
@@ -907,7 +907,7 @@ listen_delete(struct listen_dnsport* listen)
 	free(listen);
 }
 
-struct comm_base* 
+struct comm_base*
 comm_base_create(int ATTR_UNUSED(sigs))
 {
 	/* we return the runtime structure instead. */
@@ -921,7 +921,7 @@ comm_base_create(int ATTR_UNUSED(sigs))
 	return (struct comm_base*)runtime;
 }
 
-void 
+void
 comm_base_delete(struct comm_base* b)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)b;
@@ -961,7 +961,7 @@ comm_base_timept(struct comm_base* b, time_t** tt, struct timeval** tv)
 	*tv = &runtime->now_tv;
 }
 
-void 
+void
 comm_base_dispatch(struct comm_base* b)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)b;
@@ -971,7 +971,7 @@ comm_base_dispatch(struct comm_base* b)
 	else	exit(0); /* OK exit when LIBEVENT_SIGNAL_PROBLEM exists */
 }
 
-void 
+void
 comm_base_exit(struct comm_base* b)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)b;
@@ -981,7 +981,7 @@ comm_base_exit(struct comm_base* b)
 	}
 }
 
-struct comm_signal* 
+struct comm_signal*
 comm_signal_create(struct comm_base* base,
         void (*callback)(int, void*), void* cb_arg)
 {
@@ -991,20 +991,20 @@ comm_signal_create(struct comm_base* base,
 	return calloc(1, sizeof(struct comm_signal));
 }
 
-int 
-comm_signal_bind(struct comm_signal* ATTR_UNUSED(comsig), int 
+int
+comm_signal_bind(struct comm_signal* ATTR_UNUSED(comsig), int
 	ATTR_UNUSED(sig))
 {
 	return 1;
 }
 
-void 
+void
 comm_signal_delete(struct comm_signal* comsig)
 {
 	free(comsig);
 }
 
-void 
+void
 comm_point_send_reply(struct comm_reply* repinfo)
 {
 	struct replay_answer* ans = (struct replay_answer*)calloc(1,
@@ -1028,7 +1028,7 @@ comm_point_send_reply(struct comm_reply* repinfo)
 	log_pkt("reply pkt: ", ans->pkt, ans->pkt_len);
 }
 
-void 
+void
 comm_point_drop_reply(struct comm_reply* repinfo)
 {
 	log_info("comm_point_drop_reply fake");
@@ -1038,14 +1038,14 @@ comm_point_drop_reply(struct comm_reply* repinfo)
 	}
 }
 
-struct outside_network* 
-outside_network_create(struct comm_base* base, size_t bufsize, 
-	size_t ATTR_UNUSED(num_ports), char** ATTR_UNUSED(ifs), 
-	int ATTR_UNUSED(num_ifs), int ATTR_UNUSED(do_ip4), 
-	int ATTR_UNUSED(do_ip6), size_t ATTR_UNUSED(num_tcp), 
+struct outside_network*
+outside_network_create(struct comm_base* base, size_t bufsize,
+	size_t ATTR_UNUSED(num_ports), char** ATTR_UNUSED(ifs),
+	int ATTR_UNUSED(num_ifs), int ATTR_UNUSED(do_ip4),
+	int ATTR_UNUSED(do_ip6), size_t ATTR_UNUSED(num_tcp),
 	int ATTR_UNUSED(dscp),
 	struct infra_cache* infra,
-	struct ub_randstate* ATTR_UNUSED(rnd), 
+	struct ub_randstate* ATTR_UNUSED(rnd),
 	int ATTR_UNUSED(use_caps_for_id), int* ATTR_UNUSED(availports),
 	int ATTR_UNUSED(numavailports), size_t ATTR_UNUSED(unwanted_threshold),
 	int ATTR_UNUSED(outgoing_tcp_mss),
@@ -1057,7 +1057,7 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	int ATTR_UNUSED(tcp_auth_query_timeout))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)base;
-	struct outside_network* outnet =  calloc(1, 
+	struct outside_network* outnet =  calloc(1,
 		sizeof(struct outside_network));
 	(void)unwanted_action;
 	if(!outnet)
@@ -1072,7 +1072,7 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	return outnet;
 }
 
-void 
+void
 outside_network_delete(struct outside_network* outnet)
 {
 	if(!outnet)
@@ -1081,12 +1081,12 @@ outside_network_delete(struct outside_network* outnet)
 	free(outnet);
 }
 
-void 
+void
 outside_network_quit_prepare(struct outside_network* ATTR_UNUSED(outnet))
 {
 }
 
-struct pending* 
+struct pending*
 pending_udp_query(struct serviced_query* sq, sldns_buffer* packet,
 	int timeout, comm_point_callback_type* callback, void* callback_arg)
 {
@@ -1128,7 +1128,7 @@ pending_udp_query(struct serviced_query* sq, sldns_buffer* packet,
 			repevt_string(runtime->now->evt_type));
 		advance_moment(runtime);
 		/* still create the pending, because we need it to callback */
-	} 
+	}
 	log_info("testbound: created fake pending");
 	/* add to list */
 	pend->next = runtime->pending_list;
@@ -1178,7 +1178,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 			repevt_string(runtime->now->evt_type));
 		advance_moment(runtime);
 		/* still create the pending, because we need it to callback */
-	} 
+	}
 	log_info("testbound: created fake pending");
 	/* add to list */
 	pend->next = runtime->pending_list;
@@ -1202,10 +1202,10 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 		sizeof(struct fake_pending));
 	char z[256];
 	log_assert(pend);
-	log_nametypeclass(VERB_OPS, "pending serviced query", 
+	log_nametypeclass(VERB_OPS, "pending serviced query",
 		qinfo->qname, qinfo->qtype, qinfo->qclass);
 	dname_str(zone, z);
-	verbose(VERB_OPS, "pending serviced query zone %s flags%s%s%s%s", 
+	verbose(VERB_OPS, "pending serviced query zone %s flags%s%s%s%s",
 		z, (flags&BIT_RD)?" RD":"", (flags&BIT_CD)?" CD":"",
 		(flags&~(BIT_RD|BIT_CD))?" MORE":"", (dnssec)?" DO":"");
 
@@ -1301,7 +1301,7 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 			repevt_string(runtime->now->evt_type));
 		advance_moment(runtime);
 		/* still create the pending, because we need it to callback */
-	} 
+	}
 	log_info("testbound: created fake pending");
 	/* add to list */
 	pend->next = runtime->pending_list;
@@ -1356,7 +1356,7 @@ void listening_ports_free(struct listen_port* list)
 
 struct comm_point* comm_point_create_local(struct comm_base* ATTR_UNUSED(base),
         int ATTR_UNUSED(fd), size_t ATTR_UNUSED(bufsize),
-        comm_point_callback_type* ATTR_UNUSED(callback), 
+        comm_point_callback_type* ATTR_UNUSED(callback),
 	void* ATTR_UNUSED(callback_arg))
 {
 	struct fake_commpoint* fc = (struct fake_commpoint*)calloc(1,
@@ -1368,7 +1368,7 @@ struct comm_point* comm_point_create_local(struct comm_base* ATTR_UNUSED(base),
 
 struct comm_point* comm_point_create_raw(struct comm_base* ATTR_UNUSED(base),
         int ATTR_UNUSED(fd), int ATTR_UNUSED(writing),
-        comm_point_callback_type* ATTR_UNUSED(callback), 
+        comm_point_callback_type* ATTR_UNUSED(callback),
 	void* ATTR_UNUSED(callback_arg))
 {
 	/* no pipe comm possible */
@@ -1379,7 +1379,7 @@ struct comm_point* comm_point_create_raw(struct comm_base* ATTR_UNUSED(base),
 	return (struct comm_point*)fc;
 }
 
-void comm_point_start_listening(struct comm_point* ATTR_UNUSED(c), 
+void comm_point_start_listening(struct comm_point* ATTR_UNUSED(c),
 	int ATTR_UNUSED(newfd), int ATTR_UNUSED(sec))
 {
 	/* no bg write pipe comm possible */
@@ -1424,7 +1424,7 @@ size_t serviced_get_mem(struct serviced_query* ATTR_UNUSED(c))
 }
 
 /* fake for fptr wlist */
-int outnet_udp_cb(struct comm_point* ATTR_UNUSED(c), 
+int outnet_udp_cb(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply *ATTR_UNUSED(reply_info))
 {
@@ -1432,7 +1432,7 @@ int outnet_udp_cb(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int outnet_tcp_cb(struct comm_point* ATTR_UNUSED(c), 
+int outnet_tcp_cb(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply *ATTR_UNUSED(reply_info))
 {
@@ -1460,67 +1460,67 @@ void outnet_tcptimer(void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
-void comm_point_udp_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(event), 
+void comm_point_udp_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(event),
 	void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_point_udp_ancil_callback(int ATTR_UNUSED(fd), 
+void comm_point_udp_ancil_callback(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_point_tcp_accept_callback(int ATTR_UNUSED(fd), 
+void comm_point_tcp_accept_callback(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_point_tcp_handle_callback(int ATTR_UNUSED(fd), 
+void comm_point_tcp_handle_callback(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_timer_callback(int ATTR_UNUSED(fd), 
+void comm_timer_callback(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_signal_callback(int ATTR_UNUSED(fd), 
+void comm_signal_callback(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_point_http_handle_callback(int ATTR_UNUSED(fd), 
+void comm_point_http_handle_callback(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_point_local_handle_callback(int ATTR_UNUSED(fd), 
+void comm_point_local_handle_callback(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_point_raw_handle_callback(int ATTR_UNUSED(fd), 
+void comm_point_raw_handle_callback(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-void comm_base_handle_slow_accept(int ATTR_UNUSED(fd), 
+void comm_base_handle_slow_accept(int ATTR_UNUSED(fd),
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
 }
 
-int serviced_udp_callback(struct comm_point* ATTR_UNUSED(c), 
+int serviced_udp_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
 {
@@ -1528,7 +1528,7 @@ int serviced_udp_callback(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int serviced_tcp_callback(struct comm_point* ATTR_UNUSED(c), 
+int serviced_tcp_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
 {
@@ -1561,7 +1561,7 @@ int reuse_id_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 }
 
 /* timers in testbound for autotrust. statistics tested in tdir. */
-struct comm_timer* comm_timer_create(struct comm_base* base, 
+struct comm_timer* comm_timer_create(struct comm_base* base,
 	void (*cb)(void*), void* cb_arg)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)base;
@@ -1589,7 +1589,7 @@ void comm_timer_set(struct comm_timer* timer, struct timeval* tv)
 	struct fake_timer* t = (struct fake_timer*)timer;
 	t->enabled = 1;
 	t->tv = *tv;
-	log_info("fake timer set %d.%6.6d", 
+	log_info("fake timer set %d.%6.6d",
 		(int)t->tv.tv_sec, (int)t->tv.tv_usec);
 	timeval_add(&t->tv, &t->runtime->now_tv);
 }
diff --git a/usr.sbin/unbound/testcode/fake_event.h b/usr.sbin/unbound/testcode/fake_event.h
index 97ebb41cb..ec4d5a9e0 100644
--- a/usr.sbin/unbound/testcode/fake_event.h
+++ b/usr.sbin/unbound/testcode/fake_event.h
@@ -2,24 +2,24 @@
  * testcode/fake_event.h - fake event handling that replays existing scenario.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/testcode/lock_verify.c b/usr.sbin/unbound/testcode/lock_verify.c
index b0cffe292..c9a0657e6 100644
--- a/usr.sbin/unbound/testcode/lock_verify.c
+++ b/usr.sbin/unbound/testcode/lock_verify.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -40,7 +40,7 @@
  * Checks if locks are consistently locked in the same order.
  * If not, this can lead to deadlock if threads execute the different
  * ordering at the same time.
- * 
+ *
  */
 
 #include "config.h"
@@ -55,8 +55,8 @@
 /* --- data structures --- */
 struct lock_ref;
 
-/** keep track of lock id in lock-verify application 
- * Also defined in smallapp/worker_cb.c for fptr_wlist encapsulation 
+/** keep track of lock id in lock-verify application
+ * Also defined in smallapp/worker_cb.c for fptr_wlist encapsulation
  * breakage (the security tests break encapsulation for this test app) */
 struct order_id {
         /** the thread id that created it */
@@ -77,11 +77,11 @@ struct order_lock {
 	int create_line;
 	/** set of all locks that are smaller than this one (locked earlier) */
 	rbtree_type* smaller;
-	/** during depthfirstsearch, this is a linked list of the stack 
+	/** during depthfirstsearch, this is a linked list of the stack
 	 * of locks. points to the next lock bigger than this one. */
 	struct lock_ref* dfs_next;
 	/** if lock has been visited (all smaller locks have been compared to
-	 * this lock), only need to compare this with all unvisited(bigger) 
+	 * this lock), only need to compare this with all unvisited(bigger)
 	 * locks */
 	int visited;
 };
@@ -110,10 +110,10 @@ usage(void)
 	printf("lock_verify <trace files>\n");
 }
 
-/** read header entry. 
+/** read header entry.
  * @param in: file to read header of.
  * @return: False if it does not belong to the rest. */
-static int 
+static int
 read_header(FILE* in)
 {
 	time_t t;
@@ -124,7 +124,7 @@ read_header(FILE* in)
 	static pid_t the_pid;
 	static int threads[256];
 
-	if(fread(&t, sizeof(t), 1, in) != 1 ||	
+	if(fread(&t, sizeof(t), 1, in) != 1 ||
 		fread(&thrno, sizeof(thrno), 1, in) != 1 ||
 		fread(&p, sizeof(p), 1, in) != 1) {
 		fatal_exit("fread failed");
@@ -139,7 +139,7 @@ read_header(FILE* in)
 		}
 		threads[thrno] = 1;
 		have_values = 1;
-		printf(" trace %d from pid %u on %s", thrno, 
+		printf(" trace %d from pid %u on %s", thrno,
 			(unsigned)p, ctime(&t));
 	} else {
 		if(the_pid != p) {
@@ -185,8 +185,8 @@ static void read_create(rbtree_type* all, FILE* in)
 {
 	struct order_lock* o = calloc(1, sizeof(struct order_lock));
 	if(!o) fatal_exit("malloc failure");
-	if(fread(&o->id.thr, sizeof(int), 1, in) != 1 ||	
-	   fread(&o->id.instance, sizeof(int), 1, in) != 1 ||	
+	if(fread(&o->id.thr, sizeof(int), 1, in) != 1 ||
+	   fread(&o->id.instance, sizeof(int), 1, in) != 1 ||
 	   !readup_str(&o->create_file, in) ||
 	   fread(&o->create_line, sizeof(int), 1, in) != 1)
 		fatal_exit("fread failed");
@@ -194,7 +194,7 @@ static void read_create(rbtree_type* all, FILE* in)
 	o->node.key = &o->id;
 	if(!rbtree_insert(all, &o->node)) {
 		/* already inserted */
-		struct order_lock* a = (struct order_lock*)rbtree_search(all, 
+		struct order_lock* a = (struct order_lock*)rbtree_search(all,
 			&o->id);
 		log_assert(a);
 		a->create_file = o->create_file;
@@ -203,13 +203,13 @@ static void read_create(rbtree_type* all, FILE* in)
 		free(o);
 		o = a;
 	}
-	if(verb) printf("read create %u %u %s %d\n", 
+	if(verb) printf("read create %u %u %s %d\n",
 		(unsigned)o->id.thr, (unsigned)o->id.instance,
 		o->create_file, o->create_line);
 }
 
 /** insert lock entry (empty) into list */
-static struct order_lock* 
+static struct order_lock*
 insert_lock(rbtree_type* all, struct order_id* id)
 {
 	struct order_lock* o = calloc(1, sizeof(struct order_lock));
@@ -231,13 +231,13 @@ static void read_lock(rbtree_type* all, FILE* in, int val)
 	ref = (struct lock_ref*)calloc(1, sizeof(struct lock_ref));
 	if(!ref) fatal_exit("malloc failure");
 	prev_id.thr = val;
-	if(fread(&prev_id.instance, sizeof(int), 1, in) != 1 ||	
-	   fread(&now_id.thr, sizeof(int), 1, in) != 1 ||	
-	   fread(&now_id.instance, sizeof(int), 1, in) != 1 ||	
+	if(fread(&prev_id.instance, sizeof(int), 1, in) != 1 ||
+	   fread(&now_id.thr, sizeof(int), 1, in) != 1 ||
+	   fread(&now_id.instance, sizeof(int), 1, in) != 1 ||
 	   !readup_str(&ref->file, in) ||
 	   fread(&ref->line, sizeof(int), 1, in) != 1)
 		fatal_exit("fread failed");
-	if(verb) printf("read lock %u %u %u %u %s %d\n", 
+	if(verb) printf("read lock %u %u %u %u %s %d\n",
 		(unsigned)prev_id.thr, (unsigned)prev_id.instance,
 		(unsigned)now_id.thr, (unsigned)now_id.instance,
 		ref->file, ref->line);
@@ -284,19 +284,19 @@ static void found_cycle(struct lock_ref* visit, int level)
 	int i = 0;
 	errors_detected++;
 	printf("Found inconsistent locking order of length %d\n", level);
-	printf("for lock %d %d created %s %d\n", 
+	printf("for lock %d %d created %s %d\n",
 		visit->lock->id.thr, visit->lock->id.instance,
 		visit->lock->create_file, visit->lock->create_line);
 	printf("sequence is:\n");
 	p = visit;
 	while(p) {
-		struct order_lock* next = 
+		struct order_lock* next =
 			p->lock->dfs_next?p->lock->dfs_next->lock:visit->lock;
 		printf("[%d] is locked at line %s %d before lock %d %d\n",
 			i, p->file, p->line, next->id.thr, next->id.instance);
 		printf("[%d] lock %d %d is created at %s %d\n",
 			i, next->id.thr, next->id.instance,
-			next->create_file, next->create_line); 
+			next->create_file, next->create_line);
 		i++;
 		p = p->lock->dfs_next;
 		if(p && p->lock == visit->lock)
@@ -323,7 +323,7 @@ static int detect_cycle(struct lock_ref* visit, struct lock_ref* from)
  * @param level: depth of recursion. 0 is start.
  * @param from: search for matches from unvisited node upwards.
  */
-static void search_cycle(struct lock_ref* visit, int level, 
+static void search_cycle(struct lock_ref* visit, int level,
 	struct lock_ref* from)
 {
 	struct lock_ref* ref;
@@ -336,7 +336,7 @@ static void search_cycle(struct lock_ref* visit, int level,
 	if(!visit->lock->visited)
 		from = visit;
 	if(verb > 1) fprintf(stderr, "[%d] visit lock %u %u %s %d\n", level,
-			(unsigned)visit->lock->id.thr, 
+			(unsigned)visit->lock->id.thr,
 			(unsigned)visit->lock->id.instance,
 			visit->lock->create_file, visit->lock->create_line);
 	RBTREE_FOR(ref, struct lock_ref*, visit->lock->smaller) {
@@ -376,10 +376,10 @@ static void check_order(rbtree_type* all_locks)
 		if(verb)
 		    printf("[%d/%d] Checking lock %d %d %s %d\n",
 			i, (int)all_locks->count,
-			lock->id.thr, lock->id.instance, 
+			lock->id.thr, lock->id.instance,
 			lock->create_file, lock->create_line);
-		else if (i % ((all_locks->count/75)<1?1:all_locks->count/75) 
-			== 0) 
+		else if (i % ((all_locks->count/75)<1?1:all_locks->count/75)
+			== 0)
 		    fprintf(stderr, ".");
 		i++;
 		check_order_lock(lock);
@@ -450,7 +450,7 @@ main(int argc, char* argv[])
 	check_order(all_locks);
 
 	/* do not free a thing, OS will do it */
-	printf("checked %d locks in %d seconds with %d errors.\n", 
+	printf("checked %d locks in %d seconds with %d errors.\n",
 		(int)all_locks->count, (int)(time(NULL)-starttime),
 		errors_detected);
 	locks_free(all_locks);
diff --git a/usr.sbin/unbound/testcode/memstats.c b/usr.sbin/unbound/testcode/memstats.c
index a253b00ac..982c36a5a 100644
--- a/usr.sbin/unbound/testcode/memstats.c
+++ b/usr.sbin/unbound/testcode/memstats.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -228,13 +228,13 @@ printstats(rbtree_type* tree)
 	struct codeline* cl;
 	uint64_t total = 0, tcalls = 0;
 	RBTREE_FOR(cl, struct codeline*, tree) {
-		printf("%12lld / %8lld in %s %s\n", (long long)cl->alloc, 
+		printf("%12lld / %8lld in %s %s\n", (long long)cl->alloc,
 			(long long)cl->calls, cl->codeline, cl->func);
 		total += cl->alloc;
 		tcalls += cl->calls;
 	}
 	printf("------------\n");
-	printf("%12lld / %8lld total in %ld code lines\n", (long long)total, 
+	printf("%12lld / %8lld total in %ld code lines\n", (long long)total,
 		(long long)tcalls, (long)tree->count);
 	printf("\n");
 }
diff --git a/usr.sbin/unbound/testcode/perf.c b/usr.sbin/unbound/testcode/perf.c
index 7fb524e22..18d056823 100644
--- a/usr.sbin/unbound/testcode/perf.c
+++ b/usr.sbin/unbound/testcode/perf.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -56,7 +56,7 @@
 #include <sys/time.h>
 
 /** usage information for perf */
-static void usage(char* nm) 
+static void usage(char* nm)
 {
 	printf("usage: %s [options] server\n", nm);
 	printf("server: ip address of server, IP4 or IP6.\n");
@@ -74,7 +74,7 @@ struct perfinfo;
 struct perfio;
 
 /** Global info for perf */
-struct perfinfo { 
+struct perfinfo {
 	/** need to exit */
 	volatile int exit;
 	/** all purpose buffer (for UDP send and receive) */
@@ -105,7 +105,7 @@ struct perfinfo {
 	size_t total_sent;
 	/** numbers by rcode */
 	size_t by_rcode[32];
-	
+
 	/** number of I/O ports */
 	size_t io_num;
 	/** I/O ports array */
@@ -158,7 +158,7 @@ static RETSIGTYPE perf_sigh(int sig)
 
 /** timeval compare, t1 < t2 */
 static int
-perf_tv_smaller(struct timeval* t1, struct timeval* t2) 
+perf_tv_smaller(struct timeval* t1, struct timeval* t2)
 {
 #ifndef S_SPLINT_S
 	if(t1->tv_sec < t2->tv_sec)
@@ -172,7 +172,7 @@ perf_tv_smaller(struct timeval* t1, struct timeval* t2)
 
 /** timeval add, t1 += t2 */
 static void
-perf_tv_add(struct timeval* t1, struct timeval* t2) 
+perf_tv_add(struct timeval* t1, struct timeval* t2)
 {
 #ifndef S_SPLINT_S
 	t1->tv_sec += t2->tv_sec;
@@ -186,7 +186,7 @@ perf_tv_add(struct timeval* t1, struct timeval* t2)
 
 /** timeval subtract, t1 -= t2 */
 static void
-perf_tv_subtract(struct timeval* t1, struct timeval* t2) 
+perf_tv_subtract(struct timeval* t1, struct timeval* t2)
 {
 #ifndef S_SPLINT_S
 	t1->tv_sec -= t2->tv_sec;
@@ -208,7 +208,7 @@ perfsetup(struct perfinfo* info)
 	if(gettimeofday(&info->start, NULL) < 0)
 		fatal_exit("gettimeofday: %s", strerror(errno));
 	sig_info = info;
-	if( signal(SIGINT, perf_sigh) == SIG_ERR || 
+	if( signal(SIGINT, perf_sigh) == SIG_ERR ||
 #ifdef SIGQUIT
 		signal(SIGQUIT, perf_sigh) == SIG_ERR ||
 #endif
@@ -318,7 +318,7 @@ perftimeout(struct perfinfo* info, size_t n, struct timeval* now)
 
 /** print nice stats about qps */
 static void
-stat_printout(struct perfinfo* info, struct timeval* now, 
+stat_printout(struct perfinfo* info, struct timeval* now,
 	struct timeval* elapsed)
 {
 	/* calculate qps */
@@ -375,7 +375,7 @@ perfselect(struct perfinfo* info)
 		}
 	}
 	perf_tv_subtract(&timeout, &now);
-	
+
 	num = select(info->maxfd+1, &rset, NULL, NULL, &timeout);
 	if(num == -1) {
 		if(errno == EAGAIN || errno == EINTR)
@@ -398,25 +398,25 @@ perfendstats(struct perfinfo* info)
 {
 	double dt, qps;
 	struct timeval timeout, now;
-	int i, lost; 
+	int i, lost;
 	if(gettimeofday(&now, NULL) < 0)
 		fatal_exit("gettimeofday: %s", strerror(errno));
 	timeout = now;
 	perf_tv_subtract(&timeout, &info->since);
 	stat_printout(info, &now, &timeout);
-	
+
 	timeout = now;
 	perf_tv_subtract(&timeout, &info->start);
 	dt = (double)(timeout.tv_sec*1000000 + timeout.tv_usec) / 1000000.0;
 	qps = (double)(info->total_recv) / dt;
 	lost = (int)(info->total_sent - info->total_recv) - (int)info->io_num;
 	if(!info->quiet) {
-		printf("overall time: 	%g sec\n", 
-			(double)timeout.tv_sec + 
+		printf("overall time: 	%g sec\n",
+			(double)timeout.tv_sec +
 			(double)timeout.tv_usec/1000000.);
-		if(lost > 0) 
+		if(lost > 0)
 			printf("Packets lost: 	%d\n", (int)lost);
-	
+
 		for(i=0; i<(int)(sizeof(info->by_rcode)/sizeof(size_t)); i++)
 		{
 			if(info->by_rcode[i] > 0) {
@@ -447,7 +447,7 @@ static int
 qlist_parse_line(sldns_buffer* buf, char* p)
 {
 	char nm[1024], cl[1024], tp[1024], fl[1024];
-	int r; 
+	int r;
 	int rec = 1, edns = 0;
 	struct query_info qinfo;
 	nm[0] = 0; cl[0] = 0; tp[0] = 0; fl[0] = 0;
@@ -517,7 +517,7 @@ qlist_add_line(struct perfinfo* info, char* line, int no)
 		printf("error parsing query %d: %s\n", no, line);
 		exit(1);
 	}
-	sldns_buffer_write_u16_at(info->buf, 0, (uint16_t)info->qlist_size); 
+	sldns_buffer_write_u16_at(info->buf, 0, (uint16_t)info->qlist_size);
 	if(info->qlist_size + 1 > info->qlist_capacity) {
 		qlist_grow_capacity(info);
 	}
@@ -561,7 +561,7 @@ extern int optind;
 extern char* optarg;
 
 /** main program for perf */
-int main(int argc, char* argv[]) 
+int main(int argc, char* argv[])
 {
 	char* nm = argv[0];
 	int c;
@@ -626,7 +626,7 @@ int main(int argc, char* argv[])
 		printf("No queries to make, use -f or -a.\n");
 		exit(1);
 	}
-	
+
 	/* do the performance test */
 	perfmain(&info);
 
diff --git a/usr.sbin/unbound/testcode/petal.c b/usr.sbin/unbound/testcode/petal.c
index 63d3d452e..e9202193a 100644
--- a/usr.sbin/unbound/testcode/petal.c
+++ b/usr.sbin/unbound/testcode/petal.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2010, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -139,7 +139,7 @@ fd_close(int fd)
 #endif
 }
 
-/** 
+/**
  * Read one line from SSL
  * zero terminates.
  * skips "\r\n" (but not copied to buf).
@@ -377,7 +377,7 @@ provide_file_10(SSL* ssl, char* fname)
 {
 	char* buf, *at;
 	size_t len, avail, header_reserve=1024;
-	FILE* in = fopen(fname, 
+	FILE* in = fopen(fname,
 #ifndef USE_WINSOCK
 		"r"
 #else
@@ -451,7 +451,7 @@ provide_file_chunked(SSL* ssl, char* fname)
 	char* at = buf;
 	size_t avail = sizeof(buf);
 	size_t r;
-	FILE* in = fopen(fname, 
+	FILE* in = fopen(fname,
 #ifndef USE_WINSOCK
 		"r"
 #else
diff --git a/usr.sbin/unbound/testcode/pktview.c b/usr.sbin/unbound/testcode/pktview.c
index 12e0d8edb..e36b688af 100644
--- a/usr.sbin/unbound/testcode/pktview.c
+++ b/usr.sbin/unbound/testcode/pktview.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -79,13 +79,13 @@ static void analyze_dname(sldns_buffer* pkt)
 	len = pkt_dname_len(pkt);
 	printf(" len=%d", (int)len);
 	if(sldns_buffer_position(pkt)-oldpos != len)
-		printf(" comprlen=%d\n", 
+		printf(" comprlen=%d\n",
 			(int)(sldns_buffer_position(pkt)-oldpos));
 	else	printf("\n");
 }
 
 /** analyze rdata in packet */
-static void analyze_rdata(sldns_buffer*pkt, const sldns_rr_descriptor* desc, 
+static void analyze_rdata(sldns_buffer*pkt, const sldns_rr_descriptor* desc,
 	uint16_t rdlen)
 {
 	int rdf = 0;
@@ -132,10 +132,10 @@ static void analyze_rr(sldns_buffer* pkt, int q)
 	analyze_dname(pkt);
 	type = sldns_buffer_read_u16(pkt);
 	dclass = sldns_buffer_read_u16(pkt);
-	printf("type %s(%d)", sldns_rr_descript(type)?  
+	printf("type %s(%d)", sldns_rr_descript(type)?
 		sldns_rr_descript(type)->_name: "??" , (int)type);
-	printf(" class %s(%d) ", sldns_lookup_by_id(sldns_rr_classes, 
-		(int)dclass)?sldns_lookup_by_id(sldns_rr_classes, 
+	printf(" class %s(%d) ", sldns_lookup_by_id(sldns_rr_classes,
+		(int)dclass)?sldns_lookup_by_id(sldns_rr_classes,
 		(int)dclass)->name:"??", (int)dclass);
 	if(q) {
 		printf("\n");
@@ -170,14 +170,14 @@ static void analyze(sldns_buffer* pkt)
 	printf("nscount: %d\n", (int)ns);
 	ar = sldns_buffer_read_u16(pkt);
 	printf("arcount: %d\n", (int)ar);
-	
+
 	printf(";-- query section\n");
 	while(sldns_buffer_remaining(pkt) > 0) {
-		if(rrnum == (int)qd) 
+		if(rrnum == (int)qd)
 			printf(";-- answer section\n");
-		if(rrnum == (int)qd+(int)an) 
+		if(rrnum == (int)qd+(int)an)
 			printf(";-- authority section\n");
-		if(rrnum == (int)qd+(int)an+(int)ns) 
+		if(rrnum == (int)qd+(int)an+(int)ns)
 			printf(";-- additional section\n");
 		printf("rr %d ", rrnum);
 		analyze_rr(pkt, rrnum < (int)qd);
@@ -186,7 +186,7 @@ static void analyze(sldns_buffer* pkt)
 }
 
 /** main program for pktview */
-int main(int argc, char* argv[]) 
+int main(int argc, char* argv[])
 {
 	sldns_buffer* pkt = sldns_buffer_new(65553);
 	if(argc != 1) {
diff --git a/usr.sbin/unbound/testcode/readhex.h b/usr.sbin/unbound/testcode/readhex.h
index be6424539..9ddf4fc13 100644
--- a/usr.sbin/unbound/testcode/readhex.h
+++ b/usr.sbin/unbound/testcode/readhex.h
@@ -42,7 +42,7 @@
 #define TESTCODE_READHEX_H
 struct sldns_buffer;
 
-/** 
+/**
  * Helper to convert hex string to packet buffer.
  * @param pkt: buffer to put result in.
  * @param hex: string of hex data. Spaces and ';...' comments are skipped.
diff --git a/usr.sbin/unbound/testcode/replay.c b/usr.sbin/unbound/testcode/replay.c
index 43101d6ac..3caf98233 100644
--- a/usr.sbin/unbound/testcode/replay.c
+++ b/usr.sbin/unbound/testcode/replay.c
@@ -2,24 +2,24 @@
  * testcode/replay.c - store and use a replay of events for the DNS resolver.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -59,11 +59,11 @@
  * Expand a macro
  * @param store: value storage
  * @param runtime: replay runtime for other stuff.
- * @param text: the macro text, after the ${, Updated to after the } when 
+ * @param text: the macro text, after the ${, Updated to after the } when
  * 	done (successfully).
  * @return expanded text, malloced. NULL on failure.
  */
-static char* macro_expand(rbtree_type* store, 
+static char* macro_expand(rbtree_type* store,
 	struct replay_runtime* runtime, char** text);
 
 /** compare of time values */
@@ -82,12 +82,12 @@ timeval_smaller(const struct timeval* x, const struct timeval* y)
 #endif
 }
 
-/** parse keyword in string. 
+/** parse keyword in string.
  * @param line: if found, the line is advanced to after the keyword.
  * @param keyword: string.
- * @return: true if found, false if not. 
+ * @return: true if found, false if not.
  */
-static int 
+static int
 parse_keyword(char** line, const char* keyword)
 {
 	size_t len = (size_t)strlen(keyword);
@@ -135,8 +135,8 @@ strip_end_white(char* p)
 	}
 }
 
-/** 
- * Read a range from file. 
+/**
+ * Read a range from file.
  * @param remain: Rest of line (after RANGE keyword).
  * @param in: file to read from.
  * @param name: name to print in errors.
@@ -181,7 +181,7 @@ replay_range_read(char* remain, FILE* in, const char* name,
 			strip_end_white(parse);
 			if(!extstrtoaddr(parse, &rng->addr, &rng->addrlen,
 				UNBOUND_DNS_PORT)) {
-				log_err("Line %d: could not read ADDRESS: %s", 
+				log_err("Line %d: could not read ADDRESS: %s",
 					pstate->lineno, parse);
 				free(rng);
 				return NULL;
@@ -255,8 +255,8 @@ read_assign_step(char* remain, struct replay_moment* mom)
 		fatal_exit("out of memory");
 }
 
-/** 
- * Read a replay moment 'STEP' from file. 
+/**
+ * Read a replay moment 'STEP' from file.
  * @param remain: Rest of line (after STEP keyword).
  * @param in: file to read from.
  * @param name: name to print in errors.
@@ -376,18 +376,18 @@ replay_moment_read(char* remain, FILE* in, const char* name,
 		strip_end_white(remain);
 		if(!extstrtoaddr(remain, &mom->addr, &mom->addrlen,
 			UNBOUND_DNS_PORT)) {
-			log_err("line %d: could not parse ADDRESS: %s", 
+			log_err("line %d: could not parse ADDRESS: %s",
 				pstate->lineno, remain);
 			free(mom);
 			return NULL;
 		}
-	} 
+	}
 	if(parse_keyword(&remain, "ELAPSE")) {
 		double sec;
 		errno = 0;
 		sec = strtod(remain, &remain);
 		if(sec == 0. && errno != 0) {
-			log_err("line %d: could not parse ELAPSE: %s (%s)", 
+			log_err("line %d: could not parse ELAPSE: %s (%s)",
 				pstate->lineno, remain, strerror(errno));
 			free(mom);
 			return NULL;
@@ -397,7 +397,7 @@ replay_moment_read(char* remain, FILE* in, const char* name,
 		mom->elapse.tv_usec = (int)((sec - (double)mom->elapse.tv_sec)
 			*1000000. + 0.5);
 #endif
-	} 
+	}
 
 	if(readentry) {
 		mom->match = read_entry(in, name, pstate, 1);
@@ -433,7 +433,7 @@ make_scenario(char* line)
 	return scen;
 }
 
-struct replay_scenario* 
+struct replay_scenario*
 replay_scenario_read(FILE* in, const char* name, int* lineno)
 {
 	char line[MAX_LINE_LEN];
@@ -451,7 +451,7 @@ replay_scenario_read(FILE* in, const char* name, int* lineno)
 		(*lineno)++;
 		while(isspace((unsigned char)*parse))
 			parse++;
-		if(!*parse) 
+		if(!*parse)
 			continue; /* empty line */
 		if(parse_keyword(&parse, ";"))
 			continue; /* comment */
@@ -462,11 +462,11 @@ replay_scenario_read(FILE* in, const char* name, int* lineno)
 			if(!scen)
 				fatal_exit("%d: could not make scen", *lineno);
 			continue;
-		} 
+		}
 		if(!scen)
 			fatal_exit("%d: expected SCENARIO", *lineno);
 		if(parse_keyword(&parse, "RANGE_BEGIN")) {
-			struct replay_range* newr = replay_range_read(parse, 
+			struct replay_range* newr = replay_range_read(parse,
 				in, name, &pstate, line);
 			if(!newr)
 				fatal_exit("%d: bad range", pstate.lineno);
@@ -474,12 +474,12 @@ replay_scenario_read(FILE* in, const char* name, int* lineno)
 			newr->next_range = scen->range_list;
 			scen->range_list = newr;
 		} else if(parse_keyword(&parse, "STEP")) {
-			struct replay_moment* mom = replay_moment_read(parse, 
+			struct replay_moment* mom = replay_moment_read(parse,
 				in, name, &pstate);
 			if(!mom)
 				fatal_exit("%d: bad moment", pstate.lineno);
 			*lineno = pstate.lineno;
-			if(scen->mom_last && 
+			if(scen->mom_last &&
 				scen->mom_last->time_step >= mom->time_step)
 				fatal_exit("%d: time goes backwards", *lineno);
 			if(scen->mom_last)
@@ -502,7 +502,7 @@ replay_scenario_read(FILE* in, const char* name, int* lineno)
 	return NULL;
 }
 
-void 
+void
 replay_scenario_delete(struct replay_scenario* scen)
 {
 	struct replay_moment* mom, *momn;
@@ -630,7 +630,7 @@ do_macro_recursion(rbtree_type* store, struct replay_runtime* runtime,
 {
 	char* after = at+2;
 	char* expand = macro_expand(store, runtime, &after);
-	if(!expand) 
+	if(!expand)
 		return NULL; /* expansion failed */
 	if(!do_buf_insert(at, remain, after, expand)) {
 		free(expand);
@@ -665,7 +665,7 @@ do_macro_variable(rbtree_type* store, char* buf, size_t remain)
 	}
 	/* terminator, we are working in macro_expand() buffer */
 	sv = *at;
-	*at = 0; 
+	*at = 0;
 	v = macro_getvar(store, name);
 	*at = sv;
 
@@ -816,7 +816,7 @@ macro_expand(rbtree_type* store, struct replay_runtime* runtime, char** text)
 		time_t res = 0;
 		if(runtime) {
 			struct fake_timer* t = first_timer(runtime);
-			if(t && (time_t)t->tv.tv_sec >= runtime->now_secs) 
+			if(t && (time_t)t->tv.tv_sec >= runtime->now_secs)
 				res = (time_t)t->tv.tv_sec - runtime->now_secs;
 		}
 		snprintf(buf, sizeof(buf), ARG_LL "d", (long long)res);
@@ -855,9 +855,9 @@ macro_expand(rbtree_type* store, struct replay_runtime* runtime, char** text)
 	if(dofunc) {
 		/* post process functions, buf has the argument(s) */
 		if(strncmp(buf, "ctime", 5) == 0) {
-			return do_macro_ctime(buf+6);	
+			return do_macro_ctime(buf+6);
 		} else if(strncmp(buf, "range", 5) == 0) {
-			return do_macro_range(buf+6);	
+			return do_macro_range(buf+6);
 		}
 	}
 	return strdup(buf);
@@ -891,7 +891,7 @@ macro_process(rbtree_type* store, struct replay_runtime* runtime, char* text)
 	return strdup(buf);
 }
 
-char* 
+char*
 macro_lookup(rbtree_type* store, char* name)
 {
 	struct replay_var* x = macro_getvar(store, name);
@@ -907,7 +907,7 @@ void macro_print_debug(rbtree_type* store)
 	}
 }
 
-int 
+int
 macro_assign(rbtree_type* store, char* name, char* value)
 {
 	struct replay_var* x = macro_getvar(store, name);
diff --git a/usr.sbin/unbound/testcode/replay.h b/usr.sbin/unbound/testcode/replay.h
index 0271dff03..ef6f1ffc5 100644
--- a/usr.sbin/unbound/testcode/replay.h
+++ b/usr.sbin/unbound/testcode/replay.h
@@ -2,24 +2,24 @@
  * testcode/replay.h - store and use a replay of events for the DNS resolver.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -62,7 +62,7 @@
  * SCENARIO_BEGIN name_of_scenario
  * RANGE_BEGIN start_time end_time
  *    ; give ip of the virtual server, it matches any ip if not present.
- *    ADDRESS ip_address 
+ *    ADDRESS ip_address
  *    match_entries
  * RANGE_END
  * ; more RANGE items.
@@ -131,7 +131,7 @@
  * ; also, all answers must have been checked with CHECK_ANSWER.
  * ; and, no more pending out_queries (that have not been checked).
  * SCENARIO_END
- * 
+ *
  * </pre>
  */
 
@@ -161,11 +161,11 @@ struct replay_scenario {
 	/** The last element in list of replay moments. */
 	struct replay_moment* mom_last;
 
-	/** 
+	/**
 	 * List of matching answers. This is to ease replay scenario
 	 * creation. It lists queries (to the network) and what answer
 	 * should be returned. The matching answers are valid for a range
-	 * of time steps. 
+	 * of time steps.
 	 * So: timestep, parts of query, destination --> answer.
 	 */
 	struct replay_range* range_list;
@@ -178,9 +178,9 @@ struct replay_scenario {
  * And if output is presented, what is done with that.
  */
 struct replay_moment {
-	/** 
-	 * The replay time step number. Starts at 0, time is incremented 
-	 * every time the fake select() is run. 
+	/**
+	 * The replay time step number. Starts at 0, time is incremented
+	 * every time the fake select() is run.
 	 */
 	int time_step;
 	/** Next replay moment in list of replay moments. */
@@ -273,9 +273,9 @@ struct replay_runtime {
 	 */
 	struct replay_moment* now;
 
-	/** 
+	/**
 	 * List of pending queries in order they were sent out. First
-	 * one has been sent out most recently. Last one in list is oldest. 
+	 * one has been sent out most recently. Last one in list is oldest.
 	 */
 	struct fake_pending* pending_list;
 
@@ -283,7 +283,7 @@ struct replay_runtime {
 	 * List of answers to queries from clients. These need to be checked.
 	 */
 	struct replay_answer* answer_list;
-	
+
 	/** last element in answer list. */
 	struct replay_answer* answer_last;
 
@@ -410,7 +410,7 @@ struct replay_var {
  * @param lineno: incremented for every line read.
  * @return: Scenario. NULL if no scenario read.
  */
-struct replay_scenario* replay_scenario_read(FILE* in, const char* name, 
+struct replay_scenario* replay_scenario_read(FILE* in, const char* name,
 	int* lineno);
 
 /**
@@ -447,7 +447,7 @@ void macro_store_delete(rbtree_type* store);
  * @param text: string to work on.
  * @return newly malloced string with result.
  */
-char* macro_process(rbtree_type* store, struct replay_runtime* runtime, 
+char* macro_process(rbtree_type* store, struct replay_runtime* runtime,
 	char* text);
 
 /**
diff --git a/usr.sbin/unbound/testcode/signit.c b/usr.sbin/unbound/testcode/signit.c
index 0eca0e088..6137c9615 100644
--- a/usr.sbin/unbound/testcode/signit.c
+++ b/usr.sbin/unbound/testcode/signit.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * This program signs rrsets with the given keys. It can be used to 
+ * This program signs rrsets with the given keys. It can be used to
  * construct input to test the validator with.
  */
 #include "config.h"
@@ -74,7 +74,7 @@ usage(void)
 	exit(1);
 }
 
-static time_t 
+static time_t
 convert_timeval(const char* str)
 {
 	time_t t;
@@ -82,7 +82,7 @@ convert_timeval(const char* str)
 	memset(&tm, 0, sizeof(tm));
 	if(strlen(str) < 14)
 		return 0;
-	if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, 
+	if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon,
 		&tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6)
 		return 0;
 	tm.tm_year -= 1900;
@@ -178,7 +178,7 @@ read_rrs(FILE* in)
 	while(!feof(in)) {
 		s = ldns_rr_new_frm_fp_l(&rr, in, &my_ttl, &my_origin,
 			&my_prev, &line_nr);
-		if(s == LDNS_STATUS_SYNTAX_TTL || 
+		if(s == LDNS_STATUS_SYNTAX_TTL ||
 			s == LDNS_STATUS_SYNTAX_ORIGIN ||
 			s == LDNS_STATUS_SYNTAX_EMPTY)
 			continue;
@@ -199,7 +199,7 @@ signit(ldns_rr_list* rrs, ldns_key_list* keys)
 {
 	ldns_rr_list* rrset;
 	ldns_rr_list* sigs;
-	
+
 	while(ldns_rr_list_rr_count(rrs) > 0) {
 		rrset = ldns_rr_list_pop_rrset(rrs);
 		if(!rrset) fatal_exit("copy alloc failure");
@@ -256,7 +256,7 @@ process_nsec3(int argc, char* argv[])
 		ldns_rdf_print(stdout, in);
 		printf(" -> ");
 		/* arg 3 is flags, unused */
-		out = ldns_nsec3_hash_name(in, (uint8_t)atoi(argv[2]), 
+		out = ldns_nsec3_hash_name(in, (uint8_t)atoi(argv[2]),
 			(uint16_t)atoi(argv[4]),
 			ldns_rdf_data(salt)[0], ldns_rdf_data(salt)+1);
 		if(!out)
diff --git a/usr.sbin/unbound/testcode/streamtcp.1 b/usr.sbin/unbound/testcode/streamtcp.1
index f02b168d2..273bbc976 100644
--- a/usr.sbin/unbound/testcode/streamtcp.1
+++ b/usr.sbin/unbound/testcode/streamtcp.1
@@ -10,7 +10,7 @@
 .LP
 .B unbound\-streamtcp
 .RB [ \-unsh ]
-.RB [ \-f 
+.RB [ \-f
 .IR ipaddr[@port] ]
 .RB [ \-d
 .IR secs ]
@@ -46,7 +46,7 @@ Do not wait for the answer.
 .TP
 .B \-a
 Print answers on arrival.  This mean queries are sent in sequence without
-waiting for answer but if answers arrive in this time they are printed out. 
+waiting for answer but if answers arrive in this time they are printed out.
 After sending queries the program waits and prints the remainder.
 .TP
 .B \-s
@@ -71,7 +71,7 @@ $ unbound\-streamtcp \-f 192.168.1.1 www.example.com SOA IN
 .P
 $ unbound\-streamtcp \-f 192.168.1.1@1234 153.1.168.192.in\-addr.arpa. PTR IN
 .SH "EXIT CODE"
-The unbound\-streamtcp program exits with status code 1 on error, 
+The unbound\-streamtcp program exits with status code 1 on error,
 0 on no error.
 .SH "AUTHOR"
 This manual page was written by Tomas Hozza <thozza@redhat.com>.
diff --git a/usr.sbin/unbound/testcode/streamtcp.c b/usr.sbin/unbound/testcode/streamtcp.c
index b2c0d5328..cb426c91a 100644
--- a/usr.sbin/unbound/testcode/streamtcp.c
+++ b/usr.sbin/unbound/testcode/streamtcp.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -242,7 +242,7 @@ recv_one(int fd, int udp, SSL* ssl, sldns_buffer* buf)
 			if(r == 0) {
 				printf("recv: stream closed\n");
 				exit(1);
-			}	
+			}
 			if(r < (ssize_t)sizeof(len)) {
 #ifndef USE_WINSOCK
 				perror("read() len failed");
diff --git a/usr.sbin/unbound/testcode/testbound.c b/usr.sbin/unbound/testcode/testbound.c
index ec627cc8d..e634770a2 100644
--- a/usr.sbin/unbound/testcode/testbound.c
+++ b/usr.sbin/unbound/testcode/testbound.c
@@ -58,7 +58,7 @@
 #define unbound_testbound 1
 /** renamed main routine */
 int daemon_main(int argc, char* argv[]);
-/** 
+/**
  * include the main program from the unbound daemon.
  * rename main to daemon_main to call it
  */
@@ -112,7 +112,7 @@ testbound_usage(void)
 /** Max number of arguments to pass to unbound. */
 #define MAXARG 100
 
-/** 
+/**
  * Add options from string to passed argc. splits on whitespace.
  * @param args: the option argument, "-v -p 12345" or so.
  * @param pass_argc: ptr to the argc for unbound. Modified.
@@ -123,7 +123,7 @@ add_opts(const char* args, int* pass_argc, char* pass_argv[])
 {
 	const char *p = args, *np;
 	size_t len;
-	while(p && isspace((unsigned char)*p)) 
+	while(p && isspace((unsigned char)*p))
 		p++;
 	while(p && *p) {
 		/* find location of next string and length of this one */
@@ -141,7 +141,7 @@ add_opts(const char* args, int* pass_argc, char* pass_argv[])
 		(*pass_argc)++;
 		/* go to next option */
 	        p = np;
-		while(p && isspace((unsigned char)*p)) 
+		while(p && isspace((unsigned char)*p))
 			p++;
 	}
 }
@@ -166,7 +166,7 @@ spool_temp_file_name(int* lineno, FILE* cfg, char* id)
 	/* find filename for new file */
 	while(isspace((unsigned char)*id))
 		id++;
-	if(*id == '\0') 
+	if(*id == '\0')
 		fatal_exit("TEMPFILE_NAME must have id, line %d", *lineno);
 	strip_end_white(id);
 	fake_temp_file("_temp_", id, line, sizeof(line));
@@ -183,7 +183,7 @@ spool_temp_file(FILE* in, int* lineno, char* id)
 	/* find filename for new file */
 	while(isspace((unsigned char)*id))
 		id++;
-	if(*id == '\0') 
+	if(*id == '\0')
 		fatal_exit("TEMPFILE_CONTENTS must have id, line %d", *lineno);
 	strip_end_white(id);
 	fake_temp_file("_temp_", id, line, sizeof(line));
@@ -191,7 +191,7 @@ spool_temp_file(FILE* in, int* lineno, char* id)
 	spool = fopen(line, "w");
 	if(!spool) fatal_exit("could not open %s: %s", line, strerror(errno));
 	fprintf(stderr, "testbound is spooling temp file: %s\n", line);
-	if(!cfg_strlist_insert(&cfgfiles, strdup(line))) 
+	if(!cfg_strlist_insert(&cfgfiles, strdup(line)))
 		fatal_exit("out of memory");
 	line[sizeof(line)-1] = 0;
 	while(fgets(line, MAX_LINE_LEN-1, in)) {
@@ -228,7 +228,7 @@ spool_auto_file(FILE* in, int* lineno, FILE* cfg, char* id)
 	/* find filename for new file */
 	while(isspace((unsigned char)*id))
 		id++;
-	if(*id == '\0') 
+	if(*id == '\0')
 		fatal_exit("AUTROTRUST_FILE must have id, line %d", *lineno);
 	strip_end_white(id);
 	fake_temp_file("_auto_", id, line, sizeof(line));
@@ -238,7 +238,7 @@ spool_auto_file(FILE* in, int* lineno, FILE* cfg, char* id)
 	spool = fopen(line, "w");
 	if(!spool) fatal_exit("could not open %s: %s", line, strerror(errno));
 	fprintf(stderr, "testbound is spooling key file: %s\n", line);
-	if(!cfg_strlist_insert(&cfgfiles, strdup(line))) 
+	if(!cfg_strlist_insert(&cfgfiles, strdup(line)))
 		fatal_exit("out of memory");
 	line[sizeof(line)-1] = 0;
 	while(fgets(line, MAX_LINE_LEN-1, in)) {
@@ -267,9 +267,9 @@ setup_config(FILE* in, int* lineno, int* pass_argc, char* pass_argv[])
 	add_opts("-c", pass_argc, pass_argv);
 	add_opts(configfile, pass_argc, pass_argv);
 	cfg = fopen(configfile, "w");
-	if(!cfg) fatal_exit("could not open %s: %s", 
+	if(!cfg) fatal_exit("could not open %s: %s",
 			configfile, strerror(errno));
-	if(!cfg_strlist_insert(&cfgfiles, strdup(configfile))) 
+	if(!cfg_strlist_insert(&cfgfiles, strdup(configfile)))
 		fatal_exit("out of memory");
 	line[sizeof(line)-1] = 0;
 	/* some basic settings to not pollute the host system */
@@ -316,7 +316,7 @@ setup_config(FILE* in, int* lineno, int* pass_argc, char* pass_argv[])
 }
 
 /** read playback file */
-static struct replay_scenario* 
+static struct replay_scenario*
 setup_playback(const char* filename, int* pass_argc, char* pass_argv[])
 {
 	struct replay_scenario* scen = NULL;
@@ -355,7 +355,7 @@ static void remove_configfile(void)
  * @param argv: array of commandline arguments.
  * @return program failure if test fails.
  */
-int 
+int
 main(int argc, char* argv[])
 {
 	int c, res;
@@ -510,7 +510,7 @@ main(int argc, char* argv[])
 }
 
 /* fake remote control */
-struct listen_port* daemon_remote_open_ports(struct config_file* 
+struct listen_port* daemon_remote_open_ports(struct config_file*
 	ATTR_UNUSED(cfg))
 {
 	return NULL;
@@ -532,13 +532,13 @@ void daemon_remote_clear(struct daemon_remote* ATTR_UNUSED(rc))
 }
 
 int daemon_remote_open_accept(struct daemon_remote* ATTR_UNUSED(rc),
-        struct listen_port* ATTR_UNUSED(ports), 
+        struct listen_port* ATTR_UNUSED(ports),
 	struct worker* ATTR_UNUSED(worker))
 {
 	return 1;
 }
 
-int remote_accept_callback(struct comm_point* ATTR_UNUSED(c), 
+int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -546,7 +546,7 @@ int remote_accept_callback(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
-int remote_control_callback(struct comm_point* ATTR_UNUSED(c), 
+int remote_control_callback(struct comm_point* ATTR_UNUSED(c),
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(repinfo))
 {
@@ -560,8 +560,8 @@ void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
 }
 
 #ifdef UB_ON_WINDOWS
-void wsvc_command_option(const char* ATTR_UNUSED(wopt), 
-	const char* ATTR_UNUSED(cfgfile), int ATTR_UNUSED(v), 
+void wsvc_command_option(const char* ATTR_UNUSED(wopt),
+	const char* ATTR_UNUSED(cfgfile), int ATTR_UNUSED(v),
 	int ATTR_UNUSED(c))
 {
 	log_assert(0);
diff --git a/usr.sbin/unbound/testcode/testpkts.c b/usr.sbin/unbound/testcode/testpkts.c
index 3702c3f18..b70d4c439 100644
--- a/usr.sbin/unbound/testcode/testpkts.c
+++ b/usr.sbin/unbound/testcode/testpkts.c
@@ -36,7 +36,7 @@ struct sockaddr_storage;
 /** max size of a packet */
 #define MAX_PACKETLEN 65536
 /** max line length */
-#define MAX_LINE   10240	
+#define MAX_LINE   10240
 /** string to show in warnings and errors */
 static const char* prog_name = "testpkts";
 
@@ -64,13 +64,13 @@ static void error(const char* msg, ...)
 /** return if string is empty or comment */
 static int isendline(char c)
 {
-	if(c == ';' || c == '#' 
+	if(c == ';' || c == '#'
 		|| c == '\n' || c == 0)
 		return 1;
 	return 0;
 }
 
-/** true if the string starts with the keyword given. Moves the str ahead. 
+/** true if the string starts with the keyword given. Moves the str ahead.
  * @param str: before keyword, afterwards after keyword and spaces.
  * @param keyword: the keyword to match
  * @return: true if keyword present. False otherwise, and str unchanged.
@@ -89,7 +89,7 @@ static int str_keyword(char** str, const char* keyword)
 
 /** Add reply packet to entry */
 static struct reply_packet*
-entry_add_reply(struct entry* entry) 
+entry_add_reply(struct entry* entry)
 {
 	struct reply_packet* pkt = (struct reply_packet*)malloc(
 		sizeof(struct reply_packet));
@@ -112,7 +112,7 @@ static void matchline(char* line, struct entry* e)
 {
 	char* parse = line;
 	while(*parse) {
-		if(isendline(*parse)) 
+		if(isendline(*parse))
 			return;
 		if(str_keyword(&parse, "opcode")) {
 			e->match_opcode = 1;
@@ -180,7 +180,7 @@ static void replyline(char* line, uint8_t* reply, size_t reply_len,
 	char* parse = line;
 	if(reply_len < LDNS_HEADER_SIZE) error("packet too short for header");
 	while(*parse) {
-		if(isendline(*parse)) 
+		if(isendline(*parse))
 			return;
 			/* opcodes */
 		if(str_keyword(&parse, "QUERY")) {
@@ -240,12 +240,12 @@ static void replyline(char* line, uint8_t* reply, size_t reply_len,
 }
 
 /** parse ADJUST line */
-static void adjustline(char* line, struct entry* e, 
+static void adjustline(char* line, struct entry* e,
 	struct reply_packet* pkt)
 {
 	char* parse = line;
 	while(*parse) {
-		if(isendline(*parse)) 
+		if(isendline(*parse))
 			return;
 		if(str_keyword(&parse, "copy_id")) {
 			e->copy_id = 1;
@@ -257,11 +257,11 @@ static void adjustline(char* line, struct entry* e,
 			e->increment_ecs_scope = 1;
 		} else if(str_keyword(&parse, "sleep=")) {
 			e->sleeptime = (unsigned int) strtol(parse, (char**)&parse, 10);
-			while(isspace((unsigned char)*parse)) 
+			while(isspace((unsigned char)*parse))
 				parse++;
 		} else if(str_keyword(&parse, "packet_sleep=")) {
 			pkt->packet_sleep = (unsigned int) strtol(parse, (char**)&parse, 10);
-			while(isspace((unsigned char)*parse)) 
+			while(isspace((unsigned char)*parse))
 				parse++;
 		} else {
 			error("could not parse ADJUST: '%s'", parse);
@@ -316,11 +316,11 @@ static size_t
 hexstr2bin(char *hexstr, int len, uint8_t *buf, size_t offset, size_t buf_len)
 {
 	char c;
-	int i; 
+	int i;
 	uint8_t int8 = 0;
 	int sec = 0;
 	size_t bufpos = 0;
-	
+
 	if (len % 2 != 0) {
 		return 0;
 	}
@@ -331,15 +331,15 @@ hexstr2bin(char *hexstr, int len, uint8_t *buf, size_t offset, size_t buf_len)
 		/* case insensitive, skip spaces */
 		if (c != ' ') {
 			if (c >= '0' && c <= '9') {
-				int8 += c & 0x0f;  
+				int8 += c & 0x0f;
 			} else if (c >= 'a' && c <= 'z') {
-				int8 += (c & 0x0f) + 9;   
+				int8 += (c & 0x0f) + 9;
 			} else if (c >= 'A' && c <= 'Z') {
-				int8 += (c & 0x0f) + 9;   
+				int8 += (c & 0x0f) + 9;
 			} else {
 				return 0;
 			}
-			 
+
 			if (sec == 0) {
 				int8 = int8 << 4;
 				sec = 1;
@@ -347,7 +347,7 @@ hexstr2bin(char *hexstr, int len, uint8_t *buf, size_t offset, size_t buf_len)
 				if (bufpos + offset + 1 <= buf_len) {
 					buf[bufpos+offset] = int8;
 					int8 = 0;
-					sec = 0; 
+					sec = 0;
 					bufpos++;
 				} else {
 					fprintf(stderr, "Buffer too small in hexstr2bin");
@@ -364,7 +364,7 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 {
 	sldns_buffer *wire_buffer = NULL;
 	int c;
-	
+
 	/* stat hack
 	 * 0 = normal
 	 * 1 = comment (skip to end of line)
@@ -378,12 +378,12 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 	uint8_t *data_wire = (uint8_t *) sldns_buffer_begin(data_buffer);
 	uint8_t *wire = (uint8_t*)malloc(MAX_PACKETLEN);
 	if(!wire) error("out of memory");
-	
+
 	hexbuf = (uint8_t*)malloc(MAX_PACKETLEN);
 	if(!hexbuf) error("out of memory");
 	for (data_buf_pos = 0; data_buf_pos < sldns_buffer_position(data_buffer); data_buf_pos++) {
 		c = (int) data_wire[data_buf_pos];
-		
+
 		if (state < 2 && !isascii((unsigned char)c)) {
 			/*verbose("non ascii character found in file: (%d) switching to raw mode\n", c);*/
 			state = 2;
@@ -406,7 +406,7 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 					state = 1;
 				} else if (c == ' ' || c == '\t' || c == '\n') {
 					/* skip whitespace */
-				} 
+				}
 				break;
 			case 1:
 				if (c == '\n' || c == EOF) {
@@ -428,7 +428,7 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 	if (hexbufpos >= MAX_PACKETLEN) {
 		/*verbose("packet size reached\n");*/
 	}
-	
+
 	/* lenient mode: length must be multiple of 2 */
 	if (hexbufpos % 2 != 0) {
 		if (hexbufpos >= MAX_PACKETLEN) {
@@ -450,10 +450,10 @@ hex_buffer2wire(sldns_buffer *data_buffer)
 	free(wire);
 	free(hexbuf);
 	return wire_buffer;
-}	
+}
 
 /** parse ORIGIN */
-static void 
+static void
 get_origin(const char* name, struct sldns_file_parse_state* pstate, char* parse)
 {
 	/* snip off rest of the text so as to make the parse work in ldns */
@@ -571,7 +571,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 			continue; /* skip comment and empty lines */
 		if(str_keyword(&parse, "ENTRY_BEGIN")) {
 			if(current) {
-				error("%s line %d: previous entry does not ENTRY_END", 
+				error("%s line %d: previous entry does not ENTRY_END",
 					name, pstate->lineno);
 			}
 			current = new_entry();
@@ -588,7 +588,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 
 		/* working inside an entry */
 		if(!current) {
-			error("%s line %d: expected ENTRY_BEGIN but got %s", 
+			error("%s line %d: expected ENTRY_BEGIN but got %s",
 				name, pstate->lineno, line);
 		}
 		if(str_keyword(&parse, "MATCH")) {
@@ -690,7 +690,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 }
 
 /* reads the canned reply file and returns a list of structs */
-struct entry* 
+struct entry*
 read_datafile(const char* name, int skip_whitespace)
 {
 	struct entry* list = NULL;
@@ -1254,7 +1254,7 @@ match_question(uint8_t* q, size_t qlen, uint8_t* p, size_t plen, int mttl)
 		free(pb);
 		return 0;
 	}
-	
+
 	/* remove after answer section, (;; ANS, ;; AUTH, ;; ADD  ..) */
 	s = strstr(qcmpstr, ";; ANSWER SECTION");
 	if(!s) s = strstr(qcmpstr, ";; AUTHORITY SECTION");
@@ -1321,7 +1321,7 @@ match_answer(uint8_t* q, size_t qlen, uint8_t* p, size_t plen, int mttl)
 		free(pb);
 		return 0;
 	}
-	
+
 	/* remove after answer section, (;; AUTH, ;; ADD, ;; MSG size ..) */
 	s = strstr(qcmpstr, ";; AUTHORITY SECTION");
 	if(!s) s = strstr(qcmpstr, ";; ADDITIONAL SECTION");
@@ -1500,7 +1500,7 @@ match_ednsdata(uint8_t* q, size_t qlen, uint8_t* p, size_t plen)
 }
 
 /* finds entry in list, or returns NULL */
-struct entry* 
+struct entry*
 find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 	enum transport_type transport)
 {
@@ -1589,7 +1589,7 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 			verbose(3, "bad; EDNS OPT present\n");
 			continue;
 		}
-		if(p->match_ednsdata_raw && 
+		if(p->match_ednsdata_raw &&
 				!match_ednsdata(query_pkt, len, reply, rlen)) {
 			verbose(3, "bad EDNS data match.\n");
 			continue;
@@ -1710,7 +1710,7 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 		 * + ecs scope = index 15 */
 		if(walk_qlen >= 15 && walk_plen >= 15) {
 			walk_p[15] = walk_q[14];
-		}	
+		}
 		if(match->increment_ecs_scope) {
 			walk_p[15]++;
 		}
@@ -1729,7 +1729,7 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 }
 
 /*
- * Parses data buffer to a query, finds the correct answer 
+ * Parses data buffer to a query, finds the correct answer
  * and calls the given function for every packet to send.
  */
 void
@@ -1743,7 +1743,7 @@ handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
 	struct entry* entry = NULL;
 
 	verbose(1, "query %d: id %d: %s %d bytes: ", ++(*count),
-		(int)(inlen>=2?LDNS_ID_WIRE(inbuf):0), 
+		(int)(inlen>=2?LDNS_ID_WIRE(inbuf):0),
 		(transport==transport_tcp)?"TCP":"UDP", (int)inlen);
 	if(verbose_out) {
 		char* out = sldns_wire2str_pkt(inbuf, (size_t)inlen);
@@ -1784,7 +1784,7 @@ handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
 			free(out);
 		}
 		if(p->packet_sleep) {
-			verbose(3, "sleeping for next packet %d secs\n", 
+			verbose(3, "sleeping for next packet %d secs\n",
 				p->packet_sleep);
 #ifdef HAVE_SLEEP
 			sleep(p->packet_sleep);
diff --git a/usr.sbin/unbound/testcode/testpkts.h b/usr.sbin/unbound/testcode/testpkts.h
index 2768040c6..e3bc1f23f 100644
--- a/usr.sbin/unbound/testcode/testpkts.h
+++ b/usr.sbin/unbound/testcode/testpkts.h
@@ -14,7 +14,7 @@ struct sldns_file_parse_state;
 
 /**
  * \file
- * 
+ *
  * This is a debugging aid. It is not efficient, especially
  * with a long config file, but it can give any reply to any query.
  * This can help the developer pre-script replies for queries.
@@ -29,7 +29,7 @@ struct sldns_file_parse_state;
 
  /*
 	The data file format is as follows:
-	
+
 	; comment.
 	; a number of entries, these are processed first to last.
 	; a line based format.
@@ -105,8 +105,8 @@ struct sldns_file_parse_state;
 				; are ignored. Only copy_id is done.
 	HEX_ANSWER_END
 	HEX_EDNS_BEGIN		; follow with hex data.
-				; Raw EDNS data to match against. It must be an 
-				; exact match (all options are matched) and will be 
+				; Raw EDNS data to match against. It must be an
+				; exact match (all options are matched) and will be
 				; evaluated only when 'MATCH ednsdata' given.
 	HEX_EDNS_END
 	ENTRY_END
@@ -174,7 +174,7 @@ struct reply_packet {
 	/** or reply pkt in hex if not parsable */
 	struct sldns_buffer* reply_from_hex;
 	/** seconds to sleep before giving packet */
-	unsigned int packet_sleep; 
+	unsigned int packet_sleep;
 };
 
 /** data structure to keep the canned queries in.
@@ -226,7 +226,7 @@ struct entry {
 
 	/** how to adjust the reply packet */
 	/** copy over the ID from the query into the answer */
-	uint8_t copy_id; 
+	uint8_t copy_id;
 	/** copy the query nametypeclass from query into the answer */
 	uint8_t copy_query;
 	/** copy ednsdata to reply, assume it is clientsubnet and
@@ -235,7 +235,7 @@ struct entry {
 	/** increment the ECS scope copied from the sourcemask by one */
 	uint8_t increment_ecs_scope;
 	/** in seconds */
-	unsigned int sleeptime; 
+	unsigned int sleeptime;
 
 	/** some number that names this entry, line number in file or so */
 	int lineno;
@@ -245,7 +245,7 @@ struct entry {
 };
 
 /**
- * reads the canned reply file and returns a list of structs 
+ * reads the canned reply file and returns a list of structs
  * does an exit on error.
  * @param name: name of the file to read.
  * @param skip_whitespace: skip leftside whitespace.
@@ -266,7 +266,7 @@ void delete_entry(struct entry* list);
  * @param skip_whitespace: skip leftside whitespace.
  * @return: The entry read (malloced) or NULL if no entry could be read.
  */
-struct entry* read_entry(FILE* in, const char* name, 
+struct entry* read_entry(FILE* in, const char* name,
 	struct sldns_file_parse_state* pstate, int skip_whitespace);
 
 /**
@@ -297,7 +297,7 @@ void adjust_packet(struct entry* match, uint8_t** answer_pkt,
 	size_t* answer_pkt_len, uint8_t* query_pkt, size_t query_pkt_len);
 
 /**
- * Parses data buffer to a query, finds the correct answer 
+ * Parses data buffer to a query, finds the correct answer
  * and calls the given function for every packet to send.
  * if verbose_out filename is given, packets are dumped there.
  * @param inbuf: the packet that came in
@@ -309,8 +309,8 @@ void adjust_packet(struct entry* match, uint8_t** answer_pkt,
  * @param userdata: userarg to give to sendfunc.
  * @param verbose_out: if not NULL, verbose messages are printed there.
  */
-void handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, 
-	int* count, enum transport_type transport, 
+void handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries,
+	int* count, enum transport_type transport,
 	void (*sendfunc)(uint8_t*, size_t, void*), void* userdata,
 	FILE* verbose_out);
 
diff --git a/usr.sbin/unbound/testcode/unitanchor.c b/usr.sbin/unbound/testcode/unitanchor.c
index 8819c5ab6..68f62fb58 100644
--- a/usr.sbin/unbound/testcode/unitanchor.c
+++ b/usr.sbin/unbound/testcode/unitanchor.c
@@ -35,7 +35,7 @@
  */
 /**
  * \file
- * Calls trust anchor unit tests. Exits with code 1 on a failure. 
+ * Calls trust anchor unit tests. Exits with code 1 on a failure.
  */
 
 #include "config.h"
@@ -53,12 +53,12 @@ test_anchor_empty(struct val_anchors* a)
 	uint16_t c = LDNS_RR_CLASS_IN;
 	unit_assert(anchors_lookup(a, (uint8_t*)"\000", 1, c) == NULL);
 	unit_assert(anchors_lookup(a, (uint8_t*)"\003com\000", 5, c) == NULL);
-	unit_assert(anchors_lookup(a, 
+	unit_assert(anchors_lookup(a,
 		(uint8_t*)"\007example\003com\000", 11, c) == NULL);
 	unit_assert(anchors_lookup(a, (uint8_t*)"\002nl\000", 4, c) == NULL);
-	unit_assert(anchors_lookup(a, 
+	unit_assert(anchors_lookup(a,
 		(uint8_t*)"\004labs\002nl\000", 9, c) == NULL);
-	unit_assert(anchors_lookup(a, 
+	unit_assert(anchors_lookup(a,
 		(uint8_t*)"\004fabs\002nl\000", 9, c) == NULL);
 }
 
@@ -68,22 +68,22 @@ test_anchor_one(sldns_buffer* buff, struct val_anchors* a)
 {
 	struct trust_anchor* ta;
 	uint16_t c = LDNS_RR_CLASS_IN;
-	unit_assert(anchor_store_str(a, buff, 
+	unit_assert(anchor_store_str(a, buff,
 		"nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"));
 	unit_assert(anchors_lookup(a, (uint8_t*)"\000", 1, c) == NULL);
 	unit_assert(anchors_lookup(a, (uint8_t*)"\003com\000", 5, c) == NULL);
-	unit_assert(anchors_lookup(a, 
+	unit_assert(anchors_lookup(a,
 		(uint8_t*)"\007example\003com\000", 11, c) == NULL);
 
 	unit_assert((ta=anchors_lookup(a,
 		(uint8_t*)"\002nl\000", 4, c)) != NULL);
 	lock_basic_unlock(&ta->lock);
 
-	unit_assert((ta=anchors_lookup(a, 
+	unit_assert((ta=anchors_lookup(a,
 		(uint8_t*)"\004labs\002nl\000", 9, c)) != NULL);
 	lock_basic_unlock(&ta->lock);
 
-	unit_assert((ta=anchors_lookup(a, 
+	unit_assert((ta=anchors_lookup(a,
 		(uint8_t*)"\004fabs\002nl\000", 9, c)) != NULL);
 	lock_basic_unlock(&ta->lock);
 
@@ -96,26 +96,26 @@ test_anchors(sldns_buffer* buff, struct val_anchors* a)
 {
 	struct trust_anchor* ta;
 	uint16_t c = LDNS_RR_CLASS_IN;
-	unit_assert(anchor_store_str(a, buff, 
+	unit_assert(anchor_store_str(a, buff,
 	"labs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A"));
 	unit_assert(anchors_lookup(a, (uint8_t*)"\000", 1, c) == NULL);
 	unit_assert(anchors_lookup(a, (uint8_t*)"\003com\000", 5, c) == NULL);
-	unit_assert(anchors_lookup(a, 
+	unit_assert(anchors_lookup(a,
 		(uint8_t*)"\007example\003com\000", 11, c) == NULL);
 
 	unit_assert(ta = anchors_lookup(a, (uint8_t*)"\002nl\000", 4, c));
 	unit_assert(query_dname_compare(ta->name, (uint8_t*)"\002nl\000")==0);
 	lock_basic_unlock(&ta->lock);
 
-	unit_assert(ta = anchors_lookup(a, 
+	unit_assert(ta = anchors_lookup(a,
 		(uint8_t*)"\004labs\002nl\000", 9, c));
-	unit_assert(query_dname_compare(ta->name, 
+	unit_assert(query_dname_compare(ta->name,
 		(uint8_t*)"\004labs\002nl\000") == 0);
 	lock_basic_unlock(&ta->lock);
 
-	unit_assert(ta = anchors_lookup(a, 
+	unit_assert(ta = anchors_lookup(a,
 		(uint8_t*)"\004fabs\002nl\000", 9, c));
-	unit_assert(query_dname_compare(ta->name, 
+	unit_assert(query_dname_compare(ta->name,
 		(uint8_t*)"\002nl\000") == 0);
 	lock_basic_unlock(&ta->lock);
 
diff --git a/usr.sbin/unbound/testcode/unitauth.c b/usr.sbin/unbound/testcode/unitauth.c
index d193526b8..c47597ca2 100644
--- a/usr.sbin/unbound/testcode/unitauth.c
+++ b/usr.sbin/unbound/testcode/unitauth.c
@@ -630,7 +630,7 @@ q_ans_parse(struct q_ans* q, struct regional* region,
 	*fallback = 0; /* default fallback value */
 	if(strstr(q->flags, "fallback"))
 		*fallback = 1;
-	
+
 	/* parse zone */
 	*dp_nmlen = sizeof(buf);
 	if((ret=sldns_str2wire_dname_buf(q->zone, buf, dp_nmlen))!=0)
@@ -899,7 +899,7 @@ authzone_query_test(void)
 }
 
 /** test authzone code */
-void 
+void
 authzone_test(void)
 {
 	unit_show_feature("authzone");
diff --git a/usr.sbin/unbound/testcode/unitdname.c b/usr.sbin/unbound/testcode/unitdname.c
index 6769127b9..59be1b43e 100644
--- a/usr.sbin/unbound/testcode/unitdname.c
+++ b/usr.sbin/unbound/testcode/unitdname.c
@@ -35,7 +35,7 @@
  */
 /**
  * \file
- * Calls dname unit tests. Exits with code 1 on a failure. 
+ * Calls dname unit tests. Exits with code 1 on a failure.
  */
 
 #include "config.h"
@@ -54,7 +54,7 @@ dname_to_buf(sldns_buffer* b, const char* str)
 	sldns_buffer_clear(b);
 	e = sldns_str2wire_dname_buf(str, sldns_buffer_begin(b), &len);
 	if(e != 0)
-		fatal_exit("%s ldns: %s", __func__, 
+		fatal_exit("%s ldns: %s", __func__,
 			sldns_get_errorstr_parse(e));
 	sldns_buffer_set_position(b, len);
 	sldns_buffer_flip(b);
@@ -62,7 +62,7 @@ dname_to_buf(sldns_buffer* b, const char* str)
 }
 
 /** test query_dname_len function */
-static void 
+static void
 dname_test_qdl(sldns_buffer* buff)
 {
 	unit_show_func("util/data/dname.c", "query_dname_len");
@@ -80,12 +80,12 @@ dname_test_qdtl(sldns_buffer* buff)
 	unit_show_func("util/data/dname.c", "query_dname_tolower");
 	sldns_buffer_write_at(buff, 0, "\012abCDeaBCde\003cOm\000", 16);
 	query_dname_tolower(sldns_buffer_begin(buff));
-	unit_assert( memcmp(sldns_buffer_begin(buff), 
+	unit_assert( memcmp(sldns_buffer_begin(buff),
 		"\012abcdeabcde\003com\000", 16) == 0);
 
 	sldns_buffer_write_at(buff, 0, "\001+\012abC{e-ZYXe\003NET\000", 18);
 	query_dname_tolower(sldns_buffer_begin(buff));
-	unit_assert( memcmp(sldns_buffer_begin(buff), 
+	unit_assert( memcmp(sldns_buffer_begin(buff),
 		"\001+\012abc{e-zyxe\003net\000", 18) == 0);
 
 	sldns_buffer_write_at(buff, 0, "\000", 1);
@@ -103,27 +103,27 @@ dname_test_query_dname_compare(void)
 {
 	unit_show_func("util/data/dname.c", "query_dname_compare");
 	unit_assert(query_dname_compare((uint8_t*)"", (uint8_t*)"") == 0);
-	unit_assert(query_dname_compare((uint8_t*)"\001a", 
+	unit_assert(query_dname_compare((uint8_t*)"\001a",
 					(uint8_t*)"\001a") == 0);
-	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a", 
+	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a",
 					(uint8_t*)"\003abc\001a") == 0);
-	unit_assert(query_dname_compare((uint8_t*)"\003aBc\001a", 
+	unit_assert(query_dname_compare((uint8_t*)"\003aBc\001a",
 					(uint8_t*)"\003AbC\001A") == 0);
-	unit_assert(query_dname_compare((uint8_t*)"\003abc", 
+	unit_assert(query_dname_compare((uint8_t*)"\003abc",
 					(uint8_t*)"\003abc\001a") == -1);
-	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a", 
+	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a",
 					(uint8_t*)"\003abc") == +1);
-	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a", 
+	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a",
 					(uint8_t*)"") == +1);
-	unit_assert(query_dname_compare((uint8_t*)"", 
+	unit_assert(query_dname_compare((uint8_t*)"",
 					(uint8_t*)"\003abc\001a") == -1);
-	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a", 
+	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a",
 					(uint8_t*)"\003xxx\001a") == -1);
-	unit_assert(query_dname_compare((uint8_t*)"\003axx\001a", 
+	unit_assert(query_dname_compare((uint8_t*)"\003axx\001a",
 					(uint8_t*)"\003abc\001a") == 1);
-	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a", 
+	unit_assert(query_dname_compare((uint8_t*)"\003abc\001a",
 					(uint8_t*)"\003abc\001Z") == -1);
-	unit_assert(query_dname_compare((uint8_t*)"\003abc\001Z", 
+	unit_assert(query_dname_compare((uint8_t*)"\003abc\001Z",
 					(uint8_t*)"\003abc\001a") == 1);
 }
 
@@ -136,7 +136,7 @@ dname_test_count_labels(void)
 	unit_assert(dname_count_labels((uint8_t*)"\003com") == 2);
 	unit_assert(dname_count_labels((uint8_t*)"\003org") == 2);
 	unit_assert(dname_count_labels((uint8_t*)"\007example\003com") == 3);
-	unit_assert(dname_count_labels((uint8_t*)"\003bla\007example\003com") 
+	unit_assert(dname_count_labels((uint8_t*)"\003bla\007example\003com")
 		== 4);
 }
 
@@ -152,7 +152,7 @@ dname_test_count_size_labels(void)
 	unit_assert(sz == 5);
 	unit_assert(dname_count_size_labels((uint8_t*)"\003org", &sz) == 2);
 	unit_assert(sz == 5);
-	unit_assert(dname_count_size_labels((uint8_t*)"\007example\003com", 
+	unit_assert(dname_count_size_labels((uint8_t*)"\007example\003com",
 		&sz) == 3);
 	unit_assert(sz == 13);
 	unit_assert(dname_count_size_labels((uint8_t*)"\003bla\007example"
@@ -218,7 +218,7 @@ dname_test_pkt_dname_len(sldns_buffer* buff)
 
 	/* name very long */
 	sldns_buffer_clear(buff);
-	sldns_buffer_write(buff, 
+	sldns_buffer_write(buff,
 		"\020a1cdef5555544444"
 		"\020a2cdef5555544444"
 		"\020a3cdef5555544444"
@@ -242,7 +242,7 @@ dname_test_pkt_dname_len(sldns_buffer* buff)
 
 	/* name too long */
 	sldns_buffer_clear(buff);
-	sldns_buffer_write(buff, 
+	sldns_buffer_write(buff,
 		"\020a1cdef5555544444"
 		"\020a2cdef5555544444"
 		"\020a3cdef5555544444"
@@ -278,93 +278,93 @@ dname_test_dname_lab_cmp(void)
 	unit_assert(dname_lab_cmp((uint8_t*)"", 1, (uint8_t*)"", 1, &ml) == 0);
 	unit_assert(ml == 1);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\003net", 2, 
-		(uint8_t*)"\003net", 2, 
+		(uint8_t*)"\003net", 2,
+		(uint8_t*)"\003net", 2,
 		&ml) == 0);
 	unit_assert(ml == 2);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\007example\003net", 3, 
-		(uint8_t*)"\007example\003net", 3, 
+		(uint8_t*)"\007example\003net", 3,
+		(uint8_t*)"\007example\003net", 3,
 		&ml) == 0);
 	unit_assert(ml == 3);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\004test\007example\003net", 4, 
-		(uint8_t*)"\004test\007example\003net", 4, 
+		(uint8_t*)"\004test\007example\003net", 4,
+		(uint8_t*)"\004test\007example\003net", 4,
 		&ml) == 0);
 	unit_assert(ml == 4);
 
 	/* root is smaller than anything else */
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"", 1, 
-		(uint8_t*)"\003net", 2, 
+		(uint8_t*)"", 1,
+		(uint8_t*)"\003net", 2,
 		&ml) == -1);
 	unit_assert(ml == 1);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\003net", 2, 
-		(uint8_t*)"", 1, 
+		(uint8_t*)"\003net", 2,
+		(uint8_t*)"", 1,
 		&ml) == 1);
 	unit_assert(ml == 1);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"", 1, 
-		(uint8_t*)"\007example\003net", 3, 
+		(uint8_t*)"", 1,
+		(uint8_t*)"\007example\003net", 3,
 		&ml) == -1);
 	unit_assert(ml == 1);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\007example\003net", 3, 
-		(uint8_t*)"", 1, 
+		(uint8_t*)"\007example\003net", 3,
+		(uint8_t*)"", 1,
 		&ml) == 1);
 	unit_assert(ml == 1);
 
 	/* label length makes a difference */
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\004neta", 2, 
-		(uint8_t*)"\003net", 2, 
+		(uint8_t*)"\004neta", 2,
+		(uint8_t*)"\003net", 2,
 		&ml) != 0);
 	unit_assert(ml == 1);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\002ne", 2, 
-		(uint8_t*)"\004neta", 2, 
+		(uint8_t*)"\002ne", 2,
+		(uint8_t*)"\004neta", 2,
 		&ml) != 0);
 	unit_assert(ml == 1);
 
 	/* contents follow the zone apex */
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\003bla\007example\003net", 4, 
-		(uint8_t*)"\007example\003net", 3, 
+		(uint8_t*)"\003bla\007example\003net", 4,
+		(uint8_t*)"\007example\003net", 3,
 		&ml) == 1);
 	unit_assert(ml == 3);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\007example\003net", 3, 
-		(uint8_t*)"\003bla\007example\003net", 4, 
+		(uint8_t*)"\007example\003net", 3,
+		(uint8_t*)"\003bla\007example\003net", 4,
 		&ml) == -1);
 	unit_assert(ml == 3);
 
 	/* label content makes a difference */
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\003aag\007example\003net", 4, 
-		(uint8_t*)"\003bla\007example\003net", 4, 
+		(uint8_t*)"\003aag\007example\003net", 4,
+		(uint8_t*)"\003bla\007example\003net", 4,
 		&ml) == -1);
 	unit_assert(ml == 3);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\003aag\007example\003net", 4, 
-		(uint8_t*)"\003bla\007example\003net", 4, 
+		(uint8_t*)"\003aag\007example\003net", 4,
+		(uint8_t*)"\003bla\007example\003net", 4,
 		&ml) == -1);
 	unit_assert(ml == 3);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\003bla\003aag\007example\003net", 5, 
-		(uint8_t*)"\003aag\003bla\007example\003net", 5, 
+		(uint8_t*)"\003bla\003aag\007example\003net", 5,
+		(uint8_t*)"\003aag\003bla\007example\003net", 5,
 		&ml) == -1);
 	unit_assert(ml == 3);
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\02sn\003opt\003aag\007example\003net", 6, 
-		(uint8_t*)"\02sn\003opt\003bla\007example\003net", 6, 
+		(uint8_t*)"\02sn\003opt\003aag\007example\003net", 6,
+		(uint8_t*)"\02sn\003opt\003bla\007example\003net", 6,
 		&ml) == -1);
 	unit_assert(ml == 3);
 
 	/* but lowercase/uppercase does not make a difference. */
 	unit_assert(dname_lab_cmp(
-		(uint8_t*)"\003bLa\007examPLe\003net", 4, 
-		(uint8_t*)"\003bla\007eXAmple\003nET", 4, 
+		(uint8_t*)"\003bLa\007examPLe\003net", 4,
+		(uint8_t*)"\003bla\007eXAmple\003nET", 4,
 		&ml) == 0);
 	unit_assert(ml == 4);
 }
@@ -734,17 +734,17 @@ dname_test_topdomain(void)
 	unit_assert( query_dname_compare(
 		dname_get_shared_topdomain(
 			(uint8_t*)"",
-			(uint8_t*)""), 
+			(uint8_t*)""),
 		(uint8_t*)"") == 0);
 	unit_assert( query_dname_compare(
 		dname_get_shared_topdomain(
 			(uint8_t*)"\003www\007example\003com",
-			(uint8_t*)"\003www\007example\003com"), 
+			(uint8_t*)"\003www\007example\003com"),
 		(uint8_t*)"\003www\007example\003com") == 0);
 	unit_assert( query_dname_compare(
 		dname_get_shared_topdomain(
 			(uint8_t*)"\003www\007example\003com",
-			(uint8_t*)"\003bla\007example\003com"), 
+			(uint8_t*)"\003bla\007example\003com"),
 		(uint8_t*)"\007example\003com") == 0);
 }
 
@@ -753,7 +753,7 @@ static void
 dname_test_valid(void)
 {
 	unit_show_func("util/data/dname.c", "dname_valid");
-	unit_assert( dname_valid( 
+	unit_assert( dname_valid(
 			(uint8_t*)"\003www\007example\003com", 255) == 17);
 	unit_assert( dname_valid((uint8_t*)"", 255) == 1);
 	unit_assert( dname_valid( (uint8_t*)
diff --git a/usr.sbin/unbound/testcode/unitecs.c b/usr.sbin/unbound/testcode/unitecs.c
index 68d6907f8..736f88cc7 100644
--- a/usr.sbin/unbound/testcode/unitecs.c
+++ b/usr.sbin/unbound/testcode/unitecs.c
@@ -33,10 +33,10 @@
  * POSSIBILITY OF SUCH DAMAGE.
  *
  */
- 
+
 /**
  * \file
- * Calls ecs related unit tests. Exits with code 1 on a failure. 
+ * Calls ecs related unit tests. Exits with code 1 on a failure.
  */
 
 #include "config.h"
@@ -76,22 +76,22 @@
 			if (node->edge[i]) {
 				for (s = 0; s < indent; s++) printf(" ");
 				printkey(node->edge[i]->str, node->edge[i]->len);
-				printf("(len %d bits, %d bytes) ", node->edge[i]->len, 
+				printf("(len %d bits, %d bytes) ", node->edge[i]->len,
 					node->edge[i]->len/8 + ((node->edge[i]->len%8)>0));
 				print_tree(node->edge[i]->node, indent+1, maxdepth);
 			}
-		}	
+		}
 		if (indent == 0) printf("-----Tree-----");
 	}
 */
 
 /* what should we check?
- * X - is it balanced? (a node with 1 child should not have  
+ * X - is it balanced? (a node with 1 child should not have
  * a node with 1 child MUST have elem
  * child must be sub of parent
  * edge must be longer than parent edge
  * */
-static int addrtree_inconsistent_subtree(struct addrtree* tree, 
+static int addrtree_inconsistent_subtree(struct addrtree* tree,
 	struct addredge* parent_edge, addrlen_t depth)
 {
 	struct addredge* edge;
@@ -120,10 +120,10 @@ static int addrtree_inconsistent(struct addrtree* tree)
 {
 	struct addredge* edge;
 	int i, r;
-	
+
 	if (!tree) return 0;
 	if (!tree->root) return 1;
-	
+
 	for (i = 0; i<2; i++) {
 		edge = tree->root->edge[i];
 		if (!edge) continue;
@@ -240,7 +240,7 @@ static void bits_common_test(void)
 	addrkey_t k1[] = {0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0xDE, 0xF0};
 	addrkey_t k2[] = {0,0,0,0,0,0,0,0};
 	addrlen_t i;
-	
+
 	unit_show_func("edns-subnet/addrtree.h", "bits_common");
 	for(i = 0; i<64; i++) {
 		unit_assert( unittest_wrapper_addrtree_bits_common(k1, 64, k1, 64, i) == 64 );
@@ -263,7 +263,7 @@ static void cmpbit_test(void)
 	addrkey_t k1[] = {0xA5, 0x0F};
 	addrkey_t k2[] = {0x5A, 0xF0};
 	addrlen_t i;
-	
+
 	unit_show_func("edns-subnet/addrtree.h", "cmpbit");
 	for(i = 0; i<16; i++) {
 		unit_assert( !unittest_wrapper_addrtree_cmpbit(k1,k1,i) );
diff --git a/usr.sbin/unbound/testcode/unitldns.c b/usr.sbin/unbound/testcode/unitldns.c
index d226ee203..cdd71a607 100644
--- a/usr.sbin/unbound/testcode/unitldns.c
+++ b/usr.sbin/unbound/testcode/unitldns.c
@@ -35,7 +35,7 @@
  */
 /**
  * \file
- * Calls ldns unit tests. Exits with code 1 on a failure. 
+ * Calls ldns unit tests. Exits with code 1 on a failure.
  */
 
 #include "config.h"
@@ -73,7 +73,7 @@ buf_to_hex(uint8_t* b, size_t blen, char* s, size_t slen)
  * @param bufs: size of the text buffers.
  */
 static void
-rr_transform(char* txt_in, char* wire1, char* txt_out, char* wire2, 
+rr_transform(char* txt_in, char* wire1, char* txt_out, char* wire2,
 	size_t bufs)
 {
 	uint8_t b[65536];
@@ -188,7 +188,7 @@ rr_test_file(const char* input, const char* check)
 			rr_checks(wire_chk, txt_chk, txt_out, wire_out, back);
 		}
 	}
-	
+
 	if(of) fclose(of);
 	fclose(inf);
 	fclose(chf);
diff --git a/usr.sbin/unbound/testcode/unitlruhash.c b/usr.sbin/unbound/testcode/unitlruhash.c
index e196f0b63..1c6e2cfe7 100644
--- a/usr.sbin/unbound/testcode/unitlruhash.c
+++ b/usr.sbin/unbound/testcode/unitlruhash.c
@@ -69,7 +69,7 @@ static testkey_type* newkey(int id) {
 }
 /** new data el */
 static testdata_type* newdata(int val) {
-	testdata_type* d = (testdata_type*)calloc(1, 
+	testdata_type* d = (testdata_type*)calloc(1,
 		sizeof(testdata_type));
 	if(!d) fatal_exit("out of memory");
 	d->data = val;
@@ -137,7 +137,7 @@ test_bin_find_entry(struct lruhash* table)
 	unit_assert( bin_find_entry(table, &bin, h, k) == &k->entry );
 
 	/* remove middle element */
-	unit_assert( bin_find_entry(table, &bin, k4->entry.hash, k4) 
+	unit_assert( bin_find_entry(table, &bin, k4->entry.hash, k4)
 		== &k4->entry );
 	lock_quick_lock(&bin.lock);
 	bin_overflow_remove(&bin, &k4->entry);
@@ -171,7 +171,7 @@ static void test_lru(struct lruhash* table)
 
 	/* add one */
 	lru_front(table, &k->entry);
-	unit_assert( table->lru_start == &k->entry && 
+	unit_assert( table->lru_start == &k->entry &&
 		table->lru_end == &k->entry);
 	/* remove it */
 	lru_remove(table, &k->entry);
@@ -179,21 +179,21 @@ static void test_lru(struct lruhash* table)
 
 	/* add two */
 	lru_front(table, &k->entry);
-	unit_assert( table->lru_start == &k->entry && 
+	unit_assert( table->lru_start == &k->entry &&
 		table->lru_end == &k->entry);
 	lru_front(table, &k2->entry);
-	unit_assert( table->lru_start == &k2->entry && 
+	unit_assert( table->lru_start == &k2->entry &&
 		table->lru_end == &k->entry);
 	/* remove first in list */
 	lru_remove(table, &k2->entry);
-	unit_assert( table->lru_start == &k->entry && 
+	unit_assert( table->lru_start == &k->entry &&
 		table->lru_end == &k->entry);
 	lru_front(table, &k2->entry);
-	unit_assert( table->lru_start == &k2->entry && 
+	unit_assert( table->lru_start == &k2->entry &&
 		table->lru_end == &k->entry);
 	/* remove last in list */
 	lru_remove(table, &k->entry);
-	unit_assert( table->lru_start == &k2->entry && 
+	unit_assert( table->lru_start == &k2->entry &&
 		table->lru_end == &k2->entry);
 
 	/* empty the list */
@@ -206,19 +206,19 @@ static void test_lru(struct lruhash* table)
 
 /** test hashtable using short sequence */
 static void
-test_short_table(struct lruhash* table) 
+test_short_table(struct lruhash* table)
 {
 	testkey_type* k = newkey(12);
 	testkey_type* k2 = newkey(14);
 	testdata_type* d = newdata(128);
 	testdata_type* d2 = newdata(129);
-	
+
 	k->entry.data = d;
 	k2->entry.data = d2;
 
 	lruhash_insert(table, myhash(12), &k->entry, d, NULL);
 	lruhash_insert(table, myhash(14), &k2->entry, d2, NULL);
-	
+
 	unit_assert( lruhash_lookup(table, myhash(12), k, 0) == &k->entry);
 	lock_rw_unlock( &k->entry.lock );
 	unit_assert( lruhash_lookup(table, myhash(14), k2, 0) == &k2->entry);
@@ -303,7 +303,7 @@ check_table(struct lruhash* table)
 	unit_assert(c == table->num);
 
 	/* this assertion is specific to the unit test */
-	unit_assert( table->space_used == 
+	unit_assert( table->space_used ==
 		table->num * test_slabhash_sizefunc(NULL, NULL) );
 	lock_quick_unlock(&table->lock);
 }
@@ -345,7 +345,7 @@ testlookup_unlim(struct lruhash* table, testdata_type** ref)
 		unit_assert(en->key);
 		unit_assert(en->data);
 	}
-	if(0 && ref) log_info("lookup unlim %d got %d, expect %d", num, en ? 
+	if(0 && ref) log_info("lookup unlim %d got %d, expect %d", num, en ?
 		data->data :-1, ref[num] ? ref[num]->data : -1);
 	if(data && ref) {
 		/* its okay for !data, it fell off the lru */
@@ -357,14 +357,14 @@ testlookup_unlim(struct lruhash* table, testdata_type** ref)
 
 /** test with long sequence of adds, removes and updates, and lookups */
 static void
-test_long_table(struct lruhash* table) 
+test_long_table(struct lruhash* table)
 {
 	/* assuming it all fits in the hashtable, this check will work */
 	testdata_type* ref[HASHTESTMAX * 100];
 	size_t i;
 	memset(ref, 0, sizeof(ref));
 	/* test assumption */
-	if(0) log_info(" size %d x %d < %d", (int)test_slabhash_sizefunc(NULL, NULL), 
+	if(0) log_info(" size %d x %d < %d", (int)test_slabhash_sizefunc(NULL, NULL),
 		(int)HASHTESTMAX, (int)table->space_max);
 	unit_assert( test_slabhash_sizefunc(NULL, NULL)*HASHTESTMAX < table->space_max);
 	if(0) lruhash_status(table, "unit test", 1);
@@ -429,7 +429,7 @@ struct test_thr {
 
 /** main routine for threaded hash table test */
 static void*
-test_thr_main(void* arg) 
+test_thr_main(void* arg)
 {
 	struct test_thr* t = (struct test_thr*)arg;
 	int i;
@@ -483,16 +483,16 @@ void lruhash_test(void)
 	/* also small in size so that reclaim has to be done quickly. */
 	struct lruhash* table ;
 	unit_show_feature("lruhash");
-	table = lruhash_create(2, 8192, 
-		test_slabhash_sizefunc, test_slabhash_compfunc, 
+	table = lruhash_create(2, 8192,
+		test_slabhash_sizefunc, test_slabhash_compfunc,
 		test_slabhash_delkey, test_slabhash_deldata, NULL);
 	test_bin_find_entry(table);
 	test_lru(table);
 	test_short_table(table);
 	test_long_table(table);
 	lruhash_delete(table);
-	table = lruhash_create(2, 8192, 
-		test_slabhash_sizefunc, test_slabhash_compfunc, 
+	table = lruhash_create(2, 8192,
+		test_slabhash_sizefunc, test_slabhash_compfunc,
 		test_slabhash_delkey, test_slabhash_deldata, NULL);
 	test_threaded_table(table);
 	lruhash_delete(table);
diff --git a/usr.sbin/unbound/testcode/unitmain.c b/usr.sbin/unbound/testcode/unitmain.c
index b6dac5507..195e19b69 100644
--- a/usr.sbin/unbound/testcode/unitmain.c
+++ b/usr.sbin/unbound/testcode/unitmain.c
@@ -110,7 +110,7 @@ alloc_test(void) {
 
 #include "util/net_help.h"
 /** test net code */
-static void 
+static void
 net_test(void)
 {
 	const char* t4[] = {"\000\000\000\000",
@@ -344,7 +344,7 @@ net_test(void)
 #include "util/config_file.h"
 /** test config_file: cfg_parse_memsize */
 static void
-config_memsize_test(void) 
+config_memsize_test(void)
 {
 	size_t v = 0;
 	unit_show_func("util/config_file.c", "cfg_parse_memsize");
@@ -382,7 +382,7 @@ config_memsize_test(void)
 
 /** test config_file: test tag code */
 static void
-config_tag_test(void) 
+config_tag_test(void)
 {
 	unit_show_func("util/config_file.c", "taglist_intersect");
 	unit_assert( taglist_intersect(
@@ -401,7 +401,7 @@ config_tag_test(void)
 		(uint8_t*)"\001\000\001", 3, (uint8_t*)"\001", 1
 		) == 1);
 }
-	
+
 #include "util/rtt.h"
 #include "util/timehist.h"
 #include "iterator/iterator.h"
@@ -425,7 +425,7 @@ rtt_test(void)
 	unit_assert( rtt_timeout(&r) >= 2000 );
 	rtt_lost(&r, rtt_timeout(&r) );
 	for(i=0; i<100; i++) {
-		rtt_lost(&r, rtt_timeout(&r) ); 
+		rtt_lost(&r, rtt_timeout(&r) );
 		unit_assert( rtt_timeout(&r) > RTT_MIN_TIMEOUT-1);
 		unit_assert( rtt_timeout(&r) < RTT_MAX_TIMEOUT+1);
 	}
@@ -479,20 +479,20 @@ infra_test(void)
 	unit_assert( vs == 0 && to == init && edns_lame == 0 );
 
 	unit_assert( infra_rtt_update(slab, &one, onelen, zone, zonelen, LDNS_RR_TYPE_A, -1, init, now) );
-	unit_assert( infra_host(slab, &one, onelen, zone, zonelen, 
+	unit_assert( infra_host(slab, &one, onelen, zone, zonelen,
 			now, &vs, &edns_lame, &to) );
 	unit_assert( vs == 0 && to == init*2 && edns_lame == 0 );
 
 	unit_assert( infra_edns_update(slab, &one, onelen, zone, zonelen, -1, now) );
-	unit_assert( infra_host(slab, &one, onelen, zone, zonelen, 
+	unit_assert( infra_host(slab, &one, onelen, zone, zonelen,
 			now, &vs, &edns_lame, &to) );
 	unit_assert( vs == -1 && to == init*2  && edns_lame == 1);
 
 	now += cfg->host_ttl + 10;
-	unit_assert( infra_host(slab, &one, onelen, zone, zonelen, 
+	unit_assert( infra_host(slab, &one, onelen, zone, zonelen,
 			now, &vs, &edns_lame, &to) );
 	unit_assert( vs == 0 && to == init && edns_lame == 0 );
-	
+
 	unit_assert( infra_set_lame(slab, &one, onelen,
 		zone, zonelen,  now, 0, 0, LDNS_RR_TYPE_A) );
 	unit_assert( (d=infra_lookup_host(slab, &one, onelen, zone, zonelen, 0, now, &k)) );
@@ -512,17 +512,17 @@ infra_test(void)
 
 	/* test that noEDNS cannot overwrite known-yesEDNS */
 	now += cfg->host_ttl + 10;
-	unit_assert( infra_host(slab, &one, onelen, zone, zonelen, 
+	unit_assert( infra_host(slab, &one, onelen, zone, zonelen,
 			now, &vs, &edns_lame, &to) );
 	unit_assert( vs == 0 && to == init && edns_lame == 0 );
 
 	unit_assert( infra_edns_update(slab, &one, onelen, zone, zonelen, 0, now) );
-	unit_assert( infra_host(slab, &one, onelen, zone, zonelen, 
+	unit_assert( infra_host(slab, &one, onelen, zone, zonelen,
 			now, &vs, &edns_lame, &to) );
 	unit_assert( vs == 0 && to == init && edns_lame == 1 );
 
 	unit_assert( infra_edns_update(slab, &one, onelen, zone, zonelen, -1, now) );
-	unit_assert( infra_host(slab, &one, onelen, zone, zonelen, 
+	unit_assert( infra_host(slab, &one, onelen, zone, zonelen,
 			now, &vs, &edns_lame, &to) );
 	unit_assert( vs == 0 && to == init && edns_lame == 1 );
 
@@ -858,7 +858,7 @@ void ecdsa_evp_workaround_init(void);
  * @param argv: array of commandline arguments.
  * @return program failure if test fails.
  */
-int 
+int
 main(int argc, char* argv[])
 {
 	checklock_start();
diff --git a/usr.sbin/unbound/testcode/unitmsgparse.c b/usr.sbin/unbound/testcode/unitmsgparse.c
index a87314019..aa5b6bad5 100644
--- a/usr.sbin/unbound/testcode/unitmsgparse.c
+++ b/usr.sbin/unbound/testcode/unitmsgparse.c
@@ -35,7 +35,7 @@
  */
 /**
  * \file
- * Calls msg parse unit tests. Exits with code 1 on a failure. 
+ * Calls msg parse unit tests. Exits with code 1 on a failure.
  */
 
 #include "config.h"
@@ -88,7 +88,7 @@ test_buffers(sldns_buffer* pkt, sldns_buffer* out)
 		for(count=0; count<lim; count+=sz) {
 			size_t rem = sz;
 			if(lim-count < sz) rem = lim-count;
-			if(memcmp(sldns_buffer_at(pkt, count), 
+			if(memcmp(sldns_buffer_at(pkt, count),
 				sldns_buffer_at(out, count), rem) == 0) {
 				log_info("same %d %d", (int)count, (int)rem);
 				log_hex("same: ", sldns_buffer_at(pkt, count),
@@ -108,14 +108,14 @@ test_buffers(sldns_buffer* pkt, sldns_buffer* out)
 		char* s1, *s2;
 		log_buf(0, "orig in hex", pkt);
 		log_buf(0, "unbound out in hex", out);
-		printf("\npacket from unbound (%d):\n", 
+		printf("\npacket from unbound (%d):\n",
 			(int)sldns_buffer_limit(out));
 		s1 = sldns_wire2str_pkt(sldns_buffer_begin(out),
 			sldns_buffer_limit(out));
 		printf("%s\n", s1?s1:"null");
 		free(s1);
 
-		printf("\npacket original (%d):\n", 
+		printf("\npacket original (%d):\n",
 			(int)sldns_buffer_limit(pkt));
 		s2 = sldns_wire2str_pkt(sldns_buffer_begin(pkt),
 			sldns_buffer_limit(pkt));
@@ -163,8 +163,8 @@ checkformerr(sldns_buffer* pkt)
 
 /** performance test message encoding */
 static void
-perf_encode(struct query_info* qi, struct reply_info* rep, uint16_t id, 
-	uint16_t flags, sldns_buffer* out, time_t timenow, 
+perf_encode(struct query_info* qi, struct reply_info* rep, uint16_t id,
+	uint16_t flags, sldns_buffer* out, time_t timenow,
 	struct edns_data* edns)
 {
 	static int num = 0;
@@ -187,17 +187,17 @@ perf_encode(struct query_info* qi, struct reply_info* rep, uint16_t id,
 	if(gettimeofday(&end, NULL) < 0)
 		fatal_exit("gettimeofday: %s", strerror(errno));
 	/* time in millisec */
-	dt = (double)(end.tv_sec - start.tv_sec)*1000. + 
+	dt = (double)(end.tv_sec - start.tv_sec)*1000. +
 		((double)end.tv_usec - (double)start.tv_usec)/1000.;
 	printf("[%d] did %u in %g msec for %f encode/sec size %d\n", num++,
-		(unsigned)max, dt, (double)max / (dt/1000.), 
+		(unsigned)max, dt, (double)max / (dt/1000.),
 		(int)sldns_buffer_limit(out));
 	regional_destroy(r2);
 }
 
 /** perf test a packet */
 static void
-perftestpkt(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out, 
+perftestpkt(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out,
 	const char* hex)
 {
 	struct query_info qi;
@@ -225,7 +225,7 @@ perftestpkt(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out,
 		unit_assert(ret != LDNS_RCODE_SERVFAIL);
 	} else {
 		perf_encode(&qi, rep, id, flags, out, timenow, &edns);
-	} 
+	}
 
 	query_info_clear(&qi);
 	reply_info_parsedelete(rep, alloc);
@@ -280,7 +280,7 @@ no_data_for_rrsig(struct reply_info* rep, struct ub_packed_rrset_key* rrsig)
 	for(i=0; i<rep->rrset_count; i++) {
 		if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_RRSIG)
 			continue;
-		if(query_dname_compare(rep->rrsets[i]->rk.dname, 
+		if(query_dname_compare(rep->rrsets[i]->rk.dname,
 			rrsig->rk.dname) == 0)
 			/* only name is compared right now */
 			return 0;
@@ -311,7 +311,7 @@ check_the_rrsigs(struct query_info* qinfo, struct reply_info* rep)
 
 /** test a packet */
 static void
-testpkt(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out, 
+testpkt(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out,
 	const char* hex)
 {
 	struct query_info qi;
@@ -345,7 +345,7 @@ testpkt(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out,
 			region, 65535, (int)(edns.bits & EDNS_DO), 0);
 		unit_assert(ret != 0); /* udp packets should fit */
 		attach_edns_record(out, &edns);
-		if(vbmp) printf("inlen %u outlen %u\n", 
+		if(vbmp) printf("inlen %u outlen %u\n",
 			(unsigned)sldns_buffer_limit(pkt),
 			(unsigned)sldns_buffer_limit(out));
 		if(!check_nosameness)
@@ -354,8 +354,8 @@ testpkt(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out,
 			check_the_rrsigs(&qi, rep);
 
 		if(sldns_buffer_limit(out) > lim) {
-			ret = reply_info_encode(&qi, rep, id, flags, out, 
-				timenow, region, 
+			ret = reply_info_encode(&qi, rep, id, flags, out,
+				timenow, region,
 				lim - calc_edns_field_size(&edns),
 				(int)(edns.bits & EDNS_DO), 0);
 			unit_assert(ret != 0); /* should fit, but with TC */
@@ -371,7 +371,7 @@ testpkt(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out,
 				/* must set TC bit if shortened */
 			unit_assert(sldns_buffer_limit(out) <= lim);
 		}
-	} 
+	}
 
 	query_info_clear(&qi);
 	reply_info_parsedelete(rep, alloc);
@@ -383,11 +383,11 @@ static void
 simpletest(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out)
 {
 	/* a root query  drill -q - */
-	testpkt(pkt, alloc, out, 
+	testpkt(pkt, alloc, out,
 		" c5 40 01 00 00 01 00 00 00 00 00 00 00 00 02 00 01 ");
 
 	/* very small packet */
-	testpkt(pkt, alloc, out, 
+	testpkt(pkt, alloc, out,
 "; 0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19\n"
 ";-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --\n"
 "74 0c 85 83 00 01 00 00 00 01 00 00 03 62 6c 61 09 6e 6c 6e    ;          1-  20\n"
@@ -397,9 +397,9 @@ simpletest(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out)
 "73 74 6d 61 73 74 65 72 09 6e 6c 6e 65 74 6c 61 62 73 02 6e    ;         81- 100\n"
 "6c 00 77 a1 02 58 00 00 70 80 00 00 1c 20 00 09 3a 80 00 00    ;        101- 120\n"
 "46 50\n");
-	
+
 	/* a root reply  drill -w - */
-	testpkt(pkt, alloc, out, 
+	testpkt(pkt, alloc, out,
 	" ; 0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19\n"
 	" ;-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --\n"
 	" 97 3f 81 80 00 01 00 0d 00 00 00 02 00 00 02 00 01 00 00 02    ;          1-  20\n"
@@ -464,7 +464,7 @@ testfromfile(sldns_buffer* pkt, struct alloc_cache* alloc, sldns_buffer* out,
 
 /** simple test of parsing, drill file */
 static void
-testfromdrillfile(sldns_buffer* pkt, struct alloc_cache* alloc, 
+testfromdrillfile(sldns_buffer* pkt, struct alloc_cache* alloc,
 	sldns_buffer* out, const char* fname)
 {
 	/*  ;-- is used to indicate a new message */
@@ -526,7 +526,7 @@ void msgparse_test(void)
 	check_rrsigs = 1;
 	testfromdrillfile(pkt, &alloc, out, SRCDIRSTR "/testdata/test_packets.7");
 	check_rrsigs = 0;
-	matches_nolocation = 0; 
+	matches_nolocation = 0;
 
 	check_formerr_gone = 1;
 	testfromdrillfile(pkt, &alloc, out, SRCDIRSTR "/testdata/test_packets.8");
diff --git a/usr.sbin/unbound/testcode/unitneg.c b/usr.sbin/unbound/testcode/unitneg.c
index 59c4e8dcc..eb97fbc0b 100644
--- a/usr.sbin/unbound/testcode/unitneg.c
+++ b/usr.sbin/unbound/testcode/unitneg.c
@@ -35,7 +35,7 @@
  */
 /**
  * \file
- * Calls negative cache unit tests. Exits with code 1 on a failure. 
+ * Calls negative cache unit tests. Exits with code 1 on a failure.
  */
 
 #include "config.h"
@@ -165,7 +165,7 @@ static void get_random_data(char** fromp, char** top, char* zname)
 			labnum1[i] = random()%100;
 		for(i=common; i<lab2; i++)
 			labnum2[i] = random()%100;
-	} 
+	}
 
 	/* construct first */
 	p = buf1;
@@ -206,7 +206,7 @@ static void add_item(struct val_neg_cache* neg)
 	lock_basic_lock(&neg->lock);
 	if(negverbose)
 		log_nametypeclass(0, "add to zone", (uint8_t*)zname, 0, 0);
-	z = neg_find_zone(neg, (uint8_t*)zname, strlen(zname)+1, 
+	z = neg_find_zone(neg, (uint8_t*)zname, strlen(zname)+1,
 		LDNS_RR_CLASS_IN);
 	if(!z) {
 		z = neg_create_zone(neg,  (uint8_t*)zname, strlen(zname)+1,
@@ -246,7 +246,7 @@ static void remove_item(struct val_neg_cache* neg)
 	struct val_neg_data* d;
 	rbnode_type* walk;
 	struct val_neg_zone* z;
-	
+
 	lock_basic_lock(&neg->lock);
 	if(neg->tree.count == 0) {
 		lock_basic_unlock(&neg->lock);
@@ -355,14 +355,14 @@ static void check_lru(struct val_neg_cache* neg)
 	inuse = sumtrees_inuse(neg);
 	if(negverbose)
 		printf("num lru %d, inuse %d, all %d\n",
-			(int)num, (int)sumtrees_inuse(neg), 
+			(int)num, (int)sumtrees_inuse(neg),
 			(int)sumtrees_all(neg));
 	unit_assert( num == inuse);
 	unit_assert( inuse <= sumtrees_all(neg));
 }
 
 /** sum up number of items inuse in subtree */
-static int sum_subtree_inuse(struct val_neg_zone* zone, 
+static int sum_subtree_inuse(struct val_neg_zone* zone,
 	struct val_neg_data* data)
 {
 	struct val_neg_data* d;
@@ -425,7 +425,7 @@ static void checkzonetree(struct val_neg_zone* zone)
 }
 
 /** check if negative cache is still valid */
-static void check_zone_invariants(struct val_neg_cache* neg, 
+static void check_zone_invariants(struct val_neg_cache* neg,
 	struct val_neg_zone* zone)
 {
 	unit_assert(zone->nsec3_hash == 0);
@@ -439,14 +439,14 @@ static void check_zone_invariants(struct val_neg_cache* neg,
 			/* details on error */
 			log_nametypeclass(0, "zone", zone->name, 0, 0);
 			log_err("inuse %d count=%d tree.count=%d",
-				zone->in_use, zone->count, 
+				zone->in_use, zone->count,
 				(int)zone->tree.count);
 			if(negverbose)
 				print_neg_cache(neg);
 		}
 		unit_assert(zone->in_use);
 	}
-	
+
 	if(zone->parent) {
 		unit_assert(zone->parent->count >= zone->count);
 		if(zone->parent->in_use) {
@@ -538,7 +538,7 @@ void neg_test(void)
 	/* create with defaults */
 	neg = val_neg_create(NULL, 1500);
 	unit_assert(neg);
-	
+
 	stress_test(neg);
 
 	neg_cache_delete(neg);
diff --git a/usr.sbin/unbound/testcode/unitslabhash.c b/usr.sbin/unbound/testcode/unitslabhash.c
index 565d36139..d11532780 100644
--- a/usr.sbin/unbound/testcode/unitslabhash.c
+++ b/usr.sbin/unbound/testcode/unitslabhash.c
@@ -71,7 +71,7 @@ static testkey_type* newkey(int id) {
 }
 /** new data el */
 static testdata_type* newdata(int val) {
-	testdata_type* d = (testdata_type*)calloc(1, 
+	testdata_type* d = (testdata_type*)calloc(1,
 		sizeof(testdata_type));
 	if(!d) fatal_exit("out of memory");
 	d->data = val;
@@ -80,19 +80,19 @@ static testdata_type* newdata(int val) {
 
 /** test hashtable using short sequence */
 static void
-test_short_table(struct slabhash* table) 
+test_short_table(struct slabhash* table)
 {
 	testkey_type* k = newkey(12);
 	testkey_type* k2 = newkey(14);
 	testdata_type* d = newdata(128);
 	testdata_type* d2 = newdata(129);
-	
+
 	k->entry.data = d;
 	k2->entry.data = d2;
 
 	slabhash_insert(table, myhash(12), &k->entry, d, NULL);
 	slabhash_insert(table, myhash(14), &k2->entry, d2, NULL);
-	
+
 	unit_assert( slabhash_lookup(table, myhash(12), k, 0) == &k->entry);
 	lock_rw_unlock( &k->entry.lock );
 	unit_assert( slabhash_lookup(table, myhash(14), k2, 0) == &k2->entry);
@@ -177,7 +177,7 @@ check_lru_table(struct lruhash* table)
 	unit_assert(c == table->num);
 
 	/* this assertion is specific to the unit test */
-	unit_assert( table->space_used == 
+	unit_assert( table->space_used ==
 		table->num * test_slabhash_sizefunc(NULL, NULL) );
 	lock_quick_unlock(&table->lock);
 }
@@ -228,7 +228,7 @@ testlookup_unlim(struct slabhash* table, testdata_type** ref)
 		unit_assert(en->key);
 		unit_assert(en->data);
 	}
-	if(0 && ref) log_info("lookup unlim %d got %d, expect %d", num, en ? 
+	if(0 && ref) log_info("lookup unlim %d got %d, expect %d", num, en ?
 		data->data :-1, ref[num] ? ref[num]->data : -1);
 	if(data && ref) {
 		/* its okay for !data, it fell off the lru */
@@ -240,7 +240,7 @@ testlookup_unlim(struct slabhash* table, testdata_type** ref)
 
 /** test with long sequence of adds, removes and updates, and lookups */
 static void
-test_long_table(struct slabhash* table) 
+test_long_table(struct slabhash* table)
 {
 	/* assuming it all fits in the hashtable, this check will work */
 	testdata_type* ref[HASHTESTMAX * 100];
@@ -308,7 +308,7 @@ struct slab_test_thr {
 
 /** main routine for threaded hash table test */
 static void*
-test_thr_main(void* arg) 
+test_thr_main(void* arg)
 {
 	struct slab_test_thr* t = (struct slab_test_thr*)arg;
 	int i;
@@ -362,14 +362,14 @@ void slabhash_test(void)
 	/* also small in size so that reclaim has to be done quickly. */
 	struct slabhash* table;
 	unit_show_feature("slabhash");
-	table = slabhash_create(4, 2, 10400, 
-		test_slabhash_sizefunc, test_slabhash_compfunc, 
+	table = slabhash_create(4, 2, 10400,
+		test_slabhash_sizefunc, test_slabhash_compfunc,
 		test_slabhash_delkey, test_slabhash_deldata, NULL);
 	test_short_table(table);
 	test_long_table(table);
 	slabhash_delete(table);
-	table = slabhash_create(4, 2, 10400, 
-		test_slabhash_sizefunc, test_slabhash_compfunc, 
+	table = slabhash_create(4, 2, 10400,
+		test_slabhash_sizefunc, test_slabhash_compfunc,
 		test_slabhash_delkey, test_slabhash_deldata, NULL);
 	test_threaded_table(table);
 	slabhash_delete(table);
diff --git a/usr.sbin/unbound/testcode/unitverify.c b/usr.sbin/unbound/testcode/unitverify.c
index ff069a1bb..3376d3299 100644
--- a/usr.sbin/unbound/testcode/unitverify.c
+++ b/usr.sbin/unbound/testcode/unitverify.c
@@ -35,7 +35,7 @@
  */
 /**
  * \file
- * Calls verification unit tests. Exits with code 1 on a failure. 
+ * Calls verification unit tests. Exits with code 1 on a failure.
  */
 
 #include "config.h"
@@ -81,14 +81,14 @@ entry_to_buf(struct entry* e, sldns_buffer* pkt)
 
 /** entry to reply info conversion */
 static void
-entry_to_repinfo(struct entry* e, struct alloc_cache* alloc, 
-	struct regional* region, sldns_buffer* pkt, struct query_info* qi, 
+entry_to_repinfo(struct entry* e, struct alloc_cache* alloc,
+	struct regional* region, sldns_buffer* pkt, struct query_info* qi,
 	struct reply_info** rep)
 {
 	int ret;
 	struct edns_data edns;
 	entry_to_buf(e, pkt);
-	/* lock alloc lock to please lock checking software. 
+	/* lock alloc lock to please lock checking software.
 	 * alloc_special_obtain assumes it is talking to a ub-alloc,
 	 * and does not need to perform locking. Here the alloc is
 	 * the only one, so we lock it here */
@@ -104,8 +104,8 @@ entry_to_repinfo(struct entry* e, struct alloc_cache* alloc,
 }
 
 /** extract DNSKEY rrset from answer and convert it */
-static struct ub_packed_rrset_key* 
-extract_keys(struct entry* e, struct alloc_cache* alloc, 
+static struct ub_packed_rrset_key*
+extract_keys(struct entry* e, struct alloc_cache* alloc,
 	struct regional* region, sldns_buffer* pkt)
 {
 	struct ub_packed_rrset_key* dnskey = NULL;
@@ -173,7 +173,7 @@ setup_sigalg(struct ub_packed_rrset_key* dnskey, uint8_t* sigalg)
 
 /** verify and test one rrset against the key rrset */
 static void
-verifytest_rrset(struct module_env* env, struct val_env* ve, 
+verifytest_rrset(struct module_env* env, struct val_env* ve,
 	struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* dnskey,
 	struct query_info* qinfo)
 {
@@ -202,9 +202,9 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 
 /** verify and test an entry - every rr in the message */
 static void
-verifytest_entry(struct entry* e, struct alloc_cache* alloc, 
-	struct regional* region, sldns_buffer* pkt, 
-	struct ub_packed_rrset_key* dnskey, struct module_env* env, 
+verifytest_entry(struct entry* e, struct alloc_cache* alloc,
+	struct regional* region, sldns_buffer* pkt,
+	struct ub_packed_rrset_key* dnskey, struct module_env* env,
 	struct val_env* ve)
 {
 	struct query_info qinfo;
@@ -242,7 +242,7 @@ find_rrset_type(struct reply_info* rep, uint16_t type)
 
 /** DS sig test an entry - get DNSKEY and DS in entry and verify */
 static void
-dstest_entry(struct entry* e, struct alloc_cache* alloc, 
+dstest_entry(struct entry* e, struct alloc_cache* alloc,
 	struct regional* region, sldns_buffer* pkt, struct module_env* env)
 {
 	struct query_info qinfo;
@@ -287,7 +287,7 @@ dstest_entry(struct entry* e, struct alloc_cache* alloc,
 static void
 verifytest_file(const char* fname, const char* at_date)
 {
-	/* 
+	/*
 	 * The file contains a list of ldns-testpkts entries.
 	 * The first entry must be a query for DNSKEY.
 	 * The answer rrset is the keyset that will be used for verification
@@ -315,7 +315,7 @@ verifytest_file(const char* fname, const char* at_date)
 	unit_assert(region && buf);
 	dnskey = extract_keys(list, &alloc, region, buf);
 	if(vsig) log_nametypeclass(VERB_QUERY, "test dnskey",
-			dnskey->rk.dname, ntohs(dnskey->rk.type), 
+			dnskey->rk.dname, ntohs(dnskey->rk.type),
 			ntohs(dnskey->rk.rrset_class));
 	/* ready to go! */
 	for(e = list->next; e; e = e->next) {
@@ -333,7 +333,7 @@ verifytest_file(const char* fname, const char* at_date)
 static void
 dstest_file(const char* fname)
 {
-	/* 
+	/*
 	 * The file contains a list of ldns-testpkts entries.
 	 * The first entry must be a query for DNSKEY.
 	 * The answer rrset is the keyset that will be used for verification
@@ -417,7 +417,7 @@ nsectest(void)
 /** Test hash algo - NSEC3 hash it and compare result */
 static void
 nsec3_hash_test_entry(struct entry* e, rbtree_type* ct,
-	struct alloc_cache* alloc, struct regional* region, 
+	struct alloc_cache* alloc, struct regional* region,
 	sldns_buffer* buf)
 {
 	struct query_info qinfo;
@@ -450,7 +450,7 @@ nsec3_hash_test_entry(struct entry* e, rbtree_type* ct,
 		hash->b32 && hash->b32_len);
 	unit_assert(hash->b32_len == (size_t)answer->rk.dname[0]);
 	/* does not do lowercasing. */
-	unit_assert(memcmp(hash->b32, answer->rk.dname+1, hash->b32_len) 
+	unit_assert(memcmp(hash->b32, answer->rk.dname+1, hash->b32_len)
 		== 0);
 
 	reply_info_parsedelete(rep, alloc);
@@ -462,7 +462,7 @@ nsec3_hash_test_entry(struct entry* e, rbtree_type* ct,
 static void
 nsec3_hash_test(const char* fname)
 {
-	/* 
+	/*
 	 * The list contains a list of ldns-testpkts entries.
 	 * Every entry is a test.
 	 * 	The qname is hashed.
@@ -502,7 +502,7 @@ nsec3_hash_test(const char* fname)
 
 #define SRCDIRSTR xstr(SRCDIR)
 
-void 
+void
 verify_test(void)
 {
 	unit_show_feature("signature verify");
diff --git a/usr.sbin/unbound/util/alloc.c b/usr.sbin/unbound/util/alloc.c
index 7e9618931..75ce23acf 100644
--- a/usr.sbin/unbound/util/alloc.c
+++ b/usr.sbin/unbound/util/alloc.c
@@ -1,25 +1,25 @@
 /*
- * util/alloc.c - memory allocation service. 
+ * util/alloc.c - memory allocation service.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -59,7 +59,7 @@ alloc_setup_special(alloc_special_type* t)
 	t->entry.key = t;
 }
 
-/** prealloc some entries in the cache. To minimize contention. 
+/** prealloc some entries in the cache. To minimize contention.
  * Result is 1 lock per alloc_max newly created entries.
  * @param alloc: the structure to fill up.
  */
@@ -99,7 +99,7 @@ prealloc_blocks(struct alloc_cache* alloc, size_t num)
 	}
 }
 
-void 
+void
 alloc_init(struct alloc_cache* alloc, struct alloc_cache* super,
 	int thread_num)
 {
@@ -156,7 +156,7 @@ alloc_clear_special(struct alloc_cache* alloc)
 	}
 }
 
-void 
+void
 alloc_clear(struct alloc_cache* alloc)
 {
 	alloc_special_type* p;
@@ -201,7 +201,7 @@ alloc_get_id(struct alloc_cache* alloc)
 		(*alloc->cleanup)(alloc->cleanup_arg);
 
 		/* start back at first number */   	/* like in alloc_init*/
-		alloc->next_id = (uint64_t)alloc->thread_num; 	
+		alloc->next_id = (uint64_t)alloc->thread_num;
 		alloc->next_id <<= THRNUM_SHIFT; 	/* in steps for comp. */
 		alloc->next_id += 1;			/* portability. */
 		/* and generate new and safe id */
@@ -210,7 +210,7 @@ alloc_get_id(struct alloc_cache* alloc)
 	return id;
 }
 
-alloc_special_type* 
+alloc_special_type*
 alloc_special_obtain(struct alloc_cache* alloc)
 {
 	alloc_special_type* p;
@@ -250,13 +250,13 @@ alloc_special_obtain(struct alloc_cache* alloc)
 }
 
 /** push mem and some more items to the super */
-static void 
+static void
 pushintosuper(struct alloc_cache* alloc, alloc_special_type* mem)
 {
 	int i;
 	alloc_special_type *p = alloc->quar;
 	log_assert(p);
-	log_assert(alloc && alloc->super && 
+	log_assert(alloc && alloc->super &&
 		alloc->num_quar >= ALLOC_SPECIAL_MAX);
 	/* push ALLOC_SPECIAL_MAX/2 after mem */
 	alloc_set_special_next(mem, alloc->quar);
@@ -275,13 +275,13 @@ pushintosuper(struct alloc_cache* alloc, alloc_special_type* mem)
 	/* so 1 lock per mem+alloc/2 deletes */
 }
 
-void 
+void
 alloc_special_release(struct alloc_cache* alloc, alloc_special_type* mem)
 {
 	log_assert(alloc);
 	if(!mem)
 		return;
-	if(!alloc->super) { 
+	if(!alloc->super) {
 		lock_quick_lock(&alloc->lock); /* superalloc needs locking */
 	}
 
@@ -300,7 +300,7 @@ alloc_special_release(struct alloc_cache* alloc, alloc_special_type* mem)
 	}
 }
 
-void 
+void
 alloc_stats(struct alloc_cache* alloc)
 {
 	log_info("%salloc: %d in cache, %d blocks.", alloc->super?"":"sup",
@@ -311,7 +311,7 @@ size_t alloc_get_mem(struct alloc_cache* alloc)
 {
 	alloc_special_type* p;
 	size_t s = sizeof(*alloc);
-	if(!alloc->super) { 
+	if(!alloc->super) {
 		lock_quick_lock(&alloc->lock); /* superalloc needs locking */
 	}
 	s += sizeof(alloc_special_type) * alloc->num_quar;
@@ -325,7 +325,7 @@ size_t alloc_get_mem(struct alloc_cache* alloc)
 	return s;
 }
 
-struct regional* 
+struct regional*
 alloc_reg_obtain(struct alloc_cache* alloc)
 {
 	if(alloc->num_reg_blocks > 0) {
@@ -338,7 +338,7 @@ alloc_reg_obtain(struct alloc_cache* alloc)
 	return regional_create_custom(ALLOC_REG_SIZE);
 }
 
-void 
+void
 alloc_reg_release(struct alloc_cache* alloc, struct regional* r)
 {
 	if(alloc->num_reg_blocks >= alloc->max_reg_blocks) {
@@ -353,7 +353,7 @@ alloc_reg_release(struct alloc_cache* alloc, struct regional* r)
 	alloc->num_reg_blocks++;
 }
 
-void 
+void
 alloc_set_id_cleanup(struct alloc_cache* alloc, void (*cleanup)(void*),
         void* arg)
 {
@@ -479,7 +479,7 @@ void *unbound_stat_malloc_log(size_t size, const char* file, int line,
 void *unbound_stat_calloc_log(size_t nmemb, size_t size, const char* file,
         int line, const char* func)
 {
-	log_info("%s:%d %s calloc(%u, %u)", file, line, func, 
+	log_info("%s:%d %s calloc(%u, %u)", file, line, func,
 		(unsigned) nmemb, (unsigned)size);
 	return unbound_stat_calloc(nmemb, size);
 }
@@ -491,7 +491,7 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	if(ptr && memcmp(ptr-8, &mem_special, sizeof(mem_special)) == 0) {
 		size_t s;
 		memcpy(&s, ptr-16, sizeof(s));
-		log_info("%s:%d %s free(%p) size %u", 
+		log_info("%s:%d %s free(%p) size %u",
 			file, line, func, ptr, (unsigned)s);
 	} else
 		log_info("%s:%d %s unmatched free(%p)", file, line, func, ptr);
@@ -502,7 +502,7 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
         int line, const char* func)
 {
-	log_info("%s:%d %s realloc(%p, %u)", file, line, func, 
+	log_info("%s:%d %s realloc(%p, %u)", file, line, func,
 		ptr, (unsigned)size);
 	return unbound_stat_realloc(ptr, size);
 }
@@ -570,7 +570,7 @@ void unbound_stat_free_lite(void *ptr, const char* file, int line,
 	if(memcmp(real+lite_pad+orig+sizeof(size_t), lite_post, lite_pad)!=0){
 		log_err("free(): suffix failed %s:%d %s", file, line, func);
 		log_err("alloc size is %d", (int)orig);
-		log_hex("suffix here", real+lite_pad+orig+sizeof(size_t), 
+		log_hex("suffix here", real+lite_pad+orig+sizeof(size_t),
 			lite_pad);
 		log_hex("  should be", lite_post, lite_pad);
 		fatal_exit("alloc assertion failed");
@@ -606,7 +606,7 @@ void *unbound_stat_realloc_lite(void *ptr, size_t size, const char* file,
 	if(memcmp(real+lite_pad+orig+sizeof(size_t), lite_post, lite_pad)!=0){
 		log_err("realloc(): suffix failed %s:%d %s", file, line, func);
 		log_err("alloc size is %d", (int)orig);
-		log_hex("suffix here", real+lite_pad+orig+sizeof(size_t), 
+		log_hex("suffix here", real+lite_pad+orig+sizeof(size_t),
 			lite_pad);
 		log_hex("  should be", lite_post, lite_pad);
 		fatal_exit("alloc assertion failed");
@@ -623,7 +623,7 @@ void *unbound_stat_realloc_lite(void *ptr, size_t size, const char* file,
 	return newa;
 }
 
-char* unbound_strdup_lite(const char* s, const char* file, int line, 
+char* unbound_strdup_lite(const char* s, const char* file, int line,
         const char* func)
 {
 	/* this routine is made to make sure strdup() uses the malloc_lite */
@@ -642,14 +642,14 @@ char* unbound_lite_wrapstr(char* s)
 }
 
 #undef sldns_pkt2wire
-sldns_status unbound_lite_pkt2wire(uint8_t **dest, const sldns_pkt *p, 
+sldns_status unbound_lite_pkt2wire(uint8_t **dest, const sldns_pkt *p,
 	size_t *size)
 {
 	uint8_t* md = NULL;
 	size_t ms = 0;
 	sldns_status s = sldns_pkt2wire(&md, p, &ms);
 	if(md) {
-		*dest = unbound_stat_malloc_lite(ms, __FILE__, __LINE__, 
+		*dest = unbound_stat_malloc_lite(ms, __FILE__, __LINE__,
 			__func__);
 		*size = ms;
 		if(!*dest) { free(md); return LDNS_STATUS_MEM_ERR; }
@@ -668,7 +668,7 @@ int unbound_lite_i2d_DSA_SIG(DSA_SIG* dsasig, unsigned char** sig)
 	unsigned char* n = NULL;
 	int r= i2d_DSA_SIG(dsasig, &n);
 	if(n) {
-		*sig = unbound_stat_malloc_lite((size_t)r, __FILE__, __LINE__, 
+		*sig = unbound_stat_malloc_lite((size_t)r, __FILE__, __LINE__,
 			__func__);
 		if(!*sig) return -1;
 		memcpy(*sig, n, (size_t)r);
diff --git a/usr.sbin/unbound/util/alloc.h b/usr.sbin/unbound/util/alloc.h
index ee03b074e..d65b0df0b 100644
--- a/usr.sbin/unbound/util/alloc.h
+++ b/usr.sbin/unbound/util/alloc.h
@@ -1,25 +1,25 @@
 /*
- * util/alloc.h - memory allocation service. 
+ * util/alloc.h - memory allocation service.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -206,7 +206,7 @@ void *unbound_stat_realloc_lite(void *ptr, size_t size, const char* file,
 #    undef strdup
 #  endif
 #  define strdup(s) unbound_strdup_lite(s, __FILE__, __LINE__, __func__)
-char* unbound_strdup_lite(const char* s, const char* file, int line, 
+char* unbound_strdup_lite(const char* s, const char* file, int line,
 	const char* func);
 char* unbound_lite_wrapstr(char* s);
 #  define sldns_rr2str(rr) unbound_lite_wrapstr(sldns_rr2str(rr))
diff --git a/usr.sbin/unbound/util/as112.c b/usr.sbin/unbound/util/as112.c
index 6ee694046..bf692a3ac 100644
--- a/usr.sbin/unbound/util/as112.c
+++ b/usr.sbin/unbound/util/as112.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/util/as112.h b/usr.sbin/unbound/util/as112.h
index 7d0329e82..433799f46 100644
--- a/usr.sbin/unbound/util/as112.h
+++ b/usr.sbin/unbound/util/as112.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -42,7 +42,7 @@
 #ifndef UTIL_AS112_H
 #define UTIL_AS112_H
 
-/** 
+/**
  * Array of text-format domain names of the AS112 zones.
  * The array ends with NULL.  "AS112" is a service on the internet that
  * that this array is named after.  The names in this list (or some of them)
diff --git a/usr.sbin/unbound/util/config_file.c b/usr.sbin/unbound/util/config_file.c
index cc54c4e8d..503385120 100644
--- a/usr.sbin/unbound/util/config_file.c
+++ b/usr.sbin/unbound/util/config_file.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -87,7 +87,7 @@ struct config_parser_state* cfg_parser = 0;
 /** init ports possible for use */
 static void init_outgoing_availports(int* array, int num);
 
-struct config_file* 
+struct config_file*
 config_create(void)
 {
 	struct config_file* cfg;
@@ -152,7 +152,7 @@ config_create(void)
 	cfg->outgoing_num_ports = 48; /* windows is limited in num fds */
 	cfg->num_queries_per_thread = 24;
 	cfg->outgoing_num_tcp = 2; /* leaves 64-52=12 for: 4if,1stop,thread4 */
-	cfg->incoming_num_tcp = 2; 
+	cfg->incoming_num_tcp = 2;
 #endif
 	cfg->stream_wait_size = 4 * 1024 * 1024;
 	cfg->edns_buffer_size = 1232; /* from DNS flagday recommendation */
@@ -300,13 +300,13 @@ config_create(void)
 	cfg->rrset_roundrobin = 1;
 	cfg->unknown_server_time_limit = 376;
 	cfg->max_udp_size = 4096;
-	if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key"))) 
+	if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key")))
 		goto error_exit;
-	if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem"))) 
+	if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem")))
 		goto error_exit;
-	if(!(cfg->control_key_file = strdup(RUN_DIR"/unbound_control.key"))) 
+	if(!(cfg->control_key_file = strdup(RUN_DIR"/unbound_control.key")))
 		goto error_exit;
-	if(!(cfg->control_cert_file = strdup(RUN_DIR"/unbound_control.pem"))) 
+	if(!(cfg->control_cert_file = strdup(RUN_DIR"/unbound_control.pem")))
 		goto error_exit;
 
 #ifdef CLIENT_SUBNET
@@ -314,7 +314,7 @@ config_create(void)
 #else
 	if(!(cfg->module_conf = strdup("validator iterator"))) goto error_exit;
 #endif
-	if(!(cfg->val_nsec3_key_iterations = 
+	if(!(cfg->val_nsec3_key_iterations =
 		strdup("1024 150 2048 150 4096 150"))) goto error_exit;
 #if defined(DNSTAP_SOCKET_PATH)
 	if(!(cfg->dnstap_socket_path = strdup(DNSTAP_SOCKET_PATH)))
@@ -484,10 +484,10 @@ int config_set_option(struct config_file* cfg, const char* opt,
 		/* not supported, library must have 1 thread in bgworker */
 		return 0;
 	} else if(strcmp(opt, "outgoing-port-permit:") == 0) {
-		return cfg_mark_ports(val, 1, 
+		return cfg_mark_ports(val, 1,
 			cfg->outgoing_avail_ports, 65536);
 	} else if(strcmp(opt, "outgoing-port-avoid:") == 0) {
-		return cfg_mark_ports(val, 0, 
+		return cfg_mark_ports(val, 0,
 			cfg->outgoing_avail_ports, 65536);
 	} else if(strcmp(opt, "local-zone:") == 0) {
 		return cfg_parse_local_zone(cfg, val);
@@ -501,7 +501,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 			if(atoi(val) == 0) return 0;
 			cfg->val_date_override = (uint32_t)atoi(val);
 		}
-	} else if(strcmp(opt, "local-data-ptr:") == 0) { 
+	} else if(strcmp(opt, "local-data-ptr:") == 0) {
 		char* ptr = cfg_ptr_reverse((char*)opt);
 		return cfg_strlist_insert(&cfg->local_data, ptr);
 	} else if(strcmp(opt, "logfile:") == 0) {
@@ -680,7 +680,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else if(strcmp(opt, "serve-expired-reply-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->serve_expired_reply_ttl = atoi(val); SERVE_EXPIRED_REPLY_TTL=(time_t)cfg->serve_expired_reply_ttl;}
 	else S_NUMBER_OR_ZERO("serve-expired-client-timeout:", serve_expired_client_timeout)
-	else S_YNO("ede:", ede)	
+	else S_YNO("ede:", ede)
 	else S_YNO("ede-serve-expired:", ede_serve_expired)
 	else S_YNO("serve-original-ttl:", serve_original_ttl)
 	else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
@@ -806,7 +806,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->val_max_restart = (int32_t)atoi(val); }
 	else if (strcmp(opt, "outgoing-interface:") == 0) {
 		char* d = strdup(val);
-		char** oi = 
+		char** oi =
 		(char**)reallocarray(NULL, (size_t)cfg->num_out_ifs+1, sizeof(char*));
 		if(!d || !oi) { free(d); free(oi); return -1; }
 		if(cfg->out_ifs && cfg->num_out_ifs) {
@@ -901,7 +901,7 @@ config_collate_cat(struct config_strlist* list)
 	for(s=list; s; s=s->next)
 		total += strlen(s->str) + 1; /* len + newline */
 	left = total+1; /* one extra for nul at end */
-	r = malloc(left); 
+	r = malloc(left);
 	if(!r)
 		return NULL;
 	w = r;
@@ -980,7 +980,7 @@ config_collate_cat(struct config_strlist* list)
 	}
 
 int
-config_get_option(struct config_file* cfg, const char* opt, 
+config_get_option(struct config_file* cfg, const char* opt,
 	void (*func)(char*,void*), void* arg)
 {
 	char buf[1024], nopt[64];
@@ -1313,7 +1313,7 @@ create_cfg_parser(struct config_file* cfg, char* filename, const char* chroot)
 	init_cfg_parse();
 }
 
-int 
+int
 config_read(struct config_file* cfg, const char* filename, const char* chroot)
 {
 	FILE *in;
@@ -1353,7 +1353,7 @@ config_read(struct config_file* cfg, const char* filename, const char* chroot)
 			if(r == GLOB_NOMATCH) {
 				verbose(VERB_QUERY, "include: "
 				"no matches for %s", fname);
-				return 1; 
+				return 1;
 			} else if(r == GLOB_NOSPACE) {
 				log_err("include: %s: "
 					"fnametern out of memory", fname);
@@ -1552,7 +1552,7 @@ config_del_strbytelist(struct config_strbytelist* p)
 	}
 }
 
-void 
+void
 config_delete(struct config_file* cfg)
 {
 	if(!cfg) return;
@@ -1663,7 +1663,7 @@ config_delete(struct config_file* cfg)
 	free(cfg);
 }
 
-static void 
+static void
 init_outgoing_availports(int* a, int num)
 {
 	/* generated with make iana_update */
@@ -1676,7 +1676,7 @@ init_outgoing_availports(int* a, int num)
 	for(i=1024; i<num; i++) {
 		a[i] = i;
 	}
-	/* create empty spot at 49152 to keep ephemeral ports available 
+	/* create empty spot at 49152 to keep ephemeral ports available
 	 * to other programs */
 	for(i=49152; i<49152+256; i++)
 		a[i] = 0;
@@ -1687,7 +1687,7 @@ init_outgoing_availports(int* a, int num)
 	}
 }
 
-int 
+int
 cfg_mark_ports(const char* str, int allow, int* avail, int num)
 {
 	char* mid = strchr(str, '-');
@@ -1732,7 +1732,7 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
 	return 1;
 }
 
-int 
+int
 cfg_scan_ports(int* avail, int num)
 {
 	int i;
@@ -1849,7 +1849,7 @@ int cfg_strlist_append(struct config_strlist_head* list, char* item)
 	return 1;
 }
 
-int 
+int
 cfg_region_strlist_insert(struct regional* region,
 	struct config_strlist** head, char* item)
 {
@@ -1882,7 +1882,7 @@ cfg_strlist_find(struct config_strlist* head, const char *item)
 	return NULL;
 }
 
-int 
+int
 cfg_strlist_insert(struct config_strlist** head, char* item)
 {
 	struct config_strlist *s;
@@ -1912,7 +1912,7 @@ cfg_strlist_append_ex(struct config_strlist** head, char* item)
 		return 0;
 	s->str = item;
 	s->next = NULL;
-	
+
 	if (*head==NULL) {
 		*head = s;
 	} else {
@@ -1922,11 +1922,11 @@ cfg_strlist_append_ex(struct config_strlist** head, char* item)
 		}
 		last->next = s;
 	}
-	
-	return 1;  
+
+	return 1;
 }
 
-int 
+int
 cfg_str2list_insert(struct config_str2list** head, char* item, char* i2)
 {
 	struct config_str2list *s;
@@ -1948,7 +1948,7 @@ cfg_str2list_insert(struct config_str2list** head, char* item, char* i2)
 	return 1;
 }
 
-int 
+int
 cfg_str3list_insert(struct config_str3list** head, char* item, char* i2,
 	char* i3)
 {
@@ -1984,7 +1984,7 @@ cfg_strbytelist_insert(struct config_strbytelist** head, char* item,
 	return 1;
 }
 
-time_t 
+time_t
 cfg_convert_timeval(const char* str)
 {
 	time_t t;
@@ -1992,7 +1992,7 @@ cfg_convert_timeval(const char* str)
 	memset(&tm, 0, sizeof(tm));
 	if(strlen(str) < 14)
 		return 0;
-	if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, 
+	if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon,
 		&tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6)
 		return 0;
 	tm.tm_year -= 1900;
@@ -2009,7 +2009,7 @@ cfg_convert_timeval(const char* str)
 	return t;
 }
 
-int 
+int
 cfg_count_numbers(const char* s)
 {
 	/* format ::= (sp num)+ sp  */
@@ -2044,7 +2044,7 @@ static int isalldigit(const char* str, size_t l)
 	return 1;
 }
 
-int 
+int
 cfg_parse_memsize(const char* str, size_t* res)
 {
 	size_t len;
@@ -2060,11 +2060,11 @@ cfg_parse_memsize(const char* str, size_t* res)
 	/* check appended num */
 	while(len>0 && str[len-1]==' ')
 		len--;
-	if(len > 1 && str[len-1] == 'b') 
+	if(len > 1 && str[len-1] == 'b')
 		len--;
-	else if(len > 1 && str[len-1] == 'B') 
+	else if(len > 1 && str[len-1] == 'B')
 		len--;
-	
+
 	if(len > 1 && tolower((unsigned char)str[len-1]) == 'g')
 		mult = 1024*1024*1024;
 	else if(len > 1 && tolower((unsigned char)str[len-1]) == 'm')
@@ -2151,7 +2151,7 @@ uint8_t* config_parse_taglist(struct config_file* cfg, char* str,
 		log_err("out of memory");
 		return 0;
 	}
-	
+
 	/* parse */
 	s = str;
 	while((p=strsep(&s, " \t\n")) != NULL) {
@@ -2237,7 +2237,7 @@ int taglist_intersect(uint8_t* list1, size_t list1len, const uint8_t* list2,
 	return 0;
 }
 
-void 
+void
 config_apply(struct config_file* config)
 {
 	MAX_TTL = (time_t)config->max_ttl;
@@ -2279,7 +2279,7 @@ void config_lookup_uid(struct config_file* cfg)
 #endif
 }
 
-/** 
+/**
  * Calculate string length of full pathname in original filesys
  * @param fname: the path name to convert.
  * 	Must not be null or empty.
@@ -2293,7 +2293,7 @@ strlen_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
 {
 	size_t len = 0;
 	int slashit = 0;
-	if(cfg->chrootdir && cfg->chrootdir[0] && 
+	if(cfg->chrootdir && cfg->chrootdir[0] &&
 		strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
 		/* already full pathname, return it */
 		return strlen(fname);
@@ -2316,8 +2316,8 @@ strlen_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
 		/* prepend chdir */
 		if(slashit && cfg->directory[0] != '/')
 			len++;
-		if(cfg->chrootdir && cfg->chrootdir[0] && 
-			strncmp(cfg->chrootdir, cfg->directory, 
+		if(cfg->chrootdir && cfg->chrootdir[0] &&
+			strncmp(cfg->chrootdir, cfg->directory,
 			strlen(cfg->chrootdir)) == 0)
 			len += strlen(cfg->directory)-strlen(cfg->chrootdir);
 		else	len += strlen(cfg->directory);
@@ -2340,7 +2340,7 @@ fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
 		return NULL;
 	buf[0] = 0;
 	/* is fname already in chroot ? */
-	if(cfg->chrootdir && cfg->chrootdir[0] && 
+	if(cfg->chrootdir && cfg->chrootdir[0] &&
 		strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
 		/* already full pathname, return it */
 		(void)strlcpy(buf, fname, len);
@@ -2366,10 +2366,10 @@ fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
 		if(slashit && cfg->directory[0] != '/')
 			(void)strlcat(buf, "/", len);
 		/* is the directory already in the chroot? */
-		if(cfg->chrootdir && cfg->chrootdir[0] && 
-			strncmp(cfg->chrootdir, cfg->directory, 
+		if(cfg->chrootdir && cfg->chrootdir[0] &&
+			strncmp(cfg->chrootdir, cfg->directory,
 			strlen(cfg->chrootdir)) == 0)
-			(void)strlcat(buf, cfg->directory+strlen(cfg->chrootdir), 
+			(void)strlcat(buf, cfg->directory+strlen(cfg->chrootdir),
 				   len);
 		else (void)strlcat(buf, cfg->directory, len);
 		slashit = 1;
@@ -2406,7 +2406,7 @@ static char* last_space_pos(const char* str)
 	return (sp>tab)?sp:tab;
 }
 
-int 
+int
 cfg_parse_local_zone(struct config_file* cfg, const char* val)
 {
 	const char *type, *name_end, *name;
@@ -2441,11 +2441,11 @@ cfg_parse_local_zone(struct config_file* cfg, const char* val)
 	}
 
 	if(strcmp(type, "nodefault")==0) {
-		return cfg_strlist_insert(&cfg->local_zones_nodefault, 
+		return cfg_strlist_insert(&cfg->local_zones_nodefault,
 			strdup(name));
 #ifdef USE_IPSET
 	} else if(strcmp(type, "ipset")==0) {
-		return cfg_strlist_insert(&cfg->local_zones_ipset, 
+		return cfg_strlist_insert(&cfg->local_zones_ipset,
 			strdup(name));
 #endif
 	} else {
@@ -2500,7 +2500,7 @@ char* cfg_ptr_reverse(char* str)
 		const char* hex = "0123456789abcdef";
 		char *p = buf;
 		int i;
-		memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr, 
+		memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr,
 			sizeof(ad));
 		for(i=15; i>=0; i--) {
 			uint8_t b = ad[i];
@@ -2512,7 +2512,7 @@ char* cfg_ptr_reverse(char* str)
 		snprintf(buf+16*4, sizeof(buf)-16*4, "ip6.arpa. ");
 	} else {
 		uint8_t ad[4];
-		memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr, 
+		memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr,
 			sizeof(ad));
 		snprintf(buf, sizeof(buf), "%u.%u.%u.%u.in-addr.arpa. ",
 			(unsigned)ad[3], (unsigned)ad[2],
diff --git a/usr.sbin/unbound/util/config_file.h b/usr.sbin/unbound/util/config_file.h
index b1406913a..dba986f41 100644
--- a/usr.sbin/unbound/util/config_file.h
+++ b/usr.sbin/unbound/util/config_file.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -230,7 +230,7 @@ struct config_file {
 	/** interface description strings (IP addresses) */
 	char **ifs;
 
-	/** number of outgoing interfaces to open. 
+	/** number of outgoing interfaces to open.
 	 * If 0 default all interfaces. */
 	int num_out_ifs;
 	/** outgoing interface description strings (IP addresses) */
@@ -249,7 +249,7 @@ struct config_file {
 	/** list of donotquery addresses, linked list */
 	struct config_strlist* donotqueryaddrs;
 #ifdef CLIENT_SUBNET
-	/** list of servers we send edns-client-subnet option to and 
+	/** list of servers we send edns-client-subnet option to and
 	 * accept option from, linked list */
 	struct config_strlist* client_subnet;
 	/** list of zones we send edns-client-subnet option for */
@@ -362,7 +362,7 @@ struct config_file {
 
 	/** the module configuration string */
 	char* module_conf;
-	
+
 	/** files with trusted DS and DNSKEYs in zonefile format, list */
 	struct config_strlist* trust_anchor_file_list;
 	/** list of trustanchor keys, linked list */
@@ -387,7 +387,7 @@ struct config_file {
 	/** max number of query restarts, number of IPs to probe */
 	int32_t val_max_restart;
 	/** this value sets the number of seconds before revalidating bogus */
-	int bogus_ttl; 
+	int bogus_ttl;
 	/** should validator clean additional section for secure msgs */
 	int val_clean_additional;
 	/** log bogus messages by the validator */
@@ -802,7 +802,7 @@ struct config_view {
 	struct config_strlist* local_zones_ipset;
 #endif
 	/** Fallback to global local_zones when there is no match in the view
-	 * view specific tree. 1 for yes, 0 for no */	
+	 * view specific tree. 1 for yes, 0 for no */
 	int isfirst;
 	/** predefined actions for particular IP address responses */
 	struct config_str2list* respip_actions;
@@ -877,7 +877,7 @@ struct config_file* config_create_forlib(void);
  * @param config: where options are stored into, must be freshly created.
  * @param filename: name of configfile. If NULL nothing is done.
  * @param chroot: if not NULL, the chroot dir currently in use (for include).
- * @return: false on error. In that case errno is set, ENOENT means 
+ * @return: false on error. In that case errno is set, ENOENT means
  * 	file not found.
  */
 int config_read(struct config_file* config, const char* filename,
@@ -912,16 +912,16 @@ void config_lookup_uid(struct config_file* config);
 int config_set_option(struct config_file* config, const char* option,
 	const char* value);
 
-/** 
+/**
  * Call print routine for the given option.
  * @param cfg: config.
- * @param opt: option name without trailing :. 
+ * @param opt: option name without trailing :.
  *	This is different from config_set_option.
  * @param func: print func, called as (str, arg) for every data element.
  * @param arg: user argument for print func.
  * @return false if the option name is not supported (syntax error).
  */
-int config_get_option(struct config_file* cfg, const char* opt, 
+int config_get_option(struct config_file* cfg, const char* opt,
 	void (*func)(char*,void*), void* arg);
 
 /**
@@ -941,7 +941,7 @@ int config_get_option_list(struct config_file* cfg, const char* opt,
  * @param str: string. malloced, caller must free it.
  * @return 0=OK, 1=syntax error, 2=malloc failed.
  */
-int config_get_option_collate(struct config_file* cfg, const char* opt, 
+int config_get_option_collate(struct config_file* cfg, const char* opt,
 	char** str);
 
 /**
@@ -1136,7 +1136,7 @@ int cfg_count_numbers(const char* str);
  * k=1024, m=1024*1024, g=1024*1024*1024.
  * @param str: string
  * @param res: result is stored here, size in bytes.
- * @return: true if parsed correctly, or 0 on a parse error (and an error 
+ * @return: true if parsed correctly, or 0 on a parse error (and an error
  * is logged).
  */
 int cfg_parse_memsize(const char* str, size_t* res);
@@ -1170,7 +1170,7 @@ int find_tag_id(struct config_file* cfg, const char* tag);
 /**
  * parse taglist from string into bytestring with bitlist.
  * @param cfg: the config structure (with tagnames)
- * @param str: the string to parse.  Parse puts 0 bytes in string. 
+ * @param str: the string to parse.  Parse puts 0 bytes in string.
  * @param listlen: returns length of in bytes.
  * @return malloced bytes with a bitlist of the tags.  or NULL on parse error
  * or malloc failure.
@@ -1213,7 +1213,7 @@ int cfg_parse_local_zone(struct config_file* cfg, const char* val);
  * @param allow: give true if this range is permitted.
  * @param avail: the array from cfg.
  * @param num: size of the array (65536).
- * @return: true if parsed correctly, or 0 on a parse error (and an error 
+ * @return: true if parsed correctly, or 0 on a parse error (and an error
  * is logged).
  */
 int cfg_mark_ports(const char* str, int allow, int* avail, int num);
@@ -1241,7 +1241,7 @@ void cfg_apply_local_port_policy(struct config_file* cfg, int num);
  */
 int cfg_scan_ports(int* avail, int num);
 
-/** 
+/**
  * Convert a filename to full pathname in original filesys
  * @param fname: the path name to convert.
  *      Must not be null or empty.
@@ -1250,7 +1250,7 @@ int cfg_scan_ports(int* avail, int num);
  * @return pointer to malloced buffer which is: [chroot][chdir]fname
  *      or NULL on malloc failure.
  */
-char* fname_after_chroot(const char* fname, struct config_file* cfg, 
+char* fname_after_chroot(const char* fname, struct config_file* cfg,
 	int use_chdir);
 
 /**
diff --git a/usr.sbin/unbound/util/configlexer.lex b/usr.sbin/unbound/util/configlexer.lex
index 09e314b21..a7f5639f7 100644
--- a/usr.sbin/unbound/util/configlexer.lex
+++ b/usr.sbin/unbound/util/configlexer.lex
@@ -209,9 +209,9 @@ SQANY     [^\'\n\r\\]|\\.
 %x	quotedstring singlequotedstr include include_quoted val include_toplevel include_toplevel_quoted
 
 %%
-<INITIAL,val>{SPACE}*	{ 
+<INITIAL,val>{SPACE}*	{
 	LEXOUT(("SP ")); /* ignore */ }
-<INITIAL,val>{SPACE}*{COMMENT}.*	{ 
+<INITIAL,val>{SPACE}*{COMMENT}.*	{
 	/* note that flex makes the longest match and '.' is any but not nl */
 	LEXOUT(("comment(%s) ", yytext)); /* ignore */ }
 server{COLON}			{ YDVAR(0, VAR_SERVER) }
@@ -413,7 +413,7 @@ val-log-level{COLON}		{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 key-cache-size{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 key-cache-slabs{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 neg-cache-size{COLON}		{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
-val-nsec3-keysize-iterations{COLON}	{ 
+val-nsec3-keysize-iterations{COLON}	{
 				  YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) }
 zonemd-permissive-mode{COLON}	{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) }
 zonemd-check{COLON}		{ YDVAR(1, VAR_ZONEMD_CHECK) }
@@ -573,7 +573,7 @@ proxy-protocol-port{COLON}	{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
 	else		    { BEGIN(val); }
 }
 <quotedstring>{DQANY}*  { LEXOUT(("STR(%s) ", yytext)); yymore(); }
-<quotedstring>{NEWLINE} { yyerror("newline inside quoted string, no end \""); 
+<quotedstring>{NEWLINE} { yyerror("newline inside quoted string, no end \"");
 			  cfg_parser->line++; BEGIN(INITIAL); }
 <quotedstring>\" {
         LEXOUT(("QE "));
@@ -594,7 +594,7 @@ proxy-protocol-port{COLON}	{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
 	else		    { BEGIN(val); }
 }
 <singlequotedstr>{SQANY}*  { LEXOUT(("STR(%s) ", yytext)); yymore(); }
-<singlequotedstr>{NEWLINE} { yyerror("newline inside quoted string, no end '"); 
+<singlequotedstr>{NEWLINE} { yyerror("newline inside quoted string, no end '");
 			     cfg_parser->line++; BEGIN(INITIAL); }
 <singlequotedstr>\' {
         LEXOUT(("SQE "));
@@ -608,7 +608,7 @@ proxy-protocol-port{COLON}	{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
 }
 
 	/* include: directive */
-<INITIAL,val>include{COLON}	{ 
+<INITIAL,val>include{COLON}	{
 	LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); }
 <include><<EOF>>	{
         yyerror("EOF inside include directive");
@@ -627,7 +627,7 @@ proxy-protocol-port{COLON}	{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
         BEGIN(inc_prev);
 }
 <include_quoted>{DQANY}*	{ LEXOUT(("ISTR(%s) ", yytext)); yymore(); }
-<include_quoted>{NEWLINE}	{ yyerror("newline before \" in include name"); 
+<include_quoted>{NEWLINE}	{ yyerror("newline before \" in include name");
 				  cfg_parser->line++; BEGIN(inc_prev); }
 <include_quoted>\"	{
 	LEXOUT(("IQE "));
@@ -682,7 +682,7 @@ proxy-protocol-port{COLON}	{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
 	return (VAR_FORCE_TOPLEVEL);
 }
 
-<val>{UNQUOTEDLETTER}*	{ LEXOUT(("unquotedstr(%s) ", yytext)); 
+<val>{UNQUOTEDLETTER}*	{ LEXOUT(("unquotedstr(%s) ", yytext));
 			if(--num_args == 0) { BEGIN(INITIAL); }
 			yylval.str = strdup(yytext); return STRING_ARG; }
 
diff --git a/usr.sbin/unbound/util/configparser.y b/usr.sbin/unbound/util/configparser.y
index 3ecdad2ad..36e9dc1b3 100644
--- a/usr.sbin/unbound/util/configparser.y
+++ b/usr.sbin/unbound/util/configparser.y
@@ -301,7 +301,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_serve_expired |
 	server_serve_expired_ttl | server_serve_expired_ttl_reset |
 	server_serve_expired_reply_ttl | server_serve_expired_client_timeout |
-	server_ede_serve_expired | server_serve_original_ttl | server_fake_dsa | 
+	server_ede_serve_expired | server_serve_original_ttl | server_fake_dsa |
 	server_log_identity | server_use_systemd |
 	server_response_ip_tag | server_response_ip | server_response_ip_data |
 	server_shm_enable | server_shm_key | server_fake_sha1 |
@@ -485,7 +485,7 @@ rpz_signal_nxdomain_ra: VAR_RPZ_SIGNAL_NXDOMAIN_RA STRING_ARG
 rpzstart: VAR_RPZ
 	{
 		struct config_auth* s;
-		OUTYY(("\nP(rpz:)\n")); 
+		OUTYY(("\nP(rpz:)\n"));
 		cfg_parser->started_toplevel = 1;
 		s = (struct config_auth*)calloc(1, sizeof(struct config_auth));
 		if(s) {
@@ -501,7 +501,7 @@ rpzstart: VAR_RPZ
 		}
 	}
 	;
-contents_rpz: contents_rpz content_rpz 
+contents_rpz: contents_rpz content_rpz
 	| ;
 content_rpz: auth_name | auth_zonefile | rpz_tag | auth_master | auth_url |
 	   auth_allow_notify | rpz_action_override | rpz_cname_override |
@@ -2685,7 +2685,7 @@ server_pad_responses: VAR_PAD_RESPONSES STRING_ARG
 		OUTYY(("P(server_pad_responses:%s)\n", $2));
 		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
 			yyerror("expected yes or no.");
-		else cfg_parser->cfg->pad_responses = 
+		else cfg_parser->cfg->pad_responses =
 			(strcmp($2, "yes")==0);
 		free($2);
 	}
@@ -2704,7 +2704,7 @@ server_pad_queries: VAR_PAD_QUERIES STRING_ARG
 		OUTYY(("P(server_pad_queries:%s)\n", $2));
 		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
 			yyerror("expected yes or no.");
-		else cfg_parser->cfg->pad_queries = 
+		else cfg_parser->cfg->pad_queries =
 			(strcmp($2, "yes")==0);
 		free($2);
 	}
@@ -3444,8 +3444,8 @@ py_script: VAR_PYTHON_SCRIPT STRING_ARG
 			yyerror("out of memory");
 	}
 dynlibstart: VAR_DYNLIB
-	{ 
-		OUTYY(("\nP(dynlib:)\n")); 
+	{
+		OUTYY(("\nP(dynlib:)\n"));
 		cfg_parser->started_toplevel = 1;
 	}
 	;
diff --git a/usr.sbin/unbound/util/data/dname.c b/usr.sbin/unbound/util/data/dname.c
index 76b2ec7d6..6a0bb0cea 100644
--- a/usr.sbin/unbound/util/data/dname.c
+++ b/usr.sbin/unbound/util/data/dname.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -70,7 +70,7 @@ query_dname_len(sldns_buffer* query)
 	}
 }
 
-size_t 
+size_t
 dname_valid(uint8_t* dname, size_t maxlen)
 {
 	size_t len = 0;
@@ -96,7 +96,7 @@ dname_valid(uint8_t* dname, size_t maxlen)
 }
 
 /** compare uncompressed, noncanonical, registers are hints for speed */
-int 
+int
 query_dname_compare(register uint8_t* d1, register uint8_t* d2)
 {
 	register uint8_t lab1, lab2;
@@ -115,7 +115,7 @@ query_dname_compare(register uint8_t* d1, register uint8_t* d2)
 		/* compare lowercased labels. */
 		while(lab1--) {
 			/* compare bytes first for speed */
-			if(*d1 != *d2 && 
+			if(*d1 != *d2 &&
 				tolower((unsigned char)*d1) != tolower((unsigned char)*d2)) {
 				if(tolower((unsigned char)*d1) < tolower((unsigned char)*d2))
 					return -1;
@@ -131,7 +131,7 @@ query_dname_compare(register uint8_t* d1, register uint8_t* d2)
 	return 0;
 }
 
-void 
+void
 query_dname_tolower(uint8_t* dname)
 {
 	/* the dname is stored uncompressed */
@@ -147,7 +147,7 @@ query_dname_tolower(uint8_t* dname)
 	}
 }
 
-void 
+void
 pkt_dname_tolower(sldns_buffer* pkt, uint8_t* dname)
 {
 	uint8_t lablen;
@@ -157,7 +157,7 @@ pkt_dname_tolower(sldns_buffer* pkt, uint8_t* dname)
 	lablen = *dname++;
 	while(lablen) {
 		if(LABEL_IS_PTR(lablen)) {
-			if((size_t)PTR_OFFSET(lablen, *dname) 
+			if((size_t)PTR_OFFSET(lablen, *dname)
 				>= sldns_buffer_limit(pkt))
 				return;
 			dname = sldns_buffer_at(pkt, PTR_OFFSET(lablen, *dname));
@@ -229,7 +229,7 @@ pkt_dname_len(sldns_buffer* pkt)
 	return len;
 }
 
-int 
+int
 dname_pkt_compare(sldns_buffer* pkt, uint8_t* d1, uint8_t* d2)
 {
 	uint8_t len1, len2;
@@ -394,7 +394,7 @@ void dname_print(FILE* out, struct sldns_buffer* pkt, uint8_t* dname)
 	if(!dname) return;
 
 	lablen = *dname++;
-	if(!lablen) 
+	if(!lablen)
 		fputc('.', out);
 	while(lablen) {
 		if(LABEL_IS_PTR(lablen)) {
@@ -427,7 +427,7 @@ void dname_print(FILE* out, struct sldns_buffer* pkt, uint8_t* dname)
 	}
 }
 
-int 
+int
 dname_count_labels(uint8_t* dname)
 {
 	uint8_t lablen;
@@ -442,9 +442,9 @@ dname_count_labels(uint8_t* dname)
 	return labs;
 }
 
-int 
+int
 dname_count_size_labels(uint8_t* dname, size_t* size)
-{	
+{
 	uint8_t lablen;
 	int labs = 1;
 	size_t sz = 1;
@@ -482,7 +482,7 @@ memlowercmp(uint8_t* p1, uint8_t* p2, uint8_t len)
 	return 0;
 }
 
-int 
+int
 dname_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs)
 {
 	uint8_t len1, len2;
@@ -524,13 +524,13 @@ dname_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs)
 			d2 += len2;
 		} else {
 			/* memlowercmp is inlined here; or just like
-			 * if((c=memlowercmp(d1, d2, len1)) != 0) { 
+			 * if((c=memlowercmp(d1, d2, len1)) != 0) {
 			 *	lastdiff = c;
 			 *	lastmlabs = atlabel; } apart from d1++,d2++ */
 			while(len1) {
-				if(*d1 != *d2 && tolower((unsigned char)*d1) 
+				if(*d1 != *d2 && tolower((unsigned char)*d1)
 					!= tolower((unsigned char)*d2)) {
-					if(tolower((unsigned char)*d1) < 
+					if(tolower((unsigned char)*d1) <
 						tolower((unsigned char)*d2)) {
 						lastdiff = -1;
 						lastmlabs = atlabel;
@@ -616,7 +616,7 @@ dname_has_label(uint8_t* dname, size_t dnamelen, uint8_t* label)
 	return 0;
 }
 
-int 
+int
 dname_buffer_write(sldns_buffer* pkt, uint8_t* dname)
 {
 	uint8_t lablen;
@@ -660,8 +660,8 @@ void dname_str(uint8_t* dname, char* str)
 			return;
 		}
 		while(lablen--) {
-			if(isalnum((unsigned char)*dname) 
-				|| *dname == '-' || *dname == '_' 
+			if(isalnum((unsigned char)*dname)
+				|| *dname == '-' || *dname == '_'
 				|| *dname == '*')
 				*s++ = *(char*)dname++;
 			else	{
@@ -675,12 +675,12 @@ void dname_str(uint8_t* dname, char* str)
 	*s = 0;
 }
 
-int 
+int
 dname_strict_subdomain(uint8_t* d1, int labs1, uint8_t* d2, int labs2)
 {
 	int m;
 	/* check subdomain: d1: www.example.com. and d2: example.com. */
-	if(labs2 >= labs1) 
+	if(labs2 >= labs1)
 		return 0;
 	if(dname_lab_cmp(d1, labs1, d2, labs2, &m) > 0) {
 		/* subdomain if all labels match */
@@ -689,14 +689,14 @@ dname_strict_subdomain(uint8_t* d1, int labs1, uint8_t* d2, int labs2)
 	return 0;
 }
 
-int 
+int
 dname_strict_subdomain_c(uint8_t* d1, uint8_t* d2)
 {
 	return dname_strict_subdomain(d1, dname_count_labels(d1), d2,
 		dname_count_labels(d2));
 }
 
-int 
+int
 dname_subdomain_c(uint8_t* d1, uint8_t* d2)
 {
 	int m;
@@ -704,7 +704,7 @@ dname_subdomain_c(uint8_t* d1, uint8_t* d2)
 	/*  	or 	    d1: example.com. and d2: example.com. */
 	int labs1 = dname_count_labels(d1);
 	int labs2 = dname_count_labels(d2);
-	if(labs2 > labs1) 
+	if(labs2 > labs1)
 		return 0;
 	if(dname_lab_cmp(d1, labs1, d2, labs2, &m) < 0) {
 		/* must have been example.com , www.example.com - wrong */
@@ -714,7 +714,7 @@ dname_subdomain_c(uint8_t* d1, uint8_t* d2)
 	return (m == labs2);
 }
 
-int 
+int
 dname_is_root(uint8_t* dname)
 {
 	uint8_t len;
@@ -724,7 +724,7 @@ dname_is_root(uint8_t* dname)
 	return (len == 0);
 }
 
-void 
+void
 dname_remove_label(uint8_t** dname, size_t* len)
 {
 	size_t lablen;
@@ -738,7 +738,7 @@ dname_remove_label(uint8_t** dname, size_t* len)
 	*dname += lablen+1;
 }
 
-void 
+void
 dname_remove_labels(uint8_t** dname, size_t* len, int n)
 {
 	int i;
@@ -746,7 +746,7 @@ dname_remove_labels(uint8_t** dname, size_t* len, int n)
 		dname_remove_label(dname, len);
 }
 
-int 
+int
 dname_signame_label_count(uint8_t* dname)
 {
 	uint8_t lablen;
@@ -765,7 +765,7 @@ dname_signame_label_count(uint8_t* dname)
 	return count;
 }
 
-int 
+int
 dname_is_wild(uint8_t* dname)
 {
 	return (dname[0] == 1 && dname[1] == '*');
@@ -798,7 +798,7 @@ memcanoncmp(uint8_t* p1, uint8_t len1, uint8_t* p2, uint8_t len2)
 }
 
 
-int 
+int
 dname_canon_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs)
 {
 	/* like dname_lab_cmp, but with different label comparison,
diff --git a/usr.sbin/unbound/util/data/dname.h b/usr.sbin/unbound/util/data/dname.h
index cb0f6735d..62770b0f2 100644
--- a/usr.sbin/unbound/util/data/dname.h
+++ b/usr.sbin/unbound/util/data/dname.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -50,11 +50,11 @@ struct sldns_buffer;
 /** max number of compression ptrs to follow */
 #define MAX_COMPRESS_PTRS 256
 
-/** 
- * Determine length of dname in buffer, no compression ptrs allowed, 
+/**
+ * Determine length of dname in buffer, no compression ptrs allowed,
  * @param query: the ldns buffer, current position at start of dname.
  *	at end, position is at end of the dname.
- * @return: 0 on parse failure, or length including ending 0 of dname. 
+ * @return: 0 on parse failure, or length including ending 0 of dname.
  */
 size_t query_dname_len(struct sldns_buffer* query);
 
@@ -69,9 +69,9 @@ size_t dname_valid(uint8_t* dname, size_t len);
 /** lowercase query dname */
 void query_dname_tolower(uint8_t* dname);
 
-/** 
+/**
  * lowercase pkt dname (follows compression pointers)
- * @param pkt: the packet, used to follow compression pointers. Position 
+ * @param pkt: the packet, used to follow compression pointers. Position
  *	is unchanged.
  * @param dname: start of dname in packet.
  */
@@ -87,7 +87,7 @@ void pkt_dname_tolower(struct sldns_buffer* pkt, uint8_t* dname);
  * that is smaller (possibly after lowercasing) makes an RR smaller, or the
  * shortest name makes an RR smaller.
  *
- * This routine does not compute the canonical order needed for NSEC 
+ * This routine does not compute the canonical order needed for NSEC
  * processing.
  *
  * Dnames have to be valid format.
@@ -186,7 +186,7 @@ int dname_count_size_labels(uint8_t* dname, size_t* size);
 int dname_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs);
 
 /**
- * Check if labels starts with given prefix 
+ * Check if labels starts with given prefix
  * @param label: dname label
  * @param prefix: the string to match label with, null terminated.
  * @param endptr: pointer to location in label after prefix, only if return
@@ -207,7 +207,7 @@ int dname_has_label(uint8_t* dname, size_t dnamelen, uint8_t* label);
 
 /**
  * See if domain name d1 is a strict subdomain of d2.
- * That is a subdomain, but not equal. 
+ * That is a subdomain, but not equal.
  * @param d1: domain name, uncompressed wireformat
  * @param labs1: number of labels in d1, including root label.
  * @param d2: domain name, uncompressed wireformat
@@ -217,7 +217,7 @@ int dname_has_label(uint8_t* dname, size_t dnamelen, uint8_t* label);
 int dname_strict_subdomain(uint8_t* d1, int labs1, uint8_t* d2, int labs2);
 
 /**
- * Like dname_strict_subdomain but counts labels 
+ * Like dname_strict_subdomain but counts labels
  * @param d1: domain name, uncompressed wireformat
  * @param d2: domain name, uncompressed wireformat
  * @return true if d1 is a subdomain of d2, but not equal to d2.
@@ -232,15 +232,15 @@ int dname_strict_subdomain_c(uint8_t* d1, uint8_t* d2);
  */
 int dname_subdomain_c(uint8_t* d1, uint8_t* d2);
 
-/** 
- * Debug helper. Print wireformat dname to output. 
+/**
+ * Debug helper. Print wireformat dname to output.
  * @param out: like stdout or a file.
  * @param pkt: if not NULL, the packet for resolving compression ptrs.
  * @param dname: pointer to (start of) dname.
  */
 void dname_print(FILE* out, struct sldns_buffer* pkt, uint8_t* dname);
 
-/** 
+/**
  * Debug helper. Print dname to given string buffer (string buffer must
  * be at least 255 chars + 1 for the 0, in printable form.
  * This may lose information (? for nonprintable characters, or & if
@@ -301,7 +301,7 @@ int dname_is_wild(uint8_t* dname);
  * @param mlabs: number of labels that matched exactly (the shared topdomain).
  * @return: 0 for equal, -1 smaller, or +1 d1 larger than d2.
  */
-int dname_canon_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, 
+int dname_canon_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2,
 	int* mlabs);
 
 /**
diff --git a/usr.sbin/unbound/util/data/msgencode.c b/usr.sbin/unbound/util/data/msgencode.c
index fe21cfb86..a0adabd82 100644
--- a/usr.sbin/unbound/util/data/msgencode.c
+++ b/usr.sbin/unbound/util/data/msgencode.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -113,7 +113,7 @@ compress_tree_search(struct compress_tree_node** tree, uint8_t* dname,
 	struct compress_tree_node* close = 0;
 	struct compress_tree_node** prev = tree;
 	while(p) {
-		if((c = dname_lab_cmp(dname, labs, p->dname, p->labs, &n)) 
+		if((c = dname_lab_cmp(dname, labs, p->dname, p->labs, &n))
 			== 0) {
 			*matchlabels = n;
 			*match = p;
@@ -175,7 +175,7 @@ compress_tree_lookup(struct compress_tree_node** tree, uint8_t* dname,
  * @return new node or 0 on malloc failure.
  */
 static struct compress_tree_node*
-compress_tree_newnode(uint8_t* dname, int labs, size_t offset, 
+compress_tree_newnode(uint8_t* dname, int labs, size_t offset,
 	struct regional* region)
 {
 	struct compress_tree_node* n = (struct compress_tree_node*)
@@ -199,12 +199,12 @@ compress_tree_newnode(uint8_t* dname, int labs, size_t offset,
  * @param closest: match from previous lookup, used to compress dname.
  *	may be NULL if no previous match.
  *	if the tree has an ancestor of dname already, this must be it.
- * @param insertpt: where to insert the dname in tree. 
+ * @param insertpt: where to insert the dname in tree.
  * @return: 0 on memory error.
  */
 static int
-compress_tree_store(uint8_t* dname, int labs, size_t offset, 
-	struct regional* region, struct compress_tree_node* closest, 
+compress_tree_store(uint8_t* dname, int labs, size_t offset,
+	struct regional* region, struct compress_tree_node* closest,
 	struct compress_tree_node** insertpt)
 {
 	uint8_t lablen;
@@ -219,7 +219,7 @@ compress_tree_store(uint8_t* dname, int labs, size_t offset,
 			/* insertion failed, drop vine */
 			return 1; /* compression pointer no longer useful */
 		}
-		if(!(newnode = compress_tree_newnode(dname, labs, offset, 
+		if(!(newnode = compress_tree_newnode(dname, labs, offset,
 			region))) {
 			/* insertion failed, drop vine */
 			return 0;
@@ -284,21 +284,21 @@ write_compressed_dname(sldns_buffer* pkt, uint8_t* dname, int labs,
 
 /** compress owner name of RR, return RETVAL_OUTMEM RETVAL_TRUNC */
 static int
-compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt, 
-	struct regional* region, struct compress_tree_node** tree, 
+compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
+	struct regional* region, struct compress_tree_node** tree,
 	size_t owner_pos, uint16_t* owner_ptr, int owner_labs)
 {
 	struct compress_tree_node* p;
 	struct compress_tree_node** insertpt = NULL;
 	if(!*owner_ptr) {
 		/* compress first time dname */
-		if((p = compress_tree_lookup(tree, key->rk.dname, 
+		if((p = compress_tree_lookup(tree, key->rk.dname,
 			owner_labs, &insertpt))) {
-			if(p->labs == owner_labs) 
+			if(p->labs == owner_labs)
 				/* avoid ptr chains, since some software is
 				 * not capable of decoding ptr after a ptr. */
 				*owner_ptr = htons(PTR_CREATE(p->offset));
-			if(!write_compressed_dname(pkt, key->rk.dname, 
+			if(!write_compressed_dname(pkt, key->rk.dname,
 				owner_labs, p))
 				return RETVAL_TRUNC;
 			/* check if typeclass+4 ttl + rdatalen is available */
@@ -308,22 +308,22 @@ compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 			/* no compress */
 			if(sldns_buffer_remaining(pkt) < key->rk.dname_len+4+4+2)
 				return RETVAL_TRUNC;
-			sldns_buffer_write(pkt, key->rk.dname, 
+			sldns_buffer_write(pkt, key->rk.dname,
 				key->rk.dname_len);
 			if(owner_pos <= PTR_MAX_OFFSET)
 				*owner_ptr = htons(PTR_CREATE(owner_pos));
 		}
-		if(!compress_tree_store(key->rk.dname, owner_labs, 
+		if(!compress_tree_store(key->rk.dname, owner_labs,
 			owner_pos, region, p, insertpt))
 			return RETVAL_OUTMEM;
 	} else {
 		/* always compress 2nd-further RRs in RRset */
 		if(owner_labs == 1) {
-			if(sldns_buffer_remaining(pkt) < 1+4+4+2) 
+			if(sldns_buffer_remaining(pkt) < 1+4+4+2)
 				return RETVAL_TRUNC;
 			sldns_buffer_write_u8(pkt, 0);
 		} else {
-			if(sldns_buffer_remaining(pkt) < 2+4+4+2) 
+			if(sldns_buffer_remaining(pkt) < 2+4+4+2)
 				return RETVAL_TRUNC;
 			sldns_buffer_write(pkt, owner_ptr, 2);
 		}
@@ -333,7 +333,7 @@ compress_owner(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 
 /** compress any domain name to the packet, return RETVAL_* */
 static int
-compress_any_dname(uint8_t* dname, sldns_buffer* pkt, int labs, 
+compress_any_dname(uint8_t* dname, sldns_buffer* pkt, int labs,
 	struct regional* region, struct compress_tree_node** tree)
 {
 	struct compress_tree_node* p;
@@ -356,7 +356,7 @@ static const sldns_rr_descriptor*
 type_rdata_compressable(struct ub_packed_rrset_key* key)
 {
 	uint16_t t = ntohs(key->rk.type);
-	if(sldns_rr_descript(t) && 
+	if(sldns_rr_descript(t) &&
 		sldns_rr_descript(t)->_compress == LDNS_RR_COMPRESS)
 		return sldns_rr_descript(t);
 	return 0;
@@ -364,8 +364,8 @@ type_rdata_compressable(struct ub_packed_rrset_key* key)
 
 /** compress domain names in rdata, return RETVAL_* */
 static int
-compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen, 
-	struct regional* region, struct compress_tree_node** tree, 
+compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen,
+	struct regional* region, struct compress_tree_node** tree,
 	const sldns_rr_descriptor* desc)
 {
 	int labs, r, rdf = 0;
@@ -380,7 +380,7 @@ compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen,
 		switch(desc->_wireformat[rdf]) {
 		case LDNS_RDF_TYPE_DNAME:
 			labs = dname_count_size_labels(rdata, &dname_len);
-			if((r=compress_any_dname(rdata, pkt, labs, region, 
+			if((r=compress_any_dname(rdata, pkt, labs, region,
 				tree)) != RETVAL_OK)
 				return r;
 			rdata += dname_len;
@@ -418,7 +418,7 @@ compress_rdata(sldns_buffer* pkt, uint8_t* rdata, size_t todolen,
 
 /** Returns true if RR type should be included */
 static int
-rrset_belongs_in_reply(sldns_pkt_section s, uint16_t rrtype, uint16_t qtype, 
+rrset_belongs_in_reply(sldns_pkt_section s, uint16_t rrtype, uint16_t qtype,
 	int dnssec)
 {
 	if(dnssec)
@@ -446,7 +446,7 @@ rrset_belongs_in_reply(sldns_pkt_section s, uint16_t rrtype, uint16_t qtype,
 
 /** store rrset in buffer in wireformat, return RETVAL_* */
 static int
-packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt, 
+packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 	uint16_t* num_rrs, time_t timenow, struct regional* region,
 	int do_data, int do_sig, struct compress_tree_node** tree,
 	sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset)
@@ -457,7 +457,7 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 	time_t adjust = 0;
 	struct packed_rrset_data* data = (struct packed_rrset_data*)
 		key->entry.data;
-	
+
 	/* does this RR type belong in the answer? */
 	if(!rrset_belongs_in_reply(s, ntohs(key->rk.type), qtype, dnssec))
 		return RETVAL_OK;
@@ -477,7 +477,7 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 		for(i=0; i<data->count; i++) {
 			/* rrset roundrobin */
 			j = (i + rr_offset) % data->count;
-			if((r=compress_owner(key, pkt, region, tree, 
+			if((r=compress_owner(key, pkt, region, tree,
 				owner_pos, &owner_ptr, owner_labs))
 				!= RETVAL_OK)
 				return r;
@@ -506,15 +506,15 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 		for(i=data->count; i<total; i++) {
 			if(owner_ptr && owner_labs != 1) {
 				if(sldns_buffer_remaining(pkt) <
-					2+4+4+data->rr_len[i]) 
+					2+4+4+data->rr_len[i])
 					return RETVAL_TRUNC;
 				sldns_buffer_write(pkt, &owner_ptr, 2);
 			} else {
-				if((r=compress_any_dname(key->rk.dname, 
+				if((r=compress_any_dname(key->rk.dname,
 					pkt, owner_labs, region, tree))
 					!= RETVAL_OK)
 					return r;
-				if(sldns_buffer_remaining(pkt) < 
+				if(sldns_buffer_remaining(pkt) <
 					4+4+data->rr_len[i])
 					return RETVAL_TRUNC;
 			}
@@ -542,7 +542,7 @@ packed_rrset_encode(struct ub_packed_rrset_key* key, sldns_buffer* pkt,
 /** store msg section in wireformat buffer, return RETVAL_* */
 static int
 insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
-	sldns_buffer* pkt, size_t rrsets_before, time_t timenow, 
+	sldns_buffer* pkt, size_t rrsets_before, time_t timenow,
 	struct regional* region, struct compress_tree_node** tree,
 	sldns_pkt_section s, uint16_t qtype, int dnssec, size_t rr_offset)
 {
@@ -558,7 +558,7 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
 			dnssec = 1; /* include all types in ANY answer */
 	  	for(i=0; i<num_rrsets; i++) {
 			setstart = sldns_buffer_position(pkt);
-			if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], 
+			if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i],
 				pkt, num_rrs, timenow, region, 1, 1, tree,
 				s, qtype, dnssec, rr_offset))
 				!= RETVAL_OK) {
@@ -571,7 +571,7 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
 	} else {
 	  	for(i=0; i<num_rrsets; i++) {
 			setstart = sldns_buffer_position(pkt);
-			if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], 
+			if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i],
 				pkt, num_rrs, timenow, region, 1, 0, tree,
 				s, qtype, dnssec, rr_offset))
 				!= RETVAL_OK) {
@@ -582,7 +582,7 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
 		if(dnssec)
 	  	  for(i=0; i<num_rrsets; i++) {
 			setstart = sldns_buffer_position(pkt);
-			if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i], 
+			if((r=packed_rrset_encode(rep->rrsets[rrsets_before+i],
 				pkt, num_rrs, timenow, region, 0, 1, tree,
 				s, qtype, dnssec, rr_offset))
 				!= RETVAL_OK) {
@@ -596,14 +596,14 @@ insert_section(struct reply_info* rep, size_t num_rrsets, uint16_t* num_rrs,
 
 /** store query section in wireformat buffer, return RETVAL */
 static int
-insert_query(struct query_info* qinfo, struct compress_tree_node** tree, 
+insert_query(struct query_info* qinfo, struct compress_tree_node** tree,
 	sldns_buffer* buffer, struct regional* region)
 {
 	uint8_t* qname = qinfo->local_alias ?
 		qinfo->local_alias->rrset->rk.dname : qinfo->qname;
 	size_t qname_len = qinfo->local_alias ?
 		qinfo->local_alias->rrset->rk.dname_len : qinfo->qname_len;
-	if(sldns_buffer_remaining(buffer) < 
+	if(sldns_buffer_remaining(buffer) <
 		qinfo->qname_len+sizeof(uint16_t)*2)
 		return RETVAL_TRUNC; /* buffer too small */
 	/* the query is the first name inserted into the tree */
@@ -855,7 +855,7 @@ attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns,
 		size_t msg_sz = ((pad_pos + 3) / edns->padding_block_size + 1)
 		                               * edns->padding_block_size;
 		size_t pad_sz;
-		
+
 		if (msg_sz > max_msg_sz)
 			msg_sz = max_msg_sz;
 
@@ -873,7 +873,7 @@ attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns,
 			sldns_buffer_skip(pkt, pad_sz);
 		}
 	}
-	sldns_buffer_write_u16_at(pkt, rdatapos, 
+	sldns_buffer_write_u16_at(pkt, rdatapos,
 			sldns_buffer_position(pkt)-rdatapos-2);
 	sldns_buffer_flip(pkt);
 }
@@ -886,10 +886,10 @@ attach_edns_record(sldns_buffer* pkt, struct edns_data* edns)
 	attach_edns_record_max_msg_sz(pkt, edns, edns->udp_size);
 }
 
-int 
-reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, 
+int
+reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
 	uint16_t id, uint16_t qflags, sldns_buffer* pkt, time_t timenow,
-	int cached, struct regional* region, uint16_t udpsize, 
+	int cached, struct regional* region, uint16_t udpsize,
 	struct edns_data* edns, int dnssec, int secure)
 {
 	uint16_t flags;
@@ -897,10 +897,10 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
 
 	if(!cached || rep->authoritative) {
 		/* original flags, copy RD and CD bits from query. */
-		flags = rep->flags | (qflags & (BIT_RD|BIT_CD)); 
+		flags = rep->flags | (qflags & (BIT_RD|BIT_CD));
 	} else {
 		/* remove AA bit, copy RD and CD bits from query. */
-		flags = (rep->flags & ~BIT_AA) | (qflags & (BIT_RD|BIT_CD)); 
+		flags = (rep->flags & ~BIT_AA) | (qflags & (BIT_RD|BIT_CD));
 	}
 	if(secure && (dnssec || (qflags&BIT_AD)))
 		flags |= BIT_AD;
@@ -938,7 +938,7 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
 	return 1;
 }
 
-void 
+void
 qinfo_query_encode(sldns_buffer* pkt, struct query_info* qinfo)
 {
 	uint16_t flags = 0; /* QUERY, NOERROR */
@@ -958,7 +958,7 @@ qinfo_query_encode(sldns_buffer* pkt, struct query_info* qinfo)
 	sldns_buffer_flip(pkt);
 }
 
-void 
+void
 error_encode(sldns_buffer* buf, int r, struct query_info* qinfo,
 	uint16_t qid, uint16_t qflags, struct edns_data* edns)
 {
diff --git a/usr.sbin/unbound/util/data/msgencode.h b/usr.sbin/unbound/util/data/msgencode.h
index 30dc515cb..439892ebf 100644
--- a/usr.sbin/unbound/util/data/msgencode.h
+++ b/usr.sbin/unbound/util/data/msgencode.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -48,7 +48,7 @@ struct reply_info;
 struct regional;
 struct edns_data;
 
-/** 
+/**
  * Generate answer from reply_info.
  * @param qinf: query information that provides query section in packet.
  * @param rep: reply to fill in.
@@ -66,9 +66,9 @@ struct edns_data;
  * @param secure: if 1, the AD bit is set in the reply.
  * @return: 0 on error (server failure).
  */
-int reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, 
+int reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
 	uint16_t id, uint16_t qflags, struct sldns_buffer* dest, time_t timenow,
-	int cached, struct regional* region, uint16_t udpsize, 
+	int cached, struct regional* region, uint16_t udpsize,
 	struct edns_data* edns, int dnssec, int secure);
 
 /**
@@ -87,11 +87,11 @@ int reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
  * @param dnssec: if 0 DNSSEC records are omitted from the answer.
  * @param minimise: if true, the answer is a minimal response, with
  *   authority and additional removed if possible.
- * @return: nonzero is success, or 
+ * @return: nonzero is success, or
  *	0 on error: malloc failure (no log_err has been done).
  */
-int reply_info_encode(struct query_info* qinfo, struct reply_info* rep, 
-	uint16_t id, uint16_t flags, struct sldns_buffer* buffer, time_t timenow, 
+int reply_info_encode(struct query_info* qinfo, struct reply_info* rep,
+	uint16_t id, uint16_t flags, struct sldns_buffer* buffer, time_t timenow,
 	struct regional* region, uint16_t udpsize, int dnssec, int minimise);
 
 /**
@@ -116,7 +116,7 @@ uint16_t calc_edns_field_size(struct edns_data* edns);
  */
 void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns);
 
-/** 
+/**
  * Encode an error. With QR and RA set.
  *
  * @param pkt: where to store the packet.
diff --git a/usr.sbin/unbound/util/data/msgparse.c b/usr.sbin/unbound/util/data/msgparse.c
index 5bb69d6ed..f1aef2e55 100644
--- a/usr.sbin/unbound/util/data/msgparse.c
+++ b/usr.sbin/unbound/util/data/msgparse.c
@@ -1,25 +1,25 @@
-/* 
+/*
  * util/data/msgparse.c - parse wireformat DNS messages.
- * 
+ *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -52,7 +52,7 @@
 
 /** smart comparison of (compressed, valid) dnames from packet */
 static int
-smart_compare(sldns_buffer* pkt, uint8_t* dnow, 
+smart_compare(sldns_buffer* pkt, uint8_t* dnow,
 	uint8_t* dprfirst, uint8_t* dprlast)
 {
 	if(LABEL_IS_PTR(*dnow)) {
@@ -75,10 +75,10 @@ smart_compare(sldns_buffer* pkt, uint8_t* dnow,
 /**
  * Allocate new rrset in region, fill with data.
  */
-static struct rrset_parse* 
-new_rrset(struct msg_parse* msg, uint8_t* dname, size_t dnamelen, 
-	uint16_t type, uint16_t dclass, hashvalue_type hash, 
-	uint32_t rrset_flags, sldns_pkt_section section, 
+static struct rrset_parse*
+new_rrset(struct msg_parse* msg, uint8_t* dname, size_t dnamelen,
+	uint16_t type, uint16_t dclass, hashvalue_type hash,
+	uint32_t rrset_flags, sldns_pkt_section section,
 	struct regional* region)
 {
 	struct rrset_parse* p = regional_alloc(region, sizeof(*p));
@@ -166,7 +166,7 @@ pkt_rrset_flags(sldns_buffer* pkt, uint16_t type, sldns_pkt_section sec)
 }
 
 hashvalue_type
-pkt_hash_rrset(sldns_buffer* pkt, uint8_t* dname, uint16_t type, 
+pkt_hash_rrset(sldns_buffer* pkt, uint8_t* dname, uint16_t type,
 	uint16_t dclass, uint32_t rrset_flags)
 {
 	/* note this MUST be identical to rrset_key_hash in packed_rrset.c */
@@ -193,7 +193,7 @@ pkt_hash_rrset_first(sldns_buffer* pkt, uint8_t* dname)
 
 /** create a rrset hash from a partial dname hash */
 static hashvalue_type
-pkt_hash_rrset_rest(hashvalue_type dname_h, uint16_t type, uint16_t dclass, 
+pkt_hash_rrset_rest(hashvalue_type dname_h, uint16_t type, uint16_t dclass,
 	uint32_t rrset_flags)
 {
 	/* works together with pkt_hash_rrset_first */
@@ -207,8 +207,8 @@ pkt_hash_rrset_rest(hashvalue_type dname_h, uint16_t type, uint16_t dclass,
 
 /** compare rrset_parse with data */
 static int
-rrset_parse_equals(struct rrset_parse* p, sldns_buffer* pkt, hashvalue_type h, 
-	uint32_t rrset_flags, uint8_t* dname, size_t dnamelen, 
+rrset_parse_equals(struct rrset_parse* p, sldns_buffer* pkt, hashvalue_type h,
+	uint32_t rrset_flags, uint8_t* dname, size_t dnamelen,
 	uint16_t type, uint16_t dclass)
 {
 	if(p->hash == h && p->dname_len == dnamelen && p->type == type &&
@@ -220,7 +220,7 @@ rrset_parse_equals(struct rrset_parse* p, sldns_buffer* pkt, hashvalue_type h,
 
 
 struct rrset_parse*
-msgparse_hashtable_lookup(struct msg_parse* msg, sldns_buffer* pkt, 
+msgparse_hashtable_lookup(struct msg_parse* msg, sldns_buffer* pkt,
 	hashvalue_type h, uint32_t rrset_flags, uint8_t* dname,
 	size_t dnamelen, uint16_t type, uint16_t dclass)
 {
@@ -340,7 +340,7 @@ rrset_has_sigover(sldns_buffer* pkt, struct rrset_parse* rrset, uint16_t type,
 
 /** move rrsigs from sigset to dataset */
 static int
-moveover_rrsigs(sldns_buffer* pkt, struct regional* region, 
+moveover_rrsigs(sldns_buffer* pkt, struct regional* region,
 	struct rrset_parse* sigset, struct rrset_parse* dataset, int duplicate)
 {
 	struct rr_parse* sig = sigset->rr_first;
@@ -349,7 +349,7 @@ moveover_rrsigs(sldns_buffer* pkt, struct regional* region,
 	struct rr_parse* nextsig;
 	while(sig) {
 		nextsig = sig->next;
-		if(pkt_rrsig_covered_equals(pkt, sig->ttl_data, 
+		if(pkt_rrsig_covered_equals(pkt, sig->ttl_data,
 			dataset->type)) {
 			if(duplicate) {
 				/* new */
@@ -374,7 +374,7 @@ moveover_rrsigs(sldns_buffer* pkt, struct regional* region,
 			/* add to dataset */
 			dataset->rrsig_count++;
 			insert->next = 0;
-			if(dataset->rrsig_last) 
+			if(dataset->rrsig_last)
 				dataset->rrsig_last->next = insert;
 			else	dataset->rrsig_first = insert;
 			dataset->rrsig_last = insert;
@@ -389,21 +389,21 @@ moveover_rrsigs(sldns_buffer* pkt, struct regional* region,
 
 /** change an rrsig rrset for use as data rrset */
 static struct rrset_parse*
-change_rrsig_rrset(struct rrset_parse* sigset, struct msg_parse* msg, 
+change_rrsig_rrset(struct rrset_parse* sigset, struct msg_parse* msg,
 	sldns_buffer* pkt, uint16_t datatype, uint32_t rrset_flags,
 	int hasother, sldns_pkt_section section, struct regional* region)
 {
 	struct rrset_parse* dataset = sigset;
-	hashvalue_type hash = pkt_hash_rrset(pkt, sigset->dname, datatype, 
+	hashvalue_type hash = pkt_hash_rrset(pkt, sigset->dname, datatype,
 		sigset->rrset_class, rrset_flags);
 	log_assert( sigset->type == LDNS_RR_TYPE_RRSIG );
 	log_assert( datatype != LDNS_RR_TYPE_RRSIG );
 	if(hasother) {
 		/* need to make new rrset to hold data type */
-		dataset = new_rrset(msg, sigset->dname, sigset->dname_len, 
-			datatype, sigset->rrset_class, hash, rrset_flags, 
+		dataset = new_rrset(msg, sigset->dname, sigset->dname_len,
+			datatype, sigset->rrset_class, hash, rrset_flags,
 			section, region);
-		if(!dataset) 
+		if(!dataset)
 			return NULL;
 		switch(section) {
 			case LDNS_SECTION_ANSWER: msg->an_rrsets++; break;
@@ -411,7 +411,7 @@ change_rrsig_rrset(struct rrset_parse* sigset, struct msg_parse* msg,
 			case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets++; break;
 			default: log_assert(0);
 		}
-		if(!moveover_rrsigs(pkt, region, sigset, dataset, 
+		if(!moveover_rrsigs(pkt, region, sigset, dataset,
 			msg->qtype == LDNS_RR_TYPE_RRSIG ||
 			(msg->qtype == LDNS_RR_TYPE_ANY &&
 			section != LDNS_SECTION_ANSWER) ))
@@ -460,8 +460,8 @@ change_rrsig_rrset(struct rrset_parse* sigset, struct msg_parse* msg,
  * @return 0 on out of memory.
  */
 static int
-find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname, 
-	size_t dnamelen, uint16_t type, uint16_t dclass, hashvalue_type* hash, 
+find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname,
+	size_t dnamelen, uint16_t type, uint16_t dclass, hashvalue_type* hash,
 	uint32_t* rrset_flags,
 	uint8_t** prev_dname_first, uint8_t** prev_dname_last,
 	size_t* prev_dnamelen, uint16_t* prev_type,
@@ -474,7 +474,7 @@ find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname,
 		/* check if equal to previous item */
 		if(type == *prev_type && dclass == *prev_dclass &&
 			dnamelen == *prev_dnamelen &&
-			smart_compare(pkt, dname, *prev_dname_first, 
+			smart_compare(pkt, dname, *prev_dname_first,
 				*prev_dname_last) == 0 &&
 			type != LDNS_RR_TYPE_RRSIG) {
 			/* same as previous */
@@ -494,21 +494,21 @@ find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname,
 	}
 	/* find by hashing and lookup in hashtable */
 	*rrset_flags = pkt_rrset_flags(pkt, type, section);
-	
+
 	/* if rrsig - try to lookup matching data set first */
-	if(type == LDNS_RR_TYPE_RRSIG && pkt_rrsig_covered(pkt, 
+	if(type == LDNS_RR_TYPE_RRSIG && pkt_rrsig_covered(pkt,
 		sldns_buffer_current(pkt), &covtype)) {
-		*hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 
+		*hash = pkt_hash_rrset_rest(dname_h, covtype, dclass,
 			*rrset_flags);
-		*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 
+		*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash,
 			*rrset_flags, dname, dnamelen, covtype, dclass);
 		if(!*rrset_prev && covtype == LDNS_RR_TYPE_NSEC) {
 			/* if NSEC try with NSEC apex bit twiddled */
 			*rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX;
-			*hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 
+			*hash = pkt_hash_rrset_rest(dname_h, covtype, dclass,
 				*rrset_flags);
-			*rrset_prev = msgparse_hashtable_lookup(msg, pkt, 
-				*hash, *rrset_flags, dname, dnamelen, covtype, 
+			*rrset_prev = msgparse_hashtable_lookup(msg, pkt,
+				*hash, *rrset_flags, dname, dnamelen, covtype,
 				dclass);
 			if(!*rrset_prev) /* untwiddle if not found */
 				*rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX;
@@ -516,10 +516,10 @@ find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname,
 		if(!*rrset_prev && covtype == LDNS_RR_TYPE_SOA) {
 			/* if SOA try with SOA neg flag twiddled */
 			*rrset_flags ^= PACKED_RRSET_SOA_NEG;
-			*hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 
+			*hash = pkt_hash_rrset_rest(dname_h, covtype, dclass,
 				*rrset_flags);
-			*rrset_prev = msgparse_hashtable_lookup(msg, pkt, 
-				*hash, *rrset_flags, dname, dnamelen, covtype, 
+			*rrset_prev = msgparse_hashtable_lookup(msg, pkt,
+				*hash, *rrset_flags, dname, dnamelen, covtype,
 				dclass);
 			if(!*rrset_prev) /* untwiddle if not found */
 				*rrset_flags ^= PACKED_RRSET_SOA_NEG;
@@ -536,10 +536,10 @@ find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname,
 	if(type != LDNS_RR_TYPE_RRSIG) {
 		int hasother = 0;
 		/* find matching rrsig */
-		*hash = pkt_hash_rrset_rest(dname_h, LDNS_RR_TYPE_RRSIG, 
+		*hash = pkt_hash_rrset_rest(dname_h, LDNS_RR_TYPE_RRSIG,
 			dclass, 0);
-		*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 
-			0, dname, dnamelen, LDNS_RR_TYPE_RRSIG, 
+		*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash,
+			0, dname, dnamelen, LDNS_RR_TYPE_RRSIG,
 			dclass);
 		if(*rrset_prev && rrset_has_sigover(pkt, *rrset_prev, type,
 			&hasother)) {
@@ -549,8 +549,8 @@ find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname,
 			*prev_dnamelen = dnamelen;
 			*prev_type = type;
 			*prev_dclass = dclass;
-			*rrset_prev = change_rrsig_rrset(*rrset_prev, msg, 
-				pkt, type, *rrset_flags, hasother, section, 
+			*rrset_prev = change_rrsig_rrset(*rrset_prev, msg,
+				pkt, type, *rrset_flags, hasother, section,
 				region);
 			if(!*rrset_prev) return 0;
 			return 1;
@@ -558,7 +558,7 @@ find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname,
 	}
 
 	*hash = pkt_hash_rrset_rest(dname_h, type, dclass, *rrset_flags);
-	*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, *rrset_flags, 
+	*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, *rrset_flags,
 		dname, dnamelen, type, dclass);
 	if(*rrset_prev)
 		*prev_dname_first = (*rrset_prev)->dname;
@@ -571,7 +571,7 @@ find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname,
 }
 
 /**
- * Parse query section. 
+ * Parse query section.
  * @param pkt: packet, position at call must be at start of query section.
  *	at end position is after query section.
  * @param msg: store results here.
@@ -691,7 +691,7 @@ calc_size(sldns_buffer* pkt, uint16_t type, struct rr_parse* rr)
 
 /** skip rr ttl and rdata */
 static int
-skip_ttl_rdata(sldns_buffer* pkt) 
+skip_ttl_rdata(sldns_buffer* pkt)
 {
 	uint16_t rdatalen;
 	if(sldns_buffer_remaining(pkt) < 6) /* ttl + rdatalen */
@@ -711,7 +711,7 @@ sig_is_double(sldns_buffer* pkt, struct rrset_parse* rrset, uint8_t* ttldata)
 	uint16_t rlen, siglen;
 	size_t pos = sldns_buffer_position(pkt);
 	struct rr_parse* sig;
-	if(sldns_buffer_remaining(pkt) < 6) 
+	if(sldns_buffer_remaining(pkt) < 6)
 		return 0;
 	sldns_buffer_skip(pkt, 4); /* ttl */
 	rlen = sldns_buffer_read_u16(pkt);
@@ -731,11 +731,11 @@ sig_is_double(sldns_buffer* pkt, struct rrset_parse* rrset, uint8_t* ttldata)
 		 * to have compressed dnames anyway. If it is compressed anyway
 		 * it will lead to duplicate rrs for qtype=RRSIG. (or ANY).
 		 *
-		 * Cannot use sig->size because size of the other one is not 
+		 * Cannot use sig->size because size of the other one is not
 		 * calculated yet.
 		 */
 		if(siglen == rlen) {
-			if(siglen>0 && memcmp(sig->ttl_data+6, ttldata+6, 
+			if(siglen>0 && memcmp(sig->ttl_data+6, ttldata+6,
 				siglen) == 0) {
 				/* same! */
 				return 1;
@@ -748,8 +748,8 @@ sig_is_double(sldns_buffer* pkt, struct rrset_parse* rrset, uint8_t* ttldata)
 
 /** Add rr (from packet here) to rrset, skips rr */
 static int
-add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt, 
-	struct msg_parse* msg, struct regional* region, 
+add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt,
+	struct msg_parse* msg, struct regional* region,
 	sldns_pkt_section section, uint16_t type)
 {
 	struct rr_parse* rr;
@@ -757,8 +757,8 @@ add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt,
 	if(rrset->section != section && type != LDNS_RR_TYPE_RRSIG &&
 		rrset->type != LDNS_RR_TYPE_RRSIG) {
 		/* silently drop it - we drop the last part, since
-		 * trust in rr data depends on the section it is in. 
-		 * the less trustworthy part is discarded. 
+		 * trust in rr data depends on the section it is in.
+		 * the less trustworthy part is discarded.
 		 * also the last part is more likely to be incomplete.
 		 * RFC 2181: must put RRset only once in response. */
 		/*
@@ -770,16 +770,16 @@ add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt,
 		if(!skip_ttl_rdata(pkt))
 			return LDNS_RCODE_FORMERR;
 		return 0;
-	} 
+	}
 
 	if( (msg->qtype == LDNS_RR_TYPE_RRSIG ||
-	     msg->qtype == LDNS_RR_TYPE_ANY) 
+	     msg->qtype == LDNS_RR_TYPE_ANY)
 	    && sig_is_double(pkt, rrset, sldns_buffer_current(pkt))) {
 		if(!skip_ttl_rdata(pkt))
 			return LDNS_RCODE_FORMERR;
 		return 0;
 	}
-	
+
 	/* create rr */
 	if(!(rr = (struct rr_parse*)regional_alloc(region, sizeof(*rr))))
 		return LDNS_RCODE_SERVFAIL;
@@ -787,7 +787,7 @@ add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt,
 	rr->ttl_data = sldns_buffer_current(pkt);
 	rr->next = 0;
 	if(type == LDNS_RR_TYPE_RRSIG && rrset->type != LDNS_RR_TYPE_RRSIG) {
-		if(rrset->rrsig_last) 
+		if(rrset->rrsig_last)
 			rrset->rrsig_last->next = rr;
 		else	rrset->rrsig_first = rr;
 		rrset->rrsig_last = rr;
@@ -809,7 +809,7 @@ add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt,
 }
 
 /**
- * Parse packet RR section, for answer, authority and additional sections. 
+ * Parse packet RR section, for answer, authority and additional sections.
  * @param pkt: packet, position at call must be at start of section.
  *	at end position is after section.
  * @param msg: store results here.
@@ -820,8 +820,8 @@ add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt,
  * @return: 0 if OK, or rcode on error.
  */
 static int
-parse_section(sldns_buffer* pkt, struct msg_parse* msg, 
-	struct regional* region, sldns_pkt_section section, 
+parse_section(sldns_buffer* pkt, struct msg_parse* msg,
+	struct regional* region, sldns_pkt_section section,
 	uint16_t num_rrs, size_t* num_rrsets)
 {
 	uint16_t i;
@@ -851,7 +851,7 @@ parse_section(sldns_buffer* pkt, struct msg_parse* msg,
 		if(0) { /* debug show what is being parsed. */
 			if(type == LDNS_RR_TYPE_RRSIG) {
 				uint16_t t;
-				if(pkt_rrsig_covered(pkt, 
+				if(pkt_rrsig_covered(pkt,
 					sldns_buffer_current(pkt), &t))
 					fprintf(stderr, "parse of %s(%d) [%s(%d)]",
 					sldns_rr_descript(type)?
@@ -866,18 +866,18 @@ parse_section(sldns_buffer* pkt, struct msg_parse* msg,
 				sldns_rr_descript(type)->_name: "??",
 				(int)type);
 			fprintf(stderr, " %s(%d) ",
-				sldns_lookup_by_id(sldns_rr_classes, 
+				sldns_lookup_by_id(sldns_rr_classes,
 				(int)ntohs(dclass))?sldns_lookup_by_id(
-				sldns_rr_classes, (int)ntohs(dclass))->name: 
+				sldns_rr_classes, (int)ntohs(dclass))->name:
 				"??", (int)ntohs(dclass));
 			dname_print(stderr, pkt, dname);
 			fprintf(stderr, "\n");
 		}
 
 		/* see if it is part of an existing RR set */
-		if(!find_rrset(msg, pkt, dname, dnamelen, type, dclass, &hash, 
-			&rrset_flags, &prev_dname_f, &prev_dname_l, 
-			&prev_dnamelen, &prev_type, &prev_dclass, &rrset, 
+		if(!find_rrset(msg, pkt, dname, dnamelen, type, dclass, &hash,
+			&rrset_flags, &prev_dname_f, &prev_dname_l,
+			&prev_dnamelen, &prev_type, &prev_dclass, &rrset,
 			section, region))
 			return LDNS_RCODE_SERVFAIL;
 		if(!rrset) {
@@ -885,10 +885,10 @@ parse_section(sldns_buffer* pkt, struct msg_parse* msg,
 			(*num_rrsets)++;
 			rrset = new_rrset(msg, dname, dnamelen, type, dclass,
 				hash, rrset_flags, section, region);
-			if(!rrset) 
+			if(!rrset)
 				return LDNS_RCODE_SERVFAIL;
 		}
-		else if(0)	{ 
+		else if(0)	{
 			fprintf(stderr, "is part of existing: ");
 			dname_print(stderr, pkt, rrset->dname);
 			fprintf(stderr, " type %s(%d)\n",
@@ -897,7 +897,7 @@ parse_section(sldns_buffer* pkt, struct msg_parse* msg,
 				(int)rrset->type);
 		}
 		/* add to rrset. */
-		if((r=add_rr_to_rrset(rrset, pkt, msg, region, section, 
+		if((r=add_rr_to_rrset(rrset, pkt, msg, region, section,
 			type)) != 0)
 			return r;
 	}
@@ -1006,7 +1006,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 			 *
 			 * This should be the first time the client sends this
 			 * option, so c->tcp_keepalive is not set.
-			 * Besides adding the reply KEEPALIVE option, 
+			 * Besides adding the reply KEEPALIVE option,
 			 * c->tcp_keepalive will be set so that the
 			 * option will be added unsolicited in subsequent
 			 * responses (see the comment above the if-statement
@@ -1055,7 +1055,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 	return LDNS_RCODE_NOERROR;
 }
 
-int 
+int
 parse_extract_edns_from_response_msg(struct msg_parse* msg,
 	struct edns_data* edns, struct regional* region)
 {
@@ -1086,13 +1086,13 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
 	/* check the found RRset */
 	/* most lenient check possible. ignore dname, use last opt */
 	if(found->section != LDNS_SECTION_ADDITIONAL)
-		return LDNS_RCODE_FORMERR; 
+		return LDNS_RCODE_FORMERR;
 	if(found->rr_count == 0)
 		return LDNS_RCODE_FORMERR;
 	if(0) { /* strict checking of dname and RRcount */
-		if(found->dname_len != 1 || !found->dname 
-			|| found->dname[0] != 0) return LDNS_RCODE_FORMERR; 
-		if(found->rr_count != 1) return LDNS_RCODE_FORMERR; 
+		if(found->dname_len != 1 || !found->dname
+			|| found->dname[0] != 0) return LDNS_RCODE_FORMERR;
+		if(found->rr_count != 1) return LDNS_RCODE_FORMERR;
 	}
 	log_assert(found->rr_first && found->rr_last);
 
@@ -1104,7 +1104,7 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
 	msg->arcount --;
 	msg->ar_rrsets --;
 	msg->rrset_count --;
-	
+
 	/* take the data ! */
 	edns->edns_present = 1;
 	edns->ext_rcode = found->rr_last->ttl_data[0];
@@ -1168,7 +1168,7 @@ skip_pkt_rrs(sldns_buffer* pkt, int num)
 	return 1;
 }
 
-int 
+int
 parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns,
 	struct config_file* cfg, struct comm_point* c, struct regional* region)
 {
diff --git a/usr.sbin/unbound/util/data/msgparse.h b/usr.sbin/unbound/util/data/msgparse.h
index 0c458e6e8..1ad436742 100644
--- a/usr.sbin/unbound/util/data/msgparse.h
+++ b/usr.sbin/unbound/util/data/msgparse.h
@@ -1,25 +1,25 @@
 /*
  * util/data/msgparse.h - parse wireformat DNS messages.
- * 
+ *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -112,7 +112,7 @@ struct msg_parse {
 	/** count of RRsets per section. */
 	size_t an_rrsets;
 	/** count of RRsets per section. */
-	size_t ns_rrsets; 
+	size_t ns_rrsets;
 	/** count of RRsets per section. */
 	size_t ar_rrsets;
 	/** total number of rrsets found. */
@@ -132,7 +132,7 @@ struct msg_parse {
 	 * Based on name, type, class.  Same hash value as in rrset cache.
 	 */
 	struct rrset_parse* hashtable[PARSE_TABLE_SIZE];
-	
+
 	/** linked list of rrsets that have been found (in order). */
 	struct rrset_parse* rrset_first;
 	/** last element of rrset list. */
@@ -183,7 +183,7 @@ struct rrset_parse {
  * Data stored for an RR during parsing.
  */
 struct rr_parse {
-	/** 
+	/**
 	 * Pointer to the RR. Points to start of TTL value in the packet.
 	 * Rdata length and rdata follow it.
 	 * its dname, type and class are the same and stored for the rrset.
@@ -270,7 +270,7 @@ size_t get_rdf_size(sldns_rdf_type rdf);
  * @param region: how to alloc results.
  * @return: 0 if OK, or rcode on error.
  */
-int parse_packet(struct sldns_buffer* pkt, struct msg_parse* msg, 
+int parse_packet(struct sldns_buffer* pkt, struct msg_parse* msg,
 	struct regional* region);
 
 /**
@@ -341,8 +341,8 @@ hashvalue_type pkt_hash_rrset(struct sldns_buffer* pkt, uint8_t* dname,
  * @param dclass: rrset class, network order.
  * @return NULL or the rrset_parse if found.
  */
-struct rrset_parse* msgparse_hashtable_lookup(struct msg_parse* msg, 
-	struct sldns_buffer* pkt, hashvalue_type h, uint32_t rrset_flags, 
+struct rrset_parse* msgparse_hashtable_lookup(struct msg_parse* msg,
+	struct sldns_buffer* pkt, hashvalue_type h, uint32_t rrset_flags,
 	uint8_t* dname, size_t dnamelen, uint16_t type, uint16_t dclass);
 
 /**
diff --git a/usr.sbin/unbound/util/data/msgreply.c b/usr.sbin/unbound/util/data/msgreply.c
index 1e6ee9704..14925de7d 100644
--- a/usr.sbin/unbound/util/data/msgreply.c
+++ b/usr.sbin/unbound/util/data/msgreply.c
@@ -1,25 +1,25 @@
 /*
- * util/data/msgreply.c - store message and reply data. 
+ * util/data/msgreply.c - store message and reply data.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -72,12 +72,12 @@ int SERVE_ORIGINAL_TTL = 0;
 
 /** allocate qinfo, return 0 on error */
 static int
-parse_create_qinfo(sldns_buffer* pkt, struct msg_parse* msg, 
+parse_create_qinfo(sldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinf, struct regional* region)
 {
 	if(msg->qname) {
 		if(region)
-			qinf->qname = (uint8_t*)regional_alloc(region, 
+			qinf->qname = (uint8_t*)regional_alloc(region,
 				msg->qname_len);
 		else	qinf->qname = (uint8_t*)malloc(msg->qname_len);
 		if(!qinf->qname) return 0;
@@ -103,9 +103,9 @@ construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
 	if(total >= RR_COUNT_MAX) return NULL; /* sanity check on numRRS*/
 	if(region)
 		rep = (struct reply_info*)regional_alloc(region, s);
-	else	rep = (struct reply_info*)malloc(s + 
+	else	rep = (struct reply_info*)malloc(s +
 			sizeof(struct rrset_ref) * (total));
-	if(!rep) 
+	if(!rep)
 		return NULL;
 	rep->flags = flags;
 	rep->qdcount = qd;
@@ -135,8 +135,8 @@ static int
 parse_create_repinfo(struct msg_parse* msg, struct reply_info** rep,
 	struct regional* region)
 {
-	*rep = construct_reply_info_base(region, msg->flags, msg->qdcount, 0, 
-		0, 0, msg->an_rrsets, msg->ns_rrsets, msg->ar_rrsets, 
+	*rep = construct_reply_info_base(region, msg->flags, msg->qdcount, 0,
+		0, 0, msg->an_rrsets, msg->ns_rrsets, msg->ar_rrsets,
 		msg->rrset_count, sec_status_unchecked);
 	if(!*rep)
 		return 0;
@@ -151,10 +151,10 @@ reply_info_alloc_rrset_keys(struct reply_info* rep, struct alloc_cache* alloc,
 	for(i=0; i<rep->rrset_count; i++) {
 		if(region) {
 			rep->rrsets[i] = (struct ub_packed_rrset_key*)
-				regional_alloc(region, 
+				regional_alloc(region,
 				sizeof(struct ub_packed_rrset_key));
 			if(rep->rrsets[i]) {
-				memset(rep->rrsets[i], 0, 
+				memset(rep->rrsets[i], 0,
 					sizeof(struct ub_packed_rrset_key));
 				rep->rrsets[i]->entry.key = rep->rrsets[i];
 			}
@@ -207,7 +207,7 @@ soa_find_minttl(struct rr_parse* rr)
 
 /** do the rdata copy */
 static int
-rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to, 
+rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
 	struct rr_parse* rr, time_t* rr_ttl, uint16_t type,
 	sldns_pkt_section section)
 {
@@ -265,7 +265,7 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
 			switch(desc->_wireformat[rdf]) {
 			case LDNS_RDF_TYPE_DNAME:
 				oldpos = sldns_buffer_position(pkt);
-				dname_pkt_copy(pkt, to, 
+				dname_pkt_copy(pkt, to,
 					sldns_buffer_current(pkt));
 				to += pkt_dname_len(pkt);
 				pkt_len -= sldns_buffer_position(pkt)-oldpos;
@@ -292,13 +292,13 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
 	/* copy remaining rdata */
 	if(pkt_len >  0)
 		memmove(to, sldns_buffer_current(pkt), pkt_len);
-	
+
 	return 1;
 }
 
 /** copy over the data into packed rrset */
 static int
-parse_rr_copy(sldns_buffer* pkt, struct rrset_parse* pset, 
+parse_rr_copy(sldns_buffer* pkt, struct rrset_parse* pset,
 	struct packed_rrset_data* data)
 {
 	size_t i;
@@ -311,7 +311,7 @@ parse_rr_copy(sldns_buffer* pkt, struct rrset_parse* pset,
 	data->trust = rrset_trust_none;
 	data->security = sec_status_unchecked;
 	/* layout: struct - rr_len - rr_data - rr_ttl - rdata - rrsig */
-	data->rr_len = (size_t*)((uint8_t*)data + 
+	data->rr_len = (size_t*)((uint8_t*)data +
 		sizeof(struct packed_rrset_data));
 	data->rr_data = (uint8_t**)&(data->rr_len[total]);
 	data->rr_ttl = (time_t*)&(data->rr_data[total]);
@@ -320,7 +320,7 @@ parse_rr_copy(sldns_buffer* pkt, struct rrset_parse* pset,
 		data->rr_len[i] = rr->size;
 		data->rr_data[i] = nextrdata;
 		nextrdata += rr->size;
-		if(!rdata_copy(pkt, data, data->rr_data[i], rr, 
+		if(!rdata_copy(pkt, data, data->rr_data[i], rr,
 			&data->rr_ttl[i], pset->type, pset->section))
 			return 0;
 		rr = rr->next;
@@ -331,7 +331,7 @@ parse_rr_copy(sldns_buffer* pkt, struct rrset_parse* pset,
 		data->rr_len[i] = rr->size;
 		data->rr_data[i] = nextrdata;
 		nextrdata += rr->size;
-		if(!rdata_copy(pkt, data, data->rr_data[i], rr, 
+		if(!rdata_copy(pkt, data, data->rr_data[i], rr,
 			&data->rr_ttl[i], LDNS_RR_TYPE_RRSIG, pset->section))
 			return 0;
 		rr = rr->next;
@@ -349,9 +349,9 @@ parse_create_rrset(sldns_buffer* pkt, struct rrset_parse* pset,
 	if(pset->rr_count > RR_COUNT_MAX || pset->rrsig_count > RR_COUNT_MAX ||
 		pset->size > RR_COUNT_MAX)
 		return 0; /* protect against integer overflow */
-	s = sizeof(struct packed_rrset_data) + 
-		(pset->rr_count + pset->rrsig_count) * 
-		(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)) + 
+	s = sizeof(struct packed_rrset_data) +
+		(pset->rr_count + pset->rrsig_count) *
+		(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)) +
 		pset->size;
 	if(region)
 		*data = regional_alloc_zero(region, s);
@@ -377,14 +377,14 @@ get_rrset_trust(struct msg_parse* msg, struct rrset_parse* rrset)
 	if(rrset->section == LDNS_SECTION_ANSWER) {
 		if(AA) {
 			/* RFC2181 says remainder of CNAME chain is nonauth*/
-			if(msg->rrset_first && 
+			if(msg->rrset_first &&
 				msg->rrset_first->section==LDNS_SECTION_ANSWER
 				&& msg->rrset_first->type==LDNS_RR_TYPE_CNAME){
 				if(rrset == msg->rrset_first)
 					return rrset_trust_ans_AA;
 				else 	return rrset_trust_ans_noAA;
 			}
-			if(msg->rrset_first && 
+			if(msg->rrset_first &&
 				msg->rrset_first->section==LDNS_SECTION_ANSWER
 				&& msg->rrset_first->type==LDNS_RR_TYPE_DNAME){
 				if(rrset == msg->rrset_first ||
@@ -409,7 +409,7 @@ get_rrset_trust(struct msg_parse* msg, struct rrset_parse* rrset)
 
 int
 parse_copy_decompress_rrset(sldns_buffer* pkt, struct msg_parse* msg,
-	struct rrset_parse *pset, struct regional* region, 
+	struct rrset_parse *pset, struct regional* region,
 	struct ub_packed_rrset_key* pk)
 {
 	struct packed_rrset_data* data;
@@ -418,7 +418,7 @@ parse_copy_decompress_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 	if(region)
 		pk->rk.dname = (uint8_t*)regional_alloc(
 			region, pset->dname_len);
-	else	pk->rk.dname = 
+	else	pk->rk.dname =
 			(uint8_t*)malloc(pset->dname_len);
 	if(!pk->rk.dname)
 		return 0;
@@ -442,7 +442,7 @@ parse_copy_decompress_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 	return 1;
 }
 
-/** 
+/**
  * Copy and decompress rrs
  * @param pkt: the packet for compression pointer resolution.
  * @param msg: the parsed message
@@ -478,9 +478,9 @@ parse_copy_decompress(sldns_buffer* pkt, struct msg_parse* msg,
 	return 1;
 }
 
-int 
+int
 parse_create_msg(sldns_buffer* pkt, struct msg_parse* msg,
-	struct alloc_cache* alloc, struct query_info* qinf, 
+	struct alloc_cache* alloc, struct query_info* qinf,
 	struct reply_info** rep, struct regional* region)
 {
 	log_assert(pkt && msg);
@@ -500,13 +500,13 @@ parse_create_msg(sldns_buffer* pkt, struct msg_parse* msg,
 }
 
 int reply_info_parse(sldns_buffer* pkt, struct alloc_cache* alloc,
-        struct query_info* qinf, struct reply_info** rep, 
+        struct query_info* qinf, struct reply_info** rep,
 	struct regional* region, struct edns_data* edns)
 {
 	/* use scratch pad region-allocator during parsing. */
 	struct msg_parse* msg;
 	int ret;
-	
+
 	qinf->qname = NULL;
 	qinf->local_alias = NULL;
 	*rep = NULL;
@@ -514,7 +514,7 @@ int reply_info_parse(sldns_buffer* pkt, struct alloc_cache* alloc,
 		return LDNS_RCODE_SERVFAIL;
 	}
 	memset(msg, 0, sizeof(*msg));
-	
+
 	sldns_buffer_set_position(pkt, 0);
 	if((ret = parse_packet(pkt, msg, region)) != 0) {
 		return ret;
@@ -543,14 +543,14 @@ reply_info_sortref_cmp(const void* a, const void* b)
 	return 0;
 }
 
-void 
+void
 reply_info_sortref(struct reply_info* rep)
 {
 	qsort(&rep->ref[0], rep->rrset_count, sizeof(struct rrset_ref),
 		reply_info_sortref_cmp);
 }
 
-void 
+void
 reply_info_set_ttls(struct reply_info* rep, time_t timenow)
 {
 	size_t i, j;
@@ -570,11 +570,11 @@ reply_info_set_ttls(struct reply_info* rep, time_t timenow)
 	}
 }
 
-void 
+void
 reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc)
 {
 	size_t i;
-	if(!rep) 
+	if(!rep)
 		return;
 	/* no need to lock, since not shared in hashtables. */
 	for(i=0; i<rep->rrset_count; i++) {
@@ -583,7 +583,7 @@ reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc)
 	free(rep);
 }
 
-int 
+int
 query_info_parse(struct query_info* m, sldns_buffer* query)
 {
 	uint8_t* q = sldns_buffer_begin(query);
@@ -612,7 +612,7 @@ query_info_parse(struct query_info* m, sldns_buffer* query)
 	else if( (x) > (y) ) return +1; \
 	log_assert( (x) == (y) );
 
-int 
+int
 query_info_compare(void* m1, void* m2)
 {
 	struct query_info* msg1 = (struct query_info*)m1;
@@ -628,14 +628,14 @@ query_info_compare(void* m1, void* m2)
 #undef COMPARE_IT
 }
 
-void 
+void
 query_info_clear(struct query_info* m)
 {
 	free(m->qname);
 	m->qname = NULL;
 }
 
-size_t 
+size_t
 msgreply_sizefunc(void* k, void* d)
 {
 	struct msgreply_entry* q = (struct msgreply_entry*)k;
@@ -648,7 +648,7 @@ msgreply_sizefunc(void* k, void* d)
 	return s;
 }
 
-void 
+void
 query_entry_delete(void *k, void* ATTR_UNUSED(arg))
 {
 	struct msgreply_entry* q = (struct msgreply_entry*)k;
@@ -657,7 +657,7 @@ query_entry_delete(void *k, void* ATTR_UNUSED(arg))
 	free(q);
 }
 
-void 
+void
 reply_info_delete(void* d, void* ATTR_UNUSED(arg))
 {
 	struct reply_info* r = (struct reply_info*)d;
@@ -676,11 +676,11 @@ query_info_hash(struct query_info *q, uint16_t flags)
 	return h;
 }
 
-struct msgreply_entry* 
-query_info_entrysetup(struct query_info* q, struct reply_info* r, 
+struct msgreply_entry*
+query_info_entrysetup(struct query_info* q, struct reply_info* r,
 	hashvalue_type h)
 {
-	struct msgreply_entry* e = (struct msgreply_entry*)malloc( 
+	struct msgreply_entry* e = (struct msgreply_entry*)malloc(
 		sizeof(struct msgreply_entry));
 	if(!e) return NULL;
 	memcpy(&e->key, q, sizeof(*q));
@@ -703,7 +703,7 @@ query_info_entrysetup(struct query_info* q, struct reply_info* r,
 
 /** copy rrsets from replyinfo to dest replyinfo */
 static int
-repinfo_copy_rrsets(struct reply_info* dest, struct reply_info* from, 
+repinfo_copy_rrsets(struct reply_info* dest, struct reply_info* from,
 	struct regional* region)
 {
 	size_t i, s;
@@ -719,8 +719,8 @@ repinfo_copy_rrsets(struct reply_info* dest, struct reply_info* from,
 			dk->id = fk->id;
 			dk->rk.dname = (uint8_t*)regional_alloc_init(region,
 				fk->rk.dname, fk->rk.dname_len);
-		} else	
-			dk->rk.dname = (uint8_t*)memdup(fk->rk.dname, 
+		} else
+			dk->rk.dname = (uint8_t*)memdup(fk->rk.dname,
 				fk->rk.dname_len);
 		if(!dk->rk.dname)
 			return 0;
@@ -729,7 +729,7 @@ repinfo_copy_rrsets(struct reply_info* dest, struct reply_info* from,
 			dd = (struct packed_rrset_data*)regional_alloc_init(
 				region, fd, s);
 		else	dd = (struct packed_rrset_data*)memdup(fd, s);
-		if(!dd) 
+		if(!dd)
 			return 0;
 		packed_rrset_ptr_fixup(dd);
 		dk->entry.data = (void*)dd;
@@ -737,13 +737,13 @@ repinfo_copy_rrsets(struct reply_info* dest, struct reply_info* from,
 	return 1;
 }
 
-struct reply_info* 
-reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc, 
+struct reply_info*
+reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc,
 	struct regional* region)
 {
 	struct reply_info* cp;
-	cp = construct_reply_info_base(region, rep->flags, rep->qdcount, 
-		rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, 
+	cp = construct_reply_info_base(region, rep->flags, rep->qdcount,
+		rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl,
 		rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets,
 		rep->rrset_count, rep->security);
 	if(!cp)
@@ -762,7 +762,7 @@ reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc,
 	return cp;
 }
 
-uint8_t* 
+uint8_t*
 reply_find_final_cname_target(struct query_info* qinfo, struct reply_info* rep)
 {
 	uint8_t* sname = qinfo->qname;
@@ -771,8 +771,8 @@ reply_find_final_cname_target(struct query_info* qinfo, struct reply_info* rep)
 	for(i=0; i<rep->an_numrrsets; i++) {
 		struct ub_packed_rrset_key* s = rep->rrsets[i];
 		/* follow CNAME chain (if any) */
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME && 
-			ntohs(s->rk.rrset_class) == qinfo->qclass && 
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
+			ntohs(s->rk.rrset_class) == qinfo->qclass &&
 			snamelen == s->rk.dname_len &&
 			query_dname_compare(sname, s->rk.dname) == 0) {
 			get_cname_target(s, &sname, &snamelen);
@@ -783,7 +783,7 @@ reply_find_final_cname_target(struct query_info* qinfo, struct reply_info* rep)
 	return NULL;
 }
 
-struct ub_packed_rrset_key* 
+struct ub_packed_rrset_key*
 reply_find_answer_rrset(struct query_info* qinfo, struct reply_info* rep)
 {
 	uint8_t* sname = qinfo->qname;
@@ -792,15 +792,15 @@ reply_find_answer_rrset(struct query_info* qinfo, struct reply_info* rep)
 	for(i=0; i<rep->an_numrrsets; i++) {
 		struct ub_packed_rrset_key* s = rep->rrsets[i];
 		/* first match type, for query of qtype cname */
-		if(ntohs(s->rk.type) == qinfo->qtype && 
-			ntohs(s->rk.rrset_class) == qinfo->qclass && 
+		if(ntohs(s->rk.type) == qinfo->qtype &&
+			ntohs(s->rk.rrset_class) == qinfo->qclass &&
 			snamelen == s->rk.dname_len &&
 			query_dname_compare(sname, s->rk.dname) == 0) {
 			return s;
 		}
 		/* follow CNAME chain (if any) */
-		if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME && 
-			ntohs(s->rk.rrset_class) == qinfo->qclass && 
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
+			ntohs(s->rk.rrset_class) == qinfo->qclass &&
 			snamelen == s->rk.dname_len &&
 			query_dname_compare(sname, s->rk.dname) == 0) {
 			get_cname_target(s, &sname, &snamelen);
@@ -815,8 +815,8 @@ struct ub_packed_rrset_key* reply_find_rrset_section_an(struct reply_info* rep,
 	size_t i;
 	for(i=0; i<rep->an_numrrsets; i++) {
 		struct ub_packed_rrset_key* s = rep->rrsets[i];
-		if(ntohs(s->rk.type) == type && 
-			ntohs(s->rk.rrset_class) == dclass && 
+		if(ntohs(s->rk.type) == type &&
+			ntohs(s->rk.rrset_class) == dclass &&
 			namelen == s->rk.dname_len &&
 			query_dname_compare(name, s->rk.dname) == 0) {
 			return s;
@@ -831,8 +831,8 @@ struct ub_packed_rrset_key* reply_find_rrset_section_ns(struct reply_info* rep,
 	size_t i;
 	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
 		struct ub_packed_rrset_key* s = rep->rrsets[i];
-		if(ntohs(s->rk.type) == type && 
-			ntohs(s->rk.rrset_class) == dclass && 
+		if(ntohs(s->rk.type) == type &&
+			ntohs(s->rk.rrset_class) == dclass &&
 			namelen == s->rk.dname_len &&
 			query_dname_compare(name, s->rk.dname) == 0) {
 			return s;
@@ -847,8 +847,8 @@ struct ub_packed_rrset_key* reply_find_rrset(struct reply_info* rep,
 	size_t i;
 	for(i=0; i<rep->rrset_count; i++) {
 		struct ub_packed_rrset_key* s = rep->rrsets[i];
-		if(ntohs(s->rk.type) == type && 
-			ntohs(s->rk.rrset_class) == dclass && 
+		if(ntohs(s->rk.type) == type &&
+			ntohs(s->rk.rrset_class) == dclass &&
 			namelen == s->rk.dname_len &&
 			query_dname_compare(name, s->rk.dname) == 0) {
 			return s;
@@ -857,7 +857,7 @@ struct ub_packed_rrset_key* reply_find_rrset(struct reply_info* rep,
 	return NULL;
 }
 
-void 
+void
 log_dns_msg(const char* str, struct query_info* qinfo, struct reply_info* rep)
 {
 	/* not particularly fast but flexible, make wireformat and print */
@@ -927,14 +927,14 @@ log_reply_info(enum verbosity_value v, struct query_info *qinf,
 }
 
 void
-log_query_info(enum verbosity_value v, const char* str, 
+log_query_info(enum verbosity_value v, const char* str,
 	struct query_info* qinf)
 {
 	log_nametypeclass(v, str, qinf->qname, qinf->qtype, qinf->qclass);
 }
 
 int
-reply_check_cname_chain(struct query_info* qinfo, struct reply_info* rep) 
+reply_check_cname_chain(struct query_info* qinfo, struct reply_info* rep)
 {
 	/* check only answer section rrs for matching cname chain.
 	 * the cache may return changed rdata, but owner names are untouched.*/
@@ -959,7 +959,7 @@ reply_check_cname_chain(struct query_info* qinfo, struct reply_info* rep)
 }
 
 int
-reply_all_rrsets_secure(struct reply_info* rep) 
+reply_all_rrsets_secure(struct reply_info* rep)
 {
 	size_t i;
 	for(i=0; i<rep->rrset_count; i++) {
@@ -1167,7 +1167,7 @@ int inplace_cb_query_call(struct module_env* env, struct query_info* qinfo,
 	return 1;
 }
 
-int inplace_cb_edns_back_parsed_call(struct module_env* env, 
+int inplace_cb_edns_back_parsed_call(struct module_env* env,
 	struct module_qstate* qstate)
 {
 	struct inplace_cb* cb =
diff --git a/usr.sbin/unbound/util/data/msgreply.h b/usr.sbin/unbound/util/data/msgreply.h
index 9538adc5a..258271eeb 100644
--- a/usr.sbin/unbound/util/data/msgreply.h
+++ b/usr.sbin/unbound/util/data/msgreply.h
@@ -1,25 +1,25 @@
 /*
- * util/data/msgreply.h - store message and reply data. 
+ * util/data/msgreply.h - store message and reply data.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -68,8 +68,8 @@ struct dns_msg;
  * different.
  */
 struct query_info {
-	/** 
-	 * Salient data on the query: qname, in wireformat. 
+	/**
+	 * Salient data on the query: qname, in wireformat.
 	 * can be allocated or a pointer to outside buffer.
 	 * User has to keep track on the status of this.
 	 */
@@ -112,7 +112,7 @@ struct rrset_ref {
 /**
  * Structure to store DNS query and the reply packet.
  * To use it, copy over the flags from reply and modify using flags from
- * the query (RD,CD if not AA). prepend ID. 
+ * the query (RD,CD if not AA). prepend ID.
  *
  * Memory layout is:
  *	o struct
@@ -128,8 +128,8 @@ struct reply_info {
 	uint16_t flags;
 
 	/**
-	 * This flag informs unbound the answer is authoritative and 
-	 * the AA flag should be preserved. 
+	 * This flag informs unbound the answer is authoritative and
+	 * the AA flag should be preserved.
 	 */
 	uint8_t authoritative;
 
@@ -144,7 +144,7 @@ struct reply_info {
 	/** 32 bit padding to pad struct member alignment to 64 bits. */
 	uint32_t padding;
 
-	/** 
+	/**
 	 * TTL of the entire reply (for negative caching).
 	 * only for use when there are 0 RRsets in this message.
 	 * if there are RRsets, check those instead.
@@ -157,7 +157,7 @@ struct reply_info {
 	 */
 	time_t prefetch_ttl;
 
-	/** 
+	/**
 	 * Reply TTL extended with serve expired TTL, to limit time to serve
 	 * expired message.
 	 */
@@ -176,36 +176,36 @@ struct reply_info {
 	/**
 	 * Number of RRsets in each section.
 	 * The answer section. Add up the RRs in every RRset to calculate
-	 * the number of RRs, and the count for the dns packet. 
+	 * the number of RRs, and the count for the dns packet.
 	 * The number of RRs in RRsets can change due to RRset updates.
 	 */
 	size_t an_numrrsets;
 
 	/** Count of authority section RRsets */
-	size_t ns_numrrsets; 
+	size_t ns_numrrsets;
 	/** Count of additional section RRsets */
 	size_t ar_numrrsets;
 
 	/** number of RRsets: an_numrrsets + ns_numrrsets + ar_numrrsets */
 	size_t rrset_count;
 
-	/** 
-	 * List of pointers (only) to the rrsets in the order in which 
-	 * they appear in the reply message.  
+	/**
+	 * List of pointers (only) to the rrsets in the order in which
+	 * they appear in the reply message.
 	 * Number of elements is ancount+nscount+arcount RRsets.
-	 * This is a pointer to that array. 
+	 * This is a pointer to that array.
 	 * Use the accessor function for access.
 	 */
 	struct ub_packed_rrset_key** rrsets;
 
-	/** 
+	/**
 	 * Packed array of ids (see counts) and pointers to packed_rrset_key.
-	 * The number equals ancount+nscount+arcount RRsets. 
+	 * The number equals ancount+nscount+arcount RRsets.
 	 * These are sorted in ascending pointer, the locking order. So
-	 * this list can be locked (and id, ttl checked), to see if 
+	 * this list can be locked (and id, ttl checked), to see if
 	 * all the data is available and recent enough.
 	 *
-	 * This is defined as an array of size 1, so that the compiler 
+	 * This is defined as an array of size 1, so that the compiler
 	 * associates the identifier with this position in the structure.
 	 * Array bound overflow on this array then gives access to the further
 	 * elements of the array, which are allocated after the main structure.
@@ -248,8 +248,8 @@ construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd,
 		time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns,
 		size_t ar, size_t total, enum sec_status sec);
 
-/** 
- * Parse wire query into a queryinfo structure, return 0 on parse error. 
+/**
+ * Parse wire query into a queryinfo structure, return 0 on parse error.
  * initialises the (prealloced) queryinfo structure as well.
  * This query structure contains a pointer back info the buffer!
  * This pointer avoids memory allocation. allocqname does memory allocation.
@@ -276,7 +276,7 @@ int query_info_parse(struct query_info* m, struct sldns_buffer* query);
  *	o SERVFAIL for memory allocation errors.
  */
 int reply_info_parse(struct sldns_buffer* pkt, struct alloc_cache* alloc,
-	struct query_info* qinf, struct reply_info** rep, 
+	struct query_info* qinf, struct reply_info** rep,
 	struct regional* region, struct edns_data* edns);
 
 /**
@@ -310,13 +310,13 @@ void reply_info_sortref(struct reply_info* rep);
 
 /**
  * Set TTLs inside the replyinfo to absolute values.
- * @param rep: reply info. rrsets must be filled in. 
+ * @param rep: reply info. rrsets must be filled in.
  *	Also refs must be filled in.
  * @param timenow: the current time.
  */
 void reply_info_set_ttls(struct reply_info* rep, time_t timenow);
 
-/** 
+/**
  * Delete reply_info and packed_rrsets (while they are not yet added to the
  * hashtables.). Returns rrsets to the alloc cache.
  * @param rep: reply_info to delete.
@@ -325,7 +325,7 @@ void reply_info_set_ttls(struct reply_info* rep, time_t timenow);
 void reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc);
 
 /**
- * Compare two queryinfo structures, on query and type, class. 
+ * Compare two queryinfo structures, on query and type, class.
  * It is _not_ sorted in canonical ordering.
  * @param m1: struct query_info* , void* here to ease use as function pointer.
  * @param m2: struct query_info* , void* here to ease use as function pointer.
@@ -370,7 +370,7 @@ struct msgreply_entry* query_info_entrysetup(struct query_info* q,
  *	and no rrset_ref array in the reply is built up.
  * @return new reply info or NULL on memory error.
  */
-struct reply_info* reply_info_copy(struct reply_info* rep, 
+struct reply_info* reply_info_copy(struct reply_info* rep,
 	struct alloc_cache* alloc, struct regional* region);
 
 /**
@@ -415,7 +415,7 @@ make_new_reply_info(const struct reply_info* rep, struct regional* region,
  * @return false on alloc failure.
  */
 int parse_copy_decompress_rrset(struct sldns_buffer* pkt, struct msg_parse* msg,
-	struct rrset_parse *pset, struct regional* region, 
+	struct rrset_parse *pset, struct regional* region,
 	struct ub_packed_rrset_key* pk);
 
 /**
@@ -521,7 +521,7 @@ void log_reply_info(enum verbosity_value v, struct query_info *qinf,
  * @param str: string of message.
  * @param qinf: query info structure with name, type and class.
  */
-void log_query_info(enum verbosity_value v, const char* str, 
+void log_query_info(enum verbosity_value v, const char* str,
 	struct query_info* qinf);
 
 /**
@@ -697,7 +697,7 @@ int inplace_cb_query_call(struct module_env* env, struct query_info* qinfo,
  * @param qstate: module qstate.
  * @return false on failure (a callback function returned an error).
  */
-int inplace_cb_edns_back_parsed_call(struct module_env* env, 
+int inplace_cb_edns_back_parsed_call(struct module_env* env,
 	struct module_qstate* qstate);
 
 /**
diff --git a/usr.sbin/unbound/util/data/packed_rrset.c b/usr.sbin/unbound/util/data/packed_rrset.c
index e1a0833a2..5f5a07acf 100644
--- a/usr.sbin/unbound/util/data/packed_rrset.c
+++ b/usr.sbin/unbound/util/data/packed_rrset.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -66,7 +66,7 @@ ub_packed_rrset_parsedelete(struct ub_packed_rrset_key* pkey,
 	alloc_special_release(alloc, pkey);
 }
 
-size_t 
+size_t
 ub_rrset_sizefunc(void* key, void* data)
 {
 	struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)key;
@@ -76,22 +76,22 @@ ub_rrset_sizefunc(void* key, void* data)
 	return s;
 }
 
-size_t 
+size_t
 packed_rrset_sizeof(struct packed_rrset_data* d)
 {
 	size_t s;
 	if(d->rrsig_count > 0) {
-		s = ((uint8_t*)d->rr_data[d->count+d->rrsig_count-1] - 
+		s = ((uint8_t*)d->rr_data[d->count+d->rrsig_count-1] -
 			(uint8_t*)d) + d->rr_len[d->count+d->rrsig_count-1];
 	} else {
 		log_assert(d->count > 0);
-		s = ((uint8_t*)d->rr_data[d->count-1] - (uint8_t*)d) + 
+		s = ((uint8_t*)d->rr_data[d->count-1] - (uint8_t*)d) +
 			d->rr_len[d->count-1];
 	}
 	return s;
 }
 
-int 
+int
 ub_rrset_compare(void* k1, void* k2)
 {
 	struct ub_packed_rrset_key* key1 = (struct ub_packed_rrset_key*)k1;
@@ -124,7 +124,7 @@ ub_rrset_compare(void* k1, void* k2)
 	return 0;
 }
 
-void 
+void
 ub_rrset_key_delete(void* key, void* userdata)
 {
 	struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)key;
@@ -135,19 +135,19 @@ ub_rrset_key_delete(void* key, void* userdata)
 	alloc_special_release(a, k);
 }
 
-void 
+void
 rrset_data_delete(void* data, void* ATTR_UNUSED(userdata))
 {
 	struct packed_rrset_data* d = (struct packed_rrset_data*)data;
 	free(d);
 }
 
-int 
+int
 rrsetdata_equal(struct packed_rrset_data* d1, struct packed_rrset_data* d2)
 {
 	size_t i;
 	size_t total;
-	if(d1->count != d2->count || d1->rrsig_count != d2->rrsig_count) 
+	if(d1->count != d2->count || d1->rrsig_count != d2->rrsig_count)
 		return 0;
 	total = d1->count + d1->rrsig_count;
 	for(i=0; i<total; i++) {
@@ -174,7 +174,7 @@ rrset_key_hash(struct packed_rrset_key* key)
 	return h;
 }
 
-void 
+void
 packed_rrset_ptr_fixup(struct packed_rrset_data* data)
 {
 	size_t i;
@@ -192,13 +192,13 @@ packed_rrset_ptr_fixup(struct packed_rrset_data* data)
 	}
 }
 
-void 
-get_cname_target(struct ub_packed_rrset_key* rrset, uint8_t** dname, 
+void
+get_cname_target(struct ub_packed_rrset_key* rrset, uint8_t** dname,
 	size_t* dname_len)
 {
 	struct packed_rrset_data* d;
 	size_t len;
-	if(ntohs(rrset->rk.type) != LDNS_RR_TYPE_CNAME && 
+	if(ntohs(rrset->rk.type) != LDNS_RR_TYPE_CNAME &&
 		ntohs(rrset->rk.type) != LDNS_RR_TYPE_DNAME)
 		return;
 	d = (struct packed_rrset_data*)rrset->entry.data;
@@ -215,7 +215,7 @@ get_cname_target(struct ub_packed_rrset_key* rrset, uint8_t** dname,
 	*dname_len = len;
 }
 
-void 
+void
 packed_rrset_ttl_add(struct packed_rrset_data* data, time_t add)
 {
 	size_t i;
@@ -226,7 +226,7 @@ packed_rrset_ttl_add(struct packed_rrset_data* data, time_t add)
 		data->rr_ttl[i] += add;
 }
 
-const char* 
+const char*
 rrset_trust_to_string(enum rrset_trust s)
 {
 	switch(s) {
@@ -247,7 +247,7 @@ rrset_trust_to_string(enum rrset_trust s)
 	return "unknown_rrset_trust_value";
 }
 
-const char* 
+const char*
 sec_status_to_string(enum sec_status s)
 {
 	switch(s) {
@@ -261,7 +261,7 @@ sec_status_to_string(enum sec_status s)
 	return "unknown_sec_status_value";
 }
 
-void log_rrset_key(enum verbosity_value v, const char* str, 
+void log_rrset_key(enum verbosity_value v, const char* str,
 	struct ub_packed_rrset_key* rrset)
 {
 	if(verbosity >= v)
@@ -296,7 +296,7 @@ int packed_rr_to_string(struct ub_packed_rrset_key* rrset, size_t i,
 		log_info("rrbuf failure %d %s", (int)d->rr_len[i], dest);
 		dest[0] = 0;
 		return 0;
-	} 
+	}
 	return 1;
 }
 
@@ -318,7 +318,7 @@ void log_packed_rrset(enum verbosity_value v, const char* str,
 	}
 }
 
-time_t 
+time_t
 ub_packed_rrset_ttl(struct ub_packed_rrset_key* key)
 {
 	struct packed_rrset_data* d = (struct packed_rrset_data*)key->
@@ -327,10 +327,10 @@ ub_packed_rrset_ttl(struct ub_packed_rrset_key* key)
 }
 
 struct ub_packed_rrset_key*
-packed_rrset_copy_region(struct ub_packed_rrset_key* key, 
+packed_rrset_copy_region(struct ub_packed_rrset_key* key,
 	struct regional* region, time_t now)
 {
-	struct ub_packed_rrset_key* ck = regional_alloc(region, 
+	struct ub_packed_rrset_key* ck = regional_alloc(region,
 		sizeof(struct ub_packed_rrset_key));
 	struct packed_rrset_data* d;
 	struct packed_rrset_data* data = (struct packed_rrset_data*)
@@ -344,7 +344,7 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
 	ck->entry.hash = key->entry.hash;
 	ck->entry.key = ck;
 	ck->rk = key->rk;
-	ck->rk.dname = regional_alloc_init(region, key->rk.dname, 
+	ck->rk.dname = regional_alloc_init(region, key->rk.dname,
 		key->rk.dname_len);
 	if(!ck->rk.dname)
 		return NULL;
@@ -368,8 +368,8 @@ packed_rrset_copy_region(struct ub_packed_rrset_key* key,
 	return ck;
 }
 
-struct ub_packed_rrset_key* 
-packed_rrset_copy_alloc(struct ub_packed_rrset_key* key, 
+struct ub_packed_rrset_key*
+packed_rrset_copy_alloc(struct ub_packed_rrset_key* key,
 	struct alloc_cache* alloc, time_t now)
 {
 	struct packed_rrset_data* fd, *dd;
diff --git a/usr.sbin/unbound/util/data/packed_rrset.h b/usr.sbin/unbound/util/data/packed_rrset.h
index e1feb22bb..7d0f0a3cb 100644
--- a/usr.sbin/unbound/util/data/packed_rrset.h
+++ b/usr.sbin/unbound/util/data/packed_rrset.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -85,8 +85,8 @@ struct packed_rrset_key {
 	 * This dname is not canonicalized.
 	 */
 	uint8_t* dname;
-	/** 
-	 * Length of the domain name, including last 0 root octet. 
+	/**
+	 * Length of the domain name, including last 0 root octet.
 	 */
 	size_t dname_len;
 	/**
@@ -113,14 +113,14 @@ struct packed_rrset_key {
  * structure can be recycled with a new id.
  */
 struct ub_packed_rrset_key {
-	/** 
+	/**
 	 * entry into hashtable. Note the lock is never destroyed,
-	 *  even when this key is retired to the cache. 
+	 *  even when this key is retired to the cache.
 	 * the data pointer (if not null) points to a struct packed_rrset.
 	 */
 	struct lruhash_entry entry;
-	/** 
-	 * the ID of this rrset. unique, based on threadid + sequenceno. 
+	/**
+	 * the ID of this rrset. unique, based on threadid + sequenceno.
 	 * ids are not reused, except after flushing the cache.
 	 * zero is an unused entry, and never a valid id.
 	 * Check this value after getting entry.lock.
@@ -172,7 +172,7 @@ enum rrset_trust {
 	rrset_trust_prim_noglue,
 	/** DNSSEC(rfc4034) validated with trusted keys */
 	rrset_trust_validated,
-	/** ultimately trusted, no more trust is possible; 
+	/** ultimately trusted, no more trust is possible;
 	 * trusted keys from the unbound configuration setup. */
 	rrset_trust_ultimate
 };
@@ -187,19 +187,19 @@ enum sec_status {
 	/** BOGUS means that the object (RRset or message) failed to validate
 	 *  (according to local policy), but should have validated. */
 	sec_status_bogus,
-	/** INDETERMINATE means that the object is insecure, but not 
-	 * authoritatively so. Generally this means that the RRset is not 
+	/** INDETERMINATE means that the object is insecure, but not
+	 * authoritatively so. Generally this means that the RRset is not
 	 * below a configured trust anchor. */
 	sec_status_indeterminate,
-	/** INSECURE means that the object is authoritatively known to be 
-	 * insecure. Generally this means that this RRset is below a trust 
+	/** INSECURE means that the object is authoritatively known to be
+	 * insecure. Generally this means that this RRset is below a trust
 	 * anchor, but also below a verified, insecure delegation. */
 	sec_status_insecure,
 	/** SECURE_SENTINEL_FAIL means that the object (RRset or message)
 	 * validated according to local policy but did not succeed in the root
 	 * KSK sentinel test (draft-ietf-dnsop-kskroll-sentinel). */
 	sec_status_secure_sentinel_fail,
-	/** SECURE means that the object (RRset or message) validated 
+	/** SECURE means that the object (RRset or message) validated
 	 * according to local policy. */
 	sec_status_secure
 };
@@ -252,16 +252,16 @@ struct packed_rrset_data {
 	/** number of rrsigs, if 0 no rrsigs */
 	size_t rrsig_count;
 	/** the trustworthiness of the rrset data */
-	enum rrset_trust trust; 
+	enum rrset_trust trust;
 	/** security status of the rrset data */
 	enum sec_status security;
 	/** length of every rr's rdata, rr_len[i] is size of rr_data[i]. */
 	size_t* rr_len;
 	/** ttl of every rr. rr_ttl[i] ttl of rr i. */
 	time_t *rr_ttl;
-	/** 
-	 * Array of pointers to every rr's rdata. 
-	 * The rr_data[i] rdata is stored in uncompressed wireformat. 
+	/**
+	 * Array of pointers to every rr's rdata.
+	 * The rr_data[i] rdata is stored in uncompressed wireformat.
 	 * The first uint16_t of rr_data[i] is network format rdlength.
 	 *
 	 * rr_data[count] to rr_data[count+rrsig_count] contain the rrsig data.
@@ -379,7 +379,7 @@ void packed_rrset_ttl_add(struct packed_rrset_data* data, time_t add);
 /**
  * Utility procedure to extract CNAME target name from its rdata.
  * Failsafes; it will change passed dname to a valid dname or do nothing.
- * @param rrset: the rrset structure. Must be a CNAME. 
+ * @param rrset: the rrset structure. Must be a CNAME.
  *	Only first RR is used (multiple RRs are technically illegal anyway).
  * 	Also works on type DNAME. Returns target name.
  * @param dname: this pointer is updated to point into the cname rdata.
@@ -387,18 +387,18 @@ void packed_rrset_ttl_add(struct packed_rrset_data* data, time_t add);
  *	rdata was not a valid dname, not a CNAME, ...).
  * @param dname_len: length of dname is returned.
  */
-void get_cname_target(struct ub_packed_rrset_key* rrset, uint8_t** dname, 
+void get_cname_target(struct ub_packed_rrset_key* rrset, uint8_t** dname,
 	size_t* dname_len);
 
 /**
- * Get a printable string for a rrset trust value 
+ * Get a printable string for a rrset trust value
  * @param s: rrset trust value
  * @return printable string.
  */
 const char* rrset_trust_to_string(enum rrset_trust s);
 
 /**
- * Get a printable string for a security status value 
+ * Get a printable string for a security status value
  * @param s: security status
  * @return printable string.
  */
@@ -410,7 +410,7 @@ const char* sec_status_to_string(enum sec_status s);
  * @param str: string of message.
  * @param rrset: structure with name, type and class.
  */
-void log_rrset_key(enum verbosity_value v, const char* str, 
+void log_rrset_key(enum verbosity_value v, const char* str,
 	struct ub_packed_rrset_key* rrset);
 
 /**
@@ -434,8 +434,8 @@ int packed_rr_to_string(struct ub_packed_rrset_key* rrset, size_t i,
 void log_packed_rrset(enum verbosity_value v, const char* str,
 	struct ub_packed_rrset_key* rrset);
 
-/** 
- * Allocate rrset in region - no more locks needed 
+/**
+ * Allocate rrset in region - no more locks needed
  * @param key: a (just from rrset cache looked up) rrset key + valid,
  * 	packed data record.
  * @param region: where to alloc the copy
@@ -443,10 +443,10 @@ void log_packed_rrset(enum verbosity_value v, const char* str,
  * @return new region-alloced rrset key or NULL on alloc failure.
  */
 struct ub_packed_rrset_key* packed_rrset_copy_region(
-	struct ub_packed_rrset_key* key, struct regional* region, 
+	struct ub_packed_rrset_key* key, struct regional* region,
 	time_t now);
 
-/** 
+/**
  * Allocate rrset with malloc (from region or you are holding the lock).
  * @param key: key with data entry.
  * @param alloc: alloc_cache to create rrset_keys
@@ -454,7 +454,7 @@ struct ub_packed_rrset_key* packed_rrset_copy_region(
  * @return new region-alloced rrset key or NULL on alloc failure.
  */
 struct ub_packed_rrset_key* packed_rrset_copy_alloc(
-	struct ub_packed_rrset_key* key, struct alloc_cache* alloc, 
+	struct ub_packed_rrset_key* key, struct alloc_cache* alloc,
 	time_t now);
 
 /**
diff --git a/usr.sbin/unbound/util/fptr_wlist.c b/usr.sbin/unbound/util/fptr_wlist.c
index dc8ab6693..89de9dc13 100644
--- a/usr.sbin/unbound/util/fptr_wlist.c
+++ b/usr.sbin/unbound/util/fptr_wlist.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -38,7 +38,7 @@
  *
  * This file contains functions that check function pointers.
  * The functions contain a whitelist of known good callback values.
- * Any other values lead to an error. 
+ * Any other values lead to an error.
  *
  * Due to the listing nature, this file violates all the modularization
  * boundaries in the program.
@@ -100,7 +100,7 @@
 #include "dnstap/dtstream.h"
 #endif
 
-int 
+int
 fptr_whitelist_comm_point(comm_point_callback_type *fptr)
 {
 	if(fptr == &worker_handle_request) return 1;
@@ -113,7 +113,7 @@ fptr_whitelist_comm_point(comm_point_callback_type *fptr)
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_comm_point_raw(comm_point_callback_type *fptr)
 {
 	if(fptr == &tube_handle_listen) return 1;
@@ -123,7 +123,7 @@ fptr_whitelist_comm_point_raw(comm_point_callback_type *fptr)
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_comm_timer(void (*fptr)(void*))
 {
 	if(fptr == &pending_udp_timer_cb) return 1;
@@ -145,7 +145,7 @@ fptr_whitelist_comm_timer(void (*fptr)(void*))
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_comm_signal(void (*fptr)(int, void*))
 {
 	if(fptr == &worker_sighandler) return 1;
@@ -164,7 +164,7 @@ int fptr_whitelist_stop_accept(void (*fptr)(void*))
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_event(void (*fptr)(int, short, void *))
 {
 	if(fptr == &comm_point_udp_callback) return 1;
@@ -193,21 +193,21 @@ fptr_whitelist_event(void (*fptr)(int, short, void *))
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_pending_udp(comm_point_callback_type *fptr)
 {
 	if(fptr == &serviced_udp_callback) return 1;
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_pending_tcp(comm_point_callback_type *fptr)
 {
 	if(fptr == &serviced_tcp_callback) return 1;
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_serviced_query(comm_point_callback_type *fptr)
 {
 	if(fptr == &worker_handle_service_reply) return 1;
@@ -215,7 +215,7 @@ fptr_whitelist_serviced_query(comm_point_callback_type *fptr)
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_rbtree_cmp(int (*fptr) (const void *, const void *))
 {
 	if(fptr == &mesh_state_compare) return 1;
@@ -248,7 +248,7 @@ fptr_whitelist_rbtree_cmp(int (*fptr) (const void *, const void *))
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_hash_sizefunc(lruhash_sizefunc_type fptr)
 {
 	if(fptr == &msgreply_sizefunc) return 1;
@@ -268,7 +268,7 @@ fptr_whitelist_hash_sizefunc(lruhash_sizefunc_type fptr)
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_hash_compfunc(lruhash_compfunc_type fptr)
 {
 	if(fptr == &query_info_compare) return 1;
@@ -285,7 +285,7 @@ fptr_whitelist_hash_compfunc(lruhash_compfunc_type fptr)
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_hash_delkeyfunc(lruhash_delkeyfunc_type fptr)
 {
 	if(fptr == &query_entry_delete) return 1;
@@ -302,7 +302,7 @@ fptr_whitelist_hash_delkeyfunc(lruhash_delkeyfunc_type fptr)
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_hash_deldatafunc(lruhash_deldatafunc_type fptr)
 {
 	if(fptr == &reply_info_delete) return 1;
@@ -321,7 +321,7 @@ fptr_whitelist_hash_deldatafunc(lruhash_deldatafunc_type fptr)
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_type fptr)
 {
 	if(fptr == NULL) return 1;
@@ -333,7 +333,7 @@ fptr_whitelist_hash_markdelfunc(lruhash_markdelfunc_type fptr)
 }
 
 /** whitelist env->send_query callbacks */
-int 
+int
 fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
 	struct query_info* qinfo, uint16_t flags, int dnssec, int want_dnssec,
 	int nocaps, int check_ratelimit, struct sockaddr_storage* addr,
@@ -346,7 +346,7 @@ fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_modenv_detach_subs(void (*fptr)(
         struct module_qstate* qstate))
 {
@@ -354,7 +354,7 @@ fptr_whitelist_modenv_detach_subs(void (*fptr)(
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_modenv_attach_sub(int (*fptr)(
         struct module_qstate* qstate, struct query_info* qinfo,
         uint16_t qflags, int prime, int valrec, struct module_qstate** newq))
@@ -363,7 +363,7 @@ fptr_whitelist_modenv_attach_sub(int (*fptr)(
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_modenv_add_sub(int (*fptr)(
         struct module_qstate* qstate, struct query_info* qinfo,
         uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
@@ -373,14 +373,14 @@ fptr_whitelist_modenv_add_sub(int (*fptr)(
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_modenv_kill_sub(void (*fptr)(struct module_qstate* newq))
 {
 	if(fptr == &mesh_state_delete) return 1;
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_modenv_detect_cycle(int (*fptr)(
 	struct module_qstate* qstate, struct query_info* qinfo,
 	uint16_t flags, int prime, int valrec))
@@ -389,7 +389,7 @@ fptr_whitelist_modenv_detect_cycle(int (*fptr)(
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_mod_init(int (*fptr)(struct module_env* env, int id))
 {
 	if(fptr == &iter_init) return 1;
@@ -417,7 +417,7 @@ fptr_whitelist_mod_init(int (*fptr)(struct module_env* env, int id))
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_mod_deinit(void (*fptr)(struct module_env* env, int id))
 {
 	if(fptr == &iter_deinit) return 1;
@@ -445,7 +445,7 @@ fptr_whitelist_mod_deinit(void (*fptr)(struct module_env* env, int id))
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_mod_operate(void (*fptr)(struct module_qstate* qstate,
         enum module_ev event, int id, struct outbound_entry* outbound))
 {
@@ -474,7 +474,7 @@ fptr_whitelist_mod_operate(void (*fptr)(struct module_qstate* qstate,
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_mod_inform_super(void (*fptr)(
         struct module_qstate* qstate, int id, struct module_qstate* super))
 {
@@ -503,7 +503,7 @@ fptr_whitelist_mod_inform_super(void (*fptr)(
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_mod_clear(void (*fptr)(struct module_qstate* qstate,
         int id))
 {
@@ -532,7 +532,7 @@ fptr_whitelist_mod_clear(void (*fptr)(struct module_qstate* qstate,
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_mod_get_mem(size_t (*fptr)(struct module_env* env, int id))
 {
 	if(fptr == &iter_get_mem) return 1;
@@ -560,7 +560,7 @@ fptr_whitelist_mod_get_mem(size_t (*fptr)(struct module_env* env, int id))
 	return 0;
 }
 
-int 
+int
 fptr_whitelist_alloc_cleanup(void (*fptr)(void*))
 {
 	if(fptr == &worker_alloc_cleanup) return 1;
diff --git a/usr.sbin/unbound/util/fptr_wlist.h b/usr.sbin/unbound/util/fptr_wlist.h
index a0d986755..7a01620b7 100644
--- a/usr.sbin/unbound/util/fptr_wlist.h
+++ b/usr.sbin/unbound/util/fptr_wlist.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -38,10 +38,10 @@
  *
  * This file contains functions that check function pointers.
  * The functions contain a whitelist of known good callback values.
- * Any other values lead to an error. 
- * 
+ * Any other values lead to an error.
+ *
  * This prevent heap overflow based exploits, where the callback pointer
- * is overwritten by a buffer overflow (apart from this defense, buffer 
+ * is overwritten by a buffer overflow (apart from this defense, buffer
  * overflows should be fixed of course).
  *
  * Function pointers are used in
@@ -232,7 +232,7 @@ int fptr_whitelist_modenv_detach_subs(void (*fptr)(
  * @return false if not in whitelist.
  */
 int fptr_whitelist_modenv_attach_sub(int (*fptr)(
-	struct module_qstate* qstate, struct query_info* qinfo, 
+	struct module_qstate* qstate, struct query_info* qinfo,
 	uint16_t qflags, int prime, int valrec, struct module_qstate** newq));
 
 /**
@@ -259,7 +259,7 @@ int fptr_whitelist_modenv_kill_sub(void (*fptr)(struct module_qstate* newq));
  * @return false if not in whitelist.
  */
 int fptr_whitelist_modenv_detect_cycle(int (*fptr)(
-	struct module_qstate* qstate, struct query_info* qinfo, 
+	struct module_qstate* qstate, struct query_info* qinfo,
 	uint16_t flags, int prime, int valrec));
 
 /**
@@ -284,7 +284,7 @@ int fptr_whitelist_mod_deinit(void (*fptr)(struct module_env* env, int id));
  * @param fptr: function pointer to check.
  * @return false if not in whitelist.
  */
-int fptr_whitelist_mod_operate(void (*fptr)(struct module_qstate* qstate, 
+int fptr_whitelist_mod_operate(void (*fptr)(struct module_qstate* qstate,
 	enum module_ev event, int id, struct outbound_entry* outbound));
 
 /**
@@ -302,7 +302,7 @@ int fptr_whitelist_mod_inform_super(void (*fptr)(
  * @param fptr: function pointer to check.
  * @return false if not in whitelist.
  */
-int fptr_whitelist_mod_clear(void (*fptr)(struct module_qstate* qstate, 
+int fptr_whitelist_mod_clear(void (*fptr)(struct module_qstate* qstate,
 	int id));
 
 /**
@@ -387,16 +387,16 @@ int fptr_whitelist_serve_expired_lookup(serve_expired_lookup_func_type* fptr);
 
 /** Due to module breakage by fptr wlist, these test app declarations
  * are presented here */
-/** 
- * compare two order_ids from lock-verify test app 
+/**
+ * compare two order_ids from lock-verify test app
  * @param e1: first order_id
  * @param e2: second order_id
  * @return compare code -1, 0, +1 (like memcmp).
  */
 int order_lock_cmp(const void* e1, const void* e2);
 
-/** 
- * compare two codeline structs for rbtree from memstats test app 
+/**
+ * compare two codeline structs for rbtree from memstats test app
  * @param a: codeline
  * @param b: codeline
  * @return compare code -1, 0, +1 (like memcmp).
diff --git a/usr.sbin/unbound/util/locks.c b/usr.sbin/unbound/util/locks.c
index b65a02bdc..d68a47c3f 100644
--- a/usr.sbin/unbound/util/locks.c
+++ b/usr.sbin/unbound/util/locks.c
@@ -2,24 +2,24 @@
  * util/locks.c - unbound locking primitives
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -47,7 +47,7 @@
 #endif
 
 /** block all signals, masks them away. */
-void 
+void
 ub_thread_blocksigs(void)
 {
 #if defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS) || defined(HAVE_SIGPROCMASK)
@@ -63,7 +63,7 @@ ub_thread_blocksigs(void)
 #  ifdef HAVE_SOLARIS_THREADS
 	if((err=thr_sigsetmask(SIG_SETMASK, &sigset, NULL)))
 		fatal_exit("thr_sigsetmask: %s", strerror(err));
-#  else 
+#  else
 	/* have nothing, do single process signal mask */
 	if(sigprocmask(SIG_SETMASK, &sigset, NULL))
 		fatal_exit("sigprocmask: %s", strerror(errno));
@@ -89,7 +89,7 @@ void ub_thread_sig_unblock(int sig)
 #  ifdef HAVE_SOLARIS_THREADS
 	if((err=thr_sigsetmask(SIG_UNBLOCK, &sigset, NULL)))
 		fatal_exit("thr_sigsetmask: %s", strerror(err));
-#  else 
+#  else
 	/* have nothing, do single thread case */
 	if(sigprocmask(SIG_UNBLOCK, &sigset, NULL))
 		fatal_exit("sigprocmask: %s", strerror(errno));
@@ -109,7 +109,7 @@ void ub_thread_sig_unblock(int sig)
  * @param func: function body of the thread. Return value of func is lost.
  * @param arg: user argument to func.
  */
-void 
+void
 ub_thr_fork_create(ub_thread_type* thr, void* (*func)(void*), void* arg)
 {
 	pid_t pid = fork();
@@ -156,8 +156,8 @@ void* ub_thread_key_get(ub_thread_key_type key)
 static void log_win_err(const char* str, DWORD err)
 {
 	LPTSTR buf;
-	if(FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | 
-		FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_ALLOCATE_BUFFER, 
+	if(FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM |
+		FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_ALLOCATE_BUFFER,
 		NULL, err, 0, (LPTSTR)&buf, 0, NULL) == 0) {
 		/* could not format error message */
 		log_err("%s, GetLastError=%d", str, (int)err);
@@ -250,10 +250,10 @@ void ub_thread_join(ub_thread_type thr)
 {
 	DWORD ret = WaitForSingleObject(thr, INFINITE);
 	if(ret == WAIT_FAILED) {
-		log_win_err("WaitForSingleObject(Thread):WAIT_FAILED", 
+		log_win_err("WaitForSingleObject(Thread):WAIT_FAILED",
 			GetLastError());
 	} else if(ret == WAIT_TIMEOUT) {
-		log_win_err("WaitForSingleObject(Thread):WAIT_TIMEOUT", 
+		log_win_err("WaitForSingleObject(Thread):WAIT_TIMEOUT",
 			GetLastError());
 	}
 	/* and close the handle to the thread */
diff --git a/usr.sbin/unbound/util/locks.h b/usr.sbin/unbound/util/locks.h
index d86ee4923..d819d3c6b 100644
--- a/usr.sbin/unbound/util/locks.h
+++ b/usr.sbin/unbound/util/locks.h
@@ -2,24 +2,24 @@
  * util/locks.h - unbound locking primitives
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -51,7 +51,7 @@
  *     This lock is meant for non performance sensitive uses.
  *   o lock_quick: speed lock. For performance sensitive locking of critical
  *     sections. Could be implemented by a mutex or a spinlock.
- * 
+ *
  * Also thread creation and deletion functions are defined here.
  */
 
@@ -133,12 +133,12 @@ typedef pthread_mutex_t lock_quick_type;
 #else /* HAVE_PTHREAD_SPINLOCK_T */
 /** use pthread spinlock for the quick lock */
 typedef pthread_spinlock_t lock_quick_type;
-/** 
+/**
  * allocate process private since this is available whether
  * Thread Process-Shared Synchronization is supported or not.
  * This means only threads inside this process may access the lock.
  * (not threads from another process that shares memory).
- * spinlocks are not supported on all pthread platforms. 
+ * spinlocks are not supported on all pthread platforms.
  */
 #define lock_quick_init(lock) LOCKRET(pthread_spin_init(lock, PTHREAD_PROCESS_PRIVATE))
 #define lock_quick_destroy(lock) LOCKRET(pthread_spin_destroy(lock))
diff --git a/usr.sbin/unbound/util/log.c b/usr.sbin/unbound/util/log.c
index dfbb23349..1360df52f 100644
--- a/usr.sbin/unbound/util/log.c
+++ b/usr.sbin/unbound/util/log.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -92,13 +92,13 @@ log_init(const char* filename, int use_syslog, const char* chrootdir)
 		lock_basic_init(&log_lock);
 	}
 	lock_basic_lock(&log_lock);
-	if(logfile 
+	if(logfile
 #if defined(HAVE_SYSLOG_H) || defined(UB_ON_WINDOWS)
 	|| logging_to_syslog
 #endif
 	) {
 		lock_basic_unlock(&log_lock); /* verbose() needs the lock */
-		verbose(VERB_QUERY, "switching log to %s", 
+		verbose(VERB_QUERY, "switching log to %s",
 			use_syslog?"syslog":(filename&&filename[0]?filename:"stderr"));
 		lock_basic_lock(&log_lock);
 	}
@@ -140,12 +140,12 @@ log_init(const char* filename, int use_syslog, const char* chrootdir)
 	}
 	/* open the file for logging */
 	if(chrootdir && chrootdir[0] && strncmp(filename, chrootdir,
-		strlen(chrootdir)) == 0) 
+		strlen(chrootdir)) == 0)
 		filename += strlen(chrootdir);
 	f = fopen(filename, "a");
 	if(!f) {
 		lock_basic_unlock(&log_lock);
-		log_err("Could not open logfile %s: %s", filename, 
+		log_err("Could not open logfile %s: %s", filename,
 			strerror(errno));
 		return;
 	}
@@ -223,7 +223,7 @@ log_vmsg(int pri, const char* type,
 	char message[MAXSYSLOGMSGLEN];
 	unsigned int* tid = (unsigned int*)ub_thread_key_get(logkey);
 	time_t now;
-#if defined(HAVE_STRFTIME) && defined(HAVE_LOCALTIME_R) 
+#if defined(HAVE_STRFTIME) && defined(HAVE_LOCALTIME_R)
 	char tmbuf[32];
 	struct tm tm;
 #elif defined(UB_ON_WINDOWS)
@@ -233,7 +233,7 @@ log_vmsg(int pri, const char* type,
 	vsnprintf(message, sizeof(message), format, args);
 #ifdef HAVE_SYSLOG_H
 	if(logging_to_syslog) {
-		syslog(pri, "[%d:%x] %s: %s", 
+		syslog(pri, "[%d:%x] %s: %s",
 			(int)getpid(), tid?*tid:0, type, message);
 		return;
 	}
@@ -250,12 +250,12 @@ log_vmsg(int pri, const char* type,
 		} else if(strcmp(type, "warning") == 0) {
 			tp=MSG_GENERIC_WARN;
 			wt=EVENTLOG_WARNING_TYPE;
-		} else if(strcmp(type, "notice") == 0 
+		} else if(strcmp(type, "notice") == 0
 			|| strcmp(type, "debug") == 0) {
 			tp=MSG_GENERIC_SUCCESS;
 			wt=EVENTLOG_SUCCESS;
 		}
-		snprintf(m, sizeof(m), "[%s:%x] %s: %s", 
+		snprintf(m, sizeof(m), "[%s:%x] %s: %s",
 			ident, tid?*tid:0, type, message);
 		s = RegisterEventSource(NULL, SERVICE_NAME);
 		if(!s) return;
@@ -270,22 +270,22 @@ log_vmsg(int pri, const char* type,
 		return;
 	}
 	now = (time_t)time(NULL);
-#if defined(HAVE_STRFTIME) && defined(HAVE_LOCALTIME_R) 
+#if defined(HAVE_STRFTIME) && defined(HAVE_LOCALTIME_R)
 	if(log_time_asc && strftime(tmbuf, sizeof(tmbuf), "%b %d %H:%M:%S",
 		localtime_r(&now, &tm))%(sizeof(tmbuf)) != 0) {
 		/* %sizeof buf!=0 because old strftime returned max on error */
-		fprintf(logfile, "%s %s[%d:%x] %s: %s\n", tmbuf, 
+		fprintf(logfile, "%s %s[%d:%x] %s: %s\n", tmbuf,
 			ident, (int)getpid(), tid?*tid:0, type, message);
 	} else
 #elif defined(UB_ON_WINDOWS)
 	if(log_time_asc && GetTimeFormat(LOCALE_USER_DEFAULT, 0, NULL, NULL,
 		tmbuf, sizeof(tmbuf)) && GetDateFormat(LOCALE_USER_DEFAULT, 0,
 		NULL, NULL, dtbuf, sizeof(dtbuf))) {
-		fprintf(logfile, "%s %s %s[%d:%x] %s: %s\n", dtbuf, tmbuf, 
+		fprintf(logfile, "%s %s %s[%d:%x] %s: %s\n", dtbuf, tmbuf,
 			ident, (int)getpid(), tid?*tid:0, type, message);
 	} else
 #endif
-	fprintf(logfile, "[" ARG_LL "d] %s[%d:%x] %s: %s\n", (long long)now, 
+	fprintf(logfile, "[" ARG_LL "d] %s[%d:%x] %s: %s\n", (long long)now,
 		ident, (int)getpid(), tid?*tid:0, type, message);
 #ifdef UB_ON_WINDOWS
 	/* line buffering does not work on windows */
@@ -368,7 +368,7 @@ verbose(enum verbosity_value level, const char* format, ...)
 }
 
 /** log hex data */
-static void 
+static void
 log_hex_f(enum verbosity_value v, const char* msg, void* data, size_t length)
 {
 	size_t i, j;
@@ -392,12 +392,12 @@ log_hex_f(enum verbosity_value v, const char* msg, void* data, size_t length)
 			buf[j*2 + 1] = hexchar[ data8[i+j] & 0xF ];
 		}
 		buf[len*2] = 0;
-		verbose(v, "%s[%u:%u] %.*s", msg, (unsigned)length, 
+		verbose(v, "%s[%u:%u] %.*s", msg, (unsigned)length,
 			(unsigned)i, (int)len*2, buf);
 	}
 }
 
-void 
+void
 log_hex(const char* msg, void* data, size_t length)
 {
 	log_hex_f(verbosity, msg, data, length);
diff --git a/usr.sbin/unbound/util/log.h b/usr.sbin/unbound/util/log.h
index 29a1ba380..5276fcf89 100644
--- a/usr.sbin/unbound/util/log.h
+++ b/usr.sbin/unbound/util/log.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -67,11 +67,11 @@ extern enum verbosity_value verbosity;
 /**
  * log a verbose message, pass the level for this message.
  * It has printf formatted arguments. No trailing newline is needed.
- * @param level: verbosity level for this message, compared to global 
+ * @param level: verbosity level for this message, compared to global
  *	verbosity setting.
  * @param format: printf-style format string. Arguments follow.
  */
-void verbose(enum verbosity_value level, 
+void verbose(enum verbosity_value level,
 	const char* format, ...) ATTR_FORMAT(printf, 2, 3);
 
 /**
@@ -133,7 +133,7 @@ void log_ident_set_or_default(const char* identity);
 /**
  * Set if the time value is printed ascii or decimal in log entries.
  * @param use_asc: if true, ascii is printed, otherwise decimal.
- *	If the conversion fails or you have no time functions, 
+ *	If the conversion fails or you have no time functions,
  *	decimal is printed.
  */
 void log_set_time_asc(int use_asc);
@@ -187,7 +187,7 @@ void log_reply(const char* format, ...) ATTR_FORMAT(printf, 1, 2);
 
 /**
  * Easy alternative for log_hex, takes a sldns_buffer.
- * @param level: verbosity level for this message, compared to global 
+ * @param level: verbosity level for this message, compared to global
  *	verbosity setting.
  * @param msg: string desc to print
  * @param buf: the buffer.
diff --git a/usr.sbin/unbound/util/mini_event.c b/usr.sbin/unbound/util/mini_event.c
index c05dc668c..fd450d32f 100644
--- a/usr.sbin/unbound/util/mini_event.c
+++ b/usr.sbin/unbound/util/mini_event.c
@@ -2,24 +2,24 @@
  * mini_event.c - implementation of part of libevent api, portably.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -31,7 +31,7 @@
  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- * 
+ *
  */
 
 /**
@@ -108,7 +108,7 @@ void *event_init(time_t* time_secs, struct timeval* time_tv)
 	if((int)FD_SETSIZE < base->capfd)
 		base->capfd = (int)FD_SETSIZE;
 #endif
-	base->fds = (struct event**)calloc((size_t)base->capfd, 
+	base->fds = (struct event**)calloc((size_t)base->capfd,
 		sizeof(struct event*));
 	if(!base->fds) {
 		event_base_free(base);
@@ -139,7 +139,7 @@ const char *event_get_method(void)
 }
 
 /** call timeouts handlers, and return how long to wait for next one or -1 */
-static void handle_timeouts(struct event_base* base, struct timeval* now, 
+static void handle_timeouts(struct event_base* base, struct timeval* now,
 	struct timeval* wait)
 {
 	struct event* p;
@@ -151,7 +151,7 @@ static void handle_timeouts(struct event_base* base, struct timeval* now,
 		!=RBTREE_NULL) {
 #ifndef S_SPLINT_S
 		if(p->ev_timeout.tv_sec > now->tv_sec ||
-			(p->ev_timeout.tv_sec==now->tv_sec && 
+			(p->ev_timeout.tv_sec==now->tv_sec &&
 		 	p->ev_timeout.tv_usec > now->tv_usec)) {
 			/* there is a next larger timeout. wait for it */
 			wait->tv_sec = p->ev_timeout.tv_sec - now->tv_sec;
@@ -160,7 +160,7 @@ static void handle_timeouts(struct event_base* base, struct timeval* now,
 				wait->tv_usec = 1000000 - (now->tv_usec -
 					p->ev_timeout.tv_usec);
 			} else {
-				wait->tv_usec = p->ev_timeout.tv_usec 
+				wait->tv_usec = p->ev_timeout.tv_usec
 					- now->tv_usec;
 			}
 			return;
@@ -199,7 +199,7 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 	}
 	if(settime(base) < 0)
 		return -1;
-	
+
 	for(i=0; i<base->maxfd+1; i++) {
 		short bits = 0;
 		if(!base->fds[i] || !(FD_ISSET(i, &base->ready))) {
@@ -217,7 +217,7 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 		if(bits) {
 			fptr_ok(fptr_whitelist_event(
 				base->fds[i]->ev_callback));
-			(*base->fds[i]->ev_callback)(base->fds[i]->ev_fd, 
+			(*base->fds[i]->ev_callback)(base->fds[i]->ev_fd,
 				bits, base->fds[i]->ev_arg);
 			if(ret==0)
 				break;
@@ -249,7 +249,7 @@ int event_base_dispatch(struct event_base* base)
 }
 
 /** exit that loop */
-int event_base_loopexit(struct event_base* base, 
+int event_base_loopexit(struct event_base* base,
 	struct timeval* ATTR_UNUSED(tv))
 {
 	base->need_to_exit = 1;
@@ -268,7 +268,7 @@ void event_base_free(struct event_base* base)
 }
 
 /** set content of event */
-void event_set(struct event* ev, int fd, short bits, 
+void event_set(struct event* ev, int fd, short bits,
 	void (*cb)(int, short, void *), void* arg)
 {
 	ev->node.key = ev;
diff --git a/usr.sbin/unbound/util/mini_event.h b/usr.sbin/unbound/util/mini_event.h
index fa71ca3d1..29ccd4a05 100644
--- a/usr.sbin/unbound/util/mini_event.h
+++ b/usr.sbin/unbound/util/mini_event.h
@@ -2,24 +2,24 @@
  * mini-event.h - micro implementation of libevent api, using select() only.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -42,7 +42,7 @@
  *
  * Although limited to select() and a max (1024) open fds, it
  * is efficient:
- * o dispatch call caches fd_sets to use. 
+ * o dispatch call caches fd_sets to use.
  * o handler calling takes time ~ to the number of fds.
  * o timeouts are stored in a redblack tree, sorted, so take log(n).
  * Timeouts are only accurate to the second (no subsecond accuracy).
@@ -62,7 +62,7 @@
 
 #ifndef HAVE_EVENT_BASE_FREE
 #define HAVE_EVENT_BASE_FREE
-#endif 
+#endif
 
 /* redefine to use our own namespace so that on platforms where
  * linkers crosslink library-private symbols with other symbols, it works */
@@ -110,13 +110,13 @@ struct event_base
 	/** capacity - size of the fds array */
 	int capfd;
 	/* fdset for read write, for fds ready, and added */
-	fd_set 
+	fd_set
 		/** fds for reading */
-		reads, 
+		reads,
 		/** fds for writing */
-		writes, 
+		writes,
 		/** fds determined ready for use */
-		ready, 
+		ready,
 		/** ready plus newly added events. */
 		content;
 	/** array of 0 - maxsig of ptr to event for it */
diff --git a/usr.sbin/unbound/util/module.c b/usr.sbin/unbound/util/module.c
index 6698f9497..6f69094c4 100644
--- a/usr.sbin/unbound/util/module.c
+++ b/usr.sbin/unbound/util/module.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -45,7 +45,7 @@
 #include "util/data/dname.h"
 #include "util/net_help.h"
 
-const char* 
+const char*
 strextstate(enum module_ext_state s)
 {
 	switch(s) {
@@ -60,7 +60,7 @@ strextstate(enum module_ext_state s)
 	return "bad_extstate_value";
 }
 
-const char* 
+const char*
 strmodulevent(enum module_ev e)
 {
 	switch(e) {
@@ -118,9 +118,9 @@ void errinf_origin(struct module_qstate* qstate, struct sock_list *origin)
 			snprintf(buf, sizeof(buf), "from ");
 		else	snprintf(buf, sizeof(buf), "and ");
 		if(p->len == 0)
-			snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), 
+			snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf),
 				"cache");
-		else 
+		else
 			addr_to_str(&p->addr, p->len, buf+strlen(buf),
 				sizeof(buf)-strlen(buf));
 		errinf(qstate, buf);
@@ -286,7 +286,7 @@ inplace_cb_register(void* cb, enum inplace_cb_list_type type, void* cbarg,
 	callback->next = NULL;
 	callback->cb = cb;
 	callback->cb_arg = cbarg;
-	
+
 	prevp = (struct inplace_cb**) &env->inplace_cb_lists[type];
 	/* append at end of list */
 	while(*prevp != NULL)
diff --git a/usr.sbin/unbound/util/module.h b/usr.sbin/unbound/util/module.h
index 013c65b02..a3b9fd759 100644
--- a/usr.sbin/unbound/util/module.h
+++ b/usr.sbin/unbound/util/module.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -300,7 +300,7 @@ typedef int inplace_cb_query_func_type(struct query_info* qinfo, uint16_t flags,
  *	id: module id.
  *	cb_args: argument passed when registering callback.
  */
-typedef int inplace_cb_edns_back_parsed_func_type(struct module_qstate* qstate, 
+typedef int inplace_cb_edns_back_parsed_func_type(struct module_qstate* qstate,
 	int id, void* cb_args);
 
 /**
@@ -344,9 +344,9 @@ struct module_env {
 	struct key_cache* key_cache;
 
 	/* --- services --- */
-	/** 
+	/**
 	 * Send serviced DNS query to server. UDP/TCP and EDNS is handled.
-	 * operate() should return with wait_reply. Later on a callback 
+	 * operate() should return with wait_reply. Later on a callback
 	 * will cause operate() to be called with event timeout or reply.
 	 * The time until a timeout is calculated from roundtrip timing,
 	 * several UDP retries are attempted.
@@ -403,19 +403,19 @@ struct module_env {
 	 * o need to initialise the new state (module init; it is a new state).
 	 *   so that the next run of the query with this module is successful.
 	 * o no init needed, attachment successful.
-	 * 
-	 * @param qstate: the state to find mesh state, and that wants to 
+	 *
+	 * @param qstate: the state to find mesh state, and that wants to
 	 * 	receive the results from the new subquery.
 	 * @param qinfo: what to query for (copied).
 	 * @param qflags: what flags to use (RD, CD flag or not).
 	 * @param prime: if it is a (stub) priming query.
 	 * @param valrec: validation lookup recursion, does not need validation
-	 * @param newq: If the new subquery needs initialisation, it is 
+	 * @param newq: If the new subquery needs initialisation, it is
 	 * 	returned, otherwise NULL is returned.
 	 * @return: false on error, true if success (and init may be needed).
-	 */ 
-	int (*attach_sub)(struct module_qstate* qstate, 
-		struct query_info* qinfo, uint16_t qflags, int prime, 
+	 */
+	int (*attach_sub)(struct module_qstate* qstate,
+		struct query_info* qinfo, uint16_t qflags, int prime,
 		int valrec, struct module_qstate** newq);
 
 	/**
@@ -444,13 +444,13 @@ struct module_env {
 	 * @param sub: The added mesh state, created if it did not exist already.
 	 * @return: false on error, true if success (and init may be needed).
 	 */
-	int (*add_sub)(struct module_qstate* qstate, 
-		struct query_info* qinfo, uint16_t qflags, int prime, 
+	int (*add_sub)(struct module_qstate* qstate,
+		struct query_info* qinfo, uint16_t qflags, int prime,
 		int valrec, struct module_qstate** newq,
 		struct mesh_state** sub);
 
 	/**
-	 * Kill newly attached sub. If attach_sub returns newq for 
+	 * Kill newly attached sub. If attach_sub returns newq for
 	 * initialisation, but that fails, then this routine will cleanup and
 	 * delete the freshly created sub.
 	 * @param newq: the new subquery that is no longer needed.
@@ -462,16 +462,16 @@ struct module_env {
 	 * Detect if adding a dependency for qstate on name,type,class will
 	 * create a dependency cycle.
 	 * @param qstate: given mesh querystate.
-	 * @param qinfo: query info for dependency. 
+	 * @param qinfo: query info for dependency.
 	 * @param flags: query flags of dependency, RD/CD flags.
 	 * @param prime: if dependency is a priming query or not.
 	 * @param valrec: validation lookup recursion, does not need validation
-	 * @return true if the name,type,class exists and the given 
-	 * 	qstate mesh exists as a dependency of that name. Thus 
-	 * 	if qstate becomes dependent on name,type,class then a 
+	 * @return true if the name,type,class exists and the given
+	 * 	qstate mesh exists as a dependency of that name. Thus
+	 * 	if qstate becomes dependent on name,type,class then a
 	 * 	cycle is created.
 	 */
-	int (*detect_cycle)(struct module_qstate* qstate, 
+	int (*detect_cycle)(struct module_qstate* qstate,
 		struct query_info* qinfo, uint16_t flags, int prime,
 		int valrec);
 
@@ -513,12 +513,12 @@ struct module_env {
 	/** Mapping of forwarding zones to targets.
 	 * iterator forwarder information. per-thread, created by worker */
 	struct iter_forwards* fwds;
-	/** 
+	/**
 	 * iterator forwarder information. per-thread, created by worker.
-	 * The hints -- these aren't stored in the cache because they don't 
-	 * expire. The hints are always used to "prime" the cache. Note 
-	 * that both root hints and stub zone "hints" are stored in this 
-	 * data structure. 
+	 * The hints -- these aren't stored in the cache because they don't
+	 * expire. The hints are always used to "prime" the cache. Note
+	 * that both root hints and stub zone "hints" are stored in this
+	 * data structure.
 	 */
 	struct iter_hints* hints;
 	/** module specific data. indexed by module id. */
@@ -542,7 +542,7 @@ struct module_env {
 };
 
 /**
- * External visible states of the module state machine 
+ * External visible states of the module state machine
  * Modules may also have an internal state.
  * Modules are supposed to run to completion or until blocked.
  */
@@ -583,8 +583,8 @@ enum module_ev {
 	module_event_error
 };
 
-/** 
- * Linked list of sockaddrs 
+/**
+ * Linked list of sockaddrs
  * May be allocated such that only 'len' bytes of addr exist for the structure.
  */
 struct sock_list {
@@ -688,14 +688,14 @@ struct module_qstate {
 	int is_drop;
 };
 
-/** 
+/**
  * Module functionality block
  */
 struct module_func_block {
 	/** text string name of module */
 	const char* name;
 
-	/** 
+	/**
 	 * init the module. Called once for the global state.
 	 * This is the place to apply settings from the config file.
 	 * @param env: module environment.
@@ -714,14 +714,14 @@ struct module_func_block {
 	/**
 	 * accept a new query, or work further on existing query.
 	 * Changes the qstate->ext_state to be correct on exit.
-	 * @param ev: event that causes the module state machine to 
+	 * @param ev: event that causes the module state machine to
 	 *	(re-)activate.
-	 * @param qstate: the query state. 
+	 * @param qstate: the query state.
 	 *	Note that this method is not allowed to change the
 	 *	query state 'identity', that is query info, qflags,
 	 *	and priming status.
 	 *	Attach a subquery to get results to a different query.
-	 * @param id: module id number that operate() is called on. 
+	 * @param id: module id number that operate() is called on.
 	 * @param outbound: if not NULL this event is due to the reply/timeout
 	 *	or error on this outbound query.
 	 * @return: if at exit the ext_state is:
@@ -731,7 +731,7 @@ struct module_func_block {
 	 *	  the service routine to make subrequest or send message
 	 *	  have been called.
 	 */
-	void (*operate)(struct module_qstate* qstate, enum module_ev event, 
+	void (*operate)(struct module_qstate* qstate, enum module_ev event,
 		int id, struct outbound_entry* outbound);
 
 	/**
@@ -753,7 +753,7 @@ struct module_func_block {
 	void (*clear)(struct module_qstate* qstate, int id);
 
 	/**
-	 * How much memory is the module specific data using. 
+	 * How much memory is the module specific data using.
 	 * @param env: module environment.
 	 * @param id: the module id.
 	 * @return the number of bytes that are alloced.
@@ -761,15 +761,15 @@ struct module_func_block {
 	size_t (*get_mem)(struct module_env* env, int id);
 };
 
-/** 
- * Debug utility: module external qstate to string 
+/**
+ * Debug utility: module external qstate to string
  * @param s: the state value.
  * @return descriptive string.
  */
 const char* strextstate(enum module_ext_state s);
 
-/** 
- * Debug utility: module event to string 
+/**
+ * Debug utility: module event to string
  * @param e: the module event value.
  * @return descriptive string.
  */
@@ -788,7 +788,7 @@ void errinf_ede(struct module_qstate* qstate, const char* str,
 /**
  * Append text to error info:  from 1.2.3.4
  * @param qstate: query state.
- * @param origin: sock list with origin of trouble. 
+ * @param origin: sock list with origin of trouble.
  *  Every element added.
  *  If NULL: nothing is added.
  *  if 0len element: 'from cache' is added.
@@ -808,7 +808,7 @@ void errinf_rrset(struct module_qstate* qstate, struct ub_packed_rrset_key *rr);
  * @param str: explanation string
  * @param dname: the dname.
  */
-void errinf_dname(struct module_qstate* qstate, const char* str, 
+void errinf_dname(struct module_qstate* qstate, const char* str,
     uint8_t* dname);
 
 /**
diff --git a/usr.sbin/unbound/util/net_help.c b/usr.sbin/unbound/util/net_help.c
index 54fad6986..d7146be8f 100644
--- a/usr.sbin/unbound/util/net_help.c
+++ b/usr.sbin/unbound/util/net_help.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -130,8 +130,8 @@ str_is_ip6(const char* str)
 	else    return 0;
 }
 
-int 
-fd_set_nonblock(int s) 
+int
+fd_set_nonblock(int s)
 {
 #ifdef HAVE_FCNTL
 	int flag;
@@ -147,15 +147,15 @@ fd_set_nonblock(int s)
 #elif defined(HAVE_IOCTLSOCKET)
 	unsigned long on = 1;
 	if(ioctlsocket(s, FIONBIO, &on) != 0) {
-		log_err("can't ioctlsocket FIONBIO on: %s", 
+		log_err("can't ioctlsocket FIONBIO on: %s",
 			wsa_strerror(WSAGetLastError()));
 	}
 #endif
 	return 1;
 }
 
-int 
-fd_set_block(int s) 
+int
+fd_set_block(int s)
 {
 #ifdef HAVE_FCNTL
 	int flag;
@@ -172,21 +172,21 @@ fd_set_block(int s)
 	unsigned long off = 0;
 	if(ioctlsocket(s, FIONBIO, &off) != 0) {
 		if(WSAGetLastError() != WSAEINVAL || verbosity >= 4)
-			log_err("can't ioctlsocket FIONBIO off: %s", 
+			log_err("can't ioctlsocket FIONBIO off: %s",
 				wsa_strerror(WSAGetLastError()));
 	}
-#endif	
+#endif
 	return 1;
 }
 
-int 
+int
 is_pow2(size_t num)
 {
 	if(num == 0) return 1;
 	return (num & (num-1)) == 0;
 }
 
-void* 
+void*
 memdup(void* data, size_t len)
 {
 	void* d;
@@ -199,7 +199,7 @@ memdup(void* data, size_t len)
 }
 
 void
-log_addr(enum verbosity_value v, const char* str, 
+log_addr(enum verbosity_value v, const char* str,
 	struct sockaddr_storage* addr, socklen_t addrlen)
 {
 	uint16_t port;
@@ -228,7 +228,7 @@ log_addr(enum verbosity_value v, const char* str,
 	dest[sizeof(dest)-1] = 0;
 	port = ntohs(((struct sockaddr_in*)addr)->sin_port);
 	if(verbosity >= 4)
-		verbose(v, "%s %s %s port %d (len %d)", str, family, dest, 
+		verbose(v, "%s %s %s port %d (len %d)", str, family, dest,
 			(int)port, (int)addrlen);
 	else	verbose(v, "%s %s port %d", str, dest, (int)port);
 }
@@ -254,7 +254,7 @@ extstrtoaddr(const char* str, struct sockaddr_storage* addr,
 	return ipstrtoaddr(str, port, addr, addrlen);
 }
 
-int 
+int
 ipstrtoaddr(const char* ip, int port, struct sockaddr_storage* addr,
 	socklen_t* addrlen)
 {
@@ -434,7 +434,7 @@ int netblockdnametoaddr(uint8_t* dname, size_t dnamelen,
 	return 1;
 }
 
-int authextstrtoaddr(char* str, struct sockaddr_storage* addr, 
+int authextstrtoaddr(char* str, struct sockaddr_storage* addr,
 	socklen_t* addrlen, char** auth_name)
 {
 	char* s;
@@ -528,12 +528,12 @@ sockaddr_store_port(struct sockaddr_storage* addr, socklen_t addrlen, int port)
 }
 
 void
-log_nametypeclass(enum verbosity_value v, const char* str, uint8_t* name, 
+log_nametypeclass(enum verbosity_value v, const char* str, uint8_t* name,
 	uint16_t type, uint16_t dclass)
 {
 	char buf[LDNS_MAX_DOMAINLEN+1];
 	char t[12], c[12];
-	const char *ts, *cs; 
+	const char *ts, *cs;
 	if(verbosity < v)
 		return;
 	dname_str(name, buf);
@@ -564,7 +564,7 @@ log_query_in(const char* str, uint8_t* name, uint16_t type, uint16_t dclass)
 {
 	char buf[LDNS_MAX_DOMAINLEN+1];
 	char t[12], c[12];
-	const char *ts, *cs; 
+	const char *ts, *cs;
 	dname_str(name, buf);
 	if(type == LDNS_RR_TYPE_TSIG) ts = "TSIG";
 	else if(type == LDNS_RR_TYPE_IXFR) ts = "IXFR";
@@ -590,7 +590,7 @@ log_query_in(const char* str, uint8_t* name, uint16_t type, uint16_t dclass)
 	else	log_info("%s %s %s %s", str, buf, ts, cs);
 }
 
-void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone, 
+void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone,
 	struct sockaddr_storage* addr, socklen_t addrlen)
 {
 	uint16_t port;
@@ -643,7 +643,7 @@ void log_err_addr(const char* str, const char* err,
 }
 
 int
-sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1, 
+sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1,
 	struct sockaddr_storage* addr2, socklen_t len2)
 {
 	struct sockaddr_in* p1_in = (struct sockaddr_in*)addr1;
@@ -676,7 +676,7 @@ sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1,
 		if(p1_in6->sin6_port > p2_in6->sin6_port)
 			return 1;
 		log_assert(p1_in6->sin6_port == p2_in6->sin6_port);
-		return memcmp(&p1_in6->sin6_addr, &p2_in6->sin6_addr, 
+		return memcmp(&p1_in6->sin6_addr, &p2_in6->sin6_addr,
 			INET6_SIZE);
 	} else {
 		/* eek unknown type, perform this comparison for sanity. */
@@ -685,7 +685,7 @@ sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1,
 }
 
 int
-sockaddr_cmp_addr(struct sockaddr_storage* addr1, socklen_t len1, 
+sockaddr_cmp_addr(struct sockaddr_storage* addr1, socklen_t len1,
 	struct sockaddr_storage* addr2, socklen_t len2)
 {
 	struct sockaddr_in* p1_in = (struct sockaddr_in*)addr1;
@@ -706,7 +706,7 @@ sockaddr_cmp_addr(struct sockaddr_storage* addr1, socklen_t len1,
 	if( p1_in->sin_family == AF_INET ) {
 		return memcmp(&p1_in->sin_addr, &p2_in->sin_addr, INET_SIZE);
 	} else if (p1_in6->sin6_family == AF_INET6) {
-		return memcmp(&p1_in6->sin6_addr, &p2_in6->sin6_addr, 
+		return memcmp(&p1_in6->sin6_addr, &p2_in6->sin6_addr,
 			INET6_SIZE);
 	} else {
 		/* eek unknown type, perform this comparison for sanity. */
@@ -779,8 +779,8 @@ addr_in_common(struct sockaddr_storage* addr1, int net1,
 	return match;
 }
 
-void 
-addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen, 
+void
+addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
 	char* buf, size_t len)
 {
 	int af = (int)((struct sockaddr_in*)addr)->sin_family;
@@ -792,11 +792,11 @@ addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
 	}
 }
 
-int 
+int
 addr_is_ip4mapped(struct sockaddr_storage* addr, socklen_t addrlen)
 {
 	/* prefix for ipv4 into ipv6 mapping is ::ffff:x.x.x.x */
-	const uint8_t map_prefix[16] = 
+	const uint8_t map_prefix[16] =
 		{0,0,0,0,  0,0,0,0, 0,0,0xff,0xff, 0,0,0,0};
 	uint8_t* s;
 	if(!addr_is_ip6(addr, addrlen))
@@ -848,7 +848,7 @@ void sock_list_insert(struct sock_list** list, struct sockaddr_storage* addr,
 void sock_list_prepend(struct sock_list** list, struct sock_list* add)
 {
 	struct sock_list* last = add;
-	if(!last) 
+	if(!last)
 		return;
 	while(last->next)
 		last = last->next;
@@ -861,7 +861,7 @@ int sock_list_find(struct sock_list* list, struct sockaddr_storage* addr,
 {
 	while(list) {
 		if(len == list->len) {
-			if(len == 0 || sockaddr_cmp_addr(addr, len, 
+			if(len == 0 || sockaddr_cmp_addr(addr, len,
 				&list->addr, list->len) == 0)
 				return 1;
 		}
@@ -1135,7 +1135,7 @@ add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx)
 		CERT_STORE_PROV_SYSTEM,
 		0,
 		0,
-		/* NOTE: mingw does not have this const: replace with 1 << 16 from code 
+		/* NOTE: mingw does not have this const: replace with 1 << 16 from code
 		   CERT_SYSTEM_STORE_CURRENT_USER, */
 		1 << 16,
 		L"root")) == 0)
diff --git a/usr.sbin/unbound/util/net_help.h b/usr.sbin/unbound/util/net_help.h
index f1881b3ed..86e77b664 100644
--- a/usr.sbin/unbound/util/net_help.h
+++ b/usr.sbin/unbound/util/net_help.h
@@ -1,25 +1,25 @@
 /*
- * util/net_help.h - network help functions 
+ * util/net_help.h - network help functions
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -47,13 +47,13 @@ struct sock_list;
 struct regional;
 struct config_strlist;
 
-/** DNS constants for uint16_t style flag manipulation. host byteorder. 
+/** DNS constants for uint16_t style flag manipulation. host byteorder.
  *                                1  1  1  1  1  1
  *  0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
  * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
  * |QR|   Opcode  |AA|TC|RD|RA| Z|AD|CD|   RCODE   |
  * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
- */ 
+ */
 /** CD flag */
 #define BIT_CD 0x0010
 /** AD flag */
@@ -122,14 +122,14 @@ int str_is_ip6(const char* str);
  * @param s: file descriptor.
  * @return: 0 on error (error is printed to log).
  */
-int fd_set_nonblock(int s); 
+int fd_set_nonblock(int s);
 
 /**
  * Set fd (back to) blocking.
  * @param s: file descriptor.
  * @return: 0 on error (error is printed to log).
  */
-int fd_set_block(int s); 
+int fd_set_block(int s);
 
 /**
  * See if number is a power of 2.
@@ -153,7 +153,7 @@ void* memdup(void* data, size_t len);
  * @param addr: the sockaddr to print. Can be ip4 or ip6.
  * @param addrlen: length of addr.
  */
-void log_addr(enum verbosity_value v, const char* str, 
+void log_addr(enum verbosity_value v, const char* str,
 	struct sockaddr_storage* addr, socklen_t addrlen);
 
 /**
@@ -164,7 +164,7 @@ void log_addr(enum verbosity_value v, const char* str,
  * @param addr: the sockaddr to print. Can be ip4 or ip6.
  * @param addrlen: length of addr.
  */
-void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone, 
+void log_name_addr(enum verbosity_value v, const char* str, uint8_t* zone,
 	struct sockaddr_storage* addr, socklen_t addrlen);
 
 /**
@@ -186,7 +186,7 @@ void log_err_addr(const char* str, const char* err,
  * @param port: default port.
  * @return 0 on error.
  */
-int extstrtoaddr(const char* str, struct sockaddr_storage* addr, 
+int extstrtoaddr(const char* str, struct sockaddr_storage* addr,
 	socklen_t* addrlen, int port);
 
 /**
@@ -257,7 +257,7 @@ void sockaddr_store_port(struct sockaddr_storage* addr, socklen_t addrlen,
  * @param type: host format RR type.
  * @param dclass: host format RR class.
  */
-void log_nametypeclass(enum verbosity_value v, const char* str, 
+void log_nametypeclass(enum verbosity_value v, const char* str,
 	uint8_t* name, uint16_t type, uint16_t dclass);
 
 /**
@@ -275,7 +275,7 @@ void log_query_in(const char* str, uint8_t* name, uint16_t type,
  * @param len2: lengths of addr2.
  * @return: 0 if addr1 == addr2. -1 if addr1 is smaller, +1 if larger.
  */
-int sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1, 
+int sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1,
 	struct sockaddr_storage* addr2, socklen_t len2);
 
 /**
@@ -286,7 +286,7 @@ int sockaddr_cmp(struct sockaddr_storage* addr1, socklen_t len1,
  * @param len2: lengths of addr2.
  * @return: 0 if addr1 == addr2. -1 if addr1 is smaller, +1 if larger.
  */
-int sockaddr_cmp_addr(struct sockaddr_storage* addr1, socklen_t len1, 
+int sockaddr_cmp_addr(struct sockaddr_storage* addr1, socklen_t len1,
 	struct sockaddr_storage* addr2, socklen_t len2);
 
 /**
@@ -427,7 +427,7 @@ int listen_sslctx_setup(void* ctxt);
  */
 void listen_sslctx_setup_2(void* ctxt);
 
-/** 
+/**
  * create SSL listen context
  * @param key: private key file.
  * @param pem: public key cert.
diff --git a/usr.sbin/unbound/util/netevent.c b/usr.sbin/unbound/util/netevent.c
index da59a9d60..09a5c71fd 100644
--- a/usr.sbin/unbound/util/netevent.c
+++ b/usr.sbin/unbound/util/netevent.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -177,7 +177,7 @@ static struct comm_point* comm_point_create_tcp_handler(
 
 /* -------- End of local definitions -------- */
 
-struct comm_base* 
+struct comm_base*
 comm_base_create(int sigs)
 {
 	struct comm_base* b = (struct comm_base*)calloc(1,
@@ -220,7 +220,7 @@ comm_base_create_event(struct ub_event_base* base)
 	return b;
 }
 
-void 
+void
 comm_base_delete(struct comm_base* b)
 {
 	if(!b)
@@ -237,7 +237,7 @@ comm_base_delete(struct comm_base* b)
 	free(b);
 }
 
-void 
+void
 comm_base_delete_no_base(struct comm_base* b)
 {
 	if(!b)
@@ -253,14 +253,14 @@ comm_base_delete_no_base(struct comm_base* b)
 	free(b);
 }
 
-void 
+void
 comm_base_timept(struct comm_base* b, time_t** tt, struct timeval** tv)
 {
 	*tt = &b->eb->secs;
 	*tv = &b->eb->now;
 }
 
-void 
+void
 comm_base_dispatch(struct comm_base* b)
 {
 	int retval;
@@ -470,7 +470,7 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 				(struct sockaddr_storage*)addr, addrlen);
 		return 0;
 	} else if((size_t)sent != sldns_buffer_remaining(packet)) {
-		log_err("sent %d in place of %d bytes", 
+		log_err("sent %d in place of %d bytes",
 			(int)sent, (int)sldns_buffer_remaining(packet));
 		return 0;
 	}
@@ -489,7 +489,7 @@ static void p_ancil(const char* str, struct comm_reply* r)
 	if(r->srctype == 6) {
 #ifdef IPV6_PKTINFO
 		char buf[1024];
-		if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr, 
+		if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr,
 			buf, (socklen_t)sizeof(buf)) == 0) {
 			(void)strlcpy(buf, "(inet_ntop error)", sizeof(buf));
 		}
@@ -499,13 +499,13 @@ static void p_ancil(const char* str, struct comm_reply* r)
 	} else if(r->srctype == 4) {
 #ifdef IP_PKTINFO
 		char buf1[1024], buf2[1024];
-		if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr, 
+		if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr,
 			buf1, (socklen_t)sizeof(buf1)) == 0) {
 			(void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1));
 		}
 		buf1[sizeof(buf1)-1]=0;
 #ifdef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST
-		if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst, 
+		if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst,
 			buf2, (socklen_t)sizeof(buf2)) == 0) {
 			(void)strlcpy(buf2, "(inet_ntop error)", sizeof(buf2));
 		}
@@ -517,7 +517,7 @@ static void p_ancil(const char* str, struct comm_reply* r)
 			buf1, buf2);
 #elif defined(IP_RECVDSTADDR)
 		char buf1[1024];
-		if(inet_ntop(AF_INET, &r->pktinfo.v4addr, 
+		if(inet_ntop(AF_INET, &r->pktinfo.v4addr,
 			buf1, (socklen_t)sizeof(buf1)) == 0) {
 			(void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1));
 		}
@@ -531,7 +531,7 @@ static void p_ancil(const char* str, struct comm_reply* r)
 /** send a UDP reply over specified interface*/
 static int
 comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
-	struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r) 
+	struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r)
 {
 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_SENDMSG)
 	ssize_t sent;
@@ -695,7 +695,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 		if(!udp_send_errno_needs_log(addr, addrlen))
 			return 0;
 		verbose(VERB_OPS, "sendmsg failed: %s", strerror(errno));
-		log_addr(VERB_OPS, "remote address is", 
+		log_addr(VERB_OPS, "remote address is",
 			(struct sockaddr_storage*)addr, addrlen);
 #ifdef __NetBSD__
 		/* netbsd 7 has IP_PKTINFO for recv but not send */
@@ -705,7 +705,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet,
 #endif
 		return 0;
 	} else if((size_t)sent != sldns_buffer_remaining(packet)) {
-		log_err("sent %d in place of %d bytes", 
+		log_err("sent %d in place of %d bytes",
 			(int)sent, (int)sldns_buffer_remaining(packet));
 		return 0;
 	}
@@ -817,7 +817,7 @@ done:
 	return 1;
 }
 
-void 
+void
 comm_point_udp_ancil_callback(int fd, short event, void* arg)
 {
 #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG)
@@ -930,7 +930,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG */
 }
 
-void 
+void
 comm_point_udp_callback(int fd, short event, void* arg)
 {
 	struct comm_reply rep;
@@ -950,14 +950,14 @@ comm_point_udp_callback(int fd, short event, void* arg)
 		rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr);
 		log_assert(fd != -1);
 		log_assert(sldns_buffer_remaining(rep.c->buffer) > 0);
-		rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer), 
+		rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer),
 			sldns_buffer_remaining(rep.c->buffer), MSG_DONTWAIT,
 			(struct sockaddr*)&rep.remote_addr, &rep.remote_addrlen);
 		if(rcv == -1) {
 #ifndef USE_WINSOCK
 			if(errno != EAGAIN && errno != EINTR
 				&& udp_recv_needs_log(errno))
-				log_err("recvfrom %d failed: %s", 
+				log_err("recvfrom %d failed: %s",
 					fd, strerror(errno));
 #else
 			if(WSAGetLastError() != WSAEINPROGRESS &&
@@ -1012,7 +1012,7 @@ int adjusted_tcp_timeout(struct comm_point* c)
 
 /** Use a new tcp handler for new query fd, set to read query */
 static void
-setup_tcp_handler(struct comm_point* c, int fd, int cur, int max) 
+setup_tcp_handler(struct comm_point* c, int fd, int cur, int max)
 {
 	int handler_usage;
 	log_assert(c->type == comm_tcp || c->type == comm_http);
@@ -1076,10 +1076,10 @@ int comm_point_perform_accept(struct comm_point* c,
 		/* EINTR is signal interrupt. others are closed connection. */
 		if(	errno == EINTR || errno == EAGAIN
 #ifdef EWOULDBLOCK
-			|| errno == EWOULDBLOCK 
+			|| errno == EWOULDBLOCK
 #endif
 #ifdef ECONNABORTED
-			|| errno == ECONNABORTED 
+			|| errno == ECONNABORTED
 #endif
 #ifdef EPROTO
 			|| errno == EPROTO
@@ -1253,7 +1253,7 @@ static int http2_submit_settings(struct http2_session* h2_session)
 #endif /* HAVE_NGHTTP2 */
 
 
-void 
+void
 comm_point_tcp_accept_callback(int fd, short event, void* arg)
 {
 	struct comm_point* c = (struct comm_point*)arg, *c_hdl;
@@ -2161,7 +2161,7 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 		log_err("in comm_point_tcp_handle_read buffer_remaining is "
 			"not > 0 as expected, continuing with (harmless) 0 "
 			"length recv");
-	r = recv(fd, (void*)sldns_buffer_current(c->buffer), 
+	r = recv(fd, (void*)sldns_buffer_current(c->buffer),
 		sldns_buffer_remaining(c->buffer), MSG_DONTWAIT);
 	if(r == 0) {
 		if(c->tcp_req_info)
@@ -2252,8 +2252,8 @@ recv_error:
 	return 0;
 }
 
-/** 
- * Handle tcp writing callback. 
+/**
+ * Handle tcp writing callback.
  * @param fd: file descriptor of socket.
  * @param c: comm point to write buffer out of.
  * @return: 0 on error
@@ -2277,7 +2277,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 		/* from Stevens, unix network programming, vol1, 3rd ed, p450*/
 		int error = 0;
 		socklen_t len = (socklen_t)sizeof(error);
-		if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, 
+		if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error,
 			&len) < 0){
 #ifndef USE_WINSOCK
 			error = errno; /* on solaris errno is error */
@@ -2318,7 +2318,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 		return ssl_handle_it(c, 1);
 
 #ifdef USE_MSG_FASTOPEN
-	/* Only try this on first use of a connection that uses tfo, 
+	/* Only try this on first use of a connection that uses tfo,
 	   otherwise fall through to normal write */
 	/* Also, TFO support on WINDOWS not implemented at the moment */
 	if(c->tcp_do_fastopen == 1) {
@@ -2473,7 +2473,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 			if(WSAGetLastError() == WSAEWOULDBLOCK) {
 				ub_winsock_tcp_wouldblock(c->ev->ev,
 					UB_EV_WRITE);
-				return 1; 
+				return 1;
 			}
 			if(WSAGetLastError() == WSAECONNRESET && verbosity < 2)
 				return 0; /* silence reset by peer */
@@ -2522,7 +2522,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 			return 1;
 		if(WSAGetLastError() == WSAEWOULDBLOCK) {
 			ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
-			return 1; 
+			return 1;
 		}
 		if(WSAGetLastError() == WSAECONNRESET && verbosity < 2)
 			return 0; /* silence reset by peer */
@@ -2541,7 +2541,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 	if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) {
 		tcp_callback_writer(c);
 	}
-	
+
 	return 1;
 }
 
@@ -2560,7 +2560,7 @@ tcp_req_info_read_again(int fd, struct comm_point* c)
 			if(!c->tcp_do_close) {
 				fptr_ok(fptr_whitelist_comm_point(
 					c->callback));
-				(void)(*c->callback)(c, c->cb_arg, 
+				(void)(*c->callback)(c, c->cb_arg,
 					NETEVENT_CLOSED, NULL);
 			}
 			return;
@@ -2616,7 +2616,7 @@ tcp_more_write_again(int fd, struct comm_point* c)
 	}
 }
 
-void 
+void
 comm_point_tcp_handle_callback(int fd, short event, void* arg)
 {
 	struct comm_point* c = (struct comm_point*)arg;
@@ -2774,7 +2774,7 @@ http_read_more(int fd, struct comm_point* c)
 {
 	ssize_t r;
 	log_assert(sldns_buffer_remaining(c->buffer) > 0);
-	r = recv(fd, (void*)sldns_buffer_current(c->buffer), 
+	r = recv(fd, (void*)sldns_buffer_current(c->buffer),
 		sldns_buffer_remaining(c->buffer), MSG_DONTWAIT);
 	if(r == 0) {
 		return 0;
@@ -3043,7 +3043,7 @@ http_chunked_segment(struct comm_point* c)
 		/* return and wait to read more */
 		return 1;
 	}
-	
+
 	/* callback of http reader for a new part of the data */
 	c->http_stored = 0;
 	sldns_buffer_set_position(c->buffer, 0);
@@ -3393,7 +3393,7 @@ http_check_connect(int fd, struct comm_point* c)
 	/* from Stevens, unix network programming, vol1, 3rd ed, p450*/
 	int error = 0;
 	socklen_t len = (socklen_t)sizeof(error);
-	if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, 
+	if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error,
 		&len) < 0){
 #ifndef USE_WINSOCK
 		error = errno; /* on solaris errno is error */
@@ -3478,7 +3478,7 @@ http_write_more(int fd, struct comm_point* c)
 {
 	ssize_t r;
 	log_assert(sldns_buffer_remaining(c->buffer) > 0);
-	r = send(fd, (void*)sldns_buffer_current(c->buffer), 
+	r = send(fd, (void*)sldns_buffer_current(c->buffer),
 		sldns_buffer_remaining(c->buffer), 0);
 	if(r == -1) {
 #ifndef USE_WINSOCK
@@ -3489,7 +3489,7 @@ http_write_more(int fd, struct comm_point* c)
 			return 1;
 		if(WSAGetLastError() == WSAEWOULDBLOCK) {
 			ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE);
-			return 1; 
+			return 1;
 		}
 #endif
 		log_err_addr("http send r", sock_strerror(errno),
@@ -3610,8 +3610,8 @@ comm_point_http2_handle_write(int ATTR_UNUSED(fd), struct comm_point* c)
 #endif
 }
 
-/** 
- * Handle http writing callback. 
+/**
+ * Handle http writing callback.
  * @param fd: file descriptor of socket.
  * @param c: comm point to write buffer out of.
  * @return: 0 on error
@@ -3677,7 +3677,7 @@ comm_point_http_handle_write(int fd, struct comm_point* c)
 	return 1;
 }
 
-void 
+void
 comm_point_http_handle_callback(int fd, short event, void* arg)
 {
 	struct comm_point* c = (struct comm_point*)arg;
@@ -3730,7 +3730,7 @@ void comm_point_local_handle_callback(int fd, short event, void* arg)
 	if(event&UB_EV_READ) {
 		if(!comm_point_tcp_handle_read(fd, c, 1)) {
 			fptr_ok(fptr_whitelist_comm_point(c->callback));
-			(void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, 
+			(void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED,
 				NULL);
 		}
 		return;
@@ -3738,21 +3738,21 @@ void comm_point_local_handle_callback(int fd, short event, void* arg)
 	log_err("Ignored event %d for localhdl.", event);
 }
 
-void comm_point_raw_handle_callback(int ATTR_UNUSED(fd), 
+void comm_point_raw_handle_callback(int ATTR_UNUSED(fd),
 	short event, void* arg)
 {
 	struct comm_point* c = (struct comm_point*)arg;
 	int err = NETEVENT_NOERROR;
 	log_assert(c->type == comm_raw);
 	ub_comm_base_now(c->ev->base);
-	
+
 	if(event&UB_EV_TIMEOUT)
 		err = NETEVENT_TIMEOUT;
 	fptr_ok(fptr_whitelist_comm_point_raw(c->callback));
 	(void)(*c->callback)(c, c->cb_arg, err, NULL);
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
 	int pp2_enabled, comm_point_callback_type* callback,
 	void* callback_arg, struct unbound_socket* socket)
@@ -3815,7 +3815,7 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer,
 	return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	sldns_buffer* buffer, int pp2_enabled,
 	comm_point_callback_type* callback, void* callback_arg, struct unbound_socket* socket)
@@ -3878,8 +3878,8 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	return c;
 }
 
-static struct comm_point* 
-comm_point_create_tcp_handler(struct comm_base *base, 
+static struct comm_point*
+comm_point_create_tcp_handler(struct comm_base *base,
 	struct comm_point* parent, size_t bufsize,
 	struct sldns_buffer* spoolbuf, comm_point_callback_type* callback,
 	void* callback_arg, struct unbound_socket* socket)
@@ -3976,8 +3976,8 @@ comm_point_create_tcp_handler(struct comm_base *base,
 	return c;
 }
 
-static struct comm_point* 
-comm_point_create_http_handler(struct comm_base *base, 
+static struct comm_point*
+comm_point_create_http_handler(struct comm_base *base,
 	struct comm_point* parent, size_t bufsize, int harden_large_queries,
 	uint32_t http_max_streams, char* http_endpoint,
 	comm_point_callback_type* callback, void* callback_arg,
@@ -4074,7 +4074,7 @@ comm_point_create_http_handler(struct comm_base *base,
 		return NULL;
 	}
 #endif
-	
+
 	/* add to parent free list */
 	c->tcp_free = parent->tcp_free;
 	parent->tcp_free = c;
@@ -4096,7 +4096,7 @@ comm_point_create_http_handler(struct comm_base *base,
 	return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_tcp(struct comm_base *base, int fd, int num,
 	int idle_timeout, int harden_large_queries,
 	uint32_t http_max_streams, char* http_endpoint,
@@ -4194,11 +4194,11 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num,
 			return NULL;
 		}
 	}
-	
+
 	return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
         comm_point_callback_type* callback, void* callback_arg)
 {
@@ -4265,7 +4265,7 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
 	return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_http_out(struct comm_base *base, size_t bufsize,
         comm_point_callback_type* callback, void* callback_arg,
 	sldns_buffer* temp)
@@ -4336,7 +4336,7 @@ comm_point_create_http_out(struct comm_base *base, size_t bufsize,
 	return c;
 }
 
-struct comm_point* 
+struct comm_point*
 comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
         comm_point_callback_type* callback, void* callback_arg)
 {
@@ -4404,8 +4404,8 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
 	return c;
 }
 
-struct comm_point* 
-comm_point_create_raw(struct comm_base* base, int fd, int writing, 
+struct comm_point*
+comm_point_create_raw(struct comm_base* base, int fd, int writing,
 	comm_point_callback_type* callback, void* callback_arg)
 {
 	struct comm_point* c = (struct comm_point*)calloc(1,
@@ -4469,7 +4469,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
 	return c;
 }
 
-void 
+void
 comm_point_close(struct comm_point* c)
 {
 	if(!c)
@@ -4504,10 +4504,10 @@ comm_point_close(struct comm_point* c)
 	c->fd = -1;
 }
 
-void 
+void
 comm_point_delete(struct comm_point* c)
 {
-	if(!c) 
+	if(!c)
 		return;
 	if((c->type == comm_tcp || c->type == comm_http) && c->ssl) {
 #ifdef HAVE_SSL
@@ -4546,7 +4546,7 @@ comm_point_delete(struct comm_point* c)
 	free(c);
 }
 
-void 
+void
 comm_point_send_reply(struct comm_reply *repinfo)
 {
 	struct sldns_buffer* buffer;
@@ -4610,7 +4610,7 @@ comm_point_send_reply(struct comm_reply *repinfo)
 	}
 }
 
-void 
+void
 comm_point_drop_reply(struct comm_reply* repinfo)
 {
 	if(!repinfo)
@@ -4634,7 +4634,7 @@ comm_point_drop_reply(struct comm_reply* repinfo)
 	reclaim_tcp_handler(repinfo->c);
 }
 
-void 
+void
 comm_point_stop_listening(struct comm_point* c)
 {
 	verbose(VERB_ALGO, "comm point stop listening %d", c->fd);
@@ -4646,10 +4646,10 @@ comm_point_stop_listening(struct comm_point* c)
 	}
 }
 
-void 
+void
 comm_point_start_listening(struct comm_point* c, int newfd, int msec)
 {
-	verbose(VERB_ALGO, "comm point start listening %d (%d msec)", 
+	verbose(VERB_ALGO, "comm point start listening %d (%d msec)",
 		c->fd==-1?newfd:c->fd, msec);
 	if(c->type == comm_tcp_accept && !c->tcp_free) {
 		/* no use to start listening no free slots. */
@@ -4733,10 +4733,10 @@ void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr)
 size_t comm_point_get_mem(struct comm_point* c)
 {
 	size_t s;
-	if(!c) 
+	if(!c)
 		return 0;
 	s = sizeof(*c) + sizeof(*c->ev);
-	if(c->timeout) 
+	if(c->timeout)
 		s += sizeof(*c->timeout);
 	if(c->type == comm_tcp || c->type == comm_local) {
 		s += sizeof(*c->buffer) + sldns_buffer_capacity(c->buffer);
@@ -4755,7 +4755,7 @@ size_t comm_point_get_mem(struct comm_point* c)
 	return s;
 }
 
-struct comm_timer* 
+struct comm_timer*
 comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg)
 {
 	struct internal_timer *tm = (struct internal_timer*)calloc(1,
@@ -4768,7 +4768,7 @@ comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg)
 	tm->base = base;
 	tm->super.callback = cb;
 	tm->super.cb_arg = cb_arg;
-	tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT, 
+	tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT,
 		comm_timer_callback, &tm->super);
 	if(tm->ev == NULL) {
 		log_err("timer_create: event_base_set failed.");
@@ -4778,7 +4778,7 @@ comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg)
 	return &tm->super;
 }
 
-void 
+void
 comm_timer_disable(struct comm_timer* timer)
 {
 	if(!timer)
@@ -4787,7 +4787,7 @@ comm_timer_disable(struct comm_timer* timer)
 	timer->ev_timer->enabled = 0;
 }
 
-void 
+void
 comm_timer_set(struct comm_timer* timer, struct timeval* tv)
 {
 	log_assert(tv);
@@ -4799,7 +4799,7 @@ comm_timer_set(struct comm_timer* timer, struct timeval* tv)
 	timer->ev_timer->enabled = 1;
 }
 
-void 
+void
 comm_timer_delete(struct comm_timer* timer)
 {
 	if(!timer)
@@ -4812,7 +4812,7 @@ comm_timer_delete(struct comm_timer* timer)
 	free(timer->ev_timer);
 }
 
-void 
+void
 comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg)
 {
 	struct comm_timer* tm = (struct comm_timer*)arg;
@@ -4824,19 +4824,19 @@ comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg)
 	(*tm->callback)(tm->cb_arg);
 }
 
-int 
+int
 comm_timer_is_set(struct comm_timer* timer)
 {
 	return (int)timer->ev_timer->enabled;
 }
 
-size_t 
+size_t
 comm_timer_get_mem(struct comm_timer* ATTR_UNUSED(timer))
 {
 	return sizeof(struct internal_timer);
 }
 
-struct comm_signal* 
+struct comm_signal*
 comm_signal_create(struct comm_base* base,
         void (*callback)(int, void*), void* cb_arg)
 {
@@ -4853,7 +4853,7 @@ comm_signal_create(struct comm_base* base,
 	return com;
 }
 
-void 
+void
 comm_signal_callback(int sig, short event, void* arg)
 {
 	struct comm_signal* comsig = (struct comm_signal*)arg;
@@ -4864,10 +4864,10 @@ comm_signal_callback(int sig, short event, void* arg)
 	(*comsig->callback)(sig, comsig->cb_arg);
 }
 
-int 
+int
 comm_signal_bind(struct comm_signal* comsig, int sig)
 {
-	struct internal_signal* entry = (struct internal_signal*)calloc(1, 
+	struct internal_signal* entry = (struct internal_signal*)calloc(1,
 		sizeof(struct internal_signal));
 	if(!entry) {
 		log_err("malloc failed");
@@ -4894,7 +4894,7 @@ comm_signal_bind(struct comm_signal* comsig, int sig)
 	return 1;
 }
 
-void 
+void
 comm_signal_delete(struct comm_signal* comsig)
 {
 	struct internal_signal* p, *np;
diff --git a/usr.sbin/unbound/util/netevent.h b/usr.sbin/unbound/util/netevent.h
index 3e7849c13..433c14c3c 100644
--- a/usr.sbin/unbound/util/netevent.h
+++ b/usr.sbin/unbound/util/netevent.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -83,7 +83,7 @@ struct internal_timer; /* A sub struct of the comm_timer super struct */
 enum listen_type;
 
 /** callback from communication point function type */
-typedef int comm_point_callback_type(struct comm_point*, void*, int, 
+typedef int comm_point_callback_type(struct comm_point*, void*, int,
 	struct comm_reply*);
 
 /** to pass no_error to callback function */
@@ -91,7 +91,7 @@ typedef int comm_point_callback_type(struct comm_point*, void*, int,
 /** to pass closed connection to callback function */
 #define NETEVENT_CLOSED -1
 /** to pass timeout happened to callback function */
-#define NETEVENT_TIMEOUT -2 
+#define NETEVENT_TIMEOUT -2
 /** to pass fallback from capsforID to callback function; 0x20 failed */
 #define NETEVENT_CAPSFAIL -3
 /** to pass done transfer to callback function; http file is complete */
@@ -165,8 +165,8 @@ struct comm_reply {
 	socklen_t client_addrlen;
 };
 
-/** 
- * Communication point to the network 
+/**
+ * Communication point to the network
  * These behaviours can be accomplished by setting the flags
  * and passing return values from the callback.
  *    udp frontside: called after readdone. sendafter.
@@ -206,7 +206,7 @@ struct comm_point {
 	int max_tcp_count;
 	/** current number of tcp handler in-use for this accept socket */
 	int cur_tcp_count;
-	/** malloced array of tcp handlers for a tcp-accept, 
+	/** malloced array of tcp handlers for a tcp-accept,
 	    of size max_tcp_count. */
 	struct comm_point** tcp_handlers;
 	/** linked list of free tcp_handlers to use for new queries.
@@ -271,9 +271,9 @@ struct comm_point {
 	/** is this a UDP, TCP-accept or TCP socket. */
 	enum comm_point_type {
 		/** UDP socket - handle datagrams. */
-		comm_udp, 
+		comm_udp,
 		/** TCP accept socket - only creates handlers if readable. */
-		comm_tcp_accept, 
+		comm_tcp_accept,
 		/** TCP handler socket - handle byteperbyte readwrite. */
 		comm_tcp,
 		/** HTTP handler socket */
@@ -282,7 +282,7 @@ struct comm_point {
 		comm_local,
 		/** raw - not DNS format - for pipe readers and writers */
 		comm_raw
-	} 
+	}
 		/** variable with type of socket, UDP,TCP-accept,TCP,pipe */
 		type;
 
@@ -303,7 +303,7 @@ struct comm_point {
 	/** if set the connection is NOT closed on delete. */
 	int do_not_close;
 
-	/** if set, the connection is closed on error, on timeout, 
+	/** if set, the connection is closed on error, on timeout,
 	    and after read/write completes. No callback is done. */
 	int tcp_do_close;
 
@@ -387,11 +387,11 @@ struct comm_point {
 	/** callback when done.
 	    tcp_accept does not get called back, is NULL then.
 	    If a timeout happens, callback with timeout=1 is called.
-	    If an error happens, callback is called with error set 
+	    If an error happens, callback is called with error set
 	    nonzero. If not NETEVENT_NOERROR, it is an errno value.
 	    If the connection is closed (by remote end) then the
 	    callback is called with error set to NETEVENT_CLOSED=-1.
-	    If a timeout happens on the connection, the error is set to 
+	    If a timeout happens on the connection, the error is set to
 	    NETEVENT_TIMEOUT=-2.
 	    The reply_info can be copied if the reply needs to happen at a
 	    later time. It consists of a struct with commpoint and address.
@@ -399,7 +399,7 @@ struct comm_point {
 	    Note the reply information is temporary and must be copied.
 	    NULL is passed for_reply info, in cases where error happened.
 
-	    declare as: 
+	    declare as:
 	    int my_callback(struct comm_point* c, void* my_arg, int error,
 		struct comm_reply *reply_info);
 
@@ -446,14 +446,14 @@ struct comm_signal {
 
 /**
  * Create a new comm base.
- * @param sigs: if true it attempts to create a default loop for 
+ * @param sigs: if true it attempts to create a default loop for
  *   signal handling.
  * @return: the new comm base. NULL on error.
  */
 struct comm_base* comm_base_create(int sigs);
 
 /**
- * Create comm base that uses the given ub_event_base (underlying pluggable 
+ * Create comm base that uses the given ub_event_base (underlying pluggable
  * event mechanism pointer).
  * @param base: underlying pluggable event base.
  * @return: the new comm base. NULL on error.
@@ -619,7 +619,7 @@ struct comm_point* comm_point_create_http_out(struct comm_base* base,
  * @return: the commpoint or NULL on error.
  */
 struct comm_point* comm_point_create_local(struct comm_base* base,
-	int fd, size_t bufsize, 
+	int fd, size_t bufsize,
 	comm_point_callback_type* callback, void* callback_arg);
 
 /**
@@ -632,7 +632,7 @@ struct comm_point* comm_point_create_local(struct comm_base* base,
  * @return: the commpoint or NULL on error.
  */
 struct comm_point* comm_point_create_raw(struct comm_base* base,
-	int fd, int writing, 
+	int fd, int writing,
 	comm_point_callback_type* callback, void* callback_arg);
 
 /**
@@ -722,7 +722,7 @@ size_t comm_point_get_mem(struct comm_point* c);
  * @param cb_arg: user callback argument.
  * @return: the new timer or NULL on error.
  */
-struct comm_timer* comm_timer_create(struct comm_base* base, 
+struct comm_timer* comm_timer_create(struct comm_base* base,
 	void (*cb)(void*), void* cb_arg);
 
 /**
@@ -792,7 +792,7 @@ void comm_signal_delete(struct comm_signal* comsig);
  *	if -1, error message has been printed if necessary, simply drop
  *	out of the reading handler.
  */
-int comm_point_perform_accept(struct comm_point* c, 
+int comm_point_perform_accept(struct comm_point* c,
 	struct sockaddr_storage* addr, socklen_t* addrlen);
 
 /**** internal routines ****/
@@ -801,7 +801,7 @@ int comm_point_perform_accept(struct comm_point* c,
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for udp comm point.
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -811,7 +811,7 @@ void comm_point_udp_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for udp ancillary data comm point.
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -821,7 +821,7 @@ void comm_point_udp_ancil_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for tcp accept comm point
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -831,7 +831,7 @@ void comm_point_tcp_accept_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for tcp data comm point
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -841,7 +841,7 @@ void comm_point_tcp_handle_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for tcp data comm point
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -955,7 +955,7 @@ void http2_stream_add_meshstate(struct http2_stream* h2_stream,
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for timer comm.
  * @param fd: file descriptor (always -1).
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_timer structure.
  */
@@ -965,7 +965,7 @@ void comm_timer_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for signal comm.
  * @param fd: file descriptor (used for the signal number).
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the internal commsignal structure.
  */
@@ -975,7 +975,7 @@ void comm_signal_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * libevent callback for AF_UNIX fds
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -985,7 +985,7 @@ void comm_point_local_handle_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * libevent callback for raw fd access.
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
@@ -995,7 +995,7 @@ void comm_point_raw_handle_callback(int fd, short event, void* arg);
  * This routine is published for checks and tests, and is only used internally.
  * libevent callback for timeout on slow accept.
  * @param fd: file descriptor.
- * @param event: event bits from libevent: 
+ * @param event: event bits from libevent:
  *	EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT.
  * @param arg: the comm_point structure.
  */
diff --git a/usr.sbin/unbound/util/proxy_protocol.c b/usr.sbin/unbound/util/proxy_protocol.c
index 757c5141d..13270ba40 100644
--- a/usr.sbin/unbound/util/proxy_protocol.c
+++ b/usr.sbin/unbound/util/proxy_protocol.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2022, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/util/proxy_protocol.h b/usr.sbin/unbound/util/proxy_protocol.h
index 13cab9d74..38addb290 100644
--- a/usr.sbin/unbound/util/proxy_protocol.h
+++ b/usr.sbin/unbound/util/proxy_protocol.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2022, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/util/random.c b/usr.sbin/unbound/util/random.c
index 6eb102c63..21315e857 100644
--- a/usr.sbin/unbound/util/random.c
+++ b/usr.sbin/unbound/util/random.c
@@ -1,25 +1,25 @@
 /*
  * util/random.c - thread safe random generator, which is reasonably secure.
- * 
+ *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -72,14 +72,14 @@
 #include "yarrow.h"
 #endif
 
-/** 
+/**
  * Max random value.  Similar to RAND_MAX, but more portable
  * (mingw uses only 15 bits random).
  */
 #define MAX_VALUE 0x7fffffff
 
 #if defined(HAVE_SSL) || defined(HAVE_LIBBSD)
-struct ub_randstate* 
+struct ub_randstate*
 ub_initstate(struct ub_randstate* ATTR_UNUSED(from))
 {
 	struct ub_randstate* s = (struct ub_randstate*)malloc(1);
@@ -90,7 +90,7 @@ ub_initstate(struct ub_randstate* ATTR_UNUSED(from))
 	return s;
 }
 
-long int 
+long int
 ub_random(struct ub_randstate* ATTR_UNUSED(s))
 {
 	/* This relies on MAX_VALUE being 0x7fffffff. */
@@ -200,7 +200,7 @@ ub_random_max(struct ub_randstate* state, long int x)
 }
 #endif /* HAVE_NSS or HAVE_NETTLE and !HAVE_LIBBSD */
 
-void 
+void
 ub_randfree(struct ub_randstate* s)
 {
 	free(s);
diff --git a/usr.sbin/unbound/util/random.h b/usr.sbin/unbound/util/random.h
index b257793a4..7bd94acc8 100644
--- a/usr.sbin/unbound/util/random.h
+++ b/usr.sbin/unbound/util/random.h
@@ -1,25 +1,25 @@
 /*
  * util/random.h - thread safe random generator, which is reasonably secure.
- * 
+ *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -48,7 +48,7 @@
 struct ub_randstate;
 
 /**
- * Initialize a random generator state for use 
+ * Initialize a random generator state for use
  * @param from: if not NULL, the seed is taken from this random structure.
  * 	can be used to seed random states via a parent-random-state that
  * 	is itself seeded with entropy.
diff --git a/usr.sbin/unbound/util/rbtree.c b/usr.sbin/unbound/util/rbtree.c
index f031c9a13..9b20d8a1a 100644
--- a/usr.sbin/unbound/util/rbtree.c
+++ b/usr.sbin/unbound/util/rbtree.c
@@ -2,24 +2,24 @@
  * rbtree.c -- generic red black tree
  *
  * Copyright (c) 2001-2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -91,7 +91,7 @@ rbtree_create (int (*cmpf)(const void *, const void *))
 	return rbtree;
 }
 
-void 
+void
 rbtree_init(rbtree_type *rbtree, int (*cmpf)(const void *, const void *))
 {
 	/* Initialize it */
@@ -290,15 +290,15 @@ rbtree_search (rbtree_type *rbtree, const void *key)
 }
 
 /** helpers for delete: swap node colours */
-static void swap_int8(uint8_t* x, uint8_t* y) 
-{ 
-	uint8_t t = *x; *x = *y; *y = t; 
+static void swap_int8(uint8_t* x, uint8_t* y)
+{
+	uint8_t t = *x; *x = *y; *y = t;
 }
 
 /** helpers for delete: swap node pointers */
-static void swap_np(rbnode_type** x, rbnode_type** y) 
+static void swap_np(rbnode_type** x, rbnode_type** y)
 {
-	rbnode_type* t = *x; *x = *y; *y = t; 
+	rbnode_type* t = *x; *x = *y; *y = t;
 }
 
 /** Update parent pointers of child trees of 'parent' */
@@ -325,7 +325,7 @@ static void change_child_ptr(rbnode_type* child, rbnode_type* old,
 	if(child->parent == old) child->parent = new;
 }
 
-rbnode_type* 
+rbnode_type*
 rbtree_delete(rbtree_type *rbtree, const void *key)
 {
 	rbnode_type *to_delete;
@@ -433,7 +433,7 @@ static void rbtree_delete_fixup(rbtree_type* rbtree, rbnode_type* child,
 			else sibling = child_parent->right;
 		}
 
-		if(child_parent->color == BLACK 
+		if(child_parent->color == BLACK
 			&& sibling->color == BLACK
 			&& sibling->left->color == BLACK
 			&& sibling->right->color == BLACK)
@@ -453,7 +453,7 @@ static void rbtree_delete_fixup(rbtree_type* rbtree, rbnode_type* child,
 	if(child_parent->color == RED
 		&& sibling->color == BLACK
 		&& sibling->left->color == BLACK
-		&& sibling->right->color == BLACK) 
+		&& sibling->right->color == BLACK)
 	{
 		/* move red to sibling to rebalance */
 		if(sibling != RBTREE_NULL)
@@ -515,7 +515,7 @@ rbtree_find_less_equal(rbtree_type *rbtree, const void *key,
 	rbnode_type *node;
 
 	log_assert(result);
-	
+
 	/* We start at root... */
 	node = rbtree->root;
 
@@ -529,7 +529,7 @@ rbtree_find_less_equal(rbtree_type *rbtree, const void *key,
 			/* Exact match */
 			*result = node;
 			return 1;
-		} 
+		}
 		if (r < 0) {
 			node = node->left;
 		} else {
@@ -606,7 +606,7 @@ rbtree_previous(rbnode_type *node)
 }
 
 /** recursive descent traverse */
-static void 
+static void
 traverse_post(void (*func)(rbnode_type*, void*), void* arg, rbnode_type* node)
 {
 	if(!node || node == RBTREE_NULL)
@@ -618,7 +618,7 @@ traverse_post(void (*func)(rbnode_type*, void*), void* arg, rbnode_type* node)
 	(*func)(node, arg);
 }
 
-void 
+void
 traverse_postorder(rbtree_type* tree, void (*func)(rbnode_type*, void*),
 	void* arg)
 {
diff --git a/usr.sbin/unbound/util/rbtree.h b/usr.sbin/unbound/util/rbtree.h
index dfcf09ac6..2fcdf5746 100644
--- a/usr.sbin/unbound/util/rbtree.h
+++ b/usr.sbin/unbound/util/rbtree.h
@@ -2,24 +2,24 @@
  * rbtree.h -- generic red-black tree
  *
  * Copyright (c) 2001-2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -80,32 +80,32 @@ struct rbtree_type {
 	/** The number of the nodes in the tree */
 	size_t          count;
 
-	/** 
-	 * Key compare function. <0,0,>0 like strcmp. 
-	 * Return 0 on two NULL ptrs. 
+	/**
+	 * Key compare function. <0,0,>0 like strcmp.
+	 * Return 0 on two NULL ptrs.
 	 */
 	int (*cmp) (const void *, const void *);
 };
 
-/** 
- * Create new tree (malloced) with given key compare function. 
+/**
+ * Create new tree (malloced) with given key compare function.
  * @param cmpf: compare function (like strcmp) takes pointers to two keys.
  * @return: new tree, empty.
  */
 rbtree_type *rbtree_create(int (*cmpf)(const void *, const void *));
 
-/** 
- * Init a new tree (malloced by caller) with given key compare function. 
+/**
+ * Init a new tree (malloced by caller) with given key compare function.
  * @param rbtree: uninitialised memory for new tree, returned empty.
  * @param cmpf: compare function (like strcmp) takes pointers to two keys.
  */
 void rbtree_init(rbtree_type *rbtree, int (*cmpf)(const void *, const void *));
 
-/** 
- * Insert data into the tree. 
+/**
+ * Insert data into the tree.
  * @param rbtree: tree to insert to.
- * @param data: element to insert. 
- * @return: data ptr or NULL if key already present. 
+ * @param data: element to insert.
+ * @return: data ptr or NULL if key already present.
  */
 rbnode_type *rbtree_insert(rbtree_type *rbtree, rbnode_type *data);
 
@@ -113,8 +113,8 @@ rbnode_type *rbtree_insert(rbtree_type *rbtree, rbnode_type *data);
  * Delete element from tree.
  * @param rbtree: tree to delete from.
  * @param key: key of item to delete.
- * @return: node that is now unlinked from the tree. User to delete it. 
- * returns 0 if node not present 
+ * @return: node that is now unlinked from the tree. User to delete it.
+ * returns 0 if node not present
  */
 rbnode_type *rbtree_delete(rbtree_type *rbtree, const void *key);
 
@@ -133,9 +133,9 @@ rbnode_type *rbtree_search(rbtree_type *rbtree, const void *key);
  * @param result: set to the exact node if present, otherwise to element that
  *   precedes the position of key in the tree. NULL if no smaller element.
  * @return: true if exact match in result. Else result points to <= element,
- * or NULL if key is smaller than the smallest key. 
+ * or NULL if key is smaller than the smallest key.
  */
-int rbtree_find_less_equal(rbtree_type *rbtree, const void *key, 
+int rbtree_find_less_equal(rbtree_type *rbtree, const void *key,
 	rbnode_type **result);
 
 /**
@@ -168,7 +168,7 @@ rbnode_type *rbtree_previous(rbnode_type *rbtree);
 
 /**
  * Call with node=variable of struct* with rbnode_type as first element.
- * with type is the type of a pointer to that struct. 
+ * with type is the type of a pointer to that struct.
  */
 #define RBTREE_FOR(node, type, rbtree) \
 	for(node=(type)rbtree_first(rbtree); \
diff --git a/usr.sbin/unbound/util/regional.c b/usr.sbin/unbound/util/regional.c
index 93e911c5e..5577fbca9 100644
--- a/usr.sbin/unbound/util/regional.c
+++ b/usr.sbin/unbound/util/regional.c
@@ -4,24 +4,24 @@
  * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -62,7 +62,7 @@
 #define REGIONAL_LARGE_OBJECT_SIZE  2048
 #endif
 
-struct regional* 
+struct regional*
 regional_create(void)
 {
 	return regional_create_custom(REGIONAL_CHUNK_SIZE);
@@ -115,7 +115,7 @@ regional_create_nochunk(size_t size)
 	return regional_create_custom_large_object(size, 0);
 }
 
-void 
+void
 regional_free_all(struct regional *r)
 {
 	char* p = r->next, *np;
@@ -133,7 +133,7 @@ regional_free_all(struct regional *r)
 	regional_init(r);
 }
 
-void 
+void
 regional_destroy(struct regional *r)
 {
 	if(!r) return;
@@ -236,7 +236,7 @@ count_large(struct regional* r)
 	return c;
 }
 
-void 
+void
 regional_log_stats(struct regional *r)
 {
 	/* some basic assertions put here (non time critical code) */
@@ -249,9 +249,9 @@ regional_log_stats(struct regional *r)
 		(unsigned)count_chunks(r), (unsigned)count_large(r));
 }
 
-size_t 
+size_t
 regional_get_mem(struct regional* r)
 {
-	return r->first_size + (count_chunks(r)-1)*REGIONAL_CHUNK_SIZE 
+	return r->first_size + (count_chunks(r)-1)*REGIONAL_CHUNK_SIZE
 		+ r->total_large;
 }
diff --git a/usr.sbin/unbound/util/regional.h b/usr.sbin/unbound/util/regional.h
index b439897d5..90ad7ed46 100644
--- a/usr.sbin/unbound/util/regional.h
+++ b/usr.sbin/unbound/util/regional.h
@@ -2,24 +2,24 @@
  * regional.h -- region based memory allocator.
  *
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
- * 
+ *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -51,16 +51,16 @@
 #ifndef UTIL_REGIONAL_H_
 #define UTIL_REGIONAL_H_
 
-/** 
+/**
  * the regional* is the first block*.
  * every block has a ptr to the next in first bytes.
  * and so does the regional struct, which is the first block.
  */
 struct regional
 {
-	/** 
-	 * next chunk. NULL if first chunk is the only chunk. 
-	 * first inside that chunk is the char* next pointer. 
+	/**
+	 * next chunk. NULL if first chunk is the only chunk.
+	 * first inside that chunk is the char* next pointer.
 	 * When regional_free_all() has been called this value is NULL.
 	 */
 	char* next;
@@ -101,7 +101,7 @@ struct regional* regional_create_custom(size_t size);
  * @return: newly allocated regional.
  */
 struct regional* regional_create_nochunk(size_t size);
-	
+
 /**
  * Free all memory associated with regional. Only keeps the first block with
  * the regional inside it.
diff --git a/usr.sbin/unbound/util/rtt.c b/usr.sbin/unbound/util/rtt.c
index b64206eca..34f9a8a27 100644
--- a/usr.sbin/unbound/util/rtt.c
+++ b/usr.sbin/unbound/util/rtt.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -61,7 +61,7 @@ calc_rto(const struct rtt_info* rtt)
 	return rto;
 }
 
-void 
+void
 rtt_init(struct rtt_info* rtt)
 {
 	rtt->srtt = 0;
@@ -71,13 +71,13 @@ rtt_init(struct rtt_info* rtt)
 	/* first RTO is 0 + 4*0.094 = 0.376 seconds */
 }
 
-int 
+int
 rtt_timeout(const struct rtt_info* rtt)
 {
 	return rtt->rto;
 }
 
-int 
+int
 rtt_unclamped(const struct rtt_info* rtt)
 {
 	if(calc_rto(rtt) != rtt->rto) {
@@ -88,7 +88,7 @@ rtt_unclamped(const struct rtt_info* rtt)
 	return rtt->srtt + 4*rtt->rttvar;
 }
 
-void 
+void
 rtt_update(struct rtt_info* rtt, int ms)
 {
 	int delta = ms - rtt->srtt;
@@ -99,7 +99,7 @@ rtt_update(struct rtt_info* rtt, int ms)
 	rtt->rto = calc_rto(rtt);
 }
 
-void 
+void
 rtt_lost(struct rtt_info* rtt, int orig)
 {
 	/* exponential backoff */
diff --git a/usr.sbin/unbound/util/rtt.h b/usr.sbin/unbound/util/rtt.h
index 63ed8eadb..5e283833a 100644
--- a/usr.sbin/unbound/util/rtt.h
+++ b/usr.sbin/unbound/util/rtt.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -66,18 +66,18 @@ extern int RTT_MAX_TIMEOUT;
  */
 void rtt_init(struct rtt_info* rtt);
 
-/** 
+/**
  * Get timeout to use for sending a UDP packet.
  * @param rtt: round trip statistics structure.
  * @return: timeout to use in milliseconds. Relative time value.
  */
 int rtt_timeout(const struct rtt_info* rtt);
 
-/** 
+/**
  * Get unclamped timeout to use for server selection.
  * Recent timeouts are reflected in the returned value.
  * @param rtt: round trip statistics structure.
- * @return: value to use in milliseconds. 
+ * @return: value to use in milliseconds.
  */
 int rtt_unclamped(const struct rtt_info* rtt);
 
diff --git a/usr.sbin/unbound/util/shm_side/shm_main.c b/usr.sbin/unbound/util/shm_side/shm_main.c
index 6fd1f5ea6..f370ebaaa 100644
--- a/usr.sbin/unbound/util/shm_side/shm_main.c
+++ b/usr.sbin/unbound/util/shm_side/shm_main.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2017, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -85,7 +85,7 @@ int shm_main_init(struct daemon* daemon)
 #ifdef HAVE_SHMGET
 	struct ub_shm_stat_info *shm_stat;
 	size_t shm_size;
-	
+
 	/* sanitize */
 	if(!daemon)
 		return 0;
diff --git a/usr.sbin/unbound/util/shm_side/shm_main.h b/usr.sbin/unbound/util/shm_side/shm_main.h
index 76c60e484..4f7de709d 100644
--- a/usr.sbin/unbound/util/shm_side/shm_main.h
+++ b/usr.sbin/unbound/util/shm_side/shm_main.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/util/storage/dnstree.c b/usr.sbin/unbound/util/storage/dnstree.c
index eef393f91..44f2357da 100644
--- a/usr.sbin/unbound/util/storage/dnstree.c
+++ b/usr.sbin/unbound/util/storage/dnstree.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -94,7 +94,7 @@ void addr_tree_addrport_init(rbtree_type* tree)
 	rbtree_init(tree, &addr_tree_addrport_compare);
 }
 
-int name_tree_insert(rbtree_type* tree, struct name_tree_node* node, 
+int name_tree_insert(rbtree_type* tree, struct name_tree_node* node,
         uint8_t* name, size_t len, int labs, uint16_t dclass)
 {
 	node->node.key = node;
@@ -176,7 +176,7 @@ void name_tree_init_parents(rbtree_type* tree)
         }
 }
 
-struct name_tree_node* name_tree_find(rbtree_type* tree, uint8_t* name, 
+struct name_tree_node* name_tree_find(rbtree_type* tree, uint8_t* name,
         size_t len, int labs, uint16_t dclass)
 {
 	struct name_tree_node key;
@@ -220,7 +220,7 @@ struct name_tree_node* name_tree_lookup(rbtree_type* tree, uint8_t* name,
 	return result;
 }
 
-struct addr_tree_node* addr_tree_lookup(rbtree_type* tree, 
+struct addr_tree_node* addr_tree_lookup(rbtree_type* tree,
         struct sockaddr_storage* addr, socklen_t addrlen)
 {
         rbnode_type* res = NULL;
diff --git a/usr.sbin/unbound/util/storage/dnstree.h b/usr.sbin/unbound/util/storage/dnstree.h
index 8aaa94098..5d58f2ca5 100644
--- a/usr.sbin/unbound/util/storage/dnstree.h
+++ b/usr.sbin/unbound/util/storage/dnstree.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -105,7 +105,7 @@ void name_tree_init(rbtree_type* tree);
  * @param dclass: class of name
  * @return false on error (duplicate element).
  */
-int name_tree_insert(rbtree_type* tree, struct name_tree_node* node, 
+int name_tree_insert(rbtree_type* tree, struct name_tree_node* node,
 	uint8_t* name, size_t len, int labs, uint16_t dclass);
 
 /**
@@ -124,7 +124,7 @@ void name_tree_init_parents(rbtree_type* tree);
  * @param dclass: class of name
  * @return node or NULL if not found.
  */
-struct name_tree_node* name_tree_find(rbtree_type* tree, uint8_t* name, 
+struct name_tree_node* name_tree_find(rbtree_type* tree, uint8_t* name,
 	size_t len, int labs, uint16_t dclass);
 
 /**
@@ -136,7 +136,7 @@ struct name_tree_node* name_tree_find(rbtree_type* tree, uint8_t* name,
  * @param dclass: class of name
  * @return closest enclosing node (could be equal) or NULL if not found.
  */
-struct name_tree_node* name_tree_lookup(rbtree_type* tree, uint8_t* name, 
+struct name_tree_node* name_tree_lookup(rbtree_type* tree, uint8_t* name,
 	size_t len, int labs, uint16_t dclass);
 
 /**
@@ -167,10 +167,10 @@ void addr_tree_addrport_init(rbtree_type* tree);
  *	has allocated).
  * @param addr: to insert (copied).
  * @param addrlen: length of addr
- * @param net: size of subnet. 
+ * @param net: size of subnet.
  * @return false on error (duplicate element).
  */
-int addr_tree_insert(rbtree_type* tree, struct addr_tree_node* node, 
+int addr_tree_insert(rbtree_type* tree, struct addr_tree_node* node,
 	struct sockaddr_storage* addr, socklen_t addrlen, int net);
 
 /**
@@ -194,7 +194,7 @@ void addr_tree_init_parents_node(struct addr_tree_node* node);
  * @param addrlen: length of addr
  * @return closest enclosing node (could be equal) or NULL if not found.
  */
-struct addr_tree_node* addr_tree_lookup(rbtree_type* tree, 
+struct addr_tree_node* addr_tree_lookup(rbtree_type* tree,
 	struct sockaddr_storage* addr, socklen_t addrlen);
 
 /**
@@ -205,7 +205,7 @@ struct addr_tree_node* addr_tree_lookup(rbtree_type* tree,
  * @param net: size of subnet
  * @return addr tree element, or NULL if not found.
  */
-struct addr_tree_node* addr_tree_find(rbtree_type* tree, 
+struct addr_tree_node* addr_tree_find(rbtree_type* tree,
 	struct sockaddr_storage* addr, socklen_t addrlen, int net);
 
 /** compare name tree nodes */
diff --git a/usr.sbin/unbound/util/storage/lookup3.c b/usr.sbin/unbound/util/storage/lookup3.c
index c4026626c..c1988fc4d 100644
--- a/usr.sbin/unbound/util/storage/lookup3.c
+++ b/usr.sbin/unbound/util/storage/lookup3.c
@@ -16,8 +16,8 @@
 lookup3.c, by Bob Jenkins, May 2006, Public Domain.
 
 These are functions for producing 32-bit hashes for hash table lookup.
-hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final() 
-are externally useful functions.  Routines to test the hash are included 
+hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final()
+are externally useful functions.  Routines to test the hash are included
 if SELF_TEST is defined.  You can use this free for any purpose.  It's in
 the public domain.  It has no warranty.
 
@@ -25,7 +25,7 @@ You probably want to use hashlittle().  hashlittle() and hashbig()
 hash byte arrays.  hashlittle() is is faster than hashbig() on
 little-endian machines.  Intel and AMD are little-endian machines.
 On second thought, you probably want hashlittle2(), which is identical to
-hashlittle() except it returns two 32-bit hashes for the price of one.  
+hashlittle() except it returns two 32-bit hashes for the price of one.
 You could implement hashbig2() if you wanted but I haven't bothered here.
 
 If you want to find a hash of, say, exactly 7 integers, do
@@ -38,9 +38,9 @@ If you want to find a hash of, say, exactly 7 integers, do
 then use c as the hash value.  If you have a variable length array of
 4-byte integers to hash, use hashword().  If you have a byte array (like
 a character string), use hashlittle().  If you have several byte arrays, or
-a mix of things, see the comments above hashlittle().  
+a mix of things, see the comments above hashlittle().
 
-Why is this so big?  I read 12 bytes at a time into 3 4-byte integers, 
+Why is this so big?  I read 12 bytes at a time into 3 4-byte integers,
 then mix those integers.  This is fast (you can do a lot more thorough
 mixing with 12*3 instructions on 3 integers than you can with 3 instructions
 on 1 byte), but shoehorning those bytes into integers efficiently is messy.
@@ -72,7 +72,7 @@ on 1 byte), but shoehorning those bytes into integers efficiently is messy.
 # ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h> /* attempt to define endianness (solaris) */
 # endif
-# if defined(linux) || defined(__OpenBSD__)
+# if defined(linux) || defined(__OpenBSD__) || defined(__SecBSD__)
 #  ifdef HAVE_ENDIAN_H
 #    include <endian.h>    /* attempt to define endianness */
 #  else
@@ -144,7 +144,7 @@ This was tested for:
   the output delta to a Gray code (a^(a>>1)) so a string of 1's (as
   is commonly produced by subtraction) look like a single 1-bit
   difference.
-* the base values were pseudorandom, all zero but one bit set, or 
+* the base values were pseudorandom, all zero but one bit set, or
   all zero plus a counter that starts at zero.
 
 Some k values for my "a-=c; a^=rot(c,k); c+=b;" arrangement that
@@ -154,7 +154,7 @@ satisfy this are
    14  9  3  7 17  3
 Well, "9 15 3 18 27 15" didn't quite get 32 bits diffing
 for "differ" defined as + with a one-bit base and a two-bit delta.  I
-used http://burtleburtle.net/bob/hash/avalanche.html to choose 
+used http://burtleburtle.net/bob/hash/avalanche.html to choose
 the operations, constants, and arrangements of the variables.
 
 This does not achieve avalanche.  There are input bits of (a,b,c)
@@ -193,7 +193,7 @@ produce values of c that look totally different.  This was tested for
   the output delta to a Gray code (a^(a>>1)) so a string of 1's (as
   is commonly produced by subtraction) look like a single 1-bit
   difference.
-* the base values were pseudorandom, all zero but one bit set, or 
+* the base values were pseudorandom, all zero but one bit set, or
   all zero plus a counter that starts at zero.
 
 These constants passed:
@@ -252,7 +252,7 @@ uint32_t        initval)         /* the previous hash, or an arbitrary value */
 
   /*------------------------------------------- handle the last 3 uint32_t's */
   switch(length)                     /* all the case statements fall through */
-  { 
+  {
   case 3 : c+=k[2];
   	/* fallthrough */
   case 2 : b+=k[1];
@@ -273,7 +273,7 @@ uint32_t        initval)         /* the previous hash, or an arbitrary value */
 --------------------------------------------------------------------
 hashword2() -- same as hashword(), but take two seeds and return two
 32-bit values.  pc and pb must both be nonnull, and *pc and *pb must
-both be initialized with seeds.  If you pass in (*pb)==0, the output 
+both be initialized with seeds.  If you pass in (*pb)==0, the output
 (*pc) will be the same as the return value from hashword().
 --------------------------------------------------------------------
 */
@@ -302,7 +302,7 @@ uint32_t       *pb)               /* IN: more seed OUT: secondary hash value */
 
   /*------------------------------------------- handle the last 3 uint32_t's */
   switch(length)                     /* all the case statements fall through */
-  { 
+  {
   case 3 : c+=k[2];
   case 2 : b+=k[1];
   case 1 : a+=k[0];
@@ -370,7 +370,7 @@ uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
     }
 
     /*----------------------------- handle the last (probably partial) block */
-    /* 
+    /*
      * "k[2]&0xffffff" actually reads beyond the end of the string, but
      * then masks off the part it's not allowed to read.  Because the
      * string is aligned, the masked-off tail is in the same word as the
@@ -537,7 +537,7 @@ uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
  * the key.  *pc is better mixed than *pb, so use *pc first.  If you want
  * a 64-bit value do something like "*pc + (((uint64_t)*pb)<<32)".
  */
-void hashlittle2( 
+void hashlittle2(
   const void *key,       /* the key to hash */
   size_t      length,    /* length of the key */
   uint32_t   *pc,        /* IN: primary initval, OUT: primary hash */
@@ -569,7 +569,7 @@ void hashlittle2(
     }
 
     /*----------------------------- handle the last (probably partial) block */
-    /* 
+    /*
      * "k[2]&0xffffff" actually reads beyond the end of the string, but
      * then masks off the part it's not allowed to read.  Because the
      * string is aligned, the masked-off tail is in the same word as the
@@ -721,7 +721,7 @@ void hashlittle2(
  * hashbig():
  * This is the same as hashword() on big-endian machines.  It is different
  * from hashlittle() on all machines.  hashbig() takes advantage of
- * big-endian byte ordering. 
+ * big-endian byte ordering.
  */
 uint32_t hashbig( const void *key, size_t length, uint32_t initval)
 {
@@ -750,7 +750,7 @@ uint32_t hashbig( const void *key, size_t length, uint32_t initval)
     }
 
     /*----------------------------- handle the last (probably partial) block */
-    /* 
+    /*
      * "k[2]<<8" actually reads beyond the end of the string, but
      * then shifts out the part it's not allowed to read.  Because the
      * string is aligned, the illegal read is in the same word as the
@@ -861,7 +861,7 @@ void driver1(void)
 
   time(&a);
   for (i=0; i<256; ++i) buf[i] = 'x';
-  for (i=0; i<1; ++i) 
+  for (i=0; i<1; ++i)
   {
     h = hashlittle(&buf[0],1,h);
   }
@@ -897,7 +897,7 @@ void driver2(void)
 
       	  /*---- check that every output bit is affected by that input bit */
 	  for (k=0; k<MAXPAIR; k+=2)
-	  { 
+	  {
 	    uint32_t finished=1;
 	    /* keys have one bit different */
 	    for (l=0; l<hlen+1; ++l) {a[l] = b[l] = (uint8_t)0;}
@@ -922,7 +922,7 @@ void driver2(void)
 	    if (finished) break;
 	  }
 	  if (k>z) z=k;
-	  if (k==MAXPAIR) 
+	  if (k==MAXPAIR)
 	  {
 	     printf("Some bit didn't change: ");
 	     printf("%.8x %.8x %.8x %.8x %.8x %.8x  ",
@@ -1008,7 +1008,7 @@ void driver3(void)
   i=47, j=0;
   hashword2(&len, 1, &i, &j);
   if (hashword(&len, 1, 47) != i)
-    printf("hashword2 and hashword mismatch %x %x\n", 
+    printf("hashword2 and hashword mismatch %x %x\n",
 	   i, hashword(&len, 1, 47));
 
   /* check hashlittle doesn't read before or after the ends of the string */
@@ -1025,7 +1025,7 @@ void driver3(void)
       *(b-1)=(uint8_t)~0;
       x = hashlittle(b, len, (uint32_t)1);
       y = hashlittle(b, len, (uint32_t)1);
-      if ((ref != x) || (ref != y)) 
+      if ((ref != x) || (ref != y))
       {
 	printf("alignment error: %.8x %.8x %.8x %d %d\n",ref,x,y,
                h, i);
diff --git a/usr.sbin/unbound/util/storage/lookup3.h b/usr.sbin/unbound/util/storage/lookup3.h
index 59dad7c48..ab6d990b6 100644
--- a/usr.sbin/unbound/util/storage/lookup3.h
+++ b/usr.sbin/unbound/util/storage/lookup3.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/util/storage/lruhash.c b/usr.sbin/unbound/util/storage/lruhash.c
index 3500a4ef0..9cf3fce7c 100644
--- a/usr.sbin/unbound/util/storage/lruhash.c
+++ b/usr.sbin/unbound/util/storage/lruhash.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -53,18 +53,18 @@ bin_init(struct lruhash_bin* array, size_t size)
 #endif
 	for(i=0; i<size; i++) {
 		lock_quick_init(&array[i].lock);
-		lock_protect(&array[i].lock, &array[i], 
+		lock_protect(&array[i].lock, &array[i],
 			sizeof(struct lruhash_bin));
 	}
 }
 
-struct lruhash* 
+struct lruhash*
 lruhash_create(size_t start_size, size_t maxmem,
 	lruhash_sizefunc_type sizefunc, lruhash_compfunc_type compfunc,
 	lruhash_delkeyfunc_type delkeyfunc,
 	lruhash_deldatafunc_type deldatafunc, void* arg)
 {
-	struct lruhash* table = (struct lruhash*)calloc(1, 
+	struct lruhash* table = (struct lruhash*)calloc(1,
 		sizeof(struct lruhash));
 	if(!table)
 		return NULL;
@@ -89,12 +89,12 @@ lruhash_create(size_t start_size, size_t maxmem,
 	}
 	bin_init(table->array, table->size);
 	lock_protect(&table->lock, table, sizeof(*table));
-	lock_protect(&table->lock, table->array, 
+	lock_protect(&table->lock, table->array,
 		table->size*sizeof(struct lruhash_bin));
 	return table;
 }
 
-void 
+void
 bin_delete(struct lruhash* table, struct lruhash_bin* bin)
 {
 	struct lruhash_entry* p, *np;
@@ -113,8 +113,8 @@ bin_delete(struct lruhash* table, struct lruhash_bin* bin)
 	}
 }
 
-void 
-bin_split(struct lruhash* table, struct lruhash_bin* newa, 
+void
+bin_split(struct lruhash* table, struct lruhash_bin* newa,
 	int newmask)
 {
 	size_t i;
@@ -149,7 +149,7 @@ bin_split(struct lruhash* table, struct lruhash_bin* newa,
 	}
 }
 
-void 
+void
 lruhash_delete(struct lruhash* table)
 {
 	size_t i;
@@ -163,7 +163,7 @@ lruhash_delete(struct lruhash* table)
 	free(table);
 }
 
-void 
+void
 bin_overflow_remove(struct lruhash_bin* bin, struct lruhash_entry* entry)
 {
 	struct lruhash_entry* p = bin->overflow_list;
@@ -178,7 +178,7 @@ bin_overflow_remove(struct lruhash_bin* bin, struct lruhash_entry* entry)
 	}
 }
 
-void 
+void
 reclaim_space(struct lruhash* table, struct lruhash_entry** list)
 {
 	struct lruhash_entry* d;
@@ -188,8 +188,8 @@ reclaim_space(struct lruhash* table, struct lruhash_entry** list)
 	while(table->num > 1 && table->space_used > table->space_max) {
 		/* notice that since we hold the hashtable lock, nobody
 		   can change the lru chain. So it cannot be deleted underneath
-		   us. We still need the hashbin and entry write lock to make 
-		   sure we flush all users away from the entry. 
+		   us. We still need the hashbin and entry write lock to make
+		   sure we flush all users away from the entry.
 		   which is unlikely, since it is LRU, if someone got a rdlock
 		   it would be moved to front, but to be sure. */
 		d = table->lru_end;
@@ -214,8 +214,8 @@ reclaim_space(struct lruhash* table, struct lruhash_entry** list)
 	}
 }
 
-struct lruhash_entry* 
-bin_find_entry(struct lruhash* table, 
+struct lruhash_entry*
+bin_find_entry(struct lruhash* table,
 	struct lruhash_bin* bin, hashvalue_type hash, void* key)
 {
 	struct lruhash_entry* p = bin->overflow_list;
@@ -227,7 +227,7 @@ bin_find_entry(struct lruhash* table,
 	return NULL;
 }
 
-void 
+void
 table_grow(struct lruhash* table)
 {
 	struct lruhash_bin* newa;
@@ -253,16 +253,16 @@ table_grow(struct lruhash* table)
 		lock_quick_destroy(&table->array[i].lock);
 	}
 	free(table->array);
-	
+
 	table->size *= 2;
 	table->size_mask = newmask;
 	table->array = newa;
-	lock_protect(&table->lock, table->array, 
+	lock_protect(&table->lock, table->array,
 		table->size*sizeof(struct lruhash_bin));
 	return;
 }
 
-void 
+void
 lru_front(struct lruhash* table, struct lruhash_entry* entry)
 {
 	entry->lru_prev = NULL;
@@ -273,7 +273,7 @@ lru_front(struct lruhash* table, struct lruhash_entry* entry)
 	table->lru_start = entry;
 }
 
-void 
+void
 lru_remove(struct lruhash* table, struct lruhash_entry* entry)
 {
 	if(entry->lru_prev)
@@ -284,7 +284,7 @@ lru_remove(struct lruhash* table, struct lruhash_entry* entry)
 	else	table->lru_end = entry->lru_prev;
 }
 
-void 
+void
 lru_touch(struct lruhash* table, struct lruhash_entry* entry)
 {
 	log_assert(table && entry);
@@ -296,7 +296,7 @@ lru_touch(struct lruhash* table, struct lruhash_entry* entry)
 	lru_front(table, entry);
 }
 
-void 
+void
 lruhash_insert(struct lruhash* table, hashvalue_type hash,
         struct lruhash_entry* entry, void* data, void* cb_arg)
 {
@@ -352,7 +352,7 @@ lruhash_insert(struct lruhash* table, hashvalue_type hash,
 	}
 }
 
-struct lruhash_entry* 
+struct lruhash_entry*
 lruhash_lookup(struct lruhash* table, hashvalue_type hash, void* key, int wr)
 {
 	struct lruhash_entry* entry;
@@ -374,7 +374,7 @@ lruhash_lookup(struct lruhash* table, hashvalue_type hash, void* key, int wr)
 	return entry;
 }
 
-void 
+void
 lruhash_remove(struct lruhash* table, hashvalue_type hash, void* key)
 {
 	struct lruhash_entry* entry;
@@ -398,7 +398,7 @@ lruhash_remove(struct lruhash* table, hashvalue_type hash, void* key)
 		return;
 	}
 	table->num--;
-	table->space_used -= (*table->sizefunc)(entry->key, entry->data);	
+	table->space_used -= (*table->sizefunc)(entry->key, entry->data);
 	lock_rw_wrlock(&entry->lock);
 	if(table->markdelfunc)
 		(*table->markdelfunc)(entry->key);
@@ -418,7 +418,7 @@ bin_clear(struct lruhash* table, struct lruhash_bin* bin)
 	struct lruhash_entry* p, *np;
 	void *d;
 	lock_quick_lock(&bin->lock);
-	p = bin->overflow_list; 
+	p = bin->overflow_list;
 	while(p) {
 		lock_rw_wrlock(&p->lock);
 		np = p->overflow_next;
@@ -455,7 +455,7 @@ lruhash_clear(struct lruhash* table)
 	lock_quick_unlock(&table->lock);
 }
 
-void 
+void
 lruhash_status(struct lruhash* table, const char* id, int extended)
 {
 	lock_quick_lock(&table->lock);
@@ -483,7 +483,7 @@ lruhash_status(struct lruhash* table, const char* id, int extended)
 			if(here > max) max = here;
 			if(here < min) min = here;
 		}
-		log_info("  bin min %d, avg %.2lf, max %d", min, 
+		log_info("  bin min %d, avg %.2lf, max %d", min,
 			(double)table->num/(double)table->size, max);
 	}
 	lock_quick_unlock(&table->lock);
@@ -499,12 +499,12 @@ lruhash_get_mem(struct lruhash* table)
 	if(table->size != 0) {
 		size_t i;
 		for(i=0; i<table->size; i++)
-			s += sizeof(struct lruhash_bin) + 
+			s += sizeof(struct lruhash_bin) +
 				lock_get_mem(&table->array[i].lock);
 	}
 #else /* no THREAD_DEBUG */
 	if(table->size != 0)
-		s += (table->size)*(sizeof(struct lruhash_bin) + 
+		s += (table->size)*(sizeof(struct lruhash_bin) +
 			lock_get_mem(&table->array[0].lock));
 #endif
 	lock_quick_unlock(&table->lock);
@@ -512,7 +512,7 @@ lruhash_get_mem(struct lruhash* table)
 	return s;
 }
 
-void 
+void
 lruhash_setmarkdel(struct lruhash* table, lruhash_markdelfunc_type md)
 {
 	lock_quick_lock(&table->lock);
@@ -520,8 +520,8 @@ lruhash_setmarkdel(struct lruhash* table, lruhash_markdelfunc_type md)
 	lock_quick_unlock(&table->lock);
 }
 
-void 
-lruhash_traverse(struct lruhash* h, int wr, 
+void
+lruhash_traverse(struct lruhash* h, int wr,
 	void (*func)(struct lruhash_entry*, void*), void* arg)
 {
 	size_t i;
diff --git a/usr.sbin/unbound/util/storage/lruhash.h b/usr.sbin/unbound/util/storage/lruhash.h
index 4759b5001..42b58fccf 100644
--- a/usr.sbin/unbound/util/storage/lruhash.h
+++ b/usr.sbin/unbound/util/storage/lruhash.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -89,7 +89,7 @@
  *	  the hashbinlock. The next thread that comes in and needs the same
  * 	  hashbin will wait for the lock while holding the hashtable lock.
  *	  thus halting the entire system on hashtable.
- *	  This is because of the delete protection. 
+ *	  This is because of the delete protection.
  *	  Readlocks will be easier on the rwlock on entries.
  *	  While the writer is holding writelock, similar problems happen with
  *	  a reader or writer needing the same item.
@@ -118,9 +118,9 @@ struct lruhash_entry;
 /** the type of a hash value */
 typedef uint32_t hashvalue_type;
 
-/** 
+/**
  * Type of function that calculates the size of an entry.
- * Result must include the size of struct lruhash_entry. 
+ * Result must include the size of struct lruhash_entry.
  * Keys that are identical must also calculate to the same size.
  * size = func(key, data).
  */
@@ -129,7 +129,7 @@ typedef size_t (*lruhash_sizefunc_type)(void*, void*);
 /** type of function that compares two keys. return 0 if equal. */
 typedef int (*lruhash_compfunc_type)(void*, void*);
 
-/** old keys are deleted. 
+/** old keys are deleted.
  * The RRset type has to revoke its ID number, markdel() is used first.
  * This function is called: func(key, userarg) */
 typedef void (*lruhash_delkeyfunc_type)(void*, void*);
@@ -137,7 +137,7 @@ typedef void (*lruhash_delkeyfunc_type)(void*, void*);
 /** old data is deleted. This function is called: func(data, userarg). */
 typedef void (*lruhash_deldatafunc_type)(void*, void*);
 
-/** mark a key as pending to be deleted (and not to be used by anyone). 
+/** mark a key as pending to be deleted (and not to be used by anyone).
  * called: func(key) */
 typedef void (*lruhash_markdelfunc_type)(void*);
 
@@ -184,7 +184,7 @@ struct lruhash {
  * A single bin with a linked list of entries in it.
  */
 struct lruhash_bin {
-	/** 
+	/**
 	 * Lock for exclusive access to the linked list
 	 * This lock makes deletion of items safe in this overflow list.
 	 */
@@ -201,7 +201,7 @@ struct lruhash_bin {
  * to get the surrounding structure. Data should be allocated on its own.
  */
 struct lruhash_entry {
-	/** 
+	/**
 	 * rwlock for access to the contents of the entry
 	 * Note that it does _not_ cover the lru_ and overflow_ ptrs.
 	 * Even with a writelock, you cannot change hash and key.
@@ -231,7 +231,7 @@ struct lruhash_entry {
  * @param delkeyfunc: deletes key.
  *   Calling both delkey and deldata will also free the struct lruhash_entry.
  *   Make it part of the key structure and delete it in delkeyfunc.
- * @param deldatafunc: deletes data. 
+ * @param deldatafunc: deletes data.
  * @param arg: user argument that is passed to user function calls.
  * @return: new hash table or NULL on malloc failure.
  */
@@ -247,14 +247,14 @@ struct lruhash* lruhash_create(size_t start_size, size_t maxmem,
 void lruhash_delete(struct lruhash* table);
 
 /**
- * Clear hash table. Entries are all deleted, while locking them before 
+ * Clear hash table. Entries are all deleted, while locking them before
  * doing so. At end the table is empty.
  * @param table: to make empty.
  */
 void lruhash_clear(struct lruhash* table);
 
 /**
- * Insert a new element into the hashtable. 
+ * Insert a new element into the hashtable.
  * If key is already present data pointer in that entry is updated.
  * The space calculation function is called with the key, data.
  * If necessary the least recently used entries are deleted to make space.
@@ -269,7 +269,7 @@ void lruhash_clear(struct lruhash* table);
  * @param data: the data.
  * @param cb_override: if not null overrides the cb_arg for the deletefunc.
  */
-void lruhash_insert(struct lruhash* table, hashvalue_type hash, 
+void lruhash_insert(struct lruhash* table, hashvalue_type hash,
 	struct lruhash_entry* entry, void* data, void* cb_override);
 
 /**
@@ -317,7 +317,7 @@ void lru_demote(struct lruhash* table, struct lruhash_entry* entry);
  * element of it exits.
  *
  * If key is already present data pointer in that entry is kept.
- * If it is not present, a new entry is created. In that case, 
+ * If it is not present, a new entry is created. In that case,
  * the space calculation function is called with the key, data.
  * If necessary the least recently used entries are deleted to make space.
  * If necessary the hash array is grown up.
@@ -341,7 +341,7 @@ struct lruhash_entry* lruhash_insert_or_retrieve(struct lruhash* table, hashvalu
  * Delfunc is called for the entry.
  * @param table: hash table.
  * @param hash: hash of key.
- * @param key: what to look for. 
+ * @param key: what to look for.
  */
 void lruhash_remove(struct lruhash* table, hashvalue_type hash, void* key);
 
@@ -351,7 +351,7 @@ void bin_init(struct lruhash_bin* array, size_t size);
 /** delete the hash bin and entries inside it */
 void bin_delete(struct lruhash* table, struct lruhash_bin* bin);
 
-/** 
+/**
  * Find entry in hash bin. You must have locked the bin.
  * @param table: hash table with function pointers.
  * @param bin: hash bin to look into.
@@ -359,7 +359,7 @@ void bin_delete(struct lruhash* table, struct lruhash_bin* bin);
  * @param key: key to look for.
  * @return: the entry or NULL if not found.
  */
-struct lruhash_entry* bin_find_entry(struct lruhash* table, 
+struct lruhash_entry* bin_find_entry(struct lruhash* table,
 	struct lruhash_bin* bin, hashvalue_type hash, void* key);
 
 /**
@@ -368,7 +368,7 @@ struct lruhash_entry* bin_find_entry(struct lruhash* table,
  * @param bin: hash bin to look into.
  * @param entry: entry ptr that needs removal.
  */
-void bin_overflow_remove(struct lruhash_bin* bin, 
+void bin_overflow_remove(struct lruhash_bin* bin,
 	struct lruhash_entry* entry);
 
 /**
@@ -381,10 +381,10 @@ void bin_overflow_remove(struct lruhash_bin* bin,
  * @param newa: new increased array.
  * @param newmask: new lookup mask.
  */
-void bin_split(struct lruhash* table, struct lruhash_bin* newa, 
+void bin_split(struct lruhash* table, struct lruhash_bin* newa,
 	int newmask);
 
-/** 
+/**
  * Try to make space available by deleting old entries.
  * Assumes that the lock on the hashtable is being held by caller.
  * Caller must not hold bin locks.
diff --git a/usr.sbin/unbound/util/storage/slabhash.c b/usr.sbin/unbound/util/storage/slabhash.c
index a6c3d0fa6..2da70ba7c 100644
--- a/usr.sbin/unbound/util/storage/slabhash.c
+++ b/usr.sbin/unbound/util/storage/slabhash.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -45,13 +45,13 @@
 #include "config.h"
 #include "util/storage/slabhash.h"
 
-struct slabhash* slabhash_create(size_t numtables, size_t start_size, 
-	size_t maxmem, lruhash_sizefunc_type sizefunc, 
-	lruhash_compfunc_type compfunc, lruhash_delkeyfunc_type delkeyfunc, 
+struct slabhash* slabhash_create(size_t numtables, size_t start_size,
+	size_t maxmem, lruhash_sizefunc_type sizefunc,
+	lruhash_compfunc_type compfunc, lruhash_delkeyfunc_type delkeyfunc,
 	lruhash_deldatafunc_type deldatafunc, void* arg)
 {
 	size_t i;
-	struct slabhash* sl = (struct slabhash*)calloc(1, 
+	struct slabhash* sl = (struct slabhash*)calloc(1,
 		sizeof(struct slabhash));
 	if(!sl) return NULL;
 	sl->size = numtables;
@@ -65,7 +65,7 @@ struct slabhash* slabhash_create(size_t numtables, size_t start_size,
 	if(sl->mask == 0) {
 		sl->shift = 0;
 	} else {
-		log_assert( (sl->size & sl->mask) == 0 
+		log_assert( (sl->size & sl->mask) == 0
 			/* size must be power of 2 */ );
 		sl->shift = 0;
 		while(!(sl->mask & 0x80000000)) {
@@ -113,13 +113,13 @@ slab_idx(struct slabhash* sl, hashvalue_type hash)
 	return ((hash & sl->mask) >> sl->shift);
 }
 
-void slabhash_insert(struct slabhash* sl, hashvalue_type hash, 
+void slabhash_insert(struct slabhash* sl, hashvalue_type hash,
 	struct lruhash_entry* entry, void* data, void* arg)
 {
 	lruhash_insert(sl->array[slab_idx(sl, hash)], hash, entry, data, arg);
 }
 
-struct lruhash_entry* slabhash_lookup(struct slabhash* sl, 
+struct lruhash_entry* slabhash_lookup(struct slabhash* sl,
 	hashvalue_type hash, void* key, int wr)
 {
 	return lruhash_lookup(sl->array[slab_idx(sl, hash)], hash, key, wr);
@@ -134,7 +134,7 @@ void slabhash_status(struct slabhash* sl, const char* id, int extended)
 {
 	size_t i;
 	char num[17];
-	log_info("Slabhash %s: %u tables mask=%x shift=%d", 
+	log_info("Slabhash %s: %u tables mask=%x shift=%d",
 		id, (unsigned)sl->size, (unsigned)sl->mask, sl->shift);
 	for(i=0; i<sl->size; i++) {
 		snprintf(num, sizeof(num), "table %u", (unsigned)i);
@@ -167,7 +167,7 @@ int slabhash_is_size(struct slabhash* sl, size_t size, size_t slabs)
 }
 
 size_t slabhash_get_mem(struct slabhash* sl)
-{	
+{
 	size_t i, total = sizeof(*sl);
 	total += sizeof(struct lruhash*)*sl->size;
 	for(i=0; i<sl->size; i++) {
@@ -190,7 +190,7 @@ static void deldata(struct slabhash_testdata* d) {free(d);}
 
 size_t test_slabhash_sizefunc(void* ATTR_UNUSED(key), void* ATTR_UNUSED(data))
 {
-	return sizeof(struct slabhash_testkey) + 
+	return sizeof(struct slabhash_testkey) +
 		sizeof(struct slabhash_testdata);
 }
 
diff --git a/usr.sbin/unbound/util/storage/slabhash.h b/usr.sbin/unbound/util/storage/slabhash.h
index 4ecb60421..563c65407 100644
--- a/usr.sbin/unbound/util/storage/slabhash.h
+++ b/usr.sbin/unbound/util/storage/slabhash.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -49,7 +49,7 @@
 #define HASH_DEFAULT_SLABS 4
 
 /**
- * Hash table formed from several smaller ones. 
+ * Hash table formed from several smaller ones.
  * This results in a partitioned lruhash table, a 'slashtable'.
  * None of the data inside the slabhash may be altered.
  * Therefore, no locks are needed to access the structure.
@@ -75,13 +75,13 @@ struct slabhash {
  * @param sizefunc: calculates memory usage of entries.
  * @param compfunc: compares entries, 0 on equality.
  * @param delkeyfunc: deletes key.
- * @param deldatafunc: deletes data. 
+ * @param deldatafunc: deletes data.
  * @param arg: user argument that is passed to user function calls.
  * @return: new hash table or NULL on malloc failure.
  */
-struct slabhash* slabhash_create(size_t numtables, size_t start_size, 
-	size_t maxmem, lruhash_sizefunc_type sizefunc, 
-	lruhash_compfunc_type compfunc, lruhash_delkeyfunc_type delkeyfunc, 
+struct slabhash* slabhash_create(size_t numtables, size_t start_size,
+	size_t maxmem, lruhash_sizefunc_type sizefunc,
+	lruhash_compfunc_type compfunc, lruhash_delkeyfunc_type delkeyfunc,
 	lruhash_deldatafunc_type deldatafunc, void* arg);
 
 /**
@@ -97,7 +97,7 @@ void slabhash_delete(struct slabhash* table);
 void slabhash_clear(struct slabhash* table);
 
 /**
- * Insert a new element into the hashtable, uses lruhash_insert. 
+ * Insert a new element into the hashtable, uses lruhash_insert.
  * If key is already present data pointer in that entry is updated.
  *
  * @param table: hash table.
@@ -109,7 +109,7 @@ void slabhash_clear(struct slabhash* table);
  * @param data: the data.
  * @param cb_override: if not NULL overrides the cb_arg for deletefunc.
  */
-void slabhash_insert(struct slabhash* table, hashvalue_type hash, 
+void slabhash_insert(struct slabhash* table, hashvalue_type hash,
 	struct lruhash_entry* entry, void* data, void* cb_override);
 
 /**
@@ -125,7 +125,7 @@ void slabhash_insert(struct slabhash* table, hashvalue_type hash,
  * @return: pointer to the entry or NULL. The entry is locked.
  *    The user must unlock the entry when done.
  */
-struct lruhash_entry* slabhash_lookup(struct slabhash* table, 
+struct lruhash_entry* slabhash_lookup(struct slabhash* table,
 	hashvalue_type hash, void* key, int wr);
 
 /**
@@ -133,7 +133,7 @@ struct lruhash_entry* slabhash_lookup(struct slabhash* table,
  * Delfunc is called for the entry. Uses lruhash_remove.
  * @param table: hash table.
  * @param hash: hash of key.
- * @param key: what to look for. 
+ * @param key: what to look for.
  */
 void slabhash_remove(struct slabhash* table, hashvalue_type hash, void* key);
 
diff --git a/usr.sbin/unbound/util/tcp_conn_limit.c b/usr.sbin/unbound/util/tcp_conn_limit.c
index d7d86a540..d46aef572 100644
--- a/usr.sbin/unbound/util/tcp_conn_limit.c
+++ b/usr.sbin/unbound/util/tcp_conn_limit.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2018, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
diff --git a/usr.sbin/unbound/util/timehist.c b/usr.sbin/unbound/util/timehist.c
index 61cc995fd..515cf61f3 100644
--- a/usr.sbin/unbound/util/timehist.c
+++ b/usr.sbin/unbound/util/timehist.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -83,12 +83,12 @@ dosetup(struct timehist* hist)
 
 struct timehist* timehist_setup(void)
 {
-	struct timehist* hist = (struct timehist*)calloc(1, 
+	struct timehist* hist = (struct timehist*)calloc(1,
 		sizeof(struct timehist));
 	if(!hist)
 		return NULL;
 	hist->num = NUM_BUCKETS_HIST;
-	hist->buckets = (struct th_buck*)calloc(hist->num, 
+	hist->buckets = (struct th_buck*)calloc(hist->num,
 		sizeof(struct th_buck));
 	if(!hist->buckets) {
 		free(hist);
@@ -194,7 +194,7 @@ timehist_count(struct timehist* hist)
 	return res;
 }
 
-double 
+double
 timehist_quartile(struct timehist* hist, double q)
 {
 	double lookfor, passed, res;
@@ -209,22 +209,22 @@ timehist_quartile(struct timehist* hist, double q)
 	lookfor *= q;
 	passed = 0;
 	i = 0;
-	while(i+1 < hist->num && 
+	while(i+1 < hist->num &&
 		passed+(double)hist->buckets[i].count < lookfor) {
 		passed += (double)hist->buckets[i++].count;
 	}
 	/* got the right bucket */
 #ifndef S_SPLINT_S
-	low = (double)hist->buckets[i].lower.tv_sec + 
+	low = (double)hist->buckets[i].lower.tv_sec +
 		(double)hist->buckets[i].lower.tv_usec/1000000.;
-	up = (double)hist->buckets[i].upper.tv_sec + 
+	up = (double)hist->buckets[i].upper.tv_sec +
 		(double)hist->buckets[i].upper.tv_usec/1000000.;
 #endif
 	res = (lookfor - passed)*(up-low)/((double)hist->buckets[i].count);
 	return low+res;
 }
 
-void 
+void
 timehist_export(struct timehist* hist, long long* array, size_t sz)
 {
 	size_t i;
@@ -235,7 +235,7 @@ timehist_export(struct timehist* hist, long long* array, size_t sz)
 		array[i] = (long long)hist->buckets[i].count;
 }
 
-void 
+void
 timehist_import(struct timehist* hist, long long* array, size_t sz)
 {
 	size_t i;
diff --git a/usr.sbin/unbound/util/timehist.h b/usr.sbin/unbound/util/timehist.h
index 5f88a38a9..084ea9c6f 100644
--- a/usr.sbin/unbound/util/timehist.h
+++ b/usr.sbin/unbound/util/timehist.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -67,7 +67,7 @@ struct timehist {
 	struct th_buck* buckets;
 };
 
-/** 
+/**
  * Setup a histogram, default
  * @return histogram or NULL on malloc failure.
  */
@@ -94,7 +94,7 @@ void timehist_insert(struct timehist* hist, struct timeval* tv);
 
 /**
  * Find time value for given quartile, such as 0.25, 0.50, 0.75.
- * The looks up the value for the i-th element in the sorted list of time 
+ * The looks up the value for the i-th element in the sorted list of time
  * values, as approximated using the histogram.
  * @param hist: histogram. Interpolated information is used from it.
  * @param q: quartile, 0.50 results in the median. Must be >0 and <1.
diff --git a/usr.sbin/unbound/util/tube.c b/usr.sbin/unbound/util/tube.c
index 43455feef..165b73331 100644
--- a/usr.sbin/unbound/util/tube.c
+++ b/usr.sbin/unbound/util/tube.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -51,7 +51,7 @@
 
 #ifndef HAVE_SOCKETPAIR
 /** no socketpair() available, like on Minix 3.1.7, use pipe */
-#define socketpair(f, t, p, sv) pipe(sv) 
+#define socketpair(f, t, p, sv) pipe(sv)
 #endif /* HAVE_SOCKETPAIR */
 
 struct tube* tube_create(void)
@@ -162,7 +162,7 @@ tube_handle_listen(struct comm_point* c, void* arg, int error,
 			/* error has happened or */
 			/* parent closed pipe, must have exited somehow */
 			fptr_ok(fptr_whitelist_tube_listen(tube->listen_cb));
-			(*tube->listen_cb)(tube, NULL, 0, NETEVENT_CLOSED, 
+			(*tube->listen_cb)(tube, NULL, 0, NETEVENT_CLOSED,
 				tube->listen_arg);
 			return 0;
 		}
@@ -192,7 +192,7 @@ tube_handle_listen(struct comm_point* c, void* arg, int error,
 		/* error has happened or */
 		/* parent closed pipe, must have exited somehow */
 		fptr_ok(fptr_whitelist_tube_listen(tube->listen_cb));
-		(*tube->listen_cb)(tube, NULL, 0, NETEVENT_CLOSED, 
+		(*tube->listen_cb)(tube, NULL, 0, NETEVENT_CLOSED,
 			tube->listen_arg);
 		return 0;
 	}
@@ -211,7 +211,7 @@ tube_handle_listen(struct comm_point* c, void* arg, int error,
 	tube->cmd_read = 0;
 
 	fptr_ok(fptr_whitelist_tube_listen(tube->listen_cb));
-	(*tube->listen_cb)(tube, tube->cmd_msg, tube->cmd_len, 
+	(*tube->listen_cb)(tube, tube->cmd_msg, tube->cmd_len,
 		NETEVENT_NOERROR, tube->listen_arg);
 		/* also frees the buf */
 	tube->cmd_msg = NULL;
@@ -282,7 +282,7 @@ tube_handle_write(struct comm_point* c, void* arg, int error,
 	return 0;
 }
 
-int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len, 
+int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len,
         int nonblock)
 {
 	ssize_t r, d;
@@ -328,7 +328,7 @@ int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len,
 	return 1;
 }
 
-int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len, 
+int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len,
         int nonblock)
 {
 	ssize_t r, d;
@@ -456,7 +456,7 @@ int tube_setup_bg_listen(struct tube* tube, struct comm_base* base,
 {
 	tube->listen_cb = cb;
 	tube->listen_arg = arg;
-	if(!(tube->listen_com = comm_point_create_raw(base, tube->sr, 
+	if(!(tube->listen_com = comm_point_create_raw(base, tube->sr,
 		0, tube_handle_listen, tube))) {
 		int err = errno;
 		log_err("tube_setup_bg_l: commpoint creation failed");
@@ -468,7 +468,7 @@ int tube_setup_bg_listen(struct tube* tube, struct comm_base* base,
 
 int tube_setup_bg_write(struct tube* tube, struct comm_base* base)
 {
-	if(!(tube->res_com = comm_point_create_raw(base, tube->sw, 
+	if(!(tube->res_com = comm_point_create_raw(base, tube->sw,
 		1, tube_handle_write, tube))) {
 		int err = errno;
 		log_err("tube_setup_bg_w: commpoint creation failed");
@@ -503,7 +503,7 @@ int tube_queue_item(struct tube* tube, uint8_t* msg, size_t len)
 	return 1;
 }
 
-void tube_handle_signal(int ATTR_UNUSED(fd), short ATTR_UNUSED(events), 
+void tube_handle_signal(int ATTR_UNUSED(fd), short ATTR_UNUSED(events),
 	void* ATTR_UNUSED(arg))
 {
 	log_assert(0);
@@ -588,7 +588,7 @@ void tube_remove_bg_write(struct tube* tube)
 	}
 }
 
-int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len, 
+int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len,
         int ATTR_UNUSED(nonblock))
 {
 	uint8_t* a;
@@ -602,7 +602,7 @@ int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len,
 	return tube_queue_item(tube, a, len);
 }
 
-int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len, 
+int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len,
         int nonblock)
 {
 	struct tube_res_list* item = NULL;
@@ -625,7 +625,7 @@ int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len,
 			tube->res_last = NULL;
 			verbose(VERB_ALGO, "tube read_msg lastdata");
 			if(!WSAResetEvent(tube->event)) {
-				log_err("WSAResetEvent: %s", 
+				log_err("WSAResetEvent: %s",
 					wsa_strerror(WSAGetLastError()));
 			}
 		}
@@ -655,9 +655,9 @@ int tube_wait(struct tube* tube)
 {
 	/* block on eventhandle */
 	DWORD res = WSAWaitForMultipleEvents(
-		1 /* one event in array */, 
-		&tube->event /* the event to wait for, our pipe signal */, 
-		0 /* wait for all events is false */, 
+		1 /* one event in array */,
+		&tube->event /* the event to wait for, our pipe signal */,
+		0 /* wait for all events is false */,
 		WSA_INFINITE /* wait, no timeout */,
 		0 /* we are not alertable for IO completion routines */
 		);
@@ -698,7 +698,7 @@ int tube_read_fd(struct tube* ATTR_UNUSED(tube))
 }
 
 int
-tube_handle_listen(struct comm_point* ATTR_UNUSED(c), void* ATTR_UNUSED(arg), 
+tube_handle_listen(struct comm_point* ATTR_UNUSED(c), void* ATTR_UNUSED(arg),
 	int ATTR_UNUSED(error), struct comm_reply* ATTR_UNUSED(reply_info))
 {
 	log_assert(0);
@@ -706,7 +706,7 @@ tube_handle_listen(struct comm_point* ATTR_UNUSED(c), void* ATTR_UNUSED(arg),
 }
 
 int
-tube_handle_write(struct comm_point* ATTR_UNUSED(c), void* ATTR_UNUSED(arg), 
+tube_handle_write(struct comm_point* ATTR_UNUSED(c), void* ATTR_UNUSED(arg),
 	int ATTR_UNUSED(error), struct comm_reply* ATTR_UNUSED(reply_info))
 {
 	log_assert(0);
@@ -725,7 +725,7 @@ int tube_setup_bg_listen(struct tube* tube, struct comm_base* base,
 	return tube->ev_listen ? 1 : 0;
 }
 
-int tube_setup_bg_write(struct tube* ATTR_UNUSED(tube), 
+int tube_setup_bg_write(struct tube* ATTR_UNUSED(tube),
 	struct comm_base* ATTR_UNUSED(base))
 {
 	/* the queue item routine performs the signaling */
@@ -760,7 +760,7 @@ int tube_queue_item(struct tube* tube, uint8_t* msg, size_t len)
 	return 1;
 }
 
-void tube_handle_signal(int ATTR_UNUSED(fd), short ATTR_UNUSED(events), 
+void tube_handle_signal(int ATTR_UNUSED(fd), short ATTR_UNUSED(events),
 	void* arg)
 {
 	struct tube* tube = (struct tube*)arg;
@@ -770,7 +770,7 @@ void tube_handle_signal(int ATTR_UNUSED(fd), short ATTR_UNUSED(events),
 	while(tube_poll(tube)) {
 		if(tube_read_msg(tube, &buf, &len, 1)) {
 			fptr_ok(fptr_whitelist_tube_listen(tube->listen_cb));
-			(*tube->listen_cb)(tube, buf, len, NETEVENT_NOERROR, 
+			(*tube->listen_cb)(tube, buf, len, NETEVENT_NOERROR,
 				tube->listen_arg);
 		}
 	}
diff --git a/usr.sbin/unbound/util/tube.h b/usr.sbin/unbound/util/tube.h
index 5e4fb8644..3abf18c43 100644
--- a/usr.sbin/unbound/util/tube.h
+++ b/usr.sbin/unbound/util/tube.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -150,7 +150,7 @@ void tube_delete(struct tube* tube);
  *              unknown.
  *      return 1 if all OK.
  */
-int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len, 
+int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len,
 	int nonblock);
 
 /**
@@ -166,11 +166,11 @@ int tube_write_msg(struct tube* tube, uint8_t* buf, uint32_t len,
  *      If the first read fails the function returns -1.
  *      If set false, the first read is blocking.
  * @return: all remainder reads are nonblocking.
- *      return 0 on error, in that case blocking/nonblocking of socket is 
+ *      return 0 on error, in that case blocking/nonblocking of socket is
  *              unknown. On EOF 0 is returned.
  *      return 1 if all OK.
  */
-int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len, 
+int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len,
 	int nonblock);
 
 /**
@@ -267,11 +267,11 @@ void tube_remove_bg_write(struct tube* tube);
 int tube_queue_item(struct tube* tube, uint8_t* msg, size_t len);
 
 /** for fptr wlist, callback function */
-int tube_handle_listen(struct comm_point* c, void* arg, int error, 
+int tube_handle_listen(struct comm_point* c, void* arg, int error,
 	struct comm_reply* reply_info);
 
 /** for fptr wlist, callback function */
-int tube_handle_write(struct comm_point* c, void* arg, int error, 
+int tube_handle_write(struct comm_point* c, void* arg, int error,
 	struct comm_reply* reply_info);
 
 /** for fptr wlist, winsock signal event callback function */
diff --git a/usr.sbin/unbound/util/ub_event.c b/usr.sbin/unbound/util/ub_event.c
index 8cd87ec4e..729df5c50 100644
--- a/usr.sbin/unbound/util/ub_event.c
+++ b/usr.sbin/unbound/util/ub_event.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -68,8 +68,8 @@
 
 #if UB_EV_TIMEOUT != EV_TIMEOUT || UB_EV_READ != EV_READ || \
     UB_EV_WRITE != EV_WRITE || UB_EV_SIGNAL != EV_SIGNAL || \
-    UB_EV_PERSIST != EV_PERSIST 
-/* Only necessary for libev */ 
+    UB_EV_PERSIST != EV_PERSIST
+/* Only necessary for libev */
 #  define NATIVE_BITS(b) ( \
 	  (((b) & UB_EV_TIMEOUT) ? EV_TIMEOUT : 0) \
 	| (((b) & UB_EV_READ   ) ? EV_READ    : 0) \
@@ -129,7 +129,7 @@ static void (*NATIVE_BITS_CB(void (*cb)(int, short, void*)))(int, short, void*)
 		return NULL;
 	}
 }
-#else 
+#else
 #  define NATIVE_BITS(b) (b)
 #  define NATIVE_BITS_CB(c) (c)
 #endif
@@ -265,7 +265,7 @@ ub_event_base_free(struct ub_event_base* base)
 #ifdef USE_MINI_EVENT
 	event_base_free(AS_EVENT_BASE(base));
 #elif defined(HAVE_EVENT_BASE_FREE) && defined(HAVE_EVENT_BASE_ONCE)
-	/* only libevent 1.2+ has it, but in 1.2 it is broken - 
+	/* only libevent 1.2+ has it, but in 1.2 it is broken -
 	   assertion fails on signal handling ev that is not deleted
  	   in libevent 1.3c (event_base_once appears) this is fixed. */
 	event_base_free(AS_EVENT_BASE(base));
diff --git a/usr.sbin/unbound/util/ub_event.h b/usr.sbin/unbound/util/ub_event.h
index b00a9bf6c..1313d9027 100644
--- a/usr.sbin/unbound/util/ub_event.h
+++ b/usr.sbin/unbound/util/ub_event.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -60,14 +60,14 @@ struct event_base;
 #define UB_EV_PERSIST      0x10
 
 /** Returns event-base type. Could be "mini-event", "winsock-event" for the
- * daemon compile, and will be "pluggable-event<PACKAGE_VERSION>" for 
+ * daemon compile, and will be "pluggable-event<PACKAGE_VERSION>" for
  * libunbound.
  */
 const char* ub_event_get_version(void);
 /** Return the name, system and method for the pluggable event base */
 void ub_get_event_sys(struct ub_event_base*, const char** n, const char** s,
 	const char** m);
-/** Return a default event base. In the daemon this will be the only event 
+/** Return a default event base. In the daemon this will be the only event
  * bases used.
  */
 struct ub_event_base* ub_default_event_base(int, time_t*, struct timeval*);
diff --git a/usr.sbin/unbound/util/ub_event_pluggable.c b/usr.sbin/unbound/util/ub_event_pluggable.c
index 4280d4db1..74435a677 100644
--- a/usr.sbin/unbound/util/ub_event_pluggable.c
+++ b/usr.sbin/unbound/util/ub_event_pluggable.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -252,7 +252,7 @@ my_event_base_free(struct ub_event_base* base)
 #ifdef USE_MINI_EVENT
 	event_base_free(AS_MY_EVENT_BASE(base)->base);
 #elif defined(HAVE_EVENT_BASE_FREE) && defined(HAVE_EVENT_BASE_ONCE)
-	/* only libevent 1.2+ has it, but in 1.2 it is broken - 
+	/* only libevent 1.2+ has it, but in 1.2 it is broken -
 	   assertion fails on signal handling ev that is not deleted
  	   in libevent 1.3c (event_base_once appears) this is fixed. */
 	event_base_free(AS_MY_EVENT_BASE(base)->base);
diff --git a/usr.sbin/unbound/util/winsock_event.c b/usr.sbin/unbound/util/winsock_event.c
index de6c28ecb..d7bc68704 100644
--- a/usr.sbin/unbound/util/winsock_event.c
+++ b/usr.sbin/unbound/util/winsock_event.c
@@ -1,25 +1,25 @@
 /*
- * util/winsock_event.c - implementation of the unbound winsock event handler. 
+ * util/winsock_event.c - implementation of the unbound winsock event handler.
  *
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -125,7 +125,7 @@ void *event_init(time_t* time_secs, struct timeval* time_tv)
                 event_base_free(base);
                 return NULL;
         }
-	base->items = (struct event**)calloc(WSK_MAX_ITEMS, 
+	base->items = (struct event**)calloc(WSK_MAX_ITEMS,
 		sizeof(struct event*));
 	if(!base->items) {
                 event_base_free(base);
@@ -229,7 +229,7 @@ static void handle_signal(struct event* ev)
 /** call select and callbacks for that */
 static int handle_select(struct event_base* base, struct timeval* wait)
 {
-	DWORD timeout = 0; /* in milliseconds */	
+	DWORD timeout = 0; /* in milliseconds */
 	DWORD ret;
 	struct event* eventlist[WSK_MAX_ITEMS];
 	WSANETWORKEVENTS netev;
@@ -282,7 +282,7 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 			log_err("WSAWaitForMultipleEvents failed: WSA_WAIT_IO_COMPLETION");
 			return -1;
 		} else if(ret == WSA_WAIT_FAILED) {
-			log_err("WSAWaitForMultipleEvents failed: %s", 
+			log_err("WSAWaitForMultipleEvents failed: %s",
 				wsa_strerror(WSAGetLastError()));
 			return -1;
 		} else if(ret == WSA_WAIT_TIMEOUT) {
@@ -290,7 +290,7 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 		} else
 			startidx = ret - WSA_WAIT_EVENT_0;
 	}
-	verbose(VERB_CLIENT, "winsock_event wake was_timeout=%d startidx=%d", 
+	verbose(VERB_CLIENT, "winsock_event wake was_timeout=%d startidx=%d",
 		was_timeout, startidx);
 
 	/* get new time after wait */
@@ -330,11 +330,11 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 			continue; /* not a network event at all */
 		eventlist[i]->just_checked = 0;
 
-		if(WSAEnumNetworkEvents(eventlist[i]->ev_fd, 
+		if(WSAEnumNetworkEvents(eventlist[i]->ev_fd,
 			base->waitfor[i], /* reset the event handle */
 			/*NULL,*/ /* do not reset the event handle */
 			&netev) != 0) {
-			log_err("WSAEnumNetworkEvents failed: %s", 
+			log_err("WSAEnumNetworkEvents failed: %s",
 				wsa_strerror(WSAGetLastError()));
 			return -1;
 		}
@@ -390,7 +390,7 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 		}
 		if((bits & eventlist[i]->ev_events)) {
 			verbose(VERB_ALGO, "winsock event callback %p fd=%d "
-				"%s%s%s%s%s ; %s%s%s", 
+				"%s%s%s%s%s ; %s%s%s",
 				eventlist[i], eventlist[i]->ev_fd,
 				(netev.lNetworkEvents&FD_READ)?" FD_READ":"",
 				(netev.lNetworkEvents&FD_WRITE)?" FD_WRITE":"",
@@ -402,11 +402,11 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 				(bits&EV_READ)?" EV_READ":"",
 				(bits&EV_WRITE)?" EV_WRITE":"",
 				(bits&EV_TIMEOUT)?" EV_TIMEOUT":"");
-				
+
                         fptr_ok(fptr_whitelist_event(
                                 eventlist[i]->ev_callback));
                         (*eventlist[i]->ev_callback)(eventlist[i]->ev_fd,
-                                bits & eventlist[i]->ev_events, 
+                                bits & eventlist[i]->ev_events,
 				eventlist[i]->ev_arg);
 		}
 		if(eventlist[i]->is_tcp && bits)
@@ -447,7 +447,7 @@ int event_base_dispatch(struct event_base *base)
         return 0;
 }
 
-int event_base_loopexit(struct event_base *base, 
+int event_base_loopexit(struct event_base *base,
 	struct timeval * ATTR_UNUSED(tv))
 {
 	verbose(VERB_CLIENT, "winsock_event loopexit");
@@ -466,7 +466,7 @@ void event_base_free(struct event_base *base)
         free(base);
 }
 
-void event_set(struct event *ev, int fd, short bits, 
+void event_set(struct event *ev, int fd, short bits,
 	void (*cb)(int, short, void *), void *arg)
 {
         ev->node.key = ev;
@@ -490,8 +490,8 @@ int event_base_set(struct event_base *base, struct event *ev)
 
 int event_add(struct event *ev, struct timeval *tv)
 {
-	verbose(VERB_ALGO, "event_add %p added=%d fd=%d tv=" ARG_LL "d %s%s%s", 
-		ev, ev->added, ev->ev_fd, 
+	verbose(VERB_ALGO, "event_add %p added=%d fd=%d tv=" ARG_LL "d %s%s%s",
+		ev, ev->added, ev->ev_fd,
 		(tv?(long long)tv->tv_sec*1000+(long long)tv->tv_usec/1000:-1),
 		(ev->ev_events&EV_READ)?" EV_READ":"",
 		(ev->ev_events&EV_WRITE)?" EV_WRITE":"",
@@ -546,7 +546,7 @@ int event_add(struct event *ev, struct timeval *tv)
 			log_err("WSAEventSelect failed: %s",
 				wsa_strerror(WSAGetLastError()));
 		}
-		if(ev->is_tcp && ev->stick_events && 
+		if(ev->is_tcp && ev->stick_events &&
 			(ev->ev_events & ev->old_events)) {
 			/* go to processing the sticky event right away */
 			ev->ev_base->tcp_reinvigorated = 1;
@@ -571,8 +571,8 @@ int event_add(struct event *ev, struct timeval *tv)
 
 int event_del(struct event *ev)
 {
-	verbose(VERB_ALGO, "event_del %p added=%d fd=%d tv=" ARG_LL "d %s%s%s", 
-		ev, ev->added, ev->ev_fd, 
+	verbose(VERB_ALGO, "event_del %p added=%d fd=%d tv=" ARG_LL "d %s%s%s",
+		ev, ev->added, ev->ev_fd,
 		(ev->ev_events&EV_TIMEOUT)?(long long)ev->ev_timeout.tv_sec*1000+
 		(long long)ev->ev_timeout.tv_usec/1000:-1,
 		(ev->ev_events&EV_READ)?" EV_READ":"",
@@ -586,7 +586,7 @@ int event_del(struct event *ev)
         if((ev->ev_events&(EV_READ|EV_WRITE)) && ev->ev_fd != -1) {
 		log_assert(ev->ev_base->max > 0);
 		/* remove item and compact the list */
-		ev->ev_base->items[ev->idx] = 
+		ev->ev_base->items[ev->idx] =
 			ev->ev_base->items[ev->ev_base->max-1];
 		ev->ev_base->items[ev->ev_base->max-1] = NULL;
 		ev->ev_base->max--;
@@ -645,14 +645,14 @@ int signal_del(struct event *ev)
 
 void winsock_tcp_wouldblock(struct event* ev, int eventbits)
 {
-	verbose(VERB_ALGO, "winsock: tcp wouldblock %s", 
+	verbose(VERB_ALGO, "winsock: tcp wouldblock %s",
 		eventbits==EV_READ?"EV_READ":"EV_WRITE");
 	ev->old_events &= (~eventbits);
 	if(ev->old_events == 0)
 		ev->stick_events = 0;
 		/* in case this is the last sticky event, we could
 		 * possibly run an empty handler loop to reset the base
-		 * tcp_stickies variable 
+		 * tcp_stickies variable
 		 */
 }
 
diff --git a/usr.sbin/unbound/util/winsock_event.h b/usr.sbin/unbound/util/winsock_event.h
index d6dafac8c..029650ef4 100644
--- a/usr.sbin/unbound/util/winsock_event.h
+++ b/usr.sbin/unbound/util/winsock_event.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -41,17 +41,17 @@
  * sockets.
  *
  * Note that windows can only wait for max 64 events at one time.
- * 
+ *
  * Also, file descriptors cannot be waited for.
  *
  * Named pipes are not easily available (and are not usable in select() ).
  * For interprocess communication, it is possible to wait for a hEvent to
  * be signaled by another thread.
  *
- * When a socket becomes readable, then it will not be flagged as 
+ * When a socket becomes readable, then it will not be flagged as
  * readable again until you have gotten WOULDBLOCK from a recv routine.
  * That means the event handler must store the readability (edge notify)
- * and process the incoming data until it blocks. 
+ * and process the incoming data until it blocks.
  * The function performing recv then has to inform the event handler that
  * the socket has blocked, and the event handler can mark it as such.
  * Thus, this file transforms the edge notify from windows to a level notify
@@ -147,7 +147,7 @@ struct event_base
 	time_t* time_secs;
 	/** where to store time in microseconds */
 	struct timeval* time_tv;
-	/** 
+	/**
 	 * TCP streams have sticky events to them, these are not
 	 * reported by the windows event system anymore, we have to
 	 * keep reporting those events as present until wouldblock() is
@@ -196,11 +196,11 @@ struct event {
 	int is_tcp;
 	/** remembered EV_ values */
 	short old_events;
-	/** should remembered EV_ values be used for TCP streams. 
+	/** should remembered EV_ values be used for TCP streams.
 	 * Reset after WOULDBLOCK is signaled using the function. */
 	int stick_events;
 
-	/** true if this event is a signaling WSAEvent by the user. 
+	/** true if this event is a signaling WSAEvent by the user.
 	 * User created and user closed WSAEvent. Only signaled/unsignaled,
 	 * no read/write/distinctions needed. */
 	int is_signal;
@@ -257,7 +257,7 @@ void winsock_tcp_wouldblock(struct event* ev, int eventbit);
 /**
  * Routine for windows only. where you pass a signal WSAEvent that
  * you wait for. When the event is signaled, the callback gets called.
- * The callback has to WSAResetEvent to disable the signal. 
+ * The callback has to WSAResetEvent to disable the signal.
  * @param base: the event base.
  * @param ev: the event structure for data storage
  * 	can be passed uninitialised.
diff --git a/usr.sbin/unbound/validator/autotrust.c b/usr.sbin/unbound/validator/autotrust.c
index 3cdf9ceae..7fd5e5463 100644
--- a/usr.sbin/unbound/validator/autotrust.c
+++ b/usr.sbin/unbound/validator/autotrust.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2009, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * Contains autotrust implementation. The implementation was taken from 
+ * Contains autotrust implementation. The implementation was taken from
  * the autotrust daemon (BSD licensed), written by Matthijs Mekking.
  * It was modified to fit into unbound. The state table process is the same.
  */
@@ -75,7 +75,7 @@ struct autr_global_data* autr_global_create(void)
 {
 	struct autr_global_data* global;
 	global = (struct autr_global_data*)malloc(sizeof(*global));
-	if(!global) 
+	if(!global)
 		return NULL;
 	rbtree_init(&global->probe, &probetree_cmp);
 	return global;
@@ -102,7 +102,7 @@ int probetree_cmp(const void* x, const void* y)
 	return anchor_cmp(x, y);
 }
 
-size_t 
+size_t
 autr_get_num_anchors(struct val_anchors* anchors)
 {
 	size_t res = 0;
@@ -127,18 +127,18 @@ position_in_string(char *str, const char* sub)
 
 /** Debug routine to print pretty key information */
 static void
-verbose_key(struct autr_ta* ta, enum verbosity_value level, 
+verbose_key(struct autr_ta* ta, enum verbosity_value level,
 	const char* format, ...) ATTR_FORMAT(printf, 3, 4);
 
-/** 
- * Implementation of debug pretty key print 
+/**
+ * Implementation of debug pretty key print
  * @param ta: trust anchor key with DNSKEY data.
  * @param level: verbosity level to print at.
  * @param format: printf style format string.
  */
 static void
-verbose_key(struct autr_ta* ta, enum verbosity_value level, 
-	const char* format, ...) 
+verbose_key(struct autr_ta* ta, enum verbosity_value level,
+	const char* format, ...)
 {
 	va_list args;
 	va_start(args, format);
@@ -156,8 +156,8 @@ verbose_key(struct autr_ta* ta, enum verbosity_value level,
 	va_end(args);
 }
 
-/** 
- * Parse comments 
+/**
+ * Parse comments
  * @param str: to parse
  * @param ta: trust key autotrust metadata
  * @return false on failure.
@@ -429,7 +429,7 @@ find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 	}
 	tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
 		rr_len, dname_len));
-	if(!tp)	
+	if(!tp)
 		return NULL;
 	lock_basic_lock(&tp->lock);
 	return tp;
@@ -441,7 +441,7 @@ add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
         size_t dname_len, struct trust_anchor** tp)
 {
 	struct autr_ta* ta = autr_ta_create(rr, rr_len, dname_len);
-	if(!ta) 
+	if(!ta)
 		return NULL;
 	*tp = find_add_tp(anchors, rr, rr_len, dname_len);
 	if(!*tp) {
@@ -469,7 +469,7 @@ add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
  * @return new key in trust point.
  */
 static struct autr_ta*
-add_trustanchor_frm_str(struct val_anchors* anchors, char* str, 
+add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
 	struct trust_anchor** tp, uint8_t* origin, size_t origin_len,
 	uint8_t** prev, size_t* prev_len, int* skip)
 {
@@ -509,8 +509,8 @@ add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
 	return add_trustanchor_frm_rr(anchors, drr, rr_len, dname_len, tp);
 }
 
-/** 
- * Load single anchor 
+/**
+ * Load single anchor
  * @param anchors: all points.
  * @param str: comments line
  * @param fname: filename
@@ -577,7 +577,7 @@ assemble_iterate_dnskey(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 	while(*list) {
 		if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 		   (*list)->dname_len) != LDNS_RR_TYPE_DS &&
-			((*list)->s == AUTR_STATE_VALID || 
+			((*list)->s == AUTR_STATE_VALID ||
 			 (*list)->s == AUTR_STATE_MISSING)) {
 			*rr = (*list)->rr;
 			*rr_len = (*list)->rr_len;
@@ -622,7 +622,7 @@ assemble_iterate_count(int iter(struct autr_ta**, uint8_t**, size_t*,
  * @param list: the list.
  * @return key allocated or NULL on failure.
  */
-static struct ub_packed_rrset_key* 
+static struct ub_packed_rrset_key*
 ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
 	size_t*), struct autr_ta* list)
 {
@@ -651,7 +651,7 @@ ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
  * @param list: the list.
  * @return data allocated or NULL on failure.
  */
-static struct packed_rrset_data* 
+static struct packed_rrset_data*
 packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
 	size_t*), struct autr_ta* list)
 {
@@ -678,7 +678,7 @@ packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
 
 	/* allocate */
 	total = count + rrsig_count;
-	len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) + 
+	len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) +
 		sizeof(uint8_t*));
 	data = (struct packed_rrset_data*)calloc(1, len);
 	if(!data)
@@ -738,7 +738,7 @@ packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
  * @param tp: the trust point. Must be locked.
  * @return false on malloc failure.
  */
-static int 
+static int
 autr_assemble(struct trust_anchor* tp)
 {
 	struct ub_packed_rrset_key* ubds=NULL, *ubdnskey=NULL;
@@ -799,7 +799,7 @@ parse_int(char* line, int* ret)
 	unsigned int x = (unsigned int)strtol(line, &e, 10);
 	if(line == e) {
 		*ret = -1; /* parse error */
-		return 0; 
+		return 0;
 	}
 	*ret = 1; /* matched */
 	return x;
@@ -836,8 +836,8 @@ parse_id(struct val_anchors* anchors, char* line)
 	return tp;
 }
 
-/** 
- * Parse variable from trustanchor header 
+/**
+ * Parse variable from trustanchor header
  * @param line: to parse
  * @param anchors: the anchor is added to this, if "id:" is seen.
  * @param anchor: the anchor as result value or previously returned anchor
@@ -846,7 +846,7 @@ parse_id(struct val_anchors* anchors, char* line)
  * 	+2 revoked trust anchor file.
  */
 static int
-parse_var_line(char* line, struct val_anchors* anchors, 
+parse_var_line(char* line, struct val_anchors* anchors,
 	struct trust_anchor** anchor)
 {
 	struct trust_anchor* tp = *anchor;
@@ -954,9 +954,9 @@ read_multiline(char* buf, size_t len, FILE* in, int* linenr)
 		}
 
 		/* more lines expected, snip off comments and newline */
-		if(poslen>0) 
+		if(poslen>0)
 			pos[poslen-1] = 0; /* strip newline */
-		if(strchr(pos, ';')) 
+		if(strchr(pos, ';'))
 			strchr(pos, ';')[0] = 0; /* strip comments */
 
 		/* move to paste other lines behind this one */
@@ -998,7 +998,7 @@ int autr_read_file(struct val_anchors* anchors, const char* nm)
 	size_t origin_len=0, prev_len=0;
 
         if (!(fd = fopen(nm, "r"))) {
-                log_err("unable to open %s for reading: %s", 
+                log_err("unable to open %s for reading: %s",
 			nm, strerror(errno));
                 return 0;
         }
@@ -1132,17 +1132,17 @@ autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
 	if(!print_id(out, fn, tp->name, tp->namelen, tp->dclass)) {
 		return 0;
 	}
-	if(fprintf(out, ";;last_queried: %u ;;%s", 
-		(unsigned int)tp->autr->last_queried, 
+	if(fprintf(out, ";;last_queried: %u ;;%s",
+		(unsigned int)tp->autr->last_queried,
 		autr_ctime_r(&(tp->autr->last_queried), tmi)) < 0 ||
-	   fprintf(out, ";;last_success: %u ;;%s", 
+	   fprintf(out, ";;last_success: %u ;;%s",
 		(unsigned int)tp->autr->last_success,
 		autr_ctime_r(&(tp->autr->last_success), tmi)) < 0 ||
-	   fprintf(out, ";;next_probe_time: %u ;;%s", 
+	   fprintf(out, ";;next_probe_time: %u ;;%s",
 		(unsigned int)tp->autr->next_probe_time,
 		autr_ctime_r(&(tp->autr->next_probe_time), tmi)) < 0 ||
 	   fprintf(out, ";;query_failed: %d\n", (int)tp->autr->query_failed)<0
-	   || fprintf(out, ";;query_interval: %d\n", 
+	   || fprintf(out, ";;query_interval: %d\n",
 	   (int)tp->autr->query_interval) < 0 ||
 	   fprintf(out, ";;retry_time: %d\n", (int)tp->autr->retry_time) < 0) {
 		log_err("could not write to %s: %s", fn, strerror(errno));
@@ -1168,9 +1168,9 @@ autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
 		}
 		str[strlen(str)-1] = 0; /* remove newline */
 		if(fprintf(out, "%s ;;state=%d [%s] ;;count=%d "
-			";;lastchange=%u ;;%s", str, (int)ta->s, 
+			";;lastchange=%u ;;%s", str, (int)ta->s,
 			trustanchor_state2str(ta->s), (int)ta->pending_count,
-			(unsigned int)ta->last_change, 
+			(unsigned int)ta->last_change,
 			autr_ctime_r(&(ta->last_change), tmi)) < 0) {
 		   log_err("could not write to %s: %s", fn, strerror(errno));
 		   free(str);
@@ -1244,8 +1244,8 @@ void autr_write_file(struct module_env* env, struct trust_anchor* tp)
 	}
 }
 
-/** 
- * Verify if dnskey works for trust point 
+/**
+ * Verify if dnskey works for trust point
  * @param env: environment (with time) for verification
  * @param ve: validator environment (with options) for verification.
  * @param tp: trust point to verify with
@@ -1311,7 +1311,7 @@ rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
 		(int)i);
 	/* no algorithm downgrade protection necessary, if it is selfsigned
 	 * revoked it can be removed. */
-	sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i, 
+	sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
 		&reason, NULL, LDNS_SECTION_ANSWER, qstate);
 	return (sec == sec_status_secure);
 }
@@ -1402,7 +1402,7 @@ ta_compare(struct autr_ta* a, uint16_t t, uint8_t* b, size_t b_len)
 	return -1;
 }
 
-/** 
+/**
  * Find key
  * @param tp: to search in
  * @param t: rr type of the rdata.
@@ -1472,11 +1472,11 @@ key_ttl(struct ub_packed_rrset_key* k)
 
 /** update the time values for the trustpoint */
 static void
-set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval, 
+set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
 	time_t origttl, int* changed)
 {
 	time_t x, qi = tp->autr->query_interval, rt = tp->autr->retry_time;
-	
+
 	/* x = MIN(15days, ttl/2, expire/2) */
 	x = 15 * 24 * 3600;
 	if(origttl/2 < x)
@@ -1506,10 +1506,10 @@ set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
 	if(qi != tp->autr->query_interval || rt != tp->autr->retry_time) {
 		*changed = 1;
 		verbose(VERB_ALGO, "orig_ttl is %d", (int)origttl);
-		verbose(VERB_ALGO, "rrsig_exp_interval is %d", 
+		verbose(VERB_ALGO, "rrsig_exp_interval is %d",
 			(int)rrsig_exp_interval);
 		verbose(VERB_ALGO, "query_interval: %d, retry_time: %d",
-			(int)tp->autr->query_interval, 
+			(int)tp->autr->query_interval,
 			(int)tp->autr->retry_time);
 	}
 }
@@ -1550,7 +1550,7 @@ check_contains_revoked(struct module_env* env, struct val_env* ve,
 			continue; /* key not found */
 		if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate)) {
 			/* checked if there is an rrsig signed by this key. */
-			/* same keytag, but stored can be revoked already, so 
+			/* same keytag, but stored can be revoked already, so
 			 * compare keytags, with +0 or +128(REVOKE flag) */
 			log_assert(dnskey_calc_keytag(dnskey_rrset, i)-128 ==
 				sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
@@ -1563,7 +1563,7 @@ check_contains_revoked(struct module_env* env, struct val_env* ve,
 				sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
 				ta->dname_len))); /* checks conversion*/
 			verbose_key(ta, VERB_ALGO, "is self-signed revoked");
-			if(!ta->revoked) 
+			if(!ta->revoked)
 				*changed = 1;
 			seen_revoked_trustanchor(ta, 1);
 			do_revoked(env, ta, changed);
@@ -1604,7 +1604,7 @@ key_matches_a_ds(struct module_env* env, struct val_env* ve,
 		(void)ve;
 		return 1;
 		/* no need to check RRSIG, DS hash already matched with source
-		if(dnskey_verify_rrset(env, ve, dnskey_rrset, 
+		if(dnskey_verify_rrset(env, ve, dnskey_rrset,
 			dnskey_rrset, key_idx, &reason) == sec_status_secure) {
 			return 1;
 		} else {
@@ -1618,8 +1618,8 @@ key_matches_a_ds(struct module_env* env, struct val_env* ve,
 
 /** Set update events */
 static int
-update_events(struct module_env* env, struct val_env* ve, 
-	struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset, 
+update_events(struct module_env* env, struct val_env* ve,
+	struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
 	int* changed)
 {
 	struct packed_rrset_data* dd = (struct packed_rrset_data*)
@@ -1644,7 +1644,7 @@ update_events(struct module_env* env, struct val_env* ve,
 			!dnskey_size_is_supported(dnskey_rrset, i)) {
 			/* skip unknown algorithm key, it is useless to us */
 			log_nametypeclass(VERB_DETAIL, "trust point has "
-				"unsupported algorithm at", 
+				"unsupported algorithm at",
 				tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
 			continue;
 		}
@@ -1735,7 +1735,7 @@ do_newkey(struct module_env* env, struct autr_ta* anchor, int* c)
 static void
 do_addtime(struct module_env* env, struct autr_ta* anchor, int* c)
 {
-	/* This not according to RFC, this is 30 days, but the RFC demands 
+	/* This not according to RFC, this is 30 days, but the RFC demands
 	 * MAX(30days, TTL expire time of first DNSKEY set with this key),
 	 * The value may be too small if a very large TTL was used. */
 	time_t exceeded = check_holddown(env, anchor, env->cfg->add_holddown);
@@ -1864,7 +1864,7 @@ init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
 		/* last_change test makes sure it was manually configured */
 		if(sldns_wirerr_get_type(anchor->rr, anchor->rr_len,
 			anchor->dname_len) == LDNS_RR_TYPE_DNSKEY &&
-			anchor->last_change == 0 && 
+			anchor->last_change == 0 &&
 			!ta_is_dnskey_sep(anchor) &&
 			anchor->s == AUTR_STATE_VALID)
                         validzsk++;
@@ -1872,11 +1872,11 @@ init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
 	if(validzsk == 0)
 		return 0;
 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
-                if (ta_is_dnskey_sep(anchor) && 
+                if (ta_is_dnskey_sep(anchor) &&
 			anchor->s == AUTR_STATE_ADDPEND) {
 			verbose_key(anchor, VERB_ALGO, "trust KSK from "
 				"ZSK(config)");
-			set_trustanchor_state(env, anchor, changed, 
+			set_trustanchor_state(env, anchor, changed,
 				AUTR_STATE_VALID);
 			validksk++;
 		}
@@ -1912,7 +1912,7 @@ remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
 		if(valid == 0)
 			return;
 	}
-	
+
 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
 		/* ignore ZSKs if newly added */
 		if(anchor->s == AUTR_STATE_START)
@@ -1922,7 +1922,7 @@ remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
 			if(valid > 0) {
 				verbose_key(anchor, VERB_ALGO, "remove ZSK "
 					"[%d key(s) VALID]", valid);
-				set_trustanchor_state(env, anchor, changed, 
+				set_trustanchor_state(env, anchor, changed,
 					AUTR_STATE_REMOVED);
 			}
                         continue;
@@ -1934,13 +1934,13 @@ remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
 			continue; /* keep forever */
 
 		exceeded = check_holddown(env, anchor, env->cfg->keep_missing);
-		/* If keep_missing has exceeded and we still have more than 
+		/* If keep_missing has exceeded and we still have more than
 		 * one valid KSK: remove missing trust anchor */
                 if (exceeded && valid > 0) {
 			verbose_key(anchor, VERB_ALGO, "keep-missing time "
 				"exceeded " ARG_LL "d seconds ago, [%d key(s) VALID]",
 				(long long)exceeded, valid);
-			set_trustanchor_state(env, anchor, changed, 
+			set_trustanchor_state(env, anchor, changed,
 				AUTR_STATE_REMOVED);
 		}
 	}
@@ -1967,7 +1967,7 @@ autr_holddown_exceed(struct module_env* env, struct trust_anchor* tp, int* c)
 {
 	struct autr_ta* anchor;
 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
-		if(ta_is_dnskey_sep(anchor) && 
+		if(ta_is_dnskey_sep(anchor) &&
 			anchor->s == AUTR_STATE_ADDPEND)
 			do_addtime(env, anchor, c);
 	}
@@ -2025,7 +2025,7 @@ static time_t
 wait_probe_time(struct val_anchors* anchors)
 {
 	rbnode_type* t = rbtree_first(&anchors->autr->probe);
-	if(t != RBTREE_NULL) 
+	if(t != RBTREE_NULL)
 		return ((struct trust_anchor*)t->key)->autr->next_probe_time;
 	return 0;
 }
@@ -2078,13 +2078,13 @@ set_next_probe(struct module_env* env, struct trust_anchor* tp,
 	/* schedule */
 	mold = wait_probe_time(env->anchors);
 	(void)rbtree_delete(&env->anchors->autr->probe, tp);
-	tp->autr->next_probe_time = calc_next_probe(env, 
+	tp->autr->next_probe_time = calc_next_probe(env,
 		tp->autr->query_interval);
 	(void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
 	mnew = wait_probe_time(env->anchors);
 
 	lock_basic_unlock(&env->anchors->lock);
-	verbose(VERB_ALGO, "next probe set in %d seconds", 
+	verbose(VERB_ALGO, "next probe set in %d seconds",
 		(int)tp->autr->next_probe_time - (int)*env->now);
 	if(mold != mnew) {
 		reset_worker_timer(env);
@@ -2159,7 +2159,7 @@ int autr_process_prime(struct module_env* env, struct val_env* ve,
 	 * is busy deleting it. Just unlock and let the other do its job */
 	if(tp->autr->revoked) {
 		log_nametypeclass(VERB_ALGO, "autotrust not processed, "
-			"trust point revoked", tp->name, 
+			"trust point revoked", tp->name,
 			LDNS_RR_TYPE_DNSKEY, tp->dclass);
 		lock_basic_unlock(&tp->lock);
 		return 0; /* it is revoked */
@@ -2255,12 +2255,12 @@ int autr_process_prime(struct module_env* env, struct val_env* ve,
 			return 0; /* trust point removed */
 		}
 	} else verbose(VERB_ALGO, "autotrust: no changes");
-	
+
 	return 1; /* trust point exists */
 }
 
 /** debug print a trust anchor key */
-static void 
+static void
 autr_debug_print_ta(struct autr_ta* ta)
 {
 	char buf[32];
@@ -2279,7 +2279,7 @@ autr_debug_print_ta(struct autr_ta* ta)
 }
 
 /** debug print a trust point */
-static void 
+static void
 autr_debug_print_tp(struct trust_anchor* tp)
 {
 	struct autr_ta* ta;
@@ -2288,7 +2288,7 @@ autr_debug_print_tp(struct trust_anchor* tp)
 		return;
 	dname_str(tp->name, buf);
 	log_info("trust point %s : %d", buf, (int)tp->dclass);
-	log_info("assembled %d DS and %d DNSKEYs", 
+	log_info("assembled %d DS and %d DNSKEYs",
 		(int)tp->numDS, (int)tp->numDNSKEY);
 	if(tp->ds_rrset) {
 		log_packed_rrset(NO_VERBOSE, "DS:", tp->ds_rrset);
@@ -2310,13 +2310,13 @@ autr_debug_print_tp(struct trust_anchor* tp)
 	log_info("query_interval: %u", (unsigned)tp->autr->query_interval);
 	log_info("retry_time: %u", (unsigned)tp->autr->retry_time);
 	log_info("query_failed: %u", (unsigned)tp->autr->query_failed);
-		
+
 	for(ta=tp->autr->keys; ta; ta=ta->next) {
 		autr_debug_print_ta(ta);
 	}
 }
 
-void 
+void
 autr_debug_print(struct val_anchors* anchors)
 {
 	struct trust_anchor* tp;
@@ -2329,7 +2329,7 @@ autr_debug_print(struct val_anchors* anchors)
 	lock_basic_unlock(&anchors->lock);
 }
 
-void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode), 
+void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
 	sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec),
 	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
 {
@@ -2337,7 +2337,7 @@ void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
 	 * re-querytime is set when query succeeded, but that may not
 	 * have reset this timer because the query could have been
 	 * handled by another thread. In that case, this callback would
-	 * get called after the original timeout is done. 
+	 * get called after the original timeout is done.
 	 * By not resetting the timer, it may probe more often, but not
 	 * less often.
 	 * Unless the new lookup resulted in smaller TTLs and thus smaller
@@ -2366,7 +2366,7 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp)
 	qinfo.qclass = tp->dclass;
 	qinfo.local_alias = NULL;
 	log_query_info(VERB_ALGO, "autotrust probe", &qinfo);
-	verbose(VERB_ALGO, "retry probe set in %d seconds", 
+	verbose(VERB_ALGO, "retry probe set in %d seconds",
 		(int)tp->autr->next_probe_time - (int)*env->now);
 	edns.edns_present = 1;
 	edns.ext_rcode = 0;
@@ -2388,10 +2388,10 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp)
 	 * to recreate the key entry in a race condition. */
 	rrset_cache_remove(env->rrset_cache, qinfo.qname, qinfo.qname_len,
 		qinfo.qtype, qinfo.qclass, 0);
-	key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len, 
+	key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len,
 		qinfo.qclass);
 
-	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0, 
+	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
 		&probe_answer_cb, env, 0)) {
 		log_err("out of memory making 5011 probe");
 	}
@@ -2433,7 +2433,7 @@ todo_probe(struct module_env* env, time_t* next)
 	return tp;
 }
 
-time_t 
+time_t
 autr_probe_timer(struct module_env* env)
 {
 	struct trust_anchor* tp;
diff --git a/usr.sbin/unbound/validator/autotrust.h b/usr.sbin/unbound/validator/autotrust.h
index 057f2b68a..34104dea5 100644
--- a/usr.sbin/unbound/validator/autotrust.h
+++ b/usr.sbin/unbound/validator/autotrust.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2009, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -61,7 +61,7 @@ typedef enum {
 	AUTR_STATE_REMOVED = 5
 } autr_state_type;
 
-/** 
+/**
  * Autotrust metadata for one trust anchor key.
  */
 struct autr_ta {
@@ -83,7 +83,7 @@ struct autr_ta {
 	uint8_t revoked;
 };
 
-/** 
+/**
  * Autotrust metadata for a trust point.
  * This is part of the struct trust_anchor data.
  */
@@ -96,7 +96,7 @@ struct autr_point_data {
 	/** the keys */
 	struct autr_ta* keys;
 
-	/** last queried DNSKEY set 
+	/** last queried DNSKEY set
 	 * Not all failures are captured in this entry.
 	 * If the validator did not even start (e.g. timeout or localservfail),
 	 * then the last_queried and query_failed values are not updated.
@@ -112,7 +112,7 @@ struct autr_point_data {
 	/** when to retry if failed */
 	time_t retry_time;
 
-	/** 
+	/**
 	 * How many times did it fail. diagnostic only (has no effect).
 	 * Only updated if there was a dnskey rrset that failed to verify.
 	 */
@@ -121,7 +121,7 @@ struct autr_point_data {
 	uint8_t revoked;
 };
 
-/** 
+/**
  * Autotrust global metadata.
  */
 struct autr_global_data {
@@ -205,7 +205,7 @@ int autr_process_prime(struct module_env* env, struct val_env* ve,
 void autr_debug_print(struct val_anchors* anchors);
 
 /** callback for query answer to 5011 probe */
-void probe_answer_cb(void* arg, int rcode, struct sldns_buffer* buf, 
+void probe_answer_cb(void* arg, int rcode, struct sldns_buffer* buf,
 	enum sec_status sec, char* errinf, int was_ratelimited);
 
 #endif /* VALIDATOR_AUTOTRUST_H */
diff --git a/usr.sbin/unbound/validator/val_anchor.c b/usr.sbin/unbound/validator/val_anchor.c
index b1a54e1f0..006c129f0 100644
--- a/usr.sbin/unbound/validator/val_anchor.c
+++ b/usr.sbin/unbound/validator/val_anchor.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -68,11 +68,11 @@ anchor_cmp(const void* k1, const void* k2)
 			return -1;
 		return 1;
 	}
-	return dname_lab_cmp(n1->name, n1->namelabs, n2->name, n2->namelabs, 
+	return dname_lab_cmp(n1->name, n1->namelabs, n2->name, n2->namelabs,
 		&m);
 }
 
-struct val_anchors* 
+struct val_anchors*
 anchors_create(void)
 {
 	struct val_anchors* a = (struct val_anchors*)calloc(1, sizeof(*a));
@@ -136,7 +136,7 @@ anchors_delfunc(rbnode_type* elem, void* ATTR_UNUSED(arg))
 	}
 }
 
-void 
+void
 anchors_delete(struct val_anchors* anchors)
 {
 	if(!anchors)
@@ -155,7 +155,7 @@ void
 anchors_init_parents_locked(struct val_anchors* anchors)
 {
 	struct trust_anchor* node, *prev = NULL, *p;
-	int m; 
+	int m;
 	/* nobody else can grab locks because we hold the main lock.
 	 * Thus the previous items, after unlocked, are not deleted */
 	RBTREE_FOR(node, struct trust_anchor*, anchors->tree) {
@@ -166,7 +166,7 @@ anchors_init_parents_locked(struct val_anchors* anchors)
 			lock_basic_unlock(&node->lock);
 			continue;
 		}
-		(void)dname_lab_cmp(prev->name, prev->namelabs, node->name, 
+		(void)dname_lab_cmp(prev->name, prev->namelabs, node->name,
 			node->namelabs, &m); /* we know prev is smaller */
 		/* sort order like: . com. bla.com. zwb.com. net. */
 		/* find the previous, or parent-parent-parent */
@@ -268,7 +268,7 @@ anchor_find_key(struct trust_anchor* ta, uint8_t* rdata, size_t rdata_len,
 	}
 	return NULL;
 }
-	
+
 /** create new trustanchor key */
 static struct ta_key*
 anchor_new_ta_key(uint8_t* rdata, size_t rdata_len, uint16_t type)
@@ -403,7 +403,7 @@ anchor_store_str(struct val_anchors* anchors, sldns_buffer* buffer,
 	int status = sldns_str2wire_rr_buf(str, rr, &len, &dname_len,
 		0, NULL, 0, NULL, 0);
 	if(status != 0) {
-		log_err("error parsing trust anchor %s: at %d: %s", 
+		log_err("error parsing trust anchor %s: at %d: %s",
 			str, LDNS_WIREPARSE_OFFSET(status),
 			sldns_get_errorstr_parse(status));
 		return NULL;
@@ -467,7 +467,7 @@ anchor_read_file(struct val_anchors* anchors, sldns_buffer* buffer,
 		if(onlyone && ta && ta != tanew) {
 			log_err("error at %s line %d: no multiple anchor "
 				"domains allowed (you can have multiple "
-				"keys, but they must have the same name).", 
+				"keys, but they must have the same name).",
 				fname, pst.lineno);
 			ok = 0;
 			break;
@@ -506,8 +506,8 @@ is_bind_special(int c)
 	return 0;
 }
 
-/** 
- * Read a keyword skipping bind comments; spaces, specials, restkeywords. 
+/**
+ * Read a keyword skipping bind comments; spaces, specials, restkeywords.
  * The file is split into the following tokens:
  *	* special characters, on their own, rdlen=1, { } doublequote ;
  *	* whitespace becomes a single ' ' or tab. Newlines become spaces.
@@ -524,7 +524,7 @@ is_bind_special(int c)
  *	if 1, comments are skipped entirely.
  *	In BIND files, this is when reading quoted strings, for example
  *	" base 64 text with / / in there "
- * @return the number of character written to the buffer. 
+ * @return the number of character written to the buffer.
  *	0 on end of file.
  */
 static int
@@ -538,7 +538,7 @@ readkeyword_bindfile(FILE* in, sldns_buffer* buf, int* line, int comments)
 			(*line)++;
 			continue;
 		} else if(comments && c=='/' && numdone>0 && /* /_/ bla*/
-			sldns_buffer_read_u8_at(buf, 
+			sldns_buffer_read_u8_at(buf,
 			sldns_buffer_position(buf)-1) == '/') {
 			sldns_buffer_skip(buf, -1);
 			numdone--;
@@ -546,7 +546,7 @@ readkeyword_bindfile(FILE* in, sldns_buffer* buf, int* line, int comments)
 			(*line)++;
 			continue;
 		} else if(comments && c=='*' && numdone>0 && /* /_* bla *_/ */
-			sldns_buffer_read_u8_at(buf, 
+			sldns_buffer_read_u8_at(buf,
 			sldns_buffer_position(buf)-1) == '/') {
 			sldns_buffer_skip(buf, -1);
 			numdone--;
@@ -602,8 +602,8 @@ readkeyword_bindfile(FILE* in, sldns_buffer* buf, int* line, int comments)
 }
 
 /** skip through file to { or ; */
-static int 
-skip_to_special(FILE* in, sldns_buffer* buf, int* line, int spec) 
+static int
+skip_to_special(FILE* in, sldns_buffer* buf, int* line, int spec)
 {
 	int rdlen;
 	sldns_buffer_clear(buf);
@@ -614,7 +614,7 @@ skip_to_special(FILE* in, sldns_buffer* buf, int* line, int spec)
 		}
 		if(rdlen != 1 || *sldns_buffer_begin(buf) != (uint8_t)spec) {
 			sldns_buffer_write_u8(buf, 0);
-			log_err("trusted-keys, line %d, expected %c", 
+			log_err("trusted-keys, line %d, expected %c",
 				*line, spec);
 			return 0;
 		}
@@ -624,7 +624,7 @@ skip_to_special(FILE* in, sldns_buffer* buf, int* line, int spec)
 	return 0;
 }
 
-/** 
+/**
  * read contents of trusted-keys{ ... ; clauses and insert keys into storage.
  * @param anchors: where to store keys
  * @param buf: buffer to use
@@ -633,7 +633,7 @@ skip_to_special(FILE* in, sldns_buffer* buf, int* line, int spec)
  * @return 0 on error.
  */
 static int
-process_bind_contents(struct val_anchors* anchors, sldns_buffer* buf, 
+process_bind_contents(struct val_anchors* anchors, sldns_buffer* buf,
 	int* line, FILE* in)
 {
 	/* loop over contents, collate strings before ; */
@@ -703,7 +703,7 @@ process_bind_contents(struct val_anchors* anchors, sldns_buffer* buf,
 				return 0;
 			}
 			return 1;
-		} else if(rdlen == 1 && 
+		} else if(rdlen == 1 &&
 			isspace((unsigned char)sldns_buffer_current(buf)[-1])) {
 			/* leave whitespace here */
 		} else {
@@ -713,7 +713,7 @@ process_bind_contents(struct val_anchors* anchors, sldns_buffer* buf,
 				if(sldns_buffer_remaining(buf) < 8+1) {
 					log_err("line %d, too long", *line);
 					return 0;
-				}	
+				}
 				sldns_buffer_write(buf, " DNSKEY ", 8);
 			}
 		}
@@ -789,12 +789,12 @@ anchor_read_bind_file_wild(struct val_anchors* anchors, sldns_buffer* buffer,
 	glob_t g;
 	size_t i;
 	int r, flags;
-	if(!strchr(pat, '*') && !strchr(pat, '?') && !strchr(pat, '[') && 
+	if(!strchr(pat, '*') && !strchr(pat, '?') && !strchr(pat, '[') &&
 		!strchr(pat, '{') && !strchr(pat, '~')) {
 		return anchor_read_bind_file(anchors, buffer, pat);
 	}
 	verbose(VERB_QUERY, "wildcard found, processing %s", pat);
-	flags = 0 
+	flags = 0
 #ifdef GLOB_ERR
 		| GLOB_ERR
 #endif
@@ -827,7 +827,7 @@ anchor_read_bind_file_wild(struct val_anchors* anchors, sldns_buffer* buffer,
 				"failed (%s)", pat, strerror(errno));
 		}
 		/* ignore globs that yield no files */
-		return 1; 
+		return 1;
 	}
 	/* process files found, if any */
 	for(i=0; i<(size_t)g.gl_pathc; i++) {
@@ -845,8 +845,8 @@ anchor_read_bind_file_wild(struct val_anchors* anchors, sldns_buffer* buffer,
 #endif /* HAVE_GLOB */
 }
 
-/** 
- * Assemble an rrset structure for the type 
+/**
+ * Assemble an rrset structure for the type
  * @param ta: trust anchor.
  * @param num: number of items to fetch from list.
  * @param type: fetch only items of this type.
@@ -954,7 +954,7 @@ anchors_ds_unsupported(struct trust_anchor* ta)
 {
 	size_t i, num = 0;
 	for(i=0; i<ta->numDS; i++) {
-		if(!ds_digest_algo_is_supported(ta->ds_rrset, i) || 
+		if(!ds_digest_algo_is_supported(ta->ds_rrset, i) ||
 			!ds_key_algo_is_supported(ta->ds_rrset, i))
 			num++;
 	}
@@ -1009,12 +1009,12 @@ anchors_assemble_rrsets(struct val_anchors* anchors)
 		nokey = anchors_dnskey_unsupported(ta);
 		if(nods) {
 			log_nametypeclass(NO_VERBOSE, "warning: unsupported "
-				"algorithm for trust anchor", 
+				"algorithm for trust anchor",
 				ta->name, LDNS_RR_TYPE_DS, ta->dclass);
 		}
 		if(nokey) {
 			log_nametypeclass(NO_VERBOSE, "warning: unsupported "
-				"algorithm for trust anchor", 
+				"algorithm for trust anchor",
 				ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
 		}
 		if(nods == ta->numDS && nokey == ta->numDNSKEY) {
@@ -1042,7 +1042,7 @@ anchors_assemble_rrsets(struct val_anchors* anchors)
 	return 1;
 }
 
-int 
+int
 anchors_apply_cfg(struct val_anchors* anchors, struct config_file* cfg)
 {
 	struct config_strlist* f;
@@ -1116,7 +1116,7 @@ anchors_apply_cfg(struct val_anchors* anchors, struct config_file* cfg)
 			cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
 			nm += strlen(cfg->chrootdir);
 		if(!autr_read_file(anchors, nm)) {
-			log_err("error reading auto-trust-anchor-file: %s", 
+			log_err("error reading auto-trust-anchor-file: %s",
 				f->str);
 			sldns_buffer_free(parsebuf);
 			return 0;
@@ -1130,7 +1130,7 @@ anchors_apply_cfg(struct val_anchors* anchors, struct config_file* cfg)
 	return 1;
 }
 
-struct trust_anchor* 
+struct trust_anchor*
 anchors_lookup(struct val_anchors* anchors,
         uint8_t* qname, size_t qname_len, uint16_t qclass)
 {
@@ -1170,7 +1170,7 @@ anchors_lookup(struct val_anchors* anchors,
 	return result;
 }
 
-size_t 
+size_t
 anchors_get_mem(struct val_anchors* anchors)
 {
 	struct trust_anchor *ta;
diff --git a/usr.sbin/unbound/validator/val_anchor.h b/usr.sbin/unbound/validator/val_anchor.h
index 1597a7d62..e37f451e0 100644
--- a/usr.sbin/unbound/validator/val_anchor.h
+++ b/usr.sbin/unbound/validator/val_anchor.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -102,7 +102,7 @@ struct trust_anchor {
 	int namelabs;
 	/** the ancestor in the trustanchor tree */
 	struct trust_anchor* parent;
-	/** 
+	/**
 	 * List of DS or DNSKEY rrs that form the trust anchor.
 	 */
 	struct ta_key* keylist;
@@ -172,7 +172,7 @@ struct trust_anchor* anchors_lookup(struct val_anchors* anchors,
  * @param dclass: class of trust anchor
  * @return NULL if not found. The anchor is locked.
  */
-struct trust_anchor* anchor_find(struct val_anchors* anchors, 
+struct trust_anchor* anchor_find(struct val_anchors* anchors,
 	uint8_t* name, int namelabs, size_t namelen, uint16_t dclass);
 
 /**
@@ -182,7 +182,7 @@ struct trust_anchor* anchor_find(struct val_anchors* anchors,
  * @param str: string.
  * @return NULL on error.
  */
-struct trust_anchor* anchor_store_str(struct val_anchors* anchors, 
+struct trust_anchor* anchor_store_str(struct val_anchors* anchors,
 	struct sldns_buffer* buffer, const char* str);
 
 /**
diff --git a/usr.sbin/unbound/validator/val_kcache.c b/usr.sbin/unbound/validator/val_kcache.c
index c190085b5..f58d6b21c 100644
--- a/usr.sbin/unbound/validator/val_kcache.c
+++ b/usr.sbin/unbound/validator/val_kcache.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -46,10 +46,10 @@
 #include "util/data/dname.h"
 #include "util/module.h"
 
-struct key_cache* 
+struct key_cache*
 key_cache_create(struct config_file* cfg)
 {
-	struct key_cache* kcache = (struct key_cache*)calloc(1, 
+	struct key_cache* kcache = (struct key_cache*)calloc(1,
 		sizeof(*kcache));
 	size_t numtables, start_size, maxmem;
 	if(!kcache) {
@@ -70,7 +70,7 @@ key_cache_create(struct config_file* cfg)
 	return kcache;
 }
 
-void 
+void
 key_cache_delete(struct key_cache* kcache)
 {
 	if(!kcache)
@@ -79,7 +79,7 @@ key_cache_delete(struct key_cache* kcache)
 	free(kcache);
 }
 
-void 
+void
 key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey,
 	struct module_qstate* qstate)
 {
@@ -93,7 +93,7 @@ key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey,
 		key_entry_set_reason_bogus(k, errinf_to_reason_bogus(qstate));
 	}
 	key_entry_hash(k);
-	slabhash_insert(kcache->slab, k->entry.hash, &k->entry, 
+	slabhash_insert(kcache->slab, k->entry.hash, &k->entry,
 		k->entry.data, NULL);
 }
 
@@ -109,7 +109,7 @@ key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey,
  * 	performed.
  */
 static struct key_entry_key*
-key_cache_search(struct key_cache* kcache, uint8_t* name, size_t namelen, 
+key_cache_search(struct key_cache* kcache, uint8_t* name, size_t namelen,
 	uint16_t key_class, int wr)
 {
 	struct lruhash_entry* e;
@@ -120,18 +120,18 @@ key_cache_search(struct key_cache* kcache, uint8_t* name, size_t namelen,
 	lookfor.key_class = key_class;
 	key_entry_hash(&lookfor);
 	e = slabhash_lookup(kcache->slab, lookfor.entry.hash, &lookfor, wr);
-	if(!e) 
+	if(!e)
 		return NULL;
 	return (struct key_entry_key*)e->key;
 }
 
-struct key_entry_key* 
-key_cache_obtain(struct key_cache* kcache, uint8_t* name, size_t namelen, 
+struct key_entry_key*
+key_cache_obtain(struct key_cache* kcache, uint8_t* name, size_t namelen,
 	uint16_t key_class, struct regional* region, time_t now)
 {
 	/* keep looking until we find a nonexpired entry */
 	while(1) {
-		struct key_entry_key* k = key_cache_search(kcache, name, 
+		struct key_entry_key* k = key_cache_search(kcache, name,
 			namelen, key_class, 0);
 		if(k) {
 			/* see if TTL is OK */
@@ -154,7 +154,7 @@ key_cache_obtain(struct key_cache* kcache, uint8_t* name, size_t namelen,
 	return NULL;
 }
 
-size_t 
+size_t
 key_cache_get_mem(struct key_cache* kcache)
 {
 	return sizeof(*kcache) + slabhash_get_mem(kcache->slab);
diff --git a/usr.sbin/unbound/validator/val_kcache.h b/usr.sbin/unbound/validator/val_kcache.h
index 76c9dd094..9ad1eb8fd 100644
--- a/usr.sbin/unbound/validator/val_kcache.h
+++ b/usr.sbin/unbound/validator/val_kcache.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,7 +36,7 @@
 /**
  * \file
  *
- * This file contains functions for caching validated key entries. 
+ * This file contains functions for caching validated key entries.
  */
 
 #ifndef VALIDATOR_VAL_KCACHE_H
@@ -105,7 +105,7 @@ void key_cache_remove(struct key_cache* kcache,
  * 	Otherwise, NULL is returned.
  */
 struct key_entry_key* key_cache_obtain(struct key_cache* kcache,
-	uint8_t* name, size_t namelen, uint16_t key_class, 
+	uint8_t* name, size_t namelen, uint16_t key_class,
 	struct regional* region, time_t now);
 
 /**
diff --git a/usr.sbin/unbound/validator/val_kentry.c b/usr.sbin/unbound/validator/val_kentry.c
index a47feba61..d5adf4ea8 100644
--- a/usr.sbin/unbound/validator/val_kentry.c
+++ b/usr.sbin/unbound/validator/val_kentry.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -48,7 +48,7 @@
 #include "sldns/rrdef.h"
 #include "sldns/keyraw.h"
 
-size_t 
+size_t
 key_entry_sizefunc(void* key, void* data)
 {
 	struct key_entry_key* kk = (struct key_entry_key*)key;
@@ -64,7 +64,7 @@ key_entry_sizefunc(void* key, void* data)
 	return s;
 }
 
-int 
+int
 key_entry_compfunc(void* k1, void* k2)
 {
 	struct key_entry_key* n1 = (struct key_entry_key*)k1;
@@ -77,7 +77,7 @@ key_entry_compfunc(void* k1, void* k2)
 	return query_dname_compare(n1->name, n2->name);
 }
 
-void 
+void
 key_entry_delkeyfunc(void* key, void* ATTR_UNUSED(userarg))
 {
 	struct key_entry_key* kk = (struct key_entry_key*)key;
@@ -88,7 +88,7 @@ key_entry_delkeyfunc(void* key, void* ATTR_UNUSED(userarg))
 	free(kk);
 }
 
-void 
+void
 key_entry_deldatafunc(void* data, void* ATTR_UNUSED(userarg))
 {
 	struct key_entry_data* kd = (struct key_entry_data*)data;
@@ -98,16 +98,16 @@ key_entry_deldatafunc(void* data, void* ATTR_UNUSED(userarg))
 	free(kd);
 }
 
-void 
+void
 key_entry_hash(struct key_entry_key* kk)
 {
 	kk->entry.hash = 0x654;
-	kk->entry.hash = hashlittle(&kk->key_class, sizeof(kk->key_class), 
+	kk->entry.hash = hashlittle(&kk->key_class, sizeof(kk->key_class),
 		kk->entry.hash);
 	kk->entry.hash = dname_query_hash(kk->name, kk->entry.hash);
 }
 
-struct key_entry_key* 
+struct key_entry_key*
 key_entry_copy_toregion(struct key_entry_key* kkey, struct regional* region)
 {
 	struct key_entry_key* newk;
@@ -129,7 +129,7 @@ key_entry_copy_toregion(struct key_entry_key* kkey, struct regional* region)
 		/* copy rrset */
 		if(d->rrset_data) {
 			newd->rrset_data = regional_alloc_init(region,
-				d->rrset_data, 
+				d->rrset_data,
 				packed_rrset_sizeof(d->rrset_data));
 			if(!newd->rrset_data)
 				return NULL;
@@ -151,7 +151,7 @@ key_entry_copy_toregion(struct key_entry_key* kkey, struct regional* region)
 	return newk;
 }
 
-struct key_entry_key* 
+struct key_entry_key*
 key_entry_copy(struct key_entry_key* kkey)
 {
 	struct key_entry_key* newk;
@@ -180,7 +180,7 @@ key_entry_copy(struct key_entry_key* kkey)
 		}
 		/* copy rrset */
 		if(d->rrset_data) {
-			newd->rrset_data = memdup(d->rrset_data, 
+			newd->rrset_data = memdup(d->rrset_data,
 				packed_rrset_sizeof(d->rrset_data));
 			if(!newd->rrset_data) {
 				free(newd);
@@ -216,21 +216,21 @@ key_entry_copy(struct key_entry_key* kkey)
 	return newk;
 }
 
-int 
+int
 key_entry_isnull(struct key_entry_key* kkey)
 {
 	struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data;
 	return (!d->isbad && d->rrset_data == NULL);
 }
 
-int 
+int
 key_entry_isgood(struct key_entry_key* kkey)
 {
 	struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data;
 	return (!d->isbad && d->rrset_data != NULL);
 }
 
-int 
+int
 key_entry_isbad(struct key_entry_key* kkey)
 {
 	struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data;
@@ -271,7 +271,7 @@ key_entry_get_reason_bogus(struct key_entry_key* kkey)
 /** setup key entry in region */
 static int
 key_entry_setup(struct regional* region,
-	uint8_t* name, size_t namelen, uint16_t dclass, 
+	uint8_t* name, size_t namelen, uint16_t dclass,
 	struct key_entry_key** k, struct key_entry_data** d)
 {
 	*k = regional_alloc(region, sizeof(**k));
@@ -291,7 +291,7 @@ key_entry_setup(struct regional* region,
 	return 1;
 }
 
-struct key_entry_key* 
+struct key_entry_key*
 key_entry_create_null(struct regional* region,
 	uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl,
 	time_t now)
@@ -310,7 +310,7 @@ key_entry_create_null(struct regional* region,
 	return k;
 }
 
-struct key_entry_key* 
+struct key_entry_key*
 key_entry_create_rrset(struct regional* region,
 	uint8_t* name, size_t namelen, uint16_t dclass,
 	struct ub_packed_rrset_key* rrset, uint8_t* sigalg, time_t now)
@@ -339,9 +339,9 @@ key_entry_create_rrset(struct regional* region,
 	return k;
 }
 
-struct key_entry_key* 
+struct key_entry_key*
 key_entry_create_bad(struct regional* region,
-	uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, 
+	uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl,
 	time_t now)
 {
 	struct key_entry_key* k;
@@ -358,7 +358,7 @@ key_entry_create_bad(struct regional* region,
 	return k;
 }
 
-struct ub_packed_rrset_key* 
+struct ub_packed_rrset_key*
 key_entry_get_rrset(struct key_entry_key* kkey, struct regional* region)
 {
 	struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data;
@@ -377,7 +377,7 @@ key_entry_get_rrset(struct key_entry_key* kkey, struct regional* region)
 	rrk->rk.type = htons(d->rrset_type);
 	rrk->rk.rrset_class = htons(kkey->key_class);
 	rrk->entry.key = rrk;
-	rrd = regional_alloc_init(region, d->rrset_data, 
+	rrd = regional_alloc_init(region, d->rrset_data,
 		packed_rrset_sizeof(d->rrset_data));
 	if(!rrd)
 		return NULL;
@@ -413,7 +413,7 @@ kd_get_flags(struct packed_rrset_data* data, size_t idx)
 	return f;
 }
 
-size_t 
+size_t
 key_entry_keysize(struct key_entry_key* kkey)
 {
 	struct packed_rrset_data* d;
diff --git a/usr.sbin/unbound/validator/val_kentry.h b/usr.sbin/unbound/validator/val_kentry.h
index ded45beaa..07069e906 100644
--- a/usr.sbin/unbound/validator/val_kentry.h
+++ b/usr.sbin/unbound/validator/val_kentry.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -103,7 +103,7 @@ void key_entry_delkeyfunc(void* key, void* userarg);
 /** function for lruhash operation */
 void key_entry_deldatafunc(void* data, void* userarg);
 
-/** calculate hash for key entry 
+/** calculate hash for key entry
  * @param kk: key entry. The lruhash entry.hash value is filled in.
  */
 void key_entry_hash(struct key_entry_key* kk);
@@ -114,7 +114,7 @@ void key_entry_hash(struct key_entry_key* kk);
  * @param region: where to allocate it
  * @return newly region-allocated entry or NULL on a failure to allocate.
  */
-struct key_entry_key* key_entry_copy_toregion(struct key_entry_key* kkey, 
+struct key_entry_key* key_entry_copy_toregion(struct key_entry_key* kkey,
 	struct regional* region);
 
 /**
@@ -188,7 +188,7 @@ sldns_ede_code key_entry_get_reason_bogus(struct key_entry_key* kkey);
  * @return new key entry or NULL on alloc failure
  */
 struct key_entry_key* key_entry_create_null(struct regional* region,
-	uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, 
+	uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl,
 	time_t now);
 
 /**
@@ -203,7 +203,7 @@ struct key_entry_key* key_entry_create_null(struct regional* region,
  * @return new key entry or NULL on alloc failure
  */
 struct key_entry_key* key_entry_create_rrset(struct regional* region,
-        uint8_t* name, size_t namelen, uint16_t dclass, 
+        uint8_t* name, size_t namelen, uint16_t dclass,
 	struct ub_packed_rrset_key* rrset, uint8_t* sigalg, time_t now);
 
 /**
diff --git a/usr.sbin/unbound/validator/val_neg.c b/usr.sbin/unbound/validator/val_neg.c
index 67699b1f7..b19d6c9f8 100644
--- a/usr.sbin/unbound/validator/val_neg.c
+++ b/usr.sbin/unbound/validator/val_neg.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -85,7 +85,7 @@ int val_neg_zone_compare(const void* a, const void* b)
 
 struct val_neg_cache* val_neg_create(struct config_file* cfg, size_t maxiter)
 {
-	struct val_neg_cache* neg = (struct val_neg_cache*)calloc(1, 
+	struct val_neg_cache* neg = (struct val_neg_cache*)calloc(1,
 		sizeof(*neg));
 	if(!neg) {
 		log_err("Could not create neg cache: out of memory");
@@ -144,7 +144,7 @@ void neg_cache_delete(struct val_neg_cache* neg)
  * @param neg: negative cache with LRU start and end.
  * @param data: this data is fronted.
  */
-static void neg_lru_front(struct val_neg_cache* neg, 
+static void neg_lru_front(struct val_neg_cache* neg,
 	struct val_neg_data* data)
 {
 	data->prev = NULL;
@@ -160,7 +160,7 @@ static void neg_lru_front(struct val_neg_cache* neg,
  * @param neg: negative cache with LRU start and end.
  * @param data: this data is removed from the list.
  */
-static void neg_lru_remove(struct val_neg_cache* neg, 
+static void neg_lru_remove(struct val_neg_cache* neg,
 	struct val_neg_data* data)
 {
 	if(data->prev)
@@ -176,7 +176,7 @@ static void neg_lru_remove(struct val_neg_cache* neg,
  * @param neg: negative cache with LRU start and end.
  * @param data: this data is used.
  */
-static void neg_lru_touch(struct val_neg_cache* neg, 
+static void neg_lru_touch(struct val_neg_cache* neg,
 	struct val_neg_data* data)
 {
 	if(data == neg->first)
@@ -222,7 +222,7 @@ static void neg_delete_zone(struct val_neg_cache* neg, struct val_neg_zone* z)
 		p = np;
 	}
 }
-	
+
 void neg_delete_data(struct val_neg_cache* neg, struct val_neg_data* el)
 {
 	struct val_neg_zone* z;
@@ -236,7 +236,7 @@ void neg_delete_data(struct val_neg_cache* neg, struct val_neg_data* el)
 	/* remove it from the lru list */
 	neg_lru_remove(neg, el);
 	log_assert(neg->first != el && neg->last != el);
-	
+
 	/* go up the tree and reduce counts */
 	p = el;
 	while(p) {
@@ -277,7 +277,7 @@ static void neg_make_space(struct val_neg_cache* neg, size_t need)
 	}
 }
 
-struct val_neg_zone* neg_find_zone(struct val_neg_cache* neg, 
+struct val_neg_zone* neg_find_zone(struct val_neg_cache* neg,
 	uint8_t* nm, size_t len, uint16_t dclass)
 {
 	struct val_neg_zone lookfor;
@@ -301,7 +301,7 @@ struct val_neg_zone* neg_find_zone(struct val_neg_cache* neg,
  * @param labs: labels in nm
  * @return data or NULL if not found.
  */
-static struct val_neg_data* neg_find_data(struct val_neg_zone* zone, 
+static struct val_neg_data* neg_find_data(struct val_neg_zone* zone,
 	uint8_t* nm, size_t len, int labs)
 {
 	struct val_neg_data lookfor;
@@ -449,7 +449,7 @@ static struct val_neg_data* neg_closest_data_parent(
 static struct val_neg_zone* neg_setup_zone_node(
 	uint8_t* nm, size_t nm_len, int labs, uint16_t dclass)
 {
-	struct val_neg_zone* zone = 
+	struct val_neg_zone* zone =
 		(struct val_neg_zone*)calloc(1, sizeof(*zone));
 	if(!zone) {
 		return NULL;
@@ -513,7 +513,7 @@ static struct val_neg_zone* neg_zone_chain(
 		dname_remove_label(&nm, &nm_len);
 	}
 	return first;
-}	
+}
 
 void val_neg_zone_take_inuse(struct val_neg_zone* zone)
 {
@@ -670,7 +670,7 @@ static struct val_neg_data* neg_data_chain(
  * @param el: element to start walking at.
  * @param nsec: the nsec record with the end point
  */
-static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone, 
+static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
 	struct val_neg_data* el, struct ub_packed_rrset_key* nsec)
 {
 	struct packed_rrset_data* d = (struct packed_rrset_data*)nsec->
@@ -697,7 +697,7 @@ static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
 	}
 
 	/* sanity check, both owner and end must be below the zone apex */
-	if(!dname_subdomain_c(el->name, zone->name) || 
+	if(!dname_subdomain_c(el->name, zone->name) ||
 		!dname_subdomain_c(end, zone->name))
 		return;
 
@@ -710,7 +710,7 @@ static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
 	while(walk && walk != RBTREE_NULL) {
 		cur = (struct val_neg_data*)walk;
 		/* sanity check: must be larger than start */
-		if(dname_canon_lab_cmp(cur->name, cur->labs, 
+		if(dname_canon_lab_cmp(cur->name, cur->labs,
 			el->name, el->labs, &m) <= 0) {
 			/* r == 0 skip original record. */
 			/* r < 0  too small! */
@@ -718,7 +718,7 @@ static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
 			continue;
 		}
 		/* stop at endpoint, also data at empty nonterminals must be
-		 * removed (no NSECs there) so everything between 
+		 * removed (no NSECs there) so everything between
 		 * start and end */
 		if(end && dname_canon_lab_cmp(cur->name, cur->labs,
 			end, end_labs, &m) >= 0) {
@@ -734,7 +734,7 @@ static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
 		 * But it may trigger delete of other data and the
 		 * entire zone. However, if that happens, this is done
 		 * by deleting the *parents* of the element for deletion,
-		 * and maybe also the entire zone if it is empty. 
+		 * and maybe also the entire zone if it is empty.
 		 * But parents are smaller in canonical compare, thus,
 		 * if a larger element exists, then it is not a parent,
 		 * it cannot get deleted, the zone cannot get empty.
@@ -745,7 +745,7 @@ static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
 	}
 }
 
-void neg_insert_data(struct val_neg_cache* neg, 
+void neg_insert_data(struct val_neg_cache* neg,
 	struct val_neg_zone* zone, struct ub_packed_rrset_key* nsec)
 {
 	struct packed_rrset_data* d;
@@ -759,8 +759,8 @@ void neg_insert_data(struct val_neg_cache* neg,
 	if( !(d->security == sec_status_secure ||
 		(d->security == sec_status_unchecked && d->rrsig_count > 0)))
 		return;
-	log_nametypeclass(VERB_ALGO, "negcache rr", 
-		nsec->rk.dname, ntohs(nsec->rk.type), 
+	log_nametypeclass(VERB_ALGO, "negcache rr",
+		nsec->rk.dname, ntohs(nsec->rk.type),
 		ntohs(nsec->rk.rrset_class));
 
 	/* find closest enclosing parent data that (still) exists */
@@ -769,7 +769,7 @@ void neg_insert_data(struct val_neg_cache* neg,
 		/* perfect match already exists */
 		log_assert(parent->count > 0);
 		el = parent;
-	} else { 
+	} else {
 		struct val_neg_data* p, *np;
 
 		/* create subtree for perfect match */
@@ -822,7 +822,7 @@ void neg_insert_data(struct val_neg_cache* neg,
 		if(nsec3_get_params(nsec, 0, &h, &it, &s, &slen) &&
 			it <= neg->nsec3_max_iter &&
 			(h != zone->nsec3_hash || it != zone->nsec3_iter ||
-			slen != zone->nsec3_saltlen || 
+			slen != zone->nsec3_saltlen ||
 			memcmp(zone->nsec3_salt, s, slen) != 0)) {
 
 			if(slen > 0) {
@@ -893,7 +893,7 @@ void val_neg_addreply(struct val_neg_cache* neg, struct reply_info* rep)
 		rrset_class = ntohs(soa->rk.rrset_class);
 	}
 	else {
-		/* No SOA in positive (wildcard) answer. Use signer from the 
+		/* No SOA in positive (wildcard) answer. Use signer from the
 		 * validated answer RRsets' signature. */
 		if(!(dname = reply_nsec_signer(rep, &dname_len, &rrset_class)))
 			return;
@@ -901,9 +901,9 @@ void val_neg_addreply(struct val_neg_cache* neg, struct reply_info* rep)
 
 	log_nametypeclass(VERB_ALGO, "negcache insert for zone",
 		dname, LDNS_RR_TYPE_SOA, rrset_class);
-	
+
 	/* ask for enough space to store all of it */
-	need = calc_data_need(rep) + 
+	need = calc_data_need(rep) +
 		calc_zone_need(dname, dname_len);
 	lock_basic_lock(&neg->lock);
 	neg_make_space(neg, need);
@@ -924,7 +924,7 @@ void val_neg_addreply(struct val_neg_cache* neg, struct reply_info* rep)
 	for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
 		if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC)
 			continue;
-		if(!dname_subdomain_c(rep->rrsets[i]->rk.dname, 
+		if(!dname_subdomain_c(rep->rrsets[i]->rk.dname,
 			zone->name)) continue;
 		/* insert NSEC into this zone's tree */
 		neg_insert_data(neg, zone, rep->rrsets[i]);
@@ -976,7 +976,7 @@ void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
 	/* no SOA in this message, find RRSIG over NSEC's signer name.
 	 * note the NSEC records are maybe not validated yet */
 	signer = reply_nsec_signer(rep, &signer_len, &dclass);
-	if(!signer) 
+	if(!signer)
 		return;
 	if(!dname_subdomain_c(signer, zone_name)) {
 		/* the signer is not in the bailiwick, throw it out */
@@ -985,7 +985,7 @@ void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
 
 	log_nametypeclass(VERB_ALGO, "negcache insert referral ",
 		signer, LDNS_RR_TYPE_NS, dclass);
-	
+
 	/* ask for enough space to store all of it */
 	need = calc_data_need(rep) + calc_zone_need(signer, signer_len);
 	lock_basic_lock(&neg->lock);
@@ -994,7 +994,7 @@ void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
 	/* find or create the zone entry */
 	zone = neg_find_zone(neg, signer, signer_len, dclass);
 	if(!zone) {
-		if(!(zone = neg_create_zone(neg, signer, signer_len, 
+		if(!(zone = neg_create_zone(neg, signer, signer_len,
 			dclass))) {
 			lock_basic_unlock(&neg->lock);
 			log_err("out of memory adding negative zone");
@@ -1008,7 +1008,7 @@ void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
 		if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC &&
 			ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC3)
 			continue;
-		if(!dname_subdomain_c(rep->rrsets[i]->rk.dname, 
+		if(!dname_subdomain_c(rep->rrsets[i]->rk.dname,
 			zone->name)) continue;
 		/* insert NSEC into this zone's tree */
 		neg_insert_data(neg, zone, rep->rrsets[i]);
@@ -1057,8 +1057,8 @@ static int nsec3_no_type(struct ub_packed_rrset_key* k, uint16_t t)
  */
 static struct ub_packed_rrset_key*
 grab_nsec(struct rrset_cache* rrset_cache, uint8_t* qname, size_t qname_len,
-	uint16_t qtype, uint16_t qclass, uint32_t flags, 
-	struct regional* region, int checkbit, uint16_t checktype, 
+	uint16_t qtype, uint16_t qclass, uint32_t flags,
+	struct regional* region, int checkbit, uint16_t checktype,
 	time_t now)
 {
 	struct ub_packed_rrset_key* r, *k = rrset_cache_lookup(rrset_cache,
@@ -1172,8 +1172,8 @@ neg_find_nsec3_ce(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
 	*nclen = 0;
 	while(qlabs > 0) {
 		/* hash */
-		if(!(celen=nsec3_get_hashed(buf, qname, qname_len, 
-			zone->nsec3_hash, zone->nsec3_iter, zone->nsec3_salt, 
+		if(!(celen=nsec3_get_hashed(buf, qname, qname_len,
+			zone->nsec3_hash, zone->nsec3_iter, zone->nsec3_salt,
 			zone->nsec3_saltlen, hashce, sizeof(hashce))))
 			return NULL;
 		if(!(b32len=nsec3_hash_to_b32(hashce, celen, zone->name,
@@ -1212,7 +1212,7 @@ neg_params_ok(struct val_neg_zone* zone, struct ub_packed_rrset_key* rrset)
 /** get next closer for nsec3 proof */
 static struct ub_packed_rrset_key*
 neg_nsec3_getnc(struct val_neg_zone* zone, uint8_t* hashnc, size_t nclen,
-	struct rrset_cache* rrset_cache, struct regional* region, 
+	struct rrset_cache* rrset_cache, struct regional* region,
 	time_t now, uint8_t* b32, size_t maxb32)
 {
 	struct ub_packed_rrset_key* nc_rrset;
@@ -1233,7 +1233,7 @@ neg_nsec3_getnc(struct val_neg_zone* zone, uint8_t* hashnc, size_t nclen,
 	if(!data)
 		return NULL;
 	/* got a data element in tree, grab it */
-	nc_rrset = grab_nsec(rrset_cache, data->name, data->len, 
+	nc_rrset = grab_nsec(rrset_cache, data->name, data->len,
 		LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 0, 0, now);
 	if(!nc_rrset)
 		return NULL;
@@ -1258,13 +1258,13 @@ neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
 
 	/* for NSEC3 ; determine the closest encloser for which we
 	 * can find an exact match. Remember the hashed lower name,
-	 * since that is the one we need a closest match for. 
+	 * since that is the one we need a closest match for.
 	 * If we find a match straight away, then it becomes NODATA.
 	 * Otherwise, NXDOMAIN or if OPTOUT, an insecure delegation.
 	 * Also check that parameters are the same on closest encloser
 	 * and on closest match.
 	 */
-	if(!zone->nsec3_hash) 
+	if(!zone->nsec3_hash)
 		return NULL; /* not nsec3 zone */
 
 	if(!(data=neg_find_nsec3_ce(zone, qname, qname_len, qlabs, buf,
@@ -1273,8 +1273,8 @@ neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
 	}
 
 	/* grab the ce rrset */
-	ce_rrset = grab_nsec(rrset_cache, data->name, data->len, 
-		LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 1, 
+	ce_rrset = grab_nsec(rrset_cache, data->name, data->len,
+		LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 1,
 		LDNS_RR_TYPE_DS, now);
 	if(!ce_rrset)
 		return NULL;
@@ -1288,11 +1288,11 @@ neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
 			nsec3_has_type(ce_rrset, 0, LDNS_RR_TYPE_DS) ||
 			!nsec3_has_type(ce_rrset, 0, LDNS_RR_TYPE_NS))
 			return NULL;
-		if(!(msg = dns_msg_create(qname, qname_len, 
-			LDNS_RR_TYPE_DS, zone->dclass, region, 1))) 
+		if(!(msg = dns_msg_create(qname, qname_len,
+			LDNS_RR_TYPE_DS, zone->dclass, region, 1)))
 			return NULL;
 		/* TTL reduced in grab_nsec */
-		if(!dns_msg_authadd(msg, region, ce_rrset, 0)) 
+		if(!dns_msg_authadd(msg, region, ce_rrset, 0))
 			return NULL;
 		return msg;
 	}
@@ -1304,9 +1304,9 @@ neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
 
 	/* if there is no exact match, it must be in an optout span
 	 * (an existing DS implies an NSEC3 must exist) */
-	nc_rrset = neg_nsec3_getnc(zone, hashnc, nclen, rrset_cache, 
+	nc_rrset = neg_nsec3_getnc(zone, hashnc, nclen, rrset_cache,
 		region, now, nc_b32, sizeof(nc_b32));
-	if(!nc_rrset) 
+	if(!nc_rrset)
 		return NULL;
 	if(!neg_params_ok(zone, nc_rrset))
 		return NULL;
@@ -1322,13 +1322,13 @@ neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
 		 * nc_rrset is optout.
 		 * No need to check wildcard for type DS */
 		/* capacity=3: ce + nc + soa(if needed) */
-		if(!(msg = dns_msg_create(qname, qname_len, 
-			LDNS_RR_TYPE_DS, zone->dclass, region, 3))) 
+		if(!(msg = dns_msg_create(qname, qname_len,
+			LDNS_RR_TYPE_DS, zone->dclass, region, 3)))
 			return NULL;
 		/* now=0 because TTL was reduced in grab_nsec */
-		if(!dns_msg_authadd(msg, region, ce_rrset, 0)) 
+		if(!dns_msg_authadd(msg, region, ce_rrset, 0))
 			return NULL;
-		if(!dns_msg_authadd(msg, region, nc_rrset, 0)) 
+		if(!dns_msg_authadd(msg, region, nc_rrset, 0))
 			return NULL;
 		return msg;
 	}
@@ -1358,10 +1358,10 @@ static int add_soa(struct rrset_cache* rrset_cache, time_t now,
 	} else {
 		/* Assumes the signer is the zone SOA to add */
 		nm = reply_nsec_signer(msg->rep, &nmlen, &dclass);
-		if(!nm) 
+		if(!nm)
 			return 0;
 	}
-	soa = rrset_cache_lookup(rrset_cache, nm, nmlen, LDNS_RR_TYPE_SOA, 
+	soa = rrset_cache_lookup(rrset_cache, nm, nmlen, LDNS_RR_TYPE_SOA,
 		dclass, PACKED_RRSET_SOA_NEG, now, 0);
 	if(!soa)
 		return 0;
@@ -1373,9 +1373,9 @@ static int add_soa(struct rrset_cache* rrset_cache, time_t now,
 	return 1;
 }
 
-struct dns_msg* 
-val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo, 
-	struct regional* region, struct rrset_cache* rrset_cache, 
+struct dns_msg*
+val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
+	struct regional* region, struct rrset_cache* rrset_cache,
 	sldns_buffer* buf, time_t now, int addsoa, uint8_t* topname,
 	struct config_file* cfg)
 {
@@ -1407,10 +1407,10 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
 	/* Matching NSEC, use to generate No Data answer. Not creating answers
 	 * yet for No Data proven using wildcard. */
 	if(nsec && nsec_proves_nodata(nsec, qinfo, &nodata_wc) && !nodata_wc) {
-		if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len, 
-			qinfo->qtype, qinfo->qclass, region, 2))) 
+		if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len,
+			qinfo->qtype, qinfo->qclass, region, 2)))
 			return NULL;
-		if(!dns_msg_authadd(msg, region, nsec, 0)) 
+		if(!dns_msg_authadd(msg, region, nsec, 0))
 			return NULL;
 		if(addsoa && !add_soa(rrset_cache, now, region, msg, NULL))
 			return NULL;
@@ -1420,8 +1420,8 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
 		lock_basic_unlock(&neg->lock);
 		return msg;
 	} else if(nsec && val_nsec_proves_name_error(nsec, qinfo->qname)) {
-		if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len, 
-			qinfo->qtype, qinfo->qclass, region, 3))) 
+		if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len,
+			qinfo->qtype, qinfo->qclass, region, 3)))
 			return NULL;
 		if(!(ce = nsec_closest_encloser(qinfo->qname, nsec)))
 			return NULL;
@@ -1523,7 +1523,7 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
 
 	/* lookup closest zone */
 	lock_basic_lock(&neg->lock);
-	zone = neg_closest_zone_parent(neg, zname, zname_len, zname_labs, 
+	zone = neg_closest_zone_parent(neg, zname, zname_len, zname_labs,
 		qinfo->qclass);
 	while(zone && !zone->in_use)
 		zone = zone->parent;
@@ -1538,7 +1538,7 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
 		return NULL;
 	}
 
-	msg = neg_nsec3_proof_ds(zone, qinfo->qname, qinfo->qname_len, 
+	msg = neg_nsec3_proof_ds(zone, qinfo->qname, qinfo->qname_len,
 		zname_labs+1, buf, rrset_cache, region, now, topname);
 	if(msg && addsoa && !add_soa(rrset_cache, now, region, msg, zone)) {
 		lock_basic_unlock(&neg->lock);
diff --git a/usr.sbin/unbound/validator/val_neg.h b/usr.sbin/unbound/validator/val_neg.h
index 5643ca331..5452f8cf7 100644
--- a/usr.sbin/unbound/validator/val_neg.h
+++ b/usr.sbin/unbound/validator/val_neg.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2008, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -57,15 +57,15 @@ struct dns_msg;
 struct ub_packed_rrset_key;
 
 /**
- * The negative cache.  It is shared between the threads, so locked. 
+ * The negative cache.  It is shared between the threads, so locked.
  * Kept as validator-environ-state.  It refers back to the rrset cache for
- * data elements.  It can be out of date and contain conflicting data 
- * from zone content changes.  
+ * data elements.  It can be out of date and contain conflicting data
+ * from zone content changes.
  * It contains a tree of zones, every zone has a tree of data elements.
  * The data elements are part of one big LRU list, with one memory counter.
  */
 struct val_neg_cache {
-	/** the big lock on the negative cache.  Because we use a rbtree 
+	/** the big lock on the negative cache.  Because we use a rbtree
 	 * for the data (quick lookup), we need a big lock */
 	lock_basic_type lock;
 	/** The zone rbtree. contents sorted canonical, type val_neg_zone */
@@ -105,7 +105,7 @@ struct val_neg_zone {
 	struct val_neg_zone* parent;
 
 	/** the number of elements, including this one and the ones whose
-	 * parents (-parents) include this one, that are in_use 
+	 * parents (-parents) include this one, that are in_use
 	 * No elements have a count of zero, those are removed. */
 	int count;
 
@@ -118,7 +118,7 @@ struct val_neg_zone {
 	/** length of salt in bytes */
 	size_t nsec3_saltlen;
 
-	/** tree of NSEC data for this zone, sorted canonical 
+	/** tree of NSEC data for this zone, sorted canonical
 	 * by NSEC owner name */
 	rbtree_type tree;
 
@@ -153,7 +153,7 @@ struct val_neg_data {
 	struct val_neg_data* parent;
 
 	/** the number of elements, including this one and the ones whose
-	 * parents (-parents) include this one, that are in use 
+	 * parents (-parents) include this one, that are in use
 	 * No elements have a count of zero, those are removed. */
 	int count;
 
@@ -190,12 +190,12 @@ size_t val_neg_get_mem(struct val_neg_cache* neg);
  */
 void neg_cache_delete(struct val_neg_cache* neg);
 
-/** 
+/**
  * Comparison function for rbtree val neg data elements
  */
 int val_neg_data_compare(const void* a, const void* b);
 
-/** 
+/**
  * Comparison function for rbtree val neg zone elements
  */
 int val_neg_zone_compare(const void* a, const void* b);
@@ -229,7 +229,7 @@ void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
  * @param now: to check TTLs against.
  * @param addsoa: if true, produce result for external consumption.
  *	if false, do not add SOA - for unbound-internal consumption.
- * @param topname: do not look higher than this name, 
+ * @param topname: do not look higher than this name,
  * 	so that the result cannot be taken from a zone above the current
  * 	trust anchor.  Which could happen with multiple islands of trust.
  * 	if NULL, then no trust anchor is used, but also the algorithm becomes
@@ -237,12 +237,12 @@ void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
  * 	may have a trust-anchor below the optout and thus the optout cannot
  * 	be used to create a proof from the negative cache.
  * @param cfg: config options.
- * @return a reply message if something was found. 
+ * @return a reply message if something was found.
  * 	This reply may still need validation.
  * 	NULL if nothing found (or out of memory).
  */
-struct dns_msg* val_neg_getmsg(struct val_neg_cache* neg, 
-	struct query_info* qinfo, struct regional* region, 
+struct dns_msg* val_neg_getmsg(struct val_neg_cache* neg,
+	struct query_info* qinfo, struct regional* region,
 	struct rrset_cache* rrset_cache, struct sldns_buffer* buf, time_t now,
 	int addsoa, uint8_t* topname, struct config_file* cfg);
 
diff --git a/usr.sbin/unbound/validator/val_nsec.c b/usr.sbin/unbound/validator/val_nsec.c
index 876bfab6d..e3c10c8e7 100644
--- a/usr.sbin/unbound/validator/val_nsec.c
+++ b/usr.sbin/unbound/validator/val_nsec.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -50,7 +50,7 @@
 #include "services/cache/rrset.h"
 
 /** get ttl of rrset */
-static uint32_t 
+static uint32_t
 rrset_get_ttl(struct ub_packed_rrset_key* k)
 {
 	struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
@@ -74,7 +74,7 @@ nsecbitmap_has_type_rdata(uint8_t* bitmap, size_t len, uint16_t type)
 		win = *bitmap++;
 		winlen = *bitmap++;
 		len -= 2;
-		if(len < winlen || winlen < 1 || winlen > 32) 
+		if(len < winlen || winlen < 1 || winlen > 32)
 			return 0;	/* bad window length */
 		if(win == type_window) {
 			/* search window bitmap for the correct byte */
@@ -104,7 +104,7 @@ nsec_has_type(struct ub_packed_rrset_key* nsec, uint16_t type)
 	len = dname_valid(d->rr_data[0]+2, d->rr_len[0]-2);
 	if(!len)
 		return 0;
-	return nsecbitmap_has_type_rdata(d->rr_data[0]+2+len, 
+	return nsecbitmap_has_type_rdata(d->rr_data[0]+2+len,
 		d->rr_len[0]-2-len, type);
 }
 
@@ -116,7 +116,7 @@ nsec_has_type(struct ub_packed_rrset_key* nsec, uint16_t type)
  * @param ln: length of nm is returned.
  * @return false on a bad NSEC RR (too short, malformed dname).
  */
-static int 
+static int
 nsec_get_next(struct ub_packed_rrset_key* nsec, uint8_t** nm, size_t* ln)
 {
 	struct packed_rrset_data* d = (struct packed_rrset_data*)nsec->
@@ -141,30 +141,30 @@ nsec_get_next(struct ub_packed_rrset_key* nsec, uint8_t** nm, size_t* ln)
  *
  * @param nsec: NSEC for proof, must be trusted.
  * @param qinfo: what is queried for.
- * @return if secure the nsec proves that no DS is present, or 
+ * @return if secure the nsec proves that no DS is present, or
  *	insecure if it proves it is not a delegation point.
  *	or bogus if something was wrong.
  */
-static enum sec_status 
-val_nsec_proves_no_ds(struct ub_packed_rrset_key* nsec, 
+static enum sec_status
+val_nsec_proves_no_ds(struct ub_packed_rrset_key* nsec,
 	struct query_info* qinfo)
 {
 	log_assert(qinfo->qtype == LDNS_RR_TYPE_DS);
 	log_assert(ntohs(nsec->rk.type) == LDNS_RR_TYPE_NSEC);
 
 	if(nsec_has_type(nsec, LDNS_RR_TYPE_SOA) && qinfo->qname_len != 1) {
-		/* SOA present means that this is the NSEC from the child, 
+		/* SOA present means that this is the NSEC from the child,
 		 * not the parent (so it is the wrong one). */
 		return sec_status_bogus;
 	}
 	if(nsec_has_type(nsec, LDNS_RR_TYPE_DS)) {
-		/* DS present means that there should have been a positive 
+		/* DS present means that there should have been a positive
 		 * response to the DS query, so there is something wrong. */
 		return sec_status_bogus;
 	}
 
 	if(!nsec_has_type(nsec, LDNS_RR_TYPE_NS)) {
-		/* If there is no NS at this point at all, then this 
+		/* If there is no NS at this point at all, then this
 		 * doesn't prove anything one way or the other. */
 		return sec_status_insecure;
 	}
@@ -174,8 +174,8 @@ val_nsec_proves_no_ds(struct ub_packed_rrset_key* nsec,
 
 /** check security status from cache or verify rrset, returns true if secure */
 static int
-nsec_verify_rrset(struct module_env* env, struct val_env* ve, 
-	struct ub_packed_rrset_key* nsec, struct key_entry_key* kkey, 
+nsec_verify_rrset(struct module_env* env, struct val_env* ve,
+	struct ub_packed_rrset_key* nsec, struct key_entry_key* kkey,
 	char** reason, struct module_qstate* qstate)
 {
 	struct packed_rrset_data* d = (struct packed_rrset_data*)
@@ -195,14 +195,14 @@ nsec_verify_rrset(struct module_env* env, struct val_env* ve,
 	return 0;
 }
 
-enum sec_status 
-val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, 
-	struct query_info* qinfo, struct reply_info* rep, 
+enum sec_status
+val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
+	struct query_info* qinfo, struct reply_info* rep,
 	struct key_entry_key* kkey, time_t* proof_ttl, char** reason,
 	struct module_qstate* qstate)
 {
 	struct ub_packed_rrset_key* nsec = reply_find_rrset_section_ns(
-		rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_NSEC, 
+		rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_NSEC,
 		qinfo->qclass);
 	enum sec_status sec;
 	size_t i;
@@ -210,7 +210,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
 	int valid_nsec = 0;
 	struct ub_packed_rrset_key* wc_nsec = NULL;
 
-	/* If we have a NSEC at the same name, it must prove one 
+	/* If we have a NSEC at the same name, it must prove one
 	 * of two things
 	 * --
 	 * 1) this is a delegation point and there is no DS
@@ -237,11 +237,11 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
 		/* if unchecked, fall through to next proof */
 	}
 
-	/* Otherwise, there is no NSEC at qname. This could be an ENT. 
+	/* Otherwise, there is no NSEC at qname. This could be an ENT.
 	 * (ENT=empty non terminal). If not, this is broken. */
-	
+
 	/* verify NSEC rrsets in auth section */
-	for(i=rep->an_numrrsets; i < rep->an_numrrsets+rep->ns_numrrsets; 
+	for(i=rep->an_numrrsets; i < rep->an_numrrsets+rep->ns_numrrsets;
 		i++) {
 		if(rep->rrsets[i]->rk.type != htons(LDNS_RR_TYPE_NSEC))
 			continue;
@@ -255,12 +255,12 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
 			verbose(VERB_ALGO, "NSEC for empty non-terminal "
 				"proved no DS.");
 			*proof_ttl = rrset_get_ttl(rep->rrsets[i]);
-			if(wc && dname_is_wild(rep->rrsets[i]->rk.dname)) 
+			if(wc && dname_is_wild(rep->rrsets[i]->rk.dname))
 				wc_nsec = rep->rrsets[i];
 			valid_nsec = 1;
 		}
 		if(val_nsec_proves_name_error(rep->rrsets[i], qinfo->qname)) {
-			ce = nsec_closest_encloser(qinfo->qname, 
+			ce = nsec_closest_encloser(qinfo->qname,
 				rep->rrsets[i]);
 		}
 	}
@@ -268,7 +268,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
 		valid_nsec = 0;
 	else if(wc && ce) {
 		/* ce and wc must match */
-		if(query_dname_compare(wc, ce) != 0) 
+		if(query_dname_compare(wc, ce) != 0)
 			valid_nsec = 0;
 		else if(!wc_nsec)
 			valid_nsec = 0;
@@ -287,7 +287,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve,
 	return sec_status_unchecked;
 }
 
-int nsec_proves_nodata(struct ub_packed_rrset_key* nsec, 
+int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 	struct query_info* qinfo, uint8_t** wc)
 {
 	log_assert(wc);
@@ -295,27 +295,27 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 		uint8_t* nm;
 		size_t ln;
 
-		/* empty-non-terminal checking. 
+		/* empty-non-terminal checking.
 		 * Done before wildcard, because this is an exact match,
 		 * and would prevent a wildcard from matching. */
 
-		/* If the nsec is proving that qname is an ENT, the nsec owner 
-		 * will be less than qname, and the next name will be a child 
+		/* If the nsec is proving that qname is an ENT, the nsec owner
+		 * will be less than qname, and the next name will be a child
 		 * domain of the qname. */
 		if(!nsec_get_next(nsec, &nm, &ln))
 			return 0; /* bad nsec */
 		if(dname_strict_subdomain_c(nm, qinfo->qname) &&
-			dname_canonical_compare(nsec->rk.dname, 
+			dname_canonical_compare(nsec->rk.dname,
 				qinfo->qname) < 0) {
 			return 1; /* proves ENT */
 		}
 
 		/* wildcard checking. */
 
-		/* If this is a wildcard NSEC, make sure that a) it was 
-		 * possible to have generated qname from the wildcard and 
-		 * b) the type map does not contain qtype. Note that this 
-		 * does NOT prove that this wildcard was the applicable 
+		/* If this is a wildcard NSEC, make sure that a) it was
+		 * possible to have generated qname from the wildcard and
+		 * b) the type map does not contain qtype. Note that this
+		 * does NOT prove that this wildcard was the applicable
 		 * wildcard. */
 		if(dname_is_wild(nsec->rk.dname)) {
 			/* the purported closest encloser. */
@@ -323,8 +323,8 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 			size_t ce_len = nsec->rk.dname_len;
 			dname_remove_label(&ce, &ce_len);
 
-			/* The qname must be a strict subdomain of the 
-			 * closest encloser, for the wildcard to apply 
+			/* The qname must be a strict subdomain of the
+			 * closest encloser, for the wildcard to apply
 			 */
 			if(dname_strict_subdomain_c(qinfo->qname, ce)) {
 				/* here we have a matching NSEC for the qname,
@@ -333,7 +333,7 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 				   /* should have gotten the wildcard CNAME */
 					return 0;
 				}
-				if(nsec_has_type(nsec, LDNS_RR_TYPE_NS) && 
+				if(nsec_has_type(nsec, LDNS_RR_TYPE_NS) &&
 				   !nsec_has_type(nsec, LDNS_RR_TYPE_SOA)) {
 				   /* wrong parentside (wildcard) NSEC used */
 					return 0;
@@ -368,7 +368,7 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 			}
 		}
 
-		/* Otherwise, this NSEC does not prove ENT and is not a 
+		/* Otherwise, this NSEC does not prove ENT and is not a
 		 * wildcard, so it does not prove NODATA. */
 		return 0;
 	}
@@ -383,13 +383,13 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 		return 0;
 	}
 
-	/* If an NS set exists at this name, and NOT a SOA (so this is a 
-	 * zone cut, not a zone apex), then we should have gotten a 
-	 * referral (or we just got the wrong NSEC). 
+	/* If an NS set exists at this name, and NOT a SOA (so this is a
+	 * zone cut, not a zone apex), then we should have gotten a
+	 * referral (or we just got the wrong NSEC).
 	 * The reverse of this check is used when qtype is DS, since that
 	 * must use the NSEC from above the zone cut. */
 	if(qinfo->qtype != LDNS_RR_TYPE_DS &&
-		nsec_has_type(nsec, LDNS_RR_TYPE_NS) && 
+		nsec_has_type(nsec, LDNS_RR_TYPE_NS) &&
 		!nsec_has_type(nsec, LDNS_RR_TYPE_SOA)) {
 		return 0;
 	} else if(qinfo->qtype == LDNS_RR_TYPE_DS &&
@@ -401,7 +401,7 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 	return 1;
 }
 
-int 
+int
 val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec, uint8_t* qname)
 {
 	uint8_t* owner = nsec->rk.dname;
@@ -416,11 +416,11 @@ val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec, uint8_t* qname)
 	}
 
 	/* If NSEC is a parent of qname, we need to check the type map
-	 * If the parent name has a DNAME or is a delegation point, then 
+	 * If the parent name has a DNAME or is a delegation point, then
 	 * this NSEC is being misused. */
-	if(dname_subdomain_c(qname, owner) && 
+	if(dname_subdomain_c(qname, owner) &&
 		(nsec_has_type(nsec, LDNS_RR_TYPE_DNAME) ||
-		(nsec_has_type(nsec, LDNS_RR_TYPE_NS) 
+		(nsec_has_type(nsec, LDNS_RR_TYPE_NS)
 			&& !nsec_has_type(nsec, LDNS_RR_TYPE_SOA))
 		)) {
 		return 0;
@@ -435,8 +435,8 @@ val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec, uint8_t* qname)
 	}
 	else if(dname_canonical_compare(owner, next) > 0) {
 		/* this is the last nsec, ....(bigger) NSEC zonename(smaller) */
-		/* the names after the last (owner) name do not exist 
-		 * there are no names before the zone name in the zone 
+		/* the names after the last (owner) name do not exist
+		 * there are no names before the zone name in the zone
 		 * but the qname must be a subdomain of the zone name(next). */
 		if(dname_canonical_compare(owner, qname) < 0 &&
 			dname_strict_subdomain_c(qname, next))
@@ -451,7 +451,7 @@ val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec, uint8_t* qname)
 	return 0;
 }
 
-int val_nsec_proves_insecuredelegation(struct ub_packed_rrset_key* nsec, 
+int val_nsec_proves_insecuredelegation(struct ub_packed_rrset_key* nsec,
 	struct query_info* qinfo)
 {
 	if(nsec_has_type(nsec, LDNS_RR_TYPE_NS) &&
@@ -472,7 +472,7 @@ int val_nsec_proves_insecuredelegation(struct ub_packed_rrset_key* nsec,
 	return 0;
 }
 
-uint8_t* 
+uint8_t*
 nsec_closest_encloser(uint8_t* qname, struct ub_packed_rrset_key* nsec)
 {
 	uint8_t* next;
@@ -488,11 +488,11 @@ nsec_closest_encloser(uint8_t* qname, struct ub_packed_rrset_key* nsec)
 	return common2;
 }
 
-int val_nsec_proves_positive_wildcard(struct ub_packed_rrset_key* nsec, 
+int val_nsec_proves_positive_wildcard(struct ub_packed_rrset_key* nsec,
 	struct query_info* qinf, uint8_t* wc)
 {
 	uint8_t* ce;
-	/*  1) prove that qname doesn't exist and 
+	/*  1) prove that qname doesn't exist and
 	 *  2) that the correct wildcard was used
 	 *  nsec has been verified already. */
 	if(!val_nsec_proves_name_error(nsec, qinf->qname))
@@ -507,11 +507,11 @@ int val_nsec_proves_positive_wildcard(struct ub_packed_rrset_key* nsec,
 	return 1;
 }
 
-int 
-val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname, 
+int
+val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname,
 	size_t qnamelen)
 {
-	/* Determine if a NSEC record proves the non-existence of a 
+	/* Determine if a NSEC record proves the non-existence of a
 	 * wildcard that could have produced qname. */
 	int labs;
 	uint8_t* ce = nsec_closest_encloser(qname, nsec);
@@ -522,7 +522,7 @@ val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname,
 		return 0;
 	/* we can subtract the closest encloser count - since that is the
 	 * largest shared topdomain with owner and next NSEC name,
-	 * because the NSEC is no proof for names shorter than the owner 
+	 * because the NSEC is no proof for names shorter than the owner
 	 * and next names. */
 	labs = dname_count_labels(qname) - dname_count_labels(ce);
 
diff --git a/usr.sbin/unbound/validator/val_nsec.h b/usr.sbin/unbound/validator/val_nsec.h
index 7117809d6..289ae8812 100644
--- a/usr.sbin/unbound/validator/val_nsec.h
+++ b/usr.sbin/unbound/validator/val_nsec.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -69,15 +69,15 @@ struct key_entry_key;
  * @return security status.
  *	SECURE: proved absence of DS.
  *	INSECURE: proved that this was not a delegation point.
- *	BOGUS: crypto bad, or no absence of DS proven. 
+ *	BOGUS: crypto bad, or no absence of DS proven.
  *	UNCHECKED: there was no way to prove anything (no NSECs, unknown algo).
  */
 enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env,
-	struct val_env* ve, struct query_info* qinfo, 
+	struct val_env* ve, struct query_info* qinfo,
 	struct reply_info* rep, struct key_entry_key* kkey,
 	time_t* proof_ttl, char** reason, struct module_qstate* qstate);
 
-/** 
+/**
  * nsec typemap check, takes an NSEC-type bitmap as argument, checks for type.
  * @param bitmap: pointer to the bitmap part of wireformat rdata.
  * @param len: length of the bitmap, in bytes.
@@ -112,7 +112,7 @@ int nsec_has_type(struct ub_packed_rrset_key* nsec, uint16_t type);
  * 	nextcloser of qname.
  * @return true if NSEC proves this.
  */
-int nsec_proves_nodata(struct ub_packed_rrset_key* nsec, 
+int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 	struct query_info* qinfo, uint8_t** wc);
 
 /**
@@ -123,7 +123,7 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
  * @param qname: what was queried.
  * @return true if proven.
  */
-int val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec, 
+int val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec,
 	uint8_t* qname);
 
 /**
@@ -133,18 +133,18 @@ int val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec,
  * @param wc: wildcard (without *. label)
  * @return true if proven.
  */
-int val_nsec_proves_positive_wildcard(struct ub_packed_rrset_key* nsec, 
+int val_nsec_proves_positive_wildcard(struct ub_packed_rrset_key* nsec,
 	struct query_info* qinf, uint8_t* wc);
 
 /**
  * Determine closest encloser of a query name and the NSEC that covers it
- * (and thus disproved it). 
+ * (and thus disproved it).
  * A name error must have been proven already, otherwise this will be invalid.
  * @param qname: the name queried for.
  * @param nsec: the nsec RRset.
  * @return closest encloser dname or NULL on error (bad nsec RRset).
  */
-uint8_t* nsec_closest_encloser(uint8_t* qname, 
+uint8_t* nsec_closest_encloser(uint8_t* qname,
 	struct ub_packed_rrset_key* nsec);
 
 /**
@@ -155,7 +155,7 @@ uint8_t* nsec_closest_encloser(uint8_t* qname,
  * @param qnamelen: length of qname.
  * @return true if proven.
  */
-int val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname, 
+int val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname,
 	size_t qnamelen);
 
 /**
diff --git a/usr.sbin/unbound/validator/val_nsec3.c b/usr.sbin/unbound/validator/val_nsec3.c
index a2b3794f6..c5726c3c7 100644
--- a/usr.sbin/unbound/validator/val_nsec3.c
+++ b/usr.sbin/unbound/validator/val_nsec3.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -58,17 +58,17 @@
 #include "validator/val_nsec.h"
 #include "sldns/sbuffer.h"
 
-/** 
- * This function we get from ldns-compat or from base system 
+/**
+ * This function we get from ldns-compat or from base system
  * it returns the number of data bytes stored at the target, or <0 on error.
  */
 int sldns_b32_ntop_extended_hex(uint8_t const *src, size_t srclength,
 	char *target, size_t targsize);
-/** 
- * This function we get from ldns-compat or from base system 
+/**
+ * This function we get from ldns-compat or from base system
  * it returns the number of data bytes stored at the target, or <0 on error.
  */
-int sldns_b32_pton_extended_hex(char const *src, size_t hashed_owner_str_len, 
+int sldns_b32_pton_extended_hex(char const *src, size_t hashed_owner_str_len,
 	uint8_t *target, size_t targsize);
 
 /**
@@ -255,7 +255,7 @@ size_t nsec3_hash_to_b32(uint8_t* hash, size_t hashlen, uint8_t* zone,
 	if(max < hashlen*2+1) /* quick approx of b32, as if hexb16 */
 		return 0;
 	ret = sldns_b32_ntop_extended_hex(hash, hashlen, (char*)buf+1, max-1);
-	if(ret < 1) 
+	if(ret < 1)
 		return 0;
 	buf[0] = (uint8_t)ret; /* length of b32 label */
 	ret++;
@@ -291,31 +291,31 @@ nsec3_has_type(struct ub_packed_rrset_key* rrset, int r, uint16_t type)
 	/* skip salt */
 	if(d->rr_len[r] < skiplen+1)
 		return 0; /* malformed, too short */
-	skiplen += 1+(size_t)d->rr_data[r][skiplen]; 
+	skiplen += 1+(size_t)d->rr_data[r][skiplen];
 	/* skip next hashed owner */
 	if(d->rr_len[r] < skiplen+1)
 		return 0; /* malformed, too short */
-	skiplen += 1+(size_t)d->rr_data[r][skiplen]; 
+	skiplen += 1+(size_t)d->rr_data[r][skiplen];
 	if(d->rr_len[r] < skiplen)
 		return 0; /* malformed, too short */
 	bitlen = d->rr_len[r] - skiplen;
 	bitmap = d->rr_data[r]+skiplen;
 	return nsecbitmap_has_type_rdata(bitmap, bitlen, type);
 }
-	
-/** 
- * Iterate through NSEC3 list, per RR 
- * This routine gives the next RR in the list (or sets rrset null). 
+
+/**
+ * Iterate through NSEC3 list, per RR
+ * This routine gives the next RR in the list (or sets rrset null).
  * Usage:
  *
  * size_t rrsetnum;
  * int rrnum;
  * struct ub_packed_rrset_key* rrset;
- * for(rrset=filter_first(filter, &rrsetnum, &rrnum); rrset; 
+ * for(rrset=filter_first(filter, &rrsetnum, &rrnum); rrset;
  *	rrset=filter_next(filter, &rrsetnum, &rrnum))
  *		do_stuff;
- * 
- * Also filters out 
+ *
+ * Also filters out
  * 	o unknown flag NSEC3s
  * 	o unknown algorithm NSEC3s.
  * @param filter: nsec3 filter structure.
@@ -335,8 +335,8 @@ filter_next(struct nsec3_filter* filter, size_t* rrsetnum, int* rrnum)
 	for(i=*rrsetnum; i<filter->num; i++) {
 		/* see if RRset qualifies */
 		if(ntohs(filter->list[i]->rk.type) != LDNS_RR_TYPE_NSEC3 ||
-			ntohs(filter->list[i]->rk.rrset_class) != 
-			filter->fclass) 
+			ntohs(filter->list[i]->rk.rrset_class) !=
+			filter->fclass)
 			continue;
 		/* check RRset zone */
 		nm = filter->list[i]->rk.dname;
@@ -389,7 +389,7 @@ nsec3_rrset_has_known(struct ub_packed_rrset_key* s)
 	return 0;
 }
 
-/** 
+/**
  * Initialize the filter structure.
  * Finds the zone by looking at available NSEC3 records and best match.
  * 	(skips the unknown flag and unknown algo NSEC3s).
@@ -397,7 +397,7 @@ nsec3_rrset_has_known(struct ub_packed_rrset_key* s)
  * @param filter: nsec3 filter structure.
  * @param list: list of rrsets, an array of them.
  * @param num: number of rrsets in list.
- * @param qinfo: 
+ * @param qinfo:
  *	query name to match a zone for.
  *	query type (if DS a higher zone must be chosen)
  *	qclass, to filter NSEC3s with.
@@ -417,7 +417,7 @@ filter_init(struct nsec3_filter* filter, struct ub_packed_rrset_key** list,
 	for(i=0; i<num; i++) {
 		/* ignore other stuff in the list */
 		if(ntohs(list[i]->rk.type) != LDNS_RR_TYPE_NSEC3 ||
-			ntohs(list[i]->rk.rrset_class) != qinfo->qclass) 
+			ntohs(list[i]->rk.rrset_class) != qinfo->qclass)
 			continue;
 		/* skip unknown flags, algo */
 		if(!nsec3_rrset_has_known(list[i]))
@@ -433,7 +433,7 @@ filter_init(struct nsec3_filter* filter, struct ub_packed_rrset_key** list,
 		if(dname_subdomain_c(qinfo->qname, nm) && (!filter->zone ||
 			dname_subdomain_c(nm, filter->zone))) {
 			/* for a type DS do not accept a zone equal to qname*/
-			if(qinfo->qtype == LDNS_RR_TYPE_DS && 
+			if(qinfo->qtype == LDNS_RR_TYPE_DS &&
 				query_dname_compare(qinfo->qname, nm) == 0 &&
 				!dname_is_root(qinfo->qname))
 				continue;
@@ -463,7 +463,7 @@ get_max_iter(struct val_env* ve, size_t bits)
 	return ve->nsec3_maxiter[ve->nsec3_keyiter_count-1];
 }
 
-/** 
+/**
  * Determine if any of the NSEC3 rrs iteration count is too high, from key.
  * @param ve: validator environment with iteration count config settings.
  * @param filter: what NSEC3s to loop over.
@@ -471,7 +471,7 @@ get_max_iter(struct val_env* ve, size_t bits)
  * @return 1 if some nsec3s are above the max iteration count.
  */
 static int
-nsec3_iteration_count_high(struct val_env* ve, struct nsec3_filter* filter, 
+nsec3_iteration_count_high(struct val_env* ve, struct nsec3_filter* filter,
 	struct key_entry_key* kkey)
 {
 	size_t rrsetnum;
@@ -483,7 +483,7 @@ nsec3_iteration_count_high(struct val_env* ve, struct nsec3_filter* filter,
 	verbose(VERB_ALGO, "nsec3: keysize %d bits, max iterations %d",
 		(int)bits, (int)max_iter);
 
-	for(rrset=filter_first(filter, &rrsetnum, &rrnum); rrset; 
+	for(rrset=filter_first(filter, &rrsetnum, &rrnum); rrset;
 		rrset=filter_next(filter, &rrsetnum, &rrnum)) {
 		if(nsec3_get_iter(rrset, rrnum) > max_iter)
 			return 1;
@@ -493,7 +493,7 @@ nsec3_iteration_count_high(struct val_env* ve, struct nsec3_filter* filter,
 
 /* nsec3_cache_compare for rbtree */
 int
-nsec3_hash_cmp(const void* c1, const void* c2) 
+nsec3_hash_cmp(const void* c1, const void* c2)
 {
 	struct nsec3_cached_hash* h1 = (struct nsec3_cached_hash*)c1;
 	struct nsec3_cached_hash* h2 = (struct nsec3_cached_hash*)c2;
@@ -533,7 +533,7 @@ nsec3_hash_cmp(const void* c1, const void* c2)
 }
 
 size_t
-nsec3_get_hashed(sldns_buffer* buf, uint8_t* nm, size_t nmlen, int algo, 
+nsec3_get_hashed(sldns_buffer* buf, uint8_t* nm, size_t nmlen, int algo,
 	size_t iter, uint8_t* salt, size_t saltlen, uint8_t* res, size_t max)
 {
 	size_t i, hash_len;
@@ -568,7 +568,7 @@ nsec3_get_hashed(sldns_buffer* buf, uint8_t* nm, size_t nmlen, int algo,
 
 /** perform hash of name */
 static int
-nsec3_calc_hash(struct regional* region, sldns_buffer* buf, 
+nsec3_calc_hash(struct regional* region, sldns_buffer* buf,
 	struct nsec3_cached_hash* c)
 {
 	int algo = nsec3_get_algo(c->nsec3, c->rr);
@@ -607,7 +607,7 @@ nsec3_calc_hash(struct regional* region, sldns_buffer* buf,
 
 /** perform b32 encoding of hash */
 static int
-nsec3_calc_b32(struct regional* region, sldns_buffer* buf, 
+nsec3_calc_b32(struct regional* region, sldns_buffer* buf,
 	struct nsec3_cached_hash* c)
 {
 	int r;
@@ -619,7 +619,7 @@ nsec3_calc_b32(struct regional* region, sldns_buffer* buf,
 		return 0;
 	}
 	c->b32_len = (size_t)r;
-	c->b32 = regional_alloc_init(region, sldns_buffer_begin(buf), 
+	c->b32 = regional_alloc_init(region, sldns_buffer_begin(buf),
 		c->b32_len);
 	if(!c->b32)
 		return 0;
@@ -628,7 +628,7 @@ nsec3_calc_b32(struct regional* region, sldns_buffer* buf,
 
 int
 nsec3_hash_name(rbtree_type* table, struct regional* region, sldns_buffer* buf,
-	struct ub_packed_rrset_key* nsec3, int rr, uint8_t* dname, 
+	struct ub_packed_rrset_key* nsec3, int rr, uint8_t* dname,
 	size_t dname_len, struct nsec3_cached_hash** hash)
 {
 	struct nsec3_cached_hash* c;
@@ -700,15 +700,15 @@ label_compare_lower(uint8_t* lab1, uint8_t* lab2, size_t lablen)
  * @return true if matches exactly, false if not.
  */
 static int
-nsec3_hash_matches_owner(struct nsec3_filter* flt, 
+nsec3_hash_matches_owner(struct nsec3_filter* flt,
 	struct nsec3_cached_hash* hash, struct ub_packed_rrset_key* s)
 {
 	uint8_t* nm = s->rk.dname;
 	/* compare, does hash of name based on params in this NSEC3
-	 * match the owner name of this NSEC3? 
-	 * name must be: <hashlength>base32 . zone name 
+	 * match the owner name of this NSEC3?
+	 * name must be: <hashlength>base32 . zone name
 	 * so; first label must not be root label (not zero length),
-	 * and match the b32 encoded hash length, 
+	 * and match the b32 encoded hash length,
 	 * and the label content match the b32 encoded hash
 	 * and the rest must be the zone name.
 	 */
@@ -734,7 +734,7 @@ nsec3_hash_matches_owner(struct nsec3_filter* flt,
  */
 static int
 find_matching_nsec3(struct module_env* env, struct nsec3_filter* flt,
-	rbtree_type* ct, uint8_t* nm, size_t nmlen, 
+	rbtree_type* ct, uint8_t* nm, size_t nmlen,
 	struct ub_packed_rrset_key** rrset, int* rr)
 {
 	size_t i_rs;
@@ -744,7 +744,7 @@ find_matching_nsec3(struct module_env* env, struct nsec3_filter* flt,
 	int r;
 
 	/* this loop skips other-zone and unknown NSEC3s, also non-NSEC3 RRs */
-	for(s=filter_first(flt, &i_rs, &i_rr); s; 
+	for(s=filter_first(flt, &i_rs, &i_rr); s;
 		s=filter_next(flt, &i_rs, &i_rr)) {
 		/* get name hashed for this NSEC3 RR */
 		r = nsec3_hash_name(ct, env->scratch, env->scratch_buffer,
@@ -776,32 +776,32 @@ nsec3_covers(uint8_t* zone, struct nsec3_cached_hash* hash,
 		return 0; /* malformed RR proves nothing */
 
 	/* check the owner name is a hashed value . apex
-	 * base32 encoded values must have equal length. 
+	 * base32 encoded values must have equal length.
 	 * hash_value and next hash value must have equal length. */
-	if(nextlen != hash->hash_len || hash->hash_len==0||hash->b32_len==0|| 
+	if(nextlen != hash->hash_len || hash->hash_len==0||hash->b32_len==0||
 		(size_t)*rrset->rk.dname != hash->b32_len ||
 		query_dname_compare(rrset->rk.dname+1+
 			(size_t)*rrset->rk.dname, zone) != 0)
 		return 0; /* bad lengths or owner name */
 
 	/* This is the "normal case: owner < next and owner < hash < next */
-	if(label_compare_lower(rrset->rk.dname+1, hash->b32, 
-		hash->b32_len) < 0 && 
+	if(label_compare_lower(rrset->rk.dname+1, hash->b32,
+		hash->b32_len) < 0 &&
 		memcmp(hash->hash, next, nextlen) < 0)
 		return 1;
 
 	/* convert owner name from text to binary */
 	sldns_buffer_clear(buf);
 	owner = sldns_buffer_begin(buf);
-	len = sldns_b32_pton_extended_hex((char*)rrset->rk.dname+1, 
+	len = sldns_b32_pton_extended_hex((char*)rrset->rk.dname+1,
 		hash->b32_len, owner, sldns_buffer_limit(buf));
 	if(len<1)
 		return 0; /* bad owner name in some way */
 	if((size_t)len != hash->hash_len || (size_t)len != nextlen)
 		return 0; /* wrong length */
 
-	/* this is the end of zone case: next <= owner && 
-	 * 	(hash > owner || hash < next) 
+	/* this is the end of zone case: next <= owner &&
+	 * 	(hash > owner || hash < next)
 	 * this also covers the only-apex case of next==owner.
 	 */
 	if(memcmp(next, owner, nextlen) <= 0 &&
@@ -827,7 +827,7 @@ nsec3_covers(uint8_t* zone, struct nsec3_cached_hash* hash,
  */
 static int
 find_covering_nsec3(struct module_env* env, struct nsec3_filter* flt,
-        rbtree_type* ct, uint8_t* nm, size_t nmlen, 
+        rbtree_type* ct, uint8_t* nm, size_t nmlen,
 	struct ub_packed_rrset_key** rrset, int* rr)
 {
 	size_t i_rs;
@@ -837,7 +837,7 @@ find_covering_nsec3(struct module_env* env, struct nsec3_filter* flt,
 	int r;
 
 	/* this loop skips other-zone and unknown NSEC3s, also non-NSEC3 RRs */
-	for(s=filter_first(flt, &i_rs, &i_rr); s; 
+	for(s=filter_first(flt, &i_rs, &i_rr); s;
 		s=filter_next(flt, &i_rs, &i_rr)) {
 		/* get name hashed for this NSEC3 RR */
 		r = nsec3_hash_name(ct, env->scratch, env->scratch_buffer,
@@ -847,7 +847,7 @@ find_covering_nsec3(struct module_env* env, struct nsec3_filter* flt,
 			break; /* alloc failure */
 		} else if(r != 1)
 			continue; /* malformed NSEC3 */
-		else if(nsec3_covers(flt->zone, hash, s, i_rr, 
+		else if(nsec3_covers(flt->zone, hash, s, i_rr,
 			env->scratch_buffer)) {
 			*rrset = s; /* rrset with this name */
 			*rr = i_rr; /* covers hash with these parameters */
@@ -872,23 +872,23 @@ find_covering_nsec3(struct module_env* env, struct nsec3_filter* flt,
  * @return true if a closest encloser candidate is found, false if not.
  */
 static int
-nsec3_find_closest_encloser(struct module_env* env, struct nsec3_filter* flt, 
+nsec3_find_closest_encloser(struct module_env* env, struct nsec3_filter* flt,
 	rbtree_type* ct, struct query_info* qinfo, struct ce_response* ce)
 {
 	uint8_t* nm = qinfo->qname;
 	size_t nmlen = qinfo->qname_len;
 
-	/* This scans from longest name to shortest, so the first match 
+	/* This scans from longest name to shortest, so the first match
 	 * we find is the only viable candidate. */
 
-	/* (David:) FIXME: modify so that the NSEC3 matching the zone apex need 
+	/* (David:) FIXME: modify so that the NSEC3 matching the zone apex need
 	 * not be present. (Mark Andrews idea).
 	 * (Wouter:) But make sure you check for DNAME bit in zone apex,
 	 * if the NSEC3 you find is the only NSEC3 in the zone, then this
 	 * may be the case. */
 
 	while(dname_subdomain_c(nm, flt->zone)) {
-		if(find_matching_nsec3(env, flt, ct, nm, nmlen, 
+		if(find_matching_nsec3(env, flt, ct, nm, nmlen,
 			&ce->ce_rrset, &ce->ce_rr)) {
 			ce->ce = nm;
 			ce->ce_len = nmlen;
@@ -911,7 +911,7 @@ nsec3_find_closest_encloser(struct module_env* env, struct nsec3_filter* flt,
  * @param nmlen: length of nm.
  */
 static void
-next_closer(uint8_t* qname, size_t qnamelen, uint8_t* ce, 
+next_closer(uint8_t* qname, size_t qnamelen, uint8_t* ce,
 	uint8_t** nm, size_t* nmlen)
 {
 	int strip = dname_count_labels(qname) - dname_count_labels(ce) -1;
@@ -928,9 +928,9 @@ next_closer(uint8_t* qname, size_t qnamelen, uint8_t* ce,
  * @param flt: the NSEC3 RR filter, contains zone name and RRs.
  * @param ct: cached hashes table.
  * @param qinfo: query that is verified for.
- * @param prove_does_not_exist: If true, then if the closest encloser 
+ * @param prove_does_not_exist: If true, then if the closest encloser
  * 	turns out to be qname, then null is returned.
- * 	If set true, and the return value is true, then you can be 
+ * 	If set true, and the return value is true, then you can be
  * 	certain that the ce.nc_rrset and ce.nc_rr are set properly.
  * @param ce: closest encloser information is returned in here.
  * @return bogus if no closest encloser could be proven.
@@ -939,7 +939,7 @@ next_closer(uint8_t* qname, size_t qnamelen, uint8_t* ce,
  * 		that an insecure delegation exists above the qname.
  */
 static enum sec_status
-nsec3_prove_closest_encloser(struct module_env* env, struct nsec3_filter* flt, 
+nsec3_prove_closest_encloser(struct module_env* env, struct nsec3_filter* flt,
 	rbtree_type* ct, struct query_info* qinfo, int prove_does_not_exist,
 	struct ce_response* ce)
 {
@@ -961,13 +961,13 @@ nsec3_prove_closest_encloser(struct module_env* env, struct nsec3_filter* flt,
 				"proved that qname existed, bad");
 			return sec_status_bogus;
 		}
-		/* otherwise, we need to nothing else to prove that qname 
+		/* otherwise, we need to nothing else to prove that qname
 		 * is its own closest encloser. */
 		return sec_status_secure;
 	}
 
-	/* If the closest encloser is actually a delegation, then the 
-	 * response should have been a referral. If it is a DNAME, then 
+	/* If the closest encloser is actually a delegation, then the
+	 * response should have been a referral. If it is a DNAME, then
 	 * it should have been a DNAME response. */
 	if(nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_NS) &&
 		!nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_SOA)) {
@@ -985,10 +985,10 @@ nsec3_prove_closest_encloser(struct module_env* env, struct nsec3_filter* flt,
 			"encloser was a DNAME, bad");
 		return sec_status_bogus;
 	}
-	
+
 	/* Otherwise, we need to show that the next closer name is covered. */
 	next_closer(qinfo->qname, qinfo->qname_len, ce->ce, &nc, &nc_len);
-	if(!find_covering_nsec3(env, flt, ct, nc, nc_len, 
+	if(!find_covering_nsec3(env, flt, ct, nc, nc_len,
 		&ce->nc_rrset, &ce->nc_rr)) {
 		verbose(VERB_ALGO, "nsec3: Could not find proof that the "
 		          "candidate encloser was the closest encloser");
@@ -1019,7 +1019,7 @@ nsec3_ce_wildcard(struct regional* region, uint8_t* ce, size_t celen,
 
 /** Do the name error proof */
 static enum sec_status
-nsec3_do_prove_nameerror(struct module_env* env, struct nsec3_filter* flt, 
+nsec3_do_prove_nameerror(struct module_env* env, struct nsec3_filter* flt,
 	rbtree_type* ct, struct query_info* qinfo)
 {
 	struct ce_response ce;
@@ -1029,8 +1029,8 @@ nsec3_do_prove_nameerror(struct module_env* env, struct nsec3_filter* flt,
 	int wc_rr;
 	enum sec_status sec;
 
-	/* First locate and prove the closest encloser to qname. We will 
-	 * use the variant that fails if the closest encloser turns out 
+	/* First locate and prove the closest encloser to qname. We will
+	 * use the variant that fails if the closest encloser turns out
 	 * to be qname. */
 	sec = nsec3_prove_closest_encloser(env, flt, ct, qinfo, 1, &ce);
 	if(sec != sec_status_secure) {
@@ -1043,11 +1043,11 @@ nsec3_do_prove_nameerror(struct module_env* env, struct nsec3_filter* flt,
 	}
 	log_nametypeclass(VERB_ALGO, "nsec3 nameerror: proven ce=", ce.ce,0,0);
 
-	/* At this point, we know that qname does not exist. Now we need 
+	/* At this point, we know that qname does not exist. Now we need
 	 * to prove that the wildcard does not exist. */
 	log_assert(ce.ce);
 	wc = nsec3_ce_wildcard(env->scratch, ce.ce, ce.ce_len, &wclen);
-	if(!wc || !find_covering_nsec3(env, flt, ct, wc, wclen, 
+	if(!wc || !find_covering_nsec3(env, flt, ct, wc, wclen,
 		&wc_rrset, &wc_rr)) {
 		verbose(VERB_ALGO, "nsec3 nameerror proof: could not prove "
 			"that the applicable wildcard did not exist.");
@@ -1077,19 +1077,19 @@ nsec3_prove_nameerror(struct module_env* env, struct val_env* ve,
 		return sec_status_bogus; /* no RRs */
 	if(nsec3_iteration_count_high(ve, &flt, kkey))
 		return sec_status_insecure; /* iteration count too high */
-	log_nametypeclass(VERB_ALGO, "start nsec3 nameerror proof, zone", 
+	log_nametypeclass(VERB_ALGO, "start nsec3 nameerror proof, zone",
 		flt.zone, 0, 0);
 	return nsec3_do_prove_nameerror(env, &flt, &ct, qinfo);
 }
 
-/* 
- * No code to handle qtype=NSEC3 specially. 
+/*
+ * No code to handle qtype=NSEC3 specially.
  * This existed in early drafts, but was later (-05) removed.
  */
 
 /** Do the nodata proof */
 static enum sec_status
-nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt, 
+nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt,
 	rbtree_type* ct, struct query_info* qinfo)
 {
 	struct ce_response ce;
@@ -1099,7 +1099,7 @@ nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt,
 	int rr;
 	enum sec_status sec;
 
-	if(find_matching_nsec3(env, flt, ct, qinfo->qname, qinfo->qname_len, 
+	if(find_matching_nsec3(env, flt, ct, qinfo->qname, qinfo->qname_len,
 		&rrset, &rr)) {
 		/* cases 1 and 2 */
 		if(nsec3_has_type(rrset, rr, qinfo->qtype)) {
@@ -1112,9 +1112,9 @@ nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt,
 			return sec_status_bogus;
 		}
 
-		/* 
+		/*
 		 * If type DS: filter_init zone find already found a parent
-		 *   zone, so this nsec3 is from a parent zone. 
+		 *   zone, so this nsec3 is from a parent zone.
 		 *   o can be not a delegation (unusual query for normal name,
 		 *   	no DS anyway, but we can verify that).
 		 *   o can be a delegation (which is the usual DS check).
@@ -1124,13 +1124,13 @@ nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt,
 		 *
 		 * If not type DS: matching nsec3 must not be a delegation.
 		 */
-		if(qinfo->qtype == LDNS_RR_TYPE_DS && qinfo->qname_len != 1 
+		if(qinfo->qtype == LDNS_RR_TYPE_DS && qinfo->qname_len != 1
 			&& nsec3_has_type(rrset, rr, LDNS_RR_TYPE_SOA) &&
 			!dname_is_root(qinfo->qname)) {
 			verbose(VERB_ALGO, "proveNodata: apex NSEC3 "
 				"abused for no DS proof, bogus");
 			return sec_status_bogus;
-		} else if(qinfo->qtype != LDNS_RR_TYPE_DS && 
+		} else if(qinfo->qtype != LDNS_RR_TYPE_DS &&
 			nsec3_has_type(rrset, rr, LDNS_RR_TYPE_NS) &&
 			!nsec3_has_type(rrset, rr, LDNS_RR_TYPE_SOA)) {
 			if(!nsec3_has_type(rrset, rr, LDNS_RR_TYPE_DS)) {
@@ -1145,8 +1145,8 @@ nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt,
 		return sec_status_secure;
 	}
 
-	/* For cases 3 - 5, we need the proven closest encloser, and it 
-	 * can't match qname. Although, at this point, we know that it 
+	/* For cases 3 - 5, we need the proven closest encloser, and it
+	 * can't match qname. Although, at this point, we know that it
 	 * won't since we just checked that. */
 	sec = nsec3_prove_closest_encloser(env, flt, ct, qinfo, 1, &ce);
 	if(sec == sec_status_bogus) {
@@ -1175,12 +1175,12 @@ nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt,
 				"wildcard had a CNAME, bogus");
 			return sec_status_bogus;
 		}
-		if(qinfo->qtype == LDNS_RR_TYPE_DS && qinfo->qname_len != 1 
+		if(qinfo->qtype == LDNS_RR_TYPE_DS && qinfo->qname_len != 1
 			&& nsec3_has_type(rrset, rr, LDNS_RR_TYPE_SOA)) {
 			verbose(VERB_ALGO, "nsec3 nodata proof: matching "
 				"wildcard for no DS proof has a SOA, bogus");
 			return sec_status_bogus;
-		} else if(qinfo->qtype != LDNS_RR_TYPE_DS && 
+		} else if(qinfo->qtype != LDNS_RR_TYPE_DS &&
 			nsec3_has_type(rrset, rr, LDNS_RR_TYPE_NS) &&
 			!nsec3_has_type(rrset, rr, LDNS_RR_TYPE_SOA)) {
 			verbose(VERB_ALGO, "nsec3 nodata proof: matching "
@@ -1261,8 +1261,8 @@ nsec3_prove_wildcard(struct module_env* env, struct val_env* ve,
 	if(nsec3_iteration_count_high(ve, &flt, kkey))
 		return sec_status_insecure; /* iteration count too high */
 
-	/* We know what the (purported) closest encloser is by just 
-	 * looking at the supposed generating wildcard. 
+	/* We know what the (purported) closest encloser is by just
+	 * looking at the supposed generating wildcard.
 	 * The *. has already been removed from the wc name.
 	 */
 	memset(&ce, 0, sizeof(ce));
@@ -1272,7 +1272,7 @@ nsec3_prove_wildcard(struct module_env* env, struct val_env* ve,
 	/* Now we still need to prove that the original data did not exist.
 	 * Otherwise, we need to show that the next closer name is covered. */
 	next_closer(qinfo->qname, qinfo->qname_len, ce.ce, &nc, &nc_len);
-	if(!find_covering_nsec3(env, &flt, &ct, nc, nc_len, 
+	if(!find_covering_nsec3(env, &flt, &ct, nc, nc_len,
 		&ce.nc_rrset, &ce.nc_rr)) {
 		verbose(VERB_ALGO, "proveWildcard: did not find a covering "
 			"NSEC3 that covered the next closer name.");
@@ -1287,7 +1287,7 @@ nsec3_prove_wildcard(struct module_env* env, struct val_env* ve,
 
 /** test if list is all secure */
 static int
-list_is_secure(struct module_env* env, struct val_env* ve, 
+list_is_secure(struct module_env* env, struct val_env* ve,
 	struct ub_packed_rrset_key** list, size_t num,
 	struct key_entry_key* kkey, char** reason, sldns_ede_code *reason_bogus,
 	struct module_qstate* qstate)
@@ -1344,14 +1344,14 @@ nsec3_prove_nods(struct module_env* env, struct val_env* ve,
 	if(nsec3_iteration_count_high(ve, &flt, kkey))
 		return sec_status_insecure; /* iteration count too high */
 
-	/* Look for a matching NSEC3 to qname -- this is the normal 
+	/* Look for a matching NSEC3 to qname -- this is the normal
 	 * NODATA case. */
-	if(find_matching_nsec3(env, &flt, &ct, qinfo->qname, qinfo->qname_len, 
+	if(find_matching_nsec3(env, &flt, &ct, qinfo->qname, qinfo->qname_len,
 		&rrset, &rr)) {
-		/* If the matching NSEC3 has the SOA bit set, it is from 
-		 * the wrong zone (the child instead of the parent). If 
+		/* If the matching NSEC3 has the SOA bit set, it is from
+		 * the wrong zone (the child instead of the parent). If
 		 * it has the DS bit set, then we were lied to. */
-		if(nsec3_has_type(rrset, rr, LDNS_RR_TYPE_SOA) && 
+		if(nsec3_has_type(rrset, rr, LDNS_RR_TYPE_SOA) &&
 			qinfo->qname_len != 1) {
 			verbose(VERB_ALGO, "nsec3 provenods: NSEC3 is from"
 				" child zone, bogus");
@@ -1363,7 +1363,7 @@ nsec3_prove_nods(struct module_env* env, struct val_env* ve,
 			*reason = "NSEC3 has DS in bitmap";
 			return sec_status_bogus;
 		}
-		/* If the NSEC3 RR doesn't have the NS bit set, then 
+		/* If the NSEC3 RR doesn't have the NS bit set, then
 		 * this wasn't a delegation point. */
 		if(!nsec3_has_type(rrset, rr, LDNS_RR_TYPE_NS))
 			return sec_status_indeterminate;
@@ -1407,7 +1407,7 @@ nsec3_prove_nods(struct module_env* env, struct val_env* ve,
 
 enum sec_status
 nsec3_prove_nxornodata(struct module_env* env, struct val_env* ve,
-	struct ub_packed_rrset_key** list, size_t num, 
+	struct ub_packed_rrset_key** list, size_t num,
 	struct query_info* qinfo, struct key_entry_key* kkey, int* nodata)
 {
 	enum sec_status sec, secnx;
diff --git a/usr.sbin/unbound/validator/val_nsec3.h b/usr.sbin/unbound/validator/val_nsec3.h
index 7676fc8b2..f5c4141bf 100644
--- a/usr.sbin/unbound/validator/val_nsec3.h
+++ b/usr.sbin/unbound/validator/val_nsec3.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -111,30 +111,30 @@ struct sldns_buffer;
  * @param qinfo: query that is verified for.
  * @param kkey: key entry that signed the NSEC3s.
  * @return:
- * 	sec_status SECURE of the Name Error is proven by the NSEC3 RRs, 
+ * 	sec_status SECURE of the Name Error is proven by the NSEC3 RRs,
  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
  */
 enum sec_status
 nsec3_prove_nameerror(struct module_env* env, struct val_env* ve,
-	struct ub_packed_rrset_key** list, size_t num, 
+	struct ub_packed_rrset_key** list, size_t num,
 	struct query_info* qinfo, struct key_entry_key* kkey);
 
 /**
  * Determine if the NSEC3s provided in a response prove the NOERROR/NODATA
  * status. There are a number of different variants to this:
- * 
+ *
  * 1) Normal NODATA -- qname is matched to an NSEC3 record, type is not
  * present.
- * 
+ *
  * 2) ENT NODATA -- because there must be NSEC3 record for
  * empty-non-terminals, this is the same as #1.
- * 
+ *
  * 3) NSEC3 ownername NODATA -- qname matched an existing, lone NSEC3
  * ownername, but qtype was not NSEC3. NOTE: as of nsec-05, this case no
  * longer exists.
- * 
+ *
  * 4) Wildcard NODATA -- A wildcard matched the name, but not the type.
- * 
+ *
  * 5) Opt-In DS NODATA -- the qname is covered by an opt-in span and qtype ==
  * DS. (or maybe some future record with the same parent-side-only property)
  *
@@ -145,12 +145,12 @@ nsec3_prove_nameerror(struct module_env* env, struct val_env* ve,
  * @param qinfo: query that is verified for.
  * @param kkey: key entry that signed the NSEC3s.
  * @return:
- * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs, 
+ * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs,
  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
  */
 enum sec_status
 nsec3_prove_nodata(struct module_env* env, struct val_env* ve,
-	struct ub_packed_rrset_key** list, size_t num, 
+	struct ub_packed_rrset_key** list, size_t num,
 	struct query_info* qinfo, struct key_entry_key* kkey);
 
 
@@ -167,12 +167,12 @@ nsec3_prove_nodata(struct module_env* env, struct val_env* ve,
  * @param wc: The purported wildcard that matched. This is the wildcard name
  * 	as *.wildcard.name., with the *. label already removed.
  * @return:
- * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs, 
+ * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs,
  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
  */
 enum sec_status
 nsec3_prove_wildcard(struct module_env* env, struct val_env* ve,
-	struct ub_packed_rrset_key** list, size_t num, 
+	struct ub_packed_rrset_key** list, size_t num,
 	struct query_info* qinfo, struct key_entry_key* kkey, uint8_t* wc);
 
 /**
@@ -190,14 +190,14 @@ nsec3_prove_wildcard(struct module_env* env, struct val_env* ve,
  * @param reason_bogus: EDE (RFC8914) code paired with the reason of failure.
  * @param qstate: qstate with region.
  * @return:
- * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs, 
+ * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs,
  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
  * 	or if there was no DS in an insecure (i.e., opt-in) way,
  * 	INDETERMINATE if it was clear that this wasn't a delegation point.
  */
 enum sec_status
 nsec3_prove_nods(struct module_env* env, struct val_env* ve,
-	struct ub_packed_rrset_key** list, size_t num, 
+	struct ub_packed_rrset_key** list, size_t num,
 	struct query_info* qinfo, struct key_entry_key* kkey, char** reason,
 	sldns_ede_code* reason_bogus, struct module_qstate* qstate);
 
@@ -213,12 +213,12 @@ nsec3_prove_nods(struct module_env* env, struct val_env* ve,
  * @param nodata: if return value is secure, this indicates if nodata or
  * 	nxdomain was proven.
  * @return:
- * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs, 
+ * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs,
  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
  */
 enum sec_status
 nsec3_prove_nxornodata(struct module_env* env, struct val_env* ve,
-	struct ub_packed_rrset_key** list, size_t num, 
+	struct ub_packed_rrset_key** list, size_t num,
 	struct query_info* qinfo, struct key_entry_key* kkey, int* nodata);
 
 /**
@@ -308,7 +308,7 @@ size_t nsec3_get_nextowner_b32(struct ub_packed_rrset_key* rrset, int r,
 size_t nsec3_hash_to_b32(uint8_t* hash, size_t hashlen, uint8_t* zone,
 	size_t zonelen, uint8_t* buf, size_t max);
 
-/** 
+/**
  * Get NSEC3 parameters out of rr.
  * @param rrset: the NSEC3 rrset.
  * @param r: the rr num of the nsec3 in the rrset.
@@ -338,7 +338,7 @@ size_t nsec3_get_hashed(struct sldns_buffer* buf, uint8_t* nm, size_t nmlen,
 	int algo, size_t iter, uint8_t* salt, size_t saltlen, uint8_t* res,
 	size_t max);
 
-/** 
+/**
  * see if NSEC3 RR contains given type
  * @param rrset: NSEC3 rrset
  * @param r: RR in rrset
@@ -347,16 +347,16 @@ size_t nsec3_get_hashed(struct sldns_buffer* buf, uint8_t* nm, size_t nmlen,
  */
 int nsec3_has_type(struct ub_packed_rrset_key* rrset, int r, uint16_t type);
 
-/** 
- * return if nsec3 RR has the optout flag 
+/**
+ * return if nsec3 RR has the optout flag
  * @param rrset: NSEC3 rrset
  * @param r: RR in rrset
  * @return true if optout, false on error or not optout
  */
 int nsec3_has_optout(struct ub_packed_rrset_key* rrset, int r);
 
-/** 
- * Return nsec3 RR next hashed owner name 
+/**
+ * Return nsec3 RR next hashed owner name
  * @param rrset: NSEC3 rrset
  * @param r: RR in rrset
  * @param next: ptr into rdata to next owner hash
diff --git a/usr.sbin/unbound/validator/val_secalgo.c b/usr.sbin/unbound/validator/val_secalgo.c
index 786516749..d9c840d2e 100644
--- a/usr.sbin/unbound/validator/val_secalgo.c
+++ b/usr.sbin/unbound/validator/val_secalgo.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2012, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -268,7 +268,7 @@ static int
 do_gost94(unsigned char* data, size_t len, unsigned char* dest)
 {
 	const EVP_MD* md = EVP_get_digestbyname("md_gost94");
-	if(!md) 
+	if(!md)
 		return 0;
 	return sldns_digest_evp(data, (unsigned int)len, dest, md);
 }
@@ -318,8 +318,8 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
 #endif
 			return 1;
 #endif
-		default: 
-			verbose(VERB_QUERY, "unknown DS digest algorithm %d", 
+		default:
+			verbose(VERB_QUERY, "unknown DS digest algorithm %d",
 				algo);
 			break;
 	}
@@ -395,7 +395,7 @@ dnskey_algo_id_is_supported(int id)
 
 #ifdef USE_DSA
 /**
- * Setup DSA key digest in DER encoding ... 
+ * Setup DSA key digest in DER encoding ...
  * @param sig: input is signature output alloced ptr (unless failure).
  * 	caller must free alloced ptr if this routine returns true.
  * @param len: input is initial siglen, output is output len.
@@ -542,7 +542,7 @@ void ecdsa_evp_workaround_init(void)
  * @return false on failure.
  */
 static int
-setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type, 
+setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
 	unsigned char* key, size_t keylen)
 {
 	switch(algo) {
@@ -677,7 +677,7 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
 			break;
 #endif /* USE_ED448 */
 		default:
-			verbose(VERB_QUERY, "verify: unknown algorithm %d", 
+			verbose(VERB_QUERY, "verify: unknown algorithm %d",
 				algo);
 			return 0;
 	}
@@ -746,7 +746,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 	if(fake_sha1 && (algo == LDNS_DSA || algo == LDNS_DSA_NSEC3 || algo == LDNS_RSASHA1 || algo == LDNS_RSASHA1_NSEC3))
 		return sec_status_secure;
 #endif
-	
+
 	if(!setup_key_digest(algo, &evp_key, &digest_type, key, keylen)) {
 		verbose(VERB_QUERY, "verify: failed to setup key");
 		*reason = "use of key for crypto failed";
@@ -755,7 +755,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 	}
 #ifdef USE_DSA
 	/* if it is a DSA signature in bind format, convert to DER format */
-	if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) && 
+	if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&
 		sigblock_len == 1+2*SHA_DIGEST_LENGTH) {
 		if(!setup_dsa_sig(&sigblock, &sigblock_len)) {
 			verbose(VERB_QUERY, "verify: failed to setup DSA sig");
@@ -767,7 +767,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 	}
 #endif
 #if defined(USE_ECDSA) && defined(USE_DSA)
-	else 
+	else
 #endif
 #ifdef USE_ECDSA
 	if(algo == LDNS_ECDSAP256SHA256 || algo == LDNS_ECDSAP384SHA384) {
@@ -804,7 +804,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 			dofree, docrypto_free);
 		return sec;
 	}
-	if(EVP_DigestUpdate(ctx, (unsigned char*)sldns_buffer_begin(buf), 
+	if(EVP_DigestUpdate(ctx, (unsigned char*)sldns_buffer_begin(buf),
 		(unsigned int)sldns_buffer_limit(buf)) == 0) {
 		log_crypto_verbose(VERB_QUERY, "verify: EVP_DigestUpdate failed",
 			ERR_get_error());
@@ -989,8 +989,8 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
 				== SECSuccess;
 #endif
 		case LDNS_HASH_GOST:
-		default: 
-			verbose(VERB_QUERY, "unknown DS digest algorithm %d", 
+		default:
+			verbose(VERB_QUERY, "unknown DS digest algorithm %d",
 				algo);
 			break;
 	}
@@ -1198,7 +1198,7 @@ static SECKEYPublicKey* nss_buf2rsa(unsigned char* key, size_t len)
 	/* key length at least one */
 	if(len < (size_t)offset + exp + 1)
 		return NULL;
-	
+
 	exponent.data = key+offset;
 	exponent.len = exp;
 	offset += exp;
@@ -1250,7 +1250,7 @@ nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
 	static unsigned char p_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
 	0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};
 	/* from RFC6234 */
-	/* for future RSASHA384 .. 
+	/* for future RSASHA384 ..
 	static unsigned char p_sha384[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
 	0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30};
 	*/
@@ -1351,7 +1351,7 @@ nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
 #endif /* USE_ECDSA */
 		case LDNS_ECC_GOST:
 		default:
-			verbose(VERB_QUERY, "verify: unknown algorithm %d", 
+			verbose(VERB_QUERY, "verify: unknown algorithm %d",
 				algo);
 			return 0;
 	}
@@ -1372,7 +1372,7 @@ nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
  *	unchecked on format errors and alloc failures.
  */
 enum sec_status
-verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock, 
+verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 	unsigned int sigblock_len, unsigned char* key, unsigned int keylen,
 	char** reason)
 {
diff --git a/usr.sbin/unbound/validator/val_secalgo.h b/usr.sbin/unbound/validator/val_secalgo.h
index 8b6080dc2..5703ea7eb 100644
--- a/usr.sbin/unbound/validator/val_secalgo.h
+++ b/usr.sbin/unbound/validator/val_secalgo.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2012, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -113,7 +113,7 @@ void secalgo_hash_delete(struct secalgo_hash* hash);
 /**
  * Return size of DS digest according to its hash algorithm.
  * @param algo: DS digest algo.
- * @return size in bytes of digest, or 0 if not supported. 
+ * @return size in bytes of digest, or 0 if not supported.
  */
 size_t ds_digest_size_supported(int algo);
 
diff --git a/usr.sbin/unbound/validator/val_sigcrypt.c b/usr.sbin/unbound/validator/val_sigcrypt.c
index 5ab21e20e..36b3bbbba 100644
--- a/usr.sbin/unbound/validator/val_sigcrypt.c
+++ b/usr.sbin/unbound/validator/val_sigcrypt.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -104,7 +104,7 @@ rrset_get_sigcount(struct ub_packed_rrset_key* k)
  * @param sig_idx: signature index.
  * @return keytag or 0 if malformed rrsig.
  */
-static uint16_t 
+static uint16_t
 rrset_get_sig_keytag(struct ub_packed_rrset_key* k, size_t sig_idx)
 {
 	uint16_t t;
@@ -122,7 +122,7 @@ rrset_get_sig_keytag(struct ub_packed_rrset_key* k, size_t sig_idx)
  * @param sig_idx: signature index.
  * @return algo or 0 if malformed rrsig.
  */
-static int 
+static int
 rrset_get_sig_algo(struct ub_packed_rrset_key* k, size_t sig_idx)
 {
 	struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
@@ -224,7 +224,7 @@ ds_get_digest_algo(struct ub_packed_rrset_key* k, size_t idx)
 	return (int)rdata[2+3];
 }
 
-uint16_t 
+uint16_t
 ds_get_keytag(struct ub_packed_rrset_key* ds_rrset, size_t ds_idx)
 {
 	uint16_t t;
@@ -266,7 +266,7 @@ ds_get_sigdata(struct ub_packed_rrset_key* k, size_t idx, uint8_t** digest,
  * Return size of DS digest according to its hash algorithm.
  * @param k: DS rrset.
  * @param idx: which DS.
- * @return size in bytes of digest, or 0 if not supported. 
+ * @return size in bytes of digest, or 0 if not supported.
  */
 static size_t
 ds_digest_size_algo(struct ub_packed_rrset_key* k, size_t idx)
@@ -286,7 +286,7 @@ ds_digest_size_algo(struct ub_packed_rrset_key* k, size_t idx)
  * @return false on error.
  */
 static int
-ds_create_dnskey_digest(struct module_env* env, 
+ds_create_dnskey_digest(struct module_env* env,
 	struct ub_packed_rrset_key* dnskey_rrset, size_t dnskey_idx,
 	struct ub_packed_rrset_key* ds_rrset, size_t ds_idx,
 	uint8_t* digest)
@@ -296,16 +296,16 @@ ds_create_dnskey_digest(struct module_env* env,
 	size_t dnskey_len;
 	rrset_get_rdata(dnskey_rrset, dnskey_idx, &dnskey_rdata, &dnskey_len);
 
-	/* create digest source material in buffer 
+	/* create digest source material in buffer
 	 * digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);
 	 *	DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key. */
 	sldns_buffer_clear(b);
-	sldns_buffer_write(b, dnskey_rrset->rk.dname, 
+	sldns_buffer_write(b, dnskey_rrset->rk.dname,
 		dnskey_rrset->rk.dname_len);
 	query_dname_tolower(sldns_buffer_begin(b));
 	sldns_buffer_write(b, dnskey_rdata+2, dnskey_len-2); /* skip rdatalen*/
 	sldns_buffer_flip(b);
-	
+
 	return secalgo_ds_digest(ds_get_digest_algo(ds_rrset, ds_idx),
 		(unsigned char*)sldns_buffer_begin(b), sldns_buffer_limit(b),
 		(unsigned char*)digest);
@@ -329,7 +329,7 @@ int ds_digest_match_dnskey(struct module_env* env,
 	if(fake_sha1 && ds_get_digest_algo(ds_rrset, ds_idx)==LDNS_SHA1)
 		return 1;
 #endif
-	
+
 	/* check digest length in DS with length from hash function */
 	ds_get_sigdata(ds_rrset, ds_idx, &ds, &dslen);
 	if(!ds || dslen != digestlen) {
@@ -343,7 +343,7 @@ int ds_digest_match_dnskey(struct module_env* env,
 		verbose(VERB_QUERY, "DS fail: out of memory");
 		return 0; /* mem error */
 	}
-	if(!ds_create_dnskey_digest(env, dnskey_rrset, dnskey_idx, ds_rrset, 
+	if(!ds_create_dnskey_digest(env, dnskey_rrset, dnskey_idx, ds_rrset,
 		ds_idx, digest)) {
 		verbose(VERB_QUERY, "DS fail: could not calc key digest");
 		return 0; /* digest algo failed */
@@ -355,21 +355,21 @@ int ds_digest_match_dnskey(struct module_env* env,
 	return 1;
 }
 
-int 
-ds_digest_algo_is_supported(struct ub_packed_rrset_key* ds_rrset, 
+int
+ds_digest_algo_is_supported(struct ub_packed_rrset_key* ds_rrset,
 	size_t ds_idx)
 {
 	return (ds_digest_size_algo(ds_rrset, ds_idx) != 0);
 }
 
-int 
-ds_key_algo_is_supported(struct ub_packed_rrset_key* ds_rrset, 
+int
+ds_key_algo_is_supported(struct ub_packed_rrset_key* ds_rrset,
 	size_t ds_idx)
 {
 	return dnskey_algo_id_is_supported(ds_get_key_algo(ds_rrset, ds_idx));
 }
 
-uint16_t 
+uint16_t
 dnskey_calc_keytag(struct ub_packed_rrset_key* dnskey_rrset, size_t dnskey_idx)
 {
 	uint8_t* data;
@@ -382,7 +382,7 @@ dnskey_calc_keytag(struct ub_packed_rrset_key* dnskey_rrset, size_t dnskey_idx)
 int dnskey_algo_is_supported(struct ub_packed_rrset_key* dnskey_rrset,
         size_t dnskey_idx)
 {
-	return dnskey_algo_id_is_supported(dnskey_get_algo(dnskey_rrset, 
+	return dnskey_algo_id_is_supported(dnskey_get_algo(dnskey_rrset,
 		dnskey_idx));
 }
 
@@ -482,7 +482,7 @@ void algo_needs_init_ds(struct algo_needs* n, struct ub_packed_rrset_key* ds,
 		log_assert(algo != 0); /* we do not support 0 and is EOS */
 		if(n->needs[algo] == 0) {
 			n->needs[algo] = 1;
-			sigalg[total] = algo;		
+			sigalg[total] = algo;
 			total++;
 		}
 	}
@@ -604,7 +604,7 @@ dnskeyset_verify_rrset_sig(struct module_env* env, struct val_env* ve,
 	return sec_status_bogus;
 }
 
-enum sec_status 
+enum sec_status
 dnskeyset_verify_rrset(struct module_env* env, struct val_env* ve,
 	struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* dnskey,
 	uint8_t* sigalg, char** reason, sldns_ede_code *reason_bogus,
@@ -638,7 +638,7 @@ dnskeyset_verify_rrset(struct module_env* env, struct val_env* ve,
 		}
 	}
 	for(i=0; i<num; i++) {
-		sec = dnskeyset_verify_rrset_sig(env, ve, *env->now, rrset, 
+		sec = dnskeyset_verify_rrset_sig(env, ve, *env->now, rrset,
 			dnskey, i, &sortree, reason, reason_bogus,
 			section, qstate);
 		/* see which algorithm has been fixed up */
@@ -707,7 +707,7 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
 			continue;
 		buf_canon = 0;
 		sec = dnskey_verify_rrset_sig(env->scratch,
-			env->scratch_buffer, ve, *env->now, rrset, 
+			env->scratch_buffer, ve, *env->now, rrset,
 			dnskey, dnskey_idx, i, &sortree, &buf_canon, reason,
 			reason_bogus, section, qstate);
 		if(sec == sec_status_secure)
@@ -753,7 +753,7 @@ struct canon_rr {
  * @return comparison code.
  */
 static int
-canonical_compare_byfield(struct packed_rrset_data* d, 
+canonical_compare_byfield(struct packed_rrset_data* d,
 	const sldns_rr_descriptor* desc, size_t i, size_t j)
 {
 	/* sweep across rdata, keep track of some state:
@@ -799,7 +799,7 @@ canonical_compare_byfield(struct packed_rrset_data* d,
 		 * The reason to first read the byte, then setup the rdf,
 		 * is that we are then sure the byte is available and short
 		 * rdata is handled gracefully (even if it is a formerr). */
-		if(lablen_i == 0) { 
+		if(lablen_i == 0) {
 			if(dname_i) {
 				/* scan this dname label */
 				/* capture length to lowercase */
@@ -816,9 +816,9 @@ canonical_compare_byfield(struct packed_rrset_data* d,
 			} else {
 				/* scan this rdata field */
 				wfi++;
-				if(desc->_wireformat[wfi] 
+				if(desc->_wireformat[wfi]
 					== LDNS_RDF_TYPE_DNAME) {
-					dname_i = 1; 
+					dname_i = 1;
 					lablen_i = (size_t)*di;
 					if(lablen_i == 0) {
 						dname_i = 0;
@@ -826,7 +826,7 @@ canonical_compare_byfield(struct packed_rrset_data* d,
 						if(dname_num_i == 0)
 							lablen_i = ilen;
 					}
-				} else if(desc->_wireformat[wfi] 
+				} else if(desc->_wireformat[wfi]
 					== LDNS_RDF_TYPE_STR)
 					lablen_i = (size_t)*di;
 				else	lablen_i = get_rdf_size(
@@ -835,7 +835,7 @@ canonical_compare_byfield(struct packed_rrset_data* d,
 		} else	lablen_i--;
 
 		/* advance field j; same as for i */
-		if(lablen_j == 0) { 
+		if(lablen_j == 0) {
 			if(dname_j) {
 				lablen_j = (size_t)*dj;
 				if(lablen_j == 0) {
@@ -846,9 +846,9 @@ canonical_compare_byfield(struct packed_rrset_data* d,
 				}
 			} else {
 				wfj++;
-				if(desc->_wireformat[wfj] 
+				if(desc->_wireformat[wfj]
 					== LDNS_RDF_TYPE_DNAME) {
-					dname_j = 1; 
+					dname_j = 1;
 					lablen_j = (size_t)*dj;
 					if(lablen_j == 0) {
 						dname_j = 0;
@@ -856,7 +856,7 @@ canonical_compare_byfield(struct packed_rrset_data* d,
 						if(dname_num_j == 0)
 							lablen_j = jlen;
 					}
-				} else if(desc->_wireformat[wfj] 
+				} else if(desc->_wireformat[wfj]
 					== LDNS_RDF_TYPE_STR)
 					lablen_j = (size_t)*dj;
 				else	lablen_j = get_rdf_size(
@@ -907,7 +907,7 @@ canonical_compare(struct ub_packed_rrset_key* rrset, size_t i, size_t j)
 		return 0;
 
 	switch(type) {
-		/* These RR types have only a name as RDATA. 
+		/* These RR types have only a name as RDATA.
 		 * This name has to be canonicalized.*/
 		case LDNS_RR_TYPE_NS:
 		case LDNS_RR_TYPE_MD:
@@ -931,7 +931,7 @@ canonical_compare(struct ub_packed_rrset_key* rrset, size_t i, size_t j)
 		 * and after that a byte-for byte remainder can be compared.
 		 */
 		/* type starts with the name; remainder is binary compared */
-		case LDNS_RR_TYPE_NXT: 
+		case LDNS_RR_TYPE_NXT:
 		/* use rdata field formats */
 		case LDNS_RR_TYPE_MINFO:
 		case LDNS_RR_TYPE_RP:
@@ -953,7 +953,7 @@ canonical_compare(struct ub_packed_rrset_key* rrset, size_t i, size_t j)
 			return canonical_compare_byfield(d, desc, i, j);
 
 		case LDNS_RR_TYPE_HINFO: /* no longer downcased */
-		case LDNS_RR_TYPE_NSEC: 
+		case LDNS_RR_TYPE_NSEC:
 	default:
 		/* For unknown RR types, or types not listed above,
 		 * no canonicalization is needed, do binary compare */
@@ -1040,7 +1040,7 @@ insert_can_owner(sldns_buffer* buf, struct ub_packed_rrset_key* k,
 		size_t len = k->rk.dname_len;
 		/* so skip fqdn_labels-rrsig_labels */
 		for(i=0; i<fqdn_labels-rrsig_labels; i++) {
-			dname_remove_label(&nm, &len);	
+			dname_remove_label(&nm, &len);
 		}
 		*can_owner_len = len+2;
 		sldns_buffer_write(buf, (uint8_t*)"\001*", 2);
@@ -1061,7 +1061,7 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
 {
 	uint8_t* datstart = sldns_buffer_current(buf)-len+2;
 	switch(ntohs(rrset->rk.type)) {
-		case LDNS_RR_TYPE_NXT: 
+		case LDNS_RR_TYPE_NXT:
 		case LDNS_RR_TYPE_NS:
 		case LDNS_RR_TYPE_MD:
 		case LDNS_RR_TYPE_MF:
@@ -1079,7 +1079,7 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
 		case LDNS_RR_TYPE_SOA:
 			/* two names after another */
 			query_dname_tolower(datstart);
-			query_dname_tolower(datstart + 
+			query_dname_tolower(datstart +
 				dname_valid(datstart, len-2));
 			return;
 		case LDNS_RR_TYPE_RT:
@@ -1103,11 +1103,11 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
 			return;
 		case LDNS_RR_TYPE_PX:
 			/* skip, then two names after another */
-			if(len < 2+2+1) 
+			if(len < 2+2+1)
 				return;
 			datstart += 2;
 			query_dname_tolower(datstart);
-			query_dname_tolower(datstart + 
+			query_dname_tolower(datstart +
 				dname_valid(datstart, len-2-2));
 			return;
 		case LDNS_RR_TYPE_NAPTR:
@@ -1139,12 +1139,12 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
 			query_dname_tolower(datstart);
 			return;
 
-		/* do not canonicalize NSEC rdata name, compat with 
+		/* do not canonicalize NSEC rdata name, compat with
 		 * from bind 9.4 signer, where it does not do so */
 		case LDNS_RR_TYPE_NSEC: /* type starts with the name */
 		case LDNS_RR_TYPE_HINFO: /* not downcased */
 		/* A6 not supported */
-		default:	
+		default:
 			/* nothing to do for unknown types */
 			return;
 	}
@@ -1230,7 +1230,7 @@ int rrset_canonical_equal(struct regional* region,
  * @return false on alloc error.
  */
 static int
-rrset_canonical(struct regional* region, sldns_buffer* buf, 
+rrset_canonical(struct regional* region, sldns_buffer* buf,
 	struct ub_packed_rrset_key* k, uint8_t* sig, size_t siglen,
 	struct rbtree_type** sortree, sldns_pkt_section section,
 	struct module_qstate* qstate)
@@ -1242,7 +1242,7 @@ rrset_canonical(struct regional* region, sldns_buffer* buf,
 	struct canon_rr* rrs;
 
 	if(!*sortree) {
-		*sortree = (struct rbtree_type*)regional_alloc(region, 
+		*sortree = (struct rbtree_type*)regional_alloc(region,
 			sizeof(rbtree_type));
 		if(!*sortree)
 			return 0;
@@ -1260,7 +1260,7 @@ rrset_canonical(struct regional* region, sldns_buffer* buf,
 	sldns_buffer_clear(buf);
 	sldns_buffer_write(buf, sig, siglen);
 	/* canonicalize signer name */
-	query_dname_tolower(sldns_buffer_begin(buf)+18); 
+	query_dname_tolower(sldns_buffer_begin(buf)+18);
 	RBTREE_FOR(walk, struct canon_rr*, (*sortree)) {
 		/* see if there is enough space left in the buffer */
 		if(sldns_buffer_remaining(buf) < can_owner_len + 2 + 2 + 4
@@ -1272,12 +1272,12 @@ rrset_canonical(struct regional* region, sldns_buffer* buf,
 		/* determine canonical owner name */
 		if(can_owner)
 			sldns_buffer_write(buf, can_owner, can_owner_len);
-		else	insert_can_owner(buf, k, sig, &can_owner, 
+		else	insert_can_owner(buf, k, sig, &can_owner,
 				&can_owner_len);
 		sldns_buffer_write(buf, &k->rk.type, 2);
 		sldns_buffer_write(buf, &k->rk.rrset_class, 2);
 		sldns_buffer_write(buf, sig+4, 4);
-		sldns_buffer_write(buf, d->rr_data[walk->rr_idx], 
+		sldns_buffer_write(buf, d->rr_data[walk->rr_idx],
 			d->rr_len[walk->rr_idx]);
 		canonicalize_rdata(buf, k, d->rr_len[walk->rr_idx]);
 	}
@@ -1294,7 +1294,7 @@ rrset_canonical(struct regional* region, sldns_buffer* buf,
 			return 0;
 		k->rk.dname_len = can_owner_len;
 	}
-	
+
 
 	return 1;
 }
@@ -1371,10 +1371,10 @@ sigdate_error(const char* str, int32_t expi, int32_t incep, int32_t now)
 	if(gmtime_r(&te, &tm) && strftime(expi_buf, 15, "%Y%m%d%H%M%S", &tm)
 	 &&gmtime_r(&ti, &tm) && strftime(incep_buf, 15, "%Y%m%d%H%M%S", &tm)
 	 &&gmtime_r(&tn, &tm) && strftime(now_buf, 15, "%Y%m%d%H%M%S", &tm)) {
-		log_info("%s expi=%s incep=%s now=%s", str, expi_buf, 
+		log_info("%s expi=%s incep=%s now=%s", str, expi_buf,
 			incep_buf, now_buf);
 	} else
-		log_info("%s expi=%u incep=%u now=%u", str, (unsigned)expi, 
+		log_info("%s expi=%u incep=%u now=%u", str, (unsigned)expi,
 			(unsigned)incep, (unsigned)now);
 }
 
@@ -1431,11 +1431,11 @@ check_dates(struct val_env* ve, uint32_t unow, uint8_t* expi_p,
 	/* get current date */
 	if(ve->date_override) {
 		if(ve->date_override == -1) {
-			verbose(VERB_ALGO, "date override: ignore date"); 
+			verbose(VERB_ALGO, "date override: ignore date");
 			return 1;
 		}
 		now = ve->date_override;
-		verbose(VERB_ALGO, "date override option %d", (int)now); 
+		verbose(VERB_ALGO, "date override option %d", (int)now);
 	} else	now = unow;
 
 	/* check them */
@@ -1474,7 +1474,7 @@ check_dates(struct val_env* ve, uint32_t unow, uint8_t* expi_p,
 		if(skew < (uint32_t)ve->skew_min) skew = ve->skew_min;
 		if(skew > (uint32_t)ve->skew_max) skew = ve->skew_max;
 		if(subtract_1982(expi, now) > skew) {
-			sigdate_error("verify: signature expired", expi, 
+			sigdate_error("verify: signature expired", expi,
 				incep, now);
 			*reason = "signature expired";
 			if(reason_bogus)
@@ -1489,11 +1489,11 @@ check_dates(struct val_env* ve, uint32_t unow, uint8_t* expi_p,
 
 /** adjust rrset TTL for verified rrset, compare to original TTL and expi */
 static void
-adjust_ttl(struct val_env* ve, uint32_t unow, 
-	struct ub_packed_rrset_key* rrset, uint8_t* orig_p, 
+adjust_ttl(struct val_env* ve, uint32_t unow,
+	struct ub_packed_rrset_key* rrset, uint8_t* orig_p,
 	uint8_t* expi_p, uint8_t* incep_p)
 {
-	struct packed_rrset_data* d = 
+	struct packed_rrset_data* d =
 		(struct packed_rrset_data*)rrset->entry.data;
 	/* read out the dates */
 	int32_t origttl, expittl, expi, incep, now;
@@ -1537,8 +1537,8 @@ adjust_ttl(struct val_env* ve, uint32_t unow,
 	}
 }
 
-enum sec_status 
-dnskey_verify_rrset_sig(struct regional* region, sldns_buffer* buf, 
+enum sec_status
+dnskey_verify_rrset_sig(struct regional* region, sldns_buffer* buf,
 	struct val_env* ve, time_t now,
         struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* dnskey,
         size_t dnskey_idx, size_t sig_idx,
@@ -1572,10 +1572,10 @@ dnskey_verify_rrset_sig(struct regional* region, sldns_buffer* buf,
 		*reason = "dnskey without ZSK flag";
 		if(reason_bogus)
 			*reason_bogus = LDNS_EDE_NO_ZONE_KEY_BIT_SET;
-		return sec_status_bogus; 
+		return sec_status_bogus;
 	}
 
-	if(dnskey_get_protocol(dnskey, dnskey_idx) != LDNS_DNSSEC_KEYPROTO) { 
+	if(dnskey_get_protocol(dnskey, dnskey_idx) != LDNS_DNSSEC_KEYPROTO) {
 		/* RFC 4034 says DNSKEY PROTOCOL MUST be 3 */
 		verbose(VERB_QUERY, "verify: dnskey has wrong key protocol");
 		*reason = "dnskey has wrong protocolnumber";
@@ -1614,9 +1614,9 @@ dnskey_verify_rrset_sig(struct regional* region, sldns_buffer* buf,
 	/* verify key dname == sig signer name */
 	if(query_dname_compare(signer, dnskey->rk.dname) != 0) {
 		verbose(VERB_QUERY, "verify: wrong key for rrsig");
-		log_nametypeclass(VERB_QUERY, "RRSIG signername is", 
+		log_nametypeclass(VERB_QUERY, "RRSIG signername is",
 			signer, 0, 0);
-		log_nametypeclass(VERB_QUERY, "the key name is", 
+		log_nametypeclass(VERB_QUERY, "the key name is",
 			dnskey->rk.dname, 0, 0);
 		*reason = "signer name mismatches key name";
 		if(reason_bogus)
@@ -1662,9 +1662,9 @@ dnskey_verify_rrset_sig(struct regional* region, sldns_buffer* buf,
 	/* original ttl, always ok */
 
 	if(!*buf_canon) {
-		/* create rrset canonical format in buffer, ready for 
+		/* create rrset canonical format in buffer, ready for
 		 * signature */
-		if(!rrset_canonical(region, buf, rrset, sig+2, 
+		if(!rrset_canonical(region, buf, rrset, sig+2,
 			18 + signer_len, sortree, section, qstate)) {
 			log_err("verify: failed due to alloc error");
 			return sec_status_unchecked;
@@ -1682,12 +1682,12 @@ dnskey_verify_rrset_sig(struct regional* region, sldns_buffer* buf,
 	/* verify */
 	sec = verify_canonrrset(buf, (int)sig[2+2],
 		sigblock, sigblock_len, key, keylen, reason);
-	
+
 	if(sec == sec_status_secure) {
 		/* check if TTL is too high - reduce if so */
 		adjust_ttl(ve, now, rrset, sig+2+4, sig+2+8, sig+2+12);
 
-		/* verify inception, expiration dates 
+		/* verify inception, expiration dates
 		 * Do this last so that if you ignore expired-sigs the
 		 * rest is sure to be OK. */
 		if(!check_dates(ve, now, sig+2+8, sig+2+12,
diff --git a/usr.sbin/unbound/validator/val_sigcrypt.h b/usr.sbin/unbound/validator/val_sigcrypt.h
index 7f52b71e4..9baec52c0 100644
--- a/usr.sbin/unbound/validator/val_sigcrypt.h
+++ b/usr.sbin/unbound/validator/val_sigcrypt.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -141,8 +141,8 @@ int algo_needs_missing(struct algo_needs* n);
  */
 void algo_needs_reason(struct module_env* env, int alg, char** reason, char* s);
 
-/** 
- * Check if dnskey matches a DS digest 
+/**
+ * Check if dnskey matches a DS digest
  * Does not check dnskey-keyid footprint, just the digest.
  * @param env: module environment. Uses scratch space.
  * @param dnskey_rrset: DNSKEY rrset.
@@ -155,13 +155,13 @@ int ds_digest_match_dnskey(struct module_env* env,
 	struct ub_packed_rrset_key* dnskey_rrset, size_t dnskey_idx,
 	struct ub_packed_rrset_key* ds_rrset, size_t ds_idx);
 
-/** 
+/**
  * Get dnskey keytag, footprint value
  * @param dnskey_rrset: DNSKEY rrset.
  * @param dnskey_idx: index of RR in rrset.
  * @return the keytag or 0 for badly formatted DNSKEYs.
  */
-uint16_t dnskey_calc_keytag(struct ub_packed_rrset_key* dnskey_rrset, 
+uint16_t dnskey_calc_keytag(struct ub_packed_rrset_key* dnskey_rrset,
 	size_t dnskey_idx);
 
 /**
@@ -169,16 +169,16 @@ uint16_t dnskey_calc_keytag(struct ub_packed_rrset_key* dnskey_rrset,
  * @param ds_rrset: DS rrset
  * @param ds_idx: index of RR in DS rrset.
  * @return the keytag or 0 for badly formatted DSs.
- */ 
+ */
 uint16_t ds_get_keytag(struct ub_packed_rrset_key* ds_rrset, size_t ds_idx);
 
-/** 
- * See if DNSKEY algorithm is supported 
+/**
+ * See if DNSKEY algorithm is supported
  * @param dnskey_rrset: DNSKEY rrset.
  * @param dnskey_idx: index of RR in rrset.
  * @return true if supported.
  */
-int dnskey_algo_is_supported(struct ub_packed_rrset_key* dnskey_rrset, 
+int dnskey_algo_is_supported(struct ub_packed_rrset_key* dnskey_rrset,
 	size_t dnskey_idx);
 
 /**
@@ -198,13 +198,13 @@ int dnskey_size_is_supported(struct ub_packed_rrset_key* dnskey_rrset,
  */
 int dnskeyset_size_is_supported(struct ub_packed_rrset_key* dnskey_rrset);
 
-/** 
- * See if DS digest algorithm is supported 
+/**
+ * See if DS digest algorithm is supported
  * @param ds_rrset: DS rrset
  * @param ds_idx: index of RR in DS rrset.
  * @return true if supported.
  */
-int ds_digest_algo_is_supported(struct ub_packed_rrset_key* ds_rrset, 
+int ds_digest_algo_is_supported(struct ub_packed_rrset_key* ds_rrset,
 	size_t ds_idx);
 
 /**
@@ -215,13 +215,13 @@ int ds_digest_algo_is_supported(struct ub_packed_rrset_key* ds_rrset,
  */
 int ds_get_digest_algo(struct ub_packed_rrset_key* ds_rrset, size_t ds_idx);
 
-/** 
- * See if DS key algorithm is supported 
+/**
+ * See if DS key algorithm is supported
  * @param ds_rrset: DS rrset
  * @param ds_idx: index of RR in DS rrset.
  * @return true if supported.
  */
-int ds_key_algo_is_supported(struct ub_packed_rrset_key* ds_rrset, 
+int ds_key_algo_is_supported(struct ub_packed_rrset_key* ds_rrset,
 	size_t ds_idx);
 
 /**
@@ -241,15 +241,15 @@ int ds_get_key_algo(struct ub_packed_rrset_key* k, size_t idx);
 int dnskey_get_algo(struct ub_packed_rrset_key* k, size_t idx);
 
 /**
- * Get DNSKEY RR flags 
+ * Get DNSKEY RR flags
  * @param k: DNSKEY rrset.
  * @param idx: which DNSKEY RR.
  * @return flags or 0 if DNSKEY too short.
  */
 uint16_t dnskey_get_flags(struct ub_packed_rrset_key* k, size_t idx);
 
-/** 
- * Verify rrset against dnskey rrset. 
+/**
+ * Verify rrset against dnskey rrset.
  * @param env: module environment, scratch space is used.
  * @param ve: validator environment, date settings.
  * @param rrset: to be validated.
@@ -264,15 +264,15 @@ uint16_t dnskey_get_flags(struct ub_packed_rrset_key* k, size_t idx);
  *	UNCHECKED on allocation errors, unsupported algorithms, malformed data,
  *	and BOGUS on verification failures (no keys match any signatures).
  */
-enum sec_status dnskeyset_verify_rrset(struct module_env* env, 
-	struct val_env* ve, struct ub_packed_rrset_key* rrset, 
+enum sec_status dnskeyset_verify_rrset(struct module_env* env,
+	struct val_env* ve, struct ub_packed_rrset_key* rrset,
 	struct ub_packed_rrset_key* dnskey, uint8_t* sigalg,
 	char** reason, sldns_ede_code *reason_bogus,
 	sldns_pkt_section section, struct module_qstate* qstate);
 
 
-/** 
- * verify rrset against one specific dnskey (from rrset) 
+/**
+ * verify rrset against one specific dnskey (from rrset)
  * @param env: module environment, scratch space is used.
  * @param ve: validator environment, date settings.
  * @param rrset: to be validated.
@@ -290,8 +290,8 @@ enum sec_status dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
 	size_t dnskey_idx, char** reason, sldns_ede_code *reason_bogus,
 	sldns_pkt_section section, struct module_qstate* qstate);
 
-/** 
- * verify rrset, with specific dnskey(from set), for a specific rrsig 
+/**
+ * verify rrset, with specific dnskey(from set), for a specific rrsig
  * @param region: scratch region used for temporary allocation.
  * @param buf: scratch buffer used for canonicalized rrset data.
  * @param ve: validator environment, date settings.
@@ -309,7 +309,7 @@ enum sec_status dnskey_verify_rrset(struct module_env* env, struct val_env* ve,
  * @param reason_bogus: EDE (8914) code paired with the reason of failure.
  * @param section: section of packet where this rrset comes from.
  * @param qstate: qstate with region.
- * @return secure if this key signs this signature. unchecked on error or 
+ * @return secure if this key signs this signature. unchecked on error or
  *	bogus if it did not validate.
  */
 enum sec_status dnskey_verify_rrset_sig(struct regional* region,
diff --git a/usr.sbin/unbound/validator/val_utils.c b/usr.sbin/unbound/validator/val_utils.c
index e2319ee23..bd1c29b72 100644
--- a/usr.sbin/unbound/validator/val_utils.c
+++ b/usr.sbin/unbound/validator/val_utils.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -58,7 +58,7 @@
 #include "sldns/wire2str.h"
 #include "sldns/parseutil.h"
 
-enum val_classification 
+enum val_classification
 val_classify_response(uint16_t query_flags, struct query_info* origqinf,
 	struct query_info* qinf, struct reply_info* rep, size_t skip)
 {
@@ -74,7 +74,7 @@ val_classify_response(uint16_t query_flags, struct query_info* origqinf,
 	if(!(query_flags&BIT_RD) && rep->an_numrrsets == 0 &&
 		rcode == LDNS_RCODE_NOERROR) {
 		/* SOA record in auth indicates it is NODATA instead.
-		 * All validation requiring NODATA messages have SOA in 
+		 * All validation requiring NODATA messages have SOA in
 		 * authority section. */
 		/* uses fact that answer section is empty */
 		int saw_ns = 0;
@@ -92,7 +92,7 @@ val_classify_response(uint16_t query_flags, struct query_info* origqinf,
 	if(!(query_flags&BIT_RD) && rep->ns_numrrsets == 0 &&
 		rep->an_numrrsets == 1 && rcode == LDNS_RCODE_NOERROR &&
 		ntohs(rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_NS &&
-		query_dname_compare(rep->rrsets[0]->rk.dname, 
+		query_dname_compare(rep->rrsets[0]->rk.dname,
 			origqinf->qname) != 0)
 		return VAL_CLASS_REFERRAL;
 
@@ -106,15 +106,15 @@ val_classify_response(uint16_t query_flags, struct query_info* origqinf,
 	/* Next is NODATA */
 	if(rcode == LDNS_RCODE_NOERROR && rep->an_numrrsets == 0)
 		return VAL_CLASS_NODATA;
-	
+
 	/* We distinguish between CNAME response and other positive/negative
 	 * responses because CNAME answers require extra processing. */
 
-	/* We distinguish between ANY and CNAME or POSITIVE because 
+	/* We distinguish between ANY and CNAME or POSITIVE because
 	 * ANY responses are validated differently. */
 	if(rcode == LDNS_RCODE_NOERROR && qinf->qtype == LDNS_RR_TYPE_ANY)
 		return VAL_CLASS_ANY;
-	
+
 	/* Note that DNAMEs will be ignored here, unless qtype=DNAME. Unless
 	 * qtype=CNAME, this will yield a CNAME response. */
 	for(i=skip; i<rep->an_numrrsets; i++) {
@@ -156,7 +156,7 @@ rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen)
 	*sname = data;
 }
 
-void 
+void
 val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
 	size_t* slen)
 {
@@ -169,7 +169,7 @@ val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
 		return;
 	}
 	/* get rrsig signer name out of the signature */
-	rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count], 
+	rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count],
 		sname, slen);
 }
 
@@ -183,8 +183,8 @@ val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
  * 	Updated if match is improved.
  */
 static void
-val_find_best_signer(struct ub_packed_rrset_key* rrset, 
-	struct query_info* qinf, uint8_t** signer_name, size_t* signer_len, 
+val_find_best_signer(struct ub_packed_rrset_key* rrset,
+	struct query_info* qinf, uint8_t** signer_name, size_t* signer_len,
 	int* matchcount)
 {
 	struct packed_rrset_data* d = (struct packed_rrset_data*)
@@ -200,8 +200,8 @@ val_find_best_signer(struct ub_packed_rrset_key* rrset,
 		 * improve the match if possible */
 		if(d->rr_len[i] > 2+19 && /* rdata, sig + root label*/
 			dname_subdomain_c(qinf->qname, sign)) {
-			(void)dname_lab_cmp(qinf->qname, 
-				dname_count_labels(qinf->qname), 
+			(void)dname_lab_cmp(qinf->qname,
+				dname_count_labels(qinf->qname),
 				sign, dname_count_labels(sign), &m);
 			if(m > *matchcount) {
 				*matchcount = m;
@@ -213,19 +213,19 @@ val_find_best_signer(struct ub_packed_rrset_key* rrset,
 	}
 }
 
-void 
-val_find_signer(enum val_classification subtype, struct query_info* qinf, 
-	struct reply_info* rep, size_t skip, uint8_t** signer_name, 
+void
+val_find_signer(enum val_classification subtype, struct query_info* qinf,
+	struct reply_info* rep, size_t skip, uint8_t** signer_name,
 	size_t* signer_len)
 {
 	size_t i;
-	
+
 	if(subtype == VAL_CLASS_POSITIVE) {
 		/* check for the answer rrset */
 		for(i=skip; i<rep->an_numrrsets; i++) {
-			if(query_dname_compare(qinf->qname, 
+			if(query_dname_compare(qinf->qname,
 				rep->rrsets[i]->rk.dname) == 0) {
-				val_find_rrset_signer(rep->rrsets[i], 
+				val_find_rrset_signer(rep->rrsets[i],
 					signer_name, signer_len);
 				return;
 			}
@@ -235,7 +235,7 @@ val_find_signer(enum val_classification subtype, struct query_info* qinf,
 	} else if(subtype == VAL_CLASS_CNAME) {
 		/* check for the first signed cname/dname rrset */
 		for(i=skip; i<rep->an_numrrsets; i++) {
-			val_find_rrset_signer(rep->rrsets[i], 
+			val_find_rrset_signer(rep->rrsets[i],
 				signer_name, signer_len);
 			if(*signer_name)
 				return;
@@ -244,7 +244,7 @@ val_find_signer(enum val_classification subtype, struct query_info* qinf,
 		}
 		*signer_name = NULL;
 		*signer_len = 0;
-	} else if(subtype == VAL_CLASS_NAMEERROR 
+	} else if(subtype == VAL_CLASS_NAMEERROR
 		|| subtype == VAL_CLASS_NODATA) {
 		/*Check to see if the AUTH section NSEC record(s) have rrsigs*/
 		for(i=rep->an_numrrsets; i<
@@ -252,7 +252,7 @@ val_find_signer(enum val_classification subtype, struct query_info* qinf,
 			if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
 				|| ntohs(rep->rrsets[i]->rk.type) ==
 				LDNS_RR_TYPE_NSEC3) {
-				val_find_rrset_signer(rep->rrsets[i], 
+				val_find_rrset_signer(rep->rrsets[i],
 					signer_name, signer_len);
 				return;
 			}
@@ -264,9 +264,9 @@ val_find_signer(enum val_classification subtype, struct query_info* qinf,
 		*signer_name = NULL;
 		*signer_len = 0;
 		for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->
-			ns_numrrsets; i++) { 
+			ns_numrrsets; i++) {
 			if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
-				|| ntohs(rep->rrsets[i]->rk.type) == 
+				|| ntohs(rep->rrsets[i]->rk.type) ==
 				LDNS_RR_TYPE_NSEC3) {
 				val_find_best_signer(rep->rrsets[i], qinf,
 					signer_name, signer_len, &matchcount);
@@ -276,9 +276,9 @@ val_find_signer(enum val_classification subtype, struct query_info* qinf,
 		/* check for one of the answer rrset that has signatures,
 		 * or potentially a DNAME is in use with a different qname */
 		for(i=skip; i<rep->an_numrrsets; i++) {
-			if(query_dname_compare(qinf->qname, 
+			if(query_dname_compare(qinf->qname,
 				rep->rrsets[i]->rk.dname) == 0) {
-				val_find_rrset_signer(rep->rrsets[i], 
+				val_find_rrset_signer(rep->rrsets[i],
 					signer_name, signer_len);
 				if(*signer_name)
 					return;
@@ -288,7 +288,7 @@ val_find_signer(enum val_classification subtype, struct query_info* qinf,
 		if(skip < rep->an_numrrsets &&
 			ntohs(rep->rrsets[skip]->rk.type) ==
 			LDNS_RR_TYPE_DNAME) {
-			val_find_rrset_signer(rep->rrsets[skip], 
+			val_find_rrset_signer(rep->rrsets[skip],
 				signer_name, signer_len);
 			if(*signer_name)
 				return;
@@ -298,7 +298,7 @@ val_find_signer(enum val_classification subtype, struct query_info* qinf,
 	} else if(subtype == VAL_CLASS_REFERRAL) {
 		/* find keys for the item at skip */
 		if(skip < rep->rrset_count) {
-			val_find_rrset_signer(rep->rrsets[skip], 
+			val_find_rrset_signer(rep->rrsets[skip],
 				signer_name, signer_len);
 			return;
 		}
@@ -332,7 +332,7 @@ rrset_get_ttl(struct ub_packed_rrset_key* rrset)
 	return d->ttl;
 }
 
-static enum sec_status 
+static enum sec_status
 val_verify_rrset(struct module_env* env, struct val_env* ve,
         struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys,
 	uint8_t* sigalg, char** reason, sldns_ede_code *reason_bogus,
@@ -343,16 +343,16 @@ val_verify_rrset(struct module_env* env, struct val_env* ve,
 		entry.data;
 	if(d->security == sec_status_secure) {
 		/* re-verify all other statuses, because keyset may change*/
-		log_nametypeclass(VERB_ALGO, "verify rrset cached", 
-			rrset->rk.dname, ntohs(rrset->rk.type), 
+		log_nametypeclass(VERB_ALGO, "verify rrset cached",
+			rrset->rk.dname, ntohs(rrset->rk.type),
 			ntohs(rrset->rk.rrset_class));
 		return d->security;
 	}
 	/* check in the cache if verification has already been done */
 	rrset_check_sec_status(env->rrset_cache, rrset, *env->now);
 	if(d->security == sec_status_secure) {
-		log_nametypeclass(VERB_ALGO, "verify rrset from cache", 
-			rrset->rk.dname, ntohs(rrset->rk.type), 
+		log_nametypeclass(VERB_ALGO, "verify rrset from cache",
+			rrset->rk.dname, ntohs(rrset->rk.type),
 			ntohs(rrset->rk.rrset_class));
 		return d->security;
 	}
@@ -363,8 +363,8 @@ val_verify_rrset(struct module_env* env, struct val_env* ve,
 	verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec));
 	regional_free_all(env->scratch);
 
-	/* update rrset security status 
-	 * only improves security status 
+	/* update rrset security status
+	 * only improves security status
 	 * and bogus is set only once, even if we rechecked the status */
 	if(sec > d->security) {
 		d->security = sec;
@@ -389,7 +389,7 @@ val_verify_rrset(struct module_env* env, struct val_env* ve,
 	return sec;
 }
 
-enum sec_status 
+enum sec_status
 val_verify_rrset_entry(struct module_env* env, struct val_env* ve,
         struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey,
 	char** reason, sldns_ede_code *reason_bogus,
@@ -423,7 +423,7 @@ verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
 	num = rrset_get_count(dnskey_rrset);
 	for(i=0; i<num; i++) {
 		/* Skip DNSKEYs that don't match the basic criteria. */
-		if(ds_get_key_algo(ds_rrset, ds_idx) 
+		if(ds_get_key_algo(ds_rrset, ds_idx)
 		   != dnskey_get_algo(dnskey_rrset, i)
 		   || dnskey_calc_keytag(dnskey_rrset, i)
 		   != ds_get_keytag(ds_rrset, ds_idx)) {
@@ -434,9 +434,9 @@ verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
 			ds_get_key_algo(ds_rrset, ds_idx),
 			ds_get_keytag(ds_rrset, ds_idx));
 
-		/* Convert the candidate DNSKEY into a hash using the 
+		/* Convert the candidate DNSKEY into a hash using the
 		 * same DS hash algorithm. */
-		if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset, 
+		if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset,
 			ds_idx)) {
 			verbose(VERB_ALGO, "DS match attempt failed");
 			continue;
@@ -449,7 +449,7 @@ verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
 		}
 		verbose(VERB_ALGO, "DS match digest ok, trying signature");
 
-		/* Otherwise, we have a match! Make sure that the DNSKEY 
+		/* Otherwise, we have a match! Make sure that the DNSKEY
 		 * verifies *with this key*  */
 		sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset,
 			i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate);
@@ -521,7 +521,7 @@ val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
 	}
 	num = rrset_get_count(ds_rrset);
 	for(i=0; i<num; i++) {
-		/* Check to see if we can understand this DS. 
+		/* Check to see if we can understand this DS.
 		 * And check it is the strongest digest */
 		if(!ds_digest_algo_is_supported(ds_rrset, i) ||
 			!ds_key_algo_is_supported(ds_rrset, i) ||
@@ -534,8 +534,8 @@ val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
 		if(sec == sec_status_insecure)
 			continue;
 
-		/* Once we see a single DS with a known digestID and 
-		 * algorithm, we cannot return INSECURE (with a 
+		/* Once we see a single DS with a known digestID and
+		 * algorithm, we cannot return INSECURE (with a
 		 * "null" KeyEntry). */
 		has_useful_ds = 1;
 
@@ -573,24 +573,24 @@ val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
 }
 
 struct key_entry_key*
-val_verify_new_DNSKEYs(struct regional* region, struct module_env* env, 
-	struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset, 
+val_verify_new_DNSKEYs(struct regional* region, struct module_env* env,
+	struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
 	struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason,
 	sldns_ede_code *reason_bogus, struct module_qstate* qstate)
 {
 	uint8_t sigalg[ALGO_NEEDS_MAX+1];
 	enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve,
-		dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason, 
+		dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason,
 		reason_bogus, qstate);
 
 	if(sec == sec_status_secure) {
-		return key_entry_create_rrset(region, 
+		return key_entry_create_rrset(region,
 			ds_rrset->rk.dname, ds_rrset->rk.dname_len,
 			ntohs(ds_rrset->rk.rrset_class), dnskey_rrset,
 			downprot?sigalg:NULL, *env->now);
 	} else if(sec == sec_status_insecure) {
 		return key_entry_create_null(region, ds_rrset->rk.dname,
-			ds_rrset->rk.dname_len, 
+			ds_rrset->rk.dname_len,
 			ntohs(ds_rrset->rk.rrset_class),
 			rrset_get_ttl(ds_rrset), *env->now);
 	}
@@ -646,7 +646,7 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
 	if(ta_ds) {
 	    num = rrset_get_count(ta_ds);
 	    for(i=0; i<num; i++) {
-		/* Check to see if we can understand this DS. 
+		/* Check to see if we can understand this DS.
 		 * And check it is the strongest digest */
 		if(!ds_digest_algo_is_supported(ta_ds, i) ||
 			!ds_key_algo_is_supported(ta_ds, i) ||
@@ -658,8 +658,8 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
 		if(sec == sec_status_insecure)
 			continue;
 
-		/* Once we see a single DS with a known digestID and 
-		 * algorithm, we cannot return INSECURE (with a 
+		/* Once we see a single DS with a known digestID and
+		 * algorithm, we cannot return INSECURE (with a
 		 * "null" KeyEntry). */
 		has_useful_ta = 1;
 
@@ -727,7 +727,7 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
 	return sec_status_bogus;
 }
 
-struct key_entry_key* 
+struct key_entry_key*
 val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env,
 	struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
 	struct ub_packed_rrset_key* ta_ds_rrset,
@@ -786,7 +786,7 @@ val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset)
 		verbose(VERB_ALGO, "DS unsupported, hash %s %s, "
 			"key algorithm %s %s", herr,
 			(ds_digest_algo_is_supported(ds_rrset, 0)?
-			"(supported)":"(unsupported)"), aerr, 
+			"(supported)":"(unsupported)"), aerr,
 			(ds_key_algo_is_supported(ds_rrset, 0)?
 			"(supported)":"(unsupported)"));
 	}
@@ -802,7 +802,7 @@ rrsig_get_labcount(struct packed_rrset_data* d, size_t sig)
 	return d->rr_data[sig][2+3];
 }
 
-int 
+int
 val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc,
 	size_t* wc_len)
 {
@@ -823,7 +823,7 @@ val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc,
 		}
 	}
 	/* OK the rrsigs check out */
-	/* if the RRSIG label count is shorter than the number of actual 
+	/* if the RRSIG label count is shorter than the number of actual
 	 * labels, then this rrset was synthesized from a wildcard.
 	 * Note that the RRSIG label count doesn't count the root label. */
 	wn = rrset->rk.dname;
@@ -885,8 +885,8 @@ rrset_has_signer(struct ub_packed_rrset_key* rrset, uint8_t* name, size_t len)
 	return 0;
 }
 
-void 
-val_fill_reply(struct reply_info* chase, struct reply_info* orig, 
+void
+val_fill_reply(struct reply_info* chase, struct reply_info* orig,
 	size_t skip, uint8_t* name, size_t len, uint8_t* signer)
 {
 	size_t i;
@@ -898,28 +898,28 @@ val_fill_reply(struct reply_info* chase, struct reply_info* orig,
 	/* ANSWER section */
 	for(i=skip; i<orig->an_numrrsets; i++) {
 		if(!signer) {
-			if(query_dname_compare(name, 
+			if(query_dname_compare(name,
 				orig->rrsets[i]->rk.dname) == 0)
-				chase->rrsets[chase->an_numrrsets++] = 
+				chase->rrsets[chase->an_numrrsets++] =
 					orig->rrsets[i];
-		} else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) == 
+		} else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) ==
 			LDNS_RR_TYPE_CNAME) {
 			chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
 			seen_dname = 0;
 		} else if(rrset_has_signer(orig->rrsets[i], name, len)) {
 			chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
-			if(ntohs(orig->rrsets[i]->rk.type) == 
+			if(ntohs(orig->rrsets[i]->rk.type) ==
 				LDNS_RR_TYPE_DNAME) {
 					seen_dname = 1;
 			}
 		}
-	}	
+	}
 	/* AUTHORITY section */
 	for(i = (skip > orig->an_numrrsets)?skip:orig->an_numrrsets;
-		i<orig->an_numrrsets+orig->ns_numrrsets; 
+		i<orig->an_numrrsets+orig->ns_numrrsets;
 		i++) {
 		if(!signer) {
-			if(query_dname_compare(name, 
+			if(query_dname_compare(name,
 				orig->rrsets[i]->rk.dname) == 0)
 				chase->rrsets[chase->an_numrrsets+
 				    chase->ns_numrrsets++] = orig->rrsets[i];
@@ -930,20 +930,20 @@ val_fill_reply(struct reply_info* chase, struct reply_info* orig,
 	}
 	/* ADDITIONAL section */
 	for(i= (skip>orig->an_numrrsets+orig->ns_numrrsets)?
-		skip:orig->an_numrrsets+orig->ns_numrrsets; 
+		skip:orig->an_numrrsets+orig->ns_numrrsets;
 		i<orig->rrset_count; i++) {
 		if(!signer) {
-			if(query_dname_compare(name, 
+			if(query_dname_compare(name,
 				orig->rrsets[i]->rk.dname) == 0)
 			    chase->rrsets[chase->an_numrrsets
-				+orig->ns_numrrsets+chase->ar_numrrsets++] 
+				+orig->ns_numrrsets+chase->ar_numrrsets++]
 				= orig->rrsets[i];
 		} else if(rrset_has_signer(orig->rrsets[i], name, len)) {
 			chase->rrsets[chase->an_numrrsets+orig->ns_numrrsets+
 				chase->ar_numrrsets++] = orig->rrsets[i];
 		}
 	}
-	chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets + 
+	chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets +
 		chase->ar_numrrsets;
 }
 
@@ -960,7 +960,7 @@ void val_reply_remove_auth(struct reply_info* rep, size_t index)
 }
 
 void
-val_check_nonsecure(struct module_env* env, struct reply_info* rep) 
+val_check_nonsecure(struct module_env* env, struct reply_info* rep)
 {
 	size_t i;
 	/* authority */
@@ -979,17 +979,17 @@ val_check_nonsecure(struct module_env* env, struct reply_info* rep)
 
 			/* check if authority has an NS record
 			 * which is bad, and there is an answer section with
-			 * data.  In that case, delete NS and additional to 
+			 * data.  In that case, delete NS and additional to
 			 * be lenient and make a minimal response */
 			if(rep->an_numrrsets != 0 &&
-				ntohs(rep->rrsets[i]->rk.type) 
+				ntohs(rep->rrsets[i]->rk.type)
 				== LDNS_RR_TYPE_NS) {
 				verbose(VERB_ALGO, "truncate to minimal");
 				rep->ar_numrrsets = 0;
 				rep->rrset_count = rep->an_numrrsets +
 					rep->ns_numrrsets;
 				/* remove this unneeded authority rrset */
-				memmove(rep->rrsets+i, rep->rrsets+i+1, 
+				memmove(rep->rrsets+i, rep->rrsets+i+1,
 					sizeof(struct ub_packed_rrset_key*)*
 					(rep->rrset_count - i - 1));
 				rep->ns_numrrsets--;
@@ -1000,7 +1000,7 @@ val_check_nonsecure(struct module_env* env, struct reply_info* rep)
 
 			log_nametypeclass(VERB_QUERY, "message is bogus, "
 				"non secure rrset",
-				rep->rrsets[i]->rk.dname, 
+				rep->rrsets[i]->rk.dname,
 				ntohs(rep->rrsets[i]->rk.type),
 				ntohs(rep->rrsets[i]->rk.rrset_class));
 			rep->security = sec_status_bogus;
@@ -1022,7 +1022,7 @@ val_check_nonsecure(struct module_env* env, struct reply_info* rep)
 			 * their authentication.
 			 */
 			/* remove this unneeded additional rrset */
-			memmove(rep->rrsets+i, rep->rrsets+i+1, 
+			memmove(rep->rrsets+i, rep->rrsets+i+1,
 				sizeof(struct ub_packed_rrset_key*)*
 				(rep->rrset_count - i - 1));
 			rep->ar_numrrsets--;
@@ -1043,8 +1043,8 @@ check_no_anchor(struct val_anchors* anchors, uint8_t* nm, size_t l, uint16_t c)
 	return !ta;
 }
 
-void 
-val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors, 
+void
+val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors,
 	struct rrset_cache* r, struct module_env* env)
 {
 	size_t i;
@@ -1053,9 +1053,9 @@ val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors,
 		d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
 		if(d->security == sec_status_unchecked &&
 		   check_no_anchor(anchors, rep->rrsets[i]->rk.dname,
-			rep->rrsets[i]->rk.dname_len, 
-			ntohs(rep->rrsets[i]->rk.rrset_class))) 
-		{ 	
+			rep->rrsets[i]->rk.dname_len,
+			ntohs(rep->rrsets[i]->rk.rrset_class)))
+		{
 			/* mark as indeterminate */
 			d->security = sec_status_indeterminate;
 			rrset_update_sec_status(r, rep->rrsets[i], *env->now);
@@ -1063,7 +1063,7 @@ val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors,
 	}
 }
 
-void 
+void
 val_mark_insecure(struct reply_info* rep, uint8_t* kname,
 	struct rrset_cache* r, struct module_env* env)
 {
@@ -1080,7 +1080,7 @@ val_mark_insecure(struct reply_info* rep, uint8_t* kname,
 	}
 }
 
-size_t 
+size_t
 val_next_unchecked(struct reply_info* rep, size_t skip)
 {
 	size_t i;
@@ -1167,14 +1167,14 @@ int val_has_signed_nsecs(struct reply_info* rep, char** reason)
 	return 0;
 }
 
-struct dns_msg* 
-val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c, 
+struct dns_msg*
+val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
 	struct regional* region, uint8_t* topname)
 {
 	struct dns_msg* msg;
 	struct query_info qinfo;
 	struct ub_packed_rrset_key *rrset = rrset_cache_lookup(
-		env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0, 
+		env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0,
 		*env->now, 0);
 	if(rrset) {
 		/* DS rrset exists. Return it to the validator immediately*/
diff --git a/usr.sbin/unbound/validator/val_utils.h b/usr.sbin/unbound/validator/val_utils.h
index 83e3d0ad8..d6abf1235 100644
--- a/usr.sbin/unbound/validator/val_utils.h
+++ b/usr.sbin/unbound/validator/val_utils.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -93,7 +93,7 @@ enum val_classification {
  * 	Then, another CNAME type, CNAME_NOANSWER or POSITIVE are possible.
  */
 enum val_classification val_classify_response(uint16_t query_flags,
-	struct query_info* origqinf, struct query_info* qinf, 
+	struct query_info* origqinf, struct query_info* qinf,
 	struct reply_info* rep, size_t skip);
 
 /**
@@ -106,11 +106,11 @@ enum val_classification val_classify_response(uint16_t query_flags,
  * @param rep: response to that, original response.
  * @param cname_skip: how many answer rrsets have been skipped due to CNAME
  * 	chains being chased around.
- * @param signer_name:  signer name, if the response is signed 
+ * @param signer_name:  signer name, if the response is signed
  * 	(even partially), or null if the response isn't signed.
  * @param signer_len: length of signer_name of 0 if signer_name is NULL.
  */
-void val_find_signer(enum val_classification subtype, 
+void val_find_signer(enum val_classification subtype,
 	struct query_info* qinf, struct reply_info* rep,
 	size_t cname_skip, uint8_t** signer_name, size_t* signer_len);
 
@@ -126,8 +126,8 @@ void val_find_signer(enum val_classification subtype,
  * @param qstate: qstate with region.
  * @return security status of verification.
  */
-enum sec_status val_verify_rrset_entry(struct module_env* env, 
-	struct val_env* ve, struct ub_packed_rrset_key* rrset, 
+enum sec_status val_verify_rrset_entry(struct module_env* env,
+	struct val_env* ve, struct ub_packed_rrset_key* rrset,
 	struct key_entry_key* kkey, char** reason, sldns_ede_code *reason_bogus,
 	sldns_pkt_section section, struct module_qstate* qstate);
 
@@ -204,7 +204,7 @@ enum sec_status val_verify_DNSKEY_with_TA(struct module_env* env,
  */
 struct key_entry_key* val_verify_new_DNSKEYs(struct regional* region,
     struct module_env* env, struct val_env* ve,
-    struct ub_packed_rrset_key* dnskey_rrset, 
+    struct ub_packed_rrset_key* dnskey_rrset,
     struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason,
     sldns_ede_code *reason_bogus, struct module_qstate* qstate);
 
@@ -232,7 +232,7 @@ struct key_entry_key* val_verify_new_DNSKEYs(struct regional* region,
  *         rrset.
  *         if downprot is set, a key entry with an algo list is made.
  */
-struct key_entry_key* val_verify_new_DNSKEYs_with_ta(struct regional* region, 
+struct key_entry_key* val_verify_new_DNSKEYs_with_ta(struct regional* region,
     struct module_env* env, struct val_env* ve,
     struct ub_packed_rrset_key* dnskey_rrset,
     struct ub_packed_rrset_key* ta_ds_rrset,
@@ -253,18 +253,18 @@ int val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset);
  * Determine by looking at a signed RRset whether or not the RRset name was
  * the result of a wildcard expansion. If so, return the name of the
  * generating wildcard.
- * 
+ *
  * @param rrset The rrset to check.
  * @param wc: the wildcard name, if the rrset was synthesized from a wildcard.
- *         unchanged if not.  The wildcard name, without "*." in front, is 
+ *         unchanged if not.  The wildcard name, without "*." in front, is
  *         returned. This is a pointer into the rrset owner name.
  * @param wc_len: the length of the returned wildcard name.
- * @return false if the signatures are inconsistent in indicating the 
+ * @return false if the signatures are inconsistent in indicating the
  * 	wildcard status; possible spoofing of wildcard response for other
  * 	responses is being tried. We lost the status which rrsig was verified
  * 	after the verification routine finished, so we simply check if
  * 	the signatures are consistent; inserting a fake signature is a denial
- * 	of service; but in that you could also have removed the real 
+ * 	of service; but in that you could also have removed the real
  * 	signature anyway.
  */
 int val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc,
@@ -295,7 +295,7 @@ int val_chase_cname(struct query_info* qchase, struct reply_info* rep,
  * @param signer: signer name or NULL if an unsigned RRset is considered.
  *	If NULL, rrsets with the lookup name are copied over.
  */
-void val_fill_reply(struct reply_info* chase, struct reply_info* orig, 
+void val_fill_reply(struct reply_info* chase, struct reply_info* orig,
 	size_t cname_skip, uint8_t* name, size_t len, uint8_t* signer);
 
 /**
@@ -323,8 +323,8 @@ void val_check_nonsecure(struct module_env* env, struct reply_info* rep);
  * @param r: rrset cache to store updated security status into.
  * @param env: module environment
  */
-void val_mark_indeterminate(struct reply_info* rep, 
-	struct val_anchors* anchors, struct rrset_cache* r, 
+void val_mark_indeterminate(struct reply_info* rep,
+	struct val_anchors* anchors, struct rrset_cache* r,
 	struct module_env* env);
 
 /**
diff --git a/usr.sbin/unbound/validator/validator.c b/usr.sbin/unbound/validator/validator.c
index 1723afefe..2af6e7232 100644
--- a/usr.sbin/unbound/validator/validator.c
+++ b/usr.sbin/unbound/validator/validator.c
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -65,8 +65,8 @@
 #include "sldns/str2wire.h"
 
 /* forward decl for cache response and normal super inform calls of a DS */
-static void process_ds_response(struct module_qstate* qstate, 
-	struct val_qstate* vq, int id, int rcode, struct dns_msg* msg, 
+static void process_ds_response(struct module_qstate* qstate,
+	struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
 	struct query_info* qinfo, struct sock_list* origin);
 
 
@@ -112,7 +112,7 @@ fill_nsec3_iter(struct val_env* ve, char* s, int c)
 		s = e;
 		if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
 			log_err("nsec3 key iterations not ascending: %d %d",
-				(int)ve->nsec3_keysize[i-1], 
+				(int)ve->nsec3_keysize[i-1],
 				(int)ve->nsec3_keysize[i]);
 			return 0;
 		}
@@ -124,7 +124,7 @@ fill_nsec3_iter(struct val_env* ve, char* s, int c)
 
 /** apply config settings to validator */
 static int
-val_apply_cfg(struct module_env* env, struct val_env* val_env, 
+val_apply_cfg(struct module_env* env, struct val_env* val_env,
 	struct config_file* cfg)
 {
 	int c;
@@ -250,8 +250,8 @@ val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
 	}
 	vq->qchase = qstate->qinfo;
 	/* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
-	vq->chase_reply = regional_alloc_init(qstate->region, 
-		vq->orig_msg->rep, 
+	vq->chase_reply = regional_alloc_init(qstate->region,
+		vq->orig_msg->rep,
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!vq->chase_reply)
 		return NULL;
@@ -283,7 +283,7 @@ val_new(struct module_qstate* qstate, int id)
 
 /**
  * Exit validation with an error status
- * 
+ *
  * @param qstate: query state
  * @param id: validator id.
  * @return false, for use by caller to return to stop processing.
@@ -296,10 +296,10 @@ val_error(struct module_qstate* qstate, int id)
 	return 0;
 }
 
-/** 
+/**
  * Check to see if a given response needs to go through the validation
  * process. Typical reasons for this routine to return false are: CD bit was
- * on in the original request, or the response is a kind of message that 
+ * on in the original request, or the response is a kind of message that
  * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
  *
  * @param qstate: query state.
@@ -309,7 +309,7 @@ val_error(struct module_qstate* qstate, int id)
  *         mean we can actually validate this response).
  */
 static int
-needs_validation(struct module_qstate* qstate, int ret_rc, 
+needs_validation(struct module_qstate* qstate, int ret_rc,
 	struct dns_msg* ret_msg)
 {
 	int rcode;
@@ -392,8 +392,8 @@ already_validated(struct dns_msg* ret_msg)
  * @return false on alloc failure.
  */
 static int
-generate_request(struct module_qstate* qstate, int id, uint8_t* name, 
-	size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags, 
+generate_request(struct module_qstate* qstate, int id, uint8_t* name,
+	size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags,
 	struct module_qstate** newq, int detached)
 {
 	struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
@@ -420,7 +420,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 		struct mesh_state* sub = NULL;
 		fptr_ok(fptr_whitelist_modenv_add_sub(
 			qstate->env->add_sub));
-		if(!(*qstate->env->add_sub)(qstate, &ask, 
+		if(!(*qstate->env->add_sub)(qstate, &ask,
 			(uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){
 			log_err("Could not generate request: out of memory");
 			return 0;
@@ -429,7 +429,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	else {
 		fptr_ok(fptr_whitelist_modenv_attach_sub(
 			qstate->env->attach_sub));
-		if(!(*qstate->env->attach_sub)(qstate, &ask, 
+		if(!(*qstate->env->attach_sub)(qstate, &ask,
 			(uint16_t)(BIT_RD|flags), 0, valrec, newq)){
 			log_err("Could not generate request: out of memory");
 			return 0;
@@ -562,7 +562,7 @@ prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
 	}
 	/* ignore newq; validator does not need state created for that
 	 * query, and its a 'normal' for iterator as well */
-	vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing 
+	vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
 		from the validator inform_super() routine */
 	/* store trust anchor name for later lookup when prime returns */
 	vq->trust_anchor_name = regional_alloc_init(qstate->region,
@@ -581,11 +581,11 @@ prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
  * They must be validly signed with the given key.
  * Tries to validate ADDITIONAL rrsets as well, but only to check them.
  * Allows unsigned CNAME after a DNAME that expands the DNAME.
- * 
+ *
  * Note that by the time this method is called, the process of finding the
  * trusted DNSKEY rrset that signs this response must already have been
  * completed.
- * 
+ *
  * @param qstate: query state.
  * @param env: module env for verify.
  * @param ve: validator env for verify.
@@ -593,7 +593,7 @@ prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
  * @param chase_reply: answer to validate.
  * @param key_entry: the key entry, which is trusted, and which matches
  * 	the signer of the answer. The key entry isgood().
- * @return false if any of the rrsets in the an or ns sections of the message 
+ * @return false if any of the rrsets in the an or ns sections of the message
  * 	fail to verify. The message is then set to bogus.
  */
 static int
@@ -613,8 +613,8 @@ validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 	for(i=0; i<chase_reply->an_numrrsets; i++) {
 		s = chase_reply->rrsets[i];
 		/* Skip the CNAME following a (validated) DNAME.
-		 * Because of the normalization routines in the iterator, 
-		 * there will always be an unsigned CNAME following a DNAME 
+		 * Because of the normalization routines in the iterator,
+		 * there will always be an unsigned CNAME following a DNAME
 		 * (unless qtype=DNAME). */
 		if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
 			dname_seen = 0;
@@ -630,7 +630,7 @@ validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 		/* Verify the answer rrset */
 		sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
 			&reason_bogus, LDNS_SECTION_ANSWER, qstate);
-		/* If the (answer) rrset failed to validate, then this 
+		/* If the (answer) rrset failed to validate, then this
 		 * message is BAD. */
 		if(sec != sec_status_secure) {
 			log_nametypeclass(VERB_QUERY, "validator: response "
@@ -648,9 +648,9 @@ validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 			return 0;
 		}
 
-		/* Notice a DNAME that should be followed by an unsigned 
+		/* Notice a DNAME that should be followed by an unsigned
 		 * CNAME. */
-		if(qchase->qtype != LDNS_RR_TYPE_DNAME && 
+		if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
 			ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
 			dname_seen = 1;
 		}
@@ -662,7 +662,7 @@ validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 		s = chase_reply->rrsets[i];
 		sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
 			&reason_bogus, LDNS_SECTION_AUTHORITY, qstate);
-		/* If anything in the authority section fails to be secure, 
+		/* If anything in the authority section fails to be secure,
 		 * we have a bad message. */
 		if(sec != sec_status_secure) {
 			log_nametypeclass(VERB_QUERY, "validator: response "
@@ -682,7 +682,7 @@ validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 	if(!env->cfg->val_clean_additional)
 		return 1;
 	/* attempt to validate the ADDITIONAL section rrsets */
-	for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 
+	for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
 		i<chase_reply->rrset_count; i++) {
 		s = chase_reply->rrsets[i];
 		/* only validate rrs that have signatures with the key */
@@ -692,7 +692,7 @@ validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 		if(sname && query_dname_compare(sname, key_entry->name)==0)
 			(void)val_verify_rrset_entry(env, ve, s, key_entry,
 				&reason, NULL, LDNS_SECTION_ADDITIONAL, qstate);
-		/* the additional section can fail to be secure, 
+		/* the additional section can fail to be secure,
 		 * it is optional, check signature in case we need
 		 * to clean the additional section later. */
 	}
@@ -788,10 +788,10 @@ remove_spurious_authority(struct reply_info* chase_reply,
 
 /**
  * Given a "positive" response -- a response that contains an answer to the
- * question, and no CNAME chain, validate this response. 
+ * question, and no CNAME chain, validate this response.
  *
  * The answer and authority RRsets must already be verified as secure.
- * 
+ *
  * @param env: module env for verify.
  * @param ve: validator env for verify.
  * @param qchase: query that was made.
@@ -816,8 +816,8 @@ validate_positive_response(struct module_env* env, struct val_env* ve,
 	for(i=0; i<chase_reply->an_numrrsets; i++) {
 		s = chase_reply->rrsets[i];
 
-		/* Check to see if the rrset is the result of a wildcard 
-		 * expansion. If so, an additional check will need to be 
+		/* Check to see if the rrset is the result of a wildcard
+		 * expansion. If so, an additional check will need to be
 		 * made in the authority section. */
 		if(!val_rrset_wildcard(s, &wc, &wl)) {
 			log_nametypeclass(VERB_QUERY, "Positive response has "
@@ -835,15 +835,15 @@ validate_positive_response(struct module_env* env, struct val_env* ve,
 
 	}
 
-	/* validate the AUTHORITY section as well - this will generally be 
+	/* validate the AUTHORITY section as well - this will generally be
 	 * the NS rrset (which could be missing, no problem) */
 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 		chase_reply->ns_numrrsets; i++) {
 		s = chase_reply->rrsets[i];
 
-		/* If this is a positive wildcard response, and we have a 
-		 * (just verified) NSEC record, try to use it to 1) prove 
-		 * that qname doesn't exist and 2) that the correct wildcard 
+		/* If this is a positive wildcard response, and we have a
+		 * (just verified) NSEC record, try to use it to 1) prove
+		 * that qname doesn't exist and 2) that the correct wildcard
 		 * was used. */
 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
@@ -852,7 +852,7 @@ validate_positive_response(struct module_env* env, struct val_env* ve,
 			/* if not, continue looking for proof */
 		}
 
-		/* Otherwise, if this is a positive wildcard response and 
+		/* Otherwise, if this is a positive wildcard response and
 		 * we have NSEC3 records */
 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
 			nsec3s_seen = 1;
@@ -863,7 +863,7 @@ validate_positive_response(struct module_env* env, struct val_env* ve,
 	 * proven, and we have NSEC3 records, try to prove it using the NSEC3
 	 * records. */
 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
-		enum sec_status sec = nsec3_prove_wildcard(env, ve, 
+		enum sec_status sec = nsec3_prove_wildcard(env, ve,
 			chase_reply->rrsets+chase_reply->an_numrrsets,
 			chase_reply->ns_numrrsets, qchase, kkey, wc);
 		if(sec == sec_status_insecure) {
@@ -890,10 +890,10 @@ validate_positive_response(struct module_env* env, struct val_env* ve,
 	chase_reply->security = sec_status_secure;
 }
 
-/** 
+/**
  * Validate a NOERROR/NODATA signed response -- a response that has a
- * NOERROR Rcode but no ANSWER section RRsets. This consists of making 
- * certain that the authority section NSEC/NSEC3s proves that the qname 
+ * NOERROR Rcode but no ANSWER section RRsets. This consists of making
+ * certain that the authority section NSEC/NSEC3s proves that the qname
  * does exist and the qtype doesn't.
  *
  * The answer and authority RRsets must already be verified as secure.
@@ -914,29 +914,29 @@ validate_nodata_response(struct module_env* env, struct val_env* ve,
 	 * validate. */
 	/* (Note: CNAME/DNAME responses will not directly get here --
 	 * instead, they are chased down into individual CNAME validations,
-	 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER 
+	 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
 	 * validation.) */
-	
+
 	/* validate the AUTHORITY section */
 	int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
-	uint8_t* ce = NULL; /* for wildcard nodata responses. This is the 
+	uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
 				proven closest encloser. */
 	uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
 	int nsec3s_seen = 0; /* nsec3s seen */
-	struct ub_packed_rrset_key* s; 
+	struct ub_packed_rrset_key* s;
 	size_t i;
 
 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 		chase_reply->ns_numrrsets; i++) {
 		s = chase_reply->rrsets[i];
-		/* If we encounter an NSEC record, try to use it to prove 
+		/* If we encounter an NSEC record, try to use it to prove
 		 * NODATA.
 		 * This needs to handle the ENT NODATA case. */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 			if(nsec_proves_nodata(s, qchase, &wc)) {
 				has_valid_nsec = 1;
 				/* sets wc-encloser if wildcard applicable */
-			} 
+			}
 			if(val_nsec_proves_name_error(s, qchase->qname)) {
 				ce = nsec_closest_encloser(qchase->qname, s);
 			}
@@ -952,8 +952,8 @@ validate_nodata_response(struct module_env* env, struct val_env* ve,
 
 	/* check to see if we have a wildcard NODATA proof. */
 
-	/* The wildcard NODATA is 1 NSEC proving that qname does not exist 
-	 * (and also proving what the closest encloser is), and 1 NSEC 
+	/* The wildcard NODATA is 1 NSEC proving that qname does not exist
+	 * (and also proving what the closest encloser is), and 1 NSEC
 	 * showing the matching wildcard, which must be *.closest_encloser. */
 	if(wc && !ce)
 		has_valid_nsec = 0;
@@ -962,9 +962,9 @@ validate_nodata_response(struct module_env* env, struct val_env* ve,
 			has_valid_nsec = 0;
 		}
 	}
-	
+
 	if(!has_valid_nsec && nsec3s_seen) {
-		enum sec_status sec = nsec3_prove_nodata(env, ve, 
+		enum sec_status sec = nsec3_prove_nodata(env, ve,
 			chase_reply->rrsets+chase_reply->an_numrrsets,
 			chase_reply->ns_numrrsets, qchase, kkey);
 		if(sec == sec_status_insecure) {
@@ -989,12 +989,12 @@ validate_nodata_response(struct module_env* env, struct val_env* ve,
 	chase_reply->security = sec_status_secure;
 }
 
-/** 
+/**
  * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
- * Rcode. 
- * This consists of making certain that the authority section NSEC proves 
+ * Rcode.
+ * This consists of making certain that the authority section NSEC proves
  * that the qname doesn't exist and the covering wildcard also doesn't exist..
- * 
+ *
  * The answer and authority RRsets must have already been verified as secure.
  *
  * @param env: module env for verify.
@@ -1013,7 +1013,7 @@ validate_nameerror_response(struct module_env* env, struct val_env* ve,
 	int has_valid_nsec = 0;
 	int has_valid_wnsec = 0;
 	int nsec3s_seen = 0;
-	struct ub_packed_rrset_key* s; 
+	struct ub_packed_rrset_key* s;
 	size_t i;
 	uint8_t* ce;
 	int ce_labs = 0;
@@ -1025,19 +1025,19 @@ validate_nameerror_response(struct module_env* env, struct val_env* ve,
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 			if(val_nsec_proves_name_error(s, qchase->qname))
 				has_valid_nsec = 1;
-			ce = nsec_closest_encloser(qchase->qname, s);            
-			ce_labs = dname_count_labels(ce);                        
+			ce = nsec_closest_encloser(qchase->qname, s);
+			ce_labs = dname_count_labels(ce);
 			/* Use longest closest encloser to prove wildcard. */
-			if(ce_labs > prev_ce_labs ||                             
-			       (ce_labs == prev_ce_labs &&                      
-				       has_valid_wnsec == 0)) {                 
-			       if(val_nsec_proves_no_wc(s, qchase->qname,       
-				       qchase->qname_len))                      
-				       has_valid_wnsec = 1;                     
-			       else                                             
-				       has_valid_wnsec = 0;                     
-			}                                                        
-			prev_ce_labs = ce_labs; 
+			if(ce_labs > prev_ce_labs ||
+			       (ce_labs == prev_ce_labs &&
+				       has_valid_wnsec == 0)) {
+			       if(val_nsec_proves_no_wc(s, qchase->qname,
+				       qchase->qname_len))
+				       has_valid_wnsec = 1;
+			       else
+				       has_valid_wnsec = 0;
+			}
+			prev_ce_labs = ce_labs;
 			if(val_nsec_proves_insecuredelegation(s, qchase)) {
 				verbose(VERB_ALGO, "delegation is insecure");
 				chase_reply->security = sec_status_insecure;
@@ -1093,14 +1093,14 @@ validate_nameerror_response(struct module_env* env, struct val_env* ve,
 	chase_reply->security = sec_status_secure;
 }
 
-/** 
+/**
  * Given a referral response, validate rrsets and take least trusted rrset
  * as the current validation status.
- * 
+ *
  * Note that by the time this method is called, the process of finding the
  * trusted DNSKEY rrset that signs this response must already have been
  * completed.
- * 
+ *
  * @param chase_reply: answer to validate.
  */
 static void
@@ -1120,24 +1120,24 @@ validate_referral_response(struct reply_info* chase_reply)
 		sec_status_to_string(chase_reply->security));
 }
 
-/** 
+/**
  * Given an "ANY" response -- a response that contains an answer to a
- * qtype==ANY question, with answers. This does no checking that all 
+ * qtype==ANY question, with answers. This does no checking that all
  * types are present.
- * 
+ *
  * NOTE: it may be possible to get parent-side delegation point records
  * here, which won't all be signed. Right now, this routine relies on the
  * upstream iterative resolver to not return these responses -- instead
  * treating them as referrals.
- * 
+ *
  * NOTE: RFC 4035 is silent on this issue, so this may change upon
  * clarification. Clarification draft -05 says to not check all types are
  * present.
- * 
+ *
  * Note that by the time this method is called, the process of finding the
  * trusted DNSKEY rrset that signs this response must already have been
  * completed.
- * 
+ *
  * @param env: module env for verify.
  * @param ve: validator env for verify.
  * @param qchase: query that was made.
@@ -1171,13 +1171,13 @@ validate_any_response(struct module_env* env, struct val_env* ve,
 	for(i=0; i<chase_reply->an_numrrsets; i++) {
 		s = chase_reply->rrsets[i];
 
-		/* Check to see if the rrset is the result of a wildcard 
-		 * expansion. If so, an additional check will need to be 
+		/* Check to see if the rrset is the result of a wildcard
+		 * expansion. If so, an additional check will need to be
 		 * made in the authority section. */
 		if(!val_rrset_wildcard(s, &wc, &wl)) {
 			log_nametypeclass(VERB_QUERY, "Positive ANY response"
-				" has inconsistent wildcard sigs:", 
-				s->rk.dname, ntohs(s->rk.type), 
+				" has inconsistent wildcard sigs:",
+				s->rk.dname, ntohs(s->rk.type),
 				ntohs(s->rk.rrset_class));
 			chase_reply->security = sec_status_bogus;
 			update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS);
@@ -1188,13 +1188,13 @@ validate_any_response(struct module_env* env, struct val_env* ve,
 	/* if it was a wildcard, check for NSEC/NSEC3s in both answer
 	 * and authority sections (NSEC may be moved to the ANSWER section) */
 	if(wc != NULL)
-	  for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 
+	  for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
 	  	i++) {
 		s = chase_reply->rrsets[i];
 
-		/* If this is a positive wildcard response, and we have a 
-		 * (just verified) NSEC record, try to use it to 1) prove 
-		 * that qname doesn't exist and 2) that the correct wildcard 
+		/* If this is a positive wildcard response, and we have a
+		 * (just verified) NSEC record, try to use it to 1) prove
+		 * that qname doesn't exist and 2) that the correct wildcard
 		 * was used. */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
@@ -1203,7 +1203,7 @@ validate_any_response(struct module_env* env, struct val_env* ve,
 			/* if not, continue looking for proof */
 		}
 
-		/* Otherwise, if this is a positive wildcard response and 
+		/* Otherwise, if this is a positive wildcard response and
 		 * we have NSEC3 records */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
 			nsec3s_seen = 1;
@@ -1215,9 +1215,9 @@ validate_any_response(struct module_env* env, struct val_env* ve,
 	 * records. */
 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
 		/* look both in answer and auth section for NSEC3s */
-		enum sec_status sec = nsec3_prove_wildcard(env, ve, 
+		enum sec_status sec = nsec3_prove_wildcard(env, ve,
 			chase_reply->rrsets,
-			chase_reply->an_numrrsets+chase_reply->ns_numrrsets, 
+			chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
 			qchase, kkey, wc);
 		if(sec == sec_status_insecure) {
 			verbose(VERB_ALGO, "Positive ANY wildcard response is "
@@ -1245,13 +1245,13 @@ validate_any_response(struct module_env* env, struct val_env* ve,
 
 /**
  * Validate CNAME response, or DNAME+CNAME.
- * This is just like a positive proof, except that this is about a 
+ * This is just like a positive proof, except that this is about a
  * DNAME+CNAME. Possible wildcard proof.
- * Difference with positive proof is that this routine refuses 
+ * Difference with positive proof is that this routine refuses
  * wildcarded DNAMEs.
- * 
+ *
  * The answer and authority rrsets must already be verified as secure.
- * 
+ *
  * @param env: module env for verify.
  * @param ve: validator env for verify.
  * @param qchase: query that was made.
@@ -1275,8 +1275,8 @@ validate_cname_response(struct module_env* env, struct val_env* ve,
 	for(i=0; i<chase_reply->an_numrrsets; i++) {
 		s = chase_reply->rrsets[i];
 
-		/* Check to see if the rrset is the result of a wildcard 
-		 * expansion. If so, an additional check will need to be 
+		/* Check to see if the rrset is the result of a wildcard
+		 * expansion. If so, an additional check will need to be
 		 * made in the authority section. */
 		if(!val_rrset_wildcard(s, &wc, &wl)) {
 			log_nametypeclass(VERB_QUERY, "Cname response has "
@@ -1286,14 +1286,14 @@ validate_cname_response(struct module_env* env, struct val_env* ve,
 			update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS);
 			return;
 		}
-		
-		/* Refuse wildcarded DNAMEs rfc 4597. 
-		 * Do not follow a wildcarded DNAME because 
+
+		/* Refuse wildcarded DNAMEs rfc 4597.
+		 * Do not follow a wildcarded DNAME because
 		 * its synthesized CNAME expansion is underdefined */
-		if(qchase->qtype != LDNS_RR_TYPE_DNAME && 
+		if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
 			ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
 			log_nametypeclass(VERB_QUERY, "cannot validate a "
-				"wildcarded DNAME:", s->rk.dname, 
+				"wildcarded DNAME:", s->rk.dname,
 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
 			chase_reply->security = sec_status_bogus;
 			update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS);
@@ -1313,9 +1313,9 @@ validate_cname_response(struct module_env* env, struct val_env* ve,
 		chase_reply->ns_numrrsets; i++) {
 		s = chase_reply->rrsets[i];
 
-		/* If this is a positive wildcard response, and we have a 
-		 * (just verified) NSEC record, try to use it to 1) prove 
-		 * that qname doesn't exist and 2) that the correct wildcard 
+		/* If this is a positive wildcard response, and we have a
+		 * (just verified) NSEC record, try to use it to 1) prove
+		 * that qname doesn't exist and 2) that the correct wildcard
 		 * was used. */
 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
@@ -1324,7 +1324,7 @@ validate_cname_response(struct module_env* env, struct val_env* ve,
 			/* if not, continue looking for proof */
 		}
 
-		/* Otherwise, if this is a positive wildcard response and 
+		/* Otherwise, if this is a positive wildcard response and
 		 * we have NSEC3 records */
 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
 			nsec3s_seen = 1;
@@ -1335,7 +1335,7 @@ validate_cname_response(struct module_env* env, struct val_env* ve,
 	 * proven, and we have NSEC3 records, try to prove it using the NSEC3
 	 * records. */
 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
-		enum sec_status sec = nsec3_prove_wildcard(env, ve, 
+		enum sec_status sec = nsec3_prove_wildcard(env, ve,
 			chase_reply->rrsets+chase_reply->an_numrrsets,
 			chase_reply->ns_numrrsets, qchase, kkey, wc);
 		if(sec == sec_status_insecure) {
@@ -1366,9 +1366,9 @@ validate_cname_response(struct module_env* env, struct val_env* ve,
  * Validate CNAME NOANSWER response, no more data after a CNAME chain.
  * This can be a NODATA or a NAME ERROR case, but not both at the same time.
  * We don't know because the rcode has been set to NOERROR by the CNAME.
- * 
+ *
  * The answer and authority rrsets must already be verified as secure.
- * 
+ *
  * @param env: module env for verify.
  * @param ve: validator env for verify.
  * @param qchase: query that was made.
@@ -1382,13 +1382,13 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
 	struct key_entry_key* kkey)
 {
 	int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
-	uint8_t* ce = NULL; /* for wildcard nodata responses. This is the 
+	uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
 				proven closest encloser. */
 	uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
 	int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */
 	int nxdomain_valid_wnsec = 0;
 	int nsec3s_seen = 0; /* nsec3s seen */
-	struct ub_packed_rrset_key* s; 
+	struct ub_packed_rrset_key* s;
 	size_t i;
 	uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */
 	int ce_labs = 0;
@@ -1399,14 +1399,14 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
 		chase_reply->ns_numrrsets; i++) {
 		s = chase_reply->rrsets[i];
 
-		/* If we encounter an NSEC record, try to use it to prove 
-		 * NODATA. This needs to handle the ENT NODATA case. 
+		/* If we encounter an NSEC record, try to use it to prove
+		 * NODATA. This needs to handle the ENT NODATA case.
 		 * Also try to prove NAMEERROR, and absence of a wildcard */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 			if(nsec_proves_nodata(s, qchase, &wc)) {
 				nodata_valid_nsec = 1;
 				/* set wc encloser if wildcard applicable */
-			} 
+			}
 			if(val_nsec_proves_name_error(s, qchase->qname)) {
 				ce = nsec_closest_encloser(qchase->qname, s);
 				nxdomain_valid_nsec = 1;
@@ -1436,8 +1436,8 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
 
 	/* check to see if we have a wildcard NODATA proof. */
 
-	/* The wildcard NODATA is 1 NSEC proving that qname does not exists 
-	 * (and also proving what the closest encloser is), and 1 NSEC 
+	/* The wildcard NODATA is 1 NSEC proving that qname does not exists
+	 * (and also proving what the closest encloser is), and 1 NSEC
 	 * showing the matching wildcard, which must be *.closest_encloser. */
 	if(wc && !ce)
 		nodata_valid_nsec = 0;
@@ -1450,7 +1450,7 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
 		/* name error is missing wildcard denial proof */
 		nxdomain_valid_nsec = 0;
 	}
-	
+
 	if(nodata_valid_nsec && nxdomain_valid_nsec) {
 		verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
 			"exists and not exists, bogus");
@@ -1460,7 +1460,7 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
 	}
 	if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
 		int nodata;
-		enum sec_status sec = nsec3_prove_nxornodata(env, ve, 
+		enum sec_status sec = nsec3_prove_nxornodata(env, ve,
 			chase_reply->rrsets+chase_reply->an_numrrsets,
 			chase_reply->ns_numrrsets, qchase, kkey, &nodata);
 		if(sec == sec_status_insecure) {
@@ -1493,12 +1493,12 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
 	chase_reply->security = sec_status_secure;
 }
 
-/** 
+/**
  * Process init state for validator.
  * Process the INIT state. First tier responses start in the INIT state.
  * This is where they are vetted for validation suitability, and the initial
  * key search is done.
- * 
+ *
  * Currently, events the come through this routine will be either promoted
  * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
  * validation), or will be (temporarily) retired and a new priming request
@@ -1512,14 +1512,14 @@ validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
  *         not.
  */
 static int
-processInit(struct module_qstate* qstate, struct val_qstate* vq, 
+processInit(struct module_qstate* qstate, struct val_qstate* vq,
 	struct val_env* ve, int id)
 {
 	uint8_t* lookup_name;
 	size_t lookup_len;
 	struct trust_anchor* anchor;
 	enum val_classification subtype = val_classify_response(
-		qstate->query_flags, &qstate->qinfo, &vq->qchase, 
+		qstate->query_flags, &qstate->qinfo, &vq->qchase,
 		vq->orig_msg->rep, vq->rrset_skip);
 	if(vq->restart_count > ve->max_restart) {
 		verbose(VERB_ALGO, "restart count exceeded");
@@ -1529,9 +1529,9 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 	/* correctly initialize reason_bogus */
 	update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSSEC_BOGUS);
 
-	verbose(VERB_ALGO, "validator classification %s", 
+	verbose(VERB_ALGO, "validator classification %s",
 		val_classification_to_string(subtype));
-	if(subtype == VAL_CLASS_REFERRAL && 
+	if(subtype == VAL_CLASS_REFERRAL &&
 		vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
 		/* referral uses the rrset name as qchase, to find keys for
 		 * that rrset */
@@ -1549,7 +1549,7 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 	/* for type DS look at the parent side for keys/trustanchor */
 	/* also for NSEC not at apex */
 	if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
-		(vq->qchase.qtype == LDNS_RR_TYPE_NSEC && 
+		(vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
 		 vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
 		 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
 		 LDNS_RR_TYPE_NSEC &&
@@ -1558,16 +1558,16 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 		dname_remove_label(&lookup_name, &lookup_len);
 	}
 
-	val_mark_indeterminate(vq->chase_reply, qstate->env->anchors, 
+	val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
 		qstate->env->rrset_cache, qstate->env);
 	vq->key_entry = NULL;
 	vq->empty_DS_name = NULL;
 	vq->ds_rrset = 0;
-	anchor = anchors_lookup(qstate->env->anchors, 
+	anchor = anchors_lookup(qstate->env->anchors,
 		lookup_name, lookup_len, vq->qchase.qclass);
 
 	/* Determine the signer/lookup name */
-	val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep, 
+	val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
 		vq->rrset_skip, &vq->signer_name, &vq->signer_len);
 	if(vq->signer_name != NULL &&
 		!dname_subdomain_c(lookup_name, vq->signer_name)) {
@@ -1588,7 +1588,7 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 	if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
 		anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
 		lock_basic_unlock(&anchor->lock);
-		anchor = anchors_lookup(qstate->env->anchors, 
+		anchor = anchors_lookup(qstate->env->anchors,
 			lookup_name, lookup_len, vq->qchase.qclass);
 		if(!anchor) { /* unsigned parent denies anchor*/
 			verbose(VERB_QUERY, "unsigned parent zone denies"
@@ -1611,11 +1611,11 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 		subtype == VAL_CLASS_REFERRAL) {
 		/* extract this part of orig_msg into chase_reply for
 		 * the eventual VALIDATE stage */
-		val_fill_reply(vq->chase_reply, vq->orig_msg->rep, 
-			vq->rrset_skip, lookup_name, lookup_len, 
+		val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
+			vq->rrset_skip, lookup_name, lookup_len,
 			vq->signer_name);
 		if(verbosity >= VERB_ALGO)
-			log_dns_msg("chased extract", &vq->qchase, 
+			log_dns_msg("chased extract", &vq->qchase,
 				vq->chase_reply);
 	}
 
@@ -1638,7 +1638,7 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 		/* trust anchor is an 'unsigned' trust anchor */
 		if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
 			vq->chase_reply->security = sec_status_insecure;
-			val_mark_insecure(vq->chase_reply, anchor->name, 
+			val_mark_insecure(vq->chase_reply, anchor->name,
 				qstate->env->rrset_cache, qstate->env);
 			lock_basic_unlock(&anchor->lock);
 			/* go to finished state to cache this result */
@@ -1663,10 +1663,10 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 
 	if(key_entry_isnull(vq->key_entry)) {
 		/* response is under a null key, so we cannot validate
-		 * However, we do set the status to INSECURE, since it is 
+		 * However, we do set the status to INSECURE, since it is
 		 * essentially proven insecure. */
 		vq->chase_reply->security = sec_status_insecure;
-		val_mark_insecure(vq->chase_reply, vq->key_entry->name, 
+		val_mark_insecure(vq->chase_reply, vq->key_entry->name,
 			qstate->env->rrset_cache, qstate->env);
 		/* go to finished state to cache this result */
 		vq->state = VAL_FINISHED_STATE;
@@ -1695,7 +1695,7 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq,
 		return 1;
 	}
 
-	/* otherwise, we have our "closest" cached key -- continue 
+	/* otherwise, we have our "closest" cached key -- continue
 	 * processing in the next state. */
 	vq->state = VAL_FINDKEY_STATE;
 	return 1;
@@ -1723,14 +1723,14 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
 
 	log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
 	/* We know that state.key_entry is not 0 or bad key -- if it were,
-	 * then previous processing should have directed this event to 
-	 * a different state. 
+	 * then previous processing should have directed this event to
+	 * a different state.
 	 * It could be an isnull key, which signals the DNSKEY failed
 	 * with retry and has to be looked up again. */
 	log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
 	if(key_entry_isnull(vq->key_entry)) {
-		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 
-			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 
+		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
+			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
 			vq->qchase.qclass, BIT_CD, &newq, 0)) {
 			verbose(VERB_ALGO, "error generating DNSKEY request");
 			return val_error(qstate, id);
@@ -1757,7 +1757,7 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
 		/* if the last empty nonterminal/emptyDS name we detected is
 		 * below the current key, use that name to make progress
 		 * along the chain of trust */
-		if(query_dname_compare(target_key_name, 
+		if(query_dname_compare(target_key_name,
 			vq->empty_DS_name) == 0) {
 			/* do not query for empty_DS_name again */
 			verbose(VERB_ALGO, "Cannot retrieve DS for signature");
@@ -1783,18 +1783,18 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
 		return 1;
 	}
 	/* so this value is >= -1 */
-	strip_lab = dname_count_labels(target_key_name) - 
+	strip_lab = dname_count_labels(target_key_name) -
 		dname_count_labels(current_key_name) - 1;
 	log_assert(strip_lab >= -1);
 	verbose(VERB_ALGO, "striplab %d", strip_lab);
 	if(strip_lab > 0) {
-		dname_remove_labels(&target_key_name, &target_key_len, 
+		dname_remove_labels(&target_key_name, &target_key_len,
 			strip_lab);
 	}
 	log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
 		LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
 
-	/* The next step is either to query for the next DS, or to query 
+	/* The next step is either to query for the next DS, or to query
 	 * for the next DNSKEY. */
 	if(vq->ds_rrset)
 		log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
@@ -1802,8 +1802,8 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
 
 	if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
 		vq->key_entry->name) != 0) {
-		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 
-			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 
+		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
+			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
 			vq->qchase.qclass, BIT_CD, &newq, 0)) {
 			verbose(VERB_ALGO, "error generating DNSKEY request");
 			return val_error(qstate, id);
@@ -1818,12 +1818,12 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
 		 * thus can disprove the secure delegation we seek.
 		 * We can then use that NSEC even in the absence of a SOA
 		 * record that would be required by the iterator to supply
-		 * a completely protocol-correct response. 
+		 * a completely protocol-correct response.
 		 * Uses negative cache for NSEC3 lookup of DS responses. */
 		/* only if cache not blacklisted, of course */
 		struct dns_msg* msg;
 		if(!qstate->blacklist && !vq->chain_blacklist &&
-			(msg=val_find_DS(qstate->env, target_key_name, 
+			(msg=val_find_DS(qstate->env, target_key_name,
 			target_key_len, vq->qchase.qclass, qstate->region,
 			vq->key_entry->name)) ) {
 			verbose(VERB_ALGO, "Process cached DS response");
@@ -1831,7 +1831,7 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
 				msg, &msg->qinfo, NULL);
 			return 1; /* continue processing ds-response results */
 		}
-		if(!generate_request(qstate, id, target_key_name, 
+		if(!generate_request(qstate, id, target_key_name,
 			target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
 			BIT_CD, &newq, 0)) {
 			verbose(VERB_ALGO, "error generating DS request");
@@ -1841,8 +1841,8 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
 	}
 
 	/* Otherwise, it is time to query for the DNSKEY */
-	if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 
-		vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 
+	if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
+		vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
 		vq->qchase.qclass, BIT_CD, &newq, 0)) {
 		verbose(VERB_ALGO, "error generating DNSKEY request");
 		return val_error(qstate, id);
@@ -1867,7 +1867,7 @@ processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
  *         not.
  */
 static int
-processValidate(struct module_qstate* qstate, struct val_qstate* vq, 
+processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 	struct val_env* ve, int id)
 {
 	enum val_classification subtype;
@@ -1886,7 +1886,7 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 		verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
 			vq->signer_name?"":"unsigned ");
 		vq->chase_reply->security = sec_status_insecure;
-		val_mark_insecure(vq->chase_reply, vq->key_entry->name, 
+		val_mark_insecure(vq->chase_reply, vq->key_entry->name,
 			qstate->env->rrset_cache, qstate->env);
 		key_cache_insert(ve->kcache, vq->key_entry, qstate);
 		return 1;
@@ -1906,7 +1906,7 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 		return 1;
 	}
 
-	/* signerName being null is the indicator that this response was 
+	/* signerName being null is the indicator that this response was
 	 * unsigned */
 	if(vq->signer_name == NULL) {
 		log_query_info(VERB_ALGO, "processValidate: state has no "
@@ -1924,9 +1924,9 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 	if(subtype != VAL_CLASS_REFERRAL)
 		remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
 
-	/* check signatures in the message; 
+	/* check signatures in the message;
 	 * answer and authority must be valid, additional is only checked. */
-	if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase, 
+	if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
 		vq->chase_reply, vq->key_entry)) {
 		/* workaround bad recursor out there that truncates (even
 		 * with EDNS4k) to 512 by removing RRSIG from auth section
@@ -1937,11 +1937,11 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 			/* truncate the message some more */
 			vq->orig_msg->rep->ns_numrrsets = 0;
 			vq->orig_msg->rep->ar_numrrsets = 0;
-			vq->orig_msg->rep->rrset_count = 
+			vq->orig_msg->rep->rrset_count =
 				vq->orig_msg->rep->an_numrrsets;
 			vq->chase_reply->ns_numrrsets = 0;
 			vq->chase_reply->ar_numrrsets = 0;
-			vq->chase_reply->rrset_count = 
+			vq->chase_reply->rrset_count =
 				vq->chase_reply->an_numrrsets;
 			qstate->errinf = NULL;
 		}
@@ -1974,7 +1974,7 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 		case VAL_CLASS_NAMEERROR:
 			rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags);
 			verbose(VERB_ALGO, "Validating a nxdomain response");
-			validate_nameerror_response(qstate->env, ve, 
+			validate_nameerror_response(qstate->env, ve,
 				&vq->qchase, vq->chase_reply, vq->key_entry, &rcode);
 			verbose(VERB_DETAIL, "validate(nxdomain): %s",
 			  	sec_status_to_string(
@@ -2013,7 +2013,7 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 		case VAL_CLASS_ANY:
 			verbose(VERB_ALGO, "Validating a positive ANY "
 				"response");
-			validate_any_response(qstate->env, ve, &vq->qchase, 
+			validate_any_response(qstate->env, ve, &vq->qchase,
 				vq->chase_reply, vq->key_entry);
 			verbose(VERB_DETAIL, "validate(positive_any): %s",
 			  	sec_status_to_string(
@@ -2046,11 +2046,11 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
  *         not.
  */
 static int
-processFinished(struct module_qstate* qstate, struct val_qstate* vq, 
+processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 	struct val_env* ve, int id)
 {
 	enum val_classification subtype = val_classify_response(
-		qstate->query_flags, &qstate->qinfo, &vq->qchase, 
+		qstate->query_flags, &qstate->qinfo, &vq->qchase,
 		vq->orig_msg->rep, vq->rrset_skip);
 
 	/* store overall validation result in orig_msg */
@@ -2058,13 +2058,13 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 		vq->orig_msg->rep->security = vq->chase_reply->security;
 		update_reason_bogus(vq->orig_msg->rep, vq->chase_reply->reason_bogus);
 	} else if(subtype != VAL_CLASS_REFERRAL ||
-		vq->rrset_skip < vq->orig_msg->rep->an_numrrsets + 
+		vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
 		vq->orig_msg->rep->ns_numrrsets) {
-		/* ignore sec status of additional section if a referral 
+		/* ignore sec status of additional section if a referral
 		 * type message skips there and
 		 * use the lowest security status as end result. */
 		if(vq->chase_reply->security < vq->orig_msg->rep->security) {
-			vq->orig_msg->rep->security = 
+			vq->orig_msg->rep->security =
 				vq->chase_reply->security;
 			update_reason_bogus(vq->orig_msg->rep, vq->chase_reply->reason_bogus);
 		}
@@ -2072,7 +2072,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 
 	if(subtype == VAL_CLASS_REFERRAL) {
 		/* for a referral, move to next unchecked rrset and check it*/
-		vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep, 
+		vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
 			vq->rrset_skip);
 		if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
 			/* and restart for this rrset */
@@ -2086,7 +2086,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 	if(vq->chase_reply->security != sec_status_bogus &&
 		subtype == VAL_CLASS_CNAME) {
 		/* chase the CNAME; process next part of the message */
-		if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep, 
+		if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
 			&vq->rrset_skip)) {
 			verbose(VERB_ALGO, "validator: failed to chase CNAME");
 			vq->orig_msg->rep->security = sec_status_bogus;
@@ -2109,7 +2109,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 		/* this may cause the msg to be marked bogus */
 		val_check_nonsecure(qstate->env, vq->orig_msg->rep);
 		if(vq->orig_msg->rep->security == sec_status_secure) {
-			log_query_info(VERB_DETAIL, "validation success", 
+			log_query_info(VERB_DETAIL, "validation success",
 				&qstate->qinfo);
 			if(!qstate->no_cache_store) {
 				val_neg_addreply(qstate->env->neg_cache,
@@ -2126,7 +2126,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 			int restart_count = vq->restart_count+1;
 			verbose(VERB_ALGO, "validation failed, "
 				"blacklist and retry to fetch data");
-			val_blacklist(&qstate->blacklist, qstate->region, 
+			val_blacklist(&qstate->blacklist, qstate->region,
 				qstate->reply_origin, 0);
 			qstate->reply_origin = NULL;
 			qstate->errinf = NULL;
@@ -2139,9 +2139,9 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 		}
 
 		vq->orig_msg->rep->ttl = ve->bogus_ttl;
-		vq->orig_msg->rep->prefetch_ttl = 
+		vq->orig_msg->rep->prefetch_ttl =
 			PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
-		vq->orig_msg->rep->serve_expired_ttl = 
+		vq->orig_msg->rep->serve_expired_ttl =
 			vq->orig_msg->rep->ttl + qstate->env->cfg->serve_expired_ttl;
 		if((qstate->env->cfg->val_log_level >= 1 ||
 			qstate->env->cfg->log_servfail) &&
@@ -2221,7 +2221,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 	return 0;
 }
 
-/** 
+/**
  * Handle validator state.
  * If a method returns true, the next state is started. If false, then
  * processing will stop.
@@ -2231,7 +2231,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
  * @param id: module id.
  */
 static void
-val_handle(struct module_qstate* qstate, struct val_qstate* vq, 
+val_handle(struct module_qstate* qstate, struct val_qstate* vq,
 	struct val_env* ve, int id)
 {
 	int cont = 1;
@@ -2242,13 +2242,13 @@ val_handle(struct module_qstate* qstate, struct val_qstate* vq,
 			case VAL_INIT_STATE:
 				cont = processInit(qstate, vq, ve, id);
 				break;
-			case VAL_FINDKEY_STATE: 
+			case VAL_FINDKEY_STATE:
 				cont = processFindKey(qstate, vq, id);
 				break;
-			case VAL_VALIDATE_STATE: 
+			case VAL_VALIDATE_STATE:
 				cont = processValidate(qstate, vq, ve, id);
 				break;
-			case VAL_FINISHED_STATE: 
+			case VAL_FINISHED_STATE:
 				cont = processFinished(qstate, vq, ve, id);
 				break;
 			default:
@@ -2267,15 +2267,15 @@ val_operate(struct module_qstate* qstate, enum module_ev event, int id,
 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
 	struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
 	verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
-		"event:%s", id, strextstate(qstate->ext_state[id]), 
+		"event:%s", id, strextstate(qstate->ext_state[id]),
 		strmodulevent(event));
 	log_query_info(VERB_QUERY, "validator operate: query",
 		&qstate->qinfo);
-	if(vq && qstate->qinfo.qname != vq->qchase.qname) 
+	if(vq && qstate->qinfo.qname != vq->qchase.qname)
 		log_query_info(VERB_QUERY, "validator operate: chased to",
 		&vq->qchase);
 	(void)outbound;
-	if(event == module_event_new || 
+	if(event == module_event_new ||
 		(event == module_event_pass && vq == NULL)) {
 
 		/* pass request to next module, to get it */
@@ -2287,7 +2287,7 @@ val_operate(struct module_qstate* qstate, enum module_ev event, int id,
 		/* check if validation is needed */
 		verbose(VERB_ALGO, "validator: nextmodule returned");
 
-		if(!needs_validation(qstate, qstate->return_rcode, 
+		if(!needs_validation(qstate, qstate->return_rcode,
 			qstate->return_msg)) {
 			/* no need to validate this */
 			if(qstate->return_msg)
@@ -2300,7 +2300,7 @@ val_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			qstate->ext_state[id] = module_finished;
 			return;
 		}
-		/* qclass ANY should have validation result from spawned 
+		/* qclass ANY should have validation result from spawned
 		 * queries. If we get here, it is bogus or an internal error */
 		if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
 			verbose(VERB_ALGO, "cannot validate classANY: bogus");
@@ -2356,7 +2356,7 @@ val_operate(struct module_qstate* qstate, enum module_ev event, int id,
  *	Bad key (validation failed).
  */
 static struct key_entry_key*
-primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset, 
+primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
 	struct trust_anchor* ta, struct module_qstate* qstate, int id)
 {
 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
@@ -2368,7 +2368,7 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
 
 	if(!dnskey_rrset) {
 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
-			"could not fetch DNSKEY rrset", 
+			"could not fetch DNSKEY rrset",
 			ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
 		if(qstate->env->cfg->harden_dnssec_stripped) {
 			errinf_ede(qstate, "no DNSKEY rrset", LDNS_EDE_DNSKEY_MISSING);
@@ -2385,7 +2385,7 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
 		return kkey;
 	}
 	/* attempt to verify with trust anchor DS and DNSKEY */
-	kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve, 
+	kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
 		dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
 		&reason, &reason_bogus, qstate);
 	if(!kkey) {
@@ -2396,14 +2396,14 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
 		sec = sec_status_secure;
 	else
 		sec = sec_status_bogus;
-	verbose(VERB_DETAIL, "validate keys with anchor(DS): %s", 
+	verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
 		sec_status_to_string(sec));
 
 	if(sec != sec_status_secure) {
 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
-			"DNSKEY rrset is not secure", 
+			"DNSKEY rrset is not secure",
 			ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
-		/* NOTE: in this case, we should probably reject the trust 
+		/* NOTE: in this case, we should probably reject the trust
 		 * anchor for longer, perhaps forever. */
 		if(qstate->env->cfg->harden_dnssec_stripped) {
 			errinf_ede(qstate, reason, reason_bogus);
@@ -2420,7 +2420,7 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
 		return kkey;
 	}
 
-	log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor", 
+	log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
 		ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
 	return kkey;
 }
@@ -2468,7 +2468,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 		struct ub_packed_rrset_key* ds;
 		enum sec_status sec;
 		ds = reply_find_answer_rrset(qinfo, msg->rep);
-		/* If there was no DS rrset, then we have mis-classified 
+		/* If there was no DS rrset, then we have mis-classified
 		 * this message. */
 		if(!ds) {
 			log_warn("internal error: POSITIVE DS response was "
@@ -2476,7 +2476,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 			errinf_ede(qstate, "no DS record", LDNS_EDE_DNSSEC_BOGUS);
 			goto return_bogus;
 		}
-		/* Verify only returns BOGUS or SECURE. If the rrset is 
+		/* Verify only returns BOGUS or SECURE. If the rrset is
 		 * bogus, then we are done. */
 		sec = val_verify_rrset_entry(qstate->env, ve, ds,
 			vq->key_entry, &reason, &reason_bogus, LDNS_SECTION_ANSWER, qstate);
@@ -2487,17 +2487,17 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 			goto return_bogus;
 		}
 
-		/* If the DS rrset validates, we still have to make sure 
+		/* If the DS rrset validates, we still have to make sure
 		 * that they are usable. */
 		if(!val_dsset_isusable(ds)) {
-			/* If they aren't usable, then we treat it like 
+			/* If they aren't usable, then we treat it like
 			 * there was no DS. */
 
 			/* TODO add EDE Unsupported DS Digest Type; this needs
 			 * EDE to be added on non SERVFAIL answers. */
 
-			*ke = key_entry_create_null(qstate->region, 
-				qinfo->qname, qinfo->qname_len, qinfo->qclass, 
+			*ke = key_entry_create_null(qstate->region,
+				qinfo->qname, qinfo->qname_len, qinfo->qclass,
 				ub_packed_rrset_ttl(ds), *qstate->env->now);
 			return (*ke) != NULL;
 		}
@@ -2508,9 +2508,9 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 			qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
 			NULL, *qstate->env->now);
 		return (*ke) != NULL;
-	} else if(subtype == VAL_CLASS_NODATA || 
+	} else if(subtype == VAL_CLASS_NODATA ||
 		subtype == VAL_CLASS_NAMEERROR) {
-		/* NODATA means that the qname exists, but that there was 
+		/* NODATA means that the qname exists, but that there was
 		 * no DS.  This is a pretty normal case. */
 		time_t proof_ttl = 0;
 		enum sec_status sec;
@@ -2529,14 +2529,14 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 
 		/* Try to prove absence of the DS with NSEC */
 		sec = val_nsec_prove_nodata_dsreply(
-			qstate->env, ve, qinfo, msg->rep, vq->key_entry, 
+			qstate->env, ve, qinfo, msg->rep, vq->key_entry,
 			&proof_ttl, &reason, qstate);
 		switch(sec) {
 			case sec_status_secure:
 				verbose(VERB_DETAIL, "NSEC RRset for the "
 					"referral proved no DS.");
-				*ke = key_entry_create_null(qstate->region, 
-					qinfo->qname, qinfo->qname_len, 
+				*ke = key_entry_create_null(qstate->region,
+					qinfo->qname, qinfo->qname_len,
 					qinfo->qclass, proof_ttl,
 					*qstate->env->now);
 				return (*ke) != NULL;
@@ -2556,7 +2556,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 				break;
 		}
 
-		sec = nsec3_prove_nods(qstate->env, ve, 
+		sec = nsec3_prove_nods(qstate->env, ve,
 			msg->rep->rrsets + msg->rep->an_numrrsets,
 			msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason,
 			&reason_bogus, qstate);
@@ -2568,8 +2568,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 			case sec_status_secure:
 				verbose(VERB_DETAIL, "NSEC3s for the "
 					"referral proved no DS.");
-				*ke = key_entry_create_null(qstate->region, 
-					qinfo->qname, qinfo->qname_len, 
+				*ke = key_entry_create_null(qstate->region,
+					qinfo->qname, qinfo->qname_len,
 					qinfo->qclass, proof_ttl,
 					*qstate->env->now);
 				return (*ke) != NULL;
@@ -2589,13 +2589,13 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 				break;
 		}
 
-		/* Apparently, no available NSEC/NSEC3 proved NODATA, so 
+		/* Apparently, no available NSEC/NSEC3 proved NODATA, so
 		 * this is BOGUS. */
 		verbose(VERB_DETAIL, "DS %s ran out of options, so return "
 			"bogus", val_classification_to_string(subtype));
 		errinf(qstate, "no DS but also no proof of that");
 		goto return_bogus;
-	} else if(subtype == VAL_CLASS_CNAME || 
+	} else if(subtype == VAL_CLASS_CNAME ||
 		subtype == VAL_CLASS_CNAMENOANSWER) {
 		/* if the CNAME matches the exact name we want and is signed
 		 * properly, then also, we are sure that no DS exists there,
@@ -2619,7 +2619,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 			}
 			goto return_bogus;
 		}
-		sec = val_verify_rrset_entry(qstate->env, ve, cname, 
+		sec = val_verify_rrset_entry(qstate->env, ve, cname,
 			vq->key_entry, &reason, NULL, LDNS_SECTION_ANSWER, qstate);
 		if(sec == sec_status_secure) {
 			verbose(VERB_ALGO, "CNAME validated, "
@@ -2647,7 +2647,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 	}
 return_bogus:
 	*ke = key_entry_create_bad(qstate->region, qinfo->qname,
-		qinfo->qname_len, qinfo->qclass, 
+		qinfo->qname_len, qinfo->qclass,
 		BOGUS_KEY_TTL, *qstate->env->now);
 	return (*ke) != NULL;
 }
@@ -2705,7 +2705,7 @@ process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
 		}
 		vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
 		/* Keep the forState.state on FINDKEY. */
-	} else if(key_entry_isbad(dske) 
+	} else if(key_entry_isbad(dske)
 		&& vq->restart_count < ve->max_restart) {
 		vq->empty_DS_name = olds;
 		val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
@@ -2716,8 +2716,8 @@ process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
 			errinf_origin(qstate, origin);
 			errinf_dname(qstate, "for DS", qinfo->qname);
 		}
-		/* NOTE: the reason for the DS to be not good (that is, 
-		 * either bad or null) should have been logged by 
+		/* NOTE: the reason for the DS to be not good (that is,
+		 * either bad or null) should have been logged by
 		 * dsResponseToKE. */
 		vq->key_entry = dske;
 		/* The FINDKEY phase has ended, so move on. */
@@ -2768,7 +2768,7 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
 			vq->restart_count++;
 			return;
 		}
-		vq->key_entry = key_entry_create_bad(qstate->region, 
+		vq->key_entry = key_entry_create_bad(qstate->region,
 			qinfo->qname, qinfo->qname_len, qinfo->qclass,
 			BOGUS_KEY_TTL, *qstate->env->now);
 		if(!vq->key_entry) {
@@ -2801,7 +2801,7 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
 	if(!key_entry_isgood(vq->key_entry)) {
 		if(key_entry_isbad(vq->key_entry)) {
 			if(vq->restart_count < ve->max_restart) {
-				val_blacklist(&vq->chain_blacklist, 
+				val_blacklist(&vq->chain_blacklist,
 					qstate->region, origin, 1);
 				qstate->errinf = NULL;
 				vq->restart_count++;
@@ -2845,7 +2845,7 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
 {
 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
 	struct ub_packed_rrset_key* dnskey_rrset = NULL;
-	struct trust_anchor* ta = anchor_find(qstate->env->anchors, 
+	struct trust_anchor* ta = anchor_find(qstate->env->anchors,
 		vq->trust_anchor_name, vq->trust_anchor_labs,
 		vq->trust_anchor_len, vq->qchase.qclass);
 	if(!ta) {
@@ -2856,7 +2856,7 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
 		vq->trust_anchor_name = NULL;
 		return;
 	}
-	/* Fetch and validate the keyEntry that corresponds to the 
+	/* Fetch and validate the keyEntry that corresponds to the
 	 * current trust anchor. */
 	if(rcode == LDNS_RCODE_NOERROR) {
 		dnskey_rrset = reply_find_rrset_section_an(msg->rep,
@@ -2876,16 +2876,16 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
 	vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
 	lock_basic_unlock(&ta->lock);
 	if(vq->key_entry) {
-		if(key_entry_isbad(vq->key_entry) 
+		if(key_entry_isbad(vq->key_entry)
 			&& vq->restart_count < ve->max_restart) {
-			val_blacklist(&vq->chain_blacklist, qstate->region, 
+			val_blacklist(&vq->chain_blacklist, qstate->region,
 				origin, 1);
 			qstate->errinf = NULL;
 			vq->restart_count++;
 			vq->key_entry = NULL;
 			vq->state = VAL_INIT_STATE;
 			return;
-		} 
+		}
 		vq->chain_blacklist = NULL;
 		errinf_origin(qstate, origin);
 		errinf_dname(qstate, "for trust anchor", ta->name);
@@ -2901,9 +2901,9 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
 	/* the qstate will be reactivated after inform_super is done */
 }
 
-/* 
+/*
  * inform validator super.
- * 
+ *
  * @param qstate: query state that finished.
  * @param id: module id.
  * @param super: the qstate to inform.
@@ -2928,7 +2928,7 @@ val_inform_super(struct module_qstate* qstate, int id,
 	}
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
 		process_ds_response(super, vq, id, qstate->return_rcode,
-			qstate->return_msg, &qstate->qinfo, 
+			qstate->return_msg, &qstate->qinfo,
 			qstate->reply_origin);
 		return;
 	} else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
@@ -2949,19 +2949,19 @@ val_clear(struct module_qstate* qstate, int id)
 	qstate->minfo[id] = NULL;
 }
 
-size_t 
+size_t
 val_get_mem(struct module_env* env, int id)
 {
 	struct val_env* ve = (struct val_env*)env->modinfo[id];
 	if(!ve)
 		return 0;
-	return sizeof(*ve) + key_cache_get_mem(ve->kcache) + 
+	return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
 		val_neg_get_mem(ve->neg_cache) +
 		sizeof(size_t)*2*ve->nsec3_keyiter_count;
 }
 
 /**
- * The validator function block 
+ * The validator function block
  */
 static struct module_func_block val_block = {
 	"validator",
@@ -2969,13 +2969,13 @@ static struct module_func_block val_block = {
 	&val_get_mem
 };
 
-struct module_func_block* 
+struct module_func_block*
 val_get_funcblock(void)
 {
 	return &val_block;
 }
 
-const char* 
+const char*
 val_state_to_string(enum val_state state)
 {
 	switch(state) {
diff --git a/usr.sbin/unbound/validator/validator.h b/usr.sbin/unbound/validator/validator.h
index 694e4c895..b620c1e98 100644
--- a/usr.sbin/unbound/validator/validator.h
+++ b/usr.sbin/unbound/validator/validator.h
@@ -4,22 +4,22 @@
  * Copyright (c) 2007, NLnet Labs. All rights reserved.
  *
  * This software is open source.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * Redistributions of source code must retain the above copyright notice,
  * this list of conditions and the following disclaimer.
- * 
+ *
  * Redistributions in binary form must reproduce the above copyright notice,
  * this list of conditions and the following disclaimer in the documentation
  * and/or other materials provided with the distribution.
- * 
+ *
  * Neither the name of the NLNET LABS nor the names of its contributors may
  * be used to endorse or promote products derived from this software without
  * specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -72,7 +72,7 @@ struct config_strlist;
 #define SENTINEL_KEYTAG_LEN	5
 
 /**
- * Global state for the validator. 
+ * Global state for the validator.
  */
 struct val_env {
 	/** key cache; these are validated keys. trusted keys only
@@ -96,7 +96,7 @@ struct val_env {
 	int max_restart;
 
 	/** TTL for bogus data; used instead of untrusted TTL from data.
-	 * Bogus data will not be verified more often than this interval. 
+	 * Bogus data will not be verified more often than this interval.
 	 * seconds. */
 	uint32_t bogus_ttl;
 
@@ -143,7 +143,7 @@ enum val_state {
  * Per query state for the validator module.
  */
 struct val_qstate {
-	/** 
+	/**
 	 * State of the validator module.
 	 */
 	enum val_state state;
@@ -169,14 +169,14 @@ struct val_qstate {
 	 * The chased reply, extract from original message. Can be:
 	 * 	o CNAME
 	 * 	o DNAME + CNAME
-	 * 	o answer 
+	 * 	o answer
 	 * 	plus authority, additional (nsecs) that have same signature.
 	 */
 	struct reply_info* chase_reply;
 
 	/**
 	 * The cname skip value; the number of rrsets that have been skipped
-	 * due to chasing cnames. This is the offset into the 
+	 * due to chasing cnames. This is the offset into the
 	 * orig_msg->rep->rrsets array, into the answer section.
 	 * starts at 0 - for the full original message.
 	 * if it is >0 - qchase followed the cname, chase_reply setup to be
@@ -240,9 +240,9 @@ void val_deinit(struct module_env* env, int id);
 void val_operate(struct module_qstate* qstate, enum module_ev event, int id,
         struct outbound_entry* outbound);
 
-/** 
+/**
  * inform validator super.
- * 
+ *
  * @param qstate: query state that finished.
  * @param id: module id.
  * @param super: the qstate to inform.
@@ -254,9 +254,9 @@ void val_inform_super(struct module_qstate* qstate, int id,
 void val_clear(struct module_qstate* qstate, int id);
 
 /**
- * Debug helper routine that assists worker in determining memory in 
+ * Debug helper routine that assists worker in determining memory in
  * use.
- * @param env: module environment 
+ * @param env: module environment
  * @param id: module id.
  * @return memory in use in bytes.
  */