openssl: import 3.5.5

This change adds OpenSSL 3.5.5 from upstream [1].

The 3.5.5 artifact was been verified via PGP key [2] and by SHA256 checksum [3].

This is a security release, but also contains several bugfixes. All of
the CVE-worthy issues have already been addressed on the target
branch(es), so the net-result is that this is a bugfix release.

More information about the release (from a high level) can be found in
the release notes [4].

MFC after:	1 week

1. https://github.com/openssl/openssl/releases/download/openssl-3.5.5/openssl-3.5.5.tar.gz
2. https://github.com/openssl/openssl/releases/download/openssl-3.5.5/openssl-3.5.5.tar.gz.asc
3. https://github.com/openssl/openssl/releases/download/openssl-3.5.5/openssl-3.5.5.tar.gz.sha256
4. https://github.com/openssl/openssl/blob/openssl-3.5.5/NEWS.md

Merge commit '808413da28df9fb93e1f304e6016b15e660f54c8'

2269 files changed, 199489 insertions, 160959 deletions

diff --git a/crypto/openssl/.ctags.d/exclude.ctags b/crypto/openssl/.ctags.d/exclude.ctags
index c932464e6dbd..310a7ada24e0 100644
--- a/crypto/openssl/.ctags.d/exclude.ctags
+++ b/crypto/openssl/.ctags.d/exclude.ctags
@@ -1,5 +1,5 @@
 #
-# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -10,4 +10,3 @@
 # List file names or patterns you want ctags to ignore.
 --exclude=.ctags.d
 --exclude=test
---exclude=check-format-test-positives.c
diff --git a/crypto/openssl/CHANGES.md b/crypto/openssl/CHANGES.md
index b991285aedb2..1a65b72b2965 100644
--- a/crypto/openssl/CHANGES.md
+++ b/crypto/openssl/CHANGES.md
@@ -28,6 +28,245 @@ OpenSSL Releases
 OpenSSL 3.5
 -----------
 
+### Changes between 3.5.4 and 3.5.5 [27 Jan 2026]
+
+ * Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification.
+
+   Severity: Moderate
+
+   Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation
+   which can trigger a stack-based buffer overflow, invalid pointer or NULL
+   pointer dereference during MAC verification.
+
+   Impact summary: The stack buffer overflow or NULL pointer dereference may
+   cause a crash leading to Denial of Service for an application that parses
+   untrusted PKCS#12 files. The buffer overflow may also potentially enable
+   code execution depending on platform mitigations.
+
+   Reported by: Stanislav Fort (Aisle Research) and Petr Šimeček (Aisle
+   Research) and Hamza (Metadust)
+
+   ([CVE-2025-11187])
+
+   *Tomáš Mráz*
+
+ * Fixed Stack buffer overflow in CMS `AuthEnvelopedData` parsing.
+
+   Severity: High
+
+   Issue summary: Parsing CMS `AuthEnvelopedData` message with maliciously
+   crafted AEAD parameters can trigger a stack buffer overflow.
+
+   Impact summary: A stack buffer overflow may lead to a crash, causing Denial
+   of Service, or potentially remote code execution.
+
+   Reported by: Stanislav Fort (Aisle Research)
+
+   ([CVE-2025-15467])
+
+   *Igor Ustinov*
+
+ * Fixed NULL dereference in `SSL_CIPHER_find()` function on unknown cipher ID.
+
+   Severity: Low
+
+   Issue summary: If an application using the `SSL_CIPHER_find()` function
+   in a QUIC protocol client or server receives an unknown cipher suite from
+   the peer, a NULL dereference occurs.
+
+   Impact summary: A NULL pointer dereference leads to abnormal termination
+   of the running process causing Denial of Service.
+
+   Reported by: Stanislav Fort (Aisle Research)
+
+   ([CVE-2025-15468])
+
+   *Stanislav Fort*
+
+ * Fixed `openssl dgst` one-shot codepath silently truncates inputs >16 MiB.
+
+   Severity: Low
+
+   Issue summary: The `openssl dgst` command-line tool silently truncates input
+   data to 16 MiB when using one-shot signing algorithms and reports success
+   instead of an error.
+
+   Impact summary: A user signing or verifying files larger than 16 MiB with
+   one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the
+   entire file is authenticated while trailing data beyond 16 MiB remains
+   unauthenticated.
+
+   Reported by: Stanislav Fort (Aisle Research)
+
+   ([CVE-2025-15469])
+
+   *Viktor Dukhovni*
+
+ * Fixed TLS 1.3 `CompressedCertificate` excessive memory allocation.
+
+   Severity: Low
+
+   Issue summary: A TLS 1.3 connection using certificate compression can be
+   forced to allocate a large buffer before decompression without checking
+   against the configured certificate size limit.
+
+   Impact summary: An attacker can cause per-connection memory allocations
+   of up to approximately 22 MiB and extra CPU work, potentially leading
+   to service degradation or resource exhaustion (Denial of Service).
+
+   Reported by: Tomas Dulka (Aisle Research) and Stanislav Fort (Aisle
+   Research)
+
+   ([CVE-2025-66199])
+
+   *Tomas Dulka and Stanislav Fort*
+
+ * Fixed Heap out-of-bounds write in `BIO_f_linebuffer` on short writes.
+
+   Severity: Low
+
+   Issue summary: Writing large, newline-free data into a BIO chain using the
+   line-buffering filter where the next BIO performs short writes can trigger
+   a heap-based out-of-bounds write.
+
+   Impact summary: This out-of-bounds write can cause memory corruption
+   which typically results in a crash, leading to Denial of Service for
+   an application.
+
+   Reported by: Petr Simecek (Aisle Research) and Stanislav Fort (Aisle
+   Research)
+
+   ([CVE-2025-68160])
+
+   *Stanislav Fort and Neil Horman*
+
+ * Fixed Unauthenticated/unencrypted trailing bytes with low-level OCB
+   function calls.
+
+   Severity: Low
+
+   Issue summary: When using the low-level OCB API directly with AES-NI or
+   other hardware-accelerated code paths, inputs whose length is not a multiple
+   of 16 bytes can leave the final partial block unencrypted and
+   unauthenticated.
+
+   Impact summary: The trailing 1-15 bytes of a message may be exposed in
+   cleartext on encryption and are not covered by the authentication tag,
+   allowing an attacker to read or tamper with those bytes without detection.
+
+   Reported by: Stanislav Fort (Aisle Research)
+
+   ([CVE-2025-69418])
+
+   *Stanislav Fort*
+
+ * Fixed Out of bounds write in `PKCS12_get_friendlyname()` UTF-8 conversion.
+
+   Severity: Low
+
+   Issue summary: Calling `PKCS12_get_friendlyname()` function on a maliciously
+   crafted PKCS#12 file with a `BMPString` (UTF-16BE) friendly name containing
+   non-ASCII BMP code point can trigger a one byte write before the allocated
+   buffer.
+
+   Impact summary: The out-of-bounds write can cause a memory corruption
+   which can have various consequences including a Denial of Service.
+
+   Reported by: Stanislav Fort (Aisle Research)
+
+   ([CVE-2025-69419])
+
+   *Norbert Pócs*
+
+ * Fixed Missing `ASN1_TYPE` validation in `TS_RESP_verify_response()` function.
+
+   Severity: Low
+
+   Issue summary: A type confusion vulnerability exists in the TimeStamp
+   Response verification code where an `ASN1_TYPE` union member is accessed
+   without first validating the type, causing an invalid or NULL pointer
+   dereference when processing a malformed `TimeStamp` Response file.
+
+   Impact summary: An application calling `TS_RESP_verify_response()`
+   with a malformed TimeStamp Response can be caused to dereference an invalid
+   or NULL pointer when reading, resulting in a Denial of Service.
+
+   Reported by: Luigino Camastra (Aisle Research)
+
+   ([CVE-2025-69420])
+
+   *Bob Beck*
+
+ * Fixed NULL Pointer Dereference in `PKCS12_item_decrypt_d2i_ex()` function.
+
+   Severity: Low
+
+   Issue summary: Processing a malformed PKCS#12 file can trigger a NULL
+   pointer dereference in the `PKCS12_item_decrypt_d2i_ex()` function.
+
+   Impact summary: A NULL pointer dereference can trigger a crash which leads
+   to Denial of Service for an application processing PKCS#12 files.
+
+   Reported by: Luigino Camastra (Aisle Research)
+
+   ([CVE-2025-69421])
+
+   *Luigino Camastra*
+
+ * Fixed Missing `ASN1_TYPE` validation in PKCS#12 parsing.
+
+   Severity: Low
+
+   Issue summary: An invalid or NULL pointer dereference can happen in
+   an application processing a malformed PKCS#12 file.
+
+   Impact summary: An application processing a malformed PKCS#12 file can be
+   caused to dereference an invalid or NULL pointer on memory read, resulting
+   in a Denial of Service.
+
+   Reported by: Luigino Camastra (Aisle Research)
+
+   ([CVE-2026-22795])
+
+   *Bob Beck*
+
+ * Fixed `ASN1_TYPE` Type Confusion in the `PKCS7_digest_from_attributes()`
+   function.
+
+   Severity: Low
+
+   Issue summary: A type confusion vulnerability exists in the signature
+   verification of signed PKCS#7 data where an `ASN1_TYPE` union member
+   is accessed without first validating the type, causing an invalid or NULL
+   pointer dereference when processing malformed PKCS#7 data.
+
+   Impact summary: An application performing signature verification of PKCS#7
+   data or calling directly the `PKCS7_digest_from_attributes()` function can be
+   caused to dereference an invalid or NULL pointer when reading, resulting in
+   a Denial of Service.
+
+   Reported by: Luigino Camastra (Aisle Research)
+
+   ([CVE-2026-22796])
+
+   *Bob Beck*
+
+ * RISC-V capabilities string format has changed to include the base
+   architecture and the vector length for the V extension.
+   <!-- https://github.com/openssl/openssl/pull/28760 -->
+
+   *Bernd Edlinger*
+
+ * Fixed incorrect acceptance of some malformed ECDSA signatures on s390x.
+   <!-- https://github.com/openssl/openssl/pull/29214 -->
+
+   *Holger Dengler*
+
+ * Source code has been reformatted with `clang-format`.
+   <!-- https://github.com/openssl/openssl/pull/29262 -->
+
+   *Bob Beck*
+
 ### Changes between 3.5.3 and 3.5.4 [30 Sep 2025]
 
  * Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap
@@ -2340,6 +2579,24 @@ breaking changes, and mappings for the large list of deprecated functions.
 
 ### Changes between 3.0.0 and 3.0.1 [14 Dec 2021]
 
+ * Fixed carry bug in BN_mod_exp which may produce incorrect results on MIPS
+   squaring procedure. Many EC algorithms are affected, including some of the
+   TLS 1.3 default curves. Impact was not analyzed in detail, because the
+   pre-requisites for attack are considered unlikely and include reusing
+   private keys. Analysis suggests that attacks against RSA and DSA as a result
+   of this defect would be very difficult to perform and are not believed
+   likely. Attacks against DH are considered just feasible (although very
+   difficult) because most of the work necessary to deduce information about
+   a private key may be performed offline.
+   The amount of resources required for such an attack would be significant.
+   However, for an attack on TLS to be meaningful, the server would have
+   to share the DH private key among multiple clients, which is no longer
+   an option since CVE-2016-0701.
+   The issue only affects OpenSSL on MIPS platforms.
+   ([CVE-2021-4160])
+
+   *Bernd Edlinger*
+
  * Fixed invalid handling of X509_verify_cert() internal errors in libssl
    Internally libssl in OpenSSL calls X509_verify_cert() on the client side to
    verify a certificate supplied by a server. That function may return a
@@ -21350,6 +21607,18 @@ ndif
 
 <!-- Links -->
 
+[CVE-2026-22796]: https://www.openssl.org/news/vulnerabilities.html#CVE-2026-22796
+[CVE-2026-22795]: https://www.openssl.org/news/vulnerabilities.html#CVE-2026-22795
+[CVE-2025-69421]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69421
+[CVE-2025-69420]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69420
+[CVE-2025-69419]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69419
+[CVE-2025-69418]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69418
+[CVE-2025-68160]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-68160
+[CVE-2025-66199]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-66199
+[CVE-2025-15469]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-15469
+[CVE-2025-15468]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-15468
+[CVE-2025-15467]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-15467
+[CVE-2025-11187]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-11187
 [CVE-2025-9232]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9232
 [CVE-2025-9231]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9231
 [CVE-2025-9230]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9230
diff --git a/crypto/openssl/CONTRIBUTING.md b/crypto/openssl/CONTRIBUTING.md
index 35c45a319fb9..09416095e64d 100644
--- a/crypto/openssl/CONTRIBUTING.md
+++ b/crypto/openssl/CONTRIBUTING.md
@@ -19,6 +19,14 @@ open an issue for it before starting work, to get comments from the community.
 Someone may be already working on the same thing,
 or there may be special reasons why a feature is not implemented.
 
+Similarly, if you plan to submit many pull requests, please start with
+a representative sample (no more than 3 or 4) and open an issue
+explaining your process. The OpenSSL project has limited resources,
+especially when it comes to reviewers, so we appreciate advanced
+communication before submitting many pull requests. In addition,
+contributors should personally evaluate potential patches generated by
+automated tools.
+
 To make it easier to review and accept your pull request, please follow these
 guidelines:
 
diff --git a/crypto/openssl/Configurations/50-nonstop.conf b/crypto/openssl/Configurations/50-nonstop.conf
index a68f20085623..24ab6009fcf2 100644
--- a/crypto/openssl/Configurations/50-nonstop.conf
+++ b/crypto/openssl/Configurations/50-nonstop.conf
@@ -168,6 +168,7 @@
     # Build models
     'nonstop-model-put' => {
         template         => 1,
+        disable          => ['secure-memory'],
         defines          => ['_PUT_MODEL_',
                              '_REENTRANT', '_THREAD_SUPPORT_FUNCTIONS'],
         ex_libs          => '-lput',
@@ -177,6 +178,7 @@
     # Build models
     'nonstop-model-klt' => {
         template         => 1,
+        disable          => ['secure-memory'],
         defines          => ['_KLT_MODEL_',
                              '_REENTRANT', '_THREAD_SUPPORT_FUNCTIONS'],
         ex_libs          => '-lklt',
diff --git a/crypto/openssl/Configurations/unix-Makefile.tmpl b/crypto/openssl/Configurations/unix-Makefile.tmpl
index 81f49926ce92..78be4a319964 100644
--- a/crypto/openssl/Configurations/unix-Makefile.tmpl
+++ b/crypto/openssl/Configurations/unix-Makefile.tmpl
@@ -880,6 +880,7 @@ uninstall_dev: uninstall_runtime_libs
 	done
 	-$(RMDIR) "$(DESTDIR)$(PKGCONFIGDIR)"
 	-$(RMDIR) "$(DESTDIR)$(CMAKECONFIGDIR)"
+	-$(RMDIR) "$(DESTDIR)$(libdir)/cmake"
 	-$(RMDIR) "$(DESTDIR)$(libdir)"
 
 _install_modules_deps: install_runtime_libs build_modules
@@ -1205,10 +1206,18 @@ lint: ## Evaluate C code via "splint"
            echo splint -DLINT -posixlib -preproc -D__gnuc_va_list=void \
 	   -I. -Iinclude -Iapps/include $(CRYPTOHEADERS) $(SSLHEADERS) $(SRCS) )
 
-.PHONY: check-format
-check-format: ## Evaluate C code according to OpenSSL coding standards
-	( cd $(SRCDIR); $(PERL) util/check-format.pl \
-			$(SRCS) \$(CRYPTOHEADERS) $(SSLHEADERS) )
+CLANG_FORMAT_DIFF = clang-format-diff
+
+.PHONY: check-format check-clang-format-diff-cmd
+check-clang-format-diff-cmd:
+	@if ! command -v "$(CLANG_FORMAT_DIFF)" >/dev/null; then \
+		echo "Unable to find ${CLANG_FORMAT_DIFF}";\
+		echo "Please set the CLANG_FORMAT_DIFF variable to your clang-format-diff command";\
+		exit 1;\
+	fi
+
+check-format: check-clang-format-diff-cmd ## Evaluate C code according to OpenSSL coding standards
+	( cd $(SRCDIR); git diff -U0 --no-prefix --no-color | $(CLANG_FORMAT_DIFF) )
 
 generate_apps:
 	( cd $(SRCDIR); $(PERL) VMS/VMSify-conf.pl \
diff --git a/crypto/openssl/NEWS.md b/crypto/openssl/NEWS.md
index b194dfb7cb06..f4ec14718d71 100644
--- a/crypto/openssl/NEWS.md
+++ b/crypto/openssl/NEWS.md
@@ -23,6 +23,52 @@ OpenSSL Releases
 OpenSSL 3.5
 -----------
 
+### Major changes between OpenSSL 3.5.4 and OpenSSL 3.5.5 [27 Jan 2026]
+
+OpenSSL 3.5.5 is a security patch release. The most severe CVE fixed in this
+release is High.
+
+This release incorporates the following bug fixes and mitigations:
+
+  * Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification.
+    ([CVE-2025-11187])
+
+  * Fixed Stack buffer overflow in CMS `AuthEnvelopedData` parsing.
+    ([CVE-2025-15467])
+
+  * Fixed NULL dereference in `SSL_CIPHER_find()` function on unknown cipher ID.
+    ([CVE-2025-15468])
+
+  * Fixed `openssl dgst` one-shot codepath silently truncates inputs >16 MiB.
+    ([CVE-2025-15469])
+
+  * Fixed TLS 1.3 `CompressedCertificate` excessive memory allocation.
+    ([CVE-2025-66199])
+
+  * Fixed Heap out-of-bounds write in `BIO_f_linebuffer` on short writes.
+    ([CVE-2025-68160])
+
+  * Fixed Unauthenticated/unencrypted trailing bytes with low-level OCB
+    function calls.
+    ([CVE-2025-69418])
+
+  * Fixed Out of bounds write in `PKCS12_get_friendlyname()` UTF-8 conversion.
+    ([CVE-2025-69419])
+
+  * Fixed Missing `ASN1_TYPE` validation in `TS_RESP_verify_response()`
+    function.
+    ([CVE-2025-69420])
+
+  * Fixed NULL Pointer Dereference in `PKCS12_item_decrypt_d2i_ex()` function.
+    ([CVE-2025-69421])
+
+  * Fixed Missing `ASN1_TYPE` validation in PKCS#12 parsing.
+    ([CVE-2026-22795])
+
+  * Fixed `ASN1_TYPE` Type Confusion in the `PKCS7_digest_from_attributes()`
+    function.
+    ([CVE-2026-22796])
+
 ### Major changes between OpenSSL 3.5.3 and OpenSSL 3.5.4 [30 Sep 2025]
 
 OpenSSL 3.5.4 is a security patch release. The most severe CVE fixed in this
@@ -307,7 +353,7 @@ This release adds the following new features:
   * Added X509_STORE_get1_objects to avoid issues with the existing
     X509_STORE_get0_objects API in multi-threaded applications.
 
-  * Support for using certificate profiles and extened delayed delivery in CMP
+  * Support for using certificate profiles and extended delayed delivery in CMP
 
 This release incorporates the following potentially significant or incompatible
 changes:
@@ -583,6 +629,8 @@ OpenSSL 3.0
 
 ### Major changes between OpenSSL 3.0.0 and OpenSSL 3.0.1 [14 Dec 2021]
 
+  * Fixed carry bug in BN_mod_exp which may produce incorrect results on MIPS
+    ([CVE-2021-4160])
   * Fixed invalid handling of X509_verify_cert() internal errors in libssl
     ([CVE-2021-4044])
   * Allow fetching an operation from the provider that owns an unexportable key
@@ -1940,6 +1988,18 @@ OpenSSL 0.9.x
   * Support for various new platforms
 
 <!-- Links -->
+[CVE-2026-22796]: https://www.openssl.org/news/vulnerabilities.html#CVE-2026-22796
+[CVE-2026-22795]: https://www.openssl.org/news/vulnerabilities.html#CVE-2026-22795
+[CVE-2025-69421]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69421
+[CVE-2025-69420]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69420
+[CVE-2025-69419]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69419
+[CVE-2025-69418]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69418
+[CVE-2025-68160]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-68160
+[CVE-2025-66199]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-66199
+[CVE-2025-15469]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-15469
+[CVE-2025-15468]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-15468
+[CVE-2025-15467]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-15467
+[CVE-2025-11187]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-11187
 [CVE-2025-9232]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9232
 [CVE-2025-9231]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9231
 [CVE-2025-9230]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9230
diff --git a/crypto/openssl/NOTES-NONSTOP.md b/crypto/openssl/NOTES-NONSTOP.md
index 30deed20b8eb..a2d485132da6 100644
--- a/crypto/openssl/NOTES-NONSTOP.md
+++ b/crypto/openssl/NOTES-NONSTOP.md
@@ -37,8 +37,7 @@ for each on the TNS/X (L-Series) platform:
 The KLT threading model is a newly released model on NonStop. It implements
 kernel-level threading. KLT provides much closer threading to what OpenSSL
 uses for Linux-like threading models. KLT continues to use the pthread library
-API. There is no supported 32-bit or Guardian builds for KLT. Note: KLT is
-not currently available but is planned for post-2024.
+API. There is no supported 32-bit or Guardian builds for KLT.
 
 The SPT threading model is no longer supported as of OpenSSL 3.2.
 
@@ -53,6 +52,9 @@ instead of `nsx` in the set above.
 You cannot build for TNS/E for FIPS, so you must specify the `no-fips`
 option to `./Configure`.
 
+TNS/E has moved to a limited support state, so fixes for this platform will not
+be guaranteed in future.
+
 Linking and Loading Considerations
 ----------------------------------
 
@@ -73,6 +75,12 @@ for NonStop builds. If you need to have `atexit()` functionality, set
 register `OPENSSL_cleanup()` automatically. Preferably, you can explicitly call
 `OPENSSL_cleanup()` from your application.
 
+Secure Memory
+-------------
+
+The mechanism used by OpenSSL for secure memory is not supported on NonStop.
+Use the `no-secure-memory` option when running `Configure`.
+
 About Prefix and OpenSSLDir
 ---------------------------
 
diff --git a/crypto/openssl/README.md b/crypto/openssl/README.md
index f1dbadfe8ec6..d3f79363d50a 100644
--- a/crypto/openssl/README.md
+++ b/crypto/openssl/README.md
@@ -196,7 +196,7 @@ attempting to develop or distribute cryptographic code.
 Copyright
 =========
 
-Copyright (c) 1998-2025 The OpenSSL Project Authors
+Copyright (c) 1998-2026 The OpenSSL Project Authors
 
 Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
 
diff --git a/crypto/openssl/VERSION.dat b/crypto/openssl/VERSION.dat
index a8eb3ac9c421..3a61c8e4e30a 100644
--- a/crypto/openssl/VERSION.dat
+++ b/crypto/openssl/VERSION.dat
@@ -1,7 +1,7 @@
 MAJOR=3
 MINOR=5
-PATCH=4
+PATCH=5
 PRE_RELEASE_TAG=
 BUILD_METADATA=
-RELEASE_DATE="30 Sep 2025"
+RELEASE_DATE="27 Jan 2026"
 SHLIB_VERSION=3
diff --git a/crypto/openssl/apps/asn1parse.c b/crypto/openssl/apps/asn1parse.c
index 4540d5f5fb6e..fbd9d7c3349d 100644
--- a/crypto/openssl/apps/asn1parse.c
+++ b/crypto/openssl/apps/asn1parse.c
@@ -20,40 +20,51 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_IN, OPT_OUT, OPT_INDENT, OPT_NOOUT,
-    OPT_OID, OPT_OFFSET, OPT_LENGTH, OPT_DUMP, OPT_DLIMIT,
-    OPT_STRPARSE, OPT_GENSTR, OPT_GENCONF, OPT_STRICTPEM,
+    OPT_INFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_INDENT,
+    OPT_NOOUT,
+    OPT_OID,
+    OPT_OFFSET,
+    OPT_LENGTH,
+    OPT_DUMP,
+    OPT_DLIMIT,
+    OPT_STRPARSE,
+    OPT_GENSTR,
+    OPT_GENCONF,
+    OPT_STRICTPEM,
     OPT_ITEM
 } OPTION_CHOICE;
 
 const OPTIONS asn1parse_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"oid", OPT_OID, '<', "file of extra oid definitions"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "oid", OPT_OID, '<', "file of extra oid definitions" },
 
     OPT_SECTION("I/O"),
-    {"inform", OPT_INFORM, 'A', "input format - one of DER PEM B64"},
-    {"in", OPT_IN, '<', "input file"},
-    {"out", OPT_OUT, '>', "output file (output format is always DER)"},
-    {"noout", OPT_NOOUT, 0, "do not produce any output"},
-    {"offset", OPT_OFFSET, 'p', "offset into file"},
-    {"length", OPT_LENGTH, 'p', "length of section in file"},
-    {"strparse", OPT_STRPARSE, 'p',
-     "offset; a series of these can be used to 'dig'"},
-    {OPT_MORE_STR, 0, 0, "into multiple ASN1 blob wrappings"},
-    {"genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from"},
-    {"genconf", OPT_GENCONF, 's', "file to generate ASN1 structure from"},
-    {"strictpem", OPT_STRICTPEM, 0,
-     "equivalent to '-inform pem' (obsolete)"},
-    {"item", OPT_ITEM, 's', "item to parse and print"},
-    {OPT_MORE_STR, 0, 0, "(-inform  will be ignored)"},
+    { "inform", OPT_INFORM, 'A', "input format - one of DER PEM B64" },
+    { "in", OPT_IN, '<', "input file" },
+    { "out", OPT_OUT, '>', "output file (output format is always DER)" },
+    { "noout", OPT_NOOUT, 0, "do not produce any output" },
+    { "offset", OPT_OFFSET, 'p', "offset into file" },
+    { "length", OPT_LENGTH, 'p', "length of section in file" },
+    { "strparse", OPT_STRPARSE, 'p',
+        "offset; a series of these can be used to 'dig'" },
+    { OPT_MORE_STR, 0, 0, "into multiple ASN1 blob wrappings" },
+    { "genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from" },
+    { "genconf", OPT_GENCONF, 's', "file to generate ASN1 structure from" },
+    { "strictpem", OPT_STRICTPEM, 0,
+        "equivalent to '-inform pem' (obsolete)" },
+    { "item", OPT_ITEM, 's', "item to parse and print" },
+    { OPT_MORE_STR, 0, 0, "(-inform  will be ignored)" },
 
     OPT_SECTION("Formatting"),
-    {"i", OPT_INDENT, 0, "indents the output"},
-    {"dump", OPT_DUMP, 0, "unknown data in hex form"},
-    {"dlimit", OPT_DLIMIT, 'p',
-     "dump the first arg bytes of unknown data in hex form"},
-    {NULL}
+    { "i", OPT_INDENT, 0, "indents the output" },
+    { "dump", OPT_DUMP, 0, "unknown data in hex form" },
+    { "dlimit", OPT_DLIMIT, 'p',
+        "dump the first arg bytes of unknown data in hex form" },
+    { NULL }
 };
 
 static int do_generate(char *genstr, const char *genconf, BUF_MEM *buf);
@@ -88,7 +99,7 @@ int asn1parse_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -189,7 +200,7 @@ int asn1parse_main(int argc, char **argv)
         buf->length = buf->max = num;
     } else {
         if (!BUF_MEM_grow(buf, BUFSIZ * 8))
-            goto end;           /* Pre-allocate :-) */
+            goto end; /* Pre-allocate :-) */
 
         if (genstr || genconf) {
             num = do_generate(genstr, genconf, buf);
@@ -224,7 +235,6 @@ int asn1parse_main(int argc, char **argv)
             }
         }
         str = (unsigned char *)buf->data;
-
     }
 
     /* If any structs to parse go through in sequence */
@@ -238,7 +248,7 @@ int asn1parse_main(int argc, char **argv)
             j = strtol(sk_OPENSSL_STRING_value(osk, i), NULL, 0);
             if (j <= 0 || j >= tmplen) {
                 BIO_printf(bio_err, "'%s' is out of range\n",
-                           sk_OPENSSL_STRING_value(osk, i));
+                    sk_OPENSSL_STRING_value(osk, i));
                 continue;
             }
             tmpbuf += j;
@@ -304,7 +314,7 @@ int asn1parse_main(int argc, char **argv)
         }
     }
     ret = 0;
- end:
+end:
     BIO_free(derout);
     BIO_free(in);
     BIO_free(b64);
@@ -358,7 +368,7 @@ static int do_generate(char *genstr, const char *genconf, BUF_MEM *buf)
     ASN1_TYPE_free(atyp);
     return len;
 
- err:
+err:
     NCONF_free(cnf);
     ASN1_TYPE_free(atyp);
     return -1;
diff --git a/crypto/openssl/apps/ca.c b/crypto/openssl/apps/ca.c
index 6d1d1c0a6ea0..02b00c7c03ec 100644
--- a/crypto/openssl/apps/ca.c
+++ b/crypto/openssl/apps/ca.c
@@ -26,114 +26,114 @@
 #include <openssl/pem.h>
 
 #ifndef W_OK
-# ifdef OPENSSL_SYS_VMS
-#  include <unistd.h>
-# elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_TANDEM)
-#  include <sys/file.h>
-# endif
+#ifdef OPENSSL_SYS_VMS
+#include <unistd.h>
+#elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_TANDEM)
+#include <sys/file.h>
+#endif
 #endif
 
 #include "apps.h"
 #include "progs.h"
 
 #ifndef W_OK
-# define F_OK 0
-# define W_OK 2
-# define R_OK 4
+#define F_OK 0
+#define W_OK 2
+#define R_OK 4
 #endif
 
 #ifndef PATH_MAX
-# define PATH_MAX 4096
+#define PATH_MAX 4096
 #endif
 
-#define BASE_SECTION            "ca"
+#define BASE_SECTION "ca"
 
-#define ENV_DEFAULT_CA          "default_ca"
+#define ENV_DEFAULT_CA "default_ca"
 
-#define STRING_MASK             "string_mask"
-#define UTF8_IN                 "utf8"
+#define STRING_MASK "string_mask"
+#define UTF8_IN "utf8"
 
-#define ENV_NEW_CERTS_DIR       "new_certs_dir"
-#define ENV_CERTIFICATE         "certificate"
-#define ENV_SERIAL              "serial"
-#define ENV_RAND_SERIAL         "rand_serial"
-#define ENV_CRLNUMBER           "crlnumber"
-#define ENV_PRIVATE_KEY         "private_key"
-#define ENV_DEFAULT_DAYS        "default_days"
-#define ENV_DEFAULT_STARTDATE   "default_startdate"
-#define ENV_DEFAULT_ENDDATE     "default_enddate"
-#define ENV_DEFAULT_CRL_DAYS    "default_crl_days"
-#define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
-#define ENV_DEFAULT_MD          "default_md"
-#define ENV_DEFAULT_EMAIL_DN    "email_in_dn"
-#define ENV_PRESERVE            "preserve"
-#define ENV_POLICY              "policy"
-#define ENV_EXTENSIONS          "x509_extensions"
-#define ENV_CRLEXT              "crl_extensions"
-#define ENV_MSIE_HACK           "msie_hack"
-#define ENV_NAMEOPT             "name_opt"
-#define ENV_CERTOPT             "cert_opt"
-#define ENV_EXTCOPY             "copy_extensions"
-#define ENV_UNIQUE_SUBJECT      "unique_subject"
+#define ENV_NEW_CERTS_DIR "new_certs_dir"
+#define ENV_CERTIFICATE "certificate"
+#define ENV_SERIAL "serial"
+#define ENV_RAND_SERIAL "rand_serial"
+#define ENV_CRLNUMBER "crlnumber"
+#define ENV_PRIVATE_KEY "private_key"
+#define ENV_DEFAULT_DAYS "default_days"
+#define ENV_DEFAULT_STARTDATE "default_startdate"
+#define ENV_DEFAULT_ENDDATE "default_enddate"
+#define ENV_DEFAULT_CRL_DAYS "default_crl_days"
+#define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
+#define ENV_DEFAULT_MD "default_md"
+#define ENV_DEFAULT_EMAIL_DN "email_in_dn"
+#define ENV_PRESERVE "preserve"
+#define ENV_POLICY "policy"
+#define ENV_EXTENSIONS "x509_extensions"
+#define ENV_CRLEXT "crl_extensions"
+#define ENV_MSIE_HACK "msie_hack"
+#define ENV_NAMEOPT "name_opt"
+#define ENV_CERTOPT "cert_opt"
+#define ENV_EXTCOPY "copy_extensions"
+#define ENV_UNIQUE_SUBJECT "unique_subject"
 
-#define ENV_DATABASE            "database"
+#define ENV_DATABASE "database"
 
 /* Additional revocation information types */
 typedef enum {
-    REV_VALID             = -1, /* Valid (not-revoked) status */
-    REV_NONE              = 0, /* No additional information */
-    REV_CRL_REASON        = 1, /* Value is CRL reason code */
-    REV_HOLD              = 2, /* Value is hold instruction */
-    REV_KEY_COMPROMISE    = 3, /* Value is cert key compromise time */
-    REV_CA_COMPROMISE     = 4  /* Value is CA key compromise time */
+    REV_VALID = -1, /* Valid (not-revoked) status */
+    REV_NONE = 0, /* No additional information */
+    REV_CRL_REASON = 1, /* Value is CRL reason code */
+    REV_HOLD = 2, /* Value is hold instruction */
+    REV_KEY_COMPROMISE = 3, /* Value is cert key compromise time */
+    REV_CA_COMPROMISE = 4 /* Value is CA key compromise time */
 } REVINFO_TYPE;
 
 static char *lookup_conf(const CONF *conf, const char *group, const char *tag);
 
 static int certify(X509 **xret, const char *infile, int informat,
-                   EVP_PKEY *pkey, X509 *x509,
-                   const char *dgst,
-                   STACK_OF(OPENSSL_STRING) *sigopts,
-                   STACK_OF(OPENSSL_STRING) *vfyopts,
-                   STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-                   BIGNUM *serial, const char *subj, unsigned long chtype,
-                   int multirdn, int email_dn, const char *startdate,
-                   const char *enddate,
-                   long days, int batch, const char *ext_sect, CONF *conf,
-                   int verbose, unsigned long certopt, unsigned long nameopt,
-                   int default_op, int ext_copy, int selfsign, unsigned long dateopt);
+    EVP_PKEY *pkey, X509 *x509,
+    const char *dgst,
+    STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(OPENSSL_STRING) *vfyopts,
+    STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+    BIGNUM *serial, const char *subj, unsigned long chtype,
+    int multirdn, int email_dn, const char *startdate,
+    const char *enddate,
+    long days, int batch, const char *ext_sect, CONF *conf,
+    int verbose, unsigned long certopt, unsigned long nameopt,
+    int default_op, int ext_copy, int selfsign, unsigned long dateopt);
 static int certify_cert(X509 **xret, const char *infile, int certformat,
-                        const char *passin, EVP_PKEY *pkey, X509 *x509,
-                        const char *dgst,
-                        STACK_OF(OPENSSL_STRING) *sigopts,
-                        STACK_OF(OPENSSL_STRING) *vfyopts,
-                        STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-                        BIGNUM *serial, const char *subj, unsigned long chtype,
-                        int multirdn, int email_dn, const char *startdate,
-                        const char *enddate, long days, int batch, const char *ext_sect,
-                        CONF *conf, int verbose, unsigned long certopt,
-                        unsigned long nameopt, int default_op, int ext_copy, unsigned long dateopt);
+    const char *passin, EVP_PKEY *pkey, X509 *x509,
+    const char *dgst,
+    STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(OPENSSL_STRING) *vfyopts,
+    STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+    BIGNUM *serial, const char *subj, unsigned long chtype,
+    int multirdn, int email_dn, const char *startdate,
+    const char *enddate, long days, int batch, const char *ext_sect,
+    CONF *conf, int verbose, unsigned long certopt,
+    unsigned long nameopt, int default_op, int ext_copy, unsigned long dateopt);
 static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
-                         X509 *x509, const char *dgst,
-                         STACK_OF(OPENSSL_STRING) *sigopts,
-                         STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-                         BIGNUM *serial, const char *subj, unsigned long chtype,
-                         int multirdn, int email_dn, const char *startdate,
-                         const char *enddate, long days, const char *ext_sect, CONF *conf,
-                         int verbose, unsigned long certopt,
-                         unsigned long nameopt, int default_op, int ext_copy, unsigned long dateopt);
+    X509 *x509, const char *dgst,
+    STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+    BIGNUM *serial, const char *subj, unsigned long chtype,
+    int multirdn, int email_dn, const char *startdate,
+    const char *enddate, long days, const char *ext_sect, CONF *conf,
+    int verbose, unsigned long certopt,
+    unsigned long nameopt, int default_op, int ext_copy, unsigned long dateopt);
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
-                   const char *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
-                   STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
-                   const char *subj, unsigned long chtype, int multirdn,
-                   int email_dn, const char *startdate, const char *enddate, long days,
-                   int batch, int verbose, X509_REQ *req, const char *ext_sect,
-                   CONF *conf, unsigned long certopt, unsigned long nameopt,
-                   int default_op, int ext_copy, int selfsign, unsigned long dateopt);
+    const char *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
+    const char *subj, unsigned long chtype, int multirdn,
+    int email_dn, const char *startdate, const char *enddate, long days,
+    int batch, int verbose, X509_REQ *req, const char *ext_sect,
+    CONF *conf, unsigned long certopt, unsigned long nameopt,
+    int default_op, int ext_copy, int selfsign, unsigned long dateopt);
 static int get_certificate_status(const char *ser_status, CA_DB *db);
 static int check_time_format(const char *str);
 static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
-                     const char *extval);
+    const char *extval);
 static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg);
 static int make_revoked(X509_REVOKED *rev, const char *str);
 static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str);
@@ -145,122 +145,167 @@ static int msie_hack = 0;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8,
-    OPT_CREATE_SERIAL, OPT_MULTIVALUE_RDN, OPT_STARTDATE, OPT_ENDDATE,
-    OPT_DAYS, OPT_MD, OPT_POLICY, OPT_KEYFILE, OPT_KEYFORM, OPT_PASSIN,
-    OPT_KEY, OPT_CERT, OPT_CERTFORM, OPT_SELFSIGN,
-    OPT_IN, OPT_INFORM, OPT_OUT, OPT_DATEOPT, OPT_OUTDIR, OPT_VFYOPT,
-    OPT_SIGOPT, OPT_NOTEXT, OPT_BATCH, OPT_PRESERVEDN, OPT_NOEMAILDN,
-    OPT_GENCRL, OPT_MSIE_HACK, OPT_CRL_LASTUPDATE, OPT_CRL_NEXTUPDATE,
-    OPT_CRLDAYS, OPT_CRLHOURS, OPT_CRLSEC, OPT_NOT_BEFORE, OPT_NOT_AFTER,
-    OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID,
-    OPT_EXTENSIONS, OPT_EXTFILE, OPT_STATUS, OPT_UPDATEDB, OPT_CRLEXTS,
-    OPT_RAND_SERIAL, OPT_QUIET,
-    OPT_R_ENUM, OPT_PROV_ENUM,
+    OPT_ENGINE,
+    OPT_VERBOSE,
+    OPT_CONFIG,
+    OPT_NAME,
+    OPT_SUBJ,
+    OPT_UTF8,
+    OPT_CREATE_SERIAL,
+    OPT_MULTIVALUE_RDN,
+    OPT_STARTDATE,
+    OPT_ENDDATE,
+    OPT_DAYS,
+    OPT_MD,
+    OPT_POLICY,
+    OPT_KEYFILE,
+    OPT_KEYFORM,
+    OPT_PASSIN,
+    OPT_KEY,
+    OPT_CERT,
+    OPT_CERTFORM,
+    OPT_SELFSIGN,
+    OPT_IN,
+    OPT_INFORM,
+    OPT_OUT,
+    OPT_DATEOPT,
+    OPT_OUTDIR,
+    OPT_VFYOPT,
+    OPT_SIGOPT,
+    OPT_NOTEXT,
+    OPT_BATCH,
+    OPT_PRESERVEDN,
+    OPT_NOEMAILDN,
+    OPT_GENCRL,
+    OPT_MSIE_HACK,
+    OPT_CRL_LASTUPDATE,
+    OPT_CRL_NEXTUPDATE,
+    OPT_CRLDAYS,
+    OPT_CRLHOURS,
+    OPT_CRLSEC,
+    OPT_NOT_BEFORE,
+    OPT_NOT_AFTER,
+    OPT_INFILES,
+    OPT_SS_CERT,
+    OPT_SPKAC,
+    OPT_REVOKE,
+    OPT_VALID,
+    OPT_EXTENSIONS,
+    OPT_EXTFILE,
+    OPT_STATUS,
+    OPT_UPDATEDB,
+    OPT_CRLEXTS,
+    OPT_RAND_SERIAL,
+    OPT_QUIET,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM,
     /* Do not change the order here; see related case statements below */
-    OPT_CRL_REASON, OPT_CRL_HOLD, OPT_CRL_COMPROMISE, OPT_CRL_CA_COMPROMISE
+    OPT_CRL_REASON,
+    OPT_CRL_HOLD,
+    OPT_CRL_COMPROMISE,
+    OPT_CRL_CA_COMPROMISE
 } OPTION_CHOICE;
 
 const OPTIONS ca_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [certreq...]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [certreq...]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"verbose", OPT_VERBOSE, '-', "Verbose output during processing"},
-    {"quiet", OPT_QUIET, '-', "Terse output during processing"},
-    {"outdir", OPT_OUTDIR, '/', "Where to put output cert"},
-    {"in", OPT_IN, '<', "The input cert request(s)"},
-    {"inform", OPT_INFORM, 'F',
-     "CSR input format to use (PEM or DER; by default try PEM first)"},
-    {"infiles", OPT_INFILES, '-', "The last argument, requests to process"},
-    {"out", OPT_OUT, '>', "Where to put the output file(s)"},
-    {"dateopt", OPT_DATEOPT, 's', "Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822."},
-    {"notext", OPT_NOTEXT, '-', "Do not print the generated certificate"},
-    {"batch", OPT_BATCH, '-', "Don't ask questions"},
-    {"msie_hack", OPT_MSIE_HACK, '-',
-     "msie modifications to handle all Universal Strings"},
-    {"ss_cert", OPT_SS_CERT, '<', "File contains a self signed cert to sign"},
-    {"spkac", OPT_SPKAC, '<',
-     "File contains DN and signed public key and challenge"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "verbose", OPT_VERBOSE, '-', "Verbose output during processing" },
+    { "quiet", OPT_QUIET, '-', "Terse output during processing" },
+    { "outdir", OPT_OUTDIR, '/', "Where to put output cert" },
+    { "in", OPT_IN, '<', "The input cert request(s)" },
+    { "inform", OPT_INFORM, 'F',
+        "CSR input format to use (PEM or DER; by default try PEM first)" },
+    { "infiles", OPT_INFILES, '-', "The last argument, requests to process" },
+    { "out", OPT_OUT, '>', "Where to put the output file(s)" },
+    { "dateopt", OPT_DATEOPT, 's', "Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822." },
+    { "notext", OPT_NOTEXT, '-', "Do not print the generated certificate" },
+    { "batch", OPT_BATCH, '-', "Don't ask questions" },
+    { "msie_hack", OPT_MSIE_HACK, '-',
+        "msie modifications to handle all Universal Strings" },
+    { "ss_cert", OPT_SS_CERT, '<', "File contains a self signed cert to sign" },
+    { "spkac", OPT_SPKAC, '<',
+        "File contains DN and signed public key and challenge" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Configuration"),
-    {"config", OPT_CONFIG, 's', "A config file"},
-    {"name", OPT_NAME, 's', "The particular CA definition to use"},
-    {"section", OPT_NAME, 's', "An alias for -name"},
-    {"policy", OPT_POLICY, 's', "The CA 'policy' to support"},
+    { "config", OPT_CONFIG, 's', "A config file" },
+    { "name", OPT_NAME, 's', "The particular CA definition to use" },
+    { "section", OPT_NAME, 's', "An alias for -name" },
+    { "policy", OPT_POLICY, 's', "The CA 'policy' to support" },
 
     OPT_SECTION("Certificate"),
-    {"subj", OPT_SUBJ, 's', "Use arg instead of request's subject"},
-    {"utf8", OPT_UTF8, '-', "Input characters are UTF8; default ASCII"},
-    {"create_serial", OPT_CREATE_SERIAL, '-',
-     "If reading serial fails, create a new random serial"},
-    {"rand_serial", OPT_RAND_SERIAL, '-',
-     "Always create a random serial; do not store it"},
-    {"multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
-     "Deprecated; multi-valued RDNs support is always on."},
-    {"startdate", OPT_STARTDATE, 's',
-     "[CC]YYMMDDHHMMSSZ value for notBefore certificate field"},
-    {"not_before", OPT_NOT_BEFORE, 's', "An alias for -startdate"},
-    {"enddate", OPT_ENDDATE, 's',
-     "[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days"},
-    {"not_after", OPT_NOT_AFTER, 's', "An alias for -enddate"},
-    {"days", OPT_DAYS, 'p', "Number of days from today to certify the cert for"},
-    {"extensions", OPT_EXTENSIONS, 's',
-     "Extension section (override value in config file)"},
-    {"extfile", OPT_EXTFILE, '<',
-     "Configuration file with X509v3 extensions to add"},
-    {"preserveDN", OPT_PRESERVEDN, '-', "Don't re-order the DN"},
-    {"noemailDN", OPT_NOEMAILDN, '-', "Don't add the EMAIL field to the DN"},
+    { "subj", OPT_SUBJ, 's', "Use arg instead of request's subject" },
+    { "utf8", OPT_UTF8, '-', "Input characters are UTF8; default ASCII" },
+    { "create_serial", OPT_CREATE_SERIAL, '-',
+        "If reading serial fails, create a new random serial" },
+    { "rand_serial", OPT_RAND_SERIAL, '-',
+        "Always create a random serial; do not store it" },
+    { "multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
+        "Deprecated; multi-valued RDNs support is always on." },
+    { "startdate", OPT_STARTDATE, 's',
+        "[CC]YYMMDDHHMMSSZ value for notBefore certificate field" },
+    { "not_before", OPT_NOT_BEFORE, 's', "An alias for -startdate" },
+    { "enddate", OPT_ENDDATE, 's',
+        "[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days" },
+    { "not_after", OPT_NOT_AFTER, 's', "An alias for -enddate" },
+    { "days", OPT_DAYS, 'p', "Number of days from today to certify the cert for" },
+    { "extensions", OPT_EXTENSIONS, 's',
+        "Extension section (override value in config file)" },
+    { "extfile", OPT_EXTFILE, '<',
+        "Configuration file with X509v3 extensions to add" },
+    { "preserveDN", OPT_PRESERVEDN, '-', "Don't re-order the DN" },
+    { "noemailDN", OPT_NOEMAILDN, '-', "Don't add the EMAIL field to the DN" },
 
     OPT_SECTION("Signing"),
-    {"md", OPT_MD, 's', "Digest to use, such as sha256"},
-    {"keyfile", OPT_KEYFILE, 's', "The CA private key"},
-    {"keyform", OPT_KEYFORM, 'f',
-     "Private key file format (ENGINE, other values ignored)"},
-    {"passin", OPT_PASSIN, 's', "Key and cert input file pass phrase source"},
-    {"key", OPT_KEY, 's',
-     "Key to decrypt the private key or cert files if encrypted. Better use -passin"},
-    {"cert", OPT_CERT, '<', "The CA cert"},
-    {"certform", OPT_CERTFORM, 'F',
-     "Certificate input format (DER/PEM/P12); has no effect"},
-    {"selfsign", OPT_SELFSIGN, '-',
-     "Sign a cert with the key associated with it"},
-    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
-    {"vfyopt", OPT_VFYOPT, 's', "Verification parameter in n:v form"},
+    { "md", OPT_MD, 's', "Digest to use, such as sha256" },
+    { "keyfile", OPT_KEYFILE, 's', "The CA private key" },
+    { "keyform", OPT_KEYFORM, 'f',
+        "Private key file format (ENGINE, other values ignored)" },
+    { "passin", OPT_PASSIN, 's', "Key and cert input file pass phrase source" },
+    { "key", OPT_KEY, 's',
+        "Key to decrypt the private key or cert files if encrypted. Better use -passin" },
+    { "cert", OPT_CERT, '<', "The CA cert" },
+    { "certform", OPT_CERTFORM, 'F',
+        "Certificate input format (DER/PEM/P12); has no effect" },
+    { "selfsign", OPT_SELFSIGN, '-',
+        "Sign a cert with the key associated with it" },
+    { "sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form" },
+    { "vfyopt", OPT_VFYOPT, 's', "Verification parameter in n:v form" },
 
     OPT_SECTION("Revocation"),
-    {"gencrl", OPT_GENCRL, '-', "Generate a new CRL"},
-    {"valid", OPT_VALID, 's',
-     "Add a Valid(not-revoked) DB entry about a cert (given in file)"},
-    {"status", OPT_STATUS, 's', "Shows cert status given the serial number"},
-    {"updatedb", OPT_UPDATEDB, '-', "Updates db for expired cert"},
-    {"crlexts", OPT_CRLEXTS, 's',
-     "CRL extension section (override value in config file)"},
-    {"crl_reason", OPT_CRL_REASON, 's', "revocation reason"},
-    {"crl_hold", OPT_CRL_HOLD, 's',
-     "the hold instruction, an OID. Sets revocation reason to certificateHold"},
-    {"crl_compromise", OPT_CRL_COMPROMISE, 's',
-     "sets compromise time to val and the revocation reason to keyCompromise"},
-    {"crl_CA_compromise", OPT_CRL_CA_COMPROMISE, 's',
-     "sets compromise time to val and the revocation reason to CACompromise"},
-    {"crl_lastupdate", OPT_CRL_LASTUPDATE, 's',
-     "Sets the CRL lastUpdate time to val (YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ)"},
-    {"crl_nextupdate", OPT_CRL_NEXTUPDATE, 's',
-     "Sets the CRL nextUpdate time to val (YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ)"},
-    {"crldays", OPT_CRLDAYS, 'p', "Days until the next CRL is due"},
-    {"crlhours", OPT_CRLHOURS, 'p', "Hours until the next CRL is due"},
-    {"crlsec", OPT_CRLSEC, 'p', "Seconds until the next CRL is due"},
-    {"revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)"},
+    { "gencrl", OPT_GENCRL, '-', "Generate a new CRL" },
+    { "valid", OPT_VALID, 's',
+        "Add a Valid(not-revoked) DB entry about a cert (given in file)" },
+    { "status", OPT_STATUS, 's', "Shows cert status given the serial number" },
+    { "updatedb", OPT_UPDATEDB, '-', "Updates db for expired cert" },
+    { "crlexts", OPT_CRLEXTS, 's',
+        "CRL extension section (override value in config file)" },
+    { "crl_reason", OPT_CRL_REASON, 's', "revocation reason" },
+    { "crl_hold", OPT_CRL_HOLD, 's',
+        "the hold instruction, an OID. Sets revocation reason to certificateHold" },
+    { "crl_compromise", OPT_CRL_COMPROMISE, 's',
+        "sets compromise time to val and the revocation reason to keyCompromise" },
+    { "crl_CA_compromise", OPT_CRL_CA_COMPROMISE, 's',
+        "sets compromise time to val and the revocation reason to CACompromise" },
+    { "crl_lastupdate", OPT_CRL_LASTUPDATE, 's',
+        "Sets the CRL lastUpdate time to val (YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ)" },
+    { "crl_nextupdate", OPT_CRL_NEXTUPDATE, 's',
+        "Sets the CRL nextUpdate time to val (YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ)" },
+    { "crldays", OPT_CRLDAYS, 'p', "Days until the next CRL is due" },
+    { "crlhours", OPT_CRLHOURS, 'p', "Hours until the next CRL is due" },
+    { "crlsec", OPT_CRLSEC, 'p', "Seconds until the next CRL is due" },
+    { "revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"certreq", 0, 0, "Certificate requests to be signed (optional)"},
-    {NULL}
+    { "certreq", 0, 0, "Certificate requests to be signed (optional)" },
+    { NULL }
 };
 
 int ca_main(int argc, char **argv)
@@ -313,7 +358,7 @@ int ca_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
-opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -493,7 +538,7 @@ opthelp:
         case OPT_CRLEXTS:
             crl_ext = opt_arg();
             break;
-        case OPT_CRL_REASON:   /* := REV_CRL_REASON */
+        case OPT_CRL_REASON: /* := REV_CRL_REASON */
         case OPT_CRL_HOLD:
         case OPT_CRL_COMPROMISE:
         case OPT_CRL_CA_COMPROMISE:
@@ -610,7 +655,7 @@ end_of_options:
 
         if (!X509_check_private_key(x509, pkey)) {
             BIO_printf(bio_err,
-                       "CA certificate and CA private key do not match\n");
+                "CA certificate and CA private key do not match\n");
             goto end;
         }
     }
@@ -657,7 +702,7 @@ end_of_options:
         outdir = NCONF_get_string(conf, section, ENV_NEW_CERTS_DIR);
         if (outdir == NULL) {
             BIO_printf(bio_err,
-                       "there needs to be defined a directory for new certificate to be placed in\n");
+                "there needs to be defined a directory for new certificate to be placed in\n");
             goto end;
         }
 #ifndef OPENSSL_SYS_VMS
@@ -693,12 +738,11 @@ end_of_options:
         pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
         if ((pp[DB_type][0] != DB_TYPE_REV) && (pp[DB_rev_date][0] != '\0')) {
             BIO_printf(bio_err,
-                       "entry %d: not revoked yet, but has a revocation date\n",
-                       i + 1);
+                "entry %d: not revoked yet, but has a revocation date\n",
+                i + 1);
             goto end;
         }
-        if ((pp[DB_type][0] == DB_TYPE_REV) &&
-            !make_revoked(NULL, pp[DB_rev_date])) {
+        if ((pp[DB_type][0] == DB_TYPE_REV) && !make_revoked(NULL, pp[DB_rev_date])) {
             BIO_printf(bio_err, " in entry %d\n", i + 1);
             goto end;
         }
@@ -714,14 +758,14 @@ end_of_options:
         }
         if ((j & 1) || (j < 2)) {
             BIO_printf(bio_err, "entry %d: bad serial number length (%d)\n",
-                       i + 1, j);
+                i + 1, j);
             goto end;
         }
-        for ( ; *p; p++) {
+        for (; *p; p++) {
             if (!isxdigit(_UC(*p))) {
                 BIO_printf(bio_err,
-                           "entry %d: bad char 0%o '%c' in serial number\n",
-                           i + 1, *p, *p);
+                    "entry %d: bad char 0%o '%c' in serial number\n",
+                    i + 1, *p, *p);
                 goto end;
             }
         }
@@ -729,7 +773,7 @@ end_of_options:
     if (verbose) {
         TXT_DB_write(bio_out, db->db);
         BIO_printf(bio_err, "%d entries loaded from the database\n",
-                   sk_OPENSSL_PSTRING_num(db->db->data));
+            sk_OPENSSL_PSTRING_num(db->db->data));
         BIO_printf(bio_err, "generating index\n");
     }
 
@@ -771,12 +815,11 @@ end_of_options:
 
         if (verbose)
             BIO_printf(bio_err, "Successfully loaded extensions file %s\n",
-                       extfile);
+                extfile);
 
         /* We can have sections in the ext file */
         if (extensions == NULL) {
-            extensions =
-                app_conf_try_string(extfile_conf, "default", "extensions");
+            extensions = app_conf_try_string(extfile_conf, "default", "extensions");
             if (extensions == NULL)
                 extensions = "default";
         }
@@ -803,8 +846,8 @@ end_of_options:
     if (def_ret == 2 && strcmp(def_dgst, "UNDEF") == 0) {
         dgst = NULL;
     } else if (dgst == NULL
-               && (dgst = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL
-               && strcmp(def_dgst, "UNDEF") != 0) {
+        && (dgst = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL
+        && strcmp(def_dgst, "UNDEF") != 0) {
         goto end;
     } else {
         if (strcmp(dgst, "default") == 0 || strcmp(def_dgst, "UNDEF") == 0) {
@@ -820,8 +863,7 @@ end_of_options:
         if (email_dn == 1) {
             char *tmp_email_dn = NULL;
 
-            tmp_email_dn =
-                app_conf_try_string(conf, section, ENV_DEFAULT_EMAIL_DN);
+            tmp_email_dn = app_conf_try_string(conf, section, ENV_DEFAULT_EMAIL_DN);
             if (tmp_email_dn != NULL && strcmp(tmp_email_dn, "no") == 0)
                 email_dn = 0;
         }
@@ -850,8 +892,8 @@ end_of_options:
             X509V3_set_nconf(&ctx, extfile_conf);
             if (!X509V3_EXT_add_nconf(extfile_conf, &ctx, extensions, NULL)) {
                 BIO_printf(bio_err,
-                           "Error checking certificate extensions from extfile section %s\n",
-                           extensions);
+                    "Error checking certificate extensions from extfile section %s\n",
+                    extensions);
                 ret = 1;
                 goto end;
             }
@@ -870,8 +912,8 @@ end_of_options:
                 X509V3_set_nconf(&ctx, conf);
                 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions, NULL)) {
                     BIO_printf(bio_err,
-                               "Error checking certificate extension config section %s\n",
-                               extensions);
+                        "Error checking certificate extension config section %s\n",
+                        extensions);
                     ret = 1;
                     goto end;
                 }
@@ -879,8 +921,7 @@ end_of_options:
         }
 
         if (startdate == NULL)
-            startdate =
-                app_conf_try_string(conf, section, ENV_DEFAULT_STARTDATE);
+            startdate = app_conf_try_string(conf, section, ENV_DEFAULT_STARTDATE);
         if (enddate == NULL)
             enddate = app_conf_try_string(conf, section, ENV_DEFAULT_ENDDATE);
         if (days == 0) {
@@ -893,7 +934,7 @@ end_of_options:
         }
         if (days != 0 && enddate != NULL)
             BIO_printf(bio_err,
-                       "Warning: -enddate or -not_after option overriding -days option\n");
+                "Warning: -enddate or -not_after option overriding -days option\n");
 
         if (rand_ser) {
             if ((serial = BN_new()) == NULL || !rand_serial(serial, NULL)) {
@@ -930,10 +971,10 @@ end_of_options:
         if (spkac_file != NULL) {
             total++;
             j = certify_spkac(&x, spkac_file, pkey, x509, dgst, sigopts,
-                              attribs, db, serial, subj, chtype, multirdn,
-                              email_dn, startdate, enddate, days, extensions,
-                              conf, verbose, certopt, get_nameopt(), default_op,
-                              ext_copy, dateopt);
+                attribs, db, serial, subj, chtype, multirdn,
+                email_dn, startdate, enddate, days, extensions,
+                conf, verbose, certopt, get_nameopt(), default_op,
+                ext_copy, dateopt);
             if (j < 0)
                 goto end;
             if (j > 0) {
@@ -950,11 +991,11 @@ end_of_options:
         if (ss_cert_file != NULL) {
             total++;
             j = certify_cert(&x, ss_cert_file, certformat, passin, pkey,
-                             x509, dgst, sigopts, vfyopts, attribs,
-                             db, serial, subj, chtype, multirdn, email_dn,
-                             startdate, enddate, days, batch, extensions,
-                             conf, verbose, certopt, get_nameopt(), default_op,
-                             ext_copy, dateopt);
+                x509, dgst, sigopts, vfyopts, attribs,
+                db, serial, subj, chtype, multirdn, email_dn,
+                startdate, enddate, days, batch, extensions,
+                conf, verbose, certopt, get_nameopt(), default_op,
+                ext_copy, dateopt);
             if (j < 0)
                 goto end;
             if (j > 0) {
@@ -971,10 +1012,10 @@ end_of_options:
         if (infile != NULL) {
             total++;
             j = certify(&x, infile, informat, pkey, x509p, dgst,
-                        sigopts, vfyopts, attribs, db,
-                        serial, subj, chtype, multirdn, email_dn, startdate,
-                        enddate, days, batch, extensions, conf, verbose,
-                        certopt, get_nameopt(), default_op, ext_copy, selfsign, dateopt);
+                sigopts, vfyopts, attribs, db,
+                serial, subj, chtype, multirdn, email_dn, startdate,
+                enddate, days, batch, extensions, conf, verbose,
+                certopt, get_nameopt(), default_op, ext_copy, selfsign, dateopt);
             if (j < 0)
                 goto end;
             if (j > 0) {
@@ -991,11 +1032,11 @@ end_of_options:
         for (i = 0; i < argc; i++) {
             total++;
             j = certify(&x, argv[i], informat, pkey, x509p, dgst,
-                        sigopts, vfyopts,
-                        attribs, db,
-                        serial, subj, chtype, multirdn, email_dn, startdate,
-                        enddate, days, batch, extensions, conf, verbose,
-                        certopt, get_nameopt(), default_op, ext_copy, selfsign, dateopt);
+                sigopts, vfyopts,
+                attribs, db,
+                serial, subj, chtype, multirdn, email_dn, startdate,
+                enddate, days, batch, extensions, conf, verbose,
+                certopt, get_nameopt(), default_op, ext_copy, selfsign, dateopt);
             if (j < 0)
                 goto end;
             if (j > 0) {
@@ -1020,8 +1061,8 @@ end_of_options:
         if (sk_X509_num(cert_sk) > 0) {
             if (!batch) {
                 BIO_printf(bio_err,
-                           "\n%d out of %d certificate requests certified, commit? [y/n]",
-                           total_done, total);
+                    "\n%d out of %d certificate requests certified, commit? [y/n]",
+                    total_done, total);
                 (void)BIO_flush(bio_err);
                 tmp[0] = '\0';
                 if (fgets(tmp, sizeof(tmp), stdin) == NULL) {
@@ -1037,10 +1078,10 @@ end_of_options:
             }
 
             BIO_printf(bio_err, "Write out database with %d new entries\n",
-                       sk_X509_num(cert_sk));
+                sk_X509_num(cert_sk));
 
             if (serialfile != NULL
-                    && !save_serial(serialfile, "new", serial, NULL))
+                && !save_serial(serialfile, "new", serial, NULL))
                 goto end;
 
             if (!save_index(dbfile, "new", db))
@@ -1084,12 +1125,12 @@ end_of_options:
             *(n++) = 'p';
             *(n++) = 'e';
             *(n++) = 'm';
-            *n = '\0';          /* closing new_cert */
+            *n = '\0'; /* closing new_cert */
             if (verbose)
                 BIO_printf(bio_err, "writing %s\n", new_cert);
 
             Sout = bio_open_default(outfile, 'w',
-                                    output_der ? FORMAT_ASN1 : FORMAT_TEXT);
+                output_der ? FORMAT_ASN1 : FORMAT_TEXT);
             if (Sout == NULL)
                 goto end;
 
@@ -1108,7 +1149,7 @@ end_of_options:
         if (sk_X509_num(cert_sk)) {
             /* Rename the database and the serial file */
             if (serialfile != NULL
-                    && !rotate_serial(serialfile, "new", "old"))
+                && !rotate_serial(serialfile, "new", "old"))
                 goto end;
 
             if (!rotate_index(dbfile, "new", "old"))
@@ -1132,7 +1173,7 @@ end_of_options:
             X509V3_set_nconf(&ctx, conf);
             if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL)) {
                 BIO_printf(bio_err,
-                           "Error checking CRL extension section %s\n", crl_ext);
+                    "Error checking CRL extension section %s\n", crl_ext);
                 ret = 1;
                 goto end;
             }
@@ -1149,16 +1190,15 @@ end_of_options:
 
         if (!crldays && !crlhours && !crlsec) {
             if (!app_conf_try_number(conf, section,
-                                  ENV_DEFAULT_CRL_DAYS, &crldays))
+                    ENV_DEFAULT_CRL_DAYS, &crldays))
                 crldays = 0;
             if (!app_conf_try_number(conf, section,
-                                  ENV_DEFAULT_CRL_HOURS, &crlhours))
+                    ENV_DEFAULT_CRL_HOURS, &crlhours))
                 crlhours = 0;
         }
-        if ((crl_nextupdate == NULL) &&
-                (crldays == 0) && (crlhours == 0) && (crlsec == 0)) {
+        if ((crl_nextupdate == NULL) && (crldays == 0) && (crlhours == 0) && (crlsec == 0)) {
             BIO_printf(bio_err,
-                       "cannot lookup how long until the next CRL is issued\n");
+                "cannot lookup how long until the next CRL is issued\n");
             goto end;
         }
 
@@ -1176,7 +1216,7 @@ end_of_options:
         }
 
         if (!set_crl_nextupdate(crl, crl_nextupdate,
-                                crldays, crlhours, crlsec)) {
+                crldays, crlhours, crlsec)) {
             BIO_puts(bio_err, "error setting CRL nextUpdate\n");
             ret = 1;
             goto end;
@@ -1225,7 +1265,7 @@ end_of_options:
             if (crl_ext != NULL)
                 if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx, crl_ext, crl)) {
                     BIO_printf(bio_err,
-                               "Error adding CRL extensions from section %s\n", crl_ext);
+                        "Error adding CRL extensions from section %s\n", crl_ext);
                     goto end;
                 }
             if (crlnumberfile != NULL) {
@@ -1246,7 +1286,7 @@ end_of_options:
 
         /* we have a CRL number that need updating */
         if (crlnumberfile != NULL
-                && !save_serial(crlnumberfile, "new", crlnumber, NULL))
+            && !save_serial(crlnumberfile, "new", crlnumber, NULL))
             goto end;
 
         BN_free(crlnumber);
@@ -1256,7 +1296,7 @@ end_of_options:
             goto end;
 
         Sout = bio_open_default(outfile, 'w',
-                                output_der ? FORMAT_ASN1 : FORMAT_TEXT);
+            output_der ? FORMAT_ASN1 : FORMAT_TEXT);
         if (Sout == NULL)
             goto end;
 
@@ -1264,9 +1304,8 @@ end_of_options:
 
         /* Rename the crlnumber file */
         if (crlnumberfile != NULL
-                && !rotate_serial(crlnumberfile, "new", "old"))
+            && !rotate_serial(crlnumberfile, "new", "old"))
             goto end;
-
     }
     /*****************************************************************/
     if (dorevoke) {
@@ -1277,7 +1316,7 @@ end_of_options:
             X509 *revcert;
 
             revcert = load_cert_pass(infile, informat, 1, passin,
-                                     "certificate to be revoked");
+                "certificate to be revoked");
             if (revcert == NULL)
                 goto end;
             if (dorevoke == 2)
@@ -1298,7 +1337,7 @@ end_of_options:
     }
     ret = 0;
 
- end:
+end:
     if (ret)
         ERR_print_errors(bio_err);
     BIO_free_all(Sout);
@@ -1332,17 +1371,17 @@ static char *lookup_conf(const CONF *conf, const char *section, const char *tag)
 }
 
 static int certify(X509 **xret, const char *infile, int informat,
-                   EVP_PKEY *pkey, X509 *x509,
-                   const char *dgst,
-                   STACK_OF(OPENSSL_STRING) *sigopts,
-                   STACK_OF(OPENSSL_STRING) *vfyopts,
-                   STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-                   BIGNUM *serial, const char *subj, unsigned long chtype,
-                   int multirdn, int email_dn, const char *startdate,
-                   const char *enddate,
-                   long days, int batch, const char *ext_sect, CONF *lconf,
-                   int verbose, unsigned long certopt, unsigned long nameopt,
-                   int default_op, int ext_copy, int selfsign, unsigned long dateopt)
+    EVP_PKEY *pkey, X509 *x509,
+    const char *dgst,
+    STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(OPENSSL_STRING) *vfyopts,
+    STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+    BIGNUM *serial, const char *subj, unsigned long chtype,
+    int multirdn, int email_dn, const char *startdate,
+    const char *enddate,
+    long days, int batch, const char *ext_sect, CONF *lconf,
+    int verbose, unsigned long certopt, unsigned long nameopt,
+    int default_op, int ext_copy, int selfsign, unsigned long dateopt)
 {
     X509_REQ *req = NULL;
     EVP_PKEY *pktmp = NULL;
@@ -1363,7 +1402,7 @@ static int certify(X509 **xret, const char *infile, int informat,
 
     if (selfsign && !X509_REQ_check_private_key(req, pkey)) {
         BIO_printf(bio_err,
-                   "Certificate request and CA private key do not match\n");
+            "Certificate request and CA private key do not match\n");
         goto end;
     }
     i = do_X509_REQ_verify(req, pktmp, vfyopts);
@@ -1373,33 +1412,33 @@ static int certify(X509 **xret, const char *infile, int informat,
     }
     if (i == 0) {
         BIO_printf(bio_err,
-                   "Signature did not match the certificate request\n");
+            "Signature did not match the certificate request\n");
         goto end;
     }
     BIO_printf(bio_err, "Signature ok\n");
 
     ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
-                 chtype, multirdn, email_dn, startdate, enddate, days, batch,
-                 verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
-                 ext_copy, selfsign, dateopt);
+        chtype, multirdn, email_dn, startdate, enddate, days, batch,
+        verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
+        ext_copy, selfsign, dateopt);
 
- end:
+end:
     ERR_print_errors(bio_err);
     X509_REQ_free(req);
     return ok;
 }
 
 static int certify_cert(X509 **xret, const char *infile, int certformat,
-                        const char *passin, EVP_PKEY *pkey, X509 *x509,
-                        const char *dgst,
-                        STACK_OF(OPENSSL_STRING) *sigopts,
-                        STACK_OF(OPENSSL_STRING) *vfyopts,
-                        STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-                        BIGNUM *serial, const char *subj, unsigned long chtype,
-                        int multirdn, int email_dn, const char *startdate,
-                        const char *enddate, long days, int batch, const char *ext_sect,
-                        CONF *lconf, int verbose, unsigned long certopt,
-                        unsigned long nameopt, int default_op, int ext_copy, unsigned long dateopt)
+    const char *passin, EVP_PKEY *pkey, X509 *x509,
+    const char *dgst,
+    STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(OPENSSL_STRING) *vfyopts,
+    STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+    BIGNUM *serial, const char *subj, unsigned long chtype,
+    int multirdn, int email_dn, const char *startdate,
+    const char *enddate, long days, int batch, const char *ext_sect,
+    CONF *lconf, int verbose, unsigned long certopt,
+    unsigned long nameopt, int default_op, int ext_copy, unsigned long dateopt)
 {
     X509 *template_cert = NULL;
     X509_REQ *rreq = NULL;
@@ -1407,7 +1446,8 @@ static int certify_cert(X509 **xret, const char *infile, int certformat,
     int ok = -1, i;
 
     if ((template_cert = load_cert_pass(infile, certformat, 1, passin,
-                                        "template certificate")) == NULL)
+             "template certificate"))
+        == NULL)
         goto end;
     if (verbose)
         X509_print(bio_err, template_cert);
@@ -1436,24 +1476,24 @@ static int certify_cert(X509 **xret, const char *infile, int certformat,
         goto end;
 
     ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
-                 chtype, multirdn, email_dn, startdate, enddate, days, batch,
-                 verbose, rreq, ext_sect, lconf, certopt, nameopt, default_op,
-                 ext_copy, 0, dateopt);
+        chtype, multirdn, email_dn, startdate, enddate, days, batch,
+        verbose, rreq, ext_sect, lconf, certopt, nameopt, default_op,
+        ext_copy, 0, dateopt);
 
- end:
+end:
     X509_REQ_free(rreq);
     X509_free(template_cert);
     return ok;
 }
 
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
-                   const char *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
-                   STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
-                   const char *subj, unsigned long chtype, int multirdn,
-                   int email_dn, const char *startdate, const char *enddate, long days,
-                   int batch, int verbose, X509_REQ *req, const char *ext_sect,
-                   CONF *lconf, unsigned long certopt, unsigned long nameopt,
-                   int default_op, int ext_copy, int selfsign, unsigned long dateopt)
+    const char *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
+    const char *subj, unsigned long chtype, int multirdn,
+    int email_dn, const char *startdate, const char *enddate, long days,
+    int batch, int verbose, X509_REQ *req, const char *ext_sect,
+    CONF *lconf, unsigned long certopt, unsigned long nameopt,
+    int default_op, int ext_copy, int selfsign, unsigned long dateopt)
 {
     const X509_NAME *name = NULL;
     X509_NAME *CAname = NULL, *subject = NULL;
@@ -1515,16 +1555,14 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         /* check some things */
         if (nid == NID_pkcs9_emailAddress && str->type != V_ASN1_IA5STRING) {
             BIO_printf(bio_err,
-                       "\nemailAddress type needs to be of type IA5STRING\n");
+                "\nemailAddress type needs to be of type IA5STRING\n");
             goto end;
         }
         if (str->type != V_ASN1_BMPSTRING && str->type != V_ASN1_UTF8STRING) {
             j = ASN1_PRINTABLE_type(str->data, str->length);
-            if ((j == V_ASN1_T61STRING && str->type != V_ASN1_T61STRING) ||
-                (j == V_ASN1_IA5STRING && str->type == V_ASN1_PRINTABLESTRING))
-            {
+            if ((j == V_ASN1_T61STRING && str->type != V_ASN1_T61STRING) || (j == V_ASN1_IA5STRING && str->type == V_ASN1_PRINTABLESTRING)) {
                 BIO_printf(bio_err,
-                           "\nThe string contains characters that are illegal for the ASN.1 type\n");
+                    "\nThe string contains characters that are illegal for the ASN.1 type\n");
                 goto end;
             }
         }
@@ -1552,8 +1590,8 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         cv = sk_CONF_VALUE_value(policy, i); /* get the object id */
         if ((j = OBJ_txt2nid(cv->name)) == NID_undef) {
             BIO_printf(bio_err,
-                       "%s:unknown object type in 'policy' configuration\n",
-                       cv->name);
+                "%s:unknown object type in 'policy' configuration\n",
+                cv->name);
             goto end;
         }
         obj = OBJ_nid2obj(j);
@@ -1580,8 +1618,8 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
             } else if (strcmp(cv->value, "supplied") == 0) {
                 if (tne == NULL) {
                     BIO_printf(bio_err,
-                               "The %s field needed to be supplied and was missing\n",
-                               cv->name);
+                        "The %s field needed to be supplied and was missing\n",
+                        cv->name);
                     goto end;
                 } else {
                     push = tne;
@@ -1591,19 +1629,20 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
                 if (tne == NULL) {
                     BIO_printf(bio_err,
-                               "The mandatory %s field was missing\n",
-                               cv->name);
+                        "The mandatory %s field was missing\n",
+                        cv->name);
                     goto end;
                 }
 
                 last2 = -1;
 
- again2:
+            again2:
                 j = X509_NAME_get_index_by_OBJ(CAname, obj, last2);
                 if ((j < 0) && (last2 == -1)) {
                     BIO_printf(bio_err,
-                               "The %s field does not exist in the CA certificate,\n"
-                               "the 'policy' is misconfigured\n", cv->name);
+                        "The %s field does not exist in the CA certificate,\n"
+                        "the 'policy' is misconfigured\n",
+                        cv->name);
                     goto end;
                 }
                 if (j >= 0) {
@@ -1616,17 +1655,17 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
                 }
                 if (j < 0) {
                     BIO_printf(bio_err,
-                               "The %s field is different between\n"
-                               "CA certificate (%s) and the request (%s)\n",
-                               cv->name,
-                               ((str2 == NULL) ? "NULL" : (char *)str2->data),
-                               ((str == NULL) ? "NULL" : (char *)str->data));
+                        "The %s field is different between\n"
+                        "CA certificate (%s) and the request (%s)\n",
+                        cv->name,
+                        ((str2 == NULL) ? "NULL" : (char *)str2->data),
+                        ((str == NULL) ? "NULL" : (char *)str->data));
                     goto end;
                 }
             } else {
                 BIO_printf(bio_err,
-                           "%s:invalid type in 'policy' configuration\n",
-                           cv->value);
+                    "%s:invalid type in 'policy' configuration\n",
+                    cv->value);
                 goto end;
             }
 
@@ -1652,7 +1691,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     /* We are now totally happy, lets make and sign the certificate */
     if (verbose)
         BIO_printf(bio_err,
-                   "Everything appears to be ok, creating and signing the certificate\n");
+            "Everything appears to be ok, creating and signing the certificate\n");
 
     if ((ret = X509_new_ex(app_get0_libctx(), app_get0_propq())) == NULL)
         goto end;
@@ -1688,15 +1727,15 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
     /* Initialize the context structure */
     X509V3_set_ctx(&ext_ctx, selfsign ? ret : x509,
-                   ret, NULL /* no need to give req, needed info is in ret */,
-                   NULL, X509V3_CTX_REPLACE);
+        ret, NULL /* no need to give req, needed info is in ret */,
+        NULL, X509V3_CTX_REPLACE);
     /* prepare fallback for AKID, but only if issuer cert equals subject cert */
     if (selfsign) {
         if (!X509V3_set_issuer_pkey(&ext_ctx, pkey))
             goto end;
         if (!cert_matches_key(ret, pkey))
             BIO_printf(bio_err,
-                       "Warning: Signature key and public key of cert do not match\n");
+                "Warning: Signature key and public key of cert do not match\n");
     }
 
     /* Lets add the extensions, if there are any */
@@ -1711,27 +1750,27 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
             /* Adds exts contained in the configuration file */
             if (!X509V3_EXT_add_nconf(extfile_conf, &ext_ctx, ext_sect, ret)) {
                 BIO_printf(bio_err,
-                           "Error adding certificate extensions from extfile section %s\n",
-                           ext_sect);
+                    "Error adding certificate extensions from extfile section %s\n",
+                    ext_sect);
                 goto end;
             }
             if (verbose)
                 BIO_printf(bio_err,
-                           "Successfully added extensions from file.\n");
+                    "Successfully added extensions from file.\n");
         } else if (ext_sect) {
             /* We found extensions to be set from config file */
             X509V3_set_nconf(&ext_ctx, lconf);
 
             if (!X509V3_EXT_add_nconf(lconf, &ext_ctx, ext_sect, ret)) {
                 BIO_printf(bio_err,
-                           "Error adding certificate extensions from config section %s\n",
-                           ext_sect);
+                    "Error adding certificate extensions from config section %s\n",
+                    ext_sect);
                 goto end;
             }
 
             if (verbose)
                 BIO_printf(bio_err,
-                           "Successfully added extensions from config\n");
+                    "Successfully added extensions from config\n");
         }
     }
 
@@ -1744,7 +1783,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
     if (verbose)
         BIO_printf(bio_err,
-                   "The subject name appears to be ok, checking database for clashes\n");
+            "The subject name appears to be ok, checking database for clashes\n");
 
     /* Build the correct Subject if no e-mail is wanted in the subject. */
     if (!email_dn) {
@@ -1761,8 +1800,9 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         }
         i = -1;
         while ((i = X509_NAME_get_index_by_NID(dn_subject,
-                                               NID_pkcs9_emailAddress,
-                                               i)) >= 0) {
+                    NID_pkcs9_emailAddress,
+                    i))
+            >= 0) {
             tmpne = X509_NAME_delete_entry(dn_subject, i--);
             X509_NAME_ENTRY_free(tmpne);
         }
@@ -1809,18 +1849,18 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         rrow = TXT_DB_get_by_index(db->db, DB_name, crow);
         if (rrow != NULL) {
             BIO_printf(bio_err,
-                       "ERROR:There is already a certificate for %s\n",
-                       row[DB_name]);
+                "ERROR:There is already a certificate for %s\n",
+                row[DB_name]);
         }
     }
     if (rrow == NULL) {
         rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
         if (rrow != NULL) {
             BIO_printf(bio_err,
-                       "ERROR:Serial number %s has already been issued,\n",
-                       row[DB_serial]);
+                "ERROR:Serial number %s has already been issued,\n",
+                row[DB_serial]);
             BIO_printf(bio_err,
-                       "      check the database/serial_file for corruption\n");
+                "      check the database/serial_file for corruption\n");
         }
     }
 
@@ -1857,7 +1897,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         if (p == NULL)
             p = "undef";
         BIO_printf(bio_err, "Subject Name  :%s\n", p);
-        ok = -1;                /* This is now a 'bad' error. */
+        ok = -1; /* This is now a 'bad' error. */
         goto end;
     }
 
@@ -1883,7 +1923,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         buf[0] = '\0';
         if (fgets(buf, sizeof(buf), stdin) == NULL) {
             BIO_printf(bio_err,
-                       "CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
+                "CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
             ok = 0;
             goto end;
         }
@@ -1895,8 +1935,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     }
 
     pktmp = X509_get0_pubkey(ret);
-    if (EVP_PKEY_missing_parameters(pktmp) &&
-        !EVP_PKEY_missing_parameters(pkey))
+    if (EVP_PKEY_missing_parameters(pktmp) && !EVP_PKEY_missing_parameters(pkey))
         EVP_PKEY_copy_parameters(pktmp, pkey);
 
     if (!do_X509_sign(ret, 0, pkey, dgst, sigopts, &ext_ctx))
@@ -1928,7 +1967,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     }
     irow = NULL;
     ok = 1;
- end:
+end:
     if (ok != 1) {
         for (i = 0; i < DB_NUMBER; i++)
             OPENSSL_free(row[i]);
@@ -1957,14 +1996,14 @@ static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
 }
 
 static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
-                         X509 *x509, const char *dgst,
-                         STACK_OF(OPENSSL_STRING) *sigopts,
-                         STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-                         BIGNUM *serial, const char *subj, unsigned long chtype,
-                         int multirdn, int email_dn, const char *startdate,
-                         const char *enddate, long days, const char *ext_sect,
-                         CONF *lconf, int verbose, unsigned long certopt,
-                         unsigned long nameopt, int default_op, int ext_copy, unsigned long dateopt)
+    X509 *x509, const char *dgst,
+    STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(CONF_VALUE) *policy, CA_DB *db,
+    BIGNUM *serial, const char *subj, unsigned long chtype,
+    int multirdn, int email_dn, const char *startdate,
+    const char *enddate, long days, const char *ext_sect,
+    CONF *lconf, int verbose, unsigned long certopt,
+    unsigned long nameopt, int default_op, int ext_copy, unsigned long dateopt)
 {
     STACK_OF(CONF_VALUE) *sk = NULL;
     LHASH_OF(CONF_VALUE) *parms = NULL;
@@ -2035,7 +2074,7 @@ static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
                 if (spki == NULL) {
                     BIO_printf(bio_err,
-                               "unable to load Netscape SPKAC structure\n");
+                        "unable to load Netscape SPKAC structure\n");
                     goto end;
                 }
             }
@@ -2043,12 +2082,12 @@ static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
         }
 
         if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
-                                        (unsigned char *)buf, -1, -1, 0))
+                (unsigned char *)buf, -1, -1, 0))
             goto end;
     }
     if (spki == NULL) {
         BIO_printf(bio_err, "Netscape SPKAC structure not found in %s\n",
-                   infile);
+            infile);
         goto end;
     }
 
@@ -2067,7 +2106,7 @@ static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
     if (j <= 0) {
         EVP_PKEY_free(pktmp);
         BIO_printf(bio_err,
-                   "signature verification failed on SPKAC public key\n");
+            "signature verification failed on SPKAC public key\n");
         goto end;
     }
     BIO_printf(bio_err, "Signature ok\n");
@@ -2075,10 +2114,10 @@ static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
     X509_REQ_set_pubkey(req, pktmp);
     EVP_PKEY_free(pktmp);
     ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
-                 chtype, multirdn, email_dn, startdate, enddate, days, 1,
-                 verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
-                 ext_copy, 0, dateopt);
- end:
+        chtype, multirdn, email_dn, startdate, enddate, days, 1,
+        verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
+        ext_copy, 0, dateopt);
+end:
     X509_REQ_free(req);
     CONF_free(parms);
     NETSCAPE_SPKI_free(spki);
@@ -2093,7 +2132,7 @@ static int check_time_format(const char *str)
 }
 
 static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
-                     const char *value)
+    const char *value)
 {
     const ASN1_TIME *tm = NULL;
     char *row[DB_NUMBER], **rrow, **irow;
@@ -2128,8 +2167,8 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
     rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
     if (rrow == NULL) {
         BIO_printf(bio_err,
-                   "Adding Entry with serial number %s to DB for %s\n",
-                   row[DB_serial], row[DB_name]);
+            "Adding Entry with serial number %s to DB for %s\n",
+            row[DB_serial], row[DB_name]);
 
         /* We now just add it to the database as DB_TYPE_REV('V') */
         row[DB_type] = OPENSSL_strdup("V");
@@ -2174,11 +2213,11 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
         goto end;
     } else if (rev_type == REV_VALID) {
         BIO_printf(bio_err, "ERROR:Already present, serial number %s\n",
-                   row[DB_serial]);
+            row[DB_serial]);
         goto end;
     } else if (rrow[DB_type][0] == DB_TYPE_REV) {
         BIO_printf(bio_err, "ERROR:Already revoked, serial number %s\n",
-                   row[DB_serial]);
+            row[DB_serial]);
         goto end;
     } else {
         BIO_printf(bio_err, "Revoking Certificate %s.\n", rrow[DB_serial]);
@@ -2192,7 +2231,7 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
         rrow[DB_rev_date] = rev_str;
     }
     ok = 1;
- end:
+end:
     for (i = 0; i < DB_NUMBER; i++)
         OPENSSL_free(row[i]);
     return ok;
@@ -2239,26 +2278,26 @@ static int get_certificate_status(const char *serial, CA_DB *db)
         goto end;
     } else if (rrow[DB_type][0] == DB_TYPE_VAL) {
         BIO_printf(bio_err, "%s=Valid (%c)\n",
-                   row[DB_serial], rrow[DB_type][0]);
+            row[DB_serial], rrow[DB_type][0]);
         goto end;
     } else if (rrow[DB_type][0] == DB_TYPE_REV) {
         BIO_printf(bio_err, "%s=Revoked (%c)\n",
-                   row[DB_serial], rrow[DB_type][0]);
+            row[DB_serial], rrow[DB_type][0]);
         goto end;
     } else if (rrow[DB_type][0] == DB_TYPE_EXP) {
         BIO_printf(bio_err, "%s=Expired (%c)\n",
-                   row[DB_serial], rrow[DB_type][0]);
+            row[DB_serial], rrow[DB_type][0]);
         goto end;
     } else if (rrow[DB_type][0] == DB_TYPE_SUSP) {
         BIO_printf(bio_err, "%s=Suspended (%c)\n",
-                   row[DB_serial], rrow[DB_type][0]);
+            row[DB_serial], rrow[DB_type][0]);
         goto end;
     } else {
         BIO_printf(bio_err, "%s=Unknown (%c).\n",
-                   row[DB_serial], rrow[DB_type][0]);
+            row[DB_serial], rrow[DB_type][0]);
         ok = -1;
     }
- end:
+end:
     for (i = 0; i < DB_NUMBER; i++) {
         OPENSSL_free(row[i]);
     }
@@ -2385,8 +2424,8 @@ static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg)
         /* Argument is the key compromise time  */
         if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg)) {
             BIO_printf(bio_err,
-                       "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n",
-                       rev_arg);
+                "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n",
+                rev_arg);
             return NULL;
         }
         other = rev_arg;
@@ -2460,13 +2499,11 @@ static int make_revoked(X509_REVOKED *rev, const char *str)
     }
 
     if (rev && comp_time) {
-        if (X509_REVOKED_add1_ext_i2d
-            (rev, NID_invalidity_date, comp_time, 0, 0) <= 0)
+        if (X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0) <= 0)
             goto end;
     }
     if (rev && hold) {
-        if (X509_REVOKED_add1_ext_i2d
-            (rev, NID_hold_instruction_code, hold, 0, 0) <= 0)
+        if (X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0) <= 0)
             goto end;
     }
 
@@ -2475,7 +2512,7 @@ static int make_revoked(X509_REVOKED *rev, const char *str)
     else
         ret = 1;
 
- end:
+end:
 
     OPENSSL_free(tmp);
     ASN1_OBJECT_free(hold);
@@ -2528,7 +2565,7 @@ static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str)
 }
 
 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
-                   ASN1_GENERALIZEDTIME **pinvtm, const char *str)
+    ASN1_GENERALIZEDTIME **pinvtm, const char *str)
 {
     char *tmp;
     char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
@@ -2630,7 +2667,7 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
 
     ret = 1;
 
- end:
+end:
 
     OPENSSL_free(tmp);
     ASN1_GENERALIZEDTIME_free(comp_time);
diff --git a/crypto/openssl/apps/ciphers.c b/crypto/openssl/apps/ciphers.c
index c33685d8ced6..dc52b9f912ab 100644
--- a/crypto/openssl/apps/ciphers.c
+++ b/crypto/openssl/apps/ciphers.c
@@ -28,58 +28,61 @@ typedef enum OPTION_choice {
     OPT_PSK,
     OPT_SRP,
     OPT_CIPHERSUITES,
-    OPT_V, OPT_UPPER_V, OPT_S, OPT_PROV_ENUM
+    OPT_V,
+    OPT_UPPER_V,
+    OPT_S,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS ciphers_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [cipher]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [cipher]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("Output"),
-    {"v", OPT_V, '-', "Verbose listing of the SSL/TLS ciphers"},
-    {"V", OPT_UPPER_V, '-', "Even more verbose"},
-    {"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
-    {"convert", OPT_CONVERT, 's', "Convert standard name into OpenSSL name"},
+    { "v", OPT_V, '-', "Verbose listing of the SSL/TLS ciphers" },
+    { "V", OPT_UPPER_V, '-', "Even more verbose" },
+    { "stdname", OPT_STDNAME, '-', "Show standard cipher names" },
+    { "convert", OPT_CONVERT, 's', "Convert standard name into OpenSSL name" },
 
     OPT_SECTION("Cipher specification"),
-    {"s", OPT_S, '-', "Only supported ciphers"},
+    { "s", OPT_S, '-', "Only supported ciphers" },
 #ifndef OPENSSL_NO_SSL3
-    {"ssl3", OPT_SSL3, '-', "Ciphers compatible with SSL3"},
+    { "ssl3", OPT_SSL3, '-', "Ciphers compatible with SSL3" },
 #endif
 #ifndef OPENSSL_NO_TLS1
-    {"tls1", OPT_TLS1, '-', "Ciphers compatible with TLS1"},
+    { "tls1", OPT_TLS1, '-', "Ciphers compatible with TLS1" },
 #endif
 #ifndef OPENSSL_NO_TLS1_1
-    {"tls1_1", OPT_TLS1_1, '-', "Ciphers compatible with TLS1.1"},
+    { "tls1_1", OPT_TLS1_1, '-', "Ciphers compatible with TLS1.1" },
 #endif
 #ifndef OPENSSL_NO_TLS1_2
-    {"tls1_2", OPT_TLS1_2, '-', "Ciphers compatible with TLS1.2"},
+    { "tls1_2", OPT_TLS1_2, '-', "Ciphers compatible with TLS1.2" },
 #endif
 #ifndef OPENSSL_NO_TLS1_3
-    {"tls1_3", OPT_TLS1_3, '-', "Ciphers compatible with TLS1.3"},
+    { "tls1_3", OPT_TLS1_3, '-', "Ciphers compatible with TLS1.3" },
 #endif
 #ifndef OPENSSL_NO_PSK
-    {"psk", OPT_PSK, '-', "Include ciphersuites requiring PSK"},
+    { "psk", OPT_PSK, '-', "Include ciphersuites requiring PSK" },
 #endif
 #ifndef OPENSSL_NO_SRP
-    {"srp", OPT_SRP, '-', "(deprecated) Include ciphersuites requiring SRP"},
+    { "srp", OPT_SRP, '-', "(deprecated) Include ciphersuites requiring SRP" },
 #endif
-    {"ciphersuites", OPT_CIPHERSUITES, 's',
-     "Configure the TLSv1.3 ciphersuites to use"},
+    { "ciphersuites", OPT_CIPHERSUITES, 's',
+        "Configure the TLSv1.3 ciphersuites to use" },
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"cipher", 0, 0, "Cipher string to decode (optional)"},
-    {NULL}
+    { "cipher", 0, 0, "Cipher string to decode (optional)" },
+    { NULL }
 };
 
 #ifndef OPENSSL_NO_PSK
 static unsigned int dummy_psk(SSL *ssl, const char *hint, char *identity,
-                              unsigned int max_identity_len,
-                              unsigned char *psk,
-                              unsigned int max_psk_len)
+    unsigned int max_identity_len,
+    unsigned char *psk,
+    unsigned int max_psk_len)
 {
     return 0;
 }
@@ -110,7 +113,7 @@ int ciphers_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -181,7 +184,7 @@ int ciphers_main(int argc, char **argv)
 
     if (convert != NULL) {
         BIO_printf(bio_out, "OpenSSL cipher name: %s\n",
-                   OPENSSL_cipher_name(convert));
+            OPENSSL_cipher_name(convert));
         ret = 0;
         goto end;
     }
@@ -273,9 +276,9 @@ int ciphers_main(int argc, char **argv)
 
     ret = 0;
     goto end;
- err:
+err:
     ERR_print_errors(bio_err);
- end:
+end:
     if (use_supported)
         sk_SSL_CIPHER_free(sk);
     SSL_CTX_free(ctx);
diff --git a/crypto/openssl/apps/cmp.c b/crypto/openssl/apps/cmp.c
index 2b4340d9fb45..f1af0b6c2b42 100644
--- a/crypto/openssl/apps/cmp.c
+++ b/crypto/openssl/apps/cmp.c
@@ -24,10 +24,10 @@
 
 /* tweaks needed due to missing unistd.h on Windows */
 #if defined(_WIN32) && !defined(__BORLANDC__)
-# define access _access
+#define access _access
 #endif
 #ifndef F_OK
-# define F_OK 0
+#define F_OK 0
 #endif
 
 #include <openssl/ui.h>
@@ -151,7 +151,7 @@ static int opt_revreason = CRL_REASON_NONE;
 /* credentials format */
 static char *opt_certform_s = "PEM";
 static int opt_certform = FORMAT_PEM;
-/* 
+/*
  * DER format is the preferred choice for saving a CRL because it allows for
  * more efficient storage, especially when dealing with large CRLs.
  */
@@ -229,40 +229,85 @@ static X509_VERIFY_PARAM *vpm = NULL;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_CONFIG, OPT_SECTION, OPT_VERBOSITY,
+    OPT_CONFIG,
+    OPT_SECTION,
+    OPT_VERBOSITY,
 
-    OPT_CMD, OPT_INFOTYPE, OPT_PROFILE, OPT_GENINFO,
-    OPT_TEMPLATE, OPT_KEYSPEC,
+    OPT_CMD,
+    OPT_INFOTYPE,
+    OPT_PROFILE,
+    OPT_GENINFO,
+    OPT_TEMPLATE,
+    OPT_KEYSPEC,
 
-    OPT_NEWKEY, OPT_NEWKEYPASS, OPT_CENTRALKEYGEN,
-    OPT_NEWKEYOUT, OPT_SUBJECT,
-    OPT_DAYS, OPT_REQEXTS,
-    OPT_SANS, OPT_SAN_NODEFAULT,
-    OPT_POLICIES, OPT_POLICY_OIDS, OPT_POLICY_OIDS_CRITICAL,
-    OPT_POPO, OPT_CSR,
-    OPT_OUT_TRUSTED, OPT_IMPLICIT_CONFIRM, OPT_DISABLE_CONFIRM,
-    OPT_CERTOUT, OPT_CHAINOUT,
+    OPT_NEWKEY,
+    OPT_NEWKEYPASS,
+    OPT_CENTRALKEYGEN,
+    OPT_NEWKEYOUT,
+    OPT_SUBJECT,
+    OPT_DAYS,
+    OPT_REQEXTS,
+    OPT_SANS,
+    OPT_SAN_NODEFAULT,
+    OPT_POLICIES,
+    OPT_POLICY_OIDS,
+    OPT_POLICY_OIDS_CRITICAL,
+    OPT_POPO,
+    OPT_CSR,
+    OPT_OUT_TRUSTED,
+    OPT_IMPLICIT_CONFIRM,
+    OPT_DISABLE_CONFIRM,
+    OPT_CERTOUT,
+    OPT_CHAINOUT,
 
-    OPT_OLDCERT, OPT_ISSUER, OPT_SERIAL, OPT_REVREASON,
+    OPT_OLDCERT,
+    OPT_ISSUER,
+    OPT_SERIAL,
+    OPT_REVREASON,
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
-    OPT_SERVER, OPT_PROXY, OPT_NO_PROXY,
+    OPT_SERVER,
+    OPT_PROXY,
+    OPT_NO_PROXY,
 #endif
-    OPT_RECIPIENT, OPT_PATH,
-    OPT_KEEP_ALIVE, OPT_MSG_TIMEOUT, OPT_TOTAL_TIMEOUT,
+    OPT_RECIPIENT,
+    OPT_PATH,
+    OPT_KEEP_ALIVE,
+    OPT_MSG_TIMEOUT,
+    OPT_TOTAL_TIMEOUT,
 
-    OPT_TRUSTED, OPT_UNTRUSTED, OPT_SRVCERT,
+    OPT_TRUSTED,
+    OPT_UNTRUSTED,
+    OPT_SRVCERT,
     OPT_EXPECT_SENDER,
-    OPT_IGNORE_KEYUSAGE, OPT_UNPROTECTED_ERRORS, OPT_NO_CACHE_EXTRACERTS,
-    OPT_SRVCERTOUT, OPT_EXTRACERTSOUT, OPT_CACERTSOUT,
-    OPT_OLDWITHOLD, OPT_NEWWITHNEW, OPT_NEWWITHOLD, OPT_OLDWITHNEW,
-    OPT_CRLCERT, OPT_OLDCRL, OPT_CRLOUT,
+    OPT_IGNORE_KEYUSAGE,
+    OPT_UNPROTECTED_ERRORS,
+    OPT_NO_CACHE_EXTRACERTS,
+    OPT_SRVCERTOUT,
+    OPT_EXTRACERTSOUT,
+    OPT_CACERTSOUT,
+    OPT_OLDWITHOLD,
+    OPT_NEWWITHNEW,
+    OPT_NEWWITHOLD,
+    OPT_OLDWITHNEW,
+    OPT_CRLCERT,
+    OPT_OLDCRL,
+    OPT_CRLOUT,
 
-    OPT_REF, OPT_SECRET, OPT_CERT, OPT_OWN_TRUSTED, OPT_KEY, OPT_KEYPASS,
-    OPT_DIGEST, OPT_MAC, OPT_EXTRACERTS,
+    OPT_REF,
+    OPT_SECRET,
+    OPT_CERT,
+    OPT_OWN_TRUSTED,
+    OPT_KEY,
+    OPT_KEYPASS,
+    OPT_DIGEST,
+    OPT_MAC,
+    OPT_EXTRACERTS,
     OPT_UNPROTECTED_REQUESTS,
 
-    OPT_CERTFORM, OPT_CRLFORM, OPT_KEYFORM,
+    OPT_CERTFORM,
+    OPT_CRLFORM,
+    OPT_KEYFORM,
     OPT_OTHERPASS,
 #ifndef OPENSSL_NO_ENGINE
     OPT_ENGINE,
@@ -271,368 +316,395 @@ typedef enum OPTION_choice {
     OPT_R_ENUM,
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
-    OPT_TLS_USED, OPT_TLS_CERT, OPT_TLS_KEY,
+    OPT_TLS_USED,
+    OPT_TLS_CERT,
+    OPT_TLS_KEY,
     OPT_TLS_KEYPASS,
-    OPT_TLS_EXTRA, OPT_TLS_TRUSTED, OPT_TLS_HOST,
+    OPT_TLS_EXTRA,
+    OPT_TLS_TRUSTED,
+    OPT_TLS_HOST,
 #endif
 
-    OPT_BATCH, OPT_REPEAT,
-    OPT_REQIN, OPT_REQIN_NEW_TID, OPT_REQOUT, OPT_REQOUT_ONLY,
-    OPT_RSPIN, OPT_RSPOUT,
+    OPT_BATCH,
+    OPT_REPEAT,
+    OPT_REQIN,
+    OPT_REQIN_NEW_TID,
+    OPT_REQOUT,
+    OPT_REQOUT_ONLY,
+    OPT_RSPIN,
+    OPT_RSPOUT,
     OPT_USE_MOCK_SRV,
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
-    OPT_PORT, OPT_MAX_MSGS,
+    OPT_PORT,
+    OPT_MAX_MSGS,
 #endif
-    OPT_SRV_REF, OPT_SRV_SECRET,
-    OPT_SRV_CERT, OPT_SRV_KEY, OPT_SRV_KEYPASS,
-    OPT_SRV_TRUSTED, OPT_SRV_UNTRUSTED,
-    OPT_REF_CERT, OPT_RSP_CERT, OPT_RSP_KEY, OPT_RSP_KEYPASS,
-    OPT_RSP_CRL, OPT_RSP_EXTRACERTS, OPT_RSP_CAPUBS,
-    OPT_RSP_NEWWITHNEW, OPT_RSP_NEWWITHOLD, OPT_RSP_OLDWITHNEW,
-    OPT_POLL_COUNT, OPT_CHECK_AFTER,
+    OPT_SRV_REF,
+    OPT_SRV_SECRET,
+    OPT_SRV_CERT,
+    OPT_SRV_KEY,
+    OPT_SRV_KEYPASS,
+    OPT_SRV_TRUSTED,
+    OPT_SRV_UNTRUSTED,
+    OPT_REF_CERT,
+    OPT_RSP_CERT,
+    OPT_RSP_KEY,
+    OPT_RSP_KEYPASS,
+    OPT_RSP_CRL,
+    OPT_RSP_EXTRACERTS,
+    OPT_RSP_CAPUBS,
+    OPT_RSP_NEWWITHNEW,
+    OPT_RSP_NEWWITHOLD,
+    OPT_RSP_OLDWITHNEW,
+    OPT_POLL_COUNT,
+    OPT_CHECK_AFTER,
     OPT_GRANT_IMPLICITCONF,
-    OPT_PKISTATUS, OPT_FAILURE,
-    OPT_FAILUREBITS, OPT_STATUSSTRING,
-    OPT_SEND_ERROR, OPT_SEND_UNPROTECTED,
-    OPT_SEND_UNPROT_ERR, OPT_ACCEPT_UNPROTECTED,
-    OPT_ACCEPT_UNPROT_ERR, OPT_ACCEPT_RAVERIFIED,
+    OPT_PKISTATUS,
+    OPT_FAILURE,
+    OPT_FAILUREBITS,
+    OPT_STATUSSTRING,
+    OPT_SEND_ERROR,
+    OPT_SEND_UNPROTECTED,
+    OPT_SEND_UNPROT_ERR,
+    OPT_ACCEPT_UNPROTECTED,
+    OPT_ACCEPT_UNPROT_ERR,
+    OPT_ACCEPT_RAVERIFIED,
 
     OPT_V_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS cmp_options[] = {
     /* entries must be in the same order as enumerated above!! */
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"config", OPT_CONFIG, 's',
-     "Configuration file to use. \"\" = none. Default from env variable OPENSSL_CONF"},
-    {"section", OPT_SECTION, 's',
-     "Section(s) in config file to get options from. \"\" = 'default'. Default 'cmp'"},
-    {"verbosity", OPT_VERBOSITY, 'N',
-     "Log level; 3=ERR, 4=WARN, 6=INFO, 7=DEBUG, 8=TRACE. Default 6 = INFO"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "config", OPT_CONFIG, 's',
+        "Configuration file to use. \"\" = none. Default from env variable OPENSSL_CONF" },
+    { "section", OPT_SECTION, 's',
+        "Section(s) in config file to get options from. \"\" = 'default'. Default 'cmp'" },
+    { "verbosity", OPT_VERBOSITY, 'N',
+        "Log level; 3=ERR, 4=WARN, 6=INFO, 7=DEBUG, 8=TRACE. Default 6 = INFO" },
 
     OPT_SECTION("Generic message"),
-    {"cmd", OPT_CMD, 's', "CMP request to send: ir/cr/kur/p10cr/rr/genm"},
-    {"infotype", OPT_INFOTYPE, 's',
-     "InfoType name for requesting specific info in genm, with specific support"},
-    {OPT_MORE_STR, 0, 0,
-     "for 'caCerts' and 'rootCaCert'"},
-    {"profile", OPT_PROFILE, 's',
-     "Certificate profile name to place in generalInfo field of request PKIHeader"},
-    {"geninfo", OPT_GENINFO, 's',
-     "Comma-separated list of OID and value to place in generalInfo PKIHeader"},
-    {OPT_MORE_STR, 0, 0,
-     "of form <OID>:int:<n> or <OID>:str:<s>, e.g. \'1.2.3.4:int:56789, id-kp:str:name'"},
+    { "cmd", OPT_CMD, 's', "CMP request to send: ir/cr/kur/p10cr/rr/genm" },
+    { "infotype", OPT_INFOTYPE, 's',
+        "InfoType name for requesting specific info in genm, with specific support" },
+    { OPT_MORE_STR, 0, 0,
+        "for 'caCerts' and 'rootCaCert'" },
+    { "profile", OPT_PROFILE, 's',
+        "Certificate profile name to place in generalInfo field of request PKIHeader" },
+    { "geninfo", OPT_GENINFO, 's',
+        "Comma-separated list of OID and value to place in generalInfo PKIHeader" },
+    { OPT_MORE_STR, 0, 0,
+        "of form <OID>:int:<n> or <OID>:str:<s>, e.g. \'1.2.3.4:int:56789, id-kp:str:name'" },
     { "template", OPT_TEMPLATE, 's',
-      "File to save certTemplate received in genp of type certReqTemplate"},
+        "File to save certTemplate received in genp of type certReqTemplate" },
     { "keyspec", OPT_KEYSPEC, 's',
-      "Optional file to save Key specification received in genp of type certReqTemplate"},
+        "Optional file to save Key specification received in genp of type certReqTemplate" },
 
     OPT_SECTION("Certificate enrollment"),
-    {"newkey", OPT_NEWKEY, 's',
-     "Private or public key for the requested cert. Default: CSR key or client key"},
-    {"newkeypass", OPT_NEWKEYPASS, 's', "New private key pass phrase source"},
-    {"centralkeygen", OPT_CENTRALKEYGEN, '-',
-     "Request central (server-side) key generation. Default is local generation"},
-    {"newkeyout", OPT_NEWKEYOUT, 's',
-     "File to save centrally generated key, in PEM format"},
-    {"subject", OPT_SUBJECT, 's',
-     "Distinguished Name (DN) of subject to use in the requested cert template"},
-    {OPT_MORE_STR, 0, 0,
-     "For kur, default is subject of -csr arg or reference cert (see -oldcert)"},
-    {OPT_MORE_STR, 0, 0,
-     "this default is used for ir and cr only if no Subject Alt Names are set"},
-    {"days", OPT_DAYS, 'N',
-     "Requested validity time of the new certificate in number of days"},
-    {"reqexts", OPT_REQEXTS, 's',
-     "Name of config file section defining certificate request extensions."},
-    {OPT_MORE_STR, 0, 0,
-     "Augments or replaces any extensions contained CSR given with -csr"},
-    {"sans", OPT_SANS, 's',
-     "Subject Alt Names (IPADDR/DNS/URI) to add as (critical) cert req extension"},
-    {"san_nodefault", OPT_SAN_NODEFAULT, '-',
-     "Do not take default SANs from reference certificate (see -oldcert)"},
-    {"policies", OPT_POLICIES, 's',
-     "Name of config file section defining policies certificate request extension"},
-    {"policy_oids", OPT_POLICY_OIDS, 's',
-     "Policy OID(s) to add as policies certificate request extension"},
-    {"policy_oids_critical", OPT_POLICY_OIDS_CRITICAL, '-',
-     "Flag the policy OID(s) given with -policy_oids as critical"},
-    {"popo", OPT_POPO, 'n',
-     "Proof-of-Possession (POPO) method to use for ir/cr/kur where"},
-    {OPT_MORE_STR, 0, 0,
-     "-1 = NONE, 0 = RAVERIFIED, 1 = SIGNATURE (default), 2 = KEYENC"},
-    {"csr", OPT_CSR, 's',
-     "PKCS#10 CSR file in PEM or DER format to convert or to use in p10cr"},
-    {"out_trusted", OPT_OUT_TRUSTED, 's',
-     "Certificates to trust when verifying newly enrolled certificates"},
-    {"implicit_confirm", OPT_IMPLICIT_CONFIRM, '-',
-     "Request implicit confirmation of newly enrolled certificates"},
-    {"disable_confirm", OPT_DISABLE_CONFIRM, '-',
-     "Do not confirm newly enrolled certificate w/o requesting implicit"},
-    {OPT_MORE_STR, 0, 0,
-     "confirmation. WARNING: This leads to behavior violating RFC 4210"},
-    {"certout", OPT_CERTOUT, 's',
-     "File to save newly enrolled certificate"},
-    {"chainout", OPT_CHAINOUT, 's',
-     "File to save the chain of newly enrolled certificate"},
+    { "newkey", OPT_NEWKEY, 's',
+        "Private or public key for the requested cert. Default: CSR key or client key" },
+    { "newkeypass", OPT_NEWKEYPASS, 's', "New private key pass phrase source" },
+    { "centralkeygen", OPT_CENTRALKEYGEN, '-',
+        "Request central (server-side) key generation. Default is local generation" },
+    { "newkeyout", OPT_NEWKEYOUT, 's',
+        "File to save centrally generated key, in PEM format" },
+    { "subject", OPT_SUBJECT, 's',
+        "Distinguished Name (DN) of subject to use in the requested cert template" },
+    { OPT_MORE_STR, 0, 0,
+        "For kur, default is subject of -csr arg or reference cert (see -oldcert)" },
+    { OPT_MORE_STR, 0, 0,
+        "this default is used for ir and cr only if no Subject Alt Names are set" },
+    { "days", OPT_DAYS, 'N',
+        "Requested validity time of the new certificate in number of days" },
+    { "reqexts", OPT_REQEXTS, 's',
+        "Name of config file section defining certificate request extensions." },
+    { OPT_MORE_STR, 0, 0,
+        "Augments or replaces any extensions contained CSR given with -csr" },
+    { "sans", OPT_SANS, 's',
+        "Subject Alt Names (IPADDR/DNS/URI) to add as (critical) cert req extension" },
+    { "san_nodefault", OPT_SAN_NODEFAULT, '-',
+        "Do not take default SANs from reference certificate (see -oldcert)" },
+    { "policies", OPT_POLICIES, 's',
+        "Name of config file section defining policies certificate request extension" },
+    { "policy_oids", OPT_POLICY_OIDS, 's',
+        "Policy OID(s) to add as policies certificate request extension" },
+    { "policy_oids_critical", OPT_POLICY_OIDS_CRITICAL, '-',
+        "Flag the policy OID(s) given with -policy_oids as critical" },
+    { "popo", OPT_POPO, 'n',
+        "Proof-of-Possession (POPO) method to use for ir/cr/kur where" },
+    { OPT_MORE_STR, 0, 0,
+        "-1 = NONE, 0 = RAVERIFIED, 1 = SIGNATURE (default), 2 = KEYENC" },
+    { "csr", OPT_CSR, 's',
+        "PKCS#10 CSR file in PEM or DER format to convert or to use in p10cr" },
+    { "out_trusted", OPT_OUT_TRUSTED, 's',
+        "Certificates to trust when verifying newly enrolled certificates" },
+    { "implicit_confirm", OPT_IMPLICIT_CONFIRM, '-',
+        "Request implicit confirmation of newly enrolled certificates" },
+    { "disable_confirm", OPT_DISABLE_CONFIRM, '-',
+        "Do not confirm newly enrolled certificate w/o requesting implicit" },
+    { OPT_MORE_STR, 0, 0,
+        "confirmation. WARNING: This leads to behavior violating RFC 9810" },
+    { "certout", OPT_CERTOUT, 's',
+        "File to save newly enrolled certificate" },
+    { "chainout", OPT_CHAINOUT, 's',
+        "File to save the chain of newly enrolled certificate" },
 
     OPT_SECTION("Certificate enrollment and revocation"),
 
-    {"oldcert", OPT_OLDCERT, 's',
-     "Certificate to be updated (defaulting to -cert) or to be revoked in rr;"},
-    {OPT_MORE_STR, 0, 0,
-     "also used as reference (defaulting to -cert) for subject DN and SANs."},
-    {OPT_MORE_STR, 0, 0,
-     "Issuer is used as recipient unless -recipient, -srvcert, or -issuer given"},
-    {"issuer", OPT_ISSUER, 's',
-     "DN of the issuer to place in the certificate template of ir/cr/kur/rr;"},
-    {OPT_MORE_STR, 0, 0,
-     "also used as recipient if neither -recipient nor -srvcert are given"},
-    {"serial", OPT_SERIAL, 's',
-     "Serial number of certificate to be revoked in revocation request (rr)"},
-    {"revreason", OPT_REVREASON, 'n',
-     "Reason code to include in revocation request (rr); possible values:"},
-    {OPT_MORE_STR, 0, 0,
-     "0..6, 8..10 (see RFC5280, 5.3.1) or -1. Default -1 = none included"},
+    { "oldcert", OPT_OLDCERT, 's',
+        "Certificate to be updated (defaulting to -cert) or to be revoked in rr;" },
+    { OPT_MORE_STR, 0, 0,
+        "also used as reference (defaulting to -cert) for subject DN and SANs." },
+    { OPT_MORE_STR, 0, 0,
+        "Issuer is used as recipient unless -recipient, -srvcert, or -issuer given" },
+    { "issuer", OPT_ISSUER, 's',
+        "DN of the issuer to place in the certificate template of ir/cr/kur/rr;" },
+    { OPT_MORE_STR, 0, 0,
+        "also used as recipient if neither -recipient nor -srvcert are given" },
+    { "serial", OPT_SERIAL, 's',
+        "Serial number of certificate to be revoked in revocation request (rr)" },
+    { "revreason", OPT_REVREASON, 'n',
+        "Reason code to include in revocation request (rr); possible values:" },
+    { OPT_MORE_STR, 0, 0,
+        "0..6, 8..10 (see RFC5280, 5.3.1) or -1. Default -1 = none included" },
 
     OPT_SECTION("Message transfer"),
 #if defined(OPENSSL_NO_SOCK) || defined(OPENSSL_NO_HTTP)
-    {OPT_MORE_STR, 0, 0,
-     "NOTE: -server, -proxy, and -no_proxy not supported due to no-sock/no-http build"},
+    { OPT_MORE_STR, 0, 0,
+        "NOTE: -server, -proxy, and -no_proxy not supported due to no-sock/no-http build" },
 #else
-    {"server", OPT_SERVER, 's',
-     "[http[s]://]address[:port][/path] of CMP server. Default port 80 or 443."},
-    {OPT_MORE_STR, 0, 0,
-     "address may be a DNS name or an IP address; path can be overridden by -path"},
-    {"proxy", OPT_PROXY, 's',
-     "[http[s]://]address[:port][/path] of HTTP(S) proxy to use; path is ignored"},
-    {"no_proxy", OPT_NO_PROXY, 's',
-     "List of addresses of servers not to use HTTP(S) proxy for"},
-    {OPT_MORE_STR, 0, 0,
-     "Default from environment variable 'no_proxy', else 'NO_PROXY', else none"},
+    { "server", OPT_SERVER, 's',
+        "[http[s]://]address[:port][/path] of CMP server. Default port 80 or 443." },
+    { OPT_MORE_STR, 0, 0,
+        "address may be a DNS name or an IP address; path can be overridden by -path" },
+    { "proxy", OPT_PROXY, 's',
+        "[http[s]://]address[:port][/path] of HTTP(S) proxy to use; path is ignored" },
+    { "no_proxy", OPT_NO_PROXY, 's',
+        "List of addresses of servers not to use HTTP(S) proxy for" },
+    { OPT_MORE_STR, 0, 0,
+        "Default from environment variable 'no_proxy', else 'NO_PROXY', else none" },
 #endif
-    {"recipient", OPT_RECIPIENT, 's',
-     "DN of CA. Default: subject of -srvcert, -issuer, issuer of -oldcert or -cert"},
-    {"path", OPT_PATH, 's',
-     "HTTP path (aka CMP alias) at the CMP server. Default from -server, else \"/\""},
-    {"keep_alive", OPT_KEEP_ALIVE, 'N',
-     "Persistent HTTP connections. 0: no, 1 (the default): request, 2: require"},
-    {"msg_timeout", OPT_MSG_TIMEOUT, 'N',
-     "Number of seconds allowed per CMP message round trip, or 0 for infinite"},
-    {"total_timeout", OPT_TOTAL_TIMEOUT, 'N',
-     "Overall time an enrollment incl. polling may take. Default 0 = infinite"},
+    { "recipient", OPT_RECIPIENT, 's',
+        "DN of CA. Default: subject of -srvcert, -issuer, issuer of -oldcert or -cert" },
+    { "path", OPT_PATH, 's',
+        "HTTP path (aka CMP alias) at the CMP server. Default from -server, else \"/\"" },
+    { "keep_alive", OPT_KEEP_ALIVE, 'N',
+        "Persistent HTTP connections. 0: no, 1 (the default): request, 2: require" },
+    { "msg_timeout", OPT_MSG_TIMEOUT, 'N',
+        "Number of seconds allowed per CMP message round trip, or 0 for infinite" },
+    { "total_timeout", OPT_TOTAL_TIMEOUT, 'N',
+        "Overall time an enrollment incl. polling may take. Default 0 = infinite" },
 
     OPT_SECTION("Server authentication"),
-    {"trusted", OPT_TRUSTED, 's',
-     "Certificates to use as trust anchors when verifying signed CMP responses"},
-    {OPT_MORE_STR, 0, 0, "unless -srvcert is given"},
-    {"untrusted", OPT_UNTRUSTED, 's',
-     "Intermediate CA certs for chain construction for CMP/TLS/enrolled certs"},
-    {"srvcert", OPT_SRVCERT, 's',
-     "Server cert to pin and trust directly when verifying signed CMP responses"},
-    {"expect_sender", OPT_EXPECT_SENDER, 's',
-     "DN of expected sender of responses. Defaults to subject of -srvcert, if any"},
-    {"ignore_keyusage", OPT_IGNORE_KEYUSAGE, '-',
-     "Ignore CMP signer cert key usage, else 'digitalSignature' must be allowed"},
-    {"unprotected_errors", OPT_UNPROTECTED_ERRORS, '-',
-     "Accept missing or invalid protection of regular error messages and negative"},
-    {OPT_MORE_STR, 0, 0,
-     "certificate responses (ip/cp/kup), revocation responses (rp), and PKIConf"},
-    {OPT_MORE_STR, 0, 0,
-     "WARNING: This setting leads to behavior allowing violation of RFC 4210"},
-    {"no_cache_extracerts", OPT_NO_CACHE_EXTRACERTS, '-',
-     "Do not keep certificates received in the extraCerts CMP message field"},
+    { "trusted", OPT_TRUSTED, 's',
+        "Certificates to use as trust anchors when verifying signed CMP responses" },
+    { OPT_MORE_STR, 0, 0, "unless -srvcert is given" },
+    { "untrusted", OPT_UNTRUSTED, 's',
+        "Intermediate CA certs for chain construction for CMP/TLS/enrolled certs" },
+    { "srvcert", OPT_SRVCERT, 's',
+        "Server cert to pin and trust directly when verifying signed CMP responses" },
+    { "expect_sender", OPT_EXPECT_SENDER, 's',
+        "DN of expected sender of responses. Defaults to subject of -srvcert, if any" },
+    { "ignore_keyusage", OPT_IGNORE_KEYUSAGE, '-',
+        "Ignore CMP signer cert key usage, else 'digitalSignature' must be allowed" },
+    { "unprotected_errors", OPT_UNPROTECTED_ERRORS, '-',
+        "Accept missing or invalid protection of regular error messages and negative" },
+    { OPT_MORE_STR, 0, 0,
+        "certificate responses (ip/cp/kup), revocation responses (rp), and PKIConf" },
+    { OPT_MORE_STR, 0, 0,
+        "WARNING: This setting leads to behavior allowing violation of RFC 9810" },
+    { "no_cache_extracerts", OPT_NO_CACHE_EXTRACERTS, '-',
+        "Do not keep certificates received in the extraCerts CMP message field" },
     { "srvcertout", OPT_SRVCERTOUT, 's',
-      "File to save the server cert used and validated for CMP response protection"},
-    {"extracertsout", OPT_EXTRACERTSOUT, 's',
-     "File to save extra certificates received in the extraCerts field"},
-    {"cacertsout", OPT_CACERTSOUT, 's',
-     "File to save CA certs received in caPubs field or genp with id-it-caCerts"},
+        "File to save the server cert used and validated for CMP response protection" },
+    { "extracertsout", OPT_EXTRACERTSOUT, 's',
+        "File to save extra certificates received in the extraCerts field" },
+    { "cacertsout", OPT_CACERTSOUT, 's',
+        "File to save CA certs received in caPubs field or genp with id-it-caCerts" },
     { "oldwithold", OPT_OLDWITHOLD, 's',
-      "Root CA certificate to request update for in genm of type rootCaCert"},
+        "Root CA certificate to request update for in genm of type rootCaCert" },
     { "newwithnew", OPT_NEWWITHNEW, 's',
-      "File to save NewWithNew cert received in genp of type rootCaKeyUpdate"},
+        "File to save NewWithNew cert received in genp of type rootCaKeyUpdate" },
     { "newwithold", OPT_NEWWITHOLD, 's',
-      "File to save NewWithOld cert received in genp of type rootCaKeyUpdate"},
+        "File to save NewWithOld cert received in genp of type rootCaKeyUpdate" },
     { "oldwithnew", OPT_OLDWITHNEW, 's',
-      "File to save OldWithNew cert received in genp of type rootCaKeyUpdate"},
+        "File to save OldWithNew cert received in genp of type rootCaKeyUpdate" },
     { "crlcert", OPT_CRLCERT, 's',
-      "certificate to request a CRL for in genm of type crlStatusList"},
+        "certificate to request a CRL for in genm of type crlStatusList" },
     { "oldcrl", OPT_OLDCRL, 's',
-      "CRL to request update for in genm of type crlStatusList"},
+        "CRL to request update for in genm of type crlStatusList" },
     { "crlout", OPT_CRLOUT, 's',
-      "File to save new CRL received in genp of type 'crls'"},
+        "File to save new CRL received in genp of type 'crls'" },
 
     OPT_SECTION("Client authentication"),
-    {"ref", OPT_REF, 's',
-     "Reference value to use as senderKID in case no -cert is given"},
-    {"secret", OPT_SECRET, 's',
-     "Prefer PBM (over signatures) for protecting msgs with given password source"},
-    {"cert", OPT_CERT, 's',
-     "Client's CMP signer certificate; its public key must match the -key argument"},
-    {OPT_MORE_STR, 0, 0,
-     "This also used as default reference for subject DN and SANs."},
-    {OPT_MORE_STR, 0, 0,
-     "Any further certs included are appended to the untrusted certs"},
-    {"own_trusted", OPT_OWN_TRUSTED, 's',
-     "Optional certs to verify chain building for own CMP signer cert"},
-    {"key", OPT_KEY, 's', "CMP signer private key, not used when -secret given"},
-    {"keypass", OPT_KEYPASS, 's',
-     "Client private key (and cert and old cert) pass phrase source"},
-    {"digest", OPT_DIGEST, 's',
-     "Digest to use in message protection and POPO signatures. Default \"sha256\""},
-    {"mac", OPT_MAC, 's',
-     "MAC algorithm to use in PBM-based message protection. Default \"hmac-sha1\""},
-    {"extracerts", OPT_EXTRACERTS, 's',
-     "Certificates to append in extraCerts field of outgoing messages."},
-    {OPT_MORE_STR, 0, 0,
-     "This can be used as the default CMP signer cert chain to include"},
-    {"unprotected_requests", OPT_UNPROTECTED_REQUESTS, '-',
-     "Send request messages without CMP-level protection"},
+    { "ref", OPT_REF, 's',
+        "Reference value to use as senderKID in case no -cert is given" },
+    { "secret", OPT_SECRET, 's',
+        "Prefer PBM (over signatures) for protecting msgs with given password source" },
+    { "cert", OPT_CERT, 's',
+        "Client's CMP signer certificate; its public key must match the -key argument" },
+    { OPT_MORE_STR, 0, 0,
+        "This also used as default reference for subject DN and SANs." },
+    { OPT_MORE_STR, 0, 0,
+        "Any further certs included are appended to the untrusted certs" },
+    { "own_trusted", OPT_OWN_TRUSTED, 's',
+        "Optional certs to verify chain building for own CMP signer cert" },
+    { "key", OPT_KEY, 's', "CMP signer private key, not used when -secret given" },
+    { "keypass", OPT_KEYPASS, 's',
+        "Client private key (and cert and old cert) pass phrase source" },
+    { "digest", OPT_DIGEST, 's',
+        "Digest to use in message protection and POPO signatures. Default \"sha256\"" },
+    { "mac", OPT_MAC, 's',
+        "MAC algorithm to use in PBM-based message protection. Default \"hmac-sha1\"" },
+    { "extracerts", OPT_EXTRACERTS, 's',
+        "Certificates to append in extraCerts field of outgoing messages." },
+    { OPT_MORE_STR, 0, 0,
+        "This can be used as the default CMP signer cert chain to include" },
+    { "unprotected_requests", OPT_UNPROTECTED_REQUESTS, '-',
+        "Send request messages without CMP-level protection" },
 
     OPT_SECTION("Credentials format"),
-    {"certform", OPT_CERTFORM, 's',
-     "Format (PEM or DER) to use when saving a certificate to a file. Default PEM"},
-    {"crlform", OPT_CRLFORM, 's',
-     "Format (PEM or DER) to use when saving a CRL to a file. Default DER"},
-    {"keyform", OPT_KEYFORM, 's',
-     "Format of the key input (ENGINE, other values ignored)"},
-    {"otherpass", OPT_OTHERPASS, 's',
-     "Pass phrase source potentially needed for loading certificates of others"},
+    { "certform", OPT_CERTFORM, 's',
+        "Format (PEM or DER) to use when saving a certificate to a file. Default PEM" },
+    { "crlform", OPT_CRLFORM, 's',
+        "Format (PEM or DER) to use when saving a CRL to a file. Default DER" },
+    { "keyform", OPT_KEYFORM, 's',
+        "Format of the key input (ENGINE, other values ignored)" },
+    { "otherpass", OPT_OTHERPASS, 's',
+        "Pass phrase source potentially needed for loading certificates of others" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's',
-     "Use crypto engine with given identifier, possibly a hardware device."},
-    {OPT_MORE_STR, 0, 0,
-     "Engines may also be defined in OpenSSL config file engine section."},
+    { "engine", OPT_ENGINE, 's',
+        "Use crypto engine with given identifier, possibly a hardware device." },
+    { OPT_MORE_STR, 0, 0,
+        "Engines may also be defined in OpenSSL config file engine section." },
 #endif
     OPT_PROV_OPTIONS,
     OPT_R_OPTIONS,
 
     OPT_SECTION("TLS connection"),
 #if defined(OPENSSL_NO_SOCK) || defined(OPENSSL_NO_HTTP)
-    {OPT_MORE_STR, 0, 0,
-     "NOTE: -tls_used and all other TLS options not supported due to no-sock/no-http build"},
+    { OPT_MORE_STR, 0, 0,
+        "NOTE: -tls_used and all other TLS options not supported due to no-sock/no-http build" },
 #else
-    {"tls_used", OPT_TLS_USED, '-',
-     "Enable using TLS (also when other TLS options are not set)"},
-    {"tls_cert", OPT_TLS_CERT, 's',
-     "Client's TLS certificate. May include chain to be provided to TLS server"},
-    {"tls_key", OPT_TLS_KEY, 's',
-     "Private key for the client's TLS certificate"},
-    {"tls_keypass", OPT_TLS_KEYPASS, 's',
-     "Pass phrase source for the client's private TLS key (and TLS cert)"},
-    {"tls_extra", OPT_TLS_EXTRA, 's',
-     "Extra certificates to provide to TLS server during TLS handshake"},
-    {"tls_trusted", OPT_TLS_TRUSTED, 's',
-     "Trusted certificates to use for verifying the TLS server certificate;"},
-    {OPT_MORE_STR, 0, 0, "this implies hostname validation"},
-    {"tls_host", OPT_TLS_HOST, 's',
-     "Address to be checked (rather than -server) during TLS hostname validation"},
+    { "tls_used", OPT_TLS_USED, '-',
+        "Enable using TLS (also when other TLS options are not set)" },
+    { "tls_cert", OPT_TLS_CERT, 's',
+        "Client's TLS certificate. May include chain to be provided to TLS server" },
+    { "tls_key", OPT_TLS_KEY, 's',
+        "Private key for the client's TLS certificate" },
+    { "tls_keypass", OPT_TLS_KEYPASS, 's',
+        "Pass phrase source for the client's private TLS key (and TLS cert)" },
+    { "tls_extra", OPT_TLS_EXTRA, 's',
+        "Extra certificates to provide to TLS server during TLS handshake" },
+    { "tls_trusted", OPT_TLS_TRUSTED, 's',
+        "Trusted certificates to use for verifying the TLS server certificate;" },
+    { OPT_MORE_STR, 0, 0, "this implies hostname validation" },
+    { "tls_host", OPT_TLS_HOST, 's',
+        "Address to be checked (rather than -server) during TLS hostname validation" },
 #endif
 
     OPT_SECTION("Client-side debugging"),
-    {"batch", OPT_BATCH, '-',
-     "Do not interactively prompt for input when a password is required etc."},
-    {"repeat", OPT_REPEAT, 'p',
-     "Invoke the transaction the given positive number of times. Default 1"},
-    {"reqin", OPT_REQIN, 's',
-     "Take sequence of CMP requests to send to server from file(s)"},
-    {"reqin_new_tid", OPT_REQIN_NEW_TID, '-',
-     "Use fresh transactionID for CMP requests read from -reqin"},
-    {"reqout", OPT_REQOUT, 's',
-     "Save sequence of CMP requests created by the client to file(s)"},
-    {"reqout_only", OPT_REQOUT_ONLY, 's',
-     "Save first CMP request created by the client to file and exit"},
-    {"rspin", OPT_RSPIN, 's',
-     "Process sequence of CMP responses provided in file(s), skipping server"},
-    {"rspout", OPT_RSPOUT, 's',
-     "Save sequence of actually used CMP responses to file(s)"},
+    { "batch", OPT_BATCH, '-',
+        "Do not interactively prompt for input when a password is required etc." },
+    { "repeat", OPT_REPEAT, 'p',
+        "Invoke the transaction the given positive number of times. Default 1" },
+    { "reqin", OPT_REQIN, 's',
+        "Take sequence of CMP requests to send to server from file(s)" },
+    { "reqin_new_tid", OPT_REQIN_NEW_TID, '-',
+        "Use fresh transactionID for CMP requests read from -reqin" },
+    { "reqout", OPT_REQOUT, 's',
+        "Save sequence of CMP requests created by the client to file(s)" },
+    { "reqout_only", OPT_REQOUT_ONLY, 's',
+        "Save first CMP request created by the client to file and exit" },
+    { "rspin", OPT_RSPIN, 's',
+        "Process sequence of CMP responses provided in file(s), skipping server" },
+    { "rspout", OPT_RSPOUT, 's',
+        "Save sequence of actually used CMP responses to file(s)" },
 
-    {"use_mock_srv", OPT_USE_MOCK_SRV, '-',
-     "Use internal mock server at API level, bypassing socket-based HTTP"},
+    { "use_mock_srv", OPT_USE_MOCK_SRV, '-',
+        "Use internal mock server at API level, bypassing socket-based HTTP" },
 
     OPT_SECTION("Mock server"),
 #if defined(OPENSSL_NO_SOCK) || defined(OPENSSL_NO_HTTP)
-    {OPT_MORE_STR, 0, 0,
-     "NOTE: -port and -max_msgs not supported due to no-sock/no-http build"},
+    { OPT_MORE_STR, 0, 0,
+        "NOTE: -port and -max_msgs not supported due to no-sock/no-http build" },
 #else
-    {"port", OPT_PORT, 's',
-     "Act as HTTP-based mock server listening on given port"},
-    {"max_msgs", OPT_MAX_MSGS, 'N',
-     "max number of messages handled by HTTP mock server. Default: 0 = unlimited"},
+    { "port", OPT_PORT, 's',
+        "Act as HTTP-based mock server listening on given port" },
+    { "max_msgs", OPT_MAX_MSGS, 'N',
+        "max number of messages handled by HTTP mock server. Default: 0 = unlimited" },
 #endif
 
-    {"srv_ref", OPT_SRV_REF, 's',
-     "Reference value to use as senderKID of server in case no -srv_cert is given"},
-    {"srv_secret", OPT_SRV_SECRET, 's',
-     "Password source for server authentication with a pre-shared key (secret)"},
-    {"srv_cert", OPT_SRV_CERT, 's', "Certificate of the server"},
-    {"srv_key", OPT_SRV_KEY, 's',
-     "Private key used by the server for signing messages"},
-    {"srv_keypass", OPT_SRV_KEYPASS, 's',
-     "Server private key (and cert) pass phrase source"},
+    { "srv_ref", OPT_SRV_REF, 's',
+        "Reference value to use as senderKID of server in case no -srv_cert is given" },
+    { "srv_secret", OPT_SRV_SECRET, 's',
+        "Password source for server authentication with a pre-shared key (secret)" },
+    { "srv_cert", OPT_SRV_CERT, 's', "Certificate of the server" },
+    { "srv_key", OPT_SRV_KEY, 's',
+        "Private key used by the server for signing messages" },
+    { "srv_keypass", OPT_SRV_KEYPASS, 's',
+        "Server private key (and cert) pass phrase source" },
 
-    {"srv_trusted", OPT_SRV_TRUSTED, 's',
-     "Trusted certificates for client authentication"},
-    {"srv_untrusted", OPT_SRV_UNTRUSTED, 's',
-     "Intermediate certs that may be useful for verifying CMP protection"},
-    {"ref_cert", OPT_RSP_CERT, 's',
-     "Certificate to be expected for rr and any oldCertID in kur messages"},
-    {"rsp_cert", OPT_RSP_CERT, 's',
-     "Certificate to be returned as mock enrollment result"},
-    {"rsp_key", OPT_RSP_KEY, 's',
-     "Private key for the certificate to be returned as mock enrollment result"},
-    {OPT_MORE_STR, 0, 0,
-     "Key to be returned for central key pair generation"},
-    {"rsp_keypass", OPT_RSP_KEYPASS, 's',
-     "Response private key (and cert) pass phrase source"},
-    {"rsp_crl", OPT_RSP_CRL, 's',
-     "CRL to be returned in genp of type crls"},
-    {"rsp_extracerts", OPT_RSP_EXTRACERTS, 's',
-     "Extra certificates to be included in mock certification responses"},
-    {"rsp_capubs", OPT_RSP_CAPUBS, 's',
-     "CA certificates to be included in mock ip response"},
-    {"rsp_newwithnew", OPT_RSP_NEWWITHNEW, 's',
-     "New root CA certificate to include in genp of type rootCaKeyUpdate"},
-    {"rsp_newwithold", OPT_RSP_NEWWITHOLD, 's',
-     "NewWithOld transition cert to include in genp of type rootCaKeyUpdate"},
-    {"rsp_oldwithnew", OPT_RSP_OLDWITHNEW, 's',
-     "OldWithNew transition cert to include in genp of type rootCaKeyUpdate"},
-    {"poll_count", OPT_POLL_COUNT, 'N',
-     "Number of times the client must poll before receiving a certificate"},
-    {"check_after", OPT_CHECK_AFTER, 'N',
-     "The check_after value (time to wait) to include in poll response"},
-    {"grant_implicitconf", OPT_GRANT_IMPLICITCONF, '-',
-     "Grant implicit confirmation of newly enrolled certificate"},
+    { "srv_trusted", OPT_SRV_TRUSTED, 's',
+        "Trusted certificates for client authentication" },
+    { "srv_untrusted", OPT_SRV_UNTRUSTED, 's',
+        "Intermediate certs that may be useful for verifying CMP protection" },
+    { "ref_cert", OPT_RSP_CERT, 's',
+        "Certificate to be expected for rr and any oldCertID in kur messages" },
+    { "rsp_cert", OPT_RSP_CERT, 's',
+        "Certificate to be returned as mock enrollment result" },
+    { "rsp_key", OPT_RSP_KEY, 's',
+        "Private key for the certificate to be returned as mock enrollment result" },
+    { OPT_MORE_STR, 0, 0,
+        "Key to be returned for central key pair generation" },
+    { "rsp_keypass", OPT_RSP_KEYPASS, 's',
+        "Response private key (and cert) pass phrase source" },
+    { "rsp_crl", OPT_RSP_CRL, 's',
+        "CRL to be returned in genp of type crls" },
+    { "rsp_extracerts", OPT_RSP_EXTRACERTS, 's',
+        "Extra certificates to be included in mock certification responses" },
+    { "rsp_capubs", OPT_RSP_CAPUBS, 's',
+        "CA certificates to be included in mock ip response" },
+    { "rsp_newwithnew", OPT_RSP_NEWWITHNEW, 's',
+        "New root CA certificate to include in genp of type rootCaKeyUpdate" },
+    { "rsp_newwithold", OPT_RSP_NEWWITHOLD, 's',
+        "NewWithOld transition cert to include in genp of type rootCaKeyUpdate" },
+    { "rsp_oldwithnew", OPT_RSP_OLDWITHNEW, 's',
+        "OldWithNew transition cert to include in genp of type rootCaKeyUpdate" },
+    { "poll_count", OPT_POLL_COUNT, 'N',
+        "Number of times the client must poll before receiving a certificate" },
+    { "check_after", OPT_CHECK_AFTER, 'N',
+        "The check_after value (time to wait) to include in poll response" },
+    { "grant_implicitconf", OPT_GRANT_IMPLICITCONF, '-',
+        "Grant implicit confirmation of newly enrolled certificate" },
 
-    {"pkistatus", OPT_PKISTATUS, 'N',
-     "PKIStatus to be included in server response. Possible values: 0..6"},
-    {"failure", OPT_FAILURE, 'N',
-     "A single failure info bit number to include in server response, 0..26"},
-    {"failurebits", OPT_FAILUREBITS, 'N',
-     "Number representing failure bits to include in server response, 0..2^27 - 1"},
-    {"statusstring", OPT_STATUSSTRING, 's',
-     "Status string to be included in server response"},
-    {"send_error", OPT_SEND_ERROR, '-',
-     "Force server to reply with error message"},
-    {"send_unprotected", OPT_SEND_UNPROTECTED, '-',
-     "Send response messages without CMP-level protection"},
-    {"send_unprot_err", OPT_SEND_UNPROT_ERR, '-',
-     "In case of negative responses, server shall send unprotected error messages,"},
-    {OPT_MORE_STR, 0, 0,
-     "certificate responses (ip/cp/kup), and revocation responses (rp)."},
-    {OPT_MORE_STR, 0, 0,
-     "WARNING: This setting leads to behavior violating RFC 4210"},
-    {"accept_unprotected", OPT_ACCEPT_UNPROTECTED, '-',
-     "Accept missing or invalid protection of requests"},
-    {"accept_unprot_err", OPT_ACCEPT_UNPROT_ERR, '-',
-     "Accept unprotected error messages from client"},
-    {"accept_raverified", OPT_ACCEPT_RAVERIFIED, '-',
-     "Accept RAVERIFIED as proof-of-possession (POPO)"},
+    { "pkistatus", OPT_PKISTATUS, 'N',
+        "PKIStatus to be included in server response. Possible values: 0..6" },
+    { "failure", OPT_FAILURE, 'N',
+        "A single failure info bit number to include in server response, 0..26" },
+    { "failurebits", OPT_FAILUREBITS, 'N',
+        "Number representing failure bits to include in server response, 0..2^27 - 1" },
+    { "statusstring", OPT_STATUSSTRING, 's',
+        "Status string to be included in server response" },
+    { "send_error", OPT_SEND_ERROR, '-',
+        "Force server to reply with error message" },
+    { "send_unprotected", OPT_SEND_UNPROTECTED, '-',
+        "Send response messages without CMP-level protection" },
+    { "send_unprot_err", OPT_SEND_UNPROT_ERR, '-',
+        "In case of negative responses, server shall send unprotected error messages," },
+    { OPT_MORE_STR, 0, 0,
+        "certificate responses (ip/cp/kup), and revocation responses (rp)." },
+    { OPT_MORE_STR, 0, 0,
+        "WARNING: This setting leads to behavior violating RFC 9810" },
+    { "accept_unprotected", OPT_ACCEPT_UNPROTECTED, '-',
+        "Accept missing or invalid protection of requests" },
+    { "accept_unprot_err", OPT_ACCEPT_UNPROT_ERR, '-',
+        "Accept unprotected error messages from client" },
+    { "accept_raverified", OPT_ACCEPT_RAVERIFIED, '-',
+        "Accept RAVERIFIED as proof-of-possession (POPO)" },
 
     OPT_V_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 typedef union {
@@ -641,118 +713,117 @@ typedef union {
     long *num_long;
 } varref;
 static varref cmp_vars[] = { /* must be in same order as enumerated above! */
-    {&opt_config}, {&opt_section}, {(char **)&opt_verbosity},
+    { &opt_config }, { &opt_section }, { (char **)&opt_verbosity },
 
-    {&opt_cmd_s}, {&opt_infotype_s}, {&opt_profile}, {&opt_geninfo},
-    {&opt_template}, {&opt_keyspec},
+    { &opt_cmd_s }, { &opt_infotype_s }, { &opt_profile }, { &opt_geninfo },
+    { &opt_template }, { &opt_keyspec },
 
-    {&opt_newkey}, {&opt_newkeypass}, {(char **)&opt_centralkeygen},
-    {&opt_newkeyout}, {&opt_subject}, {(char **)&opt_days}, {&opt_reqexts},
-    {&opt_sans}, {(char **)&opt_san_nodefault},
-    {&opt_policies}, {&opt_policy_oids}, {(char **)&opt_policy_oids_critical},
-    {(char **)&opt_popo}, {&opt_csr},
-    {&opt_out_trusted},
-    {(char **)&opt_implicit_confirm}, {(char **)&opt_disable_confirm},
-    {&opt_certout}, {&opt_chainout},
+    { &opt_newkey }, { &opt_newkeypass }, { (char **)&opt_centralkeygen },
+    { &opt_newkeyout }, { &opt_subject }, { (char **)&opt_days }, { &opt_reqexts },
+    { &opt_sans }, { (char **)&opt_san_nodefault },
+    { &opt_policies }, { &opt_policy_oids }, { (char **)&opt_policy_oids_critical },
+    { (char **)&opt_popo }, { &opt_csr },
+    { &opt_out_trusted },
+    { (char **)&opt_implicit_confirm }, { (char **)&opt_disable_confirm },
+    { &opt_certout }, { &opt_chainout },
 
-    {&opt_oldcert}, {&opt_issuer}, {&opt_serial}, {(char **)&opt_revreason},
+    { &opt_oldcert }, { &opt_issuer }, { &opt_serial }, { (char **)&opt_revreason },
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
-    {&opt_server}, {&opt_proxy}, {&opt_no_proxy},
+    { &opt_server }, { &opt_proxy }, { &opt_no_proxy },
 #endif
-    {&opt_recipient}, {&opt_path}, {(char **)&opt_keep_alive},
-    {(char **)&opt_msg_timeout}, {(char **)&opt_total_timeout},
+    { &opt_recipient }, { &opt_path }, { (char **)&opt_keep_alive },
+    { (char **)&opt_msg_timeout }, { (char **)&opt_total_timeout },
 
-    {&opt_trusted}, {&opt_untrusted}, {&opt_srvcert},
-    {&opt_expect_sender},
-    {(char **)&opt_ignore_keyusage}, {(char **)&opt_unprotected_errors},
-    {(char **)&opt_no_cache_extracerts},
-    {&opt_srvcertout}, {&opt_extracertsout}, {&opt_cacertsout},
-    {&opt_oldwithold}, {&opt_newwithnew}, {&opt_newwithold}, {&opt_oldwithnew},
-    {&opt_crlcert}, {&opt_oldcrl}, {&opt_crlout},
+    { &opt_trusted }, { &opt_untrusted }, { &opt_srvcert },
+    { &opt_expect_sender },
+    { (char **)&opt_ignore_keyusage }, { (char **)&opt_unprotected_errors },
+    { (char **)&opt_no_cache_extracerts },
+    { &opt_srvcertout }, { &opt_extracertsout }, { &opt_cacertsout },
+    { &opt_oldwithold }, { &opt_newwithnew }, { &opt_newwithold }, { &opt_oldwithnew },
+    { &opt_crlcert }, { &opt_oldcrl }, { &opt_crlout },
 
-    {&opt_ref}, {&opt_secret},
-    {&opt_cert}, {&opt_own_trusted}, {&opt_key}, {&opt_keypass},
-    {&opt_digest}, {&opt_mac}, {&opt_extracerts},
-    {(char **)&opt_unprotected_requests},
+    { &opt_ref }, { &opt_secret },
+    { &opt_cert }, { &opt_own_trusted }, { &opt_key }, { &opt_keypass },
+    { &opt_digest }, { &opt_mac }, { &opt_extracerts },
+    { (char **)&opt_unprotected_requests },
 
-    {&opt_certform_s}, {&opt_crlform_s}, {&opt_keyform_s},
-    {&opt_otherpass},
+    { &opt_certform_s }, { &opt_crlform_s }, { &opt_keyform_s },
+    { &opt_otherpass },
 #ifndef OPENSSL_NO_ENGINE
-    {&opt_engine},
+    { &opt_engine },
 #endif
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
-    {(char **)&opt_tls_used}, {&opt_tls_cert}, {&opt_tls_key},
-    {&opt_tls_keypass},
-    {&opt_tls_extra}, {&opt_tls_trusted}, {&opt_tls_host},
+    { (char **)&opt_tls_used }, { &opt_tls_cert }, { &opt_tls_key },
+    { &opt_tls_keypass },
+    { &opt_tls_extra }, { &opt_tls_trusted }, { &opt_tls_host },
 #endif
 
-    {(char **)&opt_batch}, {(char **)&opt_repeat},
-    {&opt_reqin}, {(char **)&opt_reqin_new_tid},
-    {&opt_reqout}, {&opt_reqout_only}, {&opt_rspin}, {&opt_rspout},
+    { (char **)&opt_batch }, { (char **)&opt_repeat },
+    { &opt_reqin }, { (char **)&opt_reqin_new_tid },
+    { &opt_reqout }, { &opt_reqout_only }, { &opt_rspin }, { &opt_rspout },
 
-    {(char **)&opt_use_mock_srv},
+    { (char **)&opt_use_mock_srv },
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
-    {&opt_port}, {(char **)&opt_max_msgs},
+    { &opt_port }, { (char **)&opt_max_msgs },
 #endif
-    {&opt_srv_ref}, {&opt_srv_secret},
-    {&opt_srv_cert}, {&opt_srv_key}, {&opt_srv_keypass},
-    {&opt_srv_trusted}, {&opt_srv_untrusted},
-    {&opt_ref_cert}, {&opt_rsp_cert}, {&opt_rsp_key}, {&opt_rsp_keypass},
-    {&opt_rsp_crl}, {&opt_rsp_extracerts}, {&opt_rsp_capubs},
-    {&opt_rsp_newwithnew}, {&opt_rsp_newwithold}, {&opt_rsp_oldwithnew},
+    { &opt_srv_ref }, { &opt_srv_secret },
+    { &opt_srv_cert }, { &opt_srv_key }, { &opt_srv_keypass },
+    { &opt_srv_trusted }, { &opt_srv_untrusted },
+    { &opt_ref_cert }, { &opt_rsp_cert }, { &opt_rsp_key }, { &opt_rsp_keypass },
+    { &opt_rsp_crl }, { &opt_rsp_extracerts }, { &opt_rsp_capubs },
+    { &opt_rsp_newwithnew }, { &opt_rsp_newwithold }, { &opt_rsp_oldwithnew },
 
-    {(char **)&opt_poll_count}, {(char **)&opt_check_after},
-    {(char **)&opt_grant_implicitconf},
-    {(char **)&opt_pkistatus}, {(char **)&opt_failure},
-    {(char **)&opt_failurebits}, {&opt_statusstring},
-    {(char **)&opt_send_error}, {(char **)&opt_send_unprotected},
-    {(char **)&opt_send_unprot_err}, {(char **)&opt_accept_unprotected},
-    {(char **)&opt_accept_unprot_err}, {(char **)&opt_accept_raverified},
+    { (char **)&opt_poll_count }, { (char **)&opt_check_after },
+    { (char **)&opt_grant_implicitconf },
+    { (char **)&opt_pkistatus }, { (char **)&opt_failure },
+    { (char **)&opt_failurebits }, { &opt_statusstring },
+    { (char **)&opt_send_error }, { (char **)&opt_send_unprotected },
+    { (char **)&opt_send_unprot_err }, { (char **)&opt_accept_unprotected },
+    { (char **)&opt_accept_unprot_err }, { (char **)&opt_accept_raverified },
 
-    {NULL}
+    { NULL }
 };
 
-#define FUNC (strcmp(OPENSSL_FUNC, "(unknown function)") == 0   \
-              ? "CMP" : OPENSSL_FUNC)
+#define FUNC (strcmp(OPENSSL_FUNC, "(unknown function)") == 0 \
+        ? "CMP"                                               \
+        : OPENSSL_FUNC)
 #define CMP_print(bio, level, prefix, msg, a1, a2, a3) \
-    ((void)(level > opt_verbosity ? 0 : \
-            (BIO_printf(bio, "%s:%s:%d:CMP %s: " msg "\n", \
-                        FUNC, OPENSSL_FILE, OPENSSL_LINE, prefix, a1, a2, a3))))
+    ((void)(level > opt_verbosity ? 0 : (BIO_printf(bio, "%s:%s:%d:CMP %s: " msg "\n", FUNC, OPENSSL_FILE, OPENSSL_LINE, prefix, a1, a2, a3))))
 #define CMP_DEBUG(m, a1, a2, a3) \
     CMP_print(bio_out, OSSL_CMP_LOG_DEBUG, "debug", m, a1, a2, a3)
-#define CMP_debug(msg)             CMP_DEBUG(msg"%s%s%s", "", "", "")
-#define CMP_debug1(msg, a1)        CMP_DEBUG(msg"%s%s",   a1, "", "")
-#define CMP_debug2(msg, a1, a2)    CMP_DEBUG(msg"%s",     a1, a2, "")
-#define CMP_debug3(msg, a1, a2, a3) CMP_DEBUG(msg,        a1, a2, a3)
+#define CMP_debug(msg) CMP_DEBUG(msg "%s%s%s", "", "", "")
+#define CMP_debug1(msg, a1) CMP_DEBUG(msg "%s%s", a1, "", "")
+#define CMP_debug2(msg, a1, a2) CMP_DEBUG(msg "%s", a1, a2, "")
+#define CMP_debug3(msg, a1, a2, a3) CMP_DEBUG(msg, a1, a2, a3)
 #define CMP_INFO(msg, a1, a2, a3) \
     CMP_print(bio_out, OSSL_CMP_LOG_INFO, "info", msg, a1, a2, a3)
-#define CMP_info(msg)              CMP_INFO(msg"%s%s%s", "", "", "")
-#define CMP_info1(msg, a1)         CMP_INFO(msg"%s%s",   a1, "", "")
-#define CMP_info2(msg, a1, a2)     CMP_INFO(msg"%s",     a1, a2, "")
-#define CMP_info3(msg, a1, a2, a3) CMP_INFO(msg,         a1, a2, a3)
+#define CMP_info(msg) CMP_INFO(msg "%s%s%s", "", "", "")
+#define CMP_info1(msg, a1) CMP_INFO(msg "%s%s", a1, "", "")
+#define CMP_info2(msg, a1, a2) CMP_INFO(msg "%s", a1, a2, "")
+#define CMP_info3(msg, a1, a2, a3) CMP_INFO(msg, a1, a2, a3)
 #define CMP_WARN(m, a1, a2, a3) \
     CMP_print(bio_out, OSSL_CMP_LOG_WARNING, "warning", m, a1, a2, a3)
-#define CMP_warn(msg)              CMP_WARN(msg"%s%s%s", "", "", "")
-#define CMP_warn1(msg, a1)         CMP_WARN(msg"%s%s",   a1, "", "")
-#define CMP_warn2(msg, a1, a2)     CMP_WARN(msg"%s",     a1, a2, "")
-#define CMP_warn3(msg, a1, a2, a3) CMP_WARN(msg,         a1, a2, a3)
+#define CMP_warn(msg) CMP_WARN(msg "%s%s%s", "", "", "")
+#define CMP_warn1(msg, a1) CMP_WARN(msg "%s%s", a1, "", "")
+#define CMP_warn2(msg, a1, a2) CMP_WARN(msg "%s", a1, a2, "")
+#define CMP_warn3(msg, a1, a2, a3) CMP_WARN(msg, a1, a2, a3)
 #define CMP_ERR(msg, a1, a2, a3) \
     CMP_print(bio_err, OSSL_CMP_LOG_ERR, "error", msg, a1, a2, a3)
-#define CMP_err(msg)               CMP_ERR(msg"%s%s%s", "", "", "")
-#define CMP_err1(msg, a1)          CMP_ERR(msg"%s%s",   a1, "", "")
-#define CMP_err2(msg, a1, a2)      CMP_ERR(msg"%s",     a1, a2, "")
-#define CMP_err3(msg, a1, a2, a3)  CMP_ERR(msg,         a1, a2, a3)
+#define CMP_err(msg) CMP_ERR(msg "%s%s%s", "", "", "")
+#define CMP_err1(msg, a1) CMP_ERR(msg "%s%s", a1, "", "")
+#define CMP_err2(msg, a1, a2) CMP_ERR(msg "%s", a1, a2, "")
+#define CMP_err3(msg, a1, a2, a3) CMP_ERR(msg, a1, a2, a3)
 
 static int print_to_bio_out(const char *func, const char *file, int line,
-                            OSSL_CMP_severity level, const char *msg)
+    OSSL_CMP_severity level, const char *msg)
 {
     return OSSL_CMP_print_to_bio(bio_out, func, file, line, level, msg);
 }
 
 static int print_to_bio_err(const char *func, const char *file, int line,
-                            OSSL_CMP_severity level, const char *msg)
+    OSSL_CMP_severity level, const char *msg)
 {
     return OSSL_CMP_print_to_bio(bio_err, func, file, line, level, msg);
 }
@@ -768,7 +839,7 @@ static int set_verbosity(int level)
 }
 
 static EVP_PKEY *load_key_pwd(const char *uri, int format,
-                              const char *pass, ENGINE *eng, const char *desc)
+    const char *pass, ENGINE *eng, const char *desc)
 {
     char *pass_string = get_passwd(pass, desc);
     EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, eng, desc);
@@ -794,12 +865,11 @@ static int truststore_set_host_etc(X509_STORE *ts, const char *host)
 
     /* first clear any hostnames, IP, and email addresses */
     if (!X509_VERIFY_PARAM_set1_host(ts_vpm, NULL, 0)
-            || !X509_VERIFY_PARAM_set1_ip(ts_vpm, NULL, 0)
-            || !X509_VERIFY_PARAM_set1_email(ts_vpm, NULL, 0))
+        || !X509_VERIFY_PARAM_set1_ip(ts_vpm, NULL, 0)
+        || !X509_VERIFY_PARAM_set1_email(ts_vpm, NULL, 0))
         return 0;
     X509_VERIFY_PARAM_set_hostflags(ts_vpm,
-                                    X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT |
-                                    X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+        X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT | X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
     return (host != NULL && X509_VERIFY_PARAM_set1_ip_asc(ts_vpm, host))
         || X509_VERIFY_PARAM_set1_host(ts_vpm, host, 0);
 }
@@ -860,7 +930,7 @@ static OSSL_CMP_MSG *read_PKIMESSAGE(const char *desc, char **filenames)
  * to take the sequence of requests and responses from files.
  */
 static OSSL_CMP_MSG *read_write_req_resp(OSSL_CMP_CTX *ctx,
-                                         const OSSL_CMP_MSG *req)
+    const OSSL_CMP_MSG *req)
 {
     OSSL_CMP_MSG *req_new = NULL;
     OSSL_CMP_MSG *res = NULL;
@@ -870,7 +940,7 @@ static OSSL_CMP_MSG *read_write_req_resp(OSSL_CMP_CTX *ctx,
     if (opt_reqout_only != NULL) {
         if (OSSL_CMP_MSG_write(opt_reqout_only, req) < 0)
             CMP_err1("cannot write request PKIMessage to file '%s'",
-                     opt_reqout_only);
+                opt_reqout_only);
         else
             reqout_only_done = 1;
         return NULL; /* stop at this point, not contacting any server */
@@ -886,7 +956,7 @@ static OSSL_CMP_MSG *read_write_req_resp(OSSL_CMP_CTX *ctx,
          * The following workaround unfortunately requires re-protection.
          */
         if (opt_reqin_new_tid
-                && !OSSL_CMP_MSG_update_transactionID(ctx, req_new))
+            && !OSSL_CMP_MSG_update_transactionID(ctx, req_new))
             goto err;
 
         /*
@@ -933,7 +1003,7 @@ static OSSL_CMP_MSG *read_write_req_resp(OSSL_CMP_CTX *ctx,
         nonce = OSSL_CMP_HDR_get0_recipNonce(hdr);
         tid = OSSL_CMP_HDR_get0_transactionID(hdr);
         if (!OSSL_CMP_CTX_set1_senderNonce(ctx, nonce)
-                || !OSSL_CMP_CTX_set1_transactionID(ctx, tid)) {
+            || !OSSL_CMP_CTX_set1_transactionID(ctx, tid)) {
             OSSL_CMP_MSG_free(res);
             res = NULL;
             goto err;
@@ -945,21 +1015,21 @@ static OSSL_CMP_MSG *read_write_req_resp(OSSL_CMP_CTX *ctx,
         res = NULL;
     }
 
- err:
+err:
     OSSL_CMP_MSG_free(req_new);
     return res;
 }
 
 static int set_name(const char *str,
-                    int (*set_fn) (OSSL_CMP_CTX *ctx, const X509_NAME *name),
-                    OSSL_CMP_CTX *ctx, const char *desc)
+    int (*set_fn)(OSSL_CMP_CTX *ctx, const X509_NAME *name),
+    OSSL_CMP_CTX *ctx, const char *desc)
 {
     if (str != NULL) {
         X509_NAME *n = parse_name(str, MBSTRING_UTF8, 1, desc);
 
         if (n == NULL)
             return 0;
-        if (!(*set_fn) (ctx, n)) {
+        if (!(*set_fn)(ctx, n)) {
             X509_NAME_free(n);
             CMP_err("out of memory");
             return 0;
@@ -979,8 +1049,8 @@ static int set_gennames(OSSL_CMP_CTX *ctx, char *names, const char *desc)
         next = next_item(names);
         if (strcmp(names, "critical") == 0) {
             (void)OSSL_CMP_CTX_set_option(ctx,
-                                          OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL,
-                                          1);
+                OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL,
+                1);
             continue;
         }
 
@@ -989,9 +1059,9 @@ static int set_gennames(OSSL_CMP_CTX *ctx, char *names, const char *desc)
         n = a2i_GENERAL_NAME(NULL, NULL, NULL, GEN_IPADD, names, 0);
         if (n == NULL)
             n = a2i_GENERAL_NAME(NULL, NULL, NULL,
-                                 strchr(names, '@') != NULL ? GEN_EMAIL :
-                                 strchr(names, ':') != NULL ? GEN_URI : GEN_DNS,
-                                 names, 0);
+                strchr(names, '@') != NULL ? GEN_EMAIL : strchr(names, ':') != NULL ? GEN_URI
+                                                                                    : GEN_DNS,
+                names, 0);
         (void)ERR_pop_to_mark();
 
         if (n == NULL) {
@@ -1018,7 +1088,7 @@ static X509_STORE *load_trusted(char *input, int for_new_cert, const char *desc)
 
     /* copy vpm to store */
     if (X509_STORE_set1_param(ts, vpm /* may be NULL */)
-            && (for_new_cert || truststore_set_host_etc(ts, NULL)))
+        && (for_new_cert || truststore_set_host_etc(ts, NULL)))
         return ts;
     BIO_printf(bio_err, "error setting verification parameters for %s\n", desc);
     OSSL_CMP_CTX_print_errors(cmp_ctx);
@@ -1028,7 +1098,7 @@ static X509_STORE *load_trusted(char *input, int for_new_cert, const char *desc)
 
 typedef int (*add_X509_fn_t)(void *ctx, const X509 *cert);
 static int setup_cert(void *ctx, const char *file, const char *pass,
-                      const char *desc, add_X509_fn_t set1_fn)
+    const char *desc, add_X509_fn_t set1_fn)
 {
     X509 *cert;
     int ok;
@@ -1044,7 +1114,7 @@ static int setup_cert(void *ctx, const char *file, const char *pass,
 
 typedef int (*add_X509_stack_fn_t)(void *ctx, const STACK_OF(X509) *certs);
 static int setup_certs(char *files, const char *desc, void *ctx,
-                       add_X509_stack_fn_t set1_fn)
+    add_X509_stack_fn_t set1_fn)
 {
     STACK_OF(X509) *certs;
     int ok;
@@ -1100,13 +1170,13 @@ static int transform_opts(void)
     }
 
 #ifndef OPENSSL_NO_ENGINE
-# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_ENGINE)
+#define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_ENGINE)
 #else
-# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12)
+#define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12)
 #endif
 
     if (opt_keyform_s != NULL
-            && !opt_format(opt_keyform_s, FORMAT_OPTIONS, &opt_keyform)) {
+        && !opt_format(opt_keyform_s, FORMAT_OPTIONS, &opt_keyform)) {
         CMP_err("unknown option given for key loading format");
         return 0;
     }
@@ -1114,12 +1184,12 @@ static int transform_opts(void)
 #undef FORMAT_OPTIONS
 
     if (opt_certform_s != NULL
-            && !opt_format(opt_certform_s, OPT_FMT_PEMDER, &opt_certform)) {
+        && !opt_format(opt_certform_s, OPT_FMT_PEMDER, &opt_certform)) {
         CMP_err("unknown option given for certificate storing format");
         return 0;
     }
     if (opt_crlform_s != NULL
-            && !opt_format(opt_crlform_s, OPT_FMT_PEMDER, &opt_crlform)) {
+        && !opt_format(opt_crlform_s, OPT_FMT_PEMDER, &opt_crlform)) {
         CMP_err("unknown option given for CRL storing format");
         return 0;
     }
@@ -1131,7 +1201,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
 {
     OSSL_CMP_CTX *ctx; /* extra CMP (client) ctx partly used by server */
     OSSL_CMP_SRV_CTX *srv_ctx = ossl_cmp_mock_srv_new(app_get0_libctx(),
-                                                      app_get0_propq());
+        app_get0_propq());
 
     if (srv_ctx == NULL)
         return NULL;
@@ -1145,7 +1215,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
         }
     } else {
         if (!OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_srv_ref,
-                                              strlen(opt_srv_ref)))
+                strlen(opt_srv_ref)))
             goto err;
     }
 
@@ -1156,7 +1226,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
         if (pass_str != NULL) {
             cleanse(opt_srv_secret);
             res = OSSL_CMP_CTX_set1_secretValue(ctx, (unsigned char *)pass_str,
-                                                strlen(pass_str));
+                strlen(pass_str));
             clear_free(pass_str);
             if (res == 0)
                 goto err;
@@ -1169,18 +1239,18 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
     }
 
     if (opt_srv_secret == NULL
-            && ((opt_srv_cert == NULL) != (opt_srv_key == NULL))) {
+        && ((opt_srv_cert == NULL) != (opt_srv_key == NULL))) {
         CMP_err("must give both -srv_cert and -srv_key options or neither");
         goto err;
     }
     if (!setup_cert(ctx, opt_srv_cert, opt_srv_keypass,
-                    "signer certificate of the mock server",
-                    (add_X509_fn_t)OSSL_CMP_CTX_set1_cert))
+            "signer certificate of the mock server",
+            (add_X509_fn_t)OSSL_CMP_CTX_set1_cert))
         goto err;
     if (opt_srv_key != NULL) {
         EVP_PKEY *pkey = load_key_pwd(opt_srv_key, opt_keyform,
-                                      opt_srv_keypass,
-                                      engine, "private key for mock server cert");
+            opt_srv_keypass,
+            engine, "private key for mock server cert");
 
         if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
             EVP_PKEY_free(pkey);
@@ -1191,8 +1261,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
     cleanse(opt_srv_keypass);
 
     if (opt_srv_trusted != NULL) {
-        X509_STORE *ts =
-            load_trusted(opt_srv_trusted, 0, "certs trusted by mock server");
+        X509_STORE *ts = load_trusted(opt_srv_trusted, 0, "certs trusted by mock server");
 
         if (ts == NULL || !OSSL_CMP_CTX_set0_trusted(ctx, ts)) {
             X509_STORE_free(ts);
@@ -1202,26 +1271,26 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
         CMP_warn("mock server will not be able to handle signature-protected requests since -srv_trusted is not given");
     }
     if (!setup_certs(opt_srv_untrusted,
-                     "untrusted certificates for mock server", ctx,
-                     (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted))
+            "untrusted certificates for mock server", ctx,
+            (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted))
         goto err;
 
     if (!setup_cert(srv_ctx, opt_ref_cert, opt_otherpass,
-                    "reference cert to be expected by the mock server",
-                    (add_X509_fn_t)ossl_cmp_mock_srv_set1_refCert))
+            "reference cert to be expected by the mock server",
+            (add_X509_fn_t)ossl_cmp_mock_srv_set1_refCert))
         goto err;
     if (opt_rsp_cert == NULL) {
         CMP_warn("no -rsp_cert given for mock server");
     } else {
         if (!setup_cert(srv_ctx, opt_rsp_cert, opt_rsp_keypass,
-                        "cert the mock server returns on certificate requests",
-                        (add_X509_fn_t)ossl_cmp_mock_srv_set1_certOut))
+                "cert the mock server returns on certificate requests",
+                (add_X509_fn_t)ossl_cmp_mock_srv_set1_certOut))
             goto err;
     }
     if (opt_rsp_key != NULL) {
         EVP_PKEY *pkey = load_key_pwd(opt_rsp_key, opt_keyform,
-                                      opt_rsp_keypass, engine,
-                                      "private key for enrollment cert");
+            opt_rsp_keypass, engine,
+            "private key for enrollment cert");
 
         if (pkey == NULL
             || !ossl_cmp_mock_srv_set1_keyOut(srv_ctx, pkey)) {
@@ -1233,24 +1302,24 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
     cleanse(opt_rsp_keypass);
 
     if (!setup_mock_crlout(srv_ctx, opt_rsp_crl,
-                           "CRL to be returned by the mock server"))
+            "CRL to be returned by the mock server"))
         goto err;
     if (!setup_certs(opt_rsp_extracerts,
-                     "CMP extra certificates for mock server", srv_ctx,
-                     (add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_chainOut))
+            "CMP extra certificates for mock server", srv_ctx,
+            (add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_chainOut))
         goto err;
     if (!setup_certs(opt_rsp_capubs, "caPubs for mock server", srv_ctx,
-                     (add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_caPubsOut))
+            (add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_caPubsOut))
         goto err;
     if (!setup_cert(srv_ctx, opt_rsp_newwithnew, opt_otherpass,
-                    "NewWithNew cert the mock server returns in rootCaKeyUpdate",
-                    (add_X509_fn_t)ossl_cmp_mock_srv_set1_newWithNew)
+            "NewWithNew cert the mock server returns in rootCaKeyUpdate",
+            (add_X509_fn_t)ossl_cmp_mock_srv_set1_newWithNew)
         || !setup_cert(srv_ctx, opt_rsp_newwithold, opt_otherpass,
-                       "NewWithOld cert the mock server returns in rootCaKeyUpdate",
-                       (add_X509_fn_t)ossl_cmp_mock_srv_set1_newWithOld)
+            "NewWithOld cert the mock server returns in rootCaKeyUpdate",
+            (add_X509_fn_t)ossl_cmp_mock_srv_set1_newWithOld)
         || !setup_cert(srv_ctx, opt_rsp_oldwithnew, opt_otherpass,
-                       "OldWithNew cert the mock server returns in rootCaKeyUpdate",
-                       (add_X509_fn_t)ossl_cmp_mock_srv_set1_oldWithNew))
+            "OldWithNew cert the mock server returns in rootCaKeyUpdate",
+            (add_X509_fn_t)ossl_cmp_mock_srv_set1_oldWithNew))
         goto err;
     (void)ossl_cmp_mock_srv_set_pollCount(srv_ctx, opt_poll_count);
     (void)ossl_cmp_mock_srv_set_checkAfterTime(srv_ctx, opt_check_after);
@@ -1260,7 +1329,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
     if (opt_failure != INT_MIN) { /* option has been set explicitly */
         if (opt_failure < 0 || OSSL_CMP_PKIFAILUREINFO_MAX < opt_failure) {
             CMP_err1("-failure out of range, should be >= 0 and <= %d",
-                     OSSL_CMP_PKIFAILUREINFO_MAX);
+                OSSL_CMP_PKIFAILUREINFO_MAX);
             goto err;
         }
         if (opt_failurebits != 0)
@@ -1273,7 +1342,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
         goto err;
     }
     if (!ossl_cmp_mock_srv_set_statusInfo(srv_ctx, opt_pkistatus,
-                                          opt_failurebits, opt_statusstring))
+            opt_failurebits, opt_statusstring))
         goto err;
 
     if (opt_send_error)
@@ -1292,7 +1361,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
 
     return srv_ctx;
 
- err:
+err:
     ossl_cmp_mock_srv_free(srv_ctx);
     return NULL;
 }
@@ -1304,7 +1373,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
 static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
 {
     if (!setup_certs(opt_untrusted, "untrusted certificates", ctx,
-                     (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted))
+            (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted))
         return 0;
 
     if (opt_srvcert != NULL || opt_trusted != NULL) {
@@ -1318,8 +1387,8 @@ static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
                 opt_recipient = NULL;
             }
             if (!setup_cert(ctx, opt_srvcert, opt_otherpass,
-                            "directly trusted CMP server certificate",
-                            (add_X509_fn_t)OSSL_CMP_CTX_set1_srvCert))
+                    "directly trusted CMP server certificate",
+                    (add_X509_fn_t)OSSL_CMP_CTX_set1_srvCert))
                 return 0;
         }
         if (opt_trusted != NULL) {
@@ -1343,9 +1412,8 @@ static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
 
     if (opt_out_trusted != NULL) { /* for use in OSSL_CMP_certConf_cb() */
         X509_VERIFY_PARAM *out_vpm = NULL;
-        X509_STORE *out_trusted =
-            load_trusted(opt_out_trusted, 1,
-                         "trusted certs for verifying newly enrolled cert");
+        X509_STORE *out_trusted = load_trusted(opt_out_trusted, 1,
+            "trusted certs for verifying newly enrolled cert");
 
         if (out_trusted == NULL)
             return 0;
@@ -1371,7 +1439,7 @@ static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
  * Returns pointer on success, NULL on error
  */
 static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
-                              ENGINE *engine)
+    ENGINE *engine)
 {
     STACK_OF(X509) *untrusted = OSSL_CMP_CTX_get0_untrusted(ctx);
     EVP_PKEY *pkey = NULL;
@@ -1399,8 +1467,8 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
         int ok;
 
         if (!load_cert_certs(opt_tls_cert, &cert, &certs, 0, opt_tls_keypass,
-                             "TLS client certificate (optionally with chain)",
-                             vpm))
+                "TLS client certificate (optionally with chain)",
+                vpm))
             /* need opt_tls_keypass if opt_tls_cert is encrypted PKCS#12 file */
             goto err;
 
@@ -1413,7 +1481,7 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
          */
         if (!ok || !SSL_CTX_set0_chain(ssl_ctx, certs)) {
             CMP_err1("unable to use client TLS certificate file '%s'",
-                     opt_tls_cert);
+                opt_tls_cert);
             OSSL_STACK_OF_X509_free(certs);
             goto err;
         }
@@ -1434,15 +1502,14 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
                 bak_flags = X509_VERIFY_PARAM_get_flags(tls_vpm);
                 /* disable any cert status/revocation checking etc. */
                 X509_VERIFY_PARAM_clear_flags(tls_vpm,
-                                              ~(X509_V_FLAG_USE_CHECK_TIME
-                                                | X509_V_FLAG_NO_CHECK_TIME
-                                                | X509_V_FLAG_PARTIAL_CHAIN
-                                                | X509_V_FLAG_POLICY_CHECK));
+                    ~(X509_V_FLAG_USE_CHECK_TIME
+                        | X509_V_FLAG_NO_CHECK_TIME
+                        | X509_V_FLAG_PARTIAL_CHAIN
+                        | X509_V_FLAG_POLICY_CHECK));
             }
             CMP_debug("trying to build cert chain for own TLS cert");
             if (SSL_CTX_build_cert_chain(ssl_ctx,
-                                         SSL_BUILD_CHAIN_FLAG_UNTRUSTED |
-                                         SSL_BUILD_CHAIN_FLAG_NO_ROOT)) {
+                    SSL_BUILD_CHAIN_FLAG_UNTRUSTED | SSL_BUILD_CHAIN_FLAG_NO_ROOT)) {
                 CMP_debug("success building cert chain for own TLS cert");
             } else {
                 OSSL_CMP_CTX_print_errors(ctx);
@@ -1455,9 +1522,9 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
         /* If present we append to the list also the certs from opt_tls_extra */
         if (opt_tls_extra != NULL) {
             STACK_OF(X509) *tls_extra = load_certs_multifile(opt_tls_extra,
-                                                             opt_otherpass,
-                                                             "extra certificates for TLS",
-                                                             vpm);
+                opt_otherpass,
+                "extra certificates for TLS",
+                vpm);
             int res = 1;
 
             if (tls_extra == NULL)
@@ -1477,7 +1544,7 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
         }
 
         pkey = load_key_pwd(opt_tls_key, opt_keyform, opt_tls_keypass,
-                            engine, "TLS client private key");
+            engine, "TLS client private key");
         cleanse(opt_tls_keypass);
         if (pkey == NULL)
             goto err;
@@ -1487,9 +1554,9 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
          * because it gives poor and sometimes misleading diagnostics
          */
         if (!X509_check_private_key(SSL_CTX_get0_certificate(ssl_ctx),
-                                    pkey)) {
+                pkey)) {
             CMP_err2("TLS private key '%s' does not match the TLS certificate '%s'\n",
-                     opt_tls_key, opt_tls_cert);
+                opt_tls_key, opt_tls_cert);
             EVP_PKEY_free(pkey);
             pkey = NULL; /* otherwise, for some reason double free! */
             goto err;
@@ -1511,11 +1578,11 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
          * the expected hostname would mislead the check.
          */
         if (!truststore_set_host_etc(trust_store,
-                                     opt_tls_host != NULL ? opt_tls_host : host))
+                opt_tls_host != NULL ? opt_tls_host : host))
             goto err;
     }
     return ssl_ctx;
- err:
+err:
     SSL_CTX_free(ssl_ctx);
     return NULL;
 }
@@ -1549,8 +1616,8 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         if (pass_string != NULL) {
             cleanse(opt_secret);
             res = OSSL_CMP_CTX_set1_secretValue(ctx,
-                                                (unsigned char *)pass_string,
-                                                strlen(pass_string));
+                (unsigned char *)pass_string,
+                strlen(pass_string));
             clear_free(pass_string);
             if (res == 0)
                 return 0;
@@ -1559,13 +1626,13 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
             CMP_warn("-cert and -key not used for protection since -secret is given");
     }
     if (opt_ref != NULL
-            && !OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_ref,
-                                                 strlen(opt_ref)))
+        && !OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_ref,
+            strlen(opt_ref)))
         return 0;
 
     if (opt_key != NULL) {
         EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, engine,
-                                      "private key for CMP client certificate");
+            "private key for CMP client certificate");
 
         if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
             EVP_PKEY_free(pkey);
@@ -1583,8 +1650,8 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         int ok;
 
         if (!load_cert_certs(opt_cert, &cert, &certs, 0, opt_keypass,
-                             "CMP client certificate (optionally with chain)",
-                             vpm))
+                "CMP client certificate (optionally with chain)",
+                vpm))
             /* opt_keypass is needed if opt_cert is an encrypted PKCS#12 file */
             return 0;
         ok = OSSL_CMP_CTX_set1_cert(ctx, cert);
@@ -1594,7 +1661,7 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         } else {
             if (opt_own_trusted != NULL) {
                 own_trusted = load_trusted(opt_own_trusted, 0,
-                                           "trusted certs for verifying own CMP signer cert");
+                    "trusted certs for verifying own CMP signer cert");
                 ok = own_trusted != NULL;
             }
             ok = ok && OSSL_CMP_CTX_build_cert_chain(ctx, own_trusted, certs);
@@ -1608,7 +1675,7 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
     }
 
     if (!setup_certs(opt_extracerts, "extra certificates for CMP", ctx,
-                     (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_extraCertsOut))
+            (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_extraCertsOut))
         return 0;
     cleanse(opt_otherpass);
 
@@ -1660,25 +1727,25 @@ static int set_fallback_pubkey(OSSL_CMP_CTX *ctx)
 
     if (req == NULL) {
         CMP_err1("failed to load ir/cr/kur file '%s' attempting to get fallback public key",
-                 file);
+            file);
         return 0;
     }
     if ((pubkey = OSSL_CMP_MSG_get0_certreq_publickey(req)) == NULL
         || (pkey = X509_PUBKEY_get0(pubkey)) == NULL) {
         CMP_err1("failed to get fallback public key from ir/cr/kur file '%s'",
-                 file);
+            file);
         goto err;
     }
     pkey1 = EVP_PKEY_dup(pkey);
     if (pkey == NULL || !OSSL_CMP_CTX_set0_newPkey(ctx, 0 /* priv */, pkey1)) {
         EVP_PKEY_free(pkey1);
         CMP_err1("failed to get fallback public key obtained from ir/cr/kur file '%s'",
-                 file);
+            file);
         goto err;
     }
     res = 1;
 
- err:
+err:
     OSSL_CMP_MSG_free(req);
     return res;
 }
@@ -1695,8 +1762,8 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
     X509V3_CTX ext_ctx;
 
     if (opt_subject == NULL
-            && opt_csr == NULL && opt_oldcert == NULL && opt_cert == NULL
-            && opt_cmd != CMP_RR && opt_cmd != CMP_GENM)
+        && opt_csr == NULL && opt_oldcert == NULL && opt_cert == NULL
+        && opt_cmd != CMP_RR && opt_cmd != CMP_GENM)
         CMP_warn("no -subject given; no -csr or -oldcert or -cert available for fallback");
 
     if (!set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer"))
@@ -1728,8 +1795,7 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
             && opt_popo != OSSL_CRMF_POPO_RAVERIFIED) {
             if (opt_csr != NULL) {
                 CMP_err1("no -newkey option given with private key for POPO, -csr option provides just public key%s",
-                         opt_key == NULL ? "" :
-                         ", and -key option superseded by -csr");
+                    opt_key == NULL ? "" : ", and -key option superseded by -csr");
                 if (opt_reqin != NULL)
                     CMP_info("since -reqin is used, may use -popo -1 or -popo 0 to disable the needless generation of a POPO");
                 return 0;
@@ -1755,7 +1821,7 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
                     return 0;
             } else {
                 CMP_warn1("-subject %s since sender is taken from -ref or -cert",
-                          msg);
+                    msg);
             }
         }
         if (opt_issuer != NULL && opt_cmd != CMP_RR)
@@ -1796,7 +1862,7 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         }
         if (opt_subject != NULL)
             CMP_warn2("given -subject '%s' overrides the subject of '%s' for KUR",
-                      opt_subject, ref_cert != NULL ? ref_cert : opt_csr);
+                opt_subject, ref_cert != NULL ? ref_cert : opt_csr);
     }
     if (opt_cmd == CMP_RR) {
         if (opt_issuer == NULL && opt_serial == NULL) {
@@ -1833,7 +1899,7 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         }
         if (opt_revreason > CRL_REASON_NONE)
             (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_REVOCATION_REASON,
-                                          opt_revreason);
+                opt_revreason);
     } else {
         if (opt_serial != NULL)
             CMP_warn("Ignoring -serial for command other than 'rr'");
@@ -1844,7 +1910,7 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
     }
 
     if (opt_recipient == NULL && opt_srvcert == NULL && opt_issuer == NULL
-            && opt_oldcert == NULL && opt_cert == NULL)
+        && opt_oldcert == NULL && opt_cert == NULL)
         CMP_warn("missing -recipient, -srvcert, -issuer, -oldcert or -cert; recipient for any requests not covered by -reqin will be set to \"NULL-DN\"");
 
     if (opt_cmd == CMP_P10CR || opt_cmd == CMP_RR || opt_cmd == CMP_GENM) {
@@ -1886,15 +1952,15 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
             return 0;
         }
     } else if (opt_reqin != NULL
-               && opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL
-               && !opt_centralkeygen) {
+        && opt_key == NULL && opt_csr == NULL && opt_oldcert == NULL
+        && !opt_centralkeygen) {
         if (!set_fallback_pubkey(ctx))
             return 0;
     }
 
     if (opt_days > 0
-            && !OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_VALIDITY_DAYS,
-                                        opt_days)) {
+        && !OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_VALIDITY_DAYS,
+            opt_days)) {
         CMP_err("could not set requested cert validity period");
         return 0;
     }
@@ -1923,13 +1989,13 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         if (opt_reqexts != NULL
             && !X509V3_EXT_add_nconf_sk(conf, &ext_ctx, opt_reqexts, &exts)) {
             CMP_err1("cannot load certificate request extension section '%s'",
-                     opt_reqexts);
+                opt_reqexts);
             goto exts_err;
         }
         if (opt_policies != NULL
             && !X509V3_EXT_add_nconf_sk(conf, &ext_ctx, opt_policies, &exts)) {
             CMP_err1("cannot load policy cert request extension section '%s'",
-                     opt_policies);
+                opt_policies);
             goto exts_err;
         }
         OSSL_CMP_CTX_set0_reqExtensions(ctx, exts);
@@ -1948,7 +2014,7 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         if (opt_sans != NULL)
             CMP_warn("-opt_san_nodefault has no effect when -sans is used");
         (void)OSSL_CMP_CTX_set_option(ctx,
-                                      OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT, 1);
+            OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT, 1);
     }
 
     if (opt_policy_oids_critical) {
@@ -1990,11 +2056,10 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
             CMP_warn("-oldcert option is ignored for 'genm' command");
         } else {
             if (!setup_cert(ctx, opt_oldcert, opt_keypass,
-                            /* needed if opt_oldcert is encrypted PKCS12 file */
-                            opt_cmd == CMP_KUR ? "certificate to be updated" :
-                            opt_cmd == CMP_RR ? "certificate to be revoked" :
-                            "reference certificate (oldcert)",
-                            (add_X509_fn_t)OSSL_CMP_CTX_set1_oldCert))
+                    /* needed if opt_oldcert is encrypted PKCS12 file */
+                    opt_cmd == CMP_KUR ? "certificate to be updated" : opt_cmd == CMP_RR ? "certificate to be revoked"
+                                                                                         : "reference certificate (oldcert)",
+                    (add_X509_fn_t)OSSL_CMP_CTX_set1_oldCert))
                 return 0;
         }
     }
@@ -2002,9 +2067,9 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
 
     return 1;
 
- oom:
+oom:
     CMP_err("out of memory");
- exts_err:
+exts_err:
     sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
     X509_REQ_free(csr);
     return 0;
@@ -2036,7 +2101,7 @@ static int add_certProfile(OSSL_CMP_CTX *ctx, const char *name)
     OSSL_CMP_ITAV_free(itav);
     return 0;
 
- err:
+err:
     sk_ASN1_UTF8STRING_pop_free(sk, ASN1_UTF8STRING_free);
     return 0;
 }
@@ -2079,14 +2144,14 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
             if (*ptr != '\0') {
                 if (*ptr != ',') {
                     CMP_err1("Missing ',' or end of -geninfo arg after int at %.40s",
-                             ptr);
+                        ptr);
                     goto err;
                 }
                 ptr++;
             }
 
             if ((aint = ASN1_INTEGER_new()) == NULL
-                    || !ASN1_INTEGER_set(aint, value))
+                || !ASN1_INTEGER_set(aint, value))
                 goto oom;
             ASN1_TYPE_set(type, V_ASN1_INTEGER, aint);
             aint = NULL;
@@ -2098,7 +2163,7 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
             else
                 *end++ = '\0';
             if ((text = ASN1_UTF8STRING_new()) == NULL
-                    || !ASN1_STRING_set(text, ptr, -1))
+                || !ASN1_STRING_set(text, ptr, -1))
                 goto oom;
             ptr = end;
             ASN1_TYPE_set(type, V_ASN1_UTF8STRING, text);
@@ -2124,9 +2189,9 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
     } while (*ptr != '\0');
     return 1;
 
- oom:
+oom:
     CMP_err("out of memory");
- err:
+err:
     ASN1_OBJECT_free(obj);
     ASN1_TYPE_free(type);
     ASN1_INTEGER_free(aint);
@@ -2174,8 +2239,8 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         goto set_path;
     }
     if (!OSSL_HTTP_parse_url(opt_server, &use_ssl, NULL /* user */,
-                             &host, &port, &portnum,
-                             &path, NULL /* q */, NULL /* frag */)) {
+            &host, &port, &portnum,
+            &path, NULL /* q */, NULL /* frag */)) {
         CMP_err1("cannot parse -server URL: %s", opt_server);
         goto err;
     }
@@ -2190,21 +2255,21 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
     if (opt_path == NULL)
         used_path = path;
     if (!OSSL_CMP_CTX_set1_server(ctx, host)
-            || !OSSL_CMP_CTX_set_serverPort(ctx, portnum))
+        || !OSSL_CMP_CTX_set_serverPort(ctx, portnum))
         goto oom;
     if (opt_proxy != NULL && !OSSL_CMP_CTX_set1_proxy(ctx, opt_proxy))
         goto oom;
     if (opt_no_proxy != NULL && !OSSL_CMP_CTX_set1_no_proxy(ctx, opt_no_proxy))
         goto oom;
     (void)BIO_snprintf(server_buf, sizeof(server_buf), "http%s://%s:%s/%s",
-                       opt_tls_used ? "s" : "", host, port,
-                       *used_path == '/' ? used_path + 1 : used_path);
+        opt_tls_used ? "s" : "", host, port,
+        *used_path == '/' ? used_path + 1 : used_path);
 
     proxy_host = OSSL_HTTP_adapt_proxy(opt_proxy, opt_no_proxy, host, use_ssl);
     if (proxy_host != NULL)
         (void)BIO_snprintf(proxy_buf, sizeof(proxy_buf), " via %s", proxy_host);
 
- set_path:
+set_path:
 #endif
 
     if (!OSSL_CMP_CTX_set1_serverPath(ctx, used_path))
@@ -2255,19 +2320,19 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
 
     if (opt_keep_alive != 1)
         (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_KEEP_ALIVE,
-                                      opt_keep_alive);
+            opt_keep_alive);
     if (opt_total_timeout > 0 && opt_msg_timeout > 0
-            && opt_total_timeout < opt_msg_timeout) {
+        && opt_total_timeout < opt_msg_timeout) {
         CMP_err2("-total_timeout argument = %d must not be < %d (-msg_timeout)",
-                 opt_total_timeout, opt_msg_timeout);
+            opt_total_timeout, opt_msg_timeout);
         goto err;
     }
     if (opt_msg_timeout >= 0) /* must do this before setup_ssl_ctx() */
         (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_MSG_TIMEOUT,
-                                      opt_msg_timeout);
+            opt_msg_timeout);
     if (opt_total_timeout >= 0)
         (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_TOTAL_TIMEOUT,
-                                      opt_total_timeout);
+            opt_total_timeout);
 
     if (opt_rspin != NULL) {
         rspin_in_use = 1;
@@ -2277,7 +2342,7 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
     if (opt_reqin_new_tid && opt_reqin == NULL)
         CMP_warn("-reqin_new_tid is ignored since -reqin is not present");
     if (opt_reqin != NULL || opt_reqout != NULL
-            || opt_rspin != NULL || opt_rspout != NULL || opt_use_mock_srv)
+        || opt_rspin != NULL || opt_rspout != NULL || opt_use_mock_srv)
         (void)OSSL_CMP_CTX_set_transfer_cb(ctx, read_write_req_resp);
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
@@ -2321,8 +2386,8 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         goto err;
 
     if (!set_name(opt_recipient, OSSL_CMP_CTX_set1_recipient, ctx, "recipient")
-            || !set_name(opt_expect_sender, OSSL_CMP_CTX_set1_expected_sender,
-                         ctx, "expected sender"))
+        || !set_name(opt_expect_sender, OSSL_CMP_CTX_set1_expected_sender,
+            ctx, "expected sender"))
         goto err;
 
     if (opt_geninfo != NULL && !handle_opt_geninfo(ctx))
@@ -2333,17 +2398,16 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
     /* not printing earlier, to minimize confusion in case setup fails before */
     if (opt_reqout_only == NULL)
         CMP_info3("will contact %s%s%s ", server_buf, proxy_buf,
-                  opt_rspin == NULL ? "" :
-                  " only if -rspin argument gives too few filenames");
+            opt_rspin == NULL ? "" : " only if -rspin argument gives too few filenames");
 
     ret = 1;
 
- err:
+err:
     OPENSSL_free(host);
     OPENSSL_free(port);
     OPENSSL_free(path);
     return ret;
- oom:
+oom:
     CMP_err("out of memory");
     goto err;
 }
@@ -2356,12 +2420,12 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
 static int write_cert(BIO *bio, X509 *cert)
 {
     if ((opt_certform == FORMAT_PEM && PEM_write_bio_X509(bio, cert))
-            || (opt_certform == FORMAT_ASN1 && i2d_X509_bio(bio, cert)))
+        || (opt_certform == FORMAT_ASN1 && i2d_X509_bio(bio, cert)))
         return 1;
     if (opt_certform != FORMAT_PEM && opt_certform != FORMAT_ASN1)
         BIO_printf(bio_err,
-                   "error: unsupported type '%s' for writing certificates\n",
-                   opt_certform_s);
+            "error: unsupported type '%s' for writing certificates\n",
+            opt_certform_s);
     return 0;
 }
 
@@ -2369,12 +2433,12 @@ static int write_crl(BIO *bio, X509_CRL *crl)
 {
     if (opt_crlform != FORMAT_PEM && opt_crlform != FORMAT_ASN1) {
         BIO_printf(bio_err, "error: unsupported type '%s' for writing CRLs\n",
-                   opt_crlform_s);
+            opt_crlform_s);
         return 0;
     }
 
     return opt_crlform == FORMAT_PEM ? PEM_write_bio_X509_CRL(bio, crl)
-                                      : i2d_X509_CRL_bio(bio, crl);
+                                     : i2d_X509_CRL_bio(bio, crl);
 }
 
 /*
@@ -2386,7 +2450,7 @@ static int write_crl(BIO *bio, X509_CRL *crl)
  * Returns number of written certificates on success, -1 on error.
  */
 static int save_free_certs(STACK_OF(X509) *certs,
-                           const char *file, const char *desc)
+    const char *file, const char *desc)
 {
     BIO *bio = NULL;
     int i;
@@ -2398,14 +2462,14 @@ static int save_free_certs(STACK_OF(X509) *certs,
         goto end;
     if (certs != NULL)
         CMP_info3("received %d %s certificate(s), saving to file '%s'",
-                  n, desc, file);
+            n, desc, file);
     if (n > 1 && opt_certform != FORMAT_PEM)
         CMP_warn("saving more than one certificate in non-PEM format");
 
     if ((bio = BIO_new(BIO_s_file())) == NULL
-            || !BIO_write_filename(bio, (char *)file)) {
+        || !BIO_write_filename(bio, (char *)file)) {
         CMP_err3("could not open file '%s' for %s %s certificate(s)",
-                 file, certs == NULL ? "deleting" : "writing", desc);
+            file, certs == NULL ? "deleting" : "writing", desc);
         n = -1;
         goto end;
     }
@@ -2418,14 +2482,14 @@ static int save_free_certs(STACK_OF(X509) *certs,
         }
     }
 
- end:
+end:
     BIO_free(bio);
     OSSL_STACK_OF_X509_free(certs);
     return n;
 }
 
 static int save_crl(X509_CRL *crl,
-                    const char *file, const char *desc)
+    const char *file, const char *desc)
 {
     BIO *bio = NULL;
     int res = 0;
@@ -2436,9 +2500,9 @@ static int save_crl(X509_CRL *crl,
         CMP_info2("received %s, saving to file '%s'", desc, file);
 
     if ((bio = BIO_new(BIO_s_file())) == NULL
-            || !BIO_write_filename(bio, (char *)file)) {
+        || !BIO_write_filename(bio, (char *)file)) {
         CMP_err2("could not open file '%s' for writing %s",
-                 file, desc);
+            file, desc);
         goto end;
     }
 
@@ -2448,7 +2512,7 @@ static int save_crl(X509_CRL *crl,
     }
     res = 1;
 
- end:
+end:
     BIO_free(bio);
     return res;
 }
@@ -2460,7 +2524,7 @@ static int delete_file(const char *file, const char *desc)
 
     if (unlink(file) != 0 && errno != ENOENT) {
         CMP_err2("Failed to delete %s, which should be done to indicate there is no %s",
-                 file, desc);
+            file, desc);
         return 0;
     }
     return 1;
@@ -2499,13 +2563,13 @@ static int save_template(const char *file, const OSSL_CRMF_CERTTEMPLATE *tmpl)
 
     if (bio == NULL) {
         CMP_err1("error saving certTemplate from genp: cannot open file %s",
-                 file);
+            file);
         return 0;
     }
     if (!ASN1_i2d_bio_of(OSSL_CRMF_CERTTEMPLATE, i2d_OSSL_CRMF_CERTTEMPLATE,
-                         bio, tmpl)) {
+            bio, tmpl)) {
         CMP_err1("error saving certTemplate from genp: cannot write file %s",
-                 file);
+            file);
         BIO_free(bio);
         return 0;
     } else {
@@ -2596,7 +2660,7 @@ static const char *prev_item(const char *opt, const char *end)
     len = end - beg;
     if (len > SECTION_NAME_MAX) {
         CMP_warn3("using only first %d characters of section name starting with \"%.*s\"",
-                  SECTION_NAME_MAX, SECTION_NAME_MAX, beg);
+            SECTION_NAME_MAX, SECTION_NAME_MAX, beg);
         len = SECTION_NAME_MAX;
     }
     memcpy(opt_item, beg, len);
@@ -2613,7 +2677,7 @@ static const char *prev_item(const char *opt, const char *end)
 
 /* get str value for name from a comma-separated hierarchy of config sections */
 static char *conf_get_string(const CONF *src_conf, const char *groups,
-                             const char *name)
+    const char *name)
 {
     char *res = NULL;
     const char *end = groups + strlen(groups);
@@ -2627,7 +2691,7 @@ static char *conf_get_string(const CONF *src_conf, const char *groups,
 
 /* get long val for name from a comma-separated hierarchy of config sections */
 static int conf_get_number_e(const CONF *conf_, const char *groups,
-                             const char *name, long *result)
+    const char *name, long *result)
 {
     char *str = conf_get_string(conf_, groups, name);
     char *tailptr;
@@ -2664,25 +2728,22 @@ static int read_config(void)
     int n_options = OSSL_NELEM(cmp_options) - 1;
 
     for (opt = &cmp_options[start_opt], i = start_idx;
-         opt->name != NULL; i++, opt++)
+        opt->name != NULL; i++, opt++)
         if (!strcmp(opt->name, OPT_SECTION_STR)
-                || !strcmp(opt->name, OPT_MORE_STR))
+            || !strcmp(opt->name, OPT_MORE_STR))
             n_options--;
-    OPENSSL_assert(OSSL_NELEM(cmp_vars) == n_options
-                   + OPT_PROV__FIRST + 1 - OPT_PROV__LAST
-                   + OPT_R__FIRST + 1 - OPT_R__LAST
-                   + OPT_V__FIRST + 1 - OPT_V__LAST);
+    OPENSSL_assert(OSSL_NELEM(cmp_vars) == n_options + OPT_PROV__FIRST + 1 - OPT_PROV__LAST + OPT_R__FIRST + 1 - OPT_R__LAST + OPT_V__FIRST + 1 - OPT_V__LAST);
     for (opt = &cmp_options[start_opt], i = start_idx;
-         opt->name != NULL; i++, opt++) {
+        opt->name != NULL; i++, opt++) {
         int provider_option = (OPT_PROV__FIRST <= opt->retval
-                               && opt->retval < OPT_PROV__LAST);
+            && opt->retval < OPT_PROV__LAST);
         int rand_state_option = (OPT_R__FIRST <= opt->retval
-                                 && opt->retval < OPT_R__LAST);
+            && opt->retval < OPT_R__LAST);
         int verification_option = (OPT_V__FIRST <= opt->retval
-                                   && opt->retval < OPT_V__LAST);
+            && opt->retval < OPT_V__LAST);
 
         if (strcmp(opt->name, OPT_SECTION_STR) == 0
-                || strcmp(opt->name, OPT_MORE_STR) == 0) {
+            || strcmp(opt->name, OPT_MORE_STR) == 0) {
             i--;
             continue;
         }
@@ -2700,12 +2761,12 @@ static int read_config(void)
             }
             if (opt->valtype == 'p' && num <= 0) {
                 opt_printf_stderr("Non-positive number \"%ld\" for config option -%s\n",
-                                  num, opt->name);
+                    num, opt->name);
                 return -1;
             }
             if (opt->valtype == 'N' && num < 0) {
                 opt_printf_stderr("Negative number \"%ld\" for config option -%s\n",
-                                  num, opt->name);
+                    num, opt->name);
                 return -1;
             }
             break;
@@ -2720,7 +2781,7 @@ static int read_config(void)
             break;
         default:
             CMP_err2("internal: unsupported type '%c' for option '%s'",
-                     opt->valtype, opt->name);
+                opt->valtype, opt->name);
             return 0;
             break;
         }
@@ -2744,10 +2805,10 @@ static int read_config(void)
                 (void)opt_init(conf_argc, conf_argv, cmp_options);
 
                 if (provider_option
-                    ? !opt_provider(opt_next())
-                    : !opt_verify(opt_next(), vpm)) {
+                        ? !opt_provider(opt_next())
+                        : !opt_verify(opt_next(), vpm)) {
                     CMP_err2("for option '%s' in config file section '%s'",
-                             opt->name, opt_section);
+                        opt->name, opt_section);
                     return 0;
                 }
             }
@@ -2759,8 +2820,8 @@ static int read_config(void)
             case 'N':
                 if (num < INT_MIN || INT_MAX < num) {
                     BIO_printf(bio_err,
-                               "integer value out of range for option '%s'\n",
-                               opt->name);
+                        "integer value out of range for option '%s'\n",
+                        opt->name);
                     return 0;
                 }
                 *cmp_vars[i].num = (int)num;
@@ -2786,7 +2847,7 @@ static char *opt_str(void)
 
     if (arg[0] == '\0') {
         CMP_warn1("%s option argument is empty string, resetting option",
-                  opt_flag());
+            opt_flag());
         arg = NULL;
     } else if (arg[0] == '-') {
         CMP_warn1("%s option argument starts with hyphen", opt_flag());
@@ -2805,7 +2866,7 @@ static int get_opts(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             return 0;
         case OPT_HELP:
@@ -3016,7 +3077,7 @@ static int get_opts(int argc, char **argv)
         case OPT_POPO:
             opt_popo = opt_int_arg();
             if (opt_popo < OSSL_CRMF_POPO_NONE
-                    || opt_popo > OSSL_CRMF_POPO_KEYENC) {
+                || opt_popo > OSSL_CRMF_POPO_KEYENC) {
                 CMP_err("invalid popo spec. Valid values are -1 .. 2");
                 goto opthelp;
             }
@@ -3045,8 +3106,8 @@ static int get_opts(int argc, char **argv)
         case OPT_REVREASON:
             opt_revreason = opt_int_arg();
             if (opt_revreason < CRL_REASON_NONE
-                    || opt_revreason > CRL_REASON_AA_COMPROMISE
-                    || opt_revreason == 7) {
+                || opt_revreason > CRL_REASON_AA_COMPROMISE
+                || opt_revreason == 7) {
                 CMP_err("invalid revreason. Valid values are -1 .. 6, 8 .. 10");
                 goto opthelp;
             }
@@ -3236,9 +3297,9 @@ static int cmp_server(OSSL_CMP_CTX *srv_cmp_ctx)
         OSSL_CMP_MSG *resp = NULL;
 
         ret = http_server_get_asn1_req(ASN1_ITEM_rptr(OSSL_CMP_MSG),
-                                       (ASN1_VALUE **)&req, &path,
-                                       &cbio, acbio, &keep_alive,
-                                       prog, 0, 0);
+            (ASN1_VALUE **)&req, &path,
+            &cbio, acbio, &keep_alive,
+            prog, 0, 0);
         if (ret == 0) { /* no request yet */
             if (retry) {
                 OSSL_sleep(1000);
@@ -3257,23 +3318,23 @@ static int cmp_server(OSSL_CMP_CTX *srv_cmp_ctx)
             if (strcmp(path, "") != 0 && strcmp(path, "pkix/") != 0) {
                 (void)http_server_send_status(prog, cbio, 404, "Not Found");
                 CMP_err1("expecting empty path or 'pkix/' but got '%s'",
-                         path);
+                    path);
                 OPENSSL_free(path);
                 OSSL_CMP_MSG_free(req);
                 goto next;
             }
             OPENSSL_free(path);
-            resp = OSSL_CMP_CTX_server_perform(cmp_ctx, req);
+            resp = OSSL_CMP_CTX_server_perform(cmp_ctx /* of client */, req);
             OSSL_CMP_MSG_free(req);
             if (resp == NULL) {
                 (void)http_server_send_status(prog, cbio,
-                                              500, "Internal Server Error");
+                    500, "Internal Server Error");
                 break; /* treated as fatal error */
             }
             ret = http_server_send_asn1_resp(prog, cbio, keep_alive,
-                                             "application/pkixcmp",
-                                             ASN1_ITEM_rptr(OSSL_CMP_MSG),
-                                             (const ASN1_VALUE *)resp);
+                "application/pkixcmp",
+                ASN1_ITEM_rptr(OSSL_CMP_MSG),
+                (const ASN1_VALUE *)resp);
             OSSL_CMP_MSG_free(resp);
             if (!ret)
                 break; /* treated as fatal error */
@@ -3323,28 +3384,26 @@ static void print_keyspec(OSSL_CMP_ATAVS *keySpec)
         int nid = OBJ_obj2nid(type);
 
         switch (nid) {
-        case NID_id_regCtrl_algId:
-            {
-                X509_ALGOR *alg = OSSL_CMP_ATAV_get0_algId(atav);
-                const ASN1_OBJECT *oid;
-                int paramtype;
-                const void *param;
+        case NID_id_regCtrl_algId: {
+            X509_ALGOR *alg = OSSL_CMP_ATAV_get0_algId(atav);
+            const ASN1_OBJECT *oid;
+            int paramtype;
+            const void *param;
 
-                X509_ALGOR_get0(&oid, &paramtype, &param, alg);
-                BIO_printf(mem, "Key algorithm: ");
-                i2a_ASN1_OBJECT(mem, oid);
-                if (paramtype == V_ASN1_UNDEF || alg->parameter == NULL) {
-                    BIO_printf(mem, "\n");
-                } else {
-                    BIO_printf(mem, " - ");
-                    ASN1_item_print(mem, (ASN1_VALUE *)alg,
-                                    0, ASN1_ITEM_rptr(X509_ALGOR), NULL);
-                }
+            X509_ALGOR_get0(&oid, &paramtype, &param, alg);
+            BIO_printf(mem, "Key algorithm: ");
+            i2a_ASN1_OBJECT(mem, oid);
+            if (paramtype == V_ASN1_UNDEF || alg->parameter == NULL) {
+                BIO_printf(mem, "\n");
+            } else {
+                BIO_printf(mem, " - ");
+                ASN1_item_print(mem, (ASN1_VALUE *)alg,
+                    0, ASN1_ITEM_rptr(X509_ALGOR), NULL);
             }
-            break;
+        } break;
         case NID_id_regCtrl_rsaKeyLen:
             BIO_printf(mem, "Key algorithm: RSA %d\n",
-                       OSSL_CMP_ATAV_get_rsaKeyLen(atav));
+                OSSL_CMP_ATAV_get_rsaKeyLen(atav));
             break;
         default:
             BIO_printf(mem, "Invalid key spec: %s\n", nid_name(nid));
@@ -3367,8 +3426,7 @@ static void print_status(void)
     /* print PKIStatusInfo */
     int status = OSSL_CMP_CTX_get_status(cmp_ctx);
     char *buf = app_malloc(OSSL_CMP_PKISI_BUFLEN, "PKIStatusInfo buf");
-    const char *string =
-        OSSL_CMP_CTX_snprint_PKIStatus(cmp_ctx, buf, OSSL_CMP_PKISI_BUFLEN);
+    const char *string = OSSL_CMP_CTX_snprint_PKIStatus(cmp_ctx, buf, OSSL_CMP_PKISI_BUFLEN);
     const char *from = "", *server = "";
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
@@ -3378,16 +3436,17 @@ static void print_status(void)
     }
 #endif
     CMP_print(bio_err,
-              status == OSSL_CMP_PKISTATUS_accepted
-              ? OSSL_CMP_LOG_INFO :
-              status == OSSL_CMP_PKISTATUS_rejection
-              || status == OSSL_CMP_PKISTATUS_waiting
-              ? OSSL_CMP_LOG_ERR : OSSL_CMP_LOG_WARNING,
-              status == OSSL_CMP_PKISTATUS_accepted ? "info" :
-              status == OSSL_CMP_PKISTATUS_rejection ? "server error" :
-              status == OSSL_CMP_PKISTATUS_waiting ? "internal error"
-              : "warning", "received%s%s %s", from, server,
-              string != NULL ? string : "<unknown PKIStatus>");
+        status == OSSL_CMP_PKISTATUS_accepted
+            ? OSSL_CMP_LOG_INFO
+            : status == OSSL_CMP_PKISTATUS_rejection
+                || status == OSSL_CMP_PKISTATUS_waiting
+            ? OSSL_CMP_LOG_ERR
+            : OSSL_CMP_LOG_WARNING,
+        status == OSSL_CMP_PKISTATUS_accepted ? "info" : status == OSSL_CMP_PKISTATUS_rejection ? "server error"
+            : status == OSSL_CMP_PKISTATUS_waiting                                              ? "internal error"
+                                                                                                : "warning",
+        "received%s%s %s", from, server,
+        string != NULL ? string : "<unknown PKIStatus>");
     OPENSSL_free(buf);
 }
 
@@ -3409,7 +3468,7 @@ static int do_genm(OSSL_CMP_CTX *ctx)
             CMP_warn("no CA certificates provided by server");
         } else if (save_free_certs(cacerts, opt_cacertsout, "CA") < 0) {
             CMP_err1("Failed to store CA certificates from genp in %s",
-                     opt_cacertsout);
+                opt_cacertsout);
             return 0;
         }
         return 1;
@@ -3428,12 +3487,12 @@ static int do_genm(OSSL_CMP_CTX *ctx)
             CMP_warn("No -oldwithold given, will use all certs given with -trusted as trust anchors for verifying the newWithNew cert");
         } else {
             oldwithold = load_cert_pwd(opt_oldwithold, opt_otherpass,
-                                       "OldWithOld cert for genm with -infotype rootCaCert");
+                "OldWithOld cert for genm with -infotype rootCaCert");
             if (oldwithold == NULL)
                 goto end_upd;
         }
         if (!OSSL_CMP_get1_rootCaKeyUpdate(ctx, oldwithold, &newwithnew,
-                                           &newwithold, &oldwithnew))
+                &newwithold, &oldwithnew))
             goto end_upd;
         /* At this point might check authorization of response sender/origin */
 
@@ -3443,11 +3502,11 @@ static int do_genm(OSSL_CMP_CTX *ctx)
             CMP_warn("oldWithNew certificate received in genp for verifying oldWithOld, but oldWithOld was not provided");
 
         if (save_cert_or_delete(newwithnew, opt_newwithnew,
-                                "NewWithNew cert from genp")
+                "NewWithNew cert from genp")
             && save_cert_or_delete(newwithold, opt_newwithold,
-                                   "NewWithOld cert from genp")
+                "NewWithOld cert from genp")
             && save_cert_or_delete(oldwithnew, opt_oldwithnew,
-                                   "OldWithNew cert from genp"))
+                "OldWithNew cert from genp"))
             res = 1;
 
         X509_free(newwithnew);
@@ -3473,21 +3532,21 @@ static int do_genm(OSSL_CMP_CTX *ctx)
 
         if (opt_crlcert != NULL) {
             crlcert = load_cert_pwd(opt_crlcert, opt_otherpass,
-                                    "Cert for genm with -infotype crlStatusList");
+                "Cert for genm with -infotype crlStatusList");
             if (crlcert == NULL)
                 goto end_crlupd;
         }
 
         if (opt_oldcrl != NULL) {
             oldcrl = load_crl(opt_oldcrl, FORMAT_UNDEF, 0,
-                              "CRL for genm with -infotype crlStatusList");
+                "CRL for genm with -infotype crlStatusList");
             if (oldcrl == NULL)
                 goto end_crlupd;
         }
 
         if (opt_oldcrl != NULL && opt_crlcert != NULL) {
             if (X509_NAME_cmp(X509_CRL_get_issuer(oldcrl),
-                              X509_get_issuer_name(crlcert))
+                    X509_get_issuer_name(crlcert))
                 != 0)
                 CMP_warn("-oldcrl and -crlcert have different issuer");
         }
@@ -3550,12 +3609,12 @@ static int do_genm(OSSL_CMP_CTX *ctx)
 
         if (opt_infotype != NID_undef) {
             CMP_warn1("No specific support for -infotype %s available",
-                      opt_infotype_s);
+                opt_infotype_s);
 
             req = OSSL_CMP_ITAV_create(OBJ_nid2obj(opt_infotype), NULL);
             if (req == NULL || !OSSL_CMP_CTX_push0_genm_ITAV(ctx, req)) {
                 CMP_err1("Failed to create genm for -infotype %s",
-                         opt_infotype_s);
+                    opt_infotype_s);
                 return 0;
             }
         }
@@ -3588,11 +3647,12 @@ static int handle_opts_upfront(int argc, char **argv)
             if (!strcmp(argv[i] + 1, cmp_options[OPT_CONFIG - OPT_HELP].name))
                 opt_config = argv[++i];
             else if (!strcmp(argv[i] + 1,
-                             cmp_options[OPT_SECTION - OPT_HELP].name))
+                         cmp_options[OPT_SECTION - OPT_HELP].name))
                 opt_section = argv[++i];
             else if (strcmp(argv[i] + 1,
-                            cmp_options[OPT_VERBOSITY - OPT_HELP].name) == 0
-                     && !set_verbosity(atoi(argv[++i])))
+                         cmp_options[OPT_VERBOSITY - OPT_HELP].name)
+                    == 0
+                && !set_verbosity(atoi(argv[++i])))
                 return 0;
         }
     }
@@ -3607,7 +3667,6 @@ int cmp_main(int argc, char **argv)
     int i;
     X509 *newcert = NULL;
     ENGINE *engine = NULL;
-    OSSL_CMP_CTX *srv_cmp_ctx = NULL;
     int ret = 0; /* default: failure */
 
     if (!handle_opts_upfront(argc, argv))
@@ -3622,10 +3681,10 @@ int cmp_main(int argc, char **argv)
     /* read default values for options from config file */
     configfile = opt_config != NULL ? opt_config : default_config_file;
     if (configfile != NULL && configfile[0] != '\0' /* non-empty string */
-            && (configfile != default_config_file
-                || access(configfile, F_OK) != -1)) {
+        && (configfile != default_config_file
+            || access(configfile, F_OK) != -1)) {
         CMP_info2("using section(s) '%s' of OpenSSL configuration file '%s'",
-                  opt_section, configfile);
+            opt_section, configfile);
         conf = app_load_config(configfile);
         if (conf == NULL) {
             goto err;
@@ -3634,14 +3693,14 @@ int cmp_main(int argc, char **argv)
                 if (!NCONF_get_section(conf, opt_section))
                     CMP_info2("no [%s] section found in config file '%s';"
                               " will thus use just [default] and unnamed section if present",
-                              opt_section, configfile);
+                        opt_section, configfile);
             } else {
                 const char *end = opt_section + strlen(opt_section);
 
                 while ((end = prev_item(opt_section, end)) != NULL) {
                     if (!NCONF_get_section(conf, opt_item)) {
                         CMP_err2("no [%s] section found in config file '%s'",
-                                 opt_item, configfile);
+                            opt_item, configfile);
                         goto err;
                     }
                 }
@@ -3675,7 +3734,7 @@ int cmp_main(int argc, char **argv)
 
     if (opt_engine != NULL) {
         engine = setup_engine_methods(opt_engine,
-                                      0 /* not: ENGINE_METHOD_ALL */, 0);
+            0 /* not: ENGINE_METHOD_ALL */, 0);
         if (engine == NULL) {
             CMP_err1("cannot load engine %s", opt_engine);
             goto err;
@@ -3690,8 +3749,8 @@ int cmp_main(int argc, char **argv)
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
     if (opt_tls_cert == NULL && opt_tls_key == NULL && opt_tls_keypass == NULL
-            && opt_tls_extra == NULL && opt_tls_trusted == NULL
-            && opt_tls_host == NULL) {
+        && opt_tls_extra == NULL && opt_tls_trusted == NULL
+        && opt_tls_host == NULL) {
         if (opt_tls_used)
             CMP_warn("-tls_used given without any other TLS options");
     } else if (!opt_tls_used) {
@@ -3715,45 +3774,49 @@ int cmp_main(int argc, char **argv)
             goto err;
         }
     }
+
     if (opt_server != NULL && opt_use_mock_srv) {
         CMP_err("cannot use both -server and -use_mock_srv options");
         goto err;
     }
+    if ((opt_server == NULL || opt_use_mock_srv) && opt_tls_used) {
+        CMP_warn("ignoring -tls_used option since -server is not given or -use_mock_srv is given");
+        opt_tls_used = 0;
+    }
+
 #endif
 
     if (opt_ignore_keyusage)
         (void)OSSL_CMP_CTX_set_option(cmp_ctx, OSSL_CMP_OPT_IGNORE_KEYUSAGE, 1);
     if (opt_no_cache_extracerts)
         (void)OSSL_CMP_CTX_set_option(cmp_ctx, OSSL_CMP_OPT_NO_CACHE_EXTRACERTS,
-                                      1);
+            1);
 
     if (opt_reqout_only == NULL && (opt_use_mock_srv
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
-                                    || opt_port != NULL
+            || opt_port != NULL
 #endif
-                                    )) {
+            )) {
         OSSL_CMP_SRV_CTX *srv_ctx;
+        OSSL_CMP_CTX *srv_cmp_ctx;
 
         if ((srv_ctx = setup_srv_ctx(engine)) == NULL)
             goto err;
+        OSSL_CMP_CTX_set_transfer_cb_arg(cmp_ctx /* of client */, srv_ctx);
+
         srv_cmp_ctx = OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx);
-        OSSL_CMP_CTX_set_transfer_cb_arg(cmp_ctx, srv_ctx);
         if (!OSSL_CMP_CTX_set_log_cb(srv_cmp_ctx, print_to_bio_err)) {
             CMP_err1("cannot set up error reporting and logging for %s", prog);
             goto err;
         }
         OSSL_CMP_CTX_set_log_verbosity(srv_cmp_ctx, opt_verbosity);
-    }
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
-    if (opt_tls_used && (opt_use_mock_srv || opt_server == NULL)) {
-        CMP_warn("ignoring -tls_used option since -use_mock_srv is given or -server is not given");
-        opt_tls_used = 0;
-    }
-
-    if (opt_port != NULL) { /* act as very basic CMP HTTP server */
-        ret = cmp_server(srv_cmp_ctx);
-        goto err;
+        if (opt_port != NULL) { /* act as very basic CMP HTTP server only */
+            ret = cmp_server(srv_cmp_ctx);
+            goto err;
+        }
+#endif
     }
 
     /* act as CMP client, possibly using internal mock server */
@@ -3761,10 +3824,14 @@ int cmp_main(int argc, char **argv)
     if (opt_reqout_only != NULL) {
         const char *msg = "option is ignored since -reqout_only option is given";
 
-# if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
+#if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
+        if (opt_port != NULL) {
+            CMP_err("the -reqout_only client option does not combine with -port implying server behavior");
+            goto err;
+        }
         if (opt_server != NULL)
             CMP_warn1("-server %s", msg);
-# endif
+#endif
         if (opt_use_mock_srv)
             CMP_warn1("-use_mock_srv %s", msg);
         if (opt_reqout != NULL)
@@ -3776,12 +3843,13 @@ int cmp_main(int argc, char **argv)
         opt_reqout = opt_reqout_only;
     }
     if (opt_rspin != NULL) {
+#if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
         if (opt_server != NULL)
             CMP_warn("-server option is not used if enough filenames given for -rspin");
+#endif
         if (opt_use_mock_srv)
             CMP_warn("-use_mock_srv option is not used if enough filenames given for -rspin");
     }
-#endif
 
     if (!setup_client_ctx(cmp_ctx, engine)) {
         CMP_err("cannot set up CMP context");
@@ -3829,23 +3897,22 @@ int cmp_main(int argc, char **argv)
         }
         print_status();
         if (!save_cert_or_delete(OSSL_CMP_CTX_get0_validatedSrvCert(cmp_ctx),
-                                 opt_srvcertout, "validated server"))
+                opt_srvcertout, "validated server"))
             ret = 0;
         if (!ret)
             goto err;
         ret = 0;
         if (save_free_certs(OSSL_CMP_CTX_get1_extraCertsIn(cmp_ctx),
-                            opt_extracertsout, "extra") < 0)
+                opt_extracertsout, "extra")
+            < 0)
             goto err;
-        if (newcert != NULL && (opt_cmd == CMP_IR || opt_cmd == CMP_CR
-                                || opt_cmd == CMP_KUR || opt_cmd == CMP_P10CR)) {
+        if (newcert != NULL && (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR || opt_cmd == CMP_P10CR)) {
             STACK_OF(X509) *newchain = OSSL_CMP_CTX_get1_newChain(cmp_ctx);
 
             if (newcert != NULL && newchain != NULL /* NULL is on error only */
                 && opt_certout != NULL && opt_chainout != NULL
                 && strcmp(opt_certout, opt_chainout) == 0) {
-                if (!X509_add_cert(newchain, newcert, X509_ADD_FLAG_PREPEND
-                                   | X509_ADD_FLAG_UP_REF)) {
+                if (!X509_add_cert(newchain, newcert, X509_ADD_FLAG_PREPEND | X509_ADD_FLAG_UP_REF)) {
                     sk_X509_pop_free(newchain, X509_free);
                     goto err;
                 }
@@ -3857,7 +3924,8 @@ int cmp_main(int argc, char **argv)
                     goto err;
             }
             if (save_free_certs(OSSL_CMP_CTX_get1_caPubs(cmp_ctx),
-                                opt_cacertsout, "CA") < 0)
+                    opt_cacertsout, "CA")
+                < 0)
                 goto err;
             if (opt_centralkeygen) {
                 EVP_CIPHER *cipher = NULL;
@@ -3872,13 +3940,14 @@ int cmp_main(int argc, char **argv)
                     goto err;
                 if (opt_newkeypass != NULL) {
                     pass_string = get_passwd(opt_newkeypass,
-                                             "Centrally generated private key password");
+                        "Centrally generated private key password");
                     cipher = EVP_CIPHER_fetch(app_get0_libctx(), SN_aes_256_cbc, app_get0_propq());
                 }
 
                 CMP_info1("saving centrally generated key to file '%s'", opt_newkeyout);
                 if (PEM_write_bio_PrivateKey(out, new_key, cipher, NULL, 0, NULL,
-                                             (void *)pass_string) <= 0)
+                        (void *)pass_string)
+                    <= 0)
                     result = 0;
 
                 BIO_free(out);
@@ -3893,7 +3962,7 @@ int cmp_main(int argc, char **argv)
     }
     ret = 1;
 
- err:
+err:
     /* in case we ended up here on error without proper cleaning */
     cleanse(opt_keypass);
     cleanse(opt_newkeypass);
diff --git a/crypto/openssl/apps/cms.c b/crypto/openssl/apps/cms.c
index 6f19414880c9..214eea5bcb0a 100644
--- a/crypto/openssl/apps/cms.c
+++ b/crypto/openssl/apps/cms.c
@@ -24,31 +24,30 @@
 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
 static int cms_cb(int ok, X509_STORE_CTX *ctx);
 static void receipt_request_print(CMS_ContentInfo *cms);
-static CMS_ReceiptRequest
-*make_receipt_request(STACK_OF(OPENSSL_STRING) *rr_to, int rr_allorfirst,
-                      STACK_OF(OPENSSL_STRING) *rr_from);
+static CMS_ReceiptRequest *make_receipt_request(STACK_OF(OPENSSL_STRING) *rr_to, int rr_allorfirst,
+    STACK_OF(OPENSSL_STRING) *rr_from);
 static int cms_set_pkey_param(EVP_PKEY_CTX *pctx,
-                              STACK_OF(OPENSSL_STRING) *param);
+    STACK_OF(OPENSSL_STRING) *param);
 
-#define SMIME_OP                0x100
-#define SMIME_IP                0x200
-#define SMIME_SIGNERS           0x400
-#define SMIME_ENCRYPT           (1 | SMIME_OP)
-#define SMIME_DECRYPT           (2 | SMIME_IP)
-#define SMIME_SIGN              (3 | SMIME_OP | SMIME_SIGNERS)
-#define SMIME_VERIFY            (4 | SMIME_IP)
-#define SMIME_RESIGN            (5 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
-#define SMIME_SIGN_RECEIPT      (6 | SMIME_IP | SMIME_OP)
-#define SMIME_VERIFY_RECEIPT    (7 | SMIME_IP)
-#define SMIME_DIGEST_CREATE     (8 | SMIME_OP)
-#define SMIME_DIGEST_VERIFY     (9 | SMIME_IP)
-#define SMIME_COMPRESS          (10 | SMIME_OP)
-#define SMIME_UNCOMPRESS        (11 | SMIME_IP)
+#define SMIME_OP 0x100
+#define SMIME_IP 0x200
+#define SMIME_SIGNERS 0x400
+#define SMIME_ENCRYPT (1 | SMIME_OP)
+#define SMIME_DECRYPT (2 | SMIME_IP)
+#define SMIME_SIGN (3 | SMIME_OP | SMIME_SIGNERS)
+#define SMIME_VERIFY (4 | SMIME_IP)
+#define SMIME_RESIGN (5 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
+#define SMIME_SIGN_RECEIPT (6 | SMIME_IP | SMIME_OP)
+#define SMIME_VERIFY_RECEIPT (7 | SMIME_IP)
+#define SMIME_DIGEST_CREATE (8 | SMIME_OP)
+#define SMIME_DIGEST_VERIFY (9 | SMIME_IP)
+#define SMIME_COMPRESS (10 | SMIME_OP)
+#define SMIME_UNCOMPRESS (11 | SMIME_IP)
 #define SMIME_ENCRYPTED_ENCRYPT (12 | SMIME_OP)
 #define SMIME_ENCRYPTED_DECRYPT (13 | SMIME_IP)
-#define SMIME_DATA_CREATE       (14 | SMIME_OP)
-#define SMIME_DATA_OUT          (15 | SMIME_IP)
-#define SMIME_CMSOUT            (16 | SMIME_IP | SMIME_OP)
+#define SMIME_DATA_CREATE (14 | SMIME_OP)
+#define SMIME_DATA_OUT (15 | SMIME_IP)
+#define SMIME_CMSOUT (16 | SMIME_IP | SMIME_OP)
 
 static int verify_err = 0;
 
@@ -62,191 +61,252 @@ struct cms_key_param_st {
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENCRYPT,
-    OPT_DECRYPT, OPT_SIGN, OPT_CADES, OPT_SIGN_RECEIPT, OPT_RESIGN,
-    OPT_VERIFY, OPT_VERIFY_RETCODE, OPT_VERIFY_RECEIPT,
-    OPT_CMSOUT, OPT_DATA_OUT, OPT_DATA_CREATE, OPT_DIGEST_VERIFY,
-    OPT_DIGEST, OPT_DIGEST_CREATE, OPT_COMPRESS, OPT_UNCOMPRESS,
-    OPT_ED_DECRYPT, OPT_ED_ENCRYPT, OPT_DEBUG_DECRYPT, OPT_TEXT,
-    OPT_ASCIICRLF, OPT_NOINTERN, OPT_NOVERIFY, OPT_NOCERTS,
-    OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP, OPT_NO_SIGNING_TIME,
-    OPT_BINARY, OPT_KEYID,
-    OPT_NOSIGS, OPT_NO_CONTENT_VERIFY, OPT_NO_ATTR_VERIFY, OPT_INDEF,
-    OPT_NOINDEF, OPT_CRLFEOL, OPT_NOOUT, OPT_RR_PRINT,
-    OPT_RR_ALL, OPT_RR_FIRST, OPT_RCTFORM, OPT_CERTFILE, OPT_CAFILE,
-    OPT_CAPATH, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
-    OPT_CONTENT, OPT_PRINT, OPT_NAMEOPT,
-    OPT_SECRETKEY, OPT_SECRETKEYID, OPT_PWRI_PASSWORD, OPT_ECONTENT_TYPE,
-    OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP,
-    OPT_CERTSOUT, OPT_MD, OPT_INKEY, OPT_KEYFORM, OPT_KEYOPT, OPT_RR_FROM,
-    OPT_RR_TO, OPT_AES128_WRAP, OPT_AES192_WRAP, OPT_AES256_WRAP,
-    OPT_3DES_WRAP, OPT_WRAP, OPT_ENGINE,
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_ENCRYPT,
+    OPT_DECRYPT,
+    OPT_SIGN,
+    OPT_CADES,
+    OPT_SIGN_RECEIPT,
+    OPT_RESIGN,
+    OPT_VERIFY,
+    OPT_VERIFY_RETCODE,
+    OPT_VERIFY_RECEIPT,
+    OPT_CMSOUT,
+    OPT_DATA_OUT,
+    OPT_DATA_CREATE,
+    OPT_DIGEST_VERIFY,
+    OPT_DIGEST,
+    OPT_DIGEST_CREATE,
+    OPT_COMPRESS,
+    OPT_UNCOMPRESS,
+    OPT_ED_DECRYPT,
+    OPT_ED_ENCRYPT,
+    OPT_DEBUG_DECRYPT,
+    OPT_TEXT,
+    OPT_ASCIICRLF,
+    OPT_NOINTERN,
+    OPT_NOVERIFY,
+    OPT_NOCERTS,
+    OPT_NOATTR,
+    OPT_NODETACH,
+    OPT_NOSMIMECAP,
+    OPT_NO_SIGNING_TIME,
+    OPT_BINARY,
+    OPT_KEYID,
+    OPT_NOSIGS,
+    OPT_NO_CONTENT_VERIFY,
+    OPT_NO_ATTR_VERIFY,
+    OPT_INDEF,
+    OPT_NOINDEF,
+    OPT_CRLFEOL,
+    OPT_NOOUT,
+    OPT_RR_PRINT,
+    OPT_RR_ALL,
+    OPT_RR_FIRST,
+    OPT_RCTFORM,
+    OPT_CERTFILE,
+    OPT_CAFILE,
+    OPT_CAPATH,
+    OPT_CASTORE,
+    OPT_NOCAPATH,
+    OPT_NOCAFILE,
+    OPT_NOCASTORE,
+    OPT_CONTENT,
+    OPT_PRINT,
+    OPT_NAMEOPT,
+    OPT_SECRETKEY,
+    OPT_SECRETKEYID,
+    OPT_PWRI_PASSWORD,
+    OPT_ECONTENT_TYPE,
+    OPT_PASSIN,
+    OPT_TO,
+    OPT_FROM,
+    OPT_SUBJECT,
+    OPT_SIGNER,
+    OPT_RECIP,
+    OPT_CERTSOUT,
+    OPT_MD,
+    OPT_INKEY,
+    OPT_KEYFORM,
+    OPT_KEYOPT,
+    OPT_RR_FROM,
+    OPT_RR_TO,
+    OPT_AES128_WRAP,
+    OPT_AES192_WRAP,
+    OPT_AES256_WRAP,
+    OPT_3DES_WRAP,
+    OPT_WRAP,
+    OPT_ENGINE,
     OPT_R_ENUM,
-    OPT_PROV_ENUM, OPT_CONFIG,
+    OPT_PROV_ENUM,
+    OPT_CONFIG,
     OPT_V_ENUM,
     OPT_CIPHER,
     OPT_ORIGINATOR
 } OPTION_CHOICE;
 
 const OPTIONS cms_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n"},
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n" },
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("General"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"out", OPT_OUT, '>', "Output file"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "out", OPT_OUT, '>', "Output file" },
     OPT_CONFIG_OPTION,
 
     OPT_SECTION("Operation"),
-    {"encrypt", OPT_ENCRYPT, '-', "Encrypt message"},
-    {"decrypt", OPT_DECRYPT, '-', "Decrypt encrypted message"},
-    {"sign", OPT_SIGN, '-', "Sign message"},
-    {"verify", OPT_VERIFY, '-', "Verify signed message"},
-    {"resign", OPT_RESIGN, '-', "Resign a signed message"},
-    {"sign_receipt", OPT_SIGN_RECEIPT, '-',
-     "Generate a signed receipt for a message"},
-    {"verify_receipt", OPT_VERIFY_RECEIPT, '<',
-     "Verify receipts; exit if receipt signatures do not verify"},
-    {"digest", OPT_DIGEST, 's', "Sign a pre-computed digest in hex notation"},
-    {"digest_create", OPT_DIGEST_CREATE, '-',
-     "Create a CMS \"DigestedData\" object"},
-    {"digest_verify", OPT_DIGEST_VERIFY, '-',
-     "Verify a CMS \"DigestedData\" object and output it"},
-    {"compress", OPT_COMPRESS, '-', "Create a CMS \"CompressedData\" object"},
-    {"uncompress", OPT_UNCOMPRESS, '-',
-     "Uncompress a CMS \"CompressedData\" object"},
-    {"EncryptedData_encrypt", OPT_ED_ENCRYPT, '-',
-     "Create CMS \"EncryptedData\" object using symmetric key"},
-    {"EncryptedData_decrypt", OPT_ED_DECRYPT, '-',
-     "Decrypt CMS \"EncryptedData\" object using symmetric key"},
-    {"data_create", OPT_DATA_CREATE, '-', "Create a CMS \"Data\" object"},
-    {"data_out", OPT_DATA_OUT, '-', "Copy CMS \"Data\" object to output"},
-    {"cmsout", OPT_CMSOUT, '-', "Output CMS structure"},
+    { "encrypt", OPT_ENCRYPT, '-', "Encrypt message" },
+    { "decrypt", OPT_DECRYPT, '-', "Decrypt encrypted message" },
+    { "sign", OPT_SIGN, '-', "Sign message" },
+    { "verify", OPT_VERIFY, '-', "Verify signed message" },
+    { "resign", OPT_RESIGN, '-', "Resign a signed message" },
+    { "sign_receipt", OPT_SIGN_RECEIPT, '-',
+        "Generate a signed receipt for a message" },
+    { "verify_receipt", OPT_VERIFY_RECEIPT, '<',
+        "Verify receipts; exit if receipt signatures do not verify" },
+    { "digest", OPT_DIGEST, 's', "Sign a pre-computed digest in hex notation" },
+    { "digest_create", OPT_DIGEST_CREATE, '-',
+        "Create a CMS \"DigestedData\" object" },
+    { "digest_verify", OPT_DIGEST_VERIFY, '-',
+        "Verify a CMS \"DigestedData\" object and output it" },
+    { "compress", OPT_COMPRESS, '-', "Create a CMS \"CompressedData\" object" },
+    { "uncompress", OPT_UNCOMPRESS, '-',
+        "Uncompress a CMS \"CompressedData\" object" },
+    { "EncryptedData_encrypt", OPT_ED_ENCRYPT, '-',
+        "Create CMS \"EncryptedData\" object using symmetric key" },
+    { "EncryptedData_decrypt", OPT_ED_DECRYPT, '-',
+        "Decrypt CMS \"EncryptedData\" object using symmetric key" },
+    { "data_create", OPT_DATA_CREATE, '-', "Create a CMS \"Data\" object" },
+    { "data_out", OPT_DATA_OUT, '-', "Copy CMS \"Data\" object to output" },
+    { "cmsout", OPT_CMSOUT, '-', "Output CMS structure" },
 
     OPT_SECTION("File format"),
-    {"inform", OPT_INFORM, 'c', "Input format SMIME (default), PEM or DER"},
-    {"outform", OPT_OUTFORM, 'c',
-     "Output format SMIME (default), PEM or DER"},
-    {"rctform", OPT_RCTFORM, 'F', "Receipt file format"},
-    {"stream", OPT_INDEF, '-', "Enable CMS streaming"},
-    {"indef", OPT_INDEF, '-', "Same as -stream"},
-    {"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"},
-    {"binary", OPT_BINARY, '-',
-     "Treat input as binary: do not translate to canonical form"},
-    {"crlfeol", OPT_CRLFEOL, '-',
-     "Use CRLF as EOL termination instead of LF only" },
-    {"asciicrlf", OPT_ASCIICRLF, '-',
-     "Perform CRLF canonicalisation when signing"},
+    { "inform", OPT_INFORM, 'c', "Input format SMIME (default), PEM or DER" },
+    { "outform", OPT_OUTFORM, 'c',
+        "Output format SMIME (default), PEM or DER" },
+    { "rctform", OPT_RCTFORM, 'F', "Receipt file format" },
+    { "stream", OPT_INDEF, '-', "Enable CMS streaming" },
+    { "indef", OPT_INDEF, '-', "Same as -stream" },
+    { "noindef", OPT_NOINDEF, '-', "Disable CMS streaming" },
+    { "binary", OPT_BINARY, '-',
+        "Treat input as binary: do not translate to canonical form" },
+    { "crlfeol", OPT_CRLFEOL, '-',
+        "Use CRLF as EOL termination instead of LF only" },
+    { "asciicrlf", OPT_ASCIICRLF, '-',
+        "Perform CRLF canonicalisation when signing" },
 
     OPT_SECTION("Keys and passwords"),
-    {"pwri_password", OPT_PWRI_PASSWORD, 's',
-     "Specific password for recipient"},
-    {"secretkey", OPT_SECRETKEY, 's',
-     "Use specified hex-encoded key to decrypt/encrypt recipients or content"},
-    {"secretkeyid", OPT_SECRETKEYID, 's',
-     "Identity of the -secretkey for CMS \"KEKRecipientInfo\" object"},
-    {"inkey", OPT_INKEY, 's',
-     "Input private key (if not signer or recipient)"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"},
-    {"keyform", OPT_KEYFORM, 'f',
-     "Input private key format (ENGINE, other values ignored)"},
+    { "pwri_password", OPT_PWRI_PASSWORD, 's',
+        "Specific password for recipient" },
+    { "secretkey", OPT_SECRETKEY, 's',
+        "Use specified hex-encoded key to decrypt/encrypt recipients or content" },
+    { "secretkeyid", OPT_SECRETKEYID, 's',
+        "Identity of the -secretkey for CMS \"KEKRecipientInfo\" object" },
+    { "inkey", OPT_INKEY, 's',
+        "Input private key (if not signer or recipient)" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs" },
+    { "keyform", OPT_KEYFORM, 'f',
+        "Input private key format (ENGINE, other values ignored)" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device" },
 #endif
     OPT_PROV_OPTIONS,
     OPT_R_OPTIONS,
 
     OPT_SECTION("Encryption and decryption"),
-    {"originator", OPT_ORIGINATOR, 's', "Originator certificate file"},
-    {"recip", OPT_RECIP, '<', "Recipient cert file"},
-    {"cert...", OPT_PARAM, '.',
-     "Recipient certs (optional; used only when encrypting)"},
-    {"", OPT_CIPHER, '-',
-     "The encryption algorithm to use (any supported cipher)"},
-    {"wrap", OPT_WRAP, 's',
-     "Key wrap algorithm to use when encrypting with key agreement"},
-    {"aes128-wrap", OPT_AES128_WRAP, '-', "Use AES128 to wrap key"},
-    {"aes192-wrap", OPT_AES192_WRAP, '-', "Use AES192 to wrap key"},
-    {"aes256-wrap", OPT_AES256_WRAP, '-', "Use AES256 to wrap key"},
-    {"des3-wrap", OPT_3DES_WRAP, '-', "Use 3DES-EDE to wrap key"},
-    {"debug_decrypt", OPT_DEBUG_DECRYPT, '-',
-     "Disable MMA protection, return error if no recipient found (see doc)"},
+    { "originator", OPT_ORIGINATOR, 's', "Originator certificate file" },
+    { "recip", OPT_RECIP, '<', "Recipient cert file" },
+    { "cert...", OPT_PARAM, '.',
+        "Recipient certs (optional; used only when encrypting)" },
+    { "", OPT_CIPHER, '-',
+        "The encryption algorithm to use (any supported cipher)" },
+    { "wrap", OPT_WRAP, 's',
+        "Key wrap algorithm to use when encrypting with key agreement" },
+    { "aes128-wrap", OPT_AES128_WRAP, '-', "Use AES128 to wrap key" },
+    { "aes192-wrap", OPT_AES192_WRAP, '-', "Use AES192 to wrap key" },
+    { "aes256-wrap", OPT_AES256_WRAP, '-', "Use AES256 to wrap key" },
+    { "des3-wrap", OPT_3DES_WRAP, '-', "Use 3DES-EDE to wrap key" },
+    { "debug_decrypt", OPT_DEBUG_DECRYPT, '-',
+        "Disable MMA protection, return error if no recipient found (see doc)" },
 
     OPT_SECTION("Signing"),
-    {"md", OPT_MD, 's', "Digest algorithm to use"},
-    {"signer", OPT_SIGNER, 's', "Signer certificate input file"},
-    {"certfile", OPT_CERTFILE, '<',
-     "Extra signer and intermediate CA certificates to include when signing"},
-    {OPT_MORE_STR, 0, 0,
-     "or to use as preferred signer certs and for chain building when verifying"},
-    {"cades", OPT_CADES, '-',
-     "Include signingCertificate attribute (CAdES-BES)"},
-    {"nodetach", OPT_NODETACH, '-', "Use opaque signing"},
-    {"nocerts", OPT_NOCERTS, '-',
-     "Don't include signer's certificate when signing"},
-    {"noattr", OPT_NOATTR, '-', "Don't include any signed attributes"},
-    {"nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute"},
-    {"no_signing_time", OPT_NO_SIGNING_TIME, '-',
-     "Omit the signing time attribute"},
-    {"receipt_request_all", OPT_RR_ALL, '-',
-     "When signing, create a receipt request for all recipients"},
-    {"receipt_request_first", OPT_RR_FIRST, '-',
-     "When signing, create a receipt request for first recipient"},
-    {"receipt_request_from", OPT_RR_FROM, 's',
-     "Create signed receipt request with specified email address"},
-    {"receipt_request_to", OPT_RR_TO, 's',
-     "Create signed receipt targeted to specified address"},
+    { "md", OPT_MD, 's', "Digest algorithm to use" },
+    { "signer", OPT_SIGNER, 's', "Signer certificate input file" },
+    { "certfile", OPT_CERTFILE, '<',
+        "Extra signer and intermediate CA certificates to include when signing" },
+    { OPT_MORE_STR, 0, 0,
+        "or to use as preferred signer certs and for chain building when verifying" },
+    { "cades", OPT_CADES, '-',
+        "Include signingCertificate attribute (CAdES-BES)" },
+    { "nodetach", OPT_NODETACH, '-', "Use opaque signing" },
+    { "nocerts", OPT_NOCERTS, '-',
+        "Don't include signer's certificate when signing" },
+    { "noattr", OPT_NOATTR, '-', "Don't include any signed attributes" },
+    { "nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute" },
+    { "no_signing_time", OPT_NO_SIGNING_TIME, '-',
+        "Omit the signing time attribute" },
+    { "receipt_request_all", OPT_RR_ALL, '-',
+        "When signing, create a receipt request for all recipients" },
+    { "receipt_request_first", OPT_RR_FIRST, '-',
+        "When signing, create a receipt request for first recipient" },
+    { "receipt_request_from", OPT_RR_FROM, 's',
+        "Create signed receipt request with specified email address" },
+    { "receipt_request_to", OPT_RR_TO, 's',
+        "Create signed receipt targeted to specified address" },
 
     OPT_SECTION("Verification"),
-    {"signer", OPT_DUP, 's', "Signer certificate(s) output file"},
-    {"content", OPT_CONTENT, '<',
-     "Supply or override content for detached signature"},
-    {"no_content_verify", OPT_NO_CONTENT_VERIFY, '-',
-     "Do not verify signed content signatures"},
-    {"no_attr_verify", OPT_NO_ATTR_VERIFY, '-',
-     "Do not verify signed attribute signatures"},
-    {"nosigs", OPT_NOSIGS, '-', "Don't verify message signature"},
-    {"noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate"},
-    {"nointern", OPT_NOINTERN, '-',
-     "Don't search certificates in message for signer"},
-    {"cades", OPT_DUP, '-', "Check signingCertificate (CAdES-BES)"},
-    {"verify_retcode", OPT_VERIFY_RETCODE, '-',
-     "Exit non-zero on verification failure"},
-    {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
-    {"CApath", OPT_CAPATH, '/', "Trusted certificates directory"},
-    {"CAstore", OPT_CASTORE, ':', "Trusted certificates store URI"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load certificates from the default certificates store"},
+    { "signer", OPT_DUP, 's', "Signer certificate(s) output file" },
+    { "content", OPT_CONTENT, '<',
+        "Supply or override content for detached signature" },
+    { "no_content_verify", OPT_NO_CONTENT_VERIFY, '-',
+        "Do not verify signed content signatures" },
+    { "no_attr_verify", OPT_NO_ATTR_VERIFY, '-',
+        "Do not verify signed attribute signatures" },
+    { "nosigs", OPT_NOSIGS, '-', "Don't verify message signature" },
+    { "noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate" },
+    { "nointern", OPT_NOINTERN, '-',
+        "Don't search certificates in message for signer" },
+    { "cades", OPT_DUP, '-', "Check signingCertificate (CAdES-BES)" },
+    { "verify_retcode", OPT_VERIFY_RETCODE, '-',
+        "Exit non-zero on verification failure" },
+    { "CAfile", OPT_CAFILE, '<', "Trusted certificates file" },
+    { "CApath", OPT_CAPATH, '/', "Trusted certificates directory" },
+    { "CAstore", OPT_CASTORE, ':', "Trusted certificates store URI" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load certificates from the default certificates directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load certificates from the default certificates store" },
 
     OPT_SECTION("Output"),
-    {"keyid", OPT_KEYID, '-', "Use subject key identifier"},
-    {"econtent_type", OPT_ECONTENT_TYPE, 's', "OID for external content"},
-    {"text", OPT_TEXT, '-', "Include or delete text MIME headers"},
-    {"certsout", OPT_CERTSOUT, '>', "Certificate output file"},
-    {"to", OPT_TO, 's', "To address"},
-    {"from", OPT_FROM, 's', "From address"},
-    {"subject", OPT_SUBJECT, 's', "Subject"},
+    { "keyid", OPT_KEYID, '-', "Use subject key identifier" },
+    { "econtent_type", OPT_ECONTENT_TYPE, 's', "OID for external content" },
+    { "text", OPT_TEXT, '-', "Include or delete text MIME headers" },
+    { "certsout", OPT_CERTSOUT, '>', "Certificate output file" },
+    { "to", OPT_TO, 's', "To address" },
+    { "from", OPT_FROM, 's', "From address" },
+    { "subject", OPT_SUBJECT, 's', "Subject" },
 
     OPT_SECTION("Printing"),
-    {"noout", OPT_NOOUT, '-',
-     "For the -cmsout operation do not output the parsed CMS structure"},
-    {"print", OPT_PRINT, '-',
-     "For the -cmsout operation print out all fields of the CMS structure"},
-    {"nameopt", OPT_NAMEOPT, 's',
-     "For the -print option specifies various strings printing options"},
-    {"receipt_request_print", OPT_RR_PRINT, '-', "Print CMS Receipt Request" },
+    { "noout", OPT_NOOUT, '-',
+        "For the -cmsout operation do not output the parsed CMS structure" },
+    { "print", OPT_PRINT, '-',
+        "For the -cmsout operation print out all fields of the CMS structure" },
+    { "nameopt", OPT_NAMEOPT, 's',
+        "For the -print option specifies various strings printing options" },
+    { "receipt_request_print", OPT_RR_PRINT, '-', "Print CMS Receipt Request" },
 
     OPT_V_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 static CMS_ContentInfo *load_content_info(int informat, BIO *in, int flags,
-                                          BIO **indata, const char *name)
+    BIO **indata, const char *name)
 {
     CMS_ContentInfo *ret, *ci;
 
@@ -274,7 +334,7 @@ static CMS_ContentInfo *load_content_info(int informat, BIO *in, int flags,
         goto err;
     }
     return ret;
- err:
+err:
     CMS_ContentInfo_free(ret);
     return NULL;
 }
@@ -330,7 +390,7 @@ int cms_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -477,7 +537,7 @@ int cms_main(int argc, char **argv)
             break;
         case OPT_RCTFORM:
             if (!opt_format(opt_arg(),
-                            OPT_FMT_PEMDER | OPT_FMT_SMIME, &rctformat))
+                    OPT_FMT_PEMDER | OPT_FMT_SMIME, &rctformat))
                 goto opthelp;
             break;
         case OPT_CERTFILE:
@@ -531,7 +591,7 @@ int cms_main(int argc, char **argv)
         case OPT_SECRETKEY:
             if (secret_key != NULL) {
                 BIO_printf(bio_err, "Invalid key (supplied twice) %s\n",
-                           opt_arg());
+                    opt_arg());
                 goto opthelp;
             }
             secret_key = OPENSSL_hexstr2buf(opt_arg(), &ltmp);
@@ -544,7 +604,7 @@ int cms_main(int argc, char **argv)
         case OPT_SECRETKEYID:
             if (secret_keyid != NULL) {
                 BIO_printf(bio_err, "Invalid id (supplied twice) %s\n",
-                           opt_arg());
+                    opt_arg());
                 goto opthelp;
             }
             secret_keyid = OPENSSL_hexstr2buf(opt_arg(), &ltmp);
@@ -560,7 +620,7 @@ int cms_main(int argc, char **argv)
         case OPT_ECONTENT_TYPE:
             if (econtent_type != NULL) {
                 BIO_printf(bio_err, "Invalid OID (supplied twice) %s\n",
-                           opt_arg());
+                    opt_arg());
                 goto opthelp;
             }
             econtent_type = OBJ_txt2obj(opt_arg(), 0);
@@ -640,7 +700,7 @@ int cms_main(int argc, char **argv)
         case OPT_RECIP:
             if (operation == SMIME_ENCRYPT) {
                 cert = load_cert(opt_arg(), FORMAT_UNDEF,
-                                 "recipient certificate file");
+                    "recipient certificate file");
                 if (cert == NULL)
                     goto end;
                 if (!sk_X509_push(encerts, cert))
@@ -749,13 +809,13 @@ int cms_main(int argc, char **argv)
     if ((flags & CMS_CADES) != 0) {
         if ((flags & CMS_NOATTR) != 0) {
             BIO_puts(bio_err, "Incompatible options: "
-                     "CAdES requires signed attributes\n");
+                              "CAdES requires signed attributes\n");
             goto opthelp;
         }
         if (operation == SMIME_VERIFY
-                && (flags & (CMS_NO_SIGNER_CERT_VERIFY | CMS_NO_ATTR_VERIFY)) != 0) {
+            && (flags & (CMS_NO_SIGNER_CERT_VERIFY | CMS_NO_ATTR_VERIFY)) != 0) {
             BIO_puts(bio_err, "Incompatible options: CAdES validation requires"
-                     " certs and signed attributes validations\n");
+                              " certs and signed attributes validations\n");
             goto opthelp;
         }
     }
@@ -789,7 +849,7 @@ int cms_main(int argc, char **argv)
         if (recipfile == NULL && keyfile == NULL
             && secret_key == NULL && pwri_pass == NULL) {
             BIO_printf(bio_err,
-                       "No recipient certificate or key specified\n");
+                "No recipient certificate or key specified\n");
             goto opthelp;
         }
     } else if (operation == SMIME_ENCRYPT) {
@@ -813,16 +873,16 @@ int cms_main(int argc, char **argv)
     if ((operation & SMIME_SIGNERS) == 0) {
         if ((flags & CMS_DETACHED) == 0)
             BIO_printf(bio_err,
-                       "Warning: -nodetach option is ignored for non-signing operation\n");
+                "Warning: -nodetach option is ignored for non-signing operation\n");
 
         flags &= ~CMS_DETACHED;
     }
     if ((operation & SMIME_IP) == 0 && contfile != NULL)
         BIO_printf(bio_err,
-                   "Warning: -contfile option is ignored for the given operation\n");
+            "Warning: -contfile option is ignored for the given operation\n");
     if (operation != SMIME_ENCRYPT && *argv != NULL)
         BIO_printf(bio_err,
-                   "Warning: recipient certificate file parameters ignored for operation other than -encrypt\n");
+            "Warning: recipient certificate file parameters ignored for operation other than -encrypt\n");
 
     if ((flags & CMS_BINARY) != 0) {
         if (!(operation & SMIME_OP))
@@ -845,7 +905,7 @@ int cms_main(int argc, char **argv)
 
         for (; *argv != NULL; argv++) {
             cert = load_cert(*argv, FORMAT_UNDEF,
-                             "recipient certificate file");
+                "recipient certificate file");
             if (cert == NULL)
                 goto end;
             if (!sk_X509_push(encerts, cert))
@@ -863,7 +923,8 @@ int cms_main(int argc, char **argv)
 
     if (recipfile != NULL && (operation == SMIME_DECRYPT)) {
         if ((recip = load_cert(recipfile, FORMAT_UNDEF,
-                               "recipient certificate file")) == NULL) {
+                 "recipient certificate file"))
+            == NULL) {
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -871,7 +932,8 @@ int cms_main(int argc, char **argv)
 
     if (originatorfile != NULL) {
         if ((originator = load_cert(originatorfile, FORMAT_UNDEF,
-                                    "originator certificate file")) == NULL) {
+                 "originator certificate file"))
+            == NULL) {
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -879,7 +941,8 @@ int cms_main(int argc, char **argv)
 
     if (operation == SMIME_SIGN_RECEIPT) {
         if ((signer = load_cert(signerfile, FORMAT_UNDEF,
-                                "receipt signer certificate file")) == NULL) {
+                 "receipt signer certificate file"))
+            == NULL) {
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -904,25 +967,25 @@ int cms_main(int argc, char **argv)
     if (digesthex != NULL) {
         if (operation != SMIME_SIGN) {
             BIO_printf(bio_err,
-                       "Cannot use -digest for non-signing operation\n");
+                "Cannot use -digest for non-signing operation\n");
             goto end;
         }
         if (infile != NULL
             || (flags & CMS_DETACHED) == 0
             || (flags & CMS_STREAM) != 0) {
             BIO_printf(bio_err,
-                       "Cannot use -digest when -in, -nodetach or streaming is used\n");
+                "Cannot use -digest when -in, -nodetach or streaming is used\n");
             goto end;
         }
         digestbin = OPENSSL_hexstr2buf(digesthex, &digestlen);
         if (digestbin == NULL) {
             BIO_printf(bio_err,
-                       "Invalid hex value after -digest\n");
+                "Invalid hex value after -digest\n");
             goto end;
         }
     } else {
         in = bio_open_default(infile, 'r',
-                              binary_files ? FORMAT_BINARY : informat);
+            binary_files ? FORMAT_BINARY : informat);
         if (in == NULL)
             goto end;
     }
@@ -943,7 +1006,7 @@ int cms_main(int argc, char **argv)
             allcerts = CMS_get1_certs(cms);
             if (!save_certs(certsoutfile, allcerts)) {
                 BIO_printf(bio_err,
-                           "Error writing certs to %s\n", certsoutfile);
+                    "Error writing certs to %s\n", certsoutfile);
                 ret = 5;
                 goto end;
             }
@@ -965,13 +1028,14 @@ int cms_main(int argc, char **argv)
     }
 
     out = bio_open_default(outfile, 'w',
-                           binary_files ? FORMAT_BINARY : outformat);
+        binary_files ? FORMAT_BINARY : outformat);
     if (out == NULL)
         goto end;
 
     if ((operation == SMIME_VERIFY) || (operation == SMIME_VERIFY_RECEIPT)) {
         if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
-                                  CAstore, noCAstore)) == NULL)
+                 CAstore, noCAstore))
+            == NULL)
             goto end;
         X509_STORE_set_verify_cb(store, cms_cb);
         if (vpmtouched)
@@ -1017,13 +1081,13 @@ int cms_main(int argc, char **argv)
             }
 
             res = EVP_PKEY_CTX_ctrl(pctx, -1, -1,
-                                    EVP_PKEY_CTRL_CIPHER,
-                                    EVP_CIPHER_get_nid(cipher), NULL);
+                EVP_PKEY_CTRL_CIPHER,
+                EVP_CIPHER_get_nid(cipher), NULL);
             if (res <= 0 && res != -2)
                 goto end;
 
             if (CMS_RecipientInfo_type(ri) == CMS_RECIPINFO_AGREE
-                    && wrap_cipher != NULL) {
+                && wrap_cipher != NULL) {
                 EVP_CIPHER_CTX *wctx;
                 wctx = CMS_RecipientInfo_kari_get0_ctx(ri);
                 if (EVP_EncryptInit_ex(wctx, wrap_cipher, NULL, NULL, NULL) != 1)
@@ -1033,9 +1097,9 @@ int cms_main(int argc, char **argv)
 
         if (secret_key != NULL) {
             if (!CMS_add0_recipient_key(cms, NID_undef,
-                                        secret_key, secret_keylen,
-                                        secret_keyid, secret_keyidlen,
-                                        NULL, NULL, NULL))
+                    secret_key, secret_keylen,
+                    secret_keyid, secret_keyidlen,
+                    NULL, NULL, NULL))
                 goto end;
             /* NULL these because call absorbs them */
             secret_key = NULL;
@@ -1046,8 +1110,9 @@ int cms_main(int argc, char **argv)
             if (pwri_tmp == NULL)
                 goto end;
             if (CMS_add0_recipient_password(cms,
-                                            -1, NID_undef, NID_undef,
-                                            pwri_tmp, -1, NULL) == NULL)
+                    -1, NID_undef, NID_undef,
+                    pwri_tmp, -1, NULL)
+                == NULL)
                 goto end;
             pwri_tmp = NULL;
         }
@@ -1055,7 +1120,7 @@ int cms_main(int argc, char **argv)
             if (!CMS_final(cms, in, NULL, flags)) {
                 if (originator != NULL
                     && ERR_GET_REASON(ERR_peek_error())
-                    == CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT) {
+                        == CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT) {
                     BIO_printf(bio_err, "Cannot use originator for encryption\n");
                     goto end;
                 }
@@ -1064,7 +1129,7 @@ int cms_main(int argc, char **argv)
         }
     } else if (operation == SMIME_ENCRYPTED_ENCRYPT) {
         cms = CMS_EncryptedData_encrypt_ex(in, cipher, secret_key,
-                                           secret_keylen, flags, libctx, app_get0_propq());
+            secret_keylen, flags, libctx, app_get0_propq());
 
     } else if (operation == SMIME_SIGN_RECEIPT) {
         CMS_ContentInfo *srcms = NULL;
@@ -1171,8 +1236,8 @@ int cms_main(int argc, char **argv)
 
         if (secret_key != NULL) {
             if (!CMS_decrypt_set1_key(cms,
-                                      secret_key, secret_keylen,
-                                      secret_keyid, secret_keyidlen)) {
+                    secret_key, secret_keylen,
+                    secret_keyid, secret_keyidlen)) {
                 BIO_puts(bio_err, "Error decrypting CMS using secret key\n");
                 goto end;
             }
@@ -1211,15 +1276,15 @@ int cms_main(int argc, char **argv)
         }
     } else if (operation == SMIME_ENCRYPTED_DECRYPT) {
         if (!CMS_EncryptedData_decrypt(cms, secret_key, secret_keylen,
-                                       indata, out, flags))
+                indata, out, flags))
             goto end;
     } else if (operation == SMIME_VERIFY) {
         if (CMS_verify(cms, other, store, indata, out, flags) > 0) {
             BIO_printf(bio_err, "%s Verification successful\n",
-                       (flags & CMS_CADES) != 0 ? "CAdES" : "CMS");
+                (flags & CMS_CADES) != 0 ? "CAdES" : "CMS");
         } else {
             BIO_printf(bio_err, "%s Verification failure\n",
-                       (flags & CMS_CADES) != 0 ? "CAdES" : "CMS");
+                (flags & CMS_CADES) != 0 ? "CAdES" : "CMS");
             if (verify_retcode)
                 ret = verify_err + 32;
             goto end;
@@ -1229,7 +1294,7 @@ int cms_main(int argc, char **argv)
 
             if (!save_certs(signerfile, signers)) {
                 BIO_printf(bio_err,
-                           "Error writing signers to %s\n", signerfile);
+                    "Error writing signers to %s\n", signerfile);
                 ret = 5;
                 goto end;
             }
@@ -1286,7 +1351,7 @@ int cms_main(int argc, char **argv)
         }
     }
     ret = 0;
- end:
+end:
     if (ret)
         ERR_print_errors(bio_err);
     OSSL_STACK_OF_X509_free(encerts);
@@ -1362,7 +1427,6 @@ static int cms_cb(int ok, X509_STORE_CTX *ctx)
     policies_print(ctx);
 
     return ok;
-
 }
 
 static void gnames_stack_print(STACK_OF(GENERAL_NAMES) *gns)
@@ -1406,7 +1470,7 @@ static void receipt_request_print(CMS_ContentInfo *cms)
             const char *id;
             int idlen;
             CMS_ReceiptRequest_get0_values(rr, &scid, &allorfirst,
-                                           &rlist, &rto);
+                &rlist, &rto);
             BIO_puts(bio_err, "  Signed Content ID:\n");
             idlen = ASN1_STRING_length(scid);
             id = (const char *)ASN1_STRING_get0_data(scid);
@@ -1456,16 +1520,15 @@ static STACK_OF(GENERAL_NAMES) *make_names_stack(STACK_OF(OPENSSL_STRING) *ns)
 
     return ret;
 
- err:
+err:
     sk_GENERAL_NAMES_pop_free(ret, GENERAL_NAMES_free);
     GENERAL_NAMES_free(gens);
     GENERAL_NAME_free(gen);
     return NULL;
 }
 
-static CMS_ReceiptRequest
-*make_receipt_request(STACK_OF(OPENSSL_STRING) *rr_to, int rr_allorfirst,
-                      STACK_OF(OPENSSL_STRING) *rr_from)
+static CMS_ReceiptRequest *make_receipt_request(STACK_OF(OPENSSL_STRING) *rr_to, int rr_allorfirst,
+    STACK_OF(OPENSSL_STRING) *rr_from)
 {
     STACK_OF(GENERAL_NAMES) *rct_to = NULL, *rct_from = NULL;
     CMS_ReceiptRequest *rr;
@@ -1481,18 +1544,18 @@ static CMS_ReceiptRequest
         rct_from = NULL;
     }
     rr = CMS_ReceiptRequest_create0_ex(NULL, -1, rr_allorfirst, rct_from,
-                                       rct_to, app_get0_libctx());
+        rct_to, app_get0_libctx());
     if (rr == NULL)
         goto err;
     return rr;
- err:
+err:
     sk_GENERAL_NAMES_pop_free(rct_to, GENERAL_NAMES_free);
     sk_GENERAL_NAMES_pop_free(rct_from, GENERAL_NAMES_free);
     return NULL;
 }
 
 static int cms_set_pkey_param(EVP_PKEY_CTX *pctx,
-                              STACK_OF(OPENSSL_STRING) *param)
+    STACK_OF(OPENSSL_STRING) *param)
 {
     char *keyopt;
     int i;
diff --git a/crypto/openssl/apps/crl.c b/crypto/openssl/apps/crl.c
index afb59178fda6..cba5883dd6db 100644
--- a/crypto/openssl/apps/crl.c
+++ b/crypto/openssl/apps/crl.c
@@ -20,58 +20,81 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_IN, OPT_OUTFORM, OPT_OUT, OPT_KEYFORM, OPT_KEY,
-    OPT_ISSUER, OPT_LASTUPDATE, OPT_NEXTUPDATE, OPT_FINGERPRINT,
-    OPT_CRLNUMBER, OPT_BADSIG, OPT_GENDELTA, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
-    OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_VERIFY, OPT_DATEOPT, OPT_TEXT, OPT_HASH,
-    OPT_HASH_OLD, OPT_NOOUT, OPT_NAMEOPT, OPT_MD, OPT_PROV_ENUM
+    OPT_INFORM,
+    OPT_IN,
+    OPT_OUTFORM,
+    OPT_OUT,
+    OPT_KEYFORM,
+    OPT_KEY,
+    OPT_ISSUER,
+    OPT_LASTUPDATE,
+    OPT_NEXTUPDATE,
+    OPT_FINGERPRINT,
+    OPT_CRLNUMBER,
+    OPT_BADSIG,
+    OPT_GENDELTA,
+    OPT_CAPATH,
+    OPT_CAFILE,
+    OPT_CASTORE,
+    OPT_NOCAPATH,
+    OPT_NOCAFILE,
+    OPT_NOCASTORE,
+    OPT_VERIFY,
+    OPT_DATEOPT,
+    OPT_TEXT,
+    OPT_HASH,
+    OPT_HASH_OLD,
+    OPT_NOOUT,
+    OPT_NAMEOPT,
+    OPT_MD,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS crl_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"verify", OPT_VERIFY, '-', "Verify CRL signature"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "verify", OPT_VERIFY, '-', "Verify CRL signature" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file - default stdin"},
-    {"inform", OPT_INFORM, 'F', "CRL input format (DER or PEM); has no effect"},
-    {"key", OPT_KEY, '<', "CRL signing Private key to use"},
-    {"keyform", OPT_KEYFORM, 'F', "Private key file format (DER/PEM/P12); has no effect"},
+    { "in", OPT_IN, '<', "Input file - default stdin" },
+    { "inform", OPT_INFORM, 'F', "CRL input format (DER or PEM); has no effect" },
+    { "key", OPT_KEY, '<', "CRL signing Private key to use" },
+    { "keyform", OPT_KEYFORM, 'F', "Private key file format (DER/PEM/P12); has no effect" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "output file - default stdout"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - default PEM"},
-    {"dateopt", OPT_DATEOPT, 's', "Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822."},
-    {"text", OPT_TEXT, '-', "Print out a text format version"},
-    {"hash", OPT_HASH, '-', "Print hash value"},
+    { "out", OPT_OUT, '>', "output file - default stdout" },
+    { "outform", OPT_OUTFORM, 'F', "Output format - default PEM" },
+    { "dateopt", OPT_DATEOPT, 's', "Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822." },
+    { "text", OPT_TEXT, '-', "Print out a text format version" },
+    { "hash", OPT_HASH, '-', "Print hash value" },
 #ifndef OPENSSL_NO_MD5
-    {"hash_old", OPT_HASH_OLD, '-', "Print old-style (MD5) hash value"},
+    { "hash_old", OPT_HASH_OLD, '-', "Print old-style (MD5) hash value" },
 #endif
-    {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
-    {"", OPT_MD, '-', "Any supported digest"},
+    { "nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options" },
+    { "", OPT_MD, '-', "Any supported digest" },
 
     OPT_SECTION("CRL"),
-    {"issuer", OPT_ISSUER, '-', "Print issuer DN"},
-    {"lastupdate", OPT_LASTUPDATE, '-', "Set lastUpdate field"},
-    {"nextupdate", OPT_NEXTUPDATE, '-', "Set nextUpdate field"},
-    {"noout", OPT_NOOUT, '-', "No CRL output"},
-    {"fingerprint", OPT_FINGERPRINT, '-', "Print the crl fingerprint"},
-    {"crlnumber", OPT_CRLNUMBER, '-', "Print CRL number"},
-    {"badsig", OPT_BADSIG, '-', "Corrupt last byte of loaded CRL signature (for test)" },
-    {"gendelta", OPT_GENDELTA, '<', "Other CRL to compare/diff to the Input one"},
+    { "issuer", OPT_ISSUER, '-', "Print issuer DN" },
+    { "lastupdate", OPT_LASTUPDATE, '-', "Set lastUpdate field" },
+    { "nextupdate", OPT_NEXTUPDATE, '-', "Set nextUpdate field" },
+    { "noout", OPT_NOOUT, '-', "No CRL output" },
+    { "fingerprint", OPT_FINGERPRINT, '-', "Print the crl fingerprint" },
+    { "crlnumber", OPT_CRLNUMBER, '-', "Print CRL number" },
+    { "badsig", OPT_BADSIG, '-', "Corrupt last byte of loaded CRL signature (for test)" },
+    { "gendelta", OPT_GENDELTA, '<', "Other CRL to compare/diff to the Input one" },
 
     OPT_SECTION("Certificate"),
-    {"CApath", OPT_CAPATH, '/', "Verify CRL using certificates in dir"},
-    {"CAfile", OPT_CAFILE, '<', "Verify CRL using certificates in file name"},
-    {"CAstore", OPT_CASTORE, ':', "Verify CRL using certificates in store URI"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load certificates from the default certificates store"},
+    { "CApath", OPT_CAPATH, '/', "Verify CRL using certificates in dir" },
+    { "CAfile", OPT_CAFILE, '<', "Verify CRL using certificates in file name" },
+    { "CAstore", OPT_CASTORE, ':', "Verify CRL using certificates in store URI" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load certificates from the default certificates directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load certificates from the default certificates store" },
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int crl_main(int argc, char **argv)
@@ -104,7 +127,7 @@ int crl_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -148,13 +171,13 @@ int crl_main(int argc, char **argv)
             do_ver = 1;
             break;
         case OPT_NOCAPATH:
-            noCApath =  1;
+            noCApath = 1;
             break;
         case OPT_NOCAFILE:
-            noCAfile =  1;
+            noCAfile = 1;
             break;
         case OPT_NOCASTORE:
-            noCAstore =  1;
+            noCAstore = 1;
             break;
         case OPT_HASH_OLD:
 #ifndef OPENSSL_NO_MD5
@@ -221,7 +244,8 @@ int crl_main(int argc, char **argv)
 
     if (do_ver) {
         if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
-                                  CAstore, noCAstore)) == NULL)
+                 CAstore, noCAstore))
+            == NULL)
             goto end;
         lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
         if (lookup == NULL)
@@ -233,7 +257,7 @@ int crl_main(int argc, char **argv)
         }
 
         xobj = X509_STORE_CTX_get_obj_by_subject(ctx, X509_LU_X509,
-                                                 X509_CRL_get_issuer(x));
+            X509_CRL_get_issuer(x));
         if (xobj == NULL) {
             BIO_printf(bio_err, "Error getting CRL issuer certificate\n");
             goto end;
@@ -250,7 +274,7 @@ int crl_main(int argc, char **argv)
             goto end;
         if (i == 0) {
             BIO_printf(bio_err, "verify failure\n");
-	    goto end;
+            goto end;
         } else
             BIO_printf(bio_err, "verify OK\n");
     }
@@ -309,9 +333,8 @@ int crl_main(int argc, char **argv)
             }
             if (hash == i) {
                 int ok;
-                unsigned long hash_value =
-                    X509_NAME_hash_ex(X509_CRL_get_issuer(x), app_get0_libctx(),
-                                      app_get0_propq(), &ok);
+                unsigned long hash_value = X509_NAME_hash_ex(X509_CRL_get_issuer(x), app_get0_libctx(),
+                    app_get0_propq(), &ok);
 
                 if (num > 1)
                     BIO_printf(bio_out, "issuer name hash=");
@@ -327,7 +350,7 @@ int crl_main(int argc, char **argv)
                 if (num > 1)
                     BIO_printf(bio_out, "issuer name old hash=");
                 BIO_printf(bio_out, "%08lx\n",
-                           X509_NAME_hash_old(X509_CRL_get_issuer(x)));
+                    X509_NAME_hash_old(X509_CRL_get_issuer(x)));
             }
 #endif
             if (lastupdate == i) {
@@ -353,10 +376,9 @@ int crl_main(int argc, char **argv)
                     goto end;
                 }
                 BIO_printf(bio_out, "%s Fingerprint=",
-                           EVP_MD_get0_name(digest));
+                    EVP_MD_get0_name(digest));
                 for (j = 0; j < (int)n; j++) {
-                    BIO_printf(bio_out, "%02X%c", md[j], (j + 1 == (int)n)
-                               ? '\n' : ':');
+                    BIO_printf(bio_out, "%02X%c", md[j], (j + 1 == (int)n) ? '\n' : ':');
                 }
             }
         }
@@ -383,7 +405,7 @@ int crl_main(int argc, char **argv)
     }
     ret = 0;
 
- end:
+end:
     if (ret != 0)
         ERR_print_errors(bio_err);
     BIO_free_all(out);
diff --git a/crypto/openssl/apps/crl2pkcs7.c b/crypto/openssl/apps/crl2pkcs7.c
index f661393907e7..72d385250ac4 100644
--- a/crypto/openssl/apps/crl2pkcs7.c
+++ b/crypto/openssl/apps/crl2pkcs7.c
@@ -23,27 +23,32 @@ static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE,
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_NOCRL,
+    OPT_CERTFILE,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS crl2pkcs7_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
-    {"nocrl", OPT_NOCRL, '-', "No crl to load, just certs from '-certfile'"},
-    {"certfile", OPT_CERTFILE, '<',
-     "File of chain of certs to a trusted CA; can be repeated"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "inform", OPT_INFORM, 'F', "Input format - DER or PEM" },
+    { "nocrl", OPT_NOCRL, '-', "No crl to load, just certs from '-certfile'" },
+    { "certfile", OPT_CERTFILE, '<',
+        "File of chain of certs to a trusted CA; can be repeated" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'F', "Output format - DER or PEM" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int crl2pkcs7_main(int argc, char **argv)
@@ -56,8 +61,7 @@ int crl2pkcs7_main(int argc, char **argv)
     STACK_OF(X509_CRL) *crl_stack = NULL;
     X509_CRL *crl = NULL;
     char *infile = NULL, *outfile = NULL, *prog, *certfile;
-    int i = 0, informat = FORMAT_PEM, outformat = FORMAT_PEM, ret = 1, nocrl =
-        0;
+    int i = 0, informat = FORMAT_PEM, outformat = FORMAT_PEM, ret = 1, nocrl = 0;
     OPTION_CHOICE o;
 
     prog = opt_init(argc, argv, crl2pkcs7_options);
@@ -65,7 +69,7 @@ int crl2pkcs7_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -141,7 +145,7 @@ int crl2pkcs7_main(int argc, char **argv)
 
         if (!sk_X509_CRL_push(crl_stack, crl))
             goto end;
-        crl = NULL;             /* now part of p7 for OPENSSL_freeing */
+        crl = NULL; /* now part of p7 for OPENSSL_freeing */
     }
 
     if (certflst != NULL) {
@@ -173,7 +177,7 @@ int crl2pkcs7_main(int argc, char **argv)
         goto end;
     }
     ret = 0;
- end:
+end:
     sk_OPENSSL_STRING_free(certflst);
     BIO_free(in);
     BIO_free_all(out);
@@ -229,7 +233,7 @@ static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
     }
 
     ret = count;
- end:
+end:
     /* never need to OPENSSL_free x */
     BIO_free(in);
     sk_X509_INFO_free(sk);
diff --git a/crypto/openssl/apps/dgst.c b/crypto/openssl/apps/dgst.c
index b002de18c94b..623564e56106 100644
--- a/crypto/openssl/apps/dgst.c
+++ b/crypto/openssl/apps/dgst.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -22,15 +22,15 @@
 #include <ctype.h>
 
 #undef BUFSIZE
-#define BUFSIZE 1024*8
+#define BUFSIZE 1024 * 8
 
 static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int binout,
-                              EVP_PKEY *key, unsigned char *sigin, int siglen,
-                              const char *sig_name, const char *file);
+    EVP_PKEY *key, unsigned char *sigin, int siglen,
+    const char *sig_name, const char *file);
 int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen,
-          EVP_PKEY *key, unsigned char *sigin, int siglen,
-          const char *sig_name, const char *md_name,
-          const char *file);
+    EVP_PKEY *key, unsigned char *sigin, int siglen,
+    const char *sig_name, const char *md_name,
+    const char *file);
 static void show_digests(const OBJ_NAME *name, void *bio_);
 
 struct doall_dgst_digests {
@@ -41,57 +41,74 @@ struct doall_dgst_digests {
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_LIST,
-    OPT_C, OPT_R, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
-    OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
-    OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
-    OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT, OPT_XOFLEN,
+    OPT_C,
+    OPT_R,
+    OPT_OUT,
+    OPT_SIGN,
+    OPT_PASSIN,
+    OPT_VERIFY,
+    OPT_PRVERIFY,
+    OPT_SIGNATURE,
+    OPT_KEYFORM,
+    OPT_ENGINE,
+    OPT_ENGINE_IMPL,
+    OPT_HEX,
+    OPT_BINARY,
+    OPT_DEBUG,
+    OPT_FIPS_FINGERPRINT,
+    OPT_HMAC,
+    OPT_MAC,
+    OPT_SIGOPT,
+    OPT_MACOPT,
+    OPT_XOFLEN,
     OPT_DIGEST,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS dgst_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [file...]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [file...]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"list", OPT_LIST, '-', "List digests"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "list", OPT_LIST, '-', "List digests" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-    {"engine_impl", OPT_ENGINE_IMPL, '-',
-     "Also use engine given by -engine for digest operations"},
+    { "engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device" },
+    { "engine_impl", OPT_ENGINE_IMPL, '-',
+        "Also use engine given by -engine for digest operations" },
 #endif
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
 
     OPT_SECTION("Output"),
-    {"c", OPT_C, '-', "Print the digest with separating colons"},
-    {"r", OPT_R, '-', "Print the digest in coreutils format"},
-    {"out", OPT_OUT, '>', "Output to filename rather than stdout"},
-    {"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"},
-    {"hex", OPT_HEX, '-', "Print as hex dump"},
-    {"binary", OPT_BINARY, '-', "Print in binary form"},
-    {"xoflen", OPT_XOFLEN, 'p', "Output length for XOF algorithms. To obtain the maximum security strength set this to 32 (or greater) for SHAKE128, and 64 (or greater) for SHAKE256"},
-    {"d", OPT_DEBUG, '-', "Print debug info"},
-    {"debug", OPT_DEBUG, '-', "Print debug info"},
+    { "c", OPT_C, '-', "Print the digest with separating colons" },
+    { "r", OPT_R, '-', "Print the digest in coreutils format" },
+    { "out", OPT_OUT, '>', "Output to filename rather than stdout" },
+    { "keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)" },
+    { "hex", OPT_HEX, '-', "Print as hex dump" },
+    { "binary", OPT_BINARY, '-', "Print in binary form" },
+    { "xoflen", OPT_XOFLEN, 'p', "Output length for XOF algorithms. To obtain the maximum security strength set this to 32 (or greater) for SHAKE128, and 64 (or greater) for SHAKE256" },
+    { "d", OPT_DEBUG, '-', "Print debug info" },
+    { "debug", OPT_DEBUG, '-', "Print debug info" },
 
     OPT_SECTION("Signing"),
-    {"sign", OPT_SIGN, 's', "Sign digest using private key"},
-    {"verify", OPT_VERIFY, 's', "Verify a signature using public key"},
-    {"prverify", OPT_PRVERIFY, 's', "Verify a signature using private key"},
-    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
-    {"signature", OPT_SIGNATURE, '<', "File with signature to verify"},
-    {"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
-    {"mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)"},
-    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
-    {"", OPT_DIGEST, '-', "Any supported digest"},
-    {"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
-     "Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
+    { "sign", OPT_SIGN, 's', "Sign digest using private key" },
+    { "verify", OPT_VERIFY, 's', "Verify a signature using public key" },
+    { "prverify", OPT_PRVERIFY, 's', "Verify a signature using private key" },
+    { "sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form" },
+    { "signature", OPT_SIGNATURE, '<', "File with signature to verify" },
+    { "hmac", OPT_HMAC, 's', "Create hashed MAC with key" },
+    { "mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)" },
+    { "macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key" },
+    { "", OPT_DIGEST, '-', "Any supported digest" },
+    { "fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
+        "Compute HMAC with the key used in OpenSSL-FIPS fingerprint" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"file", 0, 0, "Files to digest (optional; default is stdin)"},
-    {NULL}
+    { "file", 0, 0, "Files to digest (optional; default is stdin)" },
+    { NULL }
 };
 
 int dgst_main(int argc, char **argv)
@@ -128,7 +145,7 @@ int dgst_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -140,7 +157,7 @@ int dgst_main(int argc, char **argv)
             dec.bio = bio_out;
             dec.n = 0;
             OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_MD_METH,
-                                   show_digests, &dec);
+                show_digests, &dec);
             BIO_printf(bio_out, "\n");
             ret = EXIT_SUCCESS;
             goto end;
@@ -244,7 +261,7 @@ int dgst_main(int argc, char **argv)
 
     if (do_verify && sigfile == NULL) {
         BIO_printf(bio_err,
-                   "No signature to verify: use the -signature option\n");
+            "No signature to verify: use the -signature option\n");
         goto end;
     }
     if (engine_impl)
@@ -297,8 +314,9 @@ int dgst_main(int argc, char **argv)
             char def_md[80];
 
             if (EVP_PKEY_get_default_digest_name(sigkey, def_md,
-                                                 sizeof(def_md)) == 2
-                    && strcmp(def_md, "UNDEF") == 0)
+                    sizeof(def_md))
+                    == 2
+                && strcmp(def_md, "UNDEF") == 0)
                 oneshot_sign = 1;
             signctx = EVP_MD_CTX_new();
             if (signctx == NULL)
@@ -336,8 +354,8 @@ int dgst_main(int argc, char **argv)
             digestname = SN_sha256;
         }
         sigkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, impl,
-                                              (unsigned char *)hmac_key,
-                                              strlen(hmac_key));
+            (unsigned char *)hmac_key,
+            strlen(hmac_key));
         if (sigkey == NULL)
             goto end;
     }
@@ -356,17 +374,16 @@ int dgst_main(int argc, char **argv)
         if (do_verify)
             if (impl == NULL)
                 res = EVP_DigestVerifyInit_ex(mctx, &pctx, digestname,
-                                              app_get0_libctx(),
-                                              app_get0_propq(), sigkey, NULL);
+                    app_get0_libctx(),
+                    app_get0_propq(), sigkey, NULL);
             else
                 res = EVP_DigestVerifyInit(mctx, &pctx, md, impl, sigkey);
+        else if (impl == NULL)
+            res = EVP_DigestSignInit_ex(mctx, &pctx, digestname,
+                app_get0_libctx(),
+                app_get0_propq(), sigkey, NULL);
         else
-            if (impl == NULL)
-                res = EVP_DigestSignInit_ex(mctx, &pctx, digestname,
-                                            app_get0_libctx(),
-                                            app_get0_propq(), sigkey, NULL);
-            else
-                res = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey);
+            res = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey);
         if (res == 0) {
             BIO_printf(bio_err, "Error setting context\n");
             goto end;
@@ -377,7 +394,7 @@ int dgst_main(int argc, char **argv)
 
                 if (pkey_ctrl_string(pctx, sigopt) <= 0) {
                     BIO_printf(bio_err, "Signature parameter error \"%s\"\n",
-                               sigopt);
+                        sigopt);
                     goto end;
                 }
             }
@@ -451,10 +468,10 @@ int dgst_main(int argc, char **argv)
         BIO_set_fp(in, stdin, BIO_NOCLOSE);
         if (oneshot_sign)
             ret = do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
-                                     sigkey, sigbuf, siglen, NULL, "stdin");
+                sigkey, sigbuf, siglen, NULL, "stdin");
         else
             ret = do_fp(out, buf, inp, separator, out_bin, xoflen,
-                        sigkey, sigbuf, siglen, NULL, md_name, "stdin");
+                sigkey, sigbuf, siglen, NULL, md_name, "stdin");
     } else {
         const char *sig_name = NULL;
 
@@ -471,19 +488,19 @@ int dgst_main(int argc, char **argv)
             } else {
                 if (oneshot_sign) {
                     if (do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
-                                           sigkey, sigbuf, siglen, sig_name,
-                                           argv[i]))
+                            sigkey, sigbuf, siglen, sig_name,
+                            argv[i]))
                         ret = EXIT_FAILURE;
                 } else {
                     if (do_fp(out, buf, inp, separator, out_bin, xoflen,
-                              sigkey, sigbuf, siglen, sig_name, md_name, argv[i]))
+                            sigkey, sigbuf, siglen, sig_name, md_name, argv[i]))
                         ret = EXIT_FAILURE;
                 }
             }
             (void)BIO_reset(bmd);
         }
     }
- end:
+end:
     if (ret != EXIT_SUCCESS)
         ERR_print_errors(bio_err);
     OPENSSL_clear_free(buf, BUFSIZE);
@@ -566,12 +583,12 @@ static const char *newline_escape_filename(const char *file, int *backslash)
         e++;
     }
     file_cpy[i] = '\0';
-    return (const char*)file_cpy;
+    return (const char *)file_cpy;
 }
 
 static void print_out(BIO *out, unsigned char *buf, size_t len,
-                      int sep, int binout,
-                      const char *sig_name, const char *md_name, const char *file)
+    int sep, int binout,
+    const char *sig_name, const char *md_name, const char *file)
 {
     int i, backslash = 0;
 
@@ -619,9 +636,9 @@ static void print_verify_result(BIO *out, int i)
 }
 
 int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen,
-          EVP_PKEY *key, unsigned char *sigin, int siglen,
-          const char *sig_name, const char *md_name,
-          const char *file)
+    EVP_PKEY *key, unsigned char *sigin, int siglen,
+    const char *sig_name, const char *md_name,
+    const char *file)
 {
     size_t len = BUFSIZE;
     int i, ret = EXIT_FAILURE;
@@ -685,7 +702,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
     }
     print_out(out, buf, len, sep, binout, sig_name, md_name, file);
     ret = EXIT_SUCCESS;
- end:
+end:
     if (allocated_buf != NULL)
         OPENSSL_clear_free(allocated_buf, len);
 
@@ -699,8 +716,8 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
  * then used inside EVP_DigestVerify() and EVP_DigestSign().
  */
 static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int binout,
-                              EVP_PKEY *key, unsigned char *sigin, int siglen,
-                              const char *sig_name, const char *file)
+    EVP_PKEY *key, unsigned char *sigin, int siglen,
+    const char *sig_name, const char *file)
 {
     int res, ret = EXIT_FAILURE;
     size_t len = 0;
@@ -736,7 +753,7 @@ static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int b
         goto end;
     }
 
- end:
+end:
     OPENSSL_free(sig);
     OPENSSL_clear_free(buf, buflen);
 
diff --git a/crypto/openssl/apps/dhparam.c b/crypto/openssl/apps/dhparam.c
index 600b7ed2b5bc..f8838abe63d0 100644
--- a/crypto/openssl/apps/dhparam.c
+++ b/crypto/openssl/apps/dhparam.c
@@ -36,47 +36,59 @@ static int verbose = 1;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
-    OPT_ENGINE, OPT_CHECK, OPT_TEXT, OPT_NOOUT,
-    OPT_DSAPARAM, OPT_2, OPT_3, OPT_5, OPT_VERBOSE, OPT_QUIET,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_ENGINE,
+    OPT_CHECK,
+    OPT_TEXT,
+    OPT_NOOUT,
+    OPT_DSAPARAM,
+    OPT_2,
+    OPT_3,
+    OPT_5,
+    OPT_VERBOSE,
+    OPT_QUIET,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS dhparam_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [numbits]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [numbits]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"check", OPT_CHECK, '-', "Check the DH parameters"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "check", OPT_CHECK, '-', "Check the DH parameters" },
 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_DEPRECATED_3_0)
-    {"dsaparam", OPT_DSAPARAM, '-',
-     "Read or generate DSA parameters, convert to DH"},
+    { "dsaparam", OPT_DSAPARAM, '-',
+        "Read or generate DSA parameters, convert to DH" },
 #endif
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"inform", OPT_INFORM, 'F', "Input format, DER or PEM"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "inform", OPT_INFORM, 'F', "Input format, DER or PEM" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'F', "Output format, DER or PEM"},
-    {"text", OPT_TEXT, '-', "Print a text form of the DH parameters"},
-    {"noout", OPT_NOOUT, '-', "Don't output any DH parameters"},
-    {"2", OPT_2, '-', "Generate parameters using 2 as the generator value"},
-    {"3", OPT_3, '-', "Generate parameters using 3 as the generator value"},
-    {"5", OPT_5, '-', "Generate parameters using 5 as the generator value"},
-    {"verbose", OPT_VERBOSE, '-', "Verbose output"},
-    {"quiet", OPT_QUIET, '-', "Terse output"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'F', "Output format, DER or PEM" },
+    { "text", OPT_TEXT, '-', "Print a text form of the DH parameters" },
+    { "noout", OPT_NOOUT, '-', "Don't output any DH parameters" },
+    { "2", OPT_2, '-', "Generate parameters using 2 as the generator value" },
+    { "3", OPT_3, '-', "Generate parameters using 3 as the generator value" },
+    { "5", OPT_5, '-', "Generate parameters using 5 as the generator value" },
+    { "verbose", OPT_VERBOSE, '-', "Verbose output" },
+    { "quiet", OPT_QUIET, '-', "Terse output" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"numbits", 0, 0, "Number of bits if generating parameters (optional)"},
-    {NULL}
+    { "numbits", 0, 0, "Number of bits if generating parameters (optional)" },
+    { NULL }
 };
 
 int dhparam_main(int argc, char **argv)
@@ -96,7 +108,7 @@ int dhparam_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -175,7 +187,7 @@ int dhparam_main(int argc, char **argv)
 
     if (dsaparam && g) {
         BIO_printf(bio_err,
-                   "Error, generator may not be chosen for DSA parameters\n");
+            "Error, generator may not be chosen for DSA parameters\n");
         goto end;
     }
 
@@ -193,22 +205,22 @@ int dhparam_main(int argc, char **argv)
         ctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), alg, app_get0_propq());
         if (ctx == NULL) {
             BIO_printf(bio_err,
-                        "Error, %s param generation context allocation failed\n",
-                        alg);
+                "Error, %s param generation context allocation failed\n",
+                alg);
             goto end;
         }
         EVP_PKEY_CTX_set_app_data(ctx, bio_err);
         if (verbose) {
             EVP_PKEY_CTX_set_cb(ctx, progress_cb);
             BIO_printf(bio_err,
-                        "Generating %s parameters, %d bit long %sprime\n",
-                        alg, num, dsaparam ? "" : "safe ");
+                "Generating %s parameters, %d bit long %sprime\n",
+                alg, num, dsaparam ? "" : "safe ");
         }
 
         if (EVP_PKEY_paramgen_init(ctx) <= 0) {
             BIO_printf(bio_err,
-                        "Error, unable to initialise %s parameters\n",
-                        alg);
+                "Error, unable to initialise %s parameters\n",
+                alg);
             goto end;
         }
 
@@ -258,32 +270,34 @@ int dhparam_main(int argc, char **argv)
              */
             done = 1;
             /*
-            * We set NULL for the keytype to allow any key type. We don't know
-            * if we're going to get DH or DHX (or DSA in the event of dsaparam).
-            * We check that we got one of those key types afterwards.
-            */
+             * We set NULL for the keytype to allow any key type. We don't know
+             * if we're going to get DH or DHX (or DSA in the event of dsaparam).
+             * We check that we got one of those key types afterwards.
+             */
             decoderctx
                 = OSSL_DECODER_CTX_new_for_pkey(&tmppkey,
-                                                (informat == FORMAT_ASN1)
-                                                    ? "DER" : "PEM",
-                                                NULL,
-                                                (informat == FORMAT_ASN1)
-                                                    ? keytype : NULL,
-                                                OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
-                                                NULL, NULL);
+                    (informat == FORMAT_ASN1)
+                        ? "DER"
+                        : "PEM",
+                    NULL,
+                    (informat == FORMAT_ASN1)
+                        ? keytype
+                        : NULL,
+                    OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
+                    NULL, NULL);
 
             if (decoderctx != NULL
-                    && !OSSL_DECODER_from_bio(decoderctx, in)
-                    && informat == FORMAT_ASN1
-                    && strcmp(keytype, "DH") == 0) {
+                && !OSSL_DECODER_from_bio(decoderctx, in)
+                && informat == FORMAT_ASN1
+                && strcmp(keytype, "DH") == 0) {
                 /*
-                * When reading DER we explicitly state the expected keytype
-                * because, unlike PEM, there is no header to declare what
-                * the contents of the DER file are. The decoders just try
-                * and guess. Unfortunately with DHX key types they may guess
-                * wrong and think we have a DSA keytype. Therefore, we try
-                * both DH and DHX sequentially.
-                */
+                 * When reading DER we explicitly state the expected keytype
+                 * because, unlike PEM, there is no header to declare what
+                 * the contents of the DER file are. The decoders just try
+                 * and guess. Unfortunately with DHX key types they may guess
+                 * wrong and think we have a DSA keytype. Therefore, we try
+                 * both DH and DHX sequentially.
+                 */
                 keytype = "DHX";
                 /*
                  * BIO_reset() returns 0 for success for file BIOs only!!!
@@ -309,7 +323,7 @@ int dhparam_main(int argc, char **argv)
                 goto end;
         } else {
             if (!EVP_PKEY_is_a(tmppkey, "DH")
-                    && !EVP_PKEY_is_a(tmppkey, "DHX")) {
+                && !EVP_PKEY_is_a(tmppkey, "DHX")) {
                 BIO_printf(bio_err, "Error, unable to load DH parameters\n");
                 goto end;
             }
@@ -339,12 +353,12 @@ int dhparam_main(int argc, char **argv)
     }
 
     if (!noout) {
-        OSSL_ENCODER_CTX *ectx =
-            OSSL_ENCODER_CTX_new_for_pkey(pkey,
-                                          OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
-                                          outformat == FORMAT_ASN1
-                                              ? "DER" : "PEM",
-                                          NULL, NULL);
+        OSSL_ENCODER_CTX *ectx = OSSL_ENCODER_CTX_new_for_pkey(pkey,
+            OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
+            outformat == FORMAT_ASN1
+                ? "DER"
+                : "PEM",
+            NULL, NULL);
 
         if (ectx == NULL || !OSSL_ENCODER_to_bio(ectx, out)) {
             OSSL_ENCODER_CTX_free(ectx);
@@ -354,7 +368,7 @@ int dhparam_main(int argc, char **argv)
         OSSL_ENCODER_CTX_free(ectx);
     }
     ret = 0;
- end:
+end:
     if (ret != 0)
         ERR_print_errors(bio_err);
     BIO_free(in);
@@ -380,33 +394,33 @@ static EVP_PKEY *dsa_to_dh(EVP_PKEY *dh)
     EVP_PKEY *pkey = NULL;
 
     if (!EVP_PKEY_get_bn_param(dh, OSSL_PKEY_PARAM_FFC_P, &bn_p)
-            || !EVP_PKEY_get_bn_param(dh, OSSL_PKEY_PARAM_FFC_Q, &bn_q)
-            || !EVP_PKEY_get_bn_param(dh, OSSL_PKEY_PARAM_FFC_G, &bn_g)) {
+        || !EVP_PKEY_get_bn_param(dh, OSSL_PKEY_PARAM_FFC_Q, &bn_q)
+        || !EVP_PKEY_get_bn_param(dh, OSSL_PKEY_PARAM_FFC_G, &bn_g)) {
         BIO_printf(bio_err, "Error, failed to set DH parameters\n");
         goto err;
     }
 
     if ((tmpl = OSSL_PARAM_BLD_new()) == NULL
-            || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P,
-                                        bn_p)
-            || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_Q,
-                                        bn_q)
-            || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_G,
-                                        bn_g)
-            || (params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL) {
+        || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P,
+            bn_p)
+        || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_Q,
+            bn_q)
+        || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_G,
+            bn_g)
+        || (params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL) {
         BIO_printf(bio_err, "Error, failed to set DH parameters\n");
         goto err;
     }
 
     ctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), "DHX", app_get0_propq());
     if (ctx == NULL
-            || EVP_PKEY_fromdata_init(ctx) <= 0
-            || EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEY_PARAMETERS, params) <= 0) {
+        || EVP_PKEY_fromdata_init(ctx) <= 0
+        || EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEY_PARAMETERS, params) <= 0) {
         BIO_printf(bio_err, "Error, failed to set DH parameters\n");
         goto err;
     }
 
- err:
+err:
     EVP_PKEY_CTX_free(ctx);
     OSSL_PARAM_free(params);
     OSSL_PARAM_BLD_free(tmpl);
@@ -415,4 +429,3 @@ static EVP_PKEY *dsa_to_dh(EVP_PKEY *dh)
     BN_free(bn_g);
     return pkey;
 }
-
diff --git a/crypto/openssl/apps/dsa.c b/crypto/openssl/apps/dsa.c
index 9ba8c252dafe..fc2ef99adb3e 100644
--- a/crypto/openssl/apps/dsa.c
+++ b/crypto/openssl/apps/dsa.c
@@ -27,51 +27,63 @@
 #include <openssl/core_dispatch.h>
 
 #ifndef OPENSSL_NO_RC4
-# define DEFAULT_PVK_ENCR_STRENGTH      2
+#define DEFAULT_PVK_ENCR_STRENGTH 2
 #else
-# define DEFAULT_PVK_ENCR_STRENGTH      0
+#define DEFAULT_PVK_ENCR_STRENGTH 0
 #endif
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENGINE,
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_ENGINE,
     /* Do not change the order here; see case statements below */
-    OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
-    OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_PUBIN,
-    OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT,
+    OPT_PVK_NONE,
+    OPT_PVK_WEAK,
+    OPT_PVK_STRONG,
+    OPT_NOOUT,
+    OPT_TEXT,
+    OPT_MODULUS,
+    OPT_PUBIN,
+    OPT_PUBOUT,
+    OPT_CIPHER,
+    OPT_PASSIN,
+    OPT_PASSOUT,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS dsa_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "", OPT_CIPHER, '-', "Any supported cipher" },
 #ifndef OPENSSL_NO_RC4
-    {"pvk-strong", OPT_PVK_STRONG, '-', "Enable 'Strong' PVK encoding level (default)"},
-    {"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"},
-    {"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"},
+    { "pvk-strong", OPT_PVK_STRONG, '-', "Enable 'Strong' PVK encoding level (default)" },
+    { "pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level" },
+    { "pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding" },
 #endif
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, 's', "Input key"},
-    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/PVK); has no effect"},
-    {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+    { "in", OPT_IN, 's', "Input key" },
+    { "inform", OPT_INFORM, 'f', "Input format (DER/PEM/PVK); has no effect" },
+    { "pubin", OPT_PUBIN, '-', "Expect a public key in input file" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'f', "Output format, DER PEM PVK"},
-    {"noout", OPT_NOOUT, '-', "Don't print key out"},
-    {"text", OPT_TEXT, '-', "Print the key in text"},
-    {"modulus", OPT_MODULUS, '-', "Print the DSA public value"},
-    {"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'f', "Output format, DER PEM PVK" },
+    { "noout", OPT_NOOUT, '-', "Don't print key out" },
+    { "text", OPT_TEXT, '-', "Print the key in text" },
+    { "modulus", OPT_MODULUS, '-', "Print the DSA public value" },
+    { "pubout", OPT_PUBOUT, '-', "Output public key, not private" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int dsa_main(int argc, char **argv)
@@ -98,7 +110,7 @@ int dsa_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             ret = 0;
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
@@ -129,9 +141,9 @@ int dsa_main(int argc, char **argv)
         case OPT_PASSOUT:
             passoutarg = opt_arg();
             break;
-        case OPT_PVK_STRONG:    /* pvk_encr:= 2 */
-        case OPT_PVK_WEAK:      /* pvk_encr:= 1 */
-        case OPT_PVK_NONE:      /* pvk_encr:= 0 */
+        case OPT_PVK_STRONG: /* pvk_encr:= 2 */
+        case OPT_PVK_WEAK: /* pvk_encr:= 1 */
+        case OPT_PVK_NONE: /* pvk_encr:= 0 */
 #ifndef OPENSSL_NO_RC4
             pvk_encr = (o - OPT_PVK_NONE);
 #endif
@@ -252,12 +264,12 @@ int dsa_main(int argc, char **argv)
     } else {
         assert(private);
         selection = (OSSL_KEYMGMT_SELECT_KEYPAIR
-                     | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS);
+            | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS);
     }
 
     /* Perform the encoding */
     ectx = OSSL_ENCODER_CTX_new_for_pkey(pkey, selection, output_type,
-                                         output_structure, NULL);
+        output_structure, NULL);
     if (OSSL_ENCODER_CTX_get_num_encoders(ectx) == 0) {
         BIO_printf(bio_err, "%s format not supported\n", output_type);
         goto end;
@@ -273,8 +285,8 @@ int dsa_main(int argc, char **argv)
         if (passout != NULL)
             /* When passout given, override the passphrase prompter */
             OSSL_ENCODER_CTX_set_passphrase(ectx,
-                                            (const unsigned char *)passout,
-                                            strlen(passout));
+                (const unsigned char *)passout,
+                strlen(passout));
     }
 
     /* PVK requires a bit more */
@@ -293,7 +305,7 @@ int dsa_main(int argc, char **argv)
         goto end;
     }
     ret = 0;
- end:
+end:
     if (ret != 0)
         ERR_print_errors(bio_err);
     OSSL_ENCODER_CTX_free(ectx);
diff --git a/crypto/openssl/apps/dsaparam.c b/crypto/openssl/apps/dsaparam.c
index 99fc3ee7b804..24e0f2c0fdb9 100644
--- a/crypto/openssl/apps/dsaparam.c
+++ b/crypto/openssl/apps/dsaparam.c
@@ -26,40 +26,49 @@ static int verbose = 0;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT,
-    OPT_NOOUT, OPT_GENKEY, OPT_ENGINE, OPT_VERBOSE, OPT_QUIET,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_TEXT,
+    OPT_NOOUT,
+    OPT_GENKEY,
+    OPT_ENGINE,
+    OPT_VERBOSE,
+    OPT_QUIET,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS dsaparam_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [numbits] [numqbits]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [numbits] [numqbits]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "inform", OPT_INFORM, 'F', "Input format - DER or PEM" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
-    {"text", OPT_TEXT, '-', "Print as text"},
-    {"noout", OPT_NOOUT, '-', "No output"},
-    {"verbose", OPT_VERBOSE, '-', "Verbose output"},
-    {"quiet", OPT_QUIET, '-', "Terse output"},
-    {"genkey", OPT_GENKEY, '-', "Generate a DSA key"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'F', "Output format - DER or PEM" },
+    { "text", OPT_TEXT, '-', "Print as text" },
+    { "noout", OPT_NOOUT, '-', "No output" },
+    { "verbose", OPT_VERBOSE, '-', "Verbose output" },
+    { "quiet", OPT_QUIET, '-', "Terse output" },
+    { "genkey", OPT_GENKEY, '-', "Generate a DSA key" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"numbits", 0, 0, "Number of bits if generating parameters or key (optional)"},
-    {"numqbits", 0, 0, "Number of bits in the subprime parameter q if generating parameters or key (optional)"},
-    {NULL}
+    { "numbits", 0, 0, "Number of bits if generating parameters or key (optional)" },
+    { "numqbits", 0, 0, "Number of bits in the subprime parameter q if generating parameters or key (optional)" },
+    { NULL }
 };
 
 int dsaparam_main(int argc, char **argv)
@@ -79,7 +88,7 @@ int dsaparam_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -153,37 +162,37 @@ int dsaparam_main(int argc, char **argv)
     ctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), "DSA", app_get0_propq());
     if (ctx == NULL) {
         BIO_printf(bio_err,
-                   "Error, DSA parameter generation context allocation failed\n");
+            "Error, DSA parameter generation context allocation failed\n");
         goto end;
     }
     if (numbits > 0) {
         if (numbits > OPENSSL_DSA_MAX_MODULUS_BITS)
             BIO_printf(bio_err,
-                       "Warning: It is not recommended to use more than %d bit for DSA keys.\n"
-                       "         Your key size is %d! Larger key size may behave not as expected.\n",
-                       OPENSSL_DSA_MAX_MODULUS_BITS, numbits);
+                "Warning: It is not recommended to use more than %d bit for DSA keys.\n"
+                "         Your key size is %d! Larger key size may behave not as expected.\n",
+                OPENSSL_DSA_MAX_MODULUS_BITS, numbits);
 
         EVP_PKEY_CTX_set_app_data(ctx, bio_err);
         if (verbose) {
             EVP_PKEY_CTX_set_cb(ctx, progress_cb);
             BIO_printf(bio_err, "Generating DSA parameters, %d bit long prime\n",
-                       num);
+                num);
             BIO_printf(bio_err, "This could take some time\n");
         }
         if (EVP_PKEY_paramgen_init(ctx) <= 0) {
             BIO_printf(bio_err,
-                       "Error, DSA key generation paramgen init failed\n");
+                "Error, DSA key generation paramgen init failed\n");
             goto end;
         }
         if (EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, num) <= 0) {
             BIO_printf(bio_err,
-                       "Error, DSA key generation setting bit length failed\n");
+                "Error, DSA key generation setting bit length failed\n");
             goto end;
         }
         if (numqbits > 0) {
             if (EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, numqbits) <= 0) {
                 BIO_printf(bio_err,
-                        "Error, DSA key generation setting subprime bit length failed\n");
+                    "Error, DSA key generation setting subprime bit length failed\n");
                 goto end;
             }
         }
@@ -220,15 +229,15 @@ int dsaparam_main(int argc, char **argv)
     if (genkey) {
         EVP_PKEY_CTX_free(ctx);
         ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), params,
-                app_get0_propq());
+            app_get0_propq());
         if (ctx == NULL) {
             BIO_printf(bio_err,
-                       "Error, DSA key generation context allocation failed\n");
+                "Error, DSA key generation context allocation failed\n");
             goto end;
         }
         if (EVP_PKEY_keygen_init(ctx) <= 0) {
             BIO_printf(bio_err,
-                       "Error, unable to initialise for key generation\n");
+                "Error, unable to initialise for key generation\n");
             goto end;
         }
         pkey = app_keygen(ctx, "DSA", numbits, verbose);
@@ -241,7 +250,7 @@ int dsaparam_main(int argc, char **argv)
             i = PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, NULL);
     }
     ret = 0;
- end:
+end:
     if (ret != 0)
         ERR_print_errors(bio_err);
     BIO_free_all(out);
diff --git a/crypto/openssl/apps/ec.c b/crypto/openssl/apps/ec.c
index 677876ccc90e..dee1ef48e7e0 100644
--- a/crypto/openssl/apps/ec.c
+++ b/crypto/openssl/apps/ec.c
@@ -23,42 +23,56 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
-    OPT_NOOUT, OPT_TEXT, OPT_PARAM_OUT, OPT_PUBIN, OPT_PUBOUT,
-    OPT_PASSIN, OPT_PASSOUT, OPT_PARAM_ENC, OPT_CONV_FORM, OPT_CIPHER,
-    OPT_NO_PUBLIC, OPT_CHECK, OPT_PROV_ENUM
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_ENGINE,
+    OPT_IN,
+    OPT_OUT,
+    OPT_NOOUT,
+    OPT_TEXT,
+    OPT_PARAM_OUT,
+    OPT_PUBIN,
+    OPT_PUBOUT,
+    OPT_PASSIN,
+    OPT_PASSOUT,
+    OPT_PARAM_ENC,
+    OPT_CONV_FORM,
+    OPT_CIPHER,
+    OPT_NO_PUBLIC,
+    OPT_CHECK,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS ec_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, 's', "Input file"},
-    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"},
-    {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"check", OPT_CHECK, '-', "check key consistency"},
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
-    {"param_enc", OPT_PARAM_ENC, 's',
-     "Specifies the way the ec parameters are encoded"},
-    {"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
+    { "in", OPT_IN, 's', "Input file" },
+    { "inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)" },
+    { "pubin", OPT_PUBIN, '-', "Expect a public key in input file" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "check", OPT_CHECK, '-', "check key consistency" },
+    { "", OPT_CIPHER, '-', "Any supported cipher" },
+    { "param_enc", OPT_PARAM_ENC, 's',
+        "Specifies the way the ec parameters are encoded" },
+    { "conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form " },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
-    {"noout", OPT_NOOUT, '-', "Don't print key out"},
-    {"text", OPT_TEXT, '-', "Print the key"},
-    {"param_out", OPT_PARAM_OUT, '-', "Print the elliptic curve parameters"},
-    {"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
-    {"no_public", OPT_NO_PUBLIC, '-', "exclude public key from private key"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'F', "Output format - DER or PEM" },
+    { "noout", OPT_NOOUT, '-', "Don't print key out" },
+    { "text", OPT_TEXT, '-', "Print the key" },
+    { "param_out", OPT_PARAM_OUT, '-', "Print the elliptic curve parameters" },
+    { "pubout", OPT_PUBOUT, '-', "Output public key, not private" },
+    { "no_public", OPT_NO_PUBLIC, '-', "exclude public key from private key" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int ec_main(int argc, char **argv)
@@ -86,7 +100,7 @@ int ec_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -188,15 +202,15 @@ int ec_main(int argc, char **argv)
 
     if (point_format
         && !EVP_PKEY_set_utf8_string_param(
-                eckey, OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
-                point_format)) {
+            eckey, OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
+            point_format)) {
         BIO_printf(bio_err, "unable to set point conversion format\n");
         goto end;
     }
 
     if (asn1_encoding != NULL
         && !EVP_PKEY_set_utf8_string_param(
-                eckey, OSSL_PKEY_PARAM_EC_ENCODING, asn1_encoding)) {
+            eckey, OSSL_PKEY_PARAM_EC_ENCODING, asn1_encoding)) {
         BIO_printf(bio_err, "unable to set asn1 encoding format\n");
         goto end;
     }
@@ -253,8 +267,8 @@ int ec_main(int argc, char **argv)
         }
 
         ectx = OSSL_ENCODER_CTX_new_for_pkey(eckey, selection,
-                                             output_type, output_structure,
-                                             NULL);
+            output_type, output_structure,
+            NULL);
         if (enc != NULL) {
             OSSL_ENCODER_CTX_set_cipher(ectx, EVP_CIPHER_get0_name(enc), NULL);
             /* Default passphrase prompter */
@@ -262,8 +276,8 @@ int ec_main(int argc, char **argv)
             if (passout != NULL)
                 /* When passout given, override the passphrase prompter */
                 OSSL_ENCODER_CTX_set_passphrase(ectx,
-                                                (const unsigned char *)passout,
-                                                strlen(passout));
+                    (const unsigned char *)passout,
+                    strlen(passout));
         }
         if (!OSSL_ENCODER_to_bio(ectx, out)) {
             BIO_printf(bio_err, "unable to write EC key\n");
diff --git a/crypto/openssl/apps/ecparam.c b/crypto/openssl/apps/ecparam.c
index f0879dfb11a9..017dc7568d8e 100644
--- a/crypto/openssl/apps/ecparam.c
+++ b/crypto/openssl/apps/ecparam.c
@@ -23,46 +23,59 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT,
-    OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME,
-    OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_TEXT,
+    OPT_CHECK,
+    OPT_LIST_CURVES,
+    OPT_NO_SEED,
+    OPT_NOOUT,
+    OPT_NAME,
+    OPT_CONV_FORM,
+    OPT_PARAM_ENC,
+    OPT_GENKEY,
+    OPT_ENGINE,
+    OPT_CHECK_NAMED,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS ecparam_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"list_curves", OPT_LIST_CURVES, '-',
-     "Prints a list of all curve 'short names'"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "list_curves", OPT_LIST_CURVES, '-',
+        "Prints a list of all curve 'short names'" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
-    {"genkey", OPT_GENKEY, '-', "Generate ec key"},
-    {"in", OPT_IN, '<', "Input file  - default stdin"},
-    {"inform", OPT_INFORM, 'F', "Input format - default PEM (DER or PEM)"},
-    {"out", OPT_OUT, '>', "Output file - default stdout"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - default PEM"},
+    { "genkey", OPT_GENKEY, '-', "Generate ec key" },
+    { "in", OPT_IN, '<', "Input file  - default stdin" },
+    { "inform", OPT_INFORM, 'F', "Input format - default PEM (DER or PEM)" },
+    { "out", OPT_OUT, '>', "Output file - default stdout" },
+    { "outform", OPT_OUTFORM, 'F', "Output format - default PEM" },
 
     OPT_SECTION("Output"),
-    {"text", OPT_TEXT, '-', "Print the ec parameters in text form"},
-    {"noout", OPT_NOOUT, '-', "Do not print the ec parameter"},
-    {"param_enc", OPT_PARAM_ENC, 's',
-     "Specifies the way the ec parameters are encoded"},
+    { "text", OPT_TEXT, '-', "Print the ec parameters in text form" },
+    { "noout", OPT_NOOUT, '-', "Do not print the ec parameter" },
+    { "param_enc", OPT_PARAM_ENC, 's',
+        "Specifies the way the ec parameters are encoded" },
 
     OPT_SECTION("Parameter"),
-    {"check", OPT_CHECK, '-', "Validate the ec parameters"},
-    {"check_named", OPT_CHECK_NAMED, '-',
-     "Check that named EC curve parameters have not been modified"},
-    {"no_seed", OPT_NO_SEED, '-',
-     "If 'explicit' parameters are chosen do not use the seed"},
-    {"name", OPT_NAME, 's',
-     "Use the ec parameters with specified 'short name'"},
-    {"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
+    { "check", OPT_CHECK, '-', "Validate the ec parameters" },
+    { "check_named", OPT_CHECK_NAMED, '-',
+        "Check that named EC curve parameters have not been modified" },
+    { "no_seed", OPT_NO_SEED, '-',
+        "If 'explicit' parameters are chosen do not use the seed" },
+    { "name", OPT_NAME, 's',
+        "Use the ec parameters with specified 'short name'" },
+    { "conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form " },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 static int list_builtin_curves(BIO *out)
@@ -112,7 +125,7 @@ int ecparam_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -206,30 +219,30 @@ int ecparam_main(int argc, char **argv)
 
         if (strcmp(curve_name, "secp192r1") == 0) {
             BIO_printf(bio_err,
-                       "using curve name prime192v1 instead of secp192r1\n");
+                "using curve name prime192v1 instead of secp192r1\n");
             curve_name = SN_X9_62_prime192v1;
         } else if (strcmp(curve_name, "secp256r1") == 0) {
             BIO_printf(bio_err,
-                       "using curve name prime256v1 instead of secp256r1\n");
+                "using curve name prime256v1 instead of secp256r1\n");
             curve_name = SN_X9_62_prime256v1;
         }
         *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
-                                                curve_name, 0);
+            curve_name, 0);
         if (asn1_encoding != NULL)
             *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_EC_ENCODING,
-                                                    asn1_encoding, 0);
+                asn1_encoding, 0);
         if (point_format != NULL)
             *p++ = OSSL_PARAM_construct_utf8_string(
-                       OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
-                       point_format, 0);
+                OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
+                point_format, 0);
         *p = OSSL_PARAM_construct_end();
 
         if (OPENSSL_strcasecmp(curve_name, "SM2") == 0)
             gctx_params = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), "sm2",
-                                                     app_get0_propq());
+                app_get0_propq());
         else
             gctx_params = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), "ec",
-                                                     app_get0_propq());
+                app_get0_propq());
         if (gctx_params == NULL
             || EVP_PKEY_keygen_init(gctx_params) <= 0
             || EVP_PKEY_CTX_set_params(gctx_params, params) <= 0
@@ -239,10 +252,10 @@ int ecparam_main(int argc, char **argv)
         }
     } else {
         params_key = load_keyparams_suppress(infile, informat, 1, "EC",
-                                             "EC parameters", 1);
+            "EC parameters", 1);
         if (params_key == NULL)
             params_key = load_keyparams_suppress(infile, informat, 1, "SM2",
-                                                 "SM2 parameters", 1);
+                "SM2 parameters", 1);
 
         if (params_key == NULL) {
             BIO_printf(bio_err, "Unable to load parameters from %s\n", infile);
@@ -251,15 +264,15 @@ int ecparam_main(int argc, char **argv)
 
         if (point_format
             && !EVP_PKEY_set_utf8_string_param(
-                    params_key, OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
-                    point_format)) {
+                params_key, OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
+                point_format)) {
             BIO_printf(bio_err, "unable to set point conversion format\n");
             goto end;
         }
 
         if (asn1_encoding != NULL
             && !EVP_PKEY_set_utf8_string_param(
-                    params_key, OSSL_PKEY_PARAM_EC_ENCODING, asn1_encoding)) {
+                params_key, OSSL_PKEY_PARAM_EC_ENCODING, asn1_encoding)) {
             BIO_printf(bio_err, "unable to set asn1 encoding format\n");
             goto end;
         }
@@ -267,7 +280,7 @@ int ecparam_main(int argc, char **argv)
 
     if (no_seed
         && !EVP_PKEY_set_octet_string_param(params_key, OSSL_PKEY_PARAM_EC_SEED,
-                                            NULL, 0)) {
+            NULL, 0)) {
         BIO_printf(bio_err, "unable to clear seed\n");
         goto end;
     }
@@ -287,13 +300,13 @@ int ecparam_main(int argc, char **argv)
 
         if (check_named
             && !EVP_PKEY_set_utf8_string_param(params_key,
-                                           OSSL_PKEY_PARAM_EC_GROUP_CHECK_TYPE,
-                                           OSSL_PKEY_EC_GROUP_CHECK_NAMED)) {
-                BIO_printf(bio_err, "unable to set check_type\n");
-                goto end;
+                OSSL_PKEY_PARAM_EC_GROUP_CHECK_TYPE,
+                OSSL_PKEY_EC_GROUP_CHECK_NAMED)) {
+            BIO_printf(bio_err, "unable to set check_type\n");
+            goto end;
         }
         pctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), params_key,
-                                          app_get0_propq());
+            app_get0_propq());
         if (pctx == NULL || EVP_PKEY_param_check(pctx) <= 0) {
             BIO_printf(bio_err, "failed\n");
             goto end;
@@ -306,8 +319,8 @@ int ecparam_main(int argc, char **argv)
 
     if (!noout) {
         ectx_params = OSSL_ENCODER_CTX_new_for_pkey(
-                          params_key, OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
-                          outformat == FORMAT_ASN1 ? "DER" : "PEM", NULL, NULL);
+            params_key, OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
+            outformat == FORMAT_ASN1 ? "DER" : "PEM", NULL, NULL);
         if (!OSSL_ENCODER_to_bio(ectx_params, out)) {
             BIO_printf(bio_err, "unable to write elliptic curve parameters\n");
             goto end;
@@ -324,7 +337,7 @@ int ecparam_main(int argc, char **argv)
          *    EVP_PKEY_keygen(gctx, &key) <= 0)
          */
         gctx_key = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), params_key,
-                                              app_get0_propq());
+            app_get0_propq());
         if (EVP_PKEY_keygen_init(gctx_key) <= 0
             || EVP_PKEY_keygen(gctx_key, &key) <= 0) {
             BIO_printf(bio_err, "unable to generate key\n");
@@ -332,11 +345,11 @@ int ecparam_main(int argc, char **argv)
         }
         assert(private);
         ectx_key = OSSL_ENCODER_CTX_new_for_pkey(
-                       key, OSSL_KEYMGMT_SELECT_ALL,
-                       outformat == FORMAT_ASN1 ? "DER" : "PEM", NULL, NULL);
+            key, OSSL_KEYMGMT_SELECT_ALL,
+            outformat == FORMAT_ASN1 ? "DER" : "PEM", NULL, NULL);
         if (!OSSL_ENCODER_to_bio(ectx_key, out)) {
             BIO_printf(bio_err, "unable to write elliptic "
-                       "curve parameters\n");
+                                "curve parameters\n");
             goto end;
         }
     }
diff --git a/crypto/openssl/apps/enc.c b/crypto/openssl/apps/enc.c
index 33949d402dd7..2dd839358231 100644
--- a/crypto/openssl/apps/enc.c
+++ b/crypto/openssl/apps/enc.c
@@ -21,16 +21,16 @@
 #include <openssl/rand.h>
 #include <openssl/pem.h>
 #ifndef OPENSSL_NO_COMP
-# include <openssl/comp.h>
+#include <openssl/comp.h>
 #endif
 #include <ctype.h>
 
 #undef SIZE
 #undef BSIZE
-#define SIZE    (512)
-#define BSIZE   (8*1024)
+#define SIZE (512)
+#define BSIZE (8 * 1024)
 
-#define PBKDF2_ITER_DEFAULT     10000
+#define PBKDF2_ITER_DEFAULT 10000
 #define STR(a) XSTR(a)
 #define XSTR(a) #a
 
@@ -45,74 +45,100 @@ struct doall_enc_ciphers {
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_LIST,
-    OPT_E, OPT_IN, OPT_OUT, OPT_PASS, OPT_ENGINE, OPT_D, OPT_P, OPT_V,
-    OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
-    OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
-    OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER,
-    OPT_SALTLEN, OPT_R_ENUM, OPT_PROV_ENUM,
-    OPT_SKEYOPT, OPT_SKEYMGMT
+    OPT_E,
+    OPT_IN,
+    OPT_OUT,
+    OPT_PASS,
+    OPT_ENGINE,
+    OPT_D,
+    OPT_P,
+    OPT_V,
+    OPT_NOPAD,
+    OPT_SALT,
+    OPT_NOSALT,
+    OPT_DEBUG,
+    OPT_UPPER_P,
+    OPT_UPPER_A,
+    OPT_A,
+    OPT_Z,
+    OPT_BUFSIZE,
+    OPT_K,
+    OPT_KFILE,
+    OPT_UPPER_K,
+    OPT_NONE,
+    OPT_UPPER_S,
+    OPT_IV,
+    OPT_MD,
+    OPT_ITER,
+    OPT_PBKDF2,
+    OPT_CIPHER,
+    OPT_SALTLEN,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM,
+    OPT_SKEYOPT,
+    OPT_SKEYMGMT
 } OPTION_CHOICE;
 
 const OPTIONS enc_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"list", OPT_LIST, '-', "List ciphers"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "list", OPT_LIST, '-', "List ciphers" },
 #ifndef OPENSSL_NO_DEPRECATED_3_0
-    {"ciphers", OPT_LIST, '-', "Alias for -list"},
+    { "ciphers", OPT_LIST, '-', "Alias for -list" },
 #endif
-    {"e", OPT_E, '-', "Encrypt"},
-    {"d", OPT_D, '-', "Decrypt"},
-    {"p", OPT_P, '-', "Print the iv/key"},
-    {"P", OPT_UPPER_P, '-', "Print the iv/key and exit"},
+    { "e", OPT_E, '-', "Encrypt" },
+    { "d", OPT_D, '-', "Decrypt" },
+    { "p", OPT_P, '-', "Print the iv/key" },
+    { "P", OPT_UPPER_P, '-', "Print the iv/key and exit" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"k", OPT_K, 's', "Passphrase"},
-    {"kfile", OPT_KFILE, '<', "Read passphrase from file"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "k", OPT_K, 's', "Passphrase" },
+    { "kfile", OPT_KFILE, '<', "Read passphrase from file" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"pass", OPT_PASS, 's', "Passphrase source"},
-    {"v", OPT_V, '-', "Verbose output"},
-    {"a", OPT_A, '-', "Base64 encode/decode, depending on encryption flag"},
-    {"base64", OPT_A, '-', "Same as option -a"},
-    {"A", OPT_UPPER_A, '-',
-     "Used with -[base64|a] to specify base64 buffer as a single line"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "pass", OPT_PASS, 's', "Passphrase source" },
+    { "v", OPT_V, '-', "Verbose output" },
+    { "a", OPT_A, '-', "Base64 encode/decode, depending on encryption flag" },
+    { "base64", OPT_A, '-', "Same as option -a" },
+    { "A", OPT_UPPER_A, '-',
+        "Used with -[base64|a] to specify base64 buffer as a single line" },
 
     OPT_SECTION("Encryption"),
-    {"nopad", OPT_NOPAD, '-', "Disable standard block padding"},
-    {"salt", OPT_SALT, '-', "Use salt in the KDF (default)"},
-    {"nosalt", OPT_NOSALT, '-', "Do not use salt in the KDF"},
-    {"debug", OPT_DEBUG, '-', "Print debug info"},
+    { "nopad", OPT_NOPAD, '-', "Disable standard block padding" },
+    { "salt", OPT_SALT, '-', "Use salt in the KDF (default)" },
+    { "nosalt", OPT_NOSALT, '-', "Do not use salt in the KDF" },
+    { "debug", OPT_DEBUG, '-', "Print debug info" },
 
-    {"bufsize", OPT_BUFSIZE, 's', "Buffer size"},
-    {"K", OPT_UPPER_K, 's', "Raw key, in hex"},
-    {"S", OPT_UPPER_S, 's', "Salt, in hex"},
-    {"iv", OPT_IV, 's', "IV in hex"},
-    {"md", OPT_MD, 's', "Use specified digest to create a key from the passphrase"},
-    {"iter", OPT_ITER, 'p',
-     "Specify the iteration count and force the use of PBKDF2"},
-    {OPT_MORE_STR, 0, 0, "Default: " STR(PBKDF2_ITER_DEFAULT)},
-    {"pbkdf2", OPT_PBKDF2, '-',
-     "Use password-based key derivation function 2 (PBKDF2)"},
-    {OPT_MORE_STR, 0, 0,
-     "Use -iter to change the iteration count from " STR(PBKDF2_ITER_DEFAULT)},
-    {"none", OPT_NONE, '-', "Don't encrypt"},
-    {"saltlen", OPT_SALTLEN, 'p', "Specify the PBKDF2 salt length (in bytes)"},
-    {OPT_MORE_STR, 0, 0, "Default: 16"},
+    { "bufsize", OPT_BUFSIZE, 's', "Buffer size" },
+    { "K", OPT_UPPER_K, 's', "Raw key, in hex" },
+    { "S", OPT_UPPER_S, 's', "Salt, in hex" },
+    { "iv", OPT_IV, 's', "IV in hex" },
+    { "md", OPT_MD, 's', "Use specified digest to create a key from the passphrase" },
+    { "iter", OPT_ITER, 'p',
+        "Specify the iteration count and force the use of PBKDF2" },
+    { OPT_MORE_STR, 0, 0, "Default: " STR(PBKDF2_ITER_DEFAULT) },
+    { "pbkdf2", OPT_PBKDF2, '-',
+        "Use password-based key derivation function 2 (PBKDF2)" },
+    { OPT_MORE_STR, 0, 0,
+        "Use -iter to change the iteration count from " STR(PBKDF2_ITER_DEFAULT) },
+    { "none", OPT_NONE, '-', "Don't encrypt" },
+    { "saltlen", OPT_SALTLEN, 'p', "Specify the PBKDF2 salt length (in bytes)" },
+    { OPT_MORE_STR, 0, 0, "Default: 16" },
 #ifndef OPENSSL_NO_ZLIB
-    {"z", OPT_Z, '-', "Compress or decompress encrypted data using zlib"},
+    { "z", OPT_Z, '-', "Compress or decompress encrypted data using zlib" },
 #endif
-    {"skeyopt", OPT_SKEYOPT, 's', "Key options as opt:value for opaque symmetric key handling"},
-    {"skeymgmt", OPT_SKEYMGMT, 's', "Symmetric key management name for opaque symmetric key handling"},
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
+    { "skeyopt", OPT_SKEYOPT, 's', "Key options as opt:value for opaque symmetric key handling" },
+    { "skeymgmt", OPT_SKEYMGMT, 's', "Symmetric key management name for opaque symmetric key handling" },
+    { "", OPT_CIPHER, '-', "Any supported cipher" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int enc_main(int argc, char **argv)
@@ -120,8 +146,7 @@ int enc_main(int argc, char **argv)
     static char buf[128];
     static const char magic[] = "Salted__";
     ENGINE *e = NULL;
-    BIO *in = NULL, *out = NULL, *b64 = NULL, *benc = NULL, *rbio =
-        NULL, *wbio = NULL;
+    BIO *in = NULL, *out = NULL, *b64 = NULL, *benc = NULL, *rbio = NULL, *wbio = NULL;
     EVP_CIPHER_CTX *ctx = NULL;
     EVP_CIPHER *cipher = NULL;
     EVP_MD *dgst = NULL;
@@ -183,7 +208,7 @@ int enc_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -195,7 +220,7 @@ int enc_main(int argc, char **argv)
             dec.bio = bio_out;
             dec.n = 0;
             OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH,
-                                   show_ciphers, &dec);
+                show_ciphers, &dec);
             BIO_printf(bio_out, "\n");
             ret = 0;
             goto end;
@@ -256,7 +281,7 @@ int enc_main(int argc, char **argv)
             if (k)
                 p[i] = '\0';
             if (!opt_long(opt_arg(), &n)
-                    || n < 0 || (k && n >= LONG_MAX / 1024))
+                || n < 0 || (k && n >= LONG_MAX / 1024))
                 goto opthelp;
             if (k)
                 n *= 1024;
@@ -276,7 +301,7 @@ int enc_main(int argc, char **argv)
             in = NULL;
             if (i <= 0) {
                 BIO_printf(bio_err,
-                           "%s Can't read key from %s\n", prog, opt_arg());
+                    "%s Can't read key from %s\n", prog, opt_arg());
                 goto opthelp;
             }
             while (--i > 0 && (buf[i] == '\r' || buf[i] == '\n'))
@@ -314,16 +339,14 @@ int enc_main(int argc, char **argv)
             break;
         case OPT_PBKDF2:
             pbkdf2 = 1;
-            if (iter == 0)    /* do not overwrite a chosen value */
+            if (iter == 0) /* do not overwrite a chosen value */
                 iter = PBKDF2_ITER_DEFAULT;
             break;
         case OPT_NONE:
             cipher = NULL;
             break;
         case OPT_SKEYOPT:
-            if ((skeyopts == NULL &&
-                 (skeyopts = sk_OPENSSL_STRING_new_null()) == NULL) ||
-                sk_OPENSSL_STRING_push(skeyopts, opt_arg()) == 0) {
+            if ((skeyopts == NULL && (skeyopts = sk_OPENSSL_STRING_new_null()) == NULL) || sk_OPENSSL_STRING_push(skeyopts, opt_arg()) == 0) {
                 BIO_printf(bio_err, "%s: out of memory\n", prog);
                 goto end;
             }
@@ -393,7 +416,7 @@ int enc_main(int argc, char **argv)
     buff = app_malloc(EVP_ENCODE_LENGTH(bsize), "evp buffer");
 
     if (infile == NULL) {
-        if (!streamable && printkey != 2) {  /* if just print key and exit, it's ok */
+        if (!streamable && printkey != 2) { /* if just print key and exit, it's ok */
             BIO_printf(bio_err, "Unstreamable cipher mode\n");
             goto end;
         }
@@ -419,8 +442,8 @@ int enc_main(int argc, char **argv)
                 char prompt[200];
 
                 BIO_snprintf(prompt, sizeof(prompt), "enter %s %s password:",
-                        EVP_CIPHER_get0_name(cipher),
-                        (enc) ? "encryption" : "decryption");
+                    EVP_CIPHER_get0_name(cipher),
+                    (enc) ? "encryption" : "decryption");
                 strbuf[0] = '\0';
                 i = EVP_read_pw_string((char *)strbuf, SIZE, prompt, enc);
                 if (i == 0) {
@@ -458,7 +481,7 @@ int enc_main(int argc, char **argv)
     wbio = out;
 
 #ifndef OPENSSL_NO_COMP
-# ifndef OPENSSL_NO_ZLIB
+#ifndef OPENSSL_NO_ZLIB
     if (do_zlib) {
         if ((bzl = BIO_new(BIO_f_zlib())) == NULL)
             goto end;
@@ -471,7 +494,7 @@ int enc_main(int argc, char **argv)
         else
             rbio = BIO_push(bzl, rbio);
     }
-# endif
+#endif
 
     if (do_brotli) {
         if ((bbrot = BIO_new(BIO_f_brotli())) == NULL)
@@ -532,7 +555,7 @@ int enc_main(int argc, char **argv)
                     BIO_printf(bio_err, "invalid hex salt value\n");
                     goto end;
                 }
-                if (enc) {  /* encryption */
+                if (enc) { /* encryption */
                     if (hsalt == NULL) {
                         if (RAND_bytes(salt, saltlen) <= 0) {
                             BIO_printf(bio_err, "RAND_bytes failed\n");
@@ -544,15 +567,17 @@ int enc_main(int argc, char **argv)
                          */
                         if ((printkey != 2)
                             && (BIO_write(wbio, magic,
-                                          sizeof(magic) - 1) != sizeof(magic) - 1
+                                    sizeof(magic) - 1)
+                                    != sizeof(magic) - 1
                                 || BIO_write(wbio,
-                                             (char *)salt,
-                                             saltlen) != saltlen)) {
+                                       (char *)salt,
+                                       saltlen)
+                                    != saltlen)) {
                             BIO_printf(bio_err, "error writing output file\n");
                             goto end;
                         }
                     }
-                } else {    /* decryption */
+                } else { /* decryption */
                     if (hsalt == NULL) {
                         if (BIO_read(rbio, mbuf, sizeof(mbuf)) != sizeof(mbuf)) {
                             BIO_printf(bio_err, "error reading input file\n");
@@ -560,7 +585,8 @@ int enc_main(int argc, char **argv)
                         }
                         if (memcmp(mbuf, magic, sizeof(mbuf)) == 0) { /* file IS salted */
                             if (BIO_read(rbio, salt,
-                                         saltlen) != saltlen) {
+                                    saltlen)
+                                != saltlen) {
                                 BIO_printf(bio_err, "error reading input file\n");
                                 goto end;
                             }
@@ -575,9 +601,9 @@ int enc_main(int argc, char **argv)
 
             if (pbkdf2 == 1) {
                 /*
-                * derive key and default iv
-                * concatenated into a temporary buffer
-                */
+                 * derive key and default iv
+                 * concatenated into a temporary buffer
+                 */
                 unsigned char tmpkeyiv[EVP_MAX_KEY_LENGTH + EVP_MAX_IV_LENGTH];
                 int iklen = EVP_CIPHER_get_key_length(cipher);
                 int ivlen = EVP_CIPHER_get_iv_length(cipher);
@@ -585,21 +611,21 @@ int enc_main(int argc, char **argv)
                 int islen = (sptr != NULL ? saltlen : 0);
 
                 if (!PKCS5_PBKDF2_HMAC(str, str_len, sptr, islen,
-                                       iter, dgst, iklen+ivlen, tmpkeyiv)) {
+                        iter, dgst, iklen + ivlen, tmpkeyiv)) {
                     BIO_printf(bio_err, "PKCS5_PBKDF2_HMAC failed\n");
                     goto end;
                 }
                 /* split and move data back to global buffer */
                 memcpy(key, tmpkeyiv, iklen);
-                memcpy(iv, tmpkeyiv+iklen, ivlen);
+                memcpy(iv, tmpkeyiv + iklen, ivlen);
                 rawkey_set = 1;
             } else {
                 BIO_printf(bio_err, "*** WARNING : "
                                     "deprecated key derivation used.\n"
                                     "Using -iter or -pbkdf2 would be better.\n");
                 if (!EVP_BytesToKey(cipher, dgst, sptr,
-                                    (unsigned char *)str, str_len,
-                                    1, key, iv)) {
+                        (unsigned char *)str, str_len,
+                        1, key, iv)) {
                     BIO_printf(bio_err, "EVP_BytesToKey failed\n");
                     goto end;
                 }
@@ -668,9 +694,9 @@ int enc_main(int argc, char **argv)
 
         if (rawkey_set) {
             if (!EVP_CipherInit_ex(ctx, cipher, e, key,
-                                   (hiv == NULL && wrap == 1 ? NULL : iv), enc)) {
+                    (hiv == NULL && wrap == 1 ? NULL : iv), enc)) {
                 BIO_printf(bio_err, "Error setting cipher %s\n",
-                           EVP_CIPHER_get0_name(cipher));
+                    EVP_CIPHER_get0_name(cipher));
                 ERR_print_errors(bio_err);
                 goto end;
             }
@@ -678,31 +704,31 @@ int enc_main(int argc, char **argv)
             OSSL_PARAM *params = NULL;
 
             mgmt = EVP_SKEYMGMT_fetch(app_get0_libctx(),
-                                      skeymgmt != NULL ? skeymgmt : EVP_CIPHER_name(cipher),
-                                      app_get0_propq());
+                skeymgmt != NULL ? skeymgmt : EVP_CIPHER_name(cipher),
+                app_get0_propq());
             if (mgmt == NULL)
                 goto end;
 
             params = app_params_new_from_opts(skeyopts,
-                                              EVP_SKEYMGMT_get0_imp_settable_params(mgmt));
+                EVP_SKEYMGMT_get0_imp_settable_params(mgmt));
             if (params == NULL)
                 goto end;
 
             skey = EVP_SKEY_import(app_get0_libctx(), EVP_SKEYMGMT_get0_name(mgmt),
-                                   app_get0_propq(), OSSL_SKEYMGMT_SELECT_ALL, params);
+                app_get0_propq(), OSSL_SKEYMGMT_SELECT_ALL, params);
             OSSL_PARAM_free(params);
             if (skey == NULL) {
                 BIO_printf(bio_err, "Error creating opaque key object for skeymgmt %s\n",
-                           skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
+                    skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
                 ERR_print_errors(bio_err);
                 goto end;
             }
 
             if (!EVP_CipherInit_SKEY(ctx, cipher, skey,
-                                     (hiv == NULL && wrap == 1 ? NULL : iv),
-                                     EVP_CIPHER_get_iv_length(cipher), enc, NULL)) {
+                    (hiv == NULL && wrap == 1 ? NULL : iv),
+                    EVP_CIPHER_get_iv_length(cipher), enc, NULL)) {
                 BIO_printf(bio_err, "Error setting an opaque key for cipher %s\n",
-                           EVP_CIPHER_get0_name(cipher));
+                    EVP_CIPHER_get0_name(cipher));
                 ERR_print_errors(bio_err);
                 goto end;
             }
@@ -750,7 +776,7 @@ int enc_main(int argc, char **argv)
         inl = BIO_read(rbio, (char *)buff, bsize);
         if (inl <= 0)
             break;
-        if (!streamable && !BIO_eof(rbio)) {    /* do not output data */
+        if (!streamable && !BIO_eof(rbio)) { /* do not output data */
             BIO_printf(bio_err, "Unstreamable cipher mode\n");
             goto end;
         }
@@ -774,7 +800,7 @@ int enc_main(int argc, char **argv)
         BIO_printf(bio_err, "bytes read   : %8ju\n", BIO_number_read(in));
         BIO_printf(bio_err, "bytes written: %8ju\n", BIO_number_written(out));
     }
- end:
+end:
     ERR_print_errors(bio_err);
     sk_OPENSSL_STRING_free(skeyopts);
     EVP_SKEYMGMT_free(mgmt);
@@ -808,8 +834,8 @@ static void show_ciphers(const OBJ_NAME *name, void *arg)
     /* Filter out ciphers that we cannot use */
     cipher = EVP_get_cipherbyname(name->name);
     if (cipher == NULL
-            || (EVP_CIPHER_get_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) != 0
-            || EVP_CIPHER_get_mode(cipher) == EVP_CIPH_XTS_MODE)
+        || (EVP_CIPHER_get_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) != 0
+        || EVP_CIPHER_get_mode(cipher) == EVP_CIPH_XTS_MODE)
         return;
 
     BIO_printf(dec->bio, "-%-25s", name->name);
diff --git a/crypto/openssl/apps/engine.c b/crypto/openssl/apps/engine.c
index edd787514882..1b8eac4dc8b6 100644
--- a/crypto/openssl/apps/engine.c
+++ b/crypto/openssl/apps/engine.c
@@ -24,32 +24,39 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_C, OPT_T, OPT_TT, OPT_PRE, OPT_POST,
-    OPT_V = 100, OPT_VV, OPT_VVV, OPT_VVVV
+    OPT_C,
+    OPT_T,
+    OPT_TT,
+    OPT_PRE,
+    OPT_POST,
+    OPT_V = 100,
+    OPT_VV,
+    OPT_VVV,
+    OPT_VVVV
 } OPTION_CHOICE;
 
 const OPTIONS engine_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] engine...\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] engine...\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"t", OPT_T, '-', "Check that specified engine is available"},
-    {"pre", OPT_PRE, 's', "Run command against the ENGINE before loading it"},
-    {"post", OPT_POST, 's', "Run command against the ENGINE after loading it"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "t", OPT_T, '-', "Check that specified engine is available" },
+    { "pre", OPT_PRE, 's', "Run command against the ENGINE before loading it" },
+    { "post", OPT_POST, 's', "Run command against the ENGINE after loading it" },
 
     OPT_SECTION("Output"),
-    {"v", OPT_V, '-', "List 'control commands' For each specified engine"},
-    {"vv", OPT_VV, '-', "Also display each command's description"},
-    {"vvv", OPT_VVV, '-', "Also add the input flags for each command"},
-    {"vvvv", OPT_VVVV, '-', "Also show internal input flags"},
-    {"c", OPT_C, '-', "List the capabilities of specified engine"},
-    {"tt", OPT_TT, '-', "Display error trace for unavailable engines"},
-    {OPT_MORE_STR, OPT_EOF, 1,
-     "Commands are like \"SO_PATH:/lib/libdriver.so\""},
+    { "v", OPT_V, '-', "List 'control commands' For each specified engine" },
+    { "vv", OPT_VV, '-', "Also display each command's description" },
+    { "vvv", OPT_VVV, '-', "Also add the input flags for each command" },
+    { "vvvv", OPT_VVVV, '-', "Also show internal input flags" },
+    { "c", OPT_C, '-', "List the capabilities of specified engine" },
+    { "tt", OPT_TT, '-', "Display error trace for unavailable engines" },
+    { OPT_MORE_STR, OPT_EOF, 1,
+        "Commands are like \"SO_PATH:/lib/libdriver.so\"" },
 
     OPT_PARAMETERS(),
-    {"engine", 0, 0, "ID of engine(s) to load"},
-    {NULL}
+    { "engine", 0, 0, "ID of engine(s) to load" },
+    { NULL }
 };
 
 static int append_buf(char **buf, int *size, const char *s)
@@ -133,9 +140,7 @@ static int util_flags(BIO *out, unsigned int flags, const char *indent)
         started = 1;
     }
     /* Check for unknown flags */
-    flags = flags & ~ENGINE_CMD_FLAG_NUMERIC &
-        ~ENGINE_CMD_FLAG_STRING &
-        ~ENGINE_CMD_FLAG_NO_INPUT & ~ENGINE_CMD_FLAG_INTERNAL;
+    flags = flags & ~ENGINE_CMD_FLAG_NUMERIC & ~ENGINE_CMD_FLAG_STRING & ~ENGINE_CMD_FLAG_NO_INPUT & ~ENGINE_CMD_FLAG_INTERNAL;
     if (flags) {
         if (started)
             BIO_printf(out, "|");
@@ -157,9 +162,7 @@ static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent)
     int flags;
     int xpos = 0;
     STACK_OF(OPENSSL_STRING) *cmds = NULL;
-    if (!ENGINE_ctrl(e, ENGINE_CTRL_HAS_CTRL_FUNCTION, 0, NULL, NULL) ||
-        ((num = ENGINE_ctrl(e, ENGINE_CTRL_GET_FIRST_CMD_TYPE,
-                            0, NULL, NULL)) <= 0)) {
+    if (!ENGINE_ctrl(e, ENGINE_CTRL_HAS_CTRL_FUNCTION, 0, NULL, NULL) || ((num = ENGINE_ctrl(e, ENGINE_CTRL_GET_FIRST_CMD_TYPE, 0, NULL, NULL)) <= 0)) {
         return 1;
     }
 
@@ -171,25 +174,30 @@ static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent)
         int len;
         /* Get the command input flags */
         if ((flags = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, num,
-                                 NULL, NULL)) < 0)
+                 NULL, NULL))
+            < 0)
             goto err;
         if (!(flags & ENGINE_CMD_FLAG_INTERNAL) || verbose >= 4) {
             /* Get the command name */
             if ((len = ENGINE_ctrl(e, ENGINE_CTRL_GET_NAME_LEN_FROM_CMD, num,
-                                   NULL, NULL)) <= 0)
+                     NULL, NULL))
+                <= 0)
                 goto err;
             name = app_malloc(len + 1, "name buffer");
             if (ENGINE_ctrl(e, ENGINE_CTRL_GET_NAME_FROM_CMD, num, name,
-                            NULL) <= 0)
+                    NULL)
+                <= 0)
                 goto err;
             /* Get the command description */
             if ((len = ENGINE_ctrl(e, ENGINE_CTRL_GET_DESC_LEN_FROM_CMD, num,
-                                   NULL, NULL)) < 0)
+                     NULL, NULL))
+                < 0)
                 goto err;
             if (len > 0) {
                 desc = app_malloc(len + 1, "description buffer");
                 if (ENGINE_ctrl(e, ENGINE_CTRL_GET_DESC_FROM_CMD, num, desc,
-                                NULL) <= 0)
+                        NULL)
+                    <= 0)
                     goto err;
             }
             /* Now decide on the output */
@@ -203,8 +211,7 @@ static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent)
                 /*
                  * We're just listing names, comma-delimited
                  */
-                if ((xpos > (int)strlen(indent)) &&
-                    (xpos + (int)strlen(name) > line_wrap)) {
+                if ((xpos > (int)strlen(indent)) && (xpos + (int)strlen(name) > line_wrap)) {
                     BIO_printf(out, "\n");
                     xpos = BIO_puts(out, indent);
                 }
@@ -212,7 +219,7 @@ static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent)
             } else {
                 /* We're listing names plus descriptions */
                 BIO_printf(out, "%s: %s\n", name,
-                           (desc == NULL) ? "<no description>" : desc);
+                    (desc == NULL) ? "<no description>" : desc);
                 /* ... and sometimes input flags */
                 if ((verbose >= 3) && !util_flags(out, flags, indent))
                     goto err;
@@ -229,7 +236,7 @@ static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent)
     if (xpos > 0)
         BIO_printf(out, "\n");
     ret = 1;
- err:
+err:
     sk_OPENSSL_STRING_free(cmds);
     OPENSSL_free(name);
     OPENSSL_free(desc);
@@ -237,7 +244,7 @@ static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent)
 }
 
 static void util_do_cmds(ENGINE *e, STACK_OF(OPENSSL_STRING) *cmds,
-                         BIO *out, const char *indent)
+    BIO *out, const char *indent)
 {
     int loop, res, num = sk_OPENSSL_STRING_num(cmds);
 
@@ -249,7 +256,7 @@ static void util_do_cmds(ENGINE *e, STACK_OF(OPENSSL_STRING) *cmds,
         char buf[256];
         const char *cmd, *arg;
         cmd = sk_OPENSSL_STRING_value(cmds, loop);
-        res = 1;                /* assume success */
+        res = 1; /* assume success */
         /* Check if this command has no ":arg" */
         if ((arg = strchr(cmd, ':')) == NULL) {
             if (!ENGINE_ctrl_cmd_string(e, cmd, NULL, 0))
@@ -261,7 +268,7 @@ static void util_do_cmds(ENGINE *e, STACK_OF(OPENSSL_STRING) *cmds,
             }
             memcpy(buf, cmd, (int)(arg - cmd));
             buf[arg - cmd] = '\0';
-            arg++;              /* Move past the ":" */
+            arg++; /* Move past the ":" */
             /* Call the command with the argument */
             if (!ENGINE_ctrl_cmd_string(e, buf, arg, 0))
                 res = 0;
@@ -288,7 +295,7 @@ static void util_store_cap(const OSSL_STORE_LOADER *loader, void *arg)
     if (OSSL_STORE_LOADER_get0_engine(loader) == ctx->engine) {
         char buf[256];
         BIO_snprintf(buf, sizeof(buf), "STORE(%s)",
-                     OSSL_STORE_LOADER_get0_scheme(loader));
+            OSSL_STORE_LOADER_get0_scheme(loader));
         if (!append_buf(ctx->cap_buf, ctx->cap_size, buf))
             ctx->ok = 0;
     }
@@ -366,10 +373,10 @@ int engine_main(int argc, char **argv)
     /* Any remaining arguments are engine names. */
     argc = opt_num_rest();
     argv = opt_rest();
-    for ( ; *argv; argv++) {
+    for (; *argv; argv++) {
         if (**argv == '-') {
             BIO_printf(bio_err, "%s: Cannot mix flags and engine names.\n",
-                       prog);
+                prog);
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         }
@@ -396,7 +403,7 @@ int engine_main(int argc, char **argv)
             util_do_cmds(e, pre_cmds, out, indent);
             if (strcmp(ENGINE_get_id(e), id) != 0) {
                 BIO_printf(out, "Loaded: (%s) %s\n",
-                           ENGINE_get_id(e), ENGINE_get_name(e));
+                    ENGINE_get_id(e), ENGINE_get_name(e));
             }
             if (list_cap) {
                 int cap_size = 256;
@@ -431,7 +438,7 @@ int engine_main(int argc, char **argv)
                     if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
                         goto end;
 
- skip_ciphers:
+            skip_ciphers:
                 fn_d = ENGINE_get_digests(e);
                 if (fn_d == NULL)
                     goto skip_digests;
@@ -440,7 +447,7 @@ int engine_main(int argc, char **argv)
                     if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
                         goto end;
 
- skip_digests:
+            skip_digests:
                 fn_pk = ENGINE_get_pkey_meths(e);
                 if (fn_pk == NULL)
                     goto skip_pmeths;
@@ -448,19 +455,18 @@ int engine_main(int argc, char **argv)
                 for (k = 0; k < n; ++k)
                     if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
                         goto end;
- skip_pmeths:
-                {
-                    struct util_store_cap_data store_ctx;
+            skip_pmeths: {
+                struct util_store_cap_data store_ctx;
 
-                    store_ctx.engine = e;
-                    store_ctx.cap_buf = &cap_buf;
-                    store_ctx.cap_size = &cap_size;
-                    store_ctx.ok = 1;
+                store_ctx.engine = e;
+                store_ctx.cap_buf = &cap_buf;
+                store_ctx.cap_size = &cap_size;
+                store_ctx.ok = 1;
 
-                    OSSL_STORE_do_all_loaders(util_store_cap, &store_ctx);
-                    if (!store_ctx.ok)
-                        goto end;
-                }
+                OSSL_STORE_do_all_loaders(util_store_cap, &store_ctx);
+                if (!store_ctx.ok)
+                    goto end;
+            }
                 if (cap_buf != NULL && (*cap_buf != '\0'))
                     BIO_printf(out, " [%s]\n", cap_buf);
 
@@ -490,7 +496,7 @@ int engine_main(int argc, char **argv)
         }
     }
 
- end:
+end:
 
     ERR_print_errors(bio_err);
     sk_OPENSSL_CSTRING_free(engines);
diff --git a/crypto/openssl/apps/errstr.c b/crypto/openssl/apps/errstr.c
index 21349d21cb42..d4146da49b9b 100644
--- a/crypto/openssl/apps/errstr.c
+++ b/crypto/openssl/apps/errstr.c
@@ -17,18 +17,20 @@
 #include <openssl/ssl.h>
 
 typedef enum OPTION_choice {
-    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP
+    OPT_ERR = -1,
+    OPT_EOF = 0,
+    OPT_HELP
 } OPTION_CHOICE;
 
 const OPTIONS errstr_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] errnum...\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] errnum...\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_PARAMETERS(),
-    {"errnum", 0, 0, "Error number(s) to decode"},
-    {NULL}
+    { "errnum", 0, 0, "Error number(s) to decode" },
+    { NULL }
 };
 
 int errstr_main(int argc, char **argv)
@@ -57,7 +59,8 @@ int errstr_main(int argc, char **argv)
      * we're still interested in SSL error strings
      */
     OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-                    | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+            | OPENSSL_INIT_LOAD_CRYPTO_STRINGS,
+        NULL);
 
     /* All remaining arg are error code. */
     ret = 0;
@@ -69,6 +72,6 @@ int errstr_main(int argc, char **argv)
             BIO_printf(bio_out, "%s\n", buf);
         }
     }
- end:
+end:
     return ret;
 }
diff --git a/crypto/openssl/apps/fipsinstall.c b/crypto/openssl/apps/fipsinstall.c
index 0daa55a1b8ae..dcc09a5ed7f7 100644
--- a/crypto/openssl/apps/fipsinstall.c
+++ b/crypto/openssl/apps/fipsinstall.c
@@ -21,8 +21,8 @@
 #define BUFSIZE 4096
 
 /* Configuration file values */
-#define VERSION_KEY  "version"
-#define VERSION_VAL  "1"
+#define VERSION_KEY "version"
+#define VERSION_VAL "1"
 #define INSTALL_STATUS_VAL "INSTALL_SELF_TEST_KATS_RUN"
 
 static OSSL_CALLBACK self_test_events;
@@ -33,15 +33,29 @@ static int quiet = 0;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_IN, OPT_OUT, OPT_MODULE, OPT_PEDANTIC,
-    OPT_PROV_NAME, OPT_SECTION_NAME, OPT_MAC_NAME, OPT_MACOPT, OPT_VERIFY,
-    OPT_NO_LOG, OPT_CORRUPT_DESC, OPT_CORRUPT_TYPE, OPT_QUIET, OPT_CONFIG,
+    OPT_IN,
+    OPT_OUT,
+    OPT_MODULE,
+    OPT_PEDANTIC,
+    OPT_PROV_NAME,
+    OPT_SECTION_NAME,
+    OPT_MAC_NAME,
+    OPT_MACOPT,
+    OPT_VERIFY,
+    OPT_NO_LOG,
+    OPT_CORRUPT_DESC,
+    OPT_CORRUPT_TYPE,
+    OPT_QUIET,
+    OPT_CONFIG,
     OPT_NO_CONDITIONAL_ERRORS,
     OPT_NO_SECURITY_CHECKS,
-    OPT_TLS_PRF_EMS_CHECK, OPT_NO_SHORT_MAC,
-    OPT_DISALLOW_PKCS15_PADDING, OPT_RSA_PSS_SALTLEN_CHECK,
+    OPT_TLS_PRF_EMS_CHECK,
+    OPT_NO_SHORT_MAC,
+    OPT_DISALLOW_PKCS15_PADDING,
+    OPT_RSA_PSS_SALTLEN_CHECK,
     OPT_DISALLOW_SIGNATURE_X931_PADDING,
-    OPT_HMAC_KEY_CHECK, OPT_KMAC_KEY_CHECK,
+    OPT_HMAC_KEY_CHECK,
+    OPT_KMAC_KEY_CHECK,
     OPT_DISALLOW_DRGB_TRUNC_DIGEST,
     OPT_SIGNATURE_DIGEST_CHECK,
     OPT_HKDF_DIGEST_CHECK,
@@ -62,93 +76,94 @@ typedef enum OPTION_choice {
     OPT_X942KDF_KEY_CHECK,
     OPT_NO_PBKDF2_LOWER_BOUND_CHECK,
     OPT_ECDH_COFACTOR_CHECK,
-    OPT_SELF_TEST_ONLOAD, OPT_SELF_TEST_ONINSTALL
+    OPT_SELF_TEST_ONLOAD,
+    OPT_SELF_TEST_ONINSTALL
 } OPTION_CHOICE;
 
 const OPTIONS fipsinstall_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"pedantic", OPT_PEDANTIC, '-', "Set options for strict FIPS compliance"},
-    {"verify", OPT_VERIFY, '-',
-     "Verify a config file instead of generating one"},
-    {"module", OPT_MODULE, '<', "File name of the provider module"},
-    {"provider_name", OPT_PROV_NAME, 's', "FIPS provider name"},
-    {"section_name", OPT_SECTION_NAME, 's',
-     "FIPS Provider config section name (optional)"},
-    {"no_conditional_errors", OPT_NO_CONDITIONAL_ERRORS, '-',
-     "Disable the ability of the fips module to enter an error state if"
-     " any conditional self tests fail"},
-    {"no_security_checks", OPT_NO_SECURITY_CHECKS, '-',
-     "Disable the run-time FIPS security checks in the module"},
-    {"self_test_onload", OPT_SELF_TEST_ONLOAD, '-',
-     "Forces self tests to always run on module load"},
-    {"self_test_oninstall", OPT_SELF_TEST_ONINSTALL, '-',
-     "Forces self tests to run once on module installation"},
-    {"ems_check", OPT_TLS_PRF_EMS_CHECK, '-',
-     "Enable the run-time FIPS check for EMS during TLS1_PRF"},
-    {"no_short_mac", OPT_NO_SHORT_MAC, '-', "Disallow short MAC output"},
-    {"no_drbg_truncated_digests", OPT_DISALLOW_DRGB_TRUNC_DIGEST, '-',
-     "Disallow truncated digests with Hash and HMAC DRBGs"},
-    {"signature_digest_check", OPT_SIGNATURE_DIGEST_CHECK, '-',
-     "Enable checking for approved digests for signatures"},
-    {"hmac_key_check", OPT_HMAC_KEY_CHECK, '-', "Enable key check for HMAC"},
-    {"kmac_key_check", OPT_KMAC_KEY_CHECK, '-', "Enable key check for KMAC"},
-    {"hkdf_digest_check", OPT_HKDF_DIGEST_CHECK, '-',
-     "Enable digest check for HKDF"},
-    {"tls13_kdf_digest_check", OPT_TLS13_KDF_DIGEST_CHECK, '-',
-     "Enable digest check for TLS13-KDF"},
-    {"tls1_prf_digest_check", OPT_TLS1_PRF_DIGEST_CHECK, '-',
-     "Enable digest check for TLS1-PRF"},
-    {"sshkdf_digest_check", OPT_SSHKDF_DIGEST_CHECK, '-',
-     "Enable digest check for SSHKDF"},
-    {"sskdf_digest_check", OPT_SSKDF_DIGEST_CHECK, '-',
-     "Enable digest check for SSKDF"},
-    {"x963kdf_digest_check", OPT_X963KDF_DIGEST_CHECK, '-',
-     "Enable digest check for X963KDF"},
-    {"dsa_sign_disabled", OPT_DISALLOW_DSA_SIGN, '-',
-     "Disallow DSA signing"},
-    {"tdes_encrypt_disabled", OPT_DISALLOW_TDES_ENCRYPT, '-',
-     "Disallow Triple-DES encryption"},
-    {"rsa_pkcs15_padding_disabled", OPT_DISALLOW_PKCS15_PADDING, '-',
-     "Disallow PKCS#1 version 1.5 padding for RSA encryption"},
-    {"rsa_pss_saltlen_check", OPT_RSA_PSS_SALTLEN_CHECK, '-',
-     "Enable salt length check for RSA-PSS signature operations"},
-    {"rsa_sign_x931_disabled", OPT_DISALLOW_SIGNATURE_X931_PADDING, '-',
-     "Disallow X931 Padding for RSA signing"},
-    {"hkdf_key_check", OPT_HKDF_KEY_CHECK, '-',
-     "Enable key check for HKDF"},
-    {"kbkdf_key_check", OPT_KBKDF_KEY_CHECK, '-',
-     "Enable key check for KBKDF"},
-    {"tls13_kdf_key_check", OPT_TLS13_KDF_KEY_CHECK, '-',
-     "Enable key check for TLS13-KDF"},
-    {"tls1_prf_key_check", OPT_TLS1_PRF_KEY_CHECK, '-',
-     "Enable key check for TLS1-PRF"},
-    {"sshkdf_key_check", OPT_SSHKDF_KEY_CHECK, '-',
-     "Enable key check for SSHKDF"},
-    {"sskdf_key_check", OPT_SSKDF_KEY_CHECK, '-',
-     "Enable key check for SSKDF"},
-    {"x963kdf_key_check", OPT_X963KDF_KEY_CHECK, '-',
-     "Enable key check for X963KDF"},
-    {"x942kdf_key_check", OPT_X942KDF_KEY_CHECK, '-',
-     "Enable key check for X942KDF"},
-    {"no_pbkdf2_lower_bound_check", OPT_NO_PBKDF2_LOWER_BOUND_CHECK, '-',
-     "Disable lower bound check for PBKDF2"},
-    {"ecdh_cofactor_check", OPT_ECDH_COFACTOR_CHECK, '-',
-     "Enable Cofactor check for ECDH"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "pedantic", OPT_PEDANTIC, '-', "Set options for strict FIPS compliance" },
+    { "verify", OPT_VERIFY, '-',
+        "Verify a config file instead of generating one" },
+    { "module", OPT_MODULE, '<', "File name of the provider module" },
+    { "provider_name", OPT_PROV_NAME, 's', "FIPS provider name" },
+    { "section_name", OPT_SECTION_NAME, 's',
+        "FIPS Provider config section name (optional)" },
+    { "no_conditional_errors", OPT_NO_CONDITIONAL_ERRORS, '-',
+        "Disable the ability of the fips module to enter an error state if"
+        " any conditional self tests fail" },
+    { "no_security_checks", OPT_NO_SECURITY_CHECKS, '-',
+        "Disable the run-time FIPS security checks in the module" },
+    { "self_test_onload", OPT_SELF_TEST_ONLOAD, '-',
+        "Forces self tests to always run on module load" },
+    { "self_test_oninstall", OPT_SELF_TEST_ONINSTALL, '-',
+        "Forces self tests to run once on module installation" },
+    { "ems_check", OPT_TLS_PRF_EMS_CHECK, '-',
+        "Enable the run-time FIPS check for EMS during TLS1_PRF" },
+    { "no_short_mac", OPT_NO_SHORT_MAC, '-', "Disallow short MAC output" },
+    { "no_drbg_truncated_digests", OPT_DISALLOW_DRGB_TRUNC_DIGEST, '-',
+        "Disallow truncated digests with Hash and HMAC DRBGs" },
+    { "signature_digest_check", OPT_SIGNATURE_DIGEST_CHECK, '-',
+        "Enable checking for approved digests for signatures" },
+    { "hmac_key_check", OPT_HMAC_KEY_CHECK, '-', "Enable key check for HMAC" },
+    { "kmac_key_check", OPT_KMAC_KEY_CHECK, '-', "Enable key check for KMAC" },
+    { "hkdf_digest_check", OPT_HKDF_DIGEST_CHECK, '-',
+        "Enable digest check for HKDF" },
+    { "tls13_kdf_digest_check", OPT_TLS13_KDF_DIGEST_CHECK, '-',
+        "Enable digest check for TLS13-KDF" },
+    { "tls1_prf_digest_check", OPT_TLS1_PRF_DIGEST_CHECK, '-',
+        "Enable digest check for TLS1-PRF" },
+    { "sshkdf_digest_check", OPT_SSHKDF_DIGEST_CHECK, '-',
+        "Enable digest check for SSHKDF" },
+    { "sskdf_digest_check", OPT_SSKDF_DIGEST_CHECK, '-',
+        "Enable digest check for SSKDF" },
+    { "x963kdf_digest_check", OPT_X963KDF_DIGEST_CHECK, '-',
+        "Enable digest check for X963KDF" },
+    { "dsa_sign_disabled", OPT_DISALLOW_DSA_SIGN, '-',
+        "Disallow DSA signing" },
+    { "tdes_encrypt_disabled", OPT_DISALLOW_TDES_ENCRYPT, '-',
+        "Disallow Triple-DES encryption" },
+    { "rsa_pkcs15_padding_disabled", OPT_DISALLOW_PKCS15_PADDING, '-',
+        "Disallow PKCS#1 version 1.5 padding for RSA encryption" },
+    { "rsa_pss_saltlen_check", OPT_RSA_PSS_SALTLEN_CHECK, '-',
+        "Enable salt length check for RSA-PSS signature operations" },
+    { "rsa_sign_x931_disabled", OPT_DISALLOW_SIGNATURE_X931_PADDING, '-',
+        "Disallow X931 Padding for RSA signing" },
+    { "hkdf_key_check", OPT_HKDF_KEY_CHECK, '-',
+        "Enable key check for HKDF" },
+    { "kbkdf_key_check", OPT_KBKDF_KEY_CHECK, '-',
+        "Enable key check for KBKDF" },
+    { "tls13_kdf_key_check", OPT_TLS13_KDF_KEY_CHECK, '-',
+        "Enable key check for TLS13-KDF" },
+    { "tls1_prf_key_check", OPT_TLS1_PRF_KEY_CHECK, '-',
+        "Enable key check for TLS1-PRF" },
+    { "sshkdf_key_check", OPT_SSHKDF_KEY_CHECK, '-',
+        "Enable key check for SSHKDF" },
+    { "sskdf_key_check", OPT_SSKDF_KEY_CHECK, '-',
+        "Enable key check for SSKDF" },
+    { "x963kdf_key_check", OPT_X963KDF_KEY_CHECK, '-',
+        "Enable key check for X963KDF" },
+    { "x942kdf_key_check", OPT_X942KDF_KEY_CHECK, '-',
+        "Enable key check for X942KDF" },
+    { "no_pbkdf2_lower_bound_check", OPT_NO_PBKDF2_LOWER_BOUND_CHECK, '-',
+        "Disable lower bound check for PBKDF2" },
+    { "ecdh_cofactor_check", OPT_ECDH_COFACTOR_CHECK, '-',
+        "Enable Cofactor check for ECDH" },
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input config file, used when verifying"},
+    { "in", OPT_IN, '<', "Input config file, used when verifying" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output config file, used when generating"},
-    {"mac_name", OPT_MAC_NAME, 's', "MAC name"},
-    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form."},
-    {OPT_MORE_STR, 0, 0, "See 'PARAMETER NAMES' in the EVP_MAC_ docs"},
-    {"noout", OPT_NO_LOG, '-', "Disable logging of self test events"},
-    {"corrupt_desc", OPT_CORRUPT_DESC, 's', "Corrupt a self test by description"},
-    {"corrupt_type", OPT_CORRUPT_TYPE, 's', "Corrupt a self test by type"},
-    {"config", OPT_CONFIG, '<', "The parent config to verify"},
-    {"quiet", OPT_QUIET, '-', "No messages, just exit status"},
-    {NULL}
+    { "out", OPT_OUT, '>', "Output config file, used when generating" },
+    { "mac_name", OPT_MAC_NAME, 's', "MAC name" },
+    { "macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form." },
+    { OPT_MORE_STR, 0, 0, "See 'PARAMETER NAMES' in the EVP_MAC_ docs" },
+    { "noout", OPT_NO_LOG, '-', "Disable logging of self test events" },
+    { "corrupt_desc", OPT_CORRUPT_DESC, 's', "Corrupt a self test by description" },
+    { "corrupt_type", OPT_CORRUPT_TYPE, 's', "Corrupt a self test by type" },
+    { "config", OPT_CONFIG, '<', "The parent config to verify" },
+    { "quiet", OPT_QUIET, '-', "No messages, just exit status" },
+    { NULL }
 };
 
 typedef struct {
@@ -186,70 +201,70 @@ typedef struct {
 
 /* Pedantic FIPS compliance */
 static const FIPS_OPTS pedantic_opts = {
-    1,      /* self_test_onload */
-    1,      /* conditional_errors */
-    1,      /* security_checks */
-    1,      /* hmac_key_check */
-    1,      /* kmac_key_check */
-    1,      /* tls_prf_ems_check */
-    1,      /* no_short_mac */
-    1,      /* drgb_no_trunc_dgst */
-    1,      /* signature_digest_check */
-    1,      /* hkdf_digest_check */
-    1,      /* tls13_kdf_digest_check */
-    1,      /* tls1_prf_digest_check */
-    1,      /* sshkdf_digest_check */
-    1,      /* sskdf_digest_check */
-    1,      /* x963kdf_digest_check */
-    1,      /* dsa_sign_disabled */
-    1,      /* tdes_encrypt_disabled */
-    1,      /* rsa_pkcs15_padding_disabled */
-    1,      /* rsa_pss_saltlen_check */
-    1,      /* sign_x931_padding_disabled */
-    1,      /* hkdf_key_check */
-    1,      /* kbkdf_key_check */
-    1,      /* tls13_kdf_key_check */
-    1,      /* tls1_prf_key_check */
-    1,      /* sshkdf_key_check */
-    1,      /* sskdf_key_check */
-    1,      /* x963kdf_key_check */
-    1,      /* x942kdf_key_check */
-    1,      /* pbkdf2_lower_bound_check */
-    1,      /* ecdh_cofactor_check */
+    1, /* self_test_onload */
+    1, /* conditional_errors */
+    1, /* security_checks */
+    1, /* hmac_key_check */
+    1, /* kmac_key_check */
+    1, /* tls_prf_ems_check */
+    1, /* no_short_mac */
+    1, /* drgb_no_trunc_dgst */
+    1, /* signature_digest_check */
+    1, /* hkdf_digest_check */
+    1, /* tls13_kdf_digest_check */
+    1, /* tls1_prf_digest_check */
+    1, /* sshkdf_digest_check */
+    1, /* sskdf_digest_check */
+    1, /* x963kdf_digest_check */
+    1, /* dsa_sign_disabled */
+    1, /* tdes_encrypt_disabled */
+    1, /* rsa_pkcs15_padding_disabled */
+    1, /* rsa_pss_saltlen_check */
+    1, /* sign_x931_padding_disabled */
+    1, /* hkdf_key_check */
+    1, /* kbkdf_key_check */
+    1, /* tls13_kdf_key_check */
+    1, /* tls1_prf_key_check */
+    1, /* sshkdf_key_check */
+    1, /* sskdf_key_check */
+    1, /* x963kdf_key_check */
+    1, /* x942kdf_key_check */
+    1, /* pbkdf2_lower_bound_check */
+    1, /* ecdh_cofactor_check */
 };
 
 /* Default FIPS settings for backward compatibility */
 static FIPS_OPTS fips_opts = {
-    1,      /* self_test_onload */
-    1,      /* conditional_errors */
-    1,      /* security_checks */
-    0,      /* hmac_key_check */
-    0,      /* kmac_key_check */
-    0,      /* tls_prf_ems_check */
-    0,      /* no_short_mac */
-    0,      /* drgb_no_trunc_dgst */
-    0,      /* signature_digest_check */
-    0,      /* hkdf_digest_check */
-    0,      /* tls13_kdf_digest_check */
-    0,      /* tls1_prf_digest_check */
-    0,      /* sshkdf_digest_check */
-    0,      /* sskdf_digest_check */
-    0,      /* x963kdf_digest_check */
-    0,      /* dsa_sign_disabled */
-    0,      /* tdes_encrypt_disabled */
-    0,      /* rsa_pkcs15_padding_disabled */
-    0,      /* rsa_pss_saltlen_check */
-    0,      /* sign_x931_padding_disabled */
-    0,      /* hkdf_key_check */
-    0,      /* kbkdf_key_check */
-    0,      /* tls13_kdf_key_check */
-    0,      /* tls1_prf_key_check */
-    0,      /* sshkdf_key_check */
-    0,      /* sskdf_key_check */
-    0,      /* x963kdf_key_check */
-    0,      /* x942kdf_key_check */
-    1,      /* pbkdf2_lower_bound_check */
-    0,      /* ecdh_cofactor_check */
+    1, /* self_test_onload */
+    1, /* conditional_errors */
+    1, /* security_checks */
+    0, /* hmac_key_check */
+    0, /* kmac_key_check */
+    0, /* tls_prf_ems_check */
+    0, /* no_short_mac */
+    0, /* drgb_no_trunc_dgst */
+    0, /* signature_digest_check */
+    0, /* hkdf_digest_check */
+    0, /* tls13_kdf_digest_check */
+    0, /* tls1_prf_digest_check */
+    0, /* sshkdf_digest_check */
+    0, /* sskdf_digest_check */
+    0, /* x963kdf_digest_check */
+    0, /* dsa_sign_disabled */
+    0, /* tdes_encrypt_disabled */
+    0, /* rsa_pkcs15_padding_disabled */
+    0, /* rsa_pss_saltlen_check */
+    0, /* sign_x931_padding_disabled */
+    0, /* hkdf_key_check */
+    0, /* kbkdf_key_check */
+    0, /* tls13_kdf_key_check */
+    0, /* tls1_prf_key_check */
+    0, /* sshkdf_key_check */
+    0, /* sskdf_key_check */
+    0, /* x963kdf_key_check */
+    0, /* x942kdf_key_check */
+    1, /* pbkdf2_lower_bound_check */
+    0, /* ecdh_cofactor_check */
 };
 
 static int check_non_pedantic_fips(int pedantic, const char *name)
@@ -262,7 +277,7 @@ static int check_non_pedantic_fips(int pedantic, const char *name)
 }
 
 static int do_mac(EVP_MAC_CTX *ctx, unsigned char *tmp, BIO *in,
-                  unsigned char *out, size_t *out_len)
+    unsigned char *out, size_t *out_len)
 {
     int ret = 0;
     int i;
@@ -285,7 +300,7 @@ err:
 }
 
 static int load_fips_prov_and_run_self_test(const char *prov_name,
-                                            int *is_fips_140_2_prov)
+    int *is_fips_140_2_prov)
 {
     int ret = 0;
     OSSL_PROVIDER *prov = NULL;
@@ -299,11 +314,11 @@ static int load_fips_prov_and_run_self_test(const char *prov_name,
     }
     if (!quiet) {
         *p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_NAME,
-                                             &name, sizeof(name));
+            &name, sizeof(name));
         *p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_VERSION,
-                                             &vers, sizeof(vers));
+            &vers, sizeof(vers));
         *p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_BUILDINFO,
-                                             &build, sizeof(build));
+            &build, sizeof(build));
         *p = OSSL_PARAM_construct_end();
         if (!OSSL_PROVIDER_get_params(prov, params)) {
             BIO_printf(bio_err, "Failed to query FIPS module parameters\n");
@@ -317,7 +332,7 @@ static int load_fips_prov_and_run_self_test(const char *prov_name,
             BIO_printf(bio_err, "\t%-10s\t%s\n", "build:", build);
     } else {
         *p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_VERSION,
-                                             &vers, sizeof(vers));
+            &vers, sizeof(vers));
         *p = OSSL_PARAM_construct_end();
         if (!OSSL_PROVIDER_get_params(prov, params)) {
             BIO_printf(bio_err, "Failed to query FIPS module parameters\n");
@@ -332,7 +347,7 @@ end:
 }
 
 static int print_mac(BIO *bio, const char *label, const unsigned char *mac,
-                     size_t len)
+    size_t len)
 {
     int ret;
     char *hexstr = NULL;
@@ -346,13 +361,13 @@ static int print_mac(BIO *bio, const char *label, const unsigned char *mac,
 }
 
 static int write_config_header(BIO *out, const char *prov_name,
-                               const char *section)
+    const char *section)
 {
     return BIO_printf(out, "openssl_conf = openssl_init\n\n")
-           && BIO_printf(out, "[openssl_init]\n")
-           && BIO_printf(out, "providers = provider_section\n\n")
-           && BIO_printf(out, "[provider_section]\n")
-           && BIO_printf(out, "%s = %s\n\n", prov_name, section);
+        && BIO_printf(out, "[openssl_init]\n")
+        && BIO_printf(out, "providers = provider_section\n\n")
+        && BIO_printf(out, "[provider_section]\n")
+        && BIO_printf(out, "%s = %s\n\n", prov_name, section);
 }
 
 /*
@@ -363,96 +378,127 @@ static int write_config_header(BIO *out, const char *prov_name,
  * Returns 1 if the config file is written otherwise it returns 0 on error.
  */
 static int write_config_fips_section(BIO *out, const char *section,
-                                     unsigned char *module_mac,
-                                     size_t module_mac_len,
-                                     const FIPS_OPTS *opts,
-                                     unsigned char *install_mac,
-                                     size_t install_mac_len)
+    unsigned char *module_mac,
+    size_t module_mac_len,
+    const FIPS_OPTS *opts,
+    unsigned char *install_mac,
+    size_t install_mac_len)
 {
     int ret = 0;
 
     if (BIO_printf(out, "[%s]\n", section) <= 0
         || BIO_printf(out, "activate = 1\n") <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_VERSION,
-                      VERSION_VAL) <= 0
+               VERSION_VAL)
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_CONDITIONAL_ERRORS,
-                      opts->conditional_errors ? "1" : "0") <= 0
+               opts->conditional_errors ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SECURITY_CHECKS,
-                      opts->security_checks ? "1" : "0") <= 0
+               opts->security_checks ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HMAC_KEY_CHECK,
-                      opts->hmac_key_check ? "1": "0") <= 0
+               opts->hmac_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_KMAC_KEY_CHECK,
-                      opts->kmac_key_check ? "1": "0") <= 0
+               opts->kmac_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TLS1_PRF_EMS_CHECK,
-                      opts->tls_prf_ems_check ? "1" : "0") <= 0
+               opts->tls_prf_ems_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_NO_SHORT_MAC,
-                      opts->no_short_mac ? "1" : "0") <= 0
+               opts->no_short_mac ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_DRBG_TRUNC_DIGEST,
-                      opts->drgb_no_trunc_dgst ? "1" : "0") <= 0
+               opts->drgb_no_trunc_dgst ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SIGNATURE_DIGEST_CHECK,
-                      opts->signature_digest_check ? "1" : "0") <= 0
+               opts->signature_digest_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HKDF_DIGEST_CHECK,
-                      opts->hkdf_digest_check ? "1": "0") <= 0
+               opts->hkdf_digest_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_TLS13_KDF_DIGEST_CHECK,
-                      opts->tls13_kdf_digest_check ? "1": "0") <= 0
+               OSSL_PROV_PARAM_TLS13_KDF_DIGEST_CHECK,
+               opts->tls13_kdf_digest_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_TLS1_PRF_DIGEST_CHECK,
-                      opts->tls1_prf_digest_check ? "1": "0") <= 0
+               OSSL_PROV_PARAM_TLS1_PRF_DIGEST_CHECK,
+               opts->tls1_prf_digest_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_SSHKDF_DIGEST_CHECK,
-                      opts->sshkdf_digest_check ? "1": "0") <= 0
+               OSSL_PROV_PARAM_SSHKDF_DIGEST_CHECK,
+               opts->sshkdf_digest_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSKDF_DIGEST_CHECK,
-                      opts->sskdf_digest_check ? "1": "0") <= 0
+               opts->sskdf_digest_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_X963KDF_DIGEST_CHECK,
-                      opts->x963kdf_digest_check ? "1": "0") <= 0
+               OSSL_PROV_PARAM_X963KDF_DIGEST_CHECK,
+               opts->x963kdf_digest_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_DSA_SIGN_DISABLED,
-                      opts->dsa_sign_disabled ? "1" : "0") <= 0
+               opts->dsa_sign_disabled ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TDES_ENCRYPT_DISABLED,
-                      opts->tdes_encrypt_disabled ? "1" : "0") <= 0
+               opts->tdes_encrypt_disabled ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_RSA_PKCS15_PAD_DISABLED,
-                      opts->rsa_pkcs15_padding_disabled ? "1" : "0") <= 0
+               OSSL_PROV_PARAM_RSA_PKCS15_PAD_DISABLED,
+               opts->rsa_pkcs15_padding_disabled ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_RSA_PSS_SALTLEN_CHECK,
-                      opts->rsa_pss_saltlen_check ? "1" : "0") <= 0
+               OSSL_PROV_PARAM_RSA_PSS_SALTLEN_CHECK,
+               opts->rsa_pss_saltlen_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_RSA_SIGN_X931_PAD_DISABLED,
-                      opts->sign_x931_padding_disabled ? "1" : "0") <= 0
+               OSSL_PROV_PARAM_RSA_SIGN_X931_PAD_DISABLED,
+               opts->sign_x931_padding_disabled ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HKDF_KEY_CHECK,
-                      opts->hkdf_key_check ? "1": "0") <= 0
+               opts->hkdf_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_KBKDF_KEY_CHECK,
-                      opts->kbkdf_key_check ? "1": "0") <= 0
+               opts->kbkdf_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_TLS13_KDF_KEY_CHECK,
-                      opts->tls13_kdf_key_check ? "1": "0") <= 0
+               OSSL_PROV_PARAM_TLS13_KDF_KEY_CHECK,
+               opts->tls13_kdf_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TLS1_PRF_KEY_CHECK,
-                      opts->tls1_prf_key_check ? "1": "0") <= 0
+               opts->tls1_prf_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSHKDF_KEY_CHECK,
-                      opts->sshkdf_key_check ? "1": "0") <= 0
+               opts->sshkdf_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSKDF_KEY_CHECK,
-                      opts->sskdf_key_check ? "1": "0") <= 0
+               opts->sskdf_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X963KDF_KEY_CHECK,
-                      opts->x963kdf_key_check ? "1": "0") <= 0
+               opts->x963kdf_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X942KDF_KEY_CHECK,
-                      opts->x942kdf_key_check ? "1": "0") <= 0
+               opts->x942kdf_key_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n",
-                      OSSL_PROV_PARAM_PBKDF2_LOWER_BOUND_CHECK,
-                      opts->pbkdf2_lower_bound_check ? "1" : "0") <= 0
+               OSSL_PROV_PARAM_PBKDF2_LOWER_BOUND_CHECK,
+               opts->pbkdf2_lower_bound_check ? "1" : "0")
+            <= 0
         || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_ECDH_COFACTOR_CHECK,
-                      opts->ecdh_cofactor_check ? "1": "0") <= 0
+               opts->ecdh_cofactor_check ? "1" : "0")
+            <= 0
         || !print_mac(out, OSSL_PROV_FIPS_PARAM_MODULE_MAC, module_mac,
-                      module_mac_len))
+            module_mac_len))
         goto end;
 
     if (install_mac != NULL
-            && install_mac_len > 0
-            && opts->self_test_onload == 0) {
+        && install_mac_len > 0
+        && opts->self_test_onload == 0) {
         if (!print_mac(out, OSSL_PROV_FIPS_PARAM_INSTALL_MAC, install_mac,
-                       install_mac_len)
+                install_mac_len)
             || BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
-                          INSTALL_STATUS_VAL) <= 0)
+                   INSTALL_STATUS_VAL)
+                <= 0)
             goto end;
     }
     ret = 1;
@@ -461,10 +507,10 @@ end:
 }
 
 static CONF *generate_config_and_load(const char *prov_name,
-                                      const char *section,
-                                      unsigned char *module_mac,
-                                      size_t module_mac_len,
-                                      const FIPS_OPTS *opts)
+    const char *section,
+    unsigned char *module_mac,
+    size_t module_mac_len,
+    const FIPS_OPTS *opts)
 {
     BIO *mem_bio = NULL;
     CONF *conf = NULL;
@@ -474,8 +520,8 @@ static CONF *generate_config_and_load(const char *prov_name,
         return 0;
     if (!write_config_header(mem_bio, prov_name, section)
         || !write_config_fips_section(mem_bio, section,
-                                      module_mac, module_mac_len,
-                                      opts, NULL, 0))
+            module_mac, module_mac_len,
+            opts, NULL, 0))
         goto end;
 
     conf = app_load_config_bio(mem_bio, NULL);
@@ -510,8 +556,8 @@ static int verify_module_load(const char *parent_config_file)
  * install_mac values, otherwise it returns 0.
  */
 static int verify_config(const char *infile, const char *section,
-                         unsigned char *module_mac, size_t module_mac_len,
-                         unsigned char *install_mac, size_t install_mac_len)
+    unsigned char *module_mac, size_t module_mac_len,
+    unsigned char *install_mac, size_t install_mac_len)
 {
     int ret = 0;
     char *s = NULL;
@@ -536,8 +582,8 @@ static int verify_config(const char *infile, const char *section,
     }
     buf1 = OPENSSL_hexstr2buf(s, &len);
     if (buf1 == NULL
-            || (size_t)len != module_mac_len
-            || memcmp(module_mac, buf1, module_mac_len) != 0) {
+        || (size_t)len != module_mac_len
+        || memcmp(module_mac, buf1, module_mac_len) != 0) {
         BIO_printf(bio_err, "Module integrity mismatch\n");
         goto end;
     }
@@ -554,8 +600,8 @@ static int verify_config(const char *infile, const char *section,
         }
         buf2 = OPENSSL_hexstr2buf(s, &len);
         if (buf2 == NULL
-                || (size_t)len != install_mac_len
-                || memcmp(install_mac, buf2, install_mac_len) != 0) {
+            || (size_t)len != install_mac_len
+            || memcmp(install_mac, buf2, install_mac_len) != 0) {
             BIO_printf(bio_err, "Install indicator status mismatch\n");
             goto end;
         }
@@ -598,7 +644,7 @@ int fipsinstall_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto cleanup;
         case OPT_HELP:
@@ -773,7 +819,7 @@ int fipsinstall_main(int argc, char **argv)
             ret = OSSL_PROVIDER_available(NULL, prov_name) ? 0 : 1;
             if (!quiet) {
                 BIO_printf(bio_err, "FIPS provider is %s\n",
-                           ret == 0 ? "available" : "not available");
+                    ret == 0 ? "available" : "not available");
             }
         }
         goto end;
@@ -792,8 +838,8 @@ int fipsinstall_main(int argc, char **argv)
     }
 
     if (self_test_log
-            || self_test_corrupt_desc != NULL
-            || self_test_corrupt_type != NULL)
+        || self_test_corrupt_desc != NULL
+        || self_test_corrupt_type != NULL)
         OSSL_SELF_TEST_set_callback(NULL, self_test_events, NULL);
 
     /* Use the default FIPS HMAC digest and key if not specified. */
@@ -826,8 +872,7 @@ int fipsinstall_main(int argc, char **argv)
 
     if (opts != NULL) {
         int ok = 1;
-        OSSL_PARAM *params =
-            app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac));
+        OSSL_PARAM *params = app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac));
 
         if (params == NULL)
             goto end;
@@ -853,7 +898,7 @@ int fipsinstall_main(int argc, char **argv)
 
     /* Calculate the MAC for the indicator status - it may not be used */
     mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
-                              strlen(INSTALL_STATUS_VAL));
+        strlen(INSTALL_STATUS_VAL));
     if (mem_bio == NULL) {
         BIO_printf(bio_err, "Unable to create memory BIO\n");
         goto end;
@@ -865,13 +910,13 @@ int fipsinstall_main(int argc, char **argv)
         if (fips_opts.self_test_onload == 1)
             install_mac_len = 0;
         if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
-                           install_mac, install_mac_len))
+                install_mac, install_mac_len))
             goto end;
         if (!quiet)
             BIO_printf(bio_err, "VERIFY PASSED\n");
     } else {
         conf = generate_config_and_load(prov_name, section_name, module_mac,
-                                        module_mac_len, &fips_opts);
+            module_mac_len, &fips_opts);
         if (conf == NULL)
             goto end;
         if (!load_fips_prov_and_run_self_test(prov_name, &is_fips_140_2_prov))
@@ -888,17 +933,16 @@ int fipsinstall_main(int argc, char **argv)
         if (set_selftest_onload_option == 0 && is_fips_140_2_prov)
             fips_opts.self_test_onload = 0;
 
-        fout =
-            out_fname == NULL ? dup_bio_out(FORMAT_TEXT)
-                              : bio_open_default(out_fname, 'w', FORMAT_TEXT);
+        fout = out_fname == NULL ? dup_bio_out(FORMAT_TEXT)
+                                 : bio_open_default(out_fname, 'w', FORMAT_TEXT);
         if (fout == NULL) {
             BIO_printf(bio_err, "Failed to open file\n");
             goto end;
         }
 
         if (!write_config_fips_section(fout, section_name,
-                                       module_mac, module_mac_len, &fips_opts,
-                                       install_mac, install_mac_len))
+                module_mac, module_mac_len, &fips_opts,
+                install_mac, install_mac_len))
             goto end;
         if (!quiet)
             BIO_printf(bio_err, "INSTALL PASSED\n");
@@ -951,7 +995,7 @@ static int self_test_events(const OSSL_PARAM params[], void *arg)
         if (strcmp(phase, OSSL_SELF_TEST_PHASE_START) == 0)
             BIO_printf(bio_err, "%s : (%s) : ", desc, type);
         else if (strcmp(phase, OSSL_SELF_TEST_PHASE_PASS) == 0
-                 || strcmp(phase, OSSL_SELF_TEST_PHASE_FAIL) == 0)
+            || strcmp(phase, OSSL_SELF_TEST_PHASE_FAIL) == 0)
             BIO_printf(bio_err, "%s\n", phase);
     }
     /*
@@ -959,13 +1003,13 @@ static int self_test_events(const OSSL_PARAM params[], void *arg)
      * error is returned during the corrupt phase.
      */
     if (strcmp(phase, OSSL_SELF_TEST_PHASE_CORRUPT) == 0
-            && (self_test_corrupt_desc != NULL
-                || self_test_corrupt_type != NULL)) {
+        && (self_test_corrupt_desc != NULL
+            || self_test_corrupt_type != NULL)) {
         if (self_test_corrupt_desc != NULL
-                && strcmp(self_test_corrupt_desc, desc) != 0)
+            && strcmp(self_test_corrupt_desc, desc) != 0)
             goto end;
         if (self_test_corrupt_type != NULL
-                && strcmp(self_test_corrupt_type, type) != 0)
+            && strcmp(self_test_corrupt_type, type) != 0)
             goto end;
         BIO_printf(bio_err, "%s ", phase);
         goto err;
diff --git a/crypto/openssl/apps/gendsa.c b/crypto/openssl/apps/gendsa.c
index a655c6ea02b2..f0f8c383dc3e 100644
--- a/crypto/openssl/apps/gendsa.c
+++ b/crypto/openssl/apps/gendsa.c
@@ -24,31 +24,37 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_CIPHER, OPT_VERBOSE, OPT_QUIET,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_OUT,
+    OPT_PASSOUT,
+    OPT_ENGINE,
+    OPT_CIPHER,
+    OPT_VERBOSE,
+    OPT_QUIET,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS gendsa_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] dsaparam-file\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] dsaparam-file\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output the key to the specified file"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
+    { "out", OPT_OUT, '>', "Output the key to the specified file" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
-    {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
-    {"verbose", OPT_VERBOSE, '-', "Verbose output"},
-    {"quiet", OPT_QUIET, '-', "Terse output"},
+    { "", OPT_CIPHER, '-', "Encrypt the output with any supported cipher" },
+    { "verbose", OPT_VERBOSE, '-', "Verbose output" },
+    { "quiet", OPT_QUIET, '-', "Terse output" },
 
     OPT_PARAMETERS(),
-    {"dsaparam-file", 0, 0, "File containing DSA parameters"},
-    {NULL}
+    { "dsaparam-file", 0, 0, "File containing DSA parameters" },
+    { NULL }
 };
 
 int gendsa_main(int argc, char **argv)
@@ -69,7 +75,7 @@ int gendsa_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -132,9 +138,9 @@ int gendsa_main(int argc, char **argv)
     nbits = EVP_PKEY_get_bits(pkey);
     if (nbits > OPENSSL_DSA_MAX_MODULUS_BITS)
         BIO_printf(bio_err,
-                   "Warning: It is not recommended to use more than %d bit for DSA keys.\n"
-                   "         Your key size is %d! Larger key size may behave not as expected.\n",
-                   OPENSSL_DSA_MAX_MODULUS_BITS, EVP_PKEY_get_bits(pkey));
+            "Warning: It is not recommended to use more than %d bit for DSA keys.\n"
+            "         Your key size is %d! Larger key size may behave not as expected.\n",
+            OPENSSL_DSA_MAX_MODULUS_BITS, EVP_PKEY_get_bits(pkey));
 
     ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey, app_get0_propq());
     if (ctx == NULL) {
@@ -157,10 +163,10 @@ int gendsa_main(int argc, char **argv)
         goto end;
     }
     ret = 0;
- end:
+end:
     if (ret != 0)
         ERR_print_errors(bio_err);
- end2:
+end2:
     BIO_free(in);
     BIO_free_all(out);
     EVP_PKEY_free(pkey);
diff --git a/crypto/openssl/apps/genpkey.c b/crypto/openssl/apps/genpkey.c
index b37a1526b441..50d088126f38 100644
--- a/crypto/openssl/apps/genpkey.c
+++ b/crypto/openssl/apps/genpkey.c
@@ -18,45 +18,57 @@
 static int verbose = 1;
 
 static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e,
-                            OSSL_LIB_CTX *libctx, const char *propq);
+    OSSL_LIB_CTX *libctx, const char *propq);
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE,
-    OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER,
-    OPT_VERBOSE, OPT_QUIET, OPT_CONFIG, OPT_OUTPUBKEY,
-    OPT_PROV_ENUM, OPT_R_ENUM
+    OPT_ENGINE,
+    OPT_OUTFORM,
+    OPT_OUT,
+    OPT_PASS,
+    OPT_PARAMFILE,
+    OPT_ALGORITHM,
+    OPT_PKEYOPT,
+    OPT_GENPARAM,
+    OPT_TEXT,
+    OPT_CIPHER,
+    OPT_VERBOSE,
+    OPT_QUIET,
+    OPT_CONFIG,
+    OPT_OUTPUBKEY,
+    OPT_PROV_ENUM,
+    OPT_R_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS genpkey_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
-    {"paramfile", OPT_PARAMFILE, '<', "Parameters file"},
-    {"algorithm", OPT_ALGORITHM, 's', "The public key algorithm"},
-    {"verbose", OPT_VERBOSE, '-', "Output status while generating keys"},
-    {"quiet", OPT_QUIET, '-', "Do not output status while generating keys"},
-    {"pkeyopt", OPT_PKEYOPT, 's',
-     "Set the public key algorithm option as opt:value"},
-     OPT_CONFIG_OPTION,
+    { "paramfile", OPT_PARAMFILE, '<', "Parameters file" },
+    { "algorithm", OPT_ALGORITHM, 's', "The public key algorithm" },
+    { "verbose", OPT_VERBOSE, '-', "Output status while generating keys" },
+    { "quiet", OPT_QUIET, '-', "Do not output status while generating keys" },
+    { "pkeyopt", OPT_PKEYOPT, 's',
+        "Set the public key algorithm option as opt:value" },
+    OPT_CONFIG_OPTION,
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output (private key) file"},
-    {"outpubkey", OPT_OUTPUBKEY, '>', "Output public key file"},
-    {"outform", OPT_OUTFORM, 'F', "output format (DER or PEM)"},
-    {"pass", OPT_PASS, 's', "Output file pass phrase source"},
-    {"genparam", OPT_GENPARAM, '-', "Generate parameters, not key"},
-    {"text", OPT_TEXT, '-', "Print the private key in text"},
-    {"", OPT_CIPHER, '-', "Cipher to use to encrypt the key"},
+    { "out", OPT_OUT, '>', "Output (private key) file" },
+    { "outpubkey", OPT_OUTPUBKEY, '>', "Output public key file" },
+    { "outform", OPT_OUTFORM, 'F', "output format (DER or PEM)" },
+    { "pass", OPT_PASS, 's', "Output file pass phrase source" },
+    { "genparam", OPT_GENPARAM, '-', "Generate parameters, not key" },
+    { "text", OPT_TEXT, '-', "Print the private key in text" },
+    { "", OPT_CIPHER, '-', "Cipher to use to encrypt the key" },
 
     OPT_PROV_OPTIONS,
     OPT_R_OPTIONS,
 
     /* This is deliberately last. */
-    {OPT_HELP_STR, 1, 1,
-     "Order of options may be important!  See the documentation.\n"},
-    {NULL}
+    { OPT_HELP_STR, 1, 1,
+        "Order of options may be important!  See the documentation.\n" },
+    { NULL }
 };
 
 static const char *param_datatype_2name(unsigned int type, int *ishex)
@@ -64,11 +76,17 @@ static const char *param_datatype_2name(unsigned int type, int *ishex)
     *ishex = 0;
 
     switch (type) {
-    case OSSL_PARAM_INTEGER: return "int";
-    case OSSL_PARAM_UNSIGNED_INTEGER: return "uint";
-    case OSSL_PARAM_REAL: return "float";
-    case OSSL_PARAM_OCTET_STRING: *ishex = 1; return "string";
-    case OSSL_PARAM_UTF8_STRING: return "string";
+    case OSSL_PARAM_INTEGER:
+        return "int";
+    case OSSL_PARAM_UNSIGNED_INTEGER:
+        return "uint";
+    case OSSL_PARAM_REAL:
+        return "float";
+    case OSSL_PARAM_OCTET_STRING:
+        *ishex = 1;
+        return "string";
+    case OSSL_PARAM_UTF8_STRING:
+        return "string";
     default:
         return NULL;
     }
@@ -129,7 +147,7 @@ int genpkey_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -294,7 +312,7 @@ int genpkey_main(int argc, char **argv)
         }
     }
 
- end:
+end:
     sk_OPENSSL_STRING_free(keyopt);
     if (ret != 0) {
         ERR_print_errors(bio_err);
@@ -303,13 +321,13 @@ int genpkey_main(int argc, char **argv)
             rv = mem_bio_to_file(mem_outpubkey, outpubkeyfile, outformat, private);
             if (!rv)
                 BIO_printf(bio_err, "Error writing to outpubkey: '%s'. Error: %s\n",
-                           outpubkeyfile, strerror(errno));
+                    outpubkeyfile, strerror(errno));
         }
         if (mem_out != NULL) {
             rv = mem_bio_to_file(mem_out, outfile, outformat, private);
             if (!rv)
                 BIO_printf(bio_err, "Error writing to outfile: '%s'. Error: %s\n",
-                           outfile, strerror(errno));
+                    outfile, strerror(errno));
         }
     }
     EVP_PKEY_free(pkey);
@@ -324,7 +342,7 @@ int genpkey_main(int argc, char **argv)
 }
 
 static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e,
-                            OSSL_LIB_CTX *libctx, const char *propq)
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     BIO *pbio;
     EVP_PKEY *pkey = NULL;
@@ -360,18 +378,17 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e,
     *pctx = ctx;
     return 1;
 
- err:
+err:
     BIO_puts(bio_err, "Error initializing context\n");
     ERR_print_errors(bio_err);
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(pkey);
     return 0;
-
 }
 
 int init_gen_str(EVP_PKEY_CTX **pctx,
-                 const char *algname, ENGINE *e, int do_param,
-                 OSSL_LIB_CTX *libctx, const char *propq)
+    const char *algname, ENGINE *e, int do_param,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     EVP_PKEY_CTX *ctx = NULL;
     int pkey_id;
@@ -400,11 +417,9 @@ int init_gen_str(EVP_PKEY_CTX **pctx,
     *pctx = ctx;
     return 1;
 
- err:
+err:
     BIO_printf(bio_err, "Error initializing %s context\n", algname);
     ERR_print_errors(bio_err);
     EVP_PKEY_CTX_free(ctx);
     return 0;
-
 }
-
diff --git a/crypto/openssl/apps/genrsa.c b/crypto/openssl/apps/genrsa.c
index 54d025e24c2c..3dce82beca15 100644
--- a/crypto/openssl/apps/genrsa.c
+++ b/crypto/openssl/apps/genrsa.c
@@ -34,43 +34,51 @@ typedef enum OPTION_choice {
 #ifndef OPENSSL_NO_DEPRECATED_3_0
     OPT_3,
 #endif
-    OPT_F4, OPT_ENGINE,
-    OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE, OPT_QUIET,
-    OPT_R_ENUM, OPT_PROV_ENUM, OPT_TRADITIONAL
+    OPT_F4,
+    OPT_ENGINE,
+    OPT_OUT,
+    OPT_PASSOUT,
+    OPT_CIPHER,
+    OPT_PRIMES,
+    OPT_VERBOSE,
+    OPT_QUIET,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM,
+    OPT_TRADITIONAL
 } OPTION_CHOICE;
 
 const OPTIONS genrsa_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] numbits\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] numbits\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
 #ifndef OPENSSL_NO_DEPRECATED_3_0
-    {"3", OPT_3, '-', "(deprecated) Use 3 for the E value"},
+    { "3", OPT_3, '-', "(deprecated) Use 3 for the E value" },
 #endif
-    {"F4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"},
-    {"f4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"},
+    { "F4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value" },
+    { "f4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output the key to specified file"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
-    {"primes", OPT_PRIMES, 'p', "Specify number of primes"},
-    {"verbose", OPT_VERBOSE, '-', "Verbose output"},
-    {"quiet", OPT_QUIET, '-', "Terse output"},
-    {"traditional", OPT_TRADITIONAL, '-',
-     "Use traditional format for private keys"},
-    {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
+    { "out", OPT_OUT, '>', "Output the key to specified file" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
+    { "primes", OPT_PRIMES, 'p', "Specify number of primes" },
+    { "verbose", OPT_VERBOSE, '-', "Verbose output" },
+    { "quiet", OPT_QUIET, '-', "Terse output" },
+    { "traditional", OPT_TRADITIONAL, '-',
+        "Use traditional format for private keys" },
+    { "", OPT_CIPHER, '-', "Encrypt the output with any supported cipher" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"numbits", 0, 0, "Size of key in bits"},
-    {NULL}
+    { "numbits", 0, 0, "Size of key in bits" },
+    { NULL }
 };
 
 int genrsa_main(int argc, char **argv)
@@ -98,7 +106,7 @@ int genrsa_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
-opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -157,9 +165,9 @@ opthelp:
             goto end;
         if (num > OPENSSL_RSA_MAX_MODULUS_BITS)
             BIO_printf(bio_err,
-                       "Warning: It is not recommended to use more than %d bit for RSA keys.\n"
-                       "         Your key size is %d! Larger key size may behave not as expected.\n",
-                       OPENSSL_RSA_MAX_MODULUS_BITS, num);
+                "Warning: It is not recommended to use more than %d bit for RSA keys.\n"
+                "         Your key size is %d! Larger key size may behave not as expected.\n",
+                OPENSSL_RSA_MAX_MODULUS_BITS, num);
     } else if (!opt_check_rest_arg(NULL)) {
         goto opthelp;
     }
@@ -180,7 +188,7 @@ opthelp:
         goto end;
 
     if (!init_gen_str(&ctx, "RSA", eng, 0, app_get0_libctx(),
-                      app_get0_propq()))
+            app_get0_propq()))
         goto end;
 
     if (verbose)
@@ -227,7 +235,7 @@ opthelp:
     }
     if (traditional) {
         if (!PEM_write_bio_PrivateKey_traditional(out, pkey, enc, NULL, 0,
-                                                  NULL, passout))
+                NULL, passout))
             goto end;
     } else {
         if (!PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, passout))
@@ -235,7 +243,7 @@ opthelp:
     }
 
     ret = 0;
- end:
+end:
     BN_free(bn);
     BN_GENCB_free(cb);
     EVP_PKEY_CTX_free(ctx);
@@ -248,4 +256,3 @@ opthelp:
         ERR_print_errors(bio_err);
     return ret;
 }
-
diff --git a/crypto/openssl/apps/include/app_libctx.h b/crypto/openssl/apps/include/app_libctx.h
index 17c0afc713d2..b7157cec4058 100644
--- a/crypto/openssl/apps/include/app_libctx.h
+++ b/crypto/openssl/apps/include/app_libctx.h
@@ -8,9 +8,9 @@
  */
 
 #ifndef OSSL_APPS_LIBCTX_H
-# define OSSL_APPS_LIBCTX_H
+#define OSSL_APPS_LIBCTX_H
 
-# include <openssl/types.h>
+#include <openssl/types.h>
 
 OSSL_LIB_CTX *app_create_libctx(void);
 OSSL_LIB_CTX *app_get0_libctx(void);
diff --git a/crypto/openssl/apps/include/app_params.h b/crypto/openssl/apps/include/app_params.h
index 79f8f58b3122..20caf737d4da 100644
--- a/crypto/openssl/apps/include/app_params.h
+++ b/crypto/openssl/apps/include/app_params.h
@@ -11,4 +11,3 @@
 
 int print_param_types(const char *thing, const OSSL_PARAM *pdefs, int indent);
 void print_param_value(const OSSL_PARAM *p, int indent);
-
diff --git a/crypto/openssl/apps/include/apps.h b/crypto/openssl/apps/include/apps.h
index 026cbfe7aecd..06ba38a5851e 100644
--- a/crypto/openssl/apps/include/apps.h
+++ b/crypto/openssl/apps/include/apps.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -8,42 +8,42 @@
  */
 
 #ifndef OSSL_APPS_H
-# define OSSL_APPS_H
+#define OSSL_APPS_H
 
-# include "internal/common.h" /* for HAS_PREFIX */
-# include "internal/nelem.h"
-# include <assert.h>
+#include "internal/common.h" /* for HAS_PREFIX */
+#include "internal/nelem.h"
+#include <assert.h>
 
-# include <stdarg.h>
-# include <sys/types.h>
-# ifndef OPENSSL_NO_POSIX_IO
-#  include <sys/stat.h>
-#  include <fcntl.h>
-# endif
+#include <stdarg.h>
+#include <sys/types.h>
+#ifndef OPENSSL_NO_POSIX_IO
+#include <sys/stat.h>
+#include <fcntl.h>
+#endif
 
-# include <openssl/e_os2.h>
-# include <openssl/types.h>
-# include <openssl/bio.h>
-# include <openssl/x509.h>
-# include <openssl/conf.h>
-# include <openssl/txt_db.h>
-# include <openssl/engine.h>
-# include <openssl/ocsp.h>
-# include <openssl/http.h>
-# include <signal.h>
-# include "apps_ui.h"
-# include "opt.h"
-# include "fmt.h"
-# include "platform.h"
-# include "engine_loader.h"
-# include "app_libctx.h"
+#include <openssl/e_os2.h>
+#include <openssl/types.h>
+#include <openssl/bio.h>
+#include <openssl/x509.h>
+#include <openssl/conf.h>
+#include <openssl/txt_db.h>
+#include <openssl/engine.h>
+#include <openssl/ocsp.h>
+#include <openssl/http.h>
+#include <signal.h>
+#include "apps_ui.h"
+#include "opt.h"
+#include "fmt.h"
+#include "platform.h"
+#include "engine_loader.h"
+#include "app_libctx.h"
 
 /*
  * quick macro when you need to pass an unsigned char instead of a char.
  * this is true for some implementations of the is*() functions, for
  * example.
  */
-# define _UC(c) ((unsigned char)(c))
+#define _UC(c) ((unsigned char)(c))
 
 void app_RAND_load_conf(CONF *c, const char *section);
 int app_RAND_write(void);
@@ -66,30 +66,30 @@ BIO *bio_open_default_quiet(const char *filename, char mode, int format);
 int mem_bio_to_file(BIO *in, const char *filename, int format, int private);
 char *app_conf_try_string(const CONF *cnf, const char *group, const char *name);
 int app_conf_try_number(const CONF *conf, const char *group, const char *name,
-                        long *result);
+    long *result);
 CONF *app_load_config_bio(BIO *in, const char *filename);
-# define app_load_config(filename) app_load_config_internal(filename, 0)
-# define app_load_config_quiet(filename) app_load_config_internal(filename, 1)
+#define app_load_config(filename) app_load_config_internal(filename, 0)
+#define app_load_config_quiet(filename) app_load_config_internal(filename, 1)
 CONF *app_load_config_internal(const char *filename, int quiet);
 CONF *app_load_config_verbose(const char *filename, int verbose);
 int app_load_modules(const CONF *config);
 CONF *app_load_config_modules(const char *configfile);
 void unbuffer(FILE *fp);
 void wait_for_async(SSL *s);
-# if defined(OPENSSL_SYS_MSDOS)
+#if defined(OPENSSL_SYS_MSDOS)
 int has_stdin_waiting(void);
-# endif
+#endif
 
 void corrupt_signature(const ASN1_STRING *signature);
 
 /* Helpers for setting X509v3 certificate fields notBefore and notAfter */
 int check_cert_time_string(const char *time, const char *desc);
 int set_cert_times(X509 *x, const char *startdate, const char *enddate,
-                   int days, int strict_compare_times);
+    int days, int strict_compare_times);
 
 int set_crl_lastupdate(X509_CRL *crl, const char *lastupdate);
 int set_crl_nextupdate(X509_CRL *crl, const char *nextupdate,
-                       long days, long hours, long secs);
+    long days, long hours, long secs);
 
 typedef struct args_st {
     int size;
@@ -106,7 +106,7 @@ int progress_cb(EVP_PKEY_CTX *ctx);
 void dump_cert_text(BIO *out, X509 *x);
 void print_name(BIO *out, const char *title, const X509_NAME *nm);
 void print_bignum_var(BIO *, const BIGNUM *, const char *,
-                      int, unsigned char *);
+    int, unsigned char *);
 void print_array(BIO *, const char *, int, const unsigned char *);
 int set_nameopt(const char *arg);
 unsigned long get_nameopt(void);
@@ -120,52 +120,52 @@ int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2);
 int add_oid_section(CONF *conf);
 X509_REQ *load_csr(const char *file, int format, const char *desc);
 X509_REQ *load_csr_autofmt(const char *infile, int format,
-                           STACK_OF(OPENSSL_STRING) *vfyopts, const char *desc);
+    STACK_OF(OPENSSL_STRING) *vfyopts, const char *desc);
 X509 *load_cert_pass(const char *uri, int format, int maybe_stdin,
-                     const char *pass, const char *desc);
-# define load_cert(uri, format, desc) load_cert_pass(uri, format, 1, NULL, desc)
+    const char *pass, const char *desc);
+#define load_cert(uri, format, desc) load_cert_pass(uri, format, 1, NULL, desc)
 X509_CRL *load_crl(const char *uri, int format, int maybe_stdin,
-                   const char *desc);
+    const char *desc);
 void cleanse(char *str);
 void clear_free(char *str);
 EVP_PKEY *load_key(const char *uri, int format, int maybe_stdin,
-                   const char *pass, ENGINE *e, const char *desc);
+    const char *pass, ENGINE *e, const char *desc);
 /* first try reading public key, on failure resort to loading private key */
 EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin,
-                      const char *pass, ENGINE *e, const char *desc);
+    const char *pass, ENGINE *e, const char *desc);
 EVP_PKEY *load_keyparams(const char *uri, int format, int maybe_stdin,
-                         const char *keytype, const char *desc);
+    const char *keytype, const char *desc);
 EVP_PKEY *load_keyparams_suppress(const char *uri, int format, int maybe_stdin,
-                                  const char *keytype, const char *desc,
-                                  int suppress_decode_errors);
+    const char *keytype, const char *desc,
+    int suppress_decode_errors);
 char *next_item(char *opt); /* in list separated by comma and/or space */
 int load_cert_certs(const char *uri,
-                    X509 **pcert, STACK_OF(X509) **pcerts,
-                    int exclude_http, const char *pass, const char *desc,
-                    X509_VERIFY_PARAM *vpm);
+    X509 **pcert, STACK_OF(X509) **pcerts,
+    int exclude_http, const char *pass, const char *desc,
+    X509_VERIFY_PARAM *vpm);
 STACK_OF(X509) *load_certs_multifile(char *files, const char *pass,
-                                     const char *desc, X509_VERIFY_PARAM *vpm);
+    const char *desc, X509_VERIFY_PARAM *vpm);
 X509_STORE *load_certstore(char *input, const char *pass, const char *desc,
-                           X509_VERIFY_PARAM *vpm);
+    X509_VERIFY_PARAM *vpm);
 int load_certs(const char *uri, int maybe_stdin, STACK_OF(X509) **certs,
-               const char *pass, const char *desc);
+    const char *pass, const char *desc);
 int load_crls(const char *uri, STACK_OF(X509_CRL) **crls,
-              const char *pass, const char *desc);
+    const char *pass, const char *desc);
 int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
-                        const char *pass, const char *desc, int quiet,
-                        EVP_PKEY **ppkey, EVP_PKEY **ppubkey,
-                        EVP_PKEY **pparams,
-                        X509 **pcert, STACK_OF(X509) **pcerts,
-                        X509_CRL **pcrl, STACK_OF(X509_CRL) **pcrls);
+    const char *pass, const char *desc, int quiet,
+    EVP_PKEY **ppkey, EVP_PKEY **ppubkey,
+    EVP_PKEY **pparams,
+    X509 **pcert, STACK_OF(X509) **pcerts,
+    X509_CRL **pcrl, STACK_OF(X509_CRL) **pcrls);
 X509_STORE *setup_verify(const char *CAfile, int noCAfile,
-                         const char *CApath, int noCApath,
-                         const char *CAstore, int noCAstore);
+    const char *CApath, int noCApath,
+    const char *CAstore, int noCAstore);
 __owur int ctx_set_verify_locations(SSL_CTX *ctx,
-                                    const char *CAfile, int noCAfile,
-                                    const char *CApath, int noCApath,
-                                    const char *CAstore, int noCAstore);
+    const char *CAfile, int noCAfile,
+    const char *CApath, int noCApath,
+    const char *CAstore, int noCAstore);
 
-# ifndef OPENSSL_NO_CT
+#ifndef OPENSSL_NO_CT
 
 /*
  * Sets the file to load the Certificate Transparency log list from.
@@ -174,10 +174,10 @@ __owur int ctx_set_verify_locations(SSL_CTX *ctx,
  */
 __owur int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path);
 
-# endif
+#endif
 
 ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug);
-# define setup_engine(e, debug) setup_engine_methods(e, (unsigned int)-1, debug)
+#define setup_engine(e, debug) setup_engine_methods(e, (unsigned int)-1, debug)
 void release_engine(ENGINE *e);
 int init_engine(ENGINE *e);
 int finish_engine(ENGINE *e);
@@ -187,30 +187,30 @@ int get_legacy_pkey_id(OSSL_LIB_CTX *libctx, const char *algname, ENGINE *e);
 const EVP_MD *get_digest_from_engine(const char *name);
 const EVP_CIPHER *get_cipher_from_engine(const char *name);
 
-# ifndef OPENSSL_NO_OCSP
+#ifndef OPENSSL_NO_OCSP
 OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host,
-                                 const char *port, const char *path,
-                                 const char *proxy, const char *no_proxy,
-                                 int use_ssl, STACK_OF(CONF_VALUE) *headers,
-                                 int req_timeout);
-# endif
+    const char *port, const char *path,
+    const char *proxy, const char *no_proxy,
+    int use_ssl, STACK_OF(CONF_VALUE) *headers,
+    int req_timeout);
+#endif
 
 /* Functions defined in ca.c and also used in ocsp.c */
 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
-                   ASN1_GENERALIZEDTIME **pinvtm, const char *str);
+    ASN1_GENERALIZEDTIME **pinvtm, const char *str);
 
-# define DB_type         0
-# define DB_exp_date     1
-# define DB_rev_date     2
-# define DB_serial       3 /* index - unique */
-# define DB_file         4
-# define DB_name         5 /* index - unique when active and not disabled */
-# define DB_NUMBER       6
+#define DB_type 0
+#define DB_exp_date 1
+#define DB_rev_date 2
+#define DB_serial 3 /* index - unique */
+#define DB_file 4
+#define DB_name 5 /* index - unique when active and not disabled */
+#define DB_NUMBER 6
 
-# define DB_TYPE_REV     'R'    /* Revoked  */
-# define DB_TYPE_EXP     'E'    /* Expired  */
-# define DB_TYPE_VAL     'V'    /* Valid ; inserted with: ca ... -valid */
-# define DB_TYPE_SUSP    'S'    /* Suspended  */
+#define DB_TYPE_REV 'R' /* Revoked  */
+#define DB_TYPE_EXP 'E' /* Expired  */
+#define DB_TYPE_VAL 'V' /* Valid ; inserted with: ca ... -valid */
+#define DB_TYPE_SUSP 'S' /* Suspended  */
 
 typedef struct db_attr_st {
     int unique_subject;
@@ -219,9 +219,9 @@ typedef struct ca_db_st {
     DB_ATTR attributes;
     TXT_DB *db;
     char *dbfname;
-# ifndef OPENSSL_NO_POSIX_IO
+#ifndef OPENSSL_NO_POSIX_IO
     struct stat dbst;
-# endif
+#endif
 } CA_DB;
 
 extern int do_updatedb(CA_DB *db, time_t *now);
@@ -231,53 +231,53 @@ void *app_malloc(size_t sz, const char *what);
 
 /* load_serial, save_serial, and rotate_serial are also used for CRL numbers */
 BIGNUM *load_serial(const char *serialfile, int *exists, int create,
-                    ASN1_INTEGER **retai);
+    ASN1_INTEGER **retai);
 int save_serial(const char *serialfile, const char *suffix,
-                const BIGNUM *serial, ASN1_INTEGER **retai);
+    const BIGNUM *serial, ASN1_INTEGER **retai);
 int rotate_serial(const char *serialfile, const char *new_suffix,
-                  const char *old_suffix);
+    const char *old_suffix);
 int rand_serial(BIGNUM *b, ASN1_INTEGER *ai);
 
 CA_DB *load_index(const char *dbfile, DB_ATTR *dbattr);
 int index_index(CA_DB *db);
 int save_index(const char *dbfile, const char *suffix, CA_DB *db);
 int rotate_index(const char *dbfile, const char *new_suffix,
-                 const char *old_suffix);
+    const char *old_suffix);
 void free_index(CA_DB *db);
-# define index_name_cmp_noconst(a, b) \
+#define index_name_cmp_noconst(a, b)                                           \
     index_name_cmp((const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, a), \
-                   (const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, b))
+        (const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, b))
 int index_name_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b);
 int parse_yesno(const char *str, int def);
 
 X509_NAME *parse_name(const char *str, int chtype, int multirdn,
-                      const char *desc);
+    const char *desc);
 void policies_print(X509_STORE_CTX *ctx);
 int bio_to_mem(unsigned char **out, size_t *outlen, size_t maxlen, BIO *in);
 int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value);
 int x509_ctrl_string(X509 *x, const char *value);
 int x509_req_ctrl_string(X509_REQ *x, const char *value);
 int init_gen_str(EVP_PKEY_CTX **pctx,
-                 const char *algname, ENGINE *e, int do_param,
-                 OSSL_LIB_CTX *libctx, const char *propq);
+    const char *algname, ENGINE *e, int do_param,
+    OSSL_LIB_CTX *libctx, const char *propq);
 int cert_matches_key(const X509 *cert, const EVP_PKEY *pkey);
 int do_X509_sign(X509 *x, int force_v1, EVP_PKEY *pkey, const char *md,
-                 STACK_OF(OPENSSL_STRING) *sigopts, X509V3_CTX *ext_ctx);
+    STACK_OF(OPENSSL_STRING) *sigopts, X509V3_CTX *ext_ctx);
 int do_X509_verify(X509 *x, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *vfyopts);
 int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const char *md,
-                     STACK_OF(OPENSSL_STRING) *sigopts);
+    STACK_OF(OPENSSL_STRING) *sigopts);
 int do_X509_REQ_verify(X509_REQ *x, EVP_PKEY *pkey,
-                       STACK_OF(OPENSSL_STRING) *vfyopts);
+    STACK_OF(OPENSSL_STRING) *vfyopts);
 int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const char *md,
-                     STACK_OF(OPENSSL_STRING) *sigopts);
+    STACK_OF(OPENSSL_STRING) *sigopts);
 
 extern char *psk_key;
 
 unsigned char *next_protos_parse(size_t *outlen, const char *in);
 
 int check_cert_attributes(BIO *bio, X509 *x,
-                          const char *checkhost, const char *checkemail,
-                          const char *checkip, int print);
+    const char *checkhost, const char *checkemail,
+    const char *checkip, int print);
 
 void store_setup_crl_download(X509_STORE *st);
 
@@ -289,38 +289,38 @@ typedef struct app_http_tls_info_st {
     SSL_CTX *ssl_ctx;
 } APP_HTTP_TLS_INFO;
 BIO *app_http_tls_cb(BIO *hbio, /* APP_HTTP_TLS_INFO */ void *arg,
-                     int connect, int detail);
+    int connect, int detail);
 void APP_HTTP_TLS_INFO_free(APP_HTTP_TLS_INFO *info);
-# ifndef OPENSSL_NO_SOCK
+#ifndef OPENSSL_NO_SOCK
 ASN1_VALUE *app_http_get_asn1(const char *url, const char *proxy,
-                              const char *no_proxy, SSL_CTX *ssl_ctx,
-                              const STACK_OF(CONF_VALUE) *headers,
-                              long timeout, const char *expected_content_type,
-                              const ASN1_ITEM *it);
+    const char *no_proxy, SSL_CTX *ssl_ctx,
+    const STACK_OF(CONF_VALUE) *headers,
+    long timeout, const char *expected_content_type,
+    const ASN1_ITEM *it);
 ASN1_VALUE *app_http_post_asn1(const char *host, const char *port,
-                               const char *path, const char *proxy,
-                               const char *no_proxy, SSL_CTX *ctx,
-                               const STACK_OF(CONF_VALUE) *headers,
-                               const char *content_type,
-                               ASN1_VALUE *req, const ASN1_ITEM *req_it,
-                               const char *expected_content_type,
-                               long timeout, const ASN1_ITEM *rsp_it);
-# endif
+    const char *path, const char *proxy,
+    const char *no_proxy, SSL_CTX *ctx,
+    const STACK_OF(CONF_VALUE) *headers,
+    const char *content_type,
+    ASN1_VALUE *req, const ASN1_ITEM *req_it,
+    const char *expected_content_type,
+    long timeout, const ASN1_ITEM *rsp_it);
+#endif
 
-# define EXT_COPY_NONE   0
-# define EXT_COPY_ADD    1
-# define EXT_COPY_ALL    2
+#define EXT_COPY_NONE 0
+#define EXT_COPY_ADD 1
+#define EXT_COPY_ALL 2
 
-# define NETSCAPE_CERT_HDR "certificate"
+#define NETSCAPE_CERT_HDR "certificate"
 
-# define APP_PASS_LEN 1024
+#define APP_PASS_LEN 1024
 
 /*
  * IETF RFC 5280 says serial number must be <= 20 bytes. Use 159 bits
  * so that the first bit will never be one, so that the DER encoding
  * rules won't force a leading octet.
  */
-# define SERIAL_RAND_BITS 159
+#define SERIAL_RAND_BITS 159
 
 int app_isdir(const char *);
 int app_access(const char *, int flag);
@@ -329,8 +329,8 @@ int fileno_stdout(void);
 int raw_read_stdin(void *, int);
 int raw_write_stdout(const void *, int);
 
-# define TM_START        0
-# define TM_STOP         1
+#define TM_START 0
+#define TM_STOP 1
 double app_tminterval(int stop, int usertime);
 
 void make_uppercase(char *string);
@@ -345,7 +345,7 @@ typedef struct verify_options_st {
 extern VERIFY_CB_ARGS verify_args;
 
 OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
-                                     const OSSL_PARAM *paramdefs);
+    const OSSL_PARAM *paramdefs);
 void app_params_free(OSSL_PARAM *params);
 int app_provider_load(OSSL_LIB_CTX *libctx, const char *provider_name);
 void app_providers_cleanup(void);
diff --git a/crypto/openssl/apps/include/apps_ui.h b/crypto/openssl/apps/include/apps_ui.h
index 6875b7c372d9..ea41c092f4da 100644
--- a/crypto/openssl/apps/include/apps_ui.h
+++ b/crypto/openssl/apps/include/apps_ui.h
@@ -8,10 +8,9 @@
  */
 
 #ifndef OSSL_APPS_UI_H
-# define OSSL_APPS_UI_H
+#define OSSL_APPS_UI_H
 
-
-# define PW_MIN_LENGTH 4
+#define PW_MIN_LENGTH 4
 typedef struct pw_cb_data {
     const void *password;
     const char *prompt_info;
diff --git a/crypto/openssl/apps/include/cmp_mock_srv.h b/crypto/openssl/apps/include/cmp_mock_srv.h
index 00f3b8f1cbca..215b95b744aa 100644
--- a/crypto/openssl/apps/include/cmp_mock_srv.h
+++ b/crypto/openssl/apps/include/cmp_mock_srv.h
@@ -9,15 +9,15 @@
  */
 
 #ifndef OSSL_APPS_CMP_MOCK_SRV_H
-# define OSSL_APPS_CMP_MOCK_SRV_H
+#define OSSL_APPS_CMP_MOCK_SRV_H
 
-# include <openssl/opensslconf.h>
-# ifndef OPENSSL_NO_CMP
+#include <openssl/opensslconf.h>
+#ifndef OPENSSL_NO_CMP
 
-#  include <openssl/cmp.h>
+#include <openssl/cmp.h>
 
 OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(OSSL_LIB_CTX *libctx,
-                                        const char *propq);
+    const char *propq);
 void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx);
 
 int ossl_cmp_mock_srv_set1_refCert(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
@@ -25,17 +25,17 @@ int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
 int ossl_cmp_mock_srv_set1_keyOut(OSSL_CMP_SRV_CTX *srv_ctx, EVP_PKEY *pkey);
 int ossl_cmp_mock_srv_set1_crlOut(OSSL_CMP_SRV_CTX *srv_ctx, X509_CRL *crl);
 int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
-                                    STACK_OF(X509) *chain);
+    STACK_OF(X509) *chain);
 int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
-                                     STACK_OF(X509) *caPubs);
+    STACK_OF(X509) *caPubs);
 int ossl_cmp_mock_srv_set1_newWithNew(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
 int ossl_cmp_mock_srv_set1_newWithOld(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
 int ossl_cmp_mock_srv_set1_oldWithNew(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
 int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
-                                     int fail_info, const char *text);
+    int fail_info, const char *text);
 int ossl_cmp_mock_srv_set_sendError(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype);
 int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count);
 int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec);
 
-# endif /* !defined(OPENSSL_NO_CMP) */
+#endif /* !defined(OPENSSL_NO_CMP) */
 #endif /* !defined(OSSL_APPS_CMP_MOCK_SRV_H) */
diff --git a/crypto/openssl/apps/include/engine_loader.h b/crypto/openssl/apps/include/engine_loader.h
index 30fdb9e55120..759d94ef597f 100644
--- a/crypto/openssl/apps/include/engine_loader.h
+++ b/crypto/openssl/apps/include/engine_loader.h
@@ -7,13 +7,13 @@
  * https://www.openssl.org/source/license.html
  */
 #ifndef HEADER_ENGINE_LOADER_H
-# define HEADER_ENGINE_LOADER_H
+#define HEADER_ENGINE_LOADER_H
 
-# include <openssl/store.h>
+#include <openssl/store.h>
 
 /* this is a private URI scheme */
-# define ENGINE_SCHEME          "org.openssl.engine"
-# define ENGINE_SCHEME_COLON    ENGINE_SCHEME ":"
+#define ENGINE_SCHEME "org.openssl.engine"
+#define ENGINE_SCHEME_COLON ENGINE_SCHEME ":"
 
 int setup_engine_loader(void);
 void destroy_engine_loader(void);
diff --git a/crypto/openssl/apps/include/fmt.h b/crypto/openssl/apps/include/fmt.h
index 98dfed7dc0a2..3cb2dc808237 100644
--- a/crypto/openssl/apps/include/fmt.h
+++ b/crypto/openssl/apps/include/fmt.h
@@ -23,22 +23,22 @@
  * contents.  The FORMAT_xxx macros are meant to express an intent with the
  * file being read or created.
  */
-# define B_FORMAT_TEXT   0x8000
-# define FORMAT_UNDEF    0
-# define FORMAT_TEXT    (1 | B_FORMAT_TEXT)     /* Generic text */
-# define FORMAT_BINARY   2                      /* Generic binary */
-# define FORMAT_BASE64  (3 | B_FORMAT_TEXT)     /* Base64 */
-# define FORMAT_ASN1     4                      /* ASN.1/DER */
-# define FORMAT_PEM     (5 | B_FORMAT_TEXT)
-# define FORMAT_PKCS12   6
-# define FORMAT_SMIME   (7 | B_FORMAT_TEXT)
-# define FORMAT_ENGINE   8                      /* Not really a file format */
-# define FORMAT_PEMRSA  (9 | B_FORMAT_TEXT)     /* PEM RSAPublicKey format */
-# define FORMAT_ASN1RSA  10                     /* DER RSAPublicKey format */
-# define FORMAT_MSBLOB   11                     /* MS Key blob format */
-# define FORMAT_PVK      12                     /* MS PVK file format */
-# define FORMAT_HTTP     13                     /* Download using HTTP */
-# define FORMAT_NSS      14                     /* NSS keylog format */
+#define B_FORMAT_TEXT 0x8000
+#define FORMAT_UNDEF 0
+#define FORMAT_TEXT (1 | B_FORMAT_TEXT) /* Generic text */
+#define FORMAT_BINARY 2 /* Generic binary */
+#define FORMAT_BASE64 (3 | B_FORMAT_TEXT) /* Base64 */
+#define FORMAT_ASN1 4 /* ASN.1/DER */
+#define FORMAT_PEM (5 | B_FORMAT_TEXT)
+#define FORMAT_PKCS12 6
+#define FORMAT_SMIME (7 | B_FORMAT_TEXT)
+#define FORMAT_ENGINE 8 /* Not really a file format */
+#define FORMAT_PEMRSA (9 | B_FORMAT_TEXT) /* PEM RSAPublicKey format */
+#define FORMAT_ASN1RSA 10 /* DER RSAPublicKey format */
+#define FORMAT_MSBLOB 11 /* MS Key blob format */
+#define FORMAT_PVK 12 /* MS PVK file format */
+#define FORMAT_HTTP 13 /* Download using HTTP */
+#define FORMAT_NSS 14 /* NSS keylog format */
 
 int FMT_istext(int format);
 
diff --git a/crypto/openssl/apps/include/function.h b/crypto/openssl/apps/include/function.h
index e796ff4045ad..ee08282e2fff 100644
--- a/crypto/openssl/apps/include/function.h
+++ b/crypto/openssl/apps/include/function.h
@@ -8,16 +8,21 @@
  */
 
 #ifndef OSSL_APPS_FUNCTION_H
-# define OSSL_APPS_FUNCTION_H
+#define OSSL_APPS_FUNCTION_H
 
-# include <openssl/lhash.h>
-# include "opt.h"
+#include <openssl/lhash.h>
+#include "opt.h"
 
-#define DEPRECATED_NO_ALTERNATIVE   "unknown"
+#define DEPRECATED_NO_ALTERNATIVE "unknown"
 
 typedef enum FUNC_TYPE {
-    FT_none, FT_general, FT_md, FT_cipher, FT_pkey,
-    FT_md_alg, FT_cipher_alg
+    FT_none,
+    FT_general,
+    FT_md,
+    FT_cipher,
+    FT_pkey,
+    FT_md_alg,
+    FT_cipher_alg
 } FUNC_TYPE;
 
 typedef struct function_st {
diff --git a/crypto/openssl/apps/include/http_server.h b/crypto/openssl/apps/include/http_server.h
index 4811e6be4013..ddc7545fa36a 100644
--- a/crypto/openssl/apps/include/http_server.h
+++ b/crypto/openssl/apps/include/http_server.h
@@ -8,35 +8,35 @@
  */
 
 #ifndef OSSL_HTTP_SERVER_H
-# define OSSL_HTTP_SERVER_H
+#define OSSL_HTTP_SERVER_H
 
-# include "apps.h"
-# include "log.h"
+#include "apps.h"
+#include "log.h"
 
-# ifndef HAVE_FORK
-#  if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS)
-#   define HAVE_FORK 0
-#  else
-#   define HAVE_FORK 1
-#  endif
-# endif
+#ifndef HAVE_FORK
+#if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS)
+#define HAVE_FORK 0
+#else
+#define HAVE_FORK 1
+#endif
+#endif
 
-# if HAVE_FORK
-#  undef NO_FORK
-# else
-#  define NO_FORK
-# endif
+#if HAVE_FORK
+#undef NO_FORK
+#else
+#define NO_FORK
+#endif
 
-# if !defined(NO_FORK) && !defined(OPENSSL_NO_SOCK) \
+#if !defined(NO_FORK) && !defined(OPENSSL_NO_SOCK) \
     && !defined(OPENSSL_NO_POSIX_IO)
-#  define HTTP_DAEMON
-#  include <sys/types.h>
-#  include <sys/wait.h>
-#  include <signal.h>
-#  define MAXERRLEN 1000 /* limit error text sent to syslog to 1000 bytes */
-# endif
+#define HTTP_DAEMON
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <signal.h>
+#define MAXERRLEN 1000 /* limit error text sent to syslog to 1000 bytes */
+#endif
 
-# ifndef OPENSSL_NO_SOCK
+#ifndef OPENSSL_NO_SOCK
 /*-
  * Initialize an HTTP server, setting up its listening BIO
  * prog: the name of the current app
@@ -66,9 +66,9 @@ BIO *http_server_init(const char *prog, const char *port, int verbosity);
  * The caller must free any non-NULL *preq, *ppath, and *pcbio pointers.
  */
 int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
-                             char **ppath, BIO **pcbio, BIO *acbio,
-                             int *found_keep_alive,
-                             const char *prog, int accept_get, int timeout);
+    char **ppath, BIO **pcbio, BIO *acbio,
+    int *found_keep_alive,
+    const char *prog, int accept_get, int timeout);
 
 /*-
  * Send an ASN.1-formatted HTTP response
@@ -82,8 +82,8 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
  * returns 1 on success, 0 on failure
  */
 int http_server_send_asn1_resp(const char *prog, BIO *cbio, int keep_alive,
-                               const char *content_type,
-                               const ASN1_ITEM *it, const ASN1_VALUE *resp);
+    const char *content_type,
+    const ASN1_ITEM *it, const ASN1_VALUE *resp);
 
 /*-
  * Send a trivial HTTP response, typically to report an error or OK
@@ -94,16 +94,16 @@ int http_server_send_asn1_resp(const char *prog, BIO *cbio, int keep_alive,
  * returns 1 on success, 0 on failure
  */
 int http_server_send_status(const char *prog, BIO *cbio,
-                            int status, const char *reason);
+    int status, const char *reason);
 
-# endif
+#endif
 
-# ifdef HTTP_DAEMON
+#ifdef HTTP_DAEMON
 extern int n_responders;
 extern int acfd;
 
 void socket_timeout(int signum);
 void spawn_loop(const char *prog);
-# endif
+#endif
 
 #endif
diff --git a/crypto/openssl/apps/include/log.h b/crypto/openssl/apps/include/log.h
index 1b8b58d41acf..d866b90c54bf 100644
--- a/crypto/openssl/apps/include/log.h
+++ b/crypto/openssl/apps/include/log.h
@@ -8,25 +8,25 @@
  */
 
 #ifndef OSSL_APPS_LOG_H
-# define OSSL_APPS_LOG_H
+#define OSSL_APPS_LOG_H
 
-# include <openssl/bio.h>
-# if !defined(OPENSSL_SYS_VMS) && !defined(OPENSSL_SYS_WINDOWS) \
+#include <openssl/bio.h>
+#if !defined(OPENSSL_SYS_VMS) && !defined(OPENSSL_SYS_WINDOWS) \
     && !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_POSIX_IO)
-#  include <syslog.h>
-# else
-#  define LOG_EMERG   0
-#  define LOG_ALERT   1
-#  define LOG_CRIT    2
-#  define LOG_ERR     3
-#  define LOG_WARNING 4
-#  define LOG_NOTICE  5
-#  define LOG_INFO    6
-#  define LOG_DEBUG   7
-# endif
+#include <syslog.h>
+#else
+#define LOG_EMERG 0
+#define LOG_ALERT 1
+#define LOG_CRIT 2
+#define LOG_ERR 3
+#define LOG_WARNING 4
+#define LOG_NOTICE 5
+#define LOG_INFO 6
+#define LOG_DEBUG 7
+#endif
 
-# undef LOG_TRACE
-# define LOG_TRACE (LOG_DEBUG + 1)
+#undef LOG_TRACE
+#define LOG_TRACE (LOG_DEBUG + 1)
 
 int log_set_verbosity(const char *prog, int level);
 int log_get_verbosity(void);
@@ -45,6 +45,6 @@ int log_get_verbosity(void);
  * returns nothing
  */
 void trace_log_message(int category,
-                       const char *prog, int level, const char *fmt, ...);
+    const char *prog, int level, const char *fmt, ...);
 
 #endif /* OSSL_APPS_LOG_H */
diff --git a/crypto/openssl/apps/include/names.h b/crypto/openssl/apps/include/names.h
index f4d6f6a9a333..bf47459ade52 100644
--- a/crypto/openssl/apps/include/names.h
+++ b/crypto/openssl/apps/include/names.h
@@ -10,7 +10,7 @@
 #include <openssl/safestack.h>
 
 /* Standard comparing function for names */
-int name_cmp(const char * const *a, const char * const *b);
+int name_cmp(const char *const *a, const char *const *b);
 /* collect_names is meant to be used with EVP_{type}_doall_names */
 void collect_names(const char *name, void *vdata);
 /* Sorts and prints a stack of names to |out| */
diff --git a/crypto/openssl/apps/include/opt.h b/crypto/openssl/apps/include/opt.h
index d8d75182802d..3b467c0d47ae 100644
--- a/crypto/openssl/apps/include/opt.h
+++ b/crypto/openssl/apps/include/opt.h
@@ -19,301 +19,312 @@
 /*
  * Common verification options.
  */
-# define OPT_V_ENUM \
-        OPT_V__FIRST=2000, \
-        OPT_V_POLICY, OPT_V_PURPOSE, OPT_V_VERIFY_NAME, OPT_V_VERIFY_DEPTH, \
-        OPT_V_ATTIME, OPT_V_VERIFY_HOSTNAME, OPT_V_VERIFY_EMAIL, \
-        OPT_V_VERIFY_IP, OPT_V_IGNORE_CRITICAL, OPT_V_ISSUER_CHECKS, \
-        OPT_V_CRL_CHECK, OPT_V_CRL_CHECK_ALL, OPT_V_POLICY_CHECK, \
-        OPT_V_EXPLICIT_POLICY, OPT_V_INHIBIT_ANY, OPT_V_INHIBIT_MAP, \
-        OPT_V_X509_STRICT, OPT_V_EXTENDED_CRL, OPT_V_USE_DELTAS, \
-        OPT_V_POLICY_PRINT, OPT_V_CHECK_SS_SIG, OPT_V_TRUSTED_FIRST, \
-        OPT_V_SUITEB_128_ONLY, OPT_V_SUITEB_128, OPT_V_SUITEB_192, \
-        OPT_V_PARTIAL_CHAIN, OPT_V_NO_ALT_CHAINS, OPT_V_NO_CHECK_TIME, \
-        OPT_V_VERIFY_AUTH_LEVEL, OPT_V_ALLOW_PROXY_CERTS, \
-        OPT_V__LAST
+#define OPT_V_ENUM                                                      \
+    OPT_V__FIRST = 2000,                                                \
+    OPT_V_POLICY, OPT_V_PURPOSE, OPT_V_VERIFY_NAME, OPT_V_VERIFY_DEPTH, \
+    OPT_V_ATTIME, OPT_V_VERIFY_HOSTNAME, OPT_V_VERIFY_EMAIL,            \
+    OPT_V_VERIFY_IP, OPT_V_IGNORE_CRITICAL, OPT_V_ISSUER_CHECKS,        \
+    OPT_V_CRL_CHECK, OPT_V_CRL_CHECK_ALL, OPT_V_POLICY_CHECK,           \
+    OPT_V_EXPLICIT_POLICY, OPT_V_INHIBIT_ANY, OPT_V_INHIBIT_MAP,        \
+    OPT_V_X509_STRICT, OPT_V_EXTENDED_CRL, OPT_V_USE_DELTAS,            \
+    OPT_V_POLICY_PRINT, OPT_V_CHECK_SS_SIG, OPT_V_TRUSTED_FIRST,        \
+    OPT_V_SUITEB_128_ONLY, OPT_V_SUITEB_128, OPT_V_SUITEB_192,          \
+    OPT_V_PARTIAL_CHAIN, OPT_V_NO_ALT_CHAINS, OPT_V_NO_CHECK_TIME,      \
+    OPT_V_VERIFY_AUTH_LEVEL, OPT_V_ALLOW_PROXY_CERTS,                   \
+    OPT_V__LAST
 
-# define OPT_V_OPTIONS \
-        OPT_SECTION("Validation"), \
-        { "policy", OPT_V_POLICY, 's', "adds policy to the acceptable policy set"}, \
-        { "purpose", OPT_V_PURPOSE, 's', \
-            "certificate chain purpose"}, \
-        { "verify_name", OPT_V_VERIFY_NAME, 's', "verification policy name"}, \
-        { "verify_depth", OPT_V_VERIFY_DEPTH, 'n', \
-            "chain depth limit" }, \
-        { "auth_level", OPT_V_VERIFY_AUTH_LEVEL, 'n', \
-            "chain authentication security level" }, \
-        { "attime", OPT_V_ATTIME, 'M', "verification epoch time" }, \
-        { "verify_hostname", OPT_V_VERIFY_HOSTNAME, 's', \
-            "expected peer hostname" }, \
-        { "verify_email", OPT_V_VERIFY_EMAIL, 's', \
-            "expected peer email" }, \
-        { "verify_ip", OPT_V_VERIFY_IP, 's', \
-            "expected peer IP address" }, \
-        { "ignore_critical", OPT_V_IGNORE_CRITICAL, '-', \
-            "permit unhandled critical extensions"}, \
-        { "issuer_checks", OPT_V_ISSUER_CHECKS, '-', "(deprecated)"}, \
-        { "crl_check", OPT_V_CRL_CHECK, '-', "check leaf certificate revocation" }, \
-        { "crl_check_all", OPT_V_CRL_CHECK_ALL, '-', "check full chain revocation" }, \
-        { "policy_check", OPT_V_POLICY_CHECK, '-', "perform rfc5280 policy checks"}, \
-        { "explicit_policy", OPT_V_EXPLICIT_POLICY, '-', \
-            "set policy variable require-explicit-policy"}, \
-        { "inhibit_any", OPT_V_INHIBIT_ANY, '-', \
-            "set policy variable inhibit-any-policy"}, \
-        { "inhibit_map", OPT_V_INHIBIT_MAP, '-', \
-            "set policy variable inhibit-policy-mapping"}, \
-        { "x509_strict", OPT_V_X509_STRICT, '-', \
-            "disable certificate compatibility work-arounds"}, \
-        { "extended_crl", OPT_V_EXTENDED_CRL, '-', \
-            "enable extended CRL features"}, \
-        { "use_deltas", OPT_V_USE_DELTAS, '-', \
-            "use delta CRLs"}, \
-        { "policy_print", OPT_V_POLICY_PRINT, '-', \
-            "print policy processing diagnostics"}, \
-        { "check_ss_sig", OPT_V_CHECK_SS_SIG, '-', \
-            "check root CA self-signatures"}, \
-        { "trusted_first", OPT_V_TRUSTED_FIRST, '-', \
-            "search trust store first (default)" }, \
-        { "suiteB_128_only", OPT_V_SUITEB_128_ONLY, '-', "Suite B 128-bit-only mode"}, \
-        { "suiteB_128", OPT_V_SUITEB_128, '-', \
-            "Suite B 128-bit mode allowing 192-bit algorithms"}, \
-        { "suiteB_192", OPT_V_SUITEB_192, '-', "Suite B 192-bit-only mode" }, \
-        { "partial_chain", OPT_V_PARTIAL_CHAIN, '-', \
-            "accept chains anchored by intermediate trust-store CAs"}, \
-        { "no_alt_chains", OPT_V_NO_ALT_CHAINS, '-', "(deprecated)" }, \
+#define OPT_V_OPTIONS                                                                      \
+    OPT_SECTION("Validation"),                                                             \
+        { "policy", OPT_V_POLICY, 's', "adds policy to the acceptable policy set" },       \
+        { "purpose", OPT_V_PURPOSE, 's',                                                   \
+            "certificate chain purpose" },                                                 \
+        { "verify_name", OPT_V_VERIFY_NAME, 's', "verification policy name" },             \
+        { "verify_depth", OPT_V_VERIFY_DEPTH, 'n',                                         \
+            "chain depth limit" },                                                         \
+        { "auth_level", OPT_V_VERIFY_AUTH_LEVEL, 'n',                                      \
+            "chain authentication security level" },                                       \
+        { "attime", OPT_V_ATTIME, 'M', "verification epoch time" },                        \
+        { "verify_hostname", OPT_V_VERIFY_HOSTNAME, 's',                                   \
+            "expected peer hostname" },                                                    \
+        { "verify_email", OPT_V_VERIFY_EMAIL, 's',                                         \
+            "expected peer email" },                                                       \
+        { "verify_ip", OPT_V_VERIFY_IP, 's',                                               \
+            "expected peer IP address" },                                                  \
+        { "ignore_critical", OPT_V_IGNORE_CRITICAL, '-',                                   \
+            "permit unhandled critical extensions" },                                      \
+        { "issuer_checks", OPT_V_ISSUER_CHECKS, '-', "(deprecated)" },                     \
+        { "crl_check", OPT_V_CRL_CHECK, '-', "check leaf certificate revocation" },        \
+        { "crl_check_all", OPT_V_CRL_CHECK_ALL, '-', "check full chain revocation" },      \
+        { "policy_check", OPT_V_POLICY_CHECK, '-', "perform rfc5280 policy checks" },      \
+        { "explicit_policy", OPT_V_EXPLICIT_POLICY, '-',                                   \
+            "set policy variable require-explicit-policy" },                               \
+        { "inhibit_any", OPT_V_INHIBIT_ANY, '-',                                           \
+            "set policy variable inhibit-any-policy" },                                    \
+        { "inhibit_map", OPT_V_INHIBIT_MAP, '-',                                           \
+            "set policy variable inhibit-policy-mapping" },                                \
+        { "x509_strict", OPT_V_X509_STRICT, '-',                                           \
+            "disable certificate compatibility work-arounds" },                            \
+        { "extended_crl", OPT_V_EXTENDED_CRL, '-',                                         \
+            "enable extended CRL features" },                                              \
+        { "use_deltas", OPT_V_USE_DELTAS, '-',                                             \
+            "use delta CRLs" },                                                            \
+        { "policy_print", OPT_V_POLICY_PRINT, '-',                                         \
+            "print policy processing diagnostics" },                                       \
+        { "check_ss_sig", OPT_V_CHECK_SS_SIG, '-',                                         \
+            "check root CA self-signatures" },                                             \
+        { "trusted_first", OPT_V_TRUSTED_FIRST, '-',                                       \
+            "search trust store first (default)" },                                        \
+        { "suiteB_128_only", OPT_V_SUITEB_128_ONLY, '-', "Suite B 128-bit-only mode" },    \
+        { "suiteB_128", OPT_V_SUITEB_128, '-',                                             \
+            "Suite B 128-bit mode allowing 192-bit algorithms" },                          \
+        { "suiteB_192", OPT_V_SUITEB_192, '-', "Suite B 192-bit-only mode" },              \
+        { "partial_chain", OPT_V_PARTIAL_CHAIN, '-',                                       \
+            "accept chains anchored by intermediate trust-store CAs" },                    \
+        { "no_alt_chains", OPT_V_NO_ALT_CHAINS, '-', "(deprecated)" },                     \
         { "no_check_time", OPT_V_NO_CHECK_TIME, '-', "ignore certificate validity time" }, \
         { "allow_proxy_certs", OPT_V_ALLOW_PROXY_CERTS, '-', "allow the use of proxy certificates" }
 
-# define OPT_V_CASES \
-        OPT_V__FIRST: case OPT_V__LAST: break; \
-        case OPT_V_POLICY: \
-        case OPT_V_PURPOSE: \
-        case OPT_V_VERIFY_NAME: \
-        case OPT_V_VERIFY_DEPTH: \
-        case OPT_V_VERIFY_AUTH_LEVEL: \
-        case OPT_V_ATTIME: \
-        case OPT_V_VERIFY_HOSTNAME: \
-        case OPT_V_VERIFY_EMAIL: \
-        case OPT_V_VERIFY_IP: \
-        case OPT_V_IGNORE_CRITICAL: \
-        case OPT_V_ISSUER_CHECKS: \
-        case OPT_V_CRL_CHECK: \
-        case OPT_V_CRL_CHECK_ALL: \
-        case OPT_V_POLICY_CHECK: \
-        case OPT_V_EXPLICIT_POLICY: \
-        case OPT_V_INHIBIT_ANY: \
-        case OPT_V_INHIBIT_MAP: \
-        case OPT_V_X509_STRICT: \
-        case OPT_V_EXTENDED_CRL: \
-        case OPT_V_USE_DELTAS: \
-        case OPT_V_POLICY_PRINT: \
-        case OPT_V_CHECK_SS_SIG: \
-        case OPT_V_TRUSTED_FIRST: \
-        case OPT_V_SUITEB_128_ONLY: \
-        case OPT_V_SUITEB_128: \
-        case OPT_V_SUITEB_192: \
-        case OPT_V_PARTIAL_CHAIN: \
-        case OPT_V_NO_ALT_CHAINS: \
-        case OPT_V_NO_CHECK_TIME: \
-        case OPT_V_ALLOW_PROXY_CERTS
+#define OPT_V_CASES               \
+    OPT_V__FIRST:                 \
+    case OPT_V__LAST:             \
+    break;                        \
+    case OPT_V_POLICY:            \
+    case OPT_V_PURPOSE:           \
+    case OPT_V_VERIFY_NAME:       \
+    case OPT_V_VERIFY_DEPTH:      \
+    case OPT_V_VERIFY_AUTH_LEVEL: \
+    case OPT_V_ATTIME:            \
+    case OPT_V_VERIFY_HOSTNAME:   \
+    case OPT_V_VERIFY_EMAIL:      \
+    case OPT_V_VERIFY_IP:         \
+    case OPT_V_IGNORE_CRITICAL:   \
+    case OPT_V_ISSUER_CHECKS:     \
+    case OPT_V_CRL_CHECK:         \
+    case OPT_V_CRL_CHECK_ALL:     \
+    case OPT_V_POLICY_CHECK:      \
+    case OPT_V_EXPLICIT_POLICY:   \
+    case OPT_V_INHIBIT_ANY:       \
+    case OPT_V_INHIBIT_MAP:       \
+    case OPT_V_X509_STRICT:       \
+    case OPT_V_EXTENDED_CRL:      \
+    case OPT_V_USE_DELTAS:        \
+    case OPT_V_POLICY_PRINT:      \
+    case OPT_V_CHECK_SS_SIG:      \
+    case OPT_V_TRUSTED_FIRST:     \
+    case OPT_V_SUITEB_128_ONLY:   \
+    case OPT_V_SUITEB_128:        \
+    case OPT_V_SUITEB_192:        \
+    case OPT_V_PARTIAL_CHAIN:     \
+    case OPT_V_NO_ALT_CHAINS:     \
+    case OPT_V_NO_CHECK_TIME:     \
+    case OPT_V_ALLOW_PROXY_CERTS
 
 /*
  * Common "extended validation" options.
  */
-# define OPT_X_ENUM \
-        OPT_X__FIRST=1000, \
-        OPT_X_KEY, OPT_X_CERT, OPT_X_CHAIN, OPT_X_CHAIN_BUILD, \
-        OPT_X_CERTFORM, OPT_X_KEYFORM, \
-        OPT_X__LAST
+#define OPT_X_ENUM                                         \
+    OPT_X__FIRST = 1000,                                   \
+    OPT_X_KEY, OPT_X_CERT, OPT_X_CHAIN, OPT_X_CHAIN_BUILD, \
+    OPT_X_CERTFORM, OPT_X_KEYFORM,                         \
+    OPT_X__LAST
 
-# define OPT_X_OPTIONS \
-        OPT_SECTION("Extended certificate"), \
-        { "xkey", OPT_X_KEY, '<', "key for Extended certificates"}, \
-        { "xcert", OPT_X_CERT, '<', "cert for Extended certificates"}, \
-        { "xchain", OPT_X_CHAIN, '<', "chain for Extended certificates"}, \
-        { "xchain_build", OPT_X_CHAIN_BUILD, '-', \
-            "build certificate chain for the extended certificates"}, \
-        { "xcertform", OPT_X_CERTFORM, 'F', \
+#define OPT_X_OPTIONS                                                        \
+    OPT_SECTION("Extended certificate"),                                     \
+        { "xkey", OPT_X_KEY, '<', "key for Extended certificates" },         \
+        { "xcert", OPT_X_CERT, '<', "cert for Extended certificates" },      \
+        { "xchain", OPT_X_CHAIN, '<', "chain for Extended certificates" },   \
+        { "xchain_build", OPT_X_CHAIN_BUILD, '-',                            \
+            "build certificate chain for the extended certificates" },       \
+        { "xcertform", OPT_X_CERTFORM, 'F',                                  \
             "format of Extended certificate (PEM/DER/P12); has no effect" }, \
-        { "xkeyform", OPT_X_KEYFORM, 'F', \
-            "format of Extended certificate's key (DER/PEM/P12); has no effect"}
+        { "xkeyform", OPT_X_KEYFORM, 'F',                                    \
+            "format of Extended certificate's key (DER/PEM/P12); has no effect" }
 
-# define OPT_X_CASES \
-        OPT_X__FIRST: case OPT_X__LAST: break; \
-        case OPT_X_KEY: \
-        case OPT_X_CERT: \
-        case OPT_X_CHAIN: \
-        case OPT_X_CHAIN_BUILD: \
-        case OPT_X_CERTFORM: \
-        case OPT_X_KEYFORM
+#define OPT_X_CASES         \
+    OPT_X__FIRST:           \
+    case OPT_X__LAST:       \
+    break;                  \
+    case OPT_X_KEY:         \
+    case OPT_X_CERT:        \
+    case OPT_X_CHAIN:       \
+    case OPT_X_CHAIN_BUILD: \
+    case OPT_X_CERTFORM:    \
+    case OPT_X_KEYFORM
 
 /*
  * Common SSL options.
  * Any changes here must be coordinated with ../ssl/ssl_conf.c
  */
-# define OPT_S_ENUM \
-        OPT_S__FIRST=3000, \
-        OPT_S_NOSSL3, OPT_S_NOTLS1, OPT_S_NOTLS1_1, OPT_S_NOTLS1_2, \
-        OPT_S_NOTLS1_3, OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_NOTICKET, \
-        OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_CLIENTRENEG, \
-        OPT_S_LEGACYCONN, \
-        OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, \
-        OPT_S_ALLOW_NO_DHE_KEX, OPT_S_PREFER_NO_DHE_KEX, \
-        OPT_S_PRIORITIZE_CHACHA, \
-        OPT_S_STRICT, OPT_S_SIGALGS, OPT_S_CLIENTSIGALGS, OPT_S_GROUPS, \
-        OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, OPT_S_CIPHERSUITES, \
-        OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, OPT_S_COMP, \
-        OPT_S_MINPROTO, OPT_S_MAXPROTO, \
-        OPT_S_NO_RENEGOTIATION, OPT_S_NO_MIDDLEBOX, OPT_S_NO_ETM, \
-        OPT_S_NO_EMS, \
-        OPT_S_NO_TX_CERT_COMP, \
-        OPT_S_NO_RX_CERT_COMP, \
-        OPT_S__LAST
+#define OPT_S_ENUM                                                    \
+    OPT_S__FIRST = 3000,                                              \
+    OPT_S_NOSSL3, OPT_S_NOTLS1, OPT_S_NOTLS1_1, OPT_S_NOTLS1_2,       \
+    OPT_S_NOTLS1_3, OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_NOTICKET,        \
+    OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_CLIENTRENEG,           \
+    OPT_S_LEGACYCONN,                                                 \
+    OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN,                               \
+    OPT_S_ALLOW_NO_DHE_KEX, OPT_S_PREFER_NO_DHE_KEX,                  \
+    OPT_S_PRIORITIZE_CHACHA,                                          \
+    OPT_S_STRICT, OPT_S_SIGALGS, OPT_S_CLIENTSIGALGS, OPT_S_GROUPS,   \
+    OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, OPT_S_CIPHERSUITES, \
+    OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, OPT_S_COMP,               \
+    OPT_S_MINPROTO, OPT_S_MAXPROTO,                                   \
+    OPT_S_NO_RENEGOTIATION, OPT_S_NO_MIDDLEBOX, OPT_S_NO_ETM,         \
+    OPT_S_NO_EMS,                                                     \
+    OPT_S_NO_TX_CERT_COMP,                                            \
+    OPT_S_NO_RX_CERT_COMP,                                            \
+    OPT_S__LAST
 
-# define OPT_S_OPTIONS \
-        OPT_SECTION("TLS/SSL"), \
-        {"no_ssl3", OPT_S_NOSSL3, '-',"Just disable SSLv3" }, \
-        {"no_tls1", OPT_S_NOTLS1, '-', "Just disable TLSv1"}, \
-        {"no_tls1_1", OPT_S_NOTLS1_1, '-', "Just disable TLSv1.1" }, \
-        {"no_tls1_2", OPT_S_NOTLS1_2, '-', "Just disable TLSv1.2"}, \
-        {"no_tls1_3", OPT_S_NOTLS1_3, '-', "Just disable TLSv1.3"}, \
-        {"bugs", OPT_S_BUGS, '-', "Turn on SSL bug compatibility"}, \
-        {"no_comp", OPT_S_NO_COMP, '-', "Disable SSL/TLS compression (default)" }, \
-        {"comp", OPT_S_COMP, '-', "Use SSL/TLS-level compression" }, \
-        {"no_tx_cert_comp", OPT_S_NO_TX_CERT_COMP, '-', "Disable sending TLSv1.3 compressed certificates" }, \
-        {"no_rx_cert_comp", OPT_S_NO_RX_CERT_COMP, '-', "Disable receiving TLSv1.3 compressed certificates" }, \
-        {"no_ticket", OPT_S_NOTICKET, '-', \
-            "Disable use of TLS session tickets"}, \
-        {"serverpref", OPT_S_SERVERPREF, '-', "Use server's cipher preferences"}, \
-        {"legacy_renegotiation", OPT_S_LEGACYRENEG, '-', \
-            "Enable use of legacy renegotiation (dangerous)"}, \
-        {"client_renegotiation", OPT_S_CLIENTRENEG, '-', \
-            "Allow client-initiated renegotiation" }, \
-        {"no_renegotiation", OPT_S_NO_RENEGOTIATION, '-', \
-            "Disable all renegotiation."}, \
-        {"legacy_server_connect", OPT_S_LEGACYCONN, '-', \
-            "Allow initial connection to servers that don't support RI"}, \
-        {"no_resumption_on_reneg", OPT_S_ONRESUMP, '-', \
-            "Disallow session resumption on renegotiation"}, \
-        {"no_legacy_server_connect", OPT_S_NOLEGACYCONN, '-', \
-            "Disallow initial connection to servers that don't support RI"}, \
-        {"allow_no_dhe_kex", OPT_S_ALLOW_NO_DHE_KEX, '-', \
-            "In TLSv1.3 allow non-(ec)dhe based key exchange on resumption"}, \
-        {"prefer_no_dhe_kex", OPT_S_PREFER_NO_DHE_KEX, '-', \
-            "In TLSv1.3 prefer non-(ec)dhe over (ec)dhe-based key exchange on resumption"}, \
-        {"prioritize_chacha", OPT_S_PRIORITIZE_CHACHA, '-', \
-            "Prioritize ChaCha ciphers when preferred by clients"}, \
-        {"strict", OPT_S_STRICT, '-', \
-            "Enforce strict certificate checks as per TLS standard"}, \
-        {"sigalgs", OPT_S_SIGALGS, 's', \
-            "Signature algorithms to support (colon-separated list)" }, \
-        {"client_sigalgs", OPT_S_CLIENTSIGALGS, 's', \
-            "Signature algorithms to support for client certificate" \
-            " authentication (colon-separated list)" }, \
-        {"groups", OPT_S_GROUPS, 's', \
-            "Groups to advertise (colon-separated list)" }, \
-        {"curves", OPT_S_CURVES, 's', \
-            "Groups to advertise (colon-separated list)" }, \
-        {"named_curve", OPT_S_NAMEDCURVE, 's', \
-            "Elliptic curve used for ECDHE (server-side only)" }, \
-        {"cipher", OPT_S_CIPHER, 's', "Specify TLSv1.2 and below cipher list to be used"}, \
-        {"ciphersuites", OPT_S_CIPHERSUITES, 's', "Specify TLSv1.3 ciphersuites to be used"}, \
-        {"min_protocol", OPT_S_MINPROTO, 's', "Specify the minimum protocol version to be used"}, \
-        {"max_protocol", OPT_S_MAXPROTO, 's', "Specify the maximum protocol version to be used"}, \
-        {"record_padding", OPT_S_RECORD_PADDING, 's', \
-            "Block size to pad TLS 1.3 records to."}, \
-        {"debug_broken_protocol", OPT_S_DEBUGBROKE, '-', \
-            "Perform all sorts of protocol violations for testing purposes"}, \
-        {"no_middlebox", OPT_S_NO_MIDDLEBOX, '-', \
-            "Disable TLSv1.3 middlebox compat mode" }, \
-        {"no_etm", OPT_S_NO_ETM, '-', \
-            "Disable Encrypt-then-Mac extension"}, \
-        {"no_ems", OPT_S_NO_EMS, '-', \
-            "Disable Extended master secret extension"}
+#define OPT_S_OPTIONS                                                                                           \
+    OPT_SECTION("TLS/SSL"),                                                                                     \
+        { "no_ssl3", OPT_S_NOSSL3, '-', "Just disable SSLv3" },                                                 \
+        { "no_tls1", OPT_S_NOTLS1, '-', "Just disable TLSv1" },                                                 \
+        { "no_tls1_1", OPT_S_NOTLS1_1, '-', "Just disable TLSv1.1" },                                           \
+        { "no_tls1_2", OPT_S_NOTLS1_2, '-', "Just disable TLSv1.2" },                                           \
+        { "no_tls1_3", OPT_S_NOTLS1_3, '-', "Just disable TLSv1.3" },                                           \
+        { "bugs", OPT_S_BUGS, '-', "Turn on SSL bug compatibility" },                                           \
+        { "no_comp", OPT_S_NO_COMP, '-', "Disable SSL/TLS compression (default)" },                             \
+        { "comp", OPT_S_COMP, '-', "Use SSL/TLS-level compression" },                                           \
+        { "no_tx_cert_comp", OPT_S_NO_TX_CERT_COMP, '-', "Disable sending TLSv1.3 compressed certificates" },   \
+        { "no_rx_cert_comp", OPT_S_NO_RX_CERT_COMP, '-', "Disable receiving TLSv1.3 compressed certificates" }, \
+        { "no_ticket", OPT_S_NOTICKET, '-',                                                                     \
+            "Disable use of TLS session tickets" },                                                             \
+        { "serverpref", OPT_S_SERVERPREF, '-', "Use server's cipher preferences" },                             \
+        { "legacy_renegotiation", OPT_S_LEGACYRENEG, '-',                                                       \
+            "Enable use of legacy renegotiation (dangerous)" },                                                 \
+        { "client_renegotiation", OPT_S_CLIENTRENEG, '-',                                                       \
+            "Allow client-initiated renegotiation" },                                                           \
+        { "no_renegotiation", OPT_S_NO_RENEGOTIATION, '-',                                                      \
+            "Disable all renegotiation." },                                                                     \
+        { "legacy_server_connect", OPT_S_LEGACYCONN, '-',                                                       \
+            "Allow initial connection to servers that don't support RI" },                                      \
+        { "no_resumption_on_reneg", OPT_S_ONRESUMP, '-',                                                        \
+            "Disallow session resumption on renegotiation" },                                                   \
+        { "no_legacy_server_connect", OPT_S_NOLEGACYCONN, '-',                                                  \
+            "Disallow initial connection to servers that don't support RI" },                                   \
+        { "allow_no_dhe_kex", OPT_S_ALLOW_NO_DHE_KEX, '-',                                                      \
+            "In TLSv1.3 allow non-(ec)dhe based key exchange on resumption" },                                  \
+        { "prefer_no_dhe_kex", OPT_S_PREFER_NO_DHE_KEX, '-',                                                    \
+            "In TLSv1.3 prefer non-(ec)dhe over (ec)dhe-based key exchange on resumption" },                    \
+        { "prioritize_chacha", OPT_S_PRIORITIZE_CHACHA, '-',                                                    \
+            "Prioritize ChaCha ciphers when preferred by clients" },                                            \
+        { "strict", OPT_S_STRICT, '-',                                                                          \
+            "Enforce strict certificate checks as per TLS standard" },                                          \
+        { "sigalgs", OPT_S_SIGALGS, 's',                                                                        \
+            "Signature algorithms to support (colon-separated list)" },                                         \
+        { "client_sigalgs", OPT_S_CLIENTSIGALGS, 's',                                                           \
+            "Signature algorithms to support for client certificate"                                            \
+            " authentication (colon-separated list)" },                                                         \
+        { "groups", OPT_S_GROUPS, 's',                                                                          \
+            "Groups to advertise (colon-separated list)" },                                                     \
+        { "curves", OPT_S_CURVES, 's',                                                                          \
+            "Groups to advertise (colon-separated list)" },                                                     \
+        { "named_curve", OPT_S_NAMEDCURVE, 's',                                                                 \
+            "Elliptic curve used for ECDHE (server-side only)" },                                               \
+        { "cipher", OPT_S_CIPHER, 's', "Specify TLSv1.2 and below cipher list to be used" },                    \
+        { "ciphersuites", OPT_S_CIPHERSUITES, 's', "Specify TLSv1.3 ciphersuites to be used" },                 \
+        { "min_protocol", OPT_S_MINPROTO, 's', "Specify the minimum protocol version to be used" },             \
+        { "max_protocol", OPT_S_MAXPROTO, 's', "Specify the maximum protocol version to be used" },             \
+        { "record_padding", OPT_S_RECORD_PADDING, 's',                                                          \
+            "Block size to pad TLS 1.3 records to." },                                                          \
+        { "debug_broken_protocol", OPT_S_DEBUGBROKE, '-',                                                       \
+            "Perform all sorts of protocol violations for testing purposes" },                                  \
+        { "no_middlebox", OPT_S_NO_MIDDLEBOX, '-',                                                              \
+            "Disable TLSv1.3 middlebox compat mode" },                                                          \
+        { "no_etm", OPT_S_NO_ETM, '-',                                                                          \
+            "Disable Encrypt-then-Mac extension" },                                                             \
+        { "no_ems", OPT_S_NO_EMS, '-',                                                                          \
+            "Disable Extended master secret extension" }
 
-# define OPT_S_CASES \
-        OPT_S__FIRST: case OPT_S__LAST: break; \
-        case OPT_S_NOSSL3: \
-        case OPT_S_NOTLS1: \
-        case OPT_S_NOTLS1_1: \
-        case OPT_S_NOTLS1_2: \
-        case OPT_S_NOTLS1_3: \
-        case OPT_S_BUGS: \
-        case OPT_S_NO_COMP: \
-        case OPT_S_COMP: \
-        case OPT_S_NO_TX_CERT_COMP: \
-        case OPT_S_NO_RX_CERT_COMP: \
-        case OPT_S_NOTICKET: \
-        case OPT_S_SERVERPREF: \
-        case OPT_S_LEGACYRENEG: \
-        case OPT_S_CLIENTRENEG: \
-        case OPT_S_LEGACYCONN: \
-        case OPT_S_ONRESUMP: \
-        case OPT_S_NOLEGACYCONN: \
-        case OPT_S_ALLOW_NO_DHE_KEX: \
-        case OPT_S_PREFER_NO_DHE_KEX: \
-        case OPT_S_PRIORITIZE_CHACHA: \
-        case OPT_S_STRICT: \
-        case OPT_S_SIGALGS: \
-        case OPT_S_CLIENTSIGALGS: \
-        case OPT_S_GROUPS: \
-        case OPT_S_CURVES: \
-        case OPT_S_NAMEDCURVE: \
-        case OPT_S_CIPHER: \
-        case OPT_S_CIPHERSUITES: \
-        case OPT_S_RECORD_PADDING: \
-        case OPT_S_NO_RENEGOTIATION: \
-        case OPT_S_MINPROTO: \
-        case OPT_S_MAXPROTO: \
-        case OPT_S_DEBUGBROKE: \
-        case OPT_S_NO_MIDDLEBOX: \
-        case OPT_S_NO_ETM: \
-        case OPT_S_NO_EMS
+#define OPT_S_CASES               \
+    OPT_S__FIRST:                 \
+    case OPT_S__LAST:             \
+    break;                        \
+    case OPT_S_NOSSL3:            \
+    case OPT_S_NOTLS1:            \
+    case OPT_S_NOTLS1_1:          \
+    case OPT_S_NOTLS1_2:          \
+    case OPT_S_NOTLS1_3:          \
+    case OPT_S_BUGS:              \
+    case OPT_S_NO_COMP:           \
+    case OPT_S_COMP:              \
+    case OPT_S_NO_TX_CERT_COMP:   \
+    case OPT_S_NO_RX_CERT_COMP:   \
+    case OPT_S_NOTICKET:          \
+    case OPT_S_SERVERPREF:        \
+    case OPT_S_LEGACYRENEG:       \
+    case OPT_S_CLIENTRENEG:       \
+    case OPT_S_LEGACYCONN:        \
+    case OPT_S_ONRESUMP:          \
+    case OPT_S_NOLEGACYCONN:      \
+    case OPT_S_ALLOW_NO_DHE_KEX:  \
+    case OPT_S_PREFER_NO_DHE_KEX: \
+    case OPT_S_PRIORITIZE_CHACHA: \
+    case OPT_S_STRICT:            \
+    case OPT_S_SIGALGS:           \
+    case OPT_S_CLIENTSIGALGS:     \
+    case OPT_S_GROUPS:            \
+    case OPT_S_CURVES:            \
+    case OPT_S_NAMEDCURVE:        \
+    case OPT_S_CIPHER:            \
+    case OPT_S_CIPHERSUITES:      \
+    case OPT_S_RECORD_PADDING:    \
+    case OPT_S_NO_RENEGOTIATION:  \
+    case OPT_S_MINPROTO:          \
+    case OPT_S_MAXPROTO:          \
+    case OPT_S_DEBUGBROKE:        \
+    case OPT_S_NO_MIDDLEBOX:      \
+    case OPT_S_NO_ETM:            \
+    case OPT_S_NO_EMS
 
-#define IS_NO_PROT_FLAG(o) \
- (o == OPT_S_NOSSL3 || o == OPT_S_NOTLS1 || o == OPT_S_NOTLS1_1 \
-  || o == OPT_S_NOTLS1_2 || o == OPT_S_NOTLS1_3)
+#define IS_NO_PROT_FLAG(o)                                         \
+    (o == OPT_S_NOSSL3 || o == OPT_S_NOTLS1 || o == OPT_S_NOTLS1_1 \
+        || o == OPT_S_NOTLS1_2 || o == OPT_S_NOTLS1_3)
 
 /*
  * Random state options.
  */
-# define OPT_R_ENUM \
-        OPT_R__FIRST=1500, OPT_R_RAND, OPT_R_WRITERAND, OPT_R__LAST
+#define OPT_R_ENUM \
+    OPT_R__FIRST = 1500, OPT_R_RAND, OPT_R_WRITERAND, OPT_R__LAST
 
-# define OPT_R_OPTIONS \
-    OPT_SECTION("Random state"), \
-    {"rand", OPT_R_RAND, 's', "Load the given file(s) into the random number generator"}, \
-    {"writerand", OPT_R_WRITERAND, '>', "Write random data to the specified file"}
+#define OPT_R_OPTIONS                                                                           \
+    OPT_SECTION("Random state"),                                                                \
+        { "rand", OPT_R_RAND, 's', "Load the given file(s) into the random number generator" }, \
+        { "writerand", OPT_R_WRITERAND, '>', "Write random data to the specified file" }
 
-# define OPT_R_CASES \
-        OPT_R__FIRST: case OPT_R__LAST: break; \
-        case OPT_R_RAND: case OPT_R_WRITERAND
+#define OPT_R_CASES   \
+    OPT_R__FIRST:     \
+    case OPT_R__LAST: \
+    break;            \
+    case OPT_R_RAND:  \
+    case OPT_R_WRITERAND
 
 /*
  * Provider options.
  */
-# define OPT_PROV_ENUM \
-        OPT_PROV__FIRST=1600, \
-        OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH, OPT_PROV_PROPQUERY, \
-        OPT_PROV_PARAM, \
-        OPT_PROV__LAST
+#define OPT_PROV_ENUM                                              \
+    OPT_PROV__FIRST = 1600,                                        \
+    OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH, OPT_PROV_PROPQUERY, \
+    OPT_PROV_PARAM,                                                \
+    OPT_PROV__LAST
 
-# define OPT_CONFIG_OPTION \
-        { "config", OPT_CONFIG, '<', "Load a configuration file (this may load modules)" }
+#define OPT_CONFIG_OPTION \
+    { "config", OPT_CONFIG, '<', "Load a configuration file (this may load modules)" }
 
-# define OPT_PROV_OPTIONS \
-        OPT_SECTION("Provider"), \
+#define OPT_PROV_OPTIONS                                                                                                         \
+    OPT_SECTION("Provider"),                                                                                                     \
         { "provider-path", OPT_PROV_PROVIDER_PATH, 's', "Provider load path (must be before 'provider' argument if required)" }, \
-        { "provider", OPT_PROV_PROVIDER, 's', "Provider to load (can be specified multiple times)" }, \
-        { "provparam", OPT_PROV_PARAM, 's', "Set a provider key-value parameter" }, \
+        { "provider", OPT_PROV_PROVIDER, 's', "Provider to load (can be specified multiple times)" },                            \
+        { "provparam", OPT_PROV_PARAM, 's', "Set a provider key-value parameter" },                                              \
         { "propquery", OPT_PROV_PROPQUERY, 's', "Property query used when fetching algorithms" }
 
-# define OPT_PROV_CASES \
-        OPT_PROV__FIRST: case OPT_PROV__LAST: break; \
-        case OPT_PROV_PROVIDER: \
-        case OPT_PROV_PROVIDER_PATH: \
-        case OPT_PROV_PARAM: \
-        case OPT_PROV_PROPQUERY
+#define OPT_PROV_CASES           \
+    OPT_PROV__FIRST:             \
+    case OPT_PROV__LAST:         \
+    break;                       \
+    case OPT_PROV_PROVIDER:      \
+    case OPT_PROV_PROVIDER_PATH: \
+    case OPT_PROV_PARAM:         \
+    case OPT_PROV_PROPQUERY
 
 /*
  * Option parsing.
@@ -367,27 +378,24 @@ typedef struct string_int_pair_st {
 } OPT_PAIR, STRINT_PAIR;
 
 /* Flags to pass into opt_format; see FORMAT_xxx, below. */
-# define OPT_FMT_PEM             (1L <<  1)
-# define OPT_FMT_DER             (1L <<  2)
-# define OPT_FMT_B64             (1L <<  3)
-# define OPT_FMT_PKCS12          (1L <<  4)
-# define OPT_FMT_SMIME           (1L <<  5)
-# define OPT_FMT_ENGINE          (1L <<  6)
-# define OPT_FMT_MSBLOB          (1L <<  7)
-# define OPT_FMT_NSS             (1L <<  8)
-# define OPT_FMT_TEXT            (1L <<  9)
-# define OPT_FMT_HTTP            (1L << 10)
-# define OPT_FMT_PVK             (1L << 11)
+#define OPT_FMT_PEM (1L << 1)
+#define OPT_FMT_DER (1L << 2)
+#define OPT_FMT_B64 (1L << 3)
+#define OPT_FMT_PKCS12 (1L << 4)
+#define OPT_FMT_SMIME (1L << 5)
+#define OPT_FMT_ENGINE (1L << 6)
+#define OPT_FMT_MSBLOB (1L << 7)
+#define OPT_FMT_NSS (1L << 8)
+#define OPT_FMT_TEXT (1L << 9)
+#define OPT_FMT_HTTP (1L << 10)
+#define OPT_FMT_PVK (1L << 11)
 
-# define OPT_FMT_PEMDER  (OPT_FMT_PEM | OPT_FMT_DER)
-# define OPT_FMT_ASN1    (OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64)
-# define OPT_FMT_PDE     (OPT_FMT_PEMDER | OPT_FMT_ENGINE)
-# define OPT_FMT_PDS     (OPT_FMT_PEMDER | OPT_FMT_SMIME)
-# define OPT_FMT_ANY     ( \
-        OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64 | \
-        OPT_FMT_PKCS12 | OPT_FMT_SMIME |                     \
-        OPT_FMT_ENGINE | OPT_FMT_MSBLOB | OPT_FMT_NSS | \
-        OPT_FMT_TEXT | OPT_FMT_HTTP | OPT_FMT_PVK)
+#define OPT_FMT_PEMDER (OPT_FMT_PEM | OPT_FMT_DER)
+#define OPT_FMT_ASN1 (OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64)
+#define OPT_FMT_PDE (OPT_FMT_PEMDER | OPT_FMT_ENGINE)
+#define OPT_FMT_PDS (OPT_FMT_PEMDER | OPT_FMT_SMIME)
+#define OPT_FMT_ANY ( \
+    OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64 | OPT_FMT_PKCS12 | OPT_FMT_SMIME | OPT_FMT_ENGINE | OPT_FMT_MSBLOB | OPT_FMT_NSS | OPT_FMT_TEXT | OPT_FMT_HTTP | OPT_FMT_PVK)
 
 /* Divide options into sections when displaying usage */
 #define OPT_SECTION(sec) { OPT_SECTION_STR, 1, '-', sec " options:\n" }
@@ -440,5 +448,4 @@ int opt_check_rest_arg(const char *expected);
 /* Returns non-zero if legacy paths are still available */
 int opt_legacy_okay(void);
 
-
 #endif /* OSSL_APPS_OPT_H */
diff --git a/crypto/openssl/apps/include/platform.h b/crypto/openssl/apps/include/platform.h
index 62fc99c5fd7a..ec12a41af7c7 100644
--- a/crypto/openssl/apps/include/platform.h
+++ b/crypto/openssl/apps/include/platform.h
@@ -8,25 +8,25 @@
  */
 
 #ifndef OSSL_APPS_PLATFORM_H
-# define OSSL_APPS_PLATFORM_H
+#define OSSL_APPS_PLATFORM_H
 
-# include <openssl/e_os2.h>
+#include <openssl/e_os2.h>
 
-# if defined(OPENSSL_SYS_VMS) && defined(__DECC)
+#if defined(OPENSSL_SYS_VMS) && defined(__DECC)
 /*
  * VMS C only for now, implemented in vms_decc_init.c
  * If other C compilers forget to terminate argv with NULL, this function
  * can be reused.
  */
 char **copy_argv(int *argc, char *argv[]);
-# endif
+#endif
 
-# ifdef _WIN32
+#ifdef _WIN32
 /*
  * Win32-specific argv initialization that splits OS-supplied UNICODE
  * command line string to array of UTF8-encoded strings.
  */
 void win32_utf8argv(int *argc, char **argv[]);
-# endif
+#endif
 
 #endif
diff --git a/crypto/openssl/apps/include/s_apps.h b/crypto/openssl/apps/include/s_apps.h
index 33c3b6278c82..c6a9a890c21d 100644
--- a/crypto/openssl/apps/include/s_apps.h
+++ b/crypto/openssl/apps/include/s_apps.h
@@ -12,8 +12,8 @@
 #include <openssl/ssl.h>
 #include <openssl/srp.h>
 
-#define PORT            "4433"
-#define PROTOCOL        "tcp"
+#define PORT "4433"
+#define PROTOCOL "tcp"
 
 #define SSL_VERSION_ALLOWS_RENEGOTIATION(s) \
     (SSL_is_dtls(s) || (SSL_version(s) < TLS1_3_VERSION))
@@ -22,48 +22,48 @@ typedef int (*do_server_cb)(int s, int stype, int prot, unsigned char *context);
 void get_sock_info_address(int asock, char **hostname, char **service);
 int report_server_accept(BIO *out, int asock, int with_address, int with_pid);
 int do_server(int *accept_sock, const char *host, const char *port,
-              int family, int type, int protocol, do_server_cb cb,
-              unsigned char *context, int naccept, BIO *bio_s_out,
-              int tfo);
+    int family, int type, int protocol, do_server_cb cb,
+    unsigned char *context, int naccept, BIO *bio_s_out,
+    int tfo);
 int verify_callback(int ok, X509_STORE_CTX *ctx);
 
 int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file);
 int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key,
-                       STACK_OF(X509) *chain, int build_chain);
+    STACK_OF(X509) *chain, int build_chain);
 int ssl_print_sigalgs(BIO *out, SSL *s);
 int ssl_print_point_formats(BIO *out, SSL *s);
 int ssl_print_groups(BIO *out, SSL *s, int noshared);
 int ssl_print_tmp_key(BIO *out, SSL *s);
 int init_client(int *sock, const char *host, const char *port,
-                const char *bindhost, const char *bindport,
-                int family, int type, int protocol, int tfo, int doconn,
-                BIO_ADDR **ba_ret);
+    const char *bindhost, const char *bindport,
+    int family, int type, int protocol, int tfo, int doconn,
+    BIO_ADDR **ba_ret);
 int should_retry(int i);
 void do_ssl_shutdown(SSL *ssl);
 
 long bio_dump_callback(BIO *bio, int cmd, const char *argp, size_t len,
-                       int argi, long argl, int ret, size_t *processed);
+    int argi, long argl, int ret, size_t *processed);
 
 void apps_ssl_info_callback(const SSL *s, int where, int ret);
 void msg_cb(int write_p, int version, int content_type, const void *buf,
-            size_t len, SSL *ssl, void *arg);
+    size_t len, SSL *ssl, void *arg);
 void tlsext_cb(SSL *s, int client_server, int type, const unsigned char *data,
-               int len, void *arg);
+    int len, void *arg);
 
 int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
-                             unsigned int *cookie_len);
+    unsigned int *cookie_len);
 int verify_cookie_callback(SSL *ssl, const unsigned char *cookie,
-                           unsigned int cookie_len);
+    unsigned int cookie_len);
 
-#ifdef __VMS                     /* 31 char symbol name limit */
-# define generate_stateless_cookie_callback      generate_stateless_cookie_cb
-# define verify_stateless_cookie_callback        verify_stateless_cookie_cb
+#ifdef __VMS /* 31 char symbol name limit */
+#define generate_stateless_cookie_callback generate_stateless_cookie_cb
+#define verify_stateless_cookie_callback verify_stateless_cookie_cb
 #endif
 
 int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
-                                       size_t *cookie_len);
+    size_t *cookie_len);
 int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie,
-                                     size_t cookie_len);
+    size_t cookie_len);
 
 typedef struct ssl_excert_st SSL_EXCERT;
 
@@ -75,12 +75,12 @@ void print_verify_detail(SSL *s, BIO *bio);
 void print_ssl_summary(SSL *s);
 int config_ctx(SSL_CONF_CTX *cctx, STACK_OF(OPENSSL_STRING) *str, SSL_CTX *ctx);
 int ssl_ctx_add_crls(SSL_CTX *ctx, STACK_OF(X509_CRL) *crls,
-                     int crl_download);
+    int crl_download);
 int ssl_load_stores(SSL_CTX *ctx, const char *vfyCApath,
-                    const char *vfyCAfile, const char *vfyCAstore,
-                    const char *chCApath, const char *chCAfile,
-                    const char *chCAstore, STACK_OF(X509_CRL) *crls,
-                    int crl_download);
+    const char *vfyCAfile, const char *vfyCAstore,
+    const char *chCApath, const char *chCAfile,
+    const char *chCAstore, STACK_OF(X509_CRL) *crls,
+    int crl_download);
 void ssl_ctx_security_debug(SSL_CTX *ctx, int verbose);
 int set_keylog_file(SSL_CTX *ctx, const char *keylog_file);
 void print_ca_names(BIO *bio, SSL *s);
@@ -91,14 +91,14 @@ void ssl_print_secure_renegotiation_notes(BIO *bio, SSL *s);
 typedef struct srp_arg_st {
     char *srppassin;
     char *srplogin;
-    int msg;                    /* copy from c_msg */
-    int debug;                  /* copy from c_debug */
-    int amp;                    /* allow more groups */
-    int strength;               /* minimal size for N */
+    int msg; /* copy from c_msg */
+    int debug; /* copy from c_debug */
+    int amp; /* allow more groups */
+    int strength; /* minimal size for N */
 } SRP_ARG;
 
 int set_up_srp_arg(SSL_CTX *ctx, SRP_ARG *srp_arg, int srp_lateuser, int c_msg,
-                   int c_debug);
+    int c_debug);
 void set_up_dummy_srp(SSL_CTX *ctx);
 
 /* The server side SRP context that we pass to all SRP related callbacks */
@@ -109,6 +109,6 @@ typedef struct srpsrvparm_st {
 } srpsrvparm;
 
 int set_up_srp_verifier_file(SSL_CTX *ctx, srpsrvparm *srp_callback_parm,
-                             char *srpuserseed, char *srp_verifier_file);
+    char *srpuserseed, char *srp_verifier_file);
 void lookup_srp_user(srpsrvparm *srp_callback_parm, BIO *bio_s_out);
 #endif /* OPENSSL_NO_SRP */
diff --git a/crypto/openssl/apps/include/vms_term_sock.h b/crypto/openssl/apps/include/vms_term_sock.h
index eae37b1af931..6e0cda9a3001 100644
--- a/crypto/openssl/apps/include/vms_term_sock.h
+++ b/crypto/openssl/apps/include/vms_term_sock.h
@@ -9,23 +9,23 @@
  */
 
 #ifndef OSSL_APPS_VMS_TERM_SOCK_H
-# define OSSL_APPS_VMS_TERM_SOCK_H
+#define OSSL_APPS_VMS_TERM_SOCK_H
 
 /*
 ** Terminal Socket Function Codes
 */
-# define TERM_SOCK_CREATE       1
-# define TERM_SOCK_DELETE       2
+#define TERM_SOCK_CREATE 1
+#define TERM_SOCK_DELETE 2
 
 /*
 ** Terminal Socket Status Codes
 */
-# define TERM_SOCK_FAILURE      0
-# define TERM_SOCK_SUCCESS      1
+#define TERM_SOCK_FAILURE 0
+#define TERM_SOCK_SUCCESS 1
 
 /*
 ** Terminal Socket Prototype
 */
-int TerminalSocket (int FunctionCode, int *ReturnSocket);
+int TerminalSocket(int FunctionCode, int *ReturnSocket);
 
 #endif
diff --git a/crypto/openssl/apps/info.c b/crypto/openssl/apps/info.c
index 5a469eed9695..779a02937d9a 100644
--- a/crypto/openssl/apps/info.c
+++ b/crypto/openssl/apps/info.c
@@ -13,27 +13,34 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_CONFIGDIR, OPT_ENGINESDIR, OPT_MODULESDIR, OPT_DSOEXT, OPT_DIRNAMESEP,
-    OPT_LISTSEP, OPT_SEEDS, OPT_CPUSETTINGS, OPT_WINDOWSCONTEXT
+    OPT_CONFIGDIR,
+    OPT_ENGINESDIR,
+    OPT_MODULESDIR,
+    OPT_DSOEXT,
+    OPT_DIRNAMESEP,
+    OPT_LISTSEP,
+    OPT_SEEDS,
+    OPT_CPUSETTINGS,
+    OPT_WINDOWSCONTEXT
 } OPTION_CHOICE;
 
 const OPTIONS info_options[] = {
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("Output"),
-    {"configdir", OPT_CONFIGDIR, '-', "Default configuration file directory"},
-    {"enginesdir", OPT_ENGINESDIR, '-', "Default engine module directory"},
-    {"modulesdir", OPT_MODULESDIR, '-',
-     "Default module directory (other than engine modules)"},
-    {"dsoext", OPT_DSOEXT, '-', "Configured extension for modules"},
-    {"dirnamesep", OPT_DIRNAMESEP, '-', "Directory-filename separator"},
-    {"listsep", OPT_LISTSEP, '-', "List separator character"},
-    {"seeds", OPT_SEEDS, '-', "Seed sources"},
-    {"cpusettings", OPT_CPUSETTINGS, '-', "CPU settings info"},
-    {"windowscontext", OPT_WINDOWSCONTEXT, '-', "Windows install context"},
-    {NULL}
+    { "configdir", OPT_CONFIGDIR, '-', "Default configuration file directory" },
+    { "enginesdir", OPT_ENGINESDIR, '-', "Default engine module directory" },
+    { "modulesdir", OPT_MODULESDIR, '-',
+        "Default module directory (other than engine modules)" },
+    { "dsoext", OPT_DSOEXT, '-', "Configured extension for modules" },
+    { "dirnamesep", OPT_DIRNAMESEP, '-', "Directory-filename separator" },
+    { "listsep", OPT_LISTSEP, '-', "List separator character" },
+    { "seeds", OPT_SEEDS, '-', "Seed sources" },
+    { "cpusettings", OPT_CPUSETTINGS, '-', "CPU settings info" },
+    { "windowscontext", OPT_WINDOWSCONTEXT, '-', "Windows install context" },
+    { NULL }
 };
 
 int info_main(int argc, char **argv)
@@ -47,7 +54,7 @@ int info_main(int argc, char **argv)
     while ((o = opt_next()) != OPT_EOF) {
         switch (o) {
         default:
-opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -106,6 +113,6 @@ opthelp:
     typedata = OPENSSL_info(type);
     BIO_printf(bio_out, "%s\n", typedata == NULL ? "Undefined" : typedata);
     ret = 0;
- end:
+end:
     return ret;
 }
diff --git a/crypto/openssl/apps/kdf.c b/crypto/openssl/apps/kdf.c
index 89ee1f69c766..222979f7a97f 100644
--- a/crypto/openssl/apps/kdf.c
+++ b/crypto/openssl/apps/kdf.c
@@ -19,37 +19,42 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_KDFOPT, OPT_BIN, OPT_KEYLEN, OPT_OUT,
-    OPT_CIPHER, OPT_DIGEST, OPT_MAC,
+    OPT_KDFOPT,
+    OPT_BIN,
+    OPT_KEYLEN,
+    OPT_OUT,
+    OPT_CIPHER,
+    OPT_DIGEST,
+    OPT_MAC,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS kdf_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] kdf_name\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] kdf_name\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"kdfopt", OPT_KDFOPT, 's', "KDF algorithm control parameters in n:v form"},
-    {"cipher", OPT_CIPHER, 's', "Cipher"},
-    {"digest", OPT_DIGEST, 's', "Digest"},
-    {"mac", OPT_MAC, 's', "MAC"},
-    {OPT_MORE_STR, 1, '-', "See 'Supported Controls' in the EVP_KDF_ docs\n"},
-    {"keylen", OPT_KEYLEN, 's', "The size of the output derived key"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "kdfopt", OPT_KDFOPT, 's', "KDF algorithm control parameters in n:v form" },
+    { "cipher", OPT_CIPHER, 's', "Cipher" },
+    { "digest", OPT_DIGEST, 's', "Digest" },
+    { "mac", OPT_MAC, 's', "MAC" },
+    { OPT_MORE_STR, 1, '-', "See 'Supported Controls' in the EVP_KDF_ docs\n" },
+    { "keylen", OPT_KEYLEN, 's', "The size of the output derived key" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output to filename rather than stdout"},
-    {"binary", OPT_BIN, '-',
-        "Output in binary format (default is hexadecimal)"},
+    { "out", OPT_OUT, '>', "Output to filename rather than stdout" },
+    { "binary", OPT_BIN, '-',
+        "Output in binary format (default is hexadecimal)" },
 
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"kdf_name", 0, 0, "Name of the KDF algorithm"},
-    {NULL}
+    { "kdf_name", 0, 0, "Name of the KDF algorithm" },
+    { NULL }
 };
 
 static char *alloc_kdf_algorithm_name(STACK_OF(OPENSSL_STRING) **optp,
-                                      const char *name, const char *arg)
+    const char *name, const char *arg)
 {
     size_t len = strlen(name) + strlen(arg) + 2;
     char *res;
@@ -85,7 +90,7 @@ int kdf_main(int argc, char **argv)
     while ((o = opt_next()) != OPT_EOF) {
         switch (o) {
         default:
-opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto err;
         case OPT_HELP:
@@ -139,7 +144,8 @@ opthelp:
         goto opthelp;
 
     if ((kdf = EVP_KDF_fetch(app_get0_libctx(), argv[0],
-                             app_get0_propq())) == NULL) {
+             app_get0_propq()))
+        == NULL) {
         BIO_printf(bio_err, "Invalid KDF name %s\n", argv[0]);
         goto opthelp;
     }
@@ -150,8 +156,7 @@ opthelp:
 
     if (opts != NULL) {
         int ok = 1;
-        OSSL_PARAM *params =
-            app_params_new_from_opts(opts, EVP_KDF_settable_ctx_params(kdf));
+        OSSL_PARAM *params = app_params_new_from_opts(opts, EVP_KDF_settable_ctx_params(kdf));
 
         if (params == NULL)
             goto err;
diff --git a/crypto/openssl/apps/lib/app_libctx.c b/crypto/openssl/apps/lib/app_libctx.c
index 2f68cb0a75ea..fb26e8e4874e 100644
--- a/crypto/openssl/apps/lib/app_libctx.c
+++ b/crypto/openssl/apps/lib/app_libctx.c
@@ -45,4 +45,3 @@ OSSL_LIB_CTX *app_create_libctx(void)
         opt_printf_stderr("Failed to create library context\n");
     return app_libctx;
 }
-
diff --git a/crypto/openssl/apps/lib/app_params.c b/crypto/openssl/apps/lib/app_params.c
index 95e1298ee926..a428afe8f38f 100644
--- a/crypto/openssl/apps/lib/app_params.c
+++ b/crypto/openssl/apps/lib/app_params.c
@@ -63,7 +63,7 @@ static int describe_param_type(char *buf, size_t bufsz, const OSSL_PARAM *param)
         printed_len = BIO_snprintf(buf, bufsz, " (arbitrary size)");
     else
         printed_len = BIO_snprintf(buf, bufsz, " (max %zu bytes large)",
-                                   param->data_size);
+            param->data_size);
     if (printed_len > 0) {
         buf += printed_len;
         bufsz -= printed_len;
@@ -85,7 +85,7 @@ int print_param_types(const char *thing, const OSSL_PARAM *pdefs, int indent)
     } else {
         BIO_printf(bio_out, "%*s%s:\n", indent, "", thing);
         for (; pdefs->key != NULL; pdefs++) {
-            char buf[200];       /* This should be ample space */
+            char buf[200]; /* This should be ample space */
 
             describe_param_type(buf, sizeof(buf), pdefs);
             BIO_printf(bio_out, "%*s  %s\n", indent, "", buf);
@@ -125,8 +125,7 @@ void print_param_value(const OSSL_PARAM *p, int indent)
         break;
     default:
         BIO_printf(bio_out, "unknown type (%u) of %zu bytes\n",
-                   p->data_type, p->data_size);
+            p->data_type, p->data_size);
         break;
     }
 }
-
diff --git a/crypto/openssl/apps/lib/app_provider.c b/crypto/openssl/apps/lib/app_provider.c
index 6db1d4b0b50c..6986ab4c1073 100644
--- a/crypto/openssl/apps/lib/app_provider.c
+++ b/crypto/openssl/apps/lib/app_provider.c
@@ -39,7 +39,7 @@ int app_provider_load(OSSL_LIB_CTX *libctx, const char *provider_name)
     if (prov == NULL) {
         opt_printf_stderr("%s: unable to load provider %s\n"
                           "Hint: use -provider-path option or OPENSSL_MODULES environment variable.\n",
-                          opt_getprog(), provider_name);
+            opt_getprog(), provider_name);
         ERR_print_errors(bio_err);
         return 0;
     }
@@ -92,7 +92,7 @@ static int opt_provider_param(const char *arg)
     if ((copy = OPENSSL_strdup(arg)) == NULL
         || (p.val = strchr(copy, '=')) == NULL) {
         opt_printf_stderr("%s: malformed '-provparam' option value: '%s'\n",
-                          opt_getprog(), arg);
+            opt_getprog(), arg);
         goto end;
     }
 
@@ -118,7 +118,7 @@ static int opt_provider_param(const char *arg)
     /* The key must not be empty */
     if (*p.key == '\0') {
         opt_printf_stderr("%s: malformed '-provparam' option value: '%s'\n",
-                          opt_getprog(), arg);
+            opt_getprog(), arg);
         goto end;
     }
 
@@ -126,14 +126,14 @@ static int opt_provider_param(const char *arg)
     ret = OSSL_PROVIDER_do_all(app_get0_libctx(), set_prov_param, (void *)&p);
     if (ret == 0) {
         opt_printf_stderr("%s: Error setting provider '%s' parameter '%s'\n",
-                          opt_getprog(), p.name, p.key);
+            opt_getprog(), p.name, p.key);
     } else if (p.found == 0) {
         opt_printf_stderr("%s: No provider named '%s' is loaded\n",
-                          opt_getprog(), p.name);
+            opt_getprog(), p.name);
         ret = 0;
     }
 
- end:
+end:
     OPENSSL_free(copy);
     return ret;
 }
diff --git a/crypto/openssl/apps/lib/app_rand.c b/crypto/openssl/apps/lib/app_rand.c
index 64d0f9b30910..061211a0b64e 100644
--- a/crypto/openssl/apps/lib/app_rand.c
+++ b/crypto/openssl/apps/lib/app_rand.c
@@ -89,11 +89,10 @@ int app_RAND_write(void)
         ret = 0;
     }
     OPENSSL_free(save_rand_file);
-    save_rand_file =  NULL;
+    save_rand_file = NULL;
     return ret;
 }
 
-
 /*
  * See comments in opt_verify for explanation of this.
  */
@@ -107,7 +106,7 @@ int opt_rand(int opt)
         break;
     case OPT_R_RAND:
         if (randfiles == NULL
-                && (randfiles = sk_OPENSSL_STRING_new_null()) == NULL)
+            && (randfiles = sk_OPENSSL_STRING_new_null()) == NULL)
             return 0;
         if (!sk_OPENSSL_STRING_push(randfiles, opt_arg()))
             return 0;
diff --git a/crypto/openssl/apps/lib/app_x509.c b/crypto/openssl/apps/lib/app_x509.c
index f2c22948f201..11cb3fa342dc 100644
--- a/crypto/openssl/apps/lib/app_x509.c
+++ b/crypto/openssl/apps/lib/app_x509.c
@@ -38,53 +38,51 @@ static int x509_ctrl(void *object, int cmd, void *value, size_t value_n)
 {
     switch (cmd) {
 #ifdef EVP_PKEY_CTRL_SET1_ID
-    case EVP_PKEY_CTRL_SET1_ID:
-        {
-            ASN1_OCTET_STRING *v = mk_octet_string(value, value_n);
+    case EVP_PKEY_CTRL_SET1_ID: {
+        ASN1_OCTET_STRING *v = mk_octet_string(value, value_n);
 
-            if (v == NULL) {
-                BIO_printf(bio_err,
-                           "error: setting distinguishing ID in certificate failed\n");
-                return 0;
-            }
-
-            X509_set0_distinguishing_id(object, v);
-            return 1;
+        if (v == NULL) {
+            BIO_printf(bio_err,
+                "error: setting distinguishing ID in certificate failed\n");
+            return 0;
         }
+
+        X509_set0_distinguishing_id(object, v);
+        return 1;
+    }
 #endif
     default:
         break;
     }
-    return -2;     /* typical EVP_PKEY return for "unsupported" */
+    return -2; /* typical EVP_PKEY return for "unsupported" */
 }
 
 static int x509_req_ctrl(void *object, int cmd, void *value, size_t value_n)
 {
     switch (cmd) {
 #ifdef EVP_PKEY_CTRL_SET1_ID
-    case EVP_PKEY_CTRL_SET1_ID:
-        {
-            ASN1_OCTET_STRING *v = mk_octet_string(value, value_n);
+    case EVP_PKEY_CTRL_SET1_ID: {
+        ASN1_OCTET_STRING *v = mk_octet_string(value, value_n);
 
-            if (v == NULL) {
-                BIO_printf(bio_err,
-                           "error: setting distinguishing ID in certificate signing request failed\n");
-                return 0;
-            }
-
-            X509_REQ_set0_distinguishing_id(object, v);
-            return 1;
+        if (v == NULL) {
+            BIO_printf(bio_err,
+                "error: setting distinguishing ID in certificate signing request failed\n");
+            return 0;
         }
+
+        X509_REQ_set0_distinguishing_id(object, v);
+        return 1;
+    }
 #endif
     default:
         break;
     }
-    return -2;     /* typical EVP_PKEY return for "unsupported" */
+    return -2; /* typical EVP_PKEY return for "unsupported" */
 }
 
 static int do_x509_ctrl_string(int (*ctrl)(void *object, int cmd,
-                                           void *value, size_t value_n),
-                               void *object, const char *value)
+                                   void *value, size_t value_n),
+    void *object, const char *value)
 {
     int rv = 0;
     char *stmp, *vtmp = NULL;
diff --git a/crypto/openssl/apps/lib/apps.c b/crypto/openssl/apps/lib/apps.c
index 6e0f756524d8..74644157e5ca 100644
--- a/crypto/openssl/apps/lib/apps.c
+++ b/crypto/openssl/apps/lib/apps.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -12,13 +12,13 @@
  * On VMS, you need to define this to get the declaration of fileno().  The
  * value 2 is to make sure no function defined in POSIX-2 is left undefined.
  */
-# define _POSIX_C_SOURCE 2
+#define _POSIX_C_SOURCE 2
 #endif
 
 #ifndef OPENSSL_NO_ENGINE
 /* We need to use some deprecated APIs */
-# define OPENSSL_SUPPRESS_DEPRECATED
-# include <openssl/engine.h>
+#define OPENSSL_SUPPRESS_DEPRECATED
+#include <openssl/engine.h>
 #endif
 
 #include <stdio.h>
@@ -26,8 +26,8 @@
 #include <string.h>
 #include <sys/types.h>
 #ifndef OPENSSL_NO_POSIX_IO
-# include <sys/stat.h>
-# include <fcntl.h>
+#include <sys/stat.h>
+#include <fcntl.h>
 #endif
 #include <ctype.h>
 #include <errno.h>
@@ -54,19 +54,19 @@
 
 #ifdef _WIN32
 static int WIN32_rename(const char *from, const char *to);
-# define rename(from, to) WIN32_rename((from), (to))
+#define rename(from, to) WIN32_rename((from), (to))
 #endif
 
 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
-# include <conio.h>
+#include <conio.h>
 #endif
 
 #if defined(OPENSSL_SYS_MSDOS) && !defined(_WIN32) || defined(__BORLANDC__)
-# define _kbhit kbhit
+#define _kbhit kbhit
 #endif
 
 static BIO *bio_open_default_(const char *filename, char mode, int format,
-                              int quiet);
+    int quiet);
 
 #define PASS_SOURCE_SIZE_MAX 4
 
@@ -79,9 +79,9 @@ typedef struct {
 } NAME_EX_TBL;
 
 static int set_table_opts(unsigned long *flags, const char *arg,
-                          const NAME_EX_TBL *in_tbl);
+    const NAME_EX_TBL *in_tbl);
 static int set_multi_opts(unsigned long *flags, const char *arg,
-                          const NAME_EX_TBL *in_tbl);
+    const NAME_EX_TBL *in_tbl);
 int app_init(long mesgwin);
 
 #ifndef APP_INIT
@@ -92,9 +92,9 @@ int app_init(long mesgwin)
 #endif
 
 int ctx_set_verify_locations(SSL_CTX *ctx,
-                             const char *CAfile, int noCAfile,
-                             const char *CApath, int noCApath,
-                             const char *CAstore, int noCAstore)
+    const char *CAfile, int noCAfile,
+    const char *CApath, int noCApath,
+    const char *CAstore, int noCAstore)
 {
     if (CAfile == NULL && CApath == NULL && CAstore == NULL) {
         if (!noCAfile && SSL_CTX_set_default_verify_file(ctx) <= 0)
@@ -143,12 +143,7 @@ int set_nameopt(const char *arg)
 
 unsigned long get_nameopt(void)
 {
-    return
-        nmflag_set ? nmflag : XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN
-                              | ASN1_STRFLGS_ESC_CTRL
-                              | ASN1_STRFLGS_UTF8_CONVERT
-                              | ASN1_STRFLGS_DUMP_UNKNOWN
-                              | ASN1_STRFLGS_DUMP_DER;
+    return nmflag_set ? nmflag : XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_UTF8_CONVERT | ASN1_STRFLGS_DUMP_UNKNOWN | ASN1_STRFLGS_DUMP_DER;
 }
 
 void dump_cert_text(BIO *out, X509 *x)
@@ -174,11 +169,11 @@ char *get_passwd(const char *pass, const char *desc)
         BIO_printf(bio_err, "Error getting password for %s\n", desc);
     if (pass != NULL && result == NULL) {
         BIO_printf(bio_err,
-                   "Trying plain input string (better precede with 'pass:')\n");
+            "Trying plain input string (better precede with 'pass:')\n");
         result = OPENSSL_strdup(pass);
         if (result == NULL)
             BIO_printf(bio_err,
-                       "Out of memory getting password for %s\n", desc);
+                "Out of memory getting password for %s\n", desc);
     }
     return result;
 }
@@ -271,12 +266,12 @@ static char *app_get_pass(const char *arg, int keepbio)
             tmp = strchr(arg, ':');
             if (tmp == NULL || tmp - arg > PASS_SOURCE_SIZE_MAX)
                 BIO_printf(bio_err,
-                           "Invalid password argument, missing ':' within the first %d chars\n",
-                           PASS_SOURCE_SIZE_MAX + 1);
+                    "Invalid password argument, missing ':' within the first %d chars\n",
+                    PASS_SOURCE_SIZE_MAX + 1);
             else
                 BIO_printf(bio_err,
-                           "Invalid password argument, starting with \"%.*s\"\n",
-                           (int)(tmp - arg + 1), arg);
+                    "Invalid password argument, starting with \"%.*s\"\n",
+                    (int)(tmp - arg + 1), arg);
             return NULL;
         }
     }
@@ -309,7 +304,7 @@ char *app_conf_try_string(const CONF *conf, const char *group, const char *name)
 }
 
 int app_conf_try_number(const CONF *conf, const char *group, const char *name,
-                        long *result)
+    long *result)
 {
     int ok;
 
@@ -337,7 +332,7 @@ CONF *app_load_config_bio(BIO *in, const char *filename)
         BIO_printf(bio_err, "%s: Can't load ", opt_getprog());
     } else {
         BIO_printf(bio_err, "%s: Error on line %ld of ", opt_getprog(),
-                   errorline);
+            errorline);
     }
     if (filename != NULL)
         BIO_printf(bio_err, "config file \"%s\"\n", filename);
@@ -412,7 +407,7 @@ int add_oid_section(CONF *conf)
         cnf = sk_CONF_VALUE_value(sktmp, i);
         if (OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {
             BIO_printf(bio_err, "problem creating object %s=%s\n",
-                       cnf->name, cnf->value);
+                cnf->name, cnf->value);
             return 0;
         }
     }
@@ -434,11 +429,11 @@ CONF *app_load_config_modules(const char *configfile)
     return conf;
 }
 
-#define IS_HTTP(uri) ((uri) != NULL  && HAS_PREFIX(uri, OSSL_HTTP_PREFIX))
+#define IS_HTTP(uri) ((uri) != NULL && HAS_PREFIX(uri, OSSL_HTTP_PREFIX))
 #define IS_HTTPS(uri) ((uri) != NULL && HAS_PREFIX(uri, OSSL_HTTPS_PREFIX))
 
 X509 *load_cert_pass(const char *uri, int format, int maybe_stdin,
-                     const char *pass, const char *desc)
+    const char *pass, const char *desc)
 {
     X509 *cert = NULL;
 
@@ -454,13 +449,13 @@ X509 *load_cert_pass(const char *uri, int format, int maybe_stdin,
         }
     } else {
         (void)load_key_certs_crls(uri, format, maybe_stdin, pass, desc, 0,
-                                  NULL, NULL, NULL, &cert, NULL, NULL, NULL);
+            NULL, NULL, NULL, &cert, NULL, NULL, NULL);
     }
     return cert;
 }
 
 X509_CRL *load_crl(const char *uri, int format, int maybe_stdin,
-                   const char *desc)
+    const char *desc)
 {
     X509_CRL *crl = NULL;
 
@@ -476,7 +471,7 @@ X509_CRL *load_crl(const char *uri, int format, int maybe_stdin,
         }
     } else {
         (void)load_key_certs_crls(uri, format, maybe_stdin, NULL, desc, 0,
-                                  NULL, NULL,  NULL, NULL, NULL, &crl, NULL);
+            NULL, NULL, NULL, NULL, NULL, &crl, NULL);
     }
     return crl;
 }
@@ -500,7 +495,7 @@ X509_REQ *load_csr(const char *file, int format, const char *desc)
     else
         print_format_error(format, OPT_FMT_PEMDER);
 
- end:
+end:
     if (req == NULL) {
         ERR_print_errors(bio_err);
         if (desc != NULL)
@@ -512,7 +507,7 @@ X509_REQ *load_csr(const char *file, int format, const char *desc)
 
 /* Better extend OSSL_STORE to support CSRs, see FR #15725 */
 X509_REQ *load_csr_autofmt(const char *infile, int format,
-                           STACK_OF(OPENSSL_STRING) *vfyopts, const char *desc)
+    STACK_OF(OPENSSL_STRING) *vfyopts, const char *desc)
 {
     X509_REQ *csr;
 
@@ -530,7 +525,7 @@ X509_REQ *load_csr_autofmt(const char *infile, int format,
         }
         if (csr == NULL) {
             BIO_printf(bio_err, "error: unable to load %s from file '%s'\n",
-                       desc, infile);
+                desc, infile);
         }
     }
     if (csr != NULL) {
@@ -559,7 +554,7 @@ void clear_free(char *str)
 }
 
 EVP_PKEY *load_key(const char *uri, int format, int may_stdin,
-                   const char *pass, ENGINE *e, const char *desc)
+    const char *pass, ENGINE *e, const char *desc)
 {
     EVP_PKEY *pkey = NULL;
     char *allocated_uri = NULL;
@@ -570,7 +565,7 @@ EVP_PKEY *load_key(const char *uri, int format, int may_stdin,
     if (format == FORMAT_ENGINE)
         uri = allocated_uri = make_engine_uri(e, uri, desc);
     (void)load_key_certs_crls(uri, format, may_stdin, pass, desc, 0,
-                              &pkey, NULL, NULL, NULL, NULL, NULL, NULL);
+        &pkey, NULL, NULL, NULL, NULL, NULL, NULL);
 
     OPENSSL_free(allocated_uri);
     return pkey;
@@ -578,7 +573,7 @@ EVP_PKEY *load_key(const char *uri, int format, int may_stdin,
 
 /* first try reading public key, on failure resort to loading private key */
 EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin,
-                      const char *pass, ENGINE *e, const char *desc)
+    const char *pass, ENGINE *e, const char *desc)
 {
     EVP_PKEY *pkey = NULL;
     char *allocated_uri = NULL;
@@ -589,30 +584,30 @@ EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin,
     if (format == FORMAT_ENGINE)
         uri = allocated_uri = make_engine_uri(e, uri, desc);
     (void)load_key_certs_crls(uri, format, maybe_stdin, pass, desc, 1,
-                              NULL, &pkey, NULL, NULL, NULL, NULL, NULL);
+        NULL, &pkey, NULL, NULL, NULL, NULL, NULL);
     if (pkey == NULL)
         (void)load_key_certs_crls(uri, format, maybe_stdin, pass, desc, 0,
-                                  &pkey, NULL, NULL, NULL, NULL, NULL, NULL);
+            &pkey, NULL, NULL, NULL, NULL, NULL, NULL);
     OPENSSL_free(allocated_uri);
     return pkey;
 }
 
 EVP_PKEY *load_keyparams_suppress(const char *uri, int format, int maybe_stdin,
-                                  const char *keytype, const char *desc,
-                                  int suppress_decode_errors)
+    const char *keytype, const char *desc,
+    int suppress_decode_errors)
 {
     EVP_PKEY *params = NULL;
 
     if (desc == NULL)
         desc = "key parameters";
     (void)load_key_certs_crls(uri, format, maybe_stdin, NULL, desc,
-                              suppress_decode_errors,
-                              NULL, NULL, &params, NULL, NULL, NULL, NULL);
+        suppress_decode_errors,
+        NULL, NULL, &params, NULL, NULL, NULL, NULL);
     if (params != NULL && keytype != NULL && !EVP_PKEY_is_a(params, keytype)) {
         ERR_print_errors(bio_err);
         BIO_printf(bio_err,
-                   "Unable to load %s from %s (unexpected parameters type)\n",
-                   desc, uri);
+            "Unable to load %s from %s (unexpected parameters type)\n",
+            desc, uri);
         EVP_PKEY_free(params);
         params = NULL;
     }
@@ -620,7 +615,7 @@ EVP_PKEY *load_keyparams_suppress(const char *uri, int format, int maybe_stdin,
 }
 
 EVP_PKEY *load_keyparams(const char *uri, int format, int maybe_stdin,
-                         const char *keytype, const char *desc)
+    const char *keytype, const char *desc)
 {
     return load_keyparams_suppress(uri, format, maybe_stdin, keytype, desc, 0);
 }
@@ -642,7 +637,7 @@ void *app_malloc(size_t sz, const char *what)
 
     if (vp == NULL)
         app_bail_out("%s: Could not allocate %zu bytes for %s\n",
-                     opt_getprog(), sz, what);
+            opt_getprog(), sz, what);
     return vp;
 }
 
@@ -666,16 +661,16 @@ static void warn_cert_msg(const char *uri, X509 *cert, const char *msg)
     char *subj = X509_NAME_oneline(X509_get_subject_name(cert), NULL, 0);
 
     BIO_printf(bio_err, "Warning: certificate from '%s' with subject '%s' %s\n",
-               uri, subj, msg);
+        uri, subj, msg);
     OPENSSL_free(subj);
 }
 
 static void warn_cert(const char *uri, X509 *cert, int warn_EE,
-                      X509_VERIFY_PARAM *vpm)
+    X509_VERIFY_PARAM *vpm)
 {
     uint32_t ex_flags = X509_get_extension_flags(cert);
     int res = X509_cmp_timeframe(vpm, X509_get0_notBefore(cert),
-                                 X509_get0_notAfter(cert));
+        X509_get0_notAfter(cert));
 
     if (res != 0)
         warn_cert_msg(uri, cert, res > 0 ? "has expired" : "not yet valid");
@@ -684,7 +679,7 @@ static void warn_cert(const char *uri, X509 *cert, int warn_EE,
 }
 
 static void warn_certs(const char *uri, STACK_OF(X509) *certs, int warn_EE,
-                       X509_VERIFY_PARAM *vpm)
+    X509_VERIFY_PARAM *vpm)
 {
     int i;
 
@@ -693,23 +688,22 @@ static void warn_certs(const char *uri, STACK_OF(X509) *certs, int warn_EE,
 }
 
 int load_cert_certs(const char *uri,
-                    X509 **pcert, STACK_OF(X509) **pcerts,
-                    int exclude_http, const char *pass, const char *desc,
-                    X509_VERIFY_PARAM *vpm)
+    X509 **pcert, STACK_OF(X509) **pcerts,
+    int exclude_http, const char *pass, const char *desc,
+    X509_VERIFY_PARAM *vpm)
 {
     int ret = 0;
     char *pass_string;
 
     if (desc == NULL)
         desc = pcerts == NULL ? "certificate" : "certificates";
-    if (exclude_http && (HAS_CASE_PREFIX(uri, "http://")
-                         || HAS_CASE_PREFIX(uri, "https://"))) {
+    if (exclude_http && (HAS_CASE_PREFIX(uri, "http://") || HAS_CASE_PREFIX(uri, "https://"))) {
         BIO_printf(bio_err, "error: HTTP retrieval not allowed for %s\n", desc);
         return ret;
     }
     pass_string = get_passwd(pass, desc);
     ret = load_key_certs_crls(uri, FORMAT_UNDEF, 0, pass_string, desc, 0,
-                              NULL, NULL, NULL, pcert, pcerts, NULL, NULL);
+        NULL, NULL, NULL, pcert, pcerts, NULL, NULL);
     clear_free(pass_string);
 
     if (ret) {
@@ -727,7 +721,7 @@ int load_cert_certs(const char *uri,
 }
 
 STACK_OF(X509) *load_certs_multifile(char *files, const char *pass,
-                                     const char *desc, X509_VERIFY_PARAM *vpm)
+    const char *desc, X509_VERIFY_PARAM *vpm)
 {
     STACK_OF(X509) *certs = NULL;
     STACK_OF(X509) *result = sk_X509_new_null();
@@ -743,7 +737,7 @@ STACK_OF(X509) *load_certs_multifile(char *files, const char *pass,
         if (!load_cert_certs(files, NULL, &certs, 0, pass, desc, vpm))
             goto err;
         if (!X509_add_certs(result, certs,
-                            X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
+                X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP))
             goto oom;
         OSSL_STACK_OF_X509_free(certs);
         certs = NULL;
@@ -751,16 +745,16 @@ STACK_OF(X509) *load_certs_multifile(char *files, const char *pass,
     }
     return result;
 
- oom:
+oom:
     BIO_printf(bio_err, "out of memory\n");
- err:
+err:
     OSSL_STACK_OF_X509_free(certs);
     OSSL_STACK_OF_X509_free(result);
     return NULL;
 }
 
 static X509_STORE *sk_X509_to_store(X509_STORE *store /* may be NULL */,
-                                    const STACK_OF(X509) *certs /* may NULL */)
+    const STACK_OF(X509) *certs /* may NULL */)
 {
     int i;
 
@@ -782,7 +776,7 @@ static X509_STORE *sk_X509_to_store(X509_STORE *store /* may be NULL */,
  * Returns pointer to created X509_STORE on success, NULL on error.
  */
 X509_STORE *load_certstore(char *input, const char *pass, const char *desc,
-                           X509_VERIFY_PARAM *vpm)
+    X509_VERIFY_PARAM *vpm)
 {
     X509_STORE *store = NULL;
     STACK_OF(X509) *certs = NULL;
@@ -810,14 +804,14 @@ X509_STORE *load_certstore(char *input, const char *pass, const char *desc,
  * The caller is responsible for freeing *certs if its value is left not NULL.
  */
 int load_certs(const char *uri, int maybe_stdin, STACK_OF(X509) **certs,
-               const char *pass, const char *desc)
+    const char *pass, const char *desc)
 {
     int ret, was_NULL = *certs == NULL;
 
     if (desc == NULL)
         desc = "certificates";
     ret = load_key_certs_crls(uri, FORMAT_UNDEF, maybe_stdin, pass, desc, 0,
-                              NULL, NULL, NULL, NULL, certs, NULL, NULL);
+        NULL, NULL, NULL, NULL, certs, NULL, NULL);
 
     if (!ret && was_NULL) {
         OSSL_STACK_OF_X509_free(*certs);
@@ -831,14 +825,14 @@ int load_certs(const char *uri, int maybe_stdin, STACK_OF(X509) **certs,
  * The caller is responsible for freeing *crls if its value is left not NULL.
  */
 int load_crls(const char *uri, STACK_OF(X509_CRL) **crls,
-              const char *pass, const char *desc)
+    const char *pass, const char *desc)
 {
     int ret, was_NULL = *crls == NULL;
 
     if (desc == NULL)
         desc = "CRLs";
     ret = load_key_certs_crls(uri, FORMAT_UNDEF, 0, pass, desc, 0,
-                              NULL, NULL, NULL, NULL, NULL, NULL, crls);
+        NULL, NULL, NULL, NULL, NULL, NULL, crls);
 
     if (!ret && was_NULL) {
         sk_X509_CRL_pop_free(*crls, X509_CRL_free);
@@ -866,16 +860,19 @@ static const char *format2string(int format)
 #define SET_EXPECT(val) \
     (expect = expect < 0 ? (val) : (expect == (val) ? (val) : 0))
 #define SET_EXPECT1(pvar, val) \
-    if ((pvar) != NULL) { \
-        *(pvar) = NULL; \
-        SET_EXPECT(val); \
+    if ((pvar) != NULL) {      \
+        *(pvar) = NULL;        \
+        SET_EXPECT(val);       \
     }
 /* Provide (error msg) text for some of the credential types to be loaded. */
-#define FAIL_NAME \
-    (ppkey != NULL ? "private key" : ppubkey != NULL ? "public key" :  \
-     pparams != NULL ? "key parameters" :                              \
-     pcert != NULL ? "certificate" : pcerts != NULL ? "certificates" : \
-     pcrl != NULL ? "CRL" : pcrls != NULL ? "CRLs" : NULL)
+#define FAIL_NAME                                                       \
+    (ppkey != NULL ? "private key" : ppubkey != NULL ? "public key"     \
+            : pparams != NULL                        ? "key parameters" \
+            : pcert != NULL                          ? "certificate"    \
+            : pcerts != NULL                         ? "certificates"   \
+            : pcrl != NULL                           ? "CRL"            \
+            : pcrls != NULL                          ? "CRLs"           \
+                                                     : NULL)
 /*
  * Load those types of credentials for which the result pointer is not NULL.
  * Reads from stdin if 'uri' is NULL and 'maybe_stdin' is nonzero.
@@ -892,11 +889,11 @@ static const char *format2string(int format)
  * of *pcerts and *pcrls (as far as they are not NULL).
  */
 int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
-                        const char *pass, const char *desc, int quiet,
-                        EVP_PKEY **ppkey, EVP_PKEY **ppubkey,
-                        EVP_PKEY **pparams,
-                        X509 **pcert, STACK_OF(X509) **pcerts,
-                        X509_CRL **pcrl, STACK_OF(X509_CRL) **pcrls)
+    const char *pass, const char *desc, int quiet,
+    EVP_PKEY **ppkey, EVP_PKEY **ppubkey,
+    EVP_PKEY **pparams,
+    X509 **pcert, STACK_OF(X509) **pcerts,
+    X509_CRL **pcrl, STACK_OF(X509_CRL) **pcrls)
 {
     PW_CB_DATA uidata;
     OSSL_STORE_CTX *ctx = NULL;
@@ -912,7 +909,7 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
     if (failed == NULL) {
         if (!quiet)
             BIO_printf(bio_err, "Internal error: nothing was requested to load from %s\n",
-                       uri != NULL ? uri : "<stdin>");
+                uri != NULL ? uri : "<stdin>");
         return 0;
     }
     /* suppress any extraneous errors left over from failed parse attempts */
@@ -923,7 +920,7 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
     SET_EXPECT1(pparams, OSSL_STORE_INFO_PARAMS);
     SET_EXPECT1(pcert, OSSL_STORE_INFO_CERT);
     /*
-     * Up to here, the follwing holds.
+     * Up to here, the following holds.
      * If just one of the ppkey, ppubkey, pparams, and pcert function parameters
      * is nonzero, expect > 0 indicates which type of credential is expected.
      * If expect == 0, more than one of them is nonzero (multiple types expected).
@@ -962,7 +959,7 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
 
     if ((input_type = format2string(format)) != NULL) {
         itp[0] = OSSL_PARAM_construct_utf8_string(OSSL_STORE_PARAM_INPUT_TYPE,
-                                                  (char *)input_type, 0);
+            (char *)input_type, 0);
         itp[1] = OSSL_PARAM_construct_end();
         params = itp;
     }
@@ -980,13 +977,13 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
         bio = BIO_new_fp(stdin, 0);
         if (bio != NULL) {
             ctx = OSSL_STORE_attach(bio, "file", libctx, propq,
-                                    get_ui_method(), &uidata, params,
-                                    NULL, NULL);
+                get_ui_method(), &uidata, params,
+                NULL, NULL);
             BIO_free(bio);
         }
     } else {
         ctx = OSSL_STORE_open_ex(uri, libctx, propq, get_ui_method(), &uidata,
-                                 params, NULL, NULL);
+            params, NULL, NULL);
     }
     if (ctx == NULL) {
         if (!quiet)
@@ -1004,8 +1001,8 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
     /* from here, failed != NULL only if actually an error has been detected */
 
     while ((ppkey != NULL || ppubkey != NULL || pparams != NULL
-            || pcert != NULL || pcerts != NULL || pcrl != NULL || pcrls != NULL)
-           && !OSSL_STORE_eof(ctx)) {
+               || pcert != NULL || pcerts != NULL || pcrl != NULL || pcrls != NULL)
+        && !OSSL_STORE_eof(ctx)) {
         OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
         int type, ok = 1;
 
@@ -1056,8 +1053,8 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
                     pcert = NULL;
             } else if (pcerts != NULL) {
                 ok = X509_add_cert(*pcerts,
-                                   OSSL_STORE_INFO_get1_CERT(info),
-                                   X509_ADD_FLAG_DEFAULT);
+                    OSSL_STORE_INFO_get1_CERT(info),
+                    X509_ADD_FLAG_DEFAULT);
             }
             ncerts += ok;
             break;
@@ -1084,7 +1081,7 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
         }
     }
 
- end:
+end:
     OSSL_STORE_close(ctx);
 
     /* see if any of the requested types of credentials was not found */
@@ -1128,37 +1125,36 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
     return failed == NULL;
 }
 
-#define X509V3_EXT_UNKNOWN_MASK  (0xfL << 16)
-#define X509V3_EXT_DEFAULT       0          /* Return error for unknown exts */
+#define X509V3_EXT_UNKNOWN_MASK (0xfL << 16)
+#define X509V3_EXT_DEFAULT 0 /* Return error for unknown exts */
 #define X509V3_EXT_ERROR_UNKNOWN (1L << 16) /* Print error for unknown exts */
 #define X509V3_EXT_PARSE_UNKNOWN (2L << 16) /* ASN1 parse unknown extensions */
-#define X509V3_EXT_DUMP_UNKNOWN  (3L << 16) /* BIO_dump unknown extensions */
+#define X509V3_EXT_DUMP_UNKNOWN (3L << 16) /* BIO_dump unknown extensions */
 
-#define X509_FLAG_CA (X509_FLAG_NO_ISSUER | X509_FLAG_NO_PUBKEY | \
-                      X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION)
+#define X509_FLAG_CA (X509_FLAG_NO_ISSUER | X509_FLAG_NO_PUBKEY | X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION)
 
 int set_cert_ex(unsigned long *flags, const char *arg)
 {
     static const NAME_EX_TBL cert_tbl[] = {
-        {"compatible", X509_FLAG_COMPAT, 0xffffffffl},
-        {"ca_default", X509_FLAG_CA, 0xffffffffl},
-        {"no_header", X509_FLAG_NO_HEADER, 0},
-        {"no_version", X509_FLAG_NO_VERSION, 0},
-        {"no_serial", X509_FLAG_NO_SERIAL, 0},
-        {"no_signame", X509_FLAG_NO_SIGNAME, 0},
-        {"no_validity", X509_FLAG_NO_VALIDITY, 0},
-        {"no_subject", X509_FLAG_NO_SUBJECT, 0},
-        {"no_issuer", X509_FLAG_NO_ISSUER, 0},
-        {"no_pubkey", X509_FLAG_NO_PUBKEY, 0},
-        {"no_extensions", X509_FLAG_NO_EXTENSIONS, 0},
-        {"no_sigdump", X509_FLAG_NO_SIGDUMP, 0},
-        {"no_aux", X509_FLAG_NO_AUX, 0},
-        {"no_attributes", X509_FLAG_NO_ATTRIBUTES, 0},
-        {"ext_default", X509V3_EXT_DEFAULT, X509V3_EXT_UNKNOWN_MASK},
-        {"ext_error", X509V3_EXT_ERROR_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
-        {"ext_parse", X509V3_EXT_PARSE_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
-        {"ext_dump", X509V3_EXT_DUMP_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
-        {NULL, 0, 0}
+        { "compatible", X509_FLAG_COMPAT, 0xffffffffl },
+        { "ca_default", X509_FLAG_CA, 0xffffffffl },
+        { "no_header", X509_FLAG_NO_HEADER, 0 },
+        { "no_version", X509_FLAG_NO_VERSION, 0 },
+        { "no_serial", X509_FLAG_NO_SERIAL, 0 },
+        { "no_signame", X509_FLAG_NO_SIGNAME, 0 },
+        { "no_validity", X509_FLAG_NO_VALIDITY, 0 },
+        { "no_subject", X509_FLAG_NO_SUBJECT, 0 },
+        { "no_issuer", X509_FLAG_NO_ISSUER, 0 },
+        { "no_pubkey", X509_FLAG_NO_PUBKEY, 0 },
+        { "no_extensions", X509_FLAG_NO_EXTENSIONS, 0 },
+        { "no_sigdump", X509_FLAG_NO_SIGDUMP, 0 },
+        { "no_aux", X509_FLAG_NO_AUX, 0 },
+        { "no_attributes", X509_FLAG_NO_ATTRIBUTES, 0 },
+        { "ext_default", X509V3_EXT_DEFAULT, X509V3_EXT_UNKNOWN_MASK },
+        { "ext_error", X509V3_EXT_ERROR_UNKNOWN, X509V3_EXT_UNKNOWN_MASK },
+        { "ext_parse", X509V3_EXT_PARSE_UNKNOWN, X509V3_EXT_UNKNOWN_MASK },
+        { "ext_dump", X509V3_EXT_DUMP_UNKNOWN, X509V3_EXT_UNKNOWN_MASK },
+        { NULL, 0, 0 }
     };
     return set_multi_opts(flags, arg, cert_tbl);
 }
@@ -1166,35 +1162,35 @@ int set_cert_ex(unsigned long *flags, const char *arg)
 int set_name_ex(unsigned long *flags, const char *arg)
 {
     static const NAME_EX_TBL ex_tbl[] = {
-        {"esc_2253", ASN1_STRFLGS_ESC_2253, 0},
-        {"esc_2254", ASN1_STRFLGS_ESC_2254, 0},
-        {"esc_ctrl", ASN1_STRFLGS_ESC_CTRL, 0},
-        {"esc_msb", ASN1_STRFLGS_ESC_MSB, 0},
-        {"use_quote", ASN1_STRFLGS_ESC_QUOTE, 0},
-        {"utf8", ASN1_STRFLGS_UTF8_CONVERT, 0},
-        {"ignore_type", ASN1_STRFLGS_IGNORE_TYPE, 0},
-        {"show_type", ASN1_STRFLGS_SHOW_TYPE, 0},
-        {"dump_all", ASN1_STRFLGS_DUMP_ALL, 0},
-        {"dump_nostr", ASN1_STRFLGS_DUMP_UNKNOWN, 0},
-        {"dump_der", ASN1_STRFLGS_DUMP_DER, 0},
-        {"compat", XN_FLAG_COMPAT, 0xffffffffL},
-        {"sep_comma_plus", XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_MASK},
-        {"sep_comma_plus_space", XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_MASK},
-        {"sep_semi_plus_space", XN_FLAG_SEP_SPLUS_SPC, XN_FLAG_SEP_MASK},
-        {"sep_multiline", XN_FLAG_SEP_MULTILINE, XN_FLAG_SEP_MASK},
-        {"dn_rev", XN_FLAG_DN_REV, 0},
-        {"nofname", XN_FLAG_FN_NONE, XN_FLAG_FN_MASK},
-        {"sname", XN_FLAG_FN_SN, XN_FLAG_FN_MASK},
-        {"lname", XN_FLAG_FN_LN, XN_FLAG_FN_MASK},
-        {"align", XN_FLAG_FN_ALIGN, 0},
-        {"oid", XN_FLAG_FN_OID, XN_FLAG_FN_MASK},
-        {"space_eq", XN_FLAG_SPC_EQ, 0},
-        {"dump_unknown", XN_FLAG_DUMP_UNKNOWN_FIELDS, 0},
-        {"RFC2253", XN_FLAG_RFC2253, 0xffffffffL},
-        {"oneline", XN_FLAG_ONELINE, 0xffffffffL},
-        {"multiline", XN_FLAG_MULTILINE, 0xffffffffL},
-        {"ca_default", XN_FLAG_MULTILINE, 0xffffffffL},
-        {NULL, 0, 0}
+        { "esc_2253", ASN1_STRFLGS_ESC_2253, 0 },
+        { "esc_2254", ASN1_STRFLGS_ESC_2254, 0 },
+        { "esc_ctrl", ASN1_STRFLGS_ESC_CTRL, 0 },
+        { "esc_msb", ASN1_STRFLGS_ESC_MSB, 0 },
+        { "use_quote", ASN1_STRFLGS_ESC_QUOTE, 0 },
+        { "utf8", ASN1_STRFLGS_UTF8_CONVERT, 0 },
+        { "ignore_type", ASN1_STRFLGS_IGNORE_TYPE, 0 },
+        { "show_type", ASN1_STRFLGS_SHOW_TYPE, 0 },
+        { "dump_all", ASN1_STRFLGS_DUMP_ALL, 0 },
+        { "dump_nostr", ASN1_STRFLGS_DUMP_UNKNOWN, 0 },
+        { "dump_der", ASN1_STRFLGS_DUMP_DER, 0 },
+        { "compat", XN_FLAG_COMPAT, 0xffffffffL },
+        { "sep_comma_plus", XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_MASK },
+        { "sep_comma_plus_space", XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_MASK },
+        { "sep_semi_plus_space", XN_FLAG_SEP_SPLUS_SPC, XN_FLAG_SEP_MASK },
+        { "sep_multiline", XN_FLAG_SEP_MULTILINE, XN_FLAG_SEP_MASK },
+        { "dn_rev", XN_FLAG_DN_REV, 0 },
+        { "nofname", XN_FLAG_FN_NONE, XN_FLAG_FN_MASK },
+        { "sname", XN_FLAG_FN_SN, XN_FLAG_FN_MASK },
+        { "lname", XN_FLAG_FN_LN, XN_FLAG_FN_MASK },
+        { "align", XN_FLAG_FN_ALIGN, 0 },
+        { "oid", XN_FLAG_FN_OID, XN_FLAG_FN_MASK },
+        { "space_eq", XN_FLAG_SPC_EQ, 0 },
+        { "dump_unknown", XN_FLAG_DUMP_UNKNOWN_FIELDS, 0 },
+        { "RFC2253", XN_FLAG_RFC2253, 0xffffffffL },
+        { "oneline", XN_FLAG_ONELINE, 0xffffffffL },
+        { "multiline", XN_FLAG_MULTILINE, 0xffffffffL },
+        { "ca_default", XN_FLAG_MULTILINE, 0xffffffffL },
+        { NULL, 0, 0 }
     };
     if (set_multi_opts(flags, arg, ex_tbl) == 0)
         return 0;
@@ -1260,13 +1256,13 @@ int copy_extensions(X509 *x, X509_REQ *req, int copy_type)
     }
     ret = 1;
 
- end:
+end:
     sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
     return ret;
 }
 
 static int set_multi_opts(unsigned long *flags, const char *arg,
-                          const NAME_EX_TBL *in_tbl)
+    const NAME_EX_TBL *in_tbl)
 {
     STACK_OF(CONF_VALUE) *vals;
     CONF_VALUE *val;
@@ -1285,7 +1281,7 @@ static int set_multi_opts(unsigned long *flags, const char *arg,
 }
 
 static int set_table_opts(unsigned long *flags, const char *arg,
-                          const NAME_EX_TBL *in_tbl)
+    const NAME_EX_TBL *in_tbl)
 {
     char c;
     const NAME_EX_TBL *ptbl;
@@ -1343,7 +1339,7 @@ void print_name(BIO *out, const char *title, const X509_NAME *nm)
 }
 
 void print_bignum_var(BIO *out, const BIGNUM *in, const char *var,
-                      int len, unsigned char *buffer)
+    int len, unsigned char *buffer)
 {
     BIO_printf(out, "    static unsigned char %s_%d[] = {", var, len);
     if (BN_is_zero(in)) {
@@ -1380,8 +1376,8 @@ void print_array(BIO *out, const char *title, int len, const unsigned char *d)
 }
 
 X509_STORE *setup_verify(const char *CAfile, int noCAfile,
-                         const char *CApath, int noCApath,
-                         const char *CAstore, int noCAstore)
+    const char *CApath, int noCApath,
+    const char *CAstore, int noCAstore)
 {
     X509_STORE *store = X509_STORE_new();
     X509_LOOKUP *lookup;
@@ -1397,17 +1393,19 @@ X509_STORE *setup_verify(const char *CAfile, int noCAfile,
             goto end;
         if (CAfile != NULL) {
             if (X509_LOOKUP_load_file_ex(lookup, CAfile, X509_FILETYPE_PEM,
-                                         libctx, propq) <= 0) {
+                    libctx, propq)
+                <= 0) {
                 ERR_clear_error();
                 if (X509_LOOKUP_load_file_ex(lookup, CAfile, X509_FILETYPE_ASN1,
-                                             libctx, propq) <= 0) {
+                        libctx, propq)
+                    <= 0) {
                     BIO_printf(bio_err, "Error loading file %s\n", CAfile);
                     goto end;
                 }
             }
         } else {
             X509_LOOKUP_load_file_ex(lookup, NULL, X509_FILETYPE_DEFAULT,
-                                     libctx, propq);
+                libctx, propq);
         }
     }
 
@@ -1438,7 +1436,7 @@ X509_STORE *setup_verify(const char *CAfile, int noCAfile,
 
     ERR_clear_error();
     return store;
- end:
+end:
     ERR_print_errors(bio_err);
     X509_STORE_free(store);
     return NULL;
@@ -1455,12 +1453,14 @@ static unsigned long index_serial_hash(const OPENSSL_CSTRING *a)
 }
 
 static int index_serial_cmp(const OPENSSL_CSTRING *a,
-                            const OPENSSL_CSTRING *b)
+    const OPENSSL_CSTRING *b)
 {
     const char *aa, *bb;
 
-    for (aa = a[DB_serial]; *aa == '0'; aa++) ;
-    for (bb = b[DB_serial]; *bb == '0'; bb++) ;
+    for (aa = a[DB_serial]; *aa == '0'; aa++)
+        ;
+    for (bb = b[DB_serial]; *bb == '0'; bb++)
+        ;
     return strcmp(aa, bb);
 }
 
@@ -1486,7 +1486,7 @@ static IMPLEMENT_LHASH_COMP_FN(index_name, OPENSSL_CSTRING)
 #undef BSIZE
 #define BSIZE 256
 BIGNUM *load_serial(const char *serialfile, int *exists, int create,
-                    ASN1_INTEGER **retai)
+    ASN1_INTEGER **retai)
 {
     BIO *in = NULL;
     BIGNUM *ret = NULL;
@@ -1511,14 +1511,14 @@ BIGNUM *load_serial(const char *serialfile, int *exists, int create,
             BIO_printf(bio_err, "Out of memory\n");
         } else if (!rand_serial(ret, ai)) {
             BIO_printf(bio_err, "Error creating random number to store in %s\n",
-                       serialfile);
+                serialfile);
             BN_free(ret);
             ret = NULL;
         }
     } else {
         if (!a2i_ASN1_INTEGER(in, ai, buf, 1024)) {
             BIO_printf(bio_err, "Unable to load number from %s\n",
-                       serialfile);
+                serialfile);
             goto err;
         }
         ret = ASN1_INTEGER_to_BN(ai, NULL);
@@ -1532,7 +1532,7 @@ BIGNUM *load_serial(const char *serialfile, int *exists, int create,
         *retai = ai;
         ai = NULL;
     }
- err:
+err:
     if (ret == NULL)
         ERR_print_errors(bio_err);
     BIO_free(in);
@@ -1541,7 +1541,7 @@ BIGNUM *load_serial(const char *serialfile, int *exists, int create,
 }
 
 int save_serial(const char *serialfile, const char *suffix,
-                const BIGNUM *serial, ASN1_INTEGER **retai)
+    const BIGNUM *serial, ASN1_INTEGER **retai)
 {
     char buf[1][BSIZE];
     BIO *out = NULL;
@@ -1583,7 +1583,7 @@ int save_serial(const char *serialfile, const char *suffix,
         *retai = ai;
         ai = NULL;
     }
- err:
+err:
     if (!ret)
         ERR_print_errors(bio_err);
     BIO_free_all(out);
@@ -1592,7 +1592,7 @@ int save_serial(const char *serialfile, const char *suffix,
 }
 
 int rotate_serial(const char *serialfile, const char *new_suffix,
-                  const char *old_suffix)
+    const char *old_suffix)
 {
     char buf[2][BSIZE];
     int i, j;
@@ -1616,21 +1616,21 @@ int rotate_serial(const char *serialfile, const char *new_suffix,
 #ifdef ENOTDIR
         && errno != ENOTDIR
 #endif
-        ) {
+    ) {
         BIO_printf(bio_err,
-                   "Unable to rename %s to %s\n", serialfile, buf[1]);
+            "Unable to rename %s to %s\n", serialfile, buf[1]);
         perror("reason");
         goto err;
     }
     if (rename(buf[0], serialfile) < 0) {
         BIO_printf(bio_err,
-                   "Unable to rename %s to %s\n", buf[0], serialfile);
+            "Unable to rename %s to %s\n", buf[0], serialfile);
         perror("reason");
         rename(buf[1], serialfile);
         goto err;
     }
     return 1;
- err:
+err:
     ERR_print_errors(bio_err);
     return 0;
 }
@@ -1651,7 +1651,7 @@ int rand_serial(BIGNUM *b, ASN1_INTEGER *ai)
 
     ret = 1;
 
- error:
+error:
 
     if (btmp != b)
         BN_free(btmp);
@@ -1679,7 +1679,7 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
     BIO_get_fp(in, &dbfp);
     if (fstat(fileno(dbfp), &dbst) == -1) {
         ERR_raise_data(ERR_LIB_SYS, errno,
-                       "calling fstat(%s)", dbfile);
+            "calling fstat(%s)", dbfile);
         goto err;
     }
 #endif
@@ -1717,7 +1717,7 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
     retdb->dbst = dbst;
 #endif
 
- err:
+err:
     ERR_print_errors(bio_err);
     NCONF_free(dbattr_conf);
     TXT_DB_free(tmpdb);
@@ -1731,24 +1731,24 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
 int index_index(CA_DB *db)
 {
     if (!TXT_DB_create_index(db->db, DB_serial, NULL,
-                             LHASH_HASH_FN(index_serial),
-                             LHASH_COMP_FN(index_serial))) {
+            LHASH_HASH_FN(index_serial),
+            LHASH_COMP_FN(index_serial))) {
         BIO_printf(bio_err,
-                   "Error creating serial number index:(%ld,%ld,%ld)\n",
-                   db->db->error, db->db->arg1, db->db->arg2);
+            "Error creating serial number index:(%ld,%ld,%ld)\n",
+            db->db->error, db->db->arg1, db->db->arg2);
         goto err;
     }
 
     if (db->attributes.unique_subject
         && !TXT_DB_create_index(db->db, DB_name, index_name_qual,
-                                LHASH_HASH_FN(index_name),
-                                LHASH_COMP_FN(index_name))) {
+            LHASH_HASH_FN(index_name),
+            LHASH_COMP_FN(index_name))) {
         BIO_printf(bio_err, "Error creating name index:(%ld,%ld,%ld)\n",
-                   db->db->error, db->db->arg1, db->db->arg2);
+            db->db->error, db->db->arg1, db->db->arg2);
         goto err;
     }
     return 1;
- err:
+err:
     ERR_print_errors(bio_err);
     return 0;
 }
@@ -1791,17 +1791,17 @@ int save_index(const char *dbfile, const char *suffix, CA_DB *db)
         goto err;
     }
     BIO_printf(out, "unique_subject = %s\n",
-               db->attributes.unique_subject ? "yes" : "no");
+        db->attributes.unique_subject ? "yes" : "no");
     BIO_free(out);
 
     return 1;
- err:
+err:
     ERR_print_errors(bio_err);
     return 0;
 }
 
 int rotate_index(const char *dbfile, const char *new_suffix,
-                 const char *old_suffix)
+    const char *old_suffix)
 {
     char buf[5][BSIZE];
     int i, j;
@@ -1831,7 +1831,7 @@ int rotate_index(const char *dbfile, const char *new_suffix,
 #ifdef ENOTDIR
         && errno != ENOTDIR
 #endif
-        ) {
+    ) {
         BIO_printf(bio_err, "Unable to rename %s to %s\n", dbfile, buf[1]);
         perror("reason");
         goto err;
@@ -1846,7 +1846,7 @@ int rotate_index(const char *dbfile, const char *new_suffix,
 #ifdef ENOTDIR
         && errno != ENOTDIR
 #endif
-        ) {
+    ) {
         BIO_printf(bio_err, "Unable to rename %s to %s\n", buf[4], buf[3]);
         perror("reason");
         rename(dbfile, buf[0]);
@@ -1862,7 +1862,7 @@ int rotate_index(const char *dbfile, const char *new_suffix,
         goto err;
     }
     return 1;
- err:
+err:
     ERR_print_errors(bio_err);
     return 0;
 }
@@ -1880,17 +1880,17 @@ int parse_yesno(const char *str, int def)
 {
     if (str) {
         switch (*str) {
-        case 'f':              /* false */
-        case 'F':              /* FALSE */
-        case 'n':              /* no */
-        case 'N':              /* NO */
-        case '0':              /* 0 */
+        case 'f': /* false */
+        case 'F': /* FALSE */
+        case 'n': /* no */
+        case 'N': /* NO */
+        case '0': /* 0 */
             return 0;
-        case 't':              /* true */
-        case 'T':              /* TRUE */
-        case 'y':              /* yes */
-        case 'Y':              /* YES */
-        case '1':              /* 1 */
+        case 't': /* true */
+        case 'T': /* TRUE */
+        case 'y': /* yes */
+        case 'Y': /* YES */
+        case '1': /* 1 */
             return 1;
         }
     }
@@ -1903,7 +1903,7 @@ int parse_yesno(const char *str, int def)
  * and characters may be escaped by \
  */
 X509_NAME *parse_name(const char *cp, int chtype, int canmulti,
-                      const char *desc)
+    const char *desc)
 {
     int nextismulti = 0;
     char *work;
@@ -1911,10 +1911,10 @@ X509_NAME *parse_name(const char *cp, int chtype, int canmulti,
 
     if (*cp++ != '/') {
         BIO_printf(bio_err,
-                   "%s: %s name is expected to be in the format "
-                   "/type0=value0/type1=value1/type2=... where characters may "
-                   "be escaped by \\. This name is not in that format: '%s'\n",
-                   opt_getprog(), desc, --cp);
+            "%s: %s name is expected to be in the format "
+            "/type0=value0/type1=value1/type2=... where characters may "
+            "be escaped by \\. This name is not in that format: '%s'\n",
+            opt_getprog(), desc, --cp);
         return NULL;
     }
 
@@ -1926,7 +1926,7 @@ X509_NAME *parse_name(const char *cp, int chtype, int canmulti,
     work = OPENSSL_strdup(cp);
     if (work == NULL) {
         BIO_printf(bio_err, "%s: Error copying %s name input\n",
-                   opt_getprog(), desc);
+            opt_getprog(), desc);
         goto err;
     }
 
@@ -1945,8 +1945,8 @@ X509_NAME *parse_name(const char *cp, int chtype, int canmulti,
         *bp++ = '\0';
         if (*cp == '\0') {
             BIO_printf(bio_err,
-                       "%s: Missing '=' after RDN type string '%s' in %s name string\n",
-                       opt_getprog(), typestr, desc);
+                "%s: Missing '=' after RDN type string '%s' in %s name string\n",
+                opt_getprog(), typestr, desc);
             goto err;
         }
         ++cp;
@@ -1961,8 +1961,8 @@ X509_NAME *parse_name(const char *cp, int chtype, int canmulti,
             }
             if (*cp == '\\' && *++cp == '\0') {
                 BIO_printf(bio_err,
-                           "%s: Escape character at end of %s name string\n",
-                           opt_getprog(), desc);
+                    "%s: Escape character at end of %s name string\n",
+                    opt_getprog(), desc);
                 goto err;
             }
         }
@@ -1976,27 +1976,27 @@ X509_NAME *parse_name(const char *cp, int chtype, int canmulti,
         nid = OBJ_txt2nid(typestr);
         if (nid == NID_undef) {
             BIO_printf(bio_err,
-                       "%s warning: Skipping unknown %s name attribute \"%s\"\n",
-                       opt_getprog(), desc, typestr);
+                "%s warning: Skipping unknown %s name attribute \"%s\"\n",
+                opt_getprog(), desc, typestr);
             if (ismulti)
                 BIO_printf(bio_err,
-                           "%s hint: a '+' in a value string needs be escaped using '\\' else a new member of a multi-valued RDN is expected\n",
-                           opt_getprog());
+                    "%s hint: a '+' in a value string needs be escaped using '\\' else a new member of a multi-valued RDN is expected\n",
+                    opt_getprog());
             continue;
         }
         if (*valstr == '\0') {
             BIO_printf(bio_err,
-                       "%s warning: No value provided for %s name attribute \"%s\", skipped\n",
-                       opt_getprog(), desc, typestr);
+                "%s warning: No value provided for %s name attribute \"%s\", skipped\n",
+                opt_getprog(), desc, typestr);
             continue;
         }
         if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
-                                        valstr, strlen((char *)valstr),
-                                        -1, ismulti ? -1 : 0)) {
+                valstr, strlen((char *)valstr),
+                -1, ismulti ? -1 : 0)) {
             ERR_print_errors(bio_err);
             BIO_printf(bio_err,
-                       "%s: Error adding %s name attribute \"/%s=%s\"\n",
-                       opt_getprog(), desc, typestr, valstr);
+                "%s: Error adding %s name attribute \"/%s=%s\"\n",
+                opt_getprog(), desc, typestr, valstr);
             goto err;
         }
     }
@@ -2004,7 +2004,7 @@ X509_NAME *parse_name(const char *cp, int chtype, int canmulti,
     OPENSSL_free(work);
     return n;
 
- err:
+err:
     X509_NAME_free(n);
     OPENSSL_free(work);
     return NULL;
@@ -2068,7 +2068,7 @@ int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value)
     vtmp++;
     rv = EVP_PKEY_CTX_ctrl_str(ctx, stmp, vtmp);
 
- err:
+err:
     OPENSSL_free(stmp);
     return rv;
 }
@@ -2099,7 +2099,7 @@ void policies_print(X509_STORE_CTX *ctx)
     explicit_policy = X509_STORE_CTX_get_explicit_policy(ctx);
 
     BIO_printf(bio_err, "Require explicit Policy: %s\n",
-               explicit_policy ? "True" : "False");
+        explicit_policy ? "True" : "False");
 
     nodes_print("Authority", X509_policy_tree_get0_policies(tree));
     nodes_print("User", X509_policy_tree_get0_user_policies(tree));
@@ -2163,8 +2163,8 @@ unsigned char *next_protos_parse(size_t *outlen, const char *in)
 }
 
 int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
-                          const char *checkemail, const char *checkip,
-                          int print)
+    const char *checkemail, const char *checkip,
+    int print)
 {
     int valid_host = 0;
     int valid_mail = 0;
@@ -2178,7 +2178,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
         valid_host = X509_check_host(x, checkhost, 0, 0, NULL);
         if (print)
             BIO_printf(bio, "Hostname %s does%s match certificate\n",
-                       checkhost, valid_host == 1 ? "" : " NOT");
+                checkhost, valid_host == 1 ? "" : " NOT");
         ret = ret && valid_host > 0;
     }
 
@@ -2186,7 +2186,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
         valid_mail = X509_check_email(x, checkemail, 0, 0);
         if (print)
             BIO_printf(bio, "Email %s does%s match certificate\n",
-                       checkemail, valid_mail ? "" : " NOT");
+                checkemail, valid_mail ? "" : " NOT");
         ret = ret && valid_mail > 0;
     }
 
@@ -2194,7 +2194,7 @@ int check_cert_attributes(BIO *bio, X509 *x, const char *checkhost,
         valid_ip = X509_check_ip_asc(x, checkip, 0);
         if (print)
             BIO_printf(bio, "IP %s does%s match certificate\n",
-                       checkip, valid_ip ? "" : " NOT");
+                checkip, valid_ip ? "" : " NOT");
         ret = ret && valid_ip > 0;
     }
 
@@ -2262,7 +2262,7 @@ static int do_x509_req_init(X509_REQ *x, STACK_OF(OPENSSL_STRING) *opts)
 }
 
 static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey,
-                        const char *md, STACK_OF(OPENSSL_STRING) *sigopts)
+    const char *md, STACK_OF(OPENSSL_STRING) *sigopts)
 {
     EVP_PKEY_CTX *pkctx = NULL;
     char def_md[80];
@@ -2274,18 +2274,18 @@ static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey,
      * for this algorithm.
      */
     if (EVP_PKEY_get_default_digest_name(pkey, def_md, sizeof(def_md)) == 2
-            && strcmp(def_md, "UNDEF") == 0) {
+        && strcmp(def_md, "UNDEF") == 0) {
         /* The signing algorithm requires there to be no digest */
         md = NULL;
     }
 
     return EVP_DigestSignInit_ex(ctx, &pkctx, md, app_get0_libctx(),
-                                 app_get0_propq(), pkey, NULL)
+               app_get0_propq(), pkey, NULL)
         && do_pkey_ctx_init(pkctx, sigopts);
 }
 
 static int adapt_keyid_ext(X509 *cert, X509V3_CTX *ext_ctx,
-                           const char *name, const char *value, int add_default)
+    const char *name, const char *value, int add_default)
 {
     const STACK_OF(X509_EXTENSION) *exts = X509_get0_extensions(cert);
     X509_EXTENSION *new_ext = X509V3_EXT_nconf(NULL, ext_ctx, name, value);
@@ -2324,7 +2324,7 @@ int cert_matches_key(const X509 *cert, const EVP_PKEY *pkey)
 
 /* Ensure RFC 5280 compliance, adapt keyIDs as needed, and sign the cert info */
 int do_X509_sign(X509 *cert, int force_v1, EVP_PKEY *pkey, const char *md,
-                 STACK_OF(OPENSSL_STRING) *sigopts, X509V3_CTX *ext_ctx)
+    STACK_OF(OPENSSL_STRING) *sigopts, X509V3_CTX *ext_ctx)
 {
     EVP_MD_CTX *mctx = EVP_MD_CTX_new();
     int self_sign;
@@ -2344,21 +2344,21 @@ int do_X509_sign(X509 *cert, int force_v1, EVP_PKEY *pkey, const char *md,
         /* Prevent X509_V_ERR_MISSING_AUTHORITY_KEY_IDENTIFIER */
         self_sign = cert_matches_key(cert, pkey);
         if (!adapt_keyid_ext(cert, ext_ctx, "authorityKeyIdentifier",
-                             "keyid, issuer", !self_sign))
+                "keyid, issuer", !self_sign))
             goto end;
     }
     /* May add further measures for ensuring RFC 5280 compliance, see #19805 */
 
     if (mctx != NULL && do_sign_init(mctx, pkey, md, sigopts) > 0)
         rv = (X509_sign_ctx(cert, mctx) > 0);
- end:
+end:
     EVP_MD_CTX_free(mctx);
     return rv;
 }
 
 /* Sign the certificate request info */
 int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const char *md,
-                     STACK_OF(OPENSSL_STRING) *sigopts)
+    STACK_OF(OPENSSL_STRING) *sigopts)
 {
     int rv = 0;
     EVP_MD_CTX *mctx = EVP_MD_CTX_new();
@@ -2371,7 +2371,7 @@ int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const char *md,
 
 /* Sign the CRL info */
 int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const char *md,
-                     STACK_OF(OPENSSL_STRING) *sigopts)
+    STACK_OF(OPENSSL_STRING) *sigopts)
 {
     int rv = 0;
     EVP_MD_CTX *mctx = EVP_MD_CTX_new();
@@ -2402,7 +2402,7 @@ int do_X509_verify(X509 *x, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *vfyopts)
  * 0 if the signature check fails, or -1 if error occurs.
  */
 int do_X509_REQ_verify(X509_REQ *x, EVP_PKEY *pkey,
-                       STACK_OF(OPENSSL_STRING) *vfyopts)
+    STACK_OF(OPENSSL_STRING) *vfyopts)
 {
     int rv = 0;
 
@@ -2464,7 +2464,7 @@ static X509_CRL *load_crl_crldp(STACK_OF(DIST_POINT) *crldp)
  */
 
 static STACK_OF(X509_CRL) *crls_http_cb(const X509_STORE_CTX *ctx,
-                                        const X509_NAME *nm)
+    const X509_NAME *nm)
 {
     X509 *x;
     STACK_OF(X509_CRL) *crls = NULL;
@@ -2560,15 +2560,14 @@ BIO *app_http_tls_cb(BIO *bio, void *arg, int connect, int detail)
         BIO *sbio = NULL;
         X509_STORE *ts = SSL_CTX_get_cert_store(ssl_ctx);
         X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts);
-        const char *host = vpm == NULL ? NULL :
-            X509_VERIFY_PARAM_get0_host(vpm, 0 /* first hostname */);
+        const char *host = vpm == NULL ? NULL : X509_VERIFY_PARAM_get0_host(vpm, 0 /* first hostname */);
 
         /* adapt after fixing callback design flaw, see #17088 */
         if ((info->use_proxy
-             && !OSSL_HTTP_proxy_connect(bio, info->server, info->port,
-                                         NULL, NULL, /* no proxy credentials */
-                                         info->timeout, bio_err, opt_getprog()))
-                || (sbio = BIO_new(BIO_f_ssl())) == NULL) {
+                && !OSSL_HTTP_proxy_connect(bio, info->server, info->port,
+                    NULL, NULL, /* no proxy credentials */
+                    info->timeout, bio_err, opt_getprog()))
+            || (sbio = BIO_new(BIO_f_ssl())) == NULL) {
             return NULL;
         }
         if ((ssl = SSL_new(ssl_ctx)) == NULL) {
@@ -2598,10 +2597,10 @@ void APP_HTTP_TLS_INFO_free(APP_HTTP_TLS_INFO *info)
 }
 
 ASN1_VALUE *app_http_get_asn1(const char *url, const char *proxy,
-                              const char *no_proxy, SSL_CTX *ssl_ctx,
-                              const STACK_OF(CONF_VALUE) *headers,
-                              long timeout, const char *expected_content_type,
-                              const ASN1_ITEM *it)
+    const char *no_proxy, SSL_CTX *ssl_ctx,
+    const STACK_OF(CONF_VALUE) *headers,
+    long timeout, const char *expected_content_type,
+    const ASN1_ITEM *it)
 {
     APP_HTTP_TLS_INFO info;
     char *server;
@@ -2616,16 +2615,16 @@ ASN1_VALUE *app_http_get_asn1(const char *url, const char *proxy,
     }
 
     if (!OSSL_HTTP_parse_url(url, &use_ssl, NULL /* userinfo */, &server, &port,
-                             NULL /* port_num, */, NULL, NULL, NULL))
+            NULL /* port_num, */, NULL, NULL, NULL))
         return NULL;
     if (use_ssl && ssl_ctx == NULL) {
         ERR_raise_data(ERR_LIB_HTTP, ERR_R_PASSED_NULL_PARAMETER,
-                       "missing SSL_CTX");
+            "missing SSL_CTX");
         goto end;
     }
     if (!use_ssl && ssl_ctx != NULL) {
         ERR_raise_data(ERR_LIB_HTTP, ERR_R_PASSED_INVALID_ARGUMENT,
-                       "SSL_CTX given but use_ssl == 0");
+            "SSL_CTX given but use_ssl == 0");
         goto end;
     }
 
@@ -2636,27 +2635,26 @@ ASN1_VALUE *app_http_get_asn1(const char *url, const char *proxy,
     info.timeout = timeout;
     info.ssl_ctx = ssl_ctx;
     mem = OSSL_HTTP_get(url, proxy, no_proxy, NULL /* bio */, NULL /* rbio */,
-                        app_http_tls_cb, &info, 0 /* buf_size */, headers,
-                        expected_content_type, 1 /* expect_asn1 */,
-                        OSSL_HTTP_DEFAULT_MAX_RESP_LEN, timeout);
+        app_http_tls_cb, &info, 0 /* buf_size */, headers,
+        expected_content_type, 1 /* expect_asn1 */,
+        OSSL_HTTP_DEFAULT_MAX_RESP_LEN, timeout);
     resp = ASN1_item_d2i_bio(it, mem, NULL);
     BIO_free(mem);
 
- end:
+end:
     OPENSSL_free(server);
     OPENSSL_free(port);
     return resp;
-
 }
 
 ASN1_VALUE *app_http_post_asn1(const char *host, const char *port,
-                               const char *path, const char *proxy,
-                               const char *no_proxy, SSL_CTX *ssl_ctx,
-                               const STACK_OF(CONF_VALUE) *headers,
-                               const char *content_type,
-                               ASN1_VALUE *req, const ASN1_ITEM *req_it,
-                               const char *expected_content_type,
-                               long timeout, const ASN1_ITEM *rsp_it)
+    const char *path, const char *proxy,
+    const char *no_proxy, SSL_CTX *ssl_ctx,
+    const STACK_OF(CONF_VALUE) *headers,
+    const char *content_type,
+    ASN1_VALUE *req, const ASN1_ITEM *req_it,
+    const char *expected_content_type,
+    long timeout, const ASN1_ITEM *rsp_it)
 {
     int use_ssl = ssl_ctx != NULL;
     APP_HTTP_TLS_INFO info;
@@ -2673,12 +2671,12 @@ ASN1_VALUE *app_http_post_asn1(const char *host, const char *port,
     info.timeout = timeout;
     info.ssl_ctx = ssl_ctx;
     rsp = OSSL_HTTP_transfer(NULL, host, port, path, use_ssl,
-                             proxy, no_proxy, NULL /* bio */, NULL /* rbio */,
-                             app_http_tls_cb, &info,
-                             0 /* buf_size */, headers, content_type, req_mem,
-                             expected_content_type, 1 /* expect_asn1 */,
-                             OSSL_HTTP_DEFAULT_MAX_RESP_LEN, timeout,
-                             0 /* keep_alive */);
+        proxy, no_proxy, NULL /* bio */, NULL /* rbio */,
+        app_http_tls_cb, &info,
+        0 /* buf_size */, headers, content_type, req_mem,
+        expected_content_type, 1 /* expect_asn1 */,
+        OSSL_HTTP_DEFAULT_MAX_RESP_LEN, timeout,
+        0 /* keep_alive */);
     BIO_free(req_mem);
     res = ASN1_item_d2i_bio(rsp_it, rsp, NULL);
     BIO_free(rsp);
@@ -2691,13 +2689,13 @@ ASN1_VALUE *app_http_post_asn1(const char *host, const char *port,
  * Platform-specific sections
  */
 #if defined(_WIN32)
-# ifdef fileno
-#  undef fileno
-#  define fileno(a) (int)_fileno(a)
-# endif
+#ifdef fileno
+#undef fileno
+#define fileno(a) (int)_fileno(a)
+#endif
 
-# include <windows.h>
-# include <tchar.h>
+#include <windows.h>
+#include <tchar.h>
 
 static int WIN32_rename(const char *from, const char *to)
 {
@@ -2708,21 +2706,21 @@ static int WIN32_rename(const char *from, const char *to)
     if (sizeof(TCHAR) == 1) {
         tfrom = (TCHAR *)from;
         tto = (TCHAR *)to;
-    } else {                    /* UNICODE path */
+    } else { /* UNICODE path */
         size_t i, flen = strlen(from) + 1, tlen = strlen(to) + 1;
 
         tfrom = malloc(sizeof(*tfrom) * (flen + tlen));
         if (tfrom == NULL)
             goto err;
         tto = tfrom + flen;
-# if !defined(_WIN32_WCE) || _WIN32_WCE >= 101
+#if !defined(_WIN32_WCE) || _WIN32_WCE >= 101
         if (!MultiByteToWideChar(CP_ACP, 0, from, flen, (WCHAR *)tfrom, flen))
-# endif
+#endif
             for (i = 0; i < flen; i++)
                 tfrom[i] = (TCHAR)from[i];
-# if !defined(_WIN32_WCE) || _WIN32_WCE >= 101
+#if !defined(_WIN32_WCE) || _WIN32_WCE >= 101
         if (!MultiByteToWideChar(CP_ACP, 0, to, tlen, (WCHAR *)tto, tlen))
-# endif
+#endif
             for (i = 0; i < tlen; i++)
                 tto[i] = (TCHAR)to[i];
     }
@@ -2740,10 +2738,10 @@ static int WIN32_rename(const char *from, const char *to)
     else if (err == ERROR_ACCESS_DENIED)
         errno = EACCES;
     else
-        errno = EINVAL;         /* we could map more codes... */
- err:
+        errno = EINVAL; /* we could map more codes... */
+err:
     ret = -1;
- ok:
+ok:
     if (tfrom != NULL && tfrom != (TCHAR *)from)
         free(tfrom);
     return ret;
@@ -2759,30 +2757,30 @@ double app_tminterval(int stop, int usertime)
     static ULARGE_INTEGER tmstart;
     static int warning = 1;
     int use_GetSystemTime = 1;
-# ifdef _WIN32_WINNT
+#ifdef _WIN32_WINNT
     static HANDLE proc = NULL;
 
     if (proc == NULL) {
         if (check_winnt())
             proc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE,
-                               GetCurrentProcessId());
+                GetCurrentProcessId());
         if (proc == NULL)
-            proc = (HANDLE) - 1;
+            proc = (HANDLE)-1;
     }
 
-    if (usertime && proc != (HANDLE) - 1) {
+    if (usertime && proc != (HANDLE)-1) {
         FILETIME junk;
 
         GetProcessTimes(proc, &junk, &junk, &junk, &now);
         use_GetSystemTime = 0;
     }
-# endif
+#endif
     if (use_GetSystemTime) {
         SYSTEMTIME systime;
 
         if (usertime && warning) {
             BIO_printf(bio_err, "To get meaningful results, run "
-                       "this program on idle system.\n");
+                                "this program on idle system.\n");
             warning = 0;
         }
         GetSystemTime(&systime);
@@ -2804,44 +2802,44 @@ double app_tminterval(int stop, int usertime)
     return ret;
 }
 #elif defined(OPENSSL_SYS_VXWORKS)
-# include <time.h>
+#include <time.h>
 
 double app_tminterval(int stop, int usertime)
 {
     double ret = 0;
-# ifdef CLOCK_REALTIME
+#ifdef CLOCK_REALTIME
     static struct timespec tmstart;
     struct timespec now;
-# else
+#else
     static unsigned long tmstart;
     unsigned long now;
-# endif
+#endif
     static int warning = 1;
 
     if (usertime && warning) {
         BIO_printf(bio_err, "To get meaningful results, run "
-                   "this program on idle system.\n");
+                            "this program on idle system.\n");
         warning = 0;
     }
-# ifdef CLOCK_REALTIME
+#ifdef CLOCK_REALTIME
     clock_gettime(CLOCK_REALTIME, &now);
     if (stop == TM_START)
         tmstart = now;
     else
         ret = ((now.tv_sec + now.tv_nsec * 1e-9)
-               - (tmstart.tv_sec + tmstart.tv_nsec * 1e-9));
-# else
+            - (tmstart.tv_sec + tmstart.tv_nsec * 1e-9));
+#else
     now = tickGet();
     if (stop == TM_START)
         tmstart = now;
     else
         ret = (now - tmstart) / (double)sysClkRateGet();
-# endif
+#endif
     return ret;
 }
 
-#elif defined(_SC_CLK_TCK)      /* by means of unistd.h */
-# include <sys/times.h>
+#elif defined(_SC_CLK_TCK) /* by means of unistd.h */
+#include <sys/times.h>
 
 double app_tminterval(int stop, int usertime)
 {
@@ -2865,8 +2863,8 @@ double app_tminterval(int stop, int usertime)
 }
 
 #else
-# include <sys/time.h>
-# include <sys/resource.h>
+#include <sys/time.h>
+#include <sys/resource.h>
 
 double app_tminterval(int stop, int usertime)
 {
@@ -2884,7 +2882,7 @@ double app_tminterval(int stop, int usertime)
         tmstart = now;
     else
         ret = ((now.tv_sec + now.tv_usec * 1e-6)
-               - (tmstart.tv_sec + tmstart.tv_usec * 1e-6));
+            - (tmstart.tv_sec + tmstart.tv_usec * 1e-6));
 
     return ret;
 }
@@ -2906,7 +2904,7 @@ int app_isdir(const char *name)
 
 /* raw_read|write section */
 #if defined(__VMS)
-# include "vms_term_sock.h"
+#include "vms_term_sock.h"
 static int stdin_sock = -1;
 
 static void close_stdin_sock(void)
@@ -2946,7 +2944,7 @@ int raw_read_stdin(void *buf, int siz)
         return -1;
 }
 #elif defined(__VMS)
-# include <sys/socket.h>
+#include <sys/socket.h>
 
 int raw_read_stdin(void *buf, int siz)
 {
@@ -2992,13 +2990,13 @@ int raw_write_stdout(const void *buf, int siz)
 BIO *dup_bio_in(int format)
 {
     return BIO_new_fp(stdin,
-                      BIO_NOCLOSE | (FMT_istext(format) ? BIO_FP_TEXT : 0));
+        BIO_NOCLOSE | (FMT_istext(format) ? BIO_FP_TEXT : 0));
 }
 
 BIO *dup_bio_out(int format)
 {
     BIO *b = BIO_new_fp(stdout,
-                        BIO_NOCLOSE | (FMT_istext(format) ? BIO_FP_TEXT : 0));
+        BIO_NOCLOSE | (FMT_istext(format) ? BIO_FP_TEXT : 0));
     void *prefix = NULL;
 
     if (b == NULL)
@@ -3021,7 +3019,7 @@ BIO *dup_bio_out(int format)
 BIO *dup_bio_err(int format)
 {
     BIO *b = BIO_new_fp(stderr,
-                        BIO_NOCLOSE | (FMT_istext(format) ? BIO_FP_TEXT : 0));
+        BIO_NOCLOSE | (FMT_istext(format) ? BIO_FP_TEXT : 0));
 
 #ifdef OPENSSL_SYS_VMS
     if (b != NULL && FMT_istext(format))
@@ -3040,12 +3038,12 @@ void unbuffer(FILE *fp)
  * temporarily.
  */
 #if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma environment save
-# pragma message disable maylosedata2
+#pragma environment save
+#pragma message disable maylosedata2
 #endif
     setbuf(fp, NULL);
 #if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma environment restore
+#pragma environment restore
 #endif
 }
 
@@ -3096,21 +3094,21 @@ BIO *bio_open_owner(const char *filename, int format, int private)
     textmode = FMT_istext(format);
 #ifndef OPENSSL_NO_POSIX_IO
     mode = O_WRONLY;
-# ifdef O_CREAT
+#ifdef O_CREAT
     mode |= O_CREAT;
-# endif
-# ifdef O_TRUNC
+#endif
+#ifdef O_TRUNC
     mode |= O_TRUNC;
-# endif
+#endif
     if (!textmode) {
-# ifdef O_BINARY
+#ifdef O_BINARY
         mode |= O_BINARY;
-# elif defined(_O_BINARY)
+#elif defined(_O_BINARY)
         mode |= _O_BINARY;
-# endif
+#endif
     }
 
-# ifdef OPENSSL_SYS_VMS
+#ifdef OPENSSL_SYS_VMS
     /*
      * VMS doesn't have O_BINARY, it just doesn't make sense.  But,
      * it still needs to know that we're going binary, or fdopen()
@@ -3120,15 +3118,15 @@ BIO *bio_open_owner(const char *filename, int format, int private)
     if (!textmode)
         fd = open(filename, mode, 0600, "ctx=bin");
     else
-# endif
+#endif
         fd = open(filename, mode, 0600);
     if (fd < 0)
         goto err;
     fp = fdopen(fd, modestr('w', format));
-#else   /* OPENSSL_NO_POSIX_IO */
+#else /* OPENSSL_NO_POSIX_IO */
     /* Have stdio but not Posix IO, do the best we can */
     fp = fopen(filename, modestr('w', format));
-#endif  /* OPENSSL_NO_POSIX_IO */
+#endif /* OPENSSL_NO_POSIX_IO */
     if (fp == NULL)
         goto err;
     bflags = BIO_CLOSE;
@@ -3138,9 +3136,9 @@ BIO *bio_open_owner(const char *filename, int format, int private)
     if (b != NULL)
         return b;
 
- err:
+err:
     BIO_printf(bio_err, "%s: Can't open \"%s\" for writing, %s\n",
-               opt_getprog(), filename, strerror(errno));
+        opt_getprog(), filename, strerror(errno));
     ERR_print_errors(bio_err);
     /* If we have fp, then fdopen took over fd, so don't close both. */
     if (fp != NULL)
@@ -3153,7 +3151,7 @@ BIO *bio_open_owner(const char *filename, int format, int private)
 }
 
 static BIO *bio_open_default_(const char *filename, char mode, int format,
-                              int quiet)
+    int quiet)
 {
     BIO *ret;
 
@@ -3166,8 +3164,8 @@ static BIO *bio_open_default_(const char *filename, char mode, int format,
         if (ret != NULL)
             return ret;
         BIO_printf(bio_err,
-                   "Can't open %s, %s\n",
-                   mode == 'r' ? "stdin" : "stdout", strerror(errno));
+            "Can't open %s, %s\n",
+            mode == 'r' ? "stdin" : "stdout", strerror(errno));
     } else {
         ret = BIO_new_file(filename, modestr(mode, format));
         if (quiet) {
@@ -3177,8 +3175,8 @@ static BIO *bio_open_default_(const char *filename, char mode, int format,
         if (ret != NULL)
             return ret;
         BIO_printf(bio_err,
-                   "Can't open \"%s\" for %s, %s\n",
-                   filename, modeverb(mode), strerror(errno));
+            "Can't open \"%s\" for %s, %s\n",
+            filename, modeverb(mode), strerror(errno));
     }
     ERR_print_errors(bio_err);
     return NULL;
@@ -3255,7 +3253,7 @@ void wait_for_async(SSL *s)
 #if defined(OPENSSL_SYS_MSDOS)
 int has_stdin_waiting(void)
 {
-# if defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_WINDOWS)
     HANDLE inhand = GetStdHandle(STD_INPUT_HANDLE);
     DWORD events = 0;
     INPUT_RECORD inputrec;
@@ -3274,7 +3272,7 @@ int has_stdin_waiting(void)
         }
         return 0;
     }
-# endif
+#endif
     return _kbhit();
 }
 #endif
@@ -3290,16 +3288,16 @@ void corrupt_signature(const ASN1_STRING *signature)
 int check_cert_time_string(const char *time, const char *desc)
 {
     if (time == NULL || strcmp(time, "today") == 0
-            || ASN1_TIME_set_string_X509(NULL, time))
+        || ASN1_TIME_set_string_X509(NULL, time))
         return 1;
     BIO_printf(bio_err,
-               "%s is invalid, it should be \"today\" or have format [CC]YYMMDDHHMMSSZ\n",
-               desc);
+        "%s is invalid, it should be \"today\" or have format [CC]YYMMDDHHMMSSZ\n",
+        desc);
     return 0;
 }
 
 int set_cert_times(X509 *x, const char *startdate, const char *enddate,
-                   int days, int strict_compare_times)
+    int days, int strict_compare_times)
 {
     if (!check_cert_time_string(startdate, "start date"))
         return 0;
@@ -3331,7 +3329,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
     }
     if (ASN1_TIME_compare(X509_get0_notAfter(x), X509_get0_notBefore(x)) < 0) {
         BIO_printf(bio_err, "%s: end date before start date\n",
-                   strict_compare_times ? "Error" : "Warning");
+            strict_compare_times ? "Error" : "Warning");
         if (strict_compare_times)
             return 0;
     }
@@ -3364,7 +3362,7 @@ end:
 }
 
 int set_crl_nextupdate(X509_CRL *crl, const char *nextupdate,
-                       long days, long hours, long secs)
+    long days, long hours, long secs)
 {
     int ret = 0;
     ASN1_TIME *tm = ASN1_TIME_new();
@@ -3398,7 +3396,7 @@ void make_uppercase(char *string)
 }
 
 OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
-                                     const OSSL_PARAM *paramdefs)
+    const OSSL_PARAM *paramdefs)
 {
     OSSL_PARAM *params = NULL;
     size_t sz = (size_t)sk_OPENSSL_STRING_num(opts);
@@ -3423,7 +3421,7 @@ OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
         /* Skip over the separator so that vmtp points to the value */
         vtmp++;
         if (!OSSL_PARAM_allocate_from_text(&params[params_n], paramdefs,
-                                           stmp, vtmp, strlen(vtmp), &found))
+                stmp, vtmp, strlen(vtmp), &found))
             goto err;
         OPENSSL_free(stmp);
     }
@@ -3432,7 +3430,7 @@ OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
 err:
     OPENSSL_free(stmp);
     BIO_printf(bio_err, "Parameter %s '%s'\n", found ? "error" : "unknown",
-               opt);
+        opt);
     ERR_print_errors(bio_err);
     app_params_free(params);
     return NULL;
@@ -3462,10 +3460,10 @@ EVP_PKEY *app_keygen(EVP_PKEY_CTX *ctx, const char *alg, int bits, int verbose)
     }
     if (!RAND_status())
         BIO_printf(bio_err, "Warning: generating random key material may take a long time\n"
-                   "if the system has a poor entropy source\n");
+                            "if the system has a poor entropy source\n");
     if (EVP_PKEY_keygen(ctx, &res) <= 0)
         BIO_printf(bio_err, "%s: Error generating %s key\n", opt_getprog(),
-                   alg != NULL ? alg : "asymmetric");
+            alg != NULL ? alg : "asymmetric");
     return res;
 }
 
@@ -3475,10 +3473,10 @@ EVP_PKEY *app_paramgen(EVP_PKEY_CTX *ctx, const char *alg)
 
     if (!RAND_status())
         BIO_printf(bio_err, "Warning: generating random key parameters may take a long time\n"
-                   "if the system has a poor entropy source\n");
+                            "if the system has a poor entropy source\n");
     if (EVP_PKEY_paramgen(ctx, &res) <= 0)
         BIO_printf(bio_err, "%s: Generating %s key parameters failed\n",
-                   opt_getprog(), alg != NULL ? alg : "asymmetric");
+            opt_getprog(), alg != NULL ? alg : "asymmetric");
     return res;
 }
 
diff --git a/crypto/openssl/apps/lib/apps_opt_printf.c b/crypto/openssl/apps/lib/apps_opt_printf.c
index e15f4b795e60..7816cb201b33 100644
--- a/crypto/openssl/apps/lib/apps_opt_printf.c
+++ b/crypto/openssl/apps/lib/apps_opt_printf.c
@@ -22,4 +22,3 @@ int opt_printf_stderr(const char *fmt, ...)
     va_end(ap);
     return ret;
 }
-
diff --git a/crypto/openssl/apps/lib/apps_ui.c b/crypto/openssl/apps/lib/apps_ui.c
index 00e0ba5d9996..aa2230381f3a 100644
--- a/crypto/openssl/apps/lib/apps_ui.c
+++ b/crypto/openssl/apps/lib/apps_ui.c
@@ -32,17 +32,14 @@ static int ui_read(UI *ui, UI_STRING *uis)
         && UI_get0_user_data(ui)) {
         switch (UI_get_string_type(uis)) {
         case UIT_PROMPT:
-        case UIT_VERIFY:
-            {
-                const char *password =
-                    ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
+        case UIT_VERIFY: {
+            const char *password = ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
 
-                if (password != NULL) {
-                    UI_set_result(ui, uis, password);
-                    return 1;
-                }
+            if (password != NULL) {
+                UI_set_result(ui, uis, password);
+                return 1;
             }
-            break;
+        } break;
         case UIT_NONE:
         case UIT_BOOLEAN:
         case UIT_INFO:
@@ -67,15 +64,12 @@ static int ui_write(UI *ui, UI_STRING *uis)
         && UI_get0_user_data(ui)) {
         switch (UI_get_string_type(uis)) {
         case UIT_PROMPT:
-        case UIT_VERIFY:
-            {
-                const char *password =
-                    ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
+        case UIT_VERIFY: {
+            const char *password = ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
 
-                if (password != NULL)
-                    return 1;
-            }
-            break;
+            if (password != NULL)
+                return 1;
+        } break;
         case UIT_NONE:
         case UIT_BOOLEAN:
         case UIT_INFO:
@@ -101,7 +95,7 @@ static int ui_close(UI *ui)
 
 /* object_name defaults to prompt_info from ui user data if present */
 static char *ui_prompt_construct(UI *ui, const char *phrase_desc,
-                                 const char *object_name)
+    const char *object_name)
 {
     PW_CB_DATA *cb_data = (PW_CB_DATA *)UI_get0_user_data(ui);
 
@@ -132,8 +126,7 @@ int setup_ui_method(void)
         && 0 == UI_method_set_reader(ui_method, ui_read)
         && 0 == UI_method_set_writer(ui_method, ui_write)
         && 0 == UI_method_set_closer(ui_method, ui_close)
-        && 0 == UI_method_set_prompt_constructor(ui_method,
-                                                 ui_prompt_construct);
+        && 0 == UI_method_set_prompt_constructor(ui_method, ui_prompt_construct);
 }
 
 void destroy_ui_method(void)
@@ -190,12 +183,12 @@ int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data)
     (void)UI_add_user_data(ui, cb_data);
 
     ok = UI_add_input_string(ui, prompt, ui_flags, buf,
-                             PW_MIN_LENGTH, bufsiz - 1);
+        PW_MIN_LENGTH, bufsiz - 1);
 
     if (ok >= 0 && verify) {
         buff = ui_malloc(bufsiz, "password buffer");
         ok = UI_add_verify_string(ui, prompt, ui_flags, buff,
-                                  PW_MIN_LENGTH, bufsiz - 1, buf);
+            PW_MIN_LENGTH, bufsiz - 1, buf);
     }
     if (ok >= 0)
         do {
diff --git a/crypto/openssl/apps/lib/cmp_mock_srv.c b/crypto/openssl/apps/lib/cmp_mock_srv.c
index 73ab1eb5600e..bf8b06c390bd 100644
--- a/crypto/openssl/apps/lib/cmp_mock_srv.c
+++ b/crypto/openssl/apps/lib/cmp_mock_srv.c
@@ -17,21 +17,21 @@
 
 /* the context for the CMP mock server */
 typedef struct {
-    X509 *refCert;             /* cert to expect for oldCertID in kur/rr msg */
-    X509 *certOut;             /* certificate to be returned in cp/ip/kup msg */
-    EVP_PKEY *keyOut;          /* Private key to be returned for central keygen */
-    X509_CRL *crlOut;          /* CRL to be returned in genp for crls */
-    STACK_OF(X509) *chainOut;  /* chain of certOut to add to extraCerts field */
+    X509 *refCert; /* cert to expect for oldCertID in kur/rr msg */
+    X509 *certOut; /* certificate to be returned in cp/ip/kup msg */
+    EVP_PKEY *keyOut; /* Private key to be returned for central keygen */
+    X509_CRL *crlOut; /* CRL to be returned in genp for crls */
+    STACK_OF(X509) *chainOut; /* chain of certOut to add to extraCerts field */
     STACK_OF(X509) *caPubsOut; /* used in caPubs of ip and in caCerts of genp */
-    X509 *newWithNew;          /* to return in newWithNew of rootKeyUpdate */
-    X509 *newWithOld;          /* to return in newWithOld of rootKeyUpdate */
-    X509 *oldWithNew;          /* to return in oldWithNew of rootKeyUpdate */
+    X509 *newWithNew; /* to return in newWithNew of rootKeyUpdate */
+    X509 *newWithOld; /* to return in newWithOld of rootKeyUpdate */
+    X509 *oldWithNew; /* to return in oldWithNew of rootKeyUpdate */
     OSSL_CMP_PKISI *statusOut; /* status for ip/cp/kup/rp msg unless polling */
-    int sendError;             /* send error response on given request type */
-    OSSL_CMP_MSG *req;         /* original request message during polling */
-    int pollCount;             /* number of polls before actual cert response */
-    int curr_pollCount;        /* number of polls so far for current request */
-    int checkAfterTime;        /* time the client should wait between polling */
+    int sendError; /* send error response on given request type */
+    OSSL_CMP_MSG *req; /* original request message during polling */
+    int pollCount; /* number of polls before actual cert response */
+    int curr_pollCount; /* number of polls so far for current request */
+    int checkAfterTime; /* time the client should wait between polling */
 } mock_srv_ctx;
 
 static void mock_srv_ctx_free(mock_srv_ctx *ctx)
@@ -62,27 +62,27 @@ static mock_srv_ctx *mock_srv_ctx_new(void)
 
     /* all other elements are initialized to 0 or NULL, respectively */
     return ctx;
- err:
+err:
     mock_srv_ctx_free(ctx);
     return NULL;
 }
 
-#define DEFINE_OSSL_SET1_CERT(FIELD) \
-    int ossl_cmp_mock_srv_set1_##FIELD(OSSL_CMP_SRV_CTX *srv_ctx, \
-                                       X509 *cert) \
-    { \
+#define DEFINE_OSSL_SET1_CERT(FIELD)                                   \
+    int ossl_cmp_mock_srv_set1_##FIELD(OSSL_CMP_SRV_CTX *srv_ctx,      \
+        X509 *cert)                                                    \
+    {                                                                  \
         mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx); \
- \
-        if (ctx == NULL) { \
-            ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT); \
-            return 0; \
-        } \
-        if (cert == NULL || X509_up_ref(cert)) { \
-            X509_free(ctx->FIELD); \
-            ctx->FIELD = cert; \
-            return 1; \
-        } \
-        return 0; \
+                                                                       \
+        if (ctx == NULL) {                                             \
+            ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);               \
+            return 0;                                                  \
+        }                                                              \
+        if (cert == NULL || X509_up_ref(cert)) {                       \
+            X509_free(ctx->FIELD);                                     \
+            ctx->FIELD = cert;                                         \
+            return 1;                                                  \
+        }                                                              \
+        return 0;                                                      \
     }
 
 DEFINE_OSSL_SET1_CERT(refCert)
@@ -104,7 +104,7 @@ int ossl_cmp_mock_srv_set1_keyOut(OSSL_CMP_SRV_CTX *srv_ctx, EVP_PKEY *pkey)
 }
 
 int ossl_cmp_mock_srv_set1_crlOut(OSSL_CMP_SRV_CTX *srv_ctx,
-                                  X509_CRL *crl)
+    X509_CRL *crl)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
 
@@ -120,7 +120,7 @@ int ossl_cmp_mock_srv_set1_crlOut(OSSL_CMP_SRV_CTX *srv_ctx,
 }
 
 int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
-                                    STACK_OF(X509) *chain)
+    STACK_OF(X509) *chain)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
     STACK_OF(X509) *chain_copy = NULL;
@@ -137,7 +137,7 @@ int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
 }
 
 int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
-                                     STACK_OF(X509) *caPubs)
+    STACK_OF(X509) *caPubs)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
     STACK_OF(X509) *caPubs_copy = NULL;
@@ -158,7 +158,7 @@ DEFINE_OSSL_SET1_CERT(newWithOld)
 DEFINE_OSSL_SET1_CERT(oldWithNew)
 
 int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
-                                     int fail_info, const char *text)
+    int fail_info, const char *text)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
     OSSL_CMP_PKISI *si;
@@ -249,7 +249,7 @@ static int delayed_delivery(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *req)
 
 /* check for matching reference cert components, as far as given */
 static int refcert_cmp(const X509 *refcert,
-                       const X509_NAME *issuer, const ASN1_INTEGER *serial)
+    const X509_NAME *issuer, const ASN1_INTEGER *serial)
 {
     const X509_NAME *ref_issuer;
     const ASN1_INTEGER *ref_serial;
@@ -264,7 +264,7 @@ static int refcert_cmp(const X509 *refcert,
 
 /* reset the state that belongs to a transaction */
 static int clean_transaction(OSSL_CMP_SRV_CTX *srv_ctx,
-                             ossl_unused const ASN1_OCTET_STRING *id)
+    ossl_unused const ASN1_OCTET_STRING *id)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
 
@@ -280,13 +280,13 @@ static int clean_transaction(OSSL_CMP_SRV_CTX *srv_ctx,
 }
 
 static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
-                                            const OSSL_CMP_MSG *cert_req,
-                                            ossl_unused int certReqId,
-                                            const OSSL_CRMF_MSG *crm,
-                                            const X509_REQ *p10cr,
-                                            X509 **certOut,
-                                            STACK_OF(X509) **chainOut,
-                                            STACK_OF(X509) **caPubs)
+    const OSSL_CMP_MSG *cert_req,
+    ossl_unused int certReqId,
+    const OSSL_CRMF_MSG *crm,
+    const X509_REQ *p10cr,
+    X509 **certOut,
+    STACK_OF(X509) **chainOut,
+    STACK_OF(X509) **caPubs)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
     int bodytype, central_keygen;
@@ -294,7 +294,7 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
     EVP_PKEY *keyOut = NULL;
 
     if (ctx == NULL || cert_req == NULL
-            || certOut == NULL || chainOut == NULL || caPubs == NULL) {
+        || certOut == NULL || chainOut == NULL || caPubs == NULL) {
         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
         return NULL;
     }
@@ -320,8 +320,7 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
 
     /* accept cert profile for cr messages only with the configured name */
     if (OSSL_CMP_MSG_get_bodytype(cert_req) == OSSL_CMP_CR) {
-        STACK_OF(OSSL_CMP_ITAV) *itavs =
-            OSSL_CMP_HDR_get0_geninfo_ITAVs(OSSL_CMP_MSG_get0_header(cert_req));
+        STACK_OF(OSSL_CMP_ITAV) *itavs = OSSL_CMP_HDR_get0_geninfo_ITAVs(OSSL_CMP_MSG_get0_header(cert_req));
         int i;
 
         for (i = 0; i < sk_OSSL_CMP_ITAV_num(itavs); i++) {
@@ -340,8 +339,7 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
                 }
                 str = sk_ASN1_UTF8STRING_value(strs, 0);
                 if (str == NULL
-                    || (data =
-                        (const char *)ASN1_STRING_get0_data(str)) == NULL) {
+                    || (data = (const char *)ASN1_STRING_get0_data(str)) == NULL) {
                     ERR_raise(ERR_LIB_CMP, ERR_R_PASSED_INVALID_ARGUMENT);
                     return NULL;
                 }
@@ -356,7 +354,7 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
 
     /* accept cert update request only for the reference cert, if given */
     if (bodytype == OSSL_CMP_KUR
-            && crm != NULL /* thus not p10cr */ && ctx->refCert != NULL) {
+        && crm != NULL /* thus not p10cr */ && ctx->refCert != NULL) {
         const OSSL_CRMF_CERTID *cid = OSSL_CRMF_MSG_get0_regCtrl_oldCertID(crm);
 
         if (cid == NULL) {
@@ -364,15 +362,15 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
             return NULL;
         }
         if (!refcert_cmp(ctx->refCert,
-                         OSSL_CRMF_CERTID_get0_issuer(cid),
-                         OSSL_CRMF_CERTID_get0_serialNumber(cid))) {
+                OSSL_CRMF_CERTID_get0_issuer(cid),
+                OSSL_CRMF_CERTID_get0_serialNumber(cid))) {
             ERR_raise(ERR_LIB_CMP, CMP_R_WRONG_CERTID);
             return NULL;
         }
     }
 
     if (ctx->certOut != NULL
-            && (*certOut = X509_dup(ctx->certOut)) == NULL)
+        && (*certOut = X509_dup(ctx->certOut)) == NULL)
         /* Should return a cert produced from request template, see FR #16054 */
         goto err;
 
@@ -383,7 +381,7 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
         && (ctx->keyOut == NULL
             || (keyOut = EVP_PKEY_dup(ctx->keyOut)) == NULL
             || !OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx),
-                                          1 /* priv */, keyOut))) {
+                1 /* priv */, keyOut))) {
         EVP_PKEY_free(keyOut);
         goto err;
     }
@@ -393,17 +391,17 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
      */
 
     if (ctx->chainOut != NULL
-            && (*chainOut = X509_chain_up_ref(ctx->chainOut)) == NULL)
+        && (*chainOut = X509_chain_up_ref(ctx->chainOut)) == NULL)
         goto err;
     if (ctx->caPubsOut != NULL /* OSSL_CMP_PKIBODY_IP not visible here */
-            && (*caPubs = X509_chain_up_ref(ctx->caPubsOut)) == NULL)
+        && (*caPubs = X509_chain_up_ref(ctx->caPubsOut)) == NULL)
         goto err;
     if (ctx->statusOut != NULL
-            && (si = OSSL_CMP_PKISI_dup(ctx->statusOut)) == NULL)
+        && (si = OSSL_CMP_PKISI_dup(ctx->statusOut)) == NULL)
         goto err;
     return si;
 
- err:
+err:
     X509_free(*certOut);
     *certOut = NULL;
     OSSL_STACK_OF_X509_free(*chainOut);
@@ -414,9 +412,9 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
 }
 
 static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
-                                  const OSSL_CMP_MSG *rr,
-                                  const X509_NAME *issuer,
-                                  const ASN1_INTEGER *serial)
+    const OSSL_CMP_MSG *rr,
+    const X509_NAME *issuer,
+    const ASN1_INTEGER *serial)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
 
@@ -425,7 +423,7 @@ static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
         return NULL;
     }
     if (ctx->sendError == 1
-            || ctx->sendError == OSSL_CMP_MSG_get_bodytype(rr)) {
+        || ctx->sendError == OSSL_CMP_MSG_get_bodytype(rr)) {
         ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
         return NULL;
     }
@@ -433,9 +431,9 @@ static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
     /* allow any RR derived from CSR which does not include issuer and serial */
     if ((issuer != NULL || serial != NULL)
         /* accept revocation only for the reference cert, if given */
-            && !refcert_cmp(ctx->refCert, issuer, serial)) {
+        && !refcert_cmp(ctx->refCert, issuer, serial)) {
         ERR_raise_data(ERR_LIB_CMP, CMP_R_REQUEST_NOT_ACCEPTED,
-                       "wrong certificate to revoke");
+            "wrong certificate to revoke");
         return NULL;
     }
     return OSSL_CMP_PKISI_dup(ctx->statusOut);
@@ -443,7 +441,7 @@ static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
 
 /* return -1 for error, 0 for no update available */
 static int check_client_crl(const STACK_OF(OSSL_CMP_CRLSTATUS) *crlStatusList,
-                            const X509_CRL *crl)
+    const X509_CRL *crl)
 {
     OSSL_CMP_CRLSTATUS *crlstatus;
     DIST_POINT_NAME *dpn = NULL;
@@ -471,9 +469,9 @@ static int check_client_crl(const STACK_OF(OSSL_CMP_CRLSTATUS) *crlStatusList,
                 ERR_raise(ERR_LIB_CMP, CMP_R_UNKNOWN_CRL_ISSUER);
                 return -1;
             }
-        } else {  
-            ERR_raise(ERR_LIB_CMP, CMP_R_SENDER_GENERALNAME_TYPE_NOT_SUPPORTED);  
-            return -1; /* error according to RFC 9483 section 4.3.4 */  
+        } else {
+            ERR_raise(ERR_LIB_CMP, CMP_R_SENDER_GENERALNAME_TYPE_NOT_SUPPORTED);
+            return -1; /* error according to RFC 9483 section 4.3.4 */
         }
     }
 
@@ -482,7 +480,7 @@ static int check_client_crl(const STACK_OF(OSSL_CMP_CRLSTATUS) *crlStatusList,
 }
 
 static OSSL_CMP_ITAV *process_genm_itav(mock_srv_ctx *ctx, int req_nid,
-                                        const OSSL_CMP_ITAV *req)
+    const OSSL_CMP_ITAV *req)
 {
     OSSL_CMP_ITAV *rsp = NULL;
 
@@ -490,81 +488,76 @@ static OSSL_CMP_ITAV *process_genm_itav(mock_srv_ctx *ctx, int req_nid,
     case NID_id_it_caCerts:
         rsp = OSSL_CMP_ITAV_new_caCerts(ctx->caPubsOut);
         break;
-    case NID_id_it_rootCaCert:
-        {
-            X509 *rootcacert = NULL;
+    case NID_id_it_rootCaCert: {
+        X509 *rootcacert = NULL;
 
-            if (!OSSL_CMP_ITAV_get0_rootCaCert(req, &rootcacert))
-                return NULL;
+        if (!OSSL_CMP_ITAV_get0_rootCaCert(req, &rootcacert))
+            return NULL;
 
-            if (rootcacert != NULL
-                && X509_NAME_cmp(X509_get_subject_name(rootcacert),
-                                 X509_get_subject_name(ctx->newWithNew)) != 0)
-                /* The subjects do not match */
-                rsp = OSSL_CMP_ITAV_new_rootCaKeyUpdate(NULL, NULL, NULL);
-            else
-                rsp = OSSL_CMP_ITAV_new_rootCaKeyUpdate(ctx->newWithNew,
-                                                        ctx->newWithOld,
-                                                        ctx->oldWithNew);
-        }
-        break;
-    case NID_id_it_crlStatusList:
-        {
-            STACK_OF(OSSL_CMP_CRLSTATUS) *crlstatuslist = NULL;
-            int res = 0;
+        if (rootcacert != NULL
+            && X509_NAME_cmp(X509_get_subject_name(rootcacert),
+                   X509_get_subject_name(ctx->newWithNew))
+                != 0)
+            /* The subjects do not match */
+            rsp = OSSL_CMP_ITAV_new_rootCaKeyUpdate(NULL, NULL, NULL);
+        else
+            rsp = OSSL_CMP_ITAV_new_rootCaKeyUpdate(ctx->newWithNew,
+                ctx->newWithOld,
+                ctx->oldWithNew);
+    } break;
+    case NID_id_it_crlStatusList: {
+        STACK_OF(OSSL_CMP_CRLSTATUS) *crlstatuslist = NULL;
+        int res = 0;
 
-            if (!OSSL_CMP_ITAV_get0_crlStatusList(req, &crlstatuslist))
-                return NULL;
+        if (!OSSL_CMP_ITAV_get0_crlStatusList(req, &crlstatuslist))
+            return NULL;
 
-            res = check_client_crl(crlstatuslist, ctx->crlOut);
-            if (res < 0)
-                rsp = NULL;
-            else
-                rsp = OSSL_CMP_ITAV_new_crls(res == 0 ? NULL : ctx->crlOut);
-        }
-        break;
-    case NID_id_it_certReqTemplate:
-        {
-            OSSL_CRMF_CERTTEMPLATE *reqtemp;
-            OSSL_CMP_ATAVS *keyspec = NULL;
-            X509_ALGOR *keyalg = NULL;
-            OSSL_CMP_ATAV *rsakeylen, *eckeyalg;
-            int ok = 0;
+        res = check_client_crl(crlstatuslist, ctx->crlOut);
+        if (res < 0)
+            rsp = NULL;
+        else
+            rsp = OSSL_CMP_ITAV_new_crls(res == 0 ? NULL : ctx->crlOut);
+    } break;
+    case NID_id_it_certReqTemplate: {
+        OSSL_CRMF_CERTTEMPLATE *reqtemp;
+        OSSL_CMP_ATAVS *keyspec = NULL;
+        X509_ALGOR *keyalg = NULL;
+        OSSL_CMP_ATAV *rsakeylen, *eckeyalg;
+        int ok = 0;
 
-            if ((reqtemp = OSSL_CRMF_CERTTEMPLATE_new()) == NULL)
-                return NULL;
+        if ((reqtemp = OSSL_CRMF_CERTTEMPLATE_new()) == NULL)
+            return NULL;
 
-            if (!OSSL_CRMF_CERTTEMPLATE_fill(reqtemp, NULL, NULL,
-                                             X509_get_issuer_name(ctx->refCert),
-                                             NULL))
-                goto crt_err;
+        if (!OSSL_CRMF_CERTTEMPLATE_fill(reqtemp, NULL, NULL,
+                X509_get_issuer_name(ctx->refCert),
+                NULL))
+            goto crt_err;
 
-            if ((keyalg = X509_ALGOR_new()) == NULL)
-                goto crt_err;
+        if ((keyalg = X509_ALGOR_new()) == NULL)
+            goto crt_err;
 
-            (void)X509_ALGOR_set0(keyalg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
-                                  V_ASN1_UNDEF, NULL); /* cannot fail */
+        (void)X509_ALGOR_set0(keyalg, OBJ_nid2obj(NID_X9_62_id_ecPublicKey),
+            V_ASN1_UNDEF, NULL); /* cannot fail */
 
-            eckeyalg = OSSL_CMP_ATAV_new_algId(keyalg);
-            rsakeylen = OSSL_CMP_ATAV_new_rsaKeyLen(4096);
-            ok = OSSL_CMP_ATAV_push1(&keyspec, eckeyalg)
-                 && OSSL_CMP_ATAV_push1(&keyspec, rsakeylen);
-            OSSL_CMP_ATAV_free(eckeyalg);
-            OSSL_CMP_ATAV_free(rsakeylen);
-            X509_ALGOR_free(keyalg);
+        eckeyalg = OSSL_CMP_ATAV_new_algId(keyalg);
+        rsakeylen = OSSL_CMP_ATAV_new_rsaKeyLen(4096);
+        ok = OSSL_CMP_ATAV_push1(&keyspec, eckeyalg)
+            && OSSL_CMP_ATAV_push1(&keyspec, rsakeylen);
+        OSSL_CMP_ATAV_free(eckeyalg);
+        OSSL_CMP_ATAV_free(rsakeylen);
+        X509_ALGOR_free(keyalg);
 
-            if (!ok)
-                goto crt_err;
+        if (!ok)
+            goto crt_err;
 
-            rsp = OSSL_CMP_ITAV_new0_certReqTemplate(reqtemp, keyspec);
-            return rsp;
+        rsp = OSSL_CMP_ITAV_new0_certReqTemplate(reqtemp, keyspec);
+        return rsp;
 
-        crt_err:
-            OSSL_CRMF_CERTTEMPLATE_free(reqtemp);
-            OSSL_CMP_ATAVS_free(keyspec);
-            return NULL;
-        }
-        break;
+    crt_err:
+        OSSL_CRMF_CERTTEMPLATE_free(reqtemp);
+        OSSL_CMP_ATAVS_free(keyspec);
+        return NULL;
+    } break;
     default:
         rsp = OSSL_CMP_ITAV_dup(req);
     }
@@ -572,9 +565,9 @@ static OSSL_CMP_ITAV *process_genm_itav(mock_srv_ctx *ctx, int req_nid,
 }
 
 static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
-                        const OSSL_CMP_MSG *genm,
-                        const STACK_OF(OSSL_CMP_ITAV) *in,
-                        STACK_OF(OSSL_CMP_ITAV) **out)
+    const OSSL_CMP_MSG *genm,
+    const STACK_OF(OSSL_CMP_ITAV) *in,
+    STACK_OF(OSSL_CMP_ITAV) **out)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
 
@@ -583,8 +576,8 @@ static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
         return 0;
     }
     if (ctx->sendError == 1
-            || ctx->sendError == OSSL_CMP_MSG_get_bodytype(genm)
-            || sk_OSSL_CMP_ITAV_num(in) > 1) {
+        || ctx->sendError == OSSL_CMP_MSG_get_bodytype(genm)
+        || sk_OSSL_CMP_ITAV_num(in) > 1) {
         ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
         return 0;
     }
@@ -602,14 +595,14 @@ static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
     }
 
     *out = sk_OSSL_CMP_ITAV_deep_copy(in, OSSL_CMP_ITAV_dup,
-                                      OSSL_CMP_ITAV_free);
+        OSSL_CMP_ITAV_free);
     return *out != NULL;
 }
 
 static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
-                          const OSSL_CMP_PKISI *statusInfo,
-                          const ASN1_INTEGER *errorCode,
-                          const OSSL_CMP_PKIFREETEXT *errorDetails)
+    const OSSL_CMP_PKISI *statusInfo,
+    const ASN1_INTEGER *errorCode,
+    const OSSL_CMP_PKIFREETEXT *errorDetails)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
     char buf[OSSL_CMP_PKISI_BUFLEN];
@@ -628,7 +621,7 @@ static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
     } else {
         sibuf = OSSL_CMP_snprint_PKIStatusInfo(statusInfo, buf, sizeof(buf));
         BIO_printf(bio_err, "pkiStatusInfo: %s\n",
-                   sibuf != NULL ? sibuf: "<invalid>");
+            sibuf != NULL ? sibuf : "<invalid>");
     }
 
     if (errorCode == NULL)
@@ -644,18 +637,18 @@ static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
             if (i > 0)
                 BIO_printf(bio_err, ", ");
             ASN1_STRING_print_ex(bio_err,
-                                 sk_ASN1_UTF8STRING_value(errorDetails, i),
-                                 ASN1_STRFLGS_ESC_QUOTE);
+                sk_ASN1_UTF8STRING_value(errorDetails, i),
+                ASN1_STRFLGS_ESC_QUOTE);
         }
         BIO_printf(bio_err, "\n");
     }
 }
 
 static int process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
-                            const OSSL_CMP_MSG *certConf,
-                            ossl_unused int certReqId,
-                            const ASN1_OCTET_STRING *certHash,
-                            const OSSL_CMP_PKISI *si)
+    const OSSL_CMP_MSG *certConf,
+    ossl_unused int certReqId,
+    const ASN1_OCTET_STRING *certHash,
+    const OSSL_CMP_PKISI *si)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
     ASN1_OCTET_STRING *digest;
@@ -665,8 +658,8 @@ static int process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
         return 0;
     }
     if (ctx->sendError == 1
-            || ctx->sendError == OSSL_CMP_MSG_get_bodytype(certConf)
-            || ctx->certOut == NULL) {
+        || ctx->sendError == OSSL_CMP_MSG_get_bodytype(certConf)
+        || ctx->certOut == NULL) {
         ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
         return 0;
     }
@@ -684,22 +677,22 @@ static int process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
 
 /* return 0 on failure, 1 on success, setting *req or otherwise *check_after */
 static int process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
-                           const OSSL_CMP_MSG *pollReq,
-                           ossl_unused int certReqId,
-                           OSSL_CMP_MSG **req, int64_t *check_after)
+    const OSSL_CMP_MSG *pollReq,
+    ossl_unused int certReqId,
+    OSSL_CMP_MSG **req, int64_t *check_after)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
 
     if (req != NULL)
         *req = NULL;
     if (ctx == NULL || pollReq == NULL
-            || req == NULL || check_after == NULL) {
+        || req == NULL || check_after == NULL) {
         ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
         return 0;
     }
 
     if (ctx->sendError == 1
-            || ctx->sendError == OSSL_CMP_MSG_get_bodytype(pollReq)) {
+        || ctx->sendError == OSSL_CMP_MSG_get_bodytype(pollReq)) {
         ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_PROCESSING_MESSAGE);
         return 0;
     }
@@ -725,11 +718,11 @@ OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(OSSL_LIB_CTX *libctx, const char *propq)
     mock_srv_ctx *ctx = mock_srv_ctx_new();
 
     if (srv_ctx != NULL && ctx != NULL
-            && OSSL_CMP_SRV_CTX_init(srv_ctx, ctx, process_cert_request,
-                                     process_rr, process_genm, process_error,
-                                     process_certConf, process_pollReq)
-            && OSSL_CMP_SRV_CTX_init_trans(srv_ctx,
-                                           delayed_delivery, clean_transaction))
+        && OSSL_CMP_SRV_CTX_init(srv_ctx, ctx, process_cert_request,
+            process_rr, process_genm, process_error,
+            process_certConf, process_pollReq)
+        && OSSL_CMP_SRV_CTX_init_trans(srv_ctx,
+            delayed_delivery, clean_transaction))
         return srv_ctx;
 
     mock_srv_ctx_free(ctx);
diff --git a/crypto/openssl/apps/lib/columns.c b/crypto/openssl/apps/lib/columns.c
index aa58fe1781f5..3dd86600e701 100644
--- a/crypto/openssl/apps/lib/columns.c
+++ b/crypto/openssl/apps/lib/columns.c
@@ -24,4 +24,3 @@ void calculate_columns(FUNCTION *functions, DISPLAY_COLUMNS *dc)
     dc->width = maxlen + 2;
     dc->columns = (80 - 1) / dc->width;
 }
-
diff --git a/crypto/openssl/apps/lib/engine.c b/crypto/openssl/apps/lib/engine.c
index 209c4b6b03c2..c486a10513e3 100644
--- a/crypto/openssl/apps/lib/engine.c
+++ b/crypto/openssl/apps/lib/engine.c
@@ -19,7 +19,7 @@
 #include <openssl/types.h> /* Ensure we have the ENGINE type, regardless */
 #include <openssl/err.h>
 #ifndef OPENSSL_NO_ENGINE
-# include <openssl/engine.h>
+#include <openssl/engine.h>
 #endif
 #include "apps.h"
 
@@ -60,8 +60,8 @@ ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug)
         if (debug)
             (void)ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM, 0, bio_err, 0);
         if (!ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0,
-                             (void *)get_ui_method(), 0, 1)
-                || !ENGINE_set_default(e, methods)) {
+                (void *)get_ui_method(), 0, 1)
+            || !ENGINE_set_default(e, methods)) {
             BIO_printf(bio_err, "Cannot use engine \"%s\"\n", ENGINE_get_id(e));
             ERR_print_errors(bio_err);
             ENGINE_free(e);
@@ -113,8 +113,7 @@ char *make_engine_uri(ENGINE *e, const char *key_id, const char *desc)
         BIO_printf(bio_err, "No engine key id specified for loading %s\n", desc);
     } else {
         const char *engineid = ENGINE_get_id(e);
-        size_t uri_sz =
-            sizeof(ENGINE_SCHEME_COLON) - 1
+        size_t uri_sz = sizeof(ENGINE_SCHEME_COLON) - 1
             + strlen(engineid)
             + 1 /* : */
             + strlen(key_id)
@@ -151,9 +150,9 @@ int get_legacy_pkey_id(OSSL_LIB_CTX *libctx, const char *algname, ENGINE *e)
         ameth = ENGINE_get_pkey_asn1_meth_str(e, algname, -1);
     else
 #endif
-    /* We're only interested if it comes from an ENGINE */
-    if (tmpeng == NULL)
-        ameth = NULL;
+        /* We're only interested if it comes from an ENGINE */
+        if (tmpeng == NULL)
+            ameth = NULL;
 
     ERR_pop_to_mark();
     if (ameth == NULL)
diff --git a/crypto/openssl/apps/lib/engine_loader.c b/crypto/openssl/apps/lib/engine_loader.c
index e0f26f614afe..dd391bafe4fa 100644
--- a/crypto/openssl/apps/lib/engine_loader.c
+++ b/crypto/openssl/apps/lib/engine_loader.c
@@ -19,10 +19,10 @@
 
 #ifndef OPENSSL_NO_ENGINE
 
-# include <stdarg.h>
-# include <string.h>
-# include <openssl/engine.h>
-# include <openssl/store.h>
+#include <stdarg.h>
+#include <string.h>
+#include <openssl/engine.h>
+#include <openssl/store.h>
 
 /*
  * Support for legacy private engine keys via the 'org.openssl.engine:' scheme
@@ -36,10 +36,10 @@
 
 /* Local definition of OSSL_STORE_LOADER_CTX */
 struct ossl_store_loader_ctx_st {
-    ENGINE *e;                   /* Structural reference */
+    ENGINE *e; /* Structural reference */
     char *keyid;
     int expected;
-    int loaded;                  /* 0 = key not loaded yet, 1 = key loaded */
+    int loaded; /* 0 = key not loaded yet, 1 = key loaded */
 };
 
 static OSSL_STORE_LOADER_CTX *OSSL_STORE_LOADER_CTX_new(ENGINE *e, char *keyid)
@@ -63,9 +63,9 @@ static void OSSL_STORE_LOADER_CTX_free(OSSL_STORE_LOADER_CTX *ctx)
 }
 
 static OSSL_STORE_LOADER_CTX *engine_open(const OSSL_STORE_LOADER *loader,
-                                          const char *uri,
-                                          const UI_METHOD *ui_method,
-                                          void *ui_data)
+    const char *uri,
+    const UI_METHOD *ui_method,
+    void *ui_data)
 {
     const char *p = uri, *q;
     ENGINE *e = NULL;
@@ -77,9 +77,9 @@ static OSSL_STORE_LOADER_CTX *engine_open(const OSSL_STORE_LOADER *loader,
 
     /* Look for engine ID */
     q = strchr(p, ':');
-    if (q != NULL                /* There is both an engine ID and a key ID */
-        && p[0] != ':'           /* The engine ID is at least one character */
-        && q[1] != '\0') {       /* The key ID is at least one character */
+    if (q != NULL /* There is both an engine ID and a key ID */
+        && p[0] != ':' /* The engine ID is at least one character */
+        && q[1] != '\0') { /* The key ID is at least one character */
         char engineid[256];
         size_t engineid_l = q - p;
 
@@ -113,7 +113,7 @@ static int engine_expect(OSSL_STORE_LOADER_CTX *ctx, int expected)
 }
 
 static OSSL_STORE_INFO *engine_load(OSSL_STORE_LOADER_CTX *ctx,
-                                    const UI_METHOD *ui_method, void *ui_data)
+    const UI_METHOD *ui_method, void *ui_data)
 {
     EVP_PKEY *pkey = NULL, *pubkey = NULL;
     OSSL_STORE_INFO *info = NULL;
@@ -122,14 +122,12 @@ static OSSL_STORE_INFO *engine_load(OSSL_STORE_LOADER_CTX *ctx,
         if (ENGINE_init(ctx->e)) {
             if (ctx->expected == 0
                 || ctx->expected == OSSL_STORE_INFO_PKEY)
-                pkey =
-                    ENGINE_load_private_key(ctx->e, ctx->keyid,
-                                            (UI_METHOD *)ui_method, ui_data);
+                pkey = ENGINE_load_private_key(ctx->e, ctx->keyid,
+                    (UI_METHOD *)ui_method, ui_data);
             if ((pkey == NULL && ctx->expected == 0)
                 || ctx->expected == OSSL_STORE_INFO_PUBKEY)
-                pubkey =
-                    ENGINE_load_public_key(ctx->e, ctx->keyid,
-                                           (UI_METHOD *)ui_method, ui_data);
+                pubkey = ENGINE_load_public_key(ctx->e, ctx->keyid,
+                    (UI_METHOD *)ui_method, ui_data);
             ENGINE_finish(ctx->e);
         }
     }
@@ -188,7 +186,7 @@ void destroy_engine_loader(void)
     OSSL_STORE_LOADER_free(loader);
 }
 
-#else  /* !OPENSSL_NO_ENGINE */
+#else /* !OPENSSL_NO_ENGINE */
 
 int setup_engine_loader(void)
 {
diff --git a/crypto/openssl/apps/lib/http_server.c b/crypto/openssl/apps/lib/http_server.c
index 8136228b32d0..9b2c45a8645a 100644
--- a/crypto/openssl/apps/lib/http_server.c
+++ b/crypto/openssl/apps/lib/http_server.c
@@ -14,7 +14,7 @@
  * On VMS, you need to define this to get the declaration of fileno().  The
  * value 2 is to make sure no function defined in POSIX-2 is left undefined.
  */
-# define _POSIX_C_SOURCE 2
+#define _POSIX_C_SOURCE 2
 #endif
 
 #include <ctype.h>
@@ -30,9 +30,9 @@
 
 #define HTTP_PREFIX "HTTP/"
 #define HTTP_VERSION_PATT "1." /* allow 1.x */
-#define HTTP_PREFIX_VERSION HTTP_PREFIX""HTTP_VERSION_PATT
-#define HTTP_1_0 HTTP_PREFIX_VERSION"0" /* "HTTP/1.0" */
-#define HTTP_VERSION_STR " "HTTP_PREFIX_VERSION
+#define HTTP_PREFIX_VERSION HTTP_PREFIX "" HTTP_VERSION_PATT
+#define HTTP_1_0 HTTP_PREFIX_VERSION "0" /* "HTTP/1.0" */
+#define HTTP_VERSION_STR " " HTTP_PREFIX_VERSION
 
 #define log_HTTP(prog, level, text) \
     trace_log_message(OSSL_TRACE_CATEGORY_HTTP, prog, level, "%s", text)
@@ -40,7 +40,7 @@
     trace_log_message(OSSL_TRACE_CATEGORY_HTTP, prog, level, fmt, arg)
 #define log_HTTP2(prog, level, fmt, arg1, arg2) \
     trace_log_message(OSSL_TRACE_CATEGORY_HTTP, prog, level, fmt, arg1, arg2)
-#define log_HTTP3(prog, level, fmt, a1, a2, a3)                        \
+#define log_HTTP3(prog, level, fmt, a1, a2, a3) \
     trace_log_message(OSSL_TRACE_CATEGORY_HTTP, prog, level, fmt, a1, a2, a3)
 
 #ifdef HTTP_DAEMON
@@ -88,8 +88,8 @@ void spawn_loop(const char *prog)
 
     if (setpgid(0, 0)) {
         log_HTTP1(prog, LOG_CRIT,
-                  "error detaching from parent process group: %s",
-                  strerror(errno));
+            "error detaching from parent process group: %s",
+            strerror(errno));
         exit(1);
     }
     kidpids = app_malloc(n_responders * sizeof(*kidpids), "child PID array");
@@ -117,32 +117,32 @@ void spawn_loop(const char *prog)
                 }
                 if (i >= n_responders) {
                     log_HTTP1(prog, LOG_CRIT,
-                              "internal error: no matching child slot for pid: %ld",
-                              (long)fpid);
+                        "internal error: no matching child slot for pid: %ld",
+                        (long)fpid);
                     killall(1, kidpids);
                 }
                 if (status != 0) {
                     if (WIFEXITED(status)) {
                         log_HTTP2(prog, LOG_WARNING,
-                                  "child process: %ld, exit status: %d",
-                                  (long)fpid, WEXITSTATUS(status));
+                            "child process: %ld, exit status: %d",
+                            (long)fpid, WEXITSTATUS(status));
                     } else if (WIFSIGNALED(status)) {
                         char *dumped = "";
 
-# ifdef WCOREDUMP
+#ifdef WCOREDUMP
                         if (WCOREDUMP(status))
                             dumped = " (core dumped)";
-# endif
+#endif
                         log_HTTP3(prog, LOG_WARNING,
-                                  "child process: %ld, term signal %d%s",
-                                  (long)fpid, WTERMSIG(status), dumped);
+                            "child process: %ld, term signal %d%s",
+                            (long)fpid, WTERMSIG(status), dumped);
                     }
                     OSSL_sleep(1000);
                 }
                 break;
             } else if (errno != EINTR) {
                 log_HTTP1(prog, LOG_CRIT,
-                          "waitpid() failed: %s", strerror(errno));
+                    "waitpid() failed: %s", strerror(errno));
                 killall(1, kidpids);
             }
         }
@@ -165,7 +165,7 @@ void spawn_loop(const char *prog)
                 _exit(1);
             }
             return;
-        default:            /* parent */
+        default: /* parent */
             for (i = 0; i < n_responders; ++i) {
                 if (kidpids[i] == 0) {
                     kidpids[i] = fpid;
@@ -175,7 +175,7 @@ void spawn_loop(const char *prog)
             }
             if (i >= n_responders) {
                 log_HTTP(prog, LOG_CRIT,
-                         "internal error: no free child slots");
+                    "internal error: no free child slots");
                 killall(1, kidpids);
             }
             break;
@@ -228,7 +228,7 @@ BIO *http_server_init(const char *prog, const char *port, int verb)
 
     return acbio;
 
- err:
+err:
     ERR_print_errors(bio_err);
     BIO_free_all(acbio);
     BIO_free(bufbio);
@@ -262,9 +262,9 @@ static int urldecode(char *p)
 /* if *pcbio != NULL, continue given connected session, else accept new */
 /* if found_keep_alive != NULL, return this way connection persistence state */
 int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
-                             char **ppath, BIO **pcbio, BIO *acbio,
-                             int *found_keep_alive,
-                             const char *prog, int accept_get, int timeout)
+    char **ppath, BIO **pcbio, BIO *acbio,
+    int *found_keep_alive,
+    const char *prog, int accept_get, int timeout)
 {
     BIO *cbio = *pcbio, *getbio = NULL, *b64 = NULL;
     int len;
@@ -286,7 +286,7 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
             goto fatal;
         }
         log_HTTP1(prog, LOG_DEBUG,
-                  "awaiting new connection on port %s ...", port);
+            "awaiting new connection on port %s ...", port);
         OPENSSL_free(port);
 
         if (BIO_do_accept(acbio) <= 0)
@@ -303,12 +303,12 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
         goto out;
     }
 
-# ifdef HTTP_DAEMON
+#ifdef HTTP_DAEMON
     if (timeout > 0) {
         (void)BIO_get_fd(cbio, &acfd);
         alarm(timeout);
     }
-# endif
+#endif
 
     /* Read the request line. */
     len = BIO_gets(cbio, reqbuf, sizeof(reqbuf));
@@ -322,23 +322,23 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
     }
 
     if (((end = strchr(reqbuf, '\r')) != NULL && end[1] == '\n')
-            || (end = strchr(reqbuf, '\n')) != NULL)
+        || (end = strchr(reqbuf, '\n')) != NULL)
         *end = '\0';
     if (log_get_verbosity() < LOG_TRACE)
         trace_log_message(-1, prog, LOG_INFO,
-                          "received request, 1st line: %s", reqbuf);
+            "received request, 1st line: %s", reqbuf);
     log_HTTP(prog, LOG_TRACE, "received request header:");
     log_HTTP1(prog, LOG_TRACE, "%s", reqbuf);
     if (end == NULL) {
         log_HTTP(prog, LOG_WARNING,
-                 "cannot parse HTTP header: missing end of line");
+            "cannot parse HTTP header: missing end of line");
         (void)http_server_send_status(prog, cbio, 400, "Bad Request");
         goto out;
     }
 
     url = meth = reqbuf;
     if ((accept_get && CHECK_AND_SKIP_PREFIX(url, "GET "))
-            || CHECK_AND_SKIP_PREFIX(url, "POST ")) {
+        || CHECK_AND_SKIP_PREFIX(url, "POST ")) {
 
         /* Expecting (GET|POST) {sp} /URL {sp} HTTP/1.x */
         url[-1] = '\0';
@@ -346,8 +346,8 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
             url++;
         if (*url != '/') {
             log_HTTP2(prog, LOG_WARNING,
-                      "invalid %s -- URL does not begin with '/': %s",
-                      meth, url);
+                "invalid %s -- URL does not begin with '/': %s",
+                meth, url);
             (void)http_server_send_status(prog, cbio, 400, "Bad Request");
             goto out;
         }
@@ -359,8 +359,8 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
                 break;
         if (!HAS_PREFIX(end, HTTP_VERSION_STR)) {
             log_HTTP2(prog, LOG_WARNING,
-                      "invalid %s -- bad HTTP/version string: %s",
-                      meth, end + 1);
+                "invalid %s -- bad HTTP/version string: %s",
+                meth, end + 1);
             (void)http_server_send_status(prog, cbio, 400, "Bad Request");
             goto out;
         }
@@ -382,7 +382,7 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
         len = urldecode(url);
         if (len < 0) {
             log_HTTP2(prog, LOG_WARNING,
-                      "invalid %s request -- bad URL encoding: %s", meth, url);
+                "invalid %s request -- bad URL encoding: %s", meth, url);
             (void)http_server_send_status(prog, cbio, 400, "Bad Request");
             goto out;
         }
@@ -390,7 +390,7 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
             if ((getbio = BIO_new_mem_buf(url, len)) == NULL
                 || (b64 = BIO_new(BIO_f_base64())) == NULL) {
                 log_HTTP1(prog, LOG_ERR,
-                          "could not allocate base64 bio with size = %d", len);
+                    "could not allocate base64 bio with size = %d", len);
                 goto fatal;
             }
             BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
@@ -398,8 +398,8 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
         }
     } else {
         log_HTTP2(prog, LOG_WARNING,
-                  "HTTP request does not begin with %sPOST: %s",
-                  accept_get ? "GET or " : "", reqbuf);
+            "HTTP request does not begin with %sPOST: %s",
+            accept_get ? "GET or " : "", reqbuf);
         (void)http_server_send_status(prog, cbio, 400, "Bad Request");
         goto out;
     }
@@ -425,11 +425,10 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
         if (((end = strchr(inbuf, '\r')) != NULL && end[1] == '\n')
             || (end = strchr(inbuf, '\n')) != NULL)
             *end = '\0';
-        log_HTTP1(prog, LOG_TRACE, "%s", *inbuf == '\0' ?
-                  " " /* workaround for "" getting ignored */ : inbuf);
+        log_HTTP1(prog, LOG_TRACE, "%s", *inbuf == '\0' ? " " /* workaround for "" getting ignored */ : inbuf);
         if (end == NULL) {
             log_HTTP(prog, LOG_WARNING,
-                     "error parsing HTTP header: missing end of line");
+                "error parsing HTTP header: missing end of line");
             (void)http_server_send_status(prog, cbio, 400, "Bad Request");
             goto out;
         }
@@ -441,7 +440,7 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
         value = strchr(key, ':');
         if (value == NULL) {
             log_HTTP(prog, LOG_WARNING,
-                     "error parsing HTTP header: missing ':'");
+                "error parsing HTTP header: missing ':'");
             (void)http_server_send_status(prog, cbio, 400, "Bad Request");
             goto out;
         }
@@ -458,37 +457,37 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
         }
     }
 
-# ifdef HTTP_DAEMON
+#ifdef HTTP_DAEMON
     /* Clear alarm before we close the client socket */
     alarm(0);
     timeout = 0;
-# endif
+#endif
 
     /* Try to read and parse request */
     req = ASN1_item_d2i_bio(it, getbio != NULL ? getbio : cbio, NULL);
     if (req == NULL) {
         log_HTTP(prog, LOG_WARNING,
-                 "error parsing DER-encoded request content");
+            "error parsing DER-encoded request content");
         (void)http_server_send_status(prog, cbio, 400, "Bad Request");
     } else if (ppath != NULL && (*ppath = OPENSSL_strdup(url)) == NULL) {
         log_HTTP1(prog, LOG_ERR,
-                  "out of memory allocating %zu bytes", strlen(url) + 1);
+            "out of memory allocating %zu bytes", strlen(url) + 1);
         ASN1_item_free(req, it);
         goto fatal;
     }
 
     *preq = req;
 
- out:
+out:
     BIO_free_all(getbio);
-# ifdef HTTP_DAEMON
+#ifdef HTTP_DAEMON
     if (timeout > 0)
         alarm(0);
     acfd = (int)INVALID_SOCKET;
-# endif
+#endif
     return ret;
 
- fatal:
+fatal:
     (void)http_server_send_status(prog, cbio, 500, "Internal Server Error");
     if (ppath != NULL) {
         OPENSSL_free(*ppath);
@@ -502,23 +501,23 @@ int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
 
 /* assumes that cbio does not do an encoding that changes the output length */
 int http_server_send_asn1_resp(const char *prog, BIO *cbio, int keep_alive,
-                               const char *content_type,
-                               const ASN1_ITEM *it, const ASN1_VALUE *resp)
+    const char *content_type,
+    const ASN1_ITEM *it, const ASN1_VALUE *resp)
 {
     char buf[200], *p;
-    int ret = BIO_snprintf(buf, sizeof(buf), HTTP_1_0" 200 OK\r\n%s"
-                           "Content-type: %s\r\n"
-                           "Content-Length: %d\r\n",
-                           keep_alive ? "Connection: keep-alive\r\n" : "",
-                           content_type,
-                           ASN1_item_i2d(resp, NULL, it));
+    int ret = BIO_snprintf(buf, sizeof(buf), HTTP_1_0 " 200 OK\r\n%s"
+                                                      "Content-type: %s\r\n"
+                                                      "Content-Length: %d\r\n",
+        keep_alive ? "Connection: keep-alive\r\n" : "",
+        content_type,
+        ASN1_item_i2d(resp, NULL, it));
 
     if (ret < 0 || (size_t)ret >= sizeof(buf))
         return 0;
     if (log_get_verbosity() < LOG_TRACE && (p = strchr(buf, '\r')) != NULL)
         trace_log_message(-1, prog, LOG_INFO,
-                          "sending response, 1st line: %.*s", (int)(p - buf),
-                          buf);
+            "sending response, 1st line: %.*s", (int)(p - buf),
+            buf);
     log_HTTP1(prog, LOG_TRACE, "sending response header:\n%s", buf);
 
     ret = BIO_printf(cbio, "%s\r\n", buf) > 0
@@ -529,12 +528,12 @@ int http_server_send_asn1_resp(const char *prog, BIO *cbio, int keep_alive,
 }
 
 int http_server_send_status(const char *prog, BIO *cbio,
-                            int status, const char *reason)
+    int status, const char *reason)
 {
     char buf[200];
-    int ret = BIO_snprintf(buf, sizeof(buf), HTTP_1_0" %d %s\r\n\r\n",
-                           /* This implicitly cancels keep-alive */
-                           status, reason);
+    int ret = BIO_snprintf(buf, sizeof(buf), HTTP_1_0 " %d %s\r\n\r\n",
+        /* This implicitly cancels keep-alive */
+        status, reason);
 
     if (ret < 0 || (size_t)ret >= sizeof(buf))
         return 0;
diff --git a/crypto/openssl/apps/lib/log.c b/crypto/openssl/apps/lib/log.c
index a5e2f5507afd..e2a531883b5e 100644
--- a/crypto/openssl/apps/lib/log.c
+++ b/crypto/openssl/apps/lib/log.c
@@ -17,7 +17,7 @@ int log_set_verbosity(const char *prog, int level)
 {
     if (level < LOG_EMERG || level > LOG_TRACE) {
         trace_log_message(-1, prog, LOG_ERR,
-                          "Invalid verbosity level %d", level);
+            "Invalid verbosity level %d", level);
         return 0;
     }
     verbosity = level;
@@ -65,11 +65,11 @@ static void log_with_prefix(const char *prog, const char *fmt, va_list ap)
  */
 #undef OSSL_NO_C99
 #if !defined(__STDC_VERSION__) || __STDC_VERSION__ + 0 < 199900L
-# define OSSL_NO_C99
+#define OSSL_NO_C99
 #endif
 
 void trace_log_message(int category,
-                       const char *prog, int level, const char *fmt, ...)
+    const char *prog, int level, const char *fmt, ...)
 {
     va_list ap;
     va_start(ap, fmt);
@@ -103,6 +103,6 @@ void trace_log_message(int category,
             ERR_print_errors_cb(print_syslog, &level);
     } else
 #endif
-    log_with_prefix(prog, fmt, ap);
+        log_with_prefix(prog, fmt, ap);
     va_end(ap);
 }
diff --git a/crypto/openssl/apps/lib/names.c b/crypto/openssl/apps/lib/names.c
index 8825dfa3d895..24a146819b07 100644
--- a/crypto/openssl/apps/lib/names.c
+++ b/crypto/openssl/apps/lib/names.c
@@ -13,7 +13,7 @@
 #include "names.h"
 #include "internal/e_os.h"
 
-int name_cmp(const char * const *a, const char * const *b)
+int name_cmp(const char *const *a, const char *const *b)
 {
     return OPENSSL_strcasecmp(*a, *b);
 }
diff --git a/crypto/openssl/apps/lib/opt.c b/crypto/openssl/apps/lib/opt.c
index 0018c268c0b4..f9135f4549be 100644
--- a/crypto/openssl/apps/lib/opt.c
+++ b/crypto/openssl/apps/lib/opt.c
@@ -17,7 +17,7 @@
 #include "internal/numbers.h"
 #include <string.h>
 #if !defined(OPENSSL_SYS_MSDOS)
-# include <unistd.h>
+#include <unistd.h>
 #endif
 
 #include <stdlib.h>
@@ -56,7 +56,7 @@ const char *opt_path_end(const char *filename)
     const char *p;
 
     /* find the last '/', '\' or ':' */
-    for (p = filename + strlen(filename); --p > filename; )
+    for (p = filename + strlen(filename); --p > filename;)
         if (*p == '/' || *p == '\\' || *p == ':') {
             p++;
             break;
@@ -74,8 +74,7 @@ char *opt_progname(const char *argv0)
 
     /* Strip off trailing nonsense. */
     n = strlen(p);
-    if (n > 4 &&
-        (strcmp(&p[n - 4], ".exe") == 0 || strcmp(&p[n - 4], ".EXE") == 0))
+    if (n > 4 && (strcmp(&p[n - 4], ".exe") == 0 || strcmp(&p[n - 4], ".EXE") == 0))
         n -= 4;
 
     /* Copy over the name, in lowercase. */
@@ -178,8 +177,8 @@ char *opt_init(int ac, char **av, const OPTIONS *o)
 #endif
 
         if (o->name == OPT_HELP_STR
-                || o->name == OPT_MORE_STR
-                || o->name == OPT_SECTION_STR)
+            || o->name == OPT_MORE_STR
+            || o->name == OPT_SECTION_STR)
             continue;
 #ifndef NDEBUG
         i = o->valtype;
@@ -191,10 +190,26 @@ char *opt_init(int ac, char **av, const OPTIONS *o)
         else
             OPENSSL_assert(o->retval == OPT_DUP || o->retval > OPT_PARAM);
         switch (i) {
-        case   0: case '-': case '.':
-        case '/': case '<': case '>': case 'E': case 'F':
-        case 'M': case 'U': case 'f': case 'l': case 'n': case 'p': case 's':
-        case 'u': case 'c': case ':': case 'N': case 'A':
+        case 0:
+        case '-':
+        case '.':
+        case '/':
+        case '<':
+        case '>':
+        case 'E':
+        case 'F':
+        case 'M':
+        case 'U':
+        case 'f':
+        case 'l':
+        case 'n':
+        case 'p':
+        case 's':
+        case 'u':
+        case 'c':
+        case ':':
+        case 'N':
+        case 'A':
             break;
         default:
             OPENSSL_assert(0);
@@ -209,7 +224,7 @@ char *opt_init(int ac, char **av, const OPTIONS *o)
                 && strcmp(o->name, next->name) == 0;
             if (duplicated) {
                 opt_printf_stderr("%s: Internal error: duplicate option %s\n",
-                                  prog, o->name);
+                    prog, o->name);
                 OPENSSL_assert(!duplicated);
             }
         }
@@ -225,18 +240,18 @@ char *opt_init(int ac, char **av, const OPTIONS *o)
 }
 
 static OPT_PAIR formats[] = {
-    {"pem", OPT_FMT_PEM},
-    {"der", OPT_FMT_DER},
-    {"b64", OPT_FMT_B64},
-    {"pkcs12", OPT_FMT_PKCS12},
-    {"smime", OPT_FMT_SMIME},
-    {"engine", OPT_FMT_ENGINE},
-    {"msblob", OPT_FMT_MSBLOB},
-    {"nss", OPT_FMT_NSS},
-    {"text", OPT_FMT_TEXT},
-    {"http", OPT_FMT_HTTP},
-    {"pvk", OPT_FMT_PVK},
-    {NULL}
+    { "pem", OPT_FMT_PEM },
+    { "der", OPT_FMT_DER },
+    { "b64", OPT_FMT_B64 },
+    { "pkcs12", OPT_FMT_PKCS12 },
+    { "smime", OPT_FMT_SMIME },
+    { "engine", OPT_FMT_ENGINE },
+    { "msblob", OPT_FMT_MSBLOB },
+    { "nss", OPT_FMT_NSS },
+    { "text", OPT_FMT_TEXT },
+    { "http", OPT_FMT_HTTP },
+    { "pvk", OPT_FMT_PVK },
+    { NULL }
 };
 
 void opt_set_unknown_name(const char *name)
@@ -269,7 +284,7 @@ int opt_format(const char *s, unsigned long flags, int *result)
     case 'b':
         if (s[1] == '\0'
             || strcmp(s, "B64") == 0 || strcmp(s, "b64") == 0
-            || strcmp(s, "BASE64") == 0 || strcmp(s, "base64") == 0 ) {
+            || strcmp(s, "BASE64") == 0 || strcmp(s, "base64") == 0) {
             if ((flags & OPT_FMT_B64) == 0)
                 return opt_format_error(s, flags);
             *result = FORMAT_BASE64;
@@ -337,7 +352,7 @@ int opt_format(const char *s, unsigned long flags, int *result)
                 return opt_format_error(s, flags);
             *result = FORMAT_PVK;
         } else if (strcmp(s, "P12") == 0 || strcmp(s, "p12") == 0
-                   || strcmp(s, "PKCS12") == 0 || strcmp(s, "pkcs12") == 0) {
+            || strcmp(s, "PKCS12") == 0 || strcmp(s, "pkcs12") == 0) {
             if ((flags & OPT_FMT_PKCS12) == 0)
                 return opt_format_error(s, flags);
             *result = FORMAT_PKCS12;
@@ -395,7 +410,8 @@ int opt_cipher_silent(const char *name, EVP_CIPHER **cipherp)
 
     ERR_set_mark();
     if ((c = EVP_CIPHER_fetch(app_get0_libctx(), name,
-                              app_get0_propq())) != NULL
+             app_get0_propq()))
+            != NULL
         || (opt_legacy_okay()
             && (c = (EVP_CIPHER *)EVP_get_cipherbyname(name)) != NULL)) {
         ERR_pop_to_mark();
@@ -416,7 +432,7 @@ int opt_cipher_any(const char *name, EVP_CIPHER **cipherp)
     int ret;
 
     if (name == NULL)
-         return 1;
+        return 1;
     if ((ret = opt_cipher_silent(name, cipherp)) == 0)
         opt_printf_stderr("%s: Unknown option or cipher: %s\n", prog, name);
     return ret;
@@ -424,13 +440,13 @@ int opt_cipher_any(const char *name, EVP_CIPHER **cipherp)
 
 int opt_cipher(const char *name, EVP_CIPHER **cipherp)
 {
-     int mode, ret = 0;
-     unsigned long int flags;
-     EVP_CIPHER *c = NULL;
+    int mode, ret = 0;
+    unsigned long int flags;
+    EVP_CIPHER *c = NULL;
 
     if (name == NULL)
-         return 1;
-     if (opt_cipher_any(name, &c)) {
+        return 1;
+    if (opt_cipher_any(name, &c)) {
         mode = EVP_CIPHER_get_mode(c);
         flags = EVP_CIPHER_get_flags(c);
         if (mode == EVP_CIPH_XTS_MODE) {
@@ -478,7 +494,7 @@ int opt_md(const char *name, EVP_MD **mdp)
         return 1;
     if ((ret = opt_md_silent(name, mdp)) == 0)
         opt_printf_stderr("%s: Unknown option or message digest: %s\n",
-                          prog, name);
+            prog, name);
     return ret;
 }
 
@@ -491,7 +507,7 @@ int opt_check_md(const char *name)
 }
 
 /* Look through a list of name/value pairs. */
-int opt_pair(const char *name, const OPT_PAIR* pairs, int *result)
+int opt_pair(const char *name, const OPT_PAIR *pairs, int *result)
 {
     const OPT_PAIR *pp;
 
@@ -530,7 +546,7 @@ int opt_int(const char *value, int *result)
     *result = (int)l;
     if (*result != l) {
         opt_printf_stderr("%s: Value \"%s\" outside integer range\n",
-                          prog, value);
+            prog, value);
         return 0;
     }
     return 1;
@@ -552,15 +568,15 @@ static void opt_number_error(const char *v)
         char *prefix;
         char *name;
     } b[] = {
-        {"0x", "a hexadecimal"},
-        {"0X", "a hexadecimal"},
-        {"0", "an octal"}
+        { "0x", "a hexadecimal" },
+        { "0X", "a hexadecimal" },
+        { "0", "an octal" }
     };
 
     for (i = 0; i < OSSL_NELEM(b); i++) {
         if (strncmp(v, b[i].prefix, strlen(b[i].prefix)) == 0) {
             opt_printf_stderr("%s: Can't parse \"%s\" as %s number\n",
-                              prog, v, b[i].name);
+                prog, v, b[i].name);
             return;
         }
     }
@@ -578,9 +594,9 @@ int opt_long(const char *value, long *result)
     errno = 0;
     l = strtol(value, &endp, 0);
     if (*endp
-            || endp == value
-            || ((l == LONG_MAX || l == LONG_MIN) && errno == ERANGE)
-            || (l == 0 && errno != 0)) {
+        || endp == value
+        || ((l == LONG_MAX || l == LONG_MIN) && errno == ERANGE)
+        || (l == 0 && errno != 0)) {
         opt_number_error(value);
         errno = oerrno;
         return 0;
@@ -590,9 +606,7 @@ int opt_long(const char *value, long *result)
     return 1;
 }
 
-#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && \
-    defined(INTMAX_MAX) && defined(UINTMAX_MAX) && \
-    !defined(OPENSSL_NO_INTTYPES_H)
+#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && defined(INTMAX_MAX) && defined(UINTMAX_MAX) && !defined(OPENSSL_NO_INTTYPES_H)
 
 /* Parse an intmax_t, put it into *result; return 0 on failure, else 1. */
 int opt_intmax(const char *value, ossl_intmax_t *result)
@@ -604,10 +618,10 @@ int opt_intmax(const char *value, ossl_intmax_t *result)
     errno = 0;
     m = strtoimax(value, &endp, 0);
     if (*endp
-            || endp == value
-            || ((m == INTMAX_MAX || m == INTMAX_MIN)
-                && errno == ERANGE)
-            || (m == 0 && errno != 0)) {
+        || endp == value
+        || ((m == INTMAX_MAX || m == INTMAX_MIN)
+            && errno == ERANGE)
+        || (m == 0 && errno != 0)) {
         opt_number_error(value);
         errno = oerrno;
         return 0;
@@ -633,9 +647,9 @@ int opt_uintmax(const char *value, ossl_uintmax_t *result)
     errno = 0;
     m = strtoumax(value, &endp, 0);
     if (*endp
-            || endp == value
-            || (m == UINTMAX_MAX && errno == ERANGE)
-            || (m == 0 && errno != 0)) {
+        || endp == value
+        || (m == UINTMAX_MAX && errno == ERANGE)
+        || (m == 0 && errno != 0)) {
         opt_number_error(value);
         errno = oerrno;
         return 0;
@@ -685,9 +699,9 @@ int opt_ulong(const char *value, unsigned long *result)
     errno = 0;
     l = strtoul(value, &endptr, 0);
     if (*endptr
-            || endptr == value
-            || ((l == ULONG_MAX) && errno == ERANGE)
-            || (l == 0 && errno != 0)) {
+        || endptr == value
+        || ((l == ULONG_MAX) && errno == ERANGE)
+        || (l == 0 && errno != 0)) {
         opt_number_error(value);
         errno = oerrno;
         return 0;
@@ -729,7 +743,7 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
         if (!X509_VERIFY_PARAM_add0_policy(vpm, otmp)) {
             ASN1_OBJECT_free(otmp);
             opt_printf_stderr("%s: Internal error adding Policy %s\n",
-                              prog, opt_arg());
+                prog, opt_arg());
             return 0;
         }
         break;
@@ -749,7 +763,7 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
 
         if (!X509_VERIFY_PARAM_set_purpose(vpm, i)) {
             opt_printf_stderr("%s: Internal error setting purpose %s\n",
-                              prog, opt_arg());
+                prog, opt_arg());
             return 0;
         }
         break;
@@ -757,7 +771,7 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
         vtmp = X509_VERIFY_PARAM_lookup(opt_arg());
         if (vtmp == NULL) {
             opt_printf_stderr("%s: Invalid verify name %s\n",
-                              prog, opt_arg());
+                prog, opt_arg());
             return 0;
         }
         X509_VERIFY_PARAM_set1(vpm, vtmp);
@@ -777,7 +791,7 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
             return 0;
         if (t != (time_t)t) {
             opt_printf_stderr("%s: epoch time out of range %s\n",
-                              prog, opt_arg());
+                prog, opt_arg());
             return 0;
         }
         X509_VERIFY_PARAM_set_time(vpm, (time_t)t);
@@ -805,8 +819,7 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
         break;
     case OPT_V_CRL_CHECK_ALL:
         X509_VERIFY_PARAM_set_flags(vpm,
-                                    X509_V_FLAG_CRL_CHECK |
-                                    X509_V_FLAG_CRL_CHECK_ALL);
+            X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
         break;
     case OPT_V_POLICY_CHECK:
         X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_POLICY_CHECK);
@@ -861,7 +874,6 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm)
         break;
     }
     return 1;
-
 }
 
 void opt_begin(void)
@@ -911,14 +923,14 @@ int opt_next(void)
     for (o = opts; o->name; ++o) {
         /* If not this option, move on to the next one. */
         if (!(strcmp(p, "h") == 0 && strcmp(o->name, "help") == 0)
-                && strcmp(p, o->name) != 0)
+            && strcmp(p, o->name) != 0)
             continue;
 
         /* If it doesn't take a value, make sure none was given. */
         if (o->valtype == 0 || o->valtype == '-') {
             if (arg) {
                 opt_printf_stderr("%s: Option -%s does not take a value\n",
-                                  prog, p);
+                    prog, p);
                 return -1;
             }
             return o->retval;
@@ -928,7 +940,7 @@ int opt_next(void)
         if (arg == NULL) {
             if (argv[opt_index] == NULL) {
                 opt_printf_stderr("%s: Option -%s needs a value\n",
-                                  prog, o->name);
+                    prog, o->name);
                 return -1;
             }
             arg = argv[opt_index++];
@@ -962,12 +974,12 @@ int opt_next(void)
                 return -1;
             if (o->valtype == 'p' && ival <= 0) {
                 opt_printf_stderr("%s: Non-positive number \"%s\" for option -%s\n",
-                                  prog, arg, o->name);
+                    prog, arg, o->name);
                 return -1;
             }
             if (o->valtype == 'N' && ival < 0) {
                 opt_printf_stderr("%s: Negative number \"%s\" for option -%s\n",
-                                  prog, arg, o->name);
+                    prog, arg, o->name);
                 return -1;
             }
             break;
@@ -994,14 +1006,14 @@ int opt_next(void)
         case 'A':
         case 'a':
             if (opt_format(arg,
-                           o->valtype == 'c' ? OPT_FMT_PDS :
-                           o->valtype == 'E' ? OPT_FMT_PDE :
-                           o->valtype == 'F' ? OPT_FMT_PEMDER :
-                           o->valtype == 'A' ? OPT_FMT_ASN1 :
-                           OPT_FMT_ANY, &ival))
+                    o->valtype == 'c' ? OPT_FMT_PDS : o->valtype == 'E' ? OPT_FMT_PDE
+                        : o->valtype == 'F'                             ? OPT_FMT_PEMDER
+                        : o->valtype == 'A'                             ? OPT_FMT_ASN1
+                                                                        : OPT_FMT_ANY,
+                    &ival))
                 break;
             opt_printf_stderr("%s: Invalid format \"%s\" for option -%s\n",
-                              prog, arg, o->name);
+                prog, arg, o->name);
             return -1;
         }
 
@@ -1011,7 +1023,7 @@ int opt_next(void)
     if (unknown != NULL) {
         if (dunno != NULL) {
             opt_printf_stderr("%s: Multiple %s or unknown options: -%s and -%s\n",
-                              prog, unknown_name, dunno, p);
+                prog, unknown_name, dunno, p);
             return -1;
         }
         dunno = p;
@@ -1083,7 +1095,7 @@ int opt_check_rest_arg(const char *expected)
         opt_printf_stderr("%s: Extra option: \"%s\"\n", prog, opt);
     else
         opt_printf_stderr("%s: Extra (unknown) options: \"%s\" \"%s\"\n",
-                          prog, opt_unknown(), opt);
+            prog, opt_unknown(), opt);
     return 0;
 }
 
@@ -1130,7 +1142,7 @@ static const char *valtype2param(const OPTIONS *o)
 
 static void opt_print(const OPTIONS *o, int doingparams, int width)
 {
-    const char* help;
+    const char *help;
     char start[80 + 1];
     int linelen, printlen;
 
@@ -1168,11 +1180,11 @@ static void opt_print(const OPTIONS *o, int doingparams, int width)
     printlen = opt_printf_stderr(" %s", !doingparams ? "-" : "");
     linelen += (printlen > 0) ? printlen : MAX_OPT_HELP_WIDTH;
 
-    printlen = opt_printf_stderr("%s" , o->name[0] ? o->name : "*");
+    printlen = opt_printf_stderr("%s", o->name[0] ? o->name : "*");
     linelen += (printlen > 0) ? printlen : MAX_OPT_HELP_WIDTH;
 
     if (o->valtype != '-') {
-        printlen = opt_printf_stderr(" %s" , valtype2param(o));
+        printlen = opt_printf_stderr(" %s", valtype2param(o));
         linelen += (printlen > 0) ? printlen : MAX_OPT_HELP_WIDTH;
     }
 
@@ -1229,52 +1241,52 @@ void opt_help(const OPTIONS *list)
 
 /* opt_isdir section */
 #ifdef _WIN32
-# include <windows.h>
+#include <windows.h>
 int opt_isdir(const char *name)
 {
     DWORD attr;
-# if defined(UNICODE) || defined(_UNICODE)
+#if defined(UNICODE) || defined(_UNICODE)
     size_t i, len_0 = strlen(name) + 1;
     WCHAR tempname[MAX_PATH];
 
     if (len_0 > MAX_PATH)
         return -1;
 
-#  if !defined(_WIN32_WCE) || _WIN32_WCE>=101
+#if !defined(_WIN32_WCE) || _WIN32_WCE >= 101
     if (!MultiByteToWideChar(CP_ACP, 0, name, len_0, tempname, MAX_PATH))
-#  endif
+#endif
         for (i = 0; i < len_0; i++)
             tempname[i] = (WCHAR)name[i];
 
     attr = GetFileAttributes(tempname);
-# else
+#else
     attr = GetFileAttributes(name);
-# endif
+#endif
     if (attr == INVALID_FILE_ATTRIBUTES)
         return -1;
     return ((attr & FILE_ATTRIBUTE_DIRECTORY) != 0);
 }
 #else
-# include <sys/stat.h>
-# ifndef S_ISDIR
-#  if defined(_S_IFMT) && defined(_S_IFDIR)
-#   define S_ISDIR(a)   (((a) & _S_IFMT) == _S_IFDIR)
-#  else
-#   define S_ISDIR(a)   (((a) & S_IFMT) == S_IFDIR)
-#  endif
-# endif
+#include <sys/stat.h>
+#ifndef S_ISDIR
+#if defined(_S_IFMT) && defined(_S_IFDIR)
+#define S_ISDIR(a) (((a) & _S_IFMT) == _S_IFDIR)
+#else
+#define S_ISDIR(a) (((a) & S_IFMT) == S_IFDIR)
+#endif
+#endif
 
 int opt_isdir(const char *name)
 {
-# if defined(S_ISDIR)
+#if defined(S_ISDIR)
     struct stat st;
 
     if (stat(name, &st) == 0)
         return S_ISDIR(st.st_mode);
     else
         return -1;
-# else
+#else
     return -1;
-# endif
+#endif
 }
 #endif
diff --git a/crypto/openssl/apps/lib/s_cb.c b/crypto/openssl/apps/lib/s_cb.c
index 9641e369e621..80b5c6555424 100644
--- a/crypto/openssl/apps/lib/s_cb.c
+++ b/crypto/openssl/apps/lib/s_cb.c
@@ -23,11 +23,11 @@
 #include <openssl/ssl.h>
 #include <openssl/bn.h>
 #ifndef OPENSSL_NO_DH
-# include <openssl/dh.h>
+#include <openssl/dh.h>
 #endif
 #include "s_apps.h"
 
-#define COOKIE_SECRET_LENGTH    16
+#define COOKIE_SECRET_LENGTH 16
 
 VERIFY_CB_ARGS verify_args = { -1, 0, X509_V_OK, 0 };
 
@@ -37,9 +37,9 @@ static int cookie_initialized = 0;
 #endif
 static BIO *bio_keylog = NULL;
 
-static const char *lookup(int val, const STRINT_PAIR* list, const char* def)
+static const char *lookup(int val, const STRINT_PAIR *list, const char *def)
 {
-    for ( ; list->name; ++list)
+    for (; list->name; ++list)
         if (list->retval == val)
             return list->name;
     return def;
@@ -58,8 +58,8 @@ int verify_callback(int ok, X509_STORE_CTX *ctx)
         BIO_printf(bio_err, "depth=%d ", depth);
         if (err_cert != NULL) {
             X509_NAME_print_ex(bio_err,
-                               X509_get_subject_name(err_cert),
-                               0, get_nameopt());
+                X509_get_subject_name(err_cert),
+                0, get_nameopt());
             BIO_puts(bio_err, "\n");
         } else {
             BIO_puts(bio_err, "<no cert>\n");
@@ -67,7 +67,7 @@ int verify_callback(int ok, X509_STORE_CTX *ctx)
     }
     if (!ok) {
         BIO_printf(bio_err, "verify error:num=%d:%s\n", err,
-                   X509_verify_cert_error_string(err));
+            X509_verify_cert_error_string(err));
         if (verify_args.depth < 0 || verify_args.depth >= depth) {
             if (!verify_args.return_error)
                 ok = 1;
@@ -82,7 +82,7 @@ int verify_callback(int ok, X509_STORE_CTX *ctx)
         if (err_cert != NULL) {
             BIO_puts(bio_err, "issuer= ");
             X509_NAME_print_ex(bio_err, X509_get_issuer_name(err_cert),
-                               0, get_nameopt());
+                0, get_nameopt());
             BIO_puts(bio_err, "\n");
         }
         break;
@@ -118,9 +118,10 @@ int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file)
 {
     if (cert_file != NULL) {
         if (SSL_CTX_use_certificate_file(ctx, cert_file,
-                                         SSL_FILETYPE_PEM) <= 0) {
+                SSL_FILETYPE_PEM)
+            <= 0) {
             BIO_printf(bio_err, "unable to get certificate from '%s'\n",
-                       cert_file);
+                cert_file);
             ERR_print_errors(bio_err);
             return 0;
         }
@@ -128,7 +129,7 @@ int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file)
             key_file = cert_file;
         if (SSL_CTX_use_PrivateKey_file(ctx, key_file, SSL_FILETYPE_PEM) <= 0) {
             BIO_printf(bio_err, "unable to get private key from '%s'\n",
-                       key_file);
+                key_file);
             ERR_print_errors(bio_err);
             return 0;
         }
@@ -144,7 +145,7 @@ int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file)
          */
         if (!SSL_CTX_check_private_key(ctx)) {
             BIO_printf(bio_err,
-                       "Private key does not match the certificate public key\n");
+                "Private key does not match the certificate public key\n");
             return 0;
         }
     }
@@ -152,7 +153,7 @@ int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file)
 }
 
 int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key,
-                       STACK_OF(X509) *chain, int build_chain)
+    STACK_OF(X509) *chain, int build_chain)
 {
     int chflags = chain ? SSL_BUILD_CHAIN_FLAG_CHECK : 0;
 
@@ -175,7 +176,7 @@ int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key,
      */
     if (!SSL_CTX_check_private_key(ctx)) {
         BIO_printf(bio_err,
-                   "Private key does not match the certificate public key\n");
+            "Private key does not match the certificate public key\n");
         return 0;
     }
     if (chain && !SSL_CTX_set1_chain(ctx, chain)) {
@@ -192,16 +193,16 @@ int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key,
 }
 
 static STRINT_PAIR cert_type_list[] = {
-    {"RSA sign", TLS_CT_RSA_SIGN},
-    {"DSA sign", TLS_CT_DSS_SIGN},
-    {"RSA fixed DH", TLS_CT_RSA_FIXED_DH},
-    {"DSS fixed DH", TLS_CT_DSS_FIXED_DH},
-    {"ECDSA sign", TLS_CT_ECDSA_SIGN},
-    {"RSA fixed ECDH", TLS_CT_RSA_FIXED_ECDH},
-    {"ECDSA fixed ECDH", TLS_CT_ECDSA_FIXED_ECDH},
-    {"GOST01 Sign", TLS_CT_GOST01_SIGN},
-    {"GOST12 Sign", TLS_CT_GOST12_IANA_SIGN},
-    {NULL}
+    { "RSA sign", TLS_CT_RSA_SIGN },
+    { "DSA sign", TLS_CT_DSS_SIGN },
+    { "RSA fixed DH", TLS_CT_RSA_FIXED_DH },
+    { "DSS fixed DH", TLS_CT_DSS_FIXED_DH },
+    { "ECDSA sign", TLS_CT_ECDSA_SIGN },
+    { "RSA fixed ECDH", TLS_CT_RSA_FIXED_ECDH },
+    { "ECDSA fixed ECDH", TLS_CT_ECDSA_FIXED_ECDH },
+    { "GOST01 Sign", TLS_CT_GOST01_SIGN },
+    { "GOST12 Sign", TLS_CT_GOST12_IANA_SIGN },
+    { NULL }
 };
 
 static void ssl_print_client_cert_types(BIO *bio, SSL *s)
@@ -287,7 +288,7 @@ static int do_print_sigalgs(BIO *out, SSL *s, int shared)
         const char *sstr = NULL;
         if (shared)
             SSL_get_shared_sigalgs(s, i, &sign_nid, &hash_nid, NULL,
-                                   &rsign, &rhash);
+                &rsign, &rhash);
         else
             SSL_get_sigalgs(s, i, &sign_nid, &hash_nid, NULL, &rsign, &rhash);
         if (i)
@@ -373,7 +374,6 @@ int ssl_print_point_formats(BIO *out, SSL *s)
         default:
             BIO_printf(out, "unknown(%d)", (int)*pformats);
             break;
-
         }
     }
     BIO_puts(out, "\n");
@@ -425,7 +425,7 @@ int ssl_print_tmp_key(BIO *out, SSL *s)
     if (!SSL_get_peer_tmp_key(s, &key)) {
         if (SSL_version(s) == TLS1_3_VERSION)
             BIO_printf(out, "Negotiated TLS1.3 group: %s\n",
-                       SSL_group_to_name(s, SSL_get_negotiated_group(s)));
+                SSL_group_to_name(s, SSL_get_negotiated_group(s)));
         return 1;
     }
 
@@ -445,28 +445,26 @@ int ssl_print_tmp_key(BIO *out, SSL *s)
         BIO_printf(out, "DH, %d bits\n", EVP_PKEY_get_bits(key));
         break;
 #ifndef OPENSSL_NO_EC
-    case EVP_PKEY_EC:
-        {
-            char name[80];
-            size_t name_len;
+    case EVP_PKEY_EC: {
+        char name[80];
+        size_t name_len;
 
-            if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME,
-                                                name, sizeof(name), &name_len))
-                strcpy(name, "?");
-            BIO_printf(out, "ECDH, %s, %d bits\n", name, EVP_PKEY_get_bits(key));
-        }
-    break;
+        if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME,
+                name, sizeof(name), &name_len))
+            strcpy(name, "?");
+        BIO_printf(out, "ECDH, %s, %d bits\n", name, EVP_PKEY_get_bits(key));
+    } break;
 #endif
     default:
         BIO_printf(out, "%s, %d bits\n", OBJ_nid2sn(EVP_PKEY_get_id(key)),
-                   EVP_PKEY_get_bits(key));
+            EVP_PKEY_get_bits(key));
     }
     EVP_PKEY_free(key);
     return 1;
 }
 
 long bio_dump_callback(BIO *bio, int cmd, const char *argp, size_t len,
-                       int argi, long argl, int ret, size_t *processed)
+    int argi, long argl, int ret, size_t *processed)
 {
     BIO *out;
     BIO_MMSG_CB_ARGS *mmsgargs;
@@ -480,22 +478,22 @@ long bio_dump_callback(BIO *bio, int cmd, const char *argp, size_t len,
     case (BIO_CB_READ | BIO_CB_RETURN):
         if (ret > 0 && processed != NULL) {
             BIO_printf(out, "read from %p [%p] (%zu bytes => %zu (0x%zX))\n",
-                       (void *)bio, (void *)argp, len, *processed, *processed);
+                (void *)bio, (void *)argp, len, *processed, *processed);
             BIO_dump(out, argp, (int)*processed);
         } else {
             BIO_printf(out, "read from %p [%p] (%zu bytes => %d)\n",
-                       (void *)bio, (void *)argp, len, ret);
+                (void *)bio, (void *)argp, len, ret);
         }
         break;
 
     case (BIO_CB_WRITE | BIO_CB_RETURN):
         if (ret > 0 && processed != NULL) {
             BIO_printf(out, "write to %p [%p] (%zu bytes => %zu (0x%zX))\n",
-                       (void *)bio, (void *)argp, len, *processed, *processed);
+                (void *)bio, (void *)argp, len, *processed, *processed);
             BIO_dump(out, argp, (int)*processed);
         } else {
             BIO_printf(out, "write to %p [%p] (%zu bytes => %d)\n",
-                       (void *)bio, (void *)argp, len, ret);
+                (void *)bio, (void *)argp, len, ret);
         }
         break;
 
@@ -504,18 +502,18 @@ long bio_dump_callback(BIO *bio, int cmd, const char *argp, size_t len,
         if (ret > 0) {
             for (i = 0; i < *(mmsgargs->msgs_processed); i++) {
                 BIO_MSG *msg = (BIO_MSG *)((char *)mmsgargs->msg
-                                           + (i * mmsgargs->stride));
+                    + (i * mmsgargs->stride));
 
                 BIO_printf(out, "read from %p [%p] (%zu bytes => %zu (0x%zX))\n",
-                           (void *)bio, (void *)msg->data, msg->data_len,
-                           msg->data_len, msg->data_len);
+                    (void *)bio, (void *)msg->data, msg->data_len,
+                    msg->data_len, msg->data_len);
                 BIO_dump(out, msg->data, msg->data_len);
             }
         } else if (mmsgargs->num_msg > 0) {
             BIO_MSG *msg = mmsgargs->msg;
 
             BIO_printf(out, "read from %p [%p] (%zu bytes => %d)\n",
-                       (void *)bio, (void *)msg->data, msg->data_len, ret);
+                (void *)bio, (void *)msg->data, msg->data_len, ret);
         }
         break;
 
@@ -524,18 +522,18 @@ long bio_dump_callback(BIO *bio, int cmd, const char *argp, size_t len,
         if (ret > 0) {
             for (i = 0; i < *(mmsgargs->msgs_processed); i++) {
                 BIO_MSG *msg = (BIO_MSG *)((char *)mmsgargs->msg
-                                           + (i * mmsgargs->stride));
+                    + (i * mmsgargs->stride));
 
                 BIO_printf(out, "write to %p [%p] (%zu bytes => %zu (0x%zX))\n",
-                           (void *)bio, (void *)msg->data, msg->data_len,
-                           msg->data_len, msg->data_len);
+                    (void *)bio, (void *)msg->data, msg->data_len,
+                    msg->data_len, msg->data_len);
                 BIO_dump(out, msg->data, msg->data_len);
             }
         } else if (mmsgargs->num_msg > 0) {
             BIO_MSG *msg = mmsgargs->msg;
 
             BIO_printf(out, "write to %p [%p] (%zu bytes => %d)\n",
-                       (void *)bio, (void *)msg->data, msg->data_len, ret);
+                (void *)bio, (void *)msg->data, msg->data_len, ret);
         }
         break;
 
@@ -565,109 +563,104 @@ void apps_ssl_info_callback(const SSL *s, int where, int ret)
     } else if (where & SSL_CB_ALERT) {
         str = (where & SSL_CB_READ) ? "read" : "write";
         BIO_printf(bio_err, "SSL3 alert %s:%s:%s\n",
-                   str,
-                   SSL_alert_type_string_long(ret),
-                   SSL_alert_desc_string_long(ret));
+            str,
+            SSL_alert_type_string_long(ret),
+            SSL_alert_desc_string_long(ret));
     } else if (where & SSL_CB_EXIT) {
         if (ret == 0)
             BIO_printf(bio_err, "%s:failed in %s\n",
-                       str, SSL_state_string_long(s));
+                str, SSL_state_string_long(s));
         else if (ret < 0)
             BIO_printf(bio_err, "%s:error in %s\n",
-                       str, SSL_state_string_long(s));
+                str, SSL_state_string_long(s));
     }
 }
 
 static STRINT_PAIR ssl_versions[] = {
-    {"SSL 3.0", SSL3_VERSION},
-    {"TLS 1.0", TLS1_VERSION},
-    {"TLS 1.1", TLS1_1_VERSION},
-    {"TLS 1.2", TLS1_2_VERSION},
-    {"TLS 1.3", TLS1_3_VERSION},
-    {"DTLS 1.0", DTLS1_VERSION},
-    {"DTLS 1.0 (bad)", DTLS1_BAD_VER},
-    {NULL}
+    { "SSL 3.0", SSL3_VERSION },
+    { "TLS 1.0", TLS1_VERSION },
+    { "TLS 1.1", TLS1_1_VERSION },
+    { "TLS 1.2", TLS1_2_VERSION },
+    { "TLS 1.3", TLS1_3_VERSION },
+    { "DTLS 1.0", DTLS1_VERSION },
+    { "DTLS 1.0 (bad)", DTLS1_BAD_VER },
+    { NULL }
 };
 
 static STRINT_PAIR alert_types[] = {
-    {" close_notify", 0},
-    {" end_of_early_data", 1},
-    {" unexpected_message", 10},
-    {" bad_record_mac", 20},
-    {" decryption_failed", 21},
-    {" record_overflow", 22},
-    {" decompression_failure", 30},
-    {" handshake_failure", 40},
-    {" bad_certificate", 42},
-    {" unsupported_certificate", 43},
-    {" certificate_revoked", 44},
-    {" certificate_expired", 45},
-    {" certificate_unknown", 46},
-    {" illegal_parameter", 47},
-    {" unknown_ca", 48},
-    {" access_denied", 49},
-    {" decode_error", 50},
-    {" decrypt_error", 51},
-    {" export_restriction", 60},
-    {" protocol_version", 70},
-    {" insufficient_security", 71},
-    {" internal_error", 80},
-    {" inappropriate_fallback", 86},
-    {" user_canceled", 90},
-    {" no_renegotiation", 100},
-    {" missing_extension", 109},
-    {" unsupported_extension", 110},
-    {" certificate_unobtainable", 111},
-    {" unrecognized_name", 112},
-    {" bad_certificate_status_response", 113},
-    {" bad_certificate_hash_value", 114},
-    {" unknown_psk_identity", 115},
-    {" certificate_required", 116},
-    {NULL}
+    { " close_notify", 0 },
+    { " end_of_early_data", 1 },
+    { " unexpected_message", 10 },
+    { " bad_record_mac", 20 },
+    { " decryption_failed", 21 },
+    { " record_overflow", 22 },
+    { " decompression_failure", 30 },
+    { " handshake_failure", 40 },
+    { " bad_certificate", 42 },
+    { " unsupported_certificate", 43 },
+    { " certificate_revoked", 44 },
+    { " certificate_expired", 45 },
+    { " certificate_unknown", 46 },
+    { " illegal_parameter", 47 },
+    { " unknown_ca", 48 },
+    { " access_denied", 49 },
+    { " decode_error", 50 },
+    { " decrypt_error", 51 },
+    { " export_restriction", 60 },
+    { " protocol_version", 70 },
+    { " insufficient_security", 71 },
+    { " internal_error", 80 },
+    { " inappropriate_fallback", 86 },
+    { " user_canceled", 90 },
+    { " no_renegotiation", 100 },
+    { " missing_extension", 109 },
+    { " unsupported_extension", 110 },
+    { " certificate_unobtainable", 111 },
+    { " unrecognized_name", 112 },
+    { " bad_certificate_status_response", 113 },
+    { " bad_certificate_hash_value", 114 },
+    { " unknown_psk_identity", 115 },
+    { " certificate_required", 116 },
+    { NULL }
 };
 
 static STRINT_PAIR handshakes[] = {
-    {", HelloRequest", SSL3_MT_HELLO_REQUEST},
-    {", ClientHello", SSL3_MT_CLIENT_HELLO},
-    {", ServerHello", SSL3_MT_SERVER_HELLO},
-    {", HelloVerifyRequest", DTLS1_MT_HELLO_VERIFY_REQUEST},
-    {", NewSessionTicket", SSL3_MT_NEWSESSION_TICKET},
-    {", EndOfEarlyData", SSL3_MT_END_OF_EARLY_DATA},
-    {", EncryptedExtensions", SSL3_MT_ENCRYPTED_EXTENSIONS},
-    {", Certificate", SSL3_MT_CERTIFICATE},
-    {", ServerKeyExchange", SSL3_MT_SERVER_KEY_EXCHANGE},
-    {", CertificateRequest", SSL3_MT_CERTIFICATE_REQUEST},
-    {", ServerHelloDone", SSL3_MT_SERVER_DONE},
-    {", CertificateVerify", SSL3_MT_CERTIFICATE_VERIFY},
-    {", ClientKeyExchange", SSL3_MT_CLIENT_KEY_EXCHANGE},
-    {", Finished", SSL3_MT_FINISHED},
-    {", CertificateUrl", SSL3_MT_CERTIFICATE_URL},
-    {", CertificateStatus", SSL3_MT_CERTIFICATE_STATUS},
-    {", SupplementalData", SSL3_MT_SUPPLEMENTAL_DATA},
-    {", KeyUpdate", SSL3_MT_KEY_UPDATE},
-    {", CompressedCertificate", SSL3_MT_COMPRESSED_CERTIFICATE},
+    { ", HelloRequest", SSL3_MT_HELLO_REQUEST },
+    { ", ClientHello", SSL3_MT_CLIENT_HELLO },
+    { ", ServerHello", SSL3_MT_SERVER_HELLO },
+    { ", HelloVerifyRequest", DTLS1_MT_HELLO_VERIFY_REQUEST },
+    { ", NewSessionTicket", SSL3_MT_NEWSESSION_TICKET },
+    { ", EndOfEarlyData", SSL3_MT_END_OF_EARLY_DATA },
+    { ", EncryptedExtensions", SSL3_MT_ENCRYPTED_EXTENSIONS },
+    { ", Certificate", SSL3_MT_CERTIFICATE },
+    { ", ServerKeyExchange", SSL3_MT_SERVER_KEY_EXCHANGE },
+    { ", CertificateRequest", SSL3_MT_CERTIFICATE_REQUEST },
+    { ", ServerHelloDone", SSL3_MT_SERVER_DONE },
+    { ", CertificateVerify", SSL3_MT_CERTIFICATE_VERIFY },
+    { ", ClientKeyExchange", SSL3_MT_CLIENT_KEY_EXCHANGE },
+    { ", Finished", SSL3_MT_FINISHED },
+    { ", CertificateUrl", SSL3_MT_CERTIFICATE_URL },
+    { ", CertificateStatus", SSL3_MT_CERTIFICATE_STATUS },
+    { ", SupplementalData", SSL3_MT_SUPPLEMENTAL_DATA },
+    { ", KeyUpdate", SSL3_MT_KEY_UPDATE },
+    { ", CompressedCertificate", SSL3_MT_COMPRESSED_CERTIFICATE },
 #ifndef OPENSSL_NO_NEXTPROTONEG
-    {", NextProto", SSL3_MT_NEXT_PROTO},
+    { ", NextProto", SSL3_MT_NEXT_PROTO },
 #endif
-    {", MessageHash", SSL3_MT_MESSAGE_HASH},
-    {NULL}
+    { ", MessageHash", SSL3_MT_MESSAGE_HASH },
+    { NULL }
 };
 
 void msg_cb(int write_p, int version, int content_type, const void *buf,
-            size_t len, SSL *ssl, void *arg)
+    size_t len, SSL *ssl, void *arg)
 {
     BIO *bio = arg;
     const char *str_write_p = write_p ? ">>>" : "<<<";
     char tmpbuf[128];
     const char *str_version, *str_content_type = "", *str_details1 = "", *str_details2 = "";
-    const unsigned char* bp = buf;
+    const unsigned char *bp = buf;
 
-    if (version == SSL3_VERSION ||
-        version == TLS1_VERSION ||
-        version == TLS1_1_VERSION ||
-        version == TLS1_2_VERSION ||
-        version == TLS1_3_VERSION ||
-        version == DTLS1_VERSION || version == DTLS1_BAD_VER) {
+    if (version == SSL3_VERSION || version == TLS1_VERSION || version == TLS1_1_VERSION || version == TLS1_2_VERSION || version == TLS1_3_VERSION || version == DTLS1_VERSION || version == DTLS1_BAD_VER) {
         str_version = lookup(version, ssl_versions, "???");
         switch (content_type) {
         case SSL3_RT_CHANGE_CIPHER_SPEC:
@@ -710,17 +703,17 @@ void msg_cb(int write_p, int version, int content_type, const void *buf,
             str_content_type = ", InnerContent";
             break;
         default:
-            BIO_snprintf(tmpbuf, sizeof(tmpbuf)-1, ", Unknown (content_type=%d)", content_type);
+            BIO_snprintf(tmpbuf, sizeof(tmpbuf) - 1, ", Unknown (content_type=%d)", content_type);
             str_content_type = tmpbuf;
         }
     } else {
-        BIO_snprintf(tmpbuf, sizeof(tmpbuf)-1, "Not TLS data or unknown version (version=%d, content_type=%d)", version, content_type);
+        BIO_snprintf(tmpbuf, sizeof(tmpbuf) - 1, "Not TLS data or unknown version (version=%d, content_type=%d)", version, content_type);
         str_version = tmpbuf;
     }
 
     BIO_printf(bio, "%s %s%s [length %04lx]%s%s\n", str_write_p, str_version,
-               str_content_type, (unsigned long)len, str_details1,
-               str_details2);
+        str_content_type, (unsigned long)len, str_details1,
+        str_details2);
 
     if (len > 0) {
         size_t num, i;
@@ -740,113 +733,113 @@ void msg_cb(int write_p, int version, int content_type, const void *buf,
 }
 
 static const STRINT_PAIR tlsext_types[] = {
-    {"server name", TLSEXT_TYPE_server_name},
-    {"max fragment length", TLSEXT_TYPE_max_fragment_length},
-    {"client certificate URL", TLSEXT_TYPE_client_certificate_url},
-    {"trusted CA keys", TLSEXT_TYPE_trusted_ca_keys},
-    {"truncated HMAC", TLSEXT_TYPE_truncated_hmac},
-    {"status request", TLSEXT_TYPE_status_request},
-    {"user mapping", TLSEXT_TYPE_user_mapping},
-    {"client authz", TLSEXT_TYPE_client_authz},
-    {"server authz", TLSEXT_TYPE_server_authz},
-    {"cert type", TLSEXT_TYPE_cert_type},
-    {"supported_groups", TLSEXT_TYPE_supported_groups},
-    {"EC point formats", TLSEXT_TYPE_ec_point_formats},
-    {"SRP", TLSEXT_TYPE_srp},
-    {"signature algorithms", TLSEXT_TYPE_signature_algorithms},
-    {"use SRTP", TLSEXT_TYPE_use_srtp},
-    {"session ticket", TLSEXT_TYPE_session_ticket},
-    {"renegotiation info", TLSEXT_TYPE_renegotiate},
-    {"signed certificate timestamps", TLSEXT_TYPE_signed_certificate_timestamp},
-    {"client cert type", TLSEXT_TYPE_client_cert_type},
-    {"server cert type", TLSEXT_TYPE_server_cert_type},
-    {"TLS padding", TLSEXT_TYPE_padding},
+    { "server name", TLSEXT_TYPE_server_name },
+    { "max fragment length", TLSEXT_TYPE_max_fragment_length },
+    { "client certificate URL", TLSEXT_TYPE_client_certificate_url },
+    { "trusted CA keys", TLSEXT_TYPE_trusted_ca_keys },
+    { "truncated HMAC", TLSEXT_TYPE_truncated_hmac },
+    { "status request", TLSEXT_TYPE_status_request },
+    { "user mapping", TLSEXT_TYPE_user_mapping },
+    { "client authz", TLSEXT_TYPE_client_authz },
+    { "server authz", TLSEXT_TYPE_server_authz },
+    { "cert type", TLSEXT_TYPE_cert_type },
+    { "supported_groups", TLSEXT_TYPE_supported_groups },
+    { "EC point formats", TLSEXT_TYPE_ec_point_formats },
+    { "SRP", TLSEXT_TYPE_srp },
+    { "signature algorithms", TLSEXT_TYPE_signature_algorithms },
+    { "use SRTP", TLSEXT_TYPE_use_srtp },
+    { "session ticket", TLSEXT_TYPE_session_ticket },
+    { "renegotiation info", TLSEXT_TYPE_renegotiate },
+    { "signed certificate timestamps", TLSEXT_TYPE_signed_certificate_timestamp },
+    { "client cert type", TLSEXT_TYPE_client_cert_type },
+    { "server cert type", TLSEXT_TYPE_server_cert_type },
+    { "TLS padding", TLSEXT_TYPE_padding },
 #ifdef TLSEXT_TYPE_next_proto_neg
-    {"next protocol", TLSEXT_TYPE_next_proto_neg},
+    { "next protocol", TLSEXT_TYPE_next_proto_neg },
 #endif
 #ifdef TLSEXT_TYPE_encrypt_then_mac
-    {"encrypt-then-mac", TLSEXT_TYPE_encrypt_then_mac},
+    { "encrypt-then-mac", TLSEXT_TYPE_encrypt_then_mac },
 #endif
 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
-    {"application layer protocol negotiation",
-     TLSEXT_TYPE_application_layer_protocol_negotiation},
+    { "application layer protocol negotiation",
+        TLSEXT_TYPE_application_layer_protocol_negotiation },
 #endif
 #ifdef TLSEXT_TYPE_extended_master_secret
-    {"extended master secret", TLSEXT_TYPE_extended_master_secret},
+    { "extended master secret", TLSEXT_TYPE_extended_master_secret },
 #endif
-    {"compress certificate", TLSEXT_TYPE_compress_certificate},
-    {"key share", TLSEXT_TYPE_key_share},
-    {"supported versions", TLSEXT_TYPE_supported_versions},
-    {"psk", TLSEXT_TYPE_psk},
-    {"psk kex modes", TLSEXT_TYPE_psk_kex_modes},
-    {"certificate authorities", TLSEXT_TYPE_certificate_authorities},
-    {"post handshake auth", TLSEXT_TYPE_post_handshake_auth},
-    {"early_data", TLSEXT_TYPE_early_data},
-    {NULL}
+    { "compress certificate", TLSEXT_TYPE_compress_certificate },
+    { "key share", TLSEXT_TYPE_key_share },
+    { "supported versions", TLSEXT_TYPE_supported_versions },
+    { "psk", TLSEXT_TYPE_psk },
+    { "psk kex modes", TLSEXT_TYPE_psk_kex_modes },
+    { "certificate authorities", TLSEXT_TYPE_certificate_authorities },
+    { "post handshake auth", TLSEXT_TYPE_post_handshake_auth },
+    { "early_data", TLSEXT_TYPE_early_data },
+    { NULL }
 };
 
 /* from rfc8446 4.2.3. + gost (https://tools.ietf.org/id/draft-smyshlyaev-tls12-gost-suites-04.html) */
 static STRINT_PAIR signature_tls13_scheme_list[] = {
-    {"rsa_pkcs1_sha1",         0x0201 /* TLSEXT_SIGALG_rsa_pkcs1_sha1 */},
-    {"ecdsa_sha1",             0x0203 /* TLSEXT_SIGALG_ecdsa_sha1 */},
-/*  {"rsa_pkcs1_sha224",       0x0301    TLSEXT_SIGALG_rsa_pkcs1_sha224}, not in rfc8446 */
-/*  {"ecdsa_sha224",           0x0303    TLSEXT_SIGALG_ecdsa_sha224}      not in rfc8446 */
-    {"rsa_pkcs1_sha256",       0x0401 /* TLSEXT_SIGALG_rsa_pkcs1_sha256 */},
-    {"ecdsa_secp256r1_sha256", 0x0403 /* TLSEXT_SIGALG_ecdsa_secp256r1_sha256 */},
-    {"rsa_pkcs1_sha384",       0x0501 /* TLSEXT_SIGALG_rsa_pkcs1_sha384 */},
-    {"ecdsa_secp384r1_sha384", 0x0503 /* TLSEXT_SIGALG_ecdsa_secp384r1_sha384 */},
-    {"rsa_pkcs1_sha512",       0x0601 /* TLSEXT_SIGALG_rsa_pkcs1_sha512 */},
-    {"ecdsa_secp521r1_sha512", 0x0603 /* TLSEXT_SIGALG_ecdsa_secp521r1_sha512 */},
-    {"rsa_pss_rsae_sha256",    0x0804 /* TLSEXT_SIGALG_rsa_pss_rsae_sha256 */},
-    {"rsa_pss_rsae_sha384",    0x0805 /* TLSEXT_SIGALG_rsa_pss_rsae_sha384 */},
-    {"rsa_pss_rsae_sha512",    0x0806 /* TLSEXT_SIGALG_rsa_pss_rsae_sha512 */},
-    {"ed25519",                0x0807 /* TLSEXT_SIGALG_ed25519 */},
-    {"ed448",                  0x0808 /* TLSEXT_SIGALG_ed448 */},
-    {"rsa_pss_pss_sha256",     0x0809 /* TLSEXT_SIGALG_rsa_pss_pss_sha256 */},
-    {"rsa_pss_pss_sha384",     0x080a /* TLSEXT_SIGALG_rsa_pss_pss_sha384 */},
-    {"rsa_pss_pss_sha512",     0x080b /* TLSEXT_SIGALG_rsa_pss_pss_sha512 */},
-    {"gostr34102001",          0xeded /* TLSEXT_SIGALG_gostr34102001_gostr3411 */},
-    {"gostr34102012_256",      0xeeee /* TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256 */},
-    {"gostr34102012_512",      0xefef /* TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512 */},
-    {NULL}
+    { "rsa_pkcs1_sha1", 0x0201 /* TLSEXT_SIGALG_rsa_pkcs1_sha1 */ },
+    { "ecdsa_sha1", 0x0203 /* TLSEXT_SIGALG_ecdsa_sha1 */ },
+    /*  {"rsa_pkcs1_sha224",       0x0301    TLSEXT_SIGALG_rsa_pkcs1_sha224}, not in rfc8446 */
+    /*  {"ecdsa_sha224",           0x0303    TLSEXT_SIGALG_ecdsa_sha224}      not in rfc8446 */
+    { "rsa_pkcs1_sha256", 0x0401 /* TLSEXT_SIGALG_rsa_pkcs1_sha256 */ },
+    { "ecdsa_secp256r1_sha256", 0x0403 /* TLSEXT_SIGALG_ecdsa_secp256r1_sha256 */ },
+    { "rsa_pkcs1_sha384", 0x0501 /* TLSEXT_SIGALG_rsa_pkcs1_sha384 */ },
+    { "ecdsa_secp384r1_sha384", 0x0503 /* TLSEXT_SIGALG_ecdsa_secp384r1_sha384 */ },
+    { "rsa_pkcs1_sha512", 0x0601 /* TLSEXT_SIGALG_rsa_pkcs1_sha512 */ },
+    { "ecdsa_secp521r1_sha512", 0x0603 /* TLSEXT_SIGALG_ecdsa_secp521r1_sha512 */ },
+    { "rsa_pss_rsae_sha256", 0x0804 /* TLSEXT_SIGALG_rsa_pss_rsae_sha256 */ },
+    { "rsa_pss_rsae_sha384", 0x0805 /* TLSEXT_SIGALG_rsa_pss_rsae_sha384 */ },
+    { "rsa_pss_rsae_sha512", 0x0806 /* TLSEXT_SIGALG_rsa_pss_rsae_sha512 */ },
+    { "ed25519", 0x0807 /* TLSEXT_SIGALG_ed25519 */ },
+    { "ed448", 0x0808 /* TLSEXT_SIGALG_ed448 */ },
+    { "rsa_pss_pss_sha256", 0x0809 /* TLSEXT_SIGALG_rsa_pss_pss_sha256 */ },
+    { "rsa_pss_pss_sha384", 0x080a /* TLSEXT_SIGALG_rsa_pss_pss_sha384 */ },
+    { "rsa_pss_pss_sha512", 0x080b /* TLSEXT_SIGALG_rsa_pss_pss_sha512 */ },
+    { "gostr34102001", 0xeded /* TLSEXT_SIGALG_gostr34102001_gostr3411 */ },
+    { "gostr34102012_256", 0xeeee /* TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256 */ },
+    { "gostr34102012_512", 0xefef /* TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512 */ },
+    { NULL }
 };
 
 /* from rfc5246 7.4.1.4.1. */
 static STRINT_PAIR signature_tls12_alg_list[] = {
-    {"anonymous", TLSEXT_signature_anonymous /* 0 */},
-    {"RSA",       TLSEXT_signature_rsa       /* 1 */},
-    {"DSA",       TLSEXT_signature_dsa       /* 2 */},
-    {"ECDSA",     TLSEXT_signature_ecdsa     /* 3 */},
-    {NULL}
+    { "anonymous", TLSEXT_signature_anonymous /* 0 */ },
+    { "RSA", TLSEXT_signature_rsa /* 1 */ },
+    { "DSA", TLSEXT_signature_dsa /* 2 */ },
+    { "ECDSA", TLSEXT_signature_ecdsa /* 3 */ },
+    { NULL }
 };
 
 /* from rfc5246 7.4.1.4.1. */
 static STRINT_PAIR signature_tls12_hash_list[] = {
-    {"none",   TLSEXT_hash_none   /* 0 */},
-    {"MD5",    TLSEXT_hash_md5    /* 1 */},
-    {"SHA1",   TLSEXT_hash_sha1   /* 2 */},
-    {"SHA224", TLSEXT_hash_sha224 /* 3 */},
-    {"SHA256", TLSEXT_hash_sha256 /* 4 */},
-    {"SHA384", TLSEXT_hash_sha384 /* 5 */},
-    {"SHA512", TLSEXT_hash_sha512 /* 6 */},
-    {NULL}
+    { "none", TLSEXT_hash_none /* 0 */ },
+    { "MD5", TLSEXT_hash_md5 /* 1 */ },
+    { "SHA1", TLSEXT_hash_sha1 /* 2 */ },
+    { "SHA224", TLSEXT_hash_sha224 /* 3 */ },
+    { "SHA256", TLSEXT_hash_sha256 /* 4 */ },
+    { "SHA384", TLSEXT_hash_sha384 /* 5 */ },
+    { "SHA512", TLSEXT_hash_sha512 /* 6 */ },
+    { NULL }
 };
 
 void tlsext_cb(SSL *s, int client_server, int type,
-               const unsigned char *data, int len, void *arg)
+    const unsigned char *data, int len, void *arg)
 {
     BIO *bio = arg;
     const char *extname = lookup(type, tlsext_types, "unknown");
 
     BIO_printf(bio, "TLS %s extension \"%s\" (id=%d), len=%d\n",
-               client_server ? "server" : "client", extname, type, len);
+        client_server ? "server" : "client", extname, type, len);
     BIO_dump(bio, (const char *)data, len);
     (void)BIO_flush(bio);
 }
 
 #ifndef OPENSSL_NO_SOCK
 int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
-                                       size_t *cookie_len)
+    size_t *cookie_len)
 {
     unsigned char *buffer = NULL;
     size_t length = 0;
@@ -888,13 +881,15 @@ int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
     buffer = app_malloc(length, "cookie generate buffer");
 
     memcpy(buffer, &port, sizeof(port));
-    BIO_ADDR_rawaddress(peer, buffer + sizeof(port), NULL);
+    if (!BIO_ADDR_rawaddress(peer, buffer + sizeof(port), NULL))
+        goto end;
 
     if (EVP_Q_mac(NULL, "HMAC", NULL, "SHA1", NULL,
-                  cookie_secret, COOKIE_SECRET_LENGTH, buffer, length,
-                  cookie, DTLS1_COOKIE_LENGTH, cookie_len) == NULL) {
+            cookie_secret, COOKIE_SECRET_LENGTH, buffer, length,
+            cookie, DTLS1_COOKIE_LENGTH, cookie_len)
+        == NULL) {
         BIO_printf(bio_err,
-                   "Error calculating HMAC-SHA1 of buffer with secret\n");
+            "Error calculating HMAC-SHA1 of buffer with secret\n");
         goto end;
     }
     res = 1;
@@ -906,7 +901,7 @@ end:
 }
 
 int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie,
-                                     size_t cookie_len)
+    size_t cookie_len)
 {
     unsigned char result[EVP_MAX_MD_SIZE];
     size_t resultlength;
@@ -923,7 +918,7 @@ int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie,
 }
 
 int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
-                             unsigned int *cookie_len)
+    unsigned int *cookie_len)
 {
     size_t temp = 0;
     int res = generate_stateless_cookie_callback(ssl, cookie, &temp);
@@ -934,7 +929,7 @@ int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
 }
 
 int verify_cookie_callback(SSL *ssl, const unsigned char *cookie,
-                           unsigned int cookie_len)
+    unsigned int cookie_len)
 {
     return verify_stateless_cookie_callback(ssl, cookie, cookie_len);
 }
@@ -963,16 +958,16 @@ struct ssl_excert_st {
 };
 
 static STRINT_PAIR chain_flags[] = {
-    {"Overall Validity", CERT_PKEY_VALID},
-    {"Sign with EE key", CERT_PKEY_SIGN},
-    {"EE signature", CERT_PKEY_EE_SIGNATURE},
-    {"CA signature", CERT_PKEY_CA_SIGNATURE},
-    {"EE key parameters", CERT_PKEY_EE_PARAM},
-    {"CA key parameters", CERT_PKEY_CA_PARAM},
-    {"Explicitly sign with EE key", CERT_PKEY_EXPLICIT_SIGN},
-    {"Issuer Name", CERT_PKEY_ISSUER_NAME},
-    {"Certificate Type", CERT_PKEY_CERT_TYPE},
-    {NULL}
+    { "Overall Validity", CERT_PKEY_VALID },
+    { "Sign with EE key", CERT_PKEY_SIGN },
+    { "EE signature", CERT_PKEY_EE_SIGNATURE },
+    { "CA signature", CERT_PKEY_CA_SIGNATURE },
+    { "EE key parameters", CERT_PKEY_EE_PARAM },
+    { "CA key parameters", CERT_PKEY_CA_PARAM },
+    { "Explicitly sign with EE key", CERT_PKEY_EXPLICIT_SIGN },
+    { "Issuer Name", CERT_PKEY_ISSUER_NAME },
+    { "Certificate Type", CERT_PKEY_CERT_TYPE },
+    { NULL }
 };
 
 static void print_chain_flags(SSL *s, int flags)
@@ -981,8 +976,8 @@ static void print_chain_flags(SSL *s, int flags)
 
     for (pp = chain_flags; pp->name; ++pp)
         BIO_printf(bio_err, "\t%s: %s\n",
-                   pp->name,
-                   (flags & pp->retval) ? "OK" : "NOT OK");
+            pp->name,
+            (flags & pp->retval) ? "OK" : "NOT OK");
     BIO_printf(bio_err, "\tSuite B: ");
     if (SSL_set_cert_flags(s, 0) & SSL_CERT_FLAG_SUITEB_128_LOS)
         BIO_puts(bio_err, flags & CERT_PKEY_SUITEB ? "OK\n" : "NOT OK\n");
@@ -1004,8 +999,8 @@ static int set_cert_cb(SSL *ssl, void *arg)
     if (retry_cnt < 5) {
         retry_cnt++;
         BIO_printf(bio_err,
-                   "Certificate callback retry test: count %d\n",
-                   retry_cnt);
+            "Certificate callback retry test: count %d\n",
+            retry_cnt);
         return -1;
     }
 #endif
@@ -1028,12 +1023,12 @@ static int set_cert_cb(SSL *ssl, void *arg)
         rv = SSL_check_chain(ssl, exc->cert, exc->key, exc->chain);
         BIO_printf(bio_err, "Checking cert chain %d:\nSubject: ", i);
         X509_NAME_print_ex(bio_err, X509_get_subject_name(exc->cert), 0,
-                           get_nameopt());
+            get_nameopt());
         BIO_puts(bio_err, "\n");
         print_chain_flags(ssl, rv);
         if (rv & CERT_PKEY_VALID) {
             if (!SSL_use_certificate(ssl, exc->cert)
-                    || !SSL_use_PrivateKey(ssl, exc->key)) {
+                || !SSL_use_PrivateKey(ssl, exc->key)) {
                 return 0;
             }
             /*
@@ -1077,7 +1072,6 @@ static int ssl_excert_prepend(SSL_EXCERT **pexc)
         exc->keyform = FORMAT_PEM;
     }
     return 1;
-
 }
 
 void ssl_excert_free(SSL_EXCERT *exc)
@@ -1114,15 +1108,15 @@ int load_excert(SSL_EXCERT **pexc)
             return 0;
         }
         exc->cert = load_cert(exc->certfile, exc->certform,
-                              "Server Certificate");
+            "Server Certificate");
         if (exc->cert == NULL)
             return 0;
         if (exc->keyfile != NULL) {
             exc->key = load_key(exc->keyfile, exc->keyform,
-                                0, NULL, NULL, "server key");
+                0, NULL, NULL, "server key");
         } else {
             exc->key = load_key(exc->certfile, exc->certform,
-                                0, NULL, NULL, "server key");
+                0, NULL, NULL, "server key");
         }
         if (exc->key == NULL)
             return 0;
@@ -1146,7 +1140,7 @@ int args_excert(int opt, SSL_EXCERT **pexc)
     if (exc == NULL) {
         if (!ssl_excert_prepend(&exc)) {
             BIO_printf(bio_err, " %s: Error initialising xcert\n",
-                       opt_getprog());
+                opt_getprog());
             goto err;
         }
         *pexc = exc;
@@ -1174,7 +1168,7 @@ int args_excert(int opt, SSL_EXCERT **pexc)
     case OPT_X_CHAIN:
         if (exc->chainfile != NULL) {
             BIO_printf(bio_err, "%s: Chain already specified\n",
-                       opt_getprog());
+                opt_getprog());
             goto err;
         }
         exc->chainfile = opt_arg();
@@ -1193,7 +1187,7 @@ int args_excert(int opt, SSL_EXCERT **pexc)
     }
     return 1;
 
- err:
+err:
     ERR_print_errors(bio_err);
     ssl_excert_free(exc);
     *pexc = NULL;
@@ -1239,11 +1233,11 @@ static char *hexencode(const unsigned char *data, size_t len)
     char *out;
     char *cp;
     size_t outlen = 2 * len + 1;
-    int ilen = (int) outlen;
+    int ilen = (int)outlen;
 
     if (outlen < len || ilen < 0 || outlen != (size_t)ilen) {
         BIO_printf(bio_err, "%s: %zu-byte buffer too large to hexencode\n",
-                   opt_getprog(), len);
+            opt_getprog(), len);
         exit(1);
     }
     cp = out = app_malloc(ilen, "TLSA hex data buffer");
@@ -1295,12 +1289,13 @@ void print_verify_detail(SSL *s, BIO *bio)
         else
             hexdata = hexencode(data, dlen);
         BIO_printf(bio, "DANE TLSA %d %d %d %s%s ",
-                   usage, selector, mtype,
-                   (dlen > TLSA_TAIL_SIZE) ? "..." : "", hexdata);
+            usage, selector, mtype,
+            (dlen > TLSA_TAIL_SIZE) ? "..." : "", hexdata);
         if (SSL_get0_peer_rpk(s) == NULL)
             BIO_printf(bio, "%s certificate at depth %d\n",
-                       (mspki != NULL) ? "signed the peer" :
-                       mdpth ? "matched the TA" : "matched the EE", mdpth);
+                (mspki != NULL) ? "signed the peer" : mdpth ? "matched the TA"
+                                                            : "matched the EE",
+                mdpth);
         else
             BIO_printf(bio, "matched the peer raw public key\n");
         OPENSSL_free(hexdata);
@@ -1323,7 +1318,7 @@ void print_ssl_summary(SSL *s)
     if (peer != NULL) {
         BIO_puts(bio_err, "Peer certificate: ");
         X509_NAME_print_ex(bio_err, X509_get_subject_name(peer),
-                           0, get_nameopt());
+            0, get_nameopt());
         BIO_puts(bio_err, "\n");
         if (SSL_get_peer_signature_nid(s, &nid))
             BIO_printf(bio_err, "Hash used: %s\n", OBJ_nid2sn(nid));
@@ -1347,7 +1342,7 @@ void print_ssl_summary(SSL *s)
 }
 
 int config_ctx(SSL_CONF_CTX *cctx, STACK_OF(OPENSSL_STRING) *str,
-               SSL_CTX *ctx)
+    SSL_CTX *ctx)
 {
     int i;
 
@@ -1358,7 +1353,7 @@ int config_ctx(SSL_CONF_CTX *cctx, STACK_OF(OPENSSL_STRING) *str,
 
         if (SSL_CONF_cmd(cctx, flag, arg) <= 0) {
             BIO_printf(bio_err, "Call to SSL_CONF_cmd(%s, %s) failed\n",
-                       flag, arg == NULL ? "<NULL>" : arg);
+                flag, arg == NULL ? "<NULL>" : arg);
             ERR_print_errors(bio_err);
             return 0;
         }
@@ -1396,11 +1391,11 @@ int ssl_ctx_add_crls(SSL_CTX *ctx, STACK_OF(X509_CRL) *crls, int crl_download)
 }
 
 int ssl_load_stores(SSL_CTX *ctx,
-                    const char *vfyCApath, const char *vfyCAfile,
-                    const char *vfyCAstore,
-                    const char *chCApath, const char *chCAfile,
-                    const char *chCAstore,
-                    STACK_OF(X509_CRL) *crls, int crl_download)
+    const char *vfyCApath, const char *vfyCAfile,
+    const char *vfyCAstore,
+    const char *chCApath, const char *chCAfile,
+    const char *chCAstore,
+    STACK_OF(X509_CRL) *crls, int crl_download)
 {
     X509_STORE *vfy = NULL, *ch = NULL;
     int rv = 0;
@@ -1435,7 +1430,7 @@ int ssl_load_stores(SSL_CTX *ctx,
             goto err;
     }
     rv = 1;
- err:
+err:
     X509_STORE_free(vfy);
     X509_STORE_free(ch);
     return rv;
@@ -1446,38 +1441,38 @@ int ssl_load_stores(SSL_CTX *ctx,
 typedef struct {
     BIO *out;
     int verbose;
-    int (*old_cb) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid,
-                   void *other, void *ex);
+    int (*old_cb)(const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid,
+        void *other, void *ex);
 } security_debug_ex;
 
 static STRINT_PAIR callback_types[] = {
-    {"Supported Ciphersuite", SSL_SECOP_CIPHER_SUPPORTED},
-    {"Shared Ciphersuite", SSL_SECOP_CIPHER_SHARED},
-    {"Check Ciphersuite", SSL_SECOP_CIPHER_CHECK},
+    { "Supported Ciphersuite", SSL_SECOP_CIPHER_SUPPORTED },
+    { "Shared Ciphersuite", SSL_SECOP_CIPHER_SHARED },
+    { "Check Ciphersuite", SSL_SECOP_CIPHER_CHECK },
 #ifndef OPENSSL_NO_DH
-    {"Temp DH key bits", SSL_SECOP_TMP_DH},
+    { "Temp DH key bits", SSL_SECOP_TMP_DH },
 #endif
-    {"Supported Curve", SSL_SECOP_CURVE_SUPPORTED},
-    {"Shared Curve", SSL_SECOP_CURVE_SHARED},
-    {"Check Curve", SSL_SECOP_CURVE_CHECK},
-    {"Supported Signature Algorithm", SSL_SECOP_SIGALG_SUPPORTED},
-    {"Shared Signature Algorithm", SSL_SECOP_SIGALG_SHARED},
-    {"Check Signature Algorithm", SSL_SECOP_SIGALG_CHECK},
-    {"Signature Algorithm mask", SSL_SECOP_SIGALG_MASK},
-    {"Certificate chain EE key", SSL_SECOP_EE_KEY},
-    {"Certificate chain CA key", SSL_SECOP_CA_KEY},
-    {"Peer Chain EE key", SSL_SECOP_PEER_EE_KEY},
-    {"Peer Chain CA key", SSL_SECOP_PEER_CA_KEY},
-    {"Certificate chain CA digest", SSL_SECOP_CA_MD},
-    {"Peer chain CA digest", SSL_SECOP_PEER_CA_MD},
-    {"SSL compression", SSL_SECOP_COMPRESSION},
-    {"Session ticket", SSL_SECOP_TICKET},
-    {NULL}
+    { "Supported Curve", SSL_SECOP_CURVE_SUPPORTED },
+    { "Shared Curve", SSL_SECOP_CURVE_SHARED },
+    { "Check Curve", SSL_SECOP_CURVE_CHECK },
+    { "Supported Signature Algorithm", SSL_SECOP_SIGALG_SUPPORTED },
+    { "Shared Signature Algorithm", SSL_SECOP_SIGALG_SHARED },
+    { "Check Signature Algorithm", SSL_SECOP_SIGALG_CHECK },
+    { "Signature Algorithm mask", SSL_SECOP_SIGALG_MASK },
+    { "Certificate chain EE key", SSL_SECOP_EE_KEY },
+    { "Certificate chain CA key", SSL_SECOP_CA_KEY },
+    { "Peer Chain EE key", SSL_SECOP_PEER_EE_KEY },
+    { "Peer Chain CA key", SSL_SECOP_PEER_CA_KEY },
+    { "Certificate chain CA digest", SSL_SECOP_CA_MD },
+    { "Peer chain CA digest", SSL_SECOP_PEER_CA_MD },
+    { "SSL compression", SSL_SECOP_COMPRESSION },
+    { "Session ticket", SSL_SECOP_TICKET },
+    { NULL }
 };
 
 static int security_callback_debug(const SSL *s, const SSL_CTX *ctx,
-                                   int op, int bits, int nid,
-                                   void *other, void *ex)
+    int op, int bits, int nid,
+    void *other, void *ex)
 {
     security_debug_ex *sdb = ex;
     int rv, show_bits = 1, cert_md = 0;
@@ -1523,66 +1518,61 @@ static int security_callback_debug(const SSL *s, const SSL_CTX *ctx,
         break;
 
 #ifndef OPENSSL_NO_EC
-    case SSL_SECOP_OTHER_CURVE:
-        {
-            const char *cname;
-            cname = EC_curve_nid2nist(nid);
-            if (cname == NULL)
-                cname = OBJ_nid2sn(nid);
-            BIO_puts(sdb->out, cname);
-        }
-        break;
+    case SSL_SECOP_OTHER_CURVE: {
+        const char *cname;
+        cname = EC_curve_nid2nist(nid);
+        if (cname == NULL)
+            cname = OBJ_nid2sn(nid);
+        BIO_puts(sdb->out, cname);
+    } break;
 #endif
-    case SSL_SECOP_OTHER_CERT:
-        {
-            if (cert_md) {
-                int sig_nid = X509_get_signature_nid(other);
+    case SSL_SECOP_OTHER_CERT: {
+        if (cert_md) {
+            int sig_nid = X509_get_signature_nid(other);
 
-                BIO_puts(sdb->out, OBJ_nid2sn(sig_nid));
-            } else {
-                EVP_PKEY *pkey = X509_get0_pubkey(other);
+            BIO_puts(sdb->out, OBJ_nid2sn(sig_nid));
+        } else {
+            EVP_PKEY *pkey = X509_get0_pubkey(other);
 
-                if (pkey == NULL) {
-                    BIO_printf(sdb->out, "Public key missing");
-                } else {
-                    const char *algname = "";
+            if (pkey == NULL) {
+                BIO_printf(sdb->out, "Public key missing");
+            } else {
+                const char *algname = "";
 
-                    EVP_PKEY_asn1_get0_info(NULL, NULL, NULL, NULL,
-                                            &algname, EVP_PKEY_get0_asn1(pkey));
-                    BIO_printf(sdb->out, "%s, bits=%d",
-                            algname, EVP_PKEY_get_bits(pkey));
-                }
+                EVP_PKEY_asn1_get0_info(NULL, NULL, NULL, NULL,
+                    &algname, EVP_PKEY_get0_asn1(pkey));
+                BIO_printf(sdb->out, "%s, bits=%d",
+                    algname, EVP_PKEY_get_bits(pkey));
             }
-            break;
         }
-    case SSL_SECOP_OTHER_SIGALG:
-        {
-            const unsigned char *salg = other;
-            const char *sname = NULL;
-            int raw_sig_code = (salg[0] << 8) + salg[1]; /* always big endian (msb, lsb) */
-                /* raw_sig_code: signature_scheme from tls1.3, or signature_and_hash from tls1.2 */
+        break;
+    }
+    case SSL_SECOP_OTHER_SIGALG: {
+        const unsigned char *salg = other;
+        const char *sname = NULL;
+        int raw_sig_code = (salg[0] << 8) + salg[1]; /* always big endian (msb, lsb) */
+        /* raw_sig_code: signature_scheme from tls1.3, or signature_and_hash from tls1.2 */
 
-            if (nm != NULL)
-                BIO_printf(sdb->out, "%s", nm);
-            else
-                BIO_printf(sdb->out, "s_cb.c:security_callback_debug op=0x%x", op);
+        if (nm != NULL)
+            BIO_printf(sdb->out, "%s", nm);
+        else
+            BIO_printf(sdb->out, "s_cb.c:security_callback_debug op=0x%x", op);
 
-            sname = lookup(raw_sig_code, signature_tls13_scheme_list, NULL);
-            if (sname != NULL) {
-                BIO_printf(sdb->out, " scheme=%s", sname);
-            } else {
-                int alg_code = salg[1];
-                int hash_code = salg[0];
-                const char *alg_str = lookup(alg_code, signature_tls12_alg_list, NULL);
-                const char *hash_str = lookup(hash_code, signature_tls12_hash_list, NULL);
+        sname = lookup(raw_sig_code, signature_tls13_scheme_list, NULL);
+        if (sname != NULL) {
+            BIO_printf(sdb->out, " scheme=%s", sname);
+        } else {
+            int alg_code = salg[1];
+            int hash_code = salg[0];
+            const char *alg_str = lookup(alg_code, signature_tls12_alg_list, NULL);
+            const char *hash_str = lookup(hash_code, signature_tls12_hash_list, NULL);
 
-                if (alg_str != NULL && hash_str != NULL)
-                    BIO_printf(sdb->out, " digest=%s, algorithm=%s", hash_str, alg_str);
-                else
-                    BIO_printf(sdb->out, " scheme=unknown(0x%04x)", raw_sig_code);
-            }
+            if (alg_str != NULL && hash_str != NULL)
+                BIO_printf(sdb->out, " digest=%s, algorithm=%s", hash_str, alg_str);
+            else
+                BIO_printf(sdb->out, " scheme=unknown(0x%04x)", raw_sig_code);
         }
-
+    }
     }
 
     if (show_bits)
@@ -1642,7 +1632,7 @@ int set_keylog_file(SSL_CTX *ctx, const char *keylog_file)
     /* Write a header for seekable, empty files (this excludes pipes). */
     if (BIO_tell(bio_keylog) == 0) {
         BIO_puts(bio_keylog,
-                 "# SSL/TLS secrets log file, generated by OpenSSL\n");
+            "# SSL/TLS secrets log file, generated by OpenSSL\n");
         (void)BIO_flush(bio_keylog);
     }
     SSL_CTX_set_keylog_callback(ctx, keylog_callback);
@@ -1672,7 +1662,7 @@ void ssl_print_secure_renegotiation_notes(BIO *bio, SSL *s)
 {
     if (SSL_VERSION_ALLOWS_RENEGOTIATION(s)) {
         BIO_printf(bio, "Secure Renegotiation IS%s supported\n",
-                   SSL_get_secure_renegotiation_support(s) ? "" : " NOT");
+            SSL_get_secure_renegotiation_support(s) ? "" : " NOT");
     } else {
         BIO_printf(bio, "This TLS version forbids renegotiation.\n");
     }
diff --git a/crypto/openssl/apps/lib/s_socket.c b/crypto/openssl/apps/lib/s_socket.c
index b2a1e3e51a4b..6f9cf23f5e57 100644
--- a/crypto/openssl/apps/lib/s_socket.c
+++ b/crypto/openssl/apps/lib/s_socket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -22,28 +22,28 @@
  * needed to have fileno() declared correctly...  So let's define u_int
  */
 #if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT)
-# define __U_INT
+#define __U_INT
 typedef unsigned int u_int;
 #endif
 
 #ifdef _WIN32
-# include <process.h>
+#include <process.h>
 
 /* MSVC renamed some POSIX functions to have an underscore prefix. */
-# ifdef _MSC_VER
-#  define getpid _getpid
-# endif
+#ifdef _MSC_VER
+#define getpid _getpid
+#endif
 #endif
 
 #ifndef OPENSSL_NO_SOCK
 
-# include "internal/e_os.h"
-# include "apps.h"
-# include "s_apps.h"
-# include "internal/sockets.h" /* for openssl_fdset() */
+#include "internal/e_os.h"
+#include "apps.h"
+#include "s_apps.h"
+#include "internal/sockets.h" /* for openssl_fdset() */
 
-# include <openssl/bio.h>
-# include <openssl/err.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
 
 /* Keep track of our peer's address for the cookie callback */
 BIO_ADDR *ourpeer = NULL;
@@ -73,9 +73,9 @@ BIO_ADDR *ourpeer = NULL;
  * Returns 1 on success, 0 on failure.
  */
 int init_client(int *sock, const char *host, const char *port,
-                const char *bindhost, const char *bindport,
-                int family, int type, int protocol, int tfo, int doconn,
-                BIO_ADDR **ba_ret)
+    const char *bindhost, const char *bindport,
+    int family, int type, int protocol, int tfo, int doconn,
+    BIO_ADDR **ba_ret)
 {
     BIO_ADDRINFO *res = NULL;
     BIO_ADDRINFO *bindaddr = NULL;
@@ -89,7 +89,7 @@ int init_client(int *sock, const char *host, const char *port,
         return 0;
 
     ret = BIO_lookup_ex(host, port, BIO_LOOKUP_CLIENT, family, type, protocol,
-                        &res);
+        &res);
     if (ret == 0) {
         ERR_print_errors(bio_err);
         return 0;
@@ -97,9 +97,9 @@ int init_client(int *sock, const char *host, const char *port,
 
     if (bindhost != NULL || bindport != NULL) {
         ret = BIO_lookup_ex(bindhost, bindport, BIO_LOOKUP_CLIENT,
-                            family, type, protocol, &bindaddr);
+            family, type, protocol, &bindaddr);
         if (ret == 0) {
-            ERR_print_errors (bio_err);
+            ERR_print_errors(bio_err);
             goto out;
         }
     }
@@ -110,10 +110,10 @@ int init_client(int *sock, const char *host, const char *port,
          * anything in the BIO_ADDRINFO chain that we haven't
          * asked for. */
         OPENSSL_assert((family == AF_UNSPEC
-                        || family == BIO_ADDRINFO_family(ai))
-                       && (type == 0 || type == BIO_ADDRINFO_socktype(ai))
-                       && (protocol == 0
-                           || protocol == BIO_ADDRINFO_protocol(ai)));
+                           || family == BIO_ADDRINFO_family(ai))
+            && (type == 0 || type == BIO_ADDRINFO_socktype(ai))
+            && (protocol == 0
+                || protocol == BIO_ADDRINFO_protocol(ai)));
 
         if (bindaddr != NULL) {
             for (bi = bindaddr; bi != NULL; bi = BIO_ADDRINFO_next(bi)) {
@@ -126,7 +126,7 @@ int init_client(int *sock, const char *host, const char *port,
         }
 
         *sock = BIO_socket(BIO_ADDRINFO_family(ai), BIO_ADDRINFO_socktype(ai),
-                           BIO_ADDRINFO_protocol(ai), 0);
+            BIO_ADDRINFO_protocol(ai), 0);
         if (*sock == INVALID_SOCKET) {
             /* Maybe the kernel doesn't support the socket family, even if
              * BIO_lookup() added it in the returned result...
@@ -136,7 +136,7 @@ int init_client(int *sock, const char *host, const char *port,
 
         if (bi != NULL) {
             if (!BIO_bind(*sock, BIO_ADDRINFO_address(bi),
-                          BIO_SOCK_REUSEADDR)) {
+                    BIO_SOCK_REUSEADDR)) {
                 BIO_closesocket(*sock);
                 *sock = INVALID_SOCKET;
                 break;
@@ -154,8 +154,9 @@ int init_client(int *sock, const char *host, const char *port,
             BIO *tmpbio = BIO_new_dgram_sctp(*sock, BIO_NOCLOSE);
 
             if (tmpbio == NULL) {
-                ERR_print_errors(bio_err);
-                return 0;
+                BIO_closesocket(*sock);
+                *sock = INVALID_SOCKET;
+                continue;
             }
             BIO_free(tmpbio);
         }
@@ -192,13 +193,14 @@ int init_client(int *sock, const char *host, const char *port,
         if (bindaddr != NULL && !found) {
             BIO_printf(bio_err, "Can't bind %saddress for %s%s%s\n",
 #ifdef AF_INET6
-                       BIO_ADDRINFO_family(res) == AF_INET6 ? "IPv6 " :
+                BIO_ADDRINFO_family(res) == AF_INET6 ? "IPv6 " :
 #endif
-                       BIO_ADDRINFO_family(res) == AF_INET ? "IPv4 " :
-                       BIO_ADDRINFO_family(res) == AF_UNIX ? "unix " : "",
-                       bindhost != NULL ? bindhost : "",
-                       bindport != NULL ? ":" : "",
-                       bindport != NULL ? bindport : "");
+                    BIO_ADDRINFO_family(res) == AF_INET   ? "IPv4 "
+                    : BIO_ADDRINFO_family(res) == AF_UNIX ? "unix "
+                                                          : "",
+                bindhost != NULL ? bindhost : "",
+                bindport != NULL ? ":" : "",
+                bindport != NULL ? bindport : "");
             ERR_clear_error();
             ret = 0;
         }
@@ -217,7 +219,7 @@ int init_client(int *sock, const char *host, const char *port,
     }
 out:
     if (bindaddr != NULL) {
-        BIO_ADDRINFO_free (bindaddr);
+        BIO_ADDRINFO_free(bindaddr);
     }
     BIO_ADDRINFO_free(res);
     return ret;
@@ -233,7 +235,7 @@ void get_sock_info_address(int asock, char **hostname, char **service)
         *service = NULL;
 
     if ((info.addr = BIO_ADDR_new()) != NULL
-            && BIO_sock_info(asock, BIO_SOCK_INFO_ADDRESS, &info)) {
+        && BIO_sock_info(asock, BIO_SOCK_INFO_ADDRESS, &info)) {
         if (hostname != NULL)
             *hostname = BIO_ADDR_hostname_string(info.addr, 1);
         if (service != NULL)
@@ -255,10 +257,11 @@ int report_server_accept(BIO *out, int asock, int with_address, int with_pid)
         success = hostname != NULL && service != NULL;
         if (success)
             success = BIO_printf(out,
-                                 strchr(hostname, ':') == NULL
-                                 ? /* IPv4 */ " %s:%s"
-                                 : /* IPv6 */ " [%s]:%s",
-                                 hostname, service) > 0;
+                          strchr(hostname, ':') == NULL
+                              ? /* IPv4 */ " %s:%s"
+                              : /* IPv6 */ " [%s]:%s",
+                          hostname, service)
+                > 0;
         else
             (void)BIO_printf(out, "unknown:error\n");
         OPENSSL_free(hostname);
@@ -293,9 +296,9 @@ int report_server_accept(BIO *out, int asock, int with_address, int with_pid)
  * 0 on failure, something other on success.
  */
 int do_server(int *accept_sock, const char *host, const char *port,
-              int family, int type, int protocol, do_server_cb cb,
-              unsigned char *context, int naccept, BIO *bio_s_out,
-              int tfo)
+    int family, int type, int protocol, do_server_cb cb,
+    unsigned char *context, int naccept, BIO *bio_s_out,
+    int tfo)
 {
     int asock = 0;
     int sock;
@@ -313,7 +316,7 @@ int do_server(int *accept_sock, const char *host, const char *port,
         return 0;
 
     if (!BIO_lookup_ex(host, port, BIO_LOOKUP_SERVER, family, type, protocol,
-                       &res)) {
+            &res)) {
         ERR_print_errors(bio_err);
         return 0;
     }
@@ -321,8 +324,8 @@ int do_server(int *accept_sock, const char *host, const char *port,
     /* Admittedly, these checks are quite paranoid, we should not get
      * anything in the BIO_ADDRINFO chain that we haven't asked for */
     OPENSSL_assert((family == AF_UNSPEC || family == BIO_ADDRINFO_family(res))
-                   && (type == 0 || type == BIO_ADDRINFO_socktype(res))
-                   && (protocol == 0 || protocol == BIO_ADDRINFO_protocol(res)));
+        && (type == 0 || type == BIO_ADDRINFO_socktype(res))
+        && (protocol == 0 || protocol == BIO_ADDRINFO_protocol(res)));
 
     sock_family = BIO_ADDRINFO_family(res);
     sock_type = BIO_ADDRINFO_socktype(res);
@@ -335,10 +338,10 @@ int do_server(int *accept_sock, const char *host, const char *port,
     if (sock_family == AF_INET6)
         sock_options |= BIO_SOCK_V6_ONLY;
     if (next != NULL
-            && BIO_ADDRINFO_socktype(next) == sock_type
-            && BIO_ADDRINFO_protocol(next) == sock_protocol) {
+        && BIO_ADDRINFO_socktype(next) == sock_type
+        && BIO_ADDRINFO_protocol(next) == sock_protocol) {
         if (sock_family == AF_INET
-                && BIO_ADDRINFO_family(next) == AF_INET6) {
+            && BIO_ADDRINFO_family(next) == AF_INET6) {
             /* In case AF_INET6 is returned but not supported by the
              * kernel, retry with the first detected address family */
             sock_family_fallback = sock_family;
@@ -346,7 +349,7 @@ int do_server(int *accept_sock, const char *host, const char *port,
             sock_family = AF_INET6;
             sock_address = BIO_ADDRINFO_address(next);
         } else if (sock_family == AF_INET6
-                   && BIO_ADDRINFO_family(next) == AF_INET) {
+            && BIO_ADDRINFO_family(next) == AF_INET) {
             sock_options &= ~BIO_SOCK_V6_ONLY;
         }
     }
@@ -377,6 +380,7 @@ int do_server(int *accept_sock, const char *host, const char *port,
         BIO *tmpbio = BIO_new_dgram_sctp(asock, BIO_NOCLOSE);
 
         if (tmpbio == NULL) {
+            BIO_ADDRINFO_free(res);
             BIO_closesocket(asock);
             ERR_print_errors(bio_err);
             goto end;
@@ -422,8 +426,6 @@ int do_server(int *accept_sock, const char *host, const char *port,
 
             if (naccept != -1)
                 naccept--;
-            if (naccept == 0)
-                BIO_closesocket(asock);
 
             BIO_set_tcp_ndelay(sock, 1);
             i = (*cb)(sock, type, protocol, context);
@@ -446,12 +448,12 @@ int do_server(int *accept_sock, const char *host, const char *port,
              * alerts are passed on...]
              */
             timeout.tv_sec = 0;
-            timeout.tv_usec = 500000;  /* some extreme round-trip */
+            timeout.tv_usec = 500000; /* some extreme round-trip */
             do {
                 FD_ZERO(&readfds);
                 openssl_fdset(sock, &readfds);
             } while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0
-                     && readsocket(sock, sink, sizeof(sink)) > 0);
+                && readsocket(sock, sink, sizeof(sink)) > 0);
 
             BIO_closesocket(sock);
         } else {
@@ -463,15 +465,16 @@ int do_server(int *accept_sock, const char *host, const char *port,
 
         if (i < 0 || naccept == 0) {
             BIO_closesocket(asock);
+            asock = INVALID_SOCKET;
             ret = i;
             break;
         }
     }
- end:
-# ifdef AF_UNIX
+end:
+#ifdef AF_UNIX
     if (family == AF_UNIX)
         unlink(host);
-# endif
+#endif
     BIO_ADDR_free(ourpeer);
     ourpeer = NULL;
     return ret;
@@ -498,4 +501,4 @@ void do_ssl_shutdown(SSL *ssl)
     } while (ret < 0);
 }
 
-#endif  /* OPENSSL_NO_SOCK */
+#endif /* OPENSSL_NO_SOCK */
diff --git a/crypto/openssl/apps/lib/tlssrp_depr.c b/crypto/openssl/apps/lib/tlssrp_depr.c
index 413f1f3538ce..058f47b90f18 100644
--- a/crypto/openssl/apps/lib/tlssrp_depr.c
+++ b/crypto/openssl/apps/lib/tlssrp_depr.c
@@ -29,16 +29,11 @@ static int srp_Verify_N_and_g(const BIGNUM *N, const BIGNUM *g)
     BN_CTX *bn_ctx = BN_CTX_new();
     BIGNUM *p = BN_new();
     BIGNUM *r = BN_new();
-    int ret =
-        g != NULL && N != NULL && bn_ctx != NULL && BN_is_odd(N) &&
-        BN_check_prime(N, bn_ctx, NULL) == 1 &&
-        p != NULL && BN_rshift1(p, N) &&
+    int ret = g != NULL && N != NULL && bn_ctx != NULL && BN_is_odd(N) && BN_check_prime(N, bn_ctx, NULL) == 1 && p != NULL && BN_rshift1(p, N) &&
         /* p = (N-1)/2 */
-        BN_check_prime(p, bn_ctx, NULL) == 1 &&
-        r != NULL &&
+        BN_check_prime(p, bn_ctx, NULL) == 1 && r != NULL &&
         /* verify g^((N-1)/2) == -1 (mod N) */
-        BN_mod_exp(r, g, p, N, bn_ctx) &&
-        BN_add_word(r, 1) && BN_cmp(r, N) == 0;
+        BN_mod_exp(r, g, p, N, bn_ctx) && BN_add_word(r, 1) && BN_cmp(r, N) == 0;
 
     BN_free(r);
     BN_free(p);
@@ -84,7 +79,7 @@ static int ssl_srp_verify_param_cb(SSL *s, void *arg)
     if (srp_arg->amp == 1) {
         if (srp_arg->debug)
             BIO_printf(bio_err,
-                       "SRP param N and g are not known params, going to check deeper.\n");
+                "SRP param N and g are not known params, going to check deeper.\n");
 
         /*
          * The srp_moregroups is a real debugging feature. Implementers
@@ -120,7 +115,7 @@ static char *ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
 }
 
 int set_up_srp_arg(SSL_CTX *ctx, SRP_ARG *srp_arg, int srp_lateuser, int c_msg,
-                   int c_debug)
+    int c_debug)
 {
     if (!srp_lateuser && !SSL_CTX_set_srp_username(ctx, srp_arg->srplogin)) {
         BIO_printf(bio_err, "Unable to set SRP username\n");
@@ -144,7 +139,7 @@ static char *dummy_srp(SSL *ssl, void *arg)
 
 void set_up_dummy_srp(SSL_CTX *ctx)
 {
-        SSL_CTX_set_srp_client_pwd_callback(ctx, dummy_srp);
+    SSL_CTX_set_srp_client_pwd_callback(ctx, dummy_srp);
 }
 
 /*
@@ -157,7 +152,7 @@ void set_up_dummy_srp(SSL_CTX *ctx)
  */
 static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
 {
-    srpsrvparm *p = (srpsrvparm *) arg;
+    srpsrvparm *p = (srpsrvparm *)arg;
     int ret = SSL3_AL_FATAL;
 
     if (p->login == NULL && p->user == NULL) {
@@ -171,18 +166,18 @@ static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
         goto err;
     }
 
-    if (SSL_set_srp_server_param
-        (s, p->user->N, p->user->g, p->user->s, p->user->v,
-         p->user->info) < 0) {
+    if (SSL_set_srp_server_param(s, p->user->N, p->user->g, p->user->s, p->user->v,
+            p->user->info)
+        < 0) {
         *ad = SSL_AD_INTERNAL_ERROR;
         goto err;
     }
     BIO_printf(bio_err,
-               "SRP parameters set: username = \"%s\" info=\"%s\"\n",
-               p->login, p->user->info);
+        "SRP parameters set: username = \"%s\" info=\"%s\"\n",
+        p->login, p->user->info);
     ret = SSL_ERROR_NONE;
 
- err:
+err:
     SRP_user_pwd_free(p->user);
     p->user = NULL;
     p->login = NULL;
@@ -190,7 +185,7 @@ static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
 }
 
 int set_up_srp_verifier_file(SSL_CTX *ctx, srpsrvparm *srp_callback_parm,
-                             char *srpuserseed, char *srp_verifier_file)
+    char *srpuserseed, char *srp_verifier_file)
 {
     int ret;
 
@@ -202,12 +197,12 @@ int set_up_srp_verifier_file(SSL_CTX *ctx, srpsrvparm *srp_callback_parm,
         BIO_printf(bio_err, "Failed to initialize SRP verifier file\n");
         return 0;
     }
-    if ((ret =
-            SRP_VBASE_init(srp_callback_parm->vb,
-                           srp_verifier_file)) != SRP_NO_ERROR) {
+    if ((ret = SRP_VBASE_init(srp_callback_parm->vb,
+             srp_verifier_file))
+        != SRP_NO_ERROR) {
         BIO_printf(bio_err,
-                    "Cannot initialize SRP verifier file \"%s\":ret=%d\n",
-                    srp_verifier_file, ret);
+            "Cannot initialize SRP verifier file \"%s\":ret=%d\n",
+            srp_verifier_file, ret);
         return 0;
     }
     SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, verify_callback);
@@ -221,11 +216,11 @@ void lookup_srp_user(srpsrvparm *srp_callback_parm, BIO *bio_s_out)
 {
     SRP_user_pwd_free(srp_callback_parm->user);
     srp_callback_parm->user = SRP_VBASE_get1_by_user(srp_callback_parm->vb,
-                                                     srp_callback_parm->login);
+        srp_callback_parm->login);
 
     if (srp_callback_parm->user != NULL)
         BIO_printf(bio_s_out, "LOOKUP done %s\n",
-                    srp_callback_parm->user->info);
+            srp_callback_parm->user->info);
     else
         BIO_printf(bio_s_out, "LOOKUP not successful\n");
 }
diff --git a/crypto/openssl/apps/lib/vms_decc_argv.c b/crypto/openssl/apps/lib/vms_decc_argv.c
index 031e5afdeca0..5976bcc9e4e0 100644
--- a/crypto/openssl/apps/lib/vms_decc_argv.c
+++ b/crypto/openssl/apps/lib/vms_decc_argv.c
@@ -9,7 +9,7 @@
 
 #include <stdlib.h>
 #include <openssl/crypto.h>
-#include "platform.h"            /* for copy_argv() */
+#include "platform.h" /* for copy_argv() */
 
 char **newargv = NULL;
 
diff --git a/crypto/openssl/apps/lib/vms_term_sock.c b/crypto/openssl/apps/lib/vms_term_sock.c
index 219a978966c7..faceb05d0145 100644
--- a/crypto/openssl/apps/lib/vms_term_sock.c
+++ b/crypto/openssl/apps/lib/vms_term_sock.c
@@ -9,107 +9,122 @@
  */
 
 #ifdef __VMS
-# define OPENSSL_SYS_VMS
-# pragma message disable DOLLARID
+#define OPENSSL_SYS_VMS
+#pragma message disable DOLLARID
 
+#include <openssl/opensslconf.h>
 
-# include <openssl/opensslconf.h>
-
-# if !defined(_POSIX_C_SOURCE) && defined(OPENSSL_SYS_VMS)
+#if !defined(_POSIX_C_SOURCE) && defined(OPENSSL_SYS_VMS)
 /*
  * On VMS, you need to define this to get the declaration of fileno().  The
  * value 2 is to make sure no function defined in POSIX-2 is left undefined.
  */
-#  define _POSIX_C_SOURCE 2
-# endif
+#define _POSIX_C_SOURCE 2
+#endif
 
-# include <stdio.h>
+#include <stdio.h>
 
-# undef _POSIX_C_SOURCE
+#undef _POSIX_C_SOURCE
 
-# include <sys/types.h>
-# include <sys/socket.h>
-# include <netinet/in.h>
-# include <inet.h>
-# include <unistd.h>
-# include <string.h>
-# include <errno.h>
-# include <starlet.h>
-# include <iodef.h>
-# ifdef __alpha
-#  include <iosbdef.h>
-# else
-typedef struct _iosb {           /* Copied from IOSBDEF.H for Alpha  */
-#  pragma __nomember_alignment
-    __union  {
-        __struct  {
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <inet.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <starlet.h>
+#include <iodef.h>
+#ifdef __alpha
+#include <iosbdef.h>
+#else
+typedef struct _iosb { /* Copied from IOSBDEF.H for Alpha  */
+#pragma __nomember_alignment
+    __union
+    {
+        __struct
+        {
             unsigned short int iosb$w_status; /* Final I/O status           */
-            __union  {
-                __struct  {             /* 16-bit byte count variant        */
+            __union
+            {
+                __struct
+                { /* 16-bit byte count variant        */
                     unsigned short int iosb$w_bcnt; /* 16-bit byte count    */
-                    __union  {
+                    __union
+                    {
                         unsigned int iosb$l_dev_depend; /* 32-bit device dependent info */
                         unsigned int iosb$l_pid; /* 32-bit pid              */
-                    } iosb$r_l;
-                } iosb$r_bcnt_16;
-                __struct  {             /* 32-bit byte count variant        */
+                    }
+                    iosb$r_l;
+                }
+                iosb$r_bcnt_16;
+                __struct
+                { /* 32-bit byte count variant        */
                     unsigned int iosb$l_bcnt; /* 32-bit byte count (unaligned) */
                     unsigned short int iosb$w_dev_depend_high; /* 16-bit device dependent info */
-                } iosb$r_bcnt_32;
-            } iosb$r_devdepend;
-        } iosb$r_io_64;
-        __struct  {
-            __union  {
+                }
+                iosb$r_bcnt_32;
+            }
+            iosb$r_devdepend;
+        }
+        iosb$r_io_64;
+        __struct
+        {
+            __union
+            {
                 unsigned int iosb$l_getxxi_status; /* Final GETxxI status   */
                 unsigned int iosb$l_reg_status; /* Final $Registry status   */
-            } iosb$r_l_status;
+            }
+            iosb$r_l_status;
             unsigned int iosb$l_reserved; /* Reserved field                 */
-        } iosb$r_get_64;
-    } iosb$r_io_get;
+        }
+        iosb$r_get_64;
+    }
+    iosb$r_io_get;
 } IOSB;
 
-#  if !defined(__VAXC)
-#   define iosb$w_status iosb$r_io_get.iosb$r_io_64.iosb$w_status
-#   define iosb$w_bcnt iosb$r_io_get.iosb$r_io_64.iosb$r_devdepend.iosb$r_bcnt_16.iosb$w_bcnt
-#   define iosb$r_l        iosb$r_io_get.iosb$r_io_64.iosb$r_devdepend.iosb$r_bcnt_16.iosb$r_l
-#   define iosb$l_dev_depend iosb$r_l.iosb$l_dev_depend
-#   define iosb$l_pid iosb$r_l.iosb$l_pid
-#   define iosb$l_bcnt iosb$r_io_get.iosb$r_io_64.iosb$r_devdepend.iosb$r_bcnt_32.iosb$l_bcnt
-#   define iosb$w_dev_depend_high iosb$r_io_get.iosb$r_io_64.iosb$r_devdepend.iosb$r_bcnt_32.iosb$w_dev_depend_high
-#   define iosb$l_getxxi_status iosb$r_io_get.iosb$r_get_64.iosb$r_l_status.iosb$l_getxxi_status
-#   define iosb$l_reg_status iosb$r_io_get.iosb$r_get_64.iosb$r_l_status.iosb$l_reg_status
-#  endif          /* #if !defined(__VAXC) */
+#if !defined(__VAXC)
+#define iosb$w_status iosb$r_io_get.iosb$r_io_64.iosb$w_status
+#define iosb$w_bcnt iosb$r_io_get.iosb$r_io_64.iosb$r_devdepend.iosb$r_bcnt_16.iosb$w_bcnt
+#define iosb$r_l iosb$r_io_get.iosb$r_io_64.iosb$r_devdepend.iosb$r_bcnt_16.iosb$r_l
+#define iosb$l_dev_depend iosb$r_l.iosb$l_dev_depend
+#define iosb$l_pid iosb$r_l.iosb$l_pid
+#define iosb$l_bcnt iosb$r_io_get.iosb$r_io_64.iosb$r_devdepend.iosb$r_bcnt_32.iosb$l_bcnt
+#define iosb$w_dev_depend_high iosb$r_io_get.iosb$r_io_64.iosb$r_devdepend.iosb$r_bcnt_32.iosb$w_dev_depend_high
+#define iosb$l_getxxi_status iosb$r_io_get.iosb$r_get_64.iosb$r_l_status.iosb$l_getxxi_status
+#define iosb$l_reg_status iosb$r_io_get.iosb$r_get_64.iosb$r_l_status.iosb$l_reg_status
+#endif /* #if !defined(__VAXC) */
 
-# endif  /* End of IOSBDEF */
+#endif /* End of IOSBDEF */
 
-# include <efndef.h>
-# include <stdlib.h>
-# include <ssdef.h>
-# include <time.h>
-# include <stdarg.h>
-# include <descrip.h>
+#include <efndef.h>
+#include <stdlib.h>
+#include <ssdef.h>
+#include <time.h>
+#include <stdarg.h>
+#include <descrip.h>
 
-# include "vms_term_sock.h"
+#include "vms_term_sock.h"
 
-# ifdef __alpha
+#ifdef __alpha
 static struct _iosb TerminalDeviceIosb;
-# else
+#else
 IOSB TerminalDeviceIosb;
-# endif
+#endif
 
 static char TerminalDeviceBuff[255 + 2];
-static int TerminalSocketPair[2] = {0, 0};
+static int TerminalSocketPair[2] = { 0, 0 };
 static unsigned short TerminalDeviceChan = 0;
 
-static int CreateSocketPair (int, int, int, int *);
-static void SocketPairTimeoutAst (int);
-static int TerminalDeviceAst (int);
-static void LogMessage (char *, ...);
+static int CreateSocketPair(int, int, int, int *);
+static void SocketPairTimeoutAst(int);
+static int TerminalDeviceAst(int);
+static void LogMessage(char *, ...);
 
 /*
 ** Socket Pair Timeout Value (must be 0-59 seconds)
 */
-# define SOCKET_PAIR_TIMEOUT_VALUE 20
+#define SOCKET_PAIR_TIMEOUT_VALUE 20
 
 /*
 ** Socket Pair Timeout Block which is passed to timeout AST
@@ -119,55 +134,54 @@ typedef struct _SocketPairTimeoutBlock {
     unsigned short SockChan2;
 } SPTB;
 
-# ifdef TERM_SOCK_TEST
+#ifdef TERM_SOCK_TEST
 
 /*----------------------------------------------------------------------------*/
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
-int main (int argc, char *argv[], char *envp[])
+int main(int argc, char *argv[], char *envp[])
 {
     char TermBuff[80];
     int TermSock,
         status,
         len;
 
-    LogMessage ("Enter 'q' or 'Q' to quit ...");
-    while (OPENSSL_strcasecmp (TermBuff, "Q")) {
+    LogMessage("Enter 'q' or 'Q' to quit ...");
+    while (OPENSSL_strcasecmp(TermBuff, "Q")) {
         /*
         ** Create the terminal socket
         */
-        status = TerminalSocket (TERM_SOCK_CREATE, &TermSock);
+        status = TerminalSocket(TERM_SOCK_CREATE, &TermSock);
         if (status != TERM_SOCK_SUCCESS)
-            exit (1);
+            exit(1);
 
         /*
         ** Process the terminal input
         */
-        LogMessage ("Waiting on terminal I/O ...\n");
-        len = recv (TermSock, TermBuff, sizeof(TermBuff), 0) ;
+        LogMessage("Waiting on terminal I/O ...\n");
+        len = recv(TermSock, TermBuff, sizeof(TermBuff), 0);
         TermBuff[len] = '\0';
-        LogMessage ("Received terminal I/O [%s]", TermBuff);
+        LogMessage("Received terminal I/O [%s]", TermBuff);
 
         /*
         ** Delete the terminal socket
         */
-        status = TerminalSocket (TERM_SOCK_DELETE, &TermSock);
+        status = TerminalSocket(TERM_SOCK_DELETE, &TermSock);
         if (status != TERM_SOCK_SUCCESS)
-            exit (1);
+            exit(1);
     }
 
     return 1;
-
 }
-# endif
+#endif
 
 /*----------------------------------------------------------------------------*/
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
-int TerminalSocket (int FunctionCode, int *ReturnSocket)
+int TerminalSocket(int FunctionCode, int *ReturnSocket)
 {
     int status;
-    $DESCRIPTOR (TerminalDeviceDesc, "SYS$COMMAND");
+    $DESCRIPTOR(TerminalDeviceDesc, "SYS$COMMAND");
 
     /*
     ** Process the requested function code
@@ -177,45 +191,45 @@ int TerminalSocket (int FunctionCode, int *ReturnSocket)
         /*
         ** Create a socket pair
         */
-        status = CreateSocketPair (AF_INET, SOCK_STREAM, 0, TerminalSocketPair);
+        status = CreateSocketPair(AF_INET, SOCK_STREAM, 0, TerminalSocketPair);
         if (status == -1) {
-            LogMessage ("TerminalSocket: CreateSocketPair () - %08X", status);
+            LogMessage("TerminalSocket: CreateSocketPair () - %08X", status);
             if (TerminalSocketPair[0])
-                close (TerminalSocketPair[0]);
+                close(TerminalSocketPair[0]);
             if (TerminalSocketPair[1])
-                close (TerminalSocketPair[1]);
+                close(TerminalSocketPair[1]);
             return TERM_SOCK_FAILURE;
         }
 
         /*
         ** Assign a channel to the terminal device
         */
-        status = sys$assign (&TerminalDeviceDesc,
-                             &TerminalDeviceChan,
-                             0, 0, 0);
-        if (! (status & 1)) {
-            LogMessage ("TerminalSocket: SYS$ASSIGN () - %08X", status);
-            close (TerminalSocketPair[0]);
-            close (TerminalSocketPair[1]);
+        status = sys$assign(&TerminalDeviceDesc,
+            &TerminalDeviceChan,
+            0, 0, 0);
+        if (!(status & 1)) {
+            LogMessage("TerminalSocket: SYS$ASSIGN () - %08X", status);
+            close(TerminalSocketPair[0]);
+            close(TerminalSocketPair[1]);
             return TERM_SOCK_FAILURE;
         }
 
         /*
         ** Queue an async IO to the terminal device
         */
-        status = sys$qio (EFN$C_ENF,
-                          TerminalDeviceChan,
-                          IO$_READVBLK,
-                          &TerminalDeviceIosb,
-                          TerminalDeviceAst,
-                          0,
-                          TerminalDeviceBuff,
-                          sizeof(TerminalDeviceBuff) - 2,
-                          0, 0, 0, 0);
-        if (! (status & 1)) {
-            LogMessage ("TerminalSocket: SYS$QIO () - %08X", status);
-            close (TerminalSocketPair[0]);
-            close (TerminalSocketPair[1]);
+        status = sys$qio(EFN$C_ENF,
+            TerminalDeviceChan,
+            IO$_READVBLK,
+            &TerminalDeviceIosb,
+            TerminalDeviceAst,
+            0,
+            TerminalDeviceBuff,
+            sizeof(TerminalDeviceBuff) - 2,
+            0, 0, 0, 0);
+        if (!(status & 1)) {
+            LogMessage("TerminalSocket: SYS$QIO () - %08X", status);
+            close(TerminalSocketPair[0]);
+            close(TerminalSocketPair[1]);
             return TERM_SOCK_FAILURE;
         }
 
@@ -229,30 +243,30 @@ int TerminalSocket (int FunctionCode, int *ReturnSocket)
         /*
         ** Cancel any pending IO on the terminal channel
         */
-        status = sys$cancel (TerminalDeviceChan);
-        if (! (status & 1)) {
-            LogMessage ("TerminalSocket: SYS$CANCEL () - %08X", status);
-            close (TerminalSocketPair[0]);
-            close (TerminalSocketPair[1]);
+        status = sys$cancel(TerminalDeviceChan);
+        if (!(status & 1)) {
+            LogMessage("TerminalSocket: SYS$CANCEL () - %08X", status);
+            close(TerminalSocketPair[0]);
+            close(TerminalSocketPair[1]);
             return TERM_SOCK_FAILURE;
         }
 
         /*
         ** Deassign the terminal channel
         */
-        status = sys$dassgn (TerminalDeviceChan);
-        if (! (status & 1)) {
-            LogMessage ("TerminalSocket: SYS$DASSGN () - %08X", status);
-            close (TerminalSocketPair[0]);
-            close (TerminalSocketPair[1]);
+        status = sys$dassgn(TerminalDeviceChan);
+        if (!(status & 1)) {
+            LogMessage("TerminalSocket: SYS$DASSGN () - %08X", status);
+            close(TerminalSocketPair[0]);
+            close(TerminalSocketPair[1]);
             return TERM_SOCK_FAILURE;
         }
 
         /*
         ** Close the terminal socket pair
         */
-        close (TerminalSocketPair[0]);
-        close (TerminalSocketPair[1]);
+        close(TerminalSocketPair[0]);
+        close(TerminalSocketPair[1]);
 
         /*
         ** Return the initialized socket
@@ -264,7 +278,7 @@ int TerminalSocket (int FunctionCode, int *ReturnSocket)
         /*
         ** Invalid function code
         */
-        LogMessage ("TerminalSocket: Invalid Function Code - %d", FunctionCode);
+        LogMessage("TerminalSocket: Invalid Function Code - %d", FunctionCode);
         return TERM_SOCK_FAILURE;
         break;
     }
@@ -273,21 +287,20 @@ int TerminalSocket (int FunctionCode, int *ReturnSocket)
     ** Return success
     */
     return TERM_SOCK_SUCCESS;
-
 }
 
 /*----------------------------------------------------------------------------*/
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
-static int CreateSocketPair (int SocketFamily,
-                             int SocketType,
-                             int SocketProtocol,
-                             int *SocketPair)
+static int CreateSocketPair(int SocketFamily,
+    int SocketType,
+    int SocketProtocol,
+    int *SocketPair)
 {
-    struct dsc$descriptor AscTimeDesc = {0, DSC$K_DTYPE_T, DSC$K_CLASS_S, NULL};
-    static const char* LocalHostAddr = {"127.0.0.1"};
+    struct dsc$descriptor AscTimeDesc = { 0, DSC$K_DTYPE_T, DSC$K_CLASS_S, NULL };
+    static const char *LocalHostAddr = { "127.0.0.1" };
     unsigned short TcpAcceptChan = 0,
-        TcpDeviceChan = 0;
+                   TcpDeviceChan = 0;
     unsigned long BinTimeBuff[2];
     struct sockaddr_in sin;
     char AscTimeBuff[32];
@@ -295,23 +308,23 @@ static int CreateSocketPair (int SocketFamily,
     int status;
     unsigned int slen;
 
-# ifdef __alpha
+#ifdef __alpha
     struct _iosb iosb;
-# else
+#else
     IOSB iosb;
-# endif
+#endif
 
     int SockDesc1 = 0,
         SockDesc2 = 0;
     SPTB sptb;
-    $DESCRIPTOR (TcpDeviceDesc, "TCPIP$DEVICE");
+    $DESCRIPTOR(TcpDeviceDesc, "TCPIP$DEVICE");
 
     /*
     ** Create a socket
     */
-    SockDesc1 = socket (SocketFamily, SocketType, 0);
+    SockDesc1 = socket(SocketFamily, SocketType, 0);
     if (SockDesc1 < 0) {
-        LogMessage ("CreateSocketPair: socket () - %d", errno);
+        LogMessage("CreateSocketPair: socket () - %d", errno);
         return -1;
     }
 
@@ -319,28 +332,28 @@ static int CreateSocketPair (int SocketFamily,
     ** Initialize the socket information
     */
     slen = sizeof(sin);
-    memset ((char *) &sin, 0, slen);
+    memset((char *)&sin, 0, slen);
     sin.sin_family = SocketFamily;
-    sin.sin_addr.s_addr = inet_addr (LocalHostAddr);
+    sin.sin_addr.s_addr = inet_addr(LocalHostAddr);
     sin.sin_port = 0;
 
     /*
     ** Bind the socket to the local IP
     */
-    status = bind (SockDesc1, (struct sockaddr *) &sin, slen);
+    status = bind(SockDesc1, (struct sockaddr *)&sin, slen);
     if (status < 0) {
-        LogMessage ("CreateSocketPair: bind () - %d", errno);
-        close (SockDesc1);
+        LogMessage("CreateSocketPair: bind () - %d", errno);
+        close(SockDesc1);
         return -1;
     }
 
     /*
     ** Get the socket name so we can save the port number
     */
-    status = getsockname (SockDesc1, (struct sockaddr *) &sin, &slen);
+    status = getsockname(SockDesc1, (struct sockaddr *)&sin, &slen);
     if (status < 0) {
-        LogMessage ("CreateSocketPair: getsockname () - %d", errno);
-        close (SockDesc1);
+        LogMessage("CreateSocketPair: getsockname () - %d", errno);
+        close(SockDesc1);
         return -1;
     } else
         LocalHostPort = sin.sin_port;
@@ -348,18 +361,18 @@ static int CreateSocketPair (int SocketFamily,
     /*
     ** Setup a listen for the socket
     */
-    listen (SockDesc1, 5);
+    listen(SockDesc1, 5);
 
     /*
     ** Get the binary (64-bit) time of the specified timeout value
     */
     BIO_snprintf(AscTimeBuff, sizeof(AscTimeBuff), "0 0:0:%02d.00", SOCKET_PAIR_TIMEOUT_VALUE);
-    AscTimeDesc.dsc$w_length = strlen (AscTimeBuff);
+    AscTimeDesc.dsc$w_length = strlen(AscTimeBuff);
     AscTimeDesc.dsc$a_pointer = AscTimeBuff;
-    status = sys$bintim (&AscTimeDesc, BinTimeBuff);
-    if (! (status & 1)) {
-        LogMessage ("CreateSocketPair: SYS$BINTIM () - %08X", status);
-        close (SockDesc1);
+    status = sys$bintim(&AscTimeDesc, BinTimeBuff);
+    if (!(status & 1)) {
+        LogMessage("CreateSocketPair: SYS$BINTIM () - %08X", status);
+        close(SockDesc1);
         return -1;
     }
 
@@ -367,87 +380,87 @@ static int CreateSocketPair (int SocketFamily,
     ** Assign another channel to the TCP/IP device for the accept.
     ** This is the channel that ends up being connected to.
     */
-    status = sys$assign (&TcpDeviceDesc, &TcpDeviceChan, 0, 0, 0);
-    if (! (status & 1)) {
-        LogMessage ("CreateSocketPair: SYS$ASSIGN () - %08X", status);
-        close (SockDesc1);
+    status = sys$assign(&TcpDeviceDesc, &TcpDeviceChan, 0, 0, 0);
+    if (!(status & 1)) {
+        LogMessage("CreateSocketPair: SYS$ASSIGN () - %08X", status);
+        close(SockDesc1);
         return -1;
     }
 
     /*
     ** Get the channel of the first socket for the accept
     */
-    TcpAcceptChan = decc$get_sdc (SockDesc1);
+    TcpAcceptChan = decc$get_sdc(SockDesc1);
 
     /*
     ** Perform the accept using $QIO so we can do this asynchronously
     */
-    status = sys$qio (EFN$C_ENF,
-                      TcpAcceptChan,
-                      IO$_ACCESS | IO$M_ACCEPT,
-                      &iosb,
-                      0, 0, 0, 0, 0,
-                      &TcpDeviceChan,
-                      0, 0);
-    if (! (status & 1)) {
-        LogMessage ("CreateSocketPair: SYS$QIO () - %08X", status);
-        close (SockDesc1);
-        sys$dassgn (TcpDeviceChan);
+    status = sys$qio(EFN$C_ENF,
+        TcpAcceptChan,
+        IO$_ACCESS | IO$M_ACCEPT,
+        &iosb,
+        0, 0, 0, 0, 0,
+        &TcpDeviceChan,
+        0, 0);
+    if (!(status & 1)) {
+        LogMessage("CreateSocketPair: SYS$QIO () - %08X", status);
+        close(SockDesc1);
+        sys$dassgn(TcpDeviceChan);
         return -1;
     }
 
     /*
     ** Create the second socket to do the connect
     */
-    SockDesc2 = socket (SocketFamily, SocketType, 0);
+    SockDesc2 = socket(SocketFamily, SocketType, 0);
     if (SockDesc2 < 0) {
-        LogMessage ("CreateSocketPair: socket () - %d", errno);
-        sys$cancel (TcpAcceptChan);
-        close (SockDesc1);
-        sys$dassgn (TcpDeviceChan);
-        return (-1) ;
+        LogMessage("CreateSocketPair: socket () - %d", errno);
+        sys$cancel(TcpAcceptChan);
+        close(SockDesc1);
+        sys$dassgn(TcpDeviceChan);
+        return (-1);
     }
 
     /*
     ** Setup the Socket Pair Timeout Block
     */
     sptb.SockChan1 = TcpAcceptChan;
-    sptb.SockChan2 = decc$get_sdc (SockDesc2);
+    sptb.SockChan2 = decc$get_sdc(SockDesc2);
 
     /*
     ** Before we block on the connect, set a timer that can cancel I/O on our
     ** two sockets if it never connects.
     */
-    status = sys$setimr (EFN$C_ENF,
-                         BinTimeBuff,
-                         SocketPairTimeoutAst,
-                         &sptb,
-                         0);
-    if (! (status & 1)) {
-        LogMessage ("CreateSocketPair: SYS$SETIMR () - %08X", status);
-        sys$cancel (TcpAcceptChan);
-        close (SockDesc1);
-        close (SockDesc2);
-        sys$dassgn (TcpDeviceChan);
+    status = sys$setimr(EFN$C_ENF,
+        BinTimeBuff,
+        SocketPairTimeoutAst,
+        &sptb,
+        0);
+    if (!(status & 1)) {
+        LogMessage("CreateSocketPair: SYS$SETIMR () - %08X", status);
+        sys$cancel(TcpAcceptChan);
+        close(SockDesc1);
+        close(SockDesc2);
+        sys$dassgn(TcpDeviceChan);
         return -1;
     }
 
     /*
     ** Now issue the connect
     */
-    memset ((char *) &sin, 0, sizeof(sin)) ;
+    memset((char *)&sin, 0, sizeof(sin));
     sin.sin_family = SocketFamily;
-    sin.sin_addr.s_addr = inet_addr (LocalHostAddr) ;
-    sin.sin_port = LocalHostPort ;
+    sin.sin_addr.s_addr = inet_addr(LocalHostAddr);
+    sin.sin_port = LocalHostPort;
 
-    status = connect (SockDesc2, (struct sockaddr *) &sin, sizeof(sin));
+    status = connect(SockDesc2, (struct sockaddr *)&sin, sizeof(sin));
     if (status < 0) {
-        LogMessage ("CreateSocketPair: connect () - %d", errno);
-        sys$cantim (&sptb, 0);
-        sys$cancel (TcpAcceptChan);
-        close (SockDesc1);
-        close (SockDesc2);
-        sys$dassgn (TcpDeviceChan);
+        LogMessage("CreateSocketPair: connect () - %d", errno);
+        sys$cantim(&sptb, 0);
+        sys$cancel(TcpAcceptChan);
+        close(SockDesc1);
+        close(SockDesc2);
+        sys$dassgn(TcpDeviceChan);
         return -1;
     }
 
@@ -456,18 +469,18 @@ static int CreateSocketPair (int SocketFamily,
     ** (SS$_ABORT), then we probably canceled it from the AST routine - so log
     ** a timeout.
     */
-    status = sys$synch (EFN$C_ENF, &iosb);
-    if (! (iosb.iosb$w_status & 1)) {
+    status = sys$synch(EFN$C_ENF, &iosb);
+    if (!(iosb.iosb$w_status & 1)) {
         if (iosb.iosb$w_status == SS$_ABORT)
-            LogMessage ("CreateSocketPair: SYS$QIO(iosb) timeout");
+            LogMessage("CreateSocketPair: SYS$QIO(iosb) timeout");
         else {
-            LogMessage ("CreateSocketPair: SYS$QIO(iosb) - %d",
-                        iosb.iosb$w_status);
-            sys$cantim (&sptb, 0);
+            LogMessage("CreateSocketPair: SYS$QIO(iosb) - %d",
+                iosb.iosb$w_status);
+            sys$cantim(&sptb, 0);
         }
-        close (SockDesc1);
-        close (SockDesc2);
-        sys$dassgn (TcpDeviceChan);
+        close(SockDesc1);
+        close(SockDesc2);
+        sys$dassgn(TcpDeviceChan);
         return -1;
     }
 
@@ -476,34 +489,32 @@ static int CreateSocketPair (int SocketFamily,
     ** I/O channel to a socket fd, close the listener socket and return the
     ** connected pair.
     */
-    sys$cantim (&sptb, 0);
-
-    close (SockDesc1) ;
-    SocketPair[0] = SockDesc2 ;
-    SocketPair[1] = socket_fd (TcpDeviceChan);
+    sys$cantim(&sptb, 0);
 
-    return (0) ;
+    close(SockDesc1);
+    SocketPair[0] = SockDesc2;
+    SocketPair[1] = socket_fd(TcpDeviceChan);
 
+    return (0);
 }
 
 /*----------------------------------------------------------------------------*/
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
-static void SocketPairTimeoutAst (int astparm)
+static void SocketPairTimeoutAst(int astparm)
 {
-    SPTB *sptb = (SPTB *) astparm;
+    SPTB *sptb = (SPTB *)astparm;
 
-    sys$cancel (sptb->SockChan2); /* Cancel the connect() */
-    sys$cancel (sptb->SockChan1); /* Cancel the accept() */
+    sys$cancel(sptb->SockChan2); /* Cancel the connect() */
+    sys$cancel(sptb->SockChan1); /* Cancel the accept() */
 
     return;
-
 }
 
 /*----------------------------------------------------------------------------*/
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
-static int TerminalDeviceAst (int astparm)
+static int TerminalDeviceAst(int astparm)
 {
     int status;
 
@@ -511,41 +522,40 @@ static int TerminalDeviceAst (int astparm)
     ** Terminate the terminal buffer
     */
     TerminalDeviceBuff[TerminalDeviceIosb.iosb$w_bcnt] = '\0';
-    strcat (TerminalDeviceBuff, "\n");
+    strcat(TerminalDeviceBuff, "\n");
 
     /*
     ** Send the data read from the terminal device through the socket pair
     */
-    send (TerminalSocketPair[0], TerminalDeviceBuff,
-          TerminalDeviceIosb.iosb$w_bcnt + 1, 0);
+    send(TerminalSocketPair[0], TerminalDeviceBuff,
+        TerminalDeviceIosb.iosb$w_bcnt + 1, 0);
 
     /*
     ** Queue another async IO to the terminal device
     */
-    status = sys$qio (EFN$C_ENF,
-                      TerminalDeviceChan,
-                      IO$_READVBLK,
-                      &TerminalDeviceIosb,
-                      TerminalDeviceAst,
-                      0,
-                      TerminalDeviceBuff,
-                      sizeof(TerminalDeviceBuff) - 1,
-                      0, 0, 0, 0);
+    status = sys$qio(EFN$C_ENF,
+        TerminalDeviceChan,
+        IO$_READVBLK,
+        &TerminalDeviceIosb,
+        TerminalDeviceAst,
+        0,
+        TerminalDeviceBuff,
+        sizeof(TerminalDeviceBuff) - 2,
+        0, 0, 0, 0);
 
     /*
     ** Return status
     */
     return status;
-
 }
 
 /*----------------------------------------------------------------------------*/
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
-static void LogMessage (char *msg, ...)
+static void LogMessage(char *msg, ...)
 {
-    char *Month[] = {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
-                     "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
+    char *Month[] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+        "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
     static unsigned int pid = 0;
     va_list args;
     time_t CurTime;
@@ -556,36 +566,35 @@ static void LogMessage (char *msg, ...)
     ** Get the process pid
     */
     if (pid == 0)
-        pid = getpid ();
+        pid = getpid();
 
     /*
     ** Convert the current time into local time
     */
-    CurTime = time (NULL);
-    LocTime = localtime (&CurTime);
+    CurTime = time(NULL);
+    LocTime = localtime(&CurTime);
 
     /*
     ** Format the message buffer
     */
     BIO_snprintf(MsgBuff, sizeof(MsgBuff), "%02d-%s-%04d %02d:%02d:%02d [%08X] %s\n",
-                 LocTime->tm_mday, Month[LocTime->tm_mon],
-                 (LocTime->tm_year + 1900), LocTime->tm_hour, LocTime->tm_min,
-                 LocTime->tm_sec, pid, msg);
+        LocTime->tm_mday, Month[LocTime->tm_mon],
+        (LocTime->tm_year + 1900), LocTime->tm_hour, LocTime->tm_min,
+        LocTime->tm_sec, pid, msg);
 
     /*
     ** Get any variable arguments and add them to the print of the message
     ** buffer
     */
-    va_start (args, msg);
-    vfprintf (stderr, MsgBuff, args);
-    va_end (args);
+    va_start(args, msg);
+    vfprintf(stderr, MsgBuff, args);
+    va_end(args);
 
     /*
     ** Flush standard error output
     */
-    fsync (fileno (stderr));
+    fsync(fileno(stderr));
 
     return;
-
 }
 #endif
diff --git a/crypto/openssl/apps/lib/win32_init.c b/crypto/openssl/apps/lib/win32_init.c
index 6d2be0c62942..824eb676310e 100644
--- a/crypto/openssl/apps/lib/win32_init.c
+++ b/crypto/openssl/apps/lib/win32_init.c
@@ -81,18 +81,18 @@ static int process_glob(WCHAR *wstr, int wlen)
             break;
 
     if (i == wlen)
-        return 0;   /* definitely not a glob */
+        return 0; /* definitely not a glob */
 
     saved_char = wstr[wlen];
     wstr[wlen] = L'\0';
     h = FindFirstFileW(wstr, &data);
     wstr[wlen] = saved_char;
     if (h == INVALID_HANDLE_VALUE)
-        return 0;   /* not a valid glob, just pass... */
+        return 0; /* not a valid glob, just pass... */
 
     if (slash)
         udlen = WideCharToMultiByte(CP_UTF8, 0, wstr, slash,
-                                    NULL, 0, NULL, NULL);
+            NULL, 0, NULL, NULL);
     else
         udlen = 0;
 
@@ -104,8 +104,7 @@ static int process_glob(WCHAR *wstr, int wlen)
          * skip over . and ..
          */
         if (data.cFileName[0] == L'.') {
-            if ((data.cFileName[1] == L'\0') ||
-                (data.cFileName[1] == L'.' && data.cFileName[2] == L'\0'))
+            if ((data.cFileName[1] == L'\0') || (data.cFileName[1] == L'.' && data.cFileName[2] == L'\0'))
                 continue;
         }
 
@@ -117,7 +116,7 @@ static int process_glob(WCHAR *wstr, int wlen)
          * so that |uflen| covers even trailing '\0'.
          */
         uflen = WideCharToMultiByte(CP_UTF8, 0, data.cFileName, -1,
-                                    NULL, 0, NULL, NULL);
+            NULL, 0, NULL, NULL);
 
         arg = malloc(udlen + uflen);
         if (arg == NULL)
@@ -125,10 +124,10 @@ static int process_glob(WCHAR *wstr, int wlen)
 
         if (udlen)
             WideCharToMultiByte(CP_UTF8, 0, wstr, slash,
-                                arg, udlen, NULL, NULL);
+                arg, udlen, NULL, NULL);
 
         WideCharToMultiByte(CP_UTF8, 0, data.cFileName, -1,
-                            arg + udlen, uflen, NULL, NULL);
+            arg + udlen, uflen, NULL, NULL);
 
         newargv[newargc++] = arg;
     } while (FindNextFileW(h, &data));
@@ -154,7 +153,8 @@ void win32_utf8argv(int *argc, char **argv[])
         return;
 
     wcmdline = GetCommandLineW();
-    if (wcmdline == NULL) return;
+    if (wcmdline == NULL)
+        return;
 
     /*
      * make a copy of the command line, since we might have to modify it...
@@ -178,7 +178,7 @@ void win32_utf8argv(int *argc, char **argv[])
          */
         warg = wend = p;
         while (*p != L'\0'
-               && (in_quote || (*p != L' ' && *p != L'\t'))) {
+            && (in_quote || (*p != L' ' && *p != L'\t'))) {
             switch (*p) {
             case L'\\':
                 /*
@@ -259,7 +259,7 @@ void win32_utf8argv(int *argc, char **argv[])
             ulen = 0;
             if (wlen > 0) {
                 ulen = WideCharToMultiByte(CP_UTF8, 0, warg, wlen,
-                                           NULL, 0, NULL, NULL);
+                    NULL, 0, NULL, NULL);
                 if (ulen <= 0)
                     continue;
             }
@@ -272,7 +272,7 @@ void win32_utf8argv(int *argc, char **argv[])
 
             if (wlen > 0)
                 WideCharToMultiByte(CP_UTF8, 0, warg, wlen,
-                                    arg, ulen, NULL, NULL);
+                    arg, ulen, NULL, NULL);
             arg[ulen] = '\0';
 
             newargv[newargc++] = arg;
@@ -303,5 +303,7 @@ void win32_utf8argv(int *argc, char **argv[])
 }
 #else
 void win32_utf8argv(int *argc, char **argv[])
-{   return;   }
+{
+    return;
+}
 #endif
diff --git a/crypto/openssl/apps/list.c b/crypto/openssl/apps/list.c
index 5219773fcf04..757400b36215 100644
--- a/crypto/openssl/apps/list.c
+++ b/crypto/openssl/apps/list.c
@@ -36,21 +36,21 @@ static int verbose = 0;
 static const char *select_name = NULL;
 
 /* Checks to see if algorithms are fetchable */
-#define IS_FETCHABLE(type, TYPE)                                \
-    static int is_ ## type ## _fetchable(const TYPE *alg)       \
-    {                                                           \
-        TYPE *impl;                                             \
-        const char *propq = app_get0_propq();                   \
-        OSSL_LIB_CTX *libctx = app_get0_libctx();               \
-        const char *name = TYPE ## _get0_name(alg);             \
-                                                                \
-        ERR_set_mark();                                         \
-        impl = TYPE ## _fetch(libctx, name, propq);             \
-        ERR_pop_to_mark();                                      \
-        if (impl == NULL)                                       \
-            return 0;                                           \
-        TYPE ## _free(impl);                                    \
-        return 1;                                               \
+#define IS_FETCHABLE(type, TYPE)                      \
+    static int is_##type##_fetchable(const TYPE *alg) \
+    {                                                 \
+        TYPE *impl;                                   \
+        const char *propq = app_get0_propq();         \
+        OSSL_LIB_CTX *libctx = app_get0_libctx();     \
+        const char *name = TYPE##_get0_name(alg);     \
+                                                      \
+        ERR_set_mark();                               \
+        impl = TYPE##_fetch(libctx, name, propq);     \
+        ERR_pop_to_mark();                            \
+        if (impl == NULL)                             \
+            return 0;                                 \
+        TYPE##_free(impl);                            \
+        return 1;                                     \
     }
 IS_FETCHABLE(cipher, EVP_CIPHER)
 IS_FETCHABLE(digest, EVP_MD)
@@ -73,7 +73,7 @@ static int include_legacy(void)
 }
 
 static void legacy_cipher_fn(const EVP_CIPHER *c,
-                             const char *from, const char *to, void *arg)
+    const char *from, const char *to, void *arg)
 {
     if (select_name != NULL
         && (c == NULL
@@ -92,11 +92,11 @@ static void legacy_cipher_fn(const EVP_CIPHER *c,
 #endif
 
 DEFINE_STACK_OF(EVP_CIPHER)
-static int cipher_cmp(const EVP_CIPHER * const *a,
-                      const EVP_CIPHER * const *b)
+static int cipher_cmp(const EVP_CIPHER *const *a,
+    const EVP_CIPHER *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_CIPHER_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_CIPHER_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_CIPHER_get0_provider(*b)));
 }
 
 static void collect_ciphers(EVP_CIPHER *cipher, void *stack)
@@ -104,8 +104,8 @@ static void collect_ciphers(EVP_CIPHER *cipher, void *stack)
     STACK_OF(EVP_CIPHER) *cipher_stack = stack;
 
     if (is_cipher_fetchable(cipher)
-            && EVP_CIPHER_up_ref(cipher)
-            && sk_EVP_CIPHER_push(cipher_stack, cipher) <= 0)
+        && EVP_CIPHER_up_ref(cipher)
+        && sk_EVP_CIPHER_push(cipher_stack, cipher) <= 0)
         EVP_CIPHER_free(cipher); /* up-ref successful but push to stack failed */
 }
 
@@ -141,7 +141,7 @@ static void list_ciphers(const char *prefix)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                       OSSL_PROVIDER_get0_name(EVP_CIPHER_get0_provider(c)));
+                OSSL_PROVIDER_get0_name(EVP_CIPHER_get0_provider(c)));
 
             if (verbose) {
                 const char *desc = EVP_CIPHER_get0_description(c);
@@ -149,11 +149,11 @@ static void list_ciphers(const char *prefix)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("retrievable algorithm parameters",
-                                  EVP_CIPHER_gettable_params(c), 4);
+                    EVP_CIPHER_gettable_params(c), 4);
                 print_param_types("retrievable operation parameters",
-                                  EVP_CIPHER_gettable_ctx_params(c), 4);
+                    EVP_CIPHER_gettable_ctx_params(c), 4);
                 print_param_types("settable operation parameters",
-                                  EVP_CIPHER_settable_ctx_params(c), 4);
+                    EVP_CIPHER_settable_ctx_params(c), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -163,7 +163,7 @@ static void list_ciphers(const char *prefix)
 
 #ifndef OPENSSL_NO_DEPRECATED_3_0
 static void legacy_md_fn(const EVP_MD *m,
-                       const char *from, const char *to, void *arg)
+    const char *from, const char *to, void *arg)
 {
     if (m != NULL) {
         BIO_printf(arg, "  %s\n", EVP_MD_get0_name(m));
@@ -178,10 +178,10 @@ static void legacy_md_fn(const EVP_MD *m,
 #endif
 
 DEFINE_STACK_OF(EVP_MD)
-static int md_cmp(const EVP_MD * const *a, const EVP_MD * const *b)
+static int md_cmp(const EVP_MD *const *a, const EVP_MD *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_MD_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_MD_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_MD_get0_provider(*b)));
 }
 
 static void collect_digests(EVP_MD *digest, void *stack)
@@ -189,8 +189,8 @@ static void collect_digests(EVP_MD *digest, void *stack)
     STACK_OF(EVP_MD) *digest_stack = stack;
 
     if (is_digest_fetchable(digest)
-            && EVP_MD_up_ref(digest)
-            && sk_EVP_MD_push(digest_stack, digest) <= 0)
+        && EVP_MD_up_ref(digest)
+        && sk_EVP_MD_push(digest_stack, digest) <= 0)
         EVP_MD_free(digest); /* up-ref successful but push to stack failed */
 }
 
@@ -226,7 +226,7 @@ static void list_digests(const char *prefix)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                       OSSL_PROVIDER_get0_name(EVP_MD_get0_provider(m)));
+                OSSL_PROVIDER_get0_name(EVP_MD_get0_provider(m)));
 
             if (verbose) {
                 const char *desc = EVP_MD_get0_description(m);
@@ -234,11 +234,11 @@ static void list_digests(const char *prefix)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("retrievable algorithm parameters",
-                                EVP_MD_gettable_params(m), 4);
+                    EVP_MD_gettable_params(m), 4);
                 print_param_types("retrievable operation parameters",
-                                EVP_MD_gettable_ctx_params(m), 4);
+                    EVP_MD_gettable_ctx_params(m), 4);
                 print_param_types("settable operation parameters",
-                                EVP_MD_settable_ctx_params(m), 4);
+                    EVP_MD_settable_ctx_params(m), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -247,10 +247,10 @@ static void list_digests(const char *prefix)
 }
 
 DEFINE_STACK_OF(EVP_MAC)
-static int mac_cmp(const EVP_MAC * const *a, const EVP_MAC * const *b)
+static int mac_cmp(const EVP_MAC *const *a, const EVP_MAC *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_MAC_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_MAC_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_MAC_get0_provider(*b)));
 }
 
 static void collect_macs(EVP_MAC *mac, void *stack)
@@ -258,7 +258,7 @@ static void collect_macs(EVP_MAC *mac, void *stack)
     STACK_OF(EVP_MAC) *mac_stack = stack;
 
     if (is_mac_fetchable(mac)
-            && sk_EVP_MAC_push(mac_stack, mac) > 0)
+        && sk_EVP_MAC_push(mac_stack, mac) > 0)
         EVP_MAC_up_ref(mac);
 }
 
@@ -287,7 +287,7 @@ static void list_macs(void)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                       OSSL_PROVIDER_get0_name(EVP_MAC_get0_provider(m)));
+                OSSL_PROVIDER_get0_name(EVP_MAC_get0_provider(m)));
 
             if (verbose) {
                 const char *desc = EVP_MAC_get0_description(m);
@@ -295,11 +295,11 @@ static void list_macs(void)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("retrievable algorithm parameters",
-                                EVP_MAC_gettable_params(m), 4);
+                    EVP_MAC_gettable_params(m), 4);
                 print_param_types("retrievable operation parameters",
-                                EVP_MAC_gettable_ctx_params(m), 4);
+                    EVP_MAC_gettable_ctx_params(m), 4);
                 print_param_types("settable operation parameters",
-                                EVP_MAC_settable_ctx_params(m), 4);
+                    EVP_MAC_settable_ctx_params(m), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -311,10 +311,10 @@ static void list_macs(void)
  * KDFs and PRFs
  */
 DEFINE_STACK_OF(EVP_KDF)
-static int kdf_cmp(const EVP_KDF * const *a, const EVP_KDF * const *b)
+static int kdf_cmp(const EVP_KDF *const *a, const EVP_KDF *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_KDF_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_KDF_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_KDF_get0_provider(*b)));
 }
 
 static void collect_kdfs(EVP_KDF *kdf, void *stack)
@@ -322,8 +322,8 @@ static void collect_kdfs(EVP_KDF *kdf, void *stack)
     STACK_OF(EVP_KDF) *kdf_stack = stack;
 
     if (is_kdf_fetchable(kdf)
-            && EVP_KDF_up_ref(kdf)
-            && sk_EVP_KDF_push(kdf_stack, kdf) <= 0)
+        && EVP_KDF_up_ref(kdf)
+        && sk_EVP_KDF_push(kdf_stack, kdf) <= 0)
         EVP_KDF_free(kdf); /* up-ref successful but push to stack failed */
 }
 
@@ -352,7 +352,7 @@ static void list_kdfs(void)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                       OSSL_PROVIDER_get0_name(EVP_KDF_get0_provider(k)));
+                OSSL_PROVIDER_get0_name(EVP_KDF_get0_provider(k)));
 
             if (verbose) {
                 const char *desc = EVP_KDF_get0_description(k);
@@ -360,11 +360,11 @@ static void list_kdfs(void)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("retrievable algorithm parameters",
-                                EVP_KDF_gettable_params(k), 4);
+                    EVP_KDF_gettable_params(k), 4);
                 print_param_types("retrievable operation parameters",
-                                EVP_KDF_gettable_ctx_params(k), 4);
+                    EVP_KDF_gettable_ctx_params(k), 4);
                 print_param_types("settable operation parameters",
-                                EVP_KDF_settable_ctx_params(k), 4);
+                    EVP_KDF_settable_ctx_params(k), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -377,13 +377,13 @@ static void list_kdfs(void)
  */
 DEFINE_STACK_OF(EVP_RAND)
 
-static int rand_cmp(const EVP_RAND * const *a, const EVP_RAND * const *b)
+static int rand_cmp(const EVP_RAND *const *a, const EVP_RAND *const *b)
 {
     int ret = OPENSSL_strcasecmp(EVP_RAND_get0_name(*a), EVP_RAND_get0_name(*b));
 
     if (ret == 0)
         ret = strcmp(OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(*a)),
-                     OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(*b)));
+            OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(*b)));
 
     return ret;
 }
@@ -393,8 +393,8 @@ static void collect_rands(EVP_RAND *rand, void *stack)
     STACK_OF(EVP_RAND) *rand_stack = stack;
 
     if (is_rand_fetchable(rand)
-            && EVP_RAND_up_ref(rand)
-            && sk_EVP_RAND_push(rand_stack, rand) <= 0)
+        && EVP_RAND_up_ref(rand)
+        && sk_EVP_RAND_push(rand_stack, rand) <= 0)
         EVP_RAND_free(rand); /* up-ref successful but push to stack failed */
 }
 
@@ -418,7 +418,7 @@ static void list_random_generators(void)
             continue;
         BIO_printf(bio_out, "  %s", EVP_RAND_get0_name(m));
         BIO_printf(bio_out, " @ %s\n",
-                   OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(m)));
+            OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(m)));
 
         if (verbose) {
             const char *desc = EVP_RAND_get0_description(m);
@@ -426,11 +426,11 @@ static void list_random_generators(void)
             if (desc != NULL)
                 BIO_printf(bio_out, "    description: %s\n", desc);
             print_param_types("retrievable algorithm parameters",
-                              EVP_RAND_gettable_params(m), 4);
+                EVP_RAND_gettable_params(m), 4);
             print_param_types("retrievable operation parameters",
-                              EVP_RAND_gettable_ctx_params(m), 4);
+                EVP_RAND_gettable_ctx_params(m), 4);
             print_param_types("settable operation parameters",
-                              EVP_RAND_settable_ctx_params(m), 4);
+                EVP_RAND_settable_ctx_params(m), 4);
         }
     }
     sk_EVP_RAND_pop_free(rands, EVP_RAND_free);
@@ -451,7 +451,7 @@ static void display_random(const char *name, EVP_RAND_CTX *drbg)
 
         BIO_printf(bio_out, "  %s", EVP_RAND_get0_name(rand));
         BIO_printf(bio_out, " @ %s\n",
-                   OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(rand)));
+            OSSL_PROVIDER_get0_name(EVP_RAND_get0_provider(rand)));
 
         switch (EVP_RAND_get_state(drbg)) {
         case EVP_RAND_STATE_UNINITIALISED:
@@ -477,13 +477,13 @@ static void display_random(const char *name, EVP_RAND_CTX *drbg)
                     continue;
                 /* Outside of verbose mode, we skip non-string values */
                 if (gettables->data_type != OSSL_PARAM_UTF8_STRING
-                        && gettables->data_type != OSSL_PARAM_UTF8_PTR
-                        && !verbose)
+                    && gettables->data_type != OSSL_PARAM_UTF8_PTR
+                    && !verbose)
                     continue;
                 params->key = gettables->key;
                 params->data_type = gettables->data_type;
                 if (gettables->data_type == OSSL_PARAM_UNSIGNED_INTEGER
-                        || gettables->data_type == OSSL_PARAM_INTEGER) {
+                    || gettables->data_type == OSSL_PARAM_INTEGER) {
                     params->data = &u;
                     params->data_size = sizeof(u);
                 } else {
@@ -508,11 +508,11 @@ static void list_random_instances(void)
  * Encoders
  */
 DEFINE_STACK_OF(OSSL_ENCODER)
-static int encoder_cmp(const OSSL_ENCODER * const *a,
-                       const OSSL_ENCODER * const *b)
+static int encoder_cmp(const OSSL_ENCODER *const *a,
+    const OSSL_ENCODER *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(OSSL_ENCODER_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(OSSL_ENCODER_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(OSSL_ENCODER_get0_provider(*b)));
 }
 
 static void collect_encoders(OSSL_ENCODER *encoder, void *stack)
@@ -520,8 +520,8 @@ static void collect_encoders(OSSL_ENCODER *encoder, void *stack)
     STACK_OF(OSSL_ENCODER) *encoder_stack = stack;
 
     if (is_encoder_fetchable(encoder)
-            && OSSL_ENCODER_up_ref(encoder)
-            && sk_OSSL_ENCODER_push(encoder_stack, encoder) <= 0)
+        && OSSL_ENCODER_up_ref(encoder)
+        && sk_OSSL_ENCODER_push(encoder_stack, encoder) <= 0)
         OSSL_ENCODER_free(encoder); /* up-ref successful but push to stack failed */
 }
 
@@ -537,7 +537,7 @@ static void list_encoders(void)
     }
     BIO_printf(bio_out, "Provided ENCODERs:\n");
     OSSL_ENCODER_do_all_provided(app_get0_libctx(), collect_encoders,
-                                 encoders);
+        encoders);
     sk_OSSL_ENCODER_sort(encoders);
 
     for (i = 0; i < sk_OSSL_ENCODER_num(encoders); i++) {
@@ -553,8 +553,8 @@ static void list_encoders(void)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s (%s)\n",
-                    OSSL_PROVIDER_get0_name(OSSL_ENCODER_get0_provider(k)),
-                    OSSL_ENCODER_get0_properties(k));
+                OSSL_PROVIDER_get0_name(OSSL_ENCODER_get0_provider(k)),
+                OSSL_ENCODER_get0_properties(k));
 
             if (verbose) {
                 const char *desc = OSSL_ENCODER_get0_description(k);
@@ -562,7 +562,7 @@ static void list_encoders(void)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("settable operation parameters",
-                                OSSL_ENCODER_settable_ctx_params(k), 4);
+                    OSSL_ENCODER_settable_ctx_params(k), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -574,11 +574,11 @@ static void list_encoders(void)
  * Decoders
  */
 DEFINE_STACK_OF(OSSL_DECODER)
-static int decoder_cmp(const OSSL_DECODER * const *a,
-                       const OSSL_DECODER * const *b)
+static int decoder_cmp(const OSSL_DECODER *const *a,
+    const OSSL_DECODER *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(OSSL_DECODER_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(OSSL_DECODER_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(OSSL_DECODER_get0_provider(*b)));
 }
 
 static void collect_decoders(OSSL_DECODER *decoder, void *stack)
@@ -586,8 +586,8 @@ static void collect_decoders(OSSL_DECODER *decoder, void *stack)
     STACK_OF(OSSL_DECODER) *decoder_stack = stack;
 
     if (is_decoder_fetchable(decoder)
-            && OSSL_DECODER_up_ref(decoder)
-            && sk_OSSL_DECODER_push(decoder_stack, decoder) <= 0)
+        && OSSL_DECODER_up_ref(decoder)
+        && sk_OSSL_DECODER_push(decoder_stack, decoder) <= 0)
         OSSL_DECODER_free(decoder); /* up-ref successful but push to stack failed */
 }
 
@@ -603,7 +603,7 @@ static void list_decoders(void)
     }
     BIO_printf(bio_out, "Provided DECODERs:\n");
     OSSL_DECODER_do_all_provided(app_get0_libctx(), collect_decoders,
-                                 decoders);
+        decoders);
     sk_OSSL_DECODER_sort(decoders);
 
     for (i = 0; i < sk_OSSL_DECODER_num(decoders); i++) {
@@ -619,8 +619,8 @@ static void list_decoders(void)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s (%s)\n",
-                       OSSL_PROVIDER_get0_name(OSSL_DECODER_get0_provider(k)),
-                       OSSL_DECODER_get0_properties(k));
+                OSSL_PROVIDER_get0_name(OSSL_DECODER_get0_provider(k)),
+                OSSL_DECODER_get0_properties(k));
 
             if (verbose) {
                 const char *desc = OSSL_DECODER_get0_description(k);
@@ -628,7 +628,7 @@ static void list_decoders(void)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("settable operation parameters",
-                                OSSL_DECODER_settable_ctx_params(k), 4);
+                    OSSL_DECODER_settable_ctx_params(k), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -637,11 +637,11 @@ static void list_decoders(void)
 }
 
 DEFINE_STACK_OF(EVP_KEYMGMT)
-static int keymanager_cmp(const EVP_KEYMGMT * const *a,
-                          const EVP_KEYMGMT * const *b)
+static int keymanager_cmp(const EVP_KEYMGMT *const *a,
+    const EVP_KEYMGMT *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_KEYMGMT_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_KEYMGMT_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_KEYMGMT_get0_provider(*b)));
 }
 
 static void collect_keymanagers(EVP_KEYMGMT *km, void *stack)
@@ -649,8 +649,8 @@ static void collect_keymanagers(EVP_KEYMGMT *km, void *stack)
     STACK_OF(EVP_KEYMGMT) *km_stack = stack;
 
     if (is_keymgmt_fetchable(km)
-            && EVP_KEYMGMT_up_ref(km)
-            && sk_EVP_KEYMGMT_push(km_stack, km) <= 0)
+        && EVP_KEYMGMT_up_ref(km)
+        && sk_EVP_KEYMGMT_push(km_stack, km) <= 0)
         EVP_KEYMGMT_free(km); /* up-ref successful but push to stack failed */
 }
 
@@ -660,7 +660,7 @@ static void list_keymanagers(void)
     STACK_OF(EVP_KEYMGMT) *km_stack = sk_EVP_KEYMGMT_new(keymanager_cmp);
 
     EVP_KEYMGMT_do_all_provided(app_get0_libctx(), collect_keymanagers,
-                                km_stack);
+        km_stack);
     sk_EVP_KEYMGMT_sort(km_stack);
 
     for (i = 0; i < sk_EVP_KEYMGMT_num(km_stack); i++) {
@@ -684,15 +684,15 @@ static void list_keymanagers(void)
             BIO_printf(bio_out, "    IDs: ");
             print_names(bio_out, names);
             BIO_printf(bio_out, " @ %s\n",
-                    OSSL_PROVIDER_get0_name(EVP_KEYMGMT_get0_provider(k)));
+                OSSL_PROVIDER_get0_name(EVP_KEYMGMT_get0_provider(k)));
 
             if (verbose) {
                 print_param_types("settable key generation parameters",
-                                EVP_KEYMGMT_gen_settable_params(k), 4);
+                    EVP_KEYMGMT_gen_settable_params(k), 4);
                 print_param_types("settable operation parameters",
-                                EVP_KEYMGMT_settable_params(k), 4);
+                    EVP_KEYMGMT_settable_params(k), 4);
                 print_param_types("retrievable operation parameters",
-                                EVP_KEYMGMT_gettable_params(k), 4);
+                    EVP_KEYMGMT_gettable_params(k), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -701,11 +701,11 @@ static void list_keymanagers(void)
 }
 
 DEFINE_STACK_OF(EVP_SKEYMGMT)
-static int skeymanager_cmp(const EVP_SKEYMGMT * const *a,
-                           const EVP_SKEYMGMT * const *b)
+static int skeymanager_cmp(const EVP_SKEYMGMT *const *a,
+    const EVP_SKEYMGMT *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(*b)));
 }
 
 static void collect_skeymanagers(EVP_SKEYMGMT *km, void *stack)
@@ -713,7 +713,7 @@ static void collect_skeymanagers(EVP_SKEYMGMT *km, void *stack)
     STACK_OF(EVP_SKEYMGMT) *km_stack = stack;
 
     if (is_skeymgmt_fetchable(km)
-            && sk_EVP_SKEYMGMT_push(km_stack, km) > 0)
+        && sk_EVP_SKEYMGMT_push(km_stack, km) > 0)
         EVP_SKEYMGMT_up_ref(km);
 }
 
@@ -723,7 +723,7 @@ static void list_skeymanagers(void)
     STACK_OF(EVP_SKEYMGMT) *km_stack = sk_EVP_SKEYMGMT_new(skeymanager_cmp);
 
     EVP_SKEYMGMT_do_all_provided(app_get0_libctx(), collect_skeymanagers,
-                                 km_stack);
+        km_stack);
     sk_EVP_SKEYMGMT_sort(km_stack);
 
     for (i = 0; i < sk_EVP_SKEYMGMT_num(km_stack); i++) {
@@ -747,8 +747,7 @@ static void list_skeymanagers(void)
             BIO_printf(bio_out, "    IDs: ");
             print_names(bio_out, names);
             BIO_printf(bio_out, " @ %s\n",
-                       OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(k)));
-
+                OSSL_PROVIDER_get0_name(EVP_SKEYMGMT_get0_provider(k)));
         }
         sk_OPENSSL_CSTRING_free(names);
     }
@@ -756,11 +755,11 @@ static void list_skeymanagers(void)
 }
 
 DEFINE_STACK_OF(EVP_SIGNATURE)
-static int signature_cmp(const EVP_SIGNATURE * const *a,
-                         const EVP_SIGNATURE * const *b)
+static int signature_cmp(const EVP_SIGNATURE *const *a,
+    const EVP_SIGNATURE *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_SIGNATURE_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_SIGNATURE_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_SIGNATURE_get0_provider(*b)));
 }
 
 static void collect_signatures(EVP_SIGNATURE *sig, void *stack)
@@ -768,8 +767,8 @@ static void collect_signatures(EVP_SIGNATURE *sig, void *stack)
     STACK_OF(EVP_SIGNATURE) *sig_stack = stack;
 
     if (is_signature_fetchable(sig)
-            && EVP_SIGNATURE_up_ref(sig)
-            && sk_EVP_SIGNATURE_push(sig_stack, sig) <= 0)
+        && EVP_SIGNATURE_up_ref(sig)
+        && sk_EVP_SIGNATURE_push(sig_stack, sig) <= 0)
         EVP_SIGNATURE_free(sig); /* up-ref successful but push to stack failed */
 }
 
@@ -779,7 +778,7 @@ static void list_signatures(void)
     STACK_OF(EVP_SIGNATURE) *sig_stack = sk_EVP_SIGNATURE_new(signature_cmp);
 
     EVP_SIGNATURE_do_all_provided(app_get0_libctx(), collect_signatures,
-                                  sig_stack);
+        sig_stack);
     sk_EVP_SIGNATURE_sort(sig_stack);
 
     for (i = 0; i < sk_EVP_SIGNATURE_num(sig_stack); i++) {
@@ -796,7 +795,7 @@ static void list_signatures(void)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                    OSSL_PROVIDER_get0_name(EVP_SIGNATURE_get0_provider(k)));
+                OSSL_PROVIDER_get0_name(EVP_SIGNATURE_get0_provider(k)));
 
             if (verbose) {
                 const char *desc = EVP_SIGNATURE_get0_description(k);
@@ -804,9 +803,9 @@ static void list_signatures(void)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("settable operation parameters",
-                                EVP_SIGNATURE_settable_ctx_params(k), 4);
+                    EVP_SIGNATURE_settable_ctx_params(k), 4);
                 print_param_types("retrievable operation parameters",
-                                EVP_SIGNATURE_gettable_ctx_params(k), 4);
+                    EVP_SIGNATURE_gettable_ctx_params(k), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -836,8 +835,8 @@ static int list_provider_tls_sigalgs(const OSSL_PARAM params[], void *data)
 static int list_tls_sigalg_caps(OSSL_PROVIDER *provider, void *cbdata)
 {
     OSSL_PROVIDER_get_capabilities(provider, "TLS-SIGALG",
-                                   list_provider_tls_sigalgs,
-                                   cbdata);
+        list_provider_tls_sigalgs,
+        cbdata);
     /* As built-in providers don't have this capability, never error */
     return 1;
 }
@@ -869,9 +868,9 @@ static void list_tls_groups(int version, int all)
     num = sk_OPENSSL_CSTRING_num(groups);
     for (i = 0; i < num; ++i) {
         BIO_printf(bio_out, "%s%c", sk_OPENSSL_CSTRING_value(groups, i),
-                   (i < num - 1) ? ':' : '\n');
+            (i < num - 1) ? ':' : '\n');
     }
- err:
+err:
     SSL_CTX_free(ctx);
     sk_OPENSSL_CSTRING_free(groups);
     return;
@@ -893,19 +892,19 @@ static void list_tls_signatures(void)
 
     if (!OSSL_PROVIDER_do_all(NULL, list_tls_sigalg_caps, &tls_sigalg_listed))
         BIO_printf(bio_err,
-                   "ERROR: could not list all provider signature algorithms\n");
+            "ERROR: could not list all provider signature algorithms\n");
     if (tls_sigalg_listed < 2)
         BIO_printf(bio_out,
-                   "\nNo TLS sig algs registered by currently active providers");
+            "\nNo TLS sig algs registered by currently active providers");
     BIO_printf(bio_out, "\n");
 }
 
 DEFINE_STACK_OF(EVP_KEM)
-static int kem_cmp(const EVP_KEM * const *a,
-                   const EVP_KEM * const *b)
+static int kem_cmp(const EVP_KEM *const *a,
+    const EVP_KEM *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_KEM_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_KEM_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_KEM_get0_provider(*b)));
 }
 
 static void collect_kem(EVP_KEM *kem, void *stack)
@@ -913,8 +912,8 @@ static void collect_kem(EVP_KEM *kem, void *stack)
     STACK_OF(EVP_KEM) *kem_stack = stack;
 
     if (is_kem_fetchable(kem)
-            && EVP_KEM_up_ref(kem)
-            && sk_EVP_KEM_push(kem_stack, kem) <= 0)
+        && EVP_KEM_up_ref(kem)
+        && sk_EVP_KEM_push(kem_stack, kem) <= 0)
         EVP_KEM_free(kem); /* up-ref successful but push to stack failed */
 }
 
@@ -940,7 +939,7 @@ static void list_kems(void)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                       OSSL_PROVIDER_get0_name(EVP_KEM_get0_provider(k)));
+                OSSL_PROVIDER_get0_name(EVP_KEM_get0_provider(k)));
 
             if (verbose) {
                 const char *desc = EVP_KEM_get0_description(k);
@@ -948,9 +947,9 @@ static void list_kems(void)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("settable operation parameters",
-                                EVP_KEM_settable_ctx_params(k), 4);
+                    EVP_KEM_settable_ctx_params(k), 4);
                 print_param_types("retrievable operation parameters",
-                                EVP_KEM_gettable_ctx_params(k), 4);
+                    EVP_KEM_gettable_ctx_params(k), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -961,11 +960,11 @@ static void list_kems(void)
 }
 
 DEFINE_STACK_OF(EVP_ASYM_CIPHER)
-static int asymcipher_cmp(const EVP_ASYM_CIPHER * const *a,
-                          const EVP_ASYM_CIPHER * const *b)
+static int asymcipher_cmp(const EVP_ASYM_CIPHER *const *a,
+    const EVP_ASYM_CIPHER *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_ASYM_CIPHER_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_ASYM_CIPHER_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_ASYM_CIPHER_get0_provider(*b)));
 }
 
 static void collect_asymciph(EVP_ASYM_CIPHER *asym_cipher, void *stack)
@@ -973,19 +972,18 @@ static void collect_asymciph(EVP_ASYM_CIPHER *asym_cipher, void *stack)
     STACK_OF(EVP_ASYM_CIPHER) *asym_cipher_stack = stack;
 
     if (is_asym_cipher_fetchable(asym_cipher)
-            && EVP_ASYM_CIPHER_up_ref(asym_cipher)
-            && sk_EVP_ASYM_CIPHER_push(asym_cipher_stack, asym_cipher) <= 0)
+        && EVP_ASYM_CIPHER_up_ref(asym_cipher)
+        && sk_EVP_ASYM_CIPHER_push(asym_cipher_stack, asym_cipher) <= 0)
         EVP_ASYM_CIPHER_free(asym_cipher); /* up-ref successful but push to stack failed */
 }
 
 static void list_asymciphers(void)
 {
     int i, count = 0;
-    STACK_OF(EVP_ASYM_CIPHER) *asymciph_stack =
-        sk_EVP_ASYM_CIPHER_new(asymcipher_cmp);
+    STACK_OF(EVP_ASYM_CIPHER) *asymciph_stack = sk_EVP_ASYM_CIPHER_new(asymcipher_cmp);
 
     EVP_ASYM_CIPHER_do_all_provided(app_get0_libctx(), collect_asymciph,
-                                    asymciph_stack);
+        asymciph_stack);
     sk_EVP_ASYM_CIPHER_sort(asymciph_stack);
 
     for (i = 0; i < sk_EVP_ASYM_CIPHER_num(asymciph_stack); i++) {
@@ -997,13 +995,13 @@ static void list_asymciphers(void)
 
         names = sk_OPENSSL_CSTRING_new(name_cmp);
         if (names != NULL
-                && EVP_ASYM_CIPHER_names_do_all(k, collect_names, names)) {
+            && EVP_ASYM_CIPHER_names_do_all(k, collect_names, names)) {
             count++;
             BIO_printf(bio_out, "  ");
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                    OSSL_PROVIDER_get0_name(EVP_ASYM_CIPHER_get0_provider(k)));
+                OSSL_PROVIDER_get0_name(EVP_ASYM_CIPHER_get0_provider(k)));
 
             if (verbose) {
                 const char *desc = EVP_ASYM_CIPHER_get0_description(k);
@@ -1011,9 +1009,9 @@ static void list_asymciphers(void)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("settable operation parameters",
-                                EVP_ASYM_CIPHER_settable_ctx_params(k), 4);
+                    EVP_ASYM_CIPHER_settable_ctx_params(k), 4);
                 print_param_types("retrievable operation parameters",
-                                EVP_ASYM_CIPHER_gettable_ctx_params(k), 4);
+                    EVP_ASYM_CIPHER_gettable_ctx_params(k), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -1024,11 +1022,11 @@ static void list_asymciphers(void)
 }
 
 DEFINE_STACK_OF(EVP_KEYEXCH)
-static int kex_cmp(const EVP_KEYEXCH * const *a,
-                   const EVP_KEYEXCH * const *b)
+static int kex_cmp(const EVP_KEYEXCH *const *a,
+    const EVP_KEYEXCH *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_KEYEXCH_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_KEYEXCH_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_KEYEXCH_get0_provider(*b)));
 }
 
 static void collect_kex(EVP_KEYEXCH *kex, void *stack)
@@ -1036,8 +1034,8 @@ static void collect_kex(EVP_KEYEXCH *kex, void *stack)
     STACK_OF(EVP_KEYEXCH) *kex_stack = stack;
 
     if (is_keyexch_fetchable(kex)
-            && EVP_KEYEXCH_up_ref(kex)
-            && sk_EVP_KEYEXCH_push(kex_stack, kex) <= 0)
+        && EVP_KEYEXCH_up_ref(kex)
+        && sk_EVP_KEYEXCH_push(kex_stack, kex) <= 0)
         EVP_KEYEXCH_free(kex); /* up-ref successful but push to stack failed */
 }
 
@@ -1063,7 +1061,7 @@ static void list_keyexchanges(void)
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                    OSSL_PROVIDER_get0_name(EVP_KEYEXCH_get0_provider(k)));
+                OSSL_PROVIDER_get0_name(EVP_KEYEXCH_get0_provider(k)));
 
             if (verbose) {
                 const char *desc = EVP_KEYEXCH_get0_description(k);
@@ -1071,9 +1069,9 @@ static void list_keyexchanges(void)
                 if (desc != NULL)
                     BIO_printf(bio_out, "    description: %s\n", desc);
                 print_param_types("settable operation parameters",
-                                EVP_KEYEXCH_settable_ctx_params(k), 4);
+                    EVP_KEYEXCH_settable_ctx_params(k), 4);
                 print_param_types("retrievable operation parameters",
-                                EVP_KEYEXCH_gettable_ctx_params(k), 4);
+                    EVP_KEYEXCH_gettable_ctx_params(k), 4);
             }
         }
         sk_OPENSSL_CSTRING_free(names);
@@ -1112,18 +1110,18 @@ static void list_objects(void)
             continue;
         }
         if (n < 0)
-            break;               /* Error */
+            break; /* Error */
 
         if (n > oid_size) {
             oid_buf = OPENSSL_realloc(oid_buf, n + 1);
             if (oid_buf == NULL) {
                 BIO_printf(bio_err, "ERROR: Memory allocation\n");
-                break;           /* Error */
+                break; /* Error */
             }
             oid_size = n + 1;
         }
         if (OBJ_obj2txt(oid_buf, oid_size, obj, 1) < 0)
-            break;               /* Error */
+            break; /* Error */
         if (ln == NULL || strcmp(sn, ln) == 0)
             BIO_printf(bio_out, "%s = %s\n", sn, oid_buf);
         else
@@ -1143,23 +1141,23 @@ static void list_options_for_command(const char *command)
             break;
     if (fp->name == NULL) {
         BIO_printf(bio_err, "Invalid command '%s'; type \"help\" for a list.\n",
-                   command);
+            command);
         return;
     }
 
     if ((o = fp->help) == NULL)
         return;
 
-    for ( ; o->name != NULL; o++) {
+    for (; o->name != NULL; o++) {
         char c = o->valtype;
 
         if (o->name == OPT_PARAM_STR)
             break;
 
         if (o->name == OPT_HELP_STR
-                || o->name == OPT_MORE_STR
-                || o->name == OPT_SECTION_STR
-                || o->name[0] == '\0')
+            || o->name == OPT_MORE_STR
+            || o->name == OPT_SECTION_STR
+            || o->name[0] == '\0')
             continue;
         BIO_printf(bio_out, "%s %c\n", o->name, c == '\0' ? '-' : c);
     }
@@ -1252,16 +1250,15 @@ static void list_pkey(void)
             const char *pinfo, *pem_str;
             ameth = EVP_PKEY_asn1_get0(i);
             EVP_PKEY_asn1_get0_info(&pkey_id, &pkey_base_id, &pkey_flags,
-                                    &pinfo, &pem_str, ameth);
+                &pinfo, &pem_str, ameth);
             if (pkey_flags & ASN1_PKEY_ALIAS) {
                 BIO_printf(bio_out, " Name: %s\n", OBJ_nid2ln(pkey_id));
                 BIO_printf(bio_out, "\tAlias for: %s\n",
-                           OBJ_nid2ln(pkey_base_id));
+                    OBJ_nid2ln(pkey_base_id));
             } else {
                 BIO_printf(bio_out, " Name: %s\n", pinfo);
                 BIO_printf(bio_out, "\tType: %s Algorithm\n",
-                           pkey_flags & ASN1_PKEY_DYNAMIC ?
-                           "External" : "Builtin");
+                    pkey_flags & ASN1_PKEY_DYNAMIC ? "External" : "Builtin");
                 BIO_printf(bio_out, "\tOID: %s\n", OBJ_nid2ln(pkey_id));
                 if (pem_str == NULL)
                     pem_str = "(none)";
@@ -1290,7 +1287,7 @@ static void list_pkey_meth(void)
             EVP_PKEY_meth_get0_info(&pkey_id, &pkey_flags, pmeth);
             BIO_printf(bio_out, " %s\n", OBJ_nid2ln(pkey_id));
             BIO_printf(bio_out, "\tType: %s Algorithm\n",
-                       pkey_flags & ASN1_PKEY_DYNAMIC ?  "External" : "Builtin");
+                pkey_flags & ASN1_PKEY_DYNAMIC ? "External" : "Builtin");
         }
     }
 #endif
@@ -1306,11 +1303,11 @@ static void list_pkey_meth(void)
 }
 
 DEFINE_STACK_OF(OSSL_STORE_LOADER)
-static int store_cmp(const OSSL_STORE_LOADER * const *a,
-                     const OSSL_STORE_LOADER * const *b)
+static int store_cmp(const OSSL_STORE_LOADER *const *a,
+    const OSSL_STORE_LOADER *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(OSSL_STORE_LOADER_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(OSSL_STORE_LOADER_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(OSSL_STORE_LOADER_get0_provider(*b)));
 }
 
 static void collect_store_loaders(OSSL_STORE_LOADER *store, void *stack)
@@ -1318,7 +1315,7 @@ static void collect_store_loaders(OSSL_STORE_LOADER *store, void *stack)
     STACK_OF(OSSL_STORE_LOADER) *store_stack = stack;
 
     if (OSSL_STORE_LOADER_up_ref(store)
-            && sk_OSSL_STORE_LOADER_push(store_stack, store) <= 0)
+        && sk_OSSL_STORE_LOADER_push(store_stack, store) <= 0)
         OSSL_STORE_LOADER_free(store); /* up-ref successful but push to stack failed */
 }
 
@@ -1333,7 +1330,7 @@ static void list_store_loaders(void)
     }
     BIO_printf(bio_out, "Provided STORE LOADERs:\n");
     OSSL_STORE_LOADER_do_all_provided(app_get0_libctx(), collect_store_loaders,
-                                      stores);
+        stores);
     sk_OSSL_STORE_LOADER_sort(stores);
     for (i = 0; i < sk_OSSL_STORE_LOADER_num(stores); i++) {
         const OSSL_STORE_LOADER *m = sk_OSSL_STORE_LOADER_value(stores, i);
@@ -1343,13 +1340,12 @@ static void list_store_loaders(void)
             continue;
 
         names = sk_OPENSSL_CSTRING_new(name_cmp);
-        if (names != NULL && OSSL_STORE_LOADER_names_do_all(m, collect_names,
-                                                            names)) {
+        if (names != NULL && OSSL_STORE_LOADER_names_do_all(m, collect_names, names)) {
             BIO_printf(bio_out, "  ");
             print_names(bio_out, names);
 
             BIO_printf(bio_out, " @ %s\n",
-                       OSSL_PROVIDER_get0_name(OSSL_STORE_LOADER_get0_provider(m)));
+                OSSL_PROVIDER_get0_name(OSSL_STORE_LOADER_get0_provider(m)));
         }
         sk_OPENSSL_CSTRING_free(names);
     }
@@ -1357,8 +1353,8 @@ static void list_store_loaders(void)
 }
 
 DEFINE_STACK_OF(OSSL_PROVIDER)
-static int provider_cmp(const OSSL_PROVIDER * const *a,
-                        const OSSL_PROVIDER * const *b)
+static int provider_cmp(const OSSL_PROVIDER *const *a,
+    const OSSL_PROVIDER *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(*a), OSSL_PROVIDER_get0_name(*b));
 }
@@ -1403,18 +1399,18 @@ static void list_provider_info(void)
 
         /* Query the "known" information parameters, the order matches below */
         params[0] = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_NAME,
-                                                  &name, 0);
+            &name, 0);
         params[1] = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_VERSION,
-                                                  &version, 0);
+            &version, 0);
         params[2] = OSSL_PARAM_construct_int(OSSL_PROV_PARAM_STATUS, &status);
         params[3] = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_BUILDINFO,
-                                                  &buildinfo, 0);
+            &buildinfo, 0);
         params[4] = OSSL_PARAM_construct_end();
         OSSL_PARAM_set_all_unmodified(params);
         if (!OSSL_PROVIDER_get_params(prov, params)) {
             BIO_printf(bio_err,
-                       "WARNING: Unable to query provider parameters for %s\n",
-                       provname);
+                "WARNING: Unable to query provider parameters for %s\n",
+                provname);
         } else {
             /* Print out the provider information, the params order matches above */
             if (OSSL_PARAM_modified(params))
@@ -1427,7 +1423,7 @@ static void list_provider_info(void)
                 if (OSSL_PARAM_modified(params + 3))
                     BIO_printf(bio_out, "    build info: %s\n", buildinfo);
                 print_param_types("gettable provider parameters",
-                                  OSSL_PROVIDER_gettable_params(prov), 4);
+                    OSSL_PROVIDER_gettable_params(prov), 4);
             }
         }
     }
@@ -1437,7 +1433,7 @@ static void list_provider_info(void)
 #ifndef OPENSSL_NO_DEPRECATED_3_0
 static void list_engines(void)
 {
-# ifndef OPENSSL_NO_ENGINE
+#ifndef OPENSSL_NO_ENGINE
     ENGINE *e;
 
     BIO_puts(bio_out, "Engines:\n");
@@ -1446,9 +1442,9 @@ static void list_engines(void)
         BIO_printf(bio_out, "%s\n", ENGINE_get_id(e));
         e = ENGINE_get_next(e);
     }
-# else
+#else
     BIO_puts(bio_out, "Engine support is disabled.\n");
-# endif
+#endif
 }
 #endif
 
@@ -1610,26 +1606,44 @@ static void list_disabled(void)
 /* Unified enum for help and list commands. */
 typedef enum HELPLIST_CHOICE {
     OPT_COMMON,
-    OPT_ONE, OPT_VERBOSE,
+    OPT_ONE,
+    OPT_VERBOSE,
     OPT_ALL_ARGORITHMS,
-    OPT_COMMANDS, OPT_DIGEST_COMMANDS, OPT_MAC_ALGORITHMS, OPT_OPTIONS,
-    OPT_DIGEST_ALGORITHMS, OPT_CIPHER_COMMANDS, OPT_CIPHER_ALGORITHMS,
-    OPT_PK_ALGORITHMS, OPT_PK_METHOD, OPT_DISABLED,
-    OPT_KDF_ALGORITHMS, OPT_RANDOM_INSTANCES, OPT_RANDOM_GENERATORS,
-    OPT_ENCODERS, OPT_DECODERS, OPT_KEYMANAGERS, OPT_KEYEXCHANGE_ALGORITHMS,
+    OPT_COMMANDS,
+    OPT_DIGEST_COMMANDS,
+    OPT_MAC_ALGORITHMS,
+    OPT_OPTIONS,
+    OPT_DIGEST_ALGORITHMS,
+    OPT_CIPHER_COMMANDS,
+    OPT_CIPHER_ALGORITHMS,
+    OPT_PK_ALGORITHMS,
+    OPT_PK_METHOD,
+    OPT_DISABLED,
+    OPT_KDF_ALGORITHMS,
+    OPT_RANDOM_INSTANCES,
+    OPT_RANDOM_GENERATORS,
+    OPT_ENCODERS,
+    OPT_DECODERS,
+    OPT_KEYMANAGERS,
+    OPT_KEYEXCHANGE_ALGORITHMS,
     OPT_SKEYMANAGERS,
-    OPT_KEM_ALGORITHMS, OPT_SIGNATURE_ALGORITHMS,
-    OPT_TLS_SIGNATURE_ALGORITHMS, OPT_ASYM_CIPHER_ALGORITHMS,
-    OPT_STORE_LOADERS, OPT_PROVIDER_INFO, OPT_OBJECTS,
+    OPT_KEM_ALGORITHMS,
+    OPT_SIGNATURE_ALGORITHMS,
+    OPT_TLS_SIGNATURE_ALGORITHMS,
+    OPT_ASYM_CIPHER_ALGORITHMS,
+    OPT_STORE_LOADERS,
+    OPT_PROVIDER_INFO,
+    OPT_OBJECTS,
     OPT_SELECT_NAME,
 #if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
-    OPT_ALL_TLS_GROUPS, OPT_TLS_GROUPS,
-# if !defined(OPENSSL_NO_TLS1_2)
+    OPT_ALL_TLS_GROUPS,
+    OPT_TLS_GROUPS,
+#if !defined(OPENSSL_NO_TLS1_2)
     OPT_TLS1_2,
-# endif
-# if !defined(OPENSSL_NO_TLS1_3)
+#endif
+#if !defined(OPENSSL_NO_TLS1_3)
     OPT_TLS1_3,
-# endif
+#endif
 #endif
 #ifndef OPENSSL_NO_DEPRECATED_3_0
     OPT_ENGINES,
@@ -1640,83 +1654,83 @@ typedef enum HELPLIST_CHOICE {
 const OPTIONS list_options[] = {
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("Output"),
-    {"1", OPT_ONE, '-', "List in one column"},
-    {"verbose", OPT_VERBOSE, '-', "Verbose listing"},
-    {"select", OPT_SELECT_NAME, 's', "Select a single algorithm"},
-    {"commands", OPT_COMMANDS, '-', "List of standard commands"},
-    {"standard-commands", OPT_COMMANDS, '-', "List of standard commands"},
-    {"all-algorithms", OPT_ALL_ARGORITHMS, '-', "List of all algorithms"},
+    { "1", OPT_ONE, '-', "List in one column" },
+    { "verbose", OPT_VERBOSE, '-', "Verbose listing" },
+    { "select", OPT_SELECT_NAME, 's', "Select a single algorithm" },
+    { "commands", OPT_COMMANDS, '-', "List of standard commands" },
+    { "standard-commands", OPT_COMMANDS, '-', "List of standard commands" },
+    { "all-algorithms", OPT_ALL_ARGORITHMS, '-', "List of all algorithms" },
 #ifndef OPENSSL_NO_DEPRECATED_3_0
-    {"digest-commands", OPT_DIGEST_COMMANDS, '-',
-     "List of message digest commands (deprecated)"},
+    { "digest-commands", OPT_DIGEST_COMMANDS, '-',
+        "List of message digest commands (deprecated)" },
 #endif
-    {"digest-algorithms", OPT_DIGEST_ALGORITHMS, '-',
-     "List of message digest algorithms"},
-    {"kdf-algorithms", OPT_KDF_ALGORITHMS, '-',
-     "List of key derivation and pseudo random function algorithms"},
-    {"random-instances", OPT_RANDOM_INSTANCES, '-',
-     "List the primary, public and private random number generator details"},
-    {"random-generators", OPT_RANDOM_GENERATORS, '-',
-     "List of random number generators"},
-    {"mac-algorithms", OPT_MAC_ALGORITHMS, '-',
-     "List of message authentication code algorithms"},
+    { "digest-algorithms", OPT_DIGEST_ALGORITHMS, '-',
+        "List of message digest algorithms" },
+    { "kdf-algorithms", OPT_KDF_ALGORITHMS, '-',
+        "List of key derivation and pseudo random function algorithms" },
+    { "random-instances", OPT_RANDOM_INSTANCES, '-',
+        "List the primary, public and private random number generator details" },
+    { "random-generators", OPT_RANDOM_GENERATORS, '-',
+        "List of random number generators" },
+    { "mac-algorithms", OPT_MAC_ALGORITHMS, '-',
+        "List of message authentication code algorithms" },
 #ifndef OPENSSL_NO_DEPRECATED_3_0
-    {"cipher-commands", OPT_CIPHER_COMMANDS, '-',
-     "List of cipher commands (deprecated)"},
+    { "cipher-commands", OPT_CIPHER_COMMANDS, '-',
+        "List of cipher commands (deprecated)" },
 #endif
-    {"cipher-algorithms", OPT_CIPHER_ALGORITHMS, '-',
-     "List of symmetric cipher algorithms"},
-    {"encoders", OPT_ENCODERS, '-', "List of encoding methods" },
-    {"decoders", OPT_DECODERS, '-', "List of decoding methods" },
-    {"key-managers", OPT_KEYMANAGERS, '-', "List of key managers" },
-    {"skey-managers", OPT_SKEYMANAGERS, '-', "List of symmetric key managers" },
-    {"key-exchange-algorithms", OPT_KEYEXCHANGE_ALGORITHMS, '-',
-     "List of key exchange algorithms" },
-    {"kem-algorithms", OPT_KEM_ALGORITHMS, '-',
-     "List of key encapsulation mechanism algorithms" },
-    {"signature-algorithms", OPT_SIGNATURE_ALGORITHMS, '-',
-     "List of signature algorithms" },
-    {"tls-signature-algorithms", OPT_TLS_SIGNATURE_ALGORITHMS, '-',
-     "List of TLS signature algorithms" },
-    {"asymcipher-algorithms", OPT_ASYM_CIPHER_ALGORITHMS, '-',
-      "List of asymmetric cipher algorithms" },
-    {"public-key-algorithms", OPT_PK_ALGORITHMS, '-',
-     "List of public key algorithms"},
-    {"public-key-methods", OPT_PK_METHOD, '-',
-     "List of public key methods"},
-    {"store-loaders", OPT_STORE_LOADERS, '-',
-     "List of store loaders"},
+    { "cipher-algorithms", OPT_CIPHER_ALGORITHMS, '-',
+        "List of symmetric cipher algorithms" },
+    { "encoders", OPT_ENCODERS, '-', "List of encoding methods" },
+    { "decoders", OPT_DECODERS, '-', "List of decoding methods" },
+    { "key-managers", OPT_KEYMANAGERS, '-', "List of key managers" },
+    { "skey-managers", OPT_SKEYMANAGERS, '-', "List of symmetric key managers" },
+    { "key-exchange-algorithms", OPT_KEYEXCHANGE_ALGORITHMS, '-',
+        "List of key exchange algorithms" },
+    { "kem-algorithms", OPT_KEM_ALGORITHMS, '-',
+        "List of key encapsulation mechanism algorithms" },
+    { "signature-algorithms", OPT_SIGNATURE_ALGORITHMS, '-',
+        "List of signature algorithms" },
+    { "tls-signature-algorithms", OPT_TLS_SIGNATURE_ALGORITHMS, '-',
+        "List of TLS signature algorithms" },
+    { "asymcipher-algorithms", OPT_ASYM_CIPHER_ALGORITHMS, '-',
+        "List of asymmetric cipher algorithms" },
+    { "public-key-algorithms", OPT_PK_ALGORITHMS, '-',
+        "List of public key algorithms" },
+    { "public-key-methods", OPT_PK_METHOD, '-',
+        "List of public key methods" },
+    { "store-loaders", OPT_STORE_LOADERS, '-',
+        "List of store loaders" },
 #if !defined(OPENSSL_NO_TLS1_2) || !defined(OPENSSL_NO_TLS1_3)
-    {"tls-groups", OPT_TLS_GROUPS, '-',
-     "List implemented TLS key exchange 'groups'" },
-    {"all-tls-groups", OPT_ALL_TLS_GROUPS, '-',
-     "List implemented TLS key exchange 'groups' and all aliases" },
-# ifndef OPENSSL_NO_TLS1_2
-    {"tls1_2", OPT_TLS1_2, '-',
-     "When listing 'groups', list those compatible with TLS1.2"},
-# endif
-# ifndef OPENSSL_NO_TLS1_3
-    {"tls1_3", OPT_TLS1_3, '-',
-     "When listing 'groups', list those compatible with TLS1.3"},
-# endif
+    { "tls-groups", OPT_TLS_GROUPS, '-',
+        "List implemented TLS key exchange 'groups'" },
+    { "all-tls-groups", OPT_ALL_TLS_GROUPS, '-',
+        "List implemented TLS key exchange 'groups' and all aliases" },
+#ifndef OPENSSL_NO_TLS1_2
+    { "tls1_2", OPT_TLS1_2, '-',
+        "When listing 'groups', list those compatible with TLS1.2" },
+#endif
+#ifndef OPENSSL_NO_TLS1_3
+    { "tls1_3", OPT_TLS1_3, '-',
+        "When listing 'groups', list those compatible with TLS1.3" },
 #endif
-    {"providers", OPT_PROVIDER_INFO, '-',
-     "List of provider information"},
+#endif
+    { "providers", OPT_PROVIDER_INFO, '-',
+        "List of provider information" },
 #ifndef OPENSSL_NO_DEPRECATED_3_0
-    {"engines", OPT_ENGINES, '-',
-     "List of loaded engines"},
+    { "engines", OPT_ENGINES, '-',
+        "List of loaded engines" },
 #endif
-    {"disabled", OPT_DISABLED, '-', "List of disabled features"},
-    {"options", OPT_OPTIONS, 's',
-     "List options for specified command"},
-    {"objects", OPT_OBJECTS, '-',
-     "List built in objects (OID<->name mappings)"},
+    { "disabled", OPT_DISABLED, '-', "List of disabled features" },
+    { "options", OPT_OPTIONS, 's',
+        "List options for specified command" },
+    { "objects", OPT_OBJECTS, '-',
+        "List built in objects (OID<->name mappings)" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int list_main(int argc, char **argv)
@@ -1727,53 +1741,55 @@ int list_main(int argc, char **argv)
     int print_newline = 0;
 #if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
     int all_tls_groups = 0;
-# if !defined(OPENSSL_NO_TLS1_3)
+#if !defined(OPENSSL_NO_TLS1_3)
     unsigned int tls_version = TLS1_3_VERSION;
-# else
+#else
     unsigned int tls_version = TLS1_2_VERSION;
-# endif
+#endif
 #endif
     struct {
-        unsigned int commands:1;
-        unsigned int all_algorithms:1;
-        unsigned int random_instances:1;
-        unsigned int random_generators:1;
-        unsigned int digest_commands:1;
-        unsigned int digest_algorithms:1;
-        unsigned int kdf_algorithms:1;
-        unsigned int mac_algorithms:1;
-        unsigned int cipher_commands:1;
-        unsigned int cipher_algorithms:1;
-        unsigned int encoder_algorithms:1;
-        unsigned int decoder_algorithms:1;
-        unsigned int keymanager_algorithms:1;
-        unsigned int skeymanager_algorithms:1;
-        unsigned int signature_algorithms:1;
-        unsigned int tls_signature_algorithms:1;
-        unsigned int keyexchange_algorithms:1;
-        unsigned int kem_algorithms:1;
-        unsigned int tls_groups:1;
-        unsigned int asym_cipher_algorithms:1;
-        unsigned int pk_algorithms:1;
-        unsigned int pk_method:1;
-        unsigned int store_loaders:1;
-        unsigned int provider_info:1;
+        unsigned int commands : 1;
+        unsigned int all_algorithms : 1;
+        unsigned int random_instances : 1;
+        unsigned int random_generators : 1;
+        unsigned int digest_commands : 1;
+        unsigned int digest_algorithms : 1;
+        unsigned int kdf_algorithms : 1;
+        unsigned int mac_algorithms : 1;
+        unsigned int cipher_commands : 1;
+        unsigned int cipher_algorithms : 1;
+        unsigned int encoder_algorithms : 1;
+        unsigned int decoder_algorithms : 1;
+        unsigned int keymanager_algorithms : 1;
+        unsigned int skeymanager_algorithms : 1;
+        unsigned int signature_algorithms : 1;
+        unsigned int tls_signature_algorithms : 1;
+        unsigned int keyexchange_algorithms : 1;
+        unsigned int kem_algorithms : 1;
+        unsigned int tls_groups : 1;
+        unsigned int asym_cipher_algorithms : 1;
+        unsigned int pk_algorithms : 1;
+        unsigned int pk_method : 1;
+        unsigned int store_loaders : 1;
+        unsigned int provider_info : 1;
 #ifndef OPENSSL_NO_DEPRECATED_3_0
-        unsigned int engines:1;
+        unsigned int engines : 1;
 #endif
-        unsigned int disabled:1;
-        unsigned int objects:1;
-        unsigned int options:1;
-    } todo = { 0, };
+        unsigned int disabled : 1;
+        unsigned int objects : 1;
+        unsigned int options : 1;
+    } todo = {
+        0,
+    };
 
-    verbose = 0;                 /* Clear a possible previous call */
+    verbose = 0; /* Clear a possible previous call */
 
     prog = opt_init(argc, argv, list_options);
     while ((o = opt_next()) != OPT_EOF) {
         switch (o) {
-        case OPT_EOF:  /* Never hit, but suppresses warning */
+        case OPT_EOF: /* Never hit, but suppresses warning */
         case OPT_ERR:
-opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             return 1;
         case OPT_HELP:
@@ -1844,16 +1860,16 @@ opthelp:
             all_tls_groups = 1;
             todo.tls_groups = 1;
             break;
-# if !defined(OPENSSL_NO_TLS1_2)
+#if !defined(OPENSSL_NO_TLS1_2)
         case OPT_TLS1_2:
             tls_version = TLS1_2_VERSION;
             break;
-# endif
-# if !defined(OPENSSL_NO_TLS1_3)
+#endif
+#if !defined(OPENSSL_NO_TLS1_3)
         case OPT_TLS1_3:
             tls_version = TLS1_3_VERSION;
             break;
-# endif
+#endif
 #endif
         case OPT_ASYM_CIPHER_ALGORITHMS:
             todo.asym_cipher_algorithms = 1;
@@ -1902,12 +1918,12 @@ opthelp:
     if (!opt_check_rest_arg(NULL))
         goto opthelp;
 
-#define MAYBE_ADD_NL(cmd) \
-    do { \
-        if (print_newline++) { \
+#define MAYBE_ADD_NL(cmd)              \
+    do {                               \
+        if (print_newline++) {         \
             BIO_printf(bio_out, "\n"); \
-        } \
-        cmd; \
+        }                              \
+        cmd;                           \
     } while (0)
 
     if (todo.commands)
diff --git a/crypto/openssl/apps/mac.c b/crypto/openssl/apps/mac.c
index 0a07b2ea4332..9e0f4d8ede55 100644
--- a/crypto/openssl/apps/mac.c
+++ b/crypto/openssl/apps/mac.c
@@ -18,42 +18,46 @@
 #include <openssl/core_names.h>
 
 #undef BUFSIZE
-#define BUFSIZE 1024*8
+#define BUFSIZE 1024 * 8
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_MACOPT, OPT_BIN, OPT_IN, OPT_OUT,
-    OPT_CIPHER, OPT_DIGEST,
+    OPT_MACOPT,
+    OPT_BIN,
+    OPT_IN,
+    OPT_OUT,
+    OPT_CIPHER,
+    OPT_DIGEST,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS mac_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] mac_name\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] mac_name\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form"},
-    {"cipher", OPT_CIPHER, 's', "Cipher"},
-    {"digest", OPT_DIGEST, 's', "Digest"},
-    {OPT_MORE_STR, 1, '-', "See 'PARAMETER NAMES' in the EVP_MAC_ docs"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form" },
+    { "cipher", OPT_CIPHER, 's', "Cipher" },
+    { "digest", OPT_DIGEST, 's', "Digest" },
+    { OPT_MORE_STR, 1, '-', "See 'PARAMETER NAMES' in the EVP_MAC_ docs" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file to MAC (default is stdin)"},
+    { "in", OPT_IN, '<', "Input file to MAC (default is stdin)" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output to filename rather than stdout"},
-    {"binary", OPT_BIN, '-',
-        "Output in binary format (default is hexadecimal)"},
+    { "out", OPT_OUT, '>', "Output to filename rather than stdout" },
+    { "binary", OPT_BIN, '-',
+        "Output in binary format (default is hexadecimal)" },
 
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"mac_name", 0, 0, "MAC algorithm"},
-    {NULL}
+    { "mac_name", 0, 0, "MAC algorithm" },
+    { NULL }
 };
 
 static char *alloc_mac_algorithm_name(STACK_OF(OPENSSL_STRING) **optp,
-                                      const char *name, const char *arg)
+    const char *name, const char *arg)
 {
     size_t len = strlen(name) + strlen(arg) + 2;
     char *res;
@@ -95,7 +99,7 @@ int mac_main(int argc, char **argv)
     while ((o = opt_next()) != OPT_EOF) {
         switch (o) {
         default:
-opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto err;
         case OPT_HELP:
@@ -155,7 +159,7 @@ opthelp:
         int ok = 1;
 
         params = app_params_new_from_opts(opts,
-                                          EVP_MAC_settable_ctx_params(mac));
+            EVP_MAC_settable_ctx_params(mac));
         if (params == NULL)
             goto err;
 
diff --git a/crypto/openssl/apps/nseq.c b/crypto/openssl/apps/nseq.c
index e66b58d95705..58b830b03159 100644
--- a/crypto/openssl/apps/nseq.c
+++ b/crypto/openssl/apps/nseq.c
@@ -16,23 +16,25 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_TOSEQ, OPT_IN, OPT_OUT,
+    OPT_TOSEQ,
+    OPT_IN,
+    OPT_OUT,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS nseq_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
+    { "in", OPT_IN, '<', "Input file" },
 
     OPT_SECTION("Output"),
-    {"toseq", OPT_TOSEQ, '-', "Output NS Sequence file"},
-    {"out", OPT_OUT, '>', "Output file"},
+    { "toseq", OPT_TOSEQ, '-', "Output NS Sequence file" },
+    { "out", OPT_OUT, '>', "Output file" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int nseq_main(int argc, char **argv)
@@ -49,7 +51,7 @@ int nseq_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -97,7 +99,7 @@ int nseq_main(int argc, char **argv)
 
         if (!sk_X509_num(seq->certs)) {
             BIO_printf(bio_err, "%s: Error reading certs file %s\n",
-                       prog, infile);
+                prog, infile);
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -109,7 +111,7 @@ int nseq_main(int argc, char **argv)
     seq = PEM_read_bio_NETSCAPE_CERT_SEQUENCE(in, NULL, NULL, NULL);
     if (seq == NULL) {
         BIO_printf(bio_err, "%s: Error reading sequence file %s\n",
-                   prog, infile);
+            prog, infile);
         ERR_print_errors(bio_err);
         goto end;
     }
@@ -120,7 +122,7 @@ int nseq_main(int argc, char **argv)
         PEM_write_bio_X509(out, x509);
     }
     ret = 0;
- end:
+end:
     BIO_free(in);
     BIO_free_all(out);
     NETSCAPE_CERT_SEQUENCE_free(seq);
diff --git a/crypto/openssl/apps/ocsp.c b/crypto/openssl/apps/ocsp.c
index 95a95f56cb99..a9b248d3a198 100644
--- a/crypto/openssl/apps/ocsp.c
+++ b/crypto/openssl/apps/ocsp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2001-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -10,8 +10,8 @@
 #include <openssl/opensslconf.h>
 
 #ifdef OPENSSL_SYS_VMS
-  /* So fd_set and friends get properly defined on OpenVMS */
-# define _XOPEN_SOURCE_EXTENDED
+/* So fd_set and friends get properly defined on OpenVMS */
+#define _XOPEN_SOURCE_EXTENDED
 #endif
 
 #include <stdio.h>
@@ -44,33 +44,33 @@ int setpgid(pid_t pid, pid_t pgid)
 pid_t fork(void)
 {
     errno = ENOSYS;
-    return (pid_t) -1;
+    return (pid_t)-1;
 }
 #endif
 /* Maximum leeway in validity period: default 5 minutes */
-#define MAX_VALIDITY_PERIOD    (5 * 60)
+#define MAX_VALIDITY_PERIOD (5 * 60)
 
 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
-                         const EVP_MD *cert_id_md, X509 *issuer,
-                         STACK_OF(OCSP_CERTID) *ids);
+    const EVP_MD *cert_id_md, X509 *issuer,
+    STACK_OF(OCSP_CERTID) *ids);
 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial,
-                           const EVP_MD *cert_id_md, X509 *issuer,
-                           STACK_OF(OCSP_CERTID) *ids);
+    const EVP_MD *cert_id_md, X509 *issuer,
+    STACK_OF(OCSP_CERTID) *ids);
 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
-                              STACK_OF(OPENSSL_STRING) *names,
-                              STACK_OF(OCSP_CERTID) *ids, long nsec,
-                              long maxage);
+    STACK_OF(OPENSSL_STRING) *names,
+    STACK_OF(OCSP_CERTID) *ids, long nsec,
+    long maxage);
 static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req,
-                              CA_DB *db, STACK_OF(X509) *ca, X509 *rcert,
-                              EVP_PKEY *rkey, const EVP_MD *md,
-                              STACK_OF(OPENSSL_STRING) *sigopts,
-                              STACK_OF(X509) *rother, unsigned long flags,
-                              int nmin, int ndays, int badsig,
-                              const EVP_MD *resp_md);
+    CA_DB *db, STACK_OF(X509) *ca, X509 *rcert,
+    EVP_PKEY *rkey, const EVP_MD *md,
+    STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(X509) *rother, unsigned long flags,
+    int nmin, int ndays, int badsig,
+    const EVP_MD *resp_md);
 
 static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser);
 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
-                        int timeout);
+    int timeout);
 static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp);
 static char *prog;
 
@@ -80,131 +80,175 @@ static int index_changed(CA_DB *);
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_OUTFILE, OPT_TIMEOUT, OPT_URL, OPT_HOST, OPT_PORT,
+    OPT_OUTFILE,
+    OPT_TIMEOUT,
+    OPT_URL,
+    OPT_HOST,
+    OPT_PORT,
 #ifndef OPENSSL_NO_SOCK
-    OPT_PROXY, OPT_NO_PROXY,
+    OPT_PROXY,
+    OPT_NO_PROXY,
 #endif
-    OPT_IGNORE_ERR, OPT_NOVERIFY, OPT_NONCE, OPT_NO_NONCE,
-    OPT_RESP_NO_CERTS, OPT_RESP_KEY_ID, OPT_NO_CERTS,
-    OPT_NO_SIGNATURE_VERIFY, OPT_NO_CERT_VERIFY, OPT_NO_CHAIN,
-    OPT_NO_CERT_CHECKS, OPT_NO_EXPLICIT, OPT_TRUST_OTHER,
-    OPT_NO_INTERN, OPT_BADSIG, OPT_TEXT, OPT_REQ_TEXT, OPT_RESP_TEXT,
-    OPT_REQIN, OPT_RESPIN, OPT_SIGNER, OPT_VAFILE, OPT_SIGN_OTHER,
-    OPT_VERIFY_OTHER, OPT_CAFILE, OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE,
-    OPT_NOCAPATH, OPT_NOCASTORE,
-    OPT_VALIDITY_PERIOD, OPT_STATUS_AGE, OPT_SIGNKEY, OPT_REQOUT,
-    OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL,
-    OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER,
-    OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_RSIGOPT, OPT_HEADER,
+    OPT_IGNORE_ERR,
+    OPT_NOVERIFY,
+    OPT_NONCE,
+    OPT_NO_NONCE,
+    OPT_RESP_NO_CERTS,
+    OPT_RESP_KEY_ID,
+    OPT_NO_CERTS,
+    OPT_NO_SIGNATURE_VERIFY,
+    OPT_NO_CERT_VERIFY,
+    OPT_NO_CHAIN,
+    OPT_NO_CERT_CHECKS,
+    OPT_NO_EXPLICIT,
+    OPT_TRUST_OTHER,
+    OPT_NO_INTERN,
+    OPT_BADSIG,
+    OPT_TEXT,
+    OPT_REQ_TEXT,
+    OPT_RESP_TEXT,
+    OPT_REQIN,
+    OPT_RESPIN,
+    OPT_SIGNER,
+    OPT_VAFILE,
+    OPT_SIGN_OTHER,
+    OPT_VERIFY_OTHER,
+    OPT_CAFILE,
+    OPT_CAPATH,
+    OPT_CASTORE,
+    OPT_NOCAFILE,
+    OPT_NOCAPATH,
+    OPT_NOCASTORE,
+    OPT_VALIDITY_PERIOD,
+    OPT_STATUS_AGE,
+    OPT_SIGNKEY,
+    OPT_REQOUT,
+    OPT_RESPOUT,
+    OPT_PATH,
+    OPT_ISSUER,
+    OPT_CERT,
+    OPT_SERIAL,
+    OPT_INDEX,
+    OPT_CA,
+    OPT_NMIN,
+    OPT_REQUEST,
+    OPT_NDAYS,
+    OPT_RSIGNER,
+    OPT_RKEY,
+    OPT_ROTHER,
+    OPT_RMD,
+    OPT_RSIGOPT,
+    OPT_HEADER,
     OPT_PASSIN,
     OPT_RCID,
     OPT_V_ENUM,
     OPT_MD,
-    OPT_MULTI, OPT_PROV_ENUM
+    OPT_MULTI,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS ocsp_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"ignore_err", OPT_IGNORE_ERR, '-',
-     "Ignore error on OCSP request or response and continue running"},
-    {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
-    {"CApath", OPT_CAPATH, '<', "Trusted certificates directory"},
-    {"CAstore", OPT_CASTORE, ':', "Trusted certificates store URI"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load certificates from the default certificates store"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "ignore_err", OPT_IGNORE_ERR, '-',
+        "Ignore error on OCSP request or response and continue running" },
+    { "CAfile", OPT_CAFILE, '<', "Trusted certificates file" },
+    { "CApath", OPT_CAPATH, '<', "Trusted certificates directory" },
+    { "CAstore", OPT_CASTORE, ':', "Trusted certificates store URI" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load certificates from the default certificates directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load certificates from the default certificates store" },
 
     OPT_SECTION("Responder"),
-    {"timeout", OPT_TIMEOUT, 'p',
-     "Connection timeout (in seconds) to the OCSP responder"},
-    {"resp_no_certs", OPT_RESP_NO_CERTS, '-',
-     "Don't include any certificates in response"},
+    { "timeout", OPT_TIMEOUT, 'p',
+        "Connection timeout (in seconds) to the OCSP responder" },
+    { "resp_no_certs", OPT_RESP_NO_CERTS, '-',
+        "Don't include any certificates in response" },
 #ifdef HTTP_DAEMON
-    {"multi", OPT_MULTI, 'p', "run multiple responder processes"},
+    { "multi", OPT_MULTI, 'p', "run multiple responder processes" },
 #endif
-    {"no_certs", OPT_NO_CERTS, '-',
-     "Don't include any certificates in signed request"},
-    {"badsig", OPT_BADSIG, '-',
-        "Corrupt last byte of loaded OCSP response signature (for test)"},
-    {"CA", OPT_CA, '<', "CA certificates"},
-    {"nmin", OPT_NMIN, 'p', "Number of minutes before next update"},
-    {"nrequest", OPT_REQUEST, 'p',
-     "Number of requests to accept (default unlimited)"},
-    {"reqin", OPT_REQIN, 's', "File with the DER-encoded request"},
-    {"signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with"},
-    {"sign_other", OPT_SIGN_OTHER, '<',
-     "Additional certificates to include in signed request"},
-    {"index", OPT_INDEX, '<', "Certificate status index file"},
-    {"ndays", OPT_NDAYS, 'p', "Number of days before next update"},
-    {"rsigner", OPT_RSIGNER, '<',
-     "Responder certificate to sign responses with"},
-    {"rkey", OPT_RKEY, '<', "Responder key to sign responses with"},
-    {"passin", OPT_PASSIN, 's', "Responder key pass phrase source"},
-    {"rother", OPT_ROTHER, '<', "Other certificates to include in response"},
-    {"rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response"},
-    {"rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form"},
-    {"header", OPT_HEADER, 's', "key=value header to add"},
-    {"rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response"},
-    {"", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )"},
+    { "no_certs", OPT_NO_CERTS, '-',
+        "Don't include any certificates in signed request" },
+    { "badsig", OPT_BADSIG, '-',
+        "Corrupt last byte of loaded OCSP response signature (for test)" },
+    { "CA", OPT_CA, '<', "CA certificates" },
+    { "nmin", OPT_NMIN, 'p', "Number of minutes before next update" },
+    { "nrequest", OPT_REQUEST, 'p',
+        "Number of requests to accept (default unlimited)" },
+    { "reqin", OPT_REQIN, 's', "File with the DER-encoded request" },
+    { "signer", OPT_SIGNER, '<', "Certificate to sign OCSP request with" },
+    { "sign_other", OPT_SIGN_OTHER, '<',
+        "Additional certificates to include in signed request" },
+    { "index", OPT_INDEX, '<', "Certificate status index file" },
+    { "ndays", OPT_NDAYS, 'p', "Number of days before next update" },
+    { "rsigner", OPT_RSIGNER, '<',
+        "Responder certificate to sign responses with" },
+    { "rkey", OPT_RKEY, '<', "Responder key to sign responses with" },
+    { "passin", OPT_PASSIN, 's', "Responder key pass phrase source" },
+    { "rother", OPT_ROTHER, '<', "Other certificates to include in response" },
+    { "rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response" },
+    { "rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form" },
+    { "header", OPT_HEADER, 's', "key=value header to add" },
+    { "rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response" },
+    { "", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )" },
 
     OPT_SECTION("Client"),
-    {"url", OPT_URL, 's', "Responder URL"},
-    {"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"},
-    {"port", OPT_PORT, 'N', "Port to run responder on"},
-    {"path", OPT_PATH, 's', "Path to use in OCSP request"},
+    { "url", OPT_URL, 's', "Responder URL" },
+    { "host", OPT_HOST, 's', "TCP/IP hostname:port to connect to" },
+    { "port", OPT_PORT, 'N', "Port to run responder on" },
+    { "path", OPT_PATH, 's', "Path to use in OCSP request" },
 #ifndef OPENSSL_NO_SOCK
-    {"proxy", OPT_PROXY, 's',
-     "[http[s]://]host[:port][/path] of HTTP(S) proxy to use; path is ignored"},
-    {"no_proxy", OPT_NO_PROXY, 's',
-     "List of addresses of servers not to use HTTP(S) proxy for"},
-    {OPT_MORE_STR, 0, 0,
-     "Default from environment variable 'no_proxy', else 'NO_PROXY', else none"},
+    { "proxy", OPT_PROXY, 's',
+        "[http[s]://]host[:port][/path] of HTTP(S) proxy to use; path is ignored" },
+    { "no_proxy", OPT_NO_PROXY, 's',
+        "List of addresses of servers not to use HTTP(S) proxy for" },
+    { OPT_MORE_STR, 0, 0,
+        "Default from environment variable 'no_proxy', else 'NO_PROXY', else none" },
 #endif
-    {"out", OPT_OUTFILE, '>', "Output filename"},
-    {"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"},
-    {"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"},
-    {"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"},
-    {"no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-',
-     "Don't check signature on response"},
-    {"resp_key_id", OPT_RESP_KEY_ID, '-',
-     "Identify response by signing certificate key ID"},
-    {"no_cert_verify", OPT_NO_CERT_VERIFY, '-',
-     "Don't check signing certificate"},
-    {"text", OPT_TEXT, '-', "Print text form of request and response"},
-    {"req_text", OPT_REQ_TEXT, '-', "Print text form of request"},
-    {"resp_text", OPT_RESP_TEXT, '-', "Print text form of response"},
-    {"no_chain", OPT_NO_CHAIN, '-', "Don't chain verify response"},
-    {"no_cert_checks", OPT_NO_CERT_CHECKS, '-',
-     "Don't do additional checks on signing certificate"},
-    {"no_explicit", OPT_NO_EXPLICIT, '-',
-     "Do not explicitly check the chain, just verify the root"},
-    {"trust_other", OPT_TRUST_OTHER, '-',
-     "Don't verify additional certificates"},
-    {"no_intern", OPT_NO_INTERN, '-',
-     "Don't search certificates contained in response for signer"},
-    {"respin", OPT_RESPIN, 's', "File with the DER-encoded response"},
-    {"VAfile", OPT_VAFILE, '<', "Validator certificates file"},
-    {"verify_other", OPT_VERIFY_OTHER, '<',
-     "Additional certificates to search for signer"},
-    {"cert", OPT_CERT, '<',
-     "Certificate to check; may be given multiple times"},
-    {"serial", OPT_SERIAL, 's',
-     "Serial number to check; may be given multiple times"},
-    {"validity_period", OPT_VALIDITY_PERIOD, 'u',
-     "Maximum validity discrepancy in seconds"},
-    {"signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with"},
-    {"reqout", OPT_REQOUT, 's', "Output file for the DER-encoded request"},
-    {"respout", OPT_RESPOUT, 's', "Output file for the DER-encoded response"},
-    {"issuer", OPT_ISSUER, '<', "Issuer certificate"},
-    {"status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds"},
+    { "out", OPT_OUTFILE, '>', "Output filename" },
+    { "noverify", OPT_NOVERIFY, '-', "Don't verify response at all" },
+    { "nonce", OPT_NONCE, '-', "Add OCSP nonce to request" },
+    { "no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request" },
+    { "no_signature_verify", OPT_NO_SIGNATURE_VERIFY, '-',
+        "Don't check signature on response" },
+    { "resp_key_id", OPT_RESP_KEY_ID, '-',
+        "Identify response by signing certificate key ID" },
+    { "no_cert_verify", OPT_NO_CERT_VERIFY, '-',
+        "Don't check signing certificate" },
+    { "text", OPT_TEXT, '-', "Print text form of request and response" },
+    { "req_text", OPT_REQ_TEXT, '-', "Print text form of request" },
+    { "resp_text", OPT_RESP_TEXT, '-', "Print text form of response" },
+    { "no_chain", OPT_NO_CHAIN, '-', "Don't chain verify response" },
+    { "no_cert_checks", OPT_NO_CERT_CHECKS, '-',
+        "Don't do additional checks on signing certificate" },
+    { "no_explicit", OPT_NO_EXPLICIT, '-',
+        "Do not explicitly check the chain, just verify the root" },
+    { "trust_other", OPT_TRUST_OTHER, '-',
+        "Don't verify additional certificates" },
+    { "no_intern", OPT_NO_INTERN, '-',
+        "Don't search certificates contained in response for signer" },
+    { "respin", OPT_RESPIN, 's', "File with the DER-encoded response" },
+    { "VAfile", OPT_VAFILE, '<', "Validator certificates file" },
+    { "verify_other", OPT_VERIFY_OTHER, '<',
+        "Additional certificates to search for signer" },
+    { "cert", OPT_CERT, '<',
+        "Certificate to check; may be given multiple times" },
+    { "serial", OPT_SERIAL, 's',
+        "Serial number to check; may be given multiple times" },
+    { "validity_period", OPT_VALIDITY_PERIOD, 'u',
+        "Maximum validity discrepancy in seconds" },
+    { "signkey", OPT_SIGNKEY, 's', "Private key to sign OCSP request with" },
+    { "reqout", OPT_REQOUT, 's', "Output file for the DER-encoded request" },
+    { "respout", OPT_RESPOUT, 's', "Output file for the DER-encoded response" },
+    { "issuer", OPT_ISSUER, '<', "Issuer certificate" },
+    { "status_age", OPT_STATUS_AGE, 'p', "Maximum status age in seconds" },
 
     OPT_V_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int ocsp_main(int argc, char **argv)
@@ -253,8 +297,8 @@ int ocsp_main(int argc, char **argv)
     OPTION_CHOICE o;
 
     if ((reqnames = sk_OPENSSL_STRING_new_null()) == NULL
-            || (ids = sk_OCSP_CERTID_new_null()) == NULL
-            || (vpm = X509_VERIFY_PARAM_new()) == NULL)
+        || (ids = sk_OCSP_CERTID_new_null()) == NULL
+        || (vpm = X509_VERIFY_PARAM_new()) == NULL)
         goto end;
 
     opt_set_unknown_name("digest");
@@ -263,7 +307,7 @@ int ocsp_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -284,8 +328,8 @@ int ocsp_main(int argc, char **argv)
             OPENSSL_free(tpath);
             thost = tport = tpath = NULL;
             if (!OSSL_HTTP_parse_url(opt_arg(), &use_ssl, NULL /* userinfo */,
-                                     &host, &port, NULL /* port_num */,
-                                     &path, NULL /* qry */, NULL /* frag */)) {
+                    &host, &port, NULL /* port_num */,
+                    &path, NULL /* qry */, NULL /* frag */)) {
                 BIO_printf(bio_err, "%s Error parsing -url argument\n", prog);
                 goto end;
             }
@@ -485,7 +529,7 @@ int ocsp_main(int argc, char **argv)
         case OPT_ROTHER:
             rcertfile = opt_arg();
             break;
-        case OPT_RMD:   /* Response MessageDigest */
+        case OPT_RMD: /* Response MessageDigest */
             respdigname = opt_arg();
             break;
         case OPT_RSIGOPT:
@@ -513,8 +557,8 @@ int ocsp_main(int argc, char **argv)
         case OPT_MD:
             if (trailing_md) {
                 BIO_printf(bio_err,
-                           "%s: Digest must be before -cert or -serial\n",
-                           prog);
+                    "%s: Digest must be before -cert or -serial\n",
+                    prog);
                 goto opthelp;
             }
             if (!opt_md(opt_unknown(), &cert_id_md))
@@ -539,7 +583,7 @@ int ocsp_main(int argc, char **argv)
 
     if (trailing_md) {
         BIO_printf(bio_err, "%s: Digest must be before -cert or -serial\n",
-                   prog);
+            prog);
         goto opthelp;
     }
 
@@ -591,7 +635,7 @@ int ocsp_main(int argc, char **argv)
             goto end;
         if (rcertfile != NULL) {
             if (!load_certs(rcertfile, 0, &rother, NULL,
-                            "responder other certificates"))
+                    "responder other certificates"))
                 goto end;
         }
         if (!app_passwd(passinarg, NULL, &passin, NULL)) {
@@ -599,7 +643,7 @@ int ocsp_main(int argc, char **argv)
             goto end;
         }
         rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin, NULL,
-                        "responder private key");
+            "responder private key");
         if (rkey == NULL)
             goto end;
     }
@@ -607,7 +651,7 @@ int ocsp_main(int argc, char **argv)
     if (ridx_filename != NULL
         && (rkey == NULL || rsigner == NULL || rca_certs == NULL)) {
         BIO_printf(bio_err,
-                   "Responder mode requires certificate, key, and CA.\n");
+            "Responder mode requires certificate, key, and CA.\n");
         goto end;
     }
 
@@ -631,7 +675,7 @@ int ocsp_main(int argc, char **argv)
 
     if (acbio != NULL)
         trace_log_message(-1, prog,
-                          LOG_INFO, "waiting for OCSP client connections...");
+            LOG_INFO, "waiting for OCSP client connections...");
 
 redo_accept:
 
@@ -646,8 +690,8 @@ redo_accept:
             } else {
                 free_index(newrdb);
                 trace_log_message(-1, prog,
-                                  LOG_ERR, "error reloading updated index: %s",
-                                  ridx_filename);
+                    LOG_ERR, "error reloading updated index: %s",
+                    ridx_filename);
             }
         }
 #endif
@@ -659,9 +703,8 @@ redo_accept:
 
         if (req == NULL) {
             if (res == 1) {
-                resp =
-                    OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST,
-                                         NULL);
+                resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST,
+                    NULL);
                 if (resp != NULL)
                     send_ocsp_response(cbio, resp);
             }
@@ -691,16 +734,16 @@ redo_accept:
         }
         if (sign_certfile != NULL) {
             if (!load_certs(sign_certfile, 0, &sign_other, NULL,
-                            "signer certificates"))
+                    "signer certificates"))
                 goto end;
         }
         key = load_key(keyfile, FORMAT_UNDEF, 0, NULL, NULL,
-                       "signer private key");
+            "signer private key");
         if (key == NULL)
             goto end;
 
         if (!OCSP_request_sign(req, signer, key, NULL,
-                               sign_other, sign_flags)) {
+                sign_other, sign_flags)) {
             BIO_printf(bio_err, "Error signing OCSP request\n");
             goto end;
         }
@@ -723,8 +766,8 @@ redo_accept:
 
     if (rdb != NULL) {
         make_ocsp_response(bio_err, &resp, req, rdb, rca_certs, rsigner, rkey,
-                           rsign_md, rsign_sigopts, rother, rflags, nmin, ndays,
-                           badsig, resp_certid_md);
+            rsign_md, rsign_sigopts, rother, rflags, nmin, ndays,
+            badsig, resp_certid_md);
         if (resp == NULL)
             goto end;
         if (cbio != NULL)
@@ -732,12 +775,12 @@ redo_accept:
     } else if (host != NULL) {
 #ifndef OPENSSL_NO_SOCK
         resp = process_responder(req, host, port, path, opt_proxy, opt_no_proxy,
-                                 use_ssl, headers, req_timeout);
+            use_ssl, headers, req_timeout);
         if (resp == NULL)
             goto end;
 #else
         BIO_printf(bio_err,
-                   "Error creating connect BIO - sockets not supported\n");
+            "Error creating connect BIO - sockets not supported\n");
         goto end;
 #endif
     } else if (respin != NULL) {
@@ -755,7 +798,7 @@ redo_accept:
         goto end;
     }
 
- done_resp:
+done_resp:
 
     if (respout != NULL) {
         derbio = bio_open_default(respout, 'w', FORMAT_ASN1);
@@ -769,7 +812,7 @@ redo_accept:
         i = OCSP_response_status(resp);
         if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
             BIO_printf(out, "Responder Error: %s (%d)\n",
-                       OCSP_response_status_str(i), i);
+                OCSP_response_status_str(i), i);
             if (!ignore_err)
                 goto end;
         }
@@ -800,7 +843,7 @@ redo_accept:
 
     if (store == NULL) {
         store = setup_verify(CAfile, noCAfile, CApath, noCApath,
-                             CAstore, noCAstore);
+            CAstore, noCAstore);
         if (!store)
             goto end;
     }
@@ -808,7 +851,7 @@ redo_accept:
         X509_STORE_set1_param(store, vpm);
     if (verify_certfile != NULL) {
         if (!load_certs(verify_certfile, 0, &verify_other, NULL,
-                        "validator certificates"))
+                "validator certificates"))
             goto end;
     }
 
@@ -849,7 +892,7 @@ redo_accept:
     if (!print_ocsp_summary(out, bs, req, reqnames, ids, nsec, maxage))
         ret = 1;
 
- end:
+end:
     ERR_print_errors(bio_err);
     X509_free(signer);
     X509_STORE_free(store);
@@ -904,8 +947,8 @@ static int index_changed(CA_DB *rdb)
 #endif
 
 static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
-                         const EVP_MD *cert_id_md, X509 *issuer,
-                         STACK_OF(OCSP_CERTID) *ids)
+    const EVP_MD *cert_id_md, X509 *issuer,
+    STACK_OF(OCSP_CERTID) *ids)
 {
     OCSP_CERTID *id;
 
@@ -924,14 +967,14 @@ static int add_ocsp_cert(OCSP_REQUEST **req, X509 *cert,
         goto err;
     return 1;
 
- err:
+err:
     BIO_printf(bio_err, "Error Creating OCSP request\n");
     return 0;
 }
 
 static int add_ocsp_serial(OCSP_REQUEST **req, char *serial,
-                           const EVP_MD *cert_id_md, X509 *issuer,
-                           STACK_OF(OCSP_CERTID) *ids)
+    const EVP_MD *cert_id_md, X509 *issuer,
+    STACK_OF(OCSP_CERTID) *ids)
 {
     OCSP_CERTID *id;
     const X509_NAME *iname;
@@ -961,15 +1004,15 @@ static int add_ocsp_serial(OCSP_REQUEST **req, char *serial,
         goto err;
     return 1;
 
- err:
+err:
     BIO_printf(bio_err, "Error Creating OCSP request\n");
     return 0;
 }
 
 static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
-                              STACK_OF(OPENSSL_STRING) *names,
-                              STACK_OF(OCSP_CERTID) *ids, long nsec,
-                              long maxage)
+    STACK_OF(OPENSSL_STRING) *names,
+    STACK_OF(OCSP_CERTID) *ids, long nsec,
+    long maxage)
 {
     OCSP_CERTID *id;
     const char *name;
@@ -989,7 +1032,7 @@ static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
         BIO_printf(out, "%s: ", name);
 
         if (!OCSP_resp_find_status(bs, id, &status, &reason,
-                                   &rev, &thisupd, &nextupd)) {
+                &rev, &thisupd, &nextupd)) {
             BIO_puts(out, "ERROR: No Status found.\n");
             ret = 0;
             continue;
@@ -1029,12 +1072,12 @@ static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
 }
 
 static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req,
-                              CA_DB *db, STACK_OF(X509) *ca, X509 *rcert,
-                              EVP_PKEY *rkey, const EVP_MD *rmd,
-                              STACK_OF(OPENSSL_STRING) *sigopts,
-                              STACK_OF(X509) *rother, unsigned long flags,
-                              int nmin, int ndays, int badsig,
-                              const EVP_MD *resp_md)
+    CA_DB *db, STACK_OF(X509) *ca, X509 *rcert,
+    EVP_PKEY *rkey, const EVP_MD *rmd,
+    STACK_OF(OPENSSL_STRING) *sigopts,
+    STACK_OF(X509) *rother, unsigned long flags,
+    int nmin, int ndays, int badsig,
+    const EVP_MD *resp_md)
 {
     ASN1_TIME *thisupd = NULL, *nextupd = NULL;
     OCSP_CERTID *cid;
@@ -1046,8 +1089,7 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
     id_count = OCSP_request_onereq_count(req);
 
     if (id_count <= 0) {
-        *resp =
-            OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
+        *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, NULL);
         goto end;
     }
 
@@ -1079,13 +1121,19 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
         cert_id_md = EVP_get_digestbyobj(cert_id_md_oid);
         if (cert_id_md == NULL) {
             *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
-                                         NULL);
+                NULL);
             goto end;
         }
         for (jj = 0; jj < sk_X509_num(ca) && !found; jj++) {
             X509 *ca_cert = sk_X509_value(ca, jj);
             OCSP_CERTID *ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca_cert);
 
+            if (ca_id == NULL) {
+                *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
+                    NULL);
+                goto end;
+            }
+
             if (OCSP_id_issuer_cmp(ca_id, cid) == 0) {
                 found = 1;
                 if (resp_md != NULL)
@@ -1101,18 +1149,18 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
 
         if (!found) {
             OCSP_basic_add1_status(bs, cid,
-                                   V_OCSP_CERTSTATUS_UNKNOWN,
-                                   0, NULL, thisupd, nextupd);
+                V_OCSP_CERTSTATUS_UNKNOWN,
+                0, NULL, thisupd, nextupd);
             continue;
         }
         if (inf == NULL) {
             OCSP_basic_add1_status(bs, cid,
-                                   V_OCSP_CERTSTATUS_UNKNOWN,
-                                   0, NULL, thisupd, nextupd);
+                V_OCSP_CERTSTATUS_UNKNOWN,
+                0, NULL, thisupd, nextupd);
         } else if (inf[DB_type][0] == DB_TYPE_VAL) {
             OCSP_basic_add1_status(bs, cid,
-                                   V_OCSP_CERTSTATUS_GOOD,
-                                   0, NULL, thisupd, nextupd);
+                V_OCSP_CERTSTATUS_GOOD,
+                0, NULL, thisupd, nextupd);
         } else if (inf[DB_type][0] == DB_TYPE_REV) {
             ASN1_OBJECT *inst = NULL;
             ASN1_TIME *revtm = NULL;
@@ -1122,20 +1170,20 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
 
             unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]);
             single = OCSP_basic_add1_status(bs, cid,
-                                            V_OCSP_CERTSTATUS_REVOKED,
-                                            reason, revtm, thisupd, nextupd);
+                V_OCSP_CERTSTATUS_REVOKED,
+                reason, revtm, thisupd, nextupd);
             if (single == NULL) {
                 *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
-                                             NULL);
+                    NULL);
                 goto end;
             }
             if (invtm != NULL)
                 OCSP_SINGLERESP_add1_ext_i2d(single, NID_invalidity_date,
-                                             invtm, 0, 0);
+                    invtm, 0, 0);
             else if (inst != NULL)
                 OCSP_SINGLERESP_add1_ext_i2d(single,
-                                             NID_hold_instruction_code, inst,
-                                             0, 0);
+                    NID_hold_instruction_code, inst,
+                    0, 0);
             ASN1_OBJECT_free(inst);
             ASN1_TIME_free(revtm);
             ASN1_GENERALIZEDTIME_free(invtm);
@@ -1157,7 +1205,7 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
             BIO_printf(err, "parameter error \"%s\"\n", sigopt);
             ERR_print_errors(bio_err);
             *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR,
-                                         NULL);
+                NULL);
             goto end;
         }
     }
@@ -1173,7 +1221,7 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
 
     *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs);
 
- end:
+end:
     EVP_MD_CTX_free(mctx);
     ASN1_TIME_free(thisupd);
     ASN1_TIME_free(nextupd);
@@ -1188,8 +1236,8 @@ static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser)
     for (i = 0; i < DB_NUMBER; i++)
         row[i] = NULL;
     bn = ASN1_INTEGER_to_BN(ser, NULL);
-    OPENSSL_assert(bn);         /* FIXME: should report an error at this
-                                 * point and abort */
+    OPENSSL_assert(bn); /* FIXME: should report an error at this
+                         * point and abort */
     if (BN_is_zero(bn)) {
         itmp = OPENSSL_strdup("00");
         OPENSSL_assert(itmp);
@@ -1204,16 +1252,16 @@ static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser)
 }
 
 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio,
-                        int timeout)
+    int timeout)
 {
 #ifndef OPENSSL_NO_SOCK
     return http_server_get_asn1_req(ASN1_ITEM_rptr(OCSP_REQUEST),
-                                    (ASN1_VALUE **)preq, NULL, pcbio, acbio,
-                                    NULL /* found_keep_alive */,
-                                    prog, 1 /* accept_get */, timeout);
+        (ASN1_VALUE **)preq, NULL, pcbio, acbio,
+        NULL /* found_keep_alive */,
+        prog, 1 /* accept_get */, timeout);
 #else
     BIO_printf(bio_err,
-               "Error getting OCSP request - sockets not supported\n");
+        "Error getting OCSP request - sockets not supported\n");
     *preq = NULL;
     return 0;
 #endif
@@ -1223,23 +1271,23 @@ static int send_ocsp_response(BIO *cbio, const OCSP_RESPONSE *resp)
 {
 #ifndef OPENSSL_NO_SOCK
     return http_server_send_asn1_resp(prog, cbio,
-                                      0 /* no keep-alive */,
-                                      "application/ocsp-response",
-                                      ASN1_ITEM_rptr(OCSP_RESPONSE),
-                                      (const ASN1_VALUE *)resp);
+        0 /* no keep-alive */,
+        "application/ocsp-response",
+        ASN1_ITEM_rptr(OCSP_RESPONSE),
+        (const ASN1_VALUE *)resp);
 #else
     BIO_printf(bio_err,
-               "Error sending OCSP response - sockets not supported\n");
+        "Error sending OCSP response - sockets not supported\n");
     return 0;
 #endif
 }
 
 #ifndef OPENSSL_NO_SOCK
 OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host,
-                                 const char *port, const char *path,
-                                 const char *proxy, const char *no_proxy,
-                                 int use_ssl, STACK_OF(CONF_VALUE) *headers,
-                                 int req_timeout)
+    const char *port, const char *path,
+    const char *proxy, const char *no_proxy,
+    int use_ssl, STACK_OF(CONF_VALUE) *headers,
+    int req_timeout)
 {
     SSL_CTX *ctx = NULL;
     OCSP_RESPONSE *resp = NULL;
@@ -1254,15 +1302,15 @@ OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host,
 
     resp = (OCSP_RESPONSE *)
         app_http_post_asn1(host, port, path, proxy, no_proxy,
-                           ctx, headers, "application/ocsp-request",
-                           (ASN1_VALUE *)req, ASN1_ITEM_rptr(OCSP_REQUEST),
-                           "application/ocsp-response",
-                           req_timeout, ASN1_ITEM_rptr(OCSP_RESPONSE));
+            ctx, headers, "application/ocsp-request",
+            (ASN1_VALUE *)req, ASN1_ITEM_rptr(OCSP_REQUEST),
+            "application/ocsp-response",
+            req_timeout, ASN1_ITEM_rptr(OCSP_RESPONSE));
 
     if (resp == NULL)
         BIO_printf(bio_err, "Error querying OCSP responder\n");
 
- end:
+end:
     SSL_CTX_free(ctx);
     return resp;
 }
diff --git a/crypto/openssl/apps/openssl.c b/crypto/openssl/apps/openssl.c
index cbd3476b32b6..01ff8e249720 100644
--- a/crypto/openssl/apps/openssl.c
+++ b/crypto/openssl/apps/openssl.c
@@ -21,12 +21,12 @@
 #include <openssl/pem.h>
 #include <openssl/ssl.h>
 #ifndef OPENSSL_NO_ENGINE
-# include <openssl/engine.h>
+#include <openssl/engine.h>
 #endif
 #include <openssl/err.h>
 /* Needed to get the other O_xxx flags. */
 #ifdef OPENSSL_SYS_VMS
-# include <unixio.h>
+#include <unixio.h>
 #endif
 #include "apps.h"
 #include "progs.h"
@@ -49,7 +49,7 @@ static void warn_deprecated(const FUNCTION *fp)
 {
     if (fp->deprecated_version != NULL)
         BIO_printf(bio_err, "The command %s was deprecated in version %s.",
-                   fp->name, fp->deprecated_version);
+            fp->name, fp->deprecated_version);
     else
         BIO_printf(bio_err, "The command %s is deprecated.", fp->name);
     if (strcmp(fp->deprecated_alternative, DEPRECATED_NO_ALTERNATIVE) != 0)
@@ -66,7 +66,8 @@ static int apps_startup(void)
 
     /* Set non-default library initialisation settings */
     if (!OPENSSL_init_ssl(OPENSSL_INIT_ENGINE_ALL_BUILTIN
-                          | OPENSSL_INIT_LOAD_CONFIG, NULL))
+                | OPENSSL_INIT_LOAD_CONFIG,
+            NULL))
         return 0;
 
     (void)setup_ui_method();
@@ -96,15 +97,14 @@ static void apps_shutdown(void)
     destroy_ui_method();
 }
 
-
 #ifndef OPENSSL_NO_TRACE
 typedef struct tracedata_st {
     BIO *bio;
-    unsigned int ingroup:1;
+    unsigned int ingroup : 1;
 } tracedata;
 
 static size_t internal_trace_cb(const char *buf, size_t cnt,
-                                int category, int cmd, void *vdata)
+    int category, int cmd, void *vdata)
 {
     int ret = 0;
     tracedata *trace_data = vdata;
@@ -122,8 +122,8 @@ static size_t internal_trace_cb(const char *buf, size_t cnt,
         tid = CRYPTO_THREAD_get_current_id();
         hex = OPENSSL_buf2hexstr((const unsigned char *)&tid, sizeof(tid));
         BIO_snprintf(buffer, sizeof(buffer), "TRACE[%s]:%s: ",
-                     hex == NULL ? "<null>" : hex,
-                     OSSL_trace_get_category_name(category));
+            hex == NULL ? "<null>" : hex,
+            OSSL_trace_get_category_name(category));
         OPENSSL_free(hex);
         BIO_set_prefix(trace_data->bio, buffer);
         break;
@@ -181,12 +181,13 @@ static void setup_trace_category(int category)
         || bio == NULL
         || (trace_data->bio = channel) == NULL
         || OSSL_trace_set_callback(category, internal_trace_cb,
-                                   trace_data) == 0
+               trace_data)
+            == 0
         || sk_tracedata_push(trace_data_stack, trace_data) == 0) {
 
         fprintf(stderr,
-                "warning: unable to setup trace callback for category '%s'.\n",
-                OSSL_trace_get_category_name(category));
+            "warning: unable to setup trace callback for category '%s'.\n",
+            OSSL_trace_get_category_name(category));
 
         OSSL_trace_set_callback(category, NULL, NULL);
         BIO_free_all(channel);
@@ -222,7 +223,7 @@ static void setup_trace(const char *str)
                 setup_trace_category(category);
             } else {
                 fprintf(stderr,
-                        "warning: unknown trace category: '%s'.\n", item);
+                    "warning: unknown trace category: '%s'.\n", item);
             }
         }
     }
@@ -265,10 +266,10 @@ int main(int argc, char *argv[])
 #endif
 
     if ((fname = "apps_startup", !apps_startup())
-            || (fname = "prog_init", (prog = prog_init()) == NULL)) {
+        || (fname = "prog_init", (prog = prog_init()) == NULL)) {
         BIO_printf(bio_err,
-                   "FATAL: Startup failure (dev note: %s()) for %s\n",
-                   fname, argv[0]);
+            "FATAL: Startup failure (dev note: %s()) for %s\n",
+            fname, argv[0]);
         ERR_print_errors(bio_err);
         ret = 1;
         goto end;
@@ -293,7 +294,8 @@ int main(int argc, char *argv[])
 
         argc--;
         argv++;
-        opt_appname(argc == 1 || global_help ? "help" : global_version ? "version" : argv[0]);
+        opt_appname(argc == 1 || global_help ? "help" : global_version ? "version"
+                                                                       : argv[0]);
     } else {
         argv[0] = pname;
     }
@@ -302,13 +304,13 @@ int main(int argc, char *argv[])
      * If there's no command, assume "help". If there's an override for help
      * or version run those, otherwise run the command given.
      */
-    ret =  (argc == 0) || global_help
-            ? do_cmd(prog, 1, help_argv)
-            : global_version
-                ? do_cmd(prog, 1, version_argv)
-                : do_cmd(prog, argc, argv);
+    ret = (argc == 0) || global_help
+        ? do_cmd(prog, 1, help_argv)
+        : global_version
+        ? do_cmd(prog, 1, version_argv)
+        : do_cmd(prog, argc, argv);
 
- end:
+end:
     OPENSSL_free(default_config_file);
     lh_FUNCTION_free(prog);
     OPENSSL_free(arg.argv);
@@ -323,18 +325,20 @@ int main(int argc, char *argv[])
 }
 
 typedef enum HELP_CHOICE {
-    OPT_hERR = -1, OPT_hEOF = 0, OPT_hHELP
+    OPT_hERR = -1,
+    OPT_hEOF = 0,
+    OPT_hHELP
 } HELP_CHOICE;
 
 const OPTIONS help_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: help [options] [command]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: help [options] [command]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_hHELP, '-', "Display this summary"},
+    { "help", OPT_hHELP, '-', "Display this summary" },
 
     OPT_PARAMETERS(),
-    {"command", 0, 0, "Name of command to display help (optional)"},
-    {NULL}
+    { "command", 0, 0, "Name of command to display help (optional)" },
+    { NULL }
 };
 
 int help_main(int argc, char **argv)
@@ -389,11 +393,11 @@ int help_main(int argc, char **argv)
             if (tp == FT_md) {
                 i = 1;
                 BIO_printf(bio_err,
-                           "\nMessage Digest commands (see the `dgst' command for more details)\n");
+                    "\nMessage Digest commands (see the `dgst' command for more details)\n");
             } else if (tp == FT_cipher) {
                 i = 1;
                 BIO_printf(bio_err,
-                           "\nCipher commands (see the `enc' command for more details)\n");
+                    "\nCipher commands (see the `enc' command for more details)\n");
             }
         }
         BIO_printf(bio_err, "%-*s", dc.width, fp->name);
@@ -442,7 +446,7 @@ static int do_cmd(LHASH_OF(FUNCTION) *prog, int argc, char *argv[])
     }
 
     BIO_printf(bio_err, "Invalid command '%s'; type \"help\" for a list.\n",
-               argv[0]);
+        argv[0]);
     return 1;
 }
 
diff --git a/crypto/openssl/apps/passwd.c b/crypto/openssl/apps/passwd.c
index 8b233538d87b..fd4725b2a430 100644
--- a/crypto/openssl/apps/passwd.c
+++ b/crypto/openssl/apps/passwd.c
@@ -17,7 +17,7 @@
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 #if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-# include <openssl/des.h>
+#include <openssl/des.h>
 #endif
 #include <openssl/md5.h>
 #include <openssl/sha.h>
@@ -46,48 +46,58 @@ typedef enum {
 } passwd_modes;
 
 static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
-                     char *passwd, BIO *out, int quiet, int table,
-                     int reverse, size_t pw_maxlen, passwd_modes mode);
+    char *passwd, BIO *out, int quiet, int table,
+    int reverse, size_t pw_maxlen, passwd_modes mode);
 
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_IN,
-    OPT_NOVERIFY, OPT_QUIET, OPT_TABLE, OPT_REVERSE, OPT_APR1,
-    OPT_1, OPT_5, OPT_6, OPT_AIXMD5, OPT_SALT, OPT_STDIN,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_NOVERIFY,
+    OPT_QUIET,
+    OPT_TABLE,
+    OPT_REVERSE,
+    OPT_APR1,
+    OPT_1,
+    OPT_5,
+    OPT_6,
+    OPT_AIXMD5,
+    OPT_SALT,
+    OPT_STDIN,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS passwd_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [password]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [password]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Read passwords from file"},
-    {"noverify", OPT_NOVERIFY, '-',
-     "Never verify when reading password from terminal"},
-    {"stdin", OPT_STDIN, '-', "Read passwords from stdin"},
+    { "in", OPT_IN, '<', "Read passwords from file" },
+    { "noverify", OPT_NOVERIFY, '-',
+        "Never verify when reading password from terminal" },
+    { "stdin", OPT_STDIN, '-', "Read passwords from stdin" },
 
     OPT_SECTION("Output"),
-    {"quiet", OPT_QUIET, '-', "No warnings"},
-    {"table", OPT_TABLE, '-', "Format output as table"},
-    {"reverse", OPT_REVERSE, '-', "Switch table columns"},
+    { "quiet", OPT_QUIET, '-', "No warnings" },
+    { "table", OPT_TABLE, '-', "Format output as table" },
+    { "reverse", OPT_REVERSE, '-', "Switch table columns" },
 
     OPT_SECTION("Cryptographic"),
-    {"salt", OPT_SALT, 's', "Use provided salt"},
-    {"6", OPT_6, '-', "SHA512-based password algorithm"},
-    {"5", OPT_5, '-', "SHA256-based password algorithm"},
-    {"apr1", OPT_APR1, '-', "MD5-based password algorithm, Apache variant"},
-    {"1", OPT_1, '-', "MD5-based password algorithm"},
-    {"aixmd5", OPT_AIXMD5, '-', "AIX MD5-based password algorithm"},
+    { "salt", OPT_SALT, 's', "Use provided salt" },
+    { "6", OPT_6, '-', "SHA512-based password algorithm" },
+    { "5", OPT_5, '-', "SHA256-based password algorithm" },
+    { "apr1", OPT_APR1, '-', "MD5-based password algorithm, Apache variant" },
+    { "1", OPT_1, '-', "MD5-based password algorithm" },
+    { "aixmd5", OPT_AIXMD5, '-', "AIX MD5-based password algorithm" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"password", 0, 0, "Password text to digest (optional)"},
-    {NULL}
+    { "password", 0, 0, "Password text to digest (optional)" },
+    { NULL }
 };
 
 int passwd_main(int argc, char **argv)
@@ -112,7 +122,7 @@ int passwd_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -223,8 +233,7 @@ int passwd_main(int argc, char **argv)
 
         passwd_malloc_size = pw_maxlen + 2;
         /* longer than necessary so that we can warn about truncation */
-        passwd = passwd_malloc =
-            app_malloc(passwd_malloc_size, "password buffer");
+        passwd = passwd_malloc = app_malloc(passwd_malloc_size, "password buffer");
     }
 
     if ((in == NULL) && (passwds == NULL)) {
@@ -240,9 +249,9 @@ int passwd_main(int argc, char **argv)
 
             passwds = passwds_static;
             if (in == NULL) {
-                if (EVP_read_pw_string
-                    (passwd_malloc, passwd_malloc_size, "Password: ",
-                     !(passed_salt || in_noverify)) != 0)
+                if (EVP_read_pw_string(passwd_malloc, passwd_malloc_size, "Password: ",
+                        !(passed_salt || in_noverify))
+                    != 0)
                     goto end;
             }
             passwds[0] = passwd_malloc;
@@ -257,10 +266,10 @@ int passwd_main(int argc, char **argv)
         assert(passwds != NULL);
         assert(*passwds != NULL);
 
-        do {                    /* loop over list of passwords */
+        do { /* loop over list of passwords */
             passwd = *passwds++;
             if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, bio_out,
-                           quiet, table, reverse, pw_maxlen, mode))
+                    quiet, table, reverse, pw_maxlen, mode))
                 goto end;
         } while (*passwds != NULL);
     } else {
@@ -273,7 +282,7 @@ int passwd_main(int argc, char **argv)
             if (r > 0) {
                 char *c = (strchr(passwd, '\n'));
                 if (c != NULL) {
-                    *c = 0;     /* truncate at newline */
+                    *c = 0; /* truncate at newline */
                 } else {
                     /* ignore rest of line */
                     char trash[BUFSIZ];
@@ -282,9 +291,8 @@ int passwd_main(int argc, char **argv)
                     while ((r > 0) && (!strchr(trash, '\n')));
                 }
 
-                if (!do_passwd
-                    (passed_salt, &salt, &salt_malloc, passwd, bio_out, quiet,
-                     table, reverse, pw_maxlen, mode))
+                if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, bio_out, quiet,
+                        table, reverse, pw_maxlen, mode))
                     goto end;
             }
             done = (r <= 0);
@@ -292,7 +300,7 @@ int passwd_main(int argc, char **argv)
     }
     ret = 0;
 
- end:
+end:
 #if 0
     ERR_print_errors(bio_err);
 #endif
@@ -316,8 +324,8 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
     /* "$apr1$..salt..$.......md5hash..........\0" */
     static char out_buf[6 + 9 + 24 + 2];
     unsigned char buf[MD5_DIGEST_LENGTH];
-    char ascii_magic[5];         /* "apr1" plus '\0' */
-    char ascii_salt[9];          /* Max 8 chars plus '\0' */
+    char ascii_magic[5]; /* "apr1" plus '\0' */
+    char ascii_salt[9]; /* Max 8 chars plus '\0' */
     char *ascii_passwd = NULL;
     char *salt_out;
     int n;
@@ -331,7 +339,7 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
     magic_len = strlen(magic);
     OPENSSL_strlcpy(ascii_magic, magic, sizeof(ascii_magic));
 #ifdef CHARSET_EBCDIC
-    if ((magic[0] & 0x80) != 0)    /* High bit is 1 in EBCDIC alnums */
+    if ((magic[0] & 0x80) != 0) /* High bit is 1 in EBCDIC alnums */
         ebcdic2ascii(ascii_magic, ascii_magic, magic_len);
 #endif
 
@@ -353,7 +361,7 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
     if (magic_len > 0) {
         OPENSSL_strlcat(out_buf, ascii_dollar, sizeof(out_buf));
 
-        if (magic_len > 4)    /* assert it's  "1" or "apr1" */
+        if (magic_len > 4) /* assert it's  "1" or "apr1" */
             goto err;
 
         OPENSSL_strlcat(out_buf, ascii_magic, sizeof(out_buf));
@@ -381,7 +389,7 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
         if (!EVP_DigestUpdate(md, ascii_dollar, 1)
             || !EVP_DigestUpdate(md, ascii_magic, magic_len)
             || !EVP_DigestUpdate(md, ascii_dollar, 1))
-          goto err;
+            goto err;
 
     if (!EVP_DigestUpdate(md, ascii_salt, salt_len))
         goto err;
@@ -415,8 +423,8 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
         if (!EVP_DigestInit_ex(md2, EVP_md5(), NULL))
             goto err;
         if (!EVP_DigestUpdate(md2,
-                              (i & 1) ? (const unsigned char *)passwd : buf,
-                              (i & 1) ? passwd_len : sizeof(buf)))
+                (i & 1) ? (const unsigned char *)passwd : buf,
+                (i & 1) ? passwd_len : sizeof(buf)))
             goto err;
         if (i % 3) {
             if (!EVP_DigestUpdate(md2, ascii_salt, salt_len))
@@ -427,11 +435,11 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
                 goto err;
         }
         if (!EVP_DigestUpdate(md2,
-                              (i & 1) ? buf : (const unsigned char *)passwd,
-                              (i & 1) ? sizeof(buf) : passwd_len))
-                goto err;
+                (i & 1) ? buf : (const unsigned char *)passwd,
+                (i & 1) ? sizeof(buf) : passwd_len))
+            goto err;
         if (!EVP_DigestFinal_ex(md2, buf, NULL))
-                goto err;
+            goto err;
     }
     EVP_MD_CTX_free(md2);
     EVP_MD_CTX_free(md);
@@ -446,14 +454,14 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
 
         /* silly output permutation */
         for (dest = 0, source = 0; dest < 14;
-             dest++, source = (source + 6) % 17)
+            dest++, source = (source + 6) % 17)
             buf_perm[dest] = buf[source];
         buf_perm[14] = buf[5];
         buf_perm[15] = buf[11];
-# ifndef PEDANTIC              /* Unfortunately, this generates a "no
-                                 * effect" warning */
+#ifndef PEDANTIC /* Unfortunately, this generates a "no \
+                  * effect" warning */
         assert(16 == sizeof(buf_perm));
-# endif
+#endif
 
         output = salt_out + salt_len;
         assert(output == out_buf + strlen(out_buf));
@@ -462,10 +470,8 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
 
         for (i = 0; i < 15; i += 3) {
             *output++ = cov_2char[buf_perm[i + 2] & 0x3f];
-            *output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) |
-                                  (buf_perm[i + 2] >> 6)];
-            *output++ = cov_2char[((buf_perm[i] & 3) << 4) |
-                                  (buf_perm[i + 1] >> 4)];
+            *output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) | (buf_perm[i + 2] >> 6)];
+            *output++ = cov_2char[((buf_perm[i] & 3) << 4) | (buf_perm[i + 1] >> 4)];
             *output++ = cov_2char[buf_perm[i] >> 2];
         }
         assert(i == 15);
@@ -480,7 +486,7 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
 
     return out_buf;
 
- err:
+err:
     OPENSSL_free(ascii_passwd);
     EVP_MD_CTX_free(md2);
     EVP_MD_CTX_free(md);
@@ -497,13 +503,13 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
     /* Prefix for optional rounds specification.  */
     static const char rounds_prefix[] = "rounds=";
     /* Maximum salt string length.  */
-# define SALT_LEN_MAX 16
+#define SALT_LEN_MAX 16
     /* Default number of rounds if not explicitly specified.  */
-# define ROUNDS_DEFAULT 5000
+#define ROUNDS_DEFAULT 5000
     /* Minimum number of rounds.  */
-# define ROUNDS_MIN 1000
+#define ROUNDS_MIN 1000
     /* Maximum number of rounds.  */
-# define ROUNDS_MAX 999999999
+#define ROUNDS_MAX 999999999
 
     /* "$6$rounds=<N>$......salt......$...shahash(up to 86 chars)...\0" */
     static char out_buf[3 + 17 + 17 + 86 + 1];
@@ -511,13 +517,13 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
     unsigned char temp_buf[SHA512_DIGEST_LENGTH];
     size_t buf_size = 0;
     char ascii_magic[2];
-    char ascii_salt[17];          /* Max 16 chars plus '\0' */
+    char ascii_salt[17]; /* Max 16 chars plus '\0' */
     char *ascii_passwd = NULL;
     size_t n;
     EVP_MD_CTX *md = NULL, *md2 = NULL;
     const EVP_MD *sha = NULL;
     size_t passwd_len, salt_len, magic_len;
-    unsigned int rounds = ROUNDS_DEFAULT;        /* Default */
+    unsigned int rounds = ROUNDS_DEFAULT; /* Default */
     char rounds_custom = 0;
     char *p_bytes = NULL;
     char *s_bytes = NULL;
@@ -546,7 +552,7 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
     if (strncmp(salt, rounds_prefix, sizeof(rounds_prefix) - 1) == 0) {
         const char *num = salt + sizeof(rounds_prefix) - 1;
         char *endp;
-        unsigned long int srounds = strtoul (num, &endp, 10);
+        unsigned long int srounds = strtoul(num, &endp, 10);
         if (*endp == '$') {
             salt = endp + 1;
             if (srounds > ROUNDS_MAX)
@@ -563,7 +569,7 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
 
     OPENSSL_strlcpy(ascii_magic, magic, sizeof(ascii_magic));
 #ifdef CHARSET_EBCDIC
-    if ((magic[0] & 0x80) != 0)    /* High bit is 1 in EBCDIC alnums */
+    if ((magic[0] & 0x80) != 0) /* High bit is 1 in EBCDIC alnums */
         ebcdic2ascii(ascii_magic, ascii_magic, magic_len);
 #endif
 
@@ -592,7 +598,7 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
         BIO_snprintf(tmp_buf, sizeof(tmp_buf), "rounds=%u", rounds);
 #ifdef CHARSET_EBCDIC
         /* In case we're really on a ASCII based platform and just pretend */
-        if (tmp_buf[0] != 0x72)  /* ASCII 'r' */
+        if (tmp_buf[0] != 0x72) /* ASCII 'r' */
             ebcdic2ascii(tmp_buf, tmp_buf, strlen(tmp_buf));
 #endif
         OPENSSL_strlcat(out_buf, tmp_buf, sizeof(out_buf));
@@ -630,8 +636,8 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
     n = passwd_len;
     while (n) {
         if (!EVP_DigestUpdate(md,
-                              (n & 1) ? buf : (const unsigned char *)passwd,
-                              (n & 1) ? buf_size : passwd_len))
+                (n & 1) ? buf : (const unsigned char *)passwd,
+                (n & 1) ? buf_size : passwd_len))
             goto err;
         n >>= 1;
     }
@@ -676,8 +682,8 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
         if (!EVP_DigestInit_ex(md2, sha, NULL))
             goto err;
         if (!EVP_DigestUpdate(md2,
-                              (n & 1) ? (const unsigned char *)p_bytes : buf,
-                              (n & 1) ? passwd_len : buf_size))
+                (n & 1) ? (const unsigned char *)p_bytes : buf,
+                (n & 1) ? passwd_len : buf_size))
             goto err;
         if (n % 3) {
             if (!EVP_DigestUpdate(md2, s_bytes, salt_len))
@@ -688,11 +694,11 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
                 goto err;
         }
         if (!EVP_DigestUpdate(md2,
-                              (n & 1) ? buf : (const unsigned char *)p_bytes,
-                              (n & 1) ? buf_size : passwd_len))
-                goto err;
+                (n & 1) ? buf : (const unsigned char *)p_bytes,
+                (n & 1) ? buf_size : passwd_len))
+            goto err;
         if (!EVP_DigestFinal_ex(md2, buf, NULL))
-                goto err;
+            goto err;
     }
     EVP_MD_CTX_free(md2);
     EVP_MD_CTX_free(md);
@@ -706,53 +712,53 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
     cp = out_buf + strlen(out_buf);
     *cp++ = ascii_dollar[0];
 
-# define b64_from_24bit(B2, B1, B0, N)                                  \
-    do {                                                                \
-        unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0);             \
-        int i = (N);                                                    \
-        while (i-- > 0) {                                               \
-            *cp++ = cov_2char[w & 0x3f];                                \
-            w >>= 6;                                                    \
-        }                                                               \
+#define b64_from_24bit(B2, B1, B0, N)                       \
+    do {                                                    \
+        unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0); \
+        int i = (N);                                        \
+        while (i-- > 0) {                                   \
+            *cp++ = cov_2char[w & 0x3f];                    \
+            w >>= 6;                                        \
+        }                                                   \
     } while (0)
 
     switch (magic[0]) {
     case '5':
-        b64_from_24bit (buf[0], buf[10], buf[20], 4);
-        b64_from_24bit (buf[21], buf[1], buf[11], 4);
-        b64_from_24bit (buf[12], buf[22], buf[2], 4);
-        b64_from_24bit (buf[3], buf[13], buf[23], 4);
-        b64_from_24bit (buf[24], buf[4], buf[14], 4);
-        b64_from_24bit (buf[15], buf[25], buf[5], 4);
-        b64_from_24bit (buf[6], buf[16], buf[26], 4);
-        b64_from_24bit (buf[27], buf[7], buf[17], 4);
-        b64_from_24bit (buf[18], buf[28], buf[8], 4);
-        b64_from_24bit (buf[9], buf[19], buf[29], 4);
-        b64_from_24bit (0, buf[31], buf[30], 3);
+        b64_from_24bit(buf[0], buf[10], buf[20], 4);
+        b64_from_24bit(buf[21], buf[1], buf[11], 4);
+        b64_from_24bit(buf[12], buf[22], buf[2], 4);
+        b64_from_24bit(buf[3], buf[13], buf[23], 4);
+        b64_from_24bit(buf[24], buf[4], buf[14], 4);
+        b64_from_24bit(buf[15], buf[25], buf[5], 4);
+        b64_from_24bit(buf[6], buf[16], buf[26], 4);
+        b64_from_24bit(buf[27], buf[7], buf[17], 4);
+        b64_from_24bit(buf[18], buf[28], buf[8], 4);
+        b64_from_24bit(buf[9], buf[19], buf[29], 4);
+        b64_from_24bit(0, buf[31], buf[30], 3);
         break;
     case '6':
-        b64_from_24bit (buf[0], buf[21], buf[42], 4);
-        b64_from_24bit (buf[22], buf[43], buf[1], 4);
-        b64_from_24bit (buf[44], buf[2], buf[23], 4);
-        b64_from_24bit (buf[3], buf[24], buf[45], 4);
-        b64_from_24bit (buf[25], buf[46], buf[4], 4);
-        b64_from_24bit (buf[47], buf[5], buf[26], 4);
-        b64_from_24bit (buf[6], buf[27], buf[48], 4);
-        b64_from_24bit (buf[28], buf[49], buf[7], 4);
-        b64_from_24bit (buf[50], buf[8], buf[29], 4);
-        b64_from_24bit (buf[9], buf[30], buf[51], 4);
-        b64_from_24bit (buf[31], buf[52], buf[10], 4);
-        b64_from_24bit (buf[53], buf[11], buf[32], 4);
-        b64_from_24bit (buf[12], buf[33], buf[54], 4);
-        b64_from_24bit (buf[34], buf[55], buf[13], 4);
-        b64_from_24bit (buf[56], buf[14], buf[35], 4);
-        b64_from_24bit (buf[15], buf[36], buf[57], 4);
-        b64_from_24bit (buf[37], buf[58], buf[16], 4);
-        b64_from_24bit (buf[59], buf[17], buf[38], 4);
-        b64_from_24bit (buf[18], buf[39], buf[60], 4);
-        b64_from_24bit (buf[40], buf[61], buf[19], 4);
-        b64_from_24bit (buf[62], buf[20], buf[41], 4);
-        b64_from_24bit (0, 0, buf[63], 2);
+        b64_from_24bit(buf[0], buf[21], buf[42], 4);
+        b64_from_24bit(buf[22], buf[43], buf[1], 4);
+        b64_from_24bit(buf[44], buf[2], buf[23], 4);
+        b64_from_24bit(buf[3], buf[24], buf[45], 4);
+        b64_from_24bit(buf[25], buf[46], buf[4], 4);
+        b64_from_24bit(buf[47], buf[5], buf[26], 4);
+        b64_from_24bit(buf[6], buf[27], buf[48], 4);
+        b64_from_24bit(buf[28], buf[49], buf[7], 4);
+        b64_from_24bit(buf[50], buf[8], buf[29], 4);
+        b64_from_24bit(buf[9], buf[30], buf[51], 4);
+        b64_from_24bit(buf[31], buf[52], buf[10], 4);
+        b64_from_24bit(buf[53], buf[11], buf[32], 4);
+        b64_from_24bit(buf[12], buf[33], buf[54], 4);
+        b64_from_24bit(buf[34], buf[55], buf[13], 4);
+        b64_from_24bit(buf[56], buf[14], buf[35], 4);
+        b64_from_24bit(buf[15], buf[36], buf[57], 4);
+        b64_from_24bit(buf[37], buf[58], buf[16], 4);
+        b64_from_24bit(buf[59], buf[17], buf[38], 4);
+        b64_from_24bit(buf[18], buf[39], buf[60], 4);
+        b64_from_24bit(buf[40], buf[61], buf[19], 4);
+        b64_from_24bit(buf[62], buf[20], buf[41], 4);
+        b64_from_24bit(0, 0, buf[63], 2);
         break;
     default:
         goto err;
@@ -764,7 +770,7 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
 
     return out_buf;
 
- err:
+err:
     EVP_MD_CTX_free(md2);
     EVP_MD_CTX_free(md);
     OPENSSL_free(p_bytes);
@@ -774,8 +780,8 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
 }
 
 static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
-                     char *passwd, BIO *out, int quiet, int table,
-                     int reverse, size_t pw_maxlen, passwd_modes mode)
+    char *passwd, BIO *out, int quiet, int table,
+    int reverse, size_t pw_maxlen, passwd_modes mode)
 {
     char *hash = NULL;
 
@@ -803,10 +809,10 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
         for (i = 0; i < saltlen; i++)
             (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */
         (*salt_p)[i] = 0;
-# ifdef CHARSET_EBCDIC
+#ifdef CHARSET_EBCDIC
         /* The password encryption function will convert back to ASCII */
         ascii2ebcdic(*salt_p, *salt_p, saltlen);
-# endif
+#endif
     }
 
     assert(*salt_p != NULL);
@@ -818,8 +824,8 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
              * XXX: really we should know how to print a size_t, not cast it
              */
             BIO_printf(bio_err,
-                       "Warning: truncating password to %u characters\n",
-                       (unsigned)pw_maxlen);
+                "Warning: truncating password to %u characters\n",
+                (unsigned)pw_maxlen);
         passwd[pw_maxlen] = 0;
     }
     assert(strlen(passwd) <= pw_maxlen);
@@ -841,6 +847,6 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
         BIO_printf(out, "%s\n", hash);
     return 1;
 
- end:
+end:
     return 0;
 }
diff --git a/crypto/openssl/apps/pkcs12.c b/crypto/openssl/apps/pkcs12.c
index 9964faf21aae..2c83e43845d2 100644
--- a/crypto/openssl/apps/pkcs12.c
+++ b/crypto/openssl/apps/pkcs12.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -23,11 +23,11 @@
 #include <openssl/kdf.h>
 #include <openssl/rand.h>
 
-#define NOKEYS          0x1
-#define NOCERTS         0x2
-#define INFO            0x4
-#define CLCERTS         0x8
-#define CACERTS         0x10
+#define NOKEYS 0x1
+#define NOCERTS 0x2
+#define INFO 0x4
+#define CLCERTS 0x8
+#define CACERTS 0x10
 
 #define PASSWD_BUF_SIZE 2048
 
@@ -37,20 +37,20 @@
     BIO_printf(bio_err, "Warning: -%s option ignored without -export\n", opt);
 
 static int get_cert_chain(X509 *cert, X509_STORE *store,
-                          STACK_OF(X509) *untrusted_certs,
-                          STACK_OF(X509) **chain);
+    STACK_OF(X509) *untrusted_certs,
+    STACK_OF(X509) **chain);
 int dump_certs_keys_p12(BIO *out, const PKCS12 *p12,
-                        const char *pass, int passlen, int options,
-                        char *pempass, const EVP_CIPHER *enc);
+    const char *pass, int passlen, int options,
+    char *pempass, const EVP_CIPHER *enc);
 int dump_certs_pkeys_bags(BIO *out, const STACK_OF(PKCS12_SAFEBAG) *bags,
-                          const char *pass, int passlen, int options,
-                          char *pempass, const EVP_CIPHER *enc);
+    const char *pass, int passlen, int options,
+    char *pempass, const EVP_CIPHER *enc);
 int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bags,
-                         const char *pass, int passlen,
-                         int options, char *pempass, const EVP_CIPHER *enc);
+    const char *pass, int passlen,
+    int options, char *pempass, const EVP_CIPHER *enc);
 void print_attribute(BIO *out, const ASN1_TYPE *av);
 int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
-                  const char *name);
+    const char *name);
 void hex_prin(BIO *out, unsigned char *buf, int len);
 static int alg_print(const X509_ALGOR *alg);
 int cert_load(BIO *in, STACK_OF(X509) *sk);
@@ -59,18 +59,58 @@ static int jdk_trust(PKCS12_SAFEBAG *bag, void *cbarg);
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_CIPHER, OPT_NOKEYS, OPT_KEYEX, OPT_KEYSIG, OPT_NOCERTS, OPT_CLCERTS,
-    OPT_CACERTS, OPT_NOOUT, OPT_INFO, OPT_CHAIN, OPT_TWOPASS, OPT_NOMACVER,
+    OPT_CIPHER,
+    OPT_NOKEYS,
+    OPT_KEYEX,
+    OPT_KEYSIG,
+    OPT_NOCERTS,
+    OPT_CLCERTS,
+    OPT_CACERTS,
+    OPT_NOOUT,
+    OPT_INFO,
+    OPT_CHAIN,
+    OPT_TWOPASS,
+    OPT_NOMACVER,
 #ifndef OPENSSL_NO_DES
     OPT_DESCERT,
 #endif
-    OPT_EXPORT, OPT_ITER, OPT_NOITER, OPT_MACITER, OPT_NOMACITER, OPT_MACSALTLEN,
-    OPT_NOMAC, OPT_LMK, OPT_NODES, OPT_NOENC, OPT_MACALG, OPT_CERTPBE, OPT_KEYPBE,
-    OPT_INKEY, OPT_CERTFILE, OPT_UNTRUSTED, OPT_PASSCERTS,
-    OPT_NAME, OPT_CSP, OPT_CANAME,
-    OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH,
-    OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_ENGINE,
-    OPT_R_ENUM, OPT_PROV_ENUM, OPT_JDKTRUST, OPT_PBMAC1_PBKDF2, OPT_PBMAC1_PBKDF2_MD,
+    OPT_EXPORT,
+    OPT_ITER,
+    OPT_NOITER,
+    OPT_MACITER,
+    OPT_NOMACITER,
+    OPT_MACSALTLEN,
+    OPT_NOMAC,
+    OPT_LMK,
+    OPT_NODES,
+    OPT_NOENC,
+    OPT_MACALG,
+    OPT_CERTPBE,
+    OPT_KEYPBE,
+    OPT_INKEY,
+    OPT_CERTFILE,
+    OPT_UNTRUSTED,
+    OPT_PASSCERTS,
+    OPT_NAME,
+    OPT_CSP,
+    OPT_CANAME,
+    OPT_IN,
+    OPT_OUT,
+    OPT_PASSIN,
+    OPT_PASSOUT,
+    OPT_PASSWORD,
+    OPT_CAPATH,
+    OPT_CAFILE,
+    OPT_CASTORE,
+    OPT_NOCAPATH,
+    OPT_NOCAFILE,
+    OPT_NOCASTORE,
+    OPT_ENGINE,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM,
+    OPT_JDKTRUST,
+    OPT_PBMAC1_PBKDF2,
+    OPT_PBMAC1_PBKDF2_MD,
 #ifndef OPENSSL_NO_DES
     OPT_LEGACY_ALG
 #endif
@@ -78,85 +118,85 @@ typedef enum OPTION_choice {
 
 const OPTIONS pkcs12_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"in", OPT_IN, '<', "Input file"},
-    {"out", OPT_OUT, '>', "Output file"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
-    {"password", OPT_PASSWORD, 's', "Set PKCS#12 import/export password source"},
-    {"twopass", OPT_TWOPASS, '-', "Separate MAC, encryption passwords"},
-    {"nokeys", OPT_NOKEYS, '-', "Don't output private keys"},
-    {"nocerts", OPT_NOCERTS, '-', "Don't output certificates"},
-    {"noout", OPT_NOOUT, '-', "Don't output anything, just verify PKCS#12 input"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "in", OPT_IN, '<', "Input file" },
+    { "out", OPT_OUT, '>', "Output file" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
+    { "password", OPT_PASSWORD, 's', "Set PKCS#12 import/export password source" },
+    { "twopass", OPT_TWOPASS, '-', "Separate MAC, encryption passwords" },
+    { "nokeys", OPT_NOKEYS, '-', "Don't output private keys" },
+    { "nocerts", OPT_NOCERTS, '-', "Don't output certificates" },
+    { "noout", OPT_NOOUT, '-', "Don't output anything, just verify PKCS#12 input" },
 #ifndef OPENSSL_NO_DES
-    {"legacy", OPT_LEGACY_ALG, '-',
-# ifdef OPENSSL_NO_RC2
-     "Use legacy encryption algorithm 3DES_CBC for keys and certs"
-# else
-     "Use legacy encryption: 3DES_CBC for keys, RC2_CBC for certs"
-# endif
+    { "legacy", OPT_LEGACY_ALG, '-',
+#ifdef OPENSSL_NO_RC2
+        "Use legacy encryption algorithm 3DES_CBC for keys and certs"
+#else
+        "Use legacy encryption: 3DES_CBC for keys, RC2_CBC for certs"
+#endif
     },
 #endif
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
     OPT_PROV_OPTIONS,
     OPT_R_OPTIONS,
 
     OPT_SECTION("PKCS#12 import (parsing PKCS#12)"),
-    {"info", OPT_INFO, '-', "Print info about PKCS#12 structure"},
-    {"nomacver", OPT_NOMACVER, '-', "Don't verify integrity MAC"},
-    {"clcerts", OPT_CLCERTS, '-', "Only output client certificates"},
-    {"cacerts", OPT_CACERTS, '-', "Only output CA certificates"},
-    {"", OPT_CIPHER, '-', "Any supported cipher for output encryption"},
-    {"noenc", OPT_NOENC, '-', "Don't encrypt private keys"},
-    {"nodes", OPT_NODES, '-', "Don't encrypt private keys; deprecated"},
+    { "info", OPT_INFO, '-', "Print info about PKCS#12 structure" },
+    { "nomacver", OPT_NOMACVER, '-', "Don't verify integrity MAC" },
+    { "clcerts", OPT_CLCERTS, '-', "Only output client certificates" },
+    { "cacerts", OPT_CACERTS, '-', "Only output CA certificates" },
+    { "", OPT_CIPHER, '-', "Any supported cipher for output encryption" },
+    { "noenc", OPT_NOENC, '-', "Don't encrypt private keys" },
+    { "nodes", OPT_NODES, '-', "Don't encrypt private keys; deprecated" },
 
     OPT_SECTION("PKCS#12 output (export)"),
-    {"export", OPT_EXPORT, '-', "Create PKCS12 file"},
-    {"inkey", OPT_INKEY, 's', "Private key, else read from -in input file"},
-    {"certfile", OPT_CERTFILE, '<', "Extra certificates for PKCS12 output"},
-    {"passcerts", OPT_PASSCERTS, 's', "Certificate file pass phrase source"},
-    {"chain", OPT_CHAIN, '-', "Build and add certificate chain for EE cert,"},
-    {OPT_MORE_STR, 0, 0,
-     "which is the 1st cert from -in matching the private key (if given)"},
-    {"untrusted", OPT_UNTRUSTED, '<', "Untrusted certificates for chain building"},
-    {"CAfile", OPT_CAFILE, '<', "PEM-format file of CA's"},
-    {"CApath", OPT_CAPATH, '/', "PEM-format directory of CA's"},
-    {"CAstore", OPT_CASTORE, ':', "URI to store of CA's"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load certificates from the default certificates store"},
-    {"name", OPT_NAME, 's', "Use name as friendly name"},
-    {"caname", OPT_CANAME, 's',
-     "Use name as CA friendly name (can be repeated)"},
-    {"CSP", OPT_CSP, 's', "Microsoft CSP name"},
-    {"LMK", OPT_LMK, '-',
-     "Add local machine keyset attribute to private key"},
-    {"keyex", OPT_KEYEX, '-', "Set key type to MS key exchange"},
-    {"keysig", OPT_KEYSIG, '-', "Set key type to MS key signature"},
-    {"keypbe", OPT_KEYPBE, 's', "Private key PBE algorithm (default AES-256 CBC)"},
-    {"certpbe", OPT_CERTPBE, 's',
-     "Certificate PBE algorithm (default PBES2 with PBKDF2 and AES-256 CBC)"},
+    { "export", OPT_EXPORT, '-', "Create PKCS12 file" },
+    { "inkey", OPT_INKEY, 's', "Private key, else read from -in input file" },
+    { "certfile", OPT_CERTFILE, '<', "Extra certificates for PKCS12 output" },
+    { "passcerts", OPT_PASSCERTS, 's', "Certificate file pass phrase source" },
+    { "chain", OPT_CHAIN, '-', "Build and add certificate chain for EE cert," },
+    { OPT_MORE_STR, 0, 0,
+        "which is the 1st cert from -in matching the private key (if given)" },
+    { "untrusted", OPT_UNTRUSTED, '<', "Untrusted certificates for chain building" },
+    { "CAfile", OPT_CAFILE, '<', "PEM-format file of CA's" },
+    { "CApath", OPT_CAPATH, '/', "PEM-format directory of CA's" },
+    { "CAstore", OPT_CASTORE, ':', "URI to store of CA's" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load certificates from the default certificates directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load certificates from the default certificates store" },
+    { "name", OPT_NAME, 's', "Use name as friendly name" },
+    { "caname", OPT_CANAME, 's',
+        "Use name as CA friendly name (can be repeated)" },
+    { "CSP", OPT_CSP, 's', "Microsoft CSP name" },
+    { "LMK", OPT_LMK, '-',
+        "Add local machine keyset attribute to private key" },
+    { "keyex", OPT_KEYEX, '-', "Set key type to MS key exchange" },
+    { "keysig", OPT_KEYSIG, '-', "Set key type to MS key signature" },
+    { "keypbe", OPT_KEYPBE, 's', "Private key PBE algorithm (default AES-256 CBC)" },
+    { "certpbe", OPT_CERTPBE, 's',
+        "Certificate PBE algorithm (default PBES2 with PBKDF2 and AES-256 CBC)" },
 #ifndef OPENSSL_NO_DES
-    {"descert", OPT_DESCERT, '-',
-     "Encrypt output with 3DES (default PBES2 with PBKDF2 and AES-256 CBC)"},
+    { "descert", OPT_DESCERT, '-',
+        "Encrypt output with 3DES (default PBES2 with PBKDF2 and AES-256 CBC)" },
 #endif
-    {"macalg", OPT_MACALG, 's',
-     "Digest algorithm to use in MAC (default SHA256)"},
-    {"pbmac1_pbkdf2", OPT_PBMAC1_PBKDF2, '-', "Use PBMAC1 with PBKDF2 instead of MAC"},
-    {"pbmac1_pbkdf2_md", OPT_PBMAC1_PBKDF2_MD, 's', "Digest to use for PBMAC1 KDF (default SHA256)"},
-    {"iter", OPT_ITER, 'p', "Specify the iteration count for encryption and MAC"},
-    {"noiter", OPT_NOITER, '-', "Don't use encryption iteration"},
-    {"nomaciter", OPT_NOMACITER, '-', "Don't use MAC iteration)"},
-    {"maciter", OPT_MACITER, '-', "Unused, kept for backwards compatibility"},
-    {"macsaltlen", OPT_MACSALTLEN, 'p', "Specify the salt len for MAC"},
-    {"nomac", OPT_NOMAC, '-', "Don't generate MAC"},
-    {"jdktrust", OPT_JDKTRUST, 's', "Mark certificate in PKCS#12 store as trusted for JDK compatibility"},
-    {NULL}
+    { "macalg", OPT_MACALG, 's',
+        "Digest algorithm to use in MAC (default SHA256)" },
+    { "pbmac1_pbkdf2", OPT_PBMAC1_PBKDF2, '-', "Use PBMAC1 with PBKDF2 instead of MAC" },
+    { "pbmac1_pbkdf2_md", OPT_PBMAC1_PBKDF2_MD, 's', "Digest to use for PBMAC1 KDF (default SHA256)" },
+    { "iter", OPT_ITER, 'p', "Specify the iteration count for encryption and MAC" },
+    { "noiter", OPT_NOITER, '-', "Don't use encryption iteration" },
+    { "nomaciter", OPT_NOMACITER, '-', "Don't use MAC iteration)" },
+    { "maciter", OPT_MACITER, '-', "Unused, kept for backwards compatibility" },
+    { "macsaltlen", OPT_MACSALTLEN, 'p', "Specify the salt len for MAC" },
+    { "nomac", OPT_NOMAC, '-', "Don't generate MAC" },
+    { "jdktrust", OPT_JDKTRUST, 's', "Mark certificate in PKCS#12 store as trusted for JDK compatibility" },
+    { NULL }
 };
 
 int pkcs12_main(int argc, char **argv)
@@ -197,7 +237,7 @@ int pkcs12_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -399,7 +439,7 @@ int pkcs12_main(int argc, char **argv)
             WARN_EXPORT("cacerts");
         if (enc != default_enc)
             BIO_printf(bio_err,
-                       "Warning: output encryption option -%s ignored with -export\n", enc_name);
+                "Warning: output encryption option -%s ignored with -export\n", enc_name);
     } else {
         if (keyname != NULL)
             WARN_NO_EXPORT("inkey");
@@ -462,11 +502,11 @@ int pkcs12_main(int argc, char **argv)
         }
         if (cert_pbe == NID_undef) {
             /* Adapt default algorithm */
-# ifndef OPENSSL_NO_RC2
+#ifndef OPENSSL_NO_RC2
             cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
-# else
+#else
             cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
-# endif
+#endif
         }
 
         if (key_pbe == NID_undef)
@@ -524,7 +564,7 @@ int pkcs12_main(int argc, char **argv)
         if (1) {
 #ifndef OPENSSL_NO_UI_CONSOLE
             if (EVP_read_pw_string(
-                macpass, sizeof(macpass), "Enter MAC Password:", export_pkcs12)) {
+                    macpass, sizeof(macpass), "Enter MAC Password:", export_pkcs12)) {
                 BIO_printf(bio_err, "Can't read Password\n");
                 goto end;
             }
@@ -557,10 +597,8 @@ int pkcs12_main(int argc, char **argv)
 
         if (!(options & NOKEYS)) {
             key = load_key(keyname ? keyname : infile,
-                           FORMAT_PEM, 1, passin, e,
-                           keyname ?
-                           "private key from -inkey file" :
-                           "private key from -in file");
+                FORMAT_PEM, 1, passin, e,
+                keyname ? "private key from -inkey file" : "private key from -in file");
             if (key == NULL)
                 goto export_end;
         }
@@ -568,7 +606,7 @@ int pkcs12_main(int argc, char **argv)
         /* Load all certs in input file */
         if (!(options & NOCERTS)) {
             if (!load_certs(infile, 1, &certs, passin,
-                            "certificates from -in file"))
+                    "certificates from -in file"))
                 goto export_end;
             if (sk_X509_num(certs) < 1) {
                 BIO_printf(bio_err, "No certificate in -in file %s\n", infile);
@@ -591,8 +629,8 @@ int pkcs12_main(int argc, char **argv)
                 }
                 if (ee_cert == NULL) {
                     BIO_printf(bio_err,
-                               "No cert in -in file '%s' matches private key\n",
-                               infile);
+                        "No cert in -in file '%s' matches private key\n",
+                        infile);
                     goto export_end;
                 }
             }
@@ -601,7 +639,7 @@ int pkcs12_main(int argc, char **argv)
         /* Load any untrusted certificates for chain building */
         if (untrusted != NULL) {
             if (!load_certs(untrusted, 0, &untrusted_certs, passcerts,
-                            "untrusted certificates"))
+                    "untrusted certificates"))
                 goto export_end;
         }
 
@@ -618,13 +656,13 @@ int pkcs12_main(int argc, char **argv)
 
             if (ee_cert_tmp == NULL) {
                 BIO_printf(bio_err,
-                           "No end entity certificate to check with -chain\n");
+                    "No end entity certificate to check with -chain\n");
                 goto export_end;
             }
 
             if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
-                                      CAstore, noCAstore))
-                    == NULL)
+                     CAstore, noCAstore))
+                == NULL)
                 goto export_end;
 
             vret = get_cert_chain(ee_cert_tmp, store, untrusted_certs, &chain2);
@@ -635,15 +673,14 @@ int pkcs12_main(int argc, char **argv)
                 /* Remove from chain2 the first (end entity) certificate */
                 X509_free(sk_X509_shift(chain2));
                 /* Add the remaining certs (except for duplicates) */
-                add_certs = X509_add_certs(certs, chain2, X509_ADD_FLAG_UP_REF
-                                           | X509_ADD_FLAG_NO_DUP);
+                add_certs = X509_add_certs(certs, chain2, X509_ADD_FLAG_UP_REF | X509_ADD_FLAG_NO_DUP);
                 OSSL_STACK_OF_X509_free(chain2);
                 if (!add_certs)
                     goto export_end;
             } else {
                 if (vret != X509_V_ERR_UNSPECIFIED)
                     BIO_printf(bio_err, "Error getting chain: %s\n",
-                               X509_verify_cert_error_string(vret));
+                        X509_verify_cert_error_string(vret));
                 goto export_end;
             }
         }
@@ -651,7 +688,7 @@ int pkcs12_main(int argc, char **argv)
         /* Add any extra certificates asked for */
         if (certfile != NULL) {
             if (!load_certs(certfile, 0, &certs, passcerts,
-                            "extra certificates from -certfile"))
+                    "extra certificates from -certfile"))
                 goto export_end;
         }
 
@@ -663,8 +700,8 @@ int pkcs12_main(int argc, char **argv)
 
         if (csp_name != NULL && key != NULL)
             EVP_PKEY_add1_attr_by_NID(key, NID_ms_csp_name,
-                                      MBSTRING_ASC, (unsigned char *)csp_name,
-                                      -1);
+                MBSTRING_ASC, (unsigned char *)csp_name,
+                -1);
 
         if (add_lmk && key != NULL)
             EVP_PKEY_add1_attr_by_NID(key, NID_LocalKeySet, 0, NULL, -1);
@@ -674,7 +711,7 @@ int pkcs12_main(int argc, char **argv)
             if (1) {
 #ifndef OPENSSL_NO_UI_CONSOLE
                 if (EVP_read_pw_string(pass, sizeof(pass),
-                                       "Enter Export Password:", 1)) {
+                        "Enter Export Password:", 1)) {
                     BIO_printf(bio_err, "Can't read Password\n");
                     goto export_end;
                 }
@@ -693,13 +730,13 @@ int pkcs12_main(int argc, char **argv)
         }
 
         p12 = PKCS12_create_ex2(cpass, name, key, ee_cert, certs,
-                                key_pbe, cert_pbe, iter, -1, keytype,
-                                app_get0_libctx(), app_get0_propq(),
-                                jdk_trust, (void*)obj);
+            key_pbe, cert_pbe, iter, -1, keytype,
+            app_get0_libctx(), app_get0_propq(),
+            jdk_trust, (void *)obj);
 
         if (p12 == NULL) {
             BIO_printf(bio_err, "Error creating PKCS12 structure for %s\n",
-                       outfile);
+                outfile);
             goto export_end;
         }
 
@@ -711,8 +748,8 @@ int pkcs12_main(int argc, char **argv)
         if (maciter != -1) {
             if (pbmac1_pbkdf2 == 1) {
                 if (!PKCS12_set_pbmac1_pbkdf2(p12, mpass, -1, NULL,
-                                              macsaltlen, maciter,
-                                              macmd, pbmac1_pbkdf2_md)) {
+                        macsaltlen, maciter,
+                        macmd, pbmac1_pbkdf2_md)) {
                     BIO_printf(bio_err, "Error creating PBMAC1\n");
                     goto export_end;
                 }
@@ -720,7 +757,7 @@ int pkcs12_main(int argc, char **argv)
                 if (!PKCS12_set_mac(p12, mpass, -1, NULL, macsaltlen, maciter, macmd)) {
                     BIO_printf(bio_err, "Error creating PKCS12 MAC; no PKCS12KDF support?\n");
                     BIO_printf(bio_err,
-                               "Use -nomac or -pbmac1_pbkdf2 if PKCS12KDF support not available\n");
+                        "Use -nomac or -pbmac1_pbkdf2 if PKCS12KDF support not available\n");
                     goto export_end;
                 }
             }
@@ -735,7 +772,7 @@ int pkcs12_main(int argc, char **argv)
 
         ret = 0;
 
- export_end:
+    export_end:
 
         EVP_PKEY_free(key);
         EVP_MD_free(macmd);
@@ -745,7 +782,6 @@ int pkcs12_main(int argc, char **argv)
         ASN1_OBJECT_free(obj);
         ERR_print_errors(bio_err);
         goto end;
-
     }
 
     in = bio_open_default(infile, 'r', FORMAT_PKCS12);
@@ -766,7 +802,7 @@ int pkcs12_main(int argc, char **argv)
         if (1) {
 #ifndef OPENSSL_NO_UI_CONSOLE
             if (EVP_read_pw_string(pass, sizeof(pass), "Enter Import Password:",
-                                   0)) {
+                    0)) {
                 BIO_printf(bio_err, "Can't read Password\n");
                 goto end;
             }
@@ -803,10 +839,10 @@ int pkcs12_main(int argc, char **argv)
                 int prfnid;
 
                 BIO_printf(bio_err, " using PBKDF2, Iteration %ld\n",
-                           ASN1_INTEGER_get(pbkdf2_param->iter));
+                    ASN1_INTEGER_get(pbkdf2_param->iter));
                 BIO_printf(bio_err, "Key length: %ld, Salt length: %d\n",
-                           ASN1_INTEGER_get(pbkdf2_param->keylength),
-                           ASN1_STRING_length(pbkdf2_param->salt->value.octet_string));
+                    ASN1_INTEGER_get(pbkdf2_param->keylength),
+                    ASN1_STRING_length(pbkdf2_param->salt->value.octet_string));
                 if (pbkdf2_param->prf == NULL) {
                     prfnid = NID_hmacWithSHA1;
                 } else {
@@ -818,10 +854,10 @@ int pkcs12_main(int argc, char **argv)
             PBKDF2PARAM_free(pbkdf2_param);
         } else {
             BIO_printf(bio_err, ", Iteration %ld\n",
-                       tmaciter != NULL ? ASN1_INTEGER_get(tmaciter) : 1L);
+                tmaciter != NULL ? ASN1_INTEGER_get(tmaciter) : 1L);
             BIO_printf(bio_err, "MAC length: %ld, salt length: %ld\n",
-                       tmac != NULL ? ASN1_STRING_length(tmac) : 0L,
-                       tsalt != NULL ? ASN1_STRING_length(tsalt) : 0L);
+                tmac != NULL ? ASN1_STRING_length(tmac) : 0L,
+                tsalt != NULL ? ASN1_STRING_length(tsalt) : 0L);
         }
     }
 
@@ -842,7 +878,7 @@ int pkcs12_main(int argc, char **argv)
             EVP_KDF *pkcs12kdf;
 
             pkcs12kdf = EVP_KDF_fetch(app_get0_libctx(), "PKCS12KDF",
-                                      app_get0_propq());
+                app_get0_propq());
             if (pkcs12kdf == NULL) {
                 BIO_printf(bio_err, "Error verifying PKCS12 MAC; no PKCS12KDF support.\n");
                 BIO_printf(bio_err, "Use -nomacver if MAC verification is not required.\n");
@@ -876,6 +912,12 @@ int pkcs12_main(int argc, char **argv)
             if (utmp == NULL)
                 goto end;
             badpass = OPENSSL_uni2utf8(utmp, utmplen);
+            if (badpass == NULL) {
+                BIO_printf(bio_err, "Verbatim password did not match, and fallback conversion to UTF-8 failed\n"
+                                    "The password entered or the input encoding may be wrong\n");
+                OPENSSL_free(utmp);
+                goto end;
+            }
             OPENSSL_free(utmp);
             if (!PKCS12_verify_mac(p12, badpass, -1)) {
                 BIO_printf(bio_err, "Mac verify error: invalid password?\n");
@@ -889,7 +931,7 @@ int pkcs12_main(int argc, char **argv)
         }
     }
 
- dump:
+dump:
     assert(private);
 
     out = bio_open_owner(outfile, FORMAT_PEM, private);
@@ -902,7 +944,7 @@ int pkcs12_main(int argc, char **argv)
         goto end;
     }
     ret = 0;
- end:
+end:
     PKCS12_free(p12);
     release_engine(e);
     BIO_free(in);
@@ -925,10 +967,10 @@ static int jdk_trust(PKCS12_SAFEBAG *bag, void *cbarg)
         return 1;
 
     /* Get the current attrs */
-    attrs = (STACK_OF(X509_ATTRIBUTE)*)PKCS12_SAFEBAG_get0_attrs(bag);
+    attrs = (STACK_OF(X509_ATTRIBUTE) *)PKCS12_SAFEBAG_get0_attrs(bag);
 
     /* Create a new attr for the JDK Trusted Usage and add it */
-    attr = X509_ATTRIBUTE_create(NID_oracle_jdk_trustedkeyusage, V_ASN1_OBJECT, (ASN1_OBJECT*)cbarg);
+    attr = X509_ATTRIBUTE_create(NID_oracle_jdk_trustedkeyusage, V_ASN1_OBJECT, (ASN1_OBJECT *)cbarg);
 
     /* Add the new attr, if attrs is NULL, it'll be initialised */
     X509at_add1_attr(&attrs, attr);
@@ -941,8 +983,8 @@ static int jdk_trust(PKCS12_SAFEBAG *bag, void *cbarg)
 }
 
 int dump_certs_keys_p12(BIO *out, const PKCS12 *p12, const char *pass,
-                        int passlen, int options, char *pempass,
-                        const EVP_CIPHER *enc)
+    int passlen, int options, char *pempass,
+    const EVP_CIPHER *enc)
 {
     STACK_OF(PKCS7) *asafes = NULL;
     int i, bagnid;
@@ -976,7 +1018,7 @@ int dump_certs_keys_p12(BIO *out, const PKCS12 *p12, const char *pass,
         if (bags == NULL)
             goto err;
         if (!dump_certs_pkeys_bags(out, bags, pass, passlen,
-                                   options, pempass, enc)) {
+                options, pempass, enc)) {
             sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
             goto err;
         }
@@ -984,28 +1026,28 @@ int dump_certs_keys_p12(BIO *out, const PKCS12 *p12, const char *pass,
     }
     ret = 1;
 
- err:
+err:
     sk_PKCS7_pop_free(asafes, PKCS7_free);
     return ret;
 }
 
 int dump_certs_pkeys_bags(BIO *out, const STACK_OF(PKCS12_SAFEBAG) *bags,
-                          const char *pass, int passlen, int options,
-                          char *pempass, const EVP_CIPHER *enc)
+    const char *pass, int passlen, int options,
+    char *pempass, const EVP_CIPHER *enc)
 {
     int i;
     for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
         if (!dump_certs_pkeys_bag(out,
-                                  sk_PKCS12_SAFEBAG_value(bags, i),
-                                  pass, passlen, options, pempass, enc))
+                sk_PKCS12_SAFEBAG_value(bags, i),
+                pass, passlen, options, pempass, enc))
             return 0;
     }
     return 1;
 }
 
 int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bag,
-                         const char *pass, int passlen, int options,
-                         char *pempass, const EVP_CIPHER *enc)
+    const char *pass, int passlen, int options,
+    char *pempass, const EVP_CIPHER *enc)
 {
     EVP_PKEY *pkey;
     PKCS8_PRIV_KEY_INFO *p8;
@@ -1091,7 +1133,7 @@ int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bag,
             BIO_printf(bio_err, "Safe Contents bag\n");
         print_attribs(out, attrs, "Bag Attributes");
         return dump_certs_pkeys_bags(out, PKCS12_SAFEBAG_get0_safes(bag),
-                                     pass, passlen, options, pempass, enc);
+            pass, passlen, options, pempass, enc);
 
     default:
         BIO_printf(bio_err, "Warning unsupported bag type: ");
@@ -1105,8 +1147,8 @@ int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bag,
 /* Given a single certificate return a verified chain or NULL if error */
 
 static int get_cert_chain(X509 *cert, X509_STORE *store,
-                          STACK_OF(X509) *untrusted_certs,
-                          STACK_OF(X509) **chain)
+    STACK_OF(X509) *untrusted_certs,
+    STACK_OF(X509) **chain)
 {
     X509_STORE_CTX *store_ctx = NULL;
     STACK_OF(X509) *chn = NULL;
@@ -1114,15 +1156,14 @@ static int get_cert_chain(X509 *cert, X509_STORE *store,
 
     store_ctx = X509_STORE_CTX_new_ex(app_get0_libctx(), app_get0_propq());
     if (store_ctx == NULL) {
-        i =  X509_V_ERR_UNSPECIFIED;
+        i = X509_V_ERR_UNSPECIFIED;
         goto end;
     }
     if (!X509_STORE_CTX_init(store_ctx, store, cert, untrusted_certs)) {
-        i =  X509_V_ERR_UNSPECIFIED;
+        i = X509_V_ERR_UNSPECIFIED;
         goto end;
     }
 
-
     if (X509_verify_cert(store_ctx) > 0)
         chn = X509_STORE_CTX_get1_chain(store_ctx);
     else if ((i = X509_STORE_CTX_get_error(store_ctx)) == 0)
@@ -1165,7 +1206,7 @@ static int alg_print(const X509_ALGOR *alg)
         X509_ALGOR_get0(&aoid, NULL, NULL, pbe2->encryption);
         encnid = OBJ_obj2nid(aoid);
         BIO_printf(bio_err, ", %s, %s", OBJ_nid2ln(pbenid),
-                   OBJ_nid2sn(encnid));
+            OBJ_nid2sn(encnid));
         /* If KDF is PBKDF2 decode parameters */
         if (pbenid == NID_id_pbkdf2) {
             PBKDF2PARAM *kdf = NULL;
@@ -1184,7 +1225,7 @@ static int alg_print(const X509_ALGOR *alg)
                 prfnid = OBJ_obj2nid(aoid);
             }
             BIO_printf(bio_err, ", Iteration %ld, PRF %s",
-                       ASN1_INTEGER_get(kdf->iter), OBJ_nid2sn(prfnid));
+                ASN1_INTEGER_get(kdf->iter), OBJ_nid2sn(prfnid));
             PBKDF2PARAM_free(kdf);
 #ifndef OPENSSL_NO_SCRYPT
         } else if (pbenid == NID_id_scrypt) {
@@ -1197,11 +1238,11 @@ static int alg_print(const X509_ALGOR *alg)
                 goto done;
             }
             BIO_printf(bio_err, ", Salt length: %d, Cost(N): %ld, "
-                       "Block size(r): %ld, Parallelism(p): %ld",
-                       ASN1_STRING_length(kdf->salt),
-                       ASN1_INTEGER_get(kdf->costParameter),
-                       ASN1_INTEGER_get(kdf->blockSize),
-                       ASN1_INTEGER_get(kdf->parallelizationParameter));
+                                "Block size(r): %ld, Parallelism(p): %ld",
+                ASN1_STRING_length(kdf->salt),
+                ASN1_INTEGER_get(kdf->costParameter),
+                ASN1_INTEGER_get(kdf->blockSize),
+                ASN1_INTEGER_get(kdf->parallelizationParameter));
             SCRYPT_PARAMS_free(kdf);
 #endif
         }
@@ -1216,7 +1257,7 @@ static int alg_print(const X509_ALGOR *alg)
         BIO_printf(bio_err, ", Iteration %ld", ASN1_INTEGER_get(pbe->iter));
         PBEPARAM_free(pbe);
     }
- done:
+done:
     BIO_puts(bio_err, "\n");
     return 1;
 }
@@ -1249,25 +1290,25 @@ void print_attribute(BIO *out, const ASN1_TYPE *av)
     switch (av->type) {
     case V_ASN1_BMPSTRING:
         value = OPENSSL_uni2asc(av->value.bmpstring->data,
-                                av->value.bmpstring->length);
+            av->value.bmpstring->length);
         BIO_printf(out, "%s\n", value);
         OPENSSL_free(value);
         break;
 
     case V_ASN1_UTF8STRING:
         BIO_printf(out, "%.*s\n", av->value.utf8string->length,
-                   av->value.utf8string->data);
+            av->value.utf8string->data);
         break;
 
     case V_ASN1_OCTET_STRING:
         hex_prin(out, av->value.octet_string->data,
-                 av->value.octet_string->length);
+            av->value.octet_string->length);
         BIO_printf(out, "\n");
         break;
 
     case V_ASN1_BIT_STRING:
         hex_prin(out, av->value.bit_string->data,
-                 av->value.bit_string->length);
+            av->value.bit_string->length);
         BIO_printf(out, "\n");
         break;
 
@@ -1289,7 +1330,7 @@ void print_attribute(BIO *out, const ASN1_TYPE *av)
 /* Generalised attribute print: handle PKCS#8 and bag attributes */
 
 int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
-                  const char *name)
+    const char *name)
 {
     X509_ATTRIBUTE *attr;
     ASN1_TYPE *av;
diff --git a/crypto/openssl/apps/pkcs7.c b/crypto/openssl/apps/pkcs7.c
index 57cb517b178f..26f8d48fc242 100644
--- a/crypto/openssl/apps/pkcs7.c
+++ b/crypto/openssl/apps/pkcs7.c
@@ -22,35 +22,43 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOOUT,
-    OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_QUIET,
-    OPT_ENGINE, OPT_PROV_ENUM
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_NOOUT,
+    OPT_TEXT,
+    OPT_PRINT,
+    OPT_PRINT_CERTS,
+    OPT_QUIET,
+    OPT_ENGINE,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS pkcs7_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "inform", OPT_INFORM, 'F', "Input format - DER or PEM" },
 
     OPT_SECTION("Output"),
-    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
-    {"out", OPT_OUT, '>', "Output file"},
-    {"noout", OPT_NOOUT, '-', "Don't output encoded data"},
-    {"text", OPT_TEXT, '-', "Print full details of certificates"},
-    {"print", OPT_PRINT, '-', "Print out all fields of the PKCS7 structure"},
-    {"print_certs", OPT_PRINT_CERTS, '-',
-     "Print_certs  print any certs or crl in the input"},
-    {"quiet", OPT_QUIET, '-',
-     "When used with -print_certs, it produces a cleaner output"},
+    { "outform", OPT_OUTFORM, 'F', "Output format - DER or PEM" },
+    { "out", OPT_OUT, '>', "Output file" },
+    { "noout", OPT_NOOUT, '-', "Don't output encoded data" },
+    { "text", OPT_TEXT, '-', "Print full details of certificates" },
+    { "print", OPT_PRINT, '-', "Print out all fields of the PKCS7 structure" },
+    { "print_certs", OPT_PRINT_CERTS, '-',
+        "Print_certs  print any certs or crl in the input" },
+    { "quiet", OPT_QUIET, '-',
+        "When used with -print_certs, it produces a cleaner output" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int pkcs7_main(int argc, char **argv)
@@ -69,7 +77,7 @@ int pkcs7_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -215,7 +223,7 @@ int pkcs7_main(int argc, char **argv)
         }
     }
     ret = 0;
- end:
+end:
     PKCS7_free(p7);
     release_engine(e);
     BIO_free(in);
diff --git a/crypto/openssl/apps/pkcs8.c b/crypto/openssl/apps/pkcs8.c
index 22978afb9093..a47f05de58f6 100644
--- a/crypto/openssl/apps/pkcs8.c
+++ b/crypto/openssl/apps/pkcs8.c
@@ -22,54 +22,69 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
-    OPT_TOPK8, OPT_NOITER, OPT_NOCRYPT,
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_ENGINE,
+    OPT_IN,
+    OPT_OUT,
+    OPT_TOPK8,
+    OPT_NOITER,
+    OPT_NOCRYPT,
 #ifndef OPENSSL_NO_SCRYPT
-    OPT_SCRYPT, OPT_SCRYPT_N, OPT_SCRYPT_R, OPT_SCRYPT_P,
+    OPT_SCRYPT,
+    OPT_SCRYPT_N,
+    OPT_SCRYPT_R,
+    OPT_SCRYPT_P,
 #endif
-    OPT_V2, OPT_V1, OPT_V2PRF, OPT_ITER, OPT_PASSIN, OPT_PASSOUT,
+    OPT_V2,
+    OPT_V1,
+    OPT_V2PRF,
+    OPT_ITER,
+    OPT_PASSIN,
+    OPT_PASSOUT,
     OPT_TRADITIONAL,
     OPT_SALTLEN,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS pkcs8_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
-    {"v1", OPT_V1, 's', "Use PKCS#5 v1.5 and cipher"},
-    {"v2", OPT_V2, 's', "Use PKCS#5 v2.0 and cipher"},
-    {"v2prf", OPT_V2PRF, 's', "Set the PRF algorithm to use with PKCS#5 v2.0"},
+    { "v1", OPT_V1, 's', "Use PKCS#5 v1.5 and cipher" },
+    { "v2", OPT_V2, 's', "Use PKCS#5 v2.0 and cipher" },
+    { "v2prf", OPT_V2PRF, 's', "Set the PRF algorithm to use with PKCS#5 v2.0" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"inform", OPT_INFORM, 'F', "Input format (DER or PEM)"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"nocrypt", OPT_NOCRYPT, '-', "Use or expect unencrypted private key"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "inform", OPT_INFORM, 'F', "Input format (DER or PEM)" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "nocrypt", OPT_NOCRYPT, '-', "Use or expect unencrypted private key" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'F', "Output format (DER or PEM)"},
-    {"topk8", OPT_TOPK8, '-', "Output PKCS8 file"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
-    {"traditional", OPT_TRADITIONAL, '-', "use traditional format private key"},
-    {"iter", OPT_ITER, 'p', "Specify the iteration count"},
-    {"noiter", OPT_NOITER, '-', "Use 1 as iteration count"},
-    {"saltlen", OPT_SALTLEN, 'p', "Specify the salt length (in bytes)"},
-    {OPT_MORE_STR, 0, 0, "Default: 8 (For PBE1) or 16 (for PBE2)"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'F', "Output format (DER or PEM)" },
+    { "topk8", OPT_TOPK8, '-', "Output PKCS8 file" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
+    { "traditional", OPT_TRADITIONAL, '-', "use traditional format private key" },
+    { "iter", OPT_ITER, 'p', "Specify the iteration count" },
+    { "noiter", OPT_NOITER, '-', "Use 1 as iteration count" },
+    { "saltlen", OPT_SALTLEN, 'p', "Specify the salt length (in bytes)" },
+    { OPT_MORE_STR, 0, 0, "Default: 8 (For PBE1) or 16 (for PBE2)" },
 #ifndef OPENSSL_NO_SCRYPT
     OPT_SECTION("Scrypt"),
-    {"scrypt", OPT_SCRYPT, '-', "Use scrypt algorithm"},
-    {"scrypt_N", OPT_SCRYPT_N, 's', "Set scrypt N parameter"},
-    {"scrypt_r", OPT_SCRYPT_R, 's', "Set scrypt r parameter"},
-    {"scrypt_p", OPT_SCRYPT_P, 's', "Set scrypt p parameter"},
+    { "scrypt", OPT_SCRYPT, '-', "Use scrypt algorithm" },
+    { "scrypt_N", OPT_SCRYPT_N, 's', "Set scrypt N parameter" },
+    { "scrypt_r", OPT_SCRYPT_R, 's', "Set scrypt r parameter" },
+    { "scrypt_p", OPT_SCRYPT_P, 's', "Set scrypt p parameter" },
 #endif
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int pkcs8_main(int argc, char **argv)
@@ -100,7 +115,7 @@ int pkcs8_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -148,7 +163,7 @@ int pkcs8_main(int argc, char **argv)
             pbe_nid = OBJ_txt2nid(opt_arg());
             if (pbe_nid == NID_undef) {
                 BIO_printf(bio_err,
-                           "%s: Unknown PBE algorithm %s\n", prog, opt_arg());
+                    "%s: Unknown PBE algorithm %s\n", prog, opt_arg());
                 goto opthelp;
             }
             break;
@@ -156,14 +171,14 @@ int pkcs8_main(int argc, char **argv)
             pbe_nid = OBJ_txt2nid(opt_arg());
             if (!EVP_PBE_find(EVP_PBE_TYPE_PRF, pbe_nid, NULL, NULL, 0)) {
                 BIO_printf(bio_err,
-                           "%s: Unknown PRF algorithm %s\n", prog, opt_arg());
+                    "%s: Unknown PRF algorithm %s\n", prog, opt_arg());
                 goto opthelp;
             }
             if (cipher == NULL)
                 cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
             break;
         case OPT_ITER:
-            iter =  opt_int_arg();
+            iter = opt_int_arg();
             break;
         case OPT_PASSIN:
             passinarg = opt_arg();
@@ -224,7 +239,7 @@ int pkcs8_main(int argc, char **argv)
         cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
 
     in = bio_open_default(infile, 'r',
-                          informat == FORMAT_UNDEF ? FORMAT_PEM : informat);
+        informat == FORMAT_UNDEF ? FORMAT_PEM : informat);
     if (in == NULL)
         goto end;
 
@@ -255,11 +270,11 @@ int pkcs8_main(int argc, char **argv)
 #ifndef OPENSSL_NO_SCRYPT
                 if (scrypt_N && scrypt_r && scrypt_p)
                     pbe = PKCS5_pbe2_set_scrypt(cipher, NULL, saltlen, NULL,
-                                                scrypt_N, scrypt_r, scrypt_p);
+                        scrypt_N, scrypt_r, scrypt_p);
                 else
 #endif
                     pbe = PKCS5_pbe2_set_iv(cipher, iter, NULL, saltlen, NULL,
-                                            pbe_nid);
+                        pbe_nid);
             } else {
                 pbe = PKCS5_pbe_set(pbe_nid, iter, NULL, saltlen);
             }
@@ -274,8 +289,7 @@ int pkcs8_main(int argc, char **argv)
                 /* To avoid bit rot */
 #ifndef OPENSSL_NO_UI_CONSOLE
                 p8pass = pass;
-                if (EVP_read_pw_string
-                    (pass, sizeof(pass), "Enter Encryption Password:", 1)) {
+                if (EVP_read_pw_string(pass, sizeof(pass), "Enter Encryption Password:", 1)) {
                     X509_ALGOR_free(pbe);
                     goto end;
                 }
@@ -366,7 +380,7 @@ int pkcs8_main(int argc, char **argv)
     if (outformat == FORMAT_PEM) {
         if (traditional)
             PEM_write_bio_PrivateKey_traditional(out, pkey, NULL, NULL, 0,
-                                                 NULL, passout);
+                NULL, passout);
         else
             PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, passout);
     } else if (outformat == FORMAT_ASN1) {
@@ -377,7 +391,7 @@ int pkcs8_main(int argc, char **argv)
     }
     ret = 0;
 
- end:
+end:
     X509_SIG_free(p8);
     PKCS8_PRIV_KEY_INFO_free(p8inf);
     EVP_PKEY_free(pkey);
diff --git a/crypto/openssl/apps/pkey.c b/crypto/openssl/apps/pkey.c
index ab0c95c2acd6..9c7b776f780f 100644
--- a/crypto/openssl/apps/pkey.c
+++ b/crypto/openssl/apps/pkey.c
@@ -19,50 +19,64 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE,
-    OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB,
-    OPT_TEXT, OPT_NOOUT, OPT_CIPHER, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK,
-    OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM,
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_PASSIN,
+    OPT_PASSOUT,
+    OPT_ENGINE,
+    OPT_IN,
+    OPT_OUT,
+    OPT_PUBIN,
+    OPT_PUBOUT,
+    OPT_TEXT_PUB,
+    OPT_TEXT,
+    OPT_NOOUT,
+    OPT_CIPHER,
+    OPT_TRADITIONAL,
+    OPT_CHECK,
+    OPT_PUB_CHECK,
+    OPT_EC_PARAM_ENC,
+    OPT_EC_CONV_FORM,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS pkey_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
     OPT_PROV_OPTIONS,
 
-    {"check", OPT_CHECK, '-', "Check key consistency"},
-    {"pubcheck", OPT_PUB_CHECK, '-', "Check public key consistency"},
+    { "check", OPT_CHECK, '-', "Check key consistency" },
+    { "pubcheck", OPT_PUB_CHECK, '-', "Check public key consistency" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, 's', "Input key"},
-    {"inform", OPT_INFORM, 'f',
-     "Key input format (ENGINE, other values ignored)"},
-    {"passin", OPT_PASSIN, 's', "Key input pass phrase source"},
-    {"pubin", OPT_PUBIN, '-',
-     "Read only public components from key input"},
+    { "in", OPT_IN, 's', "Input key" },
+    { "inform", OPT_INFORM, 'f',
+        "Key input format (ENGINE, other values ignored)" },
+    { "passin", OPT_PASSIN, 's', "Key input pass phrase source" },
+    { "pubin", OPT_PUBIN, '-',
+        "Read only public components from key input" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file for encoded and/or text output"},
-    {"outform", OPT_OUTFORM, 'F', "Output encoding format (DER or PEM)"},
-    {"", OPT_CIPHER, '-', "Any supported cipher to be used for encryption"},
-    {"passout", OPT_PASSOUT, 's', "Output PEM file pass phrase source"},
-    {"traditional", OPT_TRADITIONAL, '-',
-     "Use traditional format for private key PEM output"},
-    {"pubout", OPT_PUBOUT, '-', "Restrict encoded output to public components"},
-    {"noout", OPT_NOOUT, '-', "Do not output the key in encoded form"},
-    {"text", OPT_TEXT, '-', "Output key components in plaintext"},
-    {"text_pub", OPT_TEXT_PUB, '-',
-     "Output only public key components in text form"},
-    {"ec_conv_form", OPT_EC_CONV_FORM, 's',
-     "Specifies the EC point conversion form in the encoding"},
-    {"ec_param_enc", OPT_EC_PARAM_ENC, 's',
-     "Specifies the way the EC parameters are encoded"},
+    { "out", OPT_OUT, '>', "Output file for encoded and/or text output" },
+    { "outform", OPT_OUTFORM, 'F', "Output encoding format (DER or PEM)" },
+    { "", OPT_CIPHER, '-', "Any supported cipher to be used for encryption" },
+    { "passout", OPT_PASSOUT, 's', "Output PEM file pass phrase source" },
+    { "traditional", OPT_TRADITIONAL, '-',
+        "Use traditional format for private key PEM output" },
+    { "pubout", OPT_PUBOUT, '-', "Restrict encoded output to public components" },
+    { "noout", OPT_NOOUT, '-', "Do not output the key in encoded form" },
+    { "text", OPT_TEXT, '-', "Output key components in plaintext" },
+    { "text_pub", OPT_TEXT_PUB, '-',
+        "Output only public key components in text form" },
+    { "ec_conv_form", OPT_EC_CONV_FORM, 's',
+        "Specifies the EC point conversion form in the encoding" },
+    { "ec_param_enc", OPT_EC_PARAM_ENC, 's',
+        "Specifies the way the EC parameters are encoded" },
 
-    {NULL}
+    { NULL }
 };
 
 int pkey_main(int argc, char **argv)
@@ -89,7 +103,7 @@ int pkey_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -177,10 +191,10 @@ int pkey_main(int argc, char **argv)
 
     if (text && text_pub)
         BIO_printf(bio_err,
-                   "Warning: The -text option is ignored with -text_pub\n");
+            "Warning: The -text option is ignored with -text_pub\n");
     if (traditional && (noout || outformat != FORMAT_PEM))
         BIO_printf(bio_err,
-                   "Warning: The -traditional is ignored since there is no PEM output\n");
+            "Warning: The -traditional is ignored since there is no PEM output\n");
 
     /* -pubout and -text is the same as -text_pub */
     if (!text_pub && pubout && text) {
@@ -195,11 +209,11 @@ int pkey_main(int argc, char **argv)
     if (cipher == NULL) {
         if (passoutarg != NULL)
             BIO_printf(bio_err,
-                       "Warning: The -passout option is ignored without a cipher option\n");
+                "Warning: The -passout option is ignored without a cipher option\n");
     } else {
         if (noout || outformat != FORMAT_PEM) {
             BIO_printf(bio_err,
-                       "Error: Cipher options are supported only for PEM output\n");
+                "Error: Cipher options are supported only for PEM output\n");
             goto end;
         }
     }
@@ -228,11 +242,11 @@ int pkey_main(int argc, char **argv)
 
         if (asn1_encoding != NULL)
             *p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_EC_ENCODING,
-                                                    asn1_encoding, 0);
+                asn1_encoding, 0);
         if (point_format != NULL)
             *p++ = OSSL_PARAM_construct_utf8_string(
-                       OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
-                       point_format, 0);
+                OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
+                point_format, 0);
         *p = OSSL_PARAM_construct_end();
         if (EVP_PKEY_set_params(pkey, params) <= 0)
             goto end;
@@ -275,19 +289,19 @@ int pkey_main(int argc, char **argv)
                 assert(private);
                 if (traditional) {
                     if (!PEM_write_bio_PrivateKey_traditional(out, pkey, cipher,
-                                                              NULL, 0, NULL,
-                                                              passout))
+                            NULL, 0, NULL,
+                            passout))
                         goto end;
                 } else {
                     if (!PEM_write_bio_PrivateKey(out, pkey, cipher,
-                                                  NULL, 0, NULL, passout))
+                            NULL, 0, NULL, passout))
                         goto end;
                 }
             }
         } else if (outformat == FORMAT_ASN1) {
             if (text || text_pub) {
                 BIO_printf(bio_err,
-                           "Error: Text output cannot be combined with DER output\n");
+                    "Error: Text output cannot be combined with DER output\n");
                 goto end;
             }
             if (pubout) {
@@ -315,7 +329,7 @@ int pkey_main(int argc, char **argv)
 
     ret = 0;
 
- end:
+end:
     if (ret != 0)
         ERR_print_errors(bio_err);
     EVP_PKEY_CTX_free(ctx);
diff --git a/crypto/openssl/apps/pkeyparam.c b/crypto/openssl/apps/pkeyparam.c
index fd8de0e02fe9..3c8fc740863c 100644
--- a/crypto/openssl/apps/pkeyparam.c
+++ b/crypto/openssl/apps/pkeyparam.c
@@ -18,29 +18,33 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_IN, OPT_OUT, OPT_TEXT, OPT_NOOUT,
-    OPT_ENGINE, OPT_CHECK,
+    OPT_IN,
+    OPT_OUT,
+    OPT_TEXT,
+    OPT_NOOUT,
+    OPT_ENGINE,
+    OPT_CHECK,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS pkeyparam_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
-    {"check", OPT_CHECK, '-', "Check key param consistency"},
+    { "check", OPT_CHECK, '-', "Check key param consistency" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
+    { "in", OPT_IN, '<', "Input file" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"text", OPT_TEXT, '-', "Print parameters as text"},
-    {"noout", OPT_NOOUT, '-', "Don't output encoded parameters"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "text", OPT_TEXT, '-', "Print parameters as text" },
+    { "noout", OPT_NOOUT, '-', "Don't output encoded parameters" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int pkeyparam_main(int argc, char **argv)
@@ -58,7 +62,7 @@ int pkeyparam_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -98,7 +102,7 @@ int pkeyparam_main(int argc, char **argv)
     if (in == NULL)
         goto end;
     pkey = PEM_read_bio_Parameters_ex(in, NULL, app_get0_libctx(),
-                                      app_get0_propq());
+        app_get0_propq());
     if (pkey == NULL) {
         BIO_printf(bio_err, "Error reading parameters\n");
         ERR_print_errors(bio_err);
@@ -111,7 +115,7 @@ int pkeyparam_main(int argc, char **argv)
     if (check) {
         if (e == NULL)
             ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey,
-                                             app_get0_propq());
+                app_get0_propq());
         else
             ctx = EVP_PKEY_CTX_new(pkey, e);
         if (ctx == NULL) {
@@ -142,7 +146,7 @@ int pkeyparam_main(int argc, char **argv)
 
     ret = EXIT_SUCCESS;
 
- end:
+end:
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(pkey);
     release_engine(e);
diff --git a/crypto/openssl/apps/pkeyutl.c b/crypto/openssl/apps/pkeyutl.c
index 5ddf1c02c09b..6b6a5d625ee7 100644
--- a/crypto/openssl/apps/pkeyutl.c
+++ b/crypto/openssl/apps/pkeyutl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -15,33 +15,33 @@
 #include <openssl/evp.h>
 #include <sys/stat.h>
 
-#define KEY_NONE        0
-#define KEY_PRIVKEY     1
-#define KEY_PUBKEY      2
-#define KEY_CERT        3
+#define KEY_NONE 0
+#define KEY_PRIVKEY 1
+#define KEY_PUBKEY 2
+#define KEY_CERT 3
 
 static EVP_PKEY *get_pkey(const char *kdfalg,
-                          const char *keyfile, int keyform, int key_type,
-                          char *passinarg, int pkey_op, ENGINE *e);
+    const char *keyfile, int keyform, int key_type,
+    char *passinarg, int pkey_op, ENGINE *e);
 static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
-                              int pkey_op, ENGINE *e,
-                              const int engine_impl, int rawin,
-                              EVP_PKEY *pkey /* ownership is passed to ctx */,
-                              EVP_MD_CTX *mctx, const char *digestname,
-                              const char *kemop, OSSL_LIB_CTX *libctx, const char *propq);
+    int pkey_op, ENGINE *e,
+    const int engine_impl, int rawin,
+    EVP_PKEY *pkey /* ownership is passed to ctx */,
+    EVP_MD_CTX *mctx, const char *digestname,
+    const char *kemop, OSSL_LIB_CTX *libctx, const char *propq);
 
 static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
-                      ENGINE *e);
+    ENGINE *e);
 
 static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
-                    unsigned char *out, size_t *poutlen,
-                    const unsigned char *in, size_t inlen,
-                    unsigned char *secret, size_t *psecretlen);
+    unsigned char *out, size_t *poutlen,
+    const unsigned char *in, size_t inlen,
+    unsigned char *secret, size_t *psecretlen);
 
 static int do_raw_keyop(int pkey_op, EVP_MD_CTX *mctx,
-                        EVP_PKEY *pkey, BIO *in,
-                        int filesize, unsigned char *sig, size_t siglen,
-                        unsigned char **out, size_t *poutlen);
+    EVP_PKEY *pkey, BIO *in,
+    int filesize, unsigned char *sig, size_t siglen,
+    unsigned char **out, size_t *poutlen);
 
 static int only_nomd(EVP_PKEY *pkey)
 {
@@ -56,70 +56,95 @@ static int only_nomd(EVP_PKEY *pkey)
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_ENGINE_IMPL, OPT_IN, OPT_OUT,
-    OPT_PUBIN, OPT_CERTIN, OPT_ASN1PARSE, OPT_HEXDUMP, OPT_SIGN,
-    OPT_VERIFY, OPT_VERIFYRECOVER, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT,
-    OPT_DERIVE, OPT_SIGFILE, OPT_INKEY, OPT_PEERKEY, OPT_PASSIN,
-    OPT_PEERFORM, OPT_KEYFORM, OPT_PKEYOPT, OPT_PKEYOPT_PASSIN, OPT_KDF,
-    OPT_KDFLEN, OPT_R_ENUM, OPT_PROV_ENUM,
-    OPT_DECAP, OPT_ENCAP, OPT_SECOUT, OPT_KEMOP,
+    OPT_ENGINE,
+    OPT_ENGINE_IMPL,
+    OPT_IN,
+    OPT_OUT,
+    OPT_PUBIN,
+    OPT_CERTIN,
+    OPT_ASN1PARSE,
+    OPT_HEXDUMP,
+    OPT_SIGN,
+    OPT_VERIFY,
+    OPT_VERIFYRECOVER,
+    OPT_REV,
+    OPT_ENCRYPT,
+    OPT_DECRYPT,
+    OPT_DERIVE,
+    OPT_SIGFILE,
+    OPT_INKEY,
+    OPT_PEERKEY,
+    OPT_PASSIN,
+    OPT_PEERFORM,
+    OPT_KEYFORM,
+    OPT_PKEYOPT,
+    OPT_PKEYOPT_PASSIN,
+    OPT_KDF,
+    OPT_KDFLEN,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM,
+    OPT_DECAP,
+    OPT_ENCAP,
+    OPT_SECOUT,
+    OPT_KEMOP,
     OPT_CONFIG,
-    OPT_RAWIN, OPT_DIGEST
+    OPT_RAWIN,
+    OPT_DIGEST
 } OPTION_CHOICE;
 
 const OPTIONS pkeyutl_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-    {"engine_impl", OPT_ENGINE_IMPL, '-',
-     "Also use engine given by -engine for crypto operations"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
+    { "engine_impl", OPT_ENGINE_IMPL, '-',
+        "Also use engine given by -engine for crypto operations" },
 #endif
-    {"sign", OPT_SIGN, '-', "Sign input data with private key"},
-    {"verify", OPT_VERIFY, '-', "Verify with public key"},
-    {"encrypt", OPT_ENCRYPT, '-', "Encrypt input data with public key"},
-    {"decrypt", OPT_DECRYPT, '-', "Decrypt input data with private key"},
-    {"derive", OPT_DERIVE, '-', "Derive shared secret from own and peer (EC)DH keys"},
-    {"decap", OPT_DECAP, '-', "Decapsulate shared secret"},
-    {"encap", OPT_ENCAP, '-', "Encapsulate shared secret"},
+    { "sign", OPT_SIGN, '-', "Sign input data with private key" },
+    { "verify", OPT_VERIFY, '-', "Verify with public key" },
+    { "encrypt", OPT_ENCRYPT, '-', "Encrypt input data with public key" },
+    { "decrypt", OPT_DECRYPT, '-', "Decrypt input data with private key" },
+    { "derive", OPT_DERIVE, '-', "Derive shared secret from own and peer (EC)DH keys" },
+    { "decap", OPT_DECAP, '-', "Decapsulate shared secret" },
+    { "encap", OPT_ENCAP, '-', "Encapsulate shared secret" },
     OPT_CONFIG_OPTION,
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file - default stdin"},
-    {"inkey", OPT_INKEY, 's', "Input key, by default private key"},
-    {"pubin", OPT_PUBIN, '-', "Input key is a public key"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"peerkey", OPT_PEERKEY, 's', "Peer key file used in key derivation"},
-    {"peerform", OPT_PEERFORM, 'E', "Peer key format (DER/PEM/P12/ENGINE)"},
-    {"certin", OPT_CERTIN, '-', "Input is a cert with a public key"},
-    {"rev", OPT_REV, '-', "Reverse the order of the input buffer"},
-    {"sigfile", OPT_SIGFILE, '<', "Signature file (verify operation only)"},
-    {"keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)"},
+    { "in", OPT_IN, '<', "Input file - default stdin" },
+    { "inkey", OPT_INKEY, 's', "Input key, by default private key" },
+    { "pubin", OPT_PUBIN, '-', "Input key is a public key" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "peerkey", OPT_PEERKEY, 's', "Peer key file used in key derivation" },
+    { "peerform", OPT_PEERFORM, 'E', "Peer key format (DER/PEM/P12/ENGINE)" },
+    { "certin", OPT_CERTIN, '-', "Input is a cert with a public key" },
+    { "rev", OPT_REV, '-', "Reverse the order of the input buffer" },
+    { "sigfile", OPT_SIGFILE, '<', "Signature file (verify operation only)" },
+    { "keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file - default stdout"},
-    {"secret", OPT_SECOUT, '>', "File to store secret on encapsulation"},
-    {"asn1parse", OPT_ASN1PARSE, '-',
-     "parse the output as ASN.1 data to check its DER encoding and print errors"},
-    {"hexdump", OPT_HEXDUMP, '-', "Hex dump output"},
-    {"verifyrecover", OPT_VERIFYRECOVER, '-',
-     "Verify RSA signature, recovering original signature input data"},
+    { "out", OPT_OUT, '>', "Output file - default stdout" },
+    { "secret", OPT_SECOUT, '>', "File to store secret on encapsulation" },
+    { "asn1parse", OPT_ASN1PARSE, '-',
+        "parse the output as ASN.1 data to check its DER encoding and print errors" },
+    { "hexdump", OPT_HEXDUMP, '-', "Hex dump output" },
+    { "verifyrecover", OPT_VERIFYRECOVER, '-',
+        "Verify RSA signature, recovering original signature input data" },
 
     OPT_SECTION("Signing/Derivation/Encapsulation"),
-    {"rawin", OPT_RAWIN, '-',
-     "Indicate that the signature/verification input data is not yet hashed"},
-    {"digest", OPT_DIGEST, 's',
-     "The digest algorithm to use for signing/verifying raw input data. Implies -rawin"},
-    {"pkeyopt", OPT_PKEYOPT, 's', "Public key options as opt:value"},
-    {"pkeyopt_passin", OPT_PKEYOPT_PASSIN, 's',
-     "Public key option that is read as a passphrase argument opt:passphrase"},
-    {"kdf", OPT_KDF, 's', "Use KDF algorithm"},
-    {"kdflen", OPT_KDFLEN, 'p', "KDF algorithm output length"},
-    {"kemop", OPT_KEMOP, 's', "KEM operation specific to the key algorithm"},
+    { "rawin", OPT_RAWIN, '-',
+        "Indicate that the signature/verification input data is not yet hashed" },
+    { "digest", OPT_DIGEST, 's',
+        "The digest algorithm to use for signing/verifying raw input data. Implies -rawin" },
+    { "pkeyopt", OPT_PKEYOPT, 's', "Public key options as opt:value" },
+    { "pkeyopt_passin", OPT_PKEYOPT_PASSIN, 's',
+        "Public key option that is read as a passphrase argument opt:passphrase" },
+    { "kdf", OPT_KDF, 's', "Use KDF algorithm" },
+    { "kdflen", OPT_KDFLEN, 'p', "KDF algorithm output length" },
+    { "kemop", OPT_KEMOP, 's', "KEM operation specific to the key algorithm" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int pkeyutl_main(int argc, char **argv)
@@ -156,7 +181,7 @@ int pkeyutl_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -263,17 +288,13 @@ int pkeyutl_main(int argc, char **argv)
             rev = 1;
             break;
         case OPT_PKEYOPT:
-            if ((pkeyopts == NULL &&
-                 (pkeyopts = sk_OPENSSL_STRING_new_null()) == NULL) ||
-                sk_OPENSSL_STRING_push(pkeyopts, opt_arg()) == 0) {
+            if ((pkeyopts == NULL && (pkeyopts = sk_OPENSSL_STRING_new_null()) == NULL) || sk_OPENSSL_STRING_push(pkeyopts, opt_arg()) == 0) {
                 BIO_puts(bio_err, "out of memory\n");
                 goto end;
             }
             break;
         case OPT_PKEYOPT_PASSIN:
-            if ((pkeyopts_passin == NULL &&
-                 (pkeyopts_passin = sk_OPENSSL_STRING_new_null()) == NULL) ||
-                sk_OPENSSL_STRING_push(pkeyopts_passin, opt_arg()) == 0) {
+            if ((pkeyopts_passin == NULL && (pkeyopts_passin = sk_OPENSSL_STRING_new_null()) == NULL) || sk_OPENSSL_STRING_push(pkeyopts_passin, opt_arg()) == 0) {
                 BIO_puts(bio_err, "out of memory\n");
                 goto end;
             }
@@ -300,20 +321,20 @@ int pkeyutl_main(int argc, char **argv)
     if (kdfalg != NULL) {
         if (kdflen == 0) {
             BIO_printf(bio_err,
-                       "%s: no KDF length given (-kdflen parameter).\n", prog);
+                "%s: no KDF length given (-kdflen parameter).\n", prog);
             goto opthelp;
         }
     } else if (inkey == NULL) {
         BIO_printf(bio_err,
-                   "%s: no private key given (-inkey parameter).\n", prog);
+            "%s: no private key given (-inkey parameter).\n", prog);
         goto opthelp;
     } else if (peerkey != NULL && pkey_op != EVP_PKEY_OP_DERIVE) {
         BIO_printf(bio_err,
-                   "%s: -peerkey option not allowed without -derive.\n", prog);
+            "%s: -peerkey option not allowed without -derive.\n", prog);
         goto opthelp;
     } else if (peerkey == NULL && pkey_op == EVP_PKEY_OP_DERIVE) {
         BIO_printf(bio_err,
-                   "%s: missing -peerkey option for -derive operation.\n", prog);
+            "%s: missing -peerkey option for -derive operation.\n", prog);
         goto opthelp;
     }
 
@@ -334,15 +355,15 @@ int pkeyutl_main(int argc, char **argv)
                 const char *alg = EVP_PKEY_get0_type_name(pkey);
 
                 BIO_printf(bio_err,
-                           "%s: -digest (prehash) is not supported with %s\n",
-                           prog, alg != NULL ? alg : "(unknown key type)");
+                    "%s: -digest (prehash) is not supported with %s\n",
+                    prog, alg != NULL ? alg : "(unknown key type)");
                 goto end;
             }
             rawin = 1;
         }
     } else if (digestname != NULL || rawin) {
         BIO_printf(bio_err,
-                   "%s: -digest and -rawin can only be used with -sign or -verify\n", prog);
+            "%s: -digest and -rawin can only be used with -sign or -verify\n", prog);
         goto opthelp;
     }
 
@@ -358,7 +379,7 @@ int pkeyutl_main(int argc, char **argv)
         }
     }
     ctx = init_ctx(kdfalg, &keysize, pkey_op, e, engine_impl, rawin, pkey,
-                   mctx, digestname, kemop, libctx, app_get0_propq());
+        mctx, digestname, kemop, libctx, app_get0_propq());
     if (ctx == NULL) {
         BIO_printf(bio_err, "%s: Error initializing context\n", prog);
         goto end;
@@ -376,7 +397,7 @@ int pkeyutl_main(int argc, char **argv)
 
             if (pkey_ctrl_string(ctx, opt) <= 0) {
                 BIO_printf(bio_err, "%s: Can't set parameter \"%s\":\n",
-                           prog, opt);
+                    prog, opt);
                 goto end;
             }
         }
@@ -397,7 +418,7 @@ int pkeyutl_main(int argc, char **argv)
 
                 BIO_snprintf(passwd_buf, sizeof(passwd_buf), "Enter %s: ", opt);
                 r = EVP_read_pw_string(passwd_buf, sizeof(passwd_buf) - 1,
-                                       passwd_buf, 0);
+                    passwd_buf, 0);
                 if (r < 0) {
                     if (r == -2)
                         BIO_puts(bio_err, "user abort\n");
@@ -425,7 +446,7 @@ int pkeyutl_main(int argc, char **argv)
 
             if (EVP_PKEY_CTX_ctrl_str(ctx, opt, passwd) <= 0) {
                 BIO_printf(bio_err, "%s: Can't set parameter \"%s\":\n",
-                           prog, opt);
+                    prog, opt);
                 OPENSSL_free(passwd);
                 goto end;
             }
@@ -435,13 +456,13 @@ int pkeyutl_main(int argc, char **argv)
 
     if (sigfile != NULL && (pkey_op != EVP_PKEY_OP_VERIFY)) {
         BIO_printf(bio_err,
-                   "%s: Signature file specified for non verify\n", prog);
+            "%s: Signature file specified for non verify\n", prog);
         goto end;
     }
 
     if (sigfile == NULL && (pkey_op == EVP_PKEY_OP_VERIFY)) {
         BIO_printf(bio_err,
-                   "%s: No signature file specified for verify\n", prog);
+            "%s: No signature file specified for verify\n", prog);
         goto end;
     }
 
@@ -460,7 +481,8 @@ int pkeyutl_main(int argc, char **argv)
         if (secoutfile != NULL) {
             BIO_printf(bio_err, "%s: Decapsulation produces only a shared "
                                 "secret and no output. The '-out' option "
-                                "is not applicable.\n", prog);
+                                "is not applicable.\n",
+                prog);
             goto end;
         }
         if ((out = bio_open_owner(outfile, 'w', FORMAT_BINARY)) == NULL)
@@ -525,9 +547,9 @@ int pkeyutl_main(int argc, char **argv)
         && (pkey_op == EVP_PKEY_OP_SIGN || pkey_op == EVP_PKEY_OP_VERIFY)) {
         if (buf_inlen > EVP_MAX_MD_SIZE) {
             BIO_printf(bio_err,
-                       "Error: The non-raw input data length %zd is too long - "
-                       "max supported hashed size is %d\n",
-                       buf_inlen, EVP_MAX_MD_SIZE);
+                "Error: The non-raw input data length %zd is too long - "
+                "max supported hashed size is %d\n",
+                buf_inlen, EVP_MAX_MD_SIZE);
             goto end;
         }
     }
@@ -535,7 +557,7 @@ int pkeyutl_main(int argc, char **argv)
     if (pkey_op == EVP_PKEY_OP_VERIFY) {
         if (rawin) {
             rv = do_raw_keyop(pkey_op, mctx, pkey, in, filesize, sig, siglen,
-                              NULL, 0);
+                NULL, 0);
         } else {
             rv = EVP_PKEY_verify(ctx, sig, siglen, buf_in, buf_inlen);
         }
@@ -550,7 +572,7 @@ int pkeyutl_main(int argc, char **argv)
     if (rawin) {
         /* rawin allocates the buffer in do_raw_keyop() */
         rv = do_raw_keyop(pkey_op, mctx, pkey, in, filesize, NULL, 0,
-                          &buf_out, (size_t *)&buf_outlen);
+            &buf_out, (size_t *)&buf_outlen);
     } else {
         if (kdflen != 0) {
             buf_outlen = kdflen;
@@ -560,8 +582,7 @@ int pkeyutl_main(int argc, char **argv)
                 buf_in, buf_inlen, NULL, &secretlen);
         }
         if (rv > 0
-            && (secretlen > 0 || (pkey_op != EVP_PKEY_OP_ENCAPSULATE
-                                  && pkey_op != EVP_PKEY_OP_DECAPSULATE))
+            && (secretlen > 0 || (pkey_op != EVP_PKEY_OP_ENCAPSULATE && pkey_op != EVP_PKEY_OP_DECAPSULATE))
             && (buf_outlen > 0 || pkey_op == EVP_PKEY_OP_DECAPSULATE)) {
             if (buf_outlen > 0)
                 buf_out = app_malloc(buf_outlen, "buffer output");
@@ -594,7 +615,7 @@ int pkeyutl_main(int argc, char **argv)
     if (secretlen > 0)
         BIO_write(secout ? secout : out, secret, secretlen);
 
- end:
+end:
     if (ret != 0)
         ERR_print_errors(bio_err);
     EVP_MD_CTX_free(mctx);
@@ -616,15 +637,15 @@ int pkeyutl_main(int argc, char **argv)
 }
 
 static EVP_PKEY *get_pkey(const char *kdfalg,
-                          const char *keyfile, int keyform, int key_type,
-                          char *passinarg, int pkey_op, ENGINE *e)
+    const char *keyfile, int keyform, int key_type,
+    char *passinarg, int pkey_op, ENGINE *e)
 {
     EVP_PKEY *pkey = NULL;
     char *passin = NULL;
     X509 *x;
 
     if (((pkey_op == EVP_PKEY_OP_SIGN) || (pkey_op == EVP_PKEY_OP_DECRYPT)
-         || (pkey_op == EVP_PKEY_OP_DERIVE))
+            || (pkey_op == EVP_PKEY_OP_DERIVE))
         && (key_type != KEY_PRIVKEY && kdfalg == NULL)) {
         BIO_printf(bio_err, "A private key is needed for this operation\n");
         return NULL;
@@ -652,18 +673,17 @@ static EVP_PKEY *get_pkey(const char *kdfalg,
 
     case KEY_NONE:
         break;
-
     }
     OPENSSL_free(passin);
     return pkey;
 }
 
 static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
-                              int pkey_op, ENGINE *e,
-                              const int engine_impl, int rawin,
-                              EVP_PKEY *pkey /* ownership is passed to ctx */,
-                              EVP_MD_CTX *mctx, const char *digestname,
-                              const char *kemop, OSSL_LIB_CTX *libctx, const char *propq)
+    int pkey_op, ENGINE *e,
+    const int engine_impl, int rawin,
+    EVP_PKEY *pkey /* ownership is passed to ctx */,
+    EVP_MD_CTX *mctx, const char *digestname,
+    const char *kemop, OSSL_LIB_CTX *libctx, const char *propq)
 {
     EVP_PKEY_CTX *ctx = NULL;
     ENGINE *impl = NULL;
@@ -681,7 +701,7 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
             kdfnid = OBJ_ln2nid(kdfalg);
             if (kdfnid == NID_undef) {
                 BIO_printf(bio_err, "The given KDF \"%s\" is unknown.\n",
-                           kdfalg);
+                    kdfalg);
                 return NULL;
             }
         }
@@ -709,12 +729,12 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
         switch (pkey_op) {
         case EVP_PKEY_OP_SIGN:
             rv = EVP_DigestSignInit_ex(mctx, NULL, digestname, libctx, propq,
-                                       pkey, NULL);
+                pkey, NULL);
             break;
 
         case EVP_PKEY_OP_VERIFY:
             rv = EVP_DigestVerifyInit_ex(mctx, NULL, digestname, libctx, propq,
-                                         pkey, NULL);
+                pkey, NULL);
             break;
         }
 
@@ -767,7 +787,7 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
 }
 
 static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
-                      ENGINE *e)
+    ENGINE *e)
 {
     EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx);
     EVP_PKEY *peer = NULL;
@@ -783,8 +803,8 @@ static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
     }
     if (strcmp(EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey)) != 0) {
         BIO_printf(bio_err,
-                   "Type of peer public key: %s does not match type of private key: %s\n",
-                   EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey));
+            "Type of peer public key: %s does not match type of private key: %s\n",
+            EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey));
         ret = 0;
     } else {
         ret = EVP_PKEY_derive_set_peer(ctx, peer) > 0;
@@ -795,9 +815,9 @@ static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
 }
 
 static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
-                    unsigned char *out, size_t *poutlen,
-                    const unsigned char *in, size_t inlen,
-                    unsigned char *secret, size_t *pseclen)
+    unsigned char *out, size_t *poutlen,
+    const unsigned char *in, size_t inlen,
+    unsigned char *secret, size_t *pseclen)
 {
     int rv = 0;
 
@@ -829,7 +849,6 @@ static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
     case EVP_PKEY_OP_DECAPSULATE:
         rv = EVP_PKEY_decapsulate(ctx, secret, pseclen, in, inlen);
         break;
-
     }
     return rv;
 }
@@ -837,9 +856,9 @@ static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
 #define TBUF_MAXSIZE 2048
 
 static int do_raw_keyop(int pkey_op, EVP_MD_CTX *mctx,
-                        EVP_PKEY *pkey, BIO *in,
-                        int filesize, unsigned char *sig, size_t siglen,
-                        unsigned char **out, size_t *poutlen)
+    EVP_PKEY *pkey, BIO *in,
+    int filesize, unsigned char *sig, size_t siglen,
+    unsigned char **out, size_t *poutlen)
 {
     int rv = 0;
     unsigned char tbuf[TBUF_MAXSIZE];
@@ -850,7 +869,7 @@ static int do_raw_keyop(int pkey_op, EVP_MD_CTX *mctx,
     if (only_nomd(pkey)) {
         if (filesize < 0) {
             BIO_printf(bio_err,
-                       "Error: unable to determine file size for oneshot operation\n");
+                "Error: unable to determine file size for oneshot operation\n");
             goto end;
         }
         mbuf = app_malloc(filesize, "oneshot sign/verify buffer");
@@ -920,7 +939,7 @@ static int do_raw_keyop(int pkey_op, EVP_MD_CTX *mctx,
         break;
     }
 
- end:
+end:
     OPENSSL_free(mbuf);
     return rv;
 }
diff --git a/crypto/openssl/apps/prime.c b/crypto/openssl/apps/prime.c
index 23b7e462fc20..8f373c5e79d8 100644
--- a/crypto/openssl/apps/prime.c
+++ b/crypto/openssl/apps/prime.c
@@ -15,7 +15,11 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_HEX, OPT_GENERATE, OPT_BITS, OPT_SAFE, OPT_CHECKS,
+    OPT_HEX,
+    OPT_GENERATE,
+    OPT_BITS,
+    OPT_SAFE,
+    OPT_CHECKS,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
@@ -28,33 +32,36 @@ static int check_num(const char *s, const int is_hex)
      */
     if (is_hex) {
         for (i = 0; ('0' <= s[i] && s[i] <= '9')
-                    || ('A' <= s[i] && s[i] <= 'F')
-                    || ('a' <= s[i] && s[i] <= 'f'); i++);
+            || ('A' <= s[i] && s[i] <= 'F')
+            || ('a' <= s[i] && s[i] <= 'f');
+            i++)
+            ;
     } else {
-        for (i = 0;  '0' <= s[i] && s[i] <= '9'; i++);
+        for (i = 0; '0' <= s[i] && s[i] <= '9'; i++)
+            ;
     }
     return s[i] == 0;
 }
 
 const OPTIONS prime_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [number...]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [number...]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"bits", OPT_BITS, 'p', "Size of number in bits"},
-    {"checks", OPT_CHECKS, 'p', "Number of checks"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "bits", OPT_BITS, 'p', "Size of number in bits" },
+    { "checks", OPT_CHECKS, 'p', "Number of checks" },
 
     OPT_SECTION("Output"),
-    {"hex", OPT_HEX, '-', "Hex output"},
-    {"generate", OPT_GENERATE, '-', "Generate a prime"},
-    {"safe", OPT_SAFE, '-',
-     "When used with -generate, generate a safe prime"},
+    { "hex", OPT_HEX, '-', "Hex output" },
+    { "generate", OPT_GENERATE, '-', "Generate a prime" },
+    { "safe", OPT_SAFE, '-',
+        "When used with -generate, generate a safe prime" },
 
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"number", 0, 0, "Number(s) to check for primality if not generating"},
-    {NULL}
+    { "number", 0, 0, "Number(s) to check for primality if not generating" },
+    { NULL }
 };
 
 int prime_main(int argc, char **argv)
@@ -69,7 +76,7 @@ int prime_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
-opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -133,7 +140,7 @@ opthelp:
         BIO_printf(bio_out, "%s\n", s);
         OPENSSL_free(s);
     } else {
-        for ( ; *argv; argv++) {
+        for (; *argv; argv++) {
             int r = check_num(argv[0], hex);
 
             if (r)
@@ -151,13 +158,13 @@ opthelp:
                 goto end;
             }
             BIO_printf(bio_out, " (%s) %s prime\n",
-                       argv[0],
-                       r == 1 ? "is" : "is not");
+                argv[0],
+                r == 1 ? "is" : "is not");
         }
     }
 
     ret = 0;
- end:
+end:
     BN_free(bn);
     return ret;
 }
diff --git a/crypto/openssl/apps/progs.pl b/crypto/openssl/apps/progs.pl
index 4a1e4be47c69..b0ad006c07ec 100755
--- a/crypto/openssl/apps/progs.pl
+++ b/crypto/openssl/apps/progs.pl
@@ -19,7 +19,10 @@ die "Unrecognised option, must be -C or -H\n"
     unless ($opt eq '-H' || $opt eq '-C');
 
 my %commands     = ();
-my $cmdre        = qr/^\s*int\s+([a-z_][a-z0-9_]*)_main\(\s*int\s+argc\s*,/;
+# I think it is best reconsidered in favour of just a table
+# of commands instead of this fragile regex. There really are not that
+# many commands.
+my $cmdre        = qr/^\s*(int\s+|)\s*([a-z_][a-z0-9_]*)_main\s*\(\s*int\s+argc\s*,/;
 my $apps_openssl = shift @ARGV;
 my $YEAR         = [gmtime($ENV{SOURCE_DATE_EPOCH} || time())]->[5] + 1900;
 
@@ -36,7 +39,7 @@ foreach my $filename (@openssl_source) {
     open F, $filename or die "Couldn't open $filename: $!\n";
     foreach ( grep /$cmdre/, <F> ) {
         my @foo = /$cmdre/;
-        $commands{$1} = 1;
+        $commands{$2} = 1;
     }
     close F;
 }
diff --git a/crypto/openssl/apps/rand.c b/crypto/openssl/apps/rand.c
index da747c1783e4..fa2dd2401d09 100644
--- a/crypto/openssl/apps/rand.c
+++ b/crypto/openssl/apps/rand.c
@@ -20,30 +20,34 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_OUT, OPT_ENGINE, OPT_BASE64, OPT_HEX,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_OUT,
+    OPT_ENGINE,
+    OPT_BASE64,
+    OPT_HEX,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS rand_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] num[K|M|G|T]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] num[K|M|G|T]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"base64", OPT_BASE64, '-', "Base64 encode output"},
-    {"hex", OPT_HEX, '-', "Hex encode output"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "base64", OPT_BASE64, '-', "Base64 encode output" },
+    { "hex", OPT_HEX, '-', "Hex encode output" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"num", 0, 0, "Number of bytes to generate"},
-    {NULL}
+    { "num", 0, 0, "Number of bytes to generate" },
+    { NULL }
 };
 
 int rand_main(int argc, char **argv)
@@ -63,7 +67,7 @@ int rand_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -124,7 +128,7 @@ int rand_main(int argc, char **argv)
              */
             while (argv[0][factoridx]) {
                 if (!isdigit((int)(argv[0][factoridx]))) {
-                    switch(argv[0][factoridx]) {
+                    switch (argv[0][factoridx]) {
                     case 'K':
                         shift = 10;
                         break;
@@ -139,7 +143,7 @@ int rand_main(int argc, char **argv)
                         break;
                     default:
                         BIO_printf(bio_err, "Invalid size suffix %s\n",
-                                   &argv[0][factoridx]);
+                            &argv[0][factoridx]);
                         goto opthelp;
                     }
                     break;
@@ -149,7 +153,7 @@ int rand_main(int argc, char **argv)
 
             if (shift != 0 && strlen(&argv[0][factoridx]) != 1) {
                 BIO_printf(bio_err, "Invalid size suffix %s\n",
-                           &argv[0][factoridx]);
+                    &argv[0][factoridx]);
                 goto opthelp;
             }
         }
@@ -164,7 +168,7 @@ int rand_main(int argc, char **argv)
             /* check for overflow */
             if ((UINT64_MAX >> shift) < (size_t)num) {
                 BIO_printf(bio_err, "%lu bytes with suffix overflows\n",
-                           num);
+                    num);
                 goto opthelp;
             }
             scaled_num = num << shift;
@@ -219,7 +223,7 @@ int rand_main(int argc, char **argv)
 
     ret = 0;
 
- end:
+end:
     if (ret != 0)
         ERR_print_errors(bio_err);
     OPENSSL_free(buf);
diff --git a/crypto/openssl/apps/rehash.c b/crypto/openssl/apps/rehash.c
index e6b12d36fb6f..e2083fa76bf1 100644
--- a/crypto/openssl/apps/rehash.c
+++ b/crypto/openssl/apps/rehash.c
@@ -12,15 +12,14 @@
 #include "apps.h"
 #include "progs.h"
 
-#if defined(OPENSSL_SYS_UNIX) || defined(__APPLE__) || \
-    (defined(__VMS) && defined(__DECC) && __CRTL_VER >= 80300000)
-# include <unistd.h>
-# include <stdio.h>
-# include <limits.h>
-# include <errno.h>
-# include <string.h>
-# include <ctype.h>
-# include <sys/stat.h>
+#if defined(OPENSSL_SYS_UNIX) || defined(__APPLE__) || (defined(__VMS) && defined(__DECC) && __CRTL_VER >= 80300000)
+#include <unistd.h>
+#include <stdio.h>
+#include <limits.h>
+#include <errno.h>
+#include <string.h>
+#include <ctype.h>
+#include <sys/stat.h>
 
 /*
  * Make sure that the processing of symbol names is treated the same as when
@@ -28,32 +27,32 @@
  * include/openssl/__DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H),
  * but not for internal headers.
  */
-# ifdef __VMS
-#  pragma names save
-#  pragma names as_is,shortened
-# endif
+#ifdef __VMS
+#pragma names save
+#pragma names as_is, shortened
+#endif
 
-# include "internal/o_dir.h"
+#include "internal/o_dir.h"
 
-# ifdef __VMS
-#  pragma names restore
-# endif
+#ifdef __VMS
+#pragma names restore
+#endif
 
-# include <openssl/evp.h>
-# include <openssl/pem.h>
-# include <openssl/x509.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/x509.h>
 
-# ifndef PATH_MAX
-#  define PATH_MAX 4096
-# endif
-# define MAX_COLLISIONS  256
+#ifndef PATH_MAX
+#define PATH_MAX 4096
+#endif
+#define MAX_COLLISIONS 256
 
-# if defined(OPENSSL_SYS_VXWORKS)
+#if defined(OPENSSL_SYS_VXWORKS)
 /*
  * VxWorks has no symbolic links
  */
 
-#  define lstat(path, buf) stat(path, buf)
+#define lstat(path, buf) stat(path, buf)
 
 int symlink(const char *target, const char *linkpath)
 {
@@ -66,7 +65,7 @@ ssize_t readlink(const char *pathname, char *buf, size_t bufsiz)
     errno = ENOSYS;
     return -1;
 }
-# endif
+#endif
 
 typedef struct hentry_st {
     struct hentry_st *next;
@@ -86,14 +85,16 @@ typedef struct bucket_st {
 
 enum Type {
     /* Keep in sync with |suffixes|, below. */
-    TYPE_CERT=0, TYPE_CRL=1
+    TYPE_CERT = 0,
+    TYPE_CRL = 1
 };
 
 enum Hash {
-    HASH_OLD, HASH_NEW, HASH_BOTH
+    HASH_OLD,
+    HASH_NEW,
+    HASH_BOTH
 };
 
-
 static int evpmdsize;
 static const EVP_MD *evpmd;
 static int remove_links = 1;
@@ -103,7 +104,6 @@ static BUCKET *hash_table[257];
 static const char *suffixes[] = { "", "r" };
 static const char *extensions[] = { "pem", "crt", "cer", "crl" };
 
-
 static void bit_set(unsigned char *set, unsigned int bit)
 {
     set[bit >> 3] |= 1 << (bit & 0x7);
@@ -114,13 +114,12 @@ static int bit_isset(unsigned char *set, unsigned int bit)
     return set[bit >> 3] & (1 << (bit & 0x7));
 }
 
-
 /*
  * Process an entry; return number of errors.
  */
 static int add_entry(enum Type type, unsigned int hash, const char *filename,
-                      const unsigned char *digest, int need_symlink,
-                      unsigned short old_id)
+    const unsigned char *digest, int need_symlink,
+    unsigned short old_id)
 {
     static BUCKET nilbucket;
     static HENTRY nilhentry;
@@ -143,9 +142,9 @@ static int add_entry(enum Type type, unsigned int hash, const char *filename,
     for (ep = bp->first_entry; ep; ep = ep->next) {
         if (digest && memcmp(digest, ep->digest, (size_t)evpmdsize) == 0) {
             BIO_printf(bio_err,
-                       "%s: warning: skipping duplicate %s in %s\n",
-                       opt_getprog(),
-                       type == TYPE_CERT ? "certificate" : "CRL", filename);
+                "%s: warning: skipping duplicate %s in %s\n",
+                opt_getprog(),
+                type == TYPE_CERT ? "certificate" : "CRL", filename);
             return 0;
         }
         if (strcmp(filename, ep->filename) == 0) {
@@ -158,8 +157,8 @@ static int add_entry(enum Type type, unsigned int hash, const char *filename,
     if (ep == NULL) {
         if (bp->num_needed >= MAX_COLLISIONS) {
             BIO_printf(bio_err,
-                       "%s: error: hash table overflow for %s\n",
-                       opt_getprog(), filename);
+                "%s: error: hash table overflow for %s\n",
+                opt_getprog(), filename);
             return 1;
         }
         ep = app_malloc(sizeof(*ep), "collision bucket");
@@ -212,7 +211,8 @@ static int handle_symlink(const char *filename, const char *fullpath)
         return -1;
     for (type = OSSL_NELEM(suffixes) - 1; type > 0; type--)
         if (OPENSSL_strncasecmp(&filename[i],
-                                suffixes[type], strlen(suffixes[type])) == 0)
+                suffixes[type], strlen(suffixes[type]))
+            == 0)
             break;
 
     i += strlen(suffixes[type]);
@@ -234,7 +234,7 @@ static int handle_symlink(const char *filename, const char *fullpath)
  */
 static int do_file(const char *filename, const char *fullpath, enum Hash h)
 {
-    STACK_OF (X509_INFO) *inf = NULL;
+    STACK_OF(X509_INFO) *inf = NULL;
     X509_INFO *x;
     const X509_NAME *name = NULL;
     BIO *b;
@@ -256,7 +256,7 @@ static int do_file(const char *filename, const char *fullpath, enum Hash h)
     /* Does it have X.509 data in it? */
     if ((b = BIO_new_file(fullpath, "r")) == NULL) {
         BIO_printf(bio_err, "%s: error: skipping %s, cannot open file\n",
-                   opt_getprog(), filename);
+            opt_getprog(), filename);
         errs++;
         goto end;
     }
@@ -267,9 +267,9 @@ static int do_file(const char *filename, const char *fullpath, enum Hash h)
 
     if (sk_X509_INFO_num(inf) != 1) {
         BIO_printf(bio_err,
-                   "%s: warning: skipping %s, "
-                   "it does not contain exactly one certificate or CRL\n",
-                   opt_getprog(), filename);
+            "%s: warning: skipping %s, "
+            "it does not contain exactly one certificate or CRL\n",
+            opt_getprog(), filename);
         /* This is not an error. */
         goto end;
     }
@@ -297,21 +297,20 @@ static int do_file(const char *filename, const char *fullpath, enum Hash h)
     if (name != NULL) {
         if (h == HASH_NEW || h == HASH_BOTH) {
             int ok;
-            unsigned long hash_value =
-                X509_NAME_hash_ex(name,
-                                  app_get0_libctx(), app_get0_propq(), &ok);
+            unsigned long hash_value = X509_NAME_hash_ex(name,
+                app_get0_libctx(), app_get0_propq(), &ok);
 
             if (ok) {
                 errs += add_entry(type, hash_value, filename, digest, 1, ~0);
             } else {
                 BIO_printf(bio_err, "%s: error calculating SHA1 hash value\n",
-                           opt_getprog());
+                    opt_getprog());
                 errs++;
             }
         }
         if ((h == HASH_OLD) || (h == HASH_BOTH))
             errs += add_entry(type, X509_NAME_hash_old(name),
-                              filename, digest, 1, ~0);
+                filename, digest, 1, ~0);
     }
 
 end:
@@ -328,17 +327,17 @@ static int ends_with_dirsep(const char *path)
 {
     if (*path != '\0')
         path += strlen(path) - 1;
-# if defined __VMS
+#if defined __VMS
     if (*path == ']' || *path == '>' || *path == ':')
         return 1;
-# elif defined _WIN32
+#elif defined _WIN32
     if (*path == '\\')
         return 1;
-# endif
+#endif
     return *path == '/';
 }
 
-static int sk_strcmp(const char * const *a, const char * const *b)
+static int sk_strcmp(const char *const *a, const char *const *b)
 {
     return strcmp(*a, *b);
 }
@@ -382,7 +381,7 @@ static int do_dir(const char *dirname, enum Hash h)
         size_t fname_len = strlen(filename);
 
         if ((copy = OPENSSL_strdup(filename)) == NULL
-                || sk_OPENSSL_STRING_push(files, copy) == 0) {
+            || sk_OPENSSL_STRING_push(files, copy) == 0) {
             OPENSSL_free(copy);
             OPENSSL_DIR_end(&d);
             BIO_puts(bio_err, "out of memory\n");
@@ -402,7 +401,8 @@ static int do_dir(const char *dirname, enum Hash h)
     for (n = 0; n < numfiles; ++n) {
         filename = sk_OPENSSL_STRING_value(files, n);
         if (BIO_snprintf(buf, buflen, "%s%s%s",
-                         dirname, pathsep, filename) >= buflen)
+                dirname, pathsep, filename)
+            >= buflen)
             continue;
         if (lstat(buf, &st) < 0)
             continue;
@@ -425,47 +425,47 @@ static int do_dir(const char *dirname, enum Hash h)
                 if (ep->old_id < bp->num_needed) {
                     /* Link exists, and is used as-is */
                     BIO_snprintf(buf, buflen, "%08x.%s%d", bp->hash,
-                                 suffixes[bp->type], ep->old_id);
+                        suffixes[bp->type], ep->old_id);
                     if (verbose)
                         BIO_printf(bio_out, "link %s -> %s\n",
-                                   ep->filename, buf);
+                            ep->filename, buf);
                 } else if (ep->need_symlink) {
                     /* New link needed (it may replace something) */
                     while (bit_isset(idmask, nextid))
                         nextid++;
 
                     BIO_snprintf(buf, buflen, "%s%s%08x.%s%d",
-                                 dirname, pathsep, bp->hash,
-                                 suffixes[bp->type], nextid);
+                        dirname, pathsep, bp->hash,
+                        suffixes[bp->type], nextid);
                     if (verbose)
                         BIO_printf(bio_out, "link %s -> %s\n",
-                                   ep->filename, &buf[dirlen]);
+                            ep->filename, &buf[dirlen]);
                     if (unlink(buf) < 0 && errno != ENOENT) {
                         BIO_printf(bio_err,
-                                   "%s: Can't unlink %s, %s\n",
-                                   opt_getprog(), buf, strerror(errno));
+                            "%s: Can't unlink %s, %s\n",
+                            opt_getprog(), buf, strerror(errno));
                         errs++;
                     }
                     if (symlink(ep->filename, buf) < 0) {
                         BIO_printf(bio_err,
-                                   "%s: Can't symlink %s, %s\n",
-                                   opt_getprog(), ep->filename,
-                                   strerror(errno));
+                            "%s: Can't symlink %s, %s\n",
+                            opt_getprog(), ep->filename,
+                            strerror(errno));
                         errs++;
                     }
                     bit_set(idmask, nextid);
                 } else if (remove_links) {
                     /* Link to be deleted */
                     BIO_snprintf(buf, buflen, "%s%s%08x.%s%d",
-                                 dirname, pathsep, bp->hash,
-                                 suffixes[bp->type], ep->old_id);
+                        dirname, pathsep, bp->hash,
+                        suffixes[bp->type], ep->old_id);
                     if (verbose)
                         BIO_printf(bio_out, "unlink %s\n",
-                                   &buf[dirlen]);
+                            &buf[dirlen]);
                     if (unlink(buf) < 0 && errno != ENOENT) {
                         BIO_printf(bio_err,
-                                   "%s: Can't unlink %s, %s\n",
-                                   opt_getprog(), buf, strerror(errno));
+                            "%s: Can't unlink %s, %s\n",
+                            opt_getprog(), buf, strerror(errno));
                         errs++;
                     }
                 }
@@ -477,7 +477,7 @@ static int do_dir(const char *dirname, enum Hash h)
         hash_table[i] = NULL;
     }
 
- err:
+err:
     sk_OPENSSL_STRING_pop_free(files, str_free);
     OPENSSL_free(buf);
     return errs;
@@ -485,31 +485,33 @@ static int do_dir(const char *dirname, enum Hash h)
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_COMPAT, OPT_OLD, OPT_N, OPT_VERBOSE,
+    OPT_COMPAT,
+    OPT_OLD,
+    OPT_N,
+    OPT_VERBOSE,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS rehash_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [directory...]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [directory...]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"h", OPT_HELP, '-', "Display this summary"},
-    {"compat", OPT_COMPAT, '-', "Create both new- and old-style hash links"},
-    {"old", OPT_OLD, '-', "Use old-style hash to generate links"},
-    {"n", OPT_N, '-', "Do not remove existing links"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "h", OPT_HELP, '-', "Display this summary" },
+    { "compat", OPT_COMPAT, '-', "Create both new- and old-style hash links" },
+    { "old", OPT_OLD, '-', "Use old-style hash to generate links" },
+    { "n", OPT_N, '-', "Do not remove existing links" },
 
     OPT_SECTION("Output"),
-    {"v", OPT_VERBOSE, '-', "Verbose output"},
+    { "v", OPT_VERBOSE, '-', "Verbose output" },
 
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"directory", 0, 0, "One or more directories to process (optional)"},
-    {NULL}
+    { "directory", 0, 0, "One or more directories to process (optional)" },
+    { NULL }
 };
 
-
 int rehash_main(int argc, char **argv)
 {
     const char *env, *prog;
@@ -575,13 +577,13 @@ int rehash_main(int argc, char **argv)
         errs += do_dir(X509_get_default_cert_dir(), h);
     }
 
- end:
+end:
     return errs;
 }
 
 #else
 const OPTIONS rehash_options[] = {
-    {NULL}
+    { NULL }
 };
 
 int rehash_main(int argc, char **argv)
diff --git a/crypto/openssl/apps/req.c b/crypto/openssl/apps/req.c
index c5627ffda542..1dad6abcc750 100644
--- a/crypto/openssl/apps/req.c
+++ b/crypto/openssl/apps/req.c
@@ -28,51 +28,51 @@
 #include <openssl/lhash.h>
 #include <openssl/rsa.h>
 #ifndef OPENSSL_NO_DSA
-# include <openssl/dsa.h>
+#include <openssl/dsa.h>
 #endif
-#include "internal/e_os.h"    /* For isatty() */
+#include "internal/e_os.h" /* For isatty() */
 
-#define BITS               "default_bits"
-#define KEYFILE            "default_keyfile"
-#define PROMPT             "prompt"
+#define BITS "default_bits"
+#define KEYFILE "default_keyfile"
+#define PROMPT "prompt"
 #define DISTINGUISHED_NAME "distinguished_name"
-#define ATTRIBUTES         "attributes"
-#define V3_EXTENSIONS      "x509_extensions"
-#define REQ_EXTENSIONS     "req_extensions"
-#define STRING_MASK        "string_mask"
-#define UTF8_IN            "utf8"
+#define ATTRIBUTES "attributes"
+#define V3_EXTENSIONS "x509_extensions"
+#define REQ_EXTENSIONS "req_extensions"
+#define STRING_MASK "string_mask"
+#define UTF8_IN "utf8"
 
 #define DEFAULT_KEY_LENGTH 2048
-#define MIN_KEY_LENGTH     512
-#define DEFAULT_DAYS       30 /* default certificate validity period in days */
-#define UNSET_DAYS         -2 /* -1 may be used for testing expiration checks */
-#define EXT_COPY_UNSET     -1
+#define MIN_KEY_LENGTH 512
+#define DEFAULT_DAYS 30 /* default certificate validity period in days */
+#define UNSET_DAYS -2 /* -1 may be used for testing expiration checks */
+#define EXT_COPY_UNSET -1
 
 static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, X509_NAME *fsubj,
-                    int mutlirdn, int attribs, unsigned long chtype);
+    int mutlirdn, int attribs, unsigned long chtype);
 static int prompt_info(X509_REQ *req,
-                       STACK_OF(CONF_VALUE) *dn_sk, const char *dn_sect,
-                       STACK_OF(CONF_VALUE) *attr_sk, const char *attr_sect,
-                       int attribs, unsigned long chtype);
+    STACK_OF(CONF_VALUE) *dn_sk, const char *dn_sect,
+    STACK_OF(CONF_VALUE) *attr_sk, const char *attr_sect,
+    int attribs, unsigned long chtype);
 static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
-                     STACK_OF(CONF_VALUE) *attr, int attribs,
-                     unsigned long chtype);
+    STACK_OF(CONF_VALUE) *attr, int attribs,
+    unsigned long chtype);
 static int add_attribute_object(X509_REQ *req, char *text, const char *def,
-                                char *value, int nid, int n_min, int n_max,
-                                unsigned long chtype);
+    char *value, int nid, int n_min, int n_max,
+    unsigned long chtype);
 static int add_DN_object(X509_NAME *n, char *text, const char *def,
-                         char *value, int nid, int n_min, int n_max,
-                         unsigned long chtype, int mval);
+    char *value, int nid, int n_min, int n_max,
+    unsigned long chtype, int mval);
 static int build_data(char *text, const char *def, char *value,
-                      int n_min, int n_max, char *buf, const int buf_size,
-                      const char *desc1, const char *desc2);
+    int n_min, int n_max, char *buf, const int buf_size,
+    const char *desc1, const char *desc2);
 static int req_check_len(int len, int n_min, int n_max);
 static int check_end(const char *str, const char *end);
 static int join(char buf[], size_t buf_size, const char *name,
-                const char *tail, const char *desc);
+    const char *tail, const char *desc);
 static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
-                                    char **pkeytype, long *pkeylen,
-                                    ENGINE *keygen_engine);
+    char **pkeytype, long *pkeylen,
+    ENGINE *keygen_engine);
 
 static const char *section = "req";
 static CONF *req_conf = NULL;
@@ -82,99 +82,138 @@ static int batch = 0;
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_CIPHER,
-    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_KEYGEN_ENGINE, OPT_KEY,
-    OPT_PUBKEY, OPT_NEW, OPT_CONFIG, OPT_KEYFORM, OPT_IN, OPT_OUT,
-    OPT_KEYOUT, OPT_PASSIN, OPT_PASSOUT, OPT_NEWKEY,
-    OPT_PKEYOPT, OPT_SIGOPT, OPT_VFYOPT, OPT_BATCH, OPT_NEWHDR, OPT_MODULUS,
-    OPT_VERIFY, OPT_NOENC, OPT_NODES, OPT_NOOUT, OPT_VERBOSE, OPT_UTF8,
-    OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT,
-    OPT_X509, OPT_X509V1, OPT_CA, OPT_CAKEY,
-    OPT_MULTIVALUE_RDN, OPT_NOT_BEFORE, OPT_NOT_AFTER, OPT_DAYS, OPT_SET_SERIAL,
-    OPT_COPY_EXTENSIONS, OPT_EXTENSIONS, OPT_REQEXTS, OPT_ADDEXT,
-    OPT_PRECERT, OPT_MD,
-    OPT_SECTION, OPT_QUIET,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_ENGINE,
+    OPT_KEYGEN_ENGINE,
+    OPT_KEY,
+    OPT_PUBKEY,
+    OPT_NEW,
+    OPT_CONFIG,
+    OPT_KEYFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_KEYOUT,
+    OPT_PASSIN,
+    OPT_PASSOUT,
+    OPT_NEWKEY,
+    OPT_PKEYOPT,
+    OPT_SIGOPT,
+    OPT_VFYOPT,
+    OPT_BATCH,
+    OPT_NEWHDR,
+    OPT_MODULUS,
+    OPT_VERIFY,
+    OPT_NOENC,
+    OPT_NODES,
+    OPT_NOOUT,
+    OPT_VERBOSE,
+    OPT_UTF8,
+    OPT_NAMEOPT,
+    OPT_REQOPT,
+    OPT_SUBJ,
+    OPT_SUBJECT,
+    OPT_TEXT,
+    OPT_X509,
+    OPT_X509V1,
+    OPT_CA,
+    OPT_CAKEY,
+    OPT_MULTIVALUE_RDN,
+    OPT_NOT_BEFORE,
+    OPT_NOT_AFTER,
+    OPT_DAYS,
+    OPT_SET_SERIAL,
+    OPT_COPY_EXTENSIONS,
+    OPT_EXTENSIONS,
+    OPT_REQEXTS,
+    OPT_ADDEXT,
+    OPT_PRECERT,
+    OPT_MD,
+    OPT_SECTION,
+    OPT_QUIET,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS req_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"cipher", OPT_CIPHER, 's', "Specify the cipher for private key encryption"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "cipher", OPT_CIPHER, 's', "Specify the cipher for private key encryption" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-    {"keygen_engine", OPT_KEYGEN_ENGINE, 's',
-     "Specify engine to be used for key generation operations"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
+    { "keygen_engine", OPT_KEYGEN_ENGINE, 's',
+        "Specify engine to be used for key generation operations" },
 #endif
-    {"in", OPT_IN, '<', "X.509 request input file (default stdin)"},
-    {"inform", OPT_INFORM, 'F',
-     "CSR input format to use (PEM or DER; by default try PEM first)"},
-    {"verify", OPT_VERIFY, '-', "Verify self-signature on the request"},
+    { "in", OPT_IN, '<', "X.509 request input file (default stdin)" },
+    { "inform", OPT_INFORM, 'F',
+        "CSR input format to use (PEM or DER; by default try PEM first)" },
+    { "verify", OPT_VERIFY, '-', "Verify self-signature on the request" },
 
     OPT_SECTION("Certificate"),
-    {"new", OPT_NEW, '-', "New request"},
-    {"config", OPT_CONFIG, '<', "Request template file"},
-    {"section", OPT_SECTION, 's', "Config section to use (default \"req\")"},
-    {"utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)"},
-    {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
-    {"reqopt", OPT_REQOPT, 's', "Various request text options"},
-    {"text", OPT_TEXT, '-', "Text form of request"},
-    {"x509", OPT_X509, '-',
-     "Output an X.509 certificate structure instead of a cert request"},
-    {"x509v1", OPT_X509V1, '-', "Request cert generation with X.509 version 1"},
-    {"CA", OPT_CA, '<', "Issuer cert to use for signing a cert, implies -x509"},
-    {"CAkey", OPT_CAKEY, 's',
-     "Issuer private key to use with -CA; default is -CA arg"},
-    {OPT_MORE_STR, 1, 1, "(Required by some CA's)"},
-    {"subj", OPT_SUBJ, 's', "Set or modify subject of request or cert"},
-    {"subject", OPT_SUBJECT, '-',
-     "Print the subject of the output request or cert"},
-    {"multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
-     "Deprecated; multi-valued RDNs support is always on."},
-    {"not_before", OPT_NOT_BEFORE, 's',
-     "[CC]YYMMDDHHMMSSZ value for notBefore certificate field"},
-    {"not_after", OPT_NOT_AFTER, 's',
-     "[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days"},
-    {"days", OPT_DAYS, 'p', "Number of days certificate is valid for"},
-    {"set_serial", OPT_SET_SERIAL, 's', "Serial number to use"},
-    {"copy_extensions", OPT_COPY_EXTENSIONS, 's',
-     "copy extensions from request when using -x509"},
-    {"extensions", OPT_EXTENSIONS, 's',
-     "Cert or request extension section (override value in config file)"},
-    {"reqexts", OPT_REQEXTS, 's', "An alias for -extensions"},
-    {"addext", OPT_ADDEXT, 's',
-     "Additional cert extension key=value pair (may be given more than once)"},
-    {"precert", OPT_PRECERT, '-', "Add a poison extension to generated cert (implies -new)"},
+    { "new", OPT_NEW, '-', "New request" },
+    { "config", OPT_CONFIG, '<', "Request template file" },
+    { "section", OPT_SECTION, 's', "Config section to use (default \"req\")" },
+    { "utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)" },
+    { "nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options" },
+    { "reqopt", OPT_REQOPT, 's', "Various request text options" },
+    { "text", OPT_TEXT, '-', "Text form of request" },
+    { "x509", OPT_X509, '-',
+        "Output an X.509 certificate structure instead of a cert request" },
+    { "x509v1", OPT_X509V1, '-', "Request cert generation with X.509 version 1" },
+    { "CA", OPT_CA, '<', "Issuer cert to use for signing a cert, implies -x509" },
+    { "CAkey", OPT_CAKEY, 's',
+        "Issuer private key to use with -CA; default is -CA arg" },
+    { OPT_MORE_STR, 1, 1, "(Required by some CA's)" },
+    { "subj", OPT_SUBJ, 's', "Set or modify subject of request or cert" },
+    { "subject", OPT_SUBJECT, '-',
+        "Print the subject of the output request or cert" },
+    { "multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
+        "Deprecated; multi-valued RDNs support is always on." },
+    { "not_before", OPT_NOT_BEFORE, 's',
+        "[CC]YYMMDDHHMMSSZ value for notBefore certificate field" },
+    { "not_after", OPT_NOT_AFTER, 's',
+        "[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days" },
+    { "days", OPT_DAYS, 'p', "Number of days certificate is valid for" },
+    { "set_serial", OPT_SET_SERIAL, 's', "Serial number to use" },
+    { "copy_extensions", OPT_COPY_EXTENSIONS, 's',
+        "copy extensions from request when using -x509" },
+    { "extensions", OPT_EXTENSIONS, 's',
+        "Cert or request extension section (override value in config file)" },
+    { "reqexts", OPT_REQEXTS, 's', "An alias for -extensions" },
+    { "addext", OPT_ADDEXT, 's',
+        "Additional cert extension key=value pair (may be given more than once)" },
+    { "precert", OPT_PRECERT, '-', "Add a poison extension to generated cert (implies -new)" },
 
     OPT_SECTION("Keys and Signing"),
-    {"key", OPT_KEY, 's', "Key for signing, and to include unless -in given"},
-    {"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"},
-    {"pubkey", OPT_PUBKEY, '-', "Output public key"},
-    {"keyout", OPT_KEYOUT, '>', "File to write private key to"},
-    {"passin", OPT_PASSIN, 's', "Private key and certificate password source"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
-    {"newkey", OPT_NEWKEY, 's',
-     "Generate new key with [<alg>:]<nbits> or <alg>[:<file>] or param:<file>"},
-    {"pkeyopt", OPT_PKEYOPT, 's', "Public key options as opt:value"},
-    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
-    {"vfyopt", OPT_VFYOPT, 's', "Verification parameter in n:v form"},
-    {"", OPT_MD, '-', "Any supported digest"},
+    { "key", OPT_KEY, 's', "Key for signing, and to include unless -in given" },
+    { "keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)" },
+    { "pubkey", OPT_PUBKEY, '-', "Output public key" },
+    { "keyout", OPT_KEYOUT, '>', "File to write private key to" },
+    { "passin", OPT_PASSIN, 's', "Private key and certificate password source" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
+    { "newkey", OPT_NEWKEY, 's',
+        "Generate new key with [<alg>:]<nbits> or <alg>[:<file>] or param:<file>" },
+    { "pkeyopt", OPT_PKEYOPT, 's', "Public key options as opt:value" },
+    { "sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form" },
+    { "vfyopt", OPT_VFYOPT, 's', "Verification parameter in n:v form" },
+    { "", OPT_MD, '-', "Any supported digest" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
-    {"batch", OPT_BATCH, '-',
-     "Do not ask anything during request generation"},
-    {"verbose", OPT_VERBOSE, '-', "Verbose output"},
-    {"quiet", OPT_QUIET, '-', "Terse output"},
-    {"noenc", OPT_NOENC, '-', "Don't encrypt private keys"},
-    {"nodes", OPT_NODES, '-', "Don't encrypt private keys; deprecated"},
-    {"noout", OPT_NOOUT, '-', "Do not output REQ"},
-    {"newhdr", OPT_NEWHDR, '-', "Output \"NEW\" in the header lines"},
-    {"modulus", OPT_MODULUS, '-', "RSA modulus"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'F', "Output format - DER or PEM" },
+    { "batch", OPT_BATCH, '-',
+        "Do not ask anything during request generation" },
+    { "verbose", OPT_VERBOSE, '-', "Verbose output" },
+    { "quiet", OPT_QUIET, '-', "Terse output" },
+    { "noenc", OPT_NOENC, '-', "Don't encrypt private keys" },
+    { "nodes", OPT_NODES, '-', "Don't encrypt private keys; deprecated" },
+    { "noout", OPT_NOOUT, '-', "Do not output REQ" },
+    { "newhdr", OPT_NEWHDR, '-', "Output \"NEW\" in the header lines" },
+    { "modulus", OPT_MODULUS, '-', "RSA modulus" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 /*
@@ -283,7 +322,7 @@ int req_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -360,7 +399,7 @@ int req_main(int argc, char **argv)
             if (pkeyopts == NULL)
                 pkeyopts = sk_OPENSSL_STRING_new_null();
             if (pkeyopts == NULL
-                    || !sk_OPENSSL_STRING_push(pkeyopts, opt_arg()))
+                || !sk_OPENSSL_STRING_push(pkeyopts, opt_arg()))
                 goto opthelp;
             break;
         case OPT_SIGOPT:
@@ -439,7 +478,7 @@ int req_main(int argc, char **argv)
             days = atoi(opt_arg());
             if (days <= UNSET_DAYS) {
                 BIO_printf(bio_err, "%s: -days parameter arg must be >= -1\n",
-                           prog);
+                    prog);
                 goto end;
             }
             break;
@@ -464,7 +503,7 @@ int req_main(int argc, char **argv)
         case OPT_COPY_EXTENSIONS:
             if (!set_ext_copy(&ext_copy, opt_arg())) {
                 BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n",
-                           opt_arg());
+                    opt_arg());
                 goto end;
             }
             break;
@@ -526,7 +565,7 @@ int req_main(int argc, char **argv)
             newreq = 1;
         else if (!newreq && isatty(fileno_stdin()))
             BIO_printf(bio_err,
-                       "Warning: Will read cert request from stdin since no -in option is given\n");
+                "Warning: Will read cert request from stdin since no -in option is given\n");
     }
 
     if (!app_passwd(passargin, passargout, &passin, &passout)) {
@@ -539,7 +578,7 @@ int req_main(int argc, char **argv)
     if (addext_bio != NULL) {
         if (verbose)
             BIO_printf(bio_err,
-                       "Using additional configuration from -addext options\n");
+                "Using additional configuration from -addext options\n");
         if ((addext_conf = app_load_config_bio(addext_bio, NULL)) == NULL)
             goto end;
     }
@@ -554,7 +593,7 @@ int req_main(int argc, char **argv)
             if (oid_bio == NULL) {
                 if (verbose)
                     BIO_printf(bio_err,
-                               "Problems opening '%s' for extra OIDs\n", p);
+                        "Problems opening '%s' for extra OIDs\n", p);
             } else {
                 OBJ_create_objects(oid_bio);
                 BIO_free(oid_bio);
@@ -577,7 +616,7 @@ int req_main(int argc, char **argv)
 
     if (extsect == NULL)
         extsect = app_conf_try_string(req_conf, section,
-                                   gen_x509 ? V3_EXTENSIONS : REQ_EXTENSIONS);
+            gen_x509 ? V3_EXTENSIONS : REQ_EXTENSIONS);
     if (extsect != NULL) {
         /* Check syntax of extension section in config file */
         X509V3_CTX ctx;
@@ -586,8 +625,8 @@ int req_main(int argc, char **argv)
         X509V3_set_nconf(&ctx, req_conf);
         if (!X509V3_EXT_add_nconf(req_conf, &ctx, extsect, NULL)) {
             BIO_printf(bio_err,
-                       "Error checking %s extension section %s\n",
-                       gen_x509 ? "x509" : "request", extsect);
+                "Error checking %s extension section %s\n",
+                gen_x509 ? "x509" : "request", extsect);
             goto end;
         }
     }
@@ -604,12 +643,10 @@ int req_main(int argc, char **argv)
     }
 
     if (passin == NULL)
-        passin = nofree_passin =
-            app_conf_try_string(req_conf, section, "input_password");
+        passin = nofree_passin = app_conf_try_string(req_conf, section, "input_password");
 
     if (passout == NULL)
-        passout = nofree_passout =
-            app_conf_try_string(req_conf, section, "output_password");
+        passout = nofree_passout = app_conf_try_string(req_conf, section, "output_password");
 
     p = app_conf_try_string(req_conf, section, STRING_MASK);
     if (p != NULL && !ASN1_STRING_set_default_mask_asc(p)) {
@@ -631,7 +668,7 @@ int req_main(int argc, char **argv)
     }
     if (keyalg != NULL && pkey != NULL) {
         BIO_printf(bio_err,
-                   "Warning: Not generating key via given -newkey option since -key is given\n");
+            "Warning: Not generating key via given -newkey option since -key is given\n");
         /* Better throw an error in this case */
     }
     if (newreq && pkey == NULL) {
@@ -649,7 +686,7 @@ int req_main(int argc, char **argv)
                 || EVP_PKEY_CTX_is_a(genctx, "RSA-PSS")
                 || EVP_PKEY_CTX_is_a(genctx, "DSA"))) {
             BIO_printf(bio_err, "Private key length too short, needs to be at least %d bits, not %ld.\n",
-                       MIN_KEY_LENGTH, newkey_len);
+                MIN_KEY_LENGTH, newkey_len);
             goto end;
         }
 
@@ -657,17 +694,17 @@ int req_main(int argc, char **argv)
             && (EVP_PKEY_CTX_is_a(genctx, "RSA")
                 || EVP_PKEY_CTX_is_a(genctx, "RSA-PSS")))
             BIO_printf(bio_err,
-                       "Warning: It is not recommended to use more than %d bit for RSA keys.\n"
-                       "         Your key size is %ld! Larger key size may behave not as expected.\n",
-                       OPENSSL_RSA_MAX_MODULUS_BITS, newkey_len);
+                "Warning: It is not recommended to use more than %d bit for RSA keys.\n"
+                "         Your key size is %ld! Larger key size may behave not as expected.\n",
+                OPENSSL_RSA_MAX_MODULUS_BITS, newkey_len);
 
 #ifndef OPENSSL_NO_DSA
         if (EVP_PKEY_CTX_is_a(genctx, "DSA")
-                && newkey_len > OPENSSL_DSA_MAX_MODULUS_BITS)
+            && newkey_len > OPENSSL_DSA_MAX_MODULUS_BITS)
             BIO_printf(bio_err,
-                       "Warning: It is not recommended to use more than %d bit for DSA keys.\n"
-                       "         Your key size is %ld! Larger key size may behave not as expected.\n",
-                       OPENSSL_DSA_MAX_MODULUS_BITS, newkey_len);
+                "Warning: It is not recommended to use more than %d bit for DSA keys.\n"
+                "         Your key size is %ld! Larger key size may behave not as expected.\n",
+                OPENSSL_DSA_MAX_MODULUS_BITS, newkey_len);
 #endif
 
         if (pkeyopts != NULL) {
@@ -703,7 +740,7 @@ int req_main(int argc, char **argv)
             else
                 BIO_printf(bio_err, "'%s'\n", keyout);
         }
-        out = bio_open_owner(keyout, outformat, newreq);
+        out = bio_open_owner(keyout, outformat, 1);
         if (out == NULL)
             goto end;
 
@@ -716,11 +753,10 @@ int req_main(int argc, char **argv)
             cipher = NULL;
 
         i = 0;
- loop:
+    loop:
         if (!PEM_write_bio_PrivateKey(out, pkey, cipher,
-                                      NULL, 0, NULL, passout)) {
-            if ((ERR_GET_REASON(ERR_peek_error()) ==
-                 PEM_R_PROBLEMS_GETTING_PASSWORD) && (i < 3)) {
+                NULL, 0, NULL, passout)) {
+            if ((ERR_GET_REASON(ERR_peek_error()) == PEM_R_PROBLEMS_GETTING_PASSWORD) && (i < 3)) {
                 ERR_clear_error();
                 i++;
                 goto loop;
@@ -737,20 +773,20 @@ int req_main(int argc, char **argv)
      * where characters may be escaped by \
      */
     if (subj != NULL
-            && (fsubj = parse_name(subj, chtype, multirdn, "subject")) == NULL)
+        && (fsubj = parse_name(subj, chtype, multirdn, "subject")) == NULL)
         goto end;
 
     if (!newreq) {
         if (keyfile != NULL)
             BIO_printf(bio_err,
-                       "Warning: Not placing -key in cert or request since request is used\n");
+                "Warning: Not placing -key in cert or request since request is used\n");
         req = load_csr_autofmt(infile /* if NULL, reads from stdin */,
-                               informat, vfyopts, "X509 request");
+            informat, vfyopts, "X509 request");
         if (req == NULL)
             goto end;
     } else if (infile != NULL) {
         BIO_printf(bio_err,
-                   "Warning: Ignoring -in option since -new or -newkey or -precert is given\n");
+            "Warning: Ignoring -in option since -new or -newkey or -precert is given\n");
         /* Better throw an error in this case, as done in the x509 app */
     }
 
@@ -759,30 +795,32 @@ int req_main(int argc, char **argv)
     if (CAkeyfile != NULL) {
         if (CAfile == NULL) {
             BIO_printf(bio_err,
-                       "Warning: Ignoring -CAkey option since no -CA option is given\n");
+                "Warning: Ignoring -CAkey option since no -CA option is given\n");
         } else {
             if ((CAkey = load_key(CAkeyfile, FORMAT_UNDEF,
-                                  0, passin, e,
-                                  CAkeyfile != CAfile
-                                  ? "issuer private key from -CAkey arg"
-                                  : "issuer private key from -CA arg")) == NULL)
+                     0, passin, e,
+                     CAkeyfile != CAfile
+                         ? "issuer private key from -CAkey arg"
+                         : "issuer private key from -CA arg"))
+                == NULL)
                 goto end;
         }
     }
     if (CAfile != NULL) {
         if ((CAcert = load_cert_pass(CAfile, FORMAT_UNDEF, 1, passin,
-                                     "issuer cert from -CA arg")) == NULL)
+                 "issuer cert from -CA arg"))
+            == NULL)
             goto end;
         if (!X509_check_private_key(CAcert, CAkey)) {
             BIO_printf(bio_err,
-                       "Issuer CA certificate and key do not match\n");
+                "Issuer CA certificate and key do not match\n");
             goto end;
         }
     }
     if (newreq || gen_x509) {
         if (CAcert == NULL && pkey == NULL) {
             BIO_printf(bio_err, "Must provide a signature key using -key or"
-                " provide -CA / -CAkey\n");
+                                " provide -CA / -CAkey\n");
             goto end;
         }
 
@@ -802,17 +840,16 @@ int req_main(int argc, char **argv)
             EVP_PKEY *pub_key = X509_REQ_get0_pubkey(req);
             EVP_PKEY *issuer_key = CAcert != NULL ? CAkey : pkey;
             X509V3_CTX ext_ctx;
-            X509_NAME *issuer = CAcert != NULL ? X509_get_subject_name(CAcert) :
-                X509_REQ_get_subject_name(req);
-            X509_NAME *n_subj = fsubj != NULL ? fsubj :
-                X509_REQ_get_subject_name(req);
+            X509_NAME *issuer = CAcert != NULL ? X509_get_subject_name(CAcert) : X509_REQ_get_subject_name(req);
+            X509_NAME *n_subj = fsubj != NULL ? fsubj : X509_REQ_get_subject_name(req);
 
             if (CAcert != NULL && keyfile != NULL)
                 BIO_printf(bio_err,
-                           "Warning: Not using -key or -newkey for signing since -CA option is given\n");
+                    "Warning: Not using -key or -newkey for signing since -CA option is given\n");
 
             if ((new_x509 = X509_new_ex(app_get0_libctx(),
-                                        app_get0_propq())) == NULL)
+                     app_get0_propq()))
+                == NULL)
                 goto end;
 
             if (serial != NULL) {
@@ -828,7 +865,7 @@ int req_main(int argc, char **argv)
             if (days == UNSET_DAYS)
                 days = DEFAULT_DAYS;
             else if (not_after != NULL)
-                BIO_printf(bio_err,"Warning: -not_after option overriding -days option\n");
+                BIO_printf(bio_err, "Warning: -not_after option overriding -days option\n");
             if (!set_cert_times(new_x509, not_before, not_after, days, 1))
                 goto end;
             if (!X509_set_subject_name(new_x509, n_subj))
@@ -845,14 +882,14 @@ int req_main(int argc, char **argv)
 
             /* Set up V3 context struct */
             X509V3_set_ctx(&ext_ctx, CAcert != NULL ? CAcert : new_x509,
-                           new_x509, NULL, NULL, X509V3_CTX_REPLACE);
+                new_x509, NULL, NULL, X509V3_CTX_REPLACE);
             /* prepare fallback for AKID, but only if issuer cert == new_x509 */
             if (CAcert == NULL) {
                 if (!X509V3_set_issuer_pkey(&ext_ctx, issuer_key))
                     goto end;
                 if (!cert_matches_key(new_x509, issuer_key))
                     BIO_printf(bio_err,
-                               "Warning: Signature key and public key of cert do not match\n");
+                        "Warning: Signature key and public key of cert do not match\n");
             }
             X509V3_set_nconf(&ext_ctx, req_conf);
 
@@ -860,12 +897,12 @@ int req_main(int argc, char **argv)
             if (extsect != NULL
                 && !X509V3_EXT_add_nconf(req_conf, &ext_ctx, extsect, new_x509)) {
                 BIO_printf(bio_err, "Error adding x509 extensions from section %s\n",
-                           extsect);
+                    extsect);
                 goto end;
             }
             if (addext_conf != NULL
                 && !X509V3_EXT_add_nconf(addext_conf, &ext_ctx, "default",
-                                         new_x509)) {
+                    new_x509)) {
                 BIO_printf(bio_err, "Error adding x509 extensions defined via -addext\n");
                 goto end;
             }
@@ -873,14 +910,15 @@ int req_main(int argc, char **argv)
             /* If a pre-cert was requested, we need to add a poison extension */
             if (precert) {
                 if (X509_add1_ext_i2d(new_x509, NID_ct_precert_poison,
-                                      NULL, 1, 0) != 1) {
+                        NULL, 1, 0)
+                    != 1) {
                     BIO_printf(bio_err, "Error adding poison extension\n");
                     goto end;
                 }
             }
 
             i = do_X509_sign(new_x509, x509v1, issuer_key, digest, sigopts,
-                             &ext_ctx);
+                &ext_ctx);
             if (!i)
                 goto end;
         } else {
@@ -888,7 +926,7 @@ int req_main(int argc, char **argv)
 
             if (precert) {
                 BIO_printf(bio_err,
-                           "Warning: Ignoring -precert flag since no cert is produced\n");
+                    "Warning: Ignoring -precert flag since no cert is produced\n");
             }
             /* Set up V3 context struct */
             X509V3_set_ctx(&ext_ctx, NULL, NULL, req, NULL, X509V3_CTX_REPLACE);
@@ -898,12 +936,12 @@ int req_main(int argc, char **argv)
             if (extsect != NULL
                 && !X509V3_EXT_REQ_add_nconf(req_conf, &ext_ctx, extsect, req)) {
                 BIO_printf(bio_err, "Error adding request extensions from section %s\n",
-                           extsect);
+                    extsect);
                 goto end;
             }
             if (addext_conf != NULL
                 && !X509V3_EXT_REQ_add_nconf(addext_conf, &ext_ctx, "default",
-                                             req)) {
+                    req)) {
                 BIO_printf(bio_err, "Error adding request extensions defined via -addext\n");
                 goto end;
             }
@@ -944,7 +982,7 @@ int req_main(int argc, char **argv)
             goto end;
         if (i == 0) {
             BIO_printf(bio_err, "Certificate request self-signature verify failure\n");
-	    goto end;
+            goto end;
         } else /* i > 0 */
             BIO_printf(bio_out, "Certificate request self-signature verify OK\n");
     }
@@ -955,9 +993,8 @@ int req_main(int argc, char **argv)
     }
 
     out = bio_open_default(outfile,
-                           keyout != NULL && outfile != NULL &&
-                           strcmp(keyout, outfile) == 0 ? 'a' : 'w',
-                           outformat);
+        keyout != NULL && outfile != NULL && strcmp(keyout, outfile) == 0 ? 'a' : 'w',
+        outformat);
     if (out == NULL)
         goto end;
 
@@ -987,9 +1024,7 @@ int req_main(int argc, char **argv)
     }
 
     if (subject) {
-        print_name(out, "subject=", gen_x509
-                   ? X509_get_subject_name(new_x509)
-                   : X509_REQ_get_subject_name(req));
+        print_name(out, "subject=", gen_x509 ? X509_get_subject_name(new_x509) : X509_REQ_get_subject_name(req));
     }
 
     if (modulus) {
@@ -1040,7 +1075,7 @@ int req_main(int argc, char **argv)
         }
     }
     ret = 0;
- end:
+end:
     if (ret) {
         ERR_print_errors(bio_err);
     }
@@ -1074,7 +1109,7 @@ int req_main(int argc, char **argv)
 }
 
 static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, X509_NAME *fsubj,
-                    int multirdn, int attribs, unsigned long chtype)
+    int multirdn, int attribs, unsigned long chtype)
 {
     int ret = 0, i;
     char no_prompt = 0;
@@ -1113,7 +1148,7 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, X509_NAME *fsubj,
         i = auto_info(req, dn_sk, attr_sk, attribs, chtype);
     else
         i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs,
-                        chtype);
+            chtype);
     if (!i)
         goto err;
 
@@ -1121,14 +1156,14 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, X509_NAME *fsubj,
         goto err;
 
     ret = 1;
- err:
+err:
     return ret;
 }
 
 static int prompt_info(X509_REQ *req,
-                       STACK_OF(CONF_VALUE) *dn_sk, const char *dn_sect,
-                       STACK_OF(CONF_VALUE) *attr_sk, const char *attr_sect,
-                       int attribs, unsigned long chtype)
+    STACK_OF(CONF_VALUE) *dn_sk, const char *dn_sect,
+    STACK_OF(CONF_VALUE) *attr_sk, const char *attr_sect,
+    int attribs, unsigned long chtype)
 {
     int i;
     char *p, *q;
@@ -1142,22 +1177,22 @@ static int prompt_info(X509_REQ *req,
 
     if (!batch) {
         BIO_printf(bio_err,
-                   "You are about to be asked to enter information that will be incorporated\n");
+            "You are about to be asked to enter information that will be incorporated\n");
         BIO_printf(bio_err, "into your certificate request.\n");
         BIO_printf(bio_err,
-                   "What you are about to enter is what is called a Distinguished Name or a DN.\n");
+            "What you are about to enter is what is called a Distinguished Name or a DN.\n");
         BIO_printf(bio_err,
-                   "There are quite a few fields but you can leave some blank\n");
+            "There are quite a few fields but you can leave some blank\n");
         BIO_printf(bio_err,
-                   "For some fields there will be a default value,\n");
+            "For some fields there will be a default value,\n");
         BIO_printf(bio_err,
-                   "If you enter '.', the field will be left blank.\n");
+            "If you enter '.', the field will be left blank.\n");
         BIO_printf(bio_err, "-----\n");
     }
 
     if (sk_CONF_VALUE_num(dn_sk)) {
         i = -1;
- start:
+    start:
         for (;;) {
             i++;
             if (sk_CONF_VALUE_num(dn_sk) <= i)
@@ -1166,8 +1201,7 @@ static int prompt_info(X509_REQ *req,
             v = sk_CONF_VALUE_value(dn_sk, i);
             p = q = NULL;
             type = v->name;
-            if (!check_end(type, "_min") || !check_end(type, "_max") ||
-                !check_end(type, "_default") || !check_end(type, "_value"))
+            if (!check_end(type, "_min") || !check_end(type, "_max") || !check_end(type, "_default") || !check_end(type, "_value"))
                 continue;
             /*
              * Skip past any leading X. X: X, etc to allow for multiple
@@ -1210,7 +1244,7 @@ static int prompt_info(X509_REQ *req,
                 n_max = -1;
 
             if (!add_DN_object(subj, v->value, def, value, nid,
-                               n_min, n_max, chtype, mval))
+                    n_min, n_max, chtype, mval))
                 return 0;
         }
         if (X509_NAME_entry_count(subj) == 0) {
@@ -1222,13 +1256,13 @@ static int prompt_info(X509_REQ *req,
             if ((attr_sk != NULL) && (sk_CONF_VALUE_num(attr_sk) > 0)
                 && (!batch)) {
                 BIO_printf(bio_err,
-                           "\nPlease enter the following 'extra' attributes\n");
+                    "\nPlease enter the following 'extra' attributes\n");
                 BIO_printf(bio_err,
-                           "to be sent with your certificate request\n");
+                    "to be sent with your certificate request\n");
             }
 
             i = -1;
- start2:
+        start2:
             for (;;) {
                 i++;
                 if ((attr_sk == NULL) || (sk_CONF_VALUE_num(attr_sk) <= i))
@@ -1260,8 +1294,8 @@ static int prompt_info(X509_REQ *req,
                     n_max = -1;
 
                 if (!add_attribute_object(req,
-                                          v->value, def, value, nid, n_min,
-                                          n_max, chtype))
+                        v->value, def, value, nid, n_min,
+                        n_max, chtype))
                     return 0;
             }
         }
@@ -1271,12 +1305,11 @@ static int prompt_info(X509_REQ *req,
     }
 
     return 1;
-
 }
 
 static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
-                     STACK_OF(CONF_VALUE) *attr_sk, int attribs,
-                     unsigned long chtype)
+    STACK_OF(CONF_VALUE) *attr_sk, int attribs,
+    unsigned long chtype)
 {
     int i, spec_char, plus_char;
     char *p, *q;
@@ -1299,7 +1332,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
             spec_char = (*p == ':' || *p == ',' || *p == '.');
 #else
             spec_char = (*p == os_toascii[':'] || *p == os_toascii[',']
-                         || *p == os_toascii['.']);
+                || *p == os_toascii['.']);
 #endif
             if (spec_char) {
                 p++;
@@ -1320,10 +1353,9 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
             mval = 0;
         }
         if (!X509_NAME_add_entry_by_txt(subj, type, chtype,
-                                        (unsigned char *)v->value, -1, -1,
-                                        mval))
+                (unsigned char *)v->value, -1, -1,
+                mval))
             return 0;
-
     }
 
     if (!X509_NAME_entry_count(subj)) {
@@ -1334,7 +1366,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
         for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++) {
             v = sk_CONF_VALUE_value(attr_sk, i);
             if (!X509_REQ_add1_attr_by_txt(req, v->name, chtype,
-                                           (unsigned char *)v->value, -1))
+                    (unsigned char *)v->value, -1))
                 return 0;
         }
     }
@@ -1342,40 +1374,40 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
 }
 
 static int add_DN_object(X509_NAME *n, char *text, const char *def,
-                         char *value, int nid, int n_min, int n_max,
-                         unsigned long chtype, int mval)
+    char *value, int nid, int n_min, int n_max,
+    unsigned long chtype, int mval)
 {
     int ret = 0;
     char buf[1024];
 
     ret = build_data(text, def, value, n_min, n_max, buf, sizeof(buf),
-                     "DN value", "DN default");
+        "DN value", "DN default");
     if ((ret == 0) || (ret == 1))
         return ret;
     ret = 1;
 
     if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
-                                    (unsigned char *)buf, -1, -1, mval))
+            (unsigned char *)buf, -1, -1, mval))
         ret = 0;
 
     return ret;
 }
 
 static int add_attribute_object(X509_REQ *req, char *text, const char *def,
-                                char *value, int nid, int n_min,
-                                int n_max, unsigned long chtype)
+    char *value, int nid, int n_min,
+    int n_max, unsigned long chtype)
 {
     int ret = 0;
     char buf[1024];
 
     ret = build_data(text, def, value, n_min, n_max, buf, sizeof(buf),
-                     "Attribute value", "Attribute default");
+        "Attribute value", "Attribute default");
     if ((ret == 0) || (ret == 1))
         return ret;
     ret = 1;
 
     if (!X509_REQ_add1_attr_by_NID(req, nid, chtype,
-                                   (unsigned char *)buf, -1)) {
+            (unsigned char *)buf, -1)) {
         BIO_printf(bio_err, "Error adding attribute\n");
         ret = 0;
     }
@@ -1384,11 +1416,11 @@ static int add_attribute_object(X509_REQ *req, char *text, const char *def,
 }
 
 static int build_data(char *text, const char *def, char *value,
-                      int n_min, int n_max, char *buf, const int buf_size,
-                      const char *desc1, const char *desc2)
+    int n_min, int n_max, char *buf, const int buf_size,
+    const char *desc1, const char *desc2)
 {
     int i;
- start:
+start:
     if (!batch)
         BIO_printf(bio_err, "%s [%s]:", text, def);
     (void)BIO_flush(bio_err);
@@ -1439,12 +1471,12 @@ static int req_check_len(int len, int n_min, int n_max)
 {
     if (n_min > 0 && len < n_min) {
         BIO_printf(bio_err,
-                   "String too short, must be at least %d bytes long\n", n_min);
+            "String too short, must be at least %d bytes long\n", n_min);
         return 0;
     }
     if (n_max >= 0 && len > n_max) {
         BIO_printf(bio_err,
-                   "String too long, must be at most %d bytes long\n", n_max);
+            "String too long, must be at most %d bytes long\n", n_max);
         return 0;
     }
     return 1;
@@ -1469,7 +1501,7 @@ static int check_end(const char *str, const char *end)
  * overflow and producing an error message if there is.
  */
 static int join(char buf[], size_t buf_size, const char *name,
-                const char *tail, const char *desc)
+    const char *tail, const char *desc)
 {
     const size_t name_len = strlen(name), tail_len = strlen(tail);
 
@@ -1483,8 +1515,8 @@ static int join(char buf[], size_t buf_size, const char *name,
 }
 
 static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
-                                    char **pkeytype, long *pkeylen,
-                                    ENGINE *keygen_engine)
+    char **pkeytype, long *pkeylen,
+    ENGINE *keygen_engine)
 {
     EVP_PKEY_CTX *gctx = NULL;
     EVP_PKEY *param = NULL;
@@ -1520,8 +1552,8 @@ static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
             expect_paramfile = 1;
             if (p == NULL) {
                 BIO_printf(bio_err,
-                           "Parameter file requested but no path given: %s\n",
-                           gstr);
+                    "Parameter file requested but no path given: %s\n",
+                    gstr);
                 return NULL;
             }
         } else {
@@ -1604,19 +1636,19 @@ static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
             gctx = EVP_PKEY_CTX_new(param, keygen_engine);
         else
             gctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(),
-                                              param, app_get0_propq());
+                param, app_get0_propq());
         *pkeylen = EVP_PKEY_get_bits(param);
         EVP_PKEY_free(param);
     } else {
         if (keygen_engine != NULL) {
             int pkey_id = get_legacy_pkey_id(app_get0_libctx(), *pkeytype,
-                                             keygen_engine);
+                keygen_engine);
 
             if (pkey_id != NID_undef)
                 gctx = EVP_PKEY_CTX_new_id(pkey_id, keygen_engine);
         } else {
             gctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(),
-                                              *pkeytype, app_get0_propq());
+                *pkeytype, app_get0_propq());
         }
     }
 
@@ -1630,16 +1662,14 @@ static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
         EVP_PKEY_CTX_free(gctx);
         return NULL;
     }
-    if (keylen == -1 && (EVP_PKEY_CTX_is_a(gctx, "RSA")
-        || EVP_PKEY_CTX_is_a(gctx, "RSA-PSS")))
+    if (keylen == -1 && (EVP_PKEY_CTX_is_a(gctx, "RSA") || EVP_PKEY_CTX_is_a(gctx, "RSA-PSS")))
         keylen = *pkeylen;
 
     if (keylen != -1) {
         OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
         size_t bits = keylen;
 
-        params[0] =
-            OSSL_PARAM_construct_size_t(OSSL_PKEY_PARAM_BITS, &bits);
+        params[0] = OSSL_PARAM_construct_size_t(OSSL_PKEY_PARAM_BITS, &bits);
         if (EVP_PKEY_CTX_set_params(gctx, params) <= 0) {
             BIO_puts(bio_err, "Error setting keysize\n");
             EVP_PKEY_CTX_free(gctx);
@@ -1649,4 +1679,3 @@ static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
 
     return gctx;
 }
-
diff --git a/crypto/openssl/apps/rsa.c b/crypto/openssl/apps/rsa.c
index 9a4d16cbb01c..780f990ab5d3 100644
--- a/crypto/openssl/apps/rsa.c
+++ b/crypto/openssl/apps/rsa.c
@@ -34,63 +34,78 @@
 #include <openssl/core_dispatch.h>
 
 #ifndef OPENSSL_NO_RC4
-# define DEFAULT_PVK_ENCR_STRENGTH      2
+#define DEFAULT_PVK_ENCR_STRENGTH 2
 #else
-# define DEFAULT_PVK_ENCR_STRENGTH      0
+#define DEFAULT_PVK_ENCR_STRENGTH 0
 #endif
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
-    OPT_PUBIN, OPT_PUBOUT, OPT_PASSOUT, OPT_PASSIN,
-    OPT_RSAPUBKEY_IN, OPT_RSAPUBKEY_OUT,
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_ENGINE,
+    OPT_IN,
+    OPT_OUT,
+    OPT_PUBIN,
+    OPT_PUBOUT,
+    OPT_PASSOUT,
+    OPT_PASSIN,
+    OPT_RSAPUBKEY_IN,
+    OPT_RSAPUBKEY_OUT,
     /* Do not change the order here; see case statements below */
-    OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
-    OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_CHECK, OPT_CIPHER,
-    OPT_PROV_ENUM, OPT_TRADITIONAL
+    OPT_PVK_NONE,
+    OPT_PVK_WEAK,
+    OPT_PVK_STRONG,
+    OPT_NOOUT,
+    OPT_TEXT,
+    OPT_MODULUS,
+    OPT_CHECK,
+    OPT_CIPHER,
+    OPT_PROV_ENUM,
+    OPT_TRADITIONAL
 } OPTION_CHOICE;
 
 const OPTIONS rsa_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"check", OPT_CHECK, '-', "Verify key consistency"},
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "check", OPT_CHECK, '-', "Verify key consistency" },
+    { "", OPT_CIPHER, '-', "Any supported cipher" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, 's', "Input file"},
-    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"},
-    {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
-    {"RSAPublicKey_in", OPT_RSAPUBKEY_IN, '-', "Input is an RSAPublicKey"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+    { "in", OPT_IN, 's', "Input file" },
+    { "inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)" },
+    { "pubin", OPT_PUBIN, '-', "Expect a public key in input file" },
+    { "RSAPublicKey_in", OPT_RSAPUBKEY_IN, '-', "Input is an RSAPublicKey" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'f', "Output format, one of DER PEM PVK"},
-    {"pubout", OPT_PUBOUT, '-', "Output a public key"},
-    {"RSAPublicKey_out", OPT_RSAPUBKEY_OUT, '-', "Output is an RSAPublicKey"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
-    {"noout", OPT_NOOUT, '-', "Don't print key out"},
-    {"text", OPT_TEXT, '-', "Print the key in text"},
-    {"modulus", OPT_MODULUS, '-', "Print the RSA key modulus"},
-    {"traditional", OPT_TRADITIONAL, '-',
-     "Use traditional format for private keys"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'f', "Output format, one of DER PEM PVK" },
+    { "pubout", OPT_PUBOUT, '-', "Output a public key" },
+    { "RSAPublicKey_out", OPT_RSAPUBKEY_OUT, '-', "Output is an RSAPublicKey" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
+    { "noout", OPT_NOOUT, '-', "Don't print key out" },
+    { "text", OPT_TEXT, '-', "Print the key in text" },
+    { "modulus", OPT_MODULUS, '-', "Print the RSA key modulus" },
+    { "traditional", OPT_TRADITIONAL, '-',
+        "Use traditional format for private keys" },
 
 #ifndef OPENSSL_NO_RC4
     OPT_SECTION("PVK"),
-    {"pvk-strong", OPT_PVK_STRONG, '-', "Enable 'Strong' PVK encoding level (default)"},
-    {"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"},
-    {"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"},
+    { "pvk-strong", OPT_PVK_STRONG, '-', "Enable 'Strong' PVK encoding level (default)" },
+    { "pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level" },
+    { "pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding" },
 #endif
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 static int try_legacy_encoding(EVP_PKEY *pkey, int outformat, int pubout,
-                               BIO *out)
+    BIO *out)
 {
     int ret = 0;
 #ifndef OPENSSL_NO_DEPRECATED_3_0
@@ -109,10 +124,10 @@ static int try_legacy_encoding(EVP_PKEY *pkey, int outformat, int pubout,
             ret = PEM_write_bio_RSAPublicKey(out, rsa) > 0;
         else
             ret = PEM_write_bio_RSA_PUBKEY(out, rsa) > 0;
-# ifndef OPENSSL_NO_DSA
+#ifndef OPENSSL_NO_DSA
     } else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
         ret = i2b_PublicKey_bio(out, pkey) > 0;
-# endif
+#endif
     }
 #endif
 
@@ -145,7 +160,7 @@ int rsa_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -187,9 +202,9 @@ int rsa_main(int argc, char **argv)
         case OPT_RSAPUBKEY_OUT:
             pubout = 2;
             break;
-        case OPT_PVK_STRONG:    /* pvk_encr:= 2 */
-        case OPT_PVK_WEAK:      /* pvk_encr:= 1 */
-        case OPT_PVK_NONE:      /* pvk_encr:= 0 */
+        case OPT_PVK_STRONG: /* pvk_encr:= 2 */
+        case OPT_PVK_WEAK: /* pvk_encr:= 1 */
+        case OPT_PVK_NONE: /* pvk_encr:= 0 */
             pvk_encr = (o - OPT_PVK_NONE);
             break;
         case OPT_NOOUT:
@@ -338,7 +353,7 @@ int rsa_main(int argc, char **argv)
     } else {
         assert(private);
         selection = (OSSL_KEYMGMT_SELECT_KEYPAIR
-                     | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS);
+            | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS);
     }
 
     /* For DER based output, select the desired output structure */
@@ -359,8 +374,8 @@ int rsa_main(int argc, char **argv)
 
     /* Now, perform the encoding */
     ectx = OSSL_ENCODER_CTX_new_for_pkey(pkey, selection,
-                                         output_type, output_structure,
-                                         NULL);
+        output_type, output_structure,
+        NULL);
     if (OSSL_ENCODER_CTX_get_num_encoders(ectx) == 0) {
         if ((!pubout && !pubin)
             || !try_legacy_encoding(pkey, outformat, pubout, out))
@@ -380,8 +395,8 @@ int rsa_main(int argc, char **argv)
         if (passout != NULL)
             /* When passout given, override the passphrase prompter */
             OSSL_ENCODER_CTX_set_passphrase(ectx,
-                                            (const unsigned char *)passout,
-                                            strlen(passout));
+                (const unsigned char *)passout,
+                strlen(passout));
     }
 
     /* PVK is a bit special... */
@@ -401,7 +416,7 @@ int rsa_main(int argc, char **argv)
         goto end;
     }
     ret = 0;
- end:
+end:
     OSSL_ENCODER_CTX_free(ectx);
     release_engine(e);
     BIO_free_all(out);
diff --git a/crypto/openssl/apps/rsautl.c b/crypto/openssl/apps/rsautl.c
index 3ee8224f48d8..3c1194c1a586 100644
--- a/crypto/openssl/apps/rsautl.c
+++ b/crypto/openssl/apps/rsautl.c
@@ -16,57 +16,73 @@
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
 
-#define RSA_SIGN        1
-#define RSA_VERIFY      2
-#define RSA_ENCRYPT     3
-#define RSA_DECRYPT     4
+#define RSA_SIGN 1
+#define RSA_VERIFY 2
+#define RSA_ENCRYPT 3
+#define RSA_DECRYPT 4
 
-#define KEY_PRIVKEY     1
-#define KEY_PUBKEY      2
-#define KEY_CERT        3
+#define KEY_PRIVKEY 1
+#define KEY_PUBKEY 2
+#define KEY_CERT 3
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_IN, OPT_OUT, OPT_ASN1PARSE, OPT_HEXDUMP,
-    OPT_RSA_RAW, OPT_OAEP, OPT_PKCS, OPT_X931,
-    OPT_SIGN, OPT_VERIFY, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT,
-    OPT_PUBIN, OPT_CERTIN, OPT_INKEY, OPT_PASSIN, OPT_KEYFORM,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_ENGINE,
+    OPT_IN,
+    OPT_OUT,
+    OPT_ASN1PARSE,
+    OPT_HEXDUMP,
+    OPT_RSA_RAW,
+    OPT_OAEP,
+    OPT_PKCS,
+    OPT_X931,
+    OPT_SIGN,
+    OPT_VERIFY,
+    OPT_REV,
+    OPT_ENCRYPT,
+    OPT_DECRYPT,
+    OPT_PUBIN,
+    OPT_CERTIN,
+    OPT_INKEY,
+    OPT_PASSIN,
+    OPT_KEYFORM,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS rsautl_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"sign", OPT_SIGN, '-', "Sign with private key"},
-    {"verify", OPT_VERIFY, '-', "Verify with public key"},
-    {"encrypt", OPT_ENCRYPT, '-', "Encrypt with public key"},
-    {"decrypt", OPT_DECRYPT, '-', "Decrypt with private key"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "sign", OPT_SIGN, '-', "Sign with private key" },
+    { "verify", OPT_VERIFY, '-', "Verify with public key" },
+    { "encrypt", OPT_ENCRYPT, '-', "Encrypt with public key" },
+    { "decrypt", OPT_DECRYPT, '-', "Decrypt with private key" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"inkey", OPT_INKEY, 's', "Input key, by default an RSA private key"},
-    {"keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)"},
-    {"pubin", OPT_PUBIN, '-', "Input key is an RSA public pkey"},
-    {"certin", OPT_CERTIN, '-', "Input is a cert carrying an RSA public key"},
-    {"rev", OPT_REV, '-', "Reverse the order of the input buffer"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "inkey", OPT_INKEY, 's', "Input key, by default an RSA private key" },
+    { "keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)" },
+    { "pubin", OPT_PUBIN, '-', "Input key is an RSA public pkey" },
+    { "certin", OPT_CERTIN, '-', "Input is a cert carrying an RSA public key" },
+    { "rev", OPT_REV, '-', "Reverse the order of the input buffer" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file"},
-    {"raw", OPT_RSA_RAW, '-', "Use no padding"},
-    {"pkcs", OPT_PKCS, '-', "Use PKCS#1 v1.5 padding (default)"},
-    {"x931", OPT_X931, '-', "Use ANSI X9.31 padding"},
-    {"oaep", OPT_OAEP, '-', "Use PKCS#1 OAEP"},
-    {"asn1parse", OPT_ASN1PARSE, '-',
-     "Run output through asn1parse; useful with -verify"},
-    {"hexdump", OPT_HEXDUMP, '-', "Hex dump output"},
+    { "out", OPT_OUT, '>', "Output file" },
+    { "raw", OPT_RSA_RAW, '-', "Use no padding" },
+    { "pkcs", OPT_PKCS, '-', "Use PKCS#1 v1.5 padding (default)" },
+    { "x931", OPT_X931, '-', "Use ANSI X9.31 padding" },
+    { "oaep", OPT_OAEP, '-', "Use PKCS#1 OAEP" },
+    { "asn1parse", OPT_ASN1PARSE, '-',
+        "Run output through asn1parse; useful with -verify" },
+    { "hexdump", OPT_HEXDUMP, '-', "Hex dump output" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int rsautl_main(int argc, char **argv)
@@ -90,7 +106,7 @@ int rsautl_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -245,7 +261,8 @@ int rsautl_main(int argc, char **argv)
         rv = EVP_PKEY_verify_recover_init(ctx) > 0
             && EVP_PKEY_CTX_set_rsa_padding(ctx, pad) > 0
             && EVP_PKEY_verify_recover(ctx, rsa_out, &rsa_outlen,
-                                       rsa_in, rsa_inlen) > 0;
+                   rsa_in, rsa_inlen)
+                > 0;
         break;
     case RSA_SIGN:
         rv = EVP_PKEY_sign_init(ctx) > 0
@@ -279,7 +296,7 @@ int rsautl_main(int argc, char **argv)
     } else {
         BIO_write(out, rsa_out, rsa_outlen);
     }
- end:
+end:
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(pkey);
     release_engine(e);
diff --git a/crypto/openssl/apps/s_client.c b/crypto/openssl/apps/s_client.c
index 5c7f4a93c9fa..3625f8fcdc99 100644
--- a/crypto/openssl/apps/s_client.c
+++ b/crypto/openssl/apps/s_client.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright 2005 Nokia. All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -27,7 +27,7 @@
  * needed to have fileno() declared correctly...  So let's define u_int
  */
 #if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT)
-# define __U_INT
+#define __U_INT
 typedef unsigned int u_int;
 #endif
 
@@ -43,31 +43,31 @@ typedef unsigned int u_int;
 #include <openssl/trace.h>
 #include <openssl/async.h>
 #ifndef OPENSSL_NO_CT
-# include <openssl/ct.h>
+#include <openssl/ct.h>
 #endif
 #include "s_apps.h"
 #include "timeouts.h"
 #include "internal/sockets.h"
 
 #if defined(__has_feature)
-# if __has_feature(memory_sanitizer)
-#  include <sanitizer/msan_interface.h>
-# endif
+#if __has_feature(memory_sanitizer)
+#include <sanitizer/msan_interface.h>
+#endif
 #endif
 
 #undef BUFSIZZ
-#define BUFSIZZ 1024*16
+#define BUFSIZZ 1024 * 16
 #define S_CLIENT_IRC_READ_TIMEOUT 8
 
-#define USER_DATA_MODE_NONE     0
-#define USER_DATA_MODE_BASIC    1
+#define USER_DATA_MODE_NONE 0
+#define USER_DATA_MODE_BASIC 1
 #define USER_DATA_MODE_ADVANCED 2
 
 #define USER_DATA_PROCESS_BAD_ARGUMENT 0
-#define USER_DATA_PROCESS_SHUT         1
-#define USER_DATA_PROCESS_RESTART      2
-#define USER_DATA_PROCESS_NO_DATA      3
-#define USER_DATA_PROCESS_CONTINUE     4
+#define USER_DATA_PROCESS_SHUT 1
+#define USER_DATA_PROCESS_RESTART 2
+#define USER_DATA_PROCESS_NO_DATA 3
+#define USER_DATA_PROCESS_CONTINUE 4
 
 struct user_data_st {
     /* SSL connection we are processing commands for */
@@ -93,10 +93,10 @@ struct user_data_st {
 };
 
 static void user_data_init(struct user_data_st *user_data, SSL *con, char *buf,
-                           size_t bufmax, int mode);
+    size_t bufmax, int mode);
 static int user_data_add(struct user_data_st *user_data, size_t i);
 static int user_data_process(struct user_data_st *user_data, size_t *len,
-                             size_t *off);
+    size_t *off);
 static int user_data_has_data(struct user_data_st *user_data);
 
 static char *prog;
@@ -139,9 +139,9 @@ static char *psk_identity = "Client_identity";
 
 #ifndef OPENSSL_NO_PSK
 static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
-                                  unsigned int max_identity_len,
-                                  unsigned char *psk,
-                                  unsigned int max_psk_len)
+    unsigned int max_identity_len,
+    unsigned char *psk,
+    unsigned int max_psk_len)
 {
     int ret;
     long key_len;
@@ -153,7 +153,7 @@ static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
         /* no ServerKeyExchange message */
         if (c_debug)
             BIO_printf(bio_c_out,
-                       "NULL received PSK identity hint, continuing anyway\n");
+                "NULL received PSK identity hint, continuing anyway\n");
     } else if (c_debug) {
         BIO_printf(bio_c_out, "Received PSK identity hint '%s'\n", hint);
     }
@@ -166,19 +166,19 @@ static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
         goto out_err;
     if (c_debug)
         BIO_printf(bio_c_out, "created identity '%s' len=%d\n", identity,
-                   ret);
+            ret);
 
     /* convert the PSK key to binary */
     key = OPENSSL_hexstr2buf(psk_key, &key_len);
     if (key == NULL) {
         BIO_printf(bio_err, "Could not convert PSK key '%s' to buffer\n",
-                   psk_key);
+            psk_key);
         return 0;
     }
     if (max_psk_len > INT_MAX || key_len > (long)max_psk_len) {
         BIO_printf(bio_err,
-                   "psk buffer of callback is too small (%d) for key (%ld)\n",
-                   max_psk_len, key_len);
+            "psk buffer of callback is too small (%d) for key (%ld)\n",
+            max_psk_len, key_len);
         OPENSSL_free(key);
         return 0;
     }
@@ -190,7 +190,7 @@ static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
         BIO_printf(bio_c_out, "created PSK len=%ld\n", key_len);
 
     return key_len;
- out_err:
+out_err:
     if (c_debug)
         BIO_printf(bio_err, "Error in PSK client callback\n");
     return 0;
@@ -201,8 +201,8 @@ const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 };
 const unsigned char tls13_aes256gcmsha384_id[] = { 0x13, 0x02 };
 
 static int psk_use_session_cb(SSL *s, const EVP_MD *md,
-                              const unsigned char **id, size_t *idlen,
-                              SSL_SESSION **sess)
+    const unsigned char **id, size_t *idlen,
+    SSL_SESSION **sess)
 {
     SSL_SESSION *usesess = NULL;
     const SSL_CIPHER *cipher = NULL;
@@ -217,7 +217,7 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
 
         if (key == NULL) {
             BIO_printf(bio_err, "Could not convert PSK key '%s' to buffer\n",
-                       psk_key);
+                psk_key);
             return 0;
         }
 
@@ -231,9 +231,9 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
 
         usesess = SSL_SESSION_new();
         if (usesess == NULL
-                || !SSL_SESSION_set1_master_key(usesess, key, key_len)
-                || !SSL_SESSION_set_cipher(usesess, cipher)
-                || !SSL_SESSION_set_protocol_version(usesess, TLS1_3_VERSION)) {
+            || !SSL_SESSION_set1_master_key(usesess, key, key_len)
+            || !SSL_SESSION_set_cipher(usesess, cipher)
+            || !SSL_SESSION_set_protocol_version(usesess, TLS1_3_VERSION)) {
             OPENSSL_free(key);
             goto err;
         }
@@ -258,7 +258,7 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
 
     return 1;
 
- err:
+err:
     SSL_SESSION_free(usesess);
     return 0;
 }
@@ -271,7 +271,7 @@ typedef struct tlsextctx_st {
 
 static int ssl_servername_cb(SSL *s, int *ad, void *arg)
 {
-    tlsextctx *p = (tlsextctx *) arg;
+    tlsextctx *p = (tlsextctx *)arg;
     const char *hn = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
     if (SSL_get_servername_type(s) != -1)
         p->ack = !SSL_session_reused(s) && hn != NULL;
@@ -292,8 +292,8 @@ typedef struct tlsextnextprotoctx_st {
 static tlsextnextprotoctx next_proto;
 
 static int next_proto_cb(SSL *s, unsigned char **out, unsigned char *outlen,
-                         const unsigned char *in, unsigned int inlen,
-                         void *arg)
+    const unsigned char *in, unsigned int inlen,
+    void *arg)
 {
     tlsextnextprotoctx *ctx = arg;
 
@@ -310,15 +310,14 @@ static int next_proto_cb(SSL *s, unsigned char **out, unsigned char *outlen,
         BIO_write(bio_c_out, "\n", 1);
     }
 
-    ctx->status =
-        SSL_select_next_proto(out, outlen, in, inlen, ctx->data, ctx->len);
+    ctx->status = SSL_select_next_proto(out, outlen, in, inlen, ctx->data, ctx->len);
     return SSL_TLSEXT_ERR_OK;
 }
-#endif                         /* ndef OPENSSL_NO_NEXTPROTONEG */
+#endif /* ndef OPENSSL_NO_NEXTPROTONEG */
 
 static int serverinfo_cli_parse_cb(SSL *s, unsigned int ext_type,
-                                   const unsigned char *in, size_t inlen,
-                                   int *al, void *arg)
+    const unsigned char *in, size_t inlen,
+    int *al, void *arg)
 {
     char pem_name[100];
     unsigned char ext_buf[4 + 65536];
@@ -332,7 +331,7 @@ static int serverinfo_cli_parse_cb(SSL *s, unsigned int ext_type,
     memcpy(ext_buf + 4, in, inlen);
 
     BIO_snprintf(pem_name, sizeof(pem_name), "SERVERINFO FOR EXTENSION %d",
-                 ext_type);
+        ext_type);
     PEM_write_bio(bio_c_out, pem_name, "", ext_buf, 4 + inlen);
     return 1;
 }
@@ -396,9 +395,7 @@ static ossl_ssize_t checked_uint8(const char **inptr, void *out)
     v = strtol(in, &endp, 10);
     e = restore_errno();
 
-    if (((v == LONG_MIN || v == LONG_MAX) && e == ERANGE) ||
-        endp == in || !isspace(_UC(*endp)) ||
-        v != (*result = (uint8_t) v)) {
+    if (((v == LONG_MIN || v == LONG_MAX) && e == ERANGE) || endp == in || !isspace(_UC(*endp)) || v != (*result = (uint8_t)v)) {
         return -1;
     }
     for (in = endp; isspace(_UC(*in)); ++in)
@@ -426,7 +423,9 @@ static int tlsa_import_rr(SSL *con, const char *rrdata)
         { &selector, "selector", checked_uint8 },
         { &mtype, "mtype", checked_uint8 },
         { &data, "data", hexdecode },
-        { NULL, }
+        {
+            NULL,
+        }
     };
     struct tlsa_field *f;
     int ret;
@@ -437,7 +436,7 @@ static int tlsa_import_rr(SSL *con, const char *rrdata)
         /* Returns number of bytes produced, advances cp to next field */
         if ((len = f->parser(&cp, f->var)) <= 0) {
             BIO_printf(bio_err, "%s: warning: bad TLSA %s field in: %s\n",
-                       prog, f->name, rrdata);
+                prog, f->name, rrdata);
             return 0;
         }
     }
@@ -448,13 +447,13 @@ static int tlsa_import_rr(SSL *con, const char *rrdata)
     if (ret == 0) {
         ERR_print_errors(bio_err);
         BIO_printf(bio_err, "%s: warning: unusable TLSA rrdata: %s\n",
-                   prog, rrdata);
+            prog, rrdata);
         return 0;
     }
     if (ret < 0) {
         ERR_print_errors(bio_err);
         BIO_printf(bio_err, "%s: warning: error loading TLSA rrdata: %s\n",
-                   prog, rrdata);
+            prog, rrdata);
         return 0;
     }
     return ret;
@@ -476,284 +475,369 @@ static int tlsa_import_rrset(SSL *con, STACK_OF(OPENSSL_STRING) *rrset)
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_4, OPT_6, OPT_HOST, OPT_PORT, OPT_CONNECT, OPT_BIND, OPT_UNIX,
-    OPT_XMPPHOST, OPT_VERIFY, OPT_NAMEOPT,
-    OPT_CERT, OPT_CRL, OPT_CRL_DOWNLOAD, OPT_SESS_OUT, OPT_SESS_IN,
-    OPT_CERTFORM, OPT_CRLFORM, OPT_VERIFY_RET_ERROR, OPT_VERIFY_QUIET,
-    OPT_BRIEF, OPT_PREXIT, OPT_NO_INTERACTIVE, OPT_CRLF, OPT_QUIET, OPT_NBIO,
-    OPT_SSL_CLIENT_ENGINE, OPT_IGN_EOF, OPT_NO_IGN_EOF,
-    OPT_DEBUG, OPT_TLSEXTDEBUG, OPT_STATUS, OPT_WDEBUG,
-    OPT_MSG, OPT_MSGFILE, OPT_ENGINE, OPT_TRACE, OPT_SECURITY_DEBUG,
-    OPT_SECURITY_DEBUG_VERBOSE, OPT_SHOWCERTS, OPT_NBIO_TEST, OPT_STATE,
-    OPT_PSK_IDENTITY, OPT_PSK, OPT_PSK_SESS,
+    OPT_4,
+    OPT_6,
+    OPT_HOST,
+    OPT_PORT,
+    OPT_CONNECT,
+    OPT_BIND,
+    OPT_UNIX,
+    OPT_XMPPHOST,
+    OPT_VERIFY,
+    OPT_NAMEOPT,
+    OPT_CERT,
+    OPT_CRL,
+    OPT_CRL_DOWNLOAD,
+    OPT_SESS_OUT,
+    OPT_SESS_IN,
+    OPT_CERTFORM,
+    OPT_CRLFORM,
+    OPT_VERIFY_RET_ERROR,
+    OPT_VERIFY_QUIET,
+    OPT_BRIEF,
+    OPT_PREXIT,
+    OPT_NO_INTERACTIVE,
+    OPT_CRLF,
+    OPT_QUIET,
+    OPT_NBIO,
+    OPT_SSL_CLIENT_ENGINE,
+    OPT_IGN_EOF,
+    OPT_NO_IGN_EOF,
+    OPT_DEBUG,
+    OPT_TLSEXTDEBUG,
+    OPT_STATUS,
+    OPT_WDEBUG,
+    OPT_MSG,
+    OPT_MSGFILE,
+    OPT_ENGINE,
+    OPT_TRACE,
+    OPT_SECURITY_DEBUG,
+    OPT_SECURITY_DEBUG_VERBOSE,
+    OPT_SHOWCERTS,
+    OPT_NBIO_TEST,
+    OPT_STATE,
+    OPT_PSK_IDENTITY,
+    OPT_PSK,
+    OPT_PSK_SESS,
 #ifndef OPENSSL_NO_SRP
-    OPT_SRPUSER, OPT_SRPPASS, OPT_SRP_STRENGTH, OPT_SRP_LATEUSER,
+    OPT_SRPUSER,
+    OPT_SRPPASS,
+    OPT_SRP_STRENGTH,
+    OPT_SRP_LATEUSER,
     OPT_SRP_MOREGROUPS,
 #endif
-    OPT_SSL3, OPT_SSL_CONFIG,
-    OPT_TLS1_3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1,
-    OPT_DTLS1_2, OPT_QUIC, OPT_SCTP, OPT_TIMEOUT, OPT_MTU, OPT_KEYFORM,
-    OPT_PASS, OPT_CERT_CHAIN, OPT_KEY, OPT_RECONNECT, OPT_BUILD_CHAIN,
-    OPT_NEXTPROTONEG, OPT_ALPN,
-    OPT_CAPATH, OPT_NOCAPATH, OPT_CHAINCAPATH, OPT_VERIFYCAPATH,
-    OPT_CAFILE, OPT_NOCAFILE, OPT_CHAINCAFILE, OPT_VERIFYCAFILE,
-    OPT_CASTORE, OPT_NOCASTORE, OPT_CHAINCASTORE, OPT_VERIFYCASTORE,
-    OPT_SERVERINFO, OPT_STARTTLS, OPT_SERVERNAME, OPT_NOSERVERNAME, OPT_ASYNC,
-    OPT_USE_SRTP, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN, OPT_PROTOHOST,
-    OPT_MAXFRAGLEN, OPT_MAX_SEND_FRAG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES,
-    OPT_READ_BUF, OPT_KEYLOG_FILE, OPT_EARLY_DATA, OPT_REQCAFILE,
+    OPT_SSL3,
+    OPT_SSL_CONFIG,
+    OPT_TLS1_3,
+    OPT_TLS1_2,
+    OPT_TLS1_1,
+    OPT_TLS1,
+    OPT_DTLS,
+    OPT_DTLS1,
+    OPT_DTLS1_2,
+    OPT_QUIC,
+    OPT_SCTP,
+    OPT_TIMEOUT,
+    OPT_MTU,
+    OPT_KEYFORM,
+    OPT_PASS,
+    OPT_CERT_CHAIN,
+    OPT_KEY,
+    OPT_RECONNECT,
+    OPT_BUILD_CHAIN,
+    OPT_NEXTPROTONEG,
+    OPT_ALPN,
+    OPT_CAPATH,
+    OPT_NOCAPATH,
+    OPT_CHAINCAPATH,
+    OPT_VERIFYCAPATH,
+    OPT_CAFILE,
+    OPT_NOCAFILE,
+    OPT_CHAINCAFILE,
+    OPT_VERIFYCAFILE,
+    OPT_CASTORE,
+    OPT_NOCASTORE,
+    OPT_CHAINCASTORE,
+    OPT_VERIFYCASTORE,
+    OPT_SERVERINFO,
+    OPT_STARTTLS,
+    OPT_SERVERNAME,
+    OPT_NOSERVERNAME,
+    OPT_ASYNC,
+    OPT_USE_SRTP,
+    OPT_KEYMATEXPORT,
+    OPT_KEYMATEXPORTLEN,
+    OPT_PROTOHOST,
+    OPT_MAXFRAGLEN,
+    OPT_MAX_SEND_FRAG,
+    OPT_SPLIT_SEND_FRAG,
+    OPT_MAX_PIPELINES,
+    OPT_READ_BUF,
+    OPT_KEYLOG_FILE,
+    OPT_EARLY_DATA,
+    OPT_REQCAFILE,
     OPT_TFO,
     OPT_V_ENUM,
     OPT_X_ENUM,
-    OPT_S_ENUM, OPT_IGNORE_UNEXPECTED_EOF,
-    OPT_FALLBACKSCSV, OPT_NOCMDS, OPT_ADV, OPT_PROXY, OPT_PROXY_USER,
-    OPT_PROXY_PASS, OPT_DANE_TLSA_DOMAIN,
+    OPT_S_ENUM,
+    OPT_IGNORE_UNEXPECTED_EOF,
+    OPT_FALLBACKSCSV,
+    OPT_NOCMDS,
+    OPT_ADV,
+    OPT_PROXY,
+    OPT_PROXY_USER,
+    OPT_PROXY_PASS,
+    OPT_DANE_TLSA_DOMAIN,
 #ifndef OPENSSL_NO_CT
-    OPT_CT, OPT_NOCT, OPT_CTLOG_FILE,
+    OPT_CT,
+    OPT_NOCT,
+    OPT_CTLOG_FILE,
 #endif
-    OPT_DANE_TLSA_RRDATA, OPT_DANE_EE_NO_NAME,
+    OPT_DANE_TLSA_RRDATA,
+    OPT_DANE_EE_NO_NAME,
     OPT_ENABLE_PHA,
     OPT_ENABLE_SERVER_RPK,
     OPT_ENABLE_CLIENT_RPK,
     OPT_SCTP_LABEL_BUG,
     OPT_KTLS,
-    OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS s_client_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [host:port]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [host:port]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-    {"ssl_client_engine", OPT_SSL_CLIENT_ENGINE, 's',
-     "Specify engine to be used for client certificate operations"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
+    { "ssl_client_engine", OPT_SSL_CLIENT_ENGINE, 's',
+        "Specify engine to be used for client certificate operations" },
 #endif
-    {"ssl_config", OPT_SSL_CONFIG, 's', "Use specified section for SSL_CTX configuration"},
+    { "ssl_config", OPT_SSL_CONFIG, 's', "Use specified section for SSL_CTX configuration" },
 #ifndef OPENSSL_NO_CT
-    {"ct", OPT_CT, '-', "Request and parse SCTs (also enables OCSP stapling)"},
-    {"noct", OPT_NOCT, '-', "Do not request or parse SCTs (default)"},
-    {"ctlogfile", OPT_CTLOG_FILE, '<', "CT log list CONF file"},
+    { "ct", OPT_CT, '-', "Request and parse SCTs (also enables OCSP stapling)" },
+    { "noct", OPT_NOCT, '-', "Do not request or parse SCTs (default)" },
+    { "ctlogfile", OPT_CTLOG_FILE, '<', "CT log list CONF file" },
 #endif
 
     OPT_SECTION("Network"),
-    {"host", OPT_HOST, 's', "Use -connect instead"},
-    {"port", OPT_PORT, 'p', "Use -connect instead"},
-    {"connect", OPT_CONNECT, 's',
-     "TCP/IP where to connect; default: " PORT ")"},
-    {"bind", OPT_BIND, 's', "bind local address for connection"},
-    {"proxy", OPT_PROXY, 's',
-     "Connect to via specified proxy to the real server"},
-    {"proxy_user", OPT_PROXY_USER, 's', "UserID for proxy authentication"},
-    {"proxy_pass", OPT_PROXY_PASS, 's', "Proxy authentication password source"},
+    { "host", OPT_HOST, 's', "Use -connect instead" },
+    { "port", OPT_PORT, 'p', "Use -connect instead" },
+    { "connect", OPT_CONNECT, 's',
+        "TCP/IP where to connect; default: " PORT ")" },
+    { "bind", OPT_BIND, 's', "bind local address for connection" },
+    { "proxy", OPT_PROXY, 's',
+        "Connect to via specified proxy to the real server" },
+    { "proxy_user", OPT_PROXY_USER, 's', "UserID for proxy authentication" },
+    { "proxy_pass", OPT_PROXY_PASS, 's', "Proxy authentication password source" },
 #ifdef AF_UNIX
-    {"unix", OPT_UNIX, 's', "Connect over the specified Unix-domain socket"},
+    { "unix", OPT_UNIX, 's', "Connect over the specified Unix-domain socket" },
 #endif
-    {"4", OPT_4, '-', "Use IPv4 only"},
+    { "4", OPT_4, '-', "Use IPv4 only" },
 #ifdef AF_INET6
-    {"6", OPT_6, '-', "Use IPv6 only"},
+    { "6", OPT_6, '-', "Use IPv6 only" },
 #endif
-    {"maxfraglen", OPT_MAXFRAGLEN, 'p',
-     "Enable Maximum Fragment Length Negotiation (len values: 512, 1024, 2048 and 4096)"},
-    {"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "},
-    {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'p',
-     "Size used to split data for encrypt pipelines"},
-    {"max_pipelines", OPT_MAX_PIPELINES, 'p',
-     "Maximum number of encrypt/decrypt pipelines to be used"},
-    {"read_buf", OPT_READ_BUF, 'p',
-     "Default read buffer size to be used for connections"},
-    {"fallback_scsv", OPT_FALLBACKSCSV, '-', "Send the fallback SCSV"},
+    { "maxfraglen", OPT_MAXFRAGLEN, 'p',
+        "Enable Maximum Fragment Length Negotiation (len values: 512, 1024, 2048 and 4096)" },
+    { "max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames " },
+    { "split_send_frag", OPT_SPLIT_SEND_FRAG, 'p',
+        "Size used to split data for encrypt pipelines" },
+    { "max_pipelines", OPT_MAX_PIPELINES, 'p',
+        "Maximum number of encrypt/decrypt pipelines to be used" },
+    { "read_buf", OPT_READ_BUF, 'p',
+        "Default read buffer size to be used for connections" },
+    { "fallback_scsv", OPT_FALLBACKSCSV, '-', "Send the fallback SCSV" },
 
     OPT_SECTION("Identity"),
-    {"cert", OPT_CERT, '<', "Client certificate file to use"},
-    {"certform", OPT_CERTFORM, 'F',
-     "Client certificate file format (PEM/DER/P12); has no effect"},
-    {"cert_chain", OPT_CERT_CHAIN, '<',
-     "Client certificate chain file (in PEM format)"},
-    {"build_chain", OPT_BUILD_CHAIN, '-', "Build client certificate chain"},
-    {"key", OPT_KEY, 's', "Private key file to use; default: -cert file"},
-    {"keyform", OPT_KEYFORM, 'E', "Key format (ENGINE, other values ignored)"},
-    {"pass", OPT_PASS, 's', "Private key and cert file pass phrase source"},
-    {"verify", OPT_VERIFY, 'p', "Turn on peer certificate verification"},
-    {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
-    {"CApath", OPT_CAPATH, '/', "PEM format directory of CA's"},
-    {"CAfile", OPT_CAFILE, '<', "PEM format file of CA's"},
-    {"CAstore", OPT_CASTORE, ':', "URI to store of CA's"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load certificates from the default certificates store"},
-    {"requestCAfile", OPT_REQCAFILE, '<',
-      "PEM format file of CA names to send to the server"},
+    { "cert", OPT_CERT, '<', "Client certificate file to use" },
+    { "certform", OPT_CERTFORM, 'F',
+        "Client certificate file format (PEM/DER/P12); has no effect" },
+    { "cert_chain", OPT_CERT_CHAIN, '<',
+        "Client certificate chain file (in PEM format)" },
+    { "build_chain", OPT_BUILD_CHAIN, '-', "Build client certificate chain" },
+    { "key", OPT_KEY, 's', "Private key file to use; default: -cert file" },
+    { "keyform", OPT_KEYFORM, 'E', "Key format (ENGINE, other values ignored)" },
+    { "pass", OPT_PASS, 's', "Private key and cert file pass phrase source" },
+    { "verify", OPT_VERIFY, 'p', "Turn on peer certificate verification" },
+    { "nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options" },
+    { "CApath", OPT_CAPATH, '/', "PEM format directory of CA's" },
+    { "CAfile", OPT_CAFILE, '<', "PEM format file of CA's" },
+    { "CAstore", OPT_CASTORE, ':', "URI to store of CA's" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load certificates from the default certificates directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load certificates from the default certificates store" },
+    { "requestCAfile", OPT_REQCAFILE, '<',
+        "PEM format file of CA names to send to the server" },
 #if defined(TCP_FASTOPEN) && !defined(OPENSSL_NO_TFO)
-    {"tfo", OPT_TFO, '-', "Connect using TCP Fast Open"},
+    { "tfo", OPT_TFO, '-', "Connect using TCP Fast Open" },
 #endif
-    {"dane_tlsa_domain", OPT_DANE_TLSA_DOMAIN, 's', "DANE TLSA base domain"},
-    {"dane_tlsa_rrdata", OPT_DANE_TLSA_RRDATA, 's',
-     "DANE TLSA rrdata presentation form"},
-    {"dane_ee_no_namechecks", OPT_DANE_EE_NO_NAME, '-',
-     "Disable name checks when matching DANE-EE(3) TLSA records"},
-    {"psk_identity", OPT_PSK_IDENTITY, 's', "PSK identity"},
-    {"psk", OPT_PSK, 's', "PSK in hex (without 0x)"},
-    {"psk_session", OPT_PSK_SESS, '<', "File to read PSK SSL session from"},
-    {"name", OPT_PROTOHOST, 's',
-     "Hostname to use for \"-starttls lmtp\", \"-starttls smtp\" or \"-starttls xmpp[-server]\""},
+    { "dane_tlsa_domain", OPT_DANE_TLSA_DOMAIN, 's', "DANE TLSA base domain" },
+    { "dane_tlsa_rrdata", OPT_DANE_TLSA_RRDATA, 's',
+        "DANE TLSA rrdata presentation form" },
+    { "dane_ee_no_namechecks", OPT_DANE_EE_NO_NAME, '-',
+        "Disable name checks when matching DANE-EE(3) TLSA records" },
+    { "psk_identity", OPT_PSK_IDENTITY, 's', "PSK identity" },
+    { "psk", OPT_PSK, 's', "PSK in hex (without 0x)" },
+    { "psk_session", OPT_PSK_SESS, '<', "File to read PSK SSL session from" },
+    { "name", OPT_PROTOHOST, 's',
+        "Hostname to use for \"-starttls lmtp\", \"-starttls smtp\" or \"-starttls xmpp[-server]\"" },
 
     OPT_SECTION("Session"),
-    {"reconnect", OPT_RECONNECT, '-',
-     "Drop and re-make the connection with the same Session-ID"},
-    {"sess_out", OPT_SESS_OUT, '>', "File to write SSL session to"},
-    {"sess_in", OPT_SESS_IN, '<', "File to read SSL session from"},
+    { "reconnect", OPT_RECONNECT, '-',
+        "Drop and re-make the connection with the same Session-ID" },
+    { "sess_out", OPT_SESS_OUT, '>', "File to write SSL session to" },
+    { "sess_in", OPT_SESS_IN, '<', "File to read SSL session from" },
 
     OPT_SECTION("Input/Output"),
-    {"crlf", OPT_CRLF, '-', "Convert LF from terminal into CRLF"},
-    {"quiet", OPT_QUIET, '-', "No s_client output"},
-    {"ign_eof", OPT_IGN_EOF, '-', "Ignore input eof (default when -quiet)"},
-    {"no_ign_eof", OPT_NO_IGN_EOF, '-', "Don't ignore input eof"},
-    {"starttls", OPT_STARTTLS, 's',
-     "Use the appropriate STARTTLS command before starting TLS"},
-    {"xmpphost", OPT_XMPPHOST, 's',
-     "Alias of -name option for \"-starttls xmpp[-server]\""},
-    {"brief", OPT_BRIEF, '-',
-     "Restrict output to brief summary of connection parameters"},
-    {"prexit", OPT_PREXIT, '-',
-     "Print session information when the program exits"},
-    {"no-interactive", OPT_NO_INTERACTIVE, '-',
-     "Don't run the client in the interactive mode"},
+    { "crlf", OPT_CRLF, '-', "Convert LF from terminal into CRLF" },
+    { "quiet", OPT_QUIET, '-', "No s_client output" },
+    { "ign_eof", OPT_IGN_EOF, '-', "Ignore input eof (default when -quiet)" },
+    { "no_ign_eof", OPT_NO_IGN_EOF, '-', "Don't ignore input eof" },
+    { "starttls", OPT_STARTTLS, 's',
+        "Use the appropriate STARTTLS command before starting TLS" },
+    { "xmpphost", OPT_XMPPHOST, 's',
+        "Alias of -name option for \"-starttls xmpp[-server]\"" },
+    { "brief", OPT_BRIEF, '-',
+        "Restrict output to brief summary of connection parameters" },
+    { "prexit", OPT_PREXIT, '-',
+        "Print session information when the program exits" },
+    { "no-interactive", OPT_NO_INTERACTIVE, '-',
+        "Don't run the client in the interactive mode" },
 
     OPT_SECTION("Debug"),
-    {"showcerts", OPT_SHOWCERTS, '-',
-     "Show all certificates sent by the server"},
-    {"debug", OPT_DEBUG, '-', "Extra output"},
-    {"msg", OPT_MSG, '-', "Show protocol messages"},
-    {"msgfile", OPT_MSGFILE, '>',
-     "File to send output of -msg or -trace, instead of stdout"},
-    {"nbio_test", OPT_NBIO_TEST, '-', "More ssl protocol testing"},
-    {"state", OPT_STATE, '-', "Print the ssl states"},
-    {"keymatexport", OPT_KEYMATEXPORT, 's',
-     "Export keying material using label"},
-    {"keymatexportlen", OPT_KEYMATEXPORTLEN, 'p',
-     "Export len bytes of keying material; default 20"},
-    {"security_debug", OPT_SECURITY_DEBUG, '-',
-     "Enable security debug messages"},
-    {"security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-',
-     "Output more security debug output"},
+    { "showcerts", OPT_SHOWCERTS, '-',
+        "Show all certificates sent by the server" },
+    { "debug", OPT_DEBUG, '-', "Extra output" },
+    { "msg", OPT_MSG, '-', "Show protocol messages" },
+    { "msgfile", OPT_MSGFILE, '>',
+        "File to send output of -msg or -trace, instead of stdout" },
+    { "nbio_test", OPT_NBIO_TEST, '-', "More ssl protocol testing" },
+    { "state", OPT_STATE, '-', "Print the ssl states" },
+    { "keymatexport", OPT_KEYMATEXPORT, 's',
+        "Export keying material using label" },
+    { "keymatexportlen", OPT_KEYMATEXPORTLEN, 'p',
+        "Export len bytes of keying material; default 20" },
+    { "security_debug", OPT_SECURITY_DEBUG, '-',
+        "Enable security debug messages" },
+    { "security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-',
+        "Output more security debug output" },
 #ifndef OPENSSL_NO_SSL_TRACE
-    {"trace", OPT_TRACE, '-', "Show trace output of protocol messages"},
+    { "trace", OPT_TRACE, '-', "Show trace output of protocol messages" },
 #endif
 #ifdef WATT32
-    {"wdebug", OPT_WDEBUG, '-', "WATT-32 tcp debugging"},
+    { "wdebug", OPT_WDEBUG, '-', "WATT-32 tcp debugging" },
 #endif
-    {"keylogfile", OPT_KEYLOG_FILE, '>', "Write TLS secrets to file"},
-    {"nocommands", OPT_NOCMDS, '-', "Do not use interactive command letters"},
-    {"adv", OPT_ADV, '-', "Advanced command mode"},
-    {"servername", OPT_SERVERNAME, 's',
-     "Set TLS extension servername (SNI) in ClientHello (default)"},
-    {"noservername", OPT_NOSERVERNAME, '-',
-     "Do not send the server name (SNI) extension in the ClientHello"},
-    {"tlsextdebug", OPT_TLSEXTDEBUG, '-',
-     "Hex dump of all TLS extensions received"},
-    {"ignore_unexpected_eof", OPT_IGNORE_UNEXPECTED_EOF, '-',
-     "Do not treat lack of close_notify from a peer as an error"},
+    { "keylogfile", OPT_KEYLOG_FILE, '>', "Write TLS secrets to file" },
+    { "nocommands", OPT_NOCMDS, '-', "Do not use interactive command letters" },
+    { "adv", OPT_ADV, '-', "Advanced command mode" },
+    { "servername", OPT_SERVERNAME, 's',
+        "Set TLS extension servername (SNI) in ClientHello (default)" },
+    { "noservername", OPT_NOSERVERNAME, '-',
+        "Do not send the server name (SNI) extension in the ClientHello" },
+    { "tlsextdebug", OPT_TLSEXTDEBUG, '-',
+        "Hex dump of all TLS extensions received" },
+    { "ignore_unexpected_eof", OPT_IGNORE_UNEXPECTED_EOF, '-',
+        "Do not treat lack of close_notify from a peer as an error" },
 #ifndef OPENSSL_NO_OCSP
-    {"status", OPT_STATUS, '-', "Request certificate status from server"},
+    { "status", OPT_STATUS, '-', "Request certificate status from server" },
 #endif
-    {"serverinfo", OPT_SERVERINFO, 's',
-     "types  Send empty ClientHello extensions (comma-separated numbers)"},
-    {"alpn", OPT_ALPN, 's',
-     "Enable ALPN extension, considering named protocols supported (comma-separated list)"},
-    {"async", OPT_ASYNC, '-', "Support asynchronous operation"},
-    {"nbio", OPT_NBIO, '-', "Use non-blocking IO"},
+    { "serverinfo", OPT_SERVERINFO, 's',
+        "types  Send empty ClientHello extensions (comma-separated numbers)" },
+    { "alpn", OPT_ALPN, 's',
+        "Enable ALPN extension, considering named protocols supported (comma-separated list)" },
+    { "async", OPT_ASYNC, '-', "Support asynchronous operation" },
+    { "nbio", OPT_NBIO, '-', "Use non-blocking IO" },
 
     OPT_SECTION("Protocol and version"),
 #ifndef OPENSSL_NO_SSL3
-    {"ssl3", OPT_SSL3, '-', "Just use SSLv3"},
+    { "ssl3", OPT_SSL3, '-', "Just use SSLv3" },
 #endif
 #ifndef OPENSSL_NO_TLS1
-    {"tls1", OPT_TLS1, '-', "Just use TLSv1"},
+    { "tls1", OPT_TLS1, '-', "Just use TLSv1" },
 #endif
 #ifndef OPENSSL_NO_TLS1_1
-    {"tls1_1", OPT_TLS1_1, '-', "Just use TLSv1.1"},
+    { "tls1_1", OPT_TLS1_1, '-', "Just use TLSv1.1" },
 #endif
 #ifndef OPENSSL_NO_TLS1_2
-    {"tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2"},
+    { "tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2" },
 #endif
 #ifndef OPENSSL_NO_TLS1_3
-    {"tls1_3", OPT_TLS1_3, '-', "Just use TLSv1.3"},
+    { "tls1_3", OPT_TLS1_3, '-', "Just use TLSv1.3" },
 #endif
 #ifndef OPENSSL_NO_DTLS
-    {"dtls", OPT_DTLS, '-', "Use any version of DTLS"},
-    {"quic", OPT_QUIC, '-', "Use QUIC"},
-    {"timeout", OPT_TIMEOUT, '-',
-     "Enable send/receive timeout on DTLS connections"},
-    {"mtu", OPT_MTU, 'p', "Set the link layer MTU"},
+    { "dtls", OPT_DTLS, '-', "Use any version of DTLS" },
+    { "quic", OPT_QUIC, '-', "Use QUIC" },
+    { "timeout", OPT_TIMEOUT, '-',
+        "Enable send/receive timeout on DTLS connections" },
+    { "mtu", OPT_MTU, 'p', "Set the link layer MTU" },
 #endif
 #ifndef OPENSSL_NO_DTLS1
-    {"dtls1", OPT_DTLS1, '-', "Just use DTLSv1"},
+    { "dtls1", OPT_DTLS1, '-', "Just use DTLSv1" },
 #endif
 #ifndef OPENSSL_NO_DTLS1_2
-    {"dtls1_2", OPT_DTLS1_2, '-', "Just use DTLSv1.2"},
+    { "dtls1_2", OPT_DTLS1_2, '-', "Just use DTLSv1.2" },
 #endif
 #ifndef OPENSSL_NO_SCTP
-    {"sctp", OPT_SCTP, '-', "Use SCTP"},
-    {"sctp_label_bug", OPT_SCTP_LABEL_BUG, '-', "Enable SCTP label length bug"},
+    { "sctp", OPT_SCTP, '-', "Use SCTP" },
+    { "sctp_label_bug", OPT_SCTP_LABEL_BUG, '-', "Enable SCTP label length bug" },
 #endif
 #ifndef OPENSSL_NO_NEXTPROTONEG
-    {"nextprotoneg", OPT_NEXTPROTONEG, 's',
-     "Enable NPN extension, considering named protocols supported (comma-separated list)"},
+    { "nextprotoneg", OPT_NEXTPROTONEG, 's',
+        "Enable NPN extension, considering named protocols supported (comma-separated list)" },
 #endif
-    {"early_data", OPT_EARLY_DATA, '<', "File to send as early data"},
-    {"enable_pha", OPT_ENABLE_PHA, '-', "Enable post-handshake-authentication"},
-    {"enable_server_rpk", OPT_ENABLE_SERVER_RPK, '-', "Enable raw public keys (RFC7250) from the server"},
-    {"enable_client_rpk", OPT_ENABLE_CLIENT_RPK, '-', "Enable raw public keys (RFC7250) from the client"},
+    { "early_data", OPT_EARLY_DATA, '<', "File to send as early data" },
+    { "enable_pha", OPT_ENABLE_PHA, '-', "Enable post-handshake-authentication" },
+    { "enable_server_rpk", OPT_ENABLE_SERVER_RPK, '-', "Enable raw public keys (RFC7250) from the server" },
+    { "enable_client_rpk", OPT_ENABLE_CLIENT_RPK, '-', "Enable raw public keys (RFC7250) from the client" },
 #ifndef OPENSSL_NO_SRTP
-    {"use_srtp", OPT_USE_SRTP, 's',
-     "Offer SRTP key management with a colon-separated profile list"},
+    { "use_srtp", OPT_USE_SRTP, 's',
+        "Offer SRTP key management with a colon-separated profile list" },
 #endif
 #ifndef OPENSSL_NO_SRP
-    {"srpuser", OPT_SRPUSER, 's', "(deprecated) SRP authentication for 'user'"},
-    {"srppass", OPT_SRPPASS, 's', "(deprecated) Password for 'user'"},
-    {"srp_lateuser", OPT_SRP_LATEUSER, '-',
-     "(deprecated) SRP username into second ClientHello message"},
-    {"srp_moregroups", OPT_SRP_MOREGROUPS, '-',
-     "(deprecated) Tolerate other than the known g N values."},
-    {"srp_strength", OPT_SRP_STRENGTH, 'p',
-     "(deprecated) Minimal length in bits for N"},
+    { "srpuser", OPT_SRPUSER, 's', "(deprecated) SRP authentication for 'user'" },
+    { "srppass", OPT_SRPPASS, 's', "(deprecated) Password for 'user'" },
+    { "srp_lateuser", OPT_SRP_LATEUSER, '-',
+        "(deprecated) SRP username into second ClientHello message" },
+    { "srp_moregroups", OPT_SRP_MOREGROUPS, '-',
+        "(deprecated) Tolerate other than the known g N values." },
+    { "srp_strength", OPT_SRP_STRENGTH, 'p',
+        "(deprecated) Minimal length in bits for N" },
 #endif
 #ifndef OPENSSL_NO_KTLS
-    {"ktls", OPT_KTLS, '-', "Enable Kernel TLS for sending and receiving"},
+    { "ktls", OPT_KTLS, '-', "Enable Kernel TLS for sending and receiving" },
 #endif
 
     OPT_R_OPTIONS,
     OPT_S_OPTIONS,
     OPT_V_OPTIONS,
-    {"CRL", OPT_CRL, '<', "CRL file to use"},
-    {"crl_download", OPT_CRL_DOWNLOAD, '-', "Download CRL from distribution points"},
-    {"CRLform", OPT_CRLFORM, 'F', "CRL format (PEM or DER); default PEM"},
-    {"verify_return_error", OPT_VERIFY_RET_ERROR, '-',
-     "Close connection on verification error"},
-    {"verify_quiet", OPT_VERIFY_QUIET, '-', "Restrict verify output to errors"},
-    {"chainCAfile", OPT_CHAINCAFILE, '<',
-     "CA file for certificate chain (PEM format)"},
-    {"chainCApath", OPT_CHAINCAPATH, '/',
-     "Use dir as certificate store path to build CA certificate chain"},
-    {"chainCAstore", OPT_CHAINCASTORE, ':',
-     "CA store URI for certificate chain"},
-    {"verifyCAfile", OPT_VERIFYCAFILE, '<',
-     "CA file for certificate verification (PEM format)"},
-    {"verifyCApath", OPT_VERIFYCAPATH, '/',
-     "Use dir as certificate store path to verify CA certificate"},
-    {"verifyCAstore", OPT_VERIFYCASTORE, ':',
-     "CA store URI for certificate verification"},
+    { "CRL", OPT_CRL, '<', "CRL file to use" },
+    { "crl_download", OPT_CRL_DOWNLOAD, '-', "Download CRL from distribution points" },
+    { "CRLform", OPT_CRLFORM, 'F', "CRL format (PEM or DER); default PEM" },
+    { "verify_return_error", OPT_VERIFY_RET_ERROR, '-',
+        "Close connection on verification error" },
+    { "verify_quiet", OPT_VERIFY_QUIET, '-', "Restrict verify output to errors" },
+    { "chainCAfile", OPT_CHAINCAFILE, '<',
+        "CA file for certificate chain (PEM format)" },
+    { "chainCApath", OPT_CHAINCAPATH, '/',
+        "Use dir as certificate store path to build CA certificate chain" },
+    { "chainCAstore", OPT_CHAINCASTORE, ':',
+        "CA store URI for certificate chain" },
+    { "verifyCAfile", OPT_VERIFYCAFILE, '<',
+        "CA file for certificate verification (PEM format)" },
+    { "verifyCApath", OPT_VERIFYCAPATH, '/',
+        "Use dir as certificate store path to verify CA certificate" },
+    { "verifyCAstore", OPT_VERIFYCASTORE, ':',
+        "CA store URI for certificate verification" },
     OPT_X_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"host:port", 0, 0, "Where to connect; same as -connect option"},
-    {NULL}
+    { "host:port", 0, 0, "Where to connect; same as -connect option" },
+    { NULL }
 };
 
 typedef enum PROTOCOL_choice {
@@ -775,31 +859,31 @@ typedef enum PROTOCOL_choice {
 } PROTOCOL_CHOICE;
 
 static const OPT_PAIR services[] = {
-    {"smtp", PROTO_SMTP},
-    {"pop3", PROTO_POP3},
-    {"imap", PROTO_IMAP},
-    {"ftp", PROTO_FTP},
-    {"xmpp", PROTO_XMPP},
-    {"xmpp-server", PROTO_XMPP_SERVER},
-    {"telnet", PROTO_TELNET},
-    {"irc", PROTO_IRC},
-    {"mysql", PROTO_MYSQL},
-    {"postgres", PROTO_POSTGRES},
-    {"lmtp", PROTO_LMTP},
-    {"nntp", PROTO_NNTP},
-    {"sieve", PROTO_SIEVE},
-    {"ldap", PROTO_LDAP},
-    {NULL, 0}
+    { "smtp", PROTO_SMTP },
+    { "pop3", PROTO_POP3 },
+    { "imap", PROTO_IMAP },
+    { "ftp", PROTO_FTP },
+    { "xmpp", PROTO_XMPP },
+    { "xmpp-server", PROTO_XMPP_SERVER },
+    { "telnet", PROTO_TELNET },
+    { "irc", PROTO_IRC },
+    { "mysql", PROTO_MYSQL },
+    { "postgres", PROTO_POSTGRES },
+    { "lmtp", PROTO_LMTP },
+    { "nntp", PROTO_NNTP },
+    { "sieve", PROTO_SIEVE },
+    { "ldap", PROTO_LDAP },
+    { NULL, 0 }
 };
 
 #define IS_INET_FLAG(o) \
- (o == OPT_4 || o == OPT_6 || o == OPT_HOST || o == OPT_PORT || o == OPT_CONNECT)
+    (o == OPT_4 || o == OPT_6 || o == OPT_HOST || o == OPT_PORT || o == OPT_CONNECT)
 #define IS_UNIX_FLAG(o) (o == OPT_UNIX)
 
-#define IS_PROT_FLAG(o) \
- (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \
-  || o == OPT_TLS1_3 || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2 \
-  || o == OPT_QUIC)
+#define IS_PROT_FLAG(o)                                                           \
+    (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2         \
+        || o == OPT_TLS1_3 || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2 \
+        || o == OPT_QUIC)
 
 /* Free |*dest| and optionally set it to a copy of |source|. */
 static void freeandcopy(char **dest, const char *source)
@@ -830,7 +914,7 @@ static int new_session_cb(SSL *s, SSL_SESSION *sess)
      */
     if (SSL_version(s) == TLS1_3_VERSION) {
         BIO_printf(bio_c_out,
-                   "---\nPost-Handshake New Session Ticket arrived:\n");
+            "---\nPost-Handshake New Session Ticket arrived:\n");
         SSL_SESSION_print(bio_c_out, sess);
         BIO_printf(bio_c_out, "---\n");
     }
@@ -935,7 +1019,10 @@ int s_client_main(int argc, char **argv)
     int async = 0;
     unsigned int max_send_fragment = 0;
     unsigned int split_send_fragment = 0, max_pipelines = 0;
-    enum { use_inet, use_unix, use_unknown } connect_type = use_unknown;
+    enum { use_inet,
+        use_unix,
+        use_unknown } connect_type
+        = use_unknown;
     int count4or6 = 0;
     uint8_t maxfraglen = 0;
     int c_nbio = 0, c_msg = 0, c_ign_eof = 0, c_brief = 0;
@@ -965,10 +1052,10 @@ int s_client_main(int argc, char **argv)
     FD_ZERO(&writefds);
 /* Known false-positive of MemorySanitizer. */
 #if defined(__has_feature)
-# if __has_feature(memory_sanitizer)
+#if __has_feature(memory_sanitizer)
     __msan_unpoison(&readfds, sizeof(readfds));
     __msan_unpoison(&writefds, sizeof(writefds));
-# endif
+#endif
 #endif
 
     c_quiet = 0;
@@ -995,14 +1082,14 @@ int s_client_main(int argc, char **argv)
         /* Check for intermixing flags. */
         if (connect_type == use_unix && IS_INET_FLAG(o)) {
             BIO_printf(bio_err,
-                       "%s: Intermixed protocol flags (unix and internet domains)\n",
-                       prog);
+                "%s: Intermixed protocol flags (unix and internet domains)\n",
+                prog);
             goto end;
         }
         if (connect_type == use_inet && IS_UNIX_FLAG(o)) {
             BIO_printf(bio_err,
-                       "%s: Intermixed protocol flags (internet and unix domains)\n",
-                       prog);
+                "%s: Intermixed protocol flags (internet and unix domains)\n",
+                prog);
             goto end;
         }
 
@@ -1014,14 +1101,14 @@ int s_client_main(int argc, char **argv)
             no_prot_opt++;
         if (prot_opt == 1 && no_prot_opt) {
             BIO_printf(bio_err,
-                       "Cannot supply both a protocol flag and '-no_<prot>'\n");
+                "Cannot supply both a protocol flag and '-no_<prot>'\n");
             goto end;
         }
 
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -1262,7 +1349,7 @@ int s_client_main(int argc, char **argv)
         case OPT_SRP_STRENGTH:
             srp_arg.strength = atoi(opt_arg());
             BIO_printf(bio_err, "SRP minimal length for N is %d\n",
-                       srp_arg.strength);
+                srp_arg.strength);
             if (min_version < TLS1_VERSION)
                 min_version = TLS1_VERSION;
             break;
@@ -1359,9 +1446,9 @@ int s_client_main(int argc, char **argv)
             min_version = 0;
             max_version = 0;
             socket_type = SOCK_DGRAM;
-# ifndef OPENSSL_NO_DTLS
+#ifndef OPENSSL_NO_DTLS
             isdtls = 0;
-# endif
+#endif
             isquic = 1;
 #endif
             break;
@@ -1463,8 +1550,7 @@ int s_client_main(int argc, char **argv)
         case OPT_DANE_TLSA_RRDATA:
             if (dane_tlsa_rrset == NULL)
                 dane_tlsa_rrset = sk_OPENSSL_STRING_new_null();
-            if (dane_tlsa_rrset == NULL ||
-                !sk_OPENSSL_STRING_push(dane_tlsa_rrset, opt_arg())) {
+            if (dane_tlsa_rrset == NULL || !sk_OPENSSL_STRING_push(dane_tlsa_rrset, opt_arg())) {
                 BIO_printf(bio_err, "%s: Memory allocation failure\n", prog);
                 goto end;
             }
@@ -1536,8 +1622,8 @@ int s_client_main(int argc, char **argv)
                 break;
             default:
                 BIO_printf(bio_err,
-                           "%s: Max Fragment Len %u is out of permitted values",
-                           prog, len);
+                    "%s: Max Fragment Len %u is out of permitted values",
+                    prog, len);
                 goto opthelp;
             }
             break;
@@ -1581,8 +1667,8 @@ int s_client_main(int argc, char **argv)
         /* Don't allow -connect and a separate argument. */
         if (connectstr != NULL) {
             BIO_printf(bio_err,
-                       "%s: cannot provide both -connect option and target parameter\n",
-                       prog);
+                "%s: cannot provide both -connect option and target parameter\n",
+                prog);
             goto opthelp;
         }
         connect_type = use_inet;
@@ -1603,14 +1689,14 @@ int s_client_main(int argc, char **argv)
     if (noservername) {
         if (servername != NULL) {
             BIO_printf(bio_err,
-                       "%s: Can't use -servername and -noservername together\n",
-                       prog);
+                "%s: Can't use -servername and -noservername together\n",
+                prog);
             goto opthelp;
         }
         if (dane_tlsa_domain != NULL) {
             BIO_printf(bio_err,
-               "%s: Can't use -dane_tlsa_domain and -noservername together\n",
-               prog);
+                "%s: Can't use -dane_tlsa_domain and -noservername together\n",
+                prog);
             goto opthelp;
         }
     }
@@ -1633,8 +1719,8 @@ int s_client_main(int argc, char **argv)
             OPENSSL_free(tmp_port);
         if (!res) {
             BIO_printf(bio_err,
-                       "%s: -connect argument or target parameter malformed or ambiguous\n",
-                       prog);
+                "%s: -connect argument or target parameter malformed or ambiguous\n",
+                prog);
             goto end;
         }
     }
@@ -1672,25 +1758,24 @@ int s_client_main(int argc, char **argv)
             OPENSSL_free(tmp_port);
         if (!res) {
             BIO_printf(bio_err,
-                       "%s: -proxy argument malformed or ambiguous\n", prog);
+                "%s: -proxy argument malformed or ambiguous\n", prog);
             goto end;
         }
 #else
         BIO_printf(bio_err,
-                   "%s: -proxy not supported in no-http build\n", prog);
-	goto end;
+            "%s: -proxy not supported in no-http build\n", prog);
+        goto end;
 #endif
     }
 
-
     if (bindstr != NULL) {
         int res;
         res = BIO_parse_hostserv(bindstr, &bindhost, &bindport,
-                                 BIO_PARSE_PRIO_HOST);
+            BIO_PARSE_PRIO_HOST);
         if (!res) {
             BIO_printf(bio_err,
-                       "%s: -bind argument parameter malformed or ambiguous\n",
-                       prog);
+                "%s: -bind argument parameter malformed or ambiguous\n",
+                prog);
             goto end;
         }
     }
@@ -1698,7 +1783,7 @@ int s_client_main(int argc, char **argv)
 #ifdef AF_UNIX
     if (socket_family == AF_UNIX && socket_type != SOCK_STREAM) {
         BIO_printf(bio_err,
-                   "Can't use unix sockets and datagrams together\n");
+            "Can't use unix sockets and datagrams together\n");
         goto end;
     }
 #endif
@@ -1717,8 +1802,7 @@ int s_client_main(int argc, char **argv)
 #if !defined(OPENSSL_NO_NEXTPROTONEG)
     next_proto.status = -1;
     if (next_proto_neg_in) {
-        next_proto.data =
-            next_protos_parse(&next_proto.len, next_proto_neg_in);
+        next_proto.data = next_protos_parse(&next_proto.len, next_proto_neg_in);
         if (next_proto.data == NULL) {
             BIO_printf(bio_err, "Error parsing -nextprotoneg argument\n");
             goto end;
@@ -1747,14 +1831,14 @@ int s_client_main(int argc, char **argv)
 
     if (key_file != NULL) {
         key = load_key(key_file, key_format, 0, pass, e,
-                       "client certificate private key");
+            "client certificate private key");
         if (key == NULL)
             goto end;
     }
 
     if (cert_file != NULL) {
         cert = load_cert_pass(cert_file, cert_format, 1, pass,
-                              "client certificate");
+            "client certificate");
         if (cert == NULL)
             goto end;
     }
@@ -1824,7 +1908,7 @@ int s_client_main(int argc, char **argv)
     if (ssl_config != NULL) {
         if (SSL_CTX_config(ctx, ssl_config) == 0) {
             BIO_printf(bio_err, "Error using configuration \"%s\"\n",
-                       ssl_config);
+                ssl_config);
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -1862,21 +1946,21 @@ int s_client_main(int argc, char **argv)
     if (max_send_fragment > 0
         && !SSL_CTX_set_max_send_fragment(ctx, max_send_fragment)) {
         BIO_printf(bio_err, "%s: Max send fragment size %u is out of permitted range\n",
-                   prog, max_send_fragment);
+            prog, max_send_fragment);
         goto end;
     }
 
     if (split_send_fragment > 0
         && !SSL_CTX_set_split_send_fragment(ctx, split_send_fragment)) {
         BIO_printf(bio_err, "%s: Split send fragment size %u is out of permitted range\n",
-                   prog, split_send_fragment);
+            prog, split_send_fragment);
         goto end;
     }
 
     if (max_pipelines > 0
         && !SSL_CTX_set_max_pipelines(ctx, max_pipelines)) {
         BIO_printf(bio_err, "%s: Max pipelines %u is out of permitted range\n",
-                   prog, max_pipelines);
+            prog, max_pipelines);
         goto end;
     }
 
@@ -1885,17 +1969,18 @@ int s_client_main(int argc, char **argv)
     }
 
     if (maxfraglen > 0
-            && !SSL_CTX_set_tlsext_max_fragment_length(ctx, maxfraglen)) {
+        && !SSL_CTX_set_tlsext_max_fragment_length(ctx, maxfraglen)) {
         BIO_printf(bio_err,
-                   "%s: Max Fragment Length code %u is out of permitted values"
-                   "\n", prog, maxfraglen);
+            "%s: Max Fragment Length code %u is out of permitted values"
+            "\n",
+            prog, maxfraglen);
         goto end;
     }
 
     if (!ssl_load_stores(ctx,
-                         vfyCApath, vfyCAfile, vfyCAstore,
-                         chCApath, chCAfile, chCAstore,
-                         crls, crl_download)) {
+            vfyCApath, vfyCAfile, vfyCAstore,
+            chCApath, chCAfile, chCAstore,
+            crls, crl_download)) {
         BIO_printf(bio_err, "Error loading store locations\n");
         ERR_print_errors(bio_err);
         goto end;
@@ -1985,12 +2070,12 @@ int s_client_main(int argc, char **argv)
 
     for (i = 0; i < serverinfo_count; i++) {
         if (!SSL_CTX_add_client_custom_ext(ctx,
-                                           serverinfo_types[i],
-                                           NULL, NULL, NULL,
-                                           serverinfo_cli_parse_cb, NULL)) {
+                serverinfo_types[i],
+                NULL, NULL, NULL,
+                serverinfo_cli_parse_cb, NULL)) {
             BIO_printf(bio_err,
-                       "Warning: Unable to add custom extension %u, skipping\n",
-                       serverinfo_types[i]);
+                "Warning: Unable to add custom extension %u, skipping\n",
+                serverinfo_types[i]);
         }
     }
 
@@ -1999,8 +2084,7 @@ int s_client_main(int argc, char **argv)
 
 #ifndef OPENSSL_NO_CT
     /* Enable SCT processing, without early connection termination */
-    if (ct_validation &&
-        !SSL_CTX_enable_ct(ctx, SSL_CT_VALIDATION_PERMISSIVE)) {
+    if (ct_validation && !SSL_CTX_enable_ct(ctx, SSL_CT_VALIDATION_PERMISSIVE)) {
         ERR_print_errors(bio_err);
         goto end;
     }
@@ -2024,7 +2108,7 @@ int s_client_main(int argc, char **argv)
     SSL_CTX_set_verify(ctx, verify, verify_callback);
 
     if (!ctx_set_verify_locations(ctx, CAfile, noCAfile, CApath, noCApath,
-                                  CAstore, noCAstore)) {
+            CAstore, noCAstore)) {
         ERR_print_errors(bio_err);
         goto end;
     }
@@ -2041,15 +2125,15 @@ int s_client_main(int argc, char **argv)
     }
 #ifndef OPENSSL_NO_SRP
     if (srp_arg.srplogin != NULL
-            && !set_up_srp_arg(ctx, &srp_arg, srp_lateuser, c_msg, c_debug))
+        && !set_up_srp_arg(ctx, &srp_arg, srp_lateuser, c_msg, c_debug))
         goto end;
-# endif
+#endif
 
     if (dane_tlsa_domain != NULL) {
         if (SSL_CTX_dane_enable(ctx) <= 0) {
             BIO_printf(bio_err,
-                       "%s: Error enabling DANE TLSA authentication.\n",
-                       prog);
+                "%s: Error enabling DANE TLSA authentication.\n",
+                prog);
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -2060,8 +2144,7 @@ int s_client_main(int argc, char **argv)
      * come at any time. Therefore, we use a callback to write out the session
      * when we know about it. This approach works for < TLSv1.3 as well.
      */
-    SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT
-                                        | SSL_SESS_CACHE_NO_INTERNAL_STORE);
+    SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL_STORE);
     SSL_CTX_sess_set_new_cb(ctx, new_session_cb);
 
     if (set_keylog_file(ctx, keylog_file))
@@ -2128,25 +2211,29 @@ int s_client_main(int argc, char **argv)
     if (dane_tlsa_domain != NULL) {
         if (SSL_dane_enable(con, dane_tlsa_domain) <= 0) {
             BIO_printf(bio_err, "%s: Error enabling DANE TLSA "
-                       "authentication.\n", prog);
+                                "authentication.\n",
+                prog);
             ERR_print_errors(bio_err);
             goto end;
         }
         if (dane_tlsa_rrset == NULL) {
             BIO_printf(bio_err, "%s: DANE TLSA authentication requires at "
-                       "least one -dane_tlsa_rrdata option.\n", prog);
+                                "least one -dane_tlsa_rrdata option.\n",
+                prog);
             goto end;
         }
         if (tlsa_import_rrset(con, dane_tlsa_rrset) <= 0) {
             BIO_printf(bio_err, "%s: Failed to import any TLSA "
-                       "records.\n", prog);
+                                "records.\n",
+                prog);
             goto end;
         }
         if (dane_ee_no_name)
             SSL_dane_set_flags(con, DANE_FLAG_NO_DANE_EE_NAMECHECKS);
     } else if (dane_tlsa_rrset != NULL) {
         BIO_printf(bio_err, "%s: DANE TLSA authentication requires the "
-                   "-dane_tlsa_domain option.\n", prog);
+                            "-dane_tlsa_domain option.\n",
+            prog);
         goto end;
     }
 #ifndef OPENSSL_NO_DTLS
@@ -2168,12 +2255,13 @@ int s_client_main(int argc, char **argv)
 
     if (tfo)
         BIO_printf(bio_c_out, "Connecting via TFO\n");
- re_start:
+re_start:
     /* peer_addr might be set from previous connections */
     BIO_ADDR_free(peer_addr);
     peer_addr = NULL;
     if (init_client(&sock, host, port, bindhost, bindport, socket_family,
-                    socket_type, protocol, tfo, !isquic, &peer_addr) == 0) {
+            socket_type, protocol, tfo, !isquic, &peer_addr)
+        == 0) {
         BIO_printf(bio_err, "connect:errno=%d\n", get_last_socket_error());
         BIO_closesocket(sock);
         goto end;
@@ -2214,7 +2302,7 @@ int s_client_main(int argc, char **argv)
         }
         if (!BIO_sock_info(sock, BIO_SOCK_INFO_ADDRESS, &peer_info)) {
             BIO_printf(bio_err, "getsockname:errno=%d\n",
-                       get_last_socket_error());
+                get_last_socket_error());
             BIO_free(sbio);
             BIO_ADDR_free(peer_info.addr);
             BIO_closesocket(sock);
@@ -2238,7 +2326,7 @@ int s_client_main(int argc, char **argv)
         if (socket_mtu) {
             if (socket_mtu < DTLS_get_link_min_mtu(con)) {
                 BIO_printf(bio_err, "MTU too small. Must be at least %ld\n",
-                           DTLS_get_link_min_mtu(con));
+                    DTLS_get_link_min_mtu(con));
                 BIO_free(sbio);
                 goto shut;
             }
@@ -2255,7 +2343,7 @@ int s_client_main(int argc, char **argv)
     } else
 #endif /* OPENSSL_NO_DTLS */
 #ifndef OPENSSL_NO_QUIC
-    if (isquic) {
+        if (isquic) {
         sbio = BIO_new_dgram(sock, BIO_NOCLOSE);
         if (!SSL_set1_initial_peer_addr(con, peer_addr)) {
             BIO_printf(bio_err, "Failed to set the initial peer address\n");
@@ -2341,537 +2429,508 @@ int s_client_main(int argc, char **argv)
     if (proxystr != NULL) {
         /* Here we must use the connect string target host & port */
         if (!OSSL_HTTP_proxy_connect(sbio, thost, tport, proxyuser, proxypass,
-                                     0 /* no timeout */, bio_err, prog))
+                0 /* no timeout */, bio_err, prog))
             goto shut;
     }
 #endif
 
-    switch ((PROTOCOL_CHOICE) starttls_proto) {
+    switch ((PROTOCOL_CHOICE)starttls_proto) {
     case PROTO_OFF:
         break;
     case PROTO_LMTP:
-    case PROTO_SMTP:
-        {
-            /*
-             * This is an ugly hack that does a lot of assumptions. We do
-             * have to handle multi-line responses which may come in a single
-             * packet or not. We therefore have to use BIO_gets() which does
-             * need a buffering BIO. So during the initial chitchat we do
-             * push a buffering BIO into the chain that is removed again
-             * later on to not disturb the rest of the s_client operation.
-             */
-            int foundit = 0;
-            BIO *fbio = BIO_new(BIO_f_buffer());
+    case PROTO_SMTP: {
+        /*
+         * This is an ugly hack that does a lot of assumptions. We do
+         * have to handle multi-line responses which may come in a single
+         * packet or not. We therefore have to use BIO_gets() which does
+         * need a buffering BIO. So during the initial chitchat we do
+         * push a buffering BIO into the chain that is removed again
+         * later on to not disturb the rest of the s_client operation.
+         */
+        int foundit = 0;
+        BIO *fbio = BIO_new(BIO_f_buffer());
 
-            if (fbio == NULL) {
-                BIO_printf(bio_err, "Unable to create BIO\n");
-                goto shut;
-            }
-            BIO_push(fbio, sbio);
-            /* Wait for multi-line response to end from LMTP or SMTP */
-            do {
-                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
-            } while (mbuf_len > 3 && mbuf[3] == '-');
-            if (protohost == NULL)
-                protohost = "mail.example.com";
-            if (starttls_proto == (int)PROTO_LMTP)
-                BIO_printf(fbio, "LHLO %s\r\n", protohost);
-            else
-                BIO_printf(fbio, "EHLO %s\r\n", protohost);
-            (void)BIO_flush(fbio);
-            /*
-             * Wait for multi-line response to end LHLO LMTP or EHLO SMTP
-             * response.
-             */
-            do {
-                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
-                if (strstr(mbuf, "STARTTLS"))
-                    foundit = 1;
-            } while (mbuf_len > 3 && mbuf[3] == '-');
-            (void)BIO_flush(fbio);
-            BIO_pop(fbio);
-            BIO_free(fbio);
-            if (!foundit)
-                BIO_printf(bio_err,
-                           "Didn't find STARTTLS in server response,"
-                           " trying anyway...\n");
-            BIO_printf(sbio, "STARTTLS\r\n");
-            BIO_read(sbio, sbuf, BUFSIZZ);
+        if (fbio == NULL) {
+            BIO_printf(bio_err, "Unable to create BIO\n");
+            goto shut;
         }
-        break;
-    case PROTO_POP3:
-        {
-            BIO_read(sbio, mbuf, BUFSIZZ);
-            BIO_printf(sbio, "STLS\r\n");
-            mbuf_len = BIO_read(sbio, sbuf, BUFSIZZ);
-            if (mbuf_len < 0) {
-                BIO_printf(bio_err, "BIO_read failed\n");
-                goto end;
-            }
+        BIO_push(fbio, sbio);
+        /* Wait for multi-line response to end from LMTP or SMTP */
+        do {
+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
+        } while (mbuf_len > 3 && mbuf[3] == '-');
+        if (protohost == NULL)
+            protohost = "mail.example.com";
+        if (starttls_proto == (int)PROTO_LMTP)
+            BIO_printf(fbio, "LHLO %s\r\n", protohost);
+        else
+            BIO_printf(fbio, "EHLO %s\r\n", protohost);
+        (void)BIO_flush(fbio);
+        /*
+         * Wait for multi-line response to end LHLO LMTP or EHLO SMTP
+         * response.
+         */
+        do {
+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
+            if (strstr(mbuf, "STARTTLS"))
+                foundit = 1;
+        } while (mbuf_len > 3 && mbuf[3] == '-');
+        (void)BIO_flush(fbio);
+        BIO_pop(fbio);
+        BIO_free(fbio);
+        if (!foundit)
+            BIO_printf(bio_err,
+                "Didn't find STARTTLS in server response,"
+                " trying anyway...\n");
+        BIO_printf(sbio, "STARTTLS\r\n");
+        BIO_read(sbio, sbuf, BUFSIZZ);
+    } break;
+    case PROTO_POP3: {
+        BIO_read(sbio, mbuf, BUFSIZZ);
+        BIO_printf(sbio, "STLS\r\n");
+        mbuf_len = BIO_read(sbio, sbuf, BUFSIZZ);
+        if (mbuf_len < 0) {
+            BIO_printf(bio_err, "BIO_read failed\n");
+            goto end;
         }
-        break;
-    case PROTO_IMAP:
-        {
-            int foundit = 0;
-            BIO *fbio = BIO_new(BIO_f_buffer());
+    } break;
+    case PROTO_IMAP: {
+        int foundit = 0;
+        BIO *fbio = BIO_new(BIO_f_buffer());
 
-            if (fbio == NULL) {
-                BIO_printf(bio_err, "Unable to create BIO\n");
-                goto shut;
-            }
-            BIO_push(fbio, sbio);
-            BIO_gets(fbio, mbuf, BUFSIZZ);
-            /* STARTTLS command requires CAPABILITY... */
-            BIO_printf(fbio, ". CAPABILITY\r\n");
-            (void)BIO_flush(fbio);
-            /* wait for multi-line CAPABILITY response */
-            do {
-                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
-                if (strstr(mbuf, "STARTTLS"))
-                    foundit = 1;
-            }
-            while (mbuf_len > 3 && mbuf[0] != '.');
-            (void)BIO_flush(fbio);
-            BIO_pop(fbio);
-            BIO_free(fbio);
-            if (!foundit)
-                BIO_printf(bio_err,
-                           "Didn't find STARTTLS in server response,"
-                           " trying anyway...\n");
-            BIO_printf(sbio, ". STARTTLS\r\n");
-            BIO_read(sbio, sbuf, BUFSIZZ);
+        if (fbio == NULL) {
+            BIO_printf(bio_err, "Unable to create BIO\n");
+            goto shut;
         }
-        break;
-    case PROTO_FTP:
-        {
-            BIO *fbio = BIO_new(BIO_f_buffer());
+        BIO_push(fbio, sbio);
+        BIO_gets(fbio, mbuf, BUFSIZZ);
+        /* STARTTLS command requires CAPABILITY... */
+        BIO_printf(fbio, ". CAPABILITY\r\n");
+        (void)BIO_flush(fbio);
+        /* wait for multi-line CAPABILITY response */
+        do {
+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
+            if (strstr(mbuf, "STARTTLS"))
+                foundit = 1;
+        } while (mbuf_len > 3 && mbuf[0] != '.');
+        (void)BIO_flush(fbio);
+        BIO_pop(fbio);
+        BIO_free(fbio);
+        if (!foundit)
+            BIO_printf(bio_err,
+                "Didn't find STARTTLS in server response,"
+                " trying anyway...\n");
+        BIO_printf(sbio, ". STARTTLS\r\n");
+        BIO_read(sbio, sbuf, BUFSIZZ);
+    } break;
+    case PROTO_FTP: {
+        BIO *fbio = BIO_new(BIO_f_buffer());
 
-            if (fbio == NULL) {
-                BIO_printf(bio_err, "Unable to create BIO\n");
-                goto shut;
-            }
-            BIO_push(fbio, sbio);
-            /* wait for multi-line response to end from FTP */
-            do {
-                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
-            }
-            while (mbuf_len > 3 && (!isdigit((unsigned char)mbuf[0]) || !isdigit((unsigned char)mbuf[1]) || !isdigit((unsigned char)mbuf[2]) || mbuf[3] != ' '));
-            (void)BIO_flush(fbio);
-            BIO_pop(fbio);
-            BIO_free(fbio);
-            BIO_printf(sbio, "AUTH TLS\r\n");
-            BIO_read(sbio, sbuf, BUFSIZZ);
+        if (fbio == NULL) {
+            BIO_printf(bio_err, "Unable to create BIO\n");
+            goto shut;
         }
-        break;
+        BIO_push(fbio, sbio);
+        /* wait for multi-line response to end from FTP */
+        do {
+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
+        } while (mbuf_len > 3 && (!isdigit((unsigned char)mbuf[0]) || !isdigit((unsigned char)mbuf[1]) || !isdigit((unsigned char)mbuf[2]) || mbuf[3] != ' '));
+        (void)BIO_flush(fbio);
+        BIO_pop(fbio);
+        BIO_free(fbio);
+        BIO_printf(sbio, "AUTH TLS\r\n");
+        BIO_read(sbio, sbuf, BUFSIZZ);
+    } break;
     case PROTO_XMPP:
-    case PROTO_XMPP_SERVER:
-        {
-            int seen = 0;
-            BIO_printf(sbio, "<stream:stream "
-                       "xmlns:stream='http://etherx.jabber.org/streams' "
-                       "xmlns='jabber:%s' to='%s' version='1.0'>",
-                       starttls_proto == PROTO_XMPP ? "client" : "server",
-                       protohost ? protohost : host);
+    case PROTO_XMPP_SERVER: {
+        int seen = 0;
+        BIO_printf(sbio, "<stream:stream "
+                         "xmlns:stream='http://etherx.jabber.org/streams' "
+                         "xmlns='jabber:%s' to='%s' version='1.0'>",
+            starttls_proto == PROTO_XMPP ? "client" : "server",
+            protohost ? protohost : host);
+        seen = BIO_read(sbio, mbuf, BUFSIZZ);
+        if (seen < 0) {
+            BIO_printf(bio_err, "BIO_read failed\n");
+            goto end;
+        }
+        mbuf[seen] = '\0';
+        while (!strstr(mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'")
+            && !strstr(mbuf,
+                "<starttls xmlns=\"urn:ietf:params:xml:ns:xmpp-tls\"")) {
             seen = BIO_read(sbio, mbuf, BUFSIZZ);
-            if (seen < 0) {
-                BIO_printf(bio_err, "BIO_read failed\n");
-                goto end;
-            }
-            mbuf[seen] = '\0';
-            while (!strstr
-                   (mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'")
-                   && !strstr(mbuf,
-                              "<starttls xmlns=\"urn:ietf:params:xml:ns:xmpp-tls\""))
-            {
-                seen = BIO_read(sbio, mbuf, BUFSIZZ);
-
-                if (seen <= 0)
-                    goto shut;
 
-                mbuf[seen] = '\0';
-            }
-            BIO_printf(sbio,
-                       "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
-            seen = BIO_read(sbio, sbuf, BUFSIZZ);
-            if (seen < 0) {
-                BIO_printf(bio_err, "BIO_read failed\n");
-                goto shut;
-            }
-            sbuf[seen] = '\0';
-            if (!strstr(sbuf, "<proceed"))
+            if (seen <= 0)
                 goto shut;
-            mbuf[0] = '\0';
-        }
-        break;
-    case PROTO_TELNET:
-        {
-            static const unsigned char tls_do[] = {
-                /* IAC    DO   START_TLS */
-                   255,   253, 46
-            };
-            static const unsigned char tls_will[] = {
-                /* IAC  WILL START_TLS */
-                   255, 251, 46
-            };
-            static const unsigned char tls_follows[] = {
-                /* IAC  SB   START_TLS FOLLOWS IAC  SE */
-                   255, 250, 46,       1,      255, 240
-            };
-            int bytes;
 
-            /* Telnet server should demand we issue START_TLS */
-            bytes = BIO_read(sbio, mbuf, BUFSIZZ);
-            if (bytes != 3 || memcmp(mbuf, tls_do, 3) != 0)
-                goto shut;
-            /* Agree to issue START_TLS and send the FOLLOWS sub-command */
-            BIO_write(sbio, tls_will, 3);
-            BIO_write(sbio, tls_follows, 6);
-            (void)BIO_flush(sbio);
-            /* Telnet server also sent the FOLLOWS sub-command */
-            bytes = BIO_read(sbio, mbuf, BUFSIZZ);
-            if (bytes != 6 || memcmp(mbuf, tls_follows, 6) != 0)
-                goto shut;
+            mbuf[seen] = '\0';
         }
-        break;
-    case PROTO_IRC:
-        {
-            int numeric;
-            BIO *fbio = BIO_new(BIO_f_buffer());
+        BIO_printf(sbio,
+            "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
+        seen = BIO_read(sbio, sbuf, BUFSIZZ);
+        if (seen < 0) {
+            BIO_printf(bio_err, "BIO_read failed\n");
+            goto shut;
+        }
+        sbuf[seen] = '\0';
+        if (!strstr(sbuf, "<proceed"))
+            goto shut;
+        mbuf[0] = '\0';
+    } break;
+    case PROTO_TELNET: {
+        static const unsigned char tls_do[] = {
+            /* IAC    DO   START_TLS */
+            255, 253, 46
+        };
+        static const unsigned char tls_will[] = {
+            /* IAC  WILL START_TLS */
+            255, 251, 46
+        };
+        static const unsigned char tls_follows[] = {
+            /* IAC  SB   START_TLS FOLLOWS IAC  SE */
+            255, 250, 46, 1, 255, 240
+        };
+        int bytes;
 
-            if (fbio == NULL) {
-                BIO_printf(bio_err, "Unable to create BIO\n");
-                goto end;
-            }
-            BIO_push(fbio, sbio);
-            BIO_printf(fbio, "STARTTLS\r\n");
-            (void)BIO_flush(fbio);
-            width = SSL_get_fd(con) + 1;
+        /* Telnet server should demand we issue START_TLS */
+        bytes = BIO_read(sbio, mbuf, BUFSIZZ);
+        if (bytes != 3 || memcmp(mbuf, tls_do, 3) != 0)
+            goto shut;
+        /* Agree to issue START_TLS and send the FOLLOWS sub-command */
+        BIO_write(sbio, tls_will, 3);
+        BIO_write(sbio, tls_follows, 6);
+        (void)BIO_flush(sbio);
+        /* Telnet server also sent the FOLLOWS sub-command */
+        bytes = BIO_read(sbio, mbuf, BUFSIZZ);
+        if (bytes != 6 || memcmp(mbuf, tls_follows, 6) != 0)
+            goto shut;
+    } break;
+    case PROTO_IRC: {
+        int numeric;
+        BIO *fbio = BIO_new(BIO_f_buffer());
 
-            do {
-                numeric = 0;
+        if (fbio == NULL) {
+            BIO_printf(bio_err, "Unable to create BIO\n");
+            goto end;
+        }
+        BIO_push(fbio, sbio);
+        BIO_printf(fbio, "STARTTLS\r\n");
+        (void)BIO_flush(fbio);
+        width = SSL_get_fd(con) + 1;
 
-                FD_ZERO(&readfds);
-                openssl_fdset(SSL_get_fd(con), &readfds);
-                timeout.tv_sec = S_CLIENT_IRC_READ_TIMEOUT;
-                timeout.tv_usec = 0;
-                /*
-                 * If the IRCd doesn't respond within
-                 * S_CLIENT_IRC_READ_TIMEOUT seconds, assume
-                 * it doesn't support STARTTLS. Many IRCds
-                 * will not give _any_ sort of response to a
-                 * STARTTLS command when it's not supported.
-                 */
-                if (!BIO_get_buffer_num_lines(fbio)
-                    && !BIO_pending(fbio)
-                    && !BIO_pending(sbio)
-                    && select(width, (void *)&readfds, NULL, NULL,
-                              &timeout) < 1) {
-                    BIO_printf(bio_err,
-                               "Timeout waiting for response (%d seconds).\n",
-                               S_CLIENT_IRC_READ_TIMEOUT);
-                    break;
-                }
+        do {
+            numeric = 0;
 
-                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
-                if (mbuf_len < 1 || sscanf(mbuf, "%*s %d", &numeric) != 1)
-                    break;
-                /* :example.net 451 STARTTLS :You have not registered */
-                /* :example.net 421 STARTTLS :Unknown command */
-                if ((numeric == 451 || numeric == 421)
-                    && strstr(mbuf, "STARTTLS") != NULL) {
-                    BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);
-                    break;
-                }
-                if (numeric == 691) {
-                    BIO_printf(bio_err, "STARTTLS negotiation failed: ");
-                    ERR_print_errors(bio_err);
-                    break;
-                }
-            } while (numeric != 670);
+            FD_ZERO(&readfds);
+            openssl_fdset(SSL_get_fd(con), &readfds);
+            timeout.tv_sec = S_CLIENT_IRC_READ_TIMEOUT;
+            timeout.tv_usec = 0;
+            /*
+             * If the IRCd doesn't respond within
+             * S_CLIENT_IRC_READ_TIMEOUT seconds, assume
+             * it doesn't support STARTTLS. Many IRCds
+             * will not give _any_ sort of response to a
+             * STARTTLS command when it's not supported.
+             */
+            if (!BIO_get_buffer_num_lines(fbio)
+                && !BIO_pending(fbio)
+                && !BIO_pending(sbio)
+                && select(width, (void *)&readfds, NULL, NULL,
+                       &timeout)
+                    < 1) {
+                BIO_printf(bio_err,
+                    "Timeout waiting for response (%d seconds).\n",
+                    S_CLIENT_IRC_READ_TIMEOUT);
+                break;
+            }
 
-            (void)BIO_flush(fbio);
-            BIO_pop(fbio);
-            BIO_free(fbio);
-            if (numeric != 670) {
-                BIO_printf(bio_err, "Server does not support STARTTLS.\n");
-                ret = 1;
-                goto shut;
+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
+            if (mbuf_len < 1 || sscanf(mbuf, "%*s %d", &numeric) != 1)
+                break;
+            /* :example.net 451 STARTTLS :You have not registered */
+            /* :example.net 421 STARTTLS :Unknown command */
+            if ((numeric == 451 || numeric == 421)
+                && strstr(mbuf, "STARTTLS") != NULL) {
+                BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);
+                break;
+            }
+            if (numeric == 691) {
+                BIO_printf(bio_err, "STARTTLS negotiation failed: ");
+                ERR_print_errors(bio_err);
+                break;
             }
+        } while (numeric != 670);
+
+        (void)BIO_flush(fbio);
+        BIO_pop(fbio);
+        BIO_free(fbio);
+        if (numeric != 670) {
+            BIO_printf(bio_err, "Server does not support STARTTLS.\n");
+            ret = 1;
+            goto shut;
         }
-        break;
-    case PROTO_MYSQL:
-        {
-            /* SSL request packet */
-            static const unsigned char ssl_req[] = {
-                /* payload_length,   sequence_id */
-                   0x20, 0x00, 0x00, 0x01,
-                /* payload */
-                /* capability flags, CLIENT_SSL always set */
-                   0x85, 0xae, 0x7f, 0x00,
-                /* max-packet size */
-                   0x00, 0x00, 0x00, 0x01,
-                /* character set */
-                   0x21,
-                /* string[23] reserved (all [0]) */
-                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-            };
-            int bytes = 0;
-            int ssl_flg = 0x800;
-            int pos;
-            const unsigned char *packet = (const unsigned char *)sbuf;
+    } break;
+    case PROTO_MYSQL: {
+        /* SSL request packet */
+        static const unsigned char ssl_req[] = {
+            /* payload_length,   sequence_id */
+            0x20, 0x00, 0x00, 0x01,
+            /* payload */
+            /* capability flags, CLIENT_SSL always set */
+            0x85, 0xae, 0x7f, 0x00,
+            /* max-packet size */
+            0x00, 0x00, 0x00, 0x01,
+            /* character set */
+            0x21,
+            /* string[23] reserved (all [0]) */
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        };
+        int bytes = 0;
+        int ssl_flg = 0x800;
+        int pos;
+        const unsigned char *packet = (const unsigned char *)sbuf;
 
-            /* Receiving Initial Handshake packet. */
-            bytes = BIO_read(sbio, (void *)packet, BUFSIZZ);
-            if (bytes < 0) {
-                BIO_printf(bio_err, "BIO_read failed\n");
-                goto shut;
+        /* Receiving Initial Handshake packet. */
+        bytes = BIO_read(sbio, (void *)packet, BUFSIZZ);
+        if (bytes < 0) {
+            BIO_printf(bio_err, "BIO_read failed\n");
+            goto shut;
             /* Packet length[3], Packet number[1] + minimum payload[17] */
-            } else if (bytes < 21) {
-                BIO_printf(bio_err, "MySQL packet too short.\n");
-                goto shut;
-            } else if (bytes != (4 + packet[0] +
-                                 (packet[1] << 8) +
-                                 (packet[2] << 16))) {
-                BIO_printf(bio_err, "MySQL packet length does not match.\n");
-                goto shut;
+        } else if (bytes < 21) {
+            BIO_printf(bio_err, "MySQL packet too short.\n");
+            goto shut;
+        } else if (bytes != (4 + packet[0] + (packet[1] << 8) + (packet[2] << 16))) {
+            BIO_printf(bio_err, "MySQL packet length does not match.\n");
+            goto shut;
             /* protocol version[1] */
-            } else if (packet[4] != 0xA) {
-                BIO_printf(bio_err,
-                           "Only MySQL protocol version 10 is supported.\n");
-                goto shut;
-            }
-
-            pos = 5;
-            /* server version[string+NULL] */
-            for (;;) {
-                if (pos >= bytes) {
-                    BIO_printf(bio_err, "Cannot confirm server version. ");
-                    goto shut;
-                } else if (packet[pos++] == '\0') {
-                    break;
-                }
-            }
+        } else if (packet[4] != 0xA) {
+            BIO_printf(bio_err,
+                "Only MySQL protocol version 10 is supported.\n");
+            goto shut;
+        }
 
-            /* make sure we have at least 15 bytes left in the packet */
-            if (pos + 15 > bytes) {
-                BIO_printf(bio_err,
-                           "MySQL server handshake packet is broken.\n");
+        pos = 5;
+        /* server version[string+NULL] */
+        for (;;) {
+            if (pos >= bytes) {
+                BIO_printf(bio_err, "Cannot confirm server version. ");
                 goto shut;
+            } else if (packet[pos++] == '\0') {
+                break;
             }
+        }
 
-            pos += 12; /* skip over conn id[4] + SALT[8] */
-            if (packet[pos++] != '\0') { /* verify filler */
-                BIO_printf(bio_err,
-                           "MySQL packet is broken.\n");
-                goto shut;
-            }
+        /* make sure we have at least 15 bytes left in the packet */
+        if (pos + 15 > bytes) {
+            BIO_printf(bio_err,
+                "MySQL server handshake packet is broken.\n");
+            goto shut;
+        }
 
-            /* capability flags[2] */
-            if (!((packet[pos] + (packet[pos + 1] << 8)) & ssl_flg)) {
-                BIO_printf(bio_err, "MySQL server does not support SSL.\n");
-                goto shut;
-            }
+        pos += 12; /* skip over conn id[4] + SALT[8] */
+        if (packet[pos++] != '\0') { /* verify filler */
+            BIO_printf(bio_err,
+                "MySQL packet is broken.\n");
+            goto shut;
+        }
 
-            /* Sending SSL Handshake packet. */
-            BIO_write(sbio, ssl_req, sizeof(ssl_req));
-            (void)BIO_flush(sbio);
+        /* capability flags[2] */
+        if (!((packet[pos] + (packet[pos + 1] << 8)) & ssl_flg)) {
+            BIO_printf(bio_err, "MySQL server does not support SSL.\n");
+            goto shut;
         }
-        break;
-    case PROTO_POSTGRES:
-        {
-            static const unsigned char ssl_request[] = {
-                /* Length        SSLRequest */
-                   0, 0, 0, 8,   4, 210, 22, 47
-            };
-            int bytes;
 
-            /* Send SSLRequest packet */
-            BIO_write(sbio, ssl_request, 8);
-            (void)BIO_flush(sbio);
+        /* Sending SSL Handshake packet. */
+        BIO_write(sbio, ssl_req, sizeof(ssl_req));
+        (void)BIO_flush(sbio);
+    } break;
+    case PROTO_POSTGRES: {
+        static const unsigned char ssl_request[] = {
+            /* Length        SSLRequest */
+            0, 0, 0, 8, 4, 210, 22, 47
+        };
+        int bytes;
 
-            /* Reply will be a single S if SSL is enabled */
-            bytes = BIO_read(sbio, sbuf, BUFSIZZ);
-            if (bytes != 1 || sbuf[0] != 'S')
-                goto shut;
-        }
-        break;
-    case PROTO_NNTP:
-        {
-            int foundit = 0;
-            BIO *fbio = BIO_new(BIO_f_buffer());
+        /* Send SSLRequest packet */
+        BIO_write(sbio, ssl_request, 8);
+        (void)BIO_flush(sbio);
 
-            if (fbio == NULL) {
-                BIO_printf(bio_err, "Unable to create BIO\n");
-                goto end;
-            }
-            BIO_push(fbio, sbio);
-            BIO_gets(fbio, mbuf, BUFSIZZ);
-            /* STARTTLS command requires CAPABILITIES... */
-            BIO_printf(fbio, "CAPABILITIES\r\n");
-            (void)BIO_flush(fbio);
-            BIO_gets(fbio, mbuf, BUFSIZZ);
-            /* no point in trying to parse the CAPABILITIES response if there is none */
-            if (strstr(mbuf, "101") != NULL) {
-                /* wait for multi-line CAPABILITIES response */
-                do {
-                    mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
-                    if (strstr(mbuf, "STARTTLS"))
-                        foundit = 1;
-                } while (mbuf_len > 1 && mbuf[0] != '.');
-            }
-            (void)BIO_flush(fbio);
-            BIO_pop(fbio);
-            BIO_free(fbio);
-            if (!foundit)
-                BIO_printf(bio_err,
-                           "Didn't find STARTTLS in server response,"
-                           " trying anyway...\n");
-            BIO_printf(sbio, "STARTTLS\r\n");
-            mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);
-            if (mbuf_len < 0) {
-                BIO_printf(bio_err, "BIO_read failed\n");
-                goto end;
-            }
-            mbuf[mbuf_len] = '\0';
-            if (strstr(mbuf, "382") == NULL) {
-                BIO_printf(bio_err, "STARTTLS failed: %s", mbuf);
-                goto shut;
-            }
-        }
-        break;
-    case PROTO_SIEVE:
-        {
-            int foundit = 0;
-            BIO *fbio = BIO_new(BIO_f_buffer());
+        /* Reply will be a single S if SSL is enabled */
+        bytes = BIO_read(sbio, sbuf, BUFSIZZ);
+        if (bytes != 1 || sbuf[0] != 'S')
+            goto shut;
+    } break;
+    case PROTO_NNTP: {
+        int foundit = 0;
+        BIO *fbio = BIO_new(BIO_f_buffer());
 
-            if (fbio == NULL) {
-                BIO_printf(bio_err, "Unable to create BIO\n");
-                goto end;
-            }
-            BIO_push(fbio, sbio);
-            /* wait for multi-line response to end from Sieve */
+        if (fbio == NULL) {
+            BIO_printf(bio_err, "Unable to create BIO\n");
+            goto end;
+        }
+        BIO_push(fbio, sbio);
+        BIO_gets(fbio, mbuf, BUFSIZZ);
+        /* STARTTLS command requires CAPABILITIES... */
+        BIO_printf(fbio, "CAPABILITIES\r\n");
+        (void)BIO_flush(fbio);
+        BIO_gets(fbio, mbuf, BUFSIZZ);
+        /* no point in trying to parse the CAPABILITIES response if there is none */
+        if (strstr(mbuf, "101") != NULL) {
+            /* wait for multi-line CAPABILITIES response */
             do {
                 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
-                /*
-                 * According to RFC 5804 § 1.7, capability
-                 * is case-insensitive, make it uppercase
-                 */
-                if (mbuf_len > 1 && mbuf[0] == '"') {
-                    make_uppercase(mbuf);
-                    if (HAS_PREFIX(mbuf, "\"STARTTLS\""))
-                        foundit = 1;
-                }
-            } while (mbuf_len > 1 && mbuf[0] == '"');
-            (void)BIO_flush(fbio);
-            BIO_pop(fbio);
-            BIO_free(fbio);
-            if (!foundit)
-                BIO_printf(bio_err,
-                           "Didn't find STARTTLS in server response,"
-                           " trying anyway...\n");
-            BIO_printf(sbio, "STARTTLS\r\n");
-            mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);
-            if (mbuf_len < 0) {
-                BIO_printf(bio_err, "BIO_read failed\n");
-                goto end;
-            }
-            mbuf[mbuf_len] = '\0';
-            if (mbuf_len < 2) {
-                BIO_printf(bio_err, "STARTTLS failed: %s", mbuf);
-                goto shut;
-            }
+                if (strstr(mbuf, "STARTTLS"))
+                    foundit = 1;
+            } while (mbuf_len > 1 && mbuf[0] != '.');
+        }
+        (void)BIO_flush(fbio);
+        BIO_pop(fbio);
+        BIO_free(fbio);
+        if (!foundit)
+            BIO_printf(bio_err,
+                "Didn't find STARTTLS in server response,"
+                " trying anyway...\n");
+        BIO_printf(sbio, "STARTTLS\r\n");
+        mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);
+        if (mbuf_len < 0) {
+            BIO_printf(bio_err, "BIO_read failed\n");
+            goto end;
+        }
+        mbuf[mbuf_len] = '\0';
+        if (strstr(mbuf, "382") == NULL) {
+            BIO_printf(bio_err, "STARTTLS failed: %s", mbuf);
+            goto shut;
+        }
+    } break;
+    case PROTO_SIEVE: {
+        int foundit = 0;
+        BIO *fbio = BIO_new(BIO_f_buffer());
+
+        if (fbio == NULL) {
+            BIO_printf(bio_err, "Unable to create BIO\n");
+            goto end;
+        }
+        BIO_push(fbio, sbio);
+        /* wait for multi-line response to end from Sieve */
+        do {
+            mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
             /*
-             * According to RFC 5804 § 2.2, response codes are case-
-             * insensitive, make it uppercase but preserve the response.
+             * According to RFC 5804 § 1.7, capability
+             * is case-insensitive, make it uppercase
              */
-            strncpy(sbuf, mbuf, 2);
-            make_uppercase(sbuf);
-            if (!HAS_PREFIX(sbuf, "OK")) {
-                BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);
-                goto shut;
+            if (mbuf_len > 1 && mbuf[0] == '"') {
+                make_uppercase(mbuf);
+                if (HAS_PREFIX(mbuf, "\"STARTTLS\""))
+                    foundit = 1;
             }
+        } while (mbuf_len > 1 && mbuf[0] == '"');
+        (void)BIO_flush(fbio);
+        BIO_pop(fbio);
+        BIO_free(fbio);
+        if (!foundit)
+            BIO_printf(bio_err,
+                "Didn't find STARTTLS in server response,"
+                " trying anyway...\n");
+        BIO_printf(sbio, "STARTTLS\r\n");
+        mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);
+        if (mbuf_len < 0) {
+            BIO_printf(bio_err, "BIO_read failed\n");
+            goto end;
         }
-        break;
-    case PROTO_LDAP:
-        {
-            /* StartTLS Operation according to RFC 4511 */
-            static char ldap_tls_genconf[] = "asn1=SEQUENCE:LDAPMessage\n"
-                "[LDAPMessage]\n"
-                "messageID=INTEGER:1\n"
-                "extendedReq=EXPLICIT:23A,IMPLICIT:0C,"
-                "FORMAT:ASCII,OCT:1.3.6.1.4.1.1466.20037\n";
-            long errline = -1;
-            char *genstr = NULL;
-            int result = -1;
-            ASN1_TYPE *atyp = NULL;
-            BIO *ldapbio = BIO_new(BIO_s_mem());
-            CONF *cnf = NCONF_new(NULL);
+        mbuf[mbuf_len] = '\0';
+        if (mbuf_len < 2) {
+            BIO_printf(bio_err, "STARTTLS failed: %s", mbuf);
+            goto shut;
+        }
+        /*
+         * According to RFC 5804 § 2.2, response codes are case-
+         * insensitive, make it uppercase but preserve the response.
+         */
+        strncpy(sbuf, mbuf, 2);
+        make_uppercase(sbuf);
+        if (!HAS_PREFIX(sbuf, "OK")) {
+            BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);
+            goto shut;
+        }
+    } break;
+    case PROTO_LDAP: {
+        /* StartTLS Operation according to RFC 4511 */
+        static char ldap_tls_genconf[] = "asn1=SEQUENCE:LDAPMessage\n"
+                                         "[LDAPMessage]\n"
+                                         "messageID=INTEGER:1\n"
+                                         "extendedReq=EXPLICIT:23A,IMPLICIT:0C,"
+                                         "FORMAT:ASCII,OCT:1.3.6.1.4.1.1466.20037\n";
+        long errline = -1;
+        char *genstr = NULL;
+        int result = -1;
+        ASN1_TYPE *atyp = NULL;
+        BIO *ldapbio = BIO_new(BIO_s_mem());
+        CONF *cnf = NCONF_new(NULL);
 
-            if (ldapbio == NULL || cnf == NULL) {
-                BIO_free(ldapbio);
-                NCONF_free(cnf);
-                goto end;
-            }
-            BIO_puts(ldapbio, ldap_tls_genconf);
-            if (NCONF_load_bio(cnf, ldapbio, &errline) <= 0) {
-                BIO_free(ldapbio);
-                NCONF_free(cnf);
-                if (errline <= 0) {
-                    BIO_printf(bio_err, "NCONF_load_bio failed\n");
-                    goto end;
-                } else {
-                    BIO_printf(bio_err, "Error on line %ld\n", errline);
-                    goto end;
-                }
-            }
+        if (ldapbio == NULL || cnf == NULL) {
             BIO_free(ldapbio);
-            genstr = NCONF_get_string(cnf, "default", "asn1");
-            if (genstr == NULL) {
-                NCONF_free(cnf);
-                BIO_printf(bio_err, "NCONF_get_string failed\n");
+            NCONF_free(cnf);
+            goto end;
+        }
+        BIO_puts(ldapbio, ldap_tls_genconf);
+        if (NCONF_load_bio(cnf, ldapbio, &errline) <= 0) {
+            BIO_free(ldapbio);
+            NCONF_free(cnf);
+            if (errline <= 0) {
+                BIO_printf(bio_err, "NCONF_load_bio failed\n");
                 goto end;
-            }
-            atyp = ASN1_generate_nconf(genstr, cnf);
-            if (atyp == NULL || atyp->type != V_ASN1_SEQUENCE) {
-                NCONF_free(cnf);
-                ASN1_TYPE_free(atyp);
-                BIO_printf(bio_err, "ASN1_generate_nconf failed\n");
+            } else {
+                BIO_printf(bio_err, "Error on line %ld\n", errline);
                 goto end;
             }
+        }
+        BIO_free(ldapbio);
+        genstr = NCONF_get_string(cnf, "default", "asn1");
+        if (genstr == NULL) {
+            NCONF_free(cnf);
+            BIO_printf(bio_err, "NCONF_get_string failed\n");
+            goto end;
+        }
+        atyp = ASN1_generate_nconf(genstr, cnf);
+        if (atyp == NULL || atyp->type != V_ASN1_SEQUENCE) {
             NCONF_free(cnf);
-
-            /* Send SSLRequest packet */
-            BIO_write(sbio, atyp->value.sequence->data,
-                      atyp->value.sequence->length);
-            (void)BIO_flush(sbio);
             ASN1_TYPE_free(atyp);
+            BIO_printf(bio_err, "ASN1_generate_nconf failed\n");
+            goto end;
+        }
+        NCONF_free(cnf);
 
-            mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);
-            if (mbuf_len < 0) {
-                BIO_printf(bio_err, "BIO_read failed\n");
-                goto end;
-            }
-            result = ldap_ExtendedResponse_parse(mbuf, mbuf_len);
-            if (result < 0) {
-                BIO_printf(bio_err, "ldap_ExtendedResponse_parse failed\n");
-                goto shut;
-            } else if (result > 0) {
-                BIO_printf(bio_err, "STARTTLS failed, LDAP Result Code: %i\n",
-                           result);
-                goto shut;
-            }
-            mbuf_len = 0;
+        /* Send SSLRequest packet */
+        BIO_write(sbio, atyp->value.sequence->data,
+            atyp->value.sequence->length);
+        (void)BIO_flush(sbio);
+        ASN1_TYPE_free(atyp);
+
+        mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);
+        if (mbuf_len < 0) {
+            BIO_printf(bio_err, "BIO_read failed\n");
+            goto end;
         }
-        break;
+        result = ldap_ExtendedResponse_parse(mbuf, mbuf_len);
+        if (result < 0) {
+            BIO_printf(bio_err, "ldap_ExtendedResponse_parse failed\n");
+            goto shut;
+        } else if (result > 0) {
+            BIO_printf(bio_err, "STARTTLS failed, LDAP Result Code: %i\n",
+                result);
+            goto shut;
+        }
+        mbuf_len = 0;
+    } break;
     }
 
     if (early_data_file != NULL
-            && ((SSL_get0_session(con) != NULL
-                 && SSL_SESSION_get_max_early_data(SSL_get0_session(con)) > 0)
-                || (psksess != NULL
-                    && SSL_SESSION_get_max_early_data(psksess) > 0))) {
+        && ((SSL_get0_session(con) != NULL
+                && SSL_SESSION_get_max_early_data(SSL_get0_session(con)) > 0)
+            || (psksess != NULL
+                && SSL_SESSION_get_max_early_data(psksess) > 0))) {
         BIO *edfile = BIO_new_file(early_data_file, "r");
         size_t readbytes, writtenbytes;
         int finish = 0;
@@ -2917,7 +2976,7 @@ int s_client_main(int argc, char **argv)
             timeoutp = NULL;
 
         if (!SSL_is_init_finished(con) && SSL_total_renegotiations(con) == 0
-                && SSL_get_key_update_type(con) == SSL_KEY_UPDATE_NONE) {
+            && SSL_get_key_update_type(con) == SSL_KEY_UPDATE_NONE) {
             in_init = 1;
             tty_on = 0;
         } else {
@@ -2943,7 +3002,7 @@ int s_client_main(int argc, char **argv)
                 if (reconnect) {
                     reconnect--;
                     BIO_printf(bio_c_out,
-                               "drop connection and then reconnect\n");
+                        "drop connection and then reconnect\n");
                     do_ssl_shutdown(con);
                     SSL_set_connect_state(con);
                     BIO_closesocket(SSL_get_fd(con));
@@ -2973,8 +3032,8 @@ int s_client_main(int argc, char **argv)
                     break;
                 }
             } while (!write_ssl
-                     && cbuf_len == 0
-                     && user_data_has_data(&user_data));
+                && cbuf_len == 0
+                && user_data_has_data(&user_data));
             if (cbuf_len > 0) {
                 read_tty = 0;
                 timeout.tv_sec = 0;
@@ -3009,18 +3068,18 @@ int s_client_main(int argc, char **argv)
              * the right thing.
              */
             if ((!isquic && read_ssl)
-                    || (isquic && SSL_net_read_desired(con)))
+                || (isquic && SSL_net_read_desired(con)))
                 openssl_fdset(SSL_get_fd(con), &readfds);
             if ((!isquic && write_ssl)
-                    || (isquic && (first_loop || SSL_net_write_desired(con))))
+                || (isquic && (first_loop || SSL_net_write_desired(con))))
                 openssl_fdset(SSL_get_fd(con), &writefds);
 #else
             if (!tty_on || !write_tty) {
                 if ((!isquic && read_ssl)
-                        || (isquic && SSL_net_read_desired(con)))
+                    || (isquic && SSL_net_read_desired(con)))
                     openssl_fdset(SSL_get_fd(con), &readfds);
                 if ((!isquic && write_ssl)
-                        || (isquic && (first_loop || SSL_net_write_desired(con))))
+                    || (isquic && (first_loop || SSL_net_write_desired(con))))
                     openssl_fdset(SSL_get_fd(con), &writefds);
             }
 #endif
@@ -3046,20 +3105,20 @@ int s_client_main(int argc, char **argv)
                     tv.tv_sec = 1;
                     tv.tv_usec = 0;
                     i = select(width, (void *)&readfds, (void *)&writefds,
-                               NULL, &tv);
+                        NULL, &tv);
                     if (!i && (!has_stdin_waiting() || !read_tty))
                         continue;
                 } else
                     i = select(width, (void *)&readfds, (void *)&writefds,
-                               NULL, timeoutp);
+                        NULL, timeoutp);
             }
 #else
             i = select(width, (void *)&readfds, (void *)&writefds,
-                       NULL, timeoutp);
+                NULL, timeoutp);
 #endif
             if (i < 0) {
                 BIO_printf(bio_err, "bad select %d\n",
-                           get_last_socket_error());
+                    get_last_socket_error());
                 goto shut;
             }
         }
@@ -3067,14 +3126,14 @@ int s_client_main(int argc, char **argv)
         if (timeoutp != NULL) {
             SSL_handle_events(con);
             if (isdtls
-                    && !FD_ISSET(SSL_get_fd(con), &readfds)
-                    && !FD_ISSET(SSL_get_fd(con), &writefds))
+                && !FD_ISSET(SSL_get_fd(con), &readfds)
+                && !FD_ISSET(SSL_get_fd(con), &writefds))
                 BIO_printf(bio_err, "TIMEOUT occurred\n");
         }
 
         if (!ssl_pending
-                && ((!isquic && FD_ISSET(SSL_get_fd(con), &writefds))
-                    || (isquic && (cbuf_len > 0 || first_loop)))) {
+            && ((!isquic && FD_ISSET(SSL_get_fd(con), &writefds))
+                || (isquic && (cbuf_len > 0 || first_loop)))) {
             k = SSL_write(con, &(cbuf[cbuf_off]), (unsigned int)cbuf_len);
             switch (SSL_get_error(con, k)) {
             case SSL_ERROR_NONE:
@@ -3086,7 +3145,7 @@ int s_client_main(int argc, char **argv)
                 if (cbuf_len == 0) {
                     read_tty = 1;
                     write_ssl = 0;
-                } else {        /* if (cbuf_len > 0) */
+                } else { /* if (cbuf_len > 0) */
 
                     read_tty = 0;
                     write_ssl = 1;
@@ -3168,7 +3227,7 @@ int s_client_main(int argc, char **argv)
                 write_tty = 0;
             }
         } else if (ssl_pending
-                   || (!isquic && FD_ISSET(SSL_get_fd(con), &readfds))) {
+            || (!isquic && FD_ISSET(SSL_get_fd(con), &readfds))) {
 #ifdef RENEG
             {
                 static int iiii;
@@ -3285,7 +3344,7 @@ int s_client_main(int argc, char **argv)
         first_loop = 0;
     }
 
- shut:
+shut:
     if (in_init)
         print_stuff(bio_c_out, con, full_log);
     do_ssl_shutdown(con);
@@ -3307,15 +3366,15 @@ int s_client_main(int argc, char **argv)
      * data. [In testing context this ensures that alerts are passed on...]
      */
     timeout.tv_sec = 0;
-    timeout.tv_usec = 500000;  /* some extreme round-trip */
+    timeout.tv_usec = 500000; /* some extreme round-trip */
     do {
         FD_ZERO(&readfds);
         openssl_fdset(sock, &readfds);
     } while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0
-             && BIO_read(sbio, sbuf, BUFSIZZ) > 0);
+        && BIO_read(sbio, sbuf, BUFSIZZ) > 0);
 
     BIO_closesocket(SSL_get_fd(con));
- end:
+end:
     if (con != NULL) {
         if (prexit != 0)
             print_stuff(bio_c_out, con, 1);
@@ -3392,12 +3451,12 @@ static void print_cert_key_info(BIO *bio, X509 *cert)
         curve = ec_curve_name(pkey);
     if (curve != NULL)
         BIO_printf(bio, "   a:PKEY: %s, (%s); sigalg: %s\n",
-                   keyalg, curve,
-                   OBJ_nid2ln(X509_get_signature_nid(cert)));
+            keyalg, curve,
+            OBJ_nid2ln(X509_get_signature_nid(cert)));
     else
         BIO_printf(bio, "   a:PKEY: %s, %d (bit); sigalg: %s\n",
-                   keyalg, EVP_PKEY_get_bits(pkey),
-                   OBJ_nid2ln(X509_get_signature_nid(cert)));
+            keyalg, EVP_PKEY_get_bits(pkey),
+            OBJ_nid2ln(X509_get_signature_nid(cert)));
     OPENSSL_free(curve);
 }
 
@@ -3501,7 +3560,7 @@ static void print_stuff(BIO *bio, SSL *s, int full)
                     SCT *sct = sk_SCT_value(scts, i);
 
                     BIO_printf(bio, "SCT validation status: %s\n",
-                               SCT_validation_status_string(sct));
+                        SCT_validation_status_string(sct));
                     SCT_print(sct, bio, 0, log_store);
                     if (i < sct_count - 1)
                         BIO_printf(bio, "\n---\n");
@@ -3512,23 +3571,23 @@ static void print_stuff(BIO *bio, SSL *s, int full)
 #endif
 
         BIO_printf(bio,
-                   "---\nSSL handshake has read %ju bytes "
-                   "and written %ju bytes\n",
-                   BIO_number_read(SSL_get_rbio(s)),
-                   BIO_number_written(SSL_get_wbio(s)));
+            "---\nSSL handshake has read %ju bytes "
+            "and written %ju bytes\n",
+            BIO_number_read(SSL_get_rbio(s)),
+            BIO_number_written(SSL_get_wbio(s)));
     }
     print_verify_detail(s, bio);
     BIO_printf(bio, (SSL_session_reused(s) ? "---\nReused, " : "---\nNew, "));
     c = SSL_get_current_cipher(s);
     BIO_printf(bio, "%s, Cipher is %s\n",
-               SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
+        SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
     BIO_printf(bio, "Protocol: %s\n", SSL_get_version(s));
     if (peer != NULL) {
         EVP_PKEY *pktmp;
 
         pktmp = X509_get0_pubkey(peer);
         BIO_printf(bio, "Server public key is %d bit\n",
-                   EVP_PKEY_get_bits(pktmp));
+            EVP_PKEY_get_bits(pktmp));
     }
 
     ssl_print_secure_renegotiation_notes(bio, s);
@@ -3537,9 +3596,9 @@ static void print_stuff(BIO *bio, SSL *s, int full)
     comp = SSL_get_current_compression(s);
     expansion = SSL_get_current_expansion(s);
     BIO_printf(bio, "Compression: %s\n",
-               comp ? SSL_COMP_get_name(comp) : "NONE");
+        comp ? SSL_COMP_get_name(comp) : "NONE");
     BIO_printf(bio, "Expansion: %s\n",
-               expansion ? SSL_COMP_get_name(expansion) : "NONE");
+        expansion ? SSL_COMP_get_name(expansion) : "NONE");
 #endif
 #ifndef OPENSSL_NO_KTLS
     if (BIO_get_ktls_send(SSL_get_wbio(s)))
@@ -3557,7 +3616,7 @@ static void print_stuff(BIO *bio, SSL *s, int full)
         if ((info.addr = BIO_ADDR_new()) != NULL
             && BIO_sock_info(sock, BIO_SOCK_INFO_ADDRESS, &info)) {
             BIO_printf(bio_c_out, "LOCAL PORT is %u\n",
-                       ntohs(BIO_ADDR_rawport(info.addr)));
+                ntohs(BIO_ADDR_rawport(info.addr)));
         }
         BIO_ADDR_free(info.addr);
     }
@@ -3586,12 +3645,11 @@ static void print_stuff(BIO *bio, SSL *s, int full)
 
 #ifndef OPENSSL_NO_SRTP
     {
-        SRTP_PROTECTION_PROFILE *srtp_profile =
-            SSL_get_selected_srtp_profile(s);
+        SRTP_PROTECTION_PROFILE *srtp_profile = SSL_get_selected_srtp_profile(s);
 
         if (srtp_profile)
             BIO_printf(bio, "SRTP Extension negotiated, profile=%s\n",
-                       srtp_profile->name);
+                srtp_profile->name);
     }
 #endif
 
@@ -3608,7 +3666,6 @@ static void print_stuff(BIO *bio, SSL *s, int full)
         case SSL_EARLY_DATA_ACCEPTED:
             BIO_printf(bio, "Early data was accepted\n");
             break;
-
         }
 
         /*
@@ -3618,7 +3675,7 @@ static void print_stuff(BIO *bio, SSL *s, int full)
          */
         verify_result = SSL_get_verify_result(s);
         BIO_printf(bio, "Verify return code: %ld (%s)\n", verify_result,
-                   X509_verify_cert_error_string(verify_result));
+            X509_verify_cert_error_string(verify_result));
     } else {
         /* In TLSv1.3 we do this on arrival of a NewSessionTicket */
         SSL_SESSION_print(bio, SSL_get_session(s));
@@ -3630,10 +3687,11 @@ static void print_stuff(BIO *bio, SSL *s, int full)
         BIO_printf(bio, "    Length: %i bytes\n", keymatexportlen);
         exportedkeymat = app_malloc(keymatexportlen, "export key");
         if (SSL_export_keying_material(s, exportedkeymat,
-                                        keymatexportlen,
-                                        keymatexportlabel,
-                                        strlen(keymatexportlabel),
-                                        NULL, 0, 0) <= 0) {
+                keymatexportlen,
+                keymatexportlabel,
+                strlen(keymatexportlabel),
+                NULL, 0, 0)
+            <= 0) {
             BIO_printf(bio, "    Error\n");
         } else {
             BIO_printf(bio, "    Keying material: ");
@@ -3648,7 +3706,7 @@ static void print_stuff(BIO *bio, SSL *s, int full)
     (void)BIO_flush(bio);
 }
 
-# ifndef OPENSSL_NO_OCSP
+#ifndef OPENSSL_NO_OCSP
 static int ocsp_resp_cb(SSL *s, void *arg)
 {
     const unsigned char *p;
@@ -3672,7 +3730,7 @@ static int ocsp_resp_cb(SSL *s, void *arg)
     OCSP_RESPONSE_free(rsp);
     return 1;
 }
-# endif
+#endif
 
 static int ldap_ExtendedResponse_parse(const char *buf, long rem)
 {
@@ -3712,18 +3770,16 @@ static int ldap_ExtendedResponse_parse(const char *buf, long rem)
 
     /* pull SEQUENCE */
     inf = ASN1_get_object(&cur, &len, &tag, &xclass, rem);
-    if (inf != V_ASN1_CONSTRUCTED || tag != V_ASN1_SEQUENCE ||
-        (rem = end - cur, len > rem)) {
+    if (inf != V_ASN1_CONSTRUCTED || tag != V_ASN1_SEQUENCE || (rem = end - cur, len > rem)) {
         BIO_printf(bio_err, "Unexpected LDAP response\n");
         goto end;
     }
 
-    rem = len;  /* ensure that we don't overstep the SEQUENCE */
+    rem = len; /* ensure that we don't overstep the SEQUENCE */
 
     /* pull MessageID */
     inf = ASN1_get_object(&cur, &len, &tag, &xclass, rem);
-    if (inf != V_ASN1_UNIVERSAL || tag != V_ASN1_INTEGER ||
-        (rem = end - cur, len > rem)) {
+    if (inf != V_ASN1_UNIVERSAL || tag != V_ASN1_INTEGER || (rem = end - cur, len > rem)) {
         BIO_printf(bio_err, "No MessageID\n");
         goto end;
     }
@@ -3733,8 +3789,7 @@ static int ldap_ExtendedResponse_parse(const char *buf, long rem)
     /* pull [APPLICATION 24] */
     rem = end - cur;
     inf = ASN1_get_object(&cur, &len, &tag, &xclass, rem);
-    if (inf != V_ASN1_CONSTRUCTED || xclass != V_ASN1_APPLICATION ||
-        tag != 24) {
+    if (inf != V_ASN1_CONSTRUCTED || xclass != V_ASN1_APPLICATION || tag != 24) {
         BIO_printf(bio_err, "Not ExtendedResponse\n");
         goto end;
     }
@@ -3742,8 +3797,7 @@ static int ldap_ExtendedResponse_parse(const char *buf, long rem)
     /* pull resultCode */
     rem = end - cur;
     inf = ASN1_get_object(&cur, &len, &tag, &xclass, rem);
-    if (inf != V_ASN1_UNIVERSAL || tag != V_ASN1_ENUMERATED || len == 0 ||
-        (rem = end - cur, len > rem)) {
+    if (inf != V_ASN1_UNIVERSAL || tag != V_ASN1_ENUMERATED || len == 0 || (rem = end - cur, len > rem)) {
         BIO_printf(bio_err, "Not LDAPResult\n");
         goto end;
     }
@@ -3754,7 +3808,7 @@ static int ldap_ExtendedResponse_parse(const char *buf, long rem)
         ret |= cur[inf];
     }
     /* There is more data, but we don't care... */
- end:
+end:
     return ret;
 }
 
@@ -3825,7 +3879,7 @@ static int is_dNS_name(const char *host)
 }
 
 static void user_data_init(struct user_data_st *user_data, SSL *con, char *buf,
-                           size_t bufmax, int mode)
+    size_t bufmax, int mode)
 {
     user_data->con = con;
     user_data->buf = buf;
@@ -3847,12 +3901,12 @@ static int user_data_add(struct user_data_st *user_data, size_t i)
     return 1;
 }
 
-#define USER_COMMAND_HELP        0
-#define USER_COMMAND_QUIT        1
-#define USER_COMMAND_RECONNECT   2
+#define USER_COMMAND_HELP 0
+#define USER_COMMAND_QUIT 1
+#define USER_COMMAND_RECONNECT 2
 #define USER_COMMAND_RENEGOTIATE 3
-#define USER_COMMAND_KEY_UPDATE  4
-#define USER_COMMAND_FIN         5
+#define USER_COMMAND_KEY_UPDATE 4
+#define USER_COMMAND_FIN 5
 
 static int user_data_execute(struct user_data_st *user_data, int cmd, char *arg)
 {
@@ -3868,7 +3922,7 @@ static int user_data_execute(struct user_data_st *user_data, int cmd, char *arg)
         BIO_printf(bio_err, "  {reconnect}: Reconnect to the peer\n");
         if (SSL_is_quic(user_data->con)) {
             BIO_printf(bio_err, "  {fin}: Send FIN on the stream. No further writing is possible\n");
-        } else if(SSL_version(user_data->con) == TLS1_3_VERSION) {
+        } else if (SSL_version(user_data->con) == TLS1_3_VERSION) {
             BIO_printf(bio_err, "  {keyup:req|noreq}: Send a Key Update message\n");
             BIO_printf(bio_err, "                     Arguments:\n");
             BIO_printf(bio_err, "                     req   = peer update requested (default)\n");
@@ -3897,19 +3951,19 @@ static int user_data_execute(struct user_data_st *user_data, int cmd, char *arg)
         return USER_DATA_PROCESS_CONTINUE;
 
     case USER_COMMAND_KEY_UPDATE: {
-            int updatetype;
+        int updatetype;
 
-            if (OPENSSL_strcasecmp(arg, "req") == 0)
-                updatetype = SSL_KEY_UPDATE_REQUESTED;
-            else if (OPENSSL_strcasecmp(arg, "noreq") == 0)
-                updatetype = SSL_KEY_UPDATE_NOT_REQUESTED;
-            else
-                return USER_DATA_PROCESS_BAD_ARGUMENT;
-            BIO_printf(bio_err, "KEYUPDATE\n");
-            if (!SSL_key_update(user_data->con, updatetype))
-                break;
-            return USER_DATA_PROCESS_CONTINUE;
-        }
+        if (OPENSSL_strcasecmp(arg, "req") == 0)
+            updatetype = SSL_KEY_UPDATE_REQUESTED;
+        else if (OPENSSL_strcasecmp(arg, "noreq") == 0)
+            updatetype = SSL_KEY_UPDATE_NOT_REQUESTED;
+        else
+            return USER_DATA_PROCESS_BAD_ARGUMENT;
+        BIO_printf(bio_err, "KEYUPDATE\n");
+        if (!SSL_key_update(user_data->con, updatetype))
+            break;
+        return USER_DATA_PROCESS_CONTINUE;
+    }
 
     case USER_COMMAND_FIN:
         if (!SSL_stream_conclude(user_data->con, 0))
@@ -3928,7 +3982,7 @@ static int user_data_execute(struct user_data_st *user_data, int cmd, char *arg)
 }
 
 static int user_data_process(struct user_data_st *user_data, size_t *len,
-                             size_t *off)
+    size_t *off)
 {
     char *buf_start = user_data->buf + user_data->bufoff;
     size_t outlen = user_data->buflen;
@@ -3957,7 +4011,7 @@ static int user_data_process(struct user_data_st *user_data, size_t *len,
         case 'k':
             user_data->buflen = user_data->bufoff = *len = *off = 0;
             return user_data_execute(user_data, USER_COMMAND_KEY_UPDATE,
-                                     buf_start[0] == 'K' ? "req" : "noreq");
+                buf_start[0] == 'K' ? "req" : "noreq");
         default:
             break;
         }
@@ -3990,8 +4044,8 @@ static int user_data_process(struct user_data_st *user_data, size_t *len,
                 /* Malformed command */
                 cmd_start[outlen - 1] = '\0';
                 BIO_printf(bio_err,
-                           "ERROR PROCESSING COMMAND. REST OF LINE IGNORED: %s\n",
-                           cmd_start);
+                    "ERROR PROCESSING COMMAND. REST OF LINE IGNORED: %s\n",
+                    cmd_start);
                 user_data->buflen = user_data->bufoff = *len = *off = 0;
                 return USER_DATA_PROCESS_NO_DATA;
             }
@@ -4014,10 +4068,11 @@ static int user_data_process(struct user_data_st *user_data, size_t *len,
                 cmd = USER_COMMAND_QUIT;
             } else if (OPENSSL_strcasecmp(cmd_start, "reconnect") == 0) {
                 cmd = USER_COMMAND_RECONNECT;
-            } else if(SSL_is_quic(user_data->con)) {
+            } else if (SSL_is_quic(user_data->con)) {
                 if (OPENSSL_strcasecmp(cmd_start, "fin") == 0)
                     cmd = USER_COMMAND_FIN;
-            } if (SSL_version(user_data->con) == TLS1_3_VERSION) {
+            }
+            if (SSL_version(user_data->con) == TLS1_3_VERSION) {
                 if (OPENSSL_strcasecmp(cmd_start, "keyup") == 0) {
                     cmd = USER_COMMAND_KEY_UPDATE;
                     if (arg_start == NULL)
@@ -4030,12 +4085,12 @@ static int user_data_process(struct user_data_st *user_data, size_t *len,
             }
             if (cmd == -1) {
                 BIO_printf(bio_err, "UNRECOGNISED COMMAND (IGNORED): %s\n",
-                           cmd_start);
+                    cmd_start);
             } else {
                 ret = user_data_execute(user_data, cmd, arg_start);
                 if (ret == USER_DATA_PROCESS_BAD_ARGUMENT) {
                     BIO_printf(bio_err, "BAD ARGUMENT (COMMAND IGNORED): %s\n",
-                               arg_start);
+                        arg_start);
                     ret = USER_DATA_PROCESS_NO_DATA;
                 }
             }
@@ -4043,8 +4098,8 @@ static int user_data_process(struct user_data_st *user_data, size_t *len,
             user_data->bufoff = (cmd_end - user_data->buf) + 1;
             user_data->buflen -= user_data->bufoff - oldoff;
             if (user_data->buf + 1 == cmd_start
-                    && user_data->buflen == 1
-                    && user_data->buf[user_data->bufoff] == '\n') {
+                && user_data->buflen == 1
+                && user_data->buf[user_data->bufoff] == '\n') {
                 /*
                  * This command was the only thing on the whole line. We
                  * suppress the final `\n`
@@ -4086,4 +4141,4 @@ static int user_data_has_data(struct user_data_st *user_data)
 {
     return user_data->buflen > 0;
 }
-#endif                          /* OPENSSL_NO_SOCK */
+#endif /* OPENSSL_NO_SOCK */
diff --git a/crypto/openssl/apps/s_server.c b/crypto/openssl/apps/s_server.c
index 8a36122a25bf..da8d001bc426 100644
--- a/crypto/openssl/apps/s_server.c
+++ b/crypto/openssl/apps/s_server.c
@@ -17,7 +17,7 @@
 #include <string.h>
 #if defined(_WIN32)
 /* Included before async.h to avoid some warnings */
-# include <windows.h>
+#include <windows.h>
 #endif
 
 #include <openssl/e_os2.h>
@@ -35,7 +35,7 @@
  * needed to have fileno() declared correctly...  So let's define u_int
  */
 #if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT)
-# define __U_INT
+#define __U_INT
 typedef unsigned int u_int;
 #endif
 
@@ -48,7 +48,7 @@ typedef unsigned int u_int;
 #include <openssl/rand.h>
 #include <openssl/ocsp.h>
 #ifndef OPENSSL_NO_DH
-# include <openssl/dh.h>
+#include <openssl/dh.h>
 #endif
 #include <openssl/rsa.h>
 #include "s_apps.h"
@@ -66,7 +66,7 @@ static void close_accept_socket(void);
 static int init_ssl_connection(SSL *s);
 static void print_stats(BIO *bp, SSL_CTX *ctx);
 static int generate_session_id(SSL *ssl, unsigned char *id,
-                               unsigned int *id_len);
+    unsigned int *id_len);
 static void init_session_cache_ctx(SSL_CTX *sctx);
 static void free_sessions(void);
 static void print_connection_info(SSL *con);
@@ -74,8 +74,8 @@ static void print_connection_info(SSL *con);
 static const int bufsize = 16 * 1024;
 static int accept_socket = -1;
 
-#define TEST_CERT       "server.pem"
-#define TEST_CERT2      "server2.pem"
+#define TEST_CERT "server.pem"
+#define TEST_CERT2 "server2.pem"
 
 static int s_nbio = 0;
 static int s_nbio_test = 0;
@@ -122,14 +122,14 @@ static int early_data = 0;
 static SSL_SESSION *psksess = NULL;
 
 static char *psk_identity = "Client_identity";
-char *psk_key = NULL;           /* by default PSK is not used */
+char *psk_key = NULL; /* by default PSK is not used */
 
 static char http_server_binmode = 0; /* for now: 0/1 = default/binary */
 
 #ifndef OPENSSL_NO_PSK
 static unsigned int psk_server_cb(SSL *ssl, const char *identity,
-                                  unsigned char *psk,
-                                  unsigned int max_psk_len)
+    unsigned char *psk,
+    unsigned int max_psk_len)
 {
     long key_len = 0;
     unsigned char *key;
@@ -153,28 +153,29 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity,
     }
     if (s_debug)
         BIO_printf(bio_s_out, "identity_len=%d identity=%s\n",
-                   (int)strlen(identity), identity);
+            (int)strlen(identity), identity);
 
     /* here we could lookup the given identity e.g. from a database */
     if (strcmp(identity, psk_identity) != 0) {
         BIO_printf(bio_s_out, "PSK warning: client identity not what we expected"
-                   " (got '%s' expected '%s')\n", identity, psk_identity);
+                              " (got '%s' expected '%s')\n",
+            identity, psk_identity);
     } else {
-      if (s_debug)
-        BIO_printf(bio_s_out, "PSK client identity found\n");
+        if (s_debug)
+            BIO_printf(bio_s_out, "PSK client identity found\n");
     }
 
     /* convert the PSK key to binary */
     key = OPENSSL_hexstr2buf(psk_key, &key_len);
     if (key == NULL) {
         BIO_printf(bio_err, "Could not convert PSK key '%s' to buffer\n",
-                   psk_key);
+            psk_key);
         return 0;
     }
     if (key_len > (int)max_psk_len) {
         BIO_printf(bio_err,
-                   "psk buffer of callback is too small (%d) for key (%ld)\n",
-                   max_psk_len, key_len);
+            "psk buffer of callback is too small (%d) for key (%ld)\n",
+            max_psk_len, key_len);
         OPENSSL_free(key);
         return 0;
     }
@@ -185,7 +186,7 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity,
     if (s_debug)
         BIO_printf(bio_s_out, "fetched PSK len=%ld\n", key_len);
     return key_len;
- out_err:
+out_err:
     if (s_debug)
         BIO_printf(bio_err, "Error in PSK server callback\n");
     (void)BIO_flush(bio_err);
@@ -195,7 +196,7 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity,
 #endif
 
 static int psk_find_session_cb(SSL *ssl, const unsigned char *identity,
-                               size_t identity_len, SSL_SESSION **sess)
+    size_t identity_len, SSL_SESSION **sess)
 {
     SSL_SESSION *tmpsess = NULL;
     unsigned char *key;
@@ -203,7 +204,7 @@ static int psk_find_session_cb(SSL *ssl, const unsigned char *identity,
     const SSL_CIPHER *cipher = NULL;
 
     if (strlen(psk_identity) != identity_len
-            || memcmp(psk_identity, identity, identity_len) != 0) {
+        || memcmp(psk_identity, identity, identity_len) != 0) {
         *sess = NULL;
         return 1;
     }
@@ -219,7 +220,7 @@ static int psk_find_session_cb(SSL *ssl, const unsigned char *identity,
     key = OPENSSL_hexstr2buf(psk_key, &key_len);
     if (key == NULL) {
         BIO_printf(bio_err, "Could not convert PSK key '%s' to buffer\n",
-                   psk_key);
+            psk_key);
         return 0;
     }
 
@@ -233,9 +234,9 @@ static int psk_find_session_cb(SSL *ssl, const unsigned char *identity,
 
     tmpsess = SSL_SESSION_new();
     if (tmpsess == NULL
-            || !SSL_SESSION_set1_master_key(tmpsess, key, key_len)
-            || !SSL_SESSION_set_cipher(tmpsess, cipher)
-            || !SSL_SESSION_set_protocol_version(tmpsess, SSL_version(ssl))) {
+        || !SSL_SESSION_set1_master_key(tmpsess, key, key_len)
+        || !SSL_SESSION_set_cipher(tmpsess, cipher)
+        || !SSL_SESSION_set_protocol_version(tmpsess, SSL_version(ssl))) {
         OPENSSL_free(key);
         SSL_SESSION_free(tmpsess);
         return 0;
@@ -262,7 +263,7 @@ static long ebcdic_ctrl(BIO *b, int cmd, long num, void *ptr);
 static int ebcdic_gets(BIO *bp, char *buf, int size);
 static int ebcdic_puts(BIO *bp, const char *str);
 
-# define BIO_TYPE_EBCDIC_FILTER  (18|0x0200)
+#define BIO_TYPE_EBCDIC_FILTER (18 | 0x0200)
 static BIO_METHOD *methods_ebcdic = NULL;
 
 /* This struct is "unwarranted chumminess with the compiler." */
@@ -275,7 +276,7 @@ static const BIO_METHOD *BIO_f_ebcdic_filter(void)
 {
     if (methods_ebcdic == NULL) {
         methods_ebcdic = BIO_meth_new(BIO_TYPE_EBCDIC_FILTER,
-                                      "EBCDIC/ASCII filter");
+            "EBCDIC/ASCII filter");
         if (methods_ebcdic == NULL
             || !BIO_meth_set_write(methods_ebcdic, ebcdic_write)
             || !BIO_meth_set_read(methods_ebcdic, ebcdic_read)
@@ -344,10 +345,10 @@ static int ebcdic_write(BIO *b, const char *in, int inl)
     if (next == NULL)
         return 0;
 
-    wbuf = (EBCDIC_OUTBUFF *) BIO_get_data(b);
+    wbuf = (EBCDIC_OUTBUFF *)BIO_get_data(b);
 
     if (inl > (num = wbuf->alloced)) {
-        num = num + num;        /* double the size */
+        num = num + num; /* double the size */
         if (num < inl)
             num = inl;
         OPENSSL_free(wbuf);
@@ -391,7 +392,7 @@ static int ebcdic_gets(BIO *bp, char *buf, int size)
 
     if (next == NULL)
         return 0;
-/*      return(BIO_gets(bp->next_bio,buf,size));*/
+    /*      return(BIO_gets(bp->next_bio,buf,size));*/
     for (i = 0; i < size - 1; ++i) {
         ret = ebcdic_read(bp, &buf[i], 1);
         if (ret <= 0)
@@ -423,7 +424,7 @@ typedef struct tlsextctx_st {
 
 static int ssl_servername_cb(SSL *s, int *ad, void *arg)
 {
-    tlsextctx *p = (tlsextctx *) arg;
+    tlsextctx *p = (tlsextctx *)arg;
     const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
 
     if (servername != NULL && p->biodebug != NULL) {
@@ -433,7 +434,7 @@ static int ssl_servername_cb(SSL *s, int *ad, void *arg)
         BIO_printf(p->biodebug, "Hostname in TLS extension: \"");
         while ((uc = *cp++) != 0)
             BIO_printf(p->biodebug,
-                       (((uc) & ~127) == 0) && isprint(uc) ? "%c" : "\\x%02x", uc);
+                (((uc) & ~127) == 0) && isprint(uc) ? "%c" : "\\x%02x", uc);
         BIO_printf(p->biodebug, "\"\n");
     }
 
@@ -475,7 +476,7 @@ static tlsextstatusctx tlscstatp = { -1 };
  * them until they were considered "expired".
  */
 static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,
-                                        OCSP_RESPONSE **resp)
+    OCSP_RESPONSE **resp)
 {
     char *host = NULL, *port = NULL, *path = NULL;
     char *proxy = NULL, *no_proxy = NULL;
@@ -499,17 +500,17 @@ static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,
     aia = X509_get1_ocsp(x);
     if (aia != NULL) {
         if (!OSSL_HTTP_parse_url(sk_OPENSSL_STRING_value(aia, 0), &use_ssl,
-                                 NULL, &host, &port, NULL, &path, NULL, NULL)) {
+                NULL, &host, &port, NULL, &path, NULL, NULL)) {
             BIO_puts(bio_err, "cert_status: can't parse AIA URL\n");
             goto err;
         }
         if (srctx->verbose)
             BIO_printf(bio_err, "cert_status: AIA URL: %s\n",
-                       sk_OPENSSL_STRING_value(aia, 0));
+                sk_OPENSSL_STRING_value(aia, 0));
     } else {
         if (srctx->host == NULL) {
             BIO_puts(bio_err,
-                     "cert_status: no AIA and no default responder URL\n");
+                "cert_status: no AIA and no default responder URL\n");
             goto done;
         }
         host = srctx->host;
@@ -537,7 +538,7 @@ static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,
         if (inctx == NULL)
             goto err;
         if (!X509_STORE_CTX_init(inctx, SSL_CTX_get_cert_store(ssl_ctx),
-                                 NULL, NULL))
+                NULL, NULL))
             goto err;
         obj = X509_STORE_CTX_get_obj_by_subject(inctx, X509_LU_X509, iname);
         if (obj == NULL) {
@@ -563,7 +564,7 @@ static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,
             goto err;
     }
     *resp = process_responder(req, host, port, path, proxy, no_proxy,
-                              use_ssl, NULL /* headers */, srctx->timeout);
+        use_ssl, NULL /* headers */, srctx->timeout);
     if (*resp == NULL) {
         BIO_puts(bio_err, "cert_status: error querying responder\n");
         goto done;
@@ -572,9 +573,9 @@ static int get_ocsp_resp_from_responder(SSL *s, tlsextstatusctx *srctx,
     ret = SSL_TLSEXT_ERR_OK;
     goto done;
 
- err:
+err:
     ret = SSL_TLSEXT_ERR_ALERT_FATAL;
- done:
+done:
     /*
      * If we parsed aia we need to free; otherwise they were copied and we
      * don't
@@ -637,7 +638,7 @@ static int cert_status_cb(SSL *s, void *arg)
 
     ret = SSL_TLSEXT_ERR_OK;
 
- err:
+err:
     if (ret != SSL_TLSEXT_ERR_OK)
         ERR_print_errors(bio_err);
 
@@ -655,7 +656,7 @@ typedef struct tlsextnextprotoctx_st {
 } tlsextnextprotoctx;
 
 static int next_proto_cb(SSL *s, const unsigned char **data,
-                         unsigned int *len, void *arg)
+    unsigned int *len, void *arg)
 {
     tlsextnextprotoctx *next_proto = arg;
 
@@ -664,7 +665,7 @@ static int next_proto_cb(SSL *s, const unsigned char **data,
 
     return SSL_TLSEXT_ERR_OK;
 }
-#endif                         /* ndef OPENSSL_NO_NEXTPROTONEG */
+#endif /* ndef OPENSSL_NO_NEXTPROTONEG */
 
 /* This the context that we pass to alpn_cb */
 typedef struct tlsextalpnctx_st {
@@ -673,7 +674,7 @@ typedef struct tlsextalpnctx_st {
 } tlsextalpnctx;
 
 static int alpn_cb(SSL *s, const unsigned char **out, unsigned char *outlen,
-                   const unsigned char *in, unsigned int inlen, void *arg)
+    const unsigned char *in, unsigned int inlen, void *arg)
 {
     tlsextalpnctx *alpn_ctx = arg;
 
@@ -690,9 +691,9 @@ static int alpn_cb(SSL *s, const unsigned char **out, unsigned char *outlen,
         BIO_write(bio_s_out, "\n", 1);
     }
 
-    if (SSL_select_next_proto
-        ((unsigned char **)out, outlen, alpn_ctx->data, alpn_ctx->len, in,
-         inlen) != OPENSSL_NPN_NEGOTIATED) {
+    if (SSL_select_next_proto((unsigned char **)out, outlen, alpn_ctx->data, alpn_ctx->len, in,
+            inlen)
+        != OPENSSL_NPN_NEGOTIATED) {
         return SSL_TLSEXT_ERR_ALERT_FATAL;
     }
 
@@ -714,36 +715,131 @@ static int not_resumable_sess_cb(SSL *s, int is_forward_secure)
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_ENGINE,
-    OPT_4, OPT_6, OPT_ACCEPT, OPT_PORT, OPT_UNIX, OPT_UNLINK, OPT_NACCEPT,
-    OPT_VERIFY, OPT_NAMEOPT, OPT_UPPER_V_VERIFY, OPT_CONTEXT, OPT_CERT, OPT_CRL,
-    OPT_CRL_DOWNLOAD, OPT_SERVERINFO, OPT_CERTFORM, OPT_KEY, OPT_KEYFORM,
-    OPT_PASS, OPT_CERT_CHAIN, OPT_DHPARAM, OPT_DCERTFORM, OPT_DCERT,
-    OPT_DKEYFORM, OPT_DPASS, OPT_DKEY, OPT_DCERT_CHAIN, OPT_NOCERT,
-    OPT_CAPATH, OPT_NOCAPATH, OPT_CHAINCAPATH, OPT_VERIFYCAPATH, OPT_NO_CACHE,
-    OPT_EXT_CACHE, OPT_CRLFORM, OPT_VERIFY_RET_ERROR, OPT_VERIFY_QUIET,
-    OPT_BUILD_CHAIN, OPT_CAFILE, OPT_NOCAFILE, OPT_CHAINCAFILE,
+    OPT_4,
+    OPT_6,
+    OPT_ACCEPT,
+    OPT_PORT,
+    OPT_UNIX,
+    OPT_UNLINK,
+    OPT_NACCEPT,
+    OPT_VERIFY,
+    OPT_NAMEOPT,
+    OPT_UPPER_V_VERIFY,
+    OPT_CONTEXT,
+    OPT_CERT,
+    OPT_CRL,
+    OPT_CRL_DOWNLOAD,
+    OPT_SERVERINFO,
+    OPT_CERTFORM,
+    OPT_KEY,
+    OPT_KEYFORM,
+    OPT_PASS,
+    OPT_CERT_CHAIN,
+    OPT_DHPARAM,
+    OPT_DCERTFORM,
+    OPT_DCERT,
+    OPT_DKEYFORM,
+    OPT_DPASS,
+    OPT_DKEY,
+    OPT_DCERT_CHAIN,
+    OPT_NOCERT,
+    OPT_CAPATH,
+    OPT_NOCAPATH,
+    OPT_CHAINCAPATH,
+    OPT_VERIFYCAPATH,
+    OPT_NO_CACHE,
+    OPT_EXT_CACHE,
+    OPT_CRLFORM,
+    OPT_VERIFY_RET_ERROR,
+    OPT_VERIFY_QUIET,
+    OPT_BUILD_CHAIN,
+    OPT_CAFILE,
+    OPT_NOCAFILE,
+    OPT_CHAINCAFILE,
     OPT_VERIFYCAFILE,
-    OPT_CASTORE, OPT_NOCASTORE, OPT_CHAINCASTORE, OPT_VERIFYCASTORE,
-    OPT_NBIO, OPT_NBIO_TEST, OPT_IGN_EOF, OPT_NO_IGN_EOF,
-    OPT_DEBUG, OPT_TLSEXTDEBUG, OPT_STATUS, OPT_STATUS_VERBOSE,
-    OPT_STATUS_TIMEOUT, OPT_PROXY, OPT_NO_PROXY, OPT_STATUS_URL,
-    OPT_STATUS_FILE, OPT_MSG, OPT_MSGFILE,
-    OPT_TRACE, OPT_SECURITY_DEBUG, OPT_SECURITY_DEBUG_VERBOSE, OPT_STATE,
-    OPT_CRLF, OPT_QUIET, OPT_BRIEF, OPT_NO_DHE,
-    OPT_NO_RESUME_EPHEMERAL, OPT_PSK_IDENTITY, OPT_PSK_HINT, OPT_PSK,
-    OPT_PSK_SESS, OPT_SRPVFILE, OPT_SRPUSERSEED, OPT_REV, OPT_WWW,
-    OPT_UPPER_WWW, OPT_HTTP, OPT_ASYNC, OPT_SSL_CONFIG,
-    OPT_MAX_SEND_FRAG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF,
-    OPT_SSL3, OPT_TLS1_3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1,
-    OPT_DTLS1_2, OPT_SCTP, OPT_TIMEOUT, OPT_MTU, OPT_LISTEN, OPT_STATELESS,
-    OPT_ID_PREFIX, OPT_SERVERNAME, OPT_SERVERNAME_FATAL,
-    OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN, OPT_SENDFILE,
-    OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN,
-    OPT_KEYLOG_FILE, OPT_MAX_EARLY, OPT_RECV_MAX_EARLY, OPT_EARLY_DATA,
-    OPT_S_NUM_TICKETS, OPT_ANTI_REPLAY, OPT_NO_ANTI_REPLAY, OPT_SCTP_LABEL_BUG,
-    OPT_HTTP_SERVER_BINMODE, OPT_NOCANAMES, OPT_IGNORE_UNEXPECTED_EOF, OPT_KTLS,
+    OPT_CASTORE,
+    OPT_NOCASTORE,
+    OPT_CHAINCASTORE,
+    OPT_VERIFYCASTORE,
+    OPT_NBIO,
+    OPT_NBIO_TEST,
+    OPT_IGN_EOF,
+    OPT_NO_IGN_EOF,
+    OPT_DEBUG,
+    OPT_TLSEXTDEBUG,
+    OPT_STATUS,
+    OPT_STATUS_VERBOSE,
+    OPT_STATUS_TIMEOUT,
+    OPT_PROXY,
+    OPT_NO_PROXY,
+    OPT_STATUS_URL,
+    OPT_STATUS_FILE,
+    OPT_MSG,
+    OPT_MSGFILE,
+    OPT_TRACE,
+    OPT_SECURITY_DEBUG,
+    OPT_SECURITY_DEBUG_VERBOSE,
+    OPT_STATE,
+    OPT_CRLF,
+    OPT_QUIET,
+    OPT_BRIEF,
+    OPT_NO_DHE,
+    OPT_NO_RESUME_EPHEMERAL,
+    OPT_PSK_IDENTITY,
+    OPT_PSK_HINT,
+    OPT_PSK,
+    OPT_PSK_SESS,
+    OPT_SRPVFILE,
+    OPT_SRPUSERSEED,
+    OPT_REV,
+    OPT_WWW,
+    OPT_UPPER_WWW,
+    OPT_HTTP,
+    OPT_ASYNC,
+    OPT_SSL_CONFIG,
+    OPT_MAX_SEND_FRAG,
+    OPT_SPLIT_SEND_FRAG,
+    OPT_MAX_PIPELINES,
+    OPT_READ_BUF,
+    OPT_SSL3,
+    OPT_TLS1_3,
+    OPT_TLS1_2,
+    OPT_TLS1_1,
+    OPT_TLS1,
+    OPT_DTLS,
+    OPT_DTLS1,
+    OPT_DTLS1_2,
+    OPT_SCTP,
+    OPT_TIMEOUT,
+    OPT_MTU,
+    OPT_LISTEN,
+    OPT_STATELESS,
+    OPT_ID_PREFIX,
+    OPT_SERVERNAME,
+    OPT_SERVERNAME_FATAL,
+    OPT_CERT2,
+    OPT_KEY2,
+    OPT_NEXTPROTONEG,
+    OPT_ALPN,
+    OPT_SENDFILE,
+    OPT_SRTP_PROFILES,
+    OPT_KEYMATEXPORT,
+    OPT_KEYMATEXPORTLEN,
+    OPT_KEYLOG_FILE,
+    OPT_MAX_EARLY,
+    OPT_RECV_MAX_EARLY,
+    OPT_EARLY_DATA,
+    OPT_S_NUM_TICKETS,
+    OPT_ANTI_REPLAY,
+    OPT_NO_ANTI_REPLAY,
+    OPT_SCTP_LABEL_BUG,
+    OPT_HTTP_SERVER_BINMODE,
+    OPT_NOCANAMES,
+    OPT_IGNORE_UNEXPECTED_EOF,
+    OPT_KTLS,
     OPT_USE_ZC_SENDFILE,
-    OPT_TFO, OPT_CERT_COMP,
+    OPT_TFO,
+    OPT_CERT_COMP,
     OPT_ENABLE_SERVER_RPK,
     OPT_ENABLE_CLIENT_RPK,
     OPT_R_ENUM,
@@ -755,261 +851,261 @@ typedef enum OPTION_choice {
 
 const OPTIONS s_server_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"ssl_config", OPT_SSL_CONFIG, 's',
-     "Configure SSL_CTX using the given configuration value"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "ssl_config", OPT_SSL_CONFIG, 's',
+        "Configure SSL_CTX using the given configuration value" },
 #ifndef OPENSSL_NO_SSL_TRACE
-    {"trace", OPT_TRACE, '-', "trace protocol messages"},
+    { "trace", OPT_TRACE, '-', "trace protocol messages" },
 #endif
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Network"),
-    {"port", OPT_PORT, 'p',
-     "TCP/IP port to listen on for connections (default is " PORT ")"},
-    {"accept", OPT_ACCEPT, 's',
-     "TCP/IP optional host and port to listen on for connections (default is *:" PORT ")"},
+    { "port", OPT_PORT, 'p',
+        "TCP/IP port to listen on for connections (default is " PORT ")" },
+    { "accept", OPT_ACCEPT, 's',
+        "TCP/IP optional host and port to listen on for connections (default is *:" PORT ")" },
 #ifdef AF_UNIX
-    {"unix", OPT_UNIX, 's', "Unix domain socket to accept on"},
-    {"unlink", OPT_UNLINK, '-', "For -unix, unlink existing socket first"},
+    { "unix", OPT_UNIX, 's', "Unix domain socket to accept on" },
+    { "unlink", OPT_UNLINK, '-', "For -unix, unlink existing socket first" },
 #endif
-    {"4", OPT_4, '-', "Use IPv4 only"},
-    {"6", OPT_6, '-', "Use IPv6 only"},
+    { "4", OPT_4, '-', "Use IPv4 only" },
+    { "6", OPT_6, '-', "Use IPv6 only" },
 #if defined(TCP_FASTOPEN) && !defined(OPENSSL_NO_TFO)
-    {"tfo", OPT_TFO, '-', "Listen for TCP Fast Open connections"},
+    { "tfo", OPT_TFO, '-', "Listen for TCP Fast Open connections" },
 #endif
 
     OPT_SECTION("Identity"),
-    {"context", OPT_CONTEXT, 's', "Set session ID context"},
-    {"CAfile", OPT_CAFILE, '<', "PEM format file of CA's"},
-    {"CApath", OPT_CAPATH, '/', "PEM format directory of CA's"},
-    {"CAstore", OPT_CASTORE, ':', "URI to store of CA's"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load certificates from the default certificates store URI"},
-    {"nocert", OPT_NOCERT, '-', "Don't use any certificates (Anon-DH)"},
-    {"verify", OPT_VERIFY, 'n', "Turn on peer certificate verification"},
-    {"Verify", OPT_UPPER_V_VERIFY, 'n',
-     "Turn on peer certificate verification, must have a cert"},
-    {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
-    {"cert", OPT_CERT, '<', "Server certificate file to use; default " TEST_CERT},
-    {"cert2", OPT_CERT2, '<',
-     "Certificate file to use for servername; default " TEST_CERT2},
-    {"certform", OPT_CERTFORM, 'F',
-     "Server certificate file format (PEM/DER/P12); has no effect"},
-    {"cert_chain", OPT_CERT_CHAIN, '<',
-     "Server certificate chain file in PEM format"},
-    {"build_chain", OPT_BUILD_CHAIN, '-', "Build server certificate chain"},
-    {"serverinfo", OPT_SERVERINFO, 's',
-     "PEM serverinfo file for certificate"},
-    {"key", OPT_KEY, 's',
-     "Private key file to use; default is -cert file or else" TEST_CERT},
-    {"key2", OPT_KEY2, '<',
-     "-Private Key file to use for servername if not in -cert2"},
-    {"keyform", OPT_KEYFORM, 'f', "Key format (ENGINE, other values ignored)"},
-    {"pass", OPT_PASS, 's', "Private key and cert file pass phrase source"},
-    {"dcert", OPT_DCERT, '<',
-     "Second server certificate file to use (usually for DSA)"},
-    {"dcertform", OPT_DCERTFORM, 'F',
-     "Second server certificate file format (PEM/DER/P12); has no effect"},
-    {"dcert_chain", OPT_DCERT_CHAIN, '<',
-     "second server certificate chain file in PEM format"},
-    {"dkey", OPT_DKEY, '<',
-     "Second private key file to use (usually for DSA)"},
-    {"dkeyform", OPT_DKEYFORM, 'f',
-     "Second key file format (ENGINE, other values ignored)"},
-    {"dpass", OPT_DPASS, 's',
-     "Second private key and cert file pass phrase source"},
-    {"dhparam", OPT_DHPARAM, '<', "DH parameters file to use"},
-    {"servername", OPT_SERVERNAME, 's',
-     "Servername for HostName TLS extension"},
-    {"servername_fatal", OPT_SERVERNAME_FATAL, '-',
-     "On servername mismatch send fatal alert (default warning alert)"},
-    {"nbio_test", OPT_NBIO_TEST, '-', "Test with the non-blocking test bio"},
-    {"crlf", OPT_CRLF, '-', "Convert LF from terminal into CRLF"},
-    {"quiet", OPT_QUIET, '-', "No server output"},
-    {"no_resume_ephemeral", OPT_NO_RESUME_EPHEMERAL, '-',
-     "Disable caching and tickets if ephemeral (EC)DH is used"},
-    {"www", OPT_WWW, '-', "Respond to a 'GET /' with a status page"},
-    {"WWW", OPT_UPPER_WWW, '-', "Respond to a 'GET with the file ./path"},
-    {"ignore_unexpected_eof", OPT_IGNORE_UNEXPECTED_EOF, '-',
-     "Do not treat lack of close_notify from a peer as an error"},
-    {"tlsextdebug", OPT_TLSEXTDEBUG, '-',
-     "Hex dump of all TLS extensions received"},
-    {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path includes HTTP headers"},
-    {"id_prefix", OPT_ID_PREFIX, 's',
-     "Generate SSL/TLS session IDs prefixed by arg"},
-    {"keymatexport", OPT_KEYMATEXPORT, 's',
-     "Export keying material using label"},
-    {"keymatexportlen", OPT_KEYMATEXPORTLEN, 'p',
-     "Export len bytes of keying material; default 20"},
-    {"CRL", OPT_CRL, '<', "CRL file to use"},
-    {"CRLform", OPT_CRLFORM, 'F', "CRL file format (PEM or DER); default PEM"},
-    {"crl_download", OPT_CRL_DOWNLOAD, '-',
-     "Download CRLs from distribution points in certificate CDP entries"},
-    {"chainCAfile", OPT_CHAINCAFILE, '<',
-     "CA file for certificate chain (PEM format)"},
-    {"chainCApath", OPT_CHAINCAPATH, '/',
-     "use dir as certificate store path to build CA certificate chain"},
-    {"chainCAstore", OPT_CHAINCASTORE, ':',
-     "use URI as certificate store to build CA certificate chain"},
-    {"verifyCAfile", OPT_VERIFYCAFILE, '<',
-     "CA file for certificate verification (PEM format)"},
-    {"verifyCApath", OPT_VERIFYCAPATH, '/',
-     "use dir as certificate store path to verify CA certificate"},
-    {"verifyCAstore", OPT_VERIFYCASTORE, ':',
-     "use URI as certificate store to verify CA certificate"},
-    {"no_cache", OPT_NO_CACHE, '-', "Disable session cache"},
-    {"ext_cache", OPT_EXT_CACHE, '-',
-     "Disable internal cache, set up and use external cache"},
-    {"verify_return_error", OPT_VERIFY_RET_ERROR, '-',
-     "Close connection on verification error"},
-    {"verify_quiet", OPT_VERIFY_QUIET, '-',
-     "No verify output except verify errors"},
-    {"ign_eof", OPT_IGN_EOF, '-', "Ignore input EOF (default when -quiet)"},
-    {"no_ign_eof", OPT_NO_IGN_EOF, '-', "Do not ignore input EOF"},
+    { "context", OPT_CONTEXT, 's', "Set session ID context" },
+    { "CAfile", OPT_CAFILE, '<', "PEM format file of CA's" },
+    { "CApath", OPT_CAPATH, '/', "PEM format directory of CA's" },
+    { "CAstore", OPT_CASTORE, ':', "URI to store of CA's" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load certificates from the default certificates directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load certificates from the default certificates store URI" },
+    { "nocert", OPT_NOCERT, '-', "Don't use any certificates (Anon-DH)" },
+    { "verify", OPT_VERIFY, 'n', "Turn on peer certificate verification" },
+    { "Verify", OPT_UPPER_V_VERIFY, 'n',
+        "Turn on peer certificate verification, must have a cert" },
+    { "nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options" },
+    { "cert", OPT_CERT, '<', "Server certificate file to use; default " TEST_CERT },
+    { "cert2", OPT_CERT2, '<',
+        "Certificate file to use for servername; default " TEST_CERT2 },
+    { "certform", OPT_CERTFORM, 'F',
+        "Server certificate file format (PEM/DER/P12); has no effect" },
+    { "cert_chain", OPT_CERT_CHAIN, '<',
+        "Server certificate chain file in PEM format" },
+    { "build_chain", OPT_BUILD_CHAIN, '-', "Build server certificate chain" },
+    { "serverinfo", OPT_SERVERINFO, 's',
+        "PEM serverinfo file for certificate" },
+    { "key", OPT_KEY, 's',
+        "Private key file to use; default is -cert file or else" TEST_CERT },
+    { "key2", OPT_KEY2, '<',
+        "-Private Key file to use for servername if not in -cert2" },
+    { "keyform", OPT_KEYFORM, 'f', "Key format (ENGINE, other values ignored)" },
+    { "pass", OPT_PASS, 's', "Private key and cert file pass phrase source" },
+    { "dcert", OPT_DCERT, '<',
+        "Second server certificate file to use (usually for DSA)" },
+    { "dcertform", OPT_DCERTFORM, 'F',
+        "Second server certificate file format (PEM/DER/P12); has no effect" },
+    { "dcert_chain", OPT_DCERT_CHAIN, '<',
+        "second server certificate chain file in PEM format" },
+    { "dkey", OPT_DKEY, '<',
+        "Second private key file to use (usually for DSA)" },
+    { "dkeyform", OPT_DKEYFORM, 'f',
+        "Second key file format (ENGINE, other values ignored)" },
+    { "dpass", OPT_DPASS, 's',
+        "Second private key and cert file pass phrase source" },
+    { "dhparam", OPT_DHPARAM, '<', "DH parameters file to use" },
+    { "servername", OPT_SERVERNAME, 's',
+        "Servername for HostName TLS extension" },
+    { "servername_fatal", OPT_SERVERNAME_FATAL, '-',
+        "On servername mismatch send fatal alert (default warning alert)" },
+    { "nbio_test", OPT_NBIO_TEST, '-', "Test with the non-blocking test bio" },
+    { "crlf", OPT_CRLF, '-', "Convert LF from terminal into CRLF" },
+    { "quiet", OPT_QUIET, '-', "No server output" },
+    { "no_resume_ephemeral", OPT_NO_RESUME_EPHEMERAL, '-',
+        "Disable caching and tickets if ephemeral (EC)DH is used" },
+    { "www", OPT_WWW, '-', "Respond to a 'GET /' with a status page" },
+    { "WWW", OPT_UPPER_WWW, '-', "Respond to a 'GET with the file ./path" },
+    { "ignore_unexpected_eof", OPT_IGNORE_UNEXPECTED_EOF, '-',
+        "Do not treat lack of close_notify from a peer as an error" },
+    { "tlsextdebug", OPT_TLSEXTDEBUG, '-',
+        "Hex dump of all TLS extensions received" },
+    { "HTTP", OPT_HTTP, '-', "Like -WWW but ./path includes HTTP headers" },
+    { "id_prefix", OPT_ID_PREFIX, 's',
+        "Generate SSL/TLS session IDs prefixed by arg" },
+    { "keymatexport", OPT_KEYMATEXPORT, 's',
+        "Export keying material using label" },
+    { "keymatexportlen", OPT_KEYMATEXPORTLEN, 'p',
+        "Export len bytes of keying material; default 20" },
+    { "CRL", OPT_CRL, '<', "CRL file to use" },
+    { "CRLform", OPT_CRLFORM, 'F', "CRL file format (PEM or DER); default PEM" },
+    { "crl_download", OPT_CRL_DOWNLOAD, '-',
+        "Download CRLs from distribution points in certificate CDP entries" },
+    { "chainCAfile", OPT_CHAINCAFILE, '<',
+        "CA file for certificate chain (PEM format)" },
+    { "chainCApath", OPT_CHAINCAPATH, '/',
+        "use dir as certificate store path to build CA certificate chain" },
+    { "chainCAstore", OPT_CHAINCASTORE, ':',
+        "use URI as certificate store to build CA certificate chain" },
+    { "verifyCAfile", OPT_VERIFYCAFILE, '<',
+        "CA file for certificate verification (PEM format)" },
+    { "verifyCApath", OPT_VERIFYCAPATH, '/',
+        "use dir as certificate store path to verify CA certificate" },
+    { "verifyCAstore", OPT_VERIFYCASTORE, ':',
+        "use URI as certificate store to verify CA certificate" },
+    { "no_cache", OPT_NO_CACHE, '-', "Disable session cache" },
+    { "ext_cache", OPT_EXT_CACHE, '-',
+        "Disable internal cache, set up and use external cache" },
+    { "verify_return_error", OPT_VERIFY_RET_ERROR, '-',
+        "Close connection on verification error" },
+    { "verify_quiet", OPT_VERIFY_QUIET, '-',
+        "No verify output except verify errors" },
+    { "ign_eof", OPT_IGN_EOF, '-', "Ignore input EOF (default when -quiet)" },
+    { "no_ign_eof", OPT_NO_IGN_EOF, '-', "Do not ignore input EOF" },
 #ifndef OPENSSL_NO_COMP_ALG
-    {"cert_comp", OPT_CERT_COMP, '-', "Pre-compress server certificates"},
+    { "cert_comp", OPT_CERT_COMP, '-', "Pre-compress server certificates" },
 #endif
 
 #ifndef OPENSSL_NO_OCSP
     OPT_SECTION("OCSP"),
-    {"status", OPT_STATUS, '-', "Request certificate status from server"},
-    {"status_verbose", OPT_STATUS_VERBOSE, '-',
-     "Print more output in certificate status callback"},
-    {"status_timeout", OPT_STATUS_TIMEOUT, 'n',
-     "Status request responder timeout"},
-    {"status_url", OPT_STATUS_URL, 's', "Status request fallback URL"},
-    {"proxy", OPT_PROXY, 's',
-     "[http[s]://]host[:port][/path] of HTTP(S) proxy to use; path is ignored"},
-    {"no_proxy", OPT_NO_PROXY, 's',
-     "List of addresses of servers not to use HTTP(S) proxy for"},
-    {OPT_MORE_STR, 0, 0,
-     "Default from environment variable 'no_proxy', else 'NO_PROXY', else none"},
-    {"status_file", OPT_STATUS_FILE, '<',
-     "File containing DER encoded OCSP Response"},
+    { "status", OPT_STATUS, '-', "Request certificate status from server" },
+    { "status_verbose", OPT_STATUS_VERBOSE, '-',
+        "Print more output in certificate status callback" },
+    { "status_timeout", OPT_STATUS_TIMEOUT, 'n',
+        "Status request responder timeout" },
+    { "status_url", OPT_STATUS_URL, 's', "Status request fallback URL" },
+    { "proxy", OPT_PROXY, 's',
+        "[http[s]://]host[:port][/path] of HTTP(S) proxy to use; path is ignored" },
+    { "no_proxy", OPT_NO_PROXY, 's',
+        "List of addresses of servers not to use HTTP(S) proxy for" },
+    { OPT_MORE_STR, 0, 0,
+        "Default from environment variable 'no_proxy', else 'NO_PROXY', else none" },
+    { "status_file", OPT_STATUS_FILE, '<',
+        "File containing DER encoded OCSP Response" },
 #endif
 
     OPT_SECTION("Debug"),
-    {"security_debug", OPT_SECURITY_DEBUG, '-',
-     "Print output from SSL/TLS security framework"},
-    {"security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-',
-     "Print more output from SSL/TLS security framework"},
-    {"brief", OPT_BRIEF, '-',
-     "Restrict output to brief summary of connection parameters"},
-    {"rev", OPT_REV, '-',
-     "act as an echo server that sends back received text reversed"},
-    {"debug", OPT_DEBUG, '-', "Print more output"},
-    {"msg", OPT_MSG, '-', "Show protocol messages"},
-    {"msgfile", OPT_MSGFILE, '>',
-     "File to send output of -msg or -trace, instead of stdout"},
-    {"state", OPT_STATE, '-', "Print the SSL states"},
-    {"async", OPT_ASYNC, '-', "Operate in asynchronous mode"},
-    {"max_pipelines", OPT_MAX_PIPELINES, 'p',
-     "Maximum number of encrypt/decrypt pipelines to be used"},
-    {"naccept", OPT_NACCEPT, 'p', "Terminate after #num connections"},
-    {"keylogfile", OPT_KEYLOG_FILE, '>', "Write TLS secrets to file"},
+    { "security_debug", OPT_SECURITY_DEBUG, '-',
+        "Print output from SSL/TLS security framework" },
+    { "security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-',
+        "Print more output from SSL/TLS security framework" },
+    { "brief", OPT_BRIEF, '-',
+        "Restrict output to brief summary of connection parameters" },
+    { "rev", OPT_REV, '-',
+        "act as an echo server that sends back received text reversed" },
+    { "debug", OPT_DEBUG, '-', "Print more output" },
+    { "msg", OPT_MSG, '-', "Show protocol messages" },
+    { "msgfile", OPT_MSGFILE, '>',
+        "File to send output of -msg or -trace, instead of stdout" },
+    { "state", OPT_STATE, '-', "Print the SSL states" },
+    { "async", OPT_ASYNC, '-', "Operate in asynchronous mode" },
+    { "max_pipelines", OPT_MAX_PIPELINES, 'p',
+        "Maximum number of encrypt/decrypt pipelines to be used" },
+    { "naccept", OPT_NACCEPT, 'p', "Terminate after #num connections" },
+    { "keylogfile", OPT_KEYLOG_FILE, '>', "Write TLS secrets to file" },
 
     OPT_SECTION("Network"),
-    {"nbio", OPT_NBIO, '-', "Use non-blocking IO"},
-    {"timeout", OPT_TIMEOUT, '-', "Enable timeouts"},
-    {"mtu", OPT_MTU, 'p', "Set link-layer MTU"},
-    {"read_buf", OPT_READ_BUF, 'p',
-     "Default read buffer size to be used for connections"},
-    {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'p',
-     "Size used to split data for encrypt pipelines"},
-    {"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "},
+    { "nbio", OPT_NBIO, '-', "Use non-blocking IO" },
+    { "timeout", OPT_TIMEOUT, '-', "Enable timeouts" },
+    { "mtu", OPT_MTU, 'p', "Set link-layer MTU" },
+    { "read_buf", OPT_READ_BUF, 'p',
+        "Default read buffer size to be used for connections" },
+    { "split_send_frag", OPT_SPLIT_SEND_FRAG, 'p',
+        "Size used to split data for encrypt pipelines" },
+    { "max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames " },
 
     OPT_SECTION("Server identity"),
-    {"psk_identity", OPT_PSK_IDENTITY, 's', "PSK identity to expect"},
+    { "psk_identity", OPT_PSK_IDENTITY, 's', "PSK identity to expect" },
 #ifndef OPENSSL_NO_PSK
-    {"psk_hint", OPT_PSK_HINT, 's', "PSK identity hint to use"},
+    { "psk_hint", OPT_PSK_HINT, 's', "PSK identity hint to use" },
 #endif
-    {"psk", OPT_PSK, 's', "PSK in hex (without 0x)"},
-    {"psk_session", OPT_PSK_SESS, '<', "File to read PSK SSL session from"},
+    { "psk", OPT_PSK, 's', "PSK in hex (without 0x)" },
+    { "psk_session", OPT_PSK_SESS, '<', "File to read PSK SSL session from" },
 #ifndef OPENSSL_NO_SRP
-    {"srpvfile", OPT_SRPVFILE, '<', "(deprecated) The verifier file for SRP"},
-    {"srpuserseed", OPT_SRPUSERSEED, 's',
-     "(deprecated) A seed string for a default user salt"},
+    { "srpvfile", OPT_SRPVFILE, '<', "(deprecated) The verifier file for SRP" },
+    { "srpuserseed", OPT_SRPUSERSEED, 's',
+        "(deprecated) A seed string for a default user salt" },
 #endif
 
     OPT_SECTION("Protocol and version"),
-    {"max_early_data", OPT_MAX_EARLY, 'n',
-     "The maximum number of bytes of early data as advertised in tickets"},
-    {"recv_max_early_data", OPT_RECV_MAX_EARLY, 'n',
-     "The maximum number of bytes of early data (hard limit)"},
-    {"early_data", OPT_EARLY_DATA, '-', "Attempt to read early data"},
-    {"num_tickets", OPT_S_NUM_TICKETS, 'n',
-     "The number of TLSv1.3 session tickets that a server will automatically issue" },
-    {"anti_replay", OPT_ANTI_REPLAY, '-', "Switch on anti-replay protection (default)"},
-    {"no_anti_replay", OPT_NO_ANTI_REPLAY, '-', "Switch off anti-replay protection"},
-    {"http_server_binmode", OPT_HTTP_SERVER_BINMODE, '-', "opening files in binary mode when acting as http server (-WWW and -HTTP)"},
-    {"no_ca_names", OPT_NOCANAMES, '-',
-     "Disable TLS Extension CA Names"},
-    {"stateless", OPT_STATELESS, '-', "Require TLSv1.3 cookies"},
+    { "max_early_data", OPT_MAX_EARLY, 'n',
+        "The maximum number of bytes of early data as advertised in tickets" },
+    { "recv_max_early_data", OPT_RECV_MAX_EARLY, 'n',
+        "The maximum number of bytes of early data (hard limit)" },
+    { "early_data", OPT_EARLY_DATA, '-', "Attempt to read early data" },
+    { "num_tickets", OPT_S_NUM_TICKETS, 'n',
+        "The number of TLSv1.3 session tickets that a server will automatically issue" },
+    { "anti_replay", OPT_ANTI_REPLAY, '-', "Switch on anti-replay protection (default)" },
+    { "no_anti_replay", OPT_NO_ANTI_REPLAY, '-', "Switch off anti-replay protection" },
+    { "http_server_binmode", OPT_HTTP_SERVER_BINMODE, '-', "opening files in binary mode when acting as http server (-WWW and -HTTP)" },
+    { "no_ca_names", OPT_NOCANAMES, '-',
+        "Disable TLS Extension CA Names" },
+    { "stateless", OPT_STATELESS, '-', "Require TLSv1.3 cookies" },
 #ifndef OPENSSL_NO_SSL3
-    {"ssl3", OPT_SSL3, '-', "Just talk SSLv3"},
+    { "ssl3", OPT_SSL3, '-', "Just talk SSLv3" },
 #endif
 #ifndef OPENSSL_NO_TLS1
-    {"tls1", OPT_TLS1, '-', "Just talk TLSv1"},
+    { "tls1", OPT_TLS1, '-', "Just talk TLSv1" },
 #endif
 #ifndef OPENSSL_NO_TLS1_1
-    {"tls1_1", OPT_TLS1_1, '-', "Just talk TLSv1.1"},
+    { "tls1_1", OPT_TLS1_1, '-', "Just talk TLSv1.1" },
 #endif
 #ifndef OPENSSL_NO_TLS1_2
-    {"tls1_2", OPT_TLS1_2, '-', "just talk TLSv1.2"},
+    { "tls1_2", OPT_TLS1_2, '-', "just talk TLSv1.2" },
 #endif
 #ifndef OPENSSL_NO_TLS1_3
-    {"tls1_3", OPT_TLS1_3, '-', "just talk TLSv1.3"},
+    { "tls1_3", OPT_TLS1_3, '-', "just talk TLSv1.3" },
 #endif
 #ifndef OPENSSL_NO_DTLS
-    {"dtls", OPT_DTLS, '-', "Use any DTLS version"},
-    {"listen", OPT_LISTEN, '-',
-     "Listen for a DTLS ClientHello with a cookie and then connect"},
+    { "dtls", OPT_DTLS, '-', "Use any DTLS version" },
+    { "listen", OPT_LISTEN, '-',
+        "Listen for a DTLS ClientHello with a cookie and then connect" },
 #endif
 #ifndef OPENSSL_NO_DTLS1
-    {"dtls1", OPT_DTLS1, '-', "Just talk DTLSv1"},
+    { "dtls1", OPT_DTLS1, '-', "Just talk DTLSv1" },
 #endif
 #ifndef OPENSSL_NO_DTLS1_2
-    {"dtls1_2", OPT_DTLS1_2, '-', "Just talk DTLSv1.2"},
+    { "dtls1_2", OPT_DTLS1_2, '-', "Just talk DTLSv1.2" },
 #endif
 #ifndef OPENSSL_NO_SCTP
-    {"sctp", OPT_SCTP, '-', "Use SCTP"},
-    {"sctp_label_bug", OPT_SCTP_LABEL_BUG, '-', "Enable SCTP label length bug"},
+    { "sctp", OPT_SCTP, '-', "Use SCTP" },
+    { "sctp_label_bug", OPT_SCTP_LABEL_BUG, '-', "Enable SCTP label length bug" },
 #endif
 #ifndef OPENSSL_NO_SRTP
-    {"use_srtp", OPT_SRTP_PROFILES, 's',
-     "Offer SRTP key management with a colon-separated profile list"},
+    { "use_srtp", OPT_SRTP_PROFILES, 's',
+        "Offer SRTP key management with a colon-separated profile list" },
 #endif
-    {"no_dhe", OPT_NO_DHE, '-', "Disable ephemeral DH"},
+    { "no_dhe", OPT_NO_DHE, '-', "Disable ephemeral DH" },
 #ifndef OPENSSL_NO_NEXTPROTONEG
-    {"nextprotoneg", OPT_NEXTPROTONEG, 's',
-     "Set the advertised protocols for the NPN extension (comma-separated list)"},
+    { "nextprotoneg", OPT_NEXTPROTONEG, 's',
+        "Set the advertised protocols for the NPN extension (comma-separated list)" },
 #endif
-    {"alpn", OPT_ALPN, 's',
-     "Set the advertised protocols for the ALPN extension (comma-separated list)"},
+    { "alpn", OPT_ALPN, 's',
+        "Set the advertised protocols for the ALPN extension (comma-separated list)" },
 #ifndef OPENSSL_NO_KTLS
-    {"ktls", OPT_KTLS, '-', "Enable Kernel TLS for sending and receiving"},
-    {"sendfile", OPT_SENDFILE, '-', "Use sendfile to response file with -WWW"},
-    {"zerocopy_sendfile", OPT_USE_ZC_SENDFILE, '-', "Use zerocopy mode of KTLS sendfile"},
+    { "ktls", OPT_KTLS, '-', "Enable Kernel TLS for sending and receiving" },
+    { "sendfile", OPT_SENDFILE, '-', "Use sendfile to response file with -WWW" },
+    { "zerocopy_sendfile", OPT_USE_ZC_SENDFILE, '-', "Use zerocopy mode of KTLS sendfile" },
 #endif
-    {"enable_server_rpk", OPT_ENABLE_SERVER_RPK, '-', "Enable raw public keys (RFC7250) from the server"},
-    {"enable_client_rpk", OPT_ENABLE_CLIENT_RPK, '-', "Enable raw public keys (RFC7250) from the client"},
+    { "enable_server_rpk", OPT_ENABLE_SERVER_RPK, '-', "Enable raw public keys (RFC7250) from the server" },
+    { "enable_client_rpk", OPT_ENABLE_CLIENT_RPK, '-', "Enable raw public keys (RFC7250) from the client" },
     OPT_R_OPTIONS,
     OPT_S_OPTIONS,
     OPT_V_OPTIONS,
     OPT_X_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
-#define IS_PROT_FLAG(o) \
- (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \
-  || o == OPT_TLS1_3 || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2)
+#define IS_PROT_FLAG(o)                                                   \
+    (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \
+        || o == OPT_TLS1_3 || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2)
 
 int s_server_main(int argc, char *argv[])
 {
@@ -1120,7 +1216,7 @@ int s_server_main(int argc, char *argv[])
     if (port == NULL || cctx == NULL || vpm == NULL)
         goto end;
     SSL_CONF_CTX_set_flags(cctx,
-                           SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CMDLINE);
+        SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CMDLINE);
 
     prog = opt_init(argc, argv, s_server_options);
     while ((o = opt_next()) != OPT_EOF) {
@@ -1132,13 +1228,13 @@ int s_server_main(int argc, char *argv[])
             no_prot_opt++;
         if (prot_opt == 1 && no_prot_opt) {
             BIO_printf(bio_err,
-                       "Cannot supply both a protocol flag and '-no_<prot>'\n");
+                "Cannot supply both a protocol flag and '-no_<prot>'\n");
             goto end;
         }
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -1149,8 +1245,10 @@ int s_server_main(int argc, char *argv[])
         case OPT_4:
 #ifdef AF_UNIX
             if (socket_family == AF_UNIX) {
-                OPENSSL_free(host); host = NULL;
-                OPENSSL_free(port); port = NULL;
+                OPENSSL_free(host);
+                host = NULL;
+                OPENSSL_free(port);
+                port = NULL;
             }
 #endif
             socket_family = AF_INET;
@@ -1160,8 +1258,10 @@ int s_server_main(int argc, char *argv[])
 #ifdef AF_INET6
 #ifdef AF_UNIX
                 if (socket_family == AF_UNIX) {
-                    OPENSSL_free(host); host = NULL;
-                    OPENSSL_free(port); port = NULL;
+                    OPENSSL_free(host);
+                    host = NULL;
+                    OPENSSL_free(port);
+                    port = NULL;
                 }
 #endif
                 socket_family = AF_INET6;
@@ -1177,12 +1277,14 @@ int s_server_main(int argc, char *argv[])
                 socket_family = AF_UNSPEC;
             }
 #endif
-            OPENSSL_free(port); port = NULL;
-            OPENSSL_free(host); host = NULL;
+            OPENSSL_free(port);
+            port = NULL;
+            OPENSSL_free(host);
+            host = NULL;
             if (BIO_parse_hostserv(opt_arg(), NULL, &port, BIO_PARSE_PRIO_SERV) < 1) {
                 BIO_printf(bio_err,
-                           "%s: -port argument malformed or ambiguous\n",
-                           port);
+                    "%s: -port argument malformed or ambiguous\n",
+                    prog);
                 goto end;
             }
             break;
@@ -1192,22 +1294,26 @@ int s_server_main(int argc, char *argv[])
                 socket_family = AF_UNSPEC;
             }
 #endif
-            OPENSSL_free(port); port = NULL;
-            OPENSSL_free(host); host = NULL;
+            OPENSSL_free(port);
+            port = NULL;
+            OPENSSL_free(host);
+            host = NULL;
             if (BIO_parse_hostserv(opt_arg(), &host, &port, BIO_PARSE_PRIO_SERV) < 1) {
                 BIO_printf(bio_err,
-                           "%s: -accept argument malformed or ambiguous\n",
-                           port);
+                    "%s: -accept argument malformed or ambiguous\n",
+                    prog);
                 goto end;
             }
             break;
 #ifdef AF_UNIX
         case OPT_UNIX:
             socket_family = AF_UNIX;
-            OPENSSL_free(host); host = OPENSSL_strdup(opt_arg());
+            OPENSSL_free(host);
+            host = OPENSSL_strdup(opt_arg());
             if (host == NULL)
                 goto end;
-            OPENSSL_free(port); port = NULL;
+            OPENSSL_free(port);
+            port = NULL;
             break;
         case OPT_UNLINK:
             unlink_unix_path = 1;
@@ -1223,14 +1329,12 @@ int s_server_main(int argc, char *argv[])
                 BIO_printf(bio_err, "verify depth is %d\n", verify_args.depth);
             break;
         case OPT_UPPER_V_VERIFY:
-            s_server_verify =
-                SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
-                SSL_VERIFY_CLIENT_ONCE;
+            s_server_verify = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_CLIENT_ONCE;
             verify_args.depth = atoi(opt_arg());
             if (!s_quiet)
                 BIO_printf(bio_err,
-                           "verify depth is %d, must return a certificate\n",
-                           verify_args.depth);
+                    "verify depth is %d, must return a certificate\n",
+                    verify_args.depth);
             break;
         case OPT_CONTEXT:
             context = (unsigned char *)opt_arg();
@@ -1419,8 +1523,8 @@ int s_server_main(int argc, char *argv[])
 #ifndef OPENSSL_NO_OCSP
             s_tlsextstatus = 1;
             if (!OSSL_HTTP_parse_url(opt_arg(), &tlscstatp.use_ssl, NULL,
-                                     &tlscstatp.host, &tlscstatp.port, NULL,
-                                     &tlscstatp.path, NULL, NULL)) {
+                    &tlscstatp.host, &tlscstatp.port, NULL,
+                    &tlscstatp.path, NULL, NULL)) {
                 BIO_printf(bio_err, "Error parsing -status_url argument\n");
                 goto end;
             }
@@ -1618,7 +1722,7 @@ int s_server_main(int argc, char *argv[])
             s_key_file2 = opt_arg();
             break;
         case OPT_NEXTPROTONEG:
-# ifndef OPENSSL_NO_NEXTPROTONEG
+#ifndef OPENSSL_NO_NEXTPROTONEG
             next_proto_neg_in = opt_arg();
 #endif
             break;
@@ -1755,13 +1859,13 @@ int s_server_main(int argc, char *argv[])
 #ifdef AF_UNIX
     if (socket_family == AF_UNIX && socket_type != SOCK_STREAM) {
         BIO_printf(bio_err,
-                   "Can't use unix sockets and datagrams together\n");
+            "Can't use unix sockets and datagrams together\n");
         goto end;
     }
 #endif
     if (early_data && rev) {
         BIO_printf(bio_err,
-                   "Can't use -early_data in combination with -rev\n");
+            "Can't use -early_data in combination with -rev\n");
         goto end;
     }
 
@@ -1809,29 +1913,29 @@ int s_server_main(int argc, char *argv[])
 
     if (nocert == 0) {
         s_key = load_key(s_key_file, s_key_format, 0, pass, engine,
-                         "server certificate private key");
+            "server certificate private key");
         if (s_key == NULL)
             goto end;
 
         s_cert = load_cert_pass(s_cert_file, s_cert_format, 1, pass,
-                                "server certificate");
+            "server certificate");
 
         if (s_cert == NULL)
             goto end;
         if (s_chain_file != NULL) {
             if (!load_certs(s_chain_file, 0, &s_chain, NULL,
-                            "server certificate chain"))
+                    "server certificate chain"))
                 goto end;
         }
 
         if (tlsextcbp.servername != NULL) {
             s_key2 = load_key(s_key_file2, s_key_format, 0, pass, engine,
-                              "second server certificate private key");
+                "second server certificate private key");
             if (s_key2 == NULL)
                 goto end;
 
             s_cert2 = load_cert_pass(s_cert_file2, s_cert_format, 1, pass,
-                                "second server certificate");
+                "second server certificate");
 
             if (s_cert2 == NULL)
                 goto end;
@@ -1871,12 +1975,12 @@ int s_server_main(int argc, char *argv[])
             s_dkey_file = s_dcert_file;
 
         s_dkey = load_key(s_dkey_file, s_dkey_format,
-                          0, dpass, engine, "second certificate private key");
+            0, dpass, engine, "second certificate private key");
         if (s_dkey == NULL)
             goto end;
 
         s_dcert = load_cert_pass(s_dcert_file, s_dcert_format, 1, dpass,
-                                 "second server certificate");
+            "second server certificate");
 
         if (s_dcert == NULL) {
             ERR_print_errors(bio_err);
@@ -1884,10 +1988,9 @@ int s_server_main(int argc, char *argv[])
         }
         if (s_dchain_file != NULL) {
             if (!load_certs(s_dchain_file, 0, &s_dchain, NULL,
-                            "second server certificate chain"))
+                    "second server certificate chain"))
                 goto end;
         }
-
     }
 
     if (bio_s_out == NULL) {
@@ -1934,7 +2037,7 @@ int s_server_main(int argc, char *argv[])
     if (ssl_config) {
         if (SSL_CTX_config(ctx, ssl_config) == 0) {
             BIO_printf(bio_err, "Error using configuration \"%s\"\n",
-                       ssl_config);
+                ssl_config);
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -1954,7 +2057,7 @@ int s_server_main(int argc, char *argv[])
     if (session_id_prefix) {
         if (strlen(session_id_prefix) >= 32)
             BIO_printf(bio_err,
-                       "warning: id_prefix is too long, only one new session will be possible\n");
+                "warning: id_prefix is too long, only one new session will be possible\n");
         if (!SSL_CTX_set_generate_session_id(ctx, generate_session_id)) {
             BIO_printf(bio_err, "error setting 'id_prefix'\n");
             ERR_print_errors(bio_err);
@@ -1994,20 +2097,20 @@ int s_server_main(int argc, char *argv[])
     if (max_send_fragment > 0
         && !SSL_CTX_set_max_send_fragment(ctx, max_send_fragment)) {
         BIO_printf(bio_err, "%s: Max send fragment size %u is out of permitted range\n",
-                   prog, max_send_fragment);
+            prog, max_send_fragment);
         goto end;
     }
 
     if (split_send_fragment > 0
         && !SSL_CTX_set_split_send_fragment(ctx, split_send_fragment)) {
         BIO_printf(bio_err, "%s: Split send fragment size %u is out of permitted range\n",
-                   prog, split_send_fragment);
+            prog, split_send_fragment);
         goto end;
     }
     if (max_pipelines > 0
         && !SSL_CTX_set_max_pipelines(ctx, max_pipelines)) {
         BIO_printf(bio_err, "%s: Max pipelines %u is out of permitted range\n",
-                   prog, max_pipelines);
+            prog, max_pipelines);
         goto end;
     }
 
@@ -2026,7 +2129,7 @@ int s_server_main(int argc, char *argv[])
 #endif
 
     if (!ctx_set_verify_locations(ctx, CAfile, noCAfile, CApath, noCApath,
-                                  CAstore, noCAstore)) {
+            CAstore, noCAstore)) {
         ERR_print_errors(bio_err);
         goto end;
     }
@@ -2039,9 +2142,9 @@ int s_server_main(int argc, char *argv[])
     ssl_ctx_add_crls(ctx, crls, 0);
 
     if (!ssl_load_stores(ctx,
-                         vfyCApath, vfyCAfile, vfyCAstore,
-                         chCApath, chCAfile, chCAstore,
-                         crls, crl_download)) {
+            vfyCApath, vfyCAfile, vfyCAstore,
+            chCApath, chCAfile, chCAstore,
+            crls, crl_download)) {
         BIO_printf(bio_err, "Error loading store locations\n");
         ERR_print_errors(bio_err);
         goto end;
@@ -2064,7 +2167,7 @@ int s_server_main(int argc, char *argv[])
         if (session_id_prefix) {
             if (strlen(session_id_prefix) >= 32)
                 BIO_printf(bio_err,
-                           "warning: id_prefix is too long, only one new session will be possible\n");
+                    "warning: id_prefix is too long, only one new session will be possible\n");
             if (!SSL_CTX_set_generate_session_id(ctx2, generate_session_id)) {
                 BIO_printf(bio_err, "error setting 'id_prefix'\n");
                 ERR_print_errors(bio_err);
@@ -2089,7 +2192,7 @@ int s_server_main(int argc, char *argv[])
             SSL_CTX_set_mode(ctx2, SSL_MODE_ASYNC);
 
         if (!ctx_set_verify_locations(ctx2, CAfile, noCAfile, CApath,
-                                      noCApath, CAstore, noCAstore)) {
+                noCApath, CAstore, noCAstore)) {
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -2106,7 +2209,7 @@ int s_server_main(int argc, char *argv[])
 #ifndef OPENSSL_NO_NEXTPROTONEG
     if (next_proto.data)
         SSL_CTX_set_next_protos_advertised_cb(ctx, next_proto_cb,
-                                              &next_proto);
+            &next_proto);
 #endif
     if (alpn_ctx.data)
         SSL_CTX_set_alpn_select_cb(ctx, alpn_cb, &alpn_ctx);
@@ -2118,7 +2221,7 @@ int s_server_main(int argc, char *argv[])
             dhpkey = load_keyparams(dhfile, FORMAT_UNDEF, 0, "DH", "DH parameters");
         else if (s_cert_file != NULL)
             dhpkey = load_keyparams_suppress(s_cert_file, FORMAT_UNDEF, 0, "DH",
-                                             "DH parameters", 1);
+                "DH parameters", 1);
 
         if (dhpkey != NULL) {
             BIO_printf(bio_s_out, "Setting temp DH parameters\n");
@@ -2151,9 +2254,9 @@ int s_server_main(int argc, char *argv[])
         if (ctx2 != NULL) {
             if (dhfile != NULL) {
                 EVP_PKEY *dhpkey2 = load_keyparams_suppress(s_cert_file2,
-                                                            FORMAT_UNDEF,
-                                                            0, "DH",
-                                                            "DH parameters", 1);
+                    FORMAT_UNDEF,
+                    0, "DH",
+                    "DH parameters", 1);
 
                 if (dhpkey2 != NULL) {
                     BIO_printf(bio_s_out, "Setting temp DH parameters\n");
@@ -2196,11 +2299,11 @@ int s_server_main(int argc, char *argv[])
 
     if (no_resume_ephemeral) {
         SSL_CTX_set_not_resumable_session_callback(ctx,
-                                                   not_resumable_sess_cb);
+            not_resumable_sess_cb);
 
         if (ctx2 != NULL)
             SSL_CTX_set_not_resumable_session_callback(ctx2,
-                                                       not_resumable_sess_cb);
+                not_resumable_sess_cb);
     }
 #ifndef OPENSSL_NO_PSK
     if (psk_key != NULL) {
@@ -2236,7 +2339,6 @@ int s_server_main(int argc, char *argv[])
             ERR_print_errors(bio_err);
             goto end;
         }
-
     }
 
     if (psk_key != NULL || psksess != NULL)
@@ -2244,8 +2346,8 @@ int s_server_main(int argc, char *argv[])
 
     SSL_CTX_set_verify(ctx, s_server_verify, verify_callback);
     if (!SSL_CTX_set_session_id_context(ctx,
-                                        (void *)&s_server_session_id_context,
-                                        sizeof(s_server_session_id_context))) {
+            (void *)&s_server_session_id_context,
+            sizeof(s_server_session_id_context))) {
         BIO_printf(bio_err, "error setting session id context\n");
         ERR_print_errors(bio_err);
         goto end;
@@ -2262,8 +2364,8 @@ int s_server_main(int argc, char *argv[])
     if (ctx2 != NULL) {
         SSL_CTX_set_verify(ctx2, s_server_verify, verify_callback);
         if (!SSL_CTX_set_session_id_context(ctx2,
-                    (void *)&s_server_session_id_context,
-                    sizeof(s_server_session_id_context))) {
+                (void *)&s_server_session_id_context,
+                sizeof(s_server_session_id_context))) {
             BIO_printf(bio_err, "error setting session id context\n");
             ERR_print_errors(bio_err);
             goto end;
@@ -2278,11 +2380,11 @@ int s_server_main(int argc, char *argv[])
 #ifndef OPENSSL_NO_SRP
     if (srp_verifier_file != NULL) {
         if (!set_up_srp_verifier_file(ctx, &srp_callback_parm, srpuserseed,
-                                      srp_verifier_file))
+                srp_verifier_file))
             goto end;
     } else
 #endif
-    if (CAfile != NULL) {
+        if (CAfile != NULL) {
         SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CAfile));
 
         if (ctx2)
@@ -2338,10 +2440,10 @@ int s_server_main(int argc, char *argv[])
     if (tfo)
         BIO_printf(bio_s_out, "Listening for TFO\n");
     do_server(&accept_socket, host, port, socket_family, socket_type, protocol,
-              server_cb, context, naccept, bio_s_out, tfo);
+        server_cb, context, naccept, bio_s_out, tfo);
     print_stats(bio_s_out, ctx);
     ret = 0;
- end:
+end:
     SSL_CTX_free(ctx);
     SSL_SESSION_free(psksess);
     set_keylog_file(NULL, NULL);
@@ -2385,38 +2487,38 @@ int s_server_main(int argc, char *argv[])
 static void print_stats(BIO *bio, SSL_CTX *ssl_ctx)
 {
     BIO_printf(bio, "%4ld items in the session cache\n",
-               SSL_CTX_sess_number(ssl_ctx));
+        SSL_CTX_sess_number(ssl_ctx));
     BIO_printf(bio, "%4ld client connects (SSL_connect())\n",
-               SSL_CTX_sess_connect(ssl_ctx));
+        SSL_CTX_sess_connect(ssl_ctx));
     BIO_printf(bio, "%4ld client renegotiates (SSL_connect())\n",
-               SSL_CTX_sess_connect_renegotiate(ssl_ctx));
+        SSL_CTX_sess_connect_renegotiate(ssl_ctx));
     BIO_printf(bio, "%4ld client connects that finished\n",
-               SSL_CTX_sess_connect_good(ssl_ctx));
+        SSL_CTX_sess_connect_good(ssl_ctx));
     BIO_printf(bio, "%4ld server accepts (SSL_accept())\n",
-               SSL_CTX_sess_accept(ssl_ctx));
+        SSL_CTX_sess_accept(ssl_ctx));
     BIO_printf(bio, "%4ld server renegotiates (SSL_accept())\n",
-               SSL_CTX_sess_accept_renegotiate(ssl_ctx));
+        SSL_CTX_sess_accept_renegotiate(ssl_ctx));
     BIO_printf(bio, "%4ld server accepts that finished\n",
-               SSL_CTX_sess_accept_good(ssl_ctx));
+        SSL_CTX_sess_accept_good(ssl_ctx));
     BIO_printf(bio, "%4ld session cache hits\n", SSL_CTX_sess_hits(ssl_ctx));
     BIO_printf(bio, "%4ld session cache misses\n",
-               SSL_CTX_sess_misses(ssl_ctx));
+        SSL_CTX_sess_misses(ssl_ctx));
     BIO_printf(bio, "%4ld session cache timeouts\n",
-               SSL_CTX_sess_timeouts(ssl_ctx));
+        SSL_CTX_sess_timeouts(ssl_ctx));
     BIO_printf(bio, "%4ld callback cache hits\n",
-               SSL_CTX_sess_cb_hits(ssl_ctx));
+        SSL_CTX_sess_cb_hits(ssl_ctx));
     BIO_printf(bio, "%4ld cache full overflows (%ld allowed)\n",
-               SSL_CTX_sess_cache_full(ssl_ctx),
-               SSL_CTX_sess_get_cache_size(ssl_ctx));
+        SSL_CTX_sess_cache_full(ssl_ctx),
+        SSL_CTX_sess_get_cache_size(ssl_ctx));
 }
 
 static long int count_reads_callback(BIO *bio, int cmd, const char *argp, size_t len,
-                                 int argi, long argl, int ret, size_t *processed)
+    int argi, long argl, int ret, size_t *processed)
 {
     unsigned int *p_counter = (unsigned int *)BIO_get_callback_arg(bio);
 
     switch (cmd) {
-    case BIO_CB_READ:  /* No break here */
+    case BIO_CB_READ: /* No break here */
     case BIO_CB_GETS:
         if (p_counter != NULL)
             ++*p_counter;
@@ -2448,11 +2550,11 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
     struct timeval *timeoutp;
 #endif
 #ifndef OPENSSL_NO_DTLS
-# ifndef OPENSSL_NO_SCTP
+#ifndef OPENSSL_NO_SCTP
     int isdtls = (stype == SOCK_DGRAM || prot == IPPROTO_SCTP);
-# else
+#else
     int isdtls = (stype == SOCK_DGRAM);
-# endif
+#endif
 #endif
 
     buf = app_malloc(bufsize, "server buffer");
@@ -2476,7 +2578,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
 
     if (context != NULL
         && !SSL_set_session_id_context(con, context,
-                                       strlen((char *)context))) {
+            strlen((char *)context))) {
         BIO_printf(bio_err, "Error setting session id context\n");
         ret = -1;
         goto err;
@@ -2489,11 +2591,11 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
     }
 #ifndef OPENSSL_NO_DTLS
     if (isdtls) {
-# ifndef OPENSSL_NO_SCTP
+#ifndef OPENSSL_NO_SCTP
         if (prot == IPPROTO_SCTP)
             sbio = BIO_new_dgram_sctp(s, BIO_NOCLOSE);
         else
-# endif
+#endif
             sbio = BIO_new_dgram(s, BIO_NOCLOSE);
         if (sbio == NULL) {
             BIO_printf(bio_err, "Unable to create BIO\n");
@@ -2514,7 +2616,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
         if (socket_mtu) {
             if (socket_mtu < DTLS_get_link_min_mtu(con)) {
                 BIO_printf(bio_err, "MTU too small. Must be at least %ld\n",
-                           DTLS_get_link_min_mtu(con));
+                    DTLS_get_link_min_mtu(con));
                 ret = -1;
                 BIO_free(sbio);
                 goto err;
@@ -2530,9 +2632,9 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
             /* want to do MTU discovery */
             BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);
 
-# ifndef OPENSSL_NO_SCTP
+#ifndef OPENSSL_NO_SCTP
         if (prot != IPPROTO_SCTP)
-# endif
+#endif
             /* Turn on cookie exchange. Not necessary for SCTP */
             SSL_set_options(con, SSL_OP_COOKIE_EXCHANGE);
     } else
@@ -2632,7 +2734,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
 
         read_from_terminal = 0;
         read_from_sslcon = SSL_has_pending(con)
-                           || (async && SSL_waiting_for_async(con));
+            || (async && SSL_waiting_for_async(con));
 
         if (!read_from_sslcon) {
             FD_ZERO(&readfds);
@@ -2730,18 +2832,16 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
                 }
                 if ((buf[0] == 'R') && ((buf[1] == '\n') || (buf[1] == '\r'))) {
                     SSL_set_verify(con,
-                                   SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE,
-                                   NULL);
+                        SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE,
+                        NULL);
                     SSL_renegotiate(con);
                     i = SSL_do_handshake(con);
                     printf("SSL_do_handshake -> %d\n", i);
                     continue;
                 }
                 if ((buf[0] == 'K' || buf[0] == 'k')
-                        && ((buf[1] == '\n') || (buf[1] == '\r'))) {
-                    SSL_key_update(con, buf[0] == 'K' ?
-                                        SSL_KEY_UPDATE_REQUESTED
-                                        : SSL_KEY_UPDATE_NOT_REQUESTED);
+                    && ((buf[1] == '\n') || (buf[1] == '\r'))) {
+                    SSL_key_update(con, buf[0] == 'K' ? SSL_KEY_UPDATE_REQUESTED : SSL_KEY_UPDATE_NOT_REQUESTED);
                     i = SSL_do_handshake(con);
                     printf("SSL_do_handshake -> %d\n", i);
                     continue;
@@ -2760,7 +2860,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
                 }
                 if (buf[0] == 'P') {
                     static const char str[] = "Lets print some clear text\n";
-                    BIO_write(SSL_get_wbio(con), str, sizeof(str) -1);
+                    BIO_write(SSL_get_wbio(con), str, sizeof(str) - 1);
                 }
                 if (buf[0] == 'S') {
                     print_stats(bio_s_out, SSL_get_SSL_CTX(con));
@@ -2836,7 +2936,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
              * init_ssl_connection
              */
             if ((!async || !SSL_waiting_for_async(con))
-                    && !SSL_is_init_finished(con)) {
+                && !SSL_is_init_finished(con)) {
                 /*
                  * Count number of reads during init_ssl_connection.
                  * It helps us to distinguish configuration errors from errors
@@ -2864,7 +2964,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
                     goto err;
                 }
             } else {
- again:
+            again:
                 i = SSL_read(con, (char *)buf, bufsize);
 #ifndef OPENSSL_NO_SRP
                 while (SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP) {
@@ -2915,7 +3015,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
             }
         }
     }
- err:
+err:
     if (con != NULL) {
         BIO_printf(bio_s_out, "shutting down SSL\n");
         do_ssl_shutdown(con);
@@ -2940,8 +3040,8 @@ static int is_retryable(SSL *con, int i)
 
     /* If it's not a fatal error, it must be retryable */
     return (err != SSL_ERROR_SSL)
-           && (err != SSL_ERROR_SYSCALL)
-           && (err != SSL_ERROR_ZERO_RETURN);
+        && (err != SSL_ERROR_SYSCALL)
+        && (err != SSL_ERROR_ZERO_RETURN);
 }
 
 static int init_ssl_connection(SSL *con)
@@ -2997,10 +3097,10 @@ static int init_ssl_connection(SSL *con)
 #ifdef CERT_CB_TEST_RETRY
             {
                 while (i <= 0
-                        && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP
-                        && SSL_get_state(con) == TLS_ST_SR_CLNT_HELLO) {
+                    && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP
+                    && SSL_get_state(con) == TLS_ST_SR_CLNT_HELLO) {
                     BIO_printf(bio_err,
-                               "LOOKUP from certificate callback during accept\n");
+                        "LOOKUP from certificate callback during accept\n");
                     i = SSL_accept(con);
                     if (i <= 0)
                         retry = is_retryable(con, i);
@@ -3010,9 +3110,9 @@ static int init_ssl_connection(SSL *con)
 
 #ifndef OPENSSL_NO_SRP
             while (i <= 0
-                   && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP) {
+                && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP) {
                 BIO_printf(bio_s_out, "LOOKUP during accept %s\n",
-                           srp_callback_parm.login);
+                    srp_callback_parm.login);
 
                 lookup_srp_user(&srp_callback_parm, bio_s_out);
 
@@ -3026,7 +3126,7 @@ static int init_ssl_connection(SSL *con)
 
     if (i <= 0) {
         if (((dtlslisten || stateless) && i == 0)
-                || (!dtlslisten && !stateless && retry)) {
+            || (!dtlslisten && !stateless && retry)) {
             BIO_printf(bio_s_out, "DELAY\n");
             return 1;
         }
@@ -3036,7 +3136,7 @@ static int init_ssl_connection(SSL *con)
         verify_err = SSL_get_verify_result(con);
         if (verify_err != X509_V_OK) {
             BIO_printf(bio_err, "verify error:%s\n",
-                       X509_verify_cert_error_string(verify_err));
+                X509_verify_cert_error_string(verify_err));
         }
         /* Always print any error messages */
         ERR_print_errors(bio_err);
@@ -3111,7 +3211,7 @@ static void print_connection_info(SSL *con)
 
         if (srtp_profile)
             BIO_printf(bio_s_out, "SRTP Extension negotiated, profile=%s\n",
-                       srtp_profile->name);
+                srtp_profile->name);
     }
 #endif
     if (SSL_session_reused(con))
@@ -3128,10 +3228,11 @@ static void print_connection_info(SSL *con)
         BIO_printf(bio_s_out, "    Length: %i bytes\n", keymatexportlen);
         exportedkeymat = app_malloc(keymatexportlen, "export key");
         if (SSL_export_keying_material(con, exportedkeymat,
-                                        keymatexportlen,
-                                        keymatexportlabel,
-                                        strlen(keymatexportlabel),
-                                        NULL, 0, 0) <= 0) {
+                keymatexportlen,
+                keymatexportlabel,
+                strlen(keymatexportlabel),
+                NULL, 0, 0)
+            <= 0) {
             BIO_printf(bio_s_out, "    Error\n");
         } else {
             BIO_printf(bio_s_out, "    Keying material: ");
@@ -3205,7 +3306,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
 
     if (context != NULL
         && !SSL_set_session_id_context(con, context,
-                                       strlen((char *)context))) {
+            strlen((char *)context))) {
         SSL_free(con);
         goto err;
     }
@@ -3292,7 +3393,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
 
     for (;;) {
         i = BIO_gets(!BIO_eof(edio) ? edio : io, buf, bufsize + 1);
-        if (i < 0) {            /* error */
+        if (i < 0) { /* error */
             if (!BIO_should_retry(io) && !SSL_waiting_for_async(con)) {
                 if (!s_quiet)
                     ERR_print_errors(bio_err);
@@ -3312,14 +3413,14 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
                 OSSL_sleep(1000);
                 continue;
             }
-        } else if (i == 0) {    /* end of input */
+        } else if (i == 0) { /* end of input */
             ret = 1;
             goto end;
         }
 
         /* else we have data */
         if ((www == 1 && HAS_PREFIX(buf, "GET "))
-             || (www == 2 && HAS_PREFIX(buf, "GET /stats "))) {
+            || (www == 2 && HAS_PREFIX(buf, "GET /stats "))) {
             X509 *peer = NULL;
             STACK_OF(SSL_CIPHER) *sk;
             static const char *space = "                          ";
@@ -3327,15 +3428,15 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
             if (www == 1 && HAS_PREFIX(buf, "GET /reneg")) {
                 if (HAS_PREFIX(buf, "GET /renegcert"))
                     SSL_set_verify(con,
-                                   SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE,
-                                   NULL);
+                        SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE,
+                        NULL);
                 i = SSL_renegotiate(con);
                 BIO_printf(bio_s_out, "SSL_renegotiate -> %d\n", i);
                 /* Send the HelloRequest */
                 i = SSL_do_handshake(con);
                 if (i <= 0) {
                     BIO_printf(bio_s_out, "SSL_do_handshake() Retval %d\n",
-                               SSL_get_error(con, i));
+                        SSL_get_error(con, i));
                     ERR_print_errors(bio_err);
                     goto err;
                 }
@@ -3345,7 +3446,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
                 i = select(width, (void *)&readfds, NULL, NULL, NULL);
                 if (i <= 0 || !FD_ISSET(s, &readfds)) {
                     BIO_printf(bio_s_out,
-                               "Error waiting for client response\n");
+                        "Error waiting for client response\n");
                     ERR_print_errors(bio_err);
                     goto err;
                 }
@@ -3359,7 +3460,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
             }
 
             BIO_puts(io,
-                     "HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
+                "HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
             BIO_puts(io, "<HTML><BODY BGCOLOR=\"#ffffff\">\n");
             BIO_puts(io, "<pre>\n");
             /* BIO_puts(io, OpenSSL_version(OPENSSL_VERSION)); */
@@ -3397,7 +3498,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
             for (i = 0; i < j; i++) {
                 c = sk_SSL_CIPHER_value(sk, i);
                 BIO_printf(io, "%-11s:%-25s ",
-                           SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
+                    SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
                 if ((((i + 1) % 2) == 0) && (i + 1 != j))
                     BIO_puts(io, "\n");
             }
@@ -3405,7 +3506,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
             p = SSL_get_shared_ciphers(con, buf, bufsize);
             if (p != NULL) {
                 BIO_printf(io,
-                           "---\nCiphers common between both SSL end points:\n");
+                    "---\nCiphers common between both SSL end points:\n");
                 j = i = 0;
                 while (*p) {
                     if (*p == ':') {
@@ -3426,11 +3527,10 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
             ssl_print_groups(io, con, 0);
 #endif
             print_ca_names(io, con);
-            BIO_printf(io, (SSL_session_reused(con)
-                            ? "---\nReused, " : "---\nNew, "));
+            BIO_printf(io, (SSL_session_reused(con) ? "---\nReused, " : "---\nNew, "));
             c = SSL_get_current_cipher(con);
             BIO_printf(io, "%s, Cipher is %s\n",
-                       SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
+                SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
             SSL_SESSION_print(io, SSL_get_session(con));
             BIO_printf(io, "---\n");
             print_stats(io, SSL_get_SSL_CTX(con));
@@ -3449,8 +3549,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
         } else if ((www == 2 || www == 3) && CHECK_AND_SKIP_PREFIX(p, "GET /")) {
             BIO *file;
             char *e;
-            static const char *text =
-                "HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n";
+            static const char *text = "HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n";
 
             dot = 1;
             for (e = p; *e != '\0'; e++) {
@@ -3519,14 +3618,12 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
 
             if (www == 2) {
                 i = strlen(p);
-                if (((i > 5) && (strcmp(&(p[i - 5]), ".html") == 0)) ||
-                    ((i > 4) && (strcmp(&(p[i - 4]), ".php") == 0)) ||
-                    ((i > 4) && (strcmp(&(p[i - 4]), ".htm") == 0)))
+                if (((i > 5) && (strcmp(&(p[i - 5]), ".html") == 0)) || ((i > 4) && (strcmp(&(p[i - 4]), ".php") == 0)) || ((i > 4) && (strcmp(&(p[i - 4]), ".htm") == 0)))
                     BIO_puts(io,
-                             "HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
+                        "HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
                 else
                     BIO_puts(io,
-                             "HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n");
+                        "HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n");
             }
             /* send the file */
 #ifndef OPENSSL_NO_KTLS
@@ -3609,7 +3706,7 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
                     }
                 }
             }
- write_error:
+        write_error:
             BIO_free(file);
             break;
         }
@@ -3623,11 +3720,11 @@ static int www_body(int s, int stype, int prot, unsigned char *context)
         } else
             break;
     }
- end:
+end:
     /* make sure we reuse sessions */
     do_ssl_shutdown(con);
 
- err:
+err:
     OPENSSL_free(buf);
     BIO_free(ssl_bio);
     BIO_free_all(io);
@@ -3667,7 +3764,7 @@ static int rev_body(int s, int stype, int prot, unsigned char *context)
     }
     if (context != NULL
         && !SSL_set_session_id_context(con, context,
-                                       strlen((char *)context))) {
+            strlen((char *)context))) {
         SSL_free(con);
         ERR_print_errors(bio_err);
         goto err;
@@ -3734,7 +3831,7 @@ static int rev_body(int s, int stype, int prot, unsigned char *context)
 
     for (;;) {
         i = BIO_gets(io, buf, bufsize + 1);
-        if (i < 0) {            /* error */
+        if (i < 0) { /* error */
             if (!BIO_should_retry(io)) {
                 if (!s_quiet)
                     ERR_print_errors(bio_err);
@@ -3754,7 +3851,7 @@ static int rev_body(int s, int stype, int prot, unsigned char *context)
                 OSSL_sleep(1000);
                 continue;
             }
-        } else if (i == 0) {    /* end of input */
+        } else if (i == 0) { /* end of input */
             ret = 1;
             BIO_printf(bio_err, "CONNECTION CLOSED\n");
             goto end;
@@ -3781,11 +3878,11 @@ static int rev_body(int s, int stype, int prot, unsigned char *context)
             }
         }
     }
- end:
+end:
     /* make sure we reuse sessions */
     do_ssl_shutdown(con);
 
- err:
+err:
 
     OPENSSL_free(buf);
     BIO_free(ssl_bio);
@@ -3795,7 +3892,7 @@ static int rev_body(int s, int stype, int prot, unsigned char *context)
 
 #define MAX_SESSION_ID_ATTEMPTS 10
 static int generate_session_id(SSL *ssl, unsigned char *id,
-                               unsigned int *id_len)
+    unsigned int *id_len)
 {
     unsigned int count = 0;
     unsigned int session_id_prefix_len = strlen(session_id_prefix);
@@ -3811,11 +3908,8 @@ static int generate_session_id(SSL *ssl, unsigned char *id,
          * conflicts.
          */
         memcpy(id, session_id_prefix,
-               (session_id_prefix_len < *id_len) ?
-                session_id_prefix_len : *id_len);
-    }
-    while (SSL_has_matching_session_id(ssl, id, *id_len) &&
-           (++count < MAX_SESSION_ID_ATTEMPTS));
+            (session_id_prefix_len < *id_len) ? session_id_prefix_len : *id_len);
+    } while (SSL_has_matching_session_id(ssl, id, *id_len) && (++count < MAX_SESSION_ID_ATTEMPTS));
     if (count >= MAX_SESSION_ID_ATTEMPTS)
         return 0;
     return 1;
@@ -3878,7 +3972,7 @@ static int add_session(SSL *ssl, SSL_SESSION *session)
 }
 
 static SSL_SESSION *get_session(SSL *ssl, const unsigned char *id, int idlen,
-                                int *do_copy)
+    int *do_copy)
 {
     simple_ssl_session *sess;
     *do_copy = 0;
@@ -3887,7 +3981,7 @@ static SSL_SESSION *get_session(SSL *ssl, const unsigned char *id, int idlen,
             const unsigned char *p = sess->der;
             BIO_printf(bio_err, "Lookup session: cache hit\n");
             return d2i_SSL_SESSION_ex(NULL, &p, sess->derlen, app_get0_libctx(),
-                                      app_get0_propq());
+                app_get0_propq());
         }
     }
     BIO_printf(bio_err, "Lookup session: cache miss\n");
@@ -3918,8 +4012,7 @@ static void del_session(SSL_CTX *sctx, SSL_SESSION *session)
 static void init_session_cache_ctx(SSL_CTX *sctx)
 {
     SSL_CTX_set_session_cache_mode(sctx,
-                                   SSL_SESS_CACHE_NO_INTERNAL |
-                                   SSL_SESS_CACHE_SERVER);
+        SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_SERVER);
     SSL_CTX_sess_set_new_cb(sctx, add_session);
     SSL_CTX_sess_set_get_cb(sctx, get_session);
     SSL_CTX_sess_set_remove_cb(sctx, del_session);
@@ -3938,4 +4031,4 @@ static void free_sessions(void)
     first = NULL;
 }
 
-#endif                          /* OPENSSL_NO_SOCK */
+#endif /* OPENSSL_NO_SOCK */
diff --git a/crypto/openssl/apps/s_time.c b/crypto/openssl/apps/s_time.c
index 598e1069ed05..6bdd9e23cee9 100644
--- a/crypto/openssl/apps/s_time.c
+++ b/crypto/openssl/apps/s_time.c
@@ -24,10 +24,10 @@
 #include <openssl/err.h>
 #include "internal/sockets.h"
 #if !defined(OPENSSL_SYS_MSDOS)
-# include <unistd.h>
+#include <unistd.h>
 #endif
 
-#define SSL_CONNECT_NAME        "localhost:4433"
+#define SSL_CONNECT_NAME "localhost:4433"
 
 #define SECONDS 30
 #define SECONDSSTR "30"
@@ -44,68 +44,86 @@ static const size_t fmt_http_get_cmd_size = sizeof(fmt_http_get_cmd) - 2;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_CONNECT, OPT_CIPHER, OPT_CIPHERSUITES, OPT_CERT, OPT_NAMEOPT, OPT_KEY,
-    OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
-    OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
-    OPT_NEW, OPT_REUSE, OPT_BUGS, OPT_VERIFY, OPT_TIME, OPT_SSL3,
-    OPT_WWW, OPT_TLS1, OPT_TLS1_1, OPT_TLS1_2, OPT_TLS1_3,
+    OPT_CONNECT,
+    OPT_CIPHER,
+    OPT_CIPHERSUITES,
+    OPT_CERT,
+    OPT_NAMEOPT,
+    OPT_KEY,
+    OPT_CAPATH,
+    OPT_CAFILE,
+    OPT_CASTORE,
+    OPT_NOCAPATH,
+    OPT_NOCAFILE,
+    OPT_NOCASTORE,
+    OPT_NEW,
+    OPT_REUSE,
+    OPT_BUGS,
+    OPT_VERIFY,
+    OPT_TIME,
+    OPT_SSL3,
+    OPT_WWW,
+    OPT_TLS1,
+    OPT_TLS1_1,
+    OPT_TLS1_2,
+    OPT_TLS1_3,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS s_time_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("Connection"),
-    {"connect", OPT_CONNECT, 's',
-     "Where to connect as post:port (default is " SSL_CONNECT_NAME ")"},
-    {"new", OPT_NEW, '-', "Just time new connections"},
-    {"reuse", OPT_REUSE, '-', "Just time connection reuse"},
-    {"bugs", OPT_BUGS, '-', "Turn on SSL bug compatibility"},
-    {"cipher", OPT_CIPHER, 's', "TLSv1.2 and below cipher list to be used"},
-    {"ciphersuites", OPT_CIPHERSUITES, 's',
-     "Specify TLSv1.3 ciphersuites to be used"},
+    { "connect", OPT_CONNECT, 's',
+        "Where to connect as post:port (default is " SSL_CONNECT_NAME ")" },
+    { "new", OPT_NEW, '-', "Just time new connections" },
+    { "reuse", OPT_REUSE, '-', "Just time connection reuse" },
+    { "bugs", OPT_BUGS, '-', "Turn on SSL bug compatibility" },
+    { "cipher", OPT_CIPHER, 's', "TLSv1.2 and below cipher list to be used" },
+    { "ciphersuites", OPT_CIPHERSUITES, 's',
+        "Specify TLSv1.3 ciphersuites to be used" },
 #ifndef OPENSSL_NO_SSL3
-    {"ssl3", OPT_SSL3, '-', "Just use SSLv3"},
+    { "ssl3", OPT_SSL3, '-', "Just use SSLv3" },
 #endif
 #ifndef OPENSSL_NO_TLS1
-    {"tls1", OPT_TLS1, '-', "Just use TLSv1.0"},
+    { "tls1", OPT_TLS1, '-', "Just use TLSv1.0" },
 #endif
 #ifndef OPENSSL_NO_TLS1_1
-    {"tls1_1", OPT_TLS1_1, '-', "Just use TLSv1.1"},
+    { "tls1_1", OPT_TLS1_1, '-', "Just use TLSv1.1" },
 #endif
 #ifndef OPENSSL_NO_TLS1_2
-    {"tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2"},
+    { "tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2" },
 #endif
 #ifndef OPENSSL_NO_TLS1_3
-    {"tls1_3", OPT_TLS1_3, '-', "Just use TLSv1.3"},
+    { "tls1_3", OPT_TLS1_3, '-', "Just use TLSv1.3" },
 #endif
-    {"verify", OPT_VERIFY, 'p',
-     "Turn on peer certificate verification, set depth"},
-    {"time", OPT_TIME, 'p', "Seconds to collect data, default " SECONDSSTR},
-    {"www", OPT_WWW, 's', "Fetch specified page from the site"},
+    { "verify", OPT_VERIFY, 'p',
+        "Turn on peer certificate verification, set depth" },
+    { "time", OPT_TIME, 'p', "Seconds to collect data, default " SECONDSSTR },
+    { "www", OPT_WWW, 's', "Fetch specified page from the site" },
 
     OPT_SECTION("Certificate"),
-    {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
-    {"cert", OPT_CERT, '<', "Cert file to use, PEM format assumed"},
-    {"key", OPT_KEY, '<', "File with key, PEM; default is -cert file"},
-    {"cafile", OPT_CAFILE, '<', "PEM format file of CA's"},
-    {"CAfile", OPT_CAFILE, '<', "PEM format file of CA's"},
-    {"CApath", OPT_CAPATH, '/', "PEM format directory of CA's"},
-    {"CAstore", OPT_CASTORE, ':', "URI to store of CA's"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load certificates from the default certificates store URI"},
+    { "nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options" },
+    { "cert", OPT_CERT, '<', "Cert file to use, PEM format assumed" },
+    { "key", OPT_KEY, '<', "File with key, PEM; default is -cert file" },
+    { "cafile", OPT_CAFILE, '<', "PEM format file of CA's" },
+    { "CAfile", OPT_CAFILE, '<', "PEM format file of CA's" },
+    { "CApath", OPT_CAPATH, '/', "PEM format directory of CA's" },
+    { "CAstore", OPT_CASTORE, ':', "URI to store of CA's" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load certificates from the default certificates directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load certificates from the default certificates store URI" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
-#define START   0
-#define STOP    1
+#define START 0
+#define STOP 1
 
 static double tm_Time_F(int s)
 {
@@ -137,7 +155,7 @@ int s_time_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -156,7 +174,7 @@ int s_time_main(int argc, char **argv)
         case OPT_VERIFY:
             verify_args.depth = opt_int_arg();
             BIO_printf(bio_err, "%s: verify depth is %d\n",
-                       prog, verify_args.depth);
+                prog, verify_args.depth);
             break;
         case OPT_CERT:
             certfile = opt_arg();
@@ -259,7 +277,7 @@ int s_time_main(int argc, char **argv)
         goto end;
 
     if (!ctx_set_verify_locations(ctx, CAfile, noCAfile, CApath, noCApath,
-                                  CAstore, noCAstore)) {
+            CAstore, noCAstore)) {
         ERR_print_errors(bio_err);
         goto end;
     }
@@ -281,7 +299,7 @@ int s_time_main(int argc, char **argv)
 
         if (www_path != NULL) {
             buf_len = BIO_snprintf(buf, sizeof(buf), fmt_http_get_cmd,
-                                   www_path);
+                www_path);
             if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
                 goto end;
             while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
@@ -310,19 +328,17 @@ int s_time_main(int argc, char **argv)
     }
     totalTime += tm_Time_F(STOP); /* Add the time for this iteration */
 
-    printf
-        ("\n\n%d connections in %.2fs; %.2f connections/user sec, bytes read %ld\n",
-         nConn, totalTime, ((double)nConn / totalTime), bytes_read);
-    printf
-        ("%d connections in %ld real seconds, %ld bytes read per connection\n",
-         nConn, (long)time(NULL) - finishtime + maxtime,
-         nConn > 0 ? bytes_read / nConn : 0l);
+    printf("\n\n%d connections in %.2fs; %.2f connections/user sec, bytes read %ld\n",
+        nConn, totalTime, ((double)nConn / totalTime), bytes_read);
+    printf("%d connections in %ld real seconds, %ld bytes read per connection\n",
+        nConn, (long)time(NULL) - finishtime + maxtime,
+        nConn > 0 ? bytes_read / nConn : 0l);
 
     /*
      * Now loop and time connections using the same session id over and over
      */
 
- next:
+next:
     if (!(perform & 2)) {
         ret = 0;
         goto end;
@@ -364,7 +380,7 @@ int s_time_main(int argc, char **argv)
 
         if (www_path != NULL) {
             buf_len = BIO_snprintf(buf, sizeof(buf), fmt_http_get_cmd,
-                                   www_path);
+                www_path);
             if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
                 goto end;
             while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
@@ -391,19 +407,17 @@ int s_time_main(int argc, char **argv)
     }
     totalTime += tm_Time_F(STOP); /* Add the time for this iteration */
 
-    printf
-        ("\n\n%d connections in %.2fs; %.2f connections/user sec, bytes read %ld\n",
-         nConn, totalTime, ((double)nConn / totalTime), bytes_read);
+    printf("\n\n%d connections in %.2fs; %.2f connections/user sec, bytes read %ld\n",
+        nConn, totalTime, ((double)nConn / totalTime), bytes_read);
     if (nConn > 0)
-        printf
-            ("%d connections in %ld real seconds, %ld bytes read per connection\n",
-             nConn, (long)time(NULL) - finishtime + maxtime, bytes_read / nConn);
+        printf("%d connections in %ld real seconds, %ld bytes read per connection\n",
+            nConn, (long)time(NULL) - finishtime + maxtime, bytes_read / nConn);
     else
         printf("0 connections in %ld real seconds\n",
-               (long)time(NULL) - finishtime + maxtime);
+            (long)time(NULL) - finishtime + maxtime);
     ret = 0;
 
- end:
+end:
     SSL_free(scon);
     SSL_CTX_free(ctx);
     return ret;
@@ -422,7 +436,7 @@ static SSL *doConnection(SSL *scon, const char *host, SSL_CTX *ctx)
         return NULL;
 
     if (BIO_set_conn_hostname(conn, host) <= 0
-            || BIO_set_conn_mode(conn, BIO_SOCK_NODELAY) <= 0) {
+        || BIO_set_conn_mode(conn, BIO_SOCK_NODELAY) <= 0) {
         BIO_free(conn);
         return NULL;
     }
@@ -435,6 +449,16 @@ static SSL *doConnection(SSL *scon, const char *host, SSL_CTX *ctx)
         }
     } else {
         serverCon = scon;
+        /*
+         * Reset the SSL object before reusing it for a new connection.
+         * This clears prior handshake and I/O state while keeping
+         * configuration inherited from the SSL_CTX.
+         */
+        if (!SSL_clear(serverCon)) {
+            ERR_print_errors(bio_err);
+            BIO_free(conn);
+            return NULL;
+        }
         SSL_set_connect_state(serverCon);
     }
 
@@ -446,7 +470,7 @@ static SSL *doConnection(SSL *scon, const char *host, SSL_CTX *ctx)
         BIO_printf(bio_err, "ERROR\n");
         if (verify_args.error != X509_V_OK)
             BIO_printf(bio_err, "verify error:%s\n",
-                       X509_verify_cert_error_string(verify_args.error));
+                X509_verify_cert_error_string(verify_args.error));
         else
             ERR_print_errors(bio_err);
         if (scon == NULL)
@@ -459,12 +483,12 @@ static SSL *doConnection(SSL *scon, const char *host, SSL_CTX *ctx)
         struct linger no_linger;
         int fd;
 
-        no_linger.l_onoff  = 1;
+        no_linger.l_onoff = 1;
         no_linger.l_linger = 0;
         fd = SSL_get_fd(serverCon);
         if (fd >= 0)
-            (void)setsockopt(fd, SOL_SOCKET, SO_LINGER, (char*)&no_linger,
-                             sizeof(no_linger));
+            (void)setsockopt(fd, SOL_SOCKET, SO_LINGER, (char *)&no_linger,
+                sizeof(no_linger));
     }
 #endif
 
diff --git a/crypto/openssl/apps/sess_id.c b/crypto/openssl/apps/sess_id.c
index 54b3d055634b..715b65383387 100644
--- a/crypto/openssl/apps/sess_id.c
+++ b/crypto/openssl/apps/sess_id.c
@@ -20,27 +20,33 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
-    OPT_TEXT, OPT_CERT, OPT_NOOUT, OPT_CONTEXT
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_IN,
+    OPT_OUT,
+    OPT_TEXT,
+    OPT_CERT,
+    OPT_NOOUT,
+    OPT_CONTEXT
 } OPTION_CHOICE;
 
 const OPTIONS sess_id_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"context", OPT_CONTEXT, 's', "Set the session ID context"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "context", OPT_CONTEXT, 's', "Set the session ID context" },
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, 's', "Input file - default stdin"},
-    {"inform", OPT_INFORM, 'F', "Input format - default PEM (DER or PEM)"},
+    { "in", OPT_IN, 's', "Input file - default stdin" },
+    { "inform", OPT_INFORM, 'F', "Input format - default PEM (DER or PEM)" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file - default stdout"},
-    {"outform", OPT_OUTFORM, 'f',
-     "Output format - default PEM (PEM, DER or NSS)"},
-    {"text", OPT_TEXT, '-', "Print ssl session id details"},
-    {"cert", OPT_CERT, '-', "Output certificate "},
-    {"noout", OPT_NOOUT, '-', "Don't output the encoded session info"},
-    {NULL}
+    { "out", OPT_OUT, '>', "Output file - default stdout" },
+    { "outform", OPT_OUTFORM, 'f',
+        "Output format - default PEM (PEM, DER or NSS)" },
+    { "text", OPT_TEXT, '-', "Print ssl session id details" },
+    { "cert", OPT_CERT, '-', "Output certificate " },
+    { "noout", OPT_NOOUT, '-', "Don't output the encoded session info" },
+    { NULL }
 };
 
 static SSL_SESSION *load_sess_id(char *file, int format);
@@ -60,7 +66,7 @@ int sess_id_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -73,7 +79,7 @@ int sess_id_main(int argc, char **argv)
             break;
         case OPT_OUTFORM:
             if (!opt_format(opt_arg(), OPT_FMT_PEMDER | OPT_FMT_NSS,
-                            &outformat))
+                    &outformat))
                 goto opthelp;
             break;
         case OPT_IN:
@@ -114,7 +120,7 @@ int sess_id_main(int argc, char **argv)
             goto end;
         }
         if (!SSL_SESSION_set1_id_context(x, (unsigned char *)context,
-                                         ctx_len)) {
+                ctx_len)) {
             BIO_printf(bio_err, "Error setting id context\n");
             goto end;
         }
@@ -167,7 +173,7 @@ int sess_id_main(int argc, char **argv)
         }
     }
     ret = 0;
- end:
+end:
     BIO_free_all(out);
     SSL_SESSION_free(x);
     return ret;
@@ -191,7 +197,7 @@ static SSL_SESSION *load_sess_id(char *infile, int format)
         goto end;
     }
 
- end:
+end:
     BIO_free(in);
     return x;
 }
diff --git a/crypto/openssl/apps/skeyutl.c b/crypto/openssl/apps/skeyutl.c
index bc744f785bc1..2404a8e8aa28 100644
--- a/crypto/openssl/apps/skeyutl.c
+++ b/crypto/openssl/apps/skeyutl.c
@@ -21,18 +21,20 @@ typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_PROV_ENUM,
     OPT_CIPHER,
-    OPT_SKEYOPT, OPT_SKEYMGMT, OPT_GENKEY
+    OPT_SKEYOPT,
+    OPT_SKEYMGMT,
+    OPT_GENKEY
 } OPTION_CHOICE;
 
 const OPTIONS skeyutl_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"skeyopt", OPT_SKEYOPT, 's', "Key options as opt:value for opaque keys handling"},
-    {"skeymgmt", OPT_SKEYMGMT, 's', "Symmetric key management name for opaque keys handling"},
-    {"genkey", OPT_GENKEY, '-', "Generate an opaque symmetric key"},
-    {"cipher", OPT_CIPHER, 's', "The cipher to generate key for"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "skeyopt", OPT_SKEYOPT, 's', "Key options as opt:value for opaque keys handling" },
+    { "skeymgmt", OPT_SKEYMGMT, 's', "Symmetric key management name for opaque keys handling" },
+    { "genkey", OPT_GENKEY, '-', "Generate an opaque symmetric key" },
+    { "cipher", OPT_CIPHER, 's', "The cipher to generate key for" },
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int skeyutl_main(int argc, char **argv)
@@ -52,7 +54,7 @@ int skeyutl_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -66,9 +68,7 @@ int skeyutl_main(int argc, char **argv)
             ciphername = opt_arg();
             break;
         case OPT_SKEYOPT:
-            if ((skeyopts == NULL &&
-                 (skeyopts = sk_OPENSSL_STRING_new_null()) == NULL) ||
-                sk_OPENSSL_STRING_push(skeyopts, opt_arg()) == 0) {
+            if ((skeyopts == NULL && (skeyopts = sk_OPENSSL_STRING_new_null()) == NULL) || sk_OPENSSL_STRING_push(skeyopts, opt_arg()) == 0) {
                 BIO_printf(bio_err, "%s: out of memory\n", prog);
                 goto end;
             }
@@ -96,26 +96,26 @@ int skeyutl_main(int argc, char **argv)
         OSSL_PARAM *params = NULL;
 
         mgmt = EVP_SKEYMGMT_fetch(app_get0_libctx(),
-                                  skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),
-                                  app_get0_propq());
+            skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),
+            app_get0_propq());
         if (mgmt == NULL)
             goto end;
         params = app_params_new_from_opts(skeyopts,
-                                          EVP_SKEYMGMT_get0_gen_settable_params(mgmt));
+            EVP_SKEYMGMT_get0_gen_settable_params(mgmt));
 
         skey = EVP_SKEY_generate(app_get0_libctx(),
-                                 skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),
-                                 app_get0_propq(), params);
+            skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),
+            app_get0_propq(), params);
         OSSL_PARAM_free(params);
         if (skey == NULL) {
             BIO_printf(bio_err, "Error creating opaque key for skeymgmt %s\n",
-                       skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
+                skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
             ERR_print_errors(bio_err);
         } else {
             const char *key_name = EVP_SKEY_get0_key_id(skey);
 
             BIO_printf(bio_out, "An opaque key identified by %s is created\n",
-                       key_name ? key_name : "<unknown>");
+                key_name ? key_name : "<unknown>");
             BIO_printf(bio_out, "Provider: %s\n", EVP_SKEY_get0_provider_name(skey));
             BIO_printf(bio_out, "Key management: %s\n", EVP_SKEY_get0_skeymgmt_name(skey));
             ret = 0;
@@ -125,7 +125,7 @@ int skeyutl_main(int argc, char **argv)
         BIO_printf(bio_err, "Key generation is the only supported operation as of now\n");
     }
 
- end:
+end:
     ERR_print_errors(bio_err);
     sk_OPENSSL_STRING_free(skeyopts);
     EVP_SKEYMGMT_free(mgmt);
diff --git a/crypto/openssl/apps/smime.c b/crypto/openssl/apps/smime.c
index 211ddce4ab37..328022ce9d0a 100644
--- a/crypto/openssl/apps/smime.c
+++ b/crypto/openssl/apps/smime.c
@@ -22,114 +22,149 @@
 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
 static int smime_cb(int ok, X509_STORE_CTX *ctx);
 
-#define SMIME_OP        0x10
-#define SMIME_IP        0x20
-#define SMIME_SIGNERS   0x40
-#define SMIME_ENCRYPT   (1 | SMIME_OP)
-#define SMIME_DECRYPT   (2 | SMIME_IP)
-#define SMIME_SIGN      (3 | SMIME_OP | SMIME_SIGNERS)
-#define SMIME_RESIGN    (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
-#define SMIME_VERIFY    (4 | SMIME_IP)
-#define SMIME_PK7OUT    (5 | SMIME_IP | SMIME_OP)
+#define SMIME_OP 0x10
+#define SMIME_IP 0x20
+#define SMIME_SIGNERS 0x40
+#define SMIME_ENCRYPT (1 | SMIME_OP)
+#define SMIME_DECRYPT (2 | SMIME_IP)
+#define SMIME_SIGN (3 | SMIME_OP | SMIME_SIGNERS)
+#define SMIME_RESIGN (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
+#define SMIME_VERIFY (4 | SMIME_IP)
+#define SMIME_PK7OUT (5 | SMIME_IP | SMIME_OP)
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENCRYPT, OPT_DECRYPT, OPT_SIGN, OPT_RESIGN, OPT_VERIFY,
-    OPT_PK7OUT, OPT_TEXT, OPT_NOINTERN, OPT_NOVERIFY, OPT_NOCHAIN,
-    OPT_NOCERTS, OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP,
-    OPT_BINARY, OPT_NOSIGS, OPT_STREAM, OPT_INDEF, OPT_NOINDEF,
-    OPT_CRLFEOL, OPT_ENGINE, OPT_PASSIN,
-    OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP, OPT_MD,
-    OPT_CIPHER, OPT_INKEY, OPT_KEYFORM, OPT_CERTFILE, OPT_CAFILE,
-    OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE, OPT_NOCAPATH, OPT_NOCASTORE,
-    OPT_R_ENUM, OPT_PROV_ENUM, OPT_CONFIG,
+    OPT_ENCRYPT,
+    OPT_DECRYPT,
+    OPT_SIGN,
+    OPT_RESIGN,
+    OPT_VERIFY,
+    OPT_PK7OUT,
+    OPT_TEXT,
+    OPT_NOINTERN,
+    OPT_NOVERIFY,
+    OPT_NOCHAIN,
+    OPT_NOCERTS,
+    OPT_NOATTR,
+    OPT_NODETACH,
+    OPT_NOSMIMECAP,
+    OPT_BINARY,
+    OPT_NOSIGS,
+    OPT_STREAM,
+    OPT_INDEF,
+    OPT_NOINDEF,
+    OPT_CRLFEOL,
+    OPT_ENGINE,
+    OPT_PASSIN,
+    OPT_TO,
+    OPT_FROM,
+    OPT_SUBJECT,
+    OPT_SIGNER,
+    OPT_RECIP,
+    OPT_MD,
+    OPT_CIPHER,
+    OPT_INKEY,
+    OPT_KEYFORM,
+    OPT_CERTFILE,
+    OPT_CAFILE,
+    OPT_CAPATH,
+    OPT_CASTORE,
+    OPT_NOCAFILE,
+    OPT_NOCAPATH,
+    OPT_NOCASTORE,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM,
+    OPT_CONFIG,
     OPT_V_ENUM,
-    OPT_IN, OPT_INFORM, OPT_OUT,
-    OPT_OUTFORM, OPT_CONTENT
+    OPT_IN,
+    OPT_INFORM,
+    OPT_OUT,
+    OPT_OUTFORM,
+    OPT_CONTENT
 } OPTION_CHOICE;
 
 const OPTIONS smime_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"in", OPT_IN, '<', "Input file"},
-    {"inform", OPT_INFORM, 'c', "Input format SMIME (default), PEM or DER"},
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'c',
-     "Output format SMIME (default), PEM or DER"},
-    {"inkey", OPT_INKEY, 's',
-     "Input private key (if not signer or recipient)"},
-    {"keyform", OPT_KEYFORM, 'f', "Input private key format (ENGINE, other values ignored)"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "in", OPT_IN, '<', "Input file" },
+    { "inform", OPT_INFORM, 'c', "Input format SMIME (default), PEM or DER" },
+    { "out", OPT_OUT, '>', "Output file" },
+    { "outform", OPT_OUTFORM, 'c',
+        "Output format SMIME (default), PEM or DER" },
+    { "inkey", OPT_INKEY, 's',
+        "Input private key (if not signer or recipient)" },
+    { "keyform", OPT_KEYFORM, 'f', "Input private key format (ENGINE, other values ignored)" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
-    {"stream", OPT_STREAM, '-', "Enable CMS streaming" },
-    {"indef", OPT_INDEF, '-', "Same as -stream" },
-    {"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"},
+    { "stream", OPT_STREAM, '-', "Enable CMS streaming" },
+    { "indef", OPT_INDEF, '-', "Same as -stream" },
+    { "noindef", OPT_NOINDEF, '-', "Disable CMS streaming" },
     OPT_CONFIG_OPTION,
 
     OPT_SECTION("Action"),
-    {"encrypt", OPT_ENCRYPT, '-', "Encrypt message"},
-    {"decrypt", OPT_DECRYPT, '-', "Decrypt encrypted message"},
-    {"sign", OPT_SIGN, '-', "Sign message"},
-    {"resign", OPT_RESIGN, '-', "Resign a signed message"},
-    {"verify", OPT_VERIFY, '-', "Verify signed message"},
-    {"pk7out", OPT_PK7OUT, '-', "Output PKCS#7 structure"},
+    { "encrypt", OPT_ENCRYPT, '-', "Encrypt message" },
+    { "decrypt", OPT_DECRYPT, '-', "Decrypt encrypted message" },
+    { "sign", OPT_SIGN, '-', "Sign message" },
+    { "resign", OPT_RESIGN, '-', "Resign a signed message" },
+    { "verify", OPT_VERIFY, '-', "Verify signed message" },
+    { "pk7out", OPT_PK7OUT, '-', "Output PKCS#7 structure" },
 
     OPT_SECTION("Signing/Encryption"),
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"md", OPT_MD, 's', "Digest algorithm to use when signing or resigning"},
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
-    {"nointern", OPT_NOINTERN, '-',
-     "Don't search certificates in message for signer"},
-    {"nodetach", OPT_NODETACH, '-', "Use opaque signing"},
-    {"noattr", OPT_NOATTR, '-', "Don't include any signed attributes"},
-    {"binary", OPT_BINARY, '-', "Don't translate message to text"},
-    {"signer", OPT_SIGNER, 's', "Signer certificate file"},
-    {"content", OPT_CONTENT, '<',
-     "Supply or override content for detached signature"},
-    {"nocerts", OPT_NOCERTS, '-',
-     "Don't include signers certificate when signing"},
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "md", OPT_MD, 's', "Digest algorithm to use when signing or resigning" },
+    { "", OPT_CIPHER, '-', "Any supported cipher" },
+    { "nointern", OPT_NOINTERN, '-',
+        "Don't search certificates in message for signer" },
+    { "nodetach", OPT_NODETACH, '-', "Use opaque signing" },
+    { "noattr", OPT_NOATTR, '-', "Don't include any signed attributes" },
+    { "binary", OPT_BINARY, '-', "Don't translate message to text" },
+    { "signer", OPT_SIGNER, 's', "Signer certificate file" },
+    { "content", OPT_CONTENT, '<',
+        "Supply or override content for detached signature" },
+    { "nocerts", OPT_NOCERTS, '-',
+        "Don't include signers certificate when signing" },
 
     OPT_SECTION("Verification/Decryption"),
-    {"nosigs", OPT_NOSIGS, '-', "Don't verify message signature"},
-    {"noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate"},
+    { "nosigs", OPT_NOSIGS, '-', "Don't verify message signature" },
+    { "noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate" },
 
-    {"certfile", OPT_CERTFILE, '<',
-     "Extra signer and intermediate CA certificates to include when signing"},
-    {OPT_MORE_STR, 0, 0,
-     "or to use as preferred signer certs and for chain building when verifying"},
-    {"recip", OPT_RECIP, '<', "Recipient certificate file for decryption"},
+    { "certfile", OPT_CERTFILE, '<',
+        "Extra signer and intermediate CA certificates to include when signing" },
+    { OPT_MORE_STR, 0, 0,
+        "or to use as preferred signer certs and for chain building when verifying" },
+    { "recip", OPT_RECIP, '<', "Recipient certificate file for decryption" },
 
     OPT_SECTION("Email"),
-    {"to", OPT_TO, 's', "To address"},
-    {"from", OPT_FROM, 's', "From address"},
-    {"subject", OPT_SUBJECT, 's', "Subject"},
-    {"text", OPT_TEXT, '-', "Include or delete text MIME headers"},
-    {"nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute"},
+    { "to", OPT_TO, 's', "To address" },
+    { "from", OPT_FROM, 's', "From address" },
+    { "subject", OPT_SUBJECT, 's', "Subject" },
+    { "text", OPT_TEXT, '-', "Include or delete text MIME headers" },
+    { "nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute" },
 
     OPT_SECTION("Certificate chain"),
-    {"CApath", OPT_CAPATH, '/', "Trusted certificates directory"},
-    {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
-    {"CAstore", OPT_CASTORE, ':', "Trusted certificates store URI"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load certificates from the default certificates store"},
-    {"nochain", OPT_NOCHAIN, '-',
-     "set PKCS7_NOCHAIN so certificates contained in the message are not used as untrusted CAs" },
-    {"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of LF only"},
+    { "CApath", OPT_CAPATH, '/', "Trusted certificates directory" },
+    { "CAfile", OPT_CAFILE, '<', "Trusted certificates file" },
+    { "CAstore", OPT_CASTORE, ':', "Trusted certificates store URI" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load certificates from the default certificates directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load certificates from the default certificates store" },
+    { "nochain", OPT_NOCHAIN, '-',
+        "set PKCS7_NOCHAIN so certificates contained in the message are not used as untrusted CAs" },
+    { "crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of LF only" },
 
     OPT_R_OPTIONS,
     OPT_V_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"cert", 0, 0, "Recipient certs, used when encrypting"},
-    {NULL}
+    { "cert", 0, 0, "Recipient certs, used when encrypting" },
+    { NULL }
 };
 
 static const char *operation_name(int operation)
@@ -152,11 +187,10 @@ static const char *operation_name(int operation)
     }
 }
 
-#define SET_OPERATION(op) \
-    ((operation != 0 && (operation != (op))) \
-     ? 0 * BIO_printf(bio_err, "%s: Cannot use -%s together with -%s\n", \
-                      prog, operation_name(op), operation_name(operation)) \
-     : (operation = (op)))
+#define SET_OPERATION(op)                                                                                                            \
+    ((operation != 0 && (operation != (op)))                                                                                         \
+            ? 0 * BIO_printf(bio_err, "%s: Cannot use -%s together with -%s\n", prog, operation_name(op), operation_name(operation)) \
+            : (operation = (op)))
 
 int smime_main(int argc, char **argv)
 {
@@ -179,8 +213,7 @@ int smime_main(int argc, char **argv)
     OPTION_CHOICE o;
     int noCApath = 0, noCAfile = 0, noCAstore = 0;
     int flags = PKCS7_DETACHED, operation = 0, ret = 0, indef = 0;
-    int informat = FORMAT_SMIME, outformat = FORMAT_SMIME, keyform =
-        FORMAT_UNDEF;
+    int informat = FORMAT_SMIME, outformat = FORMAT_SMIME, keyform = FORMAT_UNDEF;
     int vpmtouched = 0, rv = 0;
     ENGINE *e = NULL;
     const char *mime_eol = "\n";
@@ -195,7 +228,7 @@ int smime_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -342,7 +375,7 @@ int smime_main(int argc, char **argv)
             if (keyfile != NULL) {
                 if (signerfile == NULL) {
                     BIO_printf(bio_err,
-                               "%s: Must have -signer before -inkey\n", prog);
+                        "%s: Must have -signer before -inkey\n", prog);
                     goto opthelp;
                 }
                 if (sksigners == NULL
@@ -407,14 +440,14 @@ int smime_main(int argc, char **argv)
             goto opthelp;
     }
     if (!opt_cipher_any(ciphername, &cipher))
-            goto opthelp;
+        goto opthelp;
     if (!(operation & SMIME_SIGNERS) && (skkeys != NULL || sksigners != NULL)) {
         BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
         goto opthelp;
     }
     if (!operation) {
         BIO_puts(bio_err,
-                "No operation (-encrypt|-sign|...) specified\n");
+            "No operation (-encrypt|-sign|...) specified\n");
         goto opthelp;
     }
 
@@ -446,7 +479,7 @@ int smime_main(int argc, char **argv)
     } else if (operation == SMIME_DECRYPT) {
         if (recipfile == NULL && keyfile == NULL) {
             BIO_printf(bio_err,
-                       "No recipient certificate or key specified\n");
+                "No recipient certificate or key specified\n");
             goto opthelp;
         }
     } else if (operation == SMIME_ENCRYPT) {
@@ -484,7 +517,7 @@ int smime_main(int argc, char **argv)
             goto end;
         while (*argv != NULL) {
             cert = load_cert(*argv, FORMAT_UNDEF,
-                             "recipient certificate file");
+                "recipient certificate file");
             if (cert == NULL)
                 goto end;
             if (!sk_X509_push(encerts, cert))
@@ -503,7 +536,8 @@ int smime_main(int argc, char **argv)
 
     if (recipfile != NULL && (operation == SMIME_DECRYPT)) {
         if ((recip = load_cert(recipfile, FORMAT_UNDEF,
-                               "recipient certificate file")) == NULL) {
+                 "recipient certificate file"))
+            == NULL) {
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -567,7 +601,8 @@ int smime_main(int argc, char **argv)
 
     if (operation == SMIME_VERIFY) {
         if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
-                                  CAstore, noCAstore)) == NULL)
+                 CAstore, noCAstore))
+            == NULL)
             goto end;
         X509_STORE_set_verify_cb(store, smime_cb);
         if (vpmtouched)
@@ -685,7 +720,7 @@ int smime_main(int argc, char **argv)
         }
     }
     ret = 0;
- end:
+end:
     if (ret)
         ERR_print_errors(bio_err);
     OSSL_STACK_OF_X509_free(encerts);
diff --git a/crypto/openssl/apps/speed.c b/crypto/openssl/apps/speed.c
index 6c1eb59e91ee..a8d7cb14f579 100644
--- a/crypto/openssl/apps/speed.c
+++ b/crypto/openssl/apps/speed.c
@@ -9,18 +9,18 @@
  */
 
 #undef SECONDS
-#define SECONDS          3
-#define PKEY_SECONDS    10
+#define SECONDS 3
+#define PKEY_SECONDS 10
 
-#define RSA_SECONDS     PKEY_SECONDS
-#define DSA_SECONDS     PKEY_SECONDS
-#define ECDSA_SECONDS   PKEY_SECONDS
-#define ECDH_SECONDS    PKEY_SECONDS
-#define EdDSA_SECONDS   PKEY_SECONDS
-#define SM2_SECONDS     PKEY_SECONDS
-#define FFDH_SECONDS    PKEY_SECONDS
-#define KEM_SECONDS     PKEY_SECONDS
-#define SIG_SECONDS     PKEY_SECONDS
+#define RSA_SECONDS PKEY_SECONDS
+#define DSA_SECONDS PKEY_SECONDS
+#define ECDSA_SECONDS PKEY_SECONDS
+#define ECDH_SECONDS PKEY_SECONDS
+#define EdDSA_SECONDS PKEY_SECONDS
+#define SM2_SECONDS PKEY_SECONDS
+#define FFDH_SECONDS PKEY_SECONDS
+#define KEM_SECONDS PKEY_SECONDS
+#define SIG_SECONDS PKEY_SECONDS
 
 #define MAX_ALGNAME_SUFFIX 100
 
@@ -45,33 +45,32 @@
 #include <openssl/async.h>
 #include <openssl/provider.h>
 #if !defined(OPENSSL_SYS_MSDOS)
-# include <unistd.h>
+#include <unistd.h>
 #endif
 
 #if defined(_WIN32)
-# include <windows.h>
+#include <windows.h>
 /*
  * While VirtualLock is available under the app partition (e.g. UWP),
  * the headers do not define the API. Define it ourselves instead.
  */
 WINBASEAPI
 BOOL
-WINAPI
-VirtualLock(
-    _In_ LPVOID lpAddress,
-    _In_ SIZE_T dwSize
-    );
+    WINAPI
+    VirtualLock(
+        _In_ LPVOID lpAddress,
+        _In_ SIZE_T dwSize);
 #endif
 
 #if defined(OPENSSL_SYS_LINUX)
-# include <sys/mman.h>
+#include <sys/mman.h>
 #endif
 
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 #include "./testrsa.h"
 #ifndef OPENSSL_NO_DH
-# include <openssl/dh.h>
+#include <openssl/dh.h>
 #endif
 #include <openssl/x509.h>
 #include <openssl/dsa.h>
@@ -79,27 +78,27 @@ VirtualLock(
 #include <openssl/modes.h>
 
 #ifndef HAVE_FORK
-# if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_VXWORKS)
-#  define HAVE_FORK 0
-# else
-#  define HAVE_FORK 1
-#  include <sys/wait.h>
-# endif
+#if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_VXWORKS)
+#define HAVE_FORK 0
+#else
+#define HAVE_FORK 1
+#include <sys/wait.h>
+#endif
 #endif
 
 #if HAVE_FORK
-# undef NO_FORK
+#undef NO_FORK
 #else
-# define NO_FORK
+#define NO_FORK
 #endif
 
 #define MAX_MISALIGNMENT 63
-#define MAX_ECDH_SIZE   256
-#define MISALIGN        64
+#define MAX_ECDH_SIZE 256
+#define MISALIGN 64
 #define MAX_FFDH_SIZE 1024
 
 #ifndef RSA_DEFAULT_PRIME_NUM
-# define RSA_DEFAULT_PRIME_NUM 2
+#define RSA_DEFAULT_PRIME_NUM 2
 #endif
 
 typedef struct openssl_speed_sec_st {
@@ -117,13 +116,13 @@ typedef struct openssl_speed_sec_st {
 
 static volatile int run = 0;
 
-static int mr = 0;  /* machine-readeable output format to merge fork results */
+static int mr = 0; /* machine-readeable output format to merge fork results */
 static int usertime = 1;
 
 static double Time_F(int s);
 static void print_message(const char *s, int length, int tm);
 static void pkey_print_message(const char *str, const char *str2,
-                               unsigned int bits, int sec);
+    unsigned int bits, int sec);
 static void kskey_print_message(const char *str, const char *str2, int tm);
 static void print_result(int alg, int run_no, int count, double time_used);
 #ifndef NO_FORK
@@ -137,15 +136,15 @@ static int testmoderesult = 0;
 static const int lengths_list[] = {
     16, 64, 256, 1024, 8 * 1024, 16 * 1024
 };
-#define SIZE_NUM         OSSL_NELEM(lengths_list)
+#define SIZE_NUM OSSL_NELEM(lengths_list)
 static const int *lengths = lengths_list;
 
 static const int aead_lengths_list[] = {
     2, 31, 136, 1024, 8 * 1024, 16 * 1024
 };
 
-#define START   0
-#define STOP    1
+#define START 0
+#define STOP 1
 
 #ifdef SIGALRM
 
@@ -165,7 +164,7 @@ static double Time_F(int s)
 
 #elif defined(_WIN32)
 
-# define SIGALRM -1
+#define SIGALRM -1
 
 static unsigned int lapse;
 static volatile unsigned int schlock;
@@ -174,9 +173,9 @@ static void alarm_win32(unsigned int secs)
     lapse = secs * 1000;
 }
 
-# define alarm alarm_win32
+#define alarm alarm_win32
 
-static DWORD WINAPI sleepy(VOID * arg)
+static DWORD WINAPI sleepy(VOID *arg)
 {
     schlock = 1;
     Sleep(lapse);
@@ -198,7 +197,7 @@ static double Time_F(int s)
             ExitProcess(err);
         }
         while (!schlock)
-            Sleep(0);           /* scheduler spinlock */
+            Sleep(0); /* scheduler spinlock */
         ret = app_tminterval(s, usertime);
     } else {
         ret = app_tminterval(s, usertime);
@@ -210,14 +209,14 @@ static double Time_F(int s)
     return ret;
 }
 #else
-# error "SIGALRM not defined and the platform is not Windows"
+#error "SIGALRM not defined and the platform is not Windows"
 #endif
 
 static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
-                             const openssl_speed_sec_t *seconds);
+    const openssl_speed_sec_t *seconds);
 
 static int opt_found(const char *name, unsigned int *result,
-                     const OPT_PAIR pairs[], unsigned int nbelem)
+    const OPT_PAIR pairs[], unsigned int nbelem)
 {
     unsigned int idx;
 
@@ -228,83 +227,124 @@ static int opt_found(const char *name, unsigned int *result,
         }
     return 0;
 }
-#define opt_found(value, pairs, result)\
+#define opt_found(value, pairs, result) \
     opt_found(value, result, pairs, OSSL_NELEM(pairs))
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_ENGINE, OPT_MULTI,
-    OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM, OPT_PROV_ENUM,
-    OPT_CONFIG, OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD, OPT_CMAC,
-    OPT_MLOCK, OPT_TESTMODE, OPT_KEM, OPT_SIG
+    OPT_ELAPSED,
+    OPT_EVP,
+    OPT_HMAC,
+    OPT_DECRYPT,
+    OPT_ENGINE,
+    OPT_MULTI,
+    OPT_MR,
+    OPT_MB,
+    OPT_MISALIGN,
+    OPT_ASYNCJOBS,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM,
+    OPT_CONFIG,
+    OPT_PRIMES,
+    OPT_SECONDS,
+    OPT_BYTES,
+    OPT_AEAD,
+    OPT_CMAC,
+    OPT_MLOCK,
+    OPT_TESTMODE,
+    OPT_KEM,
+    OPT_SIG
 } OPTION_CHOICE;
 
 const OPTIONS speed_options[] = {
-    {OPT_HELP_STR, 1, '-',
-     "Usage: %s [options] [algorithm...]\n"
-     "All +int options consider prefix '0' as base-8 input, "
-     "prefix '0x'/'0X' as base-16 input.\n"
-    },
+    { OPT_HELP_STR, 1, '-',
+        "Usage: %s [options] [algorithm...]\n"
+        "All +int options consider prefix '0' as base-8 input, "
+        "prefix '0x'/'0X' as base-16 input.\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"mb", OPT_MB, '-',
-     "Enable (tls1>=1) multi-block mode on EVP-named cipher"},
-    {"mr", OPT_MR, '-', "Produce machine readable output"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "mb", OPT_MB, '-',
+        "Enable (tls1>=1) multi-block mode on EVP-named cipher" },
+    { "mr", OPT_MR, '-', "Produce machine readable output" },
 #ifndef NO_FORK
-    {"multi", OPT_MULTI, 'p', "Run benchmarks in parallel"},
+    { "multi", OPT_MULTI, 'p', "Run benchmarks in parallel" },
 #endif
 #ifndef OPENSSL_NO_ASYNC
-    {"async_jobs", OPT_ASYNCJOBS, 'p',
-     "Enable async mode and start specified number of jobs"},
+    { "async_jobs", OPT_ASYNCJOBS, 'p',
+        "Enable async mode and start specified number of jobs" },
 #endif
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
-    {"primes", OPT_PRIMES, 'p', "Specify number of primes (for RSA only)"},
-    {"mlock", OPT_MLOCK, '-', "Lock memory for better result determinism"},
-    {"testmode", OPT_TESTMODE, '-', "Run the speed command in test mode"},
+    { "primes", OPT_PRIMES, 'p', "Specify number of primes (for RSA only)" },
+    { "mlock", OPT_MLOCK, '-', "Lock memory for better result determinism" },
+    { "testmode", OPT_TESTMODE, '-', "Run the speed command in test mode" },
     OPT_CONFIG_OPTION,
 
     OPT_SECTION("Selection"),
-    {"evp", OPT_EVP, 's', "Use EVP-named cipher or digest"},
-    {"hmac", OPT_HMAC, 's', "HMAC using EVP-named digest"},
-    {"cmac", OPT_CMAC, 's', "CMAC using EVP-named cipher"},
-    {"decrypt", OPT_DECRYPT, '-',
-     "Time decryption instead of encryption (only EVP)"},
-    {"aead", OPT_AEAD, '-',
-     "Benchmark EVP-named AEAD cipher in TLS-like sequence"},
-    {"kem-algorithms", OPT_KEM, '-',
-     "Benchmark KEM algorithms"},
-    {"signature-algorithms", OPT_SIG, '-',
-     "Benchmark signature algorithms"},
+    { "evp", OPT_EVP, 's', "Use EVP-named cipher or digest" },
+    { "hmac", OPT_HMAC, 's', "HMAC using EVP-named digest" },
+    { "cmac", OPT_CMAC, 's', "CMAC using EVP-named cipher" },
+    { "decrypt", OPT_DECRYPT, '-',
+        "Time decryption instead of encryption (only EVP)" },
+    { "aead", OPT_AEAD, '-',
+        "Benchmark EVP-named AEAD cipher in TLS-like sequence" },
+    { "kem-algorithms", OPT_KEM, '-',
+        "Benchmark KEM algorithms" },
+    { "signature-algorithms", OPT_SIG, '-',
+        "Benchmark signature algorithms" },
 
     OPT_SECTION("Timing"),
-    {"elapsed", OPT_ELAPSED, '-',
-     "Use wall-clock time instead of CPU user time as divisor"},
-    {"seconds", OPT_SECONDS, 'p',
-     "Run benchmarks for specified amount of seconds"},
-    {"bytes", OPT_BYTES, 'p',
-     "Run [non-PKI] benchmarks on custom-sized buffer"},
-    {"misalign", OPT_MISALIGN, 'p',
-     "Use specified offset to mis-align buffers"},
+    { "elapsed", OPT_ELAPSED, '-',
+        "Use wall-clock time instead of CPU user time as divisor" },
+    { "seconds", OPT_SECONDS, 'p',
+        "Run benchmarks for specified amount of seconds" },
+    { "bytes", OPT_BYTES, 'p',
+        "Run [non-PKI] benchmarks on custom-sized buffer" },
+    { "misalign", OPT_MISALIGN, 'p',
+        "Use specified offset to mis-align buffers" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"algorithm", 0, 0, "Algorithm(s) to test (optional; otherwise tests all)"},
-    {NULL}
+    { "algorithm", 0, 0, "Algorithm(s) to test (optional; otherwise tests all)" },
+    { NULL }
 };
 
 enum {
-    D_MD2, D_MDC2, D_MD4, D_MD5, D_SHA1, D_RMD160,
-    D_SHA256, D_SHA512, D_WHIRLPOOL, D_HMAC,
-    D_CBC_DES, D_EDE3_DES, D_RC4, D_CBC_IDEA, D_CBC_SEED,
-    D_CBC_RC2, D_CBC_RC5, D_CBC_BF, D_CBC_CAST,
-    D_CBC_128_AES, D_CBC_192_AES, D_CBC_256_AES,
-    D_CBC_128_CML, D_CBC_192_CML, D_CBC_256_CML,
-    D_EVP, D_GHASH, D_RAND, D_EVP_CMAC, D_KMAC128, D_KMAC256,
+    D_MD2,
+    D_MDC2,
+    D_MD4,
+    D_MD5,
+    D_SHA1,
+    D_RMD160,
+    D_SHA256,
+    D_SHA512,
+    D_WHIRLPOOL,
+    D_HMAC,
+    D_CBC_DES,
+    D_EDE3_DES,
+    D_RC4,
+    D_CBC_IDEA,
+    D_CBC_SEED,
+    D_CBC_RC2,
+    D_CBC_RC5,
+    D_CBC_BF,
+    D_CBC_CAST,
+    D_CBC_128_AES,
+    D_CBC_192_AES,
+    D_CBC_256_AES,
+    D_CBC_128_CML,
+    D_CBC_192_CML,
+    D_CBC_256_CML,
+    D_EVP,
+    D_GHASH,
+    D_RAND,
+    D_EVP_CMAC,
+    D_KMAC128,
+    D_KMAC256,
     ALGOR_NUM
 };
 /* name of algorithms to test. MUST BE KEEP IN SYNC with above enum ! */
@@ -320,197 +360,233 @@ static const char *names[ALGOR_NUM] = {
 
 /* list of configured algorithm (remaining), with some few alias */
 static const OPT_PAIR doit_choices[] = {
-    {"md2", D_MD2},
-    {"mdc2", D_MDC2},
-    {"md4", D_MD4},
-    {"md5", D_MD5},
-    {"hmac", D_HMAC},
-    {"sha1", D_SHA1},
-    {"sha256", D_SHA256},
-    {"sha512", D_SHA512},
-    {"whirlpool", D_WHIRLPOOL},
-    {"ripemd", D_RMD160},
-    {"rmd160", D_RMD160},
-    {"ripemd160", D_RMD160},
-    {"rc4", D_RC4},
-    {"des-cbc", D_CBC_DES},
-    {"des-ede3", D_EDE3_DES},
-    {"aes-128-cbc", D_CBC_128_AES},
-    {"aes-192-cbc", D_CBC_192_AES},
-    {"aes-256-cbc", D_CBC_256_AES},
-    {"camellia-128-cbc", D_CBC_128_CML},
-    {"camellia-192-cbc", D_CBC_192_CML},
-    {"camellia-256-cbc", D_CBC_256_CML},
-    {"rc2-cbc", D_CBC_RC2},
-    {"rc2", D_CBC_RC2},
-    {"rc5-cbc", D_CBC_RC5},
-    {"rc5", D_CBC_RC5},
-    {"idea-cbc", D_CBC_IDEA},
-    {"idea", D_CBC_IDEA},
-    {"seed-cbc", D_CBC_SEED},
-    {"seed", D_CBC_SEED},
-    {"bf-cbc", D_CBC_BF},
-    {"blowfish", D_CBC_BF},
-    {"bf", D_CBC_BF},
-    {"cast-cbc", D_CBC_CAST},
-    {"cast", D_CBC_CAST},
-    {"cast5", D_CBC_CAST},
-    {"ghash", D_GHASH},
-    {"rand", D_RAND},
-    {"kmac128", D_KMAC128},
-    {"kmac256", D_KMAC256},
+    { "md2", D_MD2 },
+    { "mdc2", D_MDC2 },
+    { "md4", D_MD4 },
+    { "md5", D_MD5 },
+    { "hmac", D_HMAC },
+    { "sha1", D_SHA1 },
+    { "sha256", D_SHA256 },
+    { "sha512", D_SHA512 },
+    { "whirlpool", D_WHIRLPOOL },
+    { "ripemd", D_RMD160 },
+    { "rmd160", D_RMD160 },
+    { "ripemd160", D_RMD160 },
+    { "rc4", D_RC4 },
+    { "des-cbc", D_CBC_DES },
+    { "des-ede3", D_EDE3_DES },
+    { "aes-128-cbc", D_CBC_128_AES },
+    { "aes-192-cbc", D_CBC_192_AES },
+    { "aes-256-cbc", D_CBC_256_AES },
+    { "camellia-128-cbc", D_CBC_128_CML },
+    { "camellia-192-cbc", D_CBC_192_CML },
+    { "camellia-256-cbc", D_CBC_256_CML },
+    { "rc2-cbc", D_CBC_RC2 },
+    { "rc2", D_CBC_RC2 },
+    { "rc5-cbc", D_CBC_RC5 },
+    { "rc5", D_CBC_RC5 },
+    { "idea-cbc", D_CBC_IDEA },
+    { "idea", D_CBC_IDEA },
+    { "seed-cbc", D_CBC_SEED },
+    { "seed", D_CBC_SEED },
+    { "bf-cbc", D_CBC_BF },
+    { "blowfish", D_CBC_BF },
+    { "bf", D_CBC_BF },
+    { "cast-cbc", D_CBC_CAST },
+    { "cast", D_CBC_CAST },
+    { "cast5", D_CBC_CAST },
+    { "ghash", D_GHASH },
+    { "rand", D_RAND },
+    { "kmac128", D_KMAC128 },
+    { "kmac256", D_KMAC256 },
 };
 
 static double results[ALGOR_NUM][SIZE_NUM];
 
 #ifndef OPENSSL_NO_DSA
-enum { R_DSA_1024, R_DSA_2048, DSA_NUM };
+enum { R_DSA_1024,
+    R_DSA_2048,
+    DSA_NUM };
 static const OPT_PAIR dsa_choices[DSA_NUM] = {
-    {"dsa1024", R_DSA_1024},
-    {"dsa2048", R_DSA_2048}
+    { "dsa1024", R_DSA_1024 },
+    { "dsa2048", R_DSA_2048 }
 };
-static double dsa_results[DSA_NUM][2];  /* 2 ops: sign then verify */
+static double dsa_results[DSA_NUM][2]; /* 2 ops: sign then verify */
 #endif /* OPENSSL_NO_DSA */
 
 enum {
-    R_RSA_512, R_RSA_1024, R_RSA_2048, R_RSA_3072, R_RSA_4096, R_RSA_7680,
-    R_RSA_15360, RSA_NUM
+    R_RSA_512,
+    R_RSA_1024,
+    R_RSA_2048,
+    R_RSA_3072,
+    R_RSA_4096,
+    R_RSA_7680,
+    R_RSA_15360,
+    RSA_NUM
 };
 static const OPT_PAIR rsa_choices[RSA_NUM] = {
-    {"rsa512", R_RSA_512},
-    {"rsa1024", R_RSA_1024},
-    {"rsa2048", R_RSA_2048},
-    {"rsa3072", R_RSA_3072},
-    {"rsa4096", R_RSA_4096},
-    {"rsa7680", R_RSA_7680},
-    {"rsa15360", R_RSA_15360}
+    { "rsa512", R_RSA_512 },
+    { "rsa1024", R_RSA_1024 },
+    { "rsa2048", R_RSA_2048 },
+    { "rsa3072", R_RSA_3072 },
+    { "rsa4096", R_RSA_4096 },
+    { "rsa7680", R_RSA_7680 },
+    { "rsa15360", R_RSA_15360 }
 };
 
-static double rsa_results[RSA_NUM][4];  /* 4 ops: sign, verify, encrypt, decrypt */
+static double rsa_results[RSA_NUM][4]; /* 4 ops: sign, verify, encrypt, decrypt */
 
 #ifndef OPENSSL_NO_DH
 enum ff_params_t {
-    R_FFDH_2048, R_FFDH_3072, R_FFDH_4096, R_FFDH_6144, R_FFDH_8192, FFDH_NUM
+    R_FFDH_2048,
+    R_FFDH_3072,
+    R_FFDH_4096,
+    R_FFDH_6144,
+    R_FFDH_8192,
+    FFDH_NUM
 };
 
 static const OPT_PAIR ffdh_choices[FFDH_NUM] = {
-    {"ffdh2048", R_FFDH_2048},
-    {"ffdh3072", R_FFDH_3072},
-    {"ffdh4096", R_FFDH_4096},
-    {"ffdh6144", R_FFDH_6144},
-    {"ffdh8192", R_FFDH_8192},
+    { "ffdh2048", R_FFDH_2048 },
+    { "ffdh3072", R_FFDH_3072 },
+    { "ffdh4096", R_FFDH_4096 },
+    { "ffdh6144", R_FFDH_6144 },
+    { "ffdh8192", R_FFDH_8192 },
 };
 
-static double ffdh_results[FFDH_NUM][1];  /* 1 op: derivation */
+static double ffdh_results[FFDH_NUM][1]; /* 1 op: derivation */
 #endif /* OPENSSL_NO_DH */
 
 enum ec_curves_t {
-    R_EC_P160, R_EC_P192, R_EC_P224, R_EC_P256, R_EC_P384, R_EC_P521,
+    R_EC_P160,
+    R_EC_P192,
+    R_EC_P224,
+    R_EC_P256,
+    R_EC_P384,
+    R_EC_P521,
 #ifndef OPENSSL_NO_EC2M
-    R_EC_K163, R_EC_K233, R_EC_K283, R_EC_K409, R_EC_K571,
-    R_EC_B163, R_EC_B233, R_EC_B283, R_EC_B409, R_EC_B571,
+    R_EC_K163,
+    R_EC_K233,
+    R_EC_K283,
+    R_EC_K409,
+    R_EC_K571,
+    R_EC_B163,
+    R_EC_B233,
+    R_EC_B283,
+    R_EC_B409,
+    R_EC_B571,
 #endif
-    R_EC_BRP256R1, R_EC_BRP256T1, R_EC_BRP384R1, R_EC_BRP384T1,
-    R_EC_BRP512R1, R_EC_BRP512T1, ECDSA_NUM
+    R_EC_BRP256R1,
+    R_EC_BRP256T1,
+    R_EC_BRP384R1,
+    R_EC_BRP384T1,
+    R_EC_BRP512R1,
+    R_EC_BRP512T1,
+    ECDSA_NUM
 };
 /* list of ecdsa curves */
 static const OPT_PAIR ecdsa_choices[ECDSA_NUM] = {
-    {"ecdsap160", R_EC_P160},
-    {"ecdsap192", R_EC_P192},
-    {"ecdsap224", R_EC_P224},
-    {"ecdsap256", R_EC_P256},
-    {"ecdsap384", R_EC_P384},
-    {"ecdsap521", R_EC_P521},
+    { "ecdsap160", R_EC_P160 },
+    { "ecdsap192", R_EC_P192 },
+    { "ecdsap224", R_EC_P224 },
+    { "ecdsap256", R_EC_P256 },
+    { "ecdsap384", R_EC_P384 },
+    { "ecdsap521", R_EC_P521 },
 #ifndef OPENSSL_NO_EC2M
-    {"ecdsak163", R_EC_K163},
-    {"ecdsak233", R_EC_K233},
-    {"ecdsak283", R_EC_K283},
-    {"ecdsak409", R_EC_K409},
-    {"ecdsak571", R_EC_K571},
-    {"ecdsab163", R_EC_B163},
-    {"ecdsab233", R_EC_B233},
-    {"ecdsab283", R_EC_B283},
-    {"ecdsab409", R_EC_B409},
-    {"ecdsab571", R_EC_B571},
+    { "ecdsak163", R_EC_K163 },
+    { "ecdsak233", R_EC_K233 },
+    { "ecdsak283", R_EC_K283 },
+    { "ecdsak409", R_EC_K409 },
+    { "ecdsak571", R_EC_K571 },
+    { "ecdsab163", R_EC_B163 },
+    { "ecdsab233", R_EC_B233 },
+    { "ecdsab283", R_EC_B283 },
+    { "ecdsab409", R_EC_B409 },
+    { "ecdsab571", R_EC_B571 },
 #endif
-    {"ecdsabrp256r1", R_EC_BRP256R1},
-    {"ecdsabrp256t1", R_EC_BRP256T1},
-    {"ecdsabrp384r1", R_EC_BRP384R1},
-    {"ecdsabrp384t1", R_EC_BRP384T1},
-    {"ecdsabrp512r1", R_EC_BRP512R1},
-    {"ecdsabrp512t1", R_EC_BRP512T1}
+    { "ecdsabrp256r1", R_EC_BRP256R1 },
+    { "ecdsabrp256t1", R_EC_BRP256T1 },
+    { "ecdsabrp384r1", R_EC_BRP384R1 },
+    { "ecdsabrp384t1", R_EC_BRP384T1 },
+    { "ecdsabrp512r1", R_EC_BRP512R1 },
+    { "ecdsabrp512t1", R_EC_BRP512T1 }
 };
 enum {
 #ifndef OPENSSL_NO_ECX
-    R_EC_X25519 = ECDSA_NUM, R_EC_X448, EC_NUM
+    R_EC_X25519 = ECDSA_NUM,
+    R_EC_X448,
+    EC_NUM
 #else
     EC_NUM = ECDSA_NUM
 #endif
 };
 /* list of ecdh curves, extension of |ecdsa_choices| list above */
 static const OPT_PAIR ecdh_choices[EC_NUM] = {
-    {"ecdhp160", R_EC_P160},
-    {"ecdhp192", R_EC_P192},
-    {"ecdhp224", R_EC_P224},
-    {"ecdhp256", R_EC_P256},
-    {"ecdhp384", R_EC_P384},
-    {"ecdhp521", R_EC_P521},
+    { "ecdhp160", R_EC_P160 },
+    { "ecdhp192", R_EC_P192 },
+    { "ecdhp224", R_EC_P224 },
+    { "ecdhp256", R_EC_P256 },
+    { "ecdhp384", R_EC_P384 },
+    { "ecdhp521", R_EC_P521 },
 #ifndef OPENSSL_NO_EC2M
-    {"ecdhk163", R_EC_K163},
-    {"ecdhk233", R_EC_K233},
-    {"ecdhk283", R_EC_K283},
-    {"ecdhk409", R_EC_K409},
-    {"ecdhk571", R_EC_K571},
-    {"ecdhb163", R_EC_B163},
-    {"ecdhb233", R_EC_B233},
-    {"ecdhb283", R_EC_B283},
-    {"ecdhb409", R_EC_B409},
-    {"ecdhb571", R_EC_B571},
+    { "ecdhk163", R_EC_K163 },
+    { "ecdhk233", R_EC_K233 },
+    { "ecdhk283", R_EC_K283 },
+    { "ecdhk409", R_EC_K409 },
+    { "ecdhk571", R_EC_K571 },
+    { "ecdhb163", R_EC_B163 },
+    { "ecdhb233", R_EC_B233 },
+    { "ecdhb283", R_EC_B283 },
+    { "ecdhb409", R_EC_B409 },
+    { "ecdhb571", R_EC_B571 },
 #endif
-    {"ecdhbrp256r1", R_EC_BRP256R1},
-    {"ecdhbrp256t1", R_EC_BRP256T1},
-    {"ecdhbrp384r1", R_EC_BRP384R1},
-    {"ecdhbrp384t1", R_EC_BRP384T1},
-    {"ecdhbrp512r1", R_EC_BRP512R1},
-    {"ecdhbrp512t1", R_EC_BRP512T1},
+    { "ecdhbrp256r1", R_EC_BRP256R1 },
+    { "ecdhbrp256t1", R_EC_BRP256T1 },
+    { "ecdhbrp384r1", R_EC_BRP384R1 },
+    { "ecdhbrp384t1", R_EC_BRP384T1 },
+    { "ecdhbrp512r1", R_EC_BRP512R1 },
+    { "ecdhbrp512t1", R_EC_BRP512T1 },
 #ifndef OPENSSL_NO_ECX
-    {"ecdhx25519", R_EC_X25519},
-    {"ecdhx448", R_EC_X448}
+    { "ecdhx25519", R_EC_X25519 },
+    { "ecdhx448", R_EC_X448 }
 #endif
 };
 
-static double ecdh_results[EC_NUM][1];      /* 1 op: derivation */
-static double ecdsa_results[ECDSA_NUM][2];  /* 2 ops: sign then verify */
+static double ecdh_results[EC_NUM][1]; /* 1 op: derivation */
+static double ecdsa_results[ECDSA_NUM][2]; /* 2 ops: sign then verify */
 
 #ifndef OPENSSL_NO_ECX
-enum { R_EC_Ed25519, R_EC_Ed448, EdDSA_NUM };
+enum { R_EC_Ed25519,
+    R_EC_Ed448,
+    EdDSA_NUM };
 static const OPT_PAIR eddsa_choices[EdDSA_NUM] = {
-    {"ed25519", R_EC_Ed25519},
-    {"ed448", R_EC_Ed448}
+    { "ed25519", R_EC_Ed25519 },
+    { "ed448", R_EC_Ed448 }
 
 };
-static double eddsa_results[EdDSA_NUM][2];    /* 2 ops: sign then verify */
+static double eddsa_results[EdDSA_NUM][2]; /* 2 ops: sign then verify */
 #endif /* OPENSSL_NO_ECX */
 
 #ifndef OPENSSL_NO_SM2
-enum { R_EC_CURVESM2, SM2_NUM };
+enum { R_EC_CURVESM2,
+    SM2_NUM };
 static const OPT_PAIR sm2_choices[SM2_NUM] = {
-    {"curveSM2", R_EC_CURVESM2}
+    { "curveSM2", R_EC_CURVESM2 }
 };
-# define SM2_ID        "TLSv1.3+GM+Cipher+Suite"
-# define SM2_ID_LEN    sizeof("TLSv1.3+GM+Cipher+Suite") - 1
-static double sm2_results[SM2_NUM][2];    /* 2 ops: sign then verify */
+#define SM2_ID "TLSv1.3+GM+Cipher+Suite"
+#define SM2_ID_LEN sizeof("TLSv1.3+GM+Cipher+Suite") - 1
+static double sm2_results[SM2_NUM][2]; /* 2 ops: sign then verify */
 #endif /* OPENSSL_NO_SM2 */
 
 #define MAX_KEM_NUM 111
 static size_t kems_algs_len = 0;
 static char *kems_algname[MAX_KEM_NUM] = { NULL };
-static double kems_results[MAX_KEM_NUM][3];  /* keygen, encaps, decaps */
+static double kems_results[MAX_KEM_NUM][3]; /* keygen, encaps, decaps */
 
 #define MAX_SIG_NUM 256
 static size_t sigs_algs_len = 0;
 static char *sigs_algname[MAX_SIG_NUM] = { NULL };
-static double sigs_results[MAX_SIG_NUM][3];  /* keygen, sign, verify */
+static double sigs_results[MAX_SIG_NUM][3]; /* keygen, sign, verify */
 
 #define COND(unused_cond) (run && count < (testmode ? 1 : INT_MAX))
 #define COUNT(d) (count)
@@ -580,8 +656,8 @@ typedef struct loopargs_st {
     size_t sig_act_sig_len[MAX_SIG_NUM];
     unsigned char *sig_sig[MAX_SIG_NUM];
 } loopargs_t;
-static int run_benchmark(int async_jobs, int (*loop_function) (void *),
-                         loopargs_t *loopargs);
+static int run_benchmark(int async_jobs, int (*loop_function)(void *),
+    loopargs_t *loopargs);
 
 static unsigned int testnum;
 
@@ -632,7 +708,7 @@ static int have_cipher(const char *name)
 
 static int EVP_Digest_loop(const char *mdname, ossl_unused int algindex, void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char digest[EVP_MAX_MD_SIZE];
     int count;
@@ -649,9 +725,9 @@ static int EVP_Digest_loop(const char *mdname, ossl_unused int algindex, void *a
         }
 
         for (count = 0; COND(c[algindex][testnum]); count++) {
-             if (!EVP_DigestInit_ex2(ctx, md, NULL)
-                 || !EVP_DigestUpdate(ctx, buf, (size_t)lengths[testnum])
-                 || !EVP_DigestFinalXOF(ctx, digest, sizeof(digest))) {
+            if (!EVP_DigestInit_ex2(ctx, md, NULL)
+                || !EVP_DigestUpdate(ctx, buf, (size_t)lengths[testnum])
+                || !EVP_DigestFinalXOF(ctx, digest, sizeof(digest))) {
                 count = -1;
                 break;
             }
@@ -659,7 +735,7 @@ static int EVP_Digest_loop(const char *mdname, ossl_unused int algindex, void *a
     } else {
         for (count = 0; COND(c[algindex][testnum]); count++) {
             if (!EVP_Digest(buf, (size_t)lengths[testnum], digest, NULL, md,
-                            NULL)) {
+                    NULL)) {
                 count = -1;
                 break;
             }
@@ -697,8 +773,8 @@ static int MD5_loop(void *args)
 }
 
 static int mac_setup(const char *name,
-                     EVP_MAC **mac, OSSL_PARAM params[],
-                     loopargs_t *loopargs, unsigned int loopargs_len)
+    EVP_MAC **mac, OSSL_PARAM params[],
+    loopargs_t *loopargs, unsigned int loopargs_len)
 {
     unsigned int i;
 
@@ -719,7 +795,7 @@ static int mac_setup(const char *name,
 }
 
 static void mac_teardown(EVP_MAC **mac,
-                         loopargs_t *loopargs, unsigned int loopargs_len)
+    loopargs_t *loopargs, unsigned int loopargs_len)
 {
     unsigned int i;
 
@@ -733,7 +809,7 @@ static void mac_teardown(EVP_MAC **mac,
 
 static int EVP_MAC_loop(ossl_unused int algindex, void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     EVP_MAC_CTX *mctx = tempargs->mctx;
     unsigned char mac[EVP_MAX_MD_SIZE];
@@ -799,7 +875,7 @@ static int algindex;
 
 static int EVP_Cipher_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     int count;
 
@@ -813,7 +889,7 @@ static int EVP_Cipher_loop(void *args)
 
 static int GHASH_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     EVP_MAC_CTX *mctx = tempargs->mctx;
     int count;
@@ -831,8 +907,8 @@ static int GHASH_loop(void *args)
 static unsigned char iv[2 * MAX_BLOCK_SIZE / 8];
 
 static EVP_CIPHER_CTX *init_evp_cipher_ctx(const char *ciphername,
-                                           const unsigned char *key,
-                                           int keylen)
+    const unsigned char *key,
+    int keylen)
 {
     EVP_CIPHER_CTX *ctx = NULL;
     EVP_CIPHER *cipher = NULL;
@@ -868,7 +944,7 @@ end:
 
 static int RAND_bytes_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     int count;
 
@@ -880,7 +956,7 @@ static int RAND_bytes_loop(void *args)
 static int decrypt = 0;
 static int EVP_Update_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     EVP_CIPHER_CTX *ctx = tempargs->ctx;
     int outl, count, rc;
@@ -922,7 +998,7 @@ static int EVP_Update_loop(void *args)
  */
 static int EVP_Update_loop_aead_enc(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *key = tempargs->key;
     EVP_CIPHER_CTX *ctx = tempargs->ctx;
@@ -932,7 +1008,7 @@ static int EVP_Update_loop_aead_enc(void *args)
         /* Set length of iv (Doesn't apply to SIV mode) */
         if (mode_op != EVP_CIPH_SIV_MODE) {
             if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
-                                     sizeof(aead_iv), NULL)) {
+                    sizeof(aead_iv), NULL)) {
                 BIO_printf(bio_err, "\nFailed to set iv length\n");
                 dofail();
                 exit(1);
@@ -943,7 +1019,7 @@ static int EVP_Update_loop_aead_enc(void *args)
             && mode_op != EVP_CIPH_SIV_MODE
             && mode_op != EVP_CIPH_GCM_SIV_MODE) {
             if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
-                                     TAG_LEN, NULL)) {
+                    TAG_LEN, NULL)) {
                 BIO_printf(bio_err, "\nFailed to set tag length\n");
                 dofail();
                 exit(1);
@@ -957,7 +1033,7 @@ static int EVP_Update_loop_aead_enc(void *args)
         /* Set total length of input. Only required for CCM */
         if (mode_op == EVP_CIPH_CCM_MODE) {
             if (!EVP_EncryptUpdate(ctx, NULL, &outl,
-                                   NULL, lengths[testnum])) {
+                    NULL, lengths[testnum])) {
                 BIO_printf(bio_err, "\nCouldn't set input text length\n");
                 dofail();
                 exit(1);
@@ -992,7 +1068,7 @@ static int EVP_Update_loop_aead_enc(void *args)
  */
 static int EVP_Update_loop_aead_dec(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *outbuf = tempargs->buf2;
     unsigned char *key = tempargs->key;
@@ -1004,7 +1080,7 @@ static int EVP_Update_loop_aead_dec(void *args)
         /* Set the length of iv (Doesn't apply to SIV mode) */
         if (mode_op != EVP_CIPH_SIV_MODE) {
             if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
-                                     sizeof(aead_iv), NULL)) {
+                    sizeof(aead_iv), NULL)) {
                 BIO_printf(bio_err, "\nFailed to set iv length\n");
                 dofail();
                 exit(1);
@@ -1016,7 +1092,7 @@ static int EVP_Update_loop_aead_dec(void *args)
             && mode_op != EVP_CIPH_GCM_MODE
             && mode_op != EVP_CIPH_GCM_SIV_MODE) {
             if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
-                                     TAG_LEN, NULL)) {
+                    TAG_LEN, NULL)) {
                 BIO_printf(bio_err, "\nFailed to set tag length\n");
                 dofail();
                 exit(1);
@@ -1038,7 +1114,7 @@ static int EVP_Update_loop_aead_dec(void *args)
         memcpy(tag, tempargs->tag, TAG_LEN);
 
         if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
-                                 TAG_LEN, tag)) {
+                TAG_LEN, tag)) {
             BIO_printf(bio_err, "\nFailed to set tag\n");
             dofail();
             exit(1);
@@ -1046,7 +1122,7 @@ static int EVP_Update_loop_aead_dec(void *args)
         /* Set the total length of cipher text. Only required for CCM */
         if (mode_op == EVP_CIPH_CCM_MODE) {
             if (!EVP_DecryptUpdate(ctx, NULL, &outl,
-                                   NULL, lengths[testnum])) {
+                    NULL, lengths[testnum])) {
                 BIO_printf(bio_err, "\nCouldn't set cipher text length\n");
                 dofail();
                 exit(1);
@@ -1072,7 +1148,7 @@ static int EVP_Update_loop_aead_dec(void *args)
 
 static int RSA_sign_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *buf2 = tempargs->buf2;
     size_t *rsa_num = &tempargs->sigsize;
@@ -1094,7 +1170,7 @@ static int RSA_sign_loop(void *args)
 
 static int RSA_verify_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *buf2 = tempargs->buf2;
     size_t rsa_num = tempargs->sigsize;
@@ -1115,7 +1191,7 @@ static int RSA_verify_loop(void *args)
 
 static int RSA_encrypt_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *buf2 = tempargs->buf2;
     size_t *rsa_num = &tempargs->encsize;
@@ -1137,7 +1213,7 @@ static int RSA_encrypt_loop(void *args)
 
 static int RSA_decrypt_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *buf2 = tempargs->buf2;
     size_t rsa_num;
@@ -1161,7 +1237,7 @@ static int RSA_decrypt_loop(void *args)
 
 static int FFDH_derive_key_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     EVP_PKEY_CTX *ffdh_ctx = tempargs->ffdh_ctx[testnum];
     unsigned char *derived_secret = tempargs->secret_ff_a;
     int count;
@@ -1179,7 +1255,7 @@ static int FFDH_derive_key_loop(void *args)
 #ifndef OPENSSL_NO_DSA
 static int DSA_sign_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *buf2 = tempargs->buf2;
     size_t *dsa_num = &tempargs->sigsize;
@@ -1201,7 +1277,7 @@ static int DSA_sign_loop(void *args)
 
 static int DSA_verify_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *buf2 = tempargs->buf2;
     size_t dsa_num = tempargs->sigsize;
@@ -1223,7 +1299,7 @@ static int DSA_verify_loop(void *args)
 
 static int ECDSA_sign_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *buf2 = tempargs->buf2;
     size_t *ecdsa_num = &tempargs->sigsize;
@@ -1245,7 +1321,7 @@ static int ECDSA_sign_loop(void *args)
 
 static int ECDSA_verify_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     unsigned char *buf2 = tempargs->buf2;
     size_t ecdsa_num = tempargs->sigsize;
@@ -1254,7 +1330,7 @@ static int ECDSA_verify_loop(void *args)
 
     for (count = 0; COND(ecdsa_c[testnum][1]); count++) {
         ret = EVP_PKEY_verify(ecdsa_verify_ctx[testnum], buf2, ecdsa_num,
-                              buf, 20);
+            buf, 20);
         if (ret <= 0) {
             BIO_printf(bio_err, "ECDSA verify failure\n");
             dofail();
@@ -1269,7 +1345,7 @@ static int ECDSA_verify_loop(void *args)
 
 static int ECDH_EVP_derive_key_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     EVP_PKEY_CTX *ctx = tempargs->ecdh_ctx[testnum];
     unsigned char *derived_secret = tempargs->secret_a;
     int count;
@@ -1284,7 +1360,7 @@ static int ECDH_EVP_derive_key_loop(void *args)
 #ifndef OPENSSL_NO_ECX
 static int EdDSA_sign_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     EVP_MD_CTX **edctx = tempargs->eddsa_ctx;
     unsigned char *eddsasig = tempargs->buf2;
@@ -1312,7 +1388,7 @@ static int EdDSA_sign_loop(void *args)
 
 static int EdDSA_verify_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     EVP_MD_CTX **edctx = tempargs->eddsa_ctx2;
     unsigned char *eddsasig = tempargs->buf2;
@@ -1342,7 +1418,7 @@ static int EdDSA_verify_loop(void *args)
 #ifndef OPENSSL_NO_SM2
 static int SM2_sign_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     EVP_MD_CTX **sm2ctx = tempargs->sm2_ctx;
     unsigned char *sm2sig = tempargs->buf2;
@@ -1355,14 +1431,14 @@ static int SM2_sign_loop(void *args)
         sm2sigsize = max_size;
 
         if (!EVP_DigestSignInit(sm2ctx[testnum], NULL, EVP_sm3(),
-                                NULL, sm2_pkey[testnum])) {
+                NULL, sm2_pkey[testnum])) {
             BIO_printf(bio_err, "SM2 init sign failure\n");
             dofail();
             count = -1;
             break;
         }
         ret = EVP_DigestSign(sm2ctx[testnum], sm2sig, &sm2sigsize,
-                             buf, 20);
+            buf, 20);
         if (ret == 0) {
             BIO_printf(bio_err, "SM2 sign failure\n");
             dofail();
@@ -1378,7 +1454,7 @@ static int SM2_sign_loop(void *args)
 
 static int SM2_verify_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     unsigned char *buf = tempargs->buf;
     EVP_MD_CTX **sm2ctx = tempargs->sm2_vfy_ctx;
     unsigned char *sm2sig = tempargs->buf2;
@@ -1388,14 +1464,14 @@ static int SM2_verify_loop(void *args)
 
     for (count = 0; COND(sm2_c[testnum][1]); count++) {
         if (!EVP_DigestVerifyInit(sm2ctx[testnum], NULL, EVP_sm3(),
-                                  NULL, sm2_pkey[testnum])) {
+                NULL, sm2_pkey[testnum])) {
             BIO_printf(bio_err, "SM2 verify init failure\n");
             dofail();
             count = -1;
             break;
         }
         ret = EVP_DigestVerify(sm2ctx[testnum], sm2sig, sm2sigsize,
-                               buf, 20);
+            buf, 20);
         if (ret != 1) {
             BIO_printf(bio_err, "SM2 verify failure\n");
             dofail();
@@ -1405,11 +1481,11 @@ static int SM2_verify_loop(void *args)
     }
     return count;
 }
-#endif                         /* OPENSSL_NO_SM2 */
+#endif /* OPENSSL_NO_SM2 */
 
 static int KEM_keygen_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     EVP_PKEY_CTX *ctx = tempargs->kem_gen_ctx[testnum];
     EVP_PKEY *pkey = NULL;
     int count;
@@ -1432,7 +1508,7 @@ static int KEM_keygen_loop(void *args)
 
 static int KEM_encaps_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     EVP_PKEY_CTX *ctx = tempargs->kem_encaps_ctx[testnum];
     size_t out_len = tempargs->kem_out_len[testnum];
     size_t secret_len = tempargs->kem_secret_len[testnum];
@@ -1449,7 +1525,7 @@ static int KEM_encaps_loop(void *args)
 
 static int KEM_decaps_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     EVP_PKEY_CTX *ctx = tempargs->kem_decaps_ctx[testnum];
     size_t out_len = tempargs->kem_out_len[testnum];
     size_t secret_len = tempargs->kem_secret_len[testnum];
@@ -1466,7 +1542,7 @@ static int KEM_decaps_loop(void *args)
 
 static int SIG_keygen_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     EVP_PKEY_CTX *ctx = tempargs->sig_gen_ctx[testnum];
     EVP_PKEY *pkey = NULL;
     int count;
@@ -1482,11 +1558,11 @@ static int SIG_keygen_loop(void *args)
 
 static int SIG_sign_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     EVP_PKEY_CTX *ctx = tempargs->sig_sign_ctx[testnum];
     /* be sure to not change stored sig: */
     unsigned char *sig = app_malloc(tempargs->sig_max_sig_len[testnum],
-                                    "sig sign loop");
+        "sig sign loop");
     unsigned char md[SHA256_DIGEST_LENGTH] = { 0 };
     size_t md_len = SHA256_DIGEST_LENGTH;
     int count;
@@ -1508,7 +1584,7 @@ static int SIG_sign_loop(void *args)
 
 static int SIG_verify_loop(void *args)
 {
-    loopargs_t *tempargs = *(loopargs_t **) args;
+    loopargs_t *tempargs = *(loopargs_t **)args;
     EVP_PKEY_CTX *ctx = tempargs->sig_verify_ctx[testnum];
     size_t sig_len = tempargs->sig_act_sig_len[testnum];
     unsigned char *sig = tempargs->sig_sig[testnum];
@@ -1525,7 +1601,6 @@ static int SIG_verify_loop(void *args)
             count = -1;
             break;
         }
-
     }
     return count;
 }
@@ -1541,15 +1616,15 @@ static int check_block_size(EVP_CIPHER_CTX *ctx, int length)
     }
     if (length % blocksize != 0) {
         BIO_printf(bio_err,
-                   "\nRequested encryption length not a multiple of block size for %s!\n",
-                   EVP_CIPHER_get0_name(ciph));
+            "\nRequested encryption length not a multiple of block size for %s!\n",
+            EVP_CIPHER_get0_name(ciph));
         return 0;
     }
     return 1;
 }
 
 static int run_benchmark(int async_jobs,
-                         int (*loop_function) (void *), loopargs_t *loopargs)
+    int (*loop_function)(void *), loopargs_t *loopargs)
 {
     int job_op_count = 0;
     int total_op_count = 0;
@@ -1567,8 +1642,8 @@ static int run_benchmark(int async_jobs,
 
         /* Copy pointer content (looparg_t item address) into async context */
         ret = ASYNC_start_job(&loopargs[i].inprogress_job, loopargs[i].wait_ctx,
-                              &job_op_count, loop_function,
-                              (void *)&looparg_item, sizeof(looparg_item));
+            &job_op_count, loop_function,
+            (void *)&looparg_item, sizeof(looparg_item));
         switch (ret) {
         case ASYNC_PAUSE:
             ++num_inprogress;
@@ -1603,8 +1678,7 @@ static int run_benchmark(int async_jobs,
             if (loopargs[i].inprogress_job == NULL)
                 continue;
 
-            if (!ASYNC_WAIT_CTX_get_all_fds
-                (loopargs[i].wait_ctx, NULL, &num_job_fds)
+            if (!ASYNC_WAIT_CTX_get_all_fds(loopargs[i].wait_ctx, NULL, &num_job_fds)
                 || num_job_fds > 1) {
                 BIO_printf(bio_err, "Too many fds in ASYNC_WAIT_CTX\n");
                 dofail();
@@ -1612,7 +1686,7 @@ static int run_benchmark(int async_jobs,
                 break;
             }
             ASYNC_WAIT_CTX_get_all_fds(loopargs[i].wait_ctx, &job_fd,
-                                       &num_job_fds);
+                &num_job_fds);
             FD_SET(job_fd, &waitfdset);
             if (job_fd > max_fd)
                 max_fd = job_fd;
@@ -1620,9 +1694,9 @@ static int run_benchmark(int async_jobs,
 
         if (max_fd >= (OSSL_ASYNC_FD)FD_SETSIZE) {
             BIO_printf(bio_err,
-                       "Error: max_fd (%d) must be smaller than FD_SETSIZE (%d). "
-                       "Decrease the value of async_jobs\n",
-                       max_fd, FD_SETSIZE);
+                "Error: max_fd (%d) must be smaller than FD_SETSIZE (%d). "
+                "Decrease the value of async_jobs\n",
+                max_fd, FD_SETSIZE);
             dofail();
             error = 1;
             break;
@@ -1647,8 +1721,7 @@ static int run_benchmark(int async_jobs,
             if (loopargs[i].inprogress_job == NULL)
                 continue;
 
-            if (!ASYNC_WAIT_CTX_get_all_fds
-                (loopargs[i].wait_ctx, NULL, &num_job_fds)
+            if (!ASYNC_WAIT_CTX_get_all_fds(loopargs[i].wait_ctx, NULL, &num_job_fds)
                 || num_job_fds > 1) {
                 BIO_printf(bio_err, "Too many fds in ASYNC_WAIT_CTX\n");
                 dofail();
@@ -1656,7 +1729,7 @@ static int run_benchmark(int async_jobs,
                 break;
             }
             ASYNC_WAIT_CTX_get_all_fds(loopargs[i].wait_ctx, &job_fd,
-                                       &num_job_fds);
+                &num_job_fds);
 
 #if defined(OPENSSL_SYS_UNIX)
             if (num_job_fds == 1 && !FD_ISSET(job_fd, &waitfdset))
@@ -1669,9 +1742,9 @@ static int run_benchmark(int async_jobs,
 #endif
 
             ret = ASYNC_start_job(&loopargs[i].inprogress_job,
-                                  loopargs[i].wait_ctx, &job_op_count,
-                                  loop_function, (void *)(loopargs + i),
-                                  sizeof(loopargs_t));
+                loopargs[i].wait_ctx, &job_op_count,
+                loop_function, (void *)(loopargs + i),
+                sizeof(loopargs_t));
             switch (ret) {
             case ASYNC_PAUSE:
                 break;
@@ -1714,7 +1787,7 @@ static EVP_PKEY *get_ecdsa(const EC_CURVE *curve)
     /* Ensure that the error queue is empty */
     if (ERR_peek_error()) {
         BIO_printf(bio_err,
-                   "WARNING: the error queue contains previous unhandled errors.\n");
+            "WARNING: the error queue contains previous unhandled errors.\n");
         dofail();
     }
 
@@ -1746,7 +1819,7 @@ static EVP_PKEY *get_ecdsa(const EC_CURVE *curve)
             ERR_get_error(); /* pop error from queue */
         if (ERR_peek_error()) {
             BIO_printf(bio_err,
-                       "Unhandled error in the error queue during EC key setup.\n");
+                "Unhandled error in the error queue during EC key setup.\n");
             dofail();
             return NULL;
         }
@@ -1755,7 +1828,8 @@ static EVP_PKEY *get_ecdsa(const EC_CURVE *curve)
         if ((pctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL)) == NULL
             || EVP_PKEY_paramgen_init(pctx) <= 0
             || EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx,
-                                                      curve->nid) <= 0
+                   curve->nid)
+                <= 0
             || EVP_PKEY_paramgen(pctx, &params) <= 0) {
             BIO_printf(bio_err, "EC params init failure.\n");
             dofail();
@@ -1779,25 +1853,25 @@ static EVP_PKEY *get_ecdsa(const EC_CURVE *curve)
     return key;
 }
 
-#define stop_it(do_it, test_num)\
+#define stop_it(do_it, test_num) \
     memset(do_it + test_num, 0, OSSL_NELEM(do_it) - test_num);
 
 /* Checks to see if algorithms are fetchable */
-#define IS_FETCHABLE(type, TYPE)                                \
-    static int is_ ## type ## _fetchable(const TYPE *alg)       \
-    {                                                           \
-        TYPE *impl;                                             \
-        const char *propq = app_get0_propq();                   \
-        OSSL_LIB_CTX *libctx = app_get0_libctx();               \
-        const char *name = TYPE ## _get0_name(alg);             \
-                                                                \
-        ERR_set_mark();                                         \
-        impl = TYPE ## _fetch(libctx, name, propq);             \
-        ERR_pop_to_mark();                                      \
-        if (impl == NULL)                                       \
-            return 0;                                           \
-        TYPE ## _free(impl);                                    \
-        return 1;                                               \
+#define IS_FETCHABLE(type, TYPE)                      \
+    static int is_##type##_fetchable(const TYPE *alg) \
+    {                                                 \
+        TYPE *impl;                                   \
+        const char *propq = app_get0_propq();         \
+        OSSL_LIB_CTX *libctx = app_get0_libctx();     \
+        const char *name = TYPE##_get0_name(alg);     \
+                                                      \
+        ERR_set_mark();                               \
+        impl = TYPE##_fetch(libctx, name, propq);     \
+        ERR_pop_to_mark();                            \
+        if (impl == NULL)                             \
+            return 0;                                 \
+        TYPE##_free(impl);                            \
+        return 1;                                     \
     }
 
 IS_FETCHABLE(signature, EVP_SIGNATURE)
@@ -1805,11 +1879,11 @@ IS_FETCHABLE(kem, EVP_KEM)
 
 DEFINE_STACK_OF(EVP_KEM)
 
-static int kems_cmp(const EVP_KEM * const *a,
-                    const EVP_KEM * const *b)
+static int kems_cmp(const EVP_KEM *const *a,
+    const EVP_KEM *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_KEM_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_KEM_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_KEM_get0_provider(*b)));
 }
 
 static void collect_kem(EVP_KEM *kem, void *stack)
@@ -1817,8 +1891,8 @@ static void collect_kem(EVP_KEM *kem, void *stack)
     STACK_OF(EVP_KEM) *kem_stack = stack;
 
     if (is_kem_fetchable(kem)
-            && EVP_KEM_up_ref(kem)
-            && sk_EVP_KEM_push(kem_stack, kem) <= 0)
+        && EVP_KEM_up_ref(kem)
+        && sk_EVP_KEM_push(kem_stack, kem) <= 0)
         EVP_KEM_free(kem); /* up-ref successful but push to stack failed */
 }
 
@@ -1837,11 +1911,11 @@ static int kem_locate(const char *algo, unsigned int *idx)
 
 DEFINE_STACK_OF(EVP_SIGNATURE)
 
-static int signatures_cmp(const EVP_SIGNATURE * const *a,
-                          const EVP_SIGNATURE * const *b)
+static int signatures_cmp(const EVP_SIGNATURE *const *a,
+    const EVP_SIGNATURE *const *b)
 {
     return strcmp(OSSL_PROVIDER_get0_name(EVP_SIGNATURE_get0_provider(*a)),
-                  OSSL_PROVIDER_get0_name(EVP_SIGNATURE_get0_provider(*b)));
+        OSSL_PROVIDER_get0_name(EVP_SIGNATURE_get0_provider(*b)));
 }
 
 static void collect_signatures(EVP_SIGNATURE *sig, void *stack)
@@ -1849,8 +1923,8 @@ static void collect_signatures(EVP_SIGNATURE *sig, void *stack)
     STACK_OF(EVP_SIGNATURE) *sig_stack = stack;
 
     if (is_signature_fetchable(sig)
-            && EVP_SIGNATURE_up_ref(sig)
-            && sk_EVP_SIGNATURE_push(sig_stack, sig) <= 0)
+        && EVP_SIGNATURE_up_ref(sig)
+        && sk_EVP_SIGNATURE_push(sig_stack, sig) <= 0)
         EVP_SIGNATURE_free(sig); /* up-ref successful but push to stack failed */
 }
 
@@ -1867,12 +1941,14 @@ static int sig_locate(const char *algo, unsigned int *idx)
     return 0;
 }
 
-static int get_max(const uint8_t doit[], size_t algs_len) {
+static int get_max(const uint8_t doit[], size_t algs_len)
+{
     size_t i = 0;
     int maxcnt = 0;
 
     for (i = 0; i < algs_len; i++)
-        if (maxcnt < doit[i]) maxcnt = doit[i];
+        if (maxcnt < doit[i])
+            maxcnt = doit[i];
     return maxcnt;
 }
 
@@ -1906,10 +1982,10 @@ int speed_main(int argc, char **argv)
 #endif
     long op_count = 1;
     openssl_speed_sec_t seconds = { SECONDS, RSA_SECONDS, DSA_SECONDS,
-                                    ECDSA_SECONDS, ECDH_SECONDS,
-                                    EdDSA_SECONDS, SM2_SECONDS,
-                                    FFDH_SECONDS, KEM_SECONDS,
-                                    SIG_SECONDS };
+        ECDSA_SECONDS, ECDH_SECONDS,
+        EdDSA_SECONDS, SM2_SECONDS,
+        FFDH_SECONDS, KEM_SECONDS,
+        SIG_SECONDS };
 
     static const unsigned char key32[32] = {
         0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0,
@@ -1920,19 +1996,19 @@ int speed_main(int argc, char **argv)
     static const unsigned char deskey[] = {
         0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, /* key1 */
         0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12, /* key2 */
-        0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12, 0x34  /* key3 */
+        0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12, 0x34 /* key3 */
     };
     static const struct {
         const unsigned char *data;
         unsigned int length;
         unsigned int bits;
     } rsa_keys[] = {
-        {   test512,   sizeof(test512),   512 },
-        {  test1024,  sizeof(test1024),  1024 },
-        {  test2048,  sizeof(test2048),  2048 },
-        {  test3072,  sizeof(test3072),  3072 },
-        {  test4096,  sizeof(test4096),  4096 },
-        {  test7680,  sizeof(test7680),  7680 },
+        { test512, sizeof(test512), 512 },
+        { test1024, sizeof(test1024), 1024 },
+        { test2048, sizeof(test2048), 2048 },
+        { test3072, sizeof(test3072), 3072 },
+        { test4096, sizeof(test4096), 4096 },
+        { test7680, sizeof(test7680), 7680 },
         { test15360, sizeof(test15360), 15360 }
     };
     uint8_t rsa_doit[RSA_NUM] = { 0 };
@@ -1945,11 +2021,11 @@ int speed_main(int argc, char **argv)
     } FFDH_PARAMS;
 
     static const FFDH_PARAMS ffdh_params[FFDH_NUM] = {
-        {"ffdh2048", NID_ffdhe2048, 2048},
-        {"ffdh3072", NID_ffdhe3072, 3072},
-        {"ffdh4096", NID_ffdhe4096, 4096},
-        {"ffdh6144", NID_ffdhe6144, 6144},
-        {"ffdh8192", NID_ffdhe8192, 8192}
+        { "ffdh2048", NID_ffdhe2048, 2048 },
+        { "ffdh3072", NID_ffdhe3072, 3072 },
+        { "ffdh4096", NID_ffdhe4096, 4096 },
+        { "ffdh6144", NID_ffdhe6144, 6144 },
+        { "ffdh8192", NID_ffdhe8192, 8192 }
     };
     uint8_t ffdh_doit[FFDH_NUM] = { 0 };
 
@@ -1966,48 +2042,48 @@ int speed_main(int argc, char **argv)
      */
     static const EC_CURVE ec_curves[EC_NUM] = {
         /* Prime Curves */
-        {"secp160r1", NID_secp160r1, 160},
-        {"nistp192", NID_X9_62_prime192v1, 192},
-        {"nistp224", NID_secp224r1, 224},
-        {"nistp256", NID_X9_62_prime256v1, 256},
-        {"nistp384", NID_secp384r1, 384},
-        {"nistp521", NID_secp521r1, 521},
+        { "secp160r1", NID_secp160r1, 160 },
+        { "nistp192", NID_X9_62_prime192v1, 192 },
+        { "nistp224", NID_secp224r1, 224 },
+        { "nistp256", NID_X9_62_prime256v1, 256 },
+        { "nistp384", NID_secp384r1, 384 },
+        { "nistp521", NID_secp521r1, 521 },
 #ifndef OPENSSL_NO_EC2M
         /* Binary Curves */
-        {"nistk163", NID_sect163k1, 163},
-        {"nistk233", NID_sect233k1, 233},
-        {"nistk283", NID_sect283k1, 283},
-        {"nistk409", NID_sect409k1, 409},
-        {"nistk571", NID_sect571k1, 571},
-        {"nistb163", NID_sect163r2, 163},
-        {"nistb233", NID_sect233r1, 233},
-        {"nistb283", NID_sect283r1, 283},
-        {"nistb409", NID_sect409r1, 409},
-        {"nistb571", NID_sect571r1, 571},
+        { "nistk163", NID_sect163k1, 163 },
+        { "nistk233", NID_sect233k1, 233 },
+        { "nistk283", NID_sect283k1, 283 },
+        { "nistk409", NID_sect409k1, 409 },
+        { "nistk571", NID_sect571k1, 571 },
+        { "nistb163", NID_sect163r2, 163 },
+        { "nistb233", NID_sect233r1, 233 },
+        { "nistb283", NID_sect283r1, 283 },
+        { "nistb409", NID_sect409r1, 409 },
+        { "nistb571", NID_sect571r1, 571 },
 #endif
-        {"brainpoolP256r1", NID_brainpoolP256r1, 256},
-        {"brainpoolP256t1", NID_brainpoolP256t1, 256},
-        {"brainpoolP384r1", NID_brainpoolP384r1, 384},
-        {"brainpoolP384t1", NID_brainpoolP384t1, 384},
-        {"brainpoolP512r1", NID_brainpoolP512r1, 512},
-        {"brainpoolP512t1", NID_brainpoolP512t1, 512},
+        { "brainpoolP256r1", NID_brainpoolP256r1, 256 },
+        { "brainpoolP256t1", NID_brainpoolP256t1, 256 },
+        { "brainpoolP384r1", NID_brainpoolP384r1, 384 },
+        { "brainpoolP384t1", NID_brainpoolP384t1, 384 },
+        { "brainpoolP512r1", NID_brainpoolP512r1, 512 },
+        { "brainpoolP512t1", NID_brainpoolP512t1, 512 },
 #ifndef OPENSSL_NO_ECX
         /* Other and ECDH only ones */
-        {"X25519", NID_X25519, 253},
-        {"X448", NID_X448, 448}
+        { "X25519", NID_X25519, 253 },
+        { "X448", NID_X448, 448 }
 #endif
     };
 #ifndef OPENSSL_NO_ECX
     static const EC_CURVE ed_curves[EdDSA_NUM] = {
         /* EdDSA */
-        {"Ed25519", NID_ED25519, 253, 64},
-        {"Ed448", NID_ED448, 456, 114}
+        { "Ed25519", NID_ED25519, 253, 64 },
+        { "Ed448", NID_ED448, 456, 114 }
     };
 #endif /* OPENSSL_NO_ECX */
 #ifndef OPENSSL_NO_SM2
     static const EC_CURVE sm2_curves[SM2_NUM] = {
         /* SM2 */
-        {"CurveSM2", NID_sm2, 256}
+        { "CurveSM2", NID_sm2, 256 }
     };
     uint8_t sm2_doit[SM2_NUM] = { 0 };
 #endif
@@ -2045,7 +2121,7 @@ int speed_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opterr:
+        opterr:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -2068,8 +2144,8 @@ int speed_main(int argc, char **argv)
             if (evp_cipher == NULL && evp_md_name == NULL) {
                 ERR_clear_last_mark();
                 BIO_printf(bio_err,
-                           "%s: %s is an unknown cipher or digest\n",
-                           prog, opt_arg());
+                    "%s: %s is an unknown cipher or digest\n",
+                    prog, opt_arg());
                 goto end;
             }
             ERR_pop_to_mark();
@@ -2078,7 +2154,7 @@ int speed_main(int argc, char **argv)
         case OPT_HMAC:
             if (!have_md(opt_arg())) {
                 BIO_printf(bio_err, "%s: %s is an unknown digest\n",
-                           prog, opt_arg());
+                    prog, opt_arg());
                 goto end;
             }
             evp_mac_mdname = opt_arg();
@@ -2087,7 +2163,7 @@ int speed_main(int argc, char **argv)
         case OPT_CMAC:
             if (!have_cipher(opt_arg())) {
                 BIO_printf(bio_err, "%s: %s is an unknown cipher\n",
-                           prog, opt_arg());
+                    prog, opt_arg());
                 goto end;
             }
             evp_mac_ciphername = opt_arg();
@@ -2122,8 +2198,8 @@ int speed_main(int argc, char **argv)
             }
             if (!ASYNC_is_capable()) {
                 BIO_printf(bio_err,
-                           "%s: async_jobs specified but async not supported\n",
-                           prog);
+                    "%s: async_jobs specified but async not supported\n",
+                    prog);
                 if (testmode)
                     /* Return success in the testmode. */
                     return 0;
@@ -2135,7 +2211,7 @@ int speed_main(int argc, char **argv)
             misalign = opt_int_arg();
             if (misalign > MISALIGN) {
                 BIO_printf(bio_err,
-                           "%s: Maximum offset is %d\n", prog, MISALIGN);
+                    "%s: Maximum offset is %d\n", prog, MISALIGN);
                 goto opterr;
             }
             break;
@@ -2146,8 +2222,8 @@ int speed_main(int argc, char **argv)
             multiblock = 1;
 #ifdef OPENSSL_NO_MULTIBLOCK
             BIO_printf(bio_err,
-                       "%s: -mb specified but multi-block support is disabled\n",
-                       prog);
+                "%s: -mb specified but multi-block support is disabled\n",
+                prog);
             goto end;
 #endif
             break;
@@ -2169,9 +2245,9 @@ int speed_main(int argc, char **argv)
             break;
         case OPT_SECONDS:
             seconds.sym = seconds.rsa = seconds.dsa = seconds.ecdsa
-                        = seconds.ecdh = seconds.eddsa
-                        = seconds.sm2 = seconds.ffdh
-                        = seconds.kem = seconds.sig = opt_int_arg();
+                = seconds.ecdh = seconds.eddsa
+                = seconds.sm2 = seconds.ffdh
+                = seconds.kem = seconds.sig = opt_int_arg();
             break;
         case OPT_BYTES:
             lengths_single = opt_int_arg();
@@ -2191,8 +2267,8 @@ int speed_main(int argc, char **argv)
             domlock = 1;
 #if !defined(_WIN32) && !defined(OPENSSL_SYS_LINUX)
             BIO_printf(bio_err,
-                       "%s: -mlock not supported on this platform\n",
-                       prog);
+                "%s: -mlock not supported on this platform\n",
+                prog);
             goto end;
 #endif
             break;
@@ -2214,7 +2290,7 @@ int speed_main(int argc, char **argv)
         if (strcmp(EVP_KEM_get0_name(kem), "RSA") == 0) {
             if (kems_algs_len + OSSL_NELEM(rsa_choices) >= MAX_KEM_NUM) {
                 BIO_printf(bio_err,
-                           "Too many KEMs registered. Change MAX_KEM_NUM.\n");
+                    "Too many KEMs registered. Change MAX_KEM_NUM.\n");
                 goto end;
             }
             for (i = 0; i < OSSL_NELEM(rsa_choices); i++) {
@@ -2224,7 +2300,7 @@ int speed_main(int argc, char **argv)
         } else if (strcmp(EVP_KEM_get0_name(kem), "EC") == 0) {
             if (kems_algs_len + 3 >= MAX_KEM_NUM) {
                 BIO_printf(bio_err,
-                           "Too many KEMs registered. Change MAX_KEM_NUM.\n");
+                    "Too many KEMs registered. Change MAX_KEM_NUM.\n");
                 goto end;
             }
             kems_doit[kems_algs_len] = 1;
@@ -2236,7 +2312,7 @@ int speed_main(int argc, char **argv)
         } else {
             if (kems_algs_len + 1 >= MAX_KEM_NUM) {
                 BIO_printf(bio_err,
-                           "Too many KEMs registered. Change MAX_KEM_NUM.\n");
+                    "Too many KEMs registered. Change MAX_KEM_NUM.\n");
                 goto end;
             }
             kems_doit[kems_algs_len] = 1;
@@ -2259,7 +2335,7 @@ int speed_main(int argc, char **argv)
         if (strcmp(sig_name, "RSA") == 0) {
             if (sigs_algs_len + OSSL_NELEM(rsa_choices) >= MAX_SIG_NUM) {
                 BIO_printf(bio_err,
-                           "Too many signatures registered. Change MAX_SIG_NUM.\n");
+                    "Too many signatures registered. Change MAX_SIG_NUM.\n");
                 goto end;
             }
             for (i = 0; i < OSSL_NELEM(rsa_choices); i++) {
@@ -2271,7 +2347,7 @@ int speed_main(int argc, char **argv)
         else if (strcmp(sig_name, "DSA") == 0) {
             if (sigs_algs_len + DSA_NUM >= MAX_SIG_NUM) {
                 BIO_printf(bio_err,
-                           "Too many signatures registered. Change MAX_SIG_NUM.\n");
+                    "Too many signatures registered. Change MAX_SIG_NUM.\n");
                 goto end;
             }
             for (i = 0; i < DSA_NUM; i++) {
@@ -2281,17 +2357,10 @@ int speed_main(int argc, char **argv)
         }
 #endif /* OPENSSL_NO_DSA */
         /* skipping these algs as tested elsewhere - and b/o setup is a pain */
-        else if (strcmp(sig_name, "ED25519") &&
-                 strcmp(sig_name, "ED448") &&
-                 strcmp(sig_name, "ECDSA") &&
-                 strcmp(sig_name, "HMAC") &&
-                 strcmp(sig_name, "SIPHASH") &&
-                 strcmp(sig_name, "POLY1305") &&
-                 strcmp(sig_name, "CMAC") &&
-                 strcmp(sig_name, "SM2")) { /* skip alg */
+        else if (strncmp(sig_name, "RSA", 3) && strncmp(sig_name, "DSA", 3) && strncmp(sig_name, "ED25519", 7) && strncmp(sig_name, "ED448", 5) && strncmp(sig_name, "ECDSA", 5) && strcmp(sig_name, "HMAC") && strcmp(sig_name, "SIPHASH") && strcmp(sig_name, "POLY1305") && strcmp(sig_name, "CMAC") && strcmp(sig_name, "SM2")) { /* skip alg */
             if (sigs_algs_len + 1 >= MAX_SIG_NUM) {
                 BIO_printf(bio_err,
-                           "Too many signatures registered. Change MAX_SIG_NUM.\n");
+                    "Too many signatures registered. Change MAX_SIG_NUM.\n");
                 goto end;
             }
             /* activate this provider algorithm */
@@ -2441,10 +2510,9 @@ int speed_main(int argc, char **argv)
         if (evp_cipher == NULL) {
             BIO_printf(bio_err, "-aead can be used only with an AEAD cipher\n");
             goto end;
-        } else if (!(EVP_CIPHER_get_flags(evp_cipher) &
-                     EVP_CIPH_FLAG_AEAD_CIPHER)) {
+        } else if (!(EVP_CIPHER_get_flags(evp_cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)) {
             BIO_printf(bio_err, "%s is not an AEAD cipher\n",
-                       EVP_CIPHER_get0_name(evp_cipher));
+                EVP_CIPHER_get0_name(evp_cipher));
             goto end;
         }
     }
@@ -2475,10 +2543,9 @@ int speed_main(int argc, char **argv)
             BIO_printf(bio_err, "-mb can be used only with a multi-block"
                                 " capable cipher\n");
             goto end;
-        } else if (!(EVP_CIPHER_get_flags(evp_cipher) &
-                     EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
+        } else if (!(EVP_CIPHER_get_flags(evp_cipher) & EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
             BIO_printf(bio_err, "%s is not a multi-block capable\n",
-                       EVP_CIPHER_get0_name(evp_cipher));
+                EVP_CIPHER_get0_name(evp_cipher));
             goto end;
         } else if (async_jobs > 0) {
             BIO_printf(bio_err, "Async mode is not supported with -mb");
@@ -2496,12 +2563,11 @@ int speed_main(int argc, char **argv)
     }
 
     loopargs_len = (async_jobs == 0 ? 1 : async_jobs);
-    loopargs =
-        app_malloc(loopargs_len * sizeof(loopargs_t), "array of loopargs");
+    loopargs = app_malloc(loopargs_len * sizeof(loopargs_t), "array of loopargs");
     memset(loopargs, 0, loopargs_len * sizeof(loopargs_t));
 
     buflen = lengths[size_num - 1];
-    if (buflen < 36)    /* size of random vector in RSA benchmark */
+    if (buflen < 36) /* size of random vector in RSA benchmark */
         buflen = 36;
     if (INT_MAX - (MAX_MISALIGNMENT + 1) < buflen) {
         BIO_printf(bio_err, "Error: buffer size too large\n");
@@ -2570,14 +2636,16 @@ int speed_main(int argc, char **argv)
                 doit[i] = 0;
         }
         if ((mac = EVP_MAC_fetch(app_get0_libctx(), "GMAC",
-                                 app_get0_propq())) != NULL) {
+                 app_get0_propq()))
+            != NULL) {
             EVP_MAC_free(mac);
             mac = NULL;
         } else {
             doit[D_GHASH] = 0;
         }
         if ((mac = EVP_MAC_fetch(app_get0_libctx(), "HMAC",
-                                 app_get0_propq())) != NULL) {
+                 app_get0_propq()))
+            != NULL) {
             EVP_MAC_free(mac);
             mac = NULL;
         } else {
@@ -2610,8 +2678,8 @@ int speed_main(int argc, char **argv)
 
     if (usertime == 0 && !mr)
         BIO_printf(bio_err,
-                   "You have chosen to measure elapsed time "
-                   "instead of user CPU time.\n");
+            "You have chosen to measure elapsed time "
+            "instead of user CPU time.\n");
 
 #if SIGALRM > 0
     signal(SIGALRM, alarmed);
@@ -2737,12 +2805,10 @@ int speed_main(int argc, char **argv)
         BIO_snprintf(evp_hmac_name, hmac_name_len, "hmac(%s)", evp_mac_mdname);
         names[D_HMAC] = evp_hmac_name;
 
-        params[0] =
-            OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
-                                             evp_mac_mdname, 0);
-        params[1] =
-            OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
-                                              (char *)hmac_key, len);
+        params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
+            evp_mac_mdname, 0);
+        params[1] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
+            (char *)hmac_key, len);
         params[2] = OSSL_PARAM_construct_end();
 
         if (mac_setup("HMAC", &mac, params, loopargs, loopargs_len) < 1)
@@ -2764,7 +2830,7 @@ int speed_main(int argc, char **argv)
 
         for (i = 0; st && i < loopargs_len; i++) {
             loopargs[i].ctx = init_evp_cipher_ctx("des-cbc", deskey,
-                                                  sizeof(deskey) / 3);
+                sizeof(deskey) / 3);
             st = loopargs[i].ctx != NULL;
         }
         algindex = D_CBC_DES;
@@ -2786,7 +2852,7 @@ int speed_main(int argc, char **argv)
 
         for (i = 0; st && i < loopargs_len; i++) {
             loopargs[i].ctx = init_evp_cipher_ctx("des-ede3-cbc", deskey,
-                                                  sizeof(deskey));
+                sizeof(deskey));
             st = loopargs[i].ctx != NULL;
         }
         algindex = D_EDE3_DES;
@@ -2795,8 +2861,7 @@ int speed_main(int argc, char **argv)
                 break;
             print_message(names[D_EDE3_DES], lengths[testnum], seconds.sym);
             Time_F(START);
-            count =
-                run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
+            count = run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
             d = Time_F(STOP);
             print_result(D_EDE3_DES, testnum, count, d);
         }
@@ -2812,7 +2877,7 @@ int speed_main(int argc, char **argv)
             keylen = 16 + k * 8;
             for (i = 0; st && i < loopargs_len; i++) {
                 loopargs[i].ctx = init_evp_cipher_ctx(names[algindex],
-                                                      key32, keylen);
+                    key32, keylen);
                 st = loopargs[i].ctx != NULL;
             }
 
@@ -2821,8 +2886,7 @@ int speed_main(int argc, char **argv)
                     break;
                 print_message(names[algindex], lengths[testnum], seconds.sym);
                 Time_F(START);
-                count =
-                    run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
+                count = run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
                 d = Time_F(STOP);
                 print_result(algindex, testnum, count, d);
             }
@@ -2839,7 +2903,7 @@ int speed_main(int argc, char **argv)
             keylen = 16 + k * 8;
             for (i = 0; st && i < loopargs_len; i++) {
                 loopargs[i].ctx = init_evp_cipher_ctx(names[algindex],
-                                                      key32, keylen);
+                    key32, keylen);
                 st = loopargs[i].ctx != NULL;
             }
 
@@ -2848,8 +2912,7 @@ int speed_main(int argc, char **argv)
                     break;
                 print_message(names[algindex], lengths[testnum], seconds.sym);
                 Time_F(START);
-                count =
-                    run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
+                count = run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
                 d = Time_F(STOP);
                 print_result(algindex, testnum, count, d);
             }
@@ -2865,7 +2928,7 @@ int speed_main(int argc, char **argv)
             keylen = 16;
             for (i = 0; st && i < loopargs_len; i++) {
                 loopargs[i].ctx = init_evp_cipher_ctx(names[algindex],
-                                                      key32, keylen);
+                    key32, keylen);
                 st = loopargs[i].ctx != NULL;
             }
 
@@ -2874,8 +2937,7 @@ int speed_main(int argc, char **argv)
                     break;
                 print_message(names[algindex], lengths[testnum], seconds.sym);
                 Time_F(START);
-                count =
-                    run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
+                count = run_benchmark(async_jobs, EVP_Cipher_loop, loopargs);
                 d = Time_F(STOP);
                 print_result(algindex, testnum, count, d);
             }
@@ -2888,12 +2950,12 @@ int speed_main(int argc, char **argv)
         OSSL_PARAM params[4];
 
         params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_CIPHER,
-                                                     "aes-128-gcm", 0);
+            "aes-128-gcm", 0);
         params[1] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_IV,
-                                                      (char *)gmac_iv,
-                                                      sizeof(gmac_iv) - 1);
+            (char *)gmac_iv,
+            sizeof(gmac_iv) - 1);
         params[2] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
-                                                      (void *)key32, 16);
+            (void *)key32, 16);
         params[3] = OSSL_PARAM_construct_end();
 
         if (mac_setup("GMAC", &mac, params, loopargs, loopargs_len) < 1)
@@ -2933,12 +2995,11 @@ int speed_main(int argc, char **argv)
      */
     if (doit[D_EVP]) {
         if (evp_cipher != NULL) {
-            int (*loopfunc) (void *);
+            int (*loopfunc)(void *);
             int outlen = 0;
             unsigned int ae_mode = 0;
 
-            if (multiblock && (EVP_CIPHER_get_flags(evp_cipher)
-                               & EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
+            if (multiblock && (EVP_CIPHER_get_flags(evp_cipher) & EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
                 multiblock_speed(evp_cipher, lengths_single, &seconds);
                 ret = 0;
                 goto end;
@@ -2985,7 +3046,7 @@ int speed_main(int argc, char **argv)
                      * authenticity and hence decryption will fail.
                      */
                     if (!EVP_CipherInit_ex(loopargs[k].ctx, evp_cipher, NULL,
-                                           NULL, NULL, ae_mode ? 1 : !decrypt)) {
+                            NULL, NULL, ae_mode ? 1 : !decrypt)) {
                         BIO_printf(bio_err, "\nCouldn't init the context\n");
                         dofail();
                         exit(1);
@@ -3000,22 +3061,22 @@ int speed_main(int argc, char **argv)
 
                     if (!ae_mode) {
                         if (!EVP_CipherInit_ex(loopargs[k].ctx, NULL, NULL,
-                                               loopargs[k].key, iv, -1)) {
+                                loopargs[k].key, iv, -1)) {
                             BIO_printf(bio_err, "\nFailed to set the key\n");
                             dofail();
                             exit(1);
                         }
                     } else if (mode_op == EVP_CIPH_SIV_MODE
-                               || mode_op == EVP_CIPH_GCM_SIV_MODE) {
+                        || mode_op == EVP_CIPH_GCM_SIV_MODE) {
                         EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
-                                            EVP_CTRL_SET_SPEED, 1, NULL);
+                            EVP_CTRL_SET_SPEED, 1, NULL);
                     }
                     if (ae_mode && decrypt) {
                         /* Set length of iv (Doesn't apply to SIV mode) */
                         if (mode_op != EVP_CIPH_SIV_MODE) {
                             if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
-                                                     EVP_CTRL_AEAD_SET_IVLEN,
-                                                     sizeof(aead_iv), NULL)) {
+                                    EVP_CTRL_AEAD_SET_IVLEN,
+                                    sizeof(aead_iv), NULL)) {
                                 BIO_printf(bio_err, "\nFailed to set iv length\n");
                                 dofail();
                                 exit(1);
@@ -3026,16 +3087,16 @@ int speed_main(int argc, char **argv)
                             && mode_op != EVP_CIPH_SIV_MODE
                             && mode_op != EVP_CIPH_GCM_SIV_MODE) {
                             if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
-                                                     EVP_CTRL_AEAD_SET_TAG,
-                                                     TAG_LEN, NULL)) {
+                                    EVP_CTRL_AEAD_SET_TAG,
+                                    TAG_LEN, NULL)) {
                                 BIO_printf(bio_err,
-                                           "\nFailed to set tag length\n");
+                                    "\nFailed to set tag length\n");
                                 dofail();
                                 exit(1);
                             }
                         }
                         if (!EVP_CipherInit_ex(loopargs[k].ctx, NULL, NULL,
-                                               loopargs[k].key, aead_iv, -1)) {
+                                loopargs[k].key, aead_iv, -1)) {
                             BIO_printf(bio_err, "\nFailed to set the key\n");
                             dofail();
                             exit(1);
@@ -3043,42 +3104,42 @@ int speed_main(int argc, char **argv)
                         /* Set total length of input. Only required for CCM */
                         if (mode_op == EVP_CIPH_CCM_MODE) {
                             if (!EVP_EncryptUpdate(loopargs[k].ctx, NULL,
-                                                   &outlen, NULL,
-                                                   lengths[testnum])) {
+                                    &outlen, NULL,
+                                    lengths[testnum])) {
                                 BIO_printf(bio_err,
-                                           "\nCouldn't set input text length\n");
+                                    "\nCouldn't set input text length\n");
                                 dofail();
                                 exit(1);
                             }
                         }
                         if (aead) {
                             if (!EVP_EncryptUpdate(loopargs[k].ctx, NULL,
-                                                   &outlen, aad, sizeof(aad))) {
+                                    &outlen, aad, sizeof(aad))) {
                                 BIO_printf(bio_err,
-                                           "\nCouldn't insert AAD when encrypting\n");
+                                    "\nCouldn't insert AAD when encrypting\n");
                                 dofail();
                                 exit(1);
                             }
                         }
                         if (!EVP_EncryptUpdate(loopargs[k].ctx, loopargs[k].buf,
-                                               &outlen, loopargs[k].buf,
-                                               lengths[testnum])) {
+                                &outlen, loopargs[k].buf,
+                                lengths[testnum])) {
                             BIO_printf(bio_err,
-                                       "\nFailed to to encrypt the data\n");
+                                "\nFailed to to encrypt the data\n");
                             dofail();
                             exit(1);
                         }
 
                         if (!EVP_EncryptFinal_ex(loopargs[k].ctx,
-                                                 loopargs[k].buf, &outlen)) {
+                                loopargs[k].buf, &outlen)) {
                             BIO_printf(bio_err,
-                                       "\nFailed finalize the encryption\n");
+                                "\nFailed finalize the encryption\n");
                             dofail();
                             exit(1);
                         }
 
                         if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx, EVP_CTRL_AEAD_GET_TAG,
-                                                 TAG_LEN, &loopargs[k].tag)) {
+                                TAG_LEN, &loopargs[k].tag)) {
                             BIO_printf(bio_err, "\nFailed to get the tag\n");
                             dofail();
                             exit(1);
@@ -3088,13 +3149,13 @@ int speed_main(int argc, char **argv)
                         loopargs[k].ctx = EVP_CIPHER_CTX_new();
                         if (loopargs[k].ctx == NULL) {
                             BIO_printf(bio_err,
-                                       "\nEVP_CIPHER_CTX_new failure\n");
+                                "\nEVP_CIPHER_CTX_new failure\n");
                             exit(1);
                         }
                         if (!EVP_CipherInit_ex(loopargs[k].ctx, evp_cipher,
-                                               NULL, NULL, NULL, 0)) {
+                                NULL, NULL, NULL, 0)) {
                             BIO_printf(bio_err,
-                                       "\nFailed initializing the context\n");
+                                "\nFailed initializing the context\n");
                             dofail();
                             exit(1);
                         }
@@ -3105,7 +3166,7 @@ int speed_main(int argc, char **argv)
                         if (mode_op == EVP_CIPH_SIV_MODE
                             || mode_op == EVP_CIPH_GCM_SIV_MODE)
                             EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
-                                                EVP_CTRL_SET_SPEED, 1, NULL);
+                                EVP_CTRL_SET_SPEED, 1, NULL);
                     }
                 }
 
@@ -3152,9 +3213,9 @@ int speed_main(int argc, char **argv)
         names[D_EVP_CMAC] = evp_cmac_name;
 
         params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_CIPHER,
-                                                     evp_mac_ciphername, 0);
+            evp_mac_ciphername, 0);
         params[1] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
-                                                      (char *)key32, keylen);
+            (char *)key32, keylen);
         params[2] = OSSL_PARAM_construct_end();
 
         if (mac_setup("CMAC", &mac, params, loopargs, loopargs_len) < 1)
@@ -3175,7 +3236,7 @@ int speed_main(int argc, char **argv)
         OSSL_PARAM params[2];
 
         params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
-                                                      (void *)key32, 16);
+            (void *)key32, 16);
         params[1] = OSSL_PARAM_construct_end();
 
         if (mac_setup("KMAC-128", &mac, params, loopargs, loopargs_len) < 1)
@@ -3196,7 +3257,7 @@ int speed_main(int argc, char **argv)
         OSSL_PARAM params[2];
 
         params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
-                                                      (void *)key32, 32);
+            (void *)key32, 32);
         params[1] = OSSL_PARAM_construct_end();
 
         if (mac_setup("KMAC-256", &mac, params, loopargs, loopargs_len) < 1)
@@ -3242,7 +3303,8 @@ int speed_main(int argc, char **argv)
             const unsigned char *p = rsa_keys[testnum].data;
 
             st = (rsa_key = d2i_PrivateKey(EVP_PKEY_RSA, NULL, &p,
-                                           rsa_keys[testnum].length)) != NULL;
+                      rsa_keys[testnum].length))
+                != NULL;
         }
 
         for (i = 0; st && i < loopargs_len; i++) {
@@ -3251,57 +3313,59 @@ int speed_main(int argc, char **argv)
             if (loopargs[i].rsa_sign_ctx[testnum] == NULL
                 || EVP_PKEY_sign_init(loopargs[i].rsa_sign_ctx[testnum]) <= 0
                 || EVP_PKEY_sign(loopargs[i].rsa_sign_ctx[testnum],
-                                 loopargs[i].buf2,
-                                 &loopargs[i].sigsize,
-                                 loopargs[i].buf, 36) <= 0)
+                       loopargs[i].buf2,
+                       &loopargs[i].sigsize,
+                       loopargs[i].buf, 36)
+                    <= 0)
                 st = 0;
         }
         if (!st) {
             BIO_printf(bio_err,
-                       "RSA sign setup failure.  No RSA sign will be done.\n");
+                "RSA sign setup failure.  No RSA sign will be done.\n");
             dofail();
             op_count = 1;
         } else {
             pkey_print_message("private", "rsa sign",
-                               rsa_keys[testnum].bits, seconds.rsa);
+                rsa_keys[testnum].bits, seconds.rsa);
             /* RSA_blinding_on(rsa_key[testnum],NULL); */
             Time_F(START);
             count = run_benchmark(async_jobs, RSA_sign_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R1:%ld:%d:%.2f\n"
-                       : "%ld %u bits private RSA sign ops in %.2fs\n",
-                       count, rsa_keys[testnum].bits, d);
+                mr ? "+R1:%ld:%d:%.2f\n"
+                   : "%ld %u bits private RSA sign ops in %.2fs\n",
+                count, rsa_keys[testnum].bits, d);
             rsa_results[testnum][0] = (double)count / d;
             op_count = count;
         }
 
         for (i = 0; st && i < loopargs_len; i++) {
             loopargs[i].rsa_verify_ctx[testnum] = EVP_PKEY_CTX_new(rsa_key,
-                                                                   NULL);
+                NULL);
             if (loopargs[i].rsa_verify_ctx[testnum] == NULL
                 || EVP_PKEY_verify_init(loopargs[i].rsa_verify_ctx[testnum]) <= 0
                 || EVP_PKEY_verify(loopargs[i].rsa_verify_ctx[testnum],
-                                   loopargs[i].buf2,
-                                   loopargs[i].sigsize,
-                                   loopargs[i].buf, 36) <= 0)
+                       loopargs[i].buf2,
+                       loopargs[i].sigsize,
+                       loopargs[i].buf, 36)
+                    <= 0)
                 st = 0;
         }
         if (!st) {
             BIO_printf(bio_err,
-                       "RSA verify setup failure.  No RSA verify will be done.\n");
+                "RSA verify setup failure.  No RSA verify will be done.\n");
             dofail();
             rsa_doit[testnum] = 0;
         } else {
             pkey_print_message("public", "rsa verify",
-                               rsa_keys[testnum].bits, seconds.rsa);
+                rsa_keys[testnum].bits, seconds.rsa);
             Time_F(START);
             count = run_benchmark(async_jobs, RSA_verify_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R2:%ld:%d:%.2f\n"
-                       : "%ld %u bits public RSA verify ops in %.2fs\n",
-                       count, rsa_keys[testnum].bits, d);
+                mr ? "+R2:%ld:%d:%.2f\n"
+                   : "%ld %u bits public RSA verify ops in %.2fs\n",
+                count, rsa_keys[testnum].bits, d);
             rsa_results[testnum][1] = (double)count / d;
         }
 
@@ -3311,27 +3375,28 @@ int speed_main(int argc, char **argv)
             if (loopargs[i].rsa_encrypt_ctx[testnum] == NULL
                 || EVP_PKEY_encrypt_init(loopargs[i].rsa_encrypt_ctx[testnum]) <= 0
                 || EVP_PKEY_encrypt(loopargs[i].rsa_encrypt_ctx[testnum],
-                                    loopargs[i].buf2,
-                                    &loopargs[i].encsize,
-                                    loopargs[i].buf, 36) <= 0)
+                       loopargs[i].buf2,
+                       &loopargs[i].encsize,
+                       loopargs[i].buf, 36)
+                    <= 0)
                 st = 0;
         }
         if (!st) {
             BIO_printf(bio_err,
-                       "RSA encrypt setup failure.  No RSA encrypt will be done.\n");
+                "RSA encrypt setup failure.  No RSA encrypt will be done.\n");
             dofail();
             op_count = 1;
         } else {
             pkey_print_message("public", "rsa encrypt",
-                               rsa_keys[testnum].bits, seconds.rsa);
+                rsa_keys[testnum].bits, seconds.rsa);
             /* RSA_blinding_on(rsa_key[testnum],NULL); */
             Time_F(START);
             count = run_benchmark(async_jobs, RSA_encrypt_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R3:%ld:%d:%.2f\n"
-                       : "%ld %u bits public RSA encrypt ops in %.2fs\n",
-                       count, rsa_keys[testnum].bits, d);
+                mr ? "+R3:%ld:%d:%.2f\n"
+                   : "%ld %u bits public RSA encrypt ops in %.2fs\n",
+                count, rsa_keys[testnum].bits, d);
             rsa_results[testnum][2] = (double)count / d;
             op_count = count;
         }
@@ -3342,28 +3407,29 @@ int speed_main(int argc, char **argv)
             if (loopargs[i].rsa_decrypt_ctx[testnum] == NULL
                 || EVP_PKEY_decrypt_init(loopargs[i].rsa_decrypt_ctx[testnum]) <= 0
                 || EVP_PKEY_decrypt(loopargs[i].rsa_decrypt_ctx[testnum],
-                                    loopargs[i].buf,
-                                    &declen,
-                                    loopargs[i].buf2,
-                                    loopargs[i].encsize) <= 0)
+                       loopargs[i].buf,
+                       &declen,
+                       loopargs[i].buf2,
+                       loopargs[i].encsize)
+                    <= 0)
                 st = 0;
         }
         if (!st) {
             BIO_printf(bio_err,
-                       "RSA decrypt setup failure.  No RSA decrypt will be done.\n");
+                "RSA decrypt setup failure.  No RSA decrypt will be done.\n");
             dofail();
             op_count = 1;
         } else {
             pkey_print_message("private", "rsa decrypt",
-                               rsa_keys[testnum].bits, seconds.rsa);
+                rsa_keys[testnum].bits, seconds.rsa);
             /* RSA_blinding_on(rsa_key[testnum],NULL); */
             Time_F(START);
             count = run_benchmark(async_jobs, RSA_decrypt_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R4:%ld:%d:%.2f\n"
-                       : "%ld %u bits private RSA decrypt ops in %.2fs\n",
-                       count, rsa_keys[testnum].bits, d);
+                mr ? "+R4:%ld:%d:%.2f\n"
+                   : "%ld %u bits private RSA decrypt ops in %.2fs\n",
+                count, rsa_keys[testnum].bits, d);
             rsa_results[testnum][3] = (double)count / d;
             op_count = count;
         }
@@ -3387,61 +3453,63 @@ int speed_main(int argc, char **argv)
 
         for (i = 0; st && i < loopargs_len; i++) {
             loopargs[i].dsa_sign_ctx[testnum] = EVP_PKEY_CTX_new(dsa_key,
-                                                                 NULL);
+                NULL);
             loopargs[i].sigsize = loopargs[i].buflen;
             if (loopargs[i].dsa_sign_ctx[testnum] == NULL
                 || EVP_PKEY_sign_init(loopargs[i].dsa_sign_ctx[testnum]) <= 0
                 || EVP_PKEY_sign(loopargs[i].dsa_sign_ctx[testnum],
-                                 loopargs[i].buf2,
-                                 &loopargs[i].sigsize,
-                                 loopargs[i].buf, 20) <= 0)
+                       loopargs[i].buf2,
+                       &loopargs[i].sigsize,
+                       loopargs[i].buf, 20)
+                    <= 0)
                 st = 0;
         }
         if (!st) {
             BIO_printf(bio_err,
-                       "DSA sign setup failure.  No DSA sign will be done.\n");
+                "DSA sign setup failure.  No DSA sign will be done.\n");
             dofail();
             op_count = 1;
         } else {
             pkey_print_message("sign", "dsa",
-                               dsa_bits[testnum], seconds.dsa);
+                dsa_bits[testnum], seconds.dsa);
             Time_F(START);
             count = run_benchmark(async_jobs, DSA_sign_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R5:%ld:%u:%.2f\n"
-                       : "%ld %u bits DSA sign ops in %.2fs\n",
-                       count, dsa_bits[testnum], d);
+                mr ? "+R5:%ld:%u:%.2f\n"
+                   : "%ld %u bits DSA sign ops in %.2fs\n",
+                count, dsa_bits[testnum], d);
             dsa_results[testnum][0] = (double)count / d;
             op_count = count;
         }
 
         for (i = 0; st && i < loopargs_len; i++) {
             loopargs[i].dsa_verify_ctx[testnum] = EVP_PKEY_CTX_new(dsa_key,
-                                                                   NULL);
+                NULL);
             if (loopargs[i].dsa_verify_ctx[testnum] == NULL
                 || EVP_PKEY_verify_init(loopargs[i].dsa_verify_ctx[testnum]) <= 0
                 || EVP_PKEY_verify(loopargs[i].dsa_verify_ctx[testnum],
-                                   loopargs[i].buf2,
-                                   loopargs[i].sigsize,
-                                   loopargs[i].buf, 36) <= 0)
+                       loopargs[i].buf2,
+                       loopargs[i].sigsize,
+                       loopargs[i].buf, 36)
+                    <= 0)
                 st = 0;
         }
         if (!st) {
             BIO_printf(bio_err,
-                       "DSA verify setup failure.  No DSA verify will be done.\n");
+                "DSA verify setup failure.  No DSA verify will be done.\n");
             dofail();
             dsa_doit[testnum] = 0;
         } else {
             pkey_print_message("verify", "dsa",
-                               dsa_bits[testnum], seconds.dsa);
+                dsa_bits[testnum], seconds.dsa);
             Time_F(START);
             count = run_benchmark(async_jobs, DSA_verify_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R6:%ld:%u:%.2f\n"
-                       : "%ld %u bits DSA verify ops in %.2fs\n",
-                       count, dsa_bits[testnum], d);
+                mr ? "+R6:%ld:%u:%.2f\n"
+                   : "%ld %u bits DSA verify ops in %.2fs\n",
+                count, dsa_bits[testnum], d);
             dsa_results[testnum][1] = (double)count / d;
         }
 
@@ -3464,61 +3532,63 @@ int speed_main(int argc, char **argv)
 
         for (i = 0; st && i < loopargs_len; i++) {
             loopargs[i].ecdsa_sign_ctx[testnum] = EVP_PKEY_CTX_new(ecdsa_key,
-                                                                   NULL);
+                NULL);
             loopargs[i].sigsize = loopargs[i].buflen;
             if (loopargs[i].ecdsa_sign_ctx[testnum] == NULL
                 || EVP_PKEY_sign_init(loopargs[i].ecdsa_sign_ctx[testnum]) <= 0
                 || EVP_PKEY_sign(loopargs[i].ecdsa_sign_ctx[testnum],
-                                 loopargs[i].buf2,
-                                 &loopargs[i].sigsize,
-                                 loopargs[i].buf, 20) <= 0)
+                       loopargs[i].buf2,
+                       &loopargs[i].sigsize,
+                       loopargs[i].buf, 20)
+                    <= 0)
                 st = 0;
         }
         if (!st) {
             BIO_printf(bio_err,
-                       "ECDSA sign setup failure.  No ECDSA sign will be done.\n");
+                "ECDSA sign setup failure.  No ECDSA sign will be done.\n");
             dofail();
             op_count = 1;
         } else {
             pkey_print_message("sign", "ecdsa",
-                               ec_curves[testnum].bits, seconds.ecdsa);
+                ec_curves[testnum].bits, seconds.ecdsa);
             Time_F(START);
             count = run_benchmark(async_jobs, ECDSA_sign_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R7:%ld:%u:%.2f\n"
-                       : "%ld %u bits ECDSA sign ops in %.2fs\n",
-                       count, ec_curves[testnum].bits, d);
+                mr ? "+R7:%ld:%u:%.2f\n"
+                   : "%ld %u bits ECDSA sign ops in %.2fs\n",
+                count, ec_curves[testnum].bits, d);
             ecdsa_results[testnum][0] = (double)count / d;
             op_count = count;
         }
 
         for (i = 0; st && i < loopargs_len; i++) {
             loopargs[i].ecdsa_verify_ctx[testnum] = EVP_PKEY_CTX_new(ecdsa_key,
-                                                                     NULL);
+                NULL);
             if (loopargs[i].ecdsa_verify_ctx[testnum] == NULL
                 || EVP_PKEY_verify_init(loopargs[i].ecdsa_verify_ctx[testnum]) <= 0
                 || EVP_PKEY_verify(loopargs[i].ecdsa_verify_ctx[testnum],
-                                   loopargs[i].buf2,
-                                   loopargs[i].sigsize,
-                                   loopargs[i].buf, 20) <= 0)
+                       loopargs[i].buf2,
+                       loopargs[i].sigsize,
+                       loopargs[i].buf, 20)
+                    <= 0)
                 st = 0;
         }
         if (!st) {
             BIO_printf(bio_err,
-                       "ECDSA verify setup failure.  No ECDSA verify will be done.\n");
+                "ECDSA verify setup failure.  No ECDSA verify will be done.\n");
             dofail();
             ecdsa_doit[testnum] = 0;
         } else {
             pkey_print_message("verify", "ecdsa",
-                               ec_curves[testnum].bits, seconds.ecdsa);
+                ec_curves[testnum].bits, seconds.ecdsa);
             Time_F(START);
             count = run_benchmark(async_jobs, ECDSA_verify_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R8:%ld:%u:%.2f\n"
-                       : "%ld %u bits ECDSA verify ops in %.2fs\n",
-                       count, ec_curves[testnum].bits, d);
+                mr ? "+R8:%ld:%u:%.2f\n"
+                   : "%ld %u bits ECDSA verify ops in %.2fs\n",
+                count, ec_curves[testnum].bits, d);
             ecdsa_results[testnum][1] = (double)count / d;
         }
 
@@ -3580,7 +3650,7 @@ int speed_main(int argc, char **argv)
 
             /* Compare the computation results: CRYPTO_memcmp() returns 0 if equal */
             if (CRYPTO_memcmp(loopargs[i].secret_a,
-                              loopargs[i].secret_b, outlen)) {
+                    loopargs[i].secret_b, outlen)) {
                 ecdh_checks = 0;
                 BIO_printf(bio_err, "ECDH computations don't match.\n");
                 dofail();
@@ -3598,15 +3668,13 @@ int speed_main(int argc, char **argv)
         }
         if (ecdh_checks != 0) {
             pkey_print_message("", "ecdh",
-                               ec_curves[testnum].bits, seconds.ecdh);
+                ec_curves[testnum].bits, seconds.ecdh);
             Time_F(START);
-            count =
-                run_benchmark(async_jobs, ECDH_EVP_derive_key_loop, loopargs);
+            count = run_benchmark(async_jobs, ECDH_EVP_derive_key_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R9:%ld:%d:%.2f\n" :
-                       "%ld %u-bits ECDH ops in %.2fs\n", count,
-                       ec_curves[testnum].bits, d);
+                mr ? "+R9:%ld:%d:%.2f\n" : "%ld %u-bits ECDH ops in %.2fs\n", count,
+                ec_curves[testnum].bits, d);
             ecdh_results[testnum][0] = (double)count / d;
             op_count = count;
         }
@@ -3624,7 +3692,7 @@ int speed_main(int argc, char **argv)
         EVP_PKEY_CTX *ed_pctx = NULL;
 
         if (!eddsa_doit[testnum])
-            continue;           /* Ignore Curve */
+            continue; /* Ignore Curve */
         for (i = 0; i < loopargs_len; i++) {
             loopargs[i].eddsa_ctx[testnum] = EVP_MD_CTX_new();
             if (loopargs[i].eddsa_ctx[testnum] == NULL) {
@@ -3638,7 +3706,8 @@ int speed_main(int argc, char **argv)
             }
 
             if ((ed_pctx = EVP_PKEY_CTX_new_id(ed_curves[testnum].nid,
-                                               NULL)) == NULL
+                     NULL))
+                    == NULL
                 || EVP_PKEY_keygen_init(ed_pctx) <= 0
                 || EVP_PKEY_keygen(ed_pctx, &ed_pkey) <= 0) {
                 st = 0;
@@ -3648,13 +3717,13 @@ int speed_main(int argc, char **argv)
             EVP_PKEY_CTX_free(ed_pctx);
 
             if (!EVP_DigestSignInit(loopargs[i].eddsa_ctx[testnum], NULL, NULL,
-                                    NULL, ed_pkey)) {
+                    NULL, ed_pkey)) {
                 st = 0;
                 EVP_PKEY_free(ed_pkey);
                 break;
             }
             if (!EVP_DigestVerifyInit(loopargs[i].eddsa_ctx2[testnum], NULL,
-                                      NULL, NULL, ed_pkey)) {
+                    NULL, NULL, ed_pkey)) {
                 st = 0;
                 EVP_PKEY_free(ed_pkey);
                 break;
@@ -3672,55 +3741,54 @@ int speed_main(int argc, char **argv)
                 /* Perform EdDSA signature test */
                 loopargs[i].sigsize = ed_curves[testnum].sigsize;
                 st = EVP_DigestSign(loopargs[i].eddsa_ctx[testnum],
-                                    loopargs[i].buf2, &loopargs[i].sigsize,
-                                    loopargs[i].buf, 20);
+                    loopargs[i].buf2, &loopargs[i].sigsize,
+                    loopargs[i].buf, 20);
                 if (st == 0)
                     break;
             }
             if (st == 0) {
                 BIO_printf(bio_err,
-                           "EdDSA sign failure.  No EdDSA sign will be done.\n");
+                    "EdDSA sign failure.  No EdDSA sign will be done.\n");
                 dofail();
                 op_count = 1;
             } else {
                 pkey_print_message("sign", ed_curves[testnum].name,
-                                   ed_curves[testnum].bits, seconds.eddsa);
+                    ed_curves[testnum].bits, seconds.eddsa);
                 Time_F(START);
                 count = run_benchmark(async_jobs, EdDSA_sign_loop, loopargs);
                 d = Time_F(STOP);
 
                 BIO_printf(bio_err,
-                           mr ? "+R10:%ld:%u:%s:%.2f\n" :
-                           "%ld %u bits %s sign ops in %.2fs \n",
-                           count, ed_curves[testnum].bits,
-                           ed_curves[testnum].name, d);
+                    mr ? "+R10:%ld:%u:%s:%.2f\n" : "%ld %u bits %s sign ops in %.2fs \n",
+                    count, ed_curves[testnum].bits,
+                    ed_curves[testnum].name, d);
                 eddsa_results[testnum][0] = (double)count / d;
                 op_count = count;
             }
             /* Perform EdDSA verification test */
             for (i = 0; i < loopargs_len; i++) {
                 st = EVP_DigestVerify(loopargs[i].eddsa_ctx2[testnum],
-                                      loopargs[i].buf2, loopargs[i].sigsize,
-                                      loopargs[i].buf, 20);
+                    loopargs[i].buf2, loopargs[i].sigsize,
+                    loopargs[i].buf, 20);
                 if (st != 1)
                     break;
             }
             if (st != 1) {
                 BIO_printf(bio_err,
-                           "EdDSA verify failure.  No EdDSA verify will be done.\n");
+                    "EdDSA verify failure.  No EdDSA verify will be done.\n");
                 dofail();
                 eddsa_doit[testnum] = 0;
             } else {
                 pkey_print_message("verify", ed_curves[testnum].name,
-                                   ed_curves[testnum].bits, seconds.eddsa);
+                    ed_curves[testnum].bits, seconds.eddsa);
                 Time_F(START);
                 count = run_benchmark(async_jobs, EdDSA_verify_loop, loopargs);
                 d = Time_F(STOP);
                 BIO_printf(bio_err,
-                           mr ? "+R11:%ld:%u:%s:%.2f\n"
-                           : "%ld %u bits %s verify ops in %.2fs\n",
-                           count, ed_curves[testnum].bits,
-                           ed_curves[testnum].name, d);
+                    mr ? "+R11:%ld:%u:%s:%.2f\n"
+                       : "%ld %u bits %s verify ops in %.2fs\n",
+                    count, ed_curves[testnum].bits,
+                    ed_curves[testnum].name, d);
                 eddsa_results[testnum][1] = (double)count / d;
             }
 
@@ -3738,7 +3806,7 @@ int speed_main(int argc, char **argv)
         EVP_PKEY *sm2_pkey = NULL;
 
         if (!sm2_doit[testnum])
-            continue;           /* Ignore Curve */
+            continue; /* Ignore Curve */
         /* Init signing and verification */
         for (i = 0; i < loopargs_len; i++) {
             EVP_PKEY_CTX *sm2_pctx = NULL;
@@ -3749,7 +3817,7 @@ int speed_main(int argc, char **argv)
             loopargs[i].sm2_ctx[testnum] = EVP_MD_CTX_new();
             loopargs[i].sm2_vfy_ctx[testnum] = EVP_MD_CTX_new();
             if (loopargs[i].sm2_ctx[testnum] == NULL
-                    || loopargs[i].sm2_vfy_ctx[testnum] == NULL)
+                || loopargs[i].sm2_vfy_ctx[testnum] == NULL)
                 break;
 
             sm2_pkey = NULL;
@@ -3757,7 +3825,8 @@ int speed_main(int argc, char **argv)
             st = !((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_SM2, NULL)) == NULL
                 || EVP_PKEY_keygen_init(pctx) <= 0
                 || EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx,
-                    sm2_curves[testnum].nid) <= 0
+                       sm2_curves[testnum].nid)
+                    <= 0
                 || EVP_PKEY_keygen(pctx, &sm2_pkey) <= 0);
             EVP_PKEY_CTX_free(pctx);
             if (st == 0)
@@ -3788,12 +3857,12 @@ int speed_main(int argc, char **argv)
                 break;
 
             if (!EVP_DigestSignInit(loopargs[i].sm2_ctx[testnum], NULL,
-                                    EVP_sm3(), NULL, sm2_pkey))
+                    EVP_sm3(), NULL, sm2_pkey))
                 break;
             if (!EVP_DigestVerifyInit(loopargs[i].sm2_vfy_ctx[testnum], NULL,
-                                      EVP_sm3(), NULL, sm2_pkey))
+                    EVP_sm3(), NULL, sm2_pkey))
                 break;
-            st = 1;         /* mark loop as succeeded */
+            st = 1; /* mark loop as succeeded */
         }
         if (st == 0) {
             BIO_printf(bio_err, "SM2 init failure.\n");
@@ -3803,28 +3872,27 @@ int speed_main(int argc, char **argv)
             for (i = 0; i < loopargs_len; i++) {
                 /* Perform SM2 signature test */
                 st = EVP_DigestSign(loopargs[i].sm2_ctx[testnum],
-                                    loopargs[i].buf2, &loopargs[i].sigsize,
-                                    loopargs[i].buf, 20);
+                    loopargs[i].buf2, &loopargs[i].sigsize,
+                    loopargs[i].buf, 20);
                 if (st == 0)
                     break;
             }
             if (st == 0) {
                 BIO_printf(bio_err,
-                           "SM2 sign failure.  No SM2 sign will be done.\n");
+                    "SM2 sign failure.  No SM2 sign will be done.\n");
                 dofail();
                 op_count = 1;
             } else {
                 pkey_print_message("sign", sm2_curves[testnum].name,
-                                   sm2_curves[testnum].bits, seconds.sm2);
+                    sm2_curves[testnum].bits, seconds.sm2);
                 Time_F(START);
                 count = run_benchmark(async_jobs, SM2_sign_loop, loopargs);
                 d = Time_F(STOP);
 
                 BIO_printf(bio_err,
-                           mr ? "+R12:%ld:%u:%s:%.2f\n" :
-                           "%ld %u bits %s sign ops in %.2fs \n",
-                           count, sm2_curves[testnum].bits,
-                           sm2_curves[testnum].name, d);
+                    mr ? "+R12:%ld:%u:%s:%.2f\n" : "%ld %u bits %s sign ops in %.2fs \n",
+                    count, sm2_curves[testnum].bits,
+                    sm2_curves[testnum].name, d);
                 sm2_results[testnum][0] = (double)count / d;
                 op_count = count;
             }
@@ -3832,27 +3900,27 @@ int speed_main(int argc, char **argv)
             /* Perform SM2 verification test */
             for (i = 0; i < loopargs_len; i++) {
                 st = EVP_DigestVerify(loopargs[i].sm2_vfy_ctx[testnum],
-                                      loopargs[i].buf2, loopargs[i].sigsize,
-                                      loopargs[i].buf, 20);
+                    loopargs[i].buf2, loopargs[i].sigsize,
+                    loopargs[i].buf, 20);
                 if (st != 1)
                     break;
             }
             if (st != 1) {
                 BIO_printf(bio_err,
-                           "SM2 verify failure.  No SM2 verify will be done.\n");
+                    "SM2 verify failure.  No SM2 verify will be done.\n");
                 dofail();
                 sm2_doit[testnum] = 0;
             } else {
                 pkey_print_message("verify", sm2_curves[testnum].name,
-                                   sm2_curves[testnum].bits, seconds.sm2);
+                    sm2_curves[testnum].bits, seconds.sm2);
                 Time_F(START);
                 count = run_benchmark(async_jobs, SM2_verify_loop, loopargs);
                 d = Time_F(STOP);
                 BIO_printf(bio_err,
-                           mr ? "+R13:%ld:%u:%s:%.2f\n"
-                           : "%ld %u bits %s verify ops in %.2fs\n",
-                           count, sm2_curves[testnum].bits,
-                           sm2_curves[testnum].name, d);
+                    mr ? "+R13:%ld:%u:%s:%.2f\n"
+                       : "%ld %u bits %s verify ops in %.2fs\n",
+                    count, sm2_curves[testnum].bits,
+                    sm2_curves[testnum].name, d);
                 sm2_results[testnum][1] = (double)count / d;
             }
 
@@ -3863,7 +3931,7 @@ int speed_main(int argc, char **argv)
             }
         }
     }
-#endif                         /* OPENSSL_NO_SM2 */
+#endif /* OPENSSL_NO_SM2 */
 
 #ifndef OPENSSL_NO_DH
     for (testnum = 0; testnum < FFDH_NUM; testnum++) {
@@ -3883,7 +3951,7 @@ int speed_main(int argc, char **argv)
             /* Ensure that the error queue is empty */
             if (ERR_peek_error()) {
                 BIO_printf(bio_err,
-                           "WARNING: the error queue contains previous unhandled errors.\n");
+                    "WARNING: the error queue contains previous unhandled errors.\n");
                 dofail();
             }
 
@@ -3928,8 +3996,7 @@ int speed_main(int argc, char **argv)
                 break;
             }
 
-            if (EVP_PKEY_keygen(ffdh_ctx, &pkey_A) <= 0 ||
-                EVP_PKEY_keygen(ffdh_ctx, &pkey_B) <= 0) {
+            if (EVP_PKEY_keygen(ffdh_ctx, &pkey_A) <= 0 || EVP_PKEY_keygen(ffdh_ctx, &pkey_B) <= 0) {
                 BIO_printf(bio_err, "FFDH key generation failure.\n");
                 dofail();
                 op_count = 1;
@@ -3980,8 +4047,9 @@ int speed_main(int argc, char **argv)
                 break;
             }
             if (EVP_PKEY_derive(ffdh_ctx,
-                                loopargs[i].secret_ff_a,
-                                &secret_size) <= 0) {
+                    loopargs[i].secret_ff_a,
+                    &secret_size)
+                <= 0) {
                 BIO_printf(bio_err, "Shared secret derive failure.\n");
                 dofail();
                 op_count = 1;
@@ -3997,11 +4065,7 @@ int speed_main(int argc, char **argv)
                 ffdh_checks = 0;
                 break;
             }
-            if (EVP_PKEY_derive_init(test_ctx) <= 0 ||
-                EVP_PKEY_derive_set_peer(test_ctx, pkey_A) <= 0 ||
-                EVP_PKEY_derive(test_ctx, NULL, &test_out) <= 0 ||
-                EVP_PKEY_derive(test_ctx, loopargs[i].secret_ff_b, &test_out) <= 0 ||
-                test_out != secret_size) {
+            if (EVP_PKEY_derive_init(test_ctx) <= 0 || EVP_PKEY_derive_set_peer(test_ctx, pkey_A) <= 0 || EVP_PKEY_derive(test_ctx, NULL, &test_out) <= 0 || EVP_PKEY_derive(test_ctx, loopargs[i].secret_ff_b, &test_out) <= 0 || test_out != secret_size) {
                 BIO_printf(bio_err, "FFDH computation failure.\n");
                 op_count = 1;
                 ffdh_checks = 0;
@@ -4010,7 +4074,7 @@ int speed_main(int argc, char **argv)
 
             /* compare the computed secrets */
             if (CRYPTO_memcmp(loopargs[i].secret_ff_a,
-                              loopargs[i].secret_ff_b, secret_size)) {
+                    loopargs[i].secret_ff_b, secret_size)) {
                 BIO_printf(bio_err, "FFDH computations don't match.\n");
                 dofail();
                 op_count = 1;
@@ -4029,15 +4093,13 @@ int speed_main(int argc, char **argv)
         }
         if (ffdh_checks != 0) {
             pkey_print_message("", "ffdh",
-                               ffdh_params[testnum].bits, seconds.ffdh);
+                ffdh_params[testnum].bits, seconds.ffdh);
             Time_F(START);
-            count =
-                run_benchmark(async_jobs, FFDH_derive_key_loop, loopargs);
+            count = run_benchmark(async_jobs, FFDH_derive_key_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R14:%ld:%d:%.2f\n" :
-                       "%ld %u-bits FFDH ops in %.2fs\n", count,
-                       ffdh_params[testnum].bits, d);
+                mr ? "+R14:%ld:%d:%.2f\n" : "%ld %u-bits FFDH ops in %.2fs\n", count,
+                ffdh_params[testnum].bits, d);
             ffdh_results[testnum][0] = (double)count / d;
             op_count = count;
         }
@@ -4046,7 +4108,7 @@ int speed_main(int argc, char **argv)
             stop_it(ffdh_doit, testnum);
         }
     }
-#endif  /* OPENSSL_NO_DH */
+#endif /* OPENSSL_NO_DH */
 
     for (testnum = 0; testnum < kems_algs_len; testnum++) {
         int kem_checks = 1;
@@ -4068,7 +4130,10 @@ int speed_main(int argc, char **argv)
             char sfx[MAX_ALGNAME_SUFFIX];
             OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
             int use_params = 0;
-            enum kem_type_t { KEM_RSA = 1, KEM_EC, KEM_X25519, KEM_X448 } kem_type;
+            enum kem_type_t { KEM_RSA = 1,
+                KEM_EC,
+                KEM_X25519,
+                KEM_X448 } kem_type;
 
             /* no string after rsa<bitcnt> permitted: */
             if (strlen(kem_name) < MAX_ALGNAME_SUFFIX + 4 /* rsa+digit */
@@ -4080,36 +4145,36 @@ int speed_main(int argc, char **argv)
                 kem_type = KEM_X25519;
             else if (strcmp(kem_name, "X448") == 0)
                 kem_type = KEM_X448;
-            else kem_type = 0;
+            else
+                kem_type = 0;
 
             if (ERR_peek_error()) {
                 BIO_printf(bio_err,
-                           "WARNING: the error queue contains previous unhandled errors.\n");
+                    "WARNING: the error queue contains previous unhandled errors.\n");
                 dofail();
             }
 
             if (kem_type == KEM_RSA) {
                 params[0] = OSSL_PARAM_construct_uint(OSSL_PKEY_PARAM_RSA_BITS,
-                                                      &bits);
+                    &bits);
                 use_params = 1;
             } else if (kem_type == KEM_EC) {
                 name = (char *)(kem_name + 2);
                 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
-                                                  name, 0);
+                    name, 0);
                 use_params = 1;
             }
 
             kem_gen_ctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(),
-                                               (kem_type == KEM_RSA) ? "RSA":
-                                                (kem_type == KEM_EC) ? "EC":
-                                                 kem_name,
-                                               app_get0_propq());
+                (kem_type == KEM_RSA) ? "RSA" : (kem_type == KEM_EC) ? "EC"
+                                                                     : kem_name,
+                app_get0_propq());
 
             if ((!kem_gen_ctx || EVP_PKEY_keygen_init(kem_gen_ctx) <= 0)
                 || (use_params
                     && EVP_PKEY_CTX_set_params(kem_gen_ctx, params) <= 0)) {
                 BIO_printf(bio_err, "Error initializing keygen ctx for %s.\n",
-                           kem_name);
+                    kem_name);
                 goto kem_err_break;
             }
             if (EVP_PKEY_keygen(kem_gen_ctx, &pkey) <= 0) {
@@ -4118,21 +4183,22 @@ int speed_main(int argc, char **argv)
             }
             /* Now prepare encaps data structs */
             kem_encaps_ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(),
-                                                        pkey,
-                                                        app_get0_propq());
+                pkey,
+                app_get0_propq());
             if (kem_encaps_ctx == NULL
                 || EVP_PKEY_encapsulate_init(kem_encaps_ctx, NULL) <= 0
                 || (kem_type == KEM_RSA
                     && EVP_PKEY_CTX_set_kem_op(kem_encaps_ctx, "RSASVE") <= 0)
                 || ((kem_type == KEM_EC
-                    || kem_type == KEM_X25519
-                    || kem_type == KEM_X448)
-                   && EVP_PKEY_CTX_set_kem_op(kem_encaps_ctx, "DHKEM") <= 0)
+                        || kem_type == KEM_X25519
+                        || kem_type == KEM_X448)
+                    && EVP_PKEY_CTX_set_kem_op(kem_encaps_ctx, "DHKEM") <= 0)
                 || EVP_PKEY_encapsulate(kem_encaps_ctx, NULL, &out_len,
-                                      NULL, &send_secret_len) <= 0) {
+                       NULL, &send_secret_len)
+                    <= 0) {
                 BIO_printf(bio_err,
-                           "Error while initializing encaps data structs for %s.\n",
-                           kem_name);
+                    "Error while initializing encaps data structs for %s.\n",
+                    kem_name);
                 goto kem_err_break;
             }
             out = app_malloc(out_len, "encaps result");
@@ -4142,37 +4208,40 @@ int speed_main(int argc, char **argv)
                 goto kem_err_break;
             }
             if (EVP_PKEY_encapsulate(kem_encaps_ctx, out, &out_len,
-                                     send_secret, &send_secret_len) <= 0) {
+                    send_secret, &send_secret_len)
+                <= 0) {
                 BIO_printf(bio_err, "Encaps error for %s.\n", kem_name);
                 goto kem_err_break;
             }
             /* Now prepare decaps data structs */
             kem_decaps_ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(),
-                                                        pkey,
-                                                        app_get0_propq());
+                pkey,
+                app_get0_propq());
             if (kem_decaps_ctx == NULL
                 || EVP_PKEY_decapsulate_init(kem_decaps_ctx, NULL) <= 0
                 || (kem_type == KEM_RSA
-                  && EVP_PKEY_CTX_set_kem_op(kem_decaps_ctx, "RSASVE") <= 0)
+                    && EVP_PKEY_CTX_set_kem_op(kem_decaps_ctx, "RSASVE") <= 0)
                 || ((kem_type == KEM_EC
-                     || kem_type == KEM_X25519
-                     || kem_type == KEM_X448)
-                  && EVP_PKEY_CTX_set_kem_op(kem_decaps_ctx, "DHKEM") <= 0)
+                        || kem_type == KEM_X25519
+                        || kem_type == KEM_X448)
+                    && EVP_PKEY_CTX_set_kem_op(kem_decaps_ctx, "DHKEM") <= 0)
                 || EVP_PKEY_decapsulate(kem_decaps_ctx, NULL, &rcv_secret_len,
-                                        out, out_len) <= 0) {
+                       out, out_len)
+                    <= 0) {
                 BIO_printf(bio_err,
-                           "Error while initializing decaps data structs for %s.\n",
-                           kem_name);
+                    "Error while initializing decaps data structs for %s.\n",
+                    kem_name);
                 goto kem_err_break;
             }
             rcv_secret = app_malloc(rcv_secret_len, "KEM decaps secret");
             if (rcv_secret == NULL) {
                 BIO_printf(bio_err, "MemAlloc failure in decaps for %s.\n",
-                           kem_name);
+                    kem_name);
                 goto kem_err_break;
             }
             if (EVP_PKEY_decapsulate(kem_decaps_ctx, rcv_secret,
-                                     &rcv_secret_len, out, out_len) <= 0
+                    &rcv_secret_len, out, out_len)
+                    <= 0
                 || rcv_secret_len != send_secret_len
                 || memcmp(send_secret, rcv_secret, send_secret_len)) {
                 BIO_printf(bio_err, "Decaps error for %s.\n", kem_name);
@@ -4200,35 +4269,29 @@ int speed_main(int argc, char **argv)
         if (kem_checks != 0) {
             kskey_print_message(kem_name, "keygen", seconds.kem);
             Time_F(START);
-            count =
-                run_benchmark(async_jobs, KEM_keygen_loop, loopargs);
+            count = run_benchmark(async_jobs, KEM_keygen_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R15:%ld:%s:%.2f\n" :
-                       "%ld %s KEM keygen ops in %.2fs\n", count,
-                       kem_name, d);
+                mr ? "+R15:%ld:%s:%.2f\n" : "%ld %s KEM keygen ops in %.2fs\n", count,
+                kem_name, d);
             kems_results[testnum][0] = (double)count / d;
             op_count = count;
             kskey_print_message(kem_name, "encaps", seconds.kem);
             Time_F(START);
-            count =
-                run_benchmark(async_jobs, KEM_encaps_loop, loopargs);
+            count = run_benchmark(async_jobs, KEM_encaps_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R16:%ld:%s:%.2f\n" :
-                       "%ld %s KEM encaps ops in %.2fs\n", count,
-                       kem_name, d);
+                mr ? "+R16:%ld:%s:%.2f\n" : "%ld %s KEM encaps ops in %.2fs\n", count,
+                kem_name, d);
             kems_results[testnum][1] = (double)count / d;
             op_count = count;
             kskey_print_message(kem_name, "decaps", seconds.kem);
             Time_F(START);
-            count =
-                run_benchmark(async_jobs, KEM_decaps_loop, loopargs);
+            count = run_benchmark(async_jobs, KEM_decaps_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R17:%ld:%s:%.2f\n" :
-                       "%ld %s KEM decaps ops in %.2fs\n", count,
-                       kem_name, d);
+                mr ? "+R17:%ld:%s:%.2f\n" : "%ld %s KEM decaps ops in %.2fs\n", count,
+                kem_name, d);
             kems_results[testnum][2] = (double)count / d;
             op_count = count;
         }
@@ -4248,10 +4311,11 @@ int speed_main(int argc, char **argv)
         for (i = 0; i < loopargs_len; i++) {
             EVP_PKEY *pkey = NULL;
             EVP_PKEY_CTX *ctx_params = NULL;
-            EVP_PKEY* pkey_params = NULL;
+            EVP_PKEY *pkey_params = NULL;
             EVP_PKEY_CTX *sig_gen_ctx = NULL;
             EVP_PKEY_CTX *sig_sign_ctx = NULL;
             EVP_PKEY_CTX *sig_verify_ctx = NULL;
+            EVP_SIGNATURE *alg = NULL;
             unsigned char md[SHA256_DIGEST_LENGTH];
             unsigned char *sig;
             char sfx[MAX_ALGNAME_SUFFIX];
@@ -4266,7 +4330,7 @@ int speed_main(int argc, char **argv)
 
             if (ERR_peek_error()) {
                 BIO_printf(bio_err,
-                           "WARNING: the error queue contains previous unhandled errors.\n");
+                    "WARNING: the error queue contains previous unhandled errors.\n");
                 dofail();
             }
 
@@ -4274,7 +4338,7 @@ int speed_main(int argc, char **argv)
             if (strlen(sig_name) < MAX_ALGNAME_SUFFIX + 4 /* rsa+digit */
                 && sscanf(sig_name, "rsa%u%s", &bits, sfx) == 1) {
                 params[0] = OSSL_PARAM_construct_uint(OSSL_PKEY_PARAM_RSA_BITS,
-                                                      &bits);
+                    &bits);
                 use_params = 1;
             }
 
@@ -4283,50 +4347,76 @@ int speed_main(int argc, char **argv)
                 if (ctx_params == NULL
                     || EVP_PKEY_paramgen_init(ctx_params) <= 0
                     || EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx_params,
-                                                        atoi(sig_name + 3)) <= 0
+                           atoi(sig_name + 3))
+                        <= 0
                     || EVP_PKEY_paramgen(ctx_params, &pkey_params) <= 0
                     || (sig_gen_ctx = EVP_PKEY_CTX_new(pkey_params, NULL)) == NULL
                     || EVP_PKEY_keygen_init(sig_gen_ctx) <= 0) {
                     BIO_printf(bio_err,
-                               "Error initializing classic keygen ctx for %s.\n",
-                               sig_name);
+                        "Error initializing classic keygen ctx for %s.\n",
+                        sig_name);
                     goto sig_err_break;
                 }
             }
 
             if (sig_gen_ctx == NULL)
                 sig_gen_ctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(),
-                                      use_params == 1 ? "RSA" : sig_name,
-                                      app_get0_propq());
+                    use_params == 1 ? "RSA" : sig_name,
+                    app_get0_propq());
 
             if (!sig_gen_ctx || EVP_PKEY_keygen_init(sig_gen_ctx) <= 0
-                || (use_params &&
-                    EVP_PKEY_CTX_set_params(sig_gen_ctx, params) <= 0)) {
+                || (use_params && EVP_PKEY_CTX_set_params(sig_gen_ctx, params) <= 0)) {
                 BIO_printf(bio_err, "Error initializing keygen ctx for %s.\n",
-                           sig_name);
+                    sig_name);
                 goto sig_err_break;
             }
             if (EVP_PKEY_keygen(sig_gen_ctx, &pkey) <= 0) {
                 BIO_printf(bio_err,
-                           "Error while generating signature EVP_PKEY for %s.\n",
-                           sig_name);
+                    "Error while generating signature EVP_PKEY for %s.\n",
+                    sig_name);
                 goto sig_err_break;
             }
+
+            /*
+             * Try explicitly fetching the signature algorithm implementation to
+             * use in case the algorithm does not support EVP_PKEY_sign_init
+             */
+            ERR_set_mark();
+            alg = EVP_SIGNATURE_fetch(app_get0_libctx(), sig_name, app_get0_propq());
+            ERR_pop_to_mark();
+
             /* Now prepare signature data structs */
             sig_sign_ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(),
-                                                      pkey,
-                                                      app_get0_propq());
-            if (sig_sign_ctx == NULL
-                || EVP_PKEY_sign_init(sig_sign_ctx) <= 0
-                || (use_params == 1
-                    && (EVP_PKEY_CTX_set_rsa_padding(sig_sign_ctx,
-                                                     RSA_PKCS1_PADDING) <= 0))
-                || EVP_PKEY_sign(sig_sign_ctx, NULL, &max_sig_len,
-                                 md, md_len) <= 0) {
-                    BIO_printf(bio_err,
-                               "Error while initializing signing data structs for %s.\n",
-                               sig_name);
-                    goto sig_err_break;
+                pkey,
+                app_get0_propq());
+            if (sig_sign_ctx == NULL) {
+                BIO_printf(bio_err,
+                    "Error while initializing signing ctx for %s.\n",
+                    sig_name);
+                goto sig_err_break;
+            }
+            ERR_set_mark();
+            if (EVP_PKEY_sign_init(sig_sign_ctx) <= 0
+                && (alg == NULL
+                    || EVP_PKEY_sign_message_init(sig_sign_ctx, alg, NULL) <= 0)) {
+                ERR_clear_last_mark();
+                BIO_printf(bio_err,
+                    "Error while initializing signing data structs for %s.\n",
+                    sig_name);
+                goto sig_err_break;
+            }
+            ERR_pop_to_mark();
+            if (use_params == 1 && EVP_PKEY_CTX_set_rsa_padding(sig_sign_ctx, RSA_PKCS1_PADDING) <= 0) {
+                BIO_printf(bio_err,
+                    "Error while initializing padding for %s.\n",
+                    sig_name);
+                goto sig_err_break;
+            }
+            if (EVP_PKEY_sign(sig_sign_ctx, NULL, &max_sig_len, md, md_len) <= 0) {
+                BIO_printf(bio_err,
+                    "Error while obtaining signature buffer length for %s.\n",
+                    sig_name);
+                goto sig_err_break;
             }
             sig = app_malloc(sig_len = max_sig_len, "signature buffer");
             if (sig == NULL) {
@@ -4340,18 +4430,25 @@ int speed_main(int argc, char **argv)
             /* Now prepare verify data structs */
             memset(md, 0, SHA256_DIGEST_LENGTH);
             sig_verify_ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(),
-                                                        pkey,
-                                                        app_get0_propq());
-            if (sig_verify_ctx == NULL
-                || EVP_PKEY_verify_init(sig_verify_ctx) <= 0
-                || (use_params == 1
-                  && (EVP_PKEY_CTX_set_rsa_padding(sig_verify_ctx,
-                                                   RSA_PKCS1_PADDING) <= 0))) {
+                pkey,
+                app_get0_propq());
+            if (sig_verify_ctx == NULL) {
                 BIO_printf(bio_err,
-                           "Error while initializing verify data structs for %s.\n",
-                           sig_name);
+                    "Error while initializing verify ctx for %s.\n",
+                    sig_name);
                 goto sig_err_break;
             }
+            ERR_set_mark();
+            if (EVP_PKEY_verify_init(sig_verify_ctx) <= 0
+                && (alg == NULL
+                    || EVP_PKEY_verify_message_init(sig_verify_ctx, alg, NULL) <= 0)) {
+                ERR_clear_last_mark();
+                BIO_printf(bio_err,
+                    "Error while initializing verify data structs for %s.\n",
+                    sig_name);
+                goto sig_err_break;
+            }
+            ERR_pop_to_mark();
             if (EVP_PKEY_verify(sig_verify_ctx, sig, sig_len, md, md_len) <= 0) {
                 BIO_printf(bio_err, "Verify error for %s.\n", sig_name);
                 goto sig_err_break;
@@ -4367,12 +4464,14 @@ int speed_main(int argc, char **argv)
             loopargs[i].sig_act_sig_len[testnum] = sig_len;
             loopargs[i].sig_sig[testnum] = sig;
             EVP_PKEY_free(pkey);
+            EVP_SIGNATURE_free(alg);
             pkey = NULL;
             continue;
 
         sig_err_break:
             dofail();
             EVP_PKEY_free(pkey);
+            EVP_SIGNATURE_free(alg);
             op_count = 1;
             sig_checks = 0;
             break;
@@ -4384,32 +4483,27 @@ int speed_main(int argc, char **argv)
             count = run_benchmark(async_jobs, SIG_keygen_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R18:%ld:%s:%.2f\n" :
-                       "%ld %s signature keygen ops in %.2fs\n", count,
-                       sig_name, d);
+                mr ? "+R18:%ld:%s:%.2f\n" : "%ld %s signature keygen ops in %.2fs\n", count,
+                sig_name, d);
             sigs_results[testnum][0] = (double)count / d;
             op_count = count;
             kskey_print_message(sig_name, "signs", seconds.sig);
             Time_F(START);
-            count =
-                run_benchmark(async_jobs, SIG_sign_loop, loopargs);
+            count = run_benchmark(async_jobs, SIG_sign_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R19:%ld:%s:%.2f\n" :
-                       "%ld %s signature sign ops in %.2fs\n", count,
-                       sig_name, d);
+                mr ? "+R19:%ld:%s:%.2f\n" : "%ld %s signature sign ops in %.2fs\n", count,
+                sig_name, d);
             sigs_results[testnum][1] = (double)count / d;
             op_count = count;
 
             kskey_print_message(sig_name, "verify", seconds.sig);
             Time_F(START);
-            count =
-                run_benchmark(async_jobs, SIG_verify_loop, loopargs);
+            count = run_benchmark(async_jobs, SIG_verify_loop, loopargs);
             d = Time_F(STOP);
             BIO_printf(bio_err,
-                       mr ? "+R20:%ld:%s:%.2f\n" :
-                       "%ld %s signature verify ops in %.2fs\n", count,
-                       sig_name, d);
+                mr ? "+R20:%ld:%s:%.2f\n" : "%ld %s signature verify ops in %.2fs\n", count,
+                sig_name, d);
             sigs_results[testnum][2] = (double)count / d;
             op_count = count;
         }
@@ -4418,7 +4512,7 @@ int speed_main(int argc, char **argv)
     }
 
 #ifndef NO_FORK
- show_res:
+show_res:
 #endif
     if (!mr) {
         printf("version: %s\n", OpenSSL_version(OPENSSL_FULL_VERSION_STRING));
@@ -4475,15 +4569,15 @@ int speed_main(int argc, char **argv)
         }
         if (mr)
             printf("+F2:%u:%u:%f:%f:%f:%f\n",
-                   k, rsa_keys[k].bits, rsa_results[k][0], rsa_results[k][1],
-                   rsa_results[k][2], rsa_results[k][3]);
+                k, rsa_keys[k].bits, rsa_results[k][0], rsa_results[k][1],
+                rsa_results[k][2], rsa_results[k][3]);
         else
             printf("rsa %5u bits %8.6fs %8.6fs %8.6fs %8.6fs %8.1f %8.1f %8.1f %8.1f\n",
-                   rsa_keys[k].bits, 1.0 / rsa_results[k][0],
-                   1.0 / rsa_results[k][1], 1.0 / rsa_results[k][2],
-                   1.0 / rsa_results[k][3],
-                   rsa_results[k][0], rsa_results[k][1],
-                   rsa_results[k][2], rsa_results[k][3]);
+                rsa_keys[k].bits, 1.0 / rsa_results[k][0],
+                1.0 / rsa_results[k][1], 1.0 / rsa_results[k][2],
+                1.0 / rsa_results[k][3],
+                rsa_results[k][0], rsa_results[k][1],
+                rsa_results[k][2], rsa_results[k][3]);
     }
     testnum = 1;
 #ifndef OPENSSL_NO_DSA
@@ -4496,11 +4590,11 @@ int speed_main(int argc, char **argv)
         }
         if (mr)
             printf("+F3:%u:%u:%f:%f\n",
-                   k, dsa_bits[k], dsa_results[k][0], dsa_results[k][1]);
+                k, dsa_bits[k], dsa_results[k][0], dsa_results[k][1]);
         else
             printf("dsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
-                   dsa_bits[k], 1.0 / dsa_results[k][0], 1.0 / dsa_results[k][1],
-                   dsa_results[k][0], dsa_results[k][1]);
+                dsa_bits[k], 1.0 / dsa_results[k][0], 1.0 / dsa_results[k][1],
+                dsa_results[k][0], dsa_results[k][1]);
     }
 #endif /* OPENSSL_NO_DSA */
     testnum = 1;
@@ -4514,13 +4608,13 @@ int speed_main(int argc, char **argv)
 
         if (mr)
             printf("+F4:%u:%u:%f:%f\n",
-                   k, ec_curves[k].bits,
-                   ecdsa_results[k][0], ecdsa_results[k][1]);
+                k, ec_curves[k].bits,
+                ecdsa_results[k][0], ecdsa_results[k][1]);
         else
             printf("%4u bits ecdsa (%s) %8.4fs %8.4fs %8.1f %8.1f\n",
-                   ec_curves[k].bits, ec_curves[k].name,
-                   1.0 / ecdsa_results[k][0], 1.0 / ecdsa_results[k][1],
-                   ecdsa_results[k][0], ecdsa_results[k][1]);
+                ec_curves[k].bits, ec_curves[k].name,
+                1.0 / ecdsa_results[k][0], 1.0 / ecdsa_results[k][1],
+                ecdsa_results[k][0], ecdsa_results[k][1]);
     }
 
     testnum = 1;
@@ -4533,13 +4627,13 @@ int speed_main(int argc, char **argv)
         }
         if (mr)
             printf("+F5:%u:%u:%f:%f\n",
-                   k, ec_curves[k].bits,
-                   ecdh_results[k][0], 1.0 / ecdh_results[k][0]);
+                k, ec_curves[k].bits,
+                ecdh_results[k][0], 1.0 / ecdh_results[k][0]);
 
         else
             printf("%4u bits ecdh (%s) %8.4fs %8.1f\n",
-                   ec_curves[k].bits, ec_curves[k].name,
-                   1.0 / ecdh_results[k][0], ecdh_results[k][0]);
+                ec_curves[k].bits, ec_curves[k].name,
+                1.0 / ecdh_results[k][0], ecdh_results[k][0]);
     }
 
 #ifndef OPENSSL_NO_ECX
@@ -4554,13 +4648,13 @@ int speed_main(int argc, char **argv)
 
         if (mr)
             printf("+F6:%u:%u:%s:%f:%f\n",
-                   k, ed_curves[k].bits, ed_curves[k].name,
-                   eddsa_results[k][0], eddsa_results[k][1]);
+                k, ed_curves[k].bits, ed_curves[k].name,
+                eddsa_results[k][0], eddsa_results[k][1]);
         else
             printf("%4u bits EdDSA (%s) %8.4fs %8.4fs %8.1f %8.1f\n",
-                   ed_curves[k].bits, ed_curves[k].name,
-                   1.0 / eddsa_results[k][0], 1.0 / eddsa_results[k][1],
-                   eddsa_results[k][0], eddsa_results[k][1]);
+                ed_curves[k].bits, ed_curves[k].name,
+                1.0 / eddsa_results[k][0], 1.0 / eddsa_results[k][1],
+                eddsa_results[k][0], eddsa_results[k][1]);
     }
 #endif /* OPENSSL_NO_ECX */
 
@@ -4576,13 +4670,13 @@ int speed_main(int argc, char **argv)
 
         if (mr)
             printf("+F7:%u:%u:%s:%f:%f\n",
-                   k, sm2_curves[k].bits, sm2_curves[k].name,
-                   sm2_results[k][0], sm2_results[k][1]);
+                k, sm2_curves[k].bits, sm2_curves[k].name,
+                sm2_results[k][0], sm2_results[k][1]);
         else
             printf("%4u bits SM2 (%s) %8.4fs %8.4fs %8.1f %8.1f\n",
-                   sm2_curves[k].bits, sm2_curves[k].name,
-                   1.0 / sm2_results[k][0], 1.0 / sm2_results[k][1],
-                   sm2_results[k][0], sm2_results[k][1]);
+                sm2_curves[k].bits, sm2_curves[k].name,
+                1.0 / sm2_results[k][0], 1.0 / sm2_results[k][1],
+                sm2_results[k][0], sm2_results[k][1]);
     }
 #endif
 #ifndef OPENSSL_NO_DH
@@ -4596,13 +4690,13 @@ int speed_main(int argc, char **argv)
         }
         if (mr)
             printf("+F8:%u:%u:%f:%f\n",
-                   k, ffdh_params[k].bits,
-                   ffdh_results[k][0], 1.0 / ffdh_results[k][0]);
+                k, ffdh_params[k].bits,
+                ffdh_results[k][0], 1.0 / ffdh_results[k][0]);
 
         else
             printf("%4u bits ffdh %8.4fs %8.1f\n",
-                   ffdh_params[k].bits,
-                   1.0 / ffdh_results[k][0], ffdh_results[k][0]);
+                ffdh_params[k].bits,
+                1.0 / ffdh_results[k][0], ffdh_results[k][0]);
     }
 #endif /* OPENSSL_NO_DH */
 
@@ -4618,13 +4712,13 @@ int speed_main(int argc, char **argv)
         }
         if (mr)
             printf("+F9:%u:%f:%f:%f\n",
-                   k, kems_results[k][0], kems_results[k][1],
-                   kems_results[k][2]);
+                k, kems_results[k][0], kems_results[k][1],
+                kems_results[k][2]);
         else
             printf("%27s %8.6fs %8.6fs %8.6fs %9.1f %9.1f %9.1f\n", kem_name,
-                   1.0 / kems_results[k][0],
-                   1.0 / kems_results[k][1], 1.0 / kems_results[k][2],
-                   kems_results[k][0], kems_results[k][1], kems_results[k][2]);
+                1.0 / kems_results[k][0],
+                1.0 / kems_results[k][1], 1.0 / kems_results[k][2],
+                kems_results[k][0], kems_results[k][1], kems_results[k][2]);
     }
     ret = 0;
 
@@ -4640,17 +4734,17 @@ int speed_main(int argc, char **argv)
         }
         if (mr)
             printf("+F10:%u:%f:%f:%f\n",
-                   k, sigs_results[k][0], sigs_results[k][1],
-                   sigs_results[k][2]);
+                k, sigs_results[k][0], sigs_results[k][1],
+                sigs_results[k][2]);
         else
             printf("%27s %8.6fs %8.6fs %8.6fs %9.1f %9.1f %9.1f\n", sig_name,
-                   1.0 / sigs_results[k][0], 1.0 / sigs_results[k][1],
-                   1.0 / sigs_results[k][2], sigs_results[k][0],
-                   sigs_results[k][1], sigs_results[k][2]);
+                1.0 / sigs_results[k][0], 1.0 / sigs_results[k][1],
+                1.0 / sigs_results[k][2], sigs_results[k][0],
+                sigs_results[k][1], sigs_results[k][2]);
     }
     ret = 0;
 
- end:
+end:
     if (ret == 0 && testmode)
         ret = testmoderesult;
     ERR_print_errors(bio_err);
@@ -4755,19 +4849,21 @@ int speed_main(int argc, char **argv)
 static void print_message(const char *s, int length, int tm)
 {
     BIO_printf(bio_err,
-               mr ? "+DT:%s:%d:%d\n"
-               : "Doing %s ops for %ds on %d size blocks: ", s, tm, length);
+        mr ? "+DT:%s:%d:%d\n"
+           : "Doing %s ops for %ds on %d size blocks: ",
+        s, tm, length);
     (void)BIO_flush(bio_err);
     run = 1;
     alarm(tm);
 }
 
 static void pkey_print_message(const char *str, const char *str2, unsigned int bits,
-                               int tm)
+    int tm)
 {
     BIO_printf(bio_err,
-               mr ? "+DTP:%d:%s:%s:%d\n"
-               : "Doing %u bits %s %s ops for %ds: ", bits, str, str2, tm);
+        mr ? "+DTP:%d:%s:%s:%d\n"
+           : "Doing %u bits %s %s ops for %ds: ",
+        bits, str, str2, tm);
     (void)BIO_flush(bio_err);
     run = 1;
     alarm(tm);
@@ -4776,8 +4872,9 @@ static void pkey_print_message(const char *str, const char *str2, unsigned int b
 static void kskey_print_message(const char *str, const char *str2, int tm)
 {
     BIO_printf(bio_err,
-               mr ? "+DTP:%s:%s:%d\n"
-               : "Doing %s %s ops for %ds: ", str, str2, tm);
+        mr ? "+DTP:%s:%s:%d\n"
+           : "Doing %s %s ops for %ds: ",
+        str, str2, tm);
     (void)BIO_flush(bio_err);
     run = 1;
     alarm(tm);
@@ -4791,8 +4888,9 @@ static void print_result(int alg, int run_no, int count, double time_used)
         return;
     }
     BIO_printf(bio_err,
-               mr ? "+R:%d:%s:%f\n"
-               : "%d %s ops in %.2fs\n", count, names[alg], time_used);
+        mr ? "+R:%d:%s:%f\n"
+           : "%d %s ops in %.2fs\n",
+        count, names[alg], time_used);
     results[alg][run_no] = ((double)count) / time_used * lengths[run_no];
 }
 
@@ -4822,7 +4920,7 @@ static char *sstrsep(char **string, const char *delim)
 }
 
 static int strtoint(const char *str, const int min_val, const int upper_val,
-                    int *res)
+    int *res)
 {
     char *end = NULL;
     long int val = 0;
@@ -4884,7 +4982,7 @@ static int do_multi(int multi, int size_num)
 
         if ((f = fdopen(fds[n], "r")) == NULL) {
             BIO_printf(bio_err, "fdopen failure with 0x%x\n",
-                       errno);
+                errno);
             OPENSSL_free(fds);
             return 1;
         }
@@ -4894,8 +4992,8 @@ static int do_multi(int multi, int size_num)
                 *p = '\0';
             if (buf[0] != '+') {
                 BIO_printf(bio_err,
-                           "Don't understand line '%s' from child %d\n", buf,
-                           n);
+                    "Don't understand line '%s' from child %d\n", buf,
+                    n);
                 continue;
             }
             printf("Got: %s from %d\n", buf, n);
@@ -4926,7 +5024,7 @@ static int do_multi(int multi, int size_num)
                     d = atof(sstrsep(&p, sep));
                     rsa_results[k][3] += d;
                 }
-# ifndef OPENSSL_NO_DSA
+#ifndef OPENSSL_NO_DSA
             } else if (CHECK_AND_SKIP_PREFIX(p, "+F3:")) {
                 tk = sstrsep(&p, sep);
                 if (strtoint(tk, 0, OSSL_NELEM(dsa_results), &k)) {
@@ -4938,7 +5036,7 @@ static int do_multi(int multi, int size_num)
                     d = atof(sstrsep(&p, sep));
                     dsa_results[k][1] += d;
                 }
-# endif /* OPENSSL_NO_DSA */
+#endif /* OPENSSL_NO_DSA */
             } else if (CHECK_AND_SKIP_PREFIX(p, "+F4:")) {
                 tk = sstrsep(&p, sep);
                 if (strtoint(tk, 0, OSSL_NELEM(ecdsa_results), &k)) {
@@ -4958,7 +5056,7 @@ static int do_multi(int multi, int size_num)
                     d = atof(sstrsep(&p, sep));
                     ecdh_results[k][0] += d;
                 }
-# ifndef OPENSSL_NO_ECX
+#ifndef OPENSSL_NO_ECX
             } else if (CHECK_AND_SKIP_PREFIX(p, "+F6:")) {
                 tk = sstrsep(&p, sep);
                 if (strtoint(tk, 0, OSSL_NELEM(eddsa_results), &k)) {
@@ -4971,8 +5069,8 @@ static int do_multi(int multi, int size_num)
                     d = atof(sstrsep(&p, sep));
                     eddsa_results[k][1] += d;
                 }
-# endif /* OPENSSL_NO_ECX */
-# ifndef OPENSSL_NO_SM2
+#endif /* OPENSSL_NO_ECX */
+#ifndef OPENSSL_NO_SM2
             } else if (CHECK_AND_SKIP_PREFIX(p, "+F7:")) {
                 tk = sstrsep(&p, sep);
                 if (strtoint(tk, 0, OSSL_NELEM(sm2_results), &k)) {
@@ -4985,8 +5083,8 @@ static int do_multi(int multi, int size_num)
                     d = atof(sstrsep(&p, sep));
                     sm2_results[k][1] += d;
                 }
-# endif /* OPENSSL_NO_SM2 */
-# ifndef OPENSSL_NO_DH
+#endif /* OPENSSL_NO_SM2 */
+#ifndef OPENSSL_NO_DH
             } else if (CHECK_AND_SKIP_PREFIX(p, "+F8:")) {
                 tk = sstrsep(&p, sep);
                 if (strtoint(tk, 0, OSSL_NELEM(ffdh_results), &k)) {
@@ -4995,7 +5093,7 @@ static int do_multi(int multi, int size_num)
                     d = atof(sstrsep(&p, sep));
                     ffdh_results[k][0] += d;
                 }
-# endif /* OPENSSL_NO_DH */
+#endif /* OPENSSL_NO_DH */
             } else if (CHECK_AND_SKIP_PREFIX(p, "+F9:")) {
                 tk = sstrsep(&p, sep);
                 if (strtoint(tk, 0, OSSL_NELEM(kems_results), &k)) {
@@ -5022,7 +5120,7 @@ static int do_multi(int multi, int size_num)
                 }
             } else if (!HAS_PREFIX(buf, "+H:")) {
                 BIO_printf(bio_err, "Unknown type '%s' from child %d\n", buf,
-                           n);
+                    n);
             }
         }
 
@@ -5033,14 +5131,14 @@ static int do_multi(int multi, int size_num)
         while (wait(&status) == -1)
             if (errno != EINTR) {
                 BIO_printf(bio_err, "Waitng for child failed with 0x%x\n",
-                           errno);
+                    errno);
                 return 1;
             }
         if (WIFEXITED(status) && WEXITSTATUS(status)) {
             BIO_printf(bio_err, "Child exited with %d\n", WEXITSTATUS(status));
         } else if (WIFSIGNALED(status)) {
             BIO_printf(bio_err, "Child terminated by signal %d\n",
-                       WTERMSIG(status));
+                WTERMSIG(status));
         }
     }
     return 1;
@@ -5048,7 +5146,7 @@ static int do_multi(int multi, int size_num)
 #endif
 
 static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
-                             const openssl_speed_sec_t *seconds)
+    const openssl_speed_sec_t *seconds)
 {
     static const int mblengths_list[] = {
         8 * 1024, 2 * 8 * 1024, 4 * 8 * 1024, 8 * 8 * 1024, 8 * 16 * 1024
@@ -5084,7 +5182,8 @@ static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
     OPENSSL_clear_free(key, keylen);
 
     if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_MAC_KEY,
-                             sizeof(no_key), no_key) <= 0)
+            sizeof(no_key), no_key)
+        <= 0)
         app_bail_out("failed to set AEAD key\n");
     if ((alg_name = EVP_CIPHER_get0_name(evp_cipher)) == NULL)
         app_bail_out("failed to get cipher name\n");
@@ -5097,11 +5196,11 @@ static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
             size_t len = mblengths[j];
             int packlen;
 
-            memset(aad, 0, 8);  /* avoid uninitialized values */
-            aad[8] = 23;        /* SSL3_RT_APPLICATION_DATA */
-            aad[9] = 3;         /* version */
+            memset(aad, 0, 8); /* avoid uninitialized values */
+            aad[8] = 23; /* SSL3_RT_APPLICATION_DATA */
+            aad[9] = 3; /* version */
             aad[10] = 2;
-            aad[11] = 0;        /* length */
+            aad[11] = 0; /* length */
             aad[12] = 0;
             mb_param.out = NULL;
             mb_param.inp = aad;
@@ -5109,15 +5208,15 @@ static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
             mb_param.interleave = 8;
 
             packlen = EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_TLS1_1_MULTIBLOCK_AAD,
-                                          sizeof(mb_param), &mb_param);
+                sizeof(mb_param), &mb_param);
 
             if (packlen > 0) {
                 mb_param.out = out;
                 mb_param.inp = inp;
                 mb_param.len = len;
                 (void)EVP_CIPHER_CTX_ctrl(ctx,
-                                          EVP_CTRL_TLS1_1_MULTIBLOCK_ENCRYPT,
-                                          sizeof(mb_param), &mb_param);
+                    EVP_CTRL_TLS1_1_MULTIBLOCK_ENCRYPT,
+                    sizeof(mb_param), &mb_param);
             } else {
                 int pad;
 
@@ -5127,13 +5226,12 @@ static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
                 aad[11] = (unsigned char)(len >> 8);
                 aad[12] = (unsigned char)(len);
                 pad = EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD,
-                                          EVP_AEAD_TLS1_AAD_LEN, aad);
+                    EVP_AEAD_TLS1_AAD_LEN, aad);
                 ciph_success = EVP_Cipher(ctx, out, inp, len + pad);
             }
         }
         d = Time_F(STOP);
-        BIO_printf(bio_err, mr ? "+R:%d:%s:%f\n"
-                   : "%d %s ops in %.2fs\n", count, "evp", d);
+        BIO_printf(bio_err, mr ? "+R:%d:%s:%f\n" : "%d %s ops in %.2fs\n", count, "evp", d);
         if ((ciph_success <= 0) && (mr == 0))
             BIO_printf(bio_err, "Error performing cipher op\n");
         results[D_EVP][j] = ((double)count) / d * mblengths[j];
@@ -5150,7 +5248,7 @@ static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
         fprintf(stdout, "\n");
     } else {
         fprintf(stdout,
-                "The 'numbers' are in 1000s of bytes per second processed.\n");
+            "The 'numbers' are in 1000s of bytes per second processed.\n");
         fprintf(stdout, "type                    ");
         for (j = 0; j < num; j++)
             fprintf(stdout, "%7d bytes", mblengths[j]);
@@ -5166,7 +5264,7 @@ static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
         fprintf(stdout, "\n");
     }
 
- err:
+err:
     OPENSSL_free(inp);
     OPENSSL_free(out);
     EVP_CIPHER_CTX_free(ctx);
diff --git a/crypto/openssl/apps/spkac.c b/crypto/openssl/apps/spkac.c
index 5a129a7fa775..473872194290 100644
--- a/crypto/openssl/apps/spkac.c
+++ b/crypto/openssl/apps/spkac.c
@@ -22,38 +22,48 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_NOOUT, OPT_PUBKEY, OPT_VERIFY, OPT_IN, OPT_OUT,
-    OPT_ENGINE, OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC,
-    OPT_SPKSECT, OPT_KEYFORM, OPT_DIGEST,
+    OPT_NOOUT,
+    OPT_PUBKEY,
+    OPT_VERIFY,
+    OPT_IN,
+    OPT_OUT,
+    OPT_ENGINE,
+    OPT_KEY,
+    OPT_CHALLENGE,
+    OPT_PASSIN,
+    OPT_SPKAC,
+    OPT_SPKSECT,
+    OPT_KEYFORM,
+    OPT_DIGEST,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS spkac_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"spksect", OPT_SPKSECT, 's',
-     "Specify the name of an SPKAC-dedicated section of configuration"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "spksect", OPT_SPKSECT, 's',
+        "Specify the name of an SPKAC-dedicated section of configuration" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Input"),
-    {"in", OPT_IN, '<', "Input file"},
-    {"key", OPT_KEY, '<', "Create SPKAC using private key"},
-    {"keyform", OPT_KEYFORM, 'f', "Private key file format (ENGINE, other values ignored)"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"challenge", OPT_CHALLENGE, 's', "Challenge string"},
-    {"spkac", OPT_SPKAC, 's', "Alternative SPKAC name"},
+    { "in", OPT_IN, '<', "Input file" },
+    { "key", OPT_KEY, '<', "Create SPKAC using private key" },
+    { "keyform", OPT_KEYFORM, 'f', "Private key file format (ENGINE, other values ignored)" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "challenge", OPT_CHALLENGE, 's', "Challenge string" },
+    { "spkac", OPT_SPKAC, 's', "Alternative SPKAC name" },
 
     OPT_SECTION("Output"),
-    {"digest", OPT_DIGEST, 's', "Sign new SPKAC with the specified digest (default: MD5)" },
-    {"out", OPT_OUT, '>', "Output file"},
-    {"noout", OPT_NOOUT, '-', "Don't print SPKAC"},
-    {"pubkey", OPT_PUBKEY, '-', "Output public key"},
-    {"verify", OPT_VERIFY, '-', "Verify SPKAC signature"},
+    { "digest", OPT_DIGEST, 's', "Sign new SPKAC with the specified digest (default: MD5)" },
+    { "out", OPT_OUT, '>', "Output file" },
+    { "noout", OPT_NOOUT, '-', "Don't print SPKAC" },
+    { "pubkey", OPT_PUBKEY, '-', "Output public key" },
+    { "verify", OPT_VERIFY, '-', "Verify SPKAC signature" },
 
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 int spkac_main(int argc, char **argv)
@@ -78,7 +88,7 @@ int spkac_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -146,7 +156,7 @@ int spkac_main(int argc, char **argv)
             goto end;
 
         pkey = load_key(strcmp(keyfile, "-") ? keyfile : NULL,
-                        keyformat, 1, passin, e, "private key");
+            keyformat, 1, passin, e, "private key");
         if (pkey == NULL)
             goto end;
         spki = NETSCAPE_SPKI_new();
@@ -154,7 +164,7 @@ int spkac_main(int argc, char **argv)
             goto end;
         if (challenge != NULL
             && !ASN1_STRING_set(spki->spkac->challenge,
-                                challenge, (int)strlen(challenge)))
+                challenge, (int)strlen(challenge)))
             goto end;
         if (!NETSCAPE_SPKI_set_pubkey(spki, pkey)) {
             BIO_printf(bio_err, "Error setting public key\n");
@@ -221,7 +231,7 @@ int spkac_main(int argc, char **argv)
 
     ret = 0;
 
- end:
+end:
     EVP_MD_free(md);
     NCONF_free(conf);
     NETSCAPE_SPKI_free(spki);
diff --git a/crypto/openssl/apps/srp.c b/crypto/openssl/apps/srp.c
index a9466f830289..ac0e15f49c0b 100644
--- a/crypto/openssl/apps/srp.c
+++ b/crypto/openssl/apps/srp.c
@@ -28,12 +28,11 @@
 #include "apps.h"
 #include "progs.h"
 
-#define BASE_SECTION    "srp"
+#define BASE_SECTION "srp"
 #define CONFIG_FILE "openssl.cnf"
 
-
-#define ENV_DATABASE            "srpvfile"
-#define ENV_DEFAULT_SRP         "default_srp"
+#define ENV_DATABASE "srpvfile"
+#define ENV_DEFAULT_SRP "default_srp"
 
 static int get_index(CA_DB *db, char *id, char type)
 {
@@ -86,9 +85,8 @@ static void print_user(CA_DB *db, int userindex, int verbose)
         if (pp[DB_srptype][0] != 'I') {
             print_entry(db, userindex, verbose, "User entry");
             print_entry(db, get_index(db, pp[DB_srpgN], 'I'), verbose,
-                        "g N entry");
+                "g N entry");
         }
-
     }
 }
 
@@ -120,8 +118,8 @@ static char *lookup_conf(const CONF *conf, const char *section, const char *tag)
 }
 
 static char *srp_verify_user(const char *user, const char *srp_verifier,
-                             char *srp_usersalt, const char *g, const char *N,
-                             const char *passin, int verbose)
+    char *srp_usersalt, const char *g, const char *N,
+    const char *passin, int verbose)
 {
     char password[1025];
     PW_CB_DATA cb_tmp;
@@ -132,19 +130,20 @@ static char *srp_verify_user(const char *user, const char *srp_verifier,
     cb_tmp.prompt_info = user;
     cb_tmp.password = passin;
 
-    len = password_callback(password, sizeof(password)-1, 0, &cb_tmp);
+    len = password_callback(password, sizeof(password) - 1, 0, &cb_tmp);
     if (len > 0) {
         password[len] = 0;
         if (verbose)
             BIO_printf(bio_err,
-                       "Validating\n   user=\"%s\"\n srp_verifier=\"%s\"\n srp_usersalt=\"%s\"\n g=\"%s\"\n N=\"%s\"\n",
-                       user, srp_verifier, srp_usersalt, g, N);
+                "Validating\n   user=\"%s\"\n srp_verifier=\"%s\"\n srp_usersalt=\"%s\"\n g=\"%s\"\n N=\"%s\"\n",
+                user, srp_verifier, srp_usersalt, g, N);
         if (verbose > 1)
             BIO_printf(bio_err, "Pass %s\n", password);
 
         OPENSSL_assert(srp_usersalt != NULL);
         if ((gNid = SRP_create_verifier(user, password, &srp_usersalt,
-                                        &verifier, N, g)) == NULL) {
+                 &verifier, N, g))
+            == NULL) {
             BIO_printf(bio_err, "Internal error validating SRP verifier\n");
         } else {
             if (strcmp(verifier, srp_verifier))
@@ -157,8 +156,8 @@ static char *srp_verify_user(const char *user, const char *srp_verifier,
 }
 
 static char *srp_create_user(char *user, char **srp_verifier,
-                             char **srp_usersalt, char *g, char *N,
-                             char *passout, int verbose)
+    char **srp_usersalt, char *g, char *N,
+    char *passout, int verbose)
 {
     char password[1025];
     PW_CB_DATA cb_tmp;
@@ -168,14 +167,15 @@ static char *srp_create_user(char *user, char **srp_verifier,
     cb_tmp.prompt_info = user;
     cb_tmp.password = passout;
 
-    len = password_callback(password, sizeof(password)-1, 1, &cb_tmp);
+    len = password_callback(password, sizeof(password) - 1, 1, &cb_tmp);
     if (len > 0) {
         password[len] = 0;
         if (verbose)
             BIO_printf(bio_err, "Creating\n user=\"%s\"\n g=\"%s\"\n N=\"%s\"\n",
-                       user, g, N);
+                user, g, N);
         if ((gNid = SRP_create_verifier(user, password, &salt,
-                                        srp_verifier, N, g)) == NULL) {
+                 srp_verifier, N, g))
+            == NULL) {
             BIO_printf(bio_err, "Internal error creating SRP verifier\n");
         } else {
             *srp_usersalt = salt;
@@ -183,50 +183,61 @@ static char *srp_create_user(char *user, char **srp_verifier,
         OPENSSL_cleanse(password, len);
         if (verbose > 1)
             BIO_printf(bio_err, "gNid=%s salt =\"%s\"\n verifier =\"%s\"\n",
-                       gNid, salt, *srp_verifier);
-
+                gNid, salt, *srp_verifier);
     }
     return gNid;
 }
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SRPVFILE, OPT_ADD,
-    OPT_DELETE, OPT_MODIFY, OPT_LIST, OPT_GN, OPT_USERINFO,
-    OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_VERBOSE,
+    OPT_CONFIG,
+    OPT_NAME,
+    OPT_SRPVFILE,
+    OPT_ADD,
+    OPT_DELETE,
+    OPT_MODIFY,
+    OPT_LIST,
+    OPT_GN,
+    OPT_USERINFO,
+    OPT_PASSIN,
+    OPT_PASSOUT,
+    OPT_ENGINE,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS srp_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [user...]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [user...]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"verbose", OPT_VERBOSE, '-', "Talk a lot while doing things"},
-    {"config", OPT_CONFIG, '<', "A config file"},
-    {"name", OPT_NAME, 's', "The particular srp definition to use"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "verbose", OPT_VERBOSE, '-', "Talk a lot while doing things" },
+    { "config", OPT_CONFIG, '<', "A config file" },
+    { "name", OPT_NAME, 's', "The particular srp definition to use" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Action"),
-    {"add", OPT_ADD, '-', "Add a user and SRP verifier"},
-    {"modify", OPT_MODIFY, '-', "Modify the SRP verifier of an existing user"},
-    {"delete", OPT_DELETE, '-', "Delete user from verifier file"},
-    {"list", OPT_LIST, '-', "List users"},
+    { "add", OPT_ADD, '-', "Add a user and SRP verifier" },
+    { "modify", OPT_MODIFY, '-', "Modify the SRP verifier of an existing user" },
+    { "delete", OPT_DELETE, '-', "Delete user from verifier file" },
+    { "list", OPT_LIST, '-', "List users" },
 
     OPT_SECTION("Configuration"),
-    {"srpvfile", OPT_SRPVFILE, '<', "The srp verifier file name"},
-    {"gn", OPT_GN, 's', "Set g and N values to be used for new verifier"},
-    {"userinfo", OPT_USERINFO, 's', "Additional info to be set for user"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
+    { "srpvfile", OPT_SRPVFILE, '<', "The srp verifier file name" },
+    { "gn", OPT_GN, 's', "Set g and N values to be used for new verifier" },
+    { "userinfo", OPT_USERINFO, 's', "Additional info to be set for user" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "passout", OPT_PASSOUT, 's', "Output file pass phrase source" },
 
     OPT_R_OPTIONS,
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"user", 0, 0, "Username(s) to process (optional)"},
-    {NULL}
+    { "user", 0, 0, "Username(s) to process (optional)" },
+    { NULL }
 };
 
 int srp_main(int argc, char **argv)
@@ -248,7 +259,7 @@ int srp_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -273,8 +284,8 @@ int srp_main(int argc, char **argv)
         case OPT_LIST:
             if (mode != OPT_ERR) {
                 BIO_printf(bio_err,
-                           "%s: Only one of -add/-delete/-modify/-list\n",
-                           prog);
+                    "%s: Only one of -add/-delete/-modify/-list\n",
+                    prog);
                 goto opthelp;
             }
             mode = o;
@@ -314,12 +325,12 @@ int srp_main(int argc, char **argv)
 
     if (srpvfile != NULL && configfile != NULL) {
         BIO_printf(bio_err,
-                   "-srpvfile and -configfile cannot be specified together.\n");
+            "-srpvfile and -configfile cannot be specified together.\n");
         goto end;
     }
     if (mode == OPT_ERR) {
         BIO_printf(bio_err,
-                   "Exactly one of the options -add, -delete, -modify -list must be specified.\n");
+            "Exactly one of the options -add, -delete, -modify -list must be specified.\n");
         goto opthelp;
     }
     if (mode == OPT_DELETE || mode == OPT_MODIFY || mode == OPT_ADD) {
@@ -331,7 +342,7 @@ int srp_main(int argc, char **argv)
     }
     if ((passinarg != NULL || passoutarg != NULL) && argc != 1) {
         BIO_printf(bio_err,
-                   "-passin, -passout arguments only valid with one user.\n");
+            "-passin, -passout arguments only valid with one user.\n");
         goto opthelp;
     }
 
@@ -354,8 +365,8 @@ int srp_main(int argc, char **argv)
         if (section == NULL) {
             if (verbose)
                 BIO_printf(bio_err,
-                           "trying to read " ENV_DEFAULT_SRP
-                           " in " BASE_SECTION "\n");
+                    "trying to read " ENV_DEFAULT_SRP
+                    " in " BASE_SECTION "\n");
 
             section = lookup_conf(conf, BASE_SECTION, ENV_DEFAULT_SRP);
             if (section == NULL)
@@ -366,8 +377,8 @@ int srp_main(int argc, char **argv)
 
         if (verbose)
             BIO_printf(bio_err,
-                       "trying to read " ENV_DATABASE " in section \"%s\"\n",
-                       section);
+                "trying to read " ENV_DATABASE " in section \"%s\"\n",
+                section);
 
         srpvfile = lookup_conf(conf, section, ENV_DATABASE);
         if (srpvfile == NULL)
@@ -376,7 +387,7 @@ int srp_main(int argc, char **argv)
 
     if (verbose)
         BIO_printf(bio_err, "Trying to read SRP verifier file \"%s\"\n",
-                   srpvfile);
+            srpvfile);
 
     db = load_index(srpvfile, NULL);
     if (db == NULL) {
@@ -431,14 +442,13 @@ int srp_main(int argc, char **argv)
                     print_user(db, i, 1);
             } else if (userindex < 0) {
                 BIO_printf(bio_err,
-                           "user \"%s\" does not exist, ignored. t\n", user);
+                    "user \"%s\" does not exist, ignored. t\n", user);
                 errors++;
             }
         } else if (mode == OPT_ADD) {
             if (userindex >= 0) {
                 /* reactivation of a new user */
-                char **row =
-                    sk_OPENSSL_PSTRING_value(db->db->data, userindex);
+                char **row = sk_OPENSSL_PSTRING_value(db->db->data, userindex);
                 BIO_printf(bio_err, "user \"%s\" reactivated.\n", user);
                 row[DB_srptype][0] = 'V';
 
@@ -449,16 +459,14 @@ int srp_main(int argc, char **argv)
                 row[DB_srpverifier] = NULL;
                 row[DB_srpsalt] = NULL;
                 row[DB_srpinfo] = NULL;
-                if (!
-                    (gNid =
-                     srp_create_user(user, &(row[DB_srpverifier]),
-                                     &(row[DB_srpsalt]),
-                                     gNrow ? gNrow[DB_srpsalt] : gN,
-                                     gNrow ? gNrow[DB_srpverifier] : NULL,
-                                     passout, verbose))) {
+                if (!(gNid = srp_create_user(user, &(row[DB_srpverifier]),
+                          &(row[DB_srpsalt]),
+                          gNrow ? gNrow[DB_srpsalt] : gN,
+                          gNrow ? gNrow[DB_srpverifier] : NULL,
+                          passout, verbose))) {
                     BIO_printf(bio_err,
-                               "Cannot create srp verifier for user \"%s\", operation abandoned .\n",
-                               user);
+                        "Cannot create srp verifier for user \"%s\", operation abandoned .\n",
+                        user);
                     errors++;
                     goto end;
                 }
@@ -487,18 +495,17 @@ int srp_main(int argc, char **argv)
         } else if (mode == OPT_MODIFY) {
             if (userindex < 0) {
                 BIO_printf(bio_err,
-                           "user \"%s\" does not exist, operation ignored.\n",
-                           user);
+                    "user \"%s\" does not exist, operation ignored.\n",
+                    user);
                 errors++;
             } else {
 
-                char **row =
-                    sk_OPENSSL_PSTRING_value(db->db->data, userindex);
+                char **row = sk_OPENSSL_PSTRING_value(db->db->data, userindex);
                 char type = row[DB_srptype][0];
                 if (type == 'v') {
                     BIO_printf(bio_err,
-                               "user \"%s\" already updated, operation ignored.\n",
-                               user);
+                        "user \"%s\" already updated, operation ignored.\n",
+                        user);
                     errors++;
                 } else {
                     char *gNid;
@@ -508,40 +515,35 @@ int srp_main(int argc, char **argv)
                         char **irow = NULL;
                         if (verbose)
                             BIO_printf(bio_err,
-                                       "Verifying password for user \"%s\"\n",
-                                       user);
-                        if ((user_gN =
-                             get_index(db, row[DB_srpgN], DB_SRP_INDEX)) >= 0)
-                            irow =
-                                sk_OPENSSL_PSTRING_value(db->db->data,
-                                                         userindex);
+                                "Verifying password for user \"%s\"\n",
+                                user);
+                        if ((user_gN = get_index(db, row[DB_srpgN], DB_SRP_INDEX)) >= 0)
+                            irow = sk_OPENSSL_PSTRING_value(db->db->data,
+                                userindex);
 
-                        if (!srp_verify_user
-                            (user, row[DB_srpverifier], row[DB_srpsalt],
-                             irow ? irow[DB_srpsalt] : row[DB_srpgN],
-                             irow ? irow[DB_srpverifier] : NULL, passin,
-                             verbose)) {
+                        if (!srp_verify_user(user, row[DB_srpverifier], row[DB_srpsalt],
+                                irow ? irow[DB_srpsalt] : row[DB_srpgN],
+                                irow ? irow[DB_srpverifier] : NULL, passin,
+                                verbose)) {
                             BIO_printf(bio_err,
-                                       "Invalid password for user \"%s\", operation abandoned.\n",
-                                       user);
+                                "Invalid password for user \"%s\", operation abandoned.\n",
+                                user);
                             errors++;
                             goto end;
                         }
                     }
                     if (verbose)
                         BIO_printf(bio_err, "Password for user \"%s\" ok.\n",
-                                   user);
+                            user);
 
-                    if (!
-                        (gNid =
-                         srp_create_user(user, &(row[DB_srpverifier]),
-                                         &(row[DB_srpsalt]),
-                                         gNrow ? gNrow[DB_srpsalt] : NULL,
-                                         gNrow ? gNrow[DB_srpverifier] : NULL,
-                                         passout, verbose))) {
+                    if (!(gNid = srp_create_user(user, &(row[DB_srpverifier]),
+                              &(row[DB_srpsalt]),
+                              gNrow ? gNrow[DB_srpsalt] : NULL,
+                              gNrow ? gNrow[DB_srpverifier] : NULL,
+                              passout, verbose))) {
                         BIO_printf(bio_err,
-                                   "Cannot create srp verifier for user \"%s\", operation abandoned.\n",
-                                   user);
+                            "Cannot create srp verifier for user \"%s\", operation abandoned.\n",
+                            user);
                         errors++;
                         goto end;
                     }
@@ -565,8 +567,8 @@ int srp_main(int argc, char **argv)
         } else if (mode == OPT_DELETE) {
             if (userindex < 0) {
                 BIO_printf(bio_err,
-                           "user \"%s\" does not exist, operation ignored. t\n",
-                           user);
+                    "user \"%s\" does not exist, operation ignored. t\n",
+                    user);
                 errors++;
             } else {
                 char **xpp = sk_OPENSSL_PSTRING_value(db->db->data, userindex);
@@ -612,7 +614,7 @@ int srp_main(int argc, char **argv)
     }
 
     ret = (errors != 0);
- end:
+end:
     if (errors != 0)
         if (verbose)
             BIO_printf(bio_err, "User errors %d.\n", errors);
diff --git a/crypto/openssl/apps/storeutl.c b/crypto/openssl/apps/storeutl.c
index f8ebde44481c..27cbe69dbaad 100644
--- a/crypto/openssl/apps/storeutl.c
+++ b/crypto/openssl/apps/storeutl.c
@@ -14,59 +14,69 @@
 #include <openssl/err.h>
 #include <openssl/pem.h>
 #include <openssl/store.h>
-#include <openssl/x509v3.h>      /* s2i_ASN1_INTEGER */
+#include <openssl/x509v3.h> /* s2i_ASN1_INTEGER */
 
 static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
-                   int expected, int criterion, OSSL_STORE_SEARCH *search,
-                   int text, int noout, int recursive, int indent, const char *outfile,
-                   const char *prog, OSSL_LIB_CTX *libctx);
+    int expected, int criterion, OSSL_STORE_SEARCH *search,
+    int text, int noout, int recursive, int indent, const char *outfile,
+    const char *prog, OSSL_LIB_CTX *libctx);
 
 static BIO *out = NULL;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_OUT, OPT_PASSIN,
-    OPT_NOOUT, OPT_TEXT, OPT_RECURSIVE,
-    OPT_SEARCHFOR_CERTS, OPT_SEARCHFOR_KEYS, OPT_SEARCHFOR_CRLS,
-    OPT_CRITERION_SUBJECT, OPT_CRITERION_ISSUER, OPT_CRITERION_SERIAL,
-    OPT_CRITERION_FINGERPRINT, OPT_CRITERION_ALIAS,
-    OPT_MD, OPT_PROV_ENUM
+    OPT_ENGINE,
+    OPT_OUT,
+    OPT_PASSIN,
+    OPT_NOOUT,
+    OPT_TEXT,
+    OPT_RECURSIVE,
+    OPT_SEARCHFOR_CERTS,
+    OPT_SEARCHFOR_KEYS,
+    OPT_SEARCHFOR_CRLS,
+    OPT_CRITERION_SUBJECT,
+    OPT_CRITERION_ISSUER,
+    OPT_CRITERION_SERIAL,
+    OPT_CRITERION_FINGERPRINT,
+    OPT_CRITERION_ALIAS,
+    OPT_MD,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS storeutl_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] uri\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] uri\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"", OPT_MD, '-', "Any supported digest"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "", OPT_MD, '-', "Any supported digest" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
 
     OPT_SECTION("Search"),
-    {"certs", OPT_SEARCHFOR_CERTS, '-', "Search for certificates only"},
-    {"keys", OPT_SEARCHFOR_KEYS, '-', "Search for keys only"},
-    {"crls", OPT_SEARCHFOR_CRLS, '-', "Search for CRLs only"},
-    {"subject", OPT_CRITERION_SUBJECT, 's', "Search by subject"},
-    {"issuer", OPT_CRITERION_ISSUER, 's', "Search by issuer and serial, issuer name"},
-    {"serial", OPT_CRITERION_SERIAL, 's', "Search by issuer and serial, serial number"},
-    {"fingerprint", OPT_CRITERION_FINGERPRINT, 's', "Search by public key fingerprint, given in hex"},
-    {"alias", OPT_CRITERION_ALIAS, 's', "Search by alias"},
-    {"r", OPT_RECURSIVE, '-', "Recurse through names"},
+    { "certs", OPT_SEARCHFOR_CERTS, '-', "Search for certificates only" },
+    { "keys", OPT_SEARCHFOR_KEYS, '-', "Search for keys only" },
+    { "crls", OPT_SEARCHFOR_CRLS, '-', "Search for CRLs only" },
+    { "subject", OPT_CRITERION_SUBJECT, 's', "Search by subject" },
+    { "issuer", OPT_CRITERION_ISSUER, 's', "Search by issuer and serial, issuer name" },
+    { "serial", OPT_CRITERION_SERIAL, 's', "Search by issuer and serial, serial number" },
+    { "fingerprint", OPT_CRITERION_FINGERPRINT, 's', "Search by public key fingerprint, given in hex" },
+    { "alias", OPT_CRITERION_ALIAS, 's', "Search by alias" },
+    { "r", OPT_RECURSIVE, '-', "Recurse through names" },
 
     OPT_SECTION("Input"),
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
 
     OPT_SECTION("Output"),
-    {"out", OPT_OUT, '>', "Output file - default stdout"},
-    {"text", OPT_TEXT, '-', "Print a text form of the objects"},
-    {"noout", OPT_NOOUT, '-', "No PEM output, just status"},
+    { "out", OPT_OUT, '>', "Output file - default stdout" },
+    { "text", OPT_TEXT, '-', "Print a text form of the objects" },
+    { "noout", OPT_NOOUT, '-', "No PEM output, just status" },
 
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"uri", 0, 0, "URI of the store object"},
-    {NULL}
+    { "uri", 0, 0, "URI of the store object" },
+    { NULL }
 };
 
 int storeutl_main(int argc, char *argv[])
@@ -94,7 +104,7 @@ int storeutl_main(int argc, char *argv[])
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -121,7 +131,7 @@ int storeutl_main(int argc, char *argv[])
         case OPT_SEARCHFOR_CRLS:
             if (expected != 0) {
                 BIO_printf(bio_err, "%s: only one search type can be given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             {
@@ -129,9 +139,9 @@ int storeutl_main(int argc, char *argv[])
                     enum OPTION_choice choice;
                     int type;
                 } map[] = {
-                    {OPT_SEARCHFOR_CERTS, OSSL_STORE_INFO_CERT},
-                    {OPT_SEARCHFOR_KEYS, OSSL_STORE_INFO_PKEY},
-                    {OPT_SEARCHFOR_CRLS, OSSL_STORE_INFO_CRL},
+                    { OPT_SEARCHFOR_CERTS, OSSL_STORE_INFO_CERT },
+                    { OPT_SEARCHFOR_KEYS, OSSL_STORE_INFO_PKEY },
+                    { OPT_SEARCHFOR_CRLS, OSSL_STORE_INFO_CRL },
                 };
                 size_t i;
 
@@ -151,13 +161,13 @@ int storeutl_main(int argc, char *argv[])
         case OPT_CRITERION_SUBJECT:
             if (criterion != 0) {
                 BIO_printf(bio_err, "%s: criterion already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             criterion = OSSL_STORE_SEARCH_BY_NAME;
             if (subject != NULL) {
                 BIO_printf(bio_err, "%s: subject already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             subject = parse_name(opt_arg(), MBSTRING_UTF8, 1, "subject");
@@ -168,13 +178,13 @@ int storeutl_main(int argc, char *argv[])
             if (criterion != 0
                 && criterion != OSSL_STORE_SEARCH_BY_ISSUER_SERIAL) {
                 BIO_printf(bio_err, "%s: criterion already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             criterion = OSSL_STORE_SEARCH_BY_ISSUER_SERIAL;
             if (issuer != NULL) {
                 BIO_printf(bio_err, "%s: issuer already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             issuer = parse_name(opt_arg(), MBSTRING_UTF8, 1, "issuer");
@@ -185,31 +195,31 @@ int storeutl_main(int argc, char *argv[])
             if (criterion != 0
                 && criterion != OSSL_STORE_SEARCH_BY_ISSUER_SERIAL) {
                 BIO_printf(bio_err, "%s: criterion already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             criterion = OSSL_STORE_SEARCH_BY_ISSUER_SERIAL;
             if (serial != NULL) {
                 BIO_printf(bio_err, "%s: serial number already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             if ((serial = s2i_ASN1_INTEGER(NULL, opt_arg())) == NULL) {
                 BIO_printf(bio_err, "%s: can't parse serial number argument.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             break;
         case OPT_CRITERION_FINGERPRINT:
             if (criterion != 0) {
                 BIO_printf(bio_err, "%s: criterion already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             criterion = OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT;
             if (fingerprint != NULL) {
                 BIO_printf(bio_err, "%s: fingerprint already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             {
@@ -218,8 +228,8 @@ int storeutl_main(int argc, char *argv[])
                 if ((fingerprint = OPENSSL_hexstr2buf(opt_arg(), &tmplen))
                     == NULL) {
                     BIO_printf(bio_err,
-                               "%s: can't parse fingerprint argument.\n",
-                               prog);
+                        "%s: can't parse fingerprint argument.\n",
+                        prog);
                     goto end;
                 }
                 fingerprintlen = (size_t)tmplen;
@@ -228,18 +238,18 @@ int storeutl_main(int argc, char *argv[])
         case OPT_CRITERION_ALIAS:
             if (criterion != 0) {
                 BIO_printf(bio_err, "%s: criterion already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             criterion = OSSL_STORE_SEARCH_BY_ALIAS;
             if (alias != NULL) {
                 BIO_printf(bio_err, "%s: alias already given.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             if ((alias = OPENSSL_strdup(opt_arg())) == NULL) {
                 BIO_printf(bio_err, "%s: can't parse alias argument.\n",
-                           prog);
+                    prog);
                 goto end;
             }
             break;
@@ -275,8 +285,8 @@ int storeutl_main(int argc, char *argv[])
         case OSSL_STORE_SEARCH_BY_ISSUER_SERIAL:
             if (issuer == NULL || serial == NULL) {
                 BIO_printf(bio_err,
-                           "%s: both -issuer and -serial must be given.\n",
-                           prog);
+                    "%s: both -issuer and -serial must be given.\n",
+                    prog);
                 goto end;
             }
             if ((search = OSSL_STORE_SEARCH_by_issuer_serial(issuer, serial))
@@ -287,8 +297,8 @@ int storeutl_main(int argc, char *argv[])
             break;
         case OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT:
             if ((search = OSSL_STORE_SEARCH_by_key_fingerprint(digest,
-                                                               fingerprint,
-                                                               fingerprintlen))
+                     fingerprint,
+                     fingerprintlen))
                 == NULL) {
                 ERR_print_errors(bio_err);
                 goto end;
@@ -311,10 +321,10 @@ int storeutl_main(int argc, char *argv[])
     pw_cb_data.prompt_info = argv[0];
 
     ret = process(argv[0], get_ui_method(), &pw_cb_data,
-                  expected, criterion, search,
-                  text, noout, recursive, 0, outfile, prog, libctx);
+        expected, criterion, search,
+        text, noout, recursive, 0, outfile, prog, libctx);
 
- end:
+end:
     EVP_MD_free(digest);
     OPENSSL_free(fingerprint);
     OPENSSL_free(alias);
@@ -350,15 +360,15 @@ static int indent_printf(int indent, BIO *bio, const char *format, ...)
 }
 
 static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
-                   int expected, int criterion, OSSL_STORE_SEARCH *search,
-                   int text, int noout, int recursive, int indent, const char *outfile,
-                   const char *prog, OSSL_LIB_CTX *libctx)
+    int expected, int criterion, OSSL_STORE_SEARCH *search,
+    int text, int noout, int recursive, int indent, const char *outfile,
+    const char *prog, OSSL_LIB_CTX *libctx)
 {
     OSSL_STORE_CTX *store_ctx = NULL;
     int ret = 1, items = 0;
 
     if ((store_ctx = OSSL_STORE_open_ex(uri, libctx, app_get0_propq(), uimeth, uidata,
-                                        NULL, NULL, NULL))
+             NULL, NULL, NULL))
         == NULL) {
         BIO_printf(bio_err, "Couldn't open file or uri %s\n", uri);
         ERR_print_errors(bio_err);
@@ -375,8 +385,8 @@ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
     if (criterion != 0) {
         if (!OSSL_STORE_supports_search(store_ctx, criterion)) {
             BIO_printf(bio_err,
-                       "%s: the store scheme doesn't support the given search criteria.\n",
-                       prog);
+                "%s: the store scheme doesn't support the given search criteria.\n",
+                prog);
             goto end2;
         }
 
@@ -392,8 +402,7 @@ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
     for (;;) {
         OSSL_STORE_INFO *info = OSSL_STORE_load(store_ctx);
         int type = info == NULL ? 0 : OSSL_STORE_INFO_get_type(info);
-        const char *infostr =
-            info == NULL ? NULL : OSSL_STORE_INFO_type_string(type);
+        const char *infostr = info == NULL ? NULL : OSSL_STORE_INFO_type_string(type);
 
         if (info == NULL) {
             if (OSSL_STORE_error(store_ctx)) {
@@ -411,8 +420,8 @@ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
                 break;
 
             BIO_printf(bio_err,
-                       "ERROR: OSSL_STORE_load() returned NULL without "
-                       "eof or error indications\n");
+                "ERROR: OSSL_STORE_load() returned NULL without "
+                "eof or error indications\n");
             BIO_printf(bio_err, "       This is an error in the loader\n");
             ERR_print_errors(bio_err);
             ret++;
@@ -423,7 +432,7 @@ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
             const char *name = OSSL_STORE_INFO_get0_NAME(info);
             const char *desc = OSSL_STORE_INFO_get0_NAME_description(info);
             indent_printf(indent, bio_out, "%d: %s: %s\n", items, infostr,
-                          name);
+                name);
             if (desc != NULL)
                 indent_printf(indent, bio_out, "%s\n", desc);
         } else {
@@ -447,33 +456,33 @@ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
             if (recursive) {
                 const char *suburi = OSSL_STORE_INFO_get0_NAME(info);
                 ret += process(suburi, uimeth, uidata,
-                               expected, criterion, search,
-                               text, noout, recursive, indent + 2, outfile, prog,
-                               libctx);
+                    expected, criterion, search,
+                    text, noout, recursive, indent + 2, outfile, prog,
+                    libctx);
             }
             break;
         case OSSL_STORE_INFO_PARAMS:
             if (text)
                 EVP_PKEY_print_params(out, OSSL_STORE_INFO_get0_PARAMS(info),
-                                      0, NULL);
+                    0, NULL);
             if (!noout)
                 PEM_write_bio_Parameters(out,
-                                         OSSL_STORE_INFO_get0_PARAMS(info));
+                    OSSL_STORE_INFO_get0_PARAMS(info));
             break;
         case OSSL_STORE_INFO_PUBKEY:
             if (text)
                 EVP_PKEY_print_public(out, OSSL_STORE_INFO_get0_PUBKEY(info),
-                                      0, NULL);
+                    0, NULL);
             if (!noout)
                 PEM_write_bio_PUBKEY(out, OSSL_STORE_INFO_get0_PUBKEY(info));
             break;
         case OSSL_STORE_INFO_PKEY:
             if (text)
                 EVP_PKEY_print_private(out, OSSL_STORE_INFO_get0_PKEY(info),
-                                       0, NULL);
+                    0, NULL);
             if (!noout)
                 PEM_write_bio_PrivateKey(out, OSSL_STORE_INFO_get0_PKEY(info),
-                                         NULL, NULL, 0, NULL, NULL);
+                    NULL, NULL, 0, NULL, NULL);
             break;
         case OSSL_STORE_INFO_CERT:
             if (text)
@@ -497,7 +506,7 @@ static int process(const char *uri, const UI_METHOD *uimeth, PW_CB_DATA *uidata,
     }
     indent_printf(indent, out, "Total found: %d\n", items);
 
- end2:
+end2:
     if (!OSSL_STORE_close(store_ctx)) {
         ERR_print_errors(bio_err);
         ret++;
diff --git a/crypto/openssl/apps/testdsa.h b/crypto/openssl/apps/testdsa.h
index d80d2cf7f2d2..e8d04bb31e8a 100644
--- a/crypto/openssl/apps/testdsa.h
+++ b/crypto/openssl/apps/testdsa.h
@@ -13,45 +13,274 @@
 EVP_PKEY *get_dsa(int);
 
 static unsigned char dsa512_priv[] = {
-    0x65, 0xe5, 0xc7, 0x38, 0x60, 0x24, 0xb5, 0x89, 0xd4, 0x9c, 0xeb, 0x4c,
-    0x9c, 0x1d, 0x7a, 0x22, 0xbd, 0xd1, 0xc2, 0xd2,
+    0x65,
+    0xe5,
+    0xc7,
+    0x38,
+    0x60,
+    0x24,
+    0xb5,
+    0x89,
+    0xd4,
+    0x9c,
+    0xeb,
+    0x4c,
+    0x9c,
+    0x1d,
+    0x7a,
+    0x22,
+    0xbd,
+    0xd1,
+    0xc2,
+    0xd2,
 };
 
 static unsigned char dsa512_pub[] = {
-    0x00, 0x95, 0xa7, 0x0d, 0xec, 0x93, 0x68, 0xba, 0x5f, 0xf7, 0x5f, 0x07,
-    0xf2, 0x3b, 0xad, 0x6b, 0x01, 0xdc, 0xbe, 0xec, 0xde, 0x04, 0x7a, 0x3a,
-    0x27, 0xb3, 0xec, 0x49, 0xfd, 0x08, 0x43, 0x3d, 0x7e, 0xa8, 0x2c, 0x5e,
-    0x7b, 0xbb, 0xfc, 0xf4, 0x6e, 0xeb, 0x6c, 0xb0, 0x6e, 0xf8, 0x02, 0x12,
-    0x8c, 0x38, 0x5d, 0x83, 0x56, 0x7d, 0xee, 0x53, 0x05, 0x3e, 0x24, 0x84,
-    0xbe, 0xba, 0x0a, 0x6b, 0xc8,
+    0x00,
+    0x95,
+    0xa7,
+    0x0d,
+    0xec,
+    0x93,
+    0x68,
+    0xba,
+    0x5f,
+    0xf7,
+    0x5f,
+    0x07,
+    0xf2,
+    0x3b,
+    0xad,
+    0x6b,
+    0x01,
+    0xdc,
+    0xbe,
+    0xec,
+    0xde,
+    0x04,
+    0x7a,
+    0x3a,
+    0x27,
+    0xb3,
+    0xec,
+    0x49,
+    0xfd,
+    0x08,
+    0x43,
+    0x3d,
+    0x7e,
+    0xa8,
+    0x2c,
+    0x5e,
+    0x7b,
+    0xbb,
+    0xfc,
+    0xf4,
+    0x6e,
+    0xeb,
+    0x6c,
+    0xb0,
+    0x6e,
+    0xf8,
+    0x02,
+    0x12,
+    0x8c,
+    0x38,
+    0x5d,
+    0x83,
+    0x56,
+    0x7d,
+    0xee,
+    0x53,
+    0x05,
+    0x3e,
+    0x24,
+    0x84,
+    0xbe,
+    0xba,
+    0x0a,
+    0x6b,
+    0xc8,
 };
 
 static unsigned char dsa512_p[] = {
-    0x9D, 0x1B, 0x69, 0x8E, 0x26, 0xDB, 0xF2, 0x2B, 0x11, 0x70, 0x19, 0x86,
-    0xF6, 0x19, 0xC8, 0xF8, 0x19, 0xF2, 0x18, 0x53, 0x94, 0x46, 0x06, 0xD0,
-    0x62, 0x50, 0x33, 0x4B, 0x02, 0x3C, 0x52, 0x30, 0x03, 0x8B, 0x3B, 0xF9,
-    0x5F, 0xD1, 0x24, 0x06, 0x4F, 0x7B, 0x4C, 0xBA, 0xAA, 0x40, 0x9B, 0xFD,
-    0x96, 0xE4, 0x37, 0x33, 0xBB, 0x2D, 0x5A, 0xD7, 0x5A, 0x11, 0x40, 0x66,
-    0xA2, 0x76, 0x7D, 0x31,
+    0x9D,
+    0x1B,
+    0x69,
+    0x8E,
+    0x26,
+    0xDB,
+    0xF2,
+    0x2B,
+    0x11,
+    0x70,
+    0x19,
+    0x86,
+    0xF6,
+    0x19,
+    0xC8,
+    0xF8,
+    0x19,
+    0xF2,
+    0x18,
+    0x53,
+    0x94,
+    0x46,
+    0x06,
+    0xD0,
+    0x62,
+    0x50,
+    0x33,
+    0x4B,
+    0x02,
+    0x3C,
+    0x52,
+    0x30,
+    0x03,
+    0x8B,
+    0x3B,
+    0xF9,
+    0x5F,
+    0xD1,
+    0x24,
+    0x06,
+    0x4F,
+    0x7B,
+    0x4C,
+    0xBA,
+    0xAA,
+    0x40,
+    0x9B,
+    0xFD,
+    0x96,
+    0xE4,
+    0x37,
+    0x33,
+    0xBB,
+    0x2D,
+    0x5A,
+    0xD7,
+    0x5A,
+    0x11,
+    0x40,
+    0x66,
+    0xA2,
+    0x76,
+    0x7D,
+    0x31,
 };
 
 static unsigned char dsa512_q[] = {
-    0xFB, 0x53, 0xEF, 0x50, 0xB4, 0x40, 0x92, 0x31, 0x56, 0x86, 0x53, 0x7A,
-    0xE8, 0x8B, 0x22, 0x9A, 0x49, 0xFB, 0x71, 0x8F,
+    0xFB,
+    0x53,
+    0xEF,
+    0x50,
+    0xB4,
+    0x40,
+    0x92,
+    0x31,
+    0x56,
+    0x86,
+    0x53,
+    0x7A,
+    0xE8,
+    0x8B,
+    0x22,
+    0x9A,
+    0x49,
+    0xFB,
+    0x71,
+    0x8F,
 };
 
 static unsigned char dsa512_g[] = {
-    0x83, 0x3E, 0x88, 0xE5, 0xC5, 0x89, 0x73, 0xCE, 0x3B, 0x6C, 0x01, 0x49,
-    0xBF, 0xB3, 0xC7, 0x9F, 0x0A, 0xEA, 0x44, 0x91, 0xE5, 0x30, 0xAA, 0xD9,
-    0xBE, 0x5B, 0x5F, 0xB7, 0x10, 0xD7, 0x89, 0xB7, 0x8E, 0x74, 0xFB, 0xCF,
-    0x29, 0x1E, 0xEB, 0xA8, 0x2C, 0x54, 0x51, 0xB8, 0x10, 0xDE, 0xA0, 0xCE,
-    0x2F, 0xCC, 0x24, 0x6B, 0x90, 0x77, 0xDE, 0xA2, 0x68, 0xA6, 0x52, 0x12,
-    0xA2, 0x03, 0x9D, 0x20,
+    0x83,
+    0x3E,
+    0x88,
+    0xE5,
+    0xC5,
+    0x89,
+    0x73,
+    0xCE,
+    0x3B,
+    0x6C,
+    0x01,
+    0x49,
+    0xBF,
+    0xB3,
+    0xC7,
+    0x9F,
+    0x0A,
+    0xEA,
+    0x44,
+    0x91,
+    0xE5,
+    0x30,
+    0xAA,
+    0xD9,
+    0xBE,
+    0x5B,
+    0x5F,
+    0xB7,
+    0x10,
+    0xD7,
+    0x89,
+    0xB7,
+    0x8E,
+    0x74,
+    0xFB,
+    0xCF,
+    0x29,
+    0x1E,
+    0xEB,
+    0xA8,
+    0x2C,
+    0x54,
+    0x51,
+    0xB8,
+    0x10,
+    0xDE,
+    0xA0,
+    0xCE,
+    0x2F,
+    0xCC,
+    0x24,
+    0x6B,
+    0x90,
+    0x77,
+    0xDE,
+    0xA2,
+    0x68,
+    0xA6,
+    0x52,
+    0x12,
+    0xA2,
+    0x03,
+    0x9D,
+    0x20,
 };
 
 static unsigned char dsa1024_priv[] = {
-    0x7d, 0x21, 0xda, 0xbb, 0x62, 0x15, 0x47, 0x36, 0x07, 0x67, 0x12, 0xe8,
-    0x8c, 0xaa, 0x1c, 0xcd, 0x38, 0x12, 0x61, 0x18,
+    0x7d,
+    0x21,
+    0xda,
+    0xbb,
+    0x62,
+    0x15,
+    0x47,
+    0x36,
+    0x07,
+    0x67,
+    0x12,
+    0xe8,
+    0x8c,
+    0xaa,
+    0x1c,
+    0xcd,
+    0x38,
+    0x12,
+    0x61,
+    0x18,
 };
 
 static unsigned char dsa1024_pub[] = {
@@ -69,121 +298,1111 @@ static unsigned char dsa1024_pub[] = {
 };
 
 static unsigned char dsa1024_p[] = {
-    0xA7, 0x3F, 0x6E, 0x85, 0xBF, 0x41, 0x6A, 0x29, 0x7D, 0xF0, 0x9F, 0x47,
-    0x19, 0x30, 0x90, 0x9A, 0x09, 0x1D, 0xDA, 0x6A, 0x33, 0x1E, 0xC5, 0x3D,
-    0x86, 0x96, 0xB3, 0x15, 0xE0, 0x53, 0x2E, 0x8F, 0xE0, 0x59, 0x82, 0x73,
-    0x90, 0x3E, 0x75, 0x31, 0x99, 0x47, 0x7A, 0x52, 0xFB, 0x85, 0xE4, 0xD9,
-    0xA6, 0x7B, 0x38, 0x9B, 0x68, 0x8A, 0x84, 0x9B, 0x87, 0xC6, 0x1E, 0xB5,
-    0x7E, 0x86, 0x4B, 0x53, 0x5B, 0x59, 0xCF, 0x71, 0x65, 0x19, 0x88, 0x6E,
-    0xCE, 0x66, 0xAE, 0x6B, 0x88, 0x36, 0xFB, 0xEC, 0x28, 0xDC, 0xC2, 0xD7,
-    0xA5, 0xBB, 0xE5, 0x2C, 0x39, 0x26, 0x4B, 0xDA, 0x9A, 0x70, 0x18, 0x95,
-    0x37, 0x95, 0x10, 0x56, 0x23, 0xF6, 0x15, 0xED, 0xBA, 0x04, 0x5E, 0xDE,
-    0x39, 0x4F, 0xFD, 0xB7, 0x43, 0x1F, 0xB5, 0xA4, 0x65, 0x6F, 0xCD, 0x80,
-    0x11, 0xE4, 0x70, 0x95, 0x5B, 0x50, 0xCD, 0x49,
+    0xA7,
+    0x3F,
+    0x6E,
+    0x85,
+    0xBF,
+    0x41,
+    0x6A,
+    0x29,
+    0x7D,
+    0xF0,
+    0x9F,
+    0x47,
+    0x19,
+    0x30,
+    0x90,
+    0x9A,
+    0x09,
+    0x1D,
+    0xDA,
+    0x6A,
+    0x33,
+    0x1E,
+    0xC5,
+    0x3D,
+    0x86,
+    0x96,
+    0xB3,
+    0x15,
+    0xE0,
+    0x53,
+    0x2E,
+    0x8F,
+    0xE0,
+    0x59,
+    0x82,
+    0x73,
+    0x90,
+    0x3E,
+    0x75,
+    0x31,
+    0x99,
+    0x47,
+    0x7A,
+    0x52,
+    0xFB,
+    0x85,
+    0xE4,
+    0xD9,
+    0xA6,
+    0x7B,
+    0x38,
+    0x9B,
+    0x68,
+    0x8A,
+    0x84,
+    0x9B,
+    0x87,
+    0xC6,
+    0x1E,
+    0xB5,
+    0x7E,
+    0x86,
+    0x4B,
+    0x53,
+    0x5B,
+    0x59,
+    0xCF,
+    0x71,
+    0x65,
+    0x19,
+    0x88,
+    0x6E,
+    0xCE,
+    0x66,
+    0xAE,
+    0x6B,
+    0x88,
+    0x36,
+    0xFB,
+    0xEC,
+    0x28,
+    0xDC,
+    0xC2,
+    0xD7,
+    0xA5,
+    0xBB,
+    0xE5,
+    0x2C,
+    0x39,
+    0x26,
+    0x4B,
+    0xDA,
+    0x9A,
+    0x70,
+    0x18,
+    0x95,
+    0x37,
+    0x95,
+    0x10,
+    0x56,
+    0x23,
+    0xF6,
+    0x15,
+    0xED,
+    0xBA,
+    0x04,
+    0x5E,
+    0xDE,
+    0x39,
+    0x4F,
+    0xFD,
+    0xB7,
+    0x43,
+    0x1F,
+    0xB5,
+    0xA4,
+    0x65,
+    0x6F,
+    0xCD,
+    0x80,
+    0x11,
+    0xE4,
+    0x70,
+    0x95,
+    0x5B,
+    0x50,
+    0xCD,
+    0x49,
 };
 
 static unsigned char dsa1024_q[] = {
-    0xF7, 0x07, 0x31, 0xED, 0xFA, 0x6C, 0x06, 0x03, 0xD5, 0x85, 0x8A, 0x1C,
-    0xAC, 0x9C, 0x65, 0xE7, 0x50, 0x66, 0x65, 0x6F,
+    0xF7,
+    0x07,
+    0x31,
+    0xED,
+    0xFA,
+    0x6C,
+    0x06,
+    0x03,
+    0xD5,
+    0x85,
+    0x8A,
+    0x1C,
+    0xAC,
+    0x9C,
+    0x65,
+    0xE7,
+    0x50,
+    0x66,
+    0x65,
+    0x6F,
 };
 
 static unsigned char dsa1024_g[] = {
-    0x4D, 0xDF, 0x4C, 0x03, 0xA6, 0x91, 0x8A, 0xF5, 0x19, 0x6F, 0x50, 0x46,
-    0x25, 0x99, 0xE5, 0x68, 0x6F, 0x30, 0xE3, 0x69, 0xE1, 0xE5, 0xB3, 0x5D,
-    0x98, 0xBB, 0x28, 0x86, 0x48, 0xFC, 0xDE, 0x99, 0x04, 0x3F, 0x5F, 0x88,
-    0x0C, 0x9C, 0x73, 0x24, 0x0D, 0x20, 0x5D, 0xB9, 0x2A, 0x9A, 0x3F, 0x18,
-    0x96, 0x27, 0xE4, 0x62, 0x87, 0xC1, 0x7B, 0x74, 0x62, 0x53, 0xFC, 0x61,
-    0x27, 0xA8, 0x7A, 0x91, 0x09, 0x9D, 0xB6, 0xF1, 0x4D, 0x9C, 0x54, 0x0F,
-    0x58, 0x06, 0xEE, 0x49, 0x74, 0x07, 0xCE, 0x55, 0x7E, 0x23, 0xCE, 0x16,
-    0xF6, 0xCA, 0xDC, 0x5A, 0x61, 0x01, 0x7E, 0xC9, 0x71, 0xB5, 0x4D, 0xF6,
-    0xDC, 0x34, 0x29, 0x87, 0x68, 0xF6, 0x5E, 0x20, 0x93, 0xB3, 0xDB, 0xF5,
-    0xE4, 0x09, 0x6C, 0x41, 0x17, 0x95, 0x92, 0xEB, 0x01, 0xB5, 0x73, 0xA5,
-    0x6A, 0x7E, 0xD8, 0x32, 0xED, 0x0E, 0x02, 0xB8,
+    0x4D,
+    0xDF,
+    0x4C,
+    0x03,
+    0xA6,
+    0x91,
+    0x8A,
+    0xF5,
+    0x19,
+    0x6F,
+    0x50,
+    0x46,
+    0x25,
+    0x99,
+    0xE5,
+    0x68,
+    0x6F,
+    0x30,
+    0xE3,
+    0x69,
+    0xE1,
+    0xE5,
+    0xB3,
+    0x5D,
+    0x98,
+    0xBB,
+    0x28,
+    0x86,
+    0x48,
+    0xFC,
+    0xDE,
+    0x99,
+    0x04,
+    0x3F,
+    0x5F,
+    0x88,
+    0x0C,
+    0x9C,
+    0x73,
+    0x24,
+    0x0D,
+    0x20,
+    0x5D,
+    0xB9,
+    0x2A,
+    0x9A,
+    0x3F,
+    0x18,
+    0x96,
+    0x27,
+    0xE4,
+    0x62,
+    0x87,
+    0xC1,
+    0x7B,
+    0x74,
+    0x62,
+    0x53,
+    0xFC,
+    0x61,
+    0x27,
+    0xA8,
+    0x7A,
+    0x91,
+    0x09,
+    0x9D,
+    0xB6,
+    0xF1,
+    0x4D,
+    0x9C,
+    0x54,
+    0x0F,
+    0x58,
+    0x06,
+    0xEE,
+    0x49,
+    0x74,
+    0x07,
+    0xCE,
+    0x55,
+    0x7E,
+    0x23,
+    0xCE,
+    0x16,
+    0xF6,
+    0xCA,
+    0xDC,
+    0x5A,
+    0x61,
+    0x01,
+    0x7E,
+    0xC9,
+    0x71,
+    0xB5,
+    0x4D,
+    0xF6,
+    0xDC,
+    0x34,
+    0x29,
+    0x87,
+    0x68,
+    0xF6,
+    0x5E,
+    0x20,
+    0x93,
+    0xB3,
+    0xDB,
+    0xF5,
+    0xE4,
+    0x09,
+    0x6C,
+    0x41,
+    0x17,
+    0x95,
+    0x92,
+    0xEB,
+    0x01,
+    0xB5,
+    0x73,
+    0xA5,
+    0x6A,
+    0x7E,
+    0xD8,
+    0x32,
+    0xED,
+    0x0E,
+    0x02,
+    0xB8,
 };
 
 static unsigned char dsa2048_priv[] = {
-    0x32, 0x67, 0x92, 0xf6, 0xc4, 0xe2, 0xe2, 0xe8, 0xa0, 0x8b, 0x6b, 0x45,
-    0x0c, 0x8a, 0x76, 0xb0, 0xee, 0xcf, 0x91, 0xa7,
+    0x32,
+    0x67,
+    0x92,
+    0xf6,
+    0xc4,
+    0xe2,
+    0xe2,
+    0xe8,
+    0xa0,
+    0x8b,
+    0x6b,
+    0x45,
+    0x0c,
+    0x8a,
+    0x76,
+    0xb0,
+    0xee,
+    0xcf,
+    0x91,
+    0xa7,
 };
 
 static unsigned char dsa2048_pub[] = {
-    0x17, 0x8f, 0xa8, 0x11, 0x84, 0x92, 0xec, 0x83, 0x47, 0xc7, 0x6a, 0xb0,
-    0x92, 0xaf, 0x5a, 0x20, 0x37, 0xa3, 0x64, 0x79, 0xd2, 0xd0, 0x3d, 0xcd,
-    0xe0, 0x61, 0x88, 0x88, 0x21, 0xcc, 0x74, 0x5d, 0xce, 0x4c, 0x51, 0x47,
-    0xf0, 0xc5, 0x5c, 0x4c, 0x82, 0x7a, 0xaf, 0x72, 0xad, 0xb9, 0xe0, 0x53,
-    0xf2, 0x78, 0xb7, 0xf0, 0xb5, 0x48, 0x7f, 0x8a, 0x3a, 0x18, 0xd1, 0x9f,
-    0x8b, 0x7d, 0xa5, 0x47, 0xb7, 0x95, 0xab, 0x98, 0xf8, 0x7b, 0x74, 0x50,
-    0x56, 0x8e, 0x57, 0xf0, 0xee, 0xf5, 0xb7, 0xba, 0xab, 0x85, 0x86, 0xf9,
-    0x2b, 0xef, 0x41, 0x56, 0xa0, 0xa4, 0x9f, 0xb7, 0x38, 0x00, 0x46, 0x0a,
-    0xa6, 0xf1, 0xfc, 0x1f, 0xd8, 0x4e, 0x85, 0x44, 0x92, 0x43, 0x21, 0x5d,
-    0x6e, 0xcc, 0xc2, 0xcb, 0x26, 0x31, 0x0d, 0x21, 0xc4, 0xbd, 0x8d, 0x24,
-    0xbc, 0xd9, 0x18, 0x19, 0xd7, 0xdc, 0xf1, 0xe7, 0x93, 0x50, 0x48, 0x03,
-    0x2c, 0xae, 0x2e, 0xe7, 0x49, 0x88, 0x5f, 0x93, 0x57, 0x27, 0x99, 0x36,
-    0xb4, 0x20, 0xab, 0xfc, 0xa7, 0x2b, 0xf2, 0xd9, 0x98, 0xd7, 0xd4, 0x34,
-    0x9d, 0x96, 0x50, 0x58, 0x9a, 0xea, 0x54, 0xf3, 0xee, 0xf5, 0x63, 0x14,
-    0xee, 0x85, 0x83, 0x74, 0x76, 0xe1, 0x52, 0x95, 0xc3, 0xf7, 0xeb, 0x04,
-    0x04, 0x7b, 0xa7, 0x28, 0x1b, 0xcc, 0xea, 0x4a, 0x4e, 0x84, 0xda, 0xd8,
-    0x9c, 0x79, 0xd8, 0x9b, 0x66, 0x89, 0x2f, 0xcf, 0xac, 0xd7, 0x79, 0xf9,
-    0xa9, 0xd8, 0x45, 0x13, 0x78, 0xb9, 0x00, 0x14, 0xc9, 0x7e, 0x22, 0x51,
-    0x86, 0x67, 0xb0, 0x9f, 0x26, 0x11, 0x23, 0xc8, 0x38, 0xd7, 0x70, 0x1d,
-    0x15, 0x8e, 0x4d, 0x4f, 0x95, 0x97, 0x40, 0xa1, 0xc2, 0x7e, 0x01, 0x18,
-    0x72, 0xf4, 0x10, 0xe6, 0x8d, 0x52, 0x16, 0x7f, 0xf2, 0xc9, 0xf8, 0x33,
-    0x8b, 0x33, 0xb7, 0xce,
+    0x17,
+    0x8f,
+    0xa8,
+    0x11,
+    0x84,
+    0x92,
+    0xec,
+    0x83,
+    0x47,
+    0xc7,
+    0x6a,
+    0xb0,
+    0x92,
+    0xaf,
+    0x5a,
+    0x20,
+    0x37,
+    0xa3,
+    0x64,
+    0x79,
+    0xd2,
+    0xd0,
+    0x3d,
+    0xcd,
+    0xe0,
+    0x61,
+    0x88,
+    0x88,
+    0x21,
+    0xcc,
+    0x74,
+    0x5d,
+    0xce,
+    0x4c,
+    0x51,
+    0x47,
+    0xf0,
+    0xc5,
+    0x5c,
+    0x4c,
+    0x82,
+    0x7a,
+    0xaf,
+    0x72,
+    0xad,
+    0xb9,
+    0xe0,
+    0x53,
+    0xf2,
+    0x78,
+    0xb7,
+    0xf0,
+    0xb5,
+    0x48,
+    0x7f,
+    0x8a,
+    0x3a,
+    0x18,
+    0xd1,
+    0x9f,
+    0x8b,
+    0x7d,
+    0xa5,
+    0x47,
+    0xb7,
+    0x95,
+    0xab,
+    0x98,
+    0xf8,
+    0x7b,
+    0x74,
+    0x50,
+    0x56,
+    0x8e,
+    0x57,
+    0xf0,
+    0xee,
+    0xf5,
+    0xb7,
+    0xba,
+    0xab,
+    0x85,
+    0x86,
+    0xf9,
+    0x2b,
+    0xef,
+    0x41,
+    0x56,
+    0xa0,
+    0xa4,
+    0x9f,
+    0xb7,
+    0x38,
+    0x00,
+    0x46,
+    0x0a,
+    0xa6,
+    0xf1,
+    0xfc,
+    0x1f,
+    0xd8,
+    0x4e,
+    0x85,
+    0x44,
+    0x92,
+    0x43,
+    0x21,
+    0x5d,
+    0x6e,
+    0xcc,
+    0xc2,
+    0xcb,
+    0x26,
+    0x31,
+    0x0d,
+    0x21,
+    0xc4,
+    0xbd,
+    0x8d,
+    0x24,
+    0xbc,
+    0xd9,
+    0x18,
+    0x19,
+    0xd7,
+    0xdc,
+    0xf1,
+    0xe7,
+    0x93,
+    0x50,
+    0x48,
+    0x03,
+    0x2c,
+    0xae,
+    0x2e,
+    0xe7,
+    0x49,
+    0x88,
+    0x5f,
+    0x93,
+    0x57,
+    0x27,
+    0x99,
+    0x36,
+    0xb4,
+    0x20,
+    0xab,
+    0xfc,
+    0xa7,
+    0x2b,
+    0xf2,
+    0xd9,
+    0x98,
+    0xd7,
+    0xd4,
+    0x34,
+    0x9d,
+    0x96,
+    0x50,
+    0x58,
+    0x9a,
+    0xea,
+    0x54,
+    0xf3,
+    0xee,
+    0xf5,
+    0x63,
+    0x14,
+    0xee,
+    0x85,
+    0x83,
+    0x74,
+    0x76,
+    0xe1,
+    0x52,
+    0x95,
+    0xc3,
+    0xf7,
+    0xeb,
+    0x04,
+    0x04,
+    0x7b,
+    0xa7,
+    0x28,
+    0x1b,
+    0xcc,
+    0xea,
+    0x4a,
+    0x4e,
+    0x84,
+    0xda,
+    0xd8,
+    0x9c,
+    0x79,
+    0xd8,
+    0x9b,
+    0x66,
+    0x89,
+    0x2f,
+    0xcf,
+    0xac,
+    0xd7,
+    0x79,
+    0xf9,
+    0xa9,
+    0xd8,
+    0x45,
+    0x13,
+    0x78,
+    0xb9,
+    0x00,
+    0x14,
+    0xc9,
+    0x7e,
+    0x22,
+    0x51,
+    0x86,
+    0x67,
+    0xb0,
+    0x9f,
+    0x26,
+    0x11,
+    0x23,
+    0xc8,
+    0x38,
+    0xd7,
+    0x70,
+    0x1d,
+    0x15,
+    0x8e,
+    0x4d,
+    0x4f,
+    0x95,
+    0x97,
+    0x40,
+    0xa1,
+    0xc2,
+    0x7e,
+    0x01,
+    0x18,
+    0x72,
+    0xf4,
+    0x10,
+    0xe6,
+    0x8d,
+    0x52,
+    0x16,
+    0x7f,
+    0xf2,
+    0xc9,
+    0xf8,
+    0x33,
+    0x8b,
+    0x33,
+    0xb7,
+    0xce,
 };
 
 static unsigned char dsa2048_p[] = {
-    0xA0, 0x25, 0xFA, 0xAD, 0xF4, 0x8E, 0xB9, 0xE5, 0x99, 0xF3, 0x5D, 0x6F,
-    0x4F, 0x83, 0x34, 0xE2, 0x7E, 0xCF, 0x6F, 0xBF, 0x30, 0xAF, 0x6F, 0x81,
-    0xEB, 0xF8, 0xC4, 0x13, 0xD9, 0xA0, 0x5D, 0x8B, 0x5C, 0x8E, 0xDC, 0xC2,
-    0x1D, 0x0B, 0x41, 0x32, 0xB0, 0x1F, 0xFE, 0xEF, 0x0C, 0xC2, 0xA2, 0x7E,
-    0x68, 0x5C, 0x28, 0x21, 0xE9, 0xF5, 0xB1, 0x58, 0x12, 0x63, 0x4C, 0x19,
-    0x4E, 0xFF, 0x02, 0x4B, 0x92, 0xED, 0xD2, 0x07, 0x11, 0x4D, 0x8C, 0x58,
-    0x16, 0x5C, 0x55, 0x8E, 0xAD, 0xA3, 0x67, 0x7D, 0xB9, 0x86, 0x6E, 0x0B,
-    0xE6, 0x54, 0x6F, 0x40, 0xAE, 0x0E, 0x67, 0x4C, 0xF9, 0x12, 0x5B, 0x3C,
-    0x08, 0x7A, 0xF7, 0xFC, 0x67, 0x86, 0x69, 0xE7, 0x0A, 0x94, 0x40, 0xBF,
-    0x8B, 0x76, 0xFE, 0x26, 0xD1, 0xF2, 0xA1, 0x1A, 0x84, 0xA1, 0x43, 0x56,
-    0x28, 0xBC, 0x9A, 0x5F, 0xD7, 0x3B, 0x69, 0x89, 0x8A, 0x36, 0x2C, 0x51,
-    0xDF, 0x12, 0x77, 0x2F, 0x57, 0x7B, 0xA0, 0xAA, 0xDD, 0x7F, 0xA1, 0x62,
-    0x3B, 0x40, 0x7B, 0x68, 0x1A, 0x8F, 0x0D, 0x38, 0xBB, 0x21, 0x5D, 0x18,
-    0xFC, 0x0F, 0x46, 0xF7, 0xA3, 0xB0, 0x1D, 0x23, 0xC3, 0xD2, 0xC7, 0x72,
-    0x51, 0x18, 0xDF, 0x46, 0x95, 0x79, 0xD9, 0xBD, 0xB5, 0x19, 0x02, 0x2C,
-    0x87, 0xDC, 0xE7, 0x57, 0x82, 0x7E, 0xF1, 0x8B, 0x06, 0x3D, 0x00, 0xA5,
-    0x7B, 0x6B, 0x26, 0x27, 0x91, 0x0F, 0x6A, 0x77, 0xE4, 0xD5, 0x04, 0xE4,
-    0x12, 0x2C, 0x42, 0xFF, 0xD2, 0x88, 0xBB, 0xD3, 0x92, 0xA0, 0xF9, 0xC8,
-    0x51, 0x64, 0x14, 0x5C, 0xD8, 0xF9, 0x6C, 0x47, 0x82, 0xB4, 0x1C, 0x7F,
-    0x09, 0xB8, 0xF0, 0x25, 0x83, 0x1D, 0x3F, 0x3F, 0x05, 0xB3, 0x21, 0x0A,
-    0x5D, 0xA7, 0xD8, 0x54, 0xC3, 0x65, 0x7D, 0xC3, 0xB0, 0x1D, 0xBF, 0xAE,
-    0xF8, 0x68, 0xCF, 0x9B,
+    0xA0,
+    0x25,
+    0xFA,
+    0xAD,
+    0xF4,
+    0x8E,
+    0xB9,
+    0xE5,
+    0x99,
+    0xF3,
+    0x5D,
+    0x6F,
+    0x4F,
+    0x83,
+    0x34,
+    0xE2,
+    0x7E,
+    0xCF,
+    0x6F,
+    0xBF,
+    0x30,
+    0xAF,
+    0x6F,
+    0x81,
+    0xEB,
+    0xF8,
+    0xC4,
+    0x13,
+    0xD9,
+    0xA0,
+    0x5D,
+    0x8B,
+    0x5C,
+    0x8E,
+    0xDC,
+    0xC2,
+    0x1D,
+    0x0B,
+    0x41,
+    0x32,
+    0xB0,
+    0x1F,
+    0xFE,
+    0xEF,
+    0x0C,
+    0xC2,
+    0xA2,
+    0x7E,
+    0x68,
+    0x5C,
+    0x28,
+    0x21,
+    0xE9,
+    0xF5,
+    0xB1,
+    0x58,
+    0x12,
+    0x63,
+    0x4C,
+    0x19,
+    0x4E,
+    0xFF,
+    0x02,
+    0x4B,
+    0x92,
+    0xED,
+    0xD2,
+    0x07,
+    0x11,
+    0x4D,
+    0x8C,
+    0x58,
+    0x16,
+    0x5C,
+    0x55,
+    0x8E,
+    0xAD,
+    0xA3,
+    0x67,
+    0x7D,
+    0xB9,
+    0x86,
+    0x6E,
+    0x0B,
+    0xE6,
+    0x54,
+    0x6F,
+    0x40,
+    0xAE,
+    0x0E,
+    0x67,
+    0x4C,
+    0xF9,
+    0x12,
+    0x5B,
+    0x3C,
+    0x08,
+    0x7A,
+    0xF7,
+    0xFC,
+    0x67,
+    0x86,
+    0x69,
+    0xE7,
+    0x0A,
+    0x94,
+    0x40,
+    0xBF,
+    0x8B,
+    0x76,
+    0xFE,
+    0x26,
+    0xD1,
+    0xF2,
+    0xA1,
+    0x1A,
+    0x84,
+    0xA1,
+    0x43,
+    0x56,
+    0x28,
+    0xBC,
+    0x9A,
+    0x5F,
+    0xD7,
+    0x3B,
+    0x69,
+    0x89,
+    0x8A,
+    0x36,
+    0x2C,
+    0x51,
+    0xDF,
+    0x12,
+    0x77,
+    0x2F,
+    0x57,
+    0x7B,
+    0xA0,
+    0xAA,
+    0xDD,
+    0x7F,
+    0xA1,
+    0x62,
+    0x3B,
+    0x40,
+    0x7B,
+    0x68,
+    0x1A,
+    0x8F,
+    0x0D,
+    0x38,
+    0xBB,
+    0x21,
+    0x5D,
+    0x18,
+    0xFC,
+    0x0F,
+    0x46,
+    0xF7,
+    0xA3,
+    0xB0,
+    0x1D,
+    0x23,
+    0xC3,
+    0xD2,
+    0xC7,
+    0x72,
+    0x51,
+    0x18,
+    0xDF,
+    0x46,
+    0x95,
+    0x79,
+    0xD9,
+    0xBD,
+    0xB5,
+    0x19,
+    0x02,
+    0x2C,
+    0x87,
+    0xDC,
+    0xE7,
+    0x57,
+    0x82,
+    0x7E,
+    0xF1,
+    0x8B,
+    0x06,
+    0x3D,
+    0x00,
+    0xA5,
+    0x7B,
+    0x6B,
+    0x26,
+    0x27,
+    0x91,
+    0x0F,
+    0x6A,
+    0x77,
+    0xE4,
+    0xD5,
+    0x04,
+    0xE4,
+    0x12,
+    0x2C,
+    0x42,
+    0xFF,
+    0xD2,
+    0x88,
+    0xBB,
+    0xD3,
+    0x92,
+    0xA0,
+    0xF9,
+    0xC8,
+    0x51,
+    0x64,
+    0x14,
+    0x5C,
+    0xD8,
+    0xF9,
+    0x6C,
+    0x47,
+    0x82,
+    0xB4,
+    0x1C,
+    0x7F,
+    0x09,
+    0xB8,
+    0xF0,
+    0x25,
+    0x83,
+    0x1D,
+    0x3F,
+    0x3F,
+    0x05,
+    0xB3,
+    0x21,
+    0x0A,
+    0x5D,
+    0xA7,
+    0xD8,
+    0x54,
+    0xC3,
+    0x65,
+    0x7D,
+    0xC3,
+    0xB0,
+    0x1D,
+    0xBF,
+    0xAE,
+    0xF8,
+    0x68,
+    0xCF,
+    0x9B,
 };
 
 static unsigned char dsa2048_q[] = {
-    0x97, 0xE7, 0x33, 0x4D, 0xD3, 0x94, 0x3E, 0x0B, 0xDB, 0x62, 0x74, 0xC6,
-    0xA1, 0x08, 0xDD, 0x19, 0xA3, 0x75, 0x17, 0x1B,
+    0x97,
+    0xE7,
+    0x33,
+    0x4D,
+    0xD3,
+    0x94,
+    0x3E,
+    0x0B,
+    0xDB,
+    0x62,
+    0x74,
+    0xC6,
+    0xA1,
+    0x08,
+    0xDD,
+    0x19,
+    0xA3,
+    0x75,
+    0x17,
+    0x1B,
 };
 
 static unsigned char dsa2048_g[] = {
-    0x2C, 0x78, 0x16, 0x59, 0x34, 0x63, 0xF4, 0xF3, 0x92, 0xFC, 0xB5, 0xA5,
-    0x4F, 0x13, 0xDE, 0x2F, 0x1C, 0xA4, 0x3C, 0xAE, 0xAD, 0x38, 0x3F, 0x7E,
-    0x90, 0xBF, 0x96, 0xA6, 0xAE, 0x25, 0x90, 0x72, 0xF5, 0x8E, 0x80, 0x0C,
-    0x39, 0x1C, 0xD9, 0xEC, 0xBA, 0x90, 0x5B, 0x3A, 0xE8, 0x58, 0x6C, 0x9E,
-    0x30, 0x42, 0x37, 0x02, 0x31, 0x82, 0xBC, 0x6A, 0xDF, 0x6A, 0x09, 0x29,
-    0xE3, 0xC0, 0x46, 0xD1, 0xCB, 0x85, 0xEC, 0x0C, 0x30, 0x5E, 0xEA, 0xC8,
-    0x39, 0x8E, 0x22, 0x9F, 0x22, 0x10, 0xD2, 0x34, 0x61, 0x68, 0x37, 0x3D,
-    0x2E, 0x4A, 0x5B, 0x9A, 0xF5, 0xC1, 0x48, 0xC6, 0xF6, 0xDC, 0x63, 0x1A,
-    0xD3, 0x96, 0x64, 0xBA, 0x34, 0xC9, 0xD1, 0xA0, 0xD1, 0xAE, 0x6C, 0x2F,
-    0x48, 0x17, 0x93, 0x14, 0x43, 0xED, 0xF0, 0x21, 0x30, 0x19, 0xC3, 0x1B,
-    0x5F, 0xDE, 0xA3, 0xF0, 0x70, 0x78, 0x18, 0xE1, 0xA8, 0xE4, 0xEE, 0x2E,
-    0x00, 0xA5, 0xE4, 0xB3, 0x17, 0xC8, 0x0C, 0x7D, 0x6E, 0x42, 0xDC, 0xB7,
-    0x46, 0x00, 0x36, 0x4D, 0xD4, 0x46, 0xAA, 0x3D, 0x3C, 0x46, 0x89, 0x40,
-    0xBF, 0x1D, 0x84, 0x77, 0x0A, 0x75, 0xF3, 0x87, 0x1D, 0x08, 0x4C, 0xA6,
-    0xD1, 0xA9, 0x1C, 0x1E, 0x12, 0x1E, 0xE1, 0xC7, 0x30, 0x28, 0x76, 0xA5,
-    0x7F, 0x6C, 0x85, 0x96, 0x2B, 0x6F, 0xDB, 0x80, 0x66, 0x26, 0xAE, 0xF5,
-    0x93, 0xC7, 0x8E, 0xAE, 0x9A, 0xED, 0xE4, 0xCA, 0x04, 0xEA, 0x3B, 0x72,
-    0xEF, 0xDC, 0x87, 0xED, 0x0D, 0xA5, 0x4C, 0x4A, 0xDD, 0x71, 0x22, 0x64,
-    0x59, 0x69, 0x4E, 0x8E, 0xBF, 0x43, 0xDC, 0xAB, 0x8E, 0x66, 0xBB, 0x01,
-    0xB6, 0xF4, 0xE7, 0xFD, 0xD2, 0xAD, 0x9F, 0x36, 0xC1, 0xA0, 0x29, 0x99,
-    0xD1, 0x96, 0x70, 0x59, 0x06, 0x78, 0x35, 0xBD, 0x65, 0x55, 0x52, 0x9E,
-    0xF8, 0xB2, 0xE5, 0x38,
+    0x2C,
+    0x78,
+    0x16,
+    0x59,
+    0x34,
+    0x63,
+    0xF4,
+    0xF3,
+    0x92,
+    0xFC,
+    0xB5,
+    0xA5,
+    0x4F,
+    0x13,
+    0xDE,
+    0x2F,
+    0x1C,
+    0xA4,
+    0x3C,
+    0xAE,
+    0xAD,
+    0x38,
+    0x3F,
+    0x7E,
+    0x90,
+    0xBF,
+    0x96,
+    0xA6,
+    0xAE,
+    0x25,
+    0x90,
+    0x72,
+    0xF5,
+    0x8E,
+    0x80,
+    0x0C,
+    0x39,
+    0x1C,
+    0xD9,
+    0xEC,
+    0xBA,
+    0x90,
+    0x5B,
+    0x3A,
+    0xE8,
+    0x58,
+    0x6C,
+    0x9E,
+    0x30,
+    0x42,
+    0x37,
+    0x02,
+    0x31,
+    0x82,
+    0xBC,
+    0x6A,
+    0xDF,
+    0x6A,
+    0x09,
+    0x29,
+    0xE3,
+    0xC0,
+    0x46,
+    0xD1,
+    0xCB,
+    0x85,
+    0xEC,
+    0x0C,
+    0x30,
+    0x5E,
+    0xEA,
+    0xC8,
+    0x39,
+    0x8E,
+    0x22,
+    0x9F,
+    0x22,
+    0x10,
+    0xD2,
+    0x34,
+    0x61,
+    0x68,
+    0x37,
+    0x3D,
+    0x2E,
+    0x4A,
+    0x5B,
+    0x9A,
+    0xF5,
+    0xC1,
+    0x48,
+    0xC6,
+    0xF6,
+    0xDC,
+    0x63,
+    0x1A,
+    0xD3,
+    0x96,
+    0x64,
+    0xBA,
+    0x34,
+    0xC9,
+    0xD1,
+    0xA0,
+    0xD1,
+    0xAE,
+    0x6C,
+    0x2F,
+    0x48,
+    0x17,
+    0x93,
+    0x14,
+    0x43,
+    0xED,
+    0xF0,
+    0x21,
+    0x30,
+    0x19,
+    0xC3,
+    0x1B,
+    0x5F,
+    0xDE,
+    0xA3,
+    0xF0,
+    0x70,
+    0x78,
+    0x18,
+    0xE1,
+    0xA8,
+    0xE4,
+    0xEE,
+    0x2E,
+    0x00,
+    0xA5,
+    0xE4,
+    0xB3,
+    0x17,
+    0xC8,
+    0x0C,
+    0x7D,
+    0x6E,
+    0x42,
+    0xDC,
+    0xB7,
+    0x46,
+    0x00,
+    0x36,
+    0x4D,
+    0xD4,
+    0x46,
+    0xAA,
+    0x3D,
+    0x3C,
+    0x46,
+    0x89,
+    0x40,
+    0xBF,
+    0x1D,
+    0x84,
+    0x77,
+    0x0A,
+    0x75,
+    0xF3,
+    0x87,
+    0x1D,
+    0x08,
+    0x4C,
+    0xA6,
+    0xD1,
+    0xA9,
+    0x1C,
+    0x1E,
+    0x12,
+    0x1E,
+    0xE1,
+    0xC7,
+    0x30,
+    0x28,
+    0x76,
+    0xA5,
+    0x7F,
+    0x6C,
+    0x85,
+    0x96,
+    0x2B,
+    0x6F,
+    0xDB,
+    0x80,
+    0x66,
+    0x26,
+    0xAE,
+    0xF5,
+    0x93,
+    0xC7,
+    0x8E,
+    0xAE,
+    0x9A,
+    0xED,
+    0xE4,
+    0xCA,
+    0x04,
+    0xEA,
+    0x3B,
+    0x72,
+    0xEF,
+    0xDC,
+    0x87,
+    0xED,
+    0x0D,
+    0xA5,
+    0x4C,
+    0x4A,
+    0xDD,
+    0x71,
+    0x22,
+    0x64,
+    0x59,
+    0x69,
+    0x4E,
+    0x8E,
+    0xBF,
+    0x43,
+    0xDC,
+    0xAB,
+    0x8E,
+    0x66,
+    0xBB,
+    0x01,
+    0xB6,
+    0xF4,
+    0xE7,
+    0xFD,
+    0xD2,
+    0xAD,
+    0x9F,
+    0x36,
+    0xC1,
+    0xA0,
+    0x29,
+    0x99,
+    0xD1,
+    0x96,
+    0x70,
+    0x59,
+    0x06,
+    0x78,
+    0x35,
+    0xBD,
+    0x65,
+    0x55,
+    0x52,
+    0x9E,
+    0xF8,
+    0xB2,
+    0xE5,
+    0x38,
 };
 
 typedef struct testdsa_st {
@@ -199,18 +1418,18 @@ typedef struct testdsa_st {
     int q_l;
 } testdsa;
 
-#define set_dsa_ptr(st, bits) \
-    do { \
-        st.priv = dsa##bits##_priv; \
-        st.pub = dsa##bits##_pub; \
-        st.p = dsa##bits##_p; \
-        st.g = dsa##bits##_g; \
-        st.q = dsa##bits##_q; \
+#define set_dsa_ptr(st, bits)                 \
+    do {                                      \
+        st.priv = dsa##bits##_priv;           \
+        st.pub = dsa##bits##_pub;             \
+        st.p = dsa##bits##_p;                 \
+        st.g = dsa##bits##_g;                 \
+        st.q = dsa##bits##_q;                 \
         st.priv_l = sizeof(dsa##bits##_priv); \
-        st.pub_l = sizeof(dsa##bits##_pub); \
-        st.p_l = sizeof(dsa##bits##_p); \
-        st.g_l = sizeof(dsa##bits##_g); \
-        st.q_l = sizeof(dsa##bits##_q); \
+        st.pub_l = sizeof(dsa##bits##_pub);   \
+        st.p_l = sizeof(dsa##bits##_p);       \
+        st.g_l = sizeof(dsa##bits##_g);       \
+        st.q_l = sizeof(dsa##bits##_q);       \
     } while (0)
 
 EVP_PKEY *get_dsa(int dsa_bits)
@@ -250,21 +1469,22 @@ EVP_PKEY *get_dsa(int dsa_bits)
     }
     if ((tmpl = OSSL_PARAM_BLD_new()) == NULL
         || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P,
-                                   p)
+            p)
         || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_Q,
-                                   q)
+            q)
         || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_G,
-                                   g)
+            g)
         || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_PRIV_KEY,
-                                   priv_key)
+            priv_key)
         || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_PUB_KEY,
-                                   pub_key)
+            pub_key)
         || (params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL)
         goto err;
 
     if (EVP_PKEY_fromdata_init(pctx) <= 0
         || EVP_PKEY_fromdata(pctx, &pkey, EVP_PKEY_KEYPAIR,
-                             params) <= 0)
+               params)
+            <= 0)
         pkey = NULL;
 err:
     OSSL_PARAM_free(params);
diff --git a/crypto/openssl/apps/testrsa.h b/crypto/openssl/apps/testrsa.h
index 8c3a967414c6..db9221e8aaa4 100644
--- a/crypto/openssl/apps/testrsa.h
+++ b/crypto/openssl/apps/testrsa.h
@@ -8,224 +8,2128 @@
  */
 
 static unsigned char test512[] = {
-    0x30, 0x82, 0x01, 0x3a, 0x02, 0x01, 0x00, 0x02, 0x41, 0x00,
-    0xd6, 0x33, 0xb9, 0xc8, 0xfb, 0x4f, 0x3c, 0x7d, 0xc0, 0x01,
-    0x86, 0xd0, 0xe7, 0xa0, 0x55, 0xf2, 0x95, 0x93, 0xcc, 0x4f,
-    0xb7, 0x5b, 0x67, 0x5b, 0x94, 0x68, 0xc9, 0x34, 0x15, 0xde,
-    0xa5, 0x2e, 0x1c, 0x33, 0xc2, 0x6e, 0xfc, 0x34, 0x5e, 0x71,
-    0x13, 0xb7, 0xd6, 0xee, 0xd8, 0xa5, 0x65, 0x05, 0x72, 0x87,
-    0xa8, 0xb0, 0x77, 0xfe, 0x57, 0xf5, 0xfc, 0x5f, 0x55, 0x83,
-    0x87, 0xdd, 0x57, 0x49, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02,
-    0x41, 0x00, 0xa7, 0xf7, 0x91, 0xc5, 0x0f, 0x84, 0x57, 0xdc,
-    0x07, 0xf7, 0x6a, 0x7f, 0x60, 0x52, 0xb3, 0x72, 0xf1, 0x66,
-    0x1f, 0x7d, 0x97, 0x3b, 0x9e, 0xb6, 0x0a, 0x8f, 0x8c, 0xcf,
-    0x42, 0x23, 0x00, 0x04, 0xd4, 0x28, 0x0e, 0x1c, 0x90, 0xc4,
-    0x11, 0x25, 0x25, 0xa5, 0x93, 0xa5, 0x2f, 0x70, 0x02, 0xdf,
-    0x81, 0x9c, 0x49, 0x03, 0xa0, 0xf8, 0x6d, 0x54, 0x2e, 0x26,
-    0xde, 0xaa, 0x85, 0x59, 0xa8, 0x31, 0x02, 0x21, 0x00, 0xeb,
-    0x47, 0xd7, 0x3b, 0xf6, 0xc3, 0xdd, 0x5a, 0x46, 0xc5, 0xb9,
-    0x2b, 0x9a, 0xa0, 0x09, 0x8f, 0xa6, 0xfb, 0xf3, 0x78, 0x7a,
-    0x33, 0x70, 0x9d, 0x0f, 0x42, 0x6b, 0x13, 0x68, 0x24, 0xd3,
-    0x15, 0x02, 0x21, 0x00, 0xe9, 0x10, 0xb0, 0xb3, 0x0d, 0xe2,
-    0x82, 0x68, 0x77, 0x8a, 0x6e, 0x7c, 0xda, 0xbc, 0x3e, 0x53,
-    0x83, 0xfb, 0xd6, 0x22, 0xe7, 0xb5, 0xae, 0x6e, 0x80, 0xda,
-    0x00, 0x55, 0x97, 0xc1, 0xd0, 0x65, 0x02, 0x20, 0x4c, 0xf8,
-    0x73, 0xb1, 0x6a, 0x49, 0x29, 0x61, 0x1f, 0x46, 0x10, 0x0d,
-    0xf3, 0xc7, 0xe7, 0x58, 0xd7, 0x88, 0x15, 0x5e, 0x94, 0x9b,
-    0xbf, 0x7b, 0xa2, 0x42, 0x58, 0x45, 0x41, 0x0c, 0xcb, 0x01,
-    0x02, 0x20, 0x12, 0x11, 0xba, 0x31, 0x57, 0x9d, 0x3d, 0x11,
-    0x0e, 0x5b, 0x8c, 0x2f, 0x5f, 0xe2, 0x02, 0x4f, 0x05, 0x47,
-    0x8c, 0x15, 0x8e, 0xb3, 0x56, 0x3f, 0xb8, 0xfb, 0xad, 0xd4,
-    0xf4, 0xfc, 0x10, 0xc5, 0x02, 0x20, 0x18, 0xa1, 0x29, 0x99,
-    0x5b, 0xd9, 0xc8, 0xd4, 0xfc, 0x49, 0x7a, 0x2a, 0x21, 0x2c,
-    0x49, 0xe4, 0x4f, 0xeb, 0xef, 0x51, 0xf1, 0xab, 0x6d, 0xfb,
-    0x4b, 0x14, 0xe9, 0x4b, 0x52, 0xb5, 0x82, 0x2c,
+    0x30,
+    0x82,
+    0x01,
+    0x3a,
+    0x02,
+    0x01,
+    0x00,
+    0x02,
+    0x41,
+    0x00,
+    0xd6,
+    0x33,
+    0xb9,
+    0xc8,
+    0xfb,
+    0x4f,
+    0x3c,
+    0x7d,
+    0xc0,
+    0x01,
+    0x86,
+    0xd0,
+    0xe7,
+    0xa0,
+    0x55,
+    0xf2,
+    0x95,
+    0x93,
+    0xcc,
+    0x4f,
+    0xb7,
+    0x5b,
+    0x67,
+    0x5b,
+    0x94,
+    0x68,
+    0xc9,
+    0x34,
+    0x15,
+    0xde,
+    0xa5,
+    0x2e,
+    0x1c,
+    0x33,
+    0xc2,
+    0x6e,
+    0xfc,
+    0x34,
+    0x5e,
+    0x71,
+    0x13,
+    0xb7,
+    0xd6,
+    0xee,
+    0xd8,
+    0xa5,
+    0x65,
+    0x05,
+    0x72,
+    0x87,
+    0xa8,
+    0xb0,
+    0x77,
+    0xfe,
+    0x57,
+    0xf5,
+    0xfc,
+    0x5f,
+    0x55,
+    0x83,
+    0x87,
+    0xdd,
+    0x57,
+    0x49,
+    0x02,
+    0x03,
+    0x01,
+    0x00,
+    0x01,
+    0x02,
+    0x41,
+    0x00,
+    0xa7,
+    0xf7,
+    0x91,
+    0xc5,
+    0x0f,
+    0x84,
+    0x57,
+    0xdc,
+    0x07,
+    0xf7,
+    0x6a,
+    0x7f,
+    0x60,
+    0x52,
+    0xb3,
+    0x72,
+    0xf1,
+    0x66,
+    0x1f,
+    0x7d,
+    0x97,
+    0x3b,
+    0x9e,
+    0xb6,
+    0x0a,
+    0x8f,
+    0x8c,
+    0xcf,
+    0x42,
+    0x23,
+    0x00,
+    0x04,
+    0xd4,
+    0x28,
+    0x0e,
+    0x1c,
+    0x90,
+    0xc4,
+    0x11,
+    0x25,
+    0x25,
+    0xa5,
+    0x93,
+    0xa5,
+    0x2f,
+    0x70,
+    0x02,
+    0xdf,
+    0x81,
+    0x9c,
+    0x49,
+    0x03,
+    0xa0,
+    0xf8,
+    0x6d,
+    0x54,
+    0x2e,
+    0x26,
+    0xde,
+    0xaa,
+    0x85,
+    0x59,
+    0xa8,
+    0x31,
+    0x02,
+    0x21,
+    0x00,
+    0xeb,
+    0x47,
+    0xd7,
+    0x3b,
+    0xf6,
+    0xc3,
+    0xdd,
+    0x5a,
+    0x46,
+    0xc5,
+    0xb9,
+    0x2b,
+    0x9a,
+    0xa0,
+    0x09,
+    0x8f,
+    0xa6,
+    0xfb,
+    0xf3,
+    0x78,
+    0x7a,
+    0x33,
+    0x70,
+    0x9d,
+    0x0f,
+    0x42,
+    0x6b,
+    0x13,
+    0x68,
+    0x24,
+    0xd3,
+    0x15,
+    0x02,
+    0x21,
+    0x00,
+    0xe9,
+    0x10,
+    0xb0,
+    0xb3,
+    0x0d,
+    0xe2,
+    0x82,
+    0x68,
+    0x77,
+    0x8a,
+    0x6e,
+    0x7c,
+    0xda,
+    0xbc,
+    0x3e,
+    0x53,
+    0x83,
+    0xfb,
+    0xd6,
+    0x22,
+    0xe7,
+    0xb5,
+    0xae,
+    0x6e,
+    0x80,
+    0xda,
+    0x00,
+    0x55,
+    0x97,
+    0xc1,
+    0xd0,
+    0x65,
+    0x02,
+    0x20,
+    0x4c,
+    0xf8,
+    0x73,
+    0xb1,
+    0x6a,
+    0x49,
+    0x29,
+    0x61,
+    0x1f,
+    0x46,
+    0x10,
+    0x0d,
+    0xf3,
+    0xc7,
+    0xe7,
+    0x58,
+    0xd7,
+    0x88,
+    0x15,
+    0x5e,
+    0x94,
+    0x9b,
+    0xbf,
+    0x7b,
+    0xa2,
+    0x42,
+    0x58,
+    0x45,
+    0x41,
+    0x0c,
+    0xcb,
+    0x01,
+    0x02,
+    0x20,
+    0x12,
+    0x11,
+    0xba,
+    0x31,
+    0x57,
+    0x9d,
+    0x3d,
+    0x11,
+    0x0e,
+    0x5b,
+    0x8c,
+    0x2f,
+    0x5f,
+    0xe2,
+    0x02,
+    0x4f,
+    0x05,
+    0x47,
+    0x8c,
+    0x15,
+    0x8e,
+    0xb3,
+    0x56,
+    0x3f,
+    0xb8,
+    0xfb,
+    0xad,
+    0xd4,
+    0xf4,
+    0xfc,
+    0x10,
+    0xc5,
+    0x02,
+    0x20,
+    0x18,
+    0xa1,
+    0x29,
+    0x99,
+    0x5b,
+    0xd9,
+    0xc8,
+    0xd4,
+    0xfc,
+    0x49,
+    0x7a,
+    0x2a,
+    0x21,
+    0x2c,
+    0x49,
+    0xe4,
+    0x4f,
+    0xeb,
+    0xef,
+    0x51,
+    0xf1,
+    0xab,
+    0x6d,
+    0xfb,
+    0x4b,
+    0x14,
+    0xe9,
+    0x4b,
+    0x52,
+    0xb5,
+    0x82,
+    0x2c,
 };
 
 static unsigned char test1024[] = {
-    0x30, 0x82, 0x02, 0x5c, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81,
-    0x00, 0xdc, 0x98, 0x43, 0xe8, 0x3d, 0x43, 0x5b, 0xe4, 0x05,
-    0xcd, 0xd0, 0xa9, 0x3e, 0xcb, 0x83, 0x75, 0xf6, 0xb5, 0xa5,
-    0x9f, 0x6b, 0xe9, 0x34, 0x41, 0x29, 0x18, 0xfa, 0x6a, 0x55,
-    0x4d, 0x70, 0xfc, 0xec, 0xae, 0x87, 0x38, 0x0a, 0x20, 0xa9,
-    0xc0, 0x45, 0x77, 0x6e, 0x57, 0x60, 0x57, 0xf4, 0xed, 0x96,
-    0x22, 0xcb, 0x8f, 0xe1, 0x33, 0x3a, 0x17, 0x1f, 0xed, 0x37,
-    0xa5, 0x6f, 0xeb, 0xa6, 0xbc, 0x12, 0x80, 0x1d, 0x53, 0xbd,
-    0x70, 0xeb, 0x21, 0x76, 0x3e, 0xc9, 0x2f, 0x1a, 0x45, 0x24,
-    0x82, 0xff, 0xcd, 0x59, 0x32, 0x06, 0x2e, 0x12, 0x3b, 0x23,
-    0x78, 0xed, 0x12, 0x3d, 0xe0, 0x8d, 0xf9, 0x67, 0x4f, 0x37,
-    0x4e, 0x47, 0x02, 0x4c, 0x2d, 0xc0, 0x4f, 0x1f, 0xb3, 0x94,
-    0xe1, 0x41, 0x2e, 0x2d, 0x90, 0x10, 0xfc, 0x82, 0x91, 0x8b,
-    0x0f, 0x22, 0xd4, 0xf2, 0xfc, 0x2c, 0xab, 0x53, 0x55, 0x02,
-    0x03, 0x01, 0x00, 0x01, 0x02, 0x81, 0x80, 0x2b, 0xcc, 0x3f,
-    0x8f, 0x58, 0xba, 0x8b, 0x00, 0x16, 0xf6, 0xea, 0x3a, 0xf0,
-    0x30, 0xd0, 0x05, 0x17, 0xda, 0xb0, 0xeb, 0x9a, 0x2d, 0x4f,
-    0x26, 0xb0, 0xd6, 0x38, 0xc1, 0xeb, 0xf5, 0xd8, 0x3d, 0x1f,
-    0x70, 0xf7, 0x7f, 0xf4, 0xe2, 0xcf, 0x51, 0x51, 0x79, 0x88,
-    0xfa, 0xe8, 0x32, 0x0e, 0x7b, 0x2d, 0x97, 0xf2, 0xfa, 0xba,
-    0x27, 0xc5, 0x9c, 0xd9, 0xc5, 0xeb, 0x8a, 0x79, 0x52, 0x3c,
-    0x64, 0x34, 0x7d, 0xc2, 0xcf, 0x28, 0xc7, 0x4e, 0xd5, 0x43,
-    0x0b, 0xd1, 0xa6, 0xca, 0x6d, 0x03, 0x2d, 0x72, 0x23, 0xbc,
-    0x6d, 0x05, 0xfa, 0x16, 0x09, 0x2f, 0x2e, 0x5c, 0xb6, 0xee,
-    0x74, 0xdd, 0xd2, 0x48, 0x8e, 0x36, 0x0c, 0x06, 0x3d, 0x4d,
-    0xe5, 0x10, 0x82, 0xeb, 0x6a, 0xf3, 0x4b, 0x9f, 0xd6, 0xed,
-    0x11, 0xb1, 0x6e, 0xec, 0xf4, 0xfe, 0x8e, 0x75, 0x94, 0x20,
-    0x2f, 0xcb, 0xac, 0x46, 0xf1, 0x02, 0x41, 0x00, 0xf9, 0x8c,
-    0xa3, 0x85, 0xb1, 0xdd, 0x29, 0xaf, 0x65, 0xc1, 0x33, 0xf3,
-    0x95, 0xc5, 0x52, 0x68, 0x0b, 0xd4, 0xf1, 0xe5, 0x0e, 0x02,
-    0x9f, 0x4f, 0xfa, 0x77, 0xdc, 0x46, 0x9e, 0xc7, 0xa6, 0xe4,
-    0x16, 0x29, 0xda, 0xb0, 0x07, 0xcf, 0x5b, 0xa9, 0x12, 0x8a,
-    0xdd, 0x63, 0x0a, 0xde, 0x2e, 0x8c, 0x66, 0x8b, 0x8c, 0xdc,
-    0x19, 0xa3, 0x7e, 0xf4, 0x3b, 0xd0, 0x1a, 0x8c, 0xa4, 0xc2,
-    0xe1, 0xd3, 0x02, 0x41, 0x00, 0xe2, 0x4c, 0x05, 0xf2, 0x04,
-    0x86, 0x4e, 0x61, 0x43, 0xdb, 0xb0, 0xb9, 0x96, 0x86, 0x52,
-    0x2c, 0xca, 0x8d, 0x7b, 0xab, 0x0b, 0x13, 0x0d, 0x7e, 0x38,
-    0x5b, 0xe2, 0x2e, 0x7b, 0x0e, 0xe7, 0x19, 0x99, 0x38, 0xe7,
-    0xf2, 0x21, 0xbd, 0x85, 0x85, 0xe3, 0xfd, 0x28, 0x77, 0x20,
-    0x31, 0x71, 0x2c, 0xd0, 0xff, 0xfb, 0x2e, 0xaf, 0x85, 0xb4,
-    0x86, 0xca, 0xf3, 0xbb, 0xca, 0xaa, 0x0f, 0x95, 0x37, 0x02,
-    0x40, 0x0e, 0x41, 0x9a, 0x95, 0xe8, 0xb3, 0x59, 0xce, 0x4b,
-    0x61, 0xde, 0x35, 0xec, 0x38, 0x79, 0x9c, 0xb8, 0x10, 0x52,
-    0x41, 0x63, 0xab, 0x82, 0xae, 0x6f, 0x00, 0xa9, 0xf4, 0xde,
-    0xdd, 0x49, 0x0b, 0x7e, 0xb8, 0xa5, 0x65, 0xa9, 0x0c, 0x8f,
-    0x8f, 0xf9, 0x1f, 0x35, 0xc6, 0x92, 0xb8, 0x5e, 0xb0, 0x66,
-    0xab, 0x52, 0x40, 0xc0, 0xb6, 0x36, 0x6a, 0x7d, 0x80, 0x46,
-    0x04, 0x02, 0xe5, 0x9f, 0x41, 0x02, 0x41, 0x00, 0xc0, 0xad,
-    0xcc, 0x4e, 0x21, 0xee, 0x1d, 0x24, 0x91, 0xfb, 0xa7, 0x80,
-    0x8d, 0x9a, 0xb6, 0xb3, 0x2e, 0x8f, 0xc2, 0xe1, 0x82, 0xdf,
-    0x69, 0x18, 0xb4, 0x71, 0xff, 0xa6, 0x65, 0xde, 0xed, 0x84,
-    0x8d, 0x42, 0xb7, 0xb3, 0x21, 0x69, 0x56, 0x1c, 0x07, 0x60,
-    0x51, 0x29, 0x04, 0xff, 0x34, 0x06, 0xdd, 0xb9, 0x67, 0x2c,
-    0x7c, 0x04, 0x93, 0x0e, 0x46, 0x15, 0xbb, 0x2a, 0xb7, 0x1b,
-    0xe7, 0x87, 0x02, 0x40, 0x78, 0xda, 0x5d, 0x07, 0x51, 0x0c,
-    0x16, 0x7a, 0x9f, 0x29, 0x20, 0x84, 0x0d, 0x42, 0xfa, 0xd7,
-    0x00, 0xd8, 0x77, 0x7e, 0xb0, 0xb0, 0x6b, 0xd6, 0x5b, 0x53,
-    0xb8, 0x9b, 0x7a, 0xcd, 0xc7, 0x2b, 0xb8, 0x6a, 0x63, 0xa9,
-    0xfb, 0x6f, 0xa4, 0x72, 0xbf, 0x4c, 0x5d, 0x00, 0x14, 0xba,
-    0xfa, 0x59, 0x88, 0xed, 0xe4, 0xe0, 0x8c, 0xa2, 0xec, 0x14,
-    0x7e, 0x2d, 0xe2, 0xf0, 0x46, 0x49, 0x95, 0x45,
+    0x30,
+    0x82,
+    0x02,
+    0x5c,
+    0x02,
+    0x01,
+    0x00,
+    0x02,
+    0x81,
+    0x81,
+    0x00,
+    0xdc,
+    0x98,
+    0x43,
+    0xe8,
+    0x3d,
+    0x43,
+    0x5b,
+    0xe4,
+    0x05,
+    0xcd,
+    0xd0,
+    0xa9,
+    0x3e,
+    0xcb,
+    0x83,
+    0x75,
+    0xf6,
+    0xb5,
+    0xa5,
+    0x9f,
+    0x6b,
+    0xe9,
+    0x34,
+    0x41,
+    0x29,
+    0x18,
+    0xfa,
+    0x6a,
+    0x55,
+    0x4d,
+    0x70,
+    0xfc,
+    0xec,
+    0xae,
+    0x87,
+    0x38,
+    0x0a,
+    0x20,
+    0xa9,
+    0xc0,
+    0x45,
+    0x77,
+    0x6e,
+    0x57,
+    0x60,
+    0x57,
+    0xf4,
+    0xed,
+    0x96,
+    0x22,
+    0xcb,
+    0x8f,
+    0xe1,
+    0x33,
+    0x3a,
+    0x17,
+    0x1f,
+    0xed,
+    0x37,
+    0xa5,
+    0x6f,
+    0xeb,
+    0xa6,
+    0xbc,
+    0x12,
+    0x80,
+    0x1d,
+    0x53,
+    0xbd,
+    0x70,
+    0xeb,
+    0x21,
+    0x76,
+    0x3e,
+    0xc9,
+    0x2f,
+    0x1a,
+    0x45,
+    0x24,
+    0x82,
+    0xff,
+    0xcd,
+    0x59,
+    0x32,
+    0x06,
+    0x2e,
+    0x12,
+    0x3b,
+    0x23,
+    0x78,
+    0xed,
+    0x12,
+    0x3d,
+    0xe0,
+    0x8d,
+    0xf9,
+    0x67,
+    0x4f,
+    0x37,
+    0x4e,
+    0x47,
+    0x02,
+    0x4c,
+    0x2d,
+    0xc0,
+    0x4f,
+    0x1f,
+    0xb3,
+    0x94,
+    0xe1,
+    0x41,
+    0x2e,
+    0x2d,
+    0x90,
+    0x10,
+    0xfc,
+    0x82,
+    0x91,
+    0x8b,
+    0x0f,
+    0x22,
+    0xd4,
+    0xf2,
+    0xfc,
+    0x2c,
+    0xab,
+    0x53,
+    0x55,
+    0x02,
+    0x03,
+    0x01,
+    0x00,
+    0x01,
+    0x02,
+    0x81,
+    0x80,
+    0x2b,
+    0xcc,
+    0x3f,
+    0x8f,
+    0x58,
+    0xba,
+    0x8b,
+    0x00,
+    0x16,
+    0xf6,
+    0xea,
+    0x3a,
+    0xf0,
+    0x30,
+    0xd0,
+    0x05,
+    0x17,
+    0xda,
+    0xb0,
+    0xeb,
+    0x9a,
+    0x2d,
+    0x4f,
+    0x26,
+    0xb0,
+    0xd6,
+    0x38,
+    0xc1,
+    0xeb,
+    0xf5,
+    0xd8,
+    0x3d,
+    0x1f,
+    0x70,
+    0xf7,
+    0x7f,
+    0xf4,
+    0xe2,
+    0xcf,
+    0x51,
+    0x51,
+    0x79,
+    0x88,
+    0xfa,
+    0xe8,
+    0x32,
+    0x0e,
+    0x7b,
+    0x2d,
+    0x97,
+    0xf2,
+    0xfa,
+    0xba,
+    0x27,
+    0xc5,
+    0x9c,
+    0xd9,
+    0xc5,
+    0xeb,
+    0x8a,
+    0x79,
+    0x52,
+    0x3c,
+    0x64,
+    0x34,
+    0x7d,
+    0xc2,
+    0xcf,
+    0x28,
+    0xc7,
+    0x4e,
+    0xd5,
+    0x43,
+    0x0b,
+    0xd1,
+    0xa6,
+    0xca,
+    0x6d,
+    0x03,
+    0x2d,
+    0x72,
+    0x23,
+    0xbc,
+    0x6d,
+    0x05,
+    0xfa,
+    0x16,
+    0x09,
+    0x2f,
+    0x2e,
+    0x5c,
+    0xb6,
+    0xee,
+    0x74,
+    0xdd,
+    0xd2,
+    0x48,
+    0x8e,
+    0x36,
+    0x0c,
+    0x06,
+    0x3d,
+    0x4d,
+    0xe5,
+    0x10,
+    0x82,
+    0xeb,
+    0x6a,
+    0xf3,
+    0x4b,
+    0x9f,
+    0xd6,
+    0xed,
+    0x11,
+    0xb1,
+    0x6e,
+    0xec,
+    0xf4,
+    0xfe,
+    0x8e,
+    0x75,
+    0x94,
+    0x20,
+    0x2f,
+    0xcb,
+    0xac,
+    0x46,
+    0xf1,
+    0x02,
+    0x41,
+    0x00,
+    0xf9,
+    0x8c,
+    0xa3,
+    0x85,
+    0xb1,
+    0xdd,
+    0x29,
+    0xaf,
+    0x65,
+    0xc1,
+    0x33,
+    0xf3,
+    0x95,
+    0xc5,
+    0x52,
+    0x68,
+    0x0b,
+    0xd4,
+    0xf1,
+    0xe5,
+    0x0e,
+    0x02,
+    0x9f,
+    0x4f,
+    0xfa,
+    0x77,
+    0xdc,
+    0x46,
+    0x9e,
+    0xc7,
+    0xa6,
+    0xe4,
+    0x16,
+    0x29,
+    0xda,
+    0xb0,
+    0x07,
+    0xcf,
+    0x5b,
+    0xa9,
+    0x12,
+    0x8a,
+    0xdd,
+    0x63,
+    0x0a,
+    0xde,
+    0x2e,
+    0x8c,
+    0x66,
+    0x8b,
+    0x8c,
+    0xdc,
+    0x19,
+    0xa3,
+    0x7e,
+    0xf4,
+    0x3b,
+    0xd0,
+    0x1a,
+    0x8c,
+    0xa4,
+    0xc2,
+    0xe1,
+    0xd3,
+    0x02,
+    0x41,
+    0x00,
+    0xe2,
+    0x4c,
+    0x05,
+    0xf2,
+    0x04,
+    0x86,
+    0x4e,
+    0x61,
+    0x43,
+    0xdb,
+    0xb0,
+    0xb9,
+    0x96,
+    0x86,
+    0x52,
+    0x2c,
+    0xca,
+    0x8d,
+    0x7b,
+    0xab,
+    0x0b,
+    0x13,
+    0x0d,
+    0x7e,
+    0x38,
+    0x5b,
+    0xe2,
+    0x2e,
+    0x7b,
+    0x0e,
+    0xe7,
+    0x19,
+    0x99,
+    0x38,
+    0xe7,
+    0xf2,
+    0x21,
+    0xbd,
+    0x85,
+    0x85,
+    0xe3,
+    0xfd,
+    0x28,
+    0x77,
+    0x20,
+    0x31,
+    0x71,
+    0x2c,
+    0xd0,
+    0xff,
+    0xfb,
+    0x2e,
+    0xaf,
+    0x85,
+    0xb4,
+    0x86,
+    0xca,
+    0xf3,
+    0xbb,
+    0xca,
+    0xaa,
+    0x0f,
+    0x95,
+    0x37,
+    0x02,
+    0x40,
+    0x0e,
+    0x41,
+    0x9a,
+    0x95,
+    0xe8,
+    0xb3,
+    0x59,
+    0xce,
+    0x4b,
+    0x61,
+    0xde,
+    0x35,
+    0xec,
+    0x38,
+    0x79,
+    0x9c,
+    0xb8,
+    0x10,
+    0x52,
+    0x41,
+    0x63,
+    0xab,
+    0x82,
+    0xae,
+    0x6f,
+    0x00,
+    0xa9,
+    0xf4,
+    0xde,
+    0xdd,
+    0x49,
+    0x0b,
+    0x7e,
+    0xb8,
+    0xa5,
+    0x65,
+    0xa9,
+    0x0c,
+    0x8f,
+    0x8f,
+    0xf9,
+    0x1f,
+    0x35,
+    0xc6,
+    0x92,
+    0xb8,
+    0x5e,
+    0xb0,
+    0x66,
+    0xab,
+    0x52,
+    0x40,
+    0xc0,
+    0xb6,
+    0x36,
+    0x6a,
+    0x7d,
+    0x80,
+    0x46,
+    0x04,
+    0x02,
+    0xe5,
+    0x9f,
+    0x41,
+    0x02,
+    0x41,
+    0x00,
+    0xc0,
+    0xad,
+    0xcc,
+    0x4e,
+    0x21,
+    0xee,
+    0x1d,
+    0x24,
+    0x91,
+    0xfb,
+    0xa7,
+    0x80,
+    0x8d,
+    0x9a,
+    0xb6,
+    0xb3,
+    0x2e,
+    0x8f,
+    0xc2,
+    0xe1,
+    0x82,
+    0xdf,
+    0x69,
+    0x18,
+    0xb4,
+    0x71,
+    0xff,
+    0xa6,
+    0x65,
+    0xde,
+    0xed,
+    0x84,
+    0x8d,
+    0x42,
+    0xb7,
+    0xb3,
+    0x21,
+    0x69,
+    0x56,
+    0x1c,
+    0x07,
+    0x60,
+    0x51,
+    0x29,
+    0x04,
+    0xff,
+    0x34,
+    0x06,
+    0xdd,
+    0xb9,
+    0x67,
+    0x2c,
+    0x7c,
+    0x04,
+    0x93,
+    0x0e,
+    0x46,
+    0x15,
+    0xbb,
+    0x2a,
+    0xb7,
+    0x1b,
+    0xe7,
+    0x87,
+    0x02,
+    0x40,
+    0x78,
+    0xda,
+    0x5d,
+    0x07,
+    0x51,
+    0x0c,
+    0x16,
+    0x7a,
+    0x9f,
+    0x29,
+    0x20,
+    0x84,
+    0x0d,
+    0x42,
+    0xfa,
+    0xd7,
+    0x00,
+    0xd8,
+    0x77,
+    0x7e,
+    0xb0,
+    0xb0,
+    0x6b,
+    0xd6,
+    0x5b,
+    0x53,
+    0xb8,
+    0x9b,
+    0x7a,
+    0xcd,
+    0xc7,
+    0x2b,
+    0xb8,
+    0x6a,
+    0x63,
+    0xa9,
+    0xfb,
+    0x6f,
+    0xa4,
+    0x72,
+    0xbf,
+    0x4c,
+    0x5d,
+    0x00,
+    0x14,
+    0xba,
+    0xfa,
+    0x59,
+    0x88,
+    0xed,
+    0xe4,
+    0xe0,
+    0x8c,
+    0xa2,
+    0xec,
+    0x14,
+    0x7e,
+    0x2d,
+    0xe2,
+    0xf0,
+    0x46,
+    0x49,
+    0x95,
+    0x45,
 };
 
 static unsigned char test2048[] = {
-    0x30, 0x82, 0x04, 0xa3, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01,
-    0x01, 0x00, 0xc0, 0xc0, 0xce, 0x3e, 0x3c, 0x53, 0x67, 0x3f,
-    0x4f, 0xc5, 0x2f, 0xa4, 0xc2, 0x5a, 0x2f, 0x58, 0xfd, 0x27,
-    0x52, 0x6a, 0xe8, 0xcf, 0x4a, 0x73, 0x47, 0x8d, 0x25, 0x0f,
-    0x5f, 0x03, 0x26, 0x78, 0xef, 0xf0, 0x22, 0x12, 0xd3, 0xde,
-    0x47, 0xb2, 0x1c, 0x0b, 0x38, 0x63, 0x1a, 0x6c, 0x85, 0x7a,
-    0x80, 0xc6, 0x8f, 0xa0, 0x41, 0xaf, 0x62, 0xc4, 0x67, 0x32,
-    0x88, 0xf8, 0xa6, 0x9c, 0xf5, 0x23, 0x1d, 0xe4, 0xac, 0x3f,
-    0x29, 0xf9, 0xec, 0xe1, 0x8b, 0x26, 0x03, 0x2c, 0xb2, 0xab,
-    0xf3, 0x7d, 0xb5, 0xca, 0x49, 0xc0, 0x8f, 0x1c, 0xdf, 0x33,
-    0x3a, 0x60, 0xda, 0x3c, 0xb0, 0x16, 0xf8, 0xa9, 0x12, 0x8f,
-    0x64, 0xac, 0x23, 0x0c, 0x69, 0x64, 0x97, 0x5d, 0x99, 0xd4,
-    0x09, 0x83, 0x9b, 0x61, 0xd3, 0xac, 0xf0, 0xde, 0xdd, 0x5e,
-    0x9f, 0x44, 0x94, 0xdb, 0x3a, 0x4d, 0x97, 0xe8, 0x52, 0x29,
-    0xf7, 0xdb, 0x94, 0x07, 0x45, 0x90, 0x78, 0x1e, 0x31, 0x0b,
-    0x80, 0xf7, 0x57, 0xad, 0x1c, 0x79, 0xc5, 0xcb, 0x32, 0xb0,
-    0xce, 0xcd, 0x74, 0xb3, 0xe2, 0x94, 0xc5, 0x78, 0x2f, 0x34,
-    0x1a, 0x45, 0xf7, 0x8c, 0x52, 0xa5, 0xbc, 0x8d, 0xec, 0xd1,
-    0x2f, 0x31, 0x3b, 0xf0, 0x49, 0x59, 0x5e, 0x88, 0x9d, 0x15,
-    0x92, 0x35, 0x32, 0xc1, 0xe7, 0x61, 0xec, 0x50, 0x48, 0x7c,
-    0xba, 0x05, 0xf9, 0xf8, 0xf8, 0xa7, 0x8c, 0x83, 0xe8, 0x66,
-    0x5b, 0xeb, 0xfe, 0xd8, 0x4f, 0xdd, 0x6d, 0x36, 0xc0, 0xb2,
-    0x90, 0x0f, 0xb8, 0x52, 0xf9, 0x04, 0x9b, 0x40, 0x2c, 0x27,
-    0xd6, 0x36, 0x8e, 0xc2, 0x1b, 0x44, 0xf3, 0x92, 0xd5, 0x15,
-    0x9e, 0x9a, 0xbc, 0xf3, 0x7d, 0x03, 0xd7, 0x02, 0x14, 0x20,
-    0xe9, 0x10, 0x92, 0xfd, 0xf9, 0xfc, 0x8f, 0xe5, 0x18, 0xe1,
-    0x95, 0xcc, 0x9e, 0x60, 0xa6, 0xfa, 0x38, 0x4d, 0x02, 0x03,
-    0x01, 0x00, 0x01, 0x02, 0x82, 0x01, 0x00, 0x00, 0xc3, 0xc3,
-    0x0d, 0xb4, 0x27, 0x90, 0x8d, 0x4b, 0xbf, 0xb8, 0x84, 0xaa,
-    0xd0, 0xb8, 0xc7, 0x5d, 0x99, 0xbe, 0x55, 0xf6, 0x3e, 0x7c,
-    0x49, 0x20, 0xcb, 0x8a, 0x8e, 0x19, 0x0e, 0x66, 0x24, 0xac,
-    0xaf, 0x03, 0x33, 0x97, 0xeb, 0x95, 0xd5, 0x3b, 0x0f, 0x40,
-    0x56, 0x04, 0x50, 0xd1, 0xe6, 0xbe, 0x84, 0x0b, 0x25, 0xd3,
-    0x9c, 0xe2, 0x83, 0x6c, 0xf5, 0x62, 0x5d, 0xba, 0x2b, 0x7d,
-    0x3d, 0x7a, 0x6c, 0xe1, 0xd2, 0x0e, 0x54, 0x93, 0x80, 0x01,
-    0x91, 0x51, 0x09, 0xe8, 0x5b, 0x8e, 0x47, 0xbd, 0x64, 0xe4,
-    0x0e, 0x03, 0x83, 0x55, 0xcf, 0x5a, 0x37, 0xf0, 0x25, 0xb5,
-    0x7d, 0x21, 0xd7, 0x69, 0xdf, 0x6f, 0xc2, 0xcf, 0x10, 0xc9,
-    0x8a, 0x40, 0x9f, 0x7a, 0x70, 0xc0, 0xe8, 0xe8, 0xc0, 0xe6,
-    0x9a, 0x15, 0x0a, 0x8d, 0x4e, 0x46, 0xcb, 0x7a, 0xdb, 0xb3,
-    0xcb, 0x83, 0x02, 0xc4, 0xf0, 0xab, 0xeb, 0x02, 0x01, 0x0e,
-    0x23, 0xfc, 0x1d, 0xc4, 0xbd, 0xd4, 0xaa, 0x5d, 0x31, 0x46,
-    0x99, 0xce, 0x9e, 0xf8, 0x04, 0x75, 0x10, 0x67, 0xc4, 0x53,
-    0x47, 0x44, 0xfa, 0xc2, 0x25, 0x73, 0x7e, 0xd0, 0x8e, 0x59,
-    0xd1, 0xb2, 0x5a, 0xf4, 0xc7, 0x18, 0x92, 0x2f, 0x39, 0xab,
-    0xcd, 0xa3, 0xb5, 0xc2, 0xb9, 0xc7, 0xb9, 0x1b, 0x9f, 0x48,
-    0xfa, 0x13, 0xc6, 0x98, 0x4d, 0xca, 0x84, 0x9c, 0x06, 0xca,
-    0xe7, 0x89, 0x01, 0x04, 0xc4, 0x6c, 0xfd, 0x29, 0x59, 0x35,
-    0xe7, 0xf3, 0xdd, 0xce, 0x64, 0x59, 0xbf, 0x21, 0x13, 0xa9,
-    0x9f, 0x0e, 0xc5, 0xff, 0xbd, 0x33, 0x00, 0xec, 0xac, 0x6b,
-    0x11, 0xef, 0x51, 0x5e, 0xad, 0x07, 0x15, 0xde, 0xb8, 0x5f,
-    0xc6, 0xb9, 0xa3, 0x22, 0x65, 0x46, 0x83, 0x14, 0xdf, 0xd0,
-    0xf1, 0x44, 0x8a, 0xe1, 0x9c, 0x23, 0x33, 0xb4, 0x97, 0x33,
-    0xe6, 0x6b, 0x81, 0x02, 0x81, 0x81, 0x00, 0xec, 0x12, 0xa7,
-    0x59, 0x74, 0x6a, 0xde, 0x3e, 0xad, 0xd8, 0x36, 0x80, 0x50,
-    0xa2, 0xd5, 0x21, 0x81, 0x07, 0xf1, 0xd0, 0x91, 0xf2, 0x6c,
-    0x12, 0x2f, 0x9d, 0x1a, 0x26, 0xf8, 0x30, 0x65, 0xdf, 0xe8,
-    0xc0, 0x9b, 0x6a, 0x30, 0x98, 0x82, 0x87, 0xec, 0xa2, 0x56,
-    0x87, 0x62, 0x6f, 0xe7, 0x9f, 0xf6, 0x56, 0xe6, 0x71, 0x8f,
-    0x49, 0x86, 0x93, 0x5a, 0x4d, 0x34, 0x58, 0xfe, 0xd9, 0x04,
-    0x13, 0xaf, 0x79, 0xb7, 0xad, 0x11, 0xd1, 0x30, 0x9a, 0x14,
-    0x06, 0xa0, 0xfa, 0xb7, 0x55, 0xdc, 0x6c, 0x5a, 0x4c, 0x2c,
-    0x59, 0x56, 0xf6, 0xe8, 0x9d, 0xaf, 0x0a, 0x78, 0x99, 0x06,
-    0x06, 0x9e, 0xe7, 0x9c, 0x51, 0x55, 0x43, 0xfc, 0x3b, 0x6c,
-    0x0b, 0xbf, 0x2d, 0x41, 0xa7, 0xaf, 0xb7, 0xe0, 0xe8, 0x28,
-    0x18, 0xb4, 0x13, 0xd1, 0xe6, 0x97, 0xd0, 0x9f, 0x6a, 0x80,
-    0xca, 0xdd, 0x1a, 0x7e, 0x15, 0x02, 0x81, 0x81, 0x00, 0xd1,
-    0x06, 0x0c, 0x1f, 0xe3, 0xd0, 0xab, 0xd6, 0xca, 0x7c, 0xbc,
-    0x7d, 0x13, 0x35, 0xce, 0x27, 0xcd, 0xd8, 0x49, 0x51, 0x63,
-    0x64, 0x0f, 0xca, 0x06, 0x12, 0xfc, 0x07, 0x3e, 0xaf, 0x61,
-    0x6d, 0xe2, 0x53, 0x39, 0x27, 0xae, 0xc3, 0x11, 0x9e, 0x94,
-    0x01, 0x4f, 0xe3, 0xf3, 0x67, 0xf9, 0x77, 0xf9, 0xe7, 0x95,
-    0x3a, 0x6f, 0xe2, 0x20, 0x73, 0x3e, 0xa4, 0x7a, 0x28, 0xd4,
-    0x61, 0x97, 0xf6, 0x17, 0xa0, 0x23, 0x10, 0x2b, 0xce, 0x84,
-    0x57, 0x7e, 0x25, 0x1f, 0xf4, 0xa8, 0x54, 0xd2, 0x65, 0x94,
-    0xcc, 0x95, 0x0a, 0xab, 0x30, 0xc1, 0x59, 0x1f, 0x61, 0x8e,
-    0xb9, 0x6b, 0xd7, 0x4e, 0xb9, 0x83, 0x43, 0x79, 0x85, 0x11,
-    0xbc, 0x0f, 0xae, 0x25, 0x20, 0x05, 0xbc, 0xd2, 0x48, 0xa1,
-    0x68, 0x09, 0x84, 0xf6, 0x12, 0x9a, 0x66, 0xb9, 0x2b, 0xbb,
-    0x76, 0x03, 0x17, 0x46, 0x4e, 0x97, 0x59, 0x02, 0x81, 0x80,
-    0x09, 0x4c, 0xfa, 0xd6, 0xe5, 0x65, 0x48, 0x78, 0x43, 0xb5,
-    0x1f, 0x00, 0x93, 0x2c, 0xb7, 0x24, 0xe8, 0xc6, 0x7d, 0x5a,
-    0x70, 0x45, 0x92, 0xc8, 0x6c, 0xa3, 0xcd, 0xe1, 0xf7, 0x29,
-    0x40, 0xfa, 0x3f, 0x5b, 0x47, 0x44, 0x39, 0xc1, 0xe8, 0x72,
-    0x9e, 0x7a, 0x0e, 0xda, 0xaa, 0xa0, 0x2a, 0x09, 0xfd, 0x54,
-    0x93, 0x23, 0xaa, 0x37, 0x85, 0x5b, 0xcc, 0xd4, 0xf9, 0xd8,
-    0xff, 0xc1, 0x61, 0x0d, 0xbd, 0x7e, 0x18, 0x24, 0x73, 0x6d,
-    0x40, 0x72, 0xf1, 0x93, 0x09, 0x48, 0x97, 0x6c, 0x84, 0x90,
-    0xa8, 0x46, 0x14, 0x01, 0x39, 0x11, 0xe5, 0x3c, 0x41, 0x27,
-    0x32, 0x75, 0x24, 0xed, 0xa1, 0xd9, 0x12, 0x29, 0x8a, 0x28,
-    0x71, 0x89, 0x8d, 0xca, 0x30, 0xb0, 0x01, 0xc4, 0x2f, 0x82,
-    0x19, 0x14, 0x4c, 0x70, 0x1c, 0xb8, 0x23, 0x2e, 0xe8, 0x90,
-    0x49, 0x97, 0x92, 0x97, 0x6b, 0x7a, 0x9d, 0xb9, 0x02, 0x81,
-    0x80, 0x0f, 0x0e, 0xa1, 0x76, 0xf6, 0xa1, 0x44, 0x8f, 0xaf,
-    0x7c, 0x76, 0xd3, 0x87, 0xbb, 0xbb, 0x83, 0x10, 0x88, 0x01,
-    0x18, 0x14, 0xd1, 0xd3, 0x75, 0x59, 0x24, 0xaa, 0xf5, 0x16,
-    0xa5, 0xe9, 0x9d, 0xd1, 0xcc, 0xee, 0xf4, 0x15, 0xd9, 0xc5,
-    0x7e, 0x27, 0xe9, 0x44, 0x49, 0x06, 0x72, 0xb9, 0xfc, 0xd3,
-    0x8a, 0xc4, 0x2c, 0x36, 0x7d, 0x12, 0x9b, 0x5a, 0xaa, 0xdc,
-    0x85, 0xee, 0x6e, 0xad, 0x54, 0xb3, 0xf4, 0xfc, 0x31, 0xa1,
-    0x06, 0x3a, 0x70, 0x57, 0x0c, 0xf3, 0x95, 0x5b, 0x3e, 0xe8,
-    0xfd, 0x1a, 0x4f, 0xf6, 0x78, 0x93, 0x46, 0x6a, 0xd7, 0x31,
-    0xb4, 0x84, 0x64, 0x85, 0x09, 0x38, 0x89, 0x92, 0x94, 0x1c,
-    0xbf, 0xe2, 0x3c, 0x2a, 0xe0, 0xff, 0x99, 0xa3, 0xf0, 0x2b,
-    0x31, 0xc2, 0x36, 0xcd, 0x60, 0xbf, 0x9d, 0x2d, 0x74, 0x32,
-    0xe8, 0x9c, 0x93, 0x6e, 0xbb, 0x91, 0x7b, 0xfd, 0xd9, 0x02,
-    0x81, 0x81, 0x00, 0xa2, 0x71, 0x25, 0x38, 0xeb, 0x2a, 0xe9,
-    0x37, 0xcd, 0xfe, 0x44, 0xce, 0x90, 0x3f, 0x52, 0x87, 0x84,
-    0x52, 0x1b, 0xae, 0x8d, 0x22, 0x94, 0xce, 0x38, 0xe6, 0x04,
-    0x88, 0x76, 0x85, 0x9a, 0xd3, 0x14, 0x09, 0xe5, 0x69, 0x9a,
-    0xff, 0x58, 0x92, 0x02, 0x6a, 0x7d, 0x7c, 0x1e, 0x2c, 0xfd,
-    0xa8, 0xca, 0x32, 0x14, 0x4f, 0x0d, 0x84, 0x0d, 0x37, 0x43,
-    0xbf, 0xe4, 0x5d, 0x12, 0xc8, 0x24, 0x91, 0x27, 0x8d, 0x46,
-    0xd9, 0x54, 0x53, 0xe7, 0x62, 0x71, 0xa8, 0x2b, 0x71, 0x41,
-    0x8d, 0x75, 0xf8, 0x3a, 0xa0, 0x61, 0x29, 0x46, 0xa6, 0xe5,
-    0x82, 0xfa, 0x3a, 0xd9, 0x08, 0xfa, 0xfc, 0x63, 0xfd, 0x6b,
-    0x30, 0xbc, 0xf4, 0x4e, 0x9e, 0x8c, 0x25, 0x0c, 0xb6, 0x55,
-    0xe7, 0x3c, 0xd4, 0x4e, 0x0b, 0xfd, 0x8b, 0xc3, 0x0e, 0x1d,
-    0x9c, 0x44, 0x57, 0x8f, 0x1f, 0x86, 0xf7, 0xd5, 0x1b, 0xe4,
+    0x30,
+    0x82,
+    0x04,
+    0xa3,
+    0x02,
+    0x01,
+    0x00,
+    0x02,
+    0x82,
+    0x01,
+    0x01,
+    0x00,
+    0xc0,
+    0xc0,
+    0xce,
+    0x3e,
+    0x3c,
+    0x53,
+    0x67,
+    0x3f,
+    0x4f,
+    0xc5,
+    0x2f,
+    0xa4,
+    0xc2,
+    0x5a,
+    0x2f,
+    0x58,
+    0xfd,
+    0x27,
+    0x52,
+    0x6a,
+    0xe8,
+    0xcf,
+    0x4a,
+    0x73,
+    0x47,
+    0x8d,
+    0x25,
+    0x0f,
+    0x5f,
+    0x03,
+    0x26,
+    0x78,
+    0xef,
+    0xf0,
+    0x22,
+    0x12,
+    0xd3,
+    0xde,
+    0x47,
+    0xb2,
+    0x1c,
+    0x0b,
+    0x38,
+    0x63,
+    0x1a,
+    0x6c,
+    0x85,
+    0x7a,
+    0x80,
+    0xc6,
+    0x8f,
+    0xa0,
+    0x41,
+    0xaf,
+    0x62,
+    0xc4,
+    0x67,
+    0x32,
+    0x88,
+    0xf8,
+    0xa6,
+    0x9c,
+    0xf5,
+    0x23,
+    0x1d,
+    0xe4,
+    0xac,
+    0x3f,
+    0x29,
+    0xf9,
+    0xec,
+    0xe1,
+    0x8b,
+    0x26,
+    0x03,
+    0x2c,
+    0xb2,
+    0xab,
+    0xf3,
+    0x7d,
+    0xb5,
+    0xca,
+    0x49,
+    0xc0,
+    0x8f,
+    0x1c,
+    0xdf,
+    0x33,
+    0x3a,
+    0x60,
+    0xda,
+    0x3c,
+    0xb0,
+    0x16,
+    0xf8,
+    0xa9,
+    0x12,
+    0x8f,
+    0x64,
+    0xac,
+    0x23,
+    0x0c,
+    0x69,
+    0x64,
+    0x97,
+    0x5d,
+    0x99,
+    0xd4,
+    0x09,
+    0x83,
+    0x9b,
+    0x61,
+    0xd3,
+    0xac,
+    0xf0,
+    0xde,
+    0xdd,
+    0x5e,
+    0x9f,
+    0x44,
+    0x94,
+    0xdb,
+    0x3a,
+    0x4d,
+    0x97,
+    0xe8,
+    0x52,
+    0x29,
+    0xf7,
+    0xdb,
+    0x94,
+    0x07,
+    0x45,
+    0x90,
+    0x78,
+    0x1e,
+    0x31,
+    0x0b,
+    0x80,
+    0xf7,
+    0x57,
+    0xad,
+    0x1c,
+    0x79,
+    0xc5,
+    0xcb,
+    0x32,
+    0xb0,
+    0xce,
+    0xcd,
+    0x74,
+    0xb3,
+    0xe2,
+    0x94,
+    0xc5,
+    0x78,
+    0x2f,
+    0x34,
+    0x1a,
+    0x45,
+    0xf7,
+    0x8c,
+    0x52,
+    0xa5,
+    0xbc,
+    0x8d,
+    0xec,
+    0xd1,
+    0x2f,
+    0x31,
+    0x3b,
+    0xf0,
+    0x49,
+    0x59,
+    0x5e,
+    0x88,
+    0x9d,
+    0x15,
+    0x92,
+    0x35,
+    0x32,
+    0xc1,
+    0xe7,
+    0x61,
+    0xec,
+    0x50,
+    0x48,
+    0x7c,
+    0xba,
+    0x05,
+    0xf9,
+    0xf8,
+    0xf8,
+    0xa7,
+    0x8c,
+    0x83,
+    0xe8,
+    0x66,
+    0x5b,
+    0xeb,
+    0xfe,
+    0xd8,
+    0x4f,
+    0xdd,
+    0x6d,
+    0x36,
+    0xc0,
+    0xb2,
+    0x90,
+    0x0f,
+    0xb8,
+    0x52,
+    0xf9,
+    0x04,
+    0x9b,
+    0x40,
+    0x2c,
+    0x27,
+    0xd6,
+    0x36,
+    0x8e,
+    0xc2,
+    0x1b,
+    0x44,
+    0xf3,
+    0x92,
+    0xd5,
+    0x15,
+    0x9e,
+    0x9a,
+    0xbc,
+    0xf3,
+    0x7d,
+    0x03,
+    0xd7,
+    0x02,
+    0x14,
+    0x20,
+    0xe9,
+    0x10,
+    0x92,
+    0xfd,
+    0xf9,
+    0xfc,
+    0x8f,
+    0xe5,
+    0x18,
+    0xe1,
+    0x95,
+    0xcc,
+    0x9e,
+    0x60,
+    0xa6,
+    0xfa,
+    0x38,
+    0x4d,
+    0x02,
+    0x03,
+    0x01,
+    0x00,
+    0x01,
+    0x02,
+    0x82,
+    0x01,
+    0x00,
+    0x00,
+    0xc3,
+    0xc3,
+    0x0d,
+    0xb4,
+    0x27,
+    0x90,
+    0x8d,
+    0x4b,
+    0xbf,
+    0xb8,
+    0x84,
+    0xaa,
+    0xd0,
+    0xb8,
+    0xc7,
+    0x5d,
+    0x99,
+    0xbe,
+    0x55,
+    0xf6,
+    0x3e,
+    0x7c,
+    0x49,
+    0x20,
+    0xcb,
+    0x8a,
+    0x8e,
+    0x19,
+    0x0e,
+    0x66,
+    0x24,
+    0xac,
+    0xaf,
+    0x03,
+    0x33,
+    0x97,
+    0xeb,
+    0x95,
+    0xd5,
+    0x3b,
+    0x0f,
+    0x40,
+    0x56,
+    0x04,
+    0x50,
+    0xd1,
+    0xe6,
+    0xbe,
+    0x84,
+    0x0b,
+    0x25,
+    0xd3,
+    0x9c,
+    0xe2,
+    0x83,
+    0x6c,
+    0xf5,
+    0x62,
+    0x5d,
+    0xba,
+    0x2b,
+    0x7d,
+    0x3d,
+    0x7a,
+    0x6c,
+    0xe1,
+    0xd2,
+    0x0e,
+    0x54,
+    0x93,
+    0x80,
+    0x01,
+    0x91,
+    0x51,
+    0x09,
+    0xe8,
+    0x5b,
+    0x8e,
+    0x47,
+    0xbd,
+    0x64,
+    0xe4,
+    0x0e,
+    0x03,
+    0x83,
+    0x55,
+    0xcf,
+    0x5a,
+    0x37,
+    0xf0,
+    0x25,
+    0xb5,
+    0x7d,
+    0x21,
+    0xd7,
+    0x69,
+    0xdf,
+    0x6f,
+    0xc2,
+    0xcf,
+    0x10,
+    0xc9,
+    0x8a,
+    0x40,
+    0x9f,
+    0x7a,
+    0x70,
+    0xc0,
+    0xe8,
+    0xe8,
+    0xc0,
+    0xe6,
+    0x9a,
+    0x15,
+    0x0a,
+    0x8d,
+    0x4e,
+    0x46,
+    0xcb,
+    0x7a,
+    0xdb,
+    0xb3,
+    0xcb,
+    0x83,
+    0x02,
+    0xc4,
+    0xf0,
+    0xab,
+    0xeb,
+    0x02,
+    0x01,
+    0x0e,
+    0x23,
+    0xfc,
+    0x1d,
+    0xc4,
+    0xbd,
+    0xd4,
+    0xaa,
+    0x5d,
+    0x31,
+    0x46,
+    0x99,
+    0xce,
+    0x9e,
+    0xf8,
+    0x04,
+    0x75,
+    0x10,
+    0x67,
+    0xc4,
+    0x53,
+    0x47,
+    0x44,
+    0xfa,
+    0xc2,
+    0x25,
+    0x73,
+    0x7e,
+    0xd0,
+    0x8e,
+    0x59,
+    0xd1,
+    0xb2,
+    0x5a,
+    0xf4,
+    0xc7,
+    0x18,
+    0x92,
+    0x2f,
+    0x39,
+    0xab,
+    0xcd,
+    0xa3,
+    0xb5,
+    0xc2,
+    0xb9,
+    0xc7,
+    0xb9,
+    0x1b,
+    0x9f,
+    0x48,
+    0xfa,
+    0x13,
+    0xc6,
+    0x98,
+    0x4d,
+    0xca,
+    0x84,
+    0x9c,
+    0x06,
+    0xca,
+    0xe7,
+    0x89,
+    0x01,
+    0x04,
+    0xc4,
+    0x6c,
+    0xfd,
+    0x29,
+    0x59,
+    0x35,
+    0xe7,
+    0xf3,
+    0xdd,
+    0xce,
+    0x64,
+    0x59,
+    0xbf,
+    0x21,
+    0x13,
+    0xa9,
+    0x9f,
+    0x0e,
+    0xc5,
+    0xff,
+    0xbd,
+    0x33,
+    0x00,
+    0xec,
+    0xac,
+    0x6b,
+    0x11,
+    0xef,
+    0x51,
+    0x5e,
+    0xad,
+    0x07,
+    0x15,
+    0xde,
+    0xb8,
+    0x5f,
+    0xc6,
+    0xb9,
+    0xa3,
+    0x22,
+    0x65,
+    0x46,
+    0x83,
+    0x14,
+    0xdf,
+    0xd0,
+    0xf1,
+    0x44,
+    0x8a,
+    0xe1,
+    0x9c,
+    0x23,
+    0x33,
+    0xb4,
+    0x97,
+    0x33,
+    0xe6,
+    0x6b,
+    0x81,
+    0x02,
+    0x81,
+    0x81,
+    0x00,
+    0xec,
+    0x12,
+    0xa7,
+    0x59,
+    0x74,
+    0x6a,
+    0xde,
+    0x3e,
+    0xad,
+    0xd8,
+    0x36,
+    0x80,
+    0x50,
+    0xa2,
+    0xd5,
+    0x21,
+    0x81,
+    0x07,
+    0xf1,
+    0xd0,
+    0x91,
+    0xf2,
+    0x6c,
+    0x12,
+    0x2f,
+    0x9d,
+    0x1a,
+    0x26,
+    0xf8,
+    0x30,
+    0x65,
+    0xdf,
+    0xe8,
+    0xc0,
+    0x9b,
+    0x6a,
+    0x30,
+    0x98,
+    0x82,
+    0x87,
+    0xec,
+    0xa2,
+    0x56,
+    0x87,
+    0x62,
+    0x6f,
+    0xe7,
+    0x9f,
+    0xf6,
+    0x56,
+    0xe6,
+    0x71,
+    0x8f,
+    0x49,
+    0x86,
+    0x93,
+    0x5a,
+    0x4d,
+    0x34,
+    0x58,
+    0xfe,
+    0xd9,
+    0x04,
+    0x13,
+    0xaf,
+    0x79,
+    0xb7,
+    0xad,
+    0x11,
+    0xd1,
+    0x30,
+    0x9a,
+    0x14,
+    0x06,
+    0xa0,
+    0xfa,
+    0xb7,
+    0x55,
+    0xdc,
+    0x6c,
+    0x5a,
+    0x4c,
+    0x2c,
+    0x59,
+    0x56,
+    0xf6,
+    0xe8,
+    0x9d,
+    0xaf,
+    0x0a,
+    0x78,
+    0x99,
+    0x06,
+    0x06,
+    0x9e,
+    0xe7,
+    0x9c,
+    0x51,
+    0x55,
+    0x43,
+    0xfc,
+    0x3b,
+    0x6c,
+    0x0b,
+    0xbf,
+    0x2d,
+    0x41,
+    0xa7,
+    0xaf,
+    0xb7,
+    0xe0,
+    0xe8,
+    0x28,
+    0x18,
+    0xb4,
+    0x13,
+    0xd1,
+    0xe6,
+    0x97,
+    0xd0,
+    0x9f,
+    0x6a,
+    0x80,
+    0xca,
+    0xdd,
+    0x1a,
+    0x7e,
+    0x15,
+    0x02,
+    0x81,
+    0x81,
+    0x00,
+    0xd1,
+    0x06,
+    0x0c,
+    0x1f,
+    0xe3,
+    0xd0,
+    0xab,
+    0xd6,
+    0xca,
+    0x7c,
+    0xbc,
+    0x7d,
+    0x13,
+    0x35,
+    0xce,
+    0x27,
+    0xcd,
+    0xd8,
+    0x49,
+    0x51,
+    0x63,
+    0x64,
+    0x0f,
+    0xca,
+    0x06,
+    0x12,
+    0xfc,
+    0x07,
+    0x3e,
+    0xaf,
+    0x61,
+    0x6d,
+    0xe2,
+    0x53,
+    0x39,
+    0x27,
+    0xae,
+    0xc3,
+    0x11,
+    0x9e,
+    0x94,
+    0x01,
+    0x4f,
+    0xe3,
+    0xf3,
+    0x67,
+    0xf9,
+    0x77,
+    0xf9,
+    0xe7,
+    0x95,
+    0x3a,
+    0x6f,
+    0xe2,
+    0x20,
+    0x73,
+    0x3e,
+    0xa4,
+    0x7a,
+    0x28,
+    0xd4,
+    0x61,
+    0x97,
+    0xf6,
+    0x17,
+    0xa0,
+    0x23,
+    0x10,
+    0x2b,
+    0xce,
+    0x84,
+    0x57,
+    0x7e,
+    0x25,
+    0x1f,
+    0xf4,
+    0xa8,
+    0x54,
+    0xd2,
+    0x65,
+    0x94,
+    0xcc,
+    0x95,
+    0x0a,
+    0xab,
+    0x30,
+    0xc1,
+    0x59,
+    0x1f,
+    0x61,
+    0x8e,
+    0xb9,
+    0x6b,
+    0xd7,
+    0x4e,
+    0xb9,
+    0x83,
+    0x43,
+    0x79,
+    0x85,
+    0x11,
+    0xbc,
+    0x0f,
+    0xae,
+    0x25,
+    0x20,
+    0x05,
+    0xbc,
+    0xd2,
+    0x48,
+    0xa1,
+    0x68,
+    0x09,
+    0x84,
+    0xf6,
+    0x12,
+    0x9a,
+    0x66,
+    0xb9,
+    0x2b,
+    0xbb,
+    0x76,
+    0x03,
+    0x17,
+    0x46,
+    0x4e,
+    0x97,
+    0x59,
+    0x02,
+    0x81,
+    0x80,
+    0x09,
+    0x4c,
+    0xfa,
+    0xd6,
+    0xe5,
+    0x65,
+    0x48,
+    0x78,
+    0x43,
+    0xb5,
+    0x1f,
+    0x00,
+    0x93,
+    0x2c,
+    0xb7,
+    0x24,
+    0xe8,
+    0xc6,
+    0x7d,
+    0x5a,
+    0x70,
+    0x45,
+    0x92,
+    0xc8,
+    0x6c,
+    0xa3,
+    0xcd,
+    0xe1,
+    0xf7,
+    0x29,
+    0x40,
+    0xfa,
+    0x3f,
+    0x5b,
+    0x47,
+    0x44,
+    0x39,
+    0xc1,
+    0xe8,
+    0x72,
+    0x9e,
+    0x7a,
+    0x0e,
+    0xda,
+    0xaa,
+    0xa0,
+    0x2a,
+    0x09,
+    0xfd,
+    0x54,
+    0x93,
+    0x23,
+    0xaa,
+    0x37,
+    0x85,
+    0x5b,
+    0xcc,
+    0xd4,
+    0xf9,
+    0xd8,
+    0xff,
+    0xc1,
+    0x61,
+    0x0d,
+    0xbd,
+    0x7e,
+    0x18,
+    0x24,
+    0x73,
+    0x6d,
+    0x40,
+    0x72,
+    0xf1,
+    0x93,
+    0x09,
+    0x48,
+    0x97,
+    0x6c,
+    0x84,
+    0x90,
+    0xa8,
+    0x46,
+    0x14,
+    0x01,
+    0x39,
+    0x11,
+    0xe5,
+    0x3c,
+    0x41,
+    0x27,
+    0x32,
+    0x75,
+    0x24,
+    0xed,
+    0xa1,
+    0xd9,
+    0x12,
+    0x29,
+    0x8a,
+    0x28,
+    0x71,
+    0x89,
+    0x8d,
+    0xca,
+    0x30,
+    0xb0,
+    0x01,
+    0xc4,
+    0x2f,
+    0x82,
+    0x19,
+    0x14,
+    0x4c,
+    0x70,
+    0x1c,
+    0xb8,
+    0x23,
+    0x2e,
+    0xe8,
+    0x90,
+    0x49,
+    0x97,
+    0x92,
+    0x97,
+    0x6b,
+    0x7a,
+    0x9d,
+    0xb9,
+    0x02,
+    0x81,
+    0x80,
+    0x0f,
+    0x0e,
+    0xa1,
+    0x76,
+    0xf6,
+    0xa1,
+    0x44,
+    0x8f,
+    0xaf,
+    0x7c,
+    0x76,
+    0xd3,
+    0x87,
+    0xbb,
+    0xbb,
+    0x83,
+    0x10,
+    0x88,
+    0x01,
+    0x18,
+    0x14,
+    0xd1,
+    0xd3,
+    0x75,
+    0x59,
+    0x24,
+    0xaa,
+    0xf5,
+    0x16,
+    0xa5,
+    0xe9,
+    0x9d,
+    0xd1,
+    0xcc,
+    0xee,
+    0xf4,
+    0x15,
+    0xd9,
+    0xc5,
+    0x7e,
+    0x27,
+    0xe9,
+    0x44,
+    0x49,
+    0x06,
+    0x72,
+    0xb9,
+    0xfc,
+    0xd3,
+    0x8a,
+    0xc4,
+    0x2c,
+    0x36,
+    0x7d,
+    0x12,
+    0x9b,
+    0x5a,
+    0xaa,
+    0xdc,
+    0x85,
+    0xee,
+    0x6e,
+    0xad,
+    0x54,
+    0xb3,
+    0xf4,
+    0xfc,
+    0x31,
+    0xa1,
+    0x06,
+    0x3a,
+    0x70,
+    0x57,
+    0x0c,
+    0xf3,
+    0x95,
+    0x5b,
+    0x3e,
+    0xe8,
+    0xfd,
+    0x1a,
+    0x4f,
+    0xf6,
+    0x78,
+    0x93,
+    0x46,
+    0x6a,
+    0xd7,
+    0x31,
+    0xb4,
+    0x84,
+    0x64,
+    0x85,
+    0x09,
+    0x38,
+    0x89,
+    0x92,
+    0x94,
+    0x1c,
+    0xbf,
+    0xe2,
+    0x3c,
+    0x2a,
+    0xe0,
+    0xff,
+    0x99,
+    0xa3,
+    0xf0,
+    0x2b,
+    0x31,
+    0xc2,
+    0x36,
+    0xcd,
+    0x60,
+    0xbf,
+    0x9d,
+    0x2d,
+    0x74,
+    0x32,
+    0xe8,
+    0x9c,
+    0x93,
+    0x6e,
+    0xbb,
+    0x91,
+    0x7b,
+    0xfd,
+    0xd9,
+    0x02,
+    0x81,
+    0x81,
+    0x00,
+    0xa2,
+    0x71,
+    0x25,
+    0x38,
+    0xeb,
+    0x2a,
+    0xe9,
+    0x37,
+    0xcd,
+    0xfe,
+    0x44,
+    0xce,
+    0x90,
+    0x3f,
+    0x52,
+    0x87,
+    0x84,
+    0x52,
+    0x1b,
+    0xae,
+    0x8d,
+    0x22,
+    0x94,
+    0xce,
+    0x38,
+    0xe6,
+    0x04,
+    0x88,
+    0x76,
+    0x85,
+    0x9a,
+    0xd3,
+    0x14,
+    0x09,
+    0xe5,
+    0x69,
+    0x9a,
+    0xff,
+    0x58,
+    0x92,
+    0x02,
+    0x6a,
+    0x7d,
+    0x7c,
+    0x1e,
+    0x2c,
+    0xfd,
+    0xa8,
+    0xca,
+    0x32,
+    0x14,
+    0x4f,
+    0x0d,
+    0x84,
+    0x0d,
+    0x37,
+    0x43,
+    0xbf,
+    0xe4,
+    0x5d,
+    0x12,
+    0xc8,
+    0x24,
+    0x91,
+    0x27,
+    0x8d,
+    0x46,
+    0xd9,
+    0x54,
+    0x53,
+    0xe7,
+    0x62,
+    0x71,
+    0xa8,
+    0x2b,
+    0x71,
+    0x41,
+    0x8d,
+    0x75,
+    0xf8,
+    0x3a,
+    0xa0,
+    0x61,
+    0x29,
+    0x46,
+    0xa6,
+    0xe5,
+    0x82,
+    0xfa,
+    0x3a,
+    0xd9,
+    0x08,
+    0xfa,
+    0xfc,
+    0x63,
+    0xfd,
+    0x6b,
+    0x30,
+    0xbc,
+    0xf4,
+    0x4e,
+    0x9e,
+    0x8c,
+    0x25,
+    0x0c,
+    0xb6,
+    0x55,
+    0xe7,
+    0x3c,
+    0xd4,
+    0x4e,
+    0x0b,
+    0xfd,
+    0x8b,
+    0xc3,
+    0x0e,
+    0x1d,
+    0x9c,
+    0x44,
+    0x57,
+    0x8f,
+    0x1f,
+    0x86,
+    0xf7,
+    0xd5,
+    0x1b,
+    0xe4,
     0x95,
 };
 
@@ -410,241 +2314,2355 @@ static unsigned char test3072[] = {
 };
 
 static unsigned char test4096[] = {
-    0x30, 0x82, 0x09, 0x29, 0x02, 0x01, 0x00, 0x02, 0x82, 0x02,
-    0x01, 0x00, 0xc0, 0x71, 0xac, 0x1a, 0x13, 0x88, 0x82, 0x43,
-    0x3b, 0x51, 0x57, 0x71, 0x8d, 0xb6, 0x2b, 0x82, 0x65, 0x21,
-    0x53, 0x5f, 0x28, 0x29, 0x4f, 0x8d, 0x7c, 0x8a, 0xb9, 0x44,
-    0xb3, 0x28, 0x41, 0x4f, 0xd3, 0xfa, 0x6a, 0xf8, 0xb9, 0x28,
-    0x50, 0x39, 0x67, 0x53, 0x2c, 0x3c, 0xd7, 0xcb, 0x96, 0x41,
-    0x40, 0x32, 0xbb, 0xeb, 0x70, 0xae, 0x1f, 0xb0, 0x65, 0xf7,
-    0x3a, 0xd9, 0x22, 0xfd, 0x10, 0xae, 0xbd, 0x02, 0xe2, 0xdd,
-    0xf3, 0xc2, 0x79, 0x3c, 0xc6, 0xfc, 0x75, 0xbb, 0xaf, 0x4e,
-    0x3a, 0x36, 0xc2, 0x4f, 0xea, 0x25, 0xdf, 0x13, 0x16, 0x4b,
-    0x20, 0xfe, 0x4b, 0x69, 0x16, 0xc4, 0x7f, 0x1a, 0x43, 0xa6,
-    0x17, 0x1b, 0xb9, 0x0a, 0xf3, 0x09, 0x86, 0x28, 0x89, 0xcf,
-    0x2c, 0xd0, 0xd4, 0x81, 0xaf, 0xc6, 0x6d, 0xe6, 0x21, 0x8d,
-    0xee, 0xef, 0xea, 0xdc, 0xb7, 0xc6, 0x3b, 0x63, 0x9f, 0x0e,
-    0xad, 0x89, 0x78, 0x23, 0x18, 0xbf, 0x70, 0x7e, 0x84, 0xe0,
-    0x37, 0xec, 0xdb, 0x8e, 0x9c, 0x3e, 0x6a, 0x19, 0xcc, 0x99,
-    0x72, 0xe6, 0xb5, 0x7d, 0x6d, 0xfa, 0xe5, 0xd3, 0xe4, 0x90,
-    0xb5, 0xb2, 0xb2, 0x12, 0x70, 0x4e, 0xca, 0xf8, 0x10, 0xf8,
-    0xa3, 0x14, 0xc2, 0x48, 0x19, 0xeb, 0x60, 0x99, 0xbb, 0x2a,
-    0x1f, 0xb1, 0x7a, 0xb1, 0x3d, 0x24, 0xfb, 0xa0, 0x29, 0xda,
-    0xbd, 0x1b, 0xd7, 0xa4, 0xbf, 0xef, 0x60, 0x2d, 0x22, 0xca,
-    0x65, 0x98, 0xf1, 0xc4, 0xe1, 0xc9, 0x02, 0x6b, 0x16, 0x28,
-    0x2f, 0xa1, 0xaa, 0x79, 0x00, 0xda, 0xdc, 0x7c, 0x43, 0xf7,
-    0x42, 0x3c, 0xa0, 0xef, 0x68, 0xf7, 0xdf, 0xb9, 0x69, 0xfb,
-    0x8e, 0x01, 0xed, 0x01, 0x42, 0xb5, 0x4e, 0x57, 0xa6, 0x26,
-    0xb8, 0xd0, 0x7b, 0x56, 0x6d, 0x03, 0xc6, 0x40, 0x8c, 0x8c,
-    0x2a, 0x55, 0xd7, 0x9c, 0x35, 0x00, 0x94, 0x93, 0xec, 0x03,
-    0xeb, 0x22, 0xef, 0x77, 0xbb, 0x79, 0x13, 0x3f, 0x15, 0xa1,
-    0x8f, 0xca, 0xdf, 0xfd, 0xd3, 0xb8, 0xe1, 0xd4, 0xcc, 0x09,
-    0x3f, 0x3c, 0x2c, 0xdb, 0xd1, 0x49, 0x7f, 0x38, 0x07, 0x83,
-    0x6d, 0xeb, 0x08, 0x66, 0xe9, 0x06, 0x44, 0x12, 0xac, 0x95,
-    0x22, 0x90, 0x23, 0x67, 0xd4, 0x08, 0xcc, 0xf4, 0xb7, 0xdc,
-    0xcc, 0x87, 0xd4, 0xac, 0x69, 0x35, 0x4c, 0xb5, 0x39, 0x36,
-    0xcd, 0xa4, 0xd2, 0x95, 0xca, 0x0d, 0xc5, 0xda, 0xc2, 0xc5,
-    0x22, 0x32, 0x28, 0x08, 0xe3, 0xd2, 0x8b, 0x38, 0x30, 0xdc,
-    0x8c, 0x75, 0x4f, 0x6a, 0xec, 0x7a, 0xac, 0x16, 0x3e, 0xa8,
-    0xd4, 0x6a, 0x45, 0xe1, 0xa8, 0x4f, 0x2e, 0x80, 0x34, 0xaa,
-    0x54, 0x1b, 0x02, 0x95, 0x7d, 0x8a, 0x6d, 0xcc, 0x79, 0xca,
-    0xf2, 0xa4, 0x2e, 0x8d, 0xfb, 0xfe, 0x15, 0x51, 0x10, 0x0e,
-    0x4d, 0x88, 0xb1, 0xc7, 0xf4, 0x79, 0xdb, 0xf0, 0xb4, 0x56,
-    0x44, 0x37, 0xca, 0x5a, 0xc1, 0x8c, 0x48, 0xac, 0xae, 0x48,
-    0x80, 0x83, 0x01, 0x3f, 0xde, 0xd9, 0xd3, 0x2c, 0x51, 0x46,
-    0xb1, 0x41, 0xb6, 0xc6, 0x91, 0x72, 0xf9, 0x83, 0x55, 0x1b,
-    0x8c, 0xba, 0xf3, 0x73, 0xe5, 0x2c, 0x74, 0x50, 0x3a, 0xbe,
-    0xc5, 0x2f, 0xa7, 0xb2, 0x6d, 0x8c, 0x9e, 0x13, 0x77, 0xa3,
-    0x13, 0xcd, 0x6d, 0x8c, 0x45, 0xe1, 0xfc, 0x0b, 0xb7, 0x69,
-    0xe9, 0x27, 0xbc, 0x65, 0xc3, 0xfa, 0x9b, 0xd0, 0xef, 0xfe,
-    0xe8, 0x1f, 0xb3, 0x5e, 0x34, 0xf4, 0x8c, 0xea, 0xfc, 0xd3,
-    0x81, 0xbf, 0x3d, 0x30, 0xb2, 0xb4, 0x01, 0xe8, 0x43, 0x0f,
-    0xba, 0x02, 0x23, 0x42, 0x76, 0x82, 0x31, 0x73, 0x91, 0xed,
-    0x07, 0x46, 0x61, 0x0d, 0x39, 0x83, 0x40, 0xce, 0x7a, 0xd4,
-    0xdb, 0x80, 0x2c, 0x1f, 0x0d, 0xd1, 0x34, 0xd4, 0x92, 0xe3,
-    0xd4, 0xf1, 0xc2, 0x01, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02,
-    0x82, 0x02, 0x01, 0x00, 0x97, 0x6c, 0xda, 0x6e, 0xea, 0x4f,
-    0xcf, 0xaf, 0xf7, 0x4c, 0xd9, 0xf1, 0x90, 0x00, 0x77, 0xdb,
-    0xf2, 0x97, 0x76, 0x72, 0xb9, 0xb7, 0x47, 0xd1, 0x9c, 0xdd,
-    0xcb, 0x4a, 0x33, 0x6e, 0xc9, 0x75, 0x76, 0xe6, 0xe4, 0xa5,
-    0x31, 0x8c, 0x77, 0x13, 0xb4, 0x29, 0xcd, 0xf5, 0x52, 0x17,
-    0xef, 0xf3, 0x08, 0x00, 0xe3, 0xbd, 0x2e, 0xbc, 0xd4, 0x52,
-    0x88, 0xe9, 0x30, 0x75, 0x0b, 0x02, 0xf5, 0xcd, 0x89, 0x0c,
-    0x6c, 0x57, 0x19, 0x27, 0x3d, 0x1e, 0x85, 0xb4, 0xc1, 0x2f,
-    0x1d, 0x92, 0x00, 0x5c, 0x76, 0x29, 0x4b, 0xa4, 0xe1, 0x12,
-    0xb3, 0xc8, 0x09, 0xfe, 0x0e, 0x78, 0x72, 0x61, 0xcb, 0x61,
-    0x6f, 0x39, 0x91, 0x95, 0x4e, 0xd5, 0x3e, 0xc7, 0x8f, 0xb8,
-    0xf6, 0x36, 0xfe, 0x9c, 0x93, 0x9a, 0x38, 0x25, 0x7a, 0xf4,
-    0x4a, 0x12, 0xd4, 0xa0, 0x13, 0xbd, 0xf9, 0x1d, 0x12, 0x3e,
-    0x21, 0x39, 0xfb, 0x72, 0xe0, 0x05, 0x3d, 0xc3, 0xe5, 0x50,
-    0xa8, 0x5d, 0x85, 0xa3, 0xea, 0x5f, 0x1c, 0xb2, 0x3f, 0xea,
-    0x6d, 0x03, 0x91, 0x55, 0xd8, 0x19, 0x0a, 0x21, 0x12, 0x16,
-    0xd9, 0x12, 0xc4, 0xe6, 0x07, 0x18, 0x5b, 0x26, 0xa4, 0xae,
-    0xed, 0x2b, 0xb7, 0xa6, 0xed, 0xf8, 0xad, 0xec, 0x77, 0xe6,
-    0x7f, 0x4f, 0x76, 0x00, 0xc0, 0xfa, 0x15, 0x92, 0xb4, 0x2c,
-    0x22, 0xc2, 0xeb, 0x6a, 0xad, 0x14, 0x05, 0xb2, 0xe5, 0x8a,
-    0x9e, 0x85, 0x83, 0xcc, 0x04, 0xf1, 0x56, 0x78, 0x44, 0x5e,
-    0xde, 0xe0, 0x60, 0x1a, 0x65, 0x79, 0x31, 0x23, 0x05, 0xbb,
-    0x01, 0xff, 0xdd, 0x2e, 0xb7, 0xb3, 0xaa, 0x74, 0xe0, 0xa5,
-    0x94, 0xaf, 0x4b, 0xde, 0x58, 0x0f, 0x55, 0xde, 0x33, 0xf6,
-    0xe3, 0xd6, 0x34, 0x36, 0x57, 0xd6, 0x79, 0x91, 0x2e, 0xbe,
-    0x3b, 0xd9, 0x4e, 0xb6, 0x9d, 0x21, 0x5c, 0xd3, 0x48, 0x14,
-    0x7f, 0x4a, 0xc4, 0x60, 0xa9, 0x29, 0xf8, 0x53, 0x7f, 0x88,
-    0x11, 0x2d, 0xb5, 0xc5, 0x2d, 0x6f, 0xee, 0x85, 0x0b, 0xf7,
-    0x8d, 0x9a, 0xbe, 0xb0, 0x42, 0xf2, 0x2e, 0x71, 0xaf, 0x19,
-    0x31, 0x6d, 0xec, 0xcd, 0x6f, 0x2b, 0x23, 0xdf, 0xb4, 0x40,
-    0xaf, 0x2c, 0x0a, 0xc3, 0x1b, 0x7d, 0x7d, 0x03, 0x1d, 0x4b,
-    0xf3, 0xb5, 0xe0, 0x85, 0xd8, 0xdf, 0x91, 0x6b, 0x0a, 0x69,
-    0xf7, 0xf2, 0x69, 0x66, 0x5b, 0xf1, 0xcf, 0x46, 0x7d, 0xe9,
-    0x70, 0xfa, 0x6d, 0x7e, 0x75, 0x4e, 0xa9, 0x77, 0xe6, 0x8c,
-    0x02, 0xf7, 0x14, 0x4d, 0xa5, 0x41, 0x8f, 0x3f, 0xc1, 0x62,
-    0x1e, 0x71, 0x5e, 0x38, 0xb4, 0xd6, 0xe6, 0xe1, 0x4b, 0xc2,
-    0x2c, 0x30, 0x83, 0x81, 0x6f, 0x49, 0x2e, 0x96, 0xe6, 0xc9,
-    0x9a, 0xf7, 0x5d, 0x09, 0xa0, 0x55, 0x02, 0xa5, 0x3a, 0x25,
-    0x23, 0xd0, 0x92, 0xc3, 0xa3, 0xe3, 0x0e, 0x12, 0x2f, 0x4d,
-    0xef, 0xf3, 0x55, 0x5a, 0xbe, 0xe6, 0x19, 0x86, 0x31, 0xab,
-    0x75, 0x9a, 0xd3, 0xf0, 0x2c, 0xc5, 0x41, 0x92, 0xd9, 0x1f,
-    0x5f, 0x11, 0x8c, 0x75, 0x1c, 0x63, 0xd0, 0x02, 0x80, 0x2c,
-    0x68, 0xcb, 0x93, 0xfb, 0x51, 0x73, 0x49, 0xb4, 0x60, 0xda,
-    0xe2, 0x26, 0xaf, 0xa9, 0x46, 0x12, 0xb8, 0xec, 0x50, 0xdd,
-    0x12, 0x06, 0x5f, 0xce, 0x59, 0xe6, 0xf6, 0x1c, 0xe0, 0x54,
-    0x10, 0xad, 0xf6, 0xcd, 0x98, 0xcc, 0x0f, 0xfb, 0xcb, 0x41,
-    0x14, 0x9d, 0xed, 0xe4, 0xb4, 0x74, 0x5f, 0x09, 0x60, 0xc7,
-    0x12, 0xf6, 0x7b, 0x3c, 0x8f, 0xa7, 0x20, 0xbc, 0xe4, 0xb1,
-    0xef, 0xeb, 0xa4, 0x93, 0xc5, 0x06, 0xca, 0x9a, 0x27, 0x9d,
-    0x87, 0xf3, 0xde, 0xca, 0xe5, 0xe7, 0xf6, 0x1c, 0x01, 0x65,
-    0x5b, 0xfb, 0x19, 0x79, 0x6e, 0x08, 0x26, 0xc5, 0xc8, 0x28,
-    0x0e, 0xb6, 0x3b, 0x07, 0x08, 0xc1, 0x02, 0x82, 0x01, 0x01,
-    0x00, 0xe8, 0x1c, 0x73, 0xa6, 0xb8, 0xe0, 0x0e, 0x6d, 0x8d,
-    0x1b, 0xb9, 0x53, 0xed, 0x58, 0x94, 0xe6, 0x1d, 0x60, 0x14,
-    0x5c, 0x76, 0x43, 0xc4, 0x58, 0x19, 0xc4, 0x24, 0xe8, 0xbc,
-    0x1b, 0x3b, 0x0b, 0x13, 0x24, 0x45, 0x54, 0x0e, 0xcc, 0x37,
-    0xf0, 0xe0, 0x63, 0x7d, 0xc3, 0xf7, 0xfb, 0x81, 0x74, 0x81,
-    0xc4, 0x0f, 0x1a, 0x21, 0x48, 0xaf, 0xce, 0xc1, 0xc4, 0x94,
-    0x18, 0x06, 0x44, 0x8d, 0xd3, 0xd2, 0x22, 0x2d, 0x2d, 0x3e,
-    0x5a, 0x31, 0xdc, 0x95, 0x8e, 0xf4, 0x41, 0xfc, 0x58, 0xc9,
-    0x40, 0x92, 0x17, 0x5f, 0xe3, 0xda, 0xac, 0x9e, 0x3f, 0x1c,
-    0x2a, 0x6b, 0x58, 0x5f, 0x48, 0x78, 0x20, 0xb1, 0xaf, 0x24,
-    0x9b, 0x3c, 0x20, 0x8b, 0x93, 0x25, 0x9e, 0xe6, 0x6b, 0xbc,
-    0x13, 0x42, 0x14, 0x6c, 0x36, 0x31, 0xff, 0x7a, 0xd1, 0xc1,
-    0x1a, 0x26, 0x14, 0x7f, 0xa9, 0x76, 0xa7, 0x0c, 0xf8, 0xcc,
-    0xed, 0x07, 0x6a, 0xd2, 0xdf, 0x62, 0xee, 0x0a, 0x7c, 0x84,
-    0xcb, 0x49, 0x90, 0xb2, 0x03, 0x0d, 0xa2, 0x82, 0x06, 0x77,
-    0xf1, 0xcd, 0x67, 0xf2, 0x47, 0x21, 0x02, 0x3f, 0x43, 0x21,
-    0xf0, 0x46, 0x30, 0x62, 0x51, 0x72, 0xb1, 0xe7, 0x48, 0xc6,
-    0x67, 0x12, 0xcd, 0x9e, 0xd6, 0x15, 0xe5, 0x21, 0xed, 0xfa,
-    0x8f, 0x30, 0xa6, 0x41, 0xfe, 0xb6, 0xfa, 0x8f, 0x34, 0x14,
-    0x19, 0xe8, 0x11, 0xf7, 0xa5, 0x77, 0x3e, 0xb7, 0xf9, 0x39,
-    0x07, 0x8c, 0x67, 0x2a, 0xab, 0x7b, 0x08, 0xf8, 0xb0, 0x06,
-    0xa8, 0xea, 0x2f, 0x8f, 0xfa, 0xcc, 0xcc, 0x40, 0xce, 0xf3,
-    0x70, 0x4f, 0x3f, 0x7f, 0xe2, 0x0c, 0xea, 0x76, 0x4a, 0x35,
-    0x4e, 0x47, 0xad, 0x2b, 0xa7, 0x97, 0x5d, 0x74, 0x43, 0x97,
-    0x90, 0xd2, 0xfb, 0xd9, 0xf9, 0x96, 0x01, 0x33, 0x05, 0xed,
-    0x7b, 0x03, 0x05, 0xad, 0xf8, 0x49, 0x03, 0x02, 0x82, 0x01,
-    0x01, 0x00, 0xd4, 0x40, 0x17, 0x66, 0x10, 0x92, 0x95, 0xc8,
-    0xec, 0x62, 0xa9, 0x7a, 0xcb, 0x93, 0x8e, 0xe6, 0x53, 0xd4,
-    0x80, 0x48, 0x27, 0x4b, 0x41, 0xce, 0x61, 0xdf, 0xbf, 0x94,
-    0xa4, 0x3d, 0x71, 0x03, 0x0b, 0xed, 0x25, 0x71, 0x98, 0xa4,
-    0xd6, 0xd5, 0x4a, 0x57, 0xf5, 0x6c, 0x1b, 0xda, 0x21, 0x7d,
-    0x35, 0x45, 0xb3, 0xf3, 0x6a, 0xd9, 0xd3, 0x43, 0xe8, 0x5c,
-    0x54, 0x1c, 0x83, 0x1b, 0xb4, 0x5f, 0xf2, 0x97, 0x24, 0x2e,
-    0xdc, 0x40, 0xde, 0x92, 0x23, 0x59, 0x8e, 0xbc, 0xd2, 0xa1,
-    0xf2, 0xe0, 0x4c, 0xdd, 0x0b, 0xd1, 0xe7, 0xae, 0x65, 0xbc,
-    0xb5, 0xf5, 0x5b, 0x98, 0xe9, 0xd7, 0xc2, 0xb7, 0x0e, 0x55,
-    0x71, 0x0e, 0x3c, 0x0a, 0x24, 0x6b, 0xa6, 0xe6, 0x14, 0x61,
-    0x11, 0xfd, 0x33, 0x42, 0x99, 0x2b, 0x84, 0x77, 0x74, 0x92,
-    0x91, 0xf5, 0x79, 0x79, 0xcf, 0xad, 0x8e, 0x04, 0xef, 0x80,
-    0x1e, 0x57, 0xf4, 0x14, 0xf5, 0x35, 0x09, 0x74, 0xb2, 0x13,
-    0x71, 0x58, 0x6b, 0xea, 0x32, 0x5d, 0xf3, 0xd3, 0x76, 0x48,
-    0x39, 0x10, 0x23, 0x84, 0x9d, 0xbe, 0x92, 0x77, 0x4a, 0xed,
-    0x70, 0x3e, 0x1a, 0xa2, 0x6c, 0xb3, 0x81, 0x00, 0xc3, 0xc9,
-    0xe4, 0x52, 0xc8, 0x24, 0x88, 0x0c, 0x41, 0xad, 0x87, 0x5a,
-    0xea, 0xa3, 0x7a, 0x85, 0x1c, 0x5e, 0x31, 0x7f, 0xc3, 0x35,
-    0xc6, 0xfa, 0x10, 0xc8, 0x75, 0x10, 0xc4, 0x96, 0x99, 0xe7,
-    0xfe, 0x01, 0xb4, 0x74, 0xdb, 0xb4, 0x11, 0xc3, 0xc8, 0x8c,
-    0xf6, 0xf7, 0x3b, 0x66, 0x50, 0xfc, 0xdb, 0xeb, 0xca, 0x47,
-    0x85, 0x89, 0xe1, 0x65, 0xd9, 0x62, 0x34, 0x3c, 0x70, 0xd8,
-    0x2e, 0xb4, 0x2f, 0x65, 0x3c, 0x4a, 0xa6, 0x2a, 0xe7, 0xc7,
-    0xd8, 0x41, 0x8f, 0x8a, 0x43, 0xbf, 0x42, 0xf2, 0x4d, 0xbc,
-    0xfc, 0x9e, 0x27, 0x95, 0xfb, 0x75, 0xff, 0xab, 0x02, 0x82,
-    0x01, 0x00, 0x41, 0x2f, 0x44, 0x57, 0x6d, 0x12, 0x17, 0x5b,
-    0x32, 0xc6, 0xb7, 0x6c, 0x57, 0x7a, 0x8a, 0x0e, 0x79, 0xef,
-    0x72, 0xa8, 0x68, 0xda, 0x2d, 0x38, 0xe4, 0xbb, 0x8d, 0xf6,
-    0x02, 0x65, 0xcf, 0x56, 0x13, 0xe1, 0x1a, 0xcb, 0x39, 0x80,
-    0xa6, 0xb1, 0x32, 0x03, 0x1e, 0xdd, 0xbb, 0x35, 0xd9, 0xac,
-    0x43, 0x89, 0x31, 0x08, 0x90, 0x92, 0x5e, 0x35, 0x3d, 0x7b,
-    0x9c, 0x6f, 0x86, 0xcb, 0x17, 0xdd, 0x85, 0xe4, 0xed, 0x35,
-    0x08, 0x8e, 0xc1, 0xf4, 0x05, 0xd8, 0x68, 0xc6, 0x63, 0x3c,
-    0xf7, 0xff, 0xf7, 0x47, 0x33, 0x39, 0xc5, 0x3e, 0xb7, 0x0e,
-    0x58, 0x35, 0x9d, 0x81, 0xea, 0xf8, 0x6a, 0x2c, 0x1c, 0x5a,
-    0x68, 0x78, 0x64, 0x11, 0x6b, 0xc1, 0x3e, 0x4e, 0x7a, 0xbd,
-    0x84, 0xcb, 0x0f, 0xc2, 0xb6, 0x85, 0x1d, 0xd3, 0x76, 0xc5,
-    0x93, 0x6a, 0x69, 0x89, 0x56, 0x34, 0xdc, 0x4a, 0x9b, 0xbc,
-    0xff, 0xa8, 0x0d, 0x6e, 0x35, 0x9c, 0x60, 0xa7, 0x23, 0x30,
-    0xc7, 0x06, 0x64, 0x39, 0x8b, 0x94, 0x89, 0xee, 0xba, 0x7f,
-    0x60, 0x8d, 0xfa, 0xb6, 0x97, 0x76, 0xdc, 0x51, 0x4a, 0x3c,
-    0xeb, 0x3a, 0x14, 0x2c, 0x20, 0x60, 0x69, 0x4a, 0x86, 0xfe,
-    0x8c, 0x21, 0x84, 0x49, 0x54, 0xb3, 0x20, 0xe1, 0x01, 0x7f,
-    0x58, 0xdf, 0x7f, 0xb5, 0x21, 0x51, 0x8c, 0x47, 0x9f, 0x91,
-    0xeb, 0x97, 0x3e, 0xf2, 0x54, 0xcf, 0x16, 0x46, 0xf9, 0xd9,
-    0xb6, 0xe7, 0x64, 0xc9, 0xd0, 0x54, 0xea, 0x2f, 0xa1, 0xcf,
-    0xa5, 0x7f, 0x28, 0x8d, 0x84, 0xec, 0xd5, 0x39, 0x03, 0x76,
-    0x5b, 0x2d, 0x8e, 0x43, 0xf2, 0x01, 0x24, 0xc9, 0x6f, 0xc0,
-    0xf5, 0x69, 0x6f, 0x7d, 0xb5, 0x85, 0xd2, 0x5f, 0x7f, 0x78,
-    0x40, 0x07, 0x7f, 0x09, 0x15, 0xb5, 0x1f, 0x28, 0x65, 0x10,
-    0xe4, 0x19, 0xa8, 0xc6, 0x9e, 0x8d, 0xdc, 0xcb, 0x02, 0x82,
-    0x01, 0x00, 0x13, 0x01, 0xee, 0x56, 0x80, 0x93, 0x70, 0x00,
-    0x7f, 0x52, 0xd2, 0x94, 0xa1, 0x98, 0x84, 0x4a, 0x92, 0x25,
-    0x4c, 0x9b, 0xa9, 0x91, 0x2e, 0xc2, 0x79, 0xb7, 0x5c, 0xe3,
-    0xc5, 0xd5, 0x8e, 0xc2, 0x54, 0x16, 0x17, 0xad, 0x55, 0x9b,
-    0x25, 0x76, 0x12, 0x63, 0x50, 0x22, 0x2f, 0x58, 0x58, 0x79,
-    0x6b, 0x04, 0xe3, 0xf9, 0x9f, 0x8f, 0x04, 0x41, 0x67, 0x94,
-    0xa5, 0x1f, 0xac, 0x8a, 0x15, 0x9c, 0x26, 0x10, 0x6c, 0xf8,
-    0x19, 0x57, 0x61, 0xd7, 0x3a, 0x7d, 0x31, 0xb0, 0x2d, 0x38,
-    0xbd, 0x94, 0x62, 0xad, 0xc4, 0xfa, 0x36, 0x42, 0x42, 0xf0,
-    0x24, 0x67, 0x65, 0x9d, 0x8b, 0x0b, 0x7c, 0x6f, 0x82, 0x44,
-    0x1a, 0x8c, 0xc8, 0xc9, 0xab, 0xbb, 0x4c, 0x45, 0xfc, 0x7b,
-    0x38, 0xee, 0x30, 0xe1, 0xfc, 0xef, 0x8d, 0xbc, 0x58, 0xdf,
-    0x2b, 0x5d, 0x0d, 0x54, 0xe0, 0x49, 0x4d, 0x97, 0x99, 0x8f,
-    0x22, 0xa8, 0x83, 0xbe, 0x40, 0xbb, 0x50, 0x2e, 0x78, 0x28,
-    0x0f, 0x95, 0x78, 0x8c, 0x8f, 0x98, 0x24, 0x56, 0xc2, 0x97,
-    0xf3, 0x2c, 0x43, 0xd2, 0x03, 0x82, 0x66, 0x81, 0x72, 0x5f,
-    0x53, 0x16, 0xec, 0xb1, 0xb1, 0x04, 0x5e, 0x40, 0x20, 0x48,
-    0x7b, 0x3f, 0x02, 0x97, 0x6a, 0xeb, 0x96, 0x12, 0x21, 0x35,
-    0xfe, 0x1f, 0x47, 0xc0, 0x95, 0xea, 0xc5, 0x8a, 0x08, 0x84,
-    0x4f, 0x5e, 0x63, 0x94, 0x60, 0x0f, 0x71, 0x5b, 0x7f, 0x4a,
-    0xec, 0x4f, 0x60, 0xc6, 0xba, 0x4a, 0x24, 0xf1, 0x20, 0x8b,
-    0xa7, 0x2e, 0x3a, 0xce, 0x8d, 0xe0, 0x27, 0x1d, 0xb5, 0x8e,
-    0xb4, 0x21, 0xc5, 0xe2, 0xa6, 0x16, 0x0a, 0x51, 0x83, 0x55,
-    0x88, 0xd1, 0x30, 0x11, 0x63, 0xd5, 0xd7, 0x8d, 0xae, 0x16,
-    0x12, 0x82, 0xc4, 0x85, 0x00, 0x4e, 0x27, 0x83, 0xa5, 0x7c,
-    0x90, 0x2e, 0xe5, 0xa2, 0xa3, 0xd3, 0x4c, 0x63, 0x02, 0x82,
-    0x01, 0x01, 0x00, 0x86, 0x08, 0x98, 0x98, 0xa5, 0x00, 0x05,
-    0x39, 0x77, 0xd9, 0x66, 0xb3, 0xcf, 0xca, 0xa0, 0x71, 0xb3,
-    0x50, 0xce, 0x3d, 0xb1, 0x93, 0x95, 0x35, 0xc4, 0xd4, 0x2e,
-    0x90, 0xdf, 0x0f, 0xfc, 0x60, 0xc1, 0x94, 0x68, 0x61, 0x43,
-    0xca, 0x9a, 0x23, 0x4a, 0x1e, 0x45, 0x72, 0x99, 0xb5, 0x1e,
-    0x61, 0x8d, 0x77, 0x0f, 0xa0, 0xbb, 0xd7, 0x77, 0xb4, 0x2a,
-    0x15, 0x11, 0x88, 0x2d, 0xb3, 0x56, 0x61, 0x5e, 0x6a, 0xed,
-    0xa4, 0x46, 0x4a, 0x3f, 0x50, 0x11, 0xd6, 0xba, 0xb6, 0xd7,
-    0x95, 0x65, 0x53, 0xc3, 0xa1, 0x8f, 0xe0, 0xa3, 0xf5, 0x1c,
-    0xfd, 0xaf, 0x6e, 0x43, 0xd7, 0x17, 0xa7, 0xd3, 0x81, 0x1b,
-    0xa4, 0xdf, 0xe0, 0x97, 0x8a, 0x46, 0x03, 0xd3, 0x46, 0x0e,
-    0x83, 0x48, 0x4e, 0xd2, 0x02, 0xcb, 0xc0, 0xad, 0x79, 0x95,
-    0x8c, 0x96, 0xba, 0x40, 0x34, 0x11, 0x71, 0x5e, 0xe9, 0x11,
-    0xf9, 0xc5, 0x4a, 0x5e, 0x91, 0x9d, 0xf5, 0x92, 0x4f, 0xeb,
-    0xc6, 0x70, 0x02, 0x2d, 0x3d, 0x04, 0xaa, 0xe9, 0x3a, 0x8e,
-    0xd5, 0xa8, 0xad, 0xf7, 0xce, 0x0d, 0x16, 0xb2, 0xec, 0x0a,
-    0x9c, 0xf5, 0x94, 0x39, 0xb9, 0x8a, 0xfc, 0x1e, 0xf9, 0xcc,
-    0xf2, 0x5f, 0x21, 0x31, 0x74, 0x72, 0x6b, 0x64, 0xae, 0x35,
-    0x61, 0x8d, 0x0d, 0xcb, 0xe7, 0xda, 0x39, 0xca, 0xf3, 0x21,
-    0x66, 0x0b, 0x95, 0xd7, 0x0a, 0x7c, 0xca, 0xa1, 0xa9, 0x5a,
-    0xe8, 0xac, 0xe0, 0x71, 0x54, 0xaf, 0x28, 0xcf, 0xd5, 0x70,
-    0x89, 0xe0, 0xf3, 0x9e, 0x43, 0x6c, 0x8d, 0x7b, 0x99, 0x01,
-    0x68, 0x4d, 0xa1, 0x45, 0x46, 0x0c, 0x43, 0xbc, 0xcc, 0x2c,
-    0xdd, 0xc5, 0x46, 0xc8, 0x4e, 0x0e, 0xbe, 0xed, 0xb9, 0x26,
-    0xab, 0x2e, 0xdb, 0xeb, 0x8f, 0xff, 0xdb, 0xb0, 0xc6, 0x55,
-    0xaf, 0xf8, 0x2a, 0x91, 0x9d, 0x50, 0x44, 0x21, 0x17,
+    0x30,
+    0x82,
+    0x09,
+    0x29,
+    0x02,
+    0x01,
+    0x00,
+    0x02,
+    0x82,
+    0x02,
+    0x01,
+    0x00,
+    0xc0,
+    0x71,
+    0xac,
+    0x1a,
+    0x13,
+    0x88,
+    0x82,
+    0x43,
+    0x3b,
+    0x51,
+    0x57,
+    0x71,
+    0x8d,
+    0xb6,
+    0x2b,
+    0x82,
+    0x65,
+    0x21,
+    0x53,
+    0x5f,
+    0x28,
+    0x29,
+    0x4f,
+    0x8d,
+    0x7c,
+    0x8a,
+    0xb9,
+    0x44,
+    0xb3,
+    0x28,
+    0x41,
+    0x4f,
+    0xd3,
+    0xfa,
+    0x6a,
+    0xf8,
+    0xb9,
+    0x28,
+    0x50,
+    0x39,
+    0x67,
+    0x53,
+    0x2c,
+    0x3c,
+    0xd7,
+    0xcb,
+    0x96,
+    0x41,
+    0x40,
+    0x32,
+    0xbb,
+    0xeb,
+    0x70,
+    0xae,
+    0x1f,
+    0xb0,
+    0x65,
+    0xf7,
+    0x3a,
+    0xd9,
+    0x22,
+    0xfd,
+    0x10,
+    0xae,
+    0xbd,
+    0x02,
+    0xe2,
+    0xdd,
+    0xf3,
+    0xc2,
+    0x79,
+    0x3c,
+    0xc6,
+    0xfc,
+    0x75,
+    0xbb,
+    0xaf,
+    0x4e,
+    0x3a,
+    0x36,
+    0xc2,
+    0x4f,
+    0xea,
+    0x25,
+    0xdf,
+    0x13,
+    0x16,
+    0x4b,
+    0x20,
+    0xfe,
+    0x4b,
+    0x69,
+    0x16,
+    0xc4,
+    0x7f,
+    0x1a,
+    0x43,
+    0xa6,
+    0x17,
+    0x1b,
+    0xb9,
+    0x0a,
+    0xf3,
+    0x09,
+    0x86,
+    0x28,
+    0x89,
+    0xcf,
+    0x2c,
+    0xd0,
+    0xd4,
+    0x81,
+    0xaf,
+    0xc6,
+    0x6d,
+    0xe6,
+    0x21,
+    0x8d,
+    0xee,
+    0xef,
+    0xea,
+    0xdc,
+    0xb7,
+    0xc6,
+    0x3b,
+    0x63,
+    0x9f,
+    0x0e,
+    0xad,
+    0x89,
+    0x78,
+    0x23,
+    0x18,
+    0xbf,
+    0x70,
+    0x7e,
+    0x84,
+    0xe0,
+    0x37,
+    0xec,
+    0xdb,
+    0x8e,
+    0x9c,
+    0x3e,
+    0x6a,
+    0x19,
+    0xcc,
+    0x99,
+    0x72,
+    0xe6,
+    0xb5,
+    0x7d,
+    0x6d,
+    0xfa,
+    0xe5,
+    0xd3,
+    0xe4,
+    0x90,
+    0xb5,
+    0xb2,
+    0xb2,
+    0x12,
+    0x70,
+    0x4e,
+    0xca,
+    0xf8,
+    0x10,
+    0xf8,
+    0xa3,
+    0x14,
+    0xc2,
+    0x48,
+    0x19,
+    0xeb,
+    0x60,
+    0x99,
+    0xbb,
+    0x2a,
+    0x1f,
+    0xb1,
+    0x7a,
+    0xb1,
+    0x3d,
+    0x24,
+    0xfb,
+    0xa0,
+    0x29,
+    0xda,
+    0xbd,
+    0x1b,
+    0xd7,
+    0xa4,
+    0xbf,
+    0xef,
+    0x60,
+    0x2d,
+    0x22,
+    0xca,
+    0x65,
+    0x98,
+    0xf1,
+    0xc4,
+    0xe1,
+    0xc9,
+    0x02,
+    0x6b,
+    0x16,
+    0x28,
+    0x2f,
+    0xa1,
+    0xaa,
+    0x79,
+    0x00,
+    0xda,
+    0xdc,
+    0x7c,
+    0x43,
+    0xf7,
+    0x42,
+    0x3c,
+    0xa0,
+    0xef,
+    0x68,
+    0xf7,
+    0xdf,
+    0xb9,
+    0x69,
+    0xfb,
+    0x8e,
+    0x01,
+    0xed,
+    0x01,
+    0x42,
+    0xb5,
+    0x4e,
+    0x57,
+    0xa6,
+    0x26,
+    0xb8,
+    0xd0,
+    0x7b,
+    0x56,
+    0x6d,
+    0x03,
+    0xc6,
+    0x40,
+    0x8c,
+    0x8c,
+    0x2a,
+    0x55,
+    0xd7,
+    0x9c,
+    0x35,
+    0x00,
+    0x94,
+    0x93,
+    0xec,
+    0x03,
+    0xeb,
+    0x22,
+    0xef,
+    0x77,
+    0xbb,
+    0x79,
+    0x13,
+    0x3f,
+    0x15,
+    0xa1,
+    0x8f,
+    0xca,
+    0xdf,
+    0xfd,
+    0xd3,
+    0xb8,
+    0xe1,
+    0xd4,
+    0xcc,
+    0x09,
+    0x3f,
+    0x3c,
+    0x2c,
+    0xdb,
+    0xd1,
+    0x49,
+    0x7f,
+    0x38,
+    0x07,
+    0x83,
+    0x6d,
+    0xeb,
+    0x08,
+    0x66,
+    0xe9,
+    0x06,
+    0x44,
+    0x12,
+    0xac,
+    0x95,
+    0x22,
+    0x90,
+    0x23,
+    0x67,
+    0xd4,
+    0x08,
+    0xcc,
+    0xf4,
+    0xb7,
+    0xdc,
+    0xcc,
+    0x87,
+    0xd4,
+    0xac,
+    0x69,
+    0x35,
+    0x4c,
+    0xb5,
+    0x39,
+    0x36,
+    0xcd,
+    0xa4,
+    0xd2,
+    0x95,
+    0xca,
+    0x0d,
+    0xc5,
+    0xda,
+    0xc2,
+    0xc5,
+    0x22,
+    0x32,
+    0x28,
+    0x08,
+    0xe3,
+    0xd2,
+    0x8b,
+    0x38,
+    0x30,
+    0xdc,
+    0x8c,
+    0x75,
+    0x4f,
+    0x6a,
+    0xec,
+    0x7a,
+    0xac,
+    0x16,
+    0x3e,
+    0xa8,
+    0xd4,
+    0x6a,
+    0x45,
+    0xe1,
+    0xa8,
+    0x4f,
+    0x2e,
+    0x80,
+    0x34,
+    0xaa,
+    0x54,
+    0x1b,
+    0x02,
+    0x95,
+    0x7d,
+    0x8a,
+    0x6d,
+    0xcc,
+    0x79,
+    0xca,
+    0xf2,
+    0xa4,
+    0x2e,
+    0x8d,
+    0xfb,
+    0xfe,
+    0x15,
+    0x51,
+    0x10,
+    0x0e,
+    0x4d,
+    0x88,
+    0xb1,
+    0xc7,
+    0xf4,
+    0x79,
+    0xdb,
+    0xf0,
+    0xb4,
+    0x56,
+    0x44,
+    0x37,
+    0xca,
+    0x5a,
+    0xc1,
+    0x8c,
+    0x48,
+    0xac,
+    0xae,
+    0x48,
+    0x80,
+    0x83,
+    0x01,
+    0x3f,
+    0xde,
+    0xd9,
+    0xd3,
+    0x2c,
+    0x51,
+    0x46,
+    0xb1,
+    0x41,
+    0xb6,
+    0xc6,
+    0x91,
+    0x72,
+    0xf9,
+    0x83,
+    0x55,
+    0x1b,
+    0x8c,
+    0xba,
+    0xf3,
+    0x73,
+    0xe5,
+    0x2c,
+    0x74,
+    0x50,
+    0x3a,
+    0xbe,
+    0xc5,
+    0x2f,
+    0xa7,
+    0xb2,
+    0x6d,
+    0x8c,
+    0x9e,
+    0x13,
+    0x77,
+    0xa3,
+    0x13,
+    0xcd,
+    0x6d,
+    0x8c,
+    0x45,
+    0xe1,
+    0xfc,
+    0x0b,
+    0xb7,
+    0x69,
+    0xe9,
+    0x27,
+    0xbc,
+    0x65,
+    0xc3,
+    0xfa,
+    0x9b,
+    0xd0,
+    0xef,
+    0xfe,
+    0xe8,
+    0x1f,
+    0xb3,
+    0x5e,
+    0x34,
+    0xf4,
+    0x8c,
+    0xea,
+    0xfc,
+    0xd3,
+    0x81,
+    0xbf,
+    0x3d,
+    0x30,
+    0xb2,
+    0xb4,
+    0x01,
+    0xe8,
+    0x43,
+    0x0f,
+    0xba,
+    0x02,
+    0x23,
+    0x42,
+    0x76,
+    0x82,
+    0x31,
+    0x73,
+    0x91,
+    0xed,
+    0x07,
+    0x46,
+    0x61,
+    0x0d,
+    0x39,
+    0x83,
+    0x40,
+    0xce,
+    0x7a,
+    0xd4,
+    0xdb,
+    0x80,
+    0x2c,
+    0x1f,
+    0x0d,
+    0xd1,
+    0x34,
+    0xd4,
+    0x92,
+    0xe3,
+    0xd4,
+    0xf1,
+    0xc2,
+    0x01,
+    0x02,
+    0x03,
+    0x01,
+    0x00,
+    0x01,
+    0x02,
+    0x82,
+    0x02,
+    0x01,
+    0x00,
+    0x97,
+    0x6c,
+    0xda,
+    0x6e,
+    0xea,
+    0x4f,
+    0xcf,
+    0xaf,
+    0xf7,
+    0x4c,
+    0xd9,
+    0xf1,
+    0x90,
+    0x00,
+    0x77,
+    0xdb,
+    0xf2,
+    0x97,
+    0x76,
+    0x72,
+    0xb9,
+    0xb7,
+    0x47,
+    0xd1,
+    0x9c,
+    0xdd,
+    0xcb,
+    0x4a,
+    0x33,
+    0x6e,
+    0xc9,
+    0x75,
+    0x76,
+    0xe6,
+    0xe4,
+    0xa5,
+    0x31,
+    0x8c,
+    0x77,
+    0x13,
+    0xb4,
+    0x29,
+    0xcd,
+    0xf5,
+    0x52,
+    0x17,
+    0xef,
+    0xf3,
+    0x08,
+    0x00,
+    0xe3,
+    0xbd,
+    0x2e,
+    0xbc,
+    0xd4,
+    0x52,
+    0x88,
+    0xe9,
+    0x30,
+    0x75,
+    0x0b,
+    0x02,
+    0xf5,
+    0xcd,
+    0x89,
+    0x0c,
+    0x6c,
+    0x57,
+    0x19,
+    0x27,
+    0x3d,
+    0x1e,
+    0x85,
+    0xb4,
+    0xc1,
+    0x2f,
+    0x1d,
+    0x92,
+    0x00,
+    0x5c,
+    0x76,
+    0x29,
+    0x4b,
+    0xa4,
+    0xe1,
+    0x12,
+    0xb3,
+    0xc8,
+    0x09,
+    0xfe,
+    0x0e,
+    0x78,
+    0x72,
+    0x61,
+    0xcb,
+    0x61,
+    0x6f,
+    0x39,
+    0x91,
+    0x95,
+    0x4e,
+    0xd5,
+    0x3e,
+    0xc7,
+    0x8f,
+    0xb8,
+    0xf6,
+    0x36,
+    0xfe,
+    0x9c,
+    0x93,
+    0x9a,
+    0x38,
+    0x25,
+    0x7a,
+    0xf4,
+    0x4a,
+    0x12,
+    0xd4,
+    0xa0,
+    0x13,
+    0xbd,
+    0xf9,
+    0x1d,
+    0x12,
+    0x3e,
+    0x21,
+    0x39,
+    0xfb,
+    0x72,
+    0xe0,
+    0x05,
+    0x3d,
+    0xc3,
+    0xe5,
+    0x50,
+    0xa8,
+    0x5d,
+    0x85,
+    0xa3,
+    0xea,
+    0x5f,
+    0x1c,
+    0xb2,
+    0x3f,
+    0xea,
+    0x6d,
+    0x03,
+    0x91,
+    0x55,
+    0xd8,
+    0x19,
+    0x0a,
+    0x21,
+    0x12,
+    0x16,
+    0xd9,
+    0x12,
+    0xc4,
+    0xe6,
+    0x07,
+    0x18,
+    0x5b,
+    0x26,
+    0xa4,
+    0xae,
+    0xed,
+    0x2b,
+    0xb7,
+    0xa6,
+    0xed,
+    0xf8,
+    0xad,
+    0xec,
+    0x77,
+    0xe6,
+    0x7f,
+    0x4f,
+    0x76,
+    0x00,
+    0xc0,
+    0xfa,
+    0x15,
+    0x92,
+    0xb4,
+    0x2c,
+    0x22,
+    0xc2,
+    0xeb,
+    0x6a,
+    0xad,
+    0x14,
+    0x05,
+    0xb2,
+    0xe5,
+    0x8a,
+    0x9e,
+    0x85,
+    0x83,
+    0xcc,
+    0x04,
+    0xf1,
+    0x56,
+    0x78,
+    0x44,
+    0x5e,
+    0xde,
+    0xe0,
+    0x60,
+    0x1a,
+    0x65,
+    0x79,
+    0x31,
+    0x23,
+    0x05,
+    0xbb,
+    0x01,
+    0xff,
+    0xdd,
+    0x2e,
+    0xb7,
+    0xb3,
+    0xaa,
+    0x74,
+    0xe0,
+    0xa5,
+    0x94,
+    0xaf,
+    0x4b,
+    0xde,
+    0x58,
+    0x0f,
+    0x55,
+    0xde,
+    0x33,
+    0xf6,
+    0xe3,
+    0xd6,
+    0x34,
+    0x36,
+    0x57,
+    0xd6,
+    0x79,
+    0x91,
+    0x2e,
+    0xbe,
+    0x3b,
+    0xd9,
+    0x4e,
+    0xb6,
+    0x9d,
+    0x21,
+    0x5c,
+    0xd3,
+    0x48,
+    0x14,
+    0x7f,
+    0x4a,
+    0xc4,
+    0x60,
+    0xa9,
+    0x29,
+    0xf8,
+    0x53,
+    0x7f,
+    0x88,
+    0x11,
+    0x2d,
+    0xb5,
+    0xc5,
+    0x2d,
+    0x6f,
+    0xee,
+    0x85,
+    0x0b,
+    0xf7,
+    0x8d,
+    0x9a,
+    0xbe,
+    0xb0,
+    0x42,
+    0xf2,
+    0x2e,
+    0x71,
+    0xaf,
+    0x19,
+    0x31,
+    0x6d,
+    0xec,
+    0xcd,
+    0x6f,
+    0x2b,
+    0x23,
+    0xdf,
+    0xb4,
+    0x40,
+    0xaf,
+    0x2c,
+    0x0a,
+    0xc3,
+    0x1b,
+    0x7d,
+    0x7d,
+    0x03,
+    0x1d,
+    0x4b,
+    0xf3,
+    0xb5,
+    0xe0,
+    0x85,
+    0xd8,
+    0xdf,
+    0x91,
+    0x6b,
+    0x0a,
+    0x69,
+    0xf7,
+    0xf2,
+    0x69,
+    0x66,
+    0x5b,
+    0xf1,
+    0xcf,
+    0x46,
+    0x7d,
+    0xe9,
+    0x70,
+    0xfa,
+    0x6d,
+    0x7e,
+    0x75,
+    0x4e,
+    0xa9,
+    0x77,
+    0xe6,
+    0x8c,
+    0x02,
+    0xf7,
+    0x14,
+    0x4d,
+    0xa5,
+    0x41,
+    0x8f,
+    0x3f,
+    0xc1,
+    0x62,
+    0x1e,
+    0x71,
+    0x5e,
+    0x38,
+    0xb4,
+    0xd6,
+    0xe6,
+    0xe1,
+    0x4b,
+    0xc2,
+    0x2c,
+    0x30,
+    0x83,
+    0x81,
+    0x6f,
+    0x49,
+    0x2e,
+    0x96,
+    0xe6,
+    0xc9,
+    0x9a,
+    0xf7,
+    0x5d,
+    0x09,
+    0xa0,
+    0x55,
+    0x02,
+    0xa5,
+    0x3a,
+    0x25,
+    0x23,
+    0xd0,
+    0x92,
+    0xc3,
+    0xa3,
+    0xe3,
+    0x0e,
+    0x12,
+    0x2f,
+    0x4d,
+    0xef,
+    0xf3,
+    0x55,
+    0x5a,
+    0xbe,
+    0xe6,
+    0x19,
+    0x86,
+    0x31,
+    0xab,
+    0x75,
+    0x9a,
+    0xd3,
+    0xf0,
+    0x2c,
+    0xc5,
+    0x41,
+    0x92,
+    0xd9,
+    0x1f,
+    0x5f,
+    0x11,
+    0x8c,
+    0x75,
+    0x1c,
+    0x63,
+    0xd0,
+    0x02,
+    0x80,
+    0x2c,
+    0x68,
+    0xcb,
+    0x93,
+    0xfb,
+    0x51,
+    0x73,
+    0x49,
+    0xb4,
+    0x60,
+    0xda,
+    0xe2,
+    0x26,
+    0xaf,
+    0xa9,
+    0x46,
+    0x12,
+    0xb8,
+    0xec,
+    0x50,
+    0xdd,
+    0x12,
+    0x06,
+    0x5f,
+    0xce,
+    0x59,
+    0xe6,
+    0xf6,
+    0x1c,
+    0xe0,
+    0x54,
+    0x10,
+    0xad,
+    0xf6,
+    0xcd,
+    0x98,
+    0xcc,
+    0x0f,
+    0xfb,
+    0xcb,
+    0x41,
+    0x14,
+    0x9d,
+    0xed,
+    0xe4,
+    0xb4,
+    0x74,
+    0x5f,
+    0x09,
+    0x60,
+    0xc7,
+    0x12,
+    0xf6,
+    0x7b,
+    0x3c,
+    0x8f,
+    0xa7,
+    0x20,
+    0xbc,
+    0xe4,
+    0xb1,
+    0xef,
+    0xeb,
+    0xa4,
+    0x93,
+    0xc5,
+    0x06,
+    0xca,
+    0x9a,
+    0x27,
+    0x9d,
+    0x87,
+    0xf3,
+    0xde,
+    0xca,
+    0xe5,
+    0xe7,
+    0xf6,
+    0x1c,
+    0x01,
+    0x65,
+    0x5b,
+    0xfb,
+    0x19,
+    0x79,
+    0x6e,
+    0x08,
+    0x26,
+    0xc5,
+    0xc8,
+    0x28,
+    0x0e,
+    0xb6,
+    0x3b,
+    0x07,
+    0x08,
+    0xc1,
+    0x02,
+    0x82,
+    0x01,
+    0x01,
+    0x00,
+    0xe8,
+    0x1c,
+    0x73,
+    0xa6,
+    0xb8,
+    0xe0,
+    0x0e,
+    0x6d,
+    0x8d,
+    0x1b,
+    0xb9,
+    0x53,
+    0xed,
+    0x58,
+    0x94,
+    0xe6,
+    0x1d,
+    0x60,
+    0x14,
+    0x5c,
+    0x76,
+    0x43,
+    0xc4,
+    0x58,
+    0x19,
+    0xc4,
+    0x24,
+    0xe8,
+    0xbc,
+    0x1b,
+    0x3b,
+    0x0b,
+    0x13,
+    0x24,
+    0x45,
+    0x54,
+    0x0e,
+    0xcc,
+    0x37,
+    0xf0,
+    0xe0,
+    0x63,
+    0x7d,
+    0xc3,
+    0xf7,
+    0xfb,
+    0x81,
+    0x74,
+    0x81,
+    0xc4,
+    0x0f,
+    0x1a,
+    0x21,
+    0x48,
+    0xaf,
+    0xce,
+    0xc1,
+    0xc4,
+    0x94,
+    0x18,
+    0x06,
+    0x44,
+    0x8d,
+    0xd3,
+    0xd2,
+    0x22,
+    0x2d,
+    0x2d,
+    0x3e,
+    0x5a,
+    0x31,
+    0xdc,
+    0x95,
+    0x8e,
+    0xf4,
+    0x41,
+    0xfc,
+    0x58,
+    0xc9,
+    0x40,
+    0x92,
+    0x17,
+    0x5f,
+    0xe3,
+    0xda,
+    0xac,
+    0x9e,
+    0x3f,
+    0x1c,
+    0x2a,
+    0x6b,
+    0x58,
+    0x5f,
+    0x48,
+    0x78,
+    0x20,
+    0xb1,
+    0xaf,
+    0x24,
+    0x9b,
+    0x3c,
+    0x20,
+    0x8b,
+    0x93,
+    0x25,
+    0x9e,
+    0xe6,
+    0x6b,
+    0xbc,
+    0x13,
+    0x42,
+    0x14,
+    0x6c,
+    0x36,
+    0x31,
+    0xff,
+    0x7a,
+    0xd1,
+    0xc1,
+    0x1a,
+    0x26,
+    0x14,
+    0x7f,
+    0xa9,
+    0x76,
+    0xa7,
+    0x0c,
+    0xf8,
+    0xcc,
+    0xed,
+    0x07,
+    0x6a,
+    0xd2,
+    0xdf,
+    0x62,
+    0xee,
+    0x0a,
+    0x7c,
+    0x84,
+    0xcb,
+    0x49,
+    0x90,
+    0xb2,
+    0x03,
+    0x0d,
+    0xa2,
+    0x82,
+    0x06,
+    0x77,
+    0xf1,
+    0xcd,
+    0x67,
+    0xf2,
+    0x47,
+    0x21,
+    0x02,
+    0x3f,
+    0x43,
+    0x21,
+    0xf0,
+    0x46,
+    0x30,
+    0x62,
+    0x51,
+    0x72,
+    0xb1,
+    0xe7,
+    0x48,
+    0xc6,
+    0x67,
+    0x12,
+    0xcd,
+    0x9e,
+    0xd6,
+    0x15,
+    0xe5,
+    0x21,
+    0xed,
+    0xfa,
+    0x8f,
+    0x30,
+    0xa6,
+    0x41,
+    0xfe,
+    0xb6,
+    0xfa,
+    0x8f,
+    0x34,
+    0x14,
+    0x19,
+    0xe8,
+    0x11,
+    0xf7,
+    0xa5,
+    0x77,
+    0x3e,
+    0xb7,
+    0xf9,
+    0x39,
+    0x07,
+    0x8c,
+    0x67,
+    0x2a,
+    0xab,
+    0x7b,
+    0x08,
+    0xf8,
+    0xb0,
+    0x06,
+    0xa8,
+    0xea,
+    0x2f,
+    0x8f,
+    0xfa,
+    0xcc,
+    0xcc,
+    0x40,
+    0xce,
+    0xf3,
+    0x70,
+    0x4f,
+    0x3f,
+    0x7f,
+    0xe2,
+    0x0c,
+    0xea,
+    0x76,
+    0x4a,
+    0x35,
+    0x4e,
+    0x47,
+    0xad,
+    0x2b,
+    0xa7,
+    0x97,
+    0x5d,
+    0x74,
+    0x43,
+    0x97,
+    0x90,
+    0xd2,
+    0xfb,
+    0xd9,
+    0xf9,
+    0x96,
+    0x01,
+    0x33,
+    0x05,
+    0xed,
+    0x7b,
+    0x03,
+    0x05,
+    0xad,
+    0xf8,
+    0x49,
+    0x03,
+    0x02,
+    0x82,
+    0x01,
+    0x01,
+    0x00,
+    0xd4,
+    0x40,
+    0x17,
+    0x66,
+    0x10,
+    0x92,
+    0x95,
+    0xc8,
+    0xec,
+    0x62,
+    0xa9,
+    0x7a,
+    0xcb,
+    0x93,
+    0x8e,
+    0xe6,
+    0x53,
+    0xd4,
+    0x80,
+    0x48,
+    0x27,
+    0x4b,
+    0x41,
+    0xce,
+    0x61,
+    0xdf,
+    0xbf,
+    0x94,
+    0xa4,
+    0x3d,
+    0x71,
+    0x03,
+    0x0b,
+    0xed,
+    0x25,
+    0x71,
+    0x98,
+    0xa4,
+    0xd6,
+    0xd5,
+    0x4a,
+    0x57,
+    0xf5,
+    0x6c,
+    0x1b,
+    0xda,
+    0x21,
+    0x7d,
+    0x35,
+    0x45,
+    0xb3,
+    0xf3,
+    0x6a,
+    0xd9,
+    0xd3,
+    0x43,
+    0xe8,
+    0x5c,
+    0x54,
+    0x1c,
+    0x83,
+    0x1b,
+    0xb4,
+    0x5f,
+    0xf2,
+    0x97,
+    0x24,
+    0x2e,
+    0xdc,
+    0x40,
+    0xde,
+    0x92,
+    0x23,
+    0x59,
+    0x8e,
+    0xbc,
+    0xd2,
+    0xa1,
+    0xf2,
+    0xe0,
+    0x4c,
+    0xdd,
+    0x0b,
+    0xd1,
+    0xe7,
+    0xae,
+    0x65,
+    0xbc,
+    0xb5,
+    0xf5,
+    0x5b,
+    0x98,
+    0xe9,
+    0xd7,
+    0xc2,
+    0xb7,
+    0x0e,
+    0x55,
+    0x71,
+    0x0e,
+    0x3c,
+    0x0a,
+    0x24,
+    0x6b,
+    0xa6,
+    0xe6,
+    0x14,
+    0x61,
+    0x11,
+    0xfd,
+    0x33,
+    0x42,
+    0x99,
+    0x2b,
+    0x84,
+    0x77,
+    0x74,
+    0x92,
+    0x91,
+    0xf5,
+    0x79,
+    0x79,
+    0xcf,
+    0xad,
+    0x8e,
+    0x04,
+    0xef,
+    0x80,
+    0x1e,
+    0x57,
+    0xf4,
+    0x14,
+    0xf5,
+    0x35,
+    0x09,
+    0x74,
+    0xb2,
+    0x13,
+    0x71,
+    0x58,
+    0x6b,
+    0xea,
+    0x32,
+    0x5d,
+    0xf3,
+    0xd3,
+    0x76,
+    0x48,
+    0x39,
+    0x10,
+    0x23,
+    0x84,
+    0x9d,
+    0xbe,
+    0x92,
+    0x77,
+    0x4a,
+    0xed,
+    0x70,
+    0x3e,
+    0x1a,
+    0xa2,
+    0x6c,
+    0xb3,
+    0x81,
+    0x00,
+    0xc3,
+    0xc9,
+    0xe4,
+    0x52,
+    0xc8,
+    0x24,
+    0x88,
+    0x0c,
+    0x41,
+    0xad,
+    0x87,
+    0x5a,
+    0xea,
+    0xa3,
+    0x7a,
+    0x85,
+    0x1c,
+    0x5e,
+    0x31,
+    0x7f,
+    0xc3,
+    0x35,
+    0xc6,
+    0xfa,
+    0x10,
+    0xc8,
+    0x75,
+    0x10,
+    0xc4,
+    0x96,
+    0x99,
+    0xe7,
+    0xfe,
+    0x01,
+    0xb4,
+    0x74,
+    0xdb,
+    0xb4,
+    0x11,
+    0xc3,
+    0xc8,
+    0x8c,
+    0xf6,
+    0xf7,
+    0x3b,
+    0x66,
+    0x50,
+    0xfc,
+    0xdb,
+    0xeb,
+    0xca,
+    0x47,
+    0x85,
+    0x89,
+    0xe1,
+    0x65,
+    0xd9,
+    0x62,
+    0x34,
+    0x3c,
+    0x70,
+    0xd8,
+    0x2e,
+    0xb4,
+    0x2f,
+    0x65,
+    0x3c,
+    0x4a,
+    0xa6,
+    0x2a,
+    0xe7,
+    0xc7,
+    0xd8,
+    0x41,
+    0x8f,
+    0x8a,
+    0x43,
+    0xbf,
+    0x42,
+    0xf2,
+    0x4d,
+    0xbc,
+    0xfc,
+    0x9e,
+    0x27,
+    0x95,
+    0xfb,
+    0x75,
+    0xff,
+    0xab,
+    0x02,
+    0x82,
+    0x01,
+    0x00,
+    0x41,
+    0x2f,
+    0x44,
+    0x57,
+    0x6d,
+    0x12,
+    0x17,
+    0x5b,
+    0x32,
+    0xc6,
+    0xb7,
+    0x6c,
+    0x57,
+    0x7a,
+    0x8a,
+    0x0e,
+    0x79,
+    0xef,
+    0x72,
+    0xa8,
+    0x68,
+    0xda,
+    0x2d,
+    0x38,
+    0xe4,
+    0xbb,
+    0x8d,
+    0xf6,
+    0x02,
+    0x65,
+    0xcf,
+    0x56,
+    0x13,
+    0xe1,
+    0x1a,
+    0xcb,
+    0x39,
+    0x80,
+    0xa6,
+    0xb1,
+    0x32,
+    0x03,
+    0x1e,
+    0xdd,
+    0xbb,
+    0x35,
+    0xd9,
+    0xac,
+    0x43,
+    0x89,
+    0x31,
+    0x08,
+    0x90,
+    0x92,
+    0x5e,
+    0x35,
+    0x3d,
+    0x7b,
+    0x9c,
+    0x6f,
+    0x86,
+    0xcb,
+    0x17,
+    0xdd,
+    0x85,
+    0xe4,
+    0xed,
+    0x35,
+    0x08,
+    0x8e,
+    0xc1,
+    0xf4,
+    0x05,
+    0xd8,
+    0x68,
+    0xc6,
+    0x63,
+    0x3c,
+    0xf7,
+    0xff,
+    0xf7,
+    0x47,
+    0x33,
+    0x39,
+    0xc5,
+    0x3e,
+    0xb7,
+    0x0e,
+    0x58,
+    0x35,
+    0x9d,
+    0x81,
+    0xea,
+    0xf8,
+    0x6a,
+    0x2c,
+    0x1c,
+    0x5a,
+    0x68,
+    0x78,
+    0x64,
+    0x11,
+    0x6b,
+    0xc1,
+    0x3e,
+    0x4e,
+    0x7a,
+    0xbd,
+    0x84,
+    0xcb,
+    0x0f,
+    0xc2,
+    0xb6,
+    0x85,
+    0x1d,
+    0xd3,
+    0x76,
+    0xc5,
+    0x93,
+    0x6a,
+    0x69,
+    0x89,
+    0x56,
+    0x34,
+    0xdc,
+    0x4a,
+    0x9b,
+    0xbc,
+    0xff,
+    0xa8,
+    0x0d,
+    0x6e,
+    0x35,
+    0x9c,
+    0x60,
+    0xa7,
+    0x23,
+    0x30,
+    0xc7,
+    0x06,
+    0x64,
+    0x39,
+    0x8b,
+    0x94,
+    0x89,
+    0xee,
+    0xba,
+    0x7f,
+    0x60,
+    0x8d,
+    0xfa,
+    0xb6,
+    0x97,
+    0x76,
+    0xdc,
+    0x51,
+    0x4a,
+    0x3c,
+    0xeb,
+    0x3a,
+    0x14,
+    0x2c,
+    0x20,
+    0x60,
+    0x69,
+    0x4a,
+    0x86,
+    0xfe,
+    0x8c,
+    0x21,
+    0x84,
+    0x49,
+    0x54,
+    0xb3,
+    0x20,
+    0xe1,
+    0x01,
+    0x7f,
+    0x58,
+    0xdf,
+    0x7f,
+    0xb5,
+    0x21,
+    0x51,
+    0x8c,
+    0x47,
+    0x9f,
+    0x91,
+    0xeb,
+    0x97,
+    0x3e,
+    0xf2,
+    0x54,
+    0xcf,
+    0x16,
+    0x46,
+    0xf9,
+    0xd9,
+    0xb6,
+    0xe7,
+    0x64,
+    0xc9,
+    0xd0,
+    0x54,
+    0xea,
+    0x2f,
+    0xa1,
+    0xcf,
+    0xa5,
+    0x7f,
+    0x28,
+    0x8d,
+    0x84,
+    0xec,
+    0xd5,
+    0x39,
+    0x03,
+    0x76,
+    0x5b,
+    0x2d,
+    0x8e,
+    0x43,
+    0xf2,
+    0x01,
+    0x24,
+    0xc9,
+    0x6f,
+    0xc0,
+    0xf5,
+    0x69,
+    0x6f,
+    0x7d,
+    0xb5,
+    0x85,
+    0xd2,
+    0x5f,
+    0x7f,
+    0x78,
+    0x40,
+    0x07,
+    0x7f,
+    0x09,
+    0x15,
+    0xb5,
+    0x1f,
+    0x28,
+    0x65,
+    0x10,
+    0xe4,
+    0x19,
+    0xa8,
+    0xc6,
+    0x9e,
+    0x8d,
+    0xdc,
+    0xcb,
+    0x02,
+    0x82,
+    0x01,
+    0x00,
+    0x13,
+    0x01,
+    0xee,
+    0x56,
+    0x80,
+    0x93,
+    0x70,
+    0x00,
+    0x7f,
+    0x52,
+    0xd2,
+    0x94,
+    0xa1,
+    0x98,
+    0x84,
+    0x4a,
+    0x92,
+    0x25,
+    0x4c,
+    0x9b,
+    0xa9,
+    0x91,
+    0x2e,
+    0xc2,
+    0x79,
+    0xb7,
+    0x5c,
+    0xe3,
+    0xc5,
+    0xd5,
+    0x8e,
+    0xc2,
+    0x54,
+    0x16,
+    0x17,
+    0xad,
+    0x55,
+    0x9b,
+    0x25,
+    0x76,
+    0x12,
+    0x63,
+    0x50,
+    0x22,
+    0x2f,
+    0x58,
+    0x58,
+    0x79,
+    0x6b,
+    0x04,
+    0xe3,
+    0xf9,
+    0x9f,
+    0x8f,
+    0x04,
+    0x41,
+    0x67,
+    0x94,
+    0xa5,
+    0x1f,
+    0xac,
+    0x8a,
+    0x15,
+    0x9c,
+    0x26,
+    0x10,
+    0x6c,
+    0xf8,
+    0x19,
+    0x57,
+    0x61,
+    0xd7,
+    0x3a,
+    0x7d,
+    0x31,
+    0xb0,
+    0x2d,
+    0x38,
+    0xbd,
+    0x94,
+    0x62,
+    0xad,
+    0xc4,
+    0xfa,
+    0x36,
+    0x42,
+    0x42,
+    0xf0,
+    0x24,
+    0x67,
+    0x65,
+    0x9d,
+    0x8b,
+    0x0b,
+    0x7c,
+    0x6f,
+    0x82,
+    0x44,
+    0x1a,
+    0x8c,
+    0xc8,
+    0xc9,
+    0xab,
+    0xbb,
+    0x4c,
+    0x45,
+    0xfc,
+    0x7b,
+    0x38,
+    0xee,
+    0x30,
+    0xe1,
+    0xfc,
+    0xef,
+    0x8d,
+    0xbc,
+    0x58,
+    0xdf,
+    0x2b,
+    0x5d,
+    0x0d,
+    0x54,
+    0xe0,
+    0x49,
+    0x4d,
+    0x97,
+    0x99,
+    0x8f,
+    0x22,
+    0xa8,
+    0x83,
+    0xbe,
+    0x40,
+    0xbb,
+    0x50,
+    0x2e,
+    0x78,
+    0x28,
+    0x0f,
+    0x95,
+    0x78,
+    0x8c,
+    0x8f,
+    0x98,
+    0x24,
+    0x56,
+    0xc2,
+    0x97,
+    0xf3,
+    0x2c,
+    0x43,
+    0xd2,
+    0x03,
+    0x82,
+    0x66,
+    0x81,
+    0x72,
+    0x5f,
+    0x53,
+    0x16,
+    0xec,
+    0xb1,
+    0xb1,
+    0x04,
+    0x5e,
+    0x40,
+    0x20,
+    0x48,
+    0x7b,
+    0x3f,
+    0x02,
+    0x97,
+    0x6a,
+    0xeb,
+    0x96,
+    0x12,
+    0x21,
+    0x35,
+    0xfe,
+    0x1f,
+    0x47,
+    0xc0,
+    0x95,
+    0xea,
+    0xc5,
+    0x8a,
+    0x08,
+    0x84,
+    0x4f,
+    0x5e,
+    0x63,
+    0x94,
+    0x60,
+    0x0f,
+    0x71,
+    0x5b,
+    0x7f,
+    0x4a,
+    0xec,
+    0x4f,
+    0x60,
+    0xc6,
+    0xba,
+    0x4a,
+    0x24,
+    0xf1,
+    0x20,
+    0x8b,
+    0xa7,
+    0x2e,
+    0x3a,
+    0xce,
+    0x8d,
+    0xe0,
+    0x27,
+    0x1d,
+    0xb5,
+    0x8e,
+    0xb4,
+    0x21,
+    0xc5,
+    0xe2,
+    0xa6,
+    0x16,
+    0x0a,
+    0x51,
+    0x83,
+    0x55,
+    0x88,
+    0xd1,
+    0x30,
+    0x11,
+    0x63,
+    0xd5,
+    0xd7,
+    0x8d,
+    0xae,
+    0x16,
+    0x12,
+    0x82,
+    0xc4,
+    0x85,
+    0x00,
+    0x4e,
+    0x27,
+    0x83,
+    0xa5,
+    0x7c,
+    0x90,
+    0x2e,
+    0xe5,
+    0xa2,
+    0xa3,
+    0xd3,
+    0x4c,
+    0x63,
+    0x02,
+    0x82,
+    0x01,
+    0x01,
+    0x00,
+    0x86,
+    0x08,
+    0x98,
+    0x98,
+    0xa5,
+    0x00,
+    0x05,
+    0x39,
+    0x77,
+    0xd9,
+    0x66,
+    0xb3,
+    0xcf,
+    0xca,
+    0xa0,
+    0x71,
+    0xb3,
+    0x50,
+    0xce,
+    0x3d,
+    0xb1,
+    0x93,
+    0x95,
+    0x35,
+    0xc4,
+    0xd4,
+    0x2e,
+    0x90,
+    0xdf,
+    0x0f,
+    0xfc,
+    0x60,
+    0xc1,
+    0x94,
+    0x68,
+    0x61,
+    0x43,
+    0xca,
+    0x9a,
+    0x23,
+    0x4a,
+    0x1e,
+    0x45,
+    0x72,
+    0x99,
+    0xb5,
+    0x1e,
+    0x61,
+    0x8d,
+    0x77,
+    0x0f,
+    0xa0,
+    0xbb,
+    0xd7,
+    0x77,
+    0xb4,
+    0x2a,
+    0x15,
+    0x11,
+    0x88,
+    0x2d,
+    0xb3,
+    0x56,
+    0x61,
+    0x5e,
+    0x6a,
+    0xed,
+    0xa4,
+    0x46,
+    0x4a,
+    0x3f,
+    0x50,
+    0x11,
+    0xd6,
+    0xba,
+    0xb6,
+    0xd7,
+    0x95,
+    0x65,
+    0x53,
+    0xc3,
+    0xa1,
+    0x8f,
+    0xe0,
+    0xa3,
+    0xf5,
+    0x1c,
+    0xfd,
+    0xaf,
+    0x6e,
+    0x43,
+    0xd7,
+    0x17,
+    0xa7,
+    0xd3,
+    0x81,
+    0x1b,
+    0xa4,
+    0xdf,
+    0xe0,
+    0x97,
+    0x8a,
+    0x46,
+    0x03,
+    0xd3,
+    0x46,
+    0x0e,
+    0x83,
+    0x48,
+    0x4e,
+    0xd2,
+    0x02,
+    0xcb,
+    0xc0,
+    0xad,
+    0x79,
+    0x95,
+    0x8c,
+    0x96,
+    0xba,
+    0x40,
+    0x34,
+    0x11,
+    0x71,
+    0x5e,
+    0xe9,
+    0x11,
+    0xf9,
+    0xc5,
+    0x4a,
+    0x5e,
+    0x91,
+    0x9d,
+    0xf5,
+    0x92,
+    0x4f,
+    0xeb,
+    0xc6,
+    0x70,
+    0x02,
+    0x2d,
+    0x3d,
+    0x04,
+    0xaa,
+    0xe9,
+    0x3a,
+    0x8e,
+    0xd5,
+    0xa8,
+    0xad,
+    0xf7,
+    0xce,
+    0x0d,
+    0x16,
+    0xb2,
+    0xec,
+    0x0a,
+    0x9c,
+    0xf5,
+    0x94,
+    0x39,
+    0xb9,
+    0x8a,
+    0xfc,
+    0x1e,
+    0xf9,
+    0xcc,
+    0xf2,
+    0x5f,
+    0x21,
+    0x31,
+    0x74,
+    0x72,
+    0x6b,
+    0x64,
+    0xae,
+    0x35,
+    0x61,
+    0x8d,
+    0x0d,
+    0xcb,
+    0xe7,
+    0xda,
+    0x39,
+    0xca,
+    0xf3,
+    0x21,
+    0x66,
+    0x0b,
+    0x95,
+    0xd7,
+    0x0a,
+    0x7c,
+    0xca,
+    0xa1,
+    0xa9,
+    0x5a,
+    0xe8,
+    0xac,
+    0xe0,
+    0x71,
+    0x54,
+    0xaf,
+    0x28,
+    0xcf,
+    0xd5,
+    0x70,
+    0x89,
+    0xe0,
+    0xf3,
+    0x9e,
+    0x43,
+    0x6c,
+    0x8d,
+    0x7b,
+    0x99,
+    0x01,
+    0x68,
+    0x4d,
+    0xa1,
+    0x45,
+    0x46,
+    0x0c,
+    0x43,
+    0xbc,
+    0xcc,
+    0x2c,
+    0xdd,
+    0xc5,
+    0x46,
+    0xc8,
+    0x4e,
+    0x0e,
+    0xbe,
+    0xed,
+    0xb9,
+    0x26,
+    0xab,
+    0x2e,
+    0xdb,
+    0xeb,
+    0x8f,
+    0xff,
+    0xdb,
+    0xb0,
+    0xc6,
+    0x55,
+    0xaf,
+    0xf8,
+    0x2a,
+    0x91,
+    0x9d,
+    0x50,
+    0x44,
+    0x21,
+    0x17,
 };
 
 static unsigned char test7680[] = {
diff --git a/crypto/openssl/apps/timeouts.h b/crypto/openssl/apps/timeouts.h
index 002852724763..3f9b2b50c9b8 100644
--- a/crypto/openssl/apps/timeouts.h
+++ b/crypto/openssl/apps/timeouts.h
@@ -8,10 +8,10 @@
  */
 
 #ifndef OSSL_APPS_TIMEOUTS_H
-# define OSSL_APPS_TIMEOUTS_H
+#define OSSL_APPS_TIMEOUTS_H
 
 /* numbers in us */
-# define DGRAM_RCV_TIMEOUT         250000
-# define DGRAM_SND_TIMEOUT         250000
+#define DGRAM_RCV_TIMEOUT 250000
+#define DGRAM_SND_TIMEOUT 250000
 
-#endif                          /* ! OSSL_APPS_TIMEOUTS_H */
+#endif /* ! OSSL_APPS_TIMEOUTS_H */
diff --git a/crypto/openssl/apps/ts.c b/crypto/openssl/apps/ts.c
index e59bc3b4b4a2..bd800bfaa322 100644
--- a/crypto/openssl/apps/ts.c
+++ b/crypto/openssl/apps/ts.c
@@ -21,117 +21,138 @@
 #include <openssl/bn.h>
 
 /* Request nonce length, in bits (must be a multiple of 8). */
-#define NONCE_LENGTH            64
+#define NONCE_LENGTH 64
 
 /* Name of config entry that defines the OID file. */
-#define ENV_OID_FILE            "oid_file"
+#define ENV_OID_FILE "oid_file"
 
 /* Is |EXACTLY_ONE| of three pointers set? */
 #define EXACTLY_ONE(a, b, c) \
-        (( a && !b && !c) || \
-         ( b && !a && !c) || \
-         ( c && !a && !b))
+    ((a && !b && !c) || (b && !a && !c) || (c && !a && !b))
 
 static ASN1_OBJECT *txt2obj(const char *oid);
 static CONF *load_config_file(const char *configfile);
 
 /* Query related functions. */
 static int query_command(const char *data, const char *digest,
-                         const EVP_MD *md, const char *policy, int no_nonce,
-                         int cert, const char *in, const char *out, int text);
+    const EVP_MD *md, const char *policy, int no_nonce,
+    int cert, const char *in, const char *out, int text);
 static TS_REQ *create_query(BIO *data_bio, const char *digest, const EVP_MD *md,
-                            const char *policy, int no_nonce, int cert);
+    const char *policy, int no_nonce, int cert);
 static int create_digest(BIO *input, const char *digest,
-                         const EVP_MD *md, unsigned char **md_value);
+    const EVP_MD *md, unsigned char **md_value);
 static ASN1_INTEGER *create_nonce(int bits);
 
 /* Reply related functions. */
 static int reply_command(CONF *conf, const char *section, const char *engine,
-                         const char *queryfile, const char *passin, const char *inkey,
-                         const EVP_MD *md, const char *signer, const char *chain,
-                         const char *policy, const char *in, int token_in,
-                         const char *out, int token_out, int text);
+    const char *queryfile, const char *passin, const char *inkey,
+    const EVP_MD *md, const char *signer, const char *chain,
+    const char *policy, const char *in, int token_in,
+    const char *out, int token_out, int text);
 static TS_RESP *read_PKCS7(BIO *in_bio);
 static TS_RESP *create_response(CONF *conf, const char *section, const char *engine,
-                                const char *queryfile, const char *passin,
-                                const char *inkey, const EVP_MD *md, const char *signer,
-                                const char *chain, const char *policy);
+    const char *queryfile, const char *passin,
+    const char *inkey, const EVP_MD *md, const char *signer,
+    const char *chain, const char *policy);
 static ASN1_INTEGER *serial_cb(TS_RESP_CTX *ctx, void *data);
 static ASN1_INTEGER *next_serial(const char *serialfile);
 static int save_ts_serial(const char *serialfile, ASN1_INTEGER *serial);
 
 /* Verify related functions. */
 static int verify_command(const char *data, const char *digest, const char *queryfile,
-                          const char *in, int token_in,
-                          const char *CApath, const char *CAfile,
-                          const char *CAstore,
-                          char *untrusted, X509_VERIFY_PARAM *vpm);
+    const char *in, int token_in,
+    const char *CApath, const char *CAfile,
+    const char *CAstore,
+    char *untrusted, X509_VERIFY_PARAM *vpm);
 static TS_VERIFY_CTX *create_verify_ctx(const char *data, const char *digest,
-                                        const char *queryfile,
-                                        const char *CApath, const char *CAfile,
-                                        const char *CAstore,
-                                        char *untrusted,
-                                        X509_VERIFY_PARAM *vpm);
+    const char *queryfile,
+    const char *CApath, const char *CAfile,
+    const char *CAstore,
+    char *untrusted,
+    X509_VERIFY_PARAM *vpm);
 static X509_STORE *create_cert_store(const char *CApath, const char *CAfile,
-                                     const char *CAstore, X509_VERIFY_PARAM *vpm);
+    const char *CAstore, X509_VERIFY_PARAM *vpm);
 static int verify_cb(int ok, X509_STORE_CTX *ctx);
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_CONFIG, OPT_SECTION, OPT_QUERY, OPT_DATA,
-    OPT_DIGEST, OPT_TSPOLICY, OPT_NO_NONCE, OPT_CERT,
-    OPT_IN, OPT_TOKEN_IN, OPT_OUT, OPT_TOKEN_OUT, OPT_TEXT,
-    OPT_REPLY, OPT_QUERYFILE, OPT_PASSIN, OPT_INKEY, OPT_SIGNER,
-    OPT_CHAIN, OPT_VERIFY, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE, OPT_UNTRUSTED,
-    OPT_MD, OPT_V_ENUM, OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_ENGINE,
+    OPT_CONFIG,
+    OPT_SECTION,
+    OPT_QUERY,
+    OPT_DATA,
+    OPT_DIGEST,
+    OPT_TSPOLICY,
+    OPT_NO_NONCE,
+    OPT_CERT,
+    OPT_IN,
+    OPT_TOKEN_IN,
+    OPT_OUT,
+    OPT_TOKEN_OUT,
+    OPT_TEXT,
+    OPT_REPLY,
+    OPT_QUERYFILE,
+    OPT_PASSIN,
+    OPT_INKEY,
+    OPT_SIGNER,
+    OPT_CHAIN,
+    OPT_VERIFY,
+    OPT_CAPATH,
+    OPT_CAFILE,
+    OPT_CASTORE,
+    OPT_UNTRUSTED,
+    OPT_MD,
+    OPT_V_ENUM,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS ts_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"config", OPT_CONFIG, '<', "Configuration file"},
-    {"section", OPT_SECTION, 's', "Section to use within config file"},
+    { "help", OPT_HELP, '-', "Display this summary" },
+    { "config", OPT_CONFIG, '<', "Configuration file" },
+    { "section", OPT_SECTION, 's', "Section to use within config file" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
-    {"inkey", OPT_INKEY, 's', "File with private key for reply"},
-    {"signer", OPT_SIGNER, 's', "Signer certificate file"},
-    {"chain", OPT_CHAIN, '<', "File with signer CA chain"},
-    {"CAfile", OPT_CAFILE, '<', "File with trusted CA certs"},
-    {"CApath", OPT_CAPATH, '/', "Path to trusted CA files"},
-    {"CAstore", OPT_CASTORE, ':', "URI to trusted CA store"},
-    {"untrusted", OPT_UNTRUSTED, '<', "Extra untrusted certs"},
-    {"token_in", OPT_TOKEN_IN, '-', "Input is a PKCS#7 file"},
-    {"token_out", OPT_TOKEN_OUT, '-', "Output is a PKCS#7 file"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"", OPT_MD, '-', "Any supported digest"},
+    { "inkey", OPT_INKEY, 's', "File with private key for reply" },
+    { "signer", OPT_SIGNER, 's', "Signer certificate file" },
+    { "chain", OPT_CHAIN, '<', "File with signer CA chain" },
+    { "CAfile", OPT_CAFILE, '<', "File with trusted CA certs" },
+    { "CApath", OPT_CAPATH, '/', "Path to trusted CA files" },
+    { "CAstore", OPT_CASTORE, ':', "URI to trusted CA store" },
+    { "untrusted", OPT_UNTRUSTED, '<', "Extra untrusted certs" },
+    { "token_in", OPT_TOKEN_IN, '-', "Input is a PKCS#7 file" },
+    { "token_out", OPT_TOKEN_OUT, '-', "Output is a PKCS#7 file" },
+    { "passin", OPT_PASSIN, 's', "Input file pass phrase source" },
+    { "", OPT_MD, '-', "Any supported digest" },
 
     OPT_SECTION("Query"),
-    {"query", OPT_QUERY, '-', "Generate a TS query"},
-    {"data", OPT_DATA, '<', "File to hash"},
-    {"digest", OPT_DIGEST, 's', "Digest (as a hex string)"},
-    {"queryfile", OPT_QUERYFILE, '<', "File containing a TS query"},
-    {"cert", OPT_CERT, '-', "Put cert request into query"},
-    {"in", OPT_IN, '<', "Input file"},
+    { "query", OPT_QUERY, '-', "Generate a TS query" },
+    { "data", OPT_DATA, '<', "File to hash" },
+    { "digest", OPT_DIGEST, 's', "Digest (as a hex string)" },
+    { "queryfile", OPT_QUERYFILE, '<', "File containing a TS query" },
+    { "cert", OPT_CERT, '-', "Put cert request into query" },
+    { "in", OPT_IN, '<', "Input file" },
 
     OPT_SECTION("Verify"),
-    {"verify", OPT_VERIFY, '-', "Verify a TS response"},
-    {"reply", OPT_REPLY, '-', "Generate a TS reply"},
-    {"tspolicy", OPT_TSPOLICY, 's', "Policy OID to use"},
-    {"no_nonce", OPT_NO_NONCE, '-', "Do not include a nonce"},
-    {"out", OPT_OUT, '>', "Output file"},
-    {"text", OPT_TEXT, '-', "Output text (not DER)"},
+    { "verify", OPT_VERIFY, '-', "Verify a TS response" },
+    { "reply", OPT_REPLY, '-', "Generate a TS reply" },
+    { "tspolicy", OPT_TSPOLICY, 's', "Policy OID to use" },
+    { "no_nonce", OPT_NO_NONCE, '-', "Do not include a nonce" },
+    { "out", OPT_OUT, '>', "Output file" },
+    { "text", OPT_TEXT, '-', "Output text (not DER)" },
 
     OPT_R_OPTIONS,
     OPT_V_OPTIONS,
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 /*
  * This command is so complex, special help is needed.
  */
-static char* opt_helplist[] = {
+static char *opt_helplist[] = {
     "",
     "Typical uses:",
     " openssl ts -query [-rand file...] [-config file] [-data file]",
@@ -187,7 +208,7 @@ int ts_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -303,8 +324,7 @@ int ts_main(int argc, char **argv)
 
     if (!opt_md(digestname, &md))
         goto opthelp;
-    if (mode == OPT_REPLY && passin &&
-        !app_passwd(passin, NULL, &password, NULL)) {
+    if (mode == OPT_REPLY && passin && !app_passwd(passin, NULL, &password, NULL)) {
         BIO_printf(bio_err, "Error getting password.\n");
         goto end;
     }
@@ -321,7 +341,7 @@ int ts_main(int argc, char **argv)
         if ((data != NULL) && (digest != NULL))
             goto opthelp;
         ret = !query_command(data, digest, md, policy, no_nonce, cert,
-                             in, out, text);
+            in, out, text);
     } else if (mode == OPT_REPLY) {
         if (vpmtouched)
             goto opthelp;
@@ -332,20 +352,20 @@ int ts_main(int argc, char **argv)
                 goto opthelp;
         }
         ret = !reply_command(conf, section, engine, queryfile,
-                             password, inkey, md, signer, chain, policy,
-                             in, token_in, out, token_out, text);
+            password, inkey, md, signer, chain, policy,
+            in, token_in, out, token_out, text);
 
     } else if (mode == OPT_VERIFY) {
         if ((in == NULL) || !EXACTLY_ONE(queryfile, data, digest))
             goto opthelp;
         ret = !verify_command(data, digest, queryfile, in, token_in,
-                              CApath, CAfile, CAstore, untrusted,
-                              vpmtouched ? vpm : NULL);
+            CApath, CAfile, CAstore, untrusted,
+            vpmtouched ? vpm : NULL);
     } else {
         goto opthelp;
     }
 
- end:
+end:
     X509_VERIFY_PARAM_free(vpm);
     EVP_MD_free(md);
     NCONF_free(conf);
@@ -395,8 +415,8 @@ static CONF *load_config_file(const char *configfile)
  * Query-related method definitions.
  */
 static int query_command(const char *data, const char *digest, const EVP_MD *md,
-                         const char *policy, int no_nonce,
-                         int cert, const char *in, const char *out, int text)
+    const char *policy, int no_nonce,
+    int cert, const char *in, const char *out, int text)
 {
     int ret = 0;
     TS_REQ *query = NULL;
@@ -432,7 +452,7 @@ static int query_command(const char *data, const char *digest, const EVP_MD *md,
 
     ret = 1;
 
- end:
+end:
     ERR_print_errors(bio_err);
     BIO_free_all(in_bio);
     BIO_free_all(data_bio);
@@ -442,7 +462,7 @@ static int query_command(const char *data, const char *digest, const EVP_MD *md,
 }
 
 static TS_REQ *create_query(BIO *data_bio, const char *digest, const EVP_MD *md,
-                            const char *policy, int no_nonce, int cert)
+    const char *policy, int no_nonce, int cert)
 {
     int ret = 0;
     TS_REQ *ts_req = NULL;
@@ -490,7 +510,7 @@ static TS_REQ *create_query(BIO *data_bio, const char *digest, const EVP_MD *md,
         goto err;
 
     ret = 1;
- err:
+err:
     if (!ret) {
         TS_REQ_free(ts_req);
         ts_req = NULL;
@@ -506,7 +526,7 @@ static TS_REQ *create_query(BIO *data_bio, const char *digest, const EVP_MD *md,
 }
 
 static int create_digest(BIO *input, const char *digest, const EVP_MD *md,
-                         unsigned char **md_value)
+    unsigned char **md_value)
 {
     int md_value_len;
     int rv = 0;
@@ -539,12 +559,13 @@ static int create_digest(BIO *input, const char *digest, const EVP_MD *md,
         *md_value = OPENSSL_hexstr2buf(digest, &digest_len);
         if (*md_value == NULL || md_value_len != digest_len) {
             BIO_printf(bio_err, "bad digest, %d bytes "
-                       "must be specified\n", md_value_len);
+                                "must be specified\n",
+                md_value_len);
             goto err;
         }
     }
     rv = md_value_len;
- err:
+err:
     if (rv <= 0) {
         OPENSSL_free(*md_value);
         *md_value = NULL;
@@ -577,7 +598,7 @@ static ASN1_INTEGER *create_nonce(int bits)
     memcpy(nonce->data, buf + i, nonce->length);
     return nonce;
 
- err:
+err:
     BIO_printf(bio_err, "could not create nonce\n");
     ASN1_INTEGER_free(nonce);
     return NULL;
@@ -588,10 +609,10 @@ static ASN1_INTEGER *create_nonce(int bits)
  */
 
 static int reply_command(CONF *conf, const char *section, const char *engine,
-                         const char *queryfile, const char *passin, const char *inkey,
-                         const EVP_MD *md, const char *signer, const char *chain,
-                         const char *policy, const char *in, int token_in,
-                         const char *out, int token_out, int text)
+    const char *queryfile, const char *passin, const char *inkey,
+    const EVP_MD *md, const char *signer, const char *chain,
+    const char *policy, const char *in, int token_in,
+    const char *out, int token_out, int text)
 {
     int ret = 0;
     TS_RESP *response = NULL;
@@ -611,7 +632,7 @@ static int reply_command(CONF *conf, const char *section, const char *engine,
         }
     } else {
         response = create_response(conf, section, engine, queryfile,
-                                   passin, inkey, md, signer, chain, policy);
+            passin, inkey, md, signer, chain, policy);
         if (response != NULL)
             BIO_printf(bio_err, "Response has been generated.\n");
         else
@@ -623,7 +644,7 @@ static int reply_command(CONF *conf, const char *section, const char *engine,
     /* Write response. */
     if (text) {
         if ((out_bio = bio_open_default(out, 'w', FORMAT_TEXT)) == NULL)
-        goto end;
+            goto end;
         if (token_out) {
             TS_TST_INFO *tst_info = TS_RESP_get_tst_info(response);
             if (!TS_TST_INFO_print_bio(out_bio, tst_info))
@@ -647,7 +668,7 @@ static int reply_command(CONF *conf, const char *section, const char *engine,
 
     ret = 1;
 
- end:
+end:
     ERR_print_errors(bio_err);
     BIO_free_all(in_bio);
     BIO_free_all(query_bio);
@@ -680,11 +701,11 @@ static TS_RESP *read_PKCS7(BIO *in_bio)
     if (!TS_RESP_set_status_info(resp, si))
         goto end;
     TS_RESP_set_tst_info(resp, token, tst_info);
-    token = NULL;               /* Ownership is lost. */
-    tst_info = NULL;            /* Ownership is lost. */
+    token = NULL; /* Ownership is lost. */
+    tst_info = NULL; /* Ownership is lost. */
     ret = 1;
 
- end:
+end:
     PKCS7_free(token);
     TS_TST_INFO_free(tst_info);
     if (!ret) {
@@ -696,9 +717,9 @@ static TS_RESP *read_PKCS7(BIO *in_bio)
 }
 
 static TS_RESP *create_response(CONF *conf, const char *section, const char *engine,
-                                const char *queryfile, const char *passin,
-                                const char *inkey, const EVP_MD *md, const char *signer,
-                                const char *chain, const char *policy)
+    const char *queryfile, const char *passin,
+    const char *inkey, const EVP_MD *md, const char *signer,
+    const char *chain, const char *policy)
 {
     int ret = 0;
     TS_RESP *response = NULL;
@@ -728,7 +749,7 @@ static TS_RESP *create_response(CONF *conf, const char *section, const char *eng
         if (!TS_RESP_CTX_set_signer_digest(resp_ctx, md))
             goto end;
     } else if (!TS_CONF_set_signer_digest(conf, section, NULL, resp_ctx)) {
-            goto end;
+        goto end;
     }
 
     if (!TS_CONF_set_ess_cert_id_digest(conf, section, resp_ctx))
@@ -753,7 +774,7 @@ static TS_RESP *create_response(CONF *conf, const char *section, const char *eng
         goto end;
     ret = 1;
 
- end:
+end:
     if (!ret) {
         TS_RESP_free(response);
         response = NULL;
@@ -770,8 +791,8 @@ static ASN1_INTEGER *serial_cb(TS_RESP_CTX *ctx, void *data)
 
     if (serial == NULL) {
         TS_RESP_CTX_set_status_info(ctx, TS_STATUS_REJECTION,
-                                    "Error during serial number "
-                                    "generation.");
+            "Error during serial number "
+            "generation.");
         TS_RESP_CTX_add_failure_info(ctx, TS_INFO_ADD_INFO_NOT_AVAILABLE);
     } else {
         save_ts_serial(serial_file, serial);
@@ -793,14 +814,15 @@ static ASN1_INTEGER *next_serial(const char *serialfile)
     if ((in = BIO_new_file(serialfile, "r")) == NULL) {
         ERR_clear_error();
         BIO_printf(bio_err, "Warning: could not open file %s for "
-                   "reading, using serial number: 1\n", serialfile);
+                            "reading, using serial number: 1\n",
+            serialfile);
         if (!ASN1_INTEGER_set(serial, 1))
             goto err;
     } else {
         char buf[1024];
         if (!a2i_ASN1_INTEGER(in, serial, buf, sizeof(buf))) {
             BIO_printf(bio_err, "unable to load number from %s\n",
-                       serialfile);
+                serialfile);
             goto err;
         }
         if ((bn = ASN1_INTEGER_to_BN(serial, NULL)) == NULL)
@@ -814,7 +836,7 @@ static ASN1_INTEGER *next_serial(const char *serialfile)
     }
     ret = 1;
 
- err:
+err:
     if (!ret) {
         ASN1_INTEGER_free(serial);
         serial = NULL;
@@ -836,24 +858,23 @@ static int save_ts_serial(const char *serialfile, ASN1_INTEGER *serial)
     if (BIO_puts(out, "\n") <= 0)
         goto err;
     ret = 1;
- err:
+err:
     if (!ret)
         BIO_printf(bio_err, "could not save serial number to %s\n",
-                   serialfile);
+            serialfile);
     BIO_free_all(out);
     return ret;
 }
 
-
 /*
  * Verify-related method definitions.
  */
 
 static int verify_command(const char *data, const char *digest, const char *queryfile,
-                          const char *in, int token_in,
-                          const char *CApath, const char *CAfile,
-                          const char *CAstore, char *untrusted,
-                          X509_VERIFY_PARAM *vpm)
+    const char *in, int token_in,
+    const char *CApath, const char *CAfile,
+    const char *CAstore, char *untrusted,
+    X509_VERIFY_PARAM *vpm)
 {
     BIO *in_bio = NULL;
     PKCS7 *token = NULL;
@@ -872,15 +893,16 @@ static int verify_command(const char *data, const char *digest, const char *quer
     }
 
     if ((verify_ctx = create_verify_ctx(data, digest, queryfile,
-                                        CApath, CAfile, CAstore, untrusted,
-                                        vpm)) == NULL)
+             CApath, CAfile, CAstore, untrusted,
+             vpm))
+        == NULL)
         goto end;
 
     ret = token_in
         ? TS_RESP_verify_token(verify_ctx, token)
         : TS_RESP_verify_response(verify_ctx, response);
 
- end:
+end:
     printf("Verification: ");
     if (ret)
         printf("OK\n");
@@ -897,11 +919,11 @@ static int verify_command(const char *data, const char *digest, const char *quer
 }
 
 static TS_VERIFY_CTX *create_verify_ctx(const char *data, const char *digest,
-                                        const char *queryfile,
-                                        const char *CApath, const char *CAfile,
-                                        const char *CAstore,
-                                        char *untrusted,
-                                        X509_VERIFY_PARAM *vpm)
+    const char *queryfile,
+    const char *CApath, const char *CAfile,
+    const char *CAstore,
+    char *untrusted,
+    X509_VERIFY_PARAM *vpm)
 {
     TS_VERIFY_CTX *ctx = NULL;
     STACK_OF(X509) *certs;
@@ -949,20 +971,19 @@ static TS_VERIFY_CTX *create_verify_ctx(const char *data, const char *digest,
     TS_VERIFY_CTX_add_flags(ctx, f | TS_VFY_SIGNATURE);
 
     /* Initialising the X509_STORE object. */
-    if (!TS_VERIFY_CTX_set0_store(ctx, create_cert_store(CApath, CAfile,
-                                                            CAstore, vpm)))
+    if (!TS_VERIFY_CTX_set0_store(ctx, create_cert_store(CApath, CAfile, CAstore, vpm)))
         goto err;
 
     /* Loading any extra untrusted certificates. */
     if (untrusted != NULL) {
         certs = load_certs_multifile(untrusted, NULL, "extra untrusted certs",
-                                     vpm);
+            vpm);
         if (certs == NULL || !TS_VERIFY_CTX_set0_certs(ctx, certs))
             goto err;
     }
     ret = 1;
 
- err:
+err:
     if (!ret) {
         TS_VERIFY_CTX_free(ctx);
         ctx = NULL;
@@ -973,7 +994,7 @@ static TS_VERIFY_CTX *create_verify_ctx(const char *data, const char *digest,
 }
 
 static X509_STORE *create_cert_store(const char *CApath, const char *CAfile,
-                                     const char *CAstore, X509_VERIFY_PARAM *vpm)
+    const char *CAstore, X509_VERIFY_PARAM *vpm)
 {
     X509_STORE *cert_ctx = NULL;
     X509_LOOKUP *lookup = NULL;
@@ -1005,7 +1026,8 @@ static X509_STORE *create_cert_store(const char *CApath, const char *CAfile,
             goto err;
         }
         if (X509_LOOKUP_load_file_ex(lookup, CAfile, X509_FILETYPE_PEM, libctx,
-                                      propq) <= 0) {
+                propq)
+            <= 0) {
             BIO_printf(bio_err, "Error loading file %s\n", CAfile);
             goto err;
         }
@@ -1028,7 +1050,7 @@ static X509_STORE *create_cert_store(const char *CApath, const char *CAfile,
 
     return cert_ctx;
 
- err:
+err:
     X509_STORE_free(cert_ctx);
     return NULL;
 }
diff --git a/crypto/openssl/apps/verify.c b/crypto/openssl/apps/verify.c
index 93b214281ea5..13185e605d31 100644
--- a/crypto/openssl/apps/verify.c
+++ b/crypto/openssl/apps/verify.c
@@ -20,60 +20,71 @@
 
 static int cb(int ok, X509_STORE_CTX *ctx);
 static int check(X509_STORE *ctx, const char *file,
-                 STACK_OF(X509) *uchain, STACK_OF(X509) *tchain,
-                 STACK_OF(X509_CRL) *crls, int show_chain,
-                 STACK_OF(OPENSSL_STRING) *opts);
+    STACK_OF(X509) *uchain, STACK_OF(X509) *tchain,
+    STACK_OF(X509_CRL) *crls, int show_chain,
+    STACK_OF(OPENSSL_STRING) *opts);
 static int v_verbose = 0, vflags = 0;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
-    OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
-    OPT_UNTRUSTED, OPT_TRUSTED, OPT_CRLFILE, OPT_CRL_DOWNLOAD, OPT_SHOW_CHAIN,
-    OPT_V_ENUM, OPT_NAMEOPT, OPT_VFYOPT,
+    OPT_ENGINE,
+    OPT_CAPATH,
+    OPT_CAFILE,
+    OPT_CASTORE,
+    OPT_NOCAPATH,
+    OPT_NOCAFILE,
+    OPT_NOCASTORE,
+    OPT_UNTRUSTED,
+    OPT_TRUSTED,
+    OPT_CRLFILE,
+    OPT_CRL_DOWNLOAD,
+    OPT_SHOW_CHAIN,
+    OPT_V_ENUM,
+    OPT_NAMEOPT,
+    OPT_VFYOPT,
     OPT_VERBOSE,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS verify_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n"},
+    { OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n" },
 
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
-    {"verbose", OPT_VERBOSE, '-',
-        "Print extra information about the operations being performed."},
-    {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
+    { "verbose", OPT_VERBOSE, '-',
+        "Print extra information about the operations being performed." },
+    { "nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options" },
 
     OPT_SECTION("Certificate chain"),
-    {"trusted", OPT_TRUSTED, '<', "A file of trusted certificates"},
-    {"CAfile", OPT_CAFILE, '<', "A file of trusted certificates"},
-    {"CApath", OPT_CAPATH, '/', "A directory of files with trusted certificates"},
-    {"CAstore", OPT_CASTORE, ':', "URI to a store of trusted certificates"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default trusted certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load trusted certificates from the default directory"},
-    {"no-CAstore", OPT_NOCASTORE, '-',
-     "Do not load trusted certificates from the default certificates store"},
-    {"untrusted", OPT_UNTRUSTED, '<', "A file of untrusted certificates"},
-    {"CRLfile", OPT_CRLFILE, '<',
-        "File containing one or more CRL's (in PEM format) to load"},
-    {"crl_download", OPT_CRL_DOWNLOAD, '-',
-        "Try downloading CRL information for certificates via their CDP entries"},
-    {"show_chain", OPT_SHOW_CHAIN, '-',
-        "Display information about the certificate chain"},
+    { "trusted", OPT_TRUSTED, '<', "A file of trusted certificates" },
+    { "CAfile", OPT_CAFILE, '<', "A file of trusted certificates" },
+    { "CApath", OPT_CAPATH, '/', "A directory of files with trusted certificates" },
+    { "CAstore", OPT_CASTORE, ':', "URI to a store of trusted certificates" },
+    { "no-CAfile", OPT_NOCAFILE, '-',
+        "Do not load the default trusted certificates file" },
+    { "no-CApath", OPT_NOCAPATH, '-',
+        "Do not load trusted certificates from the default directory" },
+    { "no-CAstore", OPT_NOCASTORE, '-',
+        "Do not load trusted certificates from the default certificates store" },
+    { "untrusted", OPT_UNTRUSTED, '<', "A file of untrusted certificates" },
+    { "CRLfile", OPT_CRLFILE, '<',
+        "File containing one or more CRL's (in PEM format) to load" },
+    { "crl_download", OPT_CRL_DOWNLOAD, '-',
+        "Try downloading CRL information for certificates via their CDP entries" },
+    { "show_chain", OPT_SHOW_CHAIN, '-',
+        "Display information about the certificate chain" },
 
     OPT_V_OPTIONS,
-    {"vfyopt", OPT_VFYOPT, 's', "Verification parameter in n:v form"},
+    { "vfyopt", OPT_VFYOPT, 's', "Verification parameter in n:v form" },
 
     OPT_PROV_OPTIONS,
 
     OPT_PARAMETERS(),
-    {"cert", 0, 0, "Certificate(s) to verify (optional; stdin used otherwise)"},
-    {NULL}
+    { "cert", 0, 0, "Certificate(s) to verify (optional; stdin used otherwise)" },
+    { NULL }
 };
 
 int verify_main(int argc, char **argv)
@@ -97,7 +108,7 @@ int verify_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -107,8 +118,8 @@ int verify_main(int argc, char **argv)
                 X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
 
                 BIO_printf(bio_err, "  %-15s  %s\n",
-                        X509_PURPOSE_get0_sname(ptmp),
-                        X509_PURPOSE_get0_name(ptmp));
+                    X509_PURPOSE_get0_sname(ptmp),
+                    X509_PURPOSE_get0_name(ptmp));
             }
 
             BIO_printf(bio_err, "Recognized certificate policy names:\n");
@@ -116,7 +127,7 @@ int verify_main(int argc, char **argv)
                 const X509_VERIFY_PARAM *vptmp = X509_VERIFY_PARAM_get0(i);
 
                 BIO_printf(bio_err, "  %s\n",
-                        X509_VERIFY_PARAM_get0_name(vptmp));
+                    X509_VERIFY_PARAM_get0_name(vptmp));
             }
             ret = 0;
             goto end;
@@ -146,7 +157,7 @@ int verify_main(int argc, char **argv)
         case OPT_UNTRUSTED:
             /* Zero or more times */
             if (!load_certs(opt_arg(), 0, &untrusted, NULL,
-                            "untrusted certificates"))
+                    "untrusted certificates"))
                 goto end;
             break;
         case OPT_TRUSTED:
@@ -201,13 +212,14 @@ int verify_main(int argc, char **argv)
     if (trusted != NULL
         && (CAfile != NULL || CApath != NULL || CAstore != NULL)) {
         BIO_printf(bio_err,
-                   "%s: Cannot use -trusted with -CAfile, -CApath or -CAstore\n",
-                   prog);
+            "%s: Cannot use -trusted with -CAfile, -CApath or -CAstore\n",
+            prog);
         goto end;
     }
 
     if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
-                              CAstore, noCAstore)) == NULL)
+             CAstore, noCAstore))
+        == NULL)
         goto end;
     X509_STORE_set_verify_cb(store, cb);
 
@@ -222,16 +234,18 @@ int verify_main(int argc, char **argv)
     ret = 0;
     if (argc < 1) {
         if (check(store, NULL, untrusted, trusted, crls, show_chain,
-                  vfyopts) != 1)
+                vfyopts)
+            != 1)
             ret = -1;
     } else {
         for (i = 0; i < argc; i++)
             if (check(store, argv[i], untrusted, trusted, crls, show_chain,
-                      vfyopts) != 1)
+                    vfyopts)
+                != 1)
                 ret = -1;
     }
 
- end:
+end:
     X509_VERIFY_PARAM_free(vpm);
     X509_STORE_free(store);
     OSSL_STACK_OF_X509_free(untrusted);
@@ -243,9 +257,9 @@ int verify_main(int argc, char **argv)
 }
 
 static int check(X509_STORE *ctx, const char *file,
-                 STACK_OF(X509) *uchain, STACK_OF(X509) *tchain,
-                 STACK_OF(X509_CRL) *crls, int show_chain,
-                 STACK_OF(OPENSSL_STRING) *opts)
+    STACK_OF(X509) *uchain, STACK_OF(X509) *tchain,
+    STACK_OF(X509_CRL) *crls, int show_chain,
+    STACK_OF(OPENSSL_STRING) *opts)
 {
     X509 *x = NULL;
     int i = 0, ret = 0;
@@ -272,7 +286,7 @@ static int check(X509_STORE *ctx, const char *file,
     csc = X509_STORE_CTX_new();
     if (csc == NULL) {
         BIO_printf(bio_err, "error %s: X.509 store context allocation failed\n",
-                   (file == NULL) ? "stdin" : file);
+            (file == NULL) ? "stdin" : file);
         goto end;
     }
 
@@ -280,8 +294,8 @@ static int check(X509_STORE *ctx, const char *file,
     if (!X509_STORE_CTX_init(csc, ctx, x, uchain)) {
         X509_STORE_CTX_free(csc);
         BIO_printf(bio_err,
-                   "error %s: X.509 store context initialization failed\n",
-                   (file == NULL) ? "stdin" : file);
+            "error %s: X.509 store context initialization failed\n",
+            (file == NULL) ? "stdin" : file);
         goto end;
     }
     if (tchain != NULL)
@@ -302,8 +316,8 @@ static int check(X509_STORE *ctx, const char *file,
                 X509 *cert = sk_X509_value(chain, j);
                 BIO_printf(bio_out, "depth=%d: ", j);
                 X509_NAME_print_ex_fp(stdout,
-                                      X509_get_subject_name(cert),
-                                      0, get_nameopt());
+                    X509_get_subject_name(cert),
+                    0, get_nameopt());
                 if (j < num_untrusted)
                     BIO_printf(bio_out, " (untrusted)");
                 BIO_printf(bio_out, "\n");
@@ -312,12 +326,12 @@ static int check(X509_STORE *ctx, const char *file,
         }
     } else {
         BIO_printf(bio_err,
-                   "error %s: verification failed\n",
-                   (file == NULL) ? "stdin" : file);
+            "error %s: verification failed\n",
+            (file == NULL) ? "stdin" : file);
     }
     X509_STORE_CTX_free(csc);
 
- end:
+end:
     if (i <= 0)
         ERR_print_errors(bio_err);
     X509_free(x);
@@ -333,15 +347,15 @@ static int cb(int ok, X509_STORE_CTX *ctx)
     if (!ok) {
         if (current_cert != NULL) {
             X509_NAME_print_ex(bio_err,
-                            X509_get_subject_name(current_cert),
-                            0, get_nameopt());
+                X509_get_subject_name(current_cert),
+                0, get_nameopt());
             BIO_printf(bio_err, "\n");
         }
         BIO_printf(bio_err, "%serror %d at %d depth lookup: %s\n",
-               X509_STORE_CTX_get0_parent_ctx(ctx) ? "[CRL path] " : "",
-               cert_error,
-               X509_STORE_CTX_get_error_depth(ctx),
-               X509_verify_cert_error_string(cert_error));
+            X509_STORE_CTX_get0_parent_ctx(ctx) ? "[CRL path] " : "",
+            cert_error,
+            X509_STORE_CTX_get_error_depth(ctx),
+            X509_verify_cert_error_string(cert_error));
 
         /*
          * Pretend that some errors are ok, so they don't stop further
@@ -383,7 +397,6 @@ static int cb(int ok, X509_STORE_CTX *ctx)
             ok = 1;
         }
         return ok;
-
     }
     if (cert_error == X509_V_OK && ok == 2)
         policies_print(ctx);
diff --git a/crypto/openssl/apps/version.c b/crypto/openssl/apps/version.c
index 89fb64b70a4d..4d876aef3f09 100644
--- a/crypto/openssl/apps/version.c
+++ b/crypto/openssl/apps/version.c
@@ -18,32 +18,43 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_B, OPT_D, OPT_E, OPT_M, OPT_F, OPT_O, OPT_P, OPT_V, OPT_A, OPT_R, OPT_C
+    OPT_B,
+    OPT_D,
+    OPT_E,
+    OPT_M,
+    OPT_F,
+    OPT_O,
+    OPT_P,
+    OPT_V,
+    OPT_A,
+    OPT_R,
+    OPT_C
 #if defined(_WIN32)
-    ,OPT_W
+    ,
+    OPT_W
 #endif
 } OPTION_CHOICE;
 
 const OPTIONS version_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
     OPT_SECTION("Output"),
-    {"a", OPT_A, '-', "Show all data"},
-    {"b", OPT_B, '-', "Show build date"},
-    {"d", OPT_D, '-', "Show configuration directory"},
-    {"e", OPT_E, '-', "Show engines directory"},
-    {"m", OPT_M, '-', "Show modules directory"},
-    {"f", OPT_F, '-', "Show compiler flags used"},
-    {"o", OPT_O, '-', "Show some internal datatype options"},
-    {"p", OPT_P, '-', "Show target build platform"},
-    {"r", OPT_R, '-', "Show random seeding options"},
-    {"v", OPT_V, '-', "Show library version"},
-    {"c", OPT_C, '-', "Show CPU settings info"},
+    { "a", OPT_A, '-', "Show all data" },
+    { "b", OPT_B, '-', "Show build date" },
+    { "d", OPT_D, '-', "Show configuration directory" },
+    { "e", OPT_E, '-', "Show engines directory" },
+    { "m", OPT_M, '-', "Show modules directory" },
+    { "f", OPT_F, '-', "Show compiler flags used" },
+    { "o", OPT_O, '-', "Show some internal datatype options" },
+    { "p", OPT_P, '-', "Show target build platform" },
+    { "r", OPT_R, '-', "Show random seeding options" },
+    { "v", OPT_V, '-', "Show library version" },
+    { "c", OPT_C, '-', "Show CPU settings info" },
 #if defined(_WIN32)
-    {"w", OPT_W, '-', "Show Windows install context"},
+    { "w", OPT_W, '-', "Show Windows install context" },
 #endif
-    {NULL}
+    { NULL }
 };
 
 int version_main(int argc, char **argv)
@@ -62,7 +73,7 @@ int version_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
-opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto end;
         case OPT_HELP:
@@ -121,7 +132,7 @@ opthelp:
 
     if (version)
         printf("%s (Library: %s)\n",
-               OPENSSL_VERSION_TEXT, OpenSSL_version(OPENSSL_VERSION));
+            OPENSSL_VERSION_TEXT, OpenSSL_version(OPENSSL_VERSION));
     if (date)
         printf("%s\n", OpenSSL_version(OPENSSL_BUILT_ON));
     if (platform)
@@ -150,19 +161,18 @@ opthelp:
         printf("%s\n", OpenSSL_version(OPENSSL_WINCTX));
 #endif
     ret = 0;
- end:
+end:
     return ret;
 }
 
-
 #if defined(__TANDEM) && defined(OPENSSL_VPROC)
 /*
  * Define a VPROC function for the openssl program.
  * This is used by platform version identification tools.
  * Do not inline this procedure or make it static.
  */
-# define OPENSSL_VPROC_STRING_(x)    x##_OPENSSL
-# define OPENSSL_VPROC_STRING(x)     OPENSSL_VPROC_STRING_(x)
-# define OPENSSL_VPROC_FUNC          OPENSSL_VPROC_STRING(OPENSSL_VPROC)
-void OPENSSL_VPROC_FUNC(void) {}
+#define OPENSSL_VPROC_STRING_(x) x##_OPENSSL
+#define OPENSSL_VPROC_STRING(x) OPENSSL_VPROC_STRING_(x)
+#define OPENSSL_VPROC_FUNC OPENSSL_VPROC_STRING(OPENSSL_VPROC)
+void OPENSSL_VPROC_FUNC(void) { }
 #endif
diff --git a/crypto/openssl/apps/vms_decc_init.c b/crypto/openssl/apps/vms_decc_init.c
index 21481e27bf93..58b9b190a120 100644
--- a/crypto/openssl/apps/vms_decc_init.c
+++ b/crypto/openssl/apps/vms_decc_init.c
@@ -7,9 +7,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-#if defined( __VMS) && !defined( OPENSSL_NO_DECC_INIT) && \
- defined( __DECC) && !defined( __VAX) && (__CRTL_VER >= 70301000)
-# define USE_DECC_INIT 1
+#if defined(__VMS) && !defined(OPENSSL_NO_DECC_INIT) && defined(__DECC) && !defined(__VAX) && (__CRTL_VER >= 70301000)
+#define USE_DECC_INIT 1
 #endif
 
 #ifdef USE_DECC_INIT
@@ -21,9 +20,9 @@
  * ----------------------------------------------------------------------
  */
 
-# include <stdio.h>
-# include <stdlib.h>
-# include <unixlib.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unixlib.h>
 
 /* Global storage. */
 
@@ -45,22 +44,21 @@ typedef struct {
 
 decc_feat_t decc_feat_array[] = {
     /* Preserve command-line case with SET PROCESS/PARSE_STYLE=EXTENDED */
-    {"DECC$ARGV_PARSE_STYLE", 1},
+    { "DECC$ARGV_PARSE_STYLE", 1 },
 
     /* Preserve case for file names on ODS5 disks. */
-    {"DECC$EFS_CASE_PRESERVE", 1},
+    { "DECC$EFS_CASE_PRESERVE", 1 },
 
     /*
      * Enable multiple dots (and most characters) in ODS5 file names, while
      * preserving VMS-ness of ";version".
      */
-    {"DECC$EFS_CHARSET", 1},
+    { "DECC$EFS_CHARSET", 1 },
 
     /* List terminator. */
-    {(char *)NULL, 0}
+    { (char *)NULL, 0 }
 };
 
-
 /* LIB$INITIALIZE initialization function. */
 
 static void decc_init(void)
@@ -98,31 +96,30 @@ static void decc_init(void)
             feat_value_max = decc$feature_get_value(feat_index, 3);
 
             /* Check the validity of our desired value. */
-            if ((decc_feat_array[i].value >= feat_value_min) &&
-                (decc_feat_array[i].value <= feat_value_max)) {
+            if ((decc_feat_array[i].value >= feat_value_min) && (decc_feat_array[i].value <= feat_value_max)) {
                 /* Valid value.  Set it if necessary. */
                 if (feat_value != decc_feat_array[i].value) {
                     sts = decc$feature_set_value(feat_index,
-                                                 1, decc_feat_array[i].value);
+                        1, decc_feat_array[i].value);
 
                     if (verbose > 1) {
                         fprintf(stderr, " %s = %d, sts = %d.\n",
-                                decc_feat_array[i].name,
-                                decc_feat_array[i].value, sts);
+                            decc_feat_array[i].name,
+                            decc_feat_array[i].value, sts);
                     }
                 }
             } else {
                 /* Invalid DECC feature value. */
                 fprintf(stderr,
-                        " INVALID DECC$FEATURE VALUE, %d: %d <= %s <= %d.\n",
-                        feat_value,
-                        feat_value_min, decc_feat_array[i].name,
-                        feat_value_max);
+                    " INVALID DECC$FEATURE VALUE, %d: %d <= %s <= %d.\n",
+                    feat_value,
+                    feat_value_min, decc_feat_array[i].name,
+                    feat_value_max);
             }
         } else {
             /* Invalid DECC feature name. */
             fprintf(stderr,
-                    " UNKNOWN DECC$FEATURE: %s.\n", decc_feat_array[i].name);
+                " UNKNOWN DECC$FEATURE: %s.\n", decc_feat_array[i].name);
         }
     }
 
@@ -133,44 +130,44 @@ static void decc_init(void)
 
 /* Get "decc_init()" into a valid, loaded LIB$INITIALIZE PSECT. */
 
-# pragma nostandard
+#pragma nostandard
 
 /*
  * Establish the LIB$INITIALIZE PSECTs, with proper alignment and other
  * attributes.  Note that "nopic" is significant only on VAX.
  */
-# pragma extern_model save
+#pragma extern_model save
 
-# if __INITIAL_POINTER_SIZE == 64
-#  define PSECT_ALIGN 3
-# else
-#  define PSECT_ALIGN 2
-# endif
+#if __INITIAL_POINTER_SIZE == 64
+#define PSECT_ALIGN 3
+#else
+#define PSECT_ALIGN 2
+#endif
 
-# pragma extern_model strict_refdef "LIB$INITIALIZ" PSECT_ALIGN, nopic, nowrt
+#pragma extern_model strict_refdef "LIB$INITIALIZ" PSECT_ALIGN, nopic, nowrt
 const int spare[8] = { 0 };
 
-# pragma extern_model strict_refdef "LIB$INITIALIZE" PSECT_ALIGN, nopic, nowrt
-void (*const x_decc_init) () = decc_init;
+#pragma extern_model strict_refdef "LIB$INITIALIZE" PSECT_ALIGN, nopic, nowrt
+void (*const x_decc_init)() = decc_init;
 
-# pragma extern_model restore
+#pragma extern_model restore
 
 /* Fake reference to ensure loading the LIB$INITIALIZE PSECT. */
 
-# pragma extern_model save
+#pragma extern_model save
 
 int LIB$INITIALIZE(void);
 
-# pragma extern_model strict_refdef
+#pragma extern_model strict_refdef
 int dmy_lib$initialize = (int)LIB$INITIALIZE;
 
-# pragma extern_model restore
+#pragma extern_model restore
 
-# pragma standard
+#pragma standard
 
-#else                           /* def USE_DECC_INIT */
+#else /* def USE_DECC_INIT */
 
 /* Dummy code to avoid a %CC-W-EMPTYFILE complaint. */
 int decc_init_dummy(void);
 
-#endif                          /* def USE_DECC_INIT */
+#endif /* def USE_DECC_INIT */
diff --git a/crypto/openssl/apps/x509.c b/crypto/openssl/apps/x509.c
index 3bd6564ec815..eb7737a1330f 100644
--- a/crypto/openssl/apps/x509.c
+++ b/crypto/openssl/apps/x509.c
@@ -23,170 +23,227 @@
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
 #ifndef OPENSSL_NO_DSA
-# include <openssl/dsa.h>
+#include <openssl/dsa.h>
 #endif
-#include "internal/e_os.h"    /* For isatty() */
+#include "internal/e_os.h" /* For isatty() */
 
 #undef POSTFIX
 #define POSTFIX ".srl"
-#define DEFAULT_DAYS       30 /* default certificate validity period in days */
-#define UNSET_DAYS         -2 /* -1 may be used for testing expiration checks */
-#define EXT_COPY_UNSET     -1
+#define DEFAULT_DAYS 30 /* default certificate validity period in days */
+#define UNSET_DAYS -2 /* -1 may be used for testing expiration checks */
+#define EXT_COPY_UNSET -1
 
 static int callb(int ok, X509_STORE_CTX *ctx);
 static ASN1_INTEGER *x509_load_serial(const char *CAfile,
-                                      const char *serialfile, int create);
+    const char *serialfile, int create);
 static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
 static int print_x509v3_exts(BIO *bio, X509 *x, const char *ext_names);
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_KEYFORM, OPT_REQ, OPT_CAFORM,
-    OPT_CAKEYFORM, OPT_VFYOPT, OPT_SIGOPT, OPT_DAYS, OPT_PASSIN, OPT_EXTFILE,
-    OPT_EXTENSIONS, OPT_IN, OPT_OUT, OPT_KEY, OPT_SIGNKEY, OPT_CA, OPT_CAKEY,
-    OPT_CASERIAL, OPT_SET_SERIAL, OPT_NEW, OPT_FORCE_PUBKEY, OPT_ISSU, OPT_SUBJ,
-    OPT_ADDTRUST, OPT_ADDREJECT, OPT_SETALIAS, OPT_CERTOPT, OPT_DATEOPT, OPT_NAMEOPT,
-    OPT_EMAIL, OPT_OCSP_URI, OPT_SERIAL, OPT_NEXT_SERIAL,
-    OPT_MODULUS, OPT_PUBKEY, OPT_X509TOREQ, OPT_TEXT, OPT_HASH,
-    OPT_ISSUER_HASH, OPT_SUBJECT, OPT_ISSUER, OPT_FINGERPRINT, OPT_DATES,
-    OPT_PURPOSE, OPT_STARTDATE, OPT_ENDDATE, OPT_CHECKEND, OPT_CHECKHOST,
-    OPT_CHECKEMAIL, OPT_CHECKIP, OPT_NOOUT, OPT_TRUSTOUT, OPT_CLRTRUST,
-    OPT_CLRREJECT, OPT_ALIAS, OPT_CACREATESERIAL, OPT_CLREXT, OPT_OCSPID,
-    OPT_SUBJECT_HASH_OLD, OPT_ISSUER_HASH_OLD, OPT_COPY_EXTENSIONS,
-    OPT_BADSIG, OPT_MD, OPT_ENGINE, OPT_NOCERT, OPT_PRESERVE_DATES,
-    OPT_NOT_BEFORE, OPT_NOT_AFTER,
-    OPT_R_ENUM, OPT_PROV_ENUM, OPT_EXT
+    OPT_INFORM,
+    OPT_OUTFORM,
+    OPT_KEYFORM,
+    OPT_REQ,
+    OPT_CAFORM,
+    OPT_CAKEYFORM,
+    OPT_VFYOPT,
+    OPT_SIGOPT,
+    OPT_DAYS,
+    OPT_PASSIN,
+    OPT_EXTFILE,
+    OPT_EXTENSIONS,
+    OPT_IN,
+    OPT_OUT,
+    OPT_KEY,
+    OPT_SIGNKEY,
+    OPT_CA,
+    OPT_CAKEY,
+    OPT_CASERIAL,
+    OPT_SET_SERIAL,
+    OPT_NEW,
+    OPT_FORCE_PUBKEY,
+    OPT_ISSU,
+    OPT_SUBJ,
+    OPT_ADDTRUST,
+    OPT_ADDREJECT,
+    OPT_SETALIAS,
+    OPT_CERTOPT,
+    OPT_DATEOPT,
+    OPT_NAMEOPT,
+    OPT_EMAIL,
+    OPT_OCSP_URI,
+    OPT_SERIAL,
+    OPT_NEXT_SERIAL,
+    OPT_MODULUS,
+    OPT_PUBKEY,
+    OPT_X509TOREQ,
+    OPT_TEXT,
+    OPT_HASH,
+    OPT_ISSUER_HASH,
+    OPT_SUBJECT,
+    OPT_ISSUER,
+    OPT_FINGERPRINT,
+    OPT_DATES,
+    OPT_PURPOSE,
+    OPT_STARTDATE,
+    OPT_ENDDATE,
+    OPT_CHECKEND,
+    OPT_CHECKHOST,
+    OPT_CHECKEMAIL,
+    OPT_CHECKIP,
+    OPT_NOOUT,
+    OPT_TRUSTOUT,
+    OPT_CLRTRUST,
+    OPT_CLRREJECT,
+    OPT_ALIAS,
+    OPT_CACREATESERIAL,
+    OPT_CLREXT,
+    OPT_OCSPID,
+    OPT_SUBJECT_HASH_OLD,
+    OPT_ISSUER_HASH_OLD,
+    OPT_COPY_EXTENSIONS,
+    OPT_BADSIG,
+    OPT_MD,
+    OPT_ENGINE,
+    OPT_NOCERT,
+    OPT_PRESERVE_DATES,
+    OPT_NOT_BEFORE,
+    OPT_NOT_AFTER,
+    OPT_R_ENUM,
+    OPT_PROV_ENUM,
+    OPT_EXT
 } OPTION_CHOICE;
 
 const OPTIONS x509_options[] = {
     OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
+    { "help", OPT_HELP, '-', "Display this summary" },
 
-    {"in", OPT_IN, '<',
-     "Certificate input, or CSR input file with -req (default stdin)"},
-    {"passin", OPT_PASSIN, 's', "Private key and cert file pass-phrase source"},
-    {"new", OPT_NEW, '-', "Generate a certificate from scratch"},
-    {"x509toreq", OPT_X509TOREQ, '-',
-     "Output a certification request (rather than a certificate)"},
-    {"req", OPT_REQ, '-', "Input is a CSR file (rather than a certificate)"},
-    {"copy_extensions", OPT_COPY_EXTENSIONS, 's',
-     "copy extensions when converting from CSR to x509 or vice versa"},
-    {"inform", OPT_INFORM, 'f',
-     "CSR input format to use (PEM or DER; by default try PEM first)"},
-    {"vfyopt", OPT_VFYOPT, 's', "CSR verification parameter in n:v form"},
-    {"key", OPT_KEY, 's',
-     "Key for signing, and to include unless using -force_pubkey"},
-    {"signkey", OPT_SIGNKEY, 's',
-     "Same as -key"},
-    {"keyform", OPT_KEYFORM, 'E',
-     "Key input format (ENGINE, other values ignored)"},
-    {"out", OPT_OUT, '>', "Output file - default stdout"},
-    {"outform", OPT_OUTFORM, 'f',
-     "Output format (DER or PEM) - default PEM"},
-    {"nocert", OPT_NOCERT, '-',
-     "No cert output (except for requested printing)"},
-    {"noout", OPT_NOOUT, '-', "No output (except for requested printing)"},
+    { "in", OPT_IN, '<',
+        "Certificate input, or CSR input file with -req (default stdin)" },
+    { "passin", OPT_PASSIN, 's', "Private key and cert file pass-phrase source" },
+    { "new", OPT_NEW, '-', "Generate a certificate from scratch" },
+    { "x509toreq", OPT_X509TOREQ, '-',
+        "Output a certification request (rather than a certificate)" },
+    { "req", OPT_REQ, '-', "Input is a CSR file (rather than a certificate)" },
+    { "copy_extensions", OPT_COPY_EXTENSIONS, 's',
+        "copy extensions when converting from CSR to x509 or vice versa" },
+    { "inform", OPT_INFORM, 'f',
+        "CSR input format to use (PEM or DER; by default try PEM first)" },
+    { "vfyopt", OPT_VFYOPT, 's', "CSR verification parameter in n:v form" },
+    { "key", OPT_KEY, 's',
+        "Key for signing, and to include unless using -force_pubkey" },
+    { "signkey", OPT_SIGNKEY, 's',
+        "Same as -key" },
+    { "keyform", OPT_KEYFORM, 'E',
+        "Key input format (ENGINE, other values ignored)" },
+    { "out", OPT_OUT, '>', "Output file - default stdout" },
+    { "outform", OPT_OUTFORM, 'f',
+        "Output format (DER or PEM) - default PEM" },
+    { "nocert", OPT_NOCERT, '-',
+        "No cert output (except for requested printing)" },
+    { "noout", OPT_NOOUT, '-', "No output (except for requested printing)" },
 
     OPT_SECTION("Certificate printing"),
-    {"text", OPT_TEXT, '-', "Print the certificate in text form"},
-    {"dateopt", OPT_DATEOPT, 's',
-     "Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822."},
-    {"certopt", OPT_CERTOPT, 's', "Various certificate text printing options"},
-    {"fingerprint", OPT_FINGERPRINT, '-', "Print the certificate fingerprint"},
-    {"alias", OPT_ALIAS, '-', "Print certificate alias"},
-    {"serial", OPT_SERIAL, '-', "Print serial number value"},
-    {"startdate", OPT_STARTDATE, '-', "Print the notBefore field"},
-    {"enddate", OPT_ENDDATE, '-', "Print the notAfter field"},
-    {"dates", OPT_DATES, '-', "Print both notBefore and notAfter fields"},
-    {"subject", OPT_SUBJECT, '-', "Print subject DN"},
-    {"issuer", OPT_ISSUER, '-', "Print issuer DN"},
-    {"nameopt", OPT_NAMEOPT, 's',
-     "Certificate subject/issuer name printing options"},
-    {"email", OPT_EMAIL, '-', "Print email address(es)"},
-    {"hash", OPT_HASH, '-', "Synonym for -subject_hash (for backward compat)"},
-    {"subject_hash", OPT_HASH, '-', "Print subject hash value"},
+    { "text", OPT_TEXT, '-', "Print the certificate in text form" },
+    { "dateopt", OPT_DATEOPT, 's',
+        "Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822." },
+    { "certopt", OPT_CERTOPT, 's', "Various certificate text printing options" },
+    { "fingerprint", OPT_FINGERPRINT, '-', "Print the certificate fingerprint" },
+    { "alias", OPT_ALIAS, '-', "Print certificate alias" },
+    { "serial", OPT_SERIAL, '-', "Print serial number value" },
+    { "startdate", OPT_STARTDATE, '-', "Print the notBefore field" },
+    { "enddate", OPT_ENDDATE, '-', "Print the notAfter field" },
+    { "dates", OPT_DATES, '-', "Print both notBefore and notAfter fields" },
+    { "subject", OPT_SUBJECT, '-', "Print subject DN" },
+    { "issuer", OPT_ISSUER, '-', "Print issuer DN" },
+    { "nameopt", OPT_NAMEOPT, 's',
+        "Certificate subject/issuer name printing options" },
+    { "email", OPT_EMAIL, '-', "Print email address(es)" },
+    { "hash", OPT_HASH, '-', "Synonym for -subject_hash (for backward compat)" },
+    { "subject_hash", OPT_HASH, '-', "Print subject hash value" },
 #ifndef OPENSSL_NO_MD5
-    {"subject_hash_old", OPT_SUBJECT_HASH_OLD, '-',
-     "Print old-style (MD5) subject hash value"},
+    { "subject_hash_old", OPT_SUBJECT_HASH_OLD, '-',
+        "Print old-style (MD5) subject hash value" },
 #endif
-    {"issuer_hash", OPT_ISSUER_HASH, '-', "Print issuer hash value"},
+    { "issuer_hash", OPT_ISSUER_HASH, '-', "Print issuer hash value" },
 #ifndef OPENSSL_NO_MD5
-    {"issuer_hash_old", OPT_ISSUER_HASH_OLD, '-',
-     "Print old-style (MD5) issuer hash value"},
+    { "issuer_hash_old", OPT_ISSUER_HASH_OLD, '-',
+        "Print old-style (MD5) issuer hash value" },
 #endif
-    {"ext", OPT_EXT, 's',
-     "Restrict which X.509 extensions to print and/or copy"},
-    {"ocspid", OPT_OCSPID, '-',
-     "Print OCSP hash values for the subject name and public key"},
-    {"ocsp_uri", OPT_OCSP_URI, '-', "Print OCSP Responder URL(s)"},
-    {"purpose", OPT_PURPOSE, '-', "Print out certificate purposes"},
-    {"pubkey", OPT_PUBKEY, '-', "Print the public key in PEM format"},
-    {"modulus", OPT_MODULUS, '-', "Print the RSA key modulus"},
+    { "ext", OPT_EXT, 's',
+        "Restrict which X.509 extensions to print and/or copy" },
+    { "ocspid", OPT_OCSPID, '-',
+        "Print OCSP hash values for the subject name and public key" },
+    { "ocsp_uri", OPT_OCSP_URI, '-', "Print OCSP Responder URL(s)" },
+    { "purpose", OPT_PURPOSE, '-', "Print out certificate purposes" },
+    { "pubkey", OPT_PUBKEY, '-', "Print the public key in PEM format" },
+    { "modulus", OPT_MODULUS, '-', "Print the RSA key modulus" },
 
     OPT_SECTION("Certificate checking"),
-    {"checkend", OPT_CHECKEND, 'M',
-     "Check whether cert expires in the next arg seconds"},
-    {OPT_MORE_STR, 1, 1, "Exit 1 (failure) if so, 0 if not"},
-    {"checkhost", OPT_CHECKHOST, 's', "Check certificate matches host"},
-    {"checkemail", OPT_CHECKEMAIL, 's', "Check certificate matches email"},
-    {"checkip", OPT_CHECKIP, 's', "Check certificate matches ipaddr"},
+    { "checkend", OPT_CHECKEND, 'M',
+        "Check whether cert expires in the next arg seconds" },
+    { OPT_MORE_STR, 1, 1, "Exit 1 (failure) if so, 0 if not" },
+    { "checkhost", OPT_CHECKHOST, 's', "Check certificate matches host" },
+    { "checkemail", OPT_CHECKEMAIL, 's', "Check certificate matches email" },
+    { "checkip", OPT_CHECKIP, 's', "Check certificate matches ipaddr" },
 
     OPT_SECTION("Certificate output"),
-    {"set_serial", OPT_SET_SERIAL, 's',
-     "Serial number to use, overrides -CAserial"},
-    {"next_serial", OPT_NEXT_SERIAL, '-',
-     "Increment current certificate serial number"},
-    {"not_before", OPT_NOT_BEFORE, 's',
-     "[CC]YYMMDDHHMMSSZ value for notBefore certificate field"},
-    {"not_after", OPT_NOT_AFTER, 's',
-     "[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days"},
-    {"days", OPT_DAYS, 'n',
-     "Number of days until newly generated certificate expires - default 30"},
-    {"preserve_dates", OPT_PRESERVE_DATES, '-',
-     "Preserve existing validity dates"},
-    {"set_issuer", OPT_ISSU, 's', "Set or override certificate issuer"},
-    {"set_subject", OPT_SUBJ, 's', "Set or override certificate subject (and issuer)"},
-    {"subj", OPT_SUBJ, 's', "Alias for -set_subject"},
-    {"force_pubkey", OPT_FORCE_PUBKEY, '<',
-     "Key to be placed in new certificate or certificate request"},
-    {"clrext", OPT_CLREXT, '-',
-     "Do not take over any extensions from the source certificate or request"},
-    {"extfile", OPT_EXTFILE, '<', "Config file with X509V3 extensions to add"},
-    {"extensions", OPT_EXTENSIONS, 's',
-     "Section of extfile to use - default: unnamed section"},
-    {"sigopt", OPT_SIGOPT, 's', "Signature parameter, in n:v form"},
-    {"badsig", OPT_BADSIG, '-',
-     "Corrupt last byte of certificate signature (for test)"},
-    {"", OPT_MD, '-', "Any supported digest, used for signing and printing"},
+    { "set_serial", OPT_SET_SERIAL, 's',
+        "Serial number to use, overrides -CAserial" },
+    { "next_serial", OPT_NEXT_SERIAL, '-',
+        "Increment current certificate serial number" },
+    { "not_before", OPT_NOT_BEFORE, 's',
+        "[CC]YYMMDDHHMMSSZ value for notBefore certificate field" },
+    { "not_after", OPT_NOT_AFTER, 's',
+        "[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days" },
+    { "days", OPT_DAYS, 'n',
+        "Number of days until newly generated certificate expires - default 30" },
+    { "preserve_dates", OPT_PRESERVE_DATES, '-',
+        "Preserve existing validity dates" },
+    { "set_issuer", OPT_ISSU, 's', "Set or override certificate issuer" },
+    { "set_subject", OPT_SUBJ, 's', "Set or override certificate subject (and issuer)" },
+    { "subj", OPT_SUBJ, 's', "Alias for -set_subject" },
+    { "force_pubkey", OPT_FORCE_PUBKEY, '<',
+        "Key to be placed in new certificate or certificate request" },
+    { "clrext", OPT_CLREXT, '-',
+        "Do not take over any extensions from the source certificate or request" },
+    { "extfile", OPT_EXTFILE, '<', "Config file with X509V3 extensions to add" },
+    { "extensions", OPT_EXTENSIONS, 's',
+        "Section of extfile to use - default: unnamed section" },
+    { "sigopt", OPT_SIGOPT, 's', "Signature parameter, in n:v form" },
+    { "badsig", OPT_BADSIG, '-',
+        "Corrupt last byte of certificate signature (for test)" },
+    { "", OPT_MD, '-', "Any supported digest, used for signing and printing" },
 
     OPT_SECTION("Micro-CA"),
-    {"CA", OPT_CA, '<',
-     "Use the given CA certificate, conflicts with -key"},
-    {"CAform", OPT_CAFORM, 'F', "CA cert format (PEM/DER/P12); has no effect"},
-    {"CAkey", OPT_CAKEY, 's', "The corresponding CA key; default is -CA arg"},
-    {"CAkeyform", OPT_CAKEYFORM, 'E',
-     "CA key format (ENGINE, other values ignored)"},
-    {"CAserial", OPT_CASERIAL, 's',
-     "File that keeps track of CA-generated serial number"},
-    {"CAcreateserial", OPT_CACREATESERIAL, '-',
-     "Create CA serial number file if it does not exist"},
+    { "CA", OPT_CA, '<',
+        "Use the given CA certificate, conflicts with -key" },
+    { "CAform", OPT_CAFORM, 'F', "CA cert format (PEM/DER/P12); has no effect" },
+    { "CAkey", OPT_CAKEY, 's', "The corresponding CA key; default is -CA arg" },
+    { "CAkeyform", OPT_CAKEYFORM, 'E',
+        "CA key format (ENGINE, other values ignored)" },
+    { "CAserial", OPT_CASERIAL, 's',
+        "File that keeps track of CA-generated serial number" },
+    { "CAcreateserial", OPT_CACREATESERIAL, '-',
+        "Create CA serial number file if it does not exist" },
 
     OPT_SECTION("Certificate trust output"),
-    {"trustout", OPT_TRUSTOUT, '-', "Mark certificate PEM output as trusted"},
-    {"setalias", OPT_SETALIAS, 's', "Set certificate alias (nickname)"},
-    {"clrtrust", OPT_CLRTRUST, '-', "Clear all trusted purposes"},
-    {"addtrust", OPT_ADDTRUST, 's', "Trust certificate for a given purpose"},
-    {"clrreject", OPT_CLRREJECT, '-',
-     "Clears all the prohibited or rejected uses of the certificate"},
-    {"addreject", OPT_ADDREJECT, 's',
-     "Reject certificate for a given purpose"},
+    { "trustout", OPT_TRUSTOUT, '-', "Mark certificate PEM output as trusted" },
+    { "setalias", OPT_SETALIAS, 's', "Set certificate alias (nickname)" },
+    { "clrtrust", OPT_CLRTRUST, '-', "Clear all trusted purposes" },
+    { "addtrust", OPT_ADDTRUST, 's', "Trust certificate for a given purpose" },
+    { "clrreject", OPT_CLRREJECT, '-',
+        "Clears all the prohibited or rejected uses of the certificate" },
+    { "addreject", OPT_ADDREJECT, 's',
+        "Reject certificate for a given purpose" },
 
     OPT_R_OPTIONS,
 #ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
 #endif
     OPT_PROV_OPTIONS,
-    {NULL}
+    { NULL }
 };
 
 static void warn_copying(ASN1_OBJECT *excluded, const char *names)
@@ -195,8 +252,8 @@ static void warn_copying(ASN1_OBJECT *excluded, const char *names)
 
     if (names != NULL && strstr(names, sn) != NULL)
         BIO_printf(bio_err,
-                   "Warning: -ext should not specify copying %s extension to CSR; ignoring this\n",
-                   sn);
+            "Warning: -ext should not specify copying %s extension to CSR; ignoring this\n",
+            sn);
 }
 
 static X509_REQ *x509_to_req(X509 *cert, int ext_copy, const char *names)
@@ -224,13 +281,13 @@ static X509_REQ *x509_to_req(X509 *cert, int ext_copy, const char *names)
         ASN1_OBJECT *obj = X509_EXTENSION_get_object(ex);
 
         if (OBJ_cmp(obj, skid) != 0 && OBJ_cmp(obj, akid) != 0
-                && !sk_X509_EXTENSION_push(exts, ex))
+            && !sk_X509_EXTENSION_push(exts, ex))
             goto err;
     }
 
     if (sk_X509_EXTENSION_num(exts) > 0) {
         if (ext_copy != EXT_COPY_UNSET && ext_copy != EXT_COPY_NONE
-                && !X509_REQ_add_extensions(req, exts)) {
+            && !X509_REQ_add_extensions(req, exts)) {
             BIO_printf(bio_err, "Error copying extensions from certificate\n");
             goto err;
         }
@@ -238,7 +295,7 @@ static X509_REQ *x509_to_req(X509 *cert, int ext_copy, const char *names)
     sk_X509_EXTENSION_free(exts);
     return req;
 
- err:
+err:
     sk_X509_EXTENSION_free(exts);
     X509_REQ_free(req);
     return NULL;
@@ -317,7 +374,7 @@ int x509_main(int argc, char **argv)
         switch (o) {
         case OPT_EOF:
         case OPT_ERR:
- opthelp:
+        opthelp:
             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
             goto err;
         case OPT_HELP:
@@ -357,14 +414,14 @@ int x509_main(int argc, char **argv)
         case OPT_DATEOPT:
             if (!set_dateopt(&dateopt, opt_arg())) {
                 BIO_printf(bio_err,
-                           "Invalid date format: %s\n", opt_arg());
+                    "Invalid date format: %s\n", opt_arg());
                 goto err;
             }
             break;
         case OPT_COPY_EXTENSIONS:
             if (!set_ext_copy(&ext_copy, opt_arg())) {
                 BIO_printf(bio_err,
-                           "Invalid extension copy option: %s\n", opt_arg());
+                    "Invalid extension copy option: %s\n", opt_arg());
                 goto err;
             }
             break;
@@ -391,7 +448,7 @@ int x509_main(int argc, char **argv)
             days = atoi(opt_arg());
             if (days <= UNSET_DAYS) {
                 BIO_printf(bio_err, "%s: -days parameter arg must be >= -1\n",
-                           prog);
+                    prog);
                 goto err;
             }
             break;
@@ -450,7 +507,7 @@ int x509_main(int argc, char **argv)
                 goto err;
             if ((objtmp = OBJ_txt2obj(opt_arg(), 0)) == NULL) {
                 BIO_printf(bio_err, "%s: Invalid trust object value %s\n",
-                           prog, opt_arg());
+                    prog, opt_arg());
                 goto opthelp;
             }
             if (!sk_ASN1_OBJECT_push(trust, objtmp))
@@ -462,7 +519,7 @@ int x509_main(int argc, char **argv)
                 goto err;
             if ((objtmp = OBJ_txt2obj(opt_arg(), 0)) == NULL) {
                 BIO_printf(bio_err, "%s: Invalid reject object value %s\n",
-                           prog, opt_arg());
+                    prog, opt_arg());
                 goto opthelp;
             }
             if (!sk_ASN1_OBJECT_push(reject, objtmp))
@@ -591,7 +648,7 @@ int x509_main(int argc, char **argv)
                 checkoffset = (time_t)temp;
                 if ((ossl_intmax_t)checkoffset != temp) {
                     BIO_printf(bio_err, "%s: Checkend time out of range %s\n",
-                               prog, opt_arg());
+                        prog, opt_arg());
                     goto opthelp;
                 }
             }
@@ -646,7 +703,7 @@ int x509_main(int argc, char **argv)
     }
 
     if (!X509_STORE_set_default_paths_ex(ctx, app_get0_libctx(),
-                                         app_get0_propq()))
+            app_get0_propq()))
         goto err;
 
     if (newcert && infile != NULL) {
@@ -664,27 +721,28 @@ int x509_main(int argc, char **argv)
     }
     if (pubkeyfile != NULL) {
         if ((pubkey = load_pubkey(pubkeyfile, keyformat, 0, NULL, e,
-                                  "explicitly set public key")) == NULL)
+                 "explicitly set public key"))
+            == NULL)
             goto err;
     }
 
     if (newcert) {
         if (subj == NULL) {
             BIO_printf(bio_err,
-                       "The -new option requires a subject to be set using -subj\n");
+                "The -new option requires a subject to be set using -subj\n");
             goto err;
         }
         if (privkeyfile == NULL && pubkeyfile == NULL) {
             BIO_printf(bio_err,
-                       "The -new option requires using the -key or -force_pubkey option\n");
+                "The -new option requires using the -key or -force_pubkey option\n");
             goto err;
         }
     }
     if (issu != NULL
-            && (fissu = parse_name(issu, chtype, multirdn, "issuer")) == NULL)
+        && (fissu = parse_name(issu, chtype, multirdn, "issuer")) == NULL)
         goto err;
     if (subj != NULL
-            && (fsubj = parse_name(subj, chtype, multirdn, "subject")) == NULL)
+        && (fsubj = parse_name(subj, chtype, multirdn, "subject")) == NULL)
         goto err;
 
     if (CAkeyfile == NULL)
@@ -696,7 +754,7 @@ int x509_main(int argc, char **argv)
         }
     } else {
 #define WARN_NO_CA(opt) BIO_printf(bio_err, \
-        "Warning: ignoring " opt " option since -CA option is not given\n");
+    "Warning: ignoring " opt " option since -CA option is not given\n");
         if (CAkeyfile != NULL)
             WARN_NO_CA("-CAkey");
         if (CAkeyformat != FORMAT_UNDEF)
@@ -712,7 +770,7 @@ int x509_main(int argc, char **argv)
     if (extfile == NULL) {
         if (extsect != NULL)
             BIO_printf(bio_err,
-                       "Warning: ignoring -extensions option without -extfile\n");
+                "Warning: ignoring -extensions option without -extfile\n");
     } else {
         X509V3_CTX ctx2;
 
@@ -727,7 +785,7 @@ int x509_main(int argc, char **argv)
         X509V3_set_nconf(&ctx2, extconf);
         if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL)) {
             BIO_printf(bio_err,
-                       "Error checking extension section %s\n", extsect);
+                "Error checking extension section %s\n", extsect);
             goto err;
         }
     }
@@ -735,9 +793,9 @@ int x509_main(int argc, char **argv)
     if (reqfile) {
         if (infile == NULL && isatty(fileno_stdin()))
             BIO_printf(bio_err,
-                       "Warning: Reading cert request from stdin since no -in option is given\n");
+                "Warning: Reading cert request from stdin since no -in option is given\n");
         req = load_csr_autofmt(infile, informat, vfyopts,
-                               "certificate request input");
+            "certificate request input");
         if (req == NULL)
             goto err;
 
@@ -747,9 +805,7 @@ int x509_main(int argc, char **argv)
         }
         i = do_X509_REQ_verify(req, pkey, vfyopts);
         if (i <= 0) {
-            BIO_printf(bio_err, i < 0
-                       ? "Error while verifying certificate request self-signature\n"
-                       : "Certificate request self-signature did not match the contents\n");
+            BIO_printf(bio_err, i < 0 ? "Error while verifying certificate request self-signature\n" : "Certificate request self-signature did not match the contents\n");
             goto err;
         }
         BIO_printf(bio_err, "Certificate request self-signature ok\n");
@@ -762,11 +818,11 @@ int x509_main(int argc, char **argv)
     if (reqfile || newcert) {
         if (preserve_dates)
             BIO_printf(bio_err,
-                       "Warning: ignoring -preserve_dates option with -req or -new\n");
+                "Warning: ignoring -preserve_dates option with -req or -new\n");
         preserve_dates = 0;
         if (privkeyfile == NULL && CAkeyfile == NULL) {
             BIO_printf(bio_err,
-                       "We need a private key to sign with, use -key or -CAkey or -CA with private key\n");
+                "We need a private key to sign with, use -key or -CAkey or -CA with private key\n");
             goto err;
         }
         if ((x = X509_new_ex(app_get0_libctx(), app_get0_propq())) == NULL)
@@ -788,19 +844,17 @@ int x509_main(int argc, char **argv)
     } else {
         if (infile == NULL && isatty(fileno_stdin()))
             BIO_printf(bio_err,
-                       "Warning: Reading certificate from stdin since no -in or -new option is given\n");
+                "Warning: Reading certificate from stdin since no -in or -new option is given\n");
         x = load_cert_pass(infile, informat, 1, passin, "certificate");
         if (x == NULL)
             goto err;
     }
     if ((fsubj != NULL || req != NULL)
-        && !X509_set_subject_name(x, fsubj != NULL ? fsubj :
-                                  X509_REQ_get_subject_name(req)))
+        && !X509_set_subject_name(x, fsubj != NULL ? fsubj : X509_REQ_get_subject_name(req)))
         goto err;
     if ((pubkey != NULL || privkey != NULL || req != NULL)
-        && !X509_set_pubkey(x, pubkey != NULL ? pubkey :
-                            privkey != NULL ? privkey :
-                            X509_REQ_get0_pubkey(req)))
+        && !X509_set_pubkey(x, pubkey != NULL ? pubkey : privkey != NULL ? privkey
+                                                                         : X509_REQ_get0_pubkey(req)))
         goto err;
 
     if (CAfile != NULL) {
@@ -853,7 +907,7 @@ int x509_main(int argc, char **argv)
     } else {
         if (privkey != NULL && !cert_matches_key(x, privkey))
             BIO_printf(bio_err,
-                       "Warning: Signature key and public key of cert do not match\n");
+                "Warning: Signature key and public key of cert do not match\n");
     }
 
     if (sno != NULL && !X509_set_serialNumber(x, sno))
@@ -881,7 +935,7 @@ int x509_main(int argc, char **argv)
         X509V3_set_nconf(&ext_ctx, extconf);
         if (!X509V3_EXT_add_nconf(extconf, &ext_ctx, extsect, x)) {
             BIO_printf(bio_err,
-                       "Error adding extensions from section %s\n", extsect);
+                "Error adding extensions from section %s\n", extsect);
             goto err;
         }
     }
@@ -909,7 +963,7 @@ int x509_main(int argc, char **argv)
             X509V3_set_nconf(&ext_ctx, extconf);
             if (!X509V3_EXT_REQ_add_nconf(extconf, &ext_ctx, extsect, rq)) {
                 BIO_printf(bio_err,
-                           "Error adding request extensions from section %s\n", extsect);
+                    "Error adding request extensions from section %s\n", extsect);
                 goto err;
             }
         }
@@ -924,18 +978,19 @@ int x509_main(int argc, char **argv)
             }
             if (!i) {
                 BIO_printf(bio_err,
-                           "Unable to write certificate request\n");
+                    "Unable to write certificate request\n");
                 goto err;
             }
         }
         noout = 1;
     } else if (CAfile != NULL) {
         if ((CAkey = load_key(CAkeyfile, CAkeyformat,
-                              0, passin, e, "CA private key")) == NULL)
+                 0, passin, e, "CA private key"))
+            == NULL)
             goto err;
         if (!X509_check_private_key(xca, CAkey)) {
             BIO_printf(bio_err,
-                       "CA certificate and CA private key do not match\n");
+                "CA certificate and CA private key do not match\n");
             goto err;
         }
 
@@ -969,7 +1024,7 @@ int x509_main(int argc, char **argv)
             if (bnser == NULL)
                 goto err;
             if (!BN_add_word(bnser, 1)
-                    || (ser = BN_to_ASN1_INTEGER(bnser, NULL)) == NULL) {
+                || (ser = BN_to_ASN1_INTEGER(bnser, NULL)) == NULL) {
                 BN_free(bnser);
                 goto err;
             }
@@ -978,8 +1033,7 @@ int x509_main(int argc, char **argv)
             ASN1_INTEGER_free(ser);
             BIO_puts(out, "\n");
         } else if (i == email || i == ocsp_uri) {
-            STACK_OF(OPENSSL_STRING) *emlst =
-                i == email ? X509_get1_email(x) : X509_get1_ocsp(x);
+            STACK_OF(OPENSSL_STRING) *emlst = i == email ? X509_get1_email(x) : X509_get1_ocsp(x);
 
             for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++)
                 BIO_printf(out, "%s\n", sk_OPENSSL_STRING_value(emlst, j));
@@ -1050,7 +1104,8 @@ int x509_main(int argc, char **argv)
                 fdigname = "SHA1";
 
             if ((fdig = EVP_MD_fetch(app_get0_libctx(), fdigname,
-                                     app_get0_propq())) == NULL) {
+                     app_get0_propq()))
+                == NULL) {
                 BIO_printf(bio_err, "Unknown digest\n");
                 goto err;
             }
@@ -1109,10 +1164,10 @@ int x509_main(int argc, char **argv)
     ret = 0;
     goto end;
 
- err:
+err:
     ERR_print_errors(bio_err);
 
- end:
+end:
     NCONF_free(extconf);
     BIO_free_all(out);
     X509_STORE_free(ctx);
@@ -1136,7 +1191,7 @@ int x509_main(int argc, char **argv)
 }
 
 static ASN1_INTEGER *x509_load_serial(const char *CAfile,
-                                      const char *serialfile, int create)
+    const char *serialfile, int create)
 {
     char *buf = NULL;
     ASN1_INTEGER *bs = NULL;
@@ -1168,7 +1223,7 @@ static ASN1_INTEGER *x509_load_serial(const char *CAfile,
     else
         bs = BN_to_ASN1_INTEGER(serial, NULL);
 
- end:
+end:
     OPENSSL_free(buf);
     BN_free(serial);
     return bs;
@@ -1191,9 +1246,9 @@ static int callb(int ok, X509_STORE_CTX *ctx)
         err_cert = X509_STORE_CTX_get_current_cert(ctx);
         print_name(bio_err, "subject=", X509_get_subject_name(err_cert));
         BIO_printf(bio_err,
-                   "Error with certificate - error %d at depth %d\n%s\n", err,
-                   X509_STORE_CTX_get_error_depth(ctx),
-                   X509_verify_cert_error_string(err));
+            "Error with certificate - error %d at depth %d\n%s\n", err,
+            X509_STORE_CTX_get_error_depth(ctx),
+            X509_verify_cert_error_string(err));
         return 1;
     }
 
@@ -1302,7 +1357,7 @@ static int print_x509v3_exts(BIO *bio, X509 *x, const char *ext_names)
     }
 
     ret = X509V3_extensions_print(bio, NULL, exts2, 0, 0);
- end:
+end:
     sk_X509_EXTENSION_free(exts2);
     OPENSSL_free(names);
     OPENSSL_free(tmp_ext_names);
diff --git a/crypto/openssl/crypto/LPdir_nyi.c b/crypto/openssl/crypto/LPdir_nyi.c
index a1540785f87d..a56f2edd92a1 100644
--- a/crypto/openssl/crypto/LPdir_nyi.c
+++ b/crypto/openssl/crypto/LPdir_nyi.c
@@ -37,7 +37,7 @@
  */
 
 #ifndef LPDIR_H
-# include "LPdir.h"
+#include "LPdir.h"
 #endif
 
 struct LP_dir_context_st {
diff --git a/crypto/openssl/crypto/LPdir_unix.c b/crypto/openssl/crypto/LPdir_unix.c
index b6dda7bce2ec..c3a321fe1bc4 100644
--- a/crypto/openssl/crypto/LPdir_unix.c
+++ b/crypto/openssl/crypto/LPdir_unix.c
@@ -44,10 +44,10 @@
 #include <dirent.h>
 #include <errno.h>
 #ifndef LPDIR_H
-# include "LPdir.h"
+#include "LPdir.h"
 #endif
 #ifdef __VMS
-# include <ctype.h>
+#include <ctype.h>
 #endif
 
 /*
@@ -57,9 +57,9 @@
  * if it doesn't exist, use NAME_MAX.
  */
 #if defined(PATH_MAX)
-# define LP_ENTRY_SIZE PATH_MAX
+#define LP_ENTRY_SIZE PATH_MAX
 #elif defined(NAME_MAX)
-# define LP_ENTRY_SIZE NAME_MAX
+#define LP_ENTRY_SIZE NAME_MAX
 #endif
 
 /*
@@ -68,9 +68,9 @@
  * small value (HP-UX offers 14), so we need to check if we got a result, and
  * if it meets a minimum standard, and create or change it if not.
  */
-#if !defined(LP_ENTRY_SIZE) || LP_ENTRY_SIZE<255
-# undef LP_ENTRY_SIZE
-# define LP_ENTRY_SIZE 255
+#if !defined(LP_ENTRY_SIZE) || LP_ENTRY_SIZE < 255
+#undef LP_ENTRY_SIZE
+#define LP_ENTRY_SIZE 255
 #endif
 
 struct LP_dir_context_st {
@@ -121,9 +121,9 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
 
 #ifdef __VMS
     strncpy((*ctx)->previous_entry_name, (*ctx)->entry_name,
-            sizeof((*ctx)->previous_entry_name));
+        sizeof((*ctx)->previous_entry_name));
 
- again:
+again:
 #endif
 
     direntry = readdir((*ctx)->dir);
@@ -132,7 +132,7 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
     }
 
     OPENSSL_strlcpy((*ctx)->entry_name, direntry->d_name,
-                    sizeof((*ctx)->entry_name));
+        sizeof((*ctx)->entry_name));
 #ifdef __VMS
     if ((*ctx)->expect_file_generations) {
         char *p = (*ctx)->entry_name + strlen((*ctx)->entry_name);
@@ -142,7 +142,8 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
         if (p > (*ctx)->entry_name && p[-1] == ';')
             p[-1] = '\0';
         if (OPENSSL_strcasecmp((*ctx)->entry_name,
-                               (*ctx)->previous_entry_name) == 0)
+                (*ctx)->previous_entry_name)
+            == 0)
             goto again;
     }
 #endif
diff --git a/crypto/openssl/crypto/LPdir_vms.c b/crypto/openssl/crypto/LPdir_vms.c
index 51043263ae67..4f89657179b6 100644
--- a/crypto/openssl/crypto/LPdir_vms.c
+++ b/crypto/openssl/crypto/LPdir_vms.c
@@ -49,13 +49,13 @@
 #include <str$routines.h>
 #include <stsdef.h>
 #ifndef LPDIR_H
-# include "LPdir.h"
+#include "LPdir.h"
 #endif
 #include "vms_rms.h"
 
 /* Some compiler options hide EVMSERR. */
 #ifndef EVMSERR
-# define EVMSERR        65535   /* error for non-translatable VMS errors */
+#define EVMSERR 65535 /* error for non-translatable VMS errors */
 #endif
 
 struct LP_dir_context_st {
@@ -75,12 +75,12 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
 
 /* Arrange 32-bit pointer to (copied) string storage, if needed. */
 #if __INITIAL_POINTER_SIZE == 64
-# pragma pointer_size save
-# pragma pointer_size 32
+#pragma pointer_size save
+#pragma pointer_size 32
     char *ctx_filespec_32p;
-# pragma pointer_size restore
+#pragma pointer_size restore
     char ctx_filespec_32[NAMX_MAXRSS + 1];
-#endif                          /* __INITIAL_POINTER_SIZE == 64 */
+#endif /* __INITIAL_POINTER_SIZE == 64 */
 
 #ifdef NAML$C_MAXRSS
     flags |= LIB$M_FIL_LONG_NAMES;
@@ -109,7 +109,7 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
             return 0;
         }
 
-        filespeclen += 4;       /* "*.*;" */
+        filespeclen += 4; /* "*.*;" */
 
         if (filespeclen > NAMX_MAXRSS) {
             errno = ENAMETOOLONG;
@@ -128,13 +128,13 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
 
 /* Arrange 32-bit pointer to (copied) string storage, if needed. */
 #if __INITIAL_POINTER_SIZE == 64
-# define CTX_FILESPEC ctx_filespec_32p
+#define CTX_FILESPEC ctx_filespec_32p
         /* Copy the file name to storage with a 32-bit pointer. */
         ctx_filespec_32p = ctx_filespec_32;
         strcpy(ctx_filespec_32p, (*ctx)->filespec);
-#else                           /* __INITIAL_POINTER_SIZE == 64 */
-# define CTX_FILESPEC (*ctx)->filespec
-#endif                          /* __INITIAL_POINTER_SIZE == 64 [else] */
+#else /* __INITIAL_POINTER_SIZE == 64 */
+#define CTX_FILESPEC (*ctx)->filespec
+#endif /* __INITIAL_POINTER_SIZE == 64 [else] */
 
         (*ctx)->filespec_dsc.dsc$w_length = filespeclen;
         (*ctx)->filespec_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
@@ -148,7 +148,7 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
     (*ctx)->result_dsc.dsc$a_pointer = 0;
 
     status = lib$find_file(&(*ctx)->filespec_dsc, &(*ctx)->result_dsc,
-                           &(*ctx)->VMS_context, 0, 0, 0, &flags);
+        &(*ctx)->VMS_context, 0, 0, 0, &flags);
 
     if (status == RMS$_NMF) {
         errno = 0;
diff --git a/crypto/openssl/crypto/LPdir_win.c b/crypto/openssl/crypto/LPdir_win.c
index 83cbe1fc0907..0b7504ce9de0 100644
--- a/crypto/openssl/crypto/LPdir_win.c
+++ b/crypto/openssl/crypto/LPdir_win.c
@@ -40,7 +40,7 @@
 #include <tchar.h>
 #include "internal/numbers.h"
 #ifndef LPDIR_H
-# include "LPdir.h"
+#include "LPdir.h"
 #endif
 
 /*
@@ -49,20 +49,20 @@
  * builds are compiled with -DUNICODE [as well as -D_UNICODE].
  */
 #if defined(LP_SYS_WINCE) && !defined(FindFirstFile)
-# define FindFirstFile FindFirstFileW
+#define FindFirstFile FindFirstFileW
 #endif
 #if defined(LP_SYS_WINCE) && !defined(FindNextFile)
-# define FindNextFile FindNextFileW
+#define FindNextFile FindNextFileW
 #endif
 
 #ifndef NAME_MAX
-# define NAME_MAX 255
+#define NAME_MAX 255
 #endif
 
 #ifdef CP_UTF8
-# define CP_DEFAULT CP_UTF8
+#define CP_DEFAULT CP_UTF8
 #else
-# define CP_DEFAULT CP_ACP
+#define CP_DEFAULT CP_ACP
 #endif
 
 struct LP_dir_context_st {
@@ -103,16 +103,17 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
             UINT cp;
 
             do {
-# ifdef CP_UTF8
+#ifdef CP_UTF8
                 if ((sz = MultiByteToWideChar((cp = CP_UTF8), 0,
-                                              directory, len_0,
-                                              NULL, 0)) > 0 ||
-                    GetLastError() != ERROR_NO_UNICODE_TRANSLATION)
+                         directory, len_0,
+                         NULL, 0))
+                        > 0
+                    || GetLastError() != ERROR_NO_UNICODE_TRANSLATION)
                     break;
-# endif
+#endif
                 sz = MultiByteToWideChar((cp = CP_ACP), 0,
-                                         directory, len_0,
-                                         NULL, 0);
+                    directory, len_0,
+                    NULL, 0);
             } while (0);
 
             if (sz > 0) {
@@ -122,7 +123,7 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
                  */
                 wdir = _alloca((sz + 2) * sizeof(TCHAR));
                 if (!MultiByteToWideChar(cp, 0, directory, len_0,
-                                         (WCHAR *)wdir, sz)) {
+                        (WCHAR *)wdir, sz)) {
                     free(*ctx);
                     *ctx = NULL;
                     errno = EINVAL;
@@ -187,14 +188,14 @@ const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
 
 #ifdef LP_MULTIBYTE_AVAILABLE
         if (!WideCharToMultiByte(CP_DEFAULT, 0, (WCHAR *)wdir, len_0,
-                                 (*ctx)->entry_name,
-                                 sizeof((*ctx)->entry_name), NULL, 0))
+                (*ctx)->entry_name,
+                sizeof((*ctx)->entry_name), NULL, 0))
 #endif
             for (index = 0; index < len_0; index++)
                 (*ctx)->entry_name[index] = (char)wdir[index];
     } else
         strncpy((*ctx)->entry_name, (const char *)(*ctx)->ctx.cFileName,
-                sizeof((*ctx)->entry_name) - 1);
+            sizeof((*ctx)->entry_name) - 1);
 
     (*ctx)->entry_name[sizeof((*ctx)->entry_name) - 1] = '\0';
 
diff --git a/crypto/openssl/crypto/LPdir_win32.c b/crypto/openssl/crypto/LPdir_win32.c
index b29e096ff30f..33b8261774c4 100644
--- a/crypto/openssl/crypto/LPdir_win32.c
+++ b/crypto/openssl/crypto/LPdir_win32.c
@@ -38,4 +38,6 @@
 
 #define LP_SYS_WIN32
 #define LP_MULTIBYTE_AVAILABLE
+/* clang-format off */
 #include "LPdir_win.c"
+/* clang-format on */
diff --git a/crypto/openssl/crypto/LPdir_wince.c b/crypto/openssl/crypto/LPdir_wince.c
index ebf89628272a..e4c883dcefe4 100644
--- a/crypto/openssl/crypto/LPdir_wince.c
+++ b/crypto/openssl/crypto/LPdir_wince.c
@@ -41,4 +41,6 @@
  * We might want to define LP_MULTIBYTE_AVAILABLE here.  It's currently under
  * investigation what the exact conditions would be
  */
+/* clang-format off */
 #include "LPdir_win.c"
+/* clang-format on */
diff --git a/crypto/openssl/crypto/aes/aes_cbc.c b/crypto/openssl/crypto/aes/aes_cbc.c
index f2d5381b86d7..a933fc50e5dd 100644
--- a/crypto/openssl/crypto/aes/aes_cbc.c
+++ b/crypto/openssl/crypto/aes/aes_cbc.c
@@ -18,14 +18,14 @@
 #include <openssl/modes.h>
 
 void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
-                     size_t len, const AES_KEY *key,
-                     unsigned char *ivec, const int enc)
+    size_t len, const AES_KEY *key,
+    unsigned char *ivec, const int enc)
 {
 
     if (enc)
         CRYPTO_cbc128_encrypt(in, out, len, key, ivec,
-                              (block128_f) AES_encrypt);
+            (block128_f)AES_encrypt);
     else
         CRYPTO_cbc128_decrypt(in, out, len, key, ivec,
-                              (block128_f) AES_decrypt);
+            (block128_f)AES_decrypt);
 }
diff --git a/crypto/openssl/crypto/aes/aes_cfb.c b/crypto/openssl/crypto/aes/aes_cfb.c
index e5fcbb87f609..e6a184a19f51 100644
--- a/crypto/openssl/crypto/aes/aes_cfb.c
+++ b/crypto/openssl/crypto/aes/aes_cfb.c
@@ -23,27 +23,27 @@
  */
 
 void AES_cfb128_encrypt(const unsigned char *in, unsigned char *out,
-                        size_t length, const AES_KEY *key,
-                        unsigned char *ivec, int *num, const int enc)
+    size_t length, const AES_KEY *key,
+    unsigned char *ivec, int *num, const int enc)
 {
 
     CRYPTO_cfb128_encrypt(in, out, length, key, ivec, num, enc,
-                          (block128_f) AES_encrypt);
+        (block128_f)AES_encrypt);
 }
 
 /* N.B. This expects the input to be packed, MS bit first */
 void AES_cfb1_encrypt(const unsigned char *in, unsigned char *out,
-                      size_t length, const AES_KEY *key,
-                      unsigned char *ivec, int *num, const int enc)
+    size_t length, const AES_KEY *key,
+    unsigned char *ivec, int *num, const int enc)
 {
     CRYPTO_cfb128_1_encrypt(in, out, length, key, ivec, num, enc,
-                            (block128_f) AES_encrypt);
+        (block128_f)AES_encrypt);
 }
 
 void AES_cfb8_encrypt(const unsigned char *in, unsigned char *out,
-                      size_t length, const AES_KEY *key,
-                      unsigned char *ivec, int *num, const int enc)
+    size_t length, const AES_KEY *key,
+    unsigned char *ivec, int *num, const int enc)
 {
     CRYPTO_cfb128_8_encrypt(in, out, length, key, ivec, num, enc,
-                            (block128_f) AES_encrypt);
+        (block128_f)AES_encrypt);
 }
diff --git a/crypto/openssl/crypto/aes/aes_core.c b/crypto/openssl/crypto/aes/aes_core.c
index 3413ce8f4378..b376e7e47d59 100644
--- a/crypto/openssl/crypto/aes/aes_core.c
+++ b/crypto/openssl/crypto/aes/aes_core.c
@@ -52,13 +52,13 @@
 
 #if defined(OPENSSL_AES_CONST_TIME) && !defined(AES_ASM)
 
-# if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
-#  define U64(C) C##UI64
-# elif defined(__arch64__)
-#  define U64(C) C##UL
-# else
-#  define U64(C) C##ULL
-# endif
+#if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
+#define U64(C) C##UI64
+#elif defined(__arch64__)
+#define U64(C) C##UL
+#else
+#define U64(C) C##ULL
+#endif
 
 typedef union {
     unsigned char b[8];
@@ -430,14 +430,14 @@ static void ShiftRows(u64 *state)
 
     s0 = (unsigned char *)state;
     for (r = 0; r < 4; r++) {
-        s[0] = s0[0*4 + r];
-        s[1] = s0[1*4 + r];
-        s[2] = s0[2*4 + r];
-        s[3] = s0[3*4 + r];
-        s0[0*4 + r] = s[(r+0) % 4];
-        s0[1*4 + r] = s[(r+1) % 4];
-        s0[2*4 + r] = s[(r+2) % 4];
-        s0[3*4 + r] = s[(r+3) % 4];
+        s[0] = s0[0 * 4 + r];
+        s[1] = s0[1 * 4 + r];
+        s[2] = s0[2 * 4 + r];
+        s[3] = s0[3 * 4 + r];
+        s0[0 * 4 + r] = s[(r + 0) % 4];
+        s0[1 * 4 + r] = s[(r + 1) % 4];
+        s0[2 * 4 + r] = s[(r + 2) % 4];
+        s0[3 * 4 + r] = s[(r + 3) % 4];
     }
 }
 
@@ -449,14 +449,14 @@ static void InvShiftRows(u64 *state)
 
     s0 = (unsigned char *)state;
     for (r = 0; r < 4; r++) {
-        s[0] = s0[0*4 + r];
-        s[1] = s0[1*4 + r];
-        s[2] = s0[2*4 + r];
-        s[3] = s0[3*4 + r];
-        s0[0*4 + r] = s[(4-r) % 4];
-        s0[1*4 + r] = s[(5-r) % 4];
-        s0[2*4 + r] = s[(6-r) % 4];
-        s0[3*4 + r] = s[(7-r) % 4];
+        s[0] = s0[0 * 4 + r];
+        s[1] = s0[1 * 4 + r];
+        s[2] = s0[2 * 4 + r];
+        s[3] = s0[3 * 4 + r];
+        s0[0 * 4 + r] = s[(4 - r) % 4];
+        s0[1 * 4 + r] = s[(5 - r) % 4];
+        s0[2 * 4 + r] = s[(6 - r) % 4];
+        s0[3 * 4 + r] = s[(7 - r) % 4];
     }
 }
 
@@ -470,9 +470,9 @@ static void MixColumns(u64 *state)
         s1.d = state[c];
         s.d = s1.d;
         s.d ^= ((s.d & U64(0xFFFF0000FFFF0000)) >> 16)
-               | ((s.d & U64(0x0000FFFF0000FFFF)) << 16);
+            | ((s.d & U64(0x0000FFFF0000FFFF)) << 16);
         s.d ^= ((s.d & U64(0xFF00FF00FF00FF00)) >> 8)
-               | ((s.d & U64(0x00FF00FF00FF00FF)) << 8);
+            | ((s.d & U64(0x00FF00FF00FF00FF)) << 8);
         s.d ^= s1.d;
         XtimeLong(&s1.d);
         s.d ^= s1.d;
@@ -498,9 +498,9 @@ static void InvMixColumns(u64 *state)
         s1.d = state[c];
         s.d = s1.d;
         s.d ^= ((s.d & U64(0xFFFF0000FFFF0000)) >> 16)
-               | ((s.d & U64(0x0000FFFF0000FFFF)) << 16);
+            | ((s.d & U64(0x0000FFFF0000FFFF)) << 16);
         s.d ^= ((s.d & U64(0xFF00FF00FF00FF00)) >> 8)
-               | ((s.d & U64(0x00FF00FF00FF00FF)) << 8);
+            | ((s.d & U64(0x00FF00FF00FF00FF)) << 8);
         s.d ^= s1.d;
         XtimeLong(&s1.d);
         s.d ^= s1.d;
@@ -514,11 +514,11 @@ static void InvMixColumns(u64 *state)
         s.b[7] ^= s1.b[4];
         XtimeLong(&s1.d);
         s1.d ^= ((s1.d & U64(0xFFFF0000FFFF0000)) >> 16)
-                | ((s1.d & U64(0x0000FFFF0000FFFF)) << 16);
+            | ((s1.d & U64(0x0000FFFF0000FFFF)) << 16);
         s.d ^= s1.d;
         XtimeLong(&s1.d);
         s1.d ^= ((s1.d & U64(0xFF00FF00FF00FF00)) >> 8)
-                | ((s1.d & U64(0x00FF00FF00FF00FF)) << 8);
+            | ((s1.d & U64(0x00FF00FF00FF00FF)) << 8);
         s.d ^= s1.d;
         state[c] = s.d;
     }
@@ -531,7 +531,7 @@ static void AddRoundKey(u64 *state, const u64 *w)
 }
 
 static void Cipher(const unsigned char *in, unsigned char *out,
-                   const u64 *w, int nr)
+    const u64 *w, int nr)
 {
     u64 state[2];
     int i;
@@ -545,19 +545,19 @@ static void Cipher(const unsigned char *in, unsigned char *out,
         SubLong(&state[1]);
         ShiftRows(state);
         MixColumns(state);
-        AddRoundKey(state, w + i*2);
+        AddRoundKey(state, w + i * 2);
     }
 
     SubLong(&state[0]);
     SubLong(&state[1]);
     ShiftRows(state);
-    AddRoundKey(state, w + nr*2);
+    AddRoundKey(state, w + nr * 2);
 
     memcpy(out, state, 16);
 }
 
 static void InvCipher(const unsigned char *in, unsigned char *out,
-                      const u64 *w, int nr)
+    const u64 *w, int nr)
 
 {
     u64 state[2];
@@ -565,13 +565,13 @@ static void InvCipher(const unsigned char *in, unsigned char *out,
 
     memcpy(state, in, 16);
 
-    AddRoundKey(state, w + nr*2);
+    AddRoundKey(state, w + nr * 2);
 
     for (i = nr - 1; i > 0; i--) {
         InvShiftRows(state);
         InvSubLong(&state[0]);
         InvSubLong(&state[1]);
-        AddRoundKey(state, w + i*2);
+        AddRoundKey(state, w + i * 2);
         InvMixColumns(state);
     }
 
@@ -597,18 +597,18 @@ static void RotWord(u32 *x)
 }
 
 static void KeyExpansion(const unsigned char *key, u64 *w,
-                         int nr, int nk)
+    int nr, int nk)
 {
     u32 rcon;
     uni prev;
     u32 temp;
     int i, n;
 
-    memcpy(w, key, nk*4);
+    memcpy(w, key, nk * 4);
     memcpy(&rcon, "\1\0\0\0", 4);
-    n = nk/2;
-    prev.d = w[n-1];
-    for (i = n; i < (nr+1)*2; i++) {
+    n = nk / 2;
+    prev.d = w[n - 1];
+    for (i = n; i < (nr + 1) * 2; i++) {
         temp = prev.w[1];
         if (i % n == 0) {
             RotWord(&temp);
@@ -618,7 +618,7 @@ static void KeyExpansion(const unsigned char *key, u64 *w,
         } else if (nk > 6 && i % n == 2) {
             SubWord(&temp);
         }
-        prev.d = w[i-n];
+        prev.d = w[i - n];
         prev.w[0] ^= temp;
         prev.w[1] ^= prev.w[0];
         w[i] = prev.d;
@@ -629,7 +629,7 @@ static void KeyExpansion(const unsigned char *key, u64 *w,
  * Expand the cipher key into the encryption key schedule.
  */
 int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key)
+    AES_KEY *key)
 {
     u64 *rk;
 
@@ -638,7 +638,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     if (bits != 128 && bits != 192 && bits != 256)
         return -2;
 
-    rk = (u64*)key->rd_key;
+    rk = (u64 *)key->rd_key;
 
     if (bits == 128)
         key->rounds = 10;
@@ -647,7 +647,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     else
         key->rounds = 14;
 
-    KeyExpansion(userKey, rk, key->rounds, bits/32);
+    KeyExpansion(userKey, rk, key->rounds, bits / 32);
     return 0;
 }
 
@@ -655,7 +655,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
  * Expand the cipher key into the decryption key schedule.
  */
 int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key)
+    AES_KEY *key)
 {
     return AES_set_encrypt_key(userKey, bits, key);
 }
@@ -665,12 +665,12 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
  * in and out can overlap
  */
 void AES_encrypt(const unsigned char *in, unsigned char *out,
-                 const AES_KEY *key)
+    const AES_KEY *key)
 {
     const u64 *rk;
 
     assert(in && out && key);
-    rk = (u64*)key->rd_key;
+    rk = (u64 *)key->rd_key;
 
     Cipher(in, out, rk, key->rounds);
 }
@@ -680,12 +680,12 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
  * in and out can overlap
  */
 void AES_decrypt(const unsigned char *in, unsigned char *out,
-                 const AES_KEY *key)
+    const AES_KEY *key)
 {
     const u64 *rk;
 
     assert(in && out && key);
-    rk = (u64*)key->rd_key;
+    rk = (u64 *)key->rd_key;
 
     InvCipher(in, out, rk, key->rounds);
 }
@@ -704,579 +704,2346 @@ Td4[x] = Si[x].[01];
 */
 
 static const u32 Te0[256] = {
-    0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
-    0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
-    0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
-    0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU,
-    0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U,
-    0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU,
-    0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU,
-    0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU,
-    0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU,
-    0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU,
-    0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U,
-    0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU,
-    0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU,
-    0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U,
-    0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU,
-    0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU,
-    0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU,
-    0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU,
-    0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU,
-    0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U,
-    0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU,
-    0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU,
-    0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU,
-    0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU,
-    0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U,
-    0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U,
-    0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U,
-    0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U,
-    0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU,
-    0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U,
-    0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U,
-    0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU,
-    0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU,
-    0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U,
-    0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U,
-    0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U,
-    0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU,
-    0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U,
-    0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU,
-    0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U,
-    0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU,
-    0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U,
-    0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U,
-    0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU,
-    0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U,
-    0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U,
-    0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U,
-    0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U,
-    0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U,
-    0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U,
-    0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U,
-    0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U,
-    0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU,
-    0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U,
-    0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U,
-    0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U,
-    0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U,
-    0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U,
-    0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U,
-    0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU,
-    0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U,
-    0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U,
-    0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
-    0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
+    0xc66363a5U,
+    0xf87c7c84U,
+    0xee777799U,
+    0xf67b7b8dU,
+    0xfff2f20dU,
+    0xd66b6bbdU,
+    0xde6f6fb1U,
+    0x91c5c554U,
+    0x60303050U,
+    0x02010103U,
+    0xce6767a9U,
+    0x562b2b7dU,
+    0xe7fefe19U,
+    0xb5d7d762U,
+    0x4dababe6U,
+    0xec76769aU,
+    0x8fcaca45U,
+    0x1f82829dU,
+    0x89c9c940U,
+    0xfa7d7d87U,
+    0xeffafa15U,
+    0xb25959ebU,
+    0x8e4747c9U,
+    0xfbf0f00bU,
+    0x41adadecU,
+    0xb3d4d467U,
+    0x5fa2a2fdU,
+    0x45afafeaU,
+    0x239c9cbfU,
+    0x53a4a4f7U,
+    0xe4727296U,
+    0x9bc0c05bU,
+    0x75b7b7c2U,
+    0xe1fdfd1cU,
+    0x3d9393aeU,
+    0x4c26266aU,
+    0x6c36365aU,
+    0x7e3f3f41U,
+    0xf5f7f702U,
+    0x83cccc4fU,
+    0x6834345cU,
+    0x51a5a5f4U,
+    0xd1e5e534U,
+    0xf9f1f108U,
+    0xe2717193U,
+    0xabd8d873U,
+    0x62313153U,
+    0x2a15153fU,
+    0x0804040cU,
+    0x95c7c752U,
+    0x46232365U,
+    0x9dc3c35eU,
+    0x30181828U,
+    0x379696a1U,
+    0x0a05050fU,
+    0x2f9a9ab5U,
+    0x0e070709U,
+    0x24121236U,
+    0x1b80809bU,
+    0xdfe2e23dU,
+    0xcdebeb26U,
+    0x4e272769U,
+    0x7fb2b2cdU,
+    0xea75759fU,
+    0x1209091bU,
+    0x1d83839eU,
+    0x582c2c74U,
+    0x341a1a2eU,
+    0x361b1b2dU,
+    0xdc6e6eb2U,
+    0xb45a5aeeU,
+    0x5ba0a0fbU,
+    0xa45252f6U,
+    0x763b3b4dU,
+    0xb7d6d661U,
+    0x7db3b3ceU,
+    0x5229297bU,
+    0xdde3e33eU,
+    0x5e2f2f71U,
+    0x13848497U,
+    0xa65353f5U,
+    0xb9d1d168U,
+    0x00000000U,
+    0xc1eded2cU,
+    0x40202060U,
+    0xe3fcfc1fU,
+    0x79b1b1c8U,
+    0xb65b5bedU,
+    0xd46a6abeU,
+    0x8dcbcb46U,
+    0x67bebed9U,
+    0x7239394bU,
+    0x944a4adeU,
+    0x984c4cd4U,
+    0xb05858e8U,
+    0x85cfcf4aU,
+    0xbbd0d06bU,
+    0xc5efef2aU,
+    0x4faaaae5U,
+    0xedfbfb16U,
+    0x864343c5U,
+    0x9a4d4dd7U,
+    0x66333355U,
+    0x11858594U,
+    0x8a4545cfU,
+    0xe9f9f910U,
+    0x04020206U,
+    0xfe7f7f81U,
+    0xa05050f0U,
+    0x783c3c44U,
+    0x259f9fbaU,
+    0x4ba8a8e3U,
+    0xa25151f3U,
+    0x5da3a3feU,
+    0x804040c0U,
+    0x058f8f8aU,
+    0x3f9292adU,
+    0x219d9dbcU,
+    0x70383848U,
+    0xf1f5f504U,
+    0x63bcbcdfU,
+    0x77b6b6c1U,
+    0xafdada75U,
+    0x42212163U,
+    0x20101030U,
+    0xe5ffff1aU,
+    0xfdf3f30eU,
+    0xbfd2d26dU,
+    0x81cdcd4cU,
+    0x180c0c14U,
+    0x26131335U,
+    0xc3ecec2fU,
+    0xbe5f5fe1U,
+    0x359797a2U,
+    0x884444ccU,
+    0x2e171739U,
+    0x93c4c457U,
+    0x55a7a7f2U,
+    0xfc7e7e82U,
+    0x7a3d3d47U,
+    0xc86464acU,
+    0xba5d5de7U,
+    0x3219192bU,
+    0xe6737395U,
+    0xc06060a0U,
+    0x19818198U,
+    0x9e4f4fd1U,
+    0xa3dcdc7fU,
+    0x44222266U,
+    0x542a2a7eU,
+    0x3b9090abU,
+    0x0b888883U,
+    0x8c4646caU,
+    0xc7eeee29U,
+    0x6bb8b8d3U,
+    0x2814143cU,
+    0xa7dede79U,
+    0xbc5e5ee2U,
+    0x160b0b1dU,
+    0xaddbdb76U,
+    0xdbe0e03bU,
+    0x64323256U,
+    0x743a3a4eU,
+    0x140a0a1eU,
+    0x924949dbU,
+    0x0c06060aU,
+    0x4824246cU,
+    0xb85c5ce4U,
+    0x9fc2c25dU,
+    0xbdd3d36eU,
+    0x43acacefU,
+    0xc46262a6U,
+    0x399191a8U,
+    0x319595a4U,
+    0xd3e4e437U,
+    0xf279798bU,
+    0xd5e7e732U,
+    0x8bc8c843U,
+    0x6e373759U,
+    0xda6d6db7U,
+    0x018d8d8cU,
+    0xb1d5d564U,
+    0x9c4e4ed2U,
+    0x49a9a9e0U,
+    0xd86c6cb4U,
+    0xac5656faU,
+    0xf3f4f407U,
+    0xcfeaea25U,
+    0xca6565afU,
+    0xf47a7a8eU,
+    0x47aeaee9U,
+    0x10080818U,
+    0x6fbabad5U,
+    0xf0787888U,
+    0x4a25256fU,
+    0x5c2e2e72U,
+    0x381c1c24U,
+    0x57a6a6f1U,
+    0x73b4b4c7U,
+    0x97c6c651U,
+    0xcbe8e823U,
+    0xa1dddd7cU,
+    0xe874749cU,
+    0x3e1f1f21U,
+    0x964b4bddU,
+    0x61bdbddcU,
+    0x0d8b8b86U,
+    0x0f8a8a85U,
+    0xe0707090U,
+    0x7c3e3e42U,
+    0x71b5b5c4U,
+    0xcc6666aaU,
+    0x904848d8U,
+    0x06030305U,
+    0xf7f6f601U,
+    0x1c0e0e12U,
+    0xc26161a3U,
+    0x6a35355fU,
+    0xae5757f9U,
+    0x69b9b9d0U,
+    0x17868691U,
+    0x99c1c158U,
+    0x3a1d1d27U,
+    0x279e9eb9U,
+    0xd9e1e138U,
+    0xebf8f813U,
+    0x2b9898b3U,
+    0x22111133U,
+    0xd26969bbU,
+    0xa9d9d970U,
+    0x078e8e89U,
+    0x339494a7U,
+    0x2d9b9bb6U,
+    0x3c1e1e22U,
+    0x15878792U,
+    0xc9e9e920U,
+    0x87cece49U,
+    0xaa5555ffU,
+    0x50282878U,
+    0xa5dfdf7aU,
+    0x038c8c8fU,
+    0x59a1a1f8U,
+    0x09898980U,
+    0x1a0d0d17U,
+    0x65bfbfdaU,
+    0xd7e6e631U,
+    0x844242c6U,
+    0xd06868b8U,
+    0x824141c3U,
+    0x299999b0U,
+    0x5a2d2d77U,
+    0x1e0f0f11U,
+    0x7bb0b0cbU,
+    0xa85454fcU,
+    0x6dbbbbd6U,
+    0x2c16163aU,
 };
 static const u32 Te1[256] = {
-    0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU,
-    0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U,
-    0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU,
-    0x19e7fefeU, 0x62b5d7d7U, 0xe64dababU, 0x9aec7676U,
-    0x458fcacaU, 0x9d1f8282U, 0x4089c9c9U, 0x87fa7d7dU,
-    0x15effafaU, 0xebb25959U, 0xc98e4747U, 0x0bfbf0f0U,
-    0xec41adadU, 0x67b3d4d4U, 0xfd5fa2a2U, 0xea45afafU,
-    0xbf239c9cU, 0xf753a4a4U, 0x96e47272U, 0x5b9bc0c0U,
-    0xc275b7b7U, 0x1ce1fdfdU, 0xae3d9393U, 0x6a4c2626U,
-    0x5a6c3636U, 0x417e3f3fU, 0x02f5f7f7U, 0x4f83ccccU,
-    0x5c683434U, 0xf451a5a5U, 0x34d1e5e5U, 0x08f9f1f1U,
-    0x93e27171U, 0x73abd8d8U, 0x53623131U, 0x3f2a1515U,
-    0x0c080404U, 0x5295c7c7U, 0x65462323U, 0x5e9dc3c3U,
-    0x28301818U, 0xa1379696U, 0x0f0a0505U, 0xb52f9a9aU,
-    0x090e0707U, 0x36241212U, 0x9b1b8080U, 0x3ddfe2e2U,
-    0x26cdebebU, 0x694e2727U, 0xcd7fb2b2U, 0x9fea7575U,
-    0x1b120909U, 0x9e1d8383U, 0x74582c2cU, 0x2e341a1aU,
-    0x2d361b1bU, 0xb2dc6e6eU, 0xeeb45a5aU, 0xfb5ba0a0U,
-    0xf6a45252U, 0x4d763b3bU, 0x61b7d6d6U, 0xce7db3b3U,
-    0x7b522929U, 0x3edde3e3U, 0x715e2f2fU, 0x97138484U,
-    0xf5a65353U, 0x68b9d1d1U, 0x00000000U, 0x2cc1ededU,
-    0x60402020U, 0x1fe3fcfcU, 0xc879b1b1U, 0xedb65b5bU,
-    0xbed46a6aU, 0x468dcbcbU, 0xd967bebeU, 0x4b723939U,
-    0xde944a4aU, 0xd4984c4cU, 0xe8b05858U, 0x4a85cfcfU,
-    0x6bbbd0d0U, 0x2ac5efefU, 0xe54faaaaU, 0x16edfbfbU,
-    0xc5864343U, 0xd79a4d4dU, 0x55663333U, 0x94118585U,
-    0xcf8a4545U, 0x10e9f9f9U, 0x06040202U, 0x81fe7f7fU,
-    0xf0a05050U, 0x44783c3cU, 0xba259f9fU, 0xe34ba8a8U,
-    0xf3a25151U, 0xfe5da3a3U, 0xc0804040U, 0x8a058f8fU,
-    0xad3f9292U, 0xbc219d9dU, 0x48703838U, 0x04f1f5f5U,
-    0xdf63bcbcU, 0xc177b6b6U, 0x75afdadaU, 0x63422121U,
-    0x30201010U, 0x1ae5ffffU, 0x0efdf3f3U, 0x6dbfd2d2U,
-    0x4c81cdcdU, 0x14180c0cU, 0x35261313U, 0x2fc3ececU,
-    0xe1be5f5fU, 0xa2359797U, 0xcc884444U, 0x392e1717U,
-    0x5793c4c4U, 0xf255a7a7U, 0x82fc7e7eU, 0x477a3d3dU,
-    0xacc86464U, 0xe7ba5d5dU, 0x2b321919U, 0x95e67373U,
-    0xa0c06060U, 0x98198181U, 0xd19e4f4fU, 0x7fa3dcdcU,
-    0x66442222U, 0x7e542a2aU, 0xab3b9090U, 0x830b8888U,
-    0xca8c4646U, 0x29c7eeeeU, 0xd36bb8b8U, 0x3c281414U,
-    0x79a7dedeU, 0xe2bc5e5eU, 0x1d160b0bU, 0x76addbdbU,
-    0x3bdbe0e0U, 0x56643232U, 0x4e743a3aU, 0x1e140a0aU,
-    0xdb924949U, 0x0a0c0606U, 0x6c482424U, 0xe4b85c5cU,
-    0x5d9fc2c2U, 0x6ebdd3d3U, 0xef43acacU, 0xa6c46262U,
-    0xa8399191U, 0xa4319595U, 0x37d3e4e4U, 0x8bf27979U,
-    0x32d5e7e7U, 0x438bc8c8U, 0x596e3737U, 0xb7da6d6dU,
-    0x8c018d8dU, 0x64b1d5d5U, 0xd29c4e4eU, 0xe049a9a9U,
-    0xb4d86c6cU, 0xfaac5656U, 0x07f3f4f4U, 0x25cfeaeaU,
-    0xafca6565U, 0x8ef47a7aU, 0xe947aeaeU, 0x18100808U,
-    0xd56fbabaU, 0x88f07878U, 0x6f4a2525U, 0x725c2e2eU,
-    0x24381c1cU, 0xf157a6a6U, 0xc773b4b4U, 0x5197c6c6U,
-    0x23cbe8e8U, 0x7ca1ddddU, 0x9ce87474U, 0x213e1f1fU,
-    0xdd964b4bU, 0xdc61bdbdU, 0x860d8b8bU, 0x850f8a8aU,
-    0x90e07070U, 0x427c3e3eU, 0xc471b5b5U, 0xaacc6666U,
-    0xd8904848U, 0x05060303U, 0x01f7f6f6U, 0x121c0e0eU,
-    0xa3c26161U, 0x5f6a3535U, 0xf9ae5757U, 0xd069b9b9U,
-    0x91178686U, 0x5899c1c1U, 0x273a1d1dU, 0xb9279e9eU,
-    0x38d9e1e1U, 0x13ebf8f8U, 0xb32b9898U, 0x33221111U,
-    0xbbd26969U, 0x70a9d9d9U, 0x89078e8eU, 0xa7339494U,
-    0xb62d9b9bU, 0x223c1e1eU, 0x92158787U, 0x20c9e9e9U,
-    0x4987ceceU, 0xffaa5555U, 0x78502828U, 0x7aa5dfdfU,
-    0x8f038c8cU, 0xf859a1a1U, 0x80098989U, 0x171a0d0dU,
-    0xda65bfbfU, 0x31d7e6e6U, 0xc6844242U, 0xb8d06868U,
-    0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU,
-    0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U,
+    0xa5c66363U,
+    0x84f87c7cU,
+    0x99ee7777U,
+    0x8df67b7bU,
+    0x0dfff2f2U,
+    0xbdd66b6bU,
+    0xb1de6f6fU,
+    0x5491c5c5U,
+    0x50603030U,
+    0x03020101U,
+    0xa9ce6767U,
+    0x7d562b2bU,
+    0x19e7fefeU,
+    0x62b5d7d7U,
+    0xe64dababU,
+    0x9aec7676U,
+    0x458fcacaU,
+    0x9d1f8282U,
+    0x4089c9c9U,
+    0x87fa7d7dU,
+    0x15effafaU,
+    0xebb25959U,
+    0xc98e4747U,
+    0x0bfbf0f0U,
+    0xec41adadU,
+    0x67b3d4d4U,
+    0xfd5fa2a2U,
+    0xea45afafU,
+    0xbf239c9cU,
+    0xf753a4a4U,
+    0x96e47272U,
+    0x5b9bc0c0U,
+    0xc275b7b7U,
+    0x1ce1fdfdU,
+    0xae3d9393U,
+    0x6a4c2626U,
+    0x5a6c3636U,
+    0x417e3f3fU,
+    0x02f5f7f7U,
+    0x4f83ccccU,
+    0x5c683434U,
+    0xf451a5a5U,
+    0x34d1e5e5U,
+    0x08f9f1f1U,
+    0x93e27171U,
+    0x73abd8d8U,
+    0x53623131U,
+    0x3f2a1515U,
+    0x0c080404U,
+    0x5295c7c7U,
+    0x65462323U,
+    0x5e9dc3c3U,
+    0x28301818U,
+    0xa1379696U,
+    0x0f0a0505U,
+    0xb52f9a9aU,
+    0x090e0707U,
+    0x36241212U,
+    0x9b1b8080U,
+    0x3ddfe2e2U,
+    0x26cdebebU,
+    0x694e2727U,
+    0xcd7fb2b2U,
+    0x9fea7575U,
+    0x1b120909U,
+    0x9e1d8383U,
+    0x74582c2cU,
+    0x2e341a1aU,
+    0x2d361b1bU,
+    0xb2dc6e6eU,
+    0xeeb45a5aU,
+    0xfb5ba0a0U,
+    0xf6a45252U,
+    0x4d763b3bU,
+    0x61b7d6d6U,
+    0xce7db3b3U,
+    0x7b522929U,
+    0x3edde3e3U,
+    0x715e2f2fU,
+    0x97138484U,
+    0xf5a65353U,
+    0x68b9d1d1U,
+    0x00000000U,
+    0x2cc1ededU,
+    0x60402020U,
+    0x1fe3fcfcU,
+    0xc879b1b1U,
+    0xedb65b5bU,
+    0xbed46a6aU,
+    0x468dcbcbU,
+    0xd967bebeU,
+    0x4b723939U,
+    0xde944a4aU,
+    0xd4984c4cU,
+    0xe8b05858U,
+    0x4a85cfcfU,
+    0x6bbbd0d0U,
+    0x2ac5efefU,
+    0xe54faaaaU,
+    0x16edfbfbU,
+    0xc5864343U,
+    0xd79a4d4dU,
+    0x55663333U,
+    0x94118585U,
+    0xcf8a4545U,
+    0x10e9f9f9U,
+    0x06040202U,
+    0x81fe7f7fU,
+    0xf0a05050U,
+    0x44783c3cU,
+    0xba259f9fU,
+    0xe34ba8a8U,
+    0xf3a25151U,
+    0xfe5da3a3U,
+    0xc0804040U,
+    0x8a058f8fU,
+    0xad3f9292U,
+    0xbc219d9dU,
+    0x48703838U,
+    0x04f1f5f5U,
+    0xdf63bcbcU,
+    0xc177b6b6U,
+    0x75afdadaU,
+    0x63422121U,
+    0x30201010U,
+    0x1ae5ffffU,
+    0x0efdf3f3U,
+    0x6dbfd2d2U,
+    0x4c81cdcdU,
+    0x14180c0cU,
+    0x35261313U,
+    0x2fc3ececU,
+    0xe1be5f5fU,
+    0xa2359797U,
+    0xcc884444U,
+    0x392e1717U,
+    0x5793c4c4U,
+    0xf255a7a7U,
+    0x82fc7e7eU,
+    0x477a3d3dU,
+    0xacc86464U,
+    0xe7ba5d5dU,
+    0x2b321919U,
+    0x95e67373U,
+    0xa0c06060U,
+    0x98198181U,
+    0xd19e4f4fU,
+    0x7fa3dcdcU,
+    0x66442222U,
+    0x7e542a2aU,
+    0xab3b9090U,
+    0x830b8888U,
+    0xca8c4646U,
+    0x29c7eeeeU,
+    0xd36bb8b8U,
+    0x3c281414U,
+    0x79a7dedeU,
+    0xe2bc5e5eU,
+    0x1d160b0bU,
+    0x76addbdbU,
+    0x3bdbe0e0U,
+    0x56643232U,
+    0x4e743a3aU,
+    0x1e140a0aU,
+    0xdb924949U,
+    0x0a0c0606U,
+    0x6c482424U,
+    0xe4b85c5cU,
+    0x5d9fc2c2U,
+    0x6ebdd3d3U,
+    0xef43acacU,
+    0xa6c46262U,
+    0xa8399191U,
+    0xa4319595U,
+    0x37d3e4e4U,
+    0x8bf27979U,
+    0x32d5e7e7U,
+    0x438bc8c8U,
+    0x596e3737U,
+    0xb7da6d6dU,
+    0x8c018d8dU,
+    0x64b1d5d5U,
+    0xd29c4e4eU,
+    0xe049a9a9U,
+    0xb4d86c6cU,
+    0xfaac5656U,
+    0x07f3f4f4U,
+    0x25cfeaeaU,
+    0xafca6565U,
+    0x8ef47a7aU,
+    0xe947aeaeU,
+    0x18100808U,
+    0xd56fbabaU,
+    0x88f07878U,
+    0x6f4a2525U,
+    0x725c2e2eU,
+    0x24381c1cU,
+    0xf157a6a6U,
+    0xc773b4b4U,
+    0x5197c6c6U,
+    0x23cbe8e8U,
+    0x7ca1ddddU,
+    0x9ce87474U,
+    0x213e1f1fU,
+    0xdd964b4bU,
+    0xdc61bdbdU,
+    0x860d8b8bU,
+    0x850f8a8aU,
+    0x90e07070U,
+    0x427c3e3eU,
+    0xc471b5b5U,
+    0xaacc6666U,
+    0xd8904848U,
+    0x05060303U,
+    0x01f7f6f6U,
+    0x121c0e0eU,
+    0xa3c26161U,
+    0x5f6a3535U,
+    0xf9ae5757U,
+    0xd069b9b9U,
+    0x91178686U,
+    0x5899c1c1U,
+    0x273a1d1dU,
+    0xb9279e9eU,
+    0x38d9e1e1U,
+    0x13ebf8f8U,
+    0xb32b9898U,
+    0x33221111U,
+    0xbbd26969U,
+    0x70a9d9d9U,
+    0x89078e8eU,
+    0xa7339494U,
+    0xb62d9b9bU,
+    0x223c1e1eU,
+    0x92158787U,
+    0x20c9e9e9U,
+    0x4987ceceU,
+    0xffaa5555U,
+    0x78502828U,
+    0x7aa5dfdfU,
+    0x8f038c8cU,
+    0xf859a1a1U,
+    0x80098989U,
+    0x171a0d0dU,
+    0xda65bfbfU,
+    0x31d7e6e6U,
+    0xc6844242U,
+    0xb8d06868U,
+    0xc3824141U,
+    0xb0299999U,
+    0x775a2d2dU,
+    0x111e0f0fU,
+    0xcb7bb0b0U,
+    0xfca85454U,
+    0xd66dbbbbU,
+    0x3a2c1616U,
 };
 static const u32 Te2[256] = {
-    0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU,
-    0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U,
-    0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU,
-    0xfe19e7feU, 0xd762b5d7U, 0xabe64dabU, 0x769aec76U,
-    0xca458fcaU, 0x829d1f82U, 0xc94089c9U, 0x7d87fa7dU,
-    0xfa15effaU, 0x59ebb259U, 0x47c98e47U, 0xf00bfbf0U,
-    0xadec41adU, 0xd467b3d4U, 0xa2fd5fa2U, 0xafea45afU,
-    0x9cbf239cU, 0xa4f753a4U, 0x7296e472U, 0xc05b9bc0U,
-    0xb7c275b7U, 0xfd1ce1fdU, 0x93ae3d93U, 0x266a4c26U,
-    0x365a6c36U, 0x3f417e3fU, 0xf702f5f7U, 0xcc4f83ccU,
-    0x345c6834U, 0xa5f451a5U, 0xe534d1e5U, 0xf108f9f1U,
-    0x7193e271U, 0xd873abd8U, 0x31536231U, 0x153f2a15U,
-    0x040c0804U, 0xc75295c7U, 0x23654623U, 0xc35e9dc3U,
-    0x18283018U, 0x96a13796U, 0x050f0a05U, 0x9ab52f9aU,
-    0x07090e07U, 0x12362412U, 0x809b1b80U, 0xe23ddfe2U,
-    0xeb26cdebU, 0x27694e27U, 0xb2cd7fb2U, 0x759fea75U,
-    0x091b1209U, 0x839e1d83U, 0x2c74582cU, 0x1a2e341aU,
-    0x1b2d361bU, 0x6eb2dc6eU, 0x5aeeb45aU, 0xa0fb5ba0U,
-    0x52f6a452U, 0x3b4d763bU, 0xd661b7d6U, 0xb3ce7db3U,
-    0x297b5229U, 0xe33edde3U, 0x2f715e2fU, 0x84971384U,
-    0x53f5a653U, 0xd168b9d1U, 0x00000000U, 0xed2cc1edU,
-    0x20604020U, 0xfc1fe3fcU, 0xb1c879b1U, 0x5bedb65bU,
-    0x6abed46aU, 0xcb468dcbU, 0xbed967beU, 0x394b7239U,
-    0x4ade944aU, 0x4cd4984cU, 0x58e8b058U, 0xcf4a85cfU,
-    0xd06bbbd0U, 0xef2ac5efU, 0xaae54faaU, 0xfb16edfbU,
-    0x43c58643U, 0x4dd79a4dU, 0x33556633U, 0x85941185U,
-    0x45cf8a45U, 0xf910e9f9U, 0x02060402U, 0x7f81fe7fU,
-    0x50f0a050U, 0x3c44783cU, 0x9fba259fU, 0xa8e34ba8U,
-    0x51f3a251U, 0xa3fe5da3U, 0x40c08040U, 0x8f8a058fU,
-    0x92ad3f92U, 0x9dbc219dU, 0x38487038U, 0xf504f1f5U,
-    0xbcdf63bcU, 0xb6c177b6U, 0xda75afdaU, 0x21634221U,
-    0x10302010U, 0xff1ae5ffU, 0xf30efdf3U, 0xd26dbfd2U,
-    0xcd4c81cdU, 0x0c14180cU, 0x13352613U, 0xec2fc3ecU,
-    0x5fe1be5fU, 0x97a23597U, 0x44cc8844U, 0x17392e17U,
-    0xc45793c4U, 0xa7f255a7U, 0x7e82fc7eU, 0x3d477a3dU,
-    0x64acc864U, 0x5de7ba5dU, 0x192b3219U, 0x7395e673U,
-    0x60a0c060U, 0x81981981U, 0x4fd19e4fU, 0xdc7fa3dcU,
-    0x22664422U, 0x2a7e542aU, 0x90ab3b90U, 0x88830b88U,
-    0x46ca8c46U, 0xee29c7eeU, 0xb8d36bb8U, 0x143c2814U,
-    0xde79a7deU, 0x5ee2bc5eU, 0x0b1d160bU, 0xdb76addbU,
-    0xe03bdbe0U, 0x32566432U, 0x3a4e743aU, 0x0a1e140aU,
-    0x49db9249U, 0x060a0c06U, 0x246c4824U, 0x5ce4b85cU,
-    0xc25d9fc2U, 0xd36ebdd3U, 0xacef43acU, 0x62a6c462U,
-    0x91a83991U, 0x95a43195U, 0xe437d3e4U, 0x798bf279U,
-    0xe732d5e7U, 0xc8438bc8U, 0x37596e37U, 0x6db7da6dU,
-    0x8d8c018dU, 0xd564b1d5U, 0x4ed29c4eU, 0xa9e049a9U,
-    0x6cb4d86cU, 0x56faac56U, 0xf407f3f4U, 0xea25cfeaU,
-    0x65afca65U, 0x7a8ef47aU, 0xaee947aeU, 0x08181008U,
-    0xbad56fbaU, 0x7888f078U, 0x256f4a25U, 0x2e725c2eU,
-    0x1c24381cU, 0xa6f157a6U, 0xb4c773b4U, 0xc65197c6U,
-    0xe823cbe8U, 0xdd7ca1ddU, 0x749ce874U, 0x1f213e1fU,
-    0x4bdd964bU, 0xbddc61bdU, 0x8b860d8bU, 0x8a850f8aU,
-    0x7090e070U, 0x3e427c3eU, 0xb5c471b5U, 0x66aacc66U,
-    0x48d89048U, 0x03050603U, 0xf601f7f6U, 0x0e121c0eU,
-    0x61a3c261U, 0x355f6a35U, 0x57f9ae57U, 0xb9d069b9U,
-    0x86911786U, 0xc15899c1U, 0x1d273a1dU, 0x9eb9279eU,
-    0xe138d9e1U, 0xf813ebf8U, 0x98b32b98U, 0x11332211U,
-    0x69bbd269U, 0xd970a9d9U, 0x8e89078eU, 0x94a73394U,
-    0x9bb62d9bU, 0x1e223c1eU, 0x87921587U, 0xe920c9e9U,
-    0xce4987ceU, 0x55ffaa55U, 0x28785028U, 0xdf7aa5dfU,
-    0x8c8f038cU, 0xa1f859a1U, 0x89800989U, 0x0d171a0dU,
-    0xbfda65bfU, 0xe631d7e6U, 0x42c68442U, 0x68b8d068U,
-    0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU,
-    0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
+    0x63a5c663U,
+    0x7c84f87cU,
+    0x7799ee77U,
+    0x7b8df67bU,
+    0xf20dfff2U,
+    0x6bbdd66bU,
+    0x6fb1de6fU,
+    0xc55491c5U,
+    0x30506030U,
+    0x01030201U,
+    0x67a9ce67U,
+    0x2b7d562bU,
+    0xfe19e7feU,
+    0xd762b5d7U,
+    0xabe64dabU,
+    0x769aec76U,
+    0xca458fcaU,
+    0x829d1f82U,
+    0xc94089c9U,
+    0x7d87fa7dU,
+    0xfa15effaU,
+    0x59ebb259U,
+    0x47c98e47U,
+    0xf00bfbf0U,
+    0xadec41adU,
+    0xd467b3d4U,
+    0xa2fd5fa2U,
+    0xafea45afU,
+    0x9cbf239cU,
+    0xa4f753a4U,
+    0x7296e472U,
+    0xc05b9bc0U,
+    0xb7c275b7U,
+    0xfd1ce1fdU,
+    0x93ae3d93U,
+    0x266a4c26U,
+    0x365a6c36U,
+    0x3f417e3fU,
+    0xf702f5f7U,
+    0xcc4f83ccU,
+    0x345c6834U,
+    0xa5f451a5U,
+    0xe534d1e5U,
+    0xf108f9f1U,
+    0x7193e271U,
+    0xd873abd8U,
+    0x31536231U,
+    0x153f2a15U,
+    0x040c0804U,
+    0xc75295c7U,
+    0x23654623U,
+    0xc35e9dc3U,
+    0x18283018U,
+    0x96a13796U,
+    0x050f0a05U,
+    0x9ab52f9aU,
+    0x07090e07U,
+    0x12362412U,
+    0x809b1b80U,
+    0xe23ddfe2U,
+    0xeb26cdebU,
+    0x27694e27U,
+    0xb2cd7fb2U,
+    0x759fea75U,
+    0x091b1209U,
+    0x839e1d83U,
+    0x2c74582cU,
+    0x1a2e341aU,
+    0x1b2d361bU,
+    0x6eb2dc6eU,
+    0x5aeeb45aU,
+    0xa0fb5ba0U,
+    0x52f6a452U,
+    0x3b4d763bU,
+    0xd661b7d6U,
+    0xb3ce7db3U,
+    0x297b5229U,
+    0xe33edde3U,
+    0x2f715e2fU,
+    0x84971384U,
+    0x53f5a653U,
+    0xd168b9d1U,
+    0x00000000U,
+    0xed2cc1edU,
+    0x20604020U,
+    0xfc1fe3fcU,
+    0xb1c879b1U,
+    0x5bedb65bU,
+    0x6abed46aU,
+    0xcb468dcbU,
+    0xbed967beU,
+    0x394b7239U,
+    0x4ade944aU,
+    0x4cd4984cU,
+    0x58e8b058U,
+    0xcf4a85cfU,
+    0xd06bbbd0U,
+    0xef2ac5efU,
+    0xaae54faaU,
+    0xfb16edfbU,
+    0x43c58643U,
+    0x4dd79a4dU,
+    0x33556633U,
+    0x85941185U,
+    0x45cf8a45U,
+    0xf910e9f9U,
+    0x02060402U,
+    0x7f81fe7fU,
+    0x50f0a050U,
+    0x3c44783cU,
+    0x9fba259fU,
+    0xa8e34ba8U,
+    0x51f3a251U,
+    0xa3fe5da3U,
+    0x40c08040U,
+    0x8f8a058fU,
+    0x92ad3f92U,
+    0x9dbc219dU,
+    0x38487038U,
+    0xf504f1f5U,
+    0xbcdf63bcU,
+    0xb6c177b6U,
+    0xda75afdaU,
+    0x21634221U,
+    0x10302010U,
+    0xff1ae5ffU,
+    0xf30efdf3U,
+    0xd26dbfd2U,
+    0xcd4c81cdU,
+    0x0c14180cU,
+    0x13352613U,
+    0xec2fc3ecU,
+    0x5fe1be5fU,
+    0x97a23597U,
+    0x44cc8844U,
+    0x17392e17U,
+    0xc45793c4U,
+    0xa7f255a7U,
+    0x7e82fc7eU,
+    0x3d477a3dU,
+    0x64acc864U,
+    0x5de7ba5dU,
+    0x192b3219U,
+    0x7395e673U,
+    0x60a0c060U,
+    0x81981981U,
+    0x4fd19e4fU,
+    0xdc7fa3dcU,
+    0x22664422U,
+    0x2a7e542aU,
+    0x90ab3b90U,
+    0x88830b88U,
+    0x46ca8c46U,
+    0xee29c7eeU,
+    0xb8d36bb8U,
+    0x143c2814U,
+    0xde79a7deU,
+    0x5ee2bc5eU,
+    0x0b1d160bU,
+    0xdb76addbU,
+    0xe03bdbe0U,
+    0x32566432U,
+    0x3a4e743aU,
+    0x0a1e140aU,
+    0x49db9249U,
+    0x060a0c06U,
+    0x246c4824U,
+    0x5ce4b85cU,
+    0xc25d9fc2U,
+    0xd36ebdd3U,
+    0xacef43acU,
+    0x62a6c462U,
+    0x91a83991U,
+    0x95a43195U,
+    0xe437d3e4U,
+    0x798bf279U,
+    0xe732d5e7U,
+    0xc8438bc8U,
+    0x37596e37U,
+    0x6db7da6dU,
+    0x8d8c018dU,
+    0xd564b1d5U,
+    0x4ed29c4eU,
+    0xa9e049a9U,
+    0x6cb4d86cU,
+    0x56faac56U,
+    0xf407f3f4U,
+    0xea25cfeaU,
+    0x65afca65U,
+    0x7a8ef47aU,
+    0xaee947aeU,
+    0x08181008U,
+    0xbad56fbaU,
+    0x7888f078U,
+    0x256f4a25U,
+    0x2e725c2eU,
+    0x1c24381cU,
+    0xa6f157a6U,
+    0xb4c773b4U,
+    0xc65197c6U,
+    0xe823cbe8U,
+    0xdd7ca1ddU,
+    0x749ce874U,
+    0x1f213e1fU,
+    0x4bdd964bU,
+    0xbddc61bdU,
+    0x8b860d8bU,
+    0x8a850f8aU,
+    0x7090e070U,
+    0x3e427c3eU,
+    0xb5c471b5U,
+    0x66aacc66U,
+    0x48d89048U,
+    0x03050603U,
+    0xf601f7f6U,
+    0x0e121c0eU,
+    0x61a3c261U,
+    0x355f6a35U,
+    0x57f9ae57U,
+    0xb9d069b9U,
+    0x86911786U,
+    0xc15899c1U,
+    0x1d273a1dU,
+    0x9eb9279eU,
+    0xe138d9e1U,
+    0xf813ebf8U,
+    0x98b32b98U,
+    0x11332211U,
+    0x69bbd269U,
+    0xd970a9d9U,
+    0x8e89078eU,
+    0x94a73394U,
+    0x9bb62d9bU,
+    0x1e223c1eU,
+    0x87921587U,
+    0xe920c9e9U,
+    0xce4987ceU,
+    0x55ffaa55U,
+    0x28785028U,
+    0xdf7aa5dfU,
+    0x8c8f038cU,
+    0xa1f859a1U,
+    0x89800989U,
+    0x0d171a0dU,
+    0xbfda65bfU,
+    0xe631d7e6U,
+    0x42c68442U,
+    0x68b8d068U,
+    0x41c38241U,
+    0x99b02999U,
+    0x2d775a2dU,
+    0x0f111e0fU,
+    0xb0cb7bb0U,
+    0x54fca854U,
+    0xbbd66dbbU,
+    0x163a2c16U,
 };
 static const u32 Te3[256] = {
-    0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
-    0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
-    0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
-    0xfefe19e7U, 0xd7d762b5U, 0xababe64dU, 0x76769aecU,
-    0xcaca458fU, 0x82829d1fU, 0xc9c94089U, 0x7d7d87faU,
-    0xfafa15efU, 0x5959ebb2U, 0x4747c98eU, 0xf0f00bfbU,
-    0xadadec41U, 0xd4d467b3U, 0xa2a2fd5fU, 0xafafea45U,
-    0x9c9cbf23U, 0xa4a4f753U, 0x727296e4U, 0xc0c05b9bU,
-    0xb7b7c275U, 0xfdfd1ce1U, 0x9393ae3dU, 0x26266a4cU,
-    0x36365a6cU, 0x3f3f417eU, 0xf7f702f5U, 0xcccc4f83U,
-    0x34345c68U, 0xa5a5f451U, 0xe5e534d1U, 0xf1f108f9U,
-    0x717193e2U, 0xd8d873abU, 0x31315362U, 0x15153f2aU,
-    0x04040c08U, 0xc7c75295U, 0x23236546U, 0xc3c35e9dU,
-    0x18182830U, 0x9696a137U, 0x05050f0aU, 0x9a9ab52fU,
-    0x0707090eU, 0x12123624U, 0x80809b1bU, 0xe2e23ddfU,
-    0xebeb26cdU, 0x2727694eU, 0xb2b2cd7fU, 0x75759feaU,
-    0x09091b12U, 0x83839e1dU, 0x2c2c7458U, 0x1a1a2e34U,
-    0x1b1b2d36U, 0x6e6eb2dcU, 0x5a5aeeb4U, 0xa0a0fb5bU,
-    0x5252f6a4U, 0x3b3b4d76U, 0xd6d661b7U, 0xb3b3ce7dU,
-    0x29297b52U, 0xe3e33eddU, 0x2f2f715eU, 0x84849713U,
-    0x5353f5a6U, 0xd1d168b9U, 0x00000000U, 0xeded2cc1U,
-    0x20206040U, 0xfcfc1fe3U, 0xb1b1c879U, 0x5b5bedb6U,
-    0x6a6abed4U, 0xcbcb468dU, 0xbebed967U, 0x39394b72U,
-    0x4a4ade94U, 0x4c4cd498U, 0x5858e8b0U, 0xcfcf4a85U,
-    0xd0d06bbbU, 0xefef2ac5U, 0xaaaae54fU, 0xfbfb16edU,
-    0x4343c586U, 0x4d4dd79aU, 0x33335566U, 0x85859411U,
-    0x4545cf8aU, 0xf9f910e9U, 0x02020604U, 0x7f7f81feU,
-    0x5050f0a0U, 0x3c3c4478U, 0x9f9fba25U, 0xa8a8e34bU,
-    0x5151f3a2U, 0xa3a3fe5dU, 0x4040c080U, 0x8f8f8a05U,
-    0x9292ad3fU, 0x9d9dbc21U, 0x38384870U, 0xf5f504f1U,
-    0xbcbcdf63U, 0xb6b6c177U, 0xdada75afU, 0x21216342U,
-    0x10103020U, 0xffff1ae5U, 0xf3f30efdU, 0xd2d26dbfU,
-    0xcdcd4c81U, 0x0c0c1418U, 0x13133526U, 0xecec2fc3U,
-    0x5f5fe1beU, 0x9797a235U, 0x4444cc88U, 0x1717392eU,
-    0xc4c45793U, 0xa7a7f255U, 0x7e7e82fcU, 0x3d3d477aU,
-    0x6464acc8U, 0x5d5de7baU, 0x19192b32U, 0x737395e6U,
-    0x6060a0c0U, 0x81819819U, 0x4f4fd19eU, 0xdcdc7fa3U,
-    0x22226644U, 0x2a2a7e54U, 0x9090ab3bU, 0x8888830bU,
-    0x4646ca8cU, 0xeeee29c7U, 0xb8b8d36bU, 0x14143c28U,
-    0xdede79a7U, 0x5e5ee2bcU, 0x0b0b1d16U, 0xdbdb76adU,
-    0xe0e03bdbU, 0x32325664U, 0x3a3a4e74U, 0x0a0a1e14U,
-    0x4949db92U, 0x06060a0cU, 0x24246c48U, 0x5c5ce4b8U,
-    0xc2c25d9fU, 0xd3d36ebdU, 0xacacef43U, 0x6262a6c4U,
-    0x9191a839U, 0x9595a431U, 0xe4e437d3U, 0x79798bf2U,
-    0xe7e732d5U, 0xc8c8438bU, 0x3737596eU, 0x6d6db7daU,
-    0x8d8d8c01U, 0xd5d564b1U, 0x4e4ed29cU, 0xa9a9e049U,
-    0x6c6cb4d8U, 0x5656faacU, 0xf4f407f3U, 0xeaea25cfU,
-    0x6565afcaU, 0x7a7a8ef4U, 0xaeaee947U, 0x08081810U,
-    0xbabad56fU, 0x787888f0U, 0x25256f4aU, 0x2e2e725cU,
-    0x1c1c2438U, 0xa6a6f157U, 0xb4b4c773U, 0xc6c65197U,
-    0xe8e823cbU, 0xdddd7ca1U, 0x74749ce8U, 0x1f1f213eU,
-    0x4b4bdd96U, 0xbdbddc61U, 0x8b8b860dU, 0x8a8a850fU,
-    0x707090e0U, 0x3e3e427cU, 0xb5b5c471U, 0x6666aaccU,
-    0x4848d890U, 0x03030506U, 0xf6f601f7U, 0x0e0e121cU,
-    0x6161a3c2U, 0x35355f6aU, 0x5757f9aeU, 0xb9b9d069U,
-    0x86869117U, 0xc1c15899U, 0x1d1d273aU, 0x9e9eb927U,
-    0xe1e138d9U, 0xf8f813ebU, 0x9898b32bU, 0x11113322U,
-    0x6969bbd2U, 0xd9d970a9U, 0x8e8e8907U, 0x9494a733U,
-    0x9b9bb62dU, 0x1e1e223cU, 0x87879215U, 0xe9e920c9U,
-    0xcece4987U, 0x5555ffaaU, 0x28287850U, 0xdfdf7aa5U,
-    0x8c8c8f03U, 0xa1a1f859U, 0x89898009U, 0x0d0d171aU,
-    0xbfbfda65U, 0xe6e631d7U, 0x4242c684U, 0x6868b8d0U,
-    0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
-    0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
+    0x6363a5c6U,
+    0x7c7c84f8U,
+    0x777799eeU,
+    0x7b7b8df6U,
+    0xf2f20dffU,
+    0x6b6bbdd6U,
+    0x6f6fb1deU,
+    0xc5c55491U,
+    0x30305060U,
+    0x01010302U,
+    0x6767a9ceU,
+    0x2b2b7d56U,
+    0xfefe19e7U,
+    0xd7d762b5U,
+    0xababe64dU,
+    0x76769aecU,
+    0xcaca458fU,
+    0x82829d1fU,
+    0xc9c94089U,
+    0x7d7d87faU,
+    0xfafa15efU,
+    0x5959ebb2U,
+    0x4747c98eU,
+    0xf0f00bfbU,
+    0xadadec41U,
+    0xd4d467b3U,
+    0xa2a2fd5fU,
+    0xafafea45U,
+    0x9c9cbf23U,
+    0xa4a4f753U,
+    0x727296e4U,
+    0xc0c05b9bU,
+    0xb7b7c275U,
+    0xfdfd1ce1U,
+    0x9393ae3dU,
+    0x26266a4cU,
+    0x36365a6cU,
+    0x3f3f417eU,
+    0xf7f702f5U,
+    0xcccc4f83U,
+    0x34345c68U,
+    0xa5a5f451U,
+    0xe5e534d1U,
+    0xf1f108f9U,
+    0x717193e2U,
+    0xd8d873abU,
+    0x31315362U,
+    0x15153f2aU,
+    0x04040c08U,
+    0xc7c75295U,
+    0x23236546U,
+    0xc3c35e9dU,
+    0x18182830U,
+    0x9696a137U,
+    0x05050f0aU,
+    0x9a9ab52fU,
+    0x0707090eU,
+    0x12123624U,
+    0x80809b1bU,
+    0xe2e23ddfU,
+    0xebeb26cdU,
+    0x2727694eU,
+    0xb2b2cd7fU,
+    0x75759feaU,
+    0x09091b12U,
+    0x83839e1dU,
+    0x2c2c7458U,
+    0x1a1a2e34U,
+    0x1b1b2d36U,
+    0x6e6eb2dcU,
+    0x5a5aeeb4U,
+    0xa0a0fb5bU,
+    0x5252f6a4U,
+    0x3b3b4d76U,
+    0xd6d661b7U,
+    0xb3b3ce7dU,
+    0x29297b52U,
+    0xe3e33eddU,
+    0x2f2f715eU,
+    0x84849713U,
+    0x5353f5a6U,
+    0xd1d168b9U,
+    0x00000000U,
+    0xeded2cc1U,
+    0x20206040U,
+    0xfcfc1fe3U,
+    0xb1b1c879U,
+    0x5b5bedb6U,
+    0x6a6abed4U,
+    0xcbcb468dU,
+    0xbebed967U,
+    0x39394b72U,
+    0x4a4ade94U,
+    0x4c4cd498U,
+    0x5858e8b0U,
+    0xcfcf4a85U,
+    0xd0d06bbbU,
+    0xefef2ac5U,
+    0xaaaae54fU,
+    0xfbfb16edU,
+    0x4343c586U,
+    0x4d4dd79aU,
+    0x33335566U,
+    0x85859411U,
+    0x4545cf8aU,
+    0xf9f910e9U,
+    0x02020604U,
+    0x7f7f81feU,
+    0x5050f0a0U,
+    0x3c3c4478U,
+    0x9f9fba25U,
+    0xa8a8e34bU,
+    0x5151f3a2U,
+    0xa3a3fe5dU,
+    0x4040c080U,
+    0x8f8f8a05U,
+    0x9292ad3fU,
+    0x9d9dbc21U,
+    0x38384870U,
+    0xf5f504f1U,
+    0xbcbcdf63U,
+    0xb6b6c177U,
+    0xdada75afU,
+    0x21216342U,
+    0x10103020U,
+    0xffff1ae5U,
+    0xf3f30efdU,
+    0xd2d26dbfU,
+    0xcdcd4c81U,
+    0x0c0c1418U,
+    0x13133526U,
+    0xecec2fc3U,
+    0x5f5fe1beU,
+    0x9797a235U,
+    0x4444cc88U,
+    0x1717392eU,
+    0xc4c45793U,
+    0xa7a7f255U,
+    0x7e7e82fcU,
+    0x3d3d477aU,
+    0x6464acc8U,
+    0x5d5de7baU,
+    0x19192b32U,
+    0x737395e6U,
+    0x6060a0c0U,
+    0x81819819U,
+    0x4f4fd19eU,
+    0xdcdc7fa3U,
+    0x22226644U,
+    0x2a2a7e54U,
+    0x9090ab3bU,
+    0x8888830bU,
+    0x4646ca8cU,
+    0xeeee29c7U,
+    0xb8b8d36bU,
+    0x14143c28U,
+    0xdede79a7U,
+    0x5e5ee2bcU,
+    0x0b0b1d16U,
+    0xdbdb76adU,
+    0xe0e03bdbU,
+    0x32325664U,
+    0x3a3a4e74U,
+    0x0a0a1e14U,
+    0x4949db92U,
+    0x06060a0cU,
+    0x24246c48U,
+    0x5c5ce4b8U,
+    0xc2c25d9fU,
+    0xd3d36ebdU,
+    0xacacef43U,
+    0x6262a6c4U,
+    0x9191a839U,
+    0x9595a431U,
+    0xe4e437d3U,
+    0x79798bf2U,
+    0xe7e732d5U,
+    0xc8c8438bU,
+    0x3737596eU,
+    0x6d6db7daU,
+    0x8d8d8c01U,
+    0xd5d564b1U,
+    0x4e4ed29cU,
+    0xa9a9e049U,
+    0x6c6cb4d8U,
+    0x5656faacU,
+    0xf4f407f3U,
+    0xeaea25cfU,
+    0x6565afcaU,
+    0x7a7a8ef4U,
+    0xaeaee947U,
+    0x08081810U,
+    0xbabad56fU,
+    0x787888f0U,
+    0x25256f4aU,
+    0x2e2e725cU,
+    0x1c1c2438U,
+    0xa6a6f157U,
+    0xb4b4c773U,
+    0xc6c65197U,
+    0xe8e823cbU,
+    0xdddd7ca1U,
+    0x74749ce8U,
+    0x1f1f213eU,
+    0x4b4bdd96U,
+    0xbdbddc61U,
+    0x8b8b860dU,
+    0x8a8a850fU,
+    0x707090e0U,
+    0x3e3e427cU,
+    0xb5b5c471U,
+    0x6666aaccU,
+    0x4848d890U,
+    0x03030506U,
+    0xf6f601f7U,
+    0x0e0e121cU,
+    0x6161a3c2U,
+    0x35355f6aU,
+    0x5757f9aeU,
+    0xb9b9d069U,
+    0x86869117U,
+    0xc1c15899U,
+    0x1d1d273aU,
+    0x9e9eb927U,
+    0xe1e138d9U,
+    0xf8f813ebU,
+    0x9898b32bU,
+    0x11113322U,
+    0x6969bbd2U,
+    0xd9d970a9U,
+    0x8e8e8907U,
+    0x9494a733U,
+    0x9b9bb62dU,
+    0x1e1e223cU,
+    0x87879215U,
+    0xe9e920c9U,
+    0xcece4987U,
+    0x5555ffaaU,
+    0x28287850U,
+    0xdfdf7aa5U,
+    0x8c8c8f03U,
+    0xa1a1f859U,
+    0x89898009U,
+    0x0d0d171aU,
+    0xbfbfda65U,
+    0xe6e631d7U,
+    0x4242c684U,
+    0x6868b8d0U,
+    0x4141c382U,
+    0x9999b029U,
+    0x2d2d775aU,
+    0x0f0f111eU,
+    0xb0b0cb7bU,
+    0x5454fca8U,
+    0xbbbbd66dU,
+    0x16163a2cU,
 };
 
 static const u32 Td0[256] = {
-    0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
-    0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
-    0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
-    0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU,
-    0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U,
-    0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U,
-    0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU,
-    0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U,
-    0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU,
-    0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U,
-    0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U,
-    0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U,
-    0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U,
-    0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU,
-    0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U,
-    0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU,
-    0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U,
-    0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU,
-    0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U,
-    0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U,
-    0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U,
-    0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU,
-    0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U,
-    0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU,
-    0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U,
-    0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU,
-    0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U,
-    0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU,
-    0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU,
-    0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U,
-    0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU,
-    0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U,
-    0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU,
-    0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U,
-    0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U,
-    0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U,
-    0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU,
-    0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U,
-    0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U,
-    0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU,
-    0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U,
-    0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U,
-    0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U,
-    0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U,
-    0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U,
-    0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU,
-    0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U,
-    0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U,
-    0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U,
-    0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U,
-    0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U,
-    0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU,
-    0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU,
-    0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU,
-    0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU,
-    0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U,
-    0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U,
-    0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU,
-    0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU,
-    0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U,
-    0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU,
-    0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U,
-    0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
-    0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
+    0x51f4a750U,
+    0x7e416553U,
+    0x1a17a4c3U,
+    0x3a275e96U,
+    0x3bab6bcbU,
+    0x1f9d45f1U,
+    0xacfa58abU,
+    0x4be30393U,
+    0x2030fa55U,
+    0xad766df6U,
+    0x88cc7691U,
+    0xf5024c25U,
+    0x4fe5d7fcU,
+    0xc52acbd7U,
+    0x26354480U,
+    0xb562a38fU,
+    0xdeb15a49U,
+    0x25ba1b67U,
+    0x45ea0e98U,
+    0x5dfec0e1U,
+    0xc32f7502U,
+    0x814cf012U,
+    0x8d4697a3U,
+    0x6bd3f9c6U,
+    0x038f5fe7U,
+    0x15929c95U,
+    0xbf6d7aebU,
+    0x955259daU,
+    0xd4be832dU,
+    0x587421d3U,
+    0x49e06929U,
+    0x8ec9c844U,
+    0x75c2896aU,
+    0xf48e7978U,
+    0x99583e6bU,
+    0x27b971ddU,
+    0xbee14fb6U,
+    0xf088ad17U,
+    0xc920ac66U,
+    0x7dce3ab4U,
+    0x63df4a18U,
+    0xe51a3182U,
+    0x97513360U,
+    0x62537f45U,
+    0xb16477e0U,
+    0xbb6bae84U,
+    0xfe81a01cU,
+    0xf9082b94U,
+    0x70486858U,
+    0x8f45fd19U,
+    0x94de6c87U,
+    0x527bf8b7U,
+    0xab73d323U,
+    0x724b02e2U,
+    0xe31f8f57U,
+    0x6655ab2aU,
+    0xb2eb2807U,
+    0x2fb5c203U,
+    0x86c57b9aU,
+    0xd33708a5U,
+    0x302887f2U,
+    0x23bfa5b2U,
+    0x02036abaU,
+    0xed16825cU,
+    0x8acf1c2bU,
+    0xa779b492U,
+    0xf307f2f0U,
+    0x4e69e2a1U,
+    0x65daf4cdU,
+    0x0605bed5U,
+    0xd134621fU,
+    0xc4a6fe8aU,
+    0x342e539dU,
+    0xa2f355a0U,
+    0x058ae132U,
+    0xa4f6eb75U,
+    0x0b83ec39U,
+    0x4060efaaU,
+    0x5e719f06U,
+    0xbd6e1051U,
+    0x3e218af9U,
+    0x96dd063dU,
+    0xdd3e05aeU,
+    0x4de6bd46U,
+    0x91548db5U,
+    0x71c45d05U,
+    0x0406d46fU,
+    0x605015ffU,
+    0x1998fb24U,
+    0xd6bde997U,
+    0x894043ccU,
+    0x67d99e77U,
+    0xb0e842bdU,
+    0x07898b88U,
+    0xe7195b38U,
+    0x79c8eedbU,
+    0xa17c0a47U,
+    0x7c420fe9U,
+    0xf8841ec9U,
+    0x00000000U,
+    0x09808683U,
+    0x322bed48U,
+    0x1e1170acU,
+    0x6c5a724eU,
+    0xfd0efffbU,
+    0x0f853856U,
+    0x3daed51eU,
+    0x362d3927U,
+    0x0a0fd964U,
+    0x685ca621U,
+    0x9b5b54d1U,
+    0x24362e3aU,
+    0x0c0a67b1U,
+    0x9357e70fU,
+    0xb4ee96d2U,
+    0x1b9b919eU,
+    0x80c0c54fU,
+    0x61dc20a2U,
+    0x5a774b69U,
+    0x1c121a16U,
+    0xe293ba0aU,
+    0xc0a02ae5U,
+    0x3c22e043U,
+    0x121b171dU,
+    0x0e090d0bU,
+    0xf28bc7adU,
+    0x2db6a8b9U,
+    0x141ea9c8U,
+    0x57f11985U,
+    0xaf75074cU,
+    0xee99ddbbU,
+    0xa37f60fdU,
+    0xf701269fU,
+    0x5c72f5bcU,
+    0x44663bc5U,
+    0x5bfb7e34U,
+    0x8b432976U,
+    0xcb23c6dcU,
+    0xb6edfc68U,
+    0xb8e4f163U,
+    0xd731dccaU,
+    0x42638510U,
+    0x13972240U,
+    0x84c61120U,
+    0x854a247dU,
+    0xd2bb3df8U,
+    0xaef93211U,
+    0xc729a16dU,
+    0x1d9e2f4bU,
+    0xdcb230f3U,
+    0x0d8652ecU,
+    0x77c1e3d0U,
+    0x2bb3166cU,
+    0xa970b999U,
+    0x119448faU,
+    0x47e96422U,
+    0xa8fc8cc4U,
+    0xa0f03f1aU,
+    0x567d2cd8U,
+    0x223390efU,
+    0x87494ec7U,
+    0xd938d1c1U,
+    0x8ccaa2feU,
+    0x98d40b36U,
+    0xa6f581cfU,
+    0xa57ade28U,
+    0xdab78e26U,
+    0x3fadbfa4U,
+    0x2c3a9de4U,
+    0x5078920dU,
+    0x6a5fcc9bU,
+    0x547e4662U,
+    0xf68d13c2U,
+    0x90d8b8e8U,
+    0x2e39f75eU,
+    0x82c3aff5U,
+    0x9f5d80beU,
+    0x69d0937cU,
+    0x6fd52da9U,
+    0xcf2512b3U,
+    0xc8ac993bU,
+    0x10187da7U,
+    0xe89c636eU,
+    0xdb3bbb7bU,
+    0xcd267809U,
+    0x6e5918f4U,
+    0xec9ab701U,
+    0x834f9aa8U,
+    0xe6956e65U,
+    0xaaffe67eU,
+    0x21bccf08U,
+    0xef15e8e6U,
+    0xbae79bd9U,
+    0x4a6f36ceU,
+    0xea9f09d4U,
+    0x29b07cd6U,
+    0x31a4b2afU,
+    0x2a3f2331U,
+    0xc6a59430U,
+    0x35a266c0U,
+    0x744ebc37U,
+    0xfc82caa6U,
+    0xe090d0b0U,
+    0x33a7d815U,
+    0xf104984aU,
+    0x41ecdaf7U,
+    0x7fcd500eU,
+    0x1791f62fU,
+    0x764dd68dU,
+    0x43efb04dU,
+    0xccaa4d54U,
+    0xe49604dfU,
+    0x9ed1b5e3U,
+    0x4c6a881bU,
+    0xc12c1fb8U,
+    0x4665517fU,
+    0x9d5eea04U,
+    0x018c355dU,
+    0xfa877473U,
+    0xfb0b412eU,
+    0xb3671d5aU,
+    0x92dbd252U,
+    0xe9105633U,
+    0x6dd64713U,
+    0x9ad7618cU,
+    0x37a10c7aU,
+    0x59f8148eU,
+    0xeb133c89U,
+    0xcea927eeU,
+    0xb761c935U,
+    0xe11ce5edU,
+    0x7a47b13cU,
+    0x9cd2df59U,
+    0x55f2733fU,
+    0x1814ce79U,
+    0x73c737bfU,
+    0x53f7cdeaU,
+    0x5ffdaa5bU,
+    0xdf3d6f14U,
+    0x7844db86U,
+    0xcaaff381U,
+    0xb968c43eU,
+    0x3824342cU,
+    0xc2a3405fU,
+    0x161dc372U,
+    0xbce2250cU,
+    0x283c498bU,
+    0xff0d9541U,
+    0x39a80171U,
+    0x080cb3deU,
+    0xd8b4e49cU,
+    0x6456c190U,
+    0x7bcb8461U,
+    0xd532b670U,
+    0x486c5c74U,
+    0xd0b85742U,
 };
 static const u32 Td1[256] = {
-    0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU,
-    0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U,
-    0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU,
-    0xfc4fe5d7U, 0xd7c52acbU, 0x80263544U, 0x8fb562a3U,
-    0x49deb15aU, 0x6725ba1bU, 0x9845ea0eU, 0xe15dfec0U,
-    0x02c32f75U, 0x12814cf0U, 0xa38d4697U, 0xc66bd3f9U,
-    0xe7038f5fU, 0x9515929cU, 0xebbf6d7aU, 0xda955259U,
-    0x2dd4be83U, 0xd3587421U, 0x2949e069U, 0x448ec9c8U,
-    0x6a75c289U, 0x78f48e79U, 0x6b99583eU, 0xdd27b971U,
-    0xb6bee14fU, 0x17f088adU, 0x66c920acU, 0xb47dce3aU,
-    0x1863df4aU, 0x82e51a31U, 0x60975133U, 0x4562537fU,
-    0xe0b16477U, 0x84bb6baeU, 0x1cfe81a0U, 0x94f9082bU,
-    0x58704868U, 0x198f45fdU, 0x8794de6cU, 0xb7527bf8U,
-    0x23ab73d3U, 0xe2724b02U, 0x57e31f8fU, 0x2a6655abU,
-    0x07b2eb28U, 0x032fb5c2U, 0x9a86c57bU, 0xa5d33708U,
-    0xf2302887U, 0xb223bfa5U, 0xba02036aU, 0x5ced1682U,
-    0x2b8acf1cU, 0x92a779b4U, 0xf0f307f2U, 0xa14e69e2U,
-    0xcd65daf4U, 0xd50605beU, 0x1fd13462U, 0x8ac4a6feU,
-    0x9d342e53U, 0xa0a2f355U, 0x32058ae1U, 0x75a4f6ebU,
-    0x390b83ecU, 0xaa4060efU, 0x065e719fU, 0x51bd6e10U,
-    0xf93e218aU, 0x3d96dd06U, 0xaedd3e05U, 0x464de6bdU,
-    0xb591548dU, 0x0571c45dU, 0x6f0406d4U, 0xff605015U,
-    0x241998fbU, 0x97d6bde9U, 0xcc894043U, 0x7767d99eU,
-    0xbdb0e842U, 0x8807898bU, 0x38e7195bU, 0xdb79c8eeU,
-    0x47a17c0aU, 0xe97c420fU, 0xc9f8841eU, 0x00000000U,
-    0x83098086U, 0x48322bedU, 0xac1e1170U, 0x4e6c5a72U,
-    0xfbfd0effU, 0x560f8538U, 0x1e3daed5U, 0x27362d39U,
-    0x640a0fd9U, 0x21685ca6U, 0xd19b5b54U, 0x3a24362eU,
-    0xb10c0a67U, 0x0f9357e7U, 0xd2b4ee96U, 0x9e1b9b91U,
-    0x4f80c0c5U, 0xa261dc20U, 0x695a774bU, 0x161c121aU,
-    0x0ae293baU, 0xe5c0a02aU, 0x433c22e0U, 0x1d121b17U,
-    0x0b0e090dU, 0xadf28bc7U, 0xb92db6a8U, 0xc8141ea9U,
-    0x8557f119U, 0x4caf7507U, 0xbbee99ddU, 0xfda37f60U,
-    0x9ff70126U, 0xbc5c72f5U, 0xc544663bU, 0x345bfb7eU,
-    0x768b4329U, 0xdccb23c6U, 0x68b6edfcU, 0x63b8e4f1U,
-    0xcad731dcU, 0x10426385U, 0x40139722U, 0x2084c611U,
-    0x7d854a24U, 0xf8d2bb3dU, 0x11aef932U, 0x6dc729a1U,
-    0x4b1d9e2fU, 0xf3dcb230U, 0xec0d8652U, 0xd077c1e3U,
-    0x6c2bb316U, 0x99a970b9U, 0xfa119448U, 0x2247e964U,
-    0xc4a8fc8cU, 0x1aa0f03fU, 0xd8567d2cU, 0xef223390U,
-    0xc787494eU, 0xc1d938d1U, 0xfe8ccaa2U, 0x3698d40bU,
-    0xcfa6f581U, 0x28a57adeU, 0x26dab78eU, 0xa43fadbfU,
-    0xe42c3a9dU, 0x0d507892U, 0x9b6a5fccU, 0x62547e46U,
-    0xc2f68d13U, 0xe890d8b8U, 0x5e2e39f7U, 0xf582c3afU,
-    0xbe9f5d80U, 0x7c69d093U, 0xa96fd52dU, 0xb3cf2512U,
-    0x3bc8ac99U, 0xa710187dU, 0x6ee89c63U, 0x7bdb3bbbU,
-    0x09cd2678U, 0xf46e5918U, 0x01ec9ab7U, 0xa8834f9aU,
-    0x65e6956eU, 0x7eaaffe6U, 0x0821bccfU, 0xe6ef15e8U,
-    0xd9bae79bU, 0xce4a6f36U, 0xd4ea9f09U, 0xd629b07cU,
-    0xaf31a4b2U, 0x312a3f23U, 0x30c6a594U, 0xc035a266U,
-    0x37744ebcU, 0xa6fc82caU, 0xb0e090d0U, 0x1533a7d8U,
-    0x4af10498U, 0xf741ecdaU, 0x0e7fcd50U, 0x2f1791f6U,
-    0x8d764dd6U, 0x4d43efb0U, 0x54ccaa4dU, 0xdfe49604U,
-    0xe39ed1b5U, 0x1b4c6a88U, 0xb8c12c1fU, 0x7f466551U,
-    0x049d5eeaU, 0x5d018c35U, 0x73fa8774U, 0x2efb0b41U,
-    0x5ab3671dU, 0x5292dbd2U, 0x33e91056U, 0x136dd647U,
-    0x8c9ad761U, 0x7a37a10cU, 0x8e59f814U, 0x89eb133cU,
-    0xeecea927U, 0x35b761c9U, 0xede11ce5U, 0x3c7a47b1U,
-    0x599cd2dfU, 0x3f55f273U, 0x791814ceU, 0xbf73c737U,
-    0xea53f7cdU, 0x5b5ffdaaU, 0x14df3d6fU, 0x867844dbU,
-    0x81caaff3U, 0x3eb968c4U, 0x2c382434U, 0x5fc2a340U,
-    0x72161dc3U, 0x0cbce225U, 0x8b283c49U, 0x41ff0d95U,
-    0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U,
-    0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U,
+    0x5051f4a7U,
+    0x537e4165U,
+    0xc31a17a4U,
+    0x963a275eU,
+    0xcb3bab6bU,
+    0xf11f9d45U,
+    0xabacfa58U,
+    0x934be303U,
+    0x552030faU,
+    0xf6ad766dU,
+    0x9188cc76U,
+    0x25f5024cU,
+    0xfc4fe5d7U,
+    0xd7c52acbU,
+    0x80263544U,
+    0x8fb562a3U,
+    0x49deb15aU,
+    0x6725ba1bU,
+    0x9845ea0eU,
+    0xe15dfec0U,
+    0x02c32f75U,
+    0x12814cf0U,
+    0xa38d4697U,
+    0xc66bd3f9U,
+    0xe7038f5fU,
+    0x9515929cU,
+    0xebbf6d7aU,
+    0xda955259U,
+    0x2dd4be83U,
+    0xd3587421U,
+    0x2949e069U,
+    0x448ec9c8U,
+    0x6a75c289U,
+    0x78f48e79U,
+    0x6b99583eU,
+    0xdd27b971U,
+    0xb6bee14fU,
+    0x17f088adU,
+    0x66c920acU,
+    0xb47dce3aU,
+    0x1863df4aU,
+    0x82e51a31U,
+    0x60975133U,
+    0x4562537fU,
+    0xe0b16477U,
+    0x84bb6baeU,
+    0x1cfe81a0U,
+    0x94f9082bU,
+    0x58704868U,
+    0x198f45fdU,
+    0x8794de6cU,
+    0xb7527bf8U,
+    0x23ab73d3U,
+    0xe2724b02U,
+    0x57e31f8fU,
+    0x2a6655abU,
+    0x07b2eb28U,
+    0x032fb5c2U,
+    0x9a86c57bU,
+    0xa5d33708U,
+    0xf2302887U,
+    0xb223bfa5U,
+    0xba02036aU,
+    0x5ced1682U,
+    0x2b8acf1cU,
+    0x92a779b4U,
+    0xf0f307f2U,
+    0xa14e69e2U,
+    0xcd65daf4U,
+    0xd50605beU,
+    0x1fd13462U,
+    0x8ac4a6feU,
+    0x9d342e53U,
+    0xa0a2f355U,
+    0x32058ae1U,
+    0x75a4f6ebU,
+    0x390b83ecU,
+    0xaa4060efU,
+    0x065e719fU,
+    0x51bd6e10U,
+    0xf93e218aU,
+    0x3d96dd06U,
+    0xaedd3e05U,
+    0x464de6bdU,
+    0xb591548dU,
+    0x0571c45dU,
+    0x6f0406d4U,
+    0xff605015U,
+    0x241998fbU,
+    0x97d6bde9U,
+    0xcc894043U,
+    0x7767d99eU,
+    0xbdb0e842U,
+    0x8807898bU,
+    0x38e7195bU,
+    0xdb79c8eeU,
+    0x47a17c0aU,
+    0xe97c420fU,
+    0xc9f8841eU,
+    0x00000000U,
+    0x83098086U,
+    0x48322bedU,
+    0xac1e1170U,
+    0x4e6c5a72U,
+    0xfbfd0effU,
+    0x560f8538U,
+    0x1e3daed5U,
+    0x27362d39U,
+    0x640a0fd9U,
+    0x21685ca6U,
+    0xd19b5b54U,
+    0x3a24362eU,
+    0xb10c0a67U,
+    0x0f9357e7U,
+    0xd2b4ee96U,
+    0x9e1b9b91U,
+    0x4f80c0c5U,
+    0xa261dc20U,
+    0x695a774bU,
+    0x161c121aU,
+    0x0ae293baU,
+    0xe5c0a02aU,
+    0x433c22e0U,
+    0x1d121b17U,
+    0x0b0e090dU,
+    0xadf28bc7U,
+    0xb92db6a8U,
+    0xc8141ea9U,
+    0x8557f119U,
+    0x4caf7507U,
+    0xbbee99ddU,
+    0xfda37f60U,
+    0x9ff70126U,
+    0xbc5c72f5U,
+    0xc544663bU,
+    0x345bfb7eU,
+    0x768b4329U,
+    0xdccb23c6U,
+    0x68b6edfcU,
+    0x63b8e4f1U,
+    0xcad731dcU,
+    0x10426385U,
+    0x40139722U,
+    0x2084c611U,
+    0x7d854a24U,
+    0xf8d2bb3dU,
+    0x11aef932U,
+    0x6dc729a1U,
+    0x4b1d9e2fU,
+    0xf3dcb230U,
+    0xec0d8652U,
+    0xd077c1e3U,
+    0x6c2bb316U,
+    0x99a970b9U,
+    0xfa119448U,
+    0x2247e964U,
+    0xc4a8fc8cU,
+    0x1aa0f03fU,
+    0xd8567d2cU,
+    0xef223390U,
+    0xc787494eU,
+    0xc1d938d1U,
+    0xfe8ccaa2U,
+    0x3698d40bU,
+    0xcfa6f581U,
+    0x28a57adeU,
+    0x26dab78eU,
+    0xa43fadbfU,
+    0xe42c3a9dU,
+    0x0d507892U,
+    0x9b6a5fccU,
+    0x62547e46U,
+    0xc2f68d13U,
+    0xe890d8b8U,
+    0x5e2e39f7U,
+    0xf582c3afU,
+    0xbe9f5d80U,
+    0x7c69d093U,
+    0xa96fd52dU,
+    0xb3cf2512U,
+    0x3bc8ac99U,
+    0xa710187dU,
+    0x6ee89c63U,
+    0x7bdb3bbbU,
+    0x09cd2678U,
+    0xf46e5918U,
+    0x01ec9ab7U,
+    0xa8834f9aU,
+    0x65e6956eU,
+    0x7eaaffe6U,
+    0x0821bccfU,
+    0xe6ef15e8U,
+    0xd9bae79bU,
+    0xce4a6f36U,
+    0xd4ea9f09U,
+    0xd629b07cU,
+    0xaf31a4b2U,
+    0x312a3f23U,
+    0x30c6a594U,
+    0xc035a266U,
+    0x37744ebcU,
+    0xa6fc82caU,
+    0xb0e090d0U,
+    0x1533a7d8U,
+    0x4af10498U,
+    0xf741ecdaU,
+    0x0e7fcd50U,
+    0x2f1791f6U,
+    0x8d764dd6U,
+    0x4d43efb0U,
+    0x54ccaa4dU,
+    0xdfe49604U,
+    0xe39ed1b5U,
+    0x1b4c6a88U,
+    0xb8c12c1fU,
+    0x7f466551U,
+    0x049d5eeaU,
+    0x5d018c35U,
+    0x73fa8774U,
+    0x2efb0b41U,
+    0x5ab3671dU,
+    0x5292dbd2U,
+    0x33e91056U,
+    0x136dd647U,
+    0x8c9ad761U,
+    0x7a37a10cU,
+    0x8e59f814U,
+    0x89eb133cU,
+    0xeecea927U,
+    0x35b761c9U,
+    0xede11ce5U,
+    0x3c7a47b1U,
+    0x599cd2dfU,
+    0x3f55f273U,
+    0x791814ceU,
+    0xbf73c737U,
+    0xea53f7cdU,
+    0x5b5ffdaaU,
+    0x14df3d6fU,
+    0x867844dbU,
+    0x81caaff3U,
+    0x3eb968c4U,
+    0x2c382434U,
+    0x5fc2a340U,
+    0x72161dc3U,
+    0x0cbce225U,
+    0x8b283c49U,
+    0x41ff0d95U,
+    0x7139a801U,
+    0xde080cb3U,
+    0x9cd8b4e4U,
+    0x906456c1U,
+    0x617bcb84U,
+    0x70d532b6U,
+    0x74486c5cU,
+    0x42d0b857U,
 };
 static const u32 Td2[256] = {
-    0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U,
-    0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U,
-    0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U,
-    0xd7fc4fe5U, 0xcbd7c52aU, 0x44802635U, 0xa38fb562U,
-    0x5a49deb1U, 0x1b6725baU, 0x0e9845eaU, 0xc0e15dfeU,
-    0x7502c32fU, 0xf012814cU, 0x97a38d46U, 0xf9c66bd3U,
-    0x5fe7038fU, 0x9c951592U, 0x7aebbf6dU, 0x59da9552U,
-    0x832dd4beU, 0x21d35874U, 0x692949e0U, 0xc8448ec9U,
-    0x896a75c2U, 0x7978f48eU, 0x3e6b9958U, 0x71dd27b9U,
-    0x4fb6bee1U, 0xad17f088U, 0xac66c920U, 0x3ab47dceU,
-    0x4a1863dfU, 0x3182e51aU, 0x33609751U, 0x7f456253U,
-    0x77e0b164U, 0xae84bb6bU, 0xa01cfe81U, 0x2b94f908U,
-    0x68587048U, 0xfd198f45U, 0x6c8794deU, 0xf8b7527bU,
-    0xd323ab73U, 0x02e2724bU, 0x8f57e31fU, 0xab2a6655U,
-    0x2807b2ebU, 0xc2032fb5U, 0x7b9a86c5U, 0x08a5d337U,
-    0x87f23028U, 0xa5b223bfU, 0x6aba0203U, 0x825ced16U,
-    0x1c2b8acfU, 0xb492a779U, 0xf2f0f307U, 0xe2a14e69U,
-    0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U,
-    0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U,
-    0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU,
-    0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U,
-    0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U,
-    0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U,
-    0x42bdb0e8U, 0x8b880789U, 0x5b38e719U, 0xeedb79c8U,
-    0x0a47a17cU, 0x0fe97c42U, 0x1ec9f884U, 0x00000000U,
-    0x86830980U, 0xed48322bU, 0x70ac1e11U, 0x724e6c5aU,
-    0xfffbfd0eU, 0x38560f85U, 0xd51e3daeU, 0x3927362dU,
-    0xd9640a0fU, 0xa621685cU, 0x54d19b5bU, 0x2e3a2436U,
-    0x67b10c0aU, 0xe70f9357U, 0x96d2b4eeU, 0x919e1b9bU,
-    0xc54f80c0U, 0x20a261dcU, 0x4b695a77U, 0x1a161c12U,
-    0xba0ae293U, 0x2ae5c0a0U, 0xe0433c22U, 0x171d121bU,
-    0x0d0b0e09U, 0xc7adf28bU, 0xa8b92db6U, 0xa9c8141eU,
-    0x198557f1U, 0x074caf75U, 0xddbbee99U, 0x60fda37fU,
-    0x269ff701U, 0xf5bc5c72U, 0x3bc54466U, 0x7e345bfbU,
-    0x29768b43U, 0xc6dccb23U, 0xfc68b6edU, 0xf163b8e4U,
-    0xdccad731U, 0x85104263U, 0x22401397U, 0x112084c6U,
-    0x247d854aU, 0x3df8d2bbU, 0x3211aef9U, 0xa16dc729U,
-    0x2f4b1d9eU, 0x30f3dcb2U, 0x52ec0d86U, 0xe3d077c1U,
-    0x166c2bb3U, 0xb999a970U, 0x48fa1194U, 0x642247e9U,
-    0x8cc4a8fcU, 0x3f1aa0f0U, 0x2cd8567dU, 0x90ef2233U,
-    0x4ec78749U, 0xd1c1d938U, 0xa2fe8ccaU, 0x0b3698d4U,
-    0x81cfa6f5U, 0xde28a57aU, 0x8e26dab7U, 0xbfa43fadU,
-    0x9de42c3aU, 0x920d5078U, 0xcc9b6a5fU, 0x4662547eU,
-    0x13c2f68dU, 0xb8e890d8U, 0xf75e2e39U, 0xaff582c3U,
-    0x80be9f5dU, 0x937c69d0U, 0x2da96fd5U, 0x12b3cf25U,
-    0x993bc8acU, 0x7da71018U, 0x636ee89cU, 0xbb7bdb3bU,
-    0x7809cd26U, 0x18f46e59U, 0xb701ec9aU, 0x9aa8834fU,
-    0x6e65e695U, 0xe67eaaffU, 0xcf0821bcU, 0xe8e6ef15U,
-    0x9bd9bae7U, 0x36ce4a6fU, 0x09d4ea9fU, 0x7cd629b0U,
-    0xb2af31a4U, 0x23312a3fU, 0x9430c6a5U, 0x66c035a2U,
-    0xbc37744eU, 0xcaa6fc82U, 0xd0b0e090U, 0xd81533a7U,
-    0x984af104U, 0xdaf741ecU, 0x500e7fcdU, 0xf62f1791U,
-    0xd68d764dU, 0xb04d43efU, 0x4d54ccaaU, 0x04dfe496U,
-    0xb5e39ed1U, 0x881b4c6aU, 0x1fb8c12cU, 0x517f4665U,
-    0xea049d5eU, 0x355d018cU, 0x7473fa87U, 0x412efb0bU,
-    0x1d5ab367U, 0xd25292dbU, 0x5633e910U, 0x47136dd6U,
-    0x618c9ad7U, 0x0c7a37a1U, 0x148e59f8U, 0x3c89eb13U,
-    0x27eecea9U, 0xc935b761U, 0xe5ede11cU, 0xb13c7a47U,
-    0xdf599cd2U, 0x733f55f2U, 0xce791814U, 0x37bf73c7U,
-    0xcdea53f7U, 0xaa5b5ffdU, 0x6f14df3dU, 0xdb867844U,
-    0xf381caafU, 0xc43eb968U, 0x342c3824U, 0x405fc2a3U,
-    0xc372161dU, 0x250cbce2U, 0x498b283cU, 0x9541ff0dU,
-    0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U,
-    0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U,
+    0xa75051f4U,
+    0x65537e41U,
+    0xa4c31a17U,
+    0x5e963a27U,
+    0x6bcb3babU,
+    0x45f11f9dU,
+    0x58abacfaU,
+    0x03934be3U,
+    0xfa552030U,
+    0x6df6ad76U,
+    0x769188ccU,
+    0x4c25f502U,
+    0xd7fc4fe5U,
+    0xcbd7c52aU,
+    0x44802635U,
+    0xa38fb562U,
+    0x5a49deb1U,
+    0x1b6725baU,
+    0x0e9845eaU,
+    0xc0e15dfeU,
+    0x7502c32fU,
+    0xf012814cU,
+    0x97a38d46U,
+    0xf9c66bd3U,
+    0x5fe7038fU,
+    0x9c951592U,
+    0x7aebbf6dU,
+    0x59da9552U,
+    0x832dd4beU,
+    0x21d35874U,
+    0x692949e0U,
+    0xc8448ec9U,
+    0x896a75c2U,
+    0x7978f48eU,
+    0x3e6b9958U,
+    0x71dd27b9U,
+    0x4fb6bee1U,
+    0xad17f088U,
+    0xac66c920U,
+    0x3ab47dceU,
+    0x4a1863dfU,
+    0x3182e51aU,
+    0x33609751U,
+    0x7f456253U,
+    0x77e0b164U,
+    0xae84bb6bU,
+    0xa01cfe81U,
+    0x2b94f908U,
+    0x68587048U,
+    0xfd198f45U,
+    0x6c8794deU,
+    0xf8b7527bU,
+    0xd323ab73U,
+    0x02e2724bU,
+    0x8f57e31fU,
+    0xab2a6655U,
+    0x2807b2ebU,
+    0xc2032fb5U,
+    0x7b9a86c5U,
+    0x08a5d337U,
+    0x87f23028U,
+    0xa5b223bfU,
+    0x6aba0203U,
+    0x825ced16U,
+    0x1c2b8acfU,
+    0xb492a779U,
+    0xf2f0f307U,
+    0xe2a14e69U,
+    0xf4cd65daU,
+    0xbed50605U,
+    0x621fd134U,
+    0xfe8ac4a6U,
+    0x539d342eU,
+    0x55a0a2f3U,
+    0xe132058aU,
+    0xeb75a4f6U,
+    0xec390b83U,
+    0xefaa4060U,
+    0x9f065e71U,
+    0x1051bd6eU,
+    0x8af93e21U,
+    0x063d96ddU,
+    0x05aedd3eU,
+    0xbd464de6U,
+    0x8db59154U,
+    0x5d0571c4U,
+    0xd46f0406U,
+    0x15ff6050U,
+    0xfb241998U,
+    0xe997d6bdU,
+    0x43cc8940U,
+    0x9e7767d9U,
+    0x42bdb0e8U,
+    0x8b880789U,
+    0x5b38e719U,
+    0xeedb79c8U,
+    0x0a47a17cU,
+    0x0fe97c42U,
+    0x1ec9f884U,
+    0x00000000U,
+    0x86830980U,
+    0xed48322bU,
+    0x70ac1e11U,
+    0x724e6c5aU,
+    0xfffbfd0eU,
+    0x38560f85U,
+    0xd51e3daeU,
+    0x3927362dU,
+    0xd9640a0fU,
+    0xa621685cU,
+    0x54d19b5bU,
+    0x2e3a2436U,
+    0x67b10c0aU,
+    0xe70f9357U,
+    0x96d2b4eeU,
+    0x919e1b9bU,
+    0xc54f80c0U,
+    0x20a261dcU,
+    0x4b695a77U,
+    0x1a161c12U,
+    0xba0ae293U,
+    0x2ae5c0a0U,
+    0xe0433c22U,
+    0x171d121bU,
+    0x0d0b0e09U,
+    0xc7adf28bU,
+    0xa8b92db6U,
+    0xa9c8141eU,
+    0x198557f1U,
+    0x074caf75U,
+    0xddbbee99U,
+    0x60fda37fU,
+    0x269ff701U,
+    0xf5bc5c72U,
+    0x3bc54466U,
+    0x7e345bfbU,
+    0x29768b43U,
+    0xc6dccb23U,
+    0xfc68b6edU,
+    0xf163b8e4U,
+    0xdccad731U,
+    0x85104263U,
+    0x22401397U,
+    0x112084c6U,
+    0x247d854aU,
+    0x3df8d2bbU,
+    0x3211aef9U,
+    0xa16dc729U,
+    0x2f4b1d9eU,
+    0x30f3dcb2U,
+    0x52ec0d86U,
+    0xe3d077c1U,
+    0x166c2bb3U,
+    0xb999a970U,
+    0x48fa1194U,
+    0x642247e9U,
+    0x8cc4a8fcU,
+    0x3f1aa0f0U,
+    0x2cd8567dU,
+    0x90ef2233U,
+    0x4ec78749U,
+    0xd1c1d938U,
+    0xa2fe8ccaU,
+    0x0b3698d4U,
+    0x81cfa6f5U,
+    0xde28a57aU,
+    0x8e26dab7U,
+    0xbfa43fadU,
+    0x9de42c3aU,
+    0x920d5078U,
+    0xcc9b6a5fU,
+    0x4662547eU,
+    0x13c2f68dU,
+    0xb8e890d8U,
+    0xf75e2e39U,
+    0xaff582c3U,
+    0x80be9f5dU,
+    0x937c69d0U,
+    0x2da96fd5U,
+    0x12b3cf25U,
+    0x993bc8acU,
+    0x7da71018U,
+    0x636ee89cU,
+    0xbb7bdb3bU,
+    0x7809cd26U,
+    0x18f46e59U,
+    0xb701ec9aU,
+    0x9aa8834fU,
+    0x6e65e695U,
+    0xe67eaaffU,
+    0xcf0821bcU,
+    0xe8e6ef15U,
+    0x9bd9bae7U,
+    0x36ce4a6fU,
+    0x09d4ea9fU,
+    0x7cd629b0U,
+    0xb2af31a4U,
+    0x23312a3fU,
+    0x9430c6a5U,
+    0x66c035a2U,
+    0xbc37744eU,
+    0xcaa6fc82U,
+    0xd0b0e090U,
+    0xd81533a7U,
+    0x984af104U,
+    0xdaf741ecU,
+    0x500e7fcdU,
+    0xf62f1791U,
+    0xd68d764dU,
+    0xb04d43efU,
+    0x4d54ccaaU,
+    0x04dfe496U,
+    0xb5e39ed1U,
+    0x881b4c6aU,
+    0x1fb8c12cU,
+    0x517f4665U,
+    0xea049d5eU,
+    0x355d018cU,
+    0x7473fa87U,
+    0x412efb0bU,
+    0x1d5ab367U,
+    0xd25292dbU,
+    0x5633e910U,
+    0x47136dd6U,
+    0x618c9ad7U,
+    0x0c7a37a1U,
+    0x148e59f8U,
+    0x3c89eb13U,
+    0x27eecea9U,
+    0xc935b761U,
+    0xe5ede11cU,
+    0xb13c7a47U,
+    0xdf599cd2U,
+    0x733f55f2U,
+    0xce791814U,
+    0x37bf73c7U,
+    0xcdea53f7U,
+    0xaa5b5ffdU,
+    0x6f14df3dU,
+    0xdb867844U,
+    0xf381caafU,
+    0xc43eb968U,
+    0x342c3824U,
+    0x405fc2a3U,
+    0xc372161dU,
+    0x250cbce2U,
+    0x498b283cU,
+    0x9541ff0dU,
+    0x017139a8U,
+    0xb3de080cU,
+    0xe49cd8b4U,
+    0xc1906456U,
+    0x84617bcbU,
+    0xb670d532U,
+    0x5c74486cU,
+    0x5742d0b8U,
 };
 static const u32 Td3[256] = {
-    0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU,
-    0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU,
-    0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U,
-    0xe5d7fc4fU, 0x2acbd7c5U, 0x35448026U, 0x62a38fb5U,
-    0xb15a49deU, 0xba1b6725U, 0xea0e9845U, 0xfec0e15dU,
-    0x2f7502c3U, 0x4cf01281U, 0x4697a38dU, 0xd3f9c66bU,
-    0x8f5fe703U, 0x929c9515U, 0x6d7aebbfU, 0x5259da95U,
-    0xbe832dd4U, 0x7421d358U, 0xe0692949U, 0xc9c8448eU,
-    0xc2896a75U, 0x8e7978f4U, 0x583e6b99U, 0xb971dd27U,
-    0xe14fb6beU, 0x88ad17f0U, 0x20ac66c9U, 0xce3ab47dU,
-    0xdf4a1863U, 0x1a3182e5U, 0x51336097U, 0x537f4562U,
-    0x6477e0b1U, 0x6bae84bbU, 0x81a01cfeU, 0x082b94f9U,
-    0x48685870U, 0x45fd198fU, 0xde6c8794U, 0x7bf8b752U,
-    0x73d323abU, 0x4b02e272U, 0x1f8f57e3U, 0x55ab2a66U,
-    0xeb2807b2U, 0xb5c2032fU, 0xc57b9a86U, 0x3708a5d3U,
-    0x2887f230U, 0xbfa5b223U, 0x036aba02U, 0x16825cedU,
-    0xcf1c2b8aU, 0x79b492a7U, 0x07f2f0f3U, 0x69e2a14eU,
-    0xdaf4cd65U, 0x05bed506U, 0x34621fd1U, 0xa6fe8ac4U,
-    0x2e539d34U, 0xf355a0a2U, 0x8ae13205U, 0xf6eb75a4U,
-    0x83ec390bU, 0x60efaa40U, 0x719f065eU, 0x6e1051bdU,
-    0x218af93eU, 0xdd063d96U, 0x3e05aeddU, 0xe6bd464dU,
-    0x548db591U, 0xc45d0571U, 0x06d46f04U, 0x5015ff60U,
-    0x98fb2419U, 0xbde997d6U, 0x4043cc89U, 0xd99e7767U,
-    0xe842bdb0U, 0x898b8807U, 0x195b38e7U, 0xc8eedb79U,
-    0x7c0a47a1U, 0x420fe97cU, 0x841ec9f8U, 0x00000000U,
-    0x80868309U, 0x2bed4832U, 0x1170ac1eU, 0x5a724e6cU,
-    0x0efffbfdU, 0x8538560fU, 0xaed51e3dU, 0x2d392736U,
-    0x0fd9640aU, 0x5ca62168U, 0x5b54d19bU, 0x362e3a24U,
-    0x0a67b10cU, 0x57e70f93U, 0xee96d2b4U, 0x9b919e1bU,
-    0xc0c54f80U, 0xdc20a261U, 0x774b695aU, 0x121a161cU,
-    0x93ba0ae2U, 0xa02ae5c0U, 0x22e0433cU, 0x1b171d12U,
-    0x090d0b0eU, 0x8bc7adf2U, 0xb6a8b92dU, 0x1ea9c814U,
-    0xf1198557U, 0x75074cafU, 0x99ddbbeeU, 0x7f60fda3U,
-    0x01269ff7U, 0x72f5bc5cU, 0x663bc544U, 0xfb7e345bU,
-    0x4329768bU, 0x23c6dccbU, 0xedfc68b6U, 0xe4f163b8U,
-    0x31dccad7U, 0x63851042U, 0x97224013U, 0xc6112084U,
-    0x4a247d85U, 0xbb3df8d2U, 0xf93211aeU, 0x29a16dc7U,
-    0x9e2f4b1dU, 0xb230f3dcU, 0x8652ec0dU, 0xc1e3d077U,
-    0xb3166c2bU, 0x70b999a9U, 0x9448fa11U, 0xe9642247U,
-    0xfc8cc4a8U, 0xf03f1aa0U, 0x7d2cd856U, 0x3390ef22U,
-    0x494ec787U, 0x38d1c1d9U, 0xcaa2fe8cU, 0xd40b3698U,
-    0xf581cfa6U, 0x7ade28a5U, 0xb78e26daU, 0xadbfa43fU,
-    0x3a9de42cU, 0x78920d50U, 0x5fcc9b6aU, 0x7e466254U,
-    0x8d13c2f6U, 0xd8b8e890U, 0x39f75e2eU, 0xc3aff582U,
-    0x5d80be9fU, 0xd0937c69U, 0xd52da96fU, 0x2512b3cfU,
-    0xac993bc8U, 0x187da710U, 0x9c636ee8U, 0x3bbb7bdbU,
-    0x267809cdU, 0x5918f46eU, 0x9ab701ecU, 0x4f9aa883U,
-    0x956e65e6U, 0xffe67eaaU, 0xbccf0821U, 0x15e8e6efU,
-    0xe79bd9baU, 0x6f36ce4aU, 0x9f09d4eaU, 0xb07cd629U,
-    0xa4b2af31U, 0x3f23312aU, 0xa59430c6U, 0xa266c035U,
-    0x4ebc3774U, 0x82caa6fcU, 0x90d0b0e0U, 0xa7d81533U,
-    0x04984af1U, 0xecdaf741U, 0xcd500e7fU, 0x91f62f17U,
-    0x4dd68d76U, 0xefb04d43U, 0xaa4d54ccU, 0x9604dfe4U,
-    0xd1b5e39eU, 0x6a881b4cU, 0x2c1fb8c1U, 0x65517f46U,
-    0x5eea049dU, 0x8c355d01U, 0x877473faU, 0x0b412efbU,
-    0x671d5ab3U, 0xdbd25292U, 0x105633e9U, 0xd647136dU,
-    0xd7618c9aU, 0xa10c7a37U, 0xf8148e59U, 0x133c89ebU,
-    0xa927eeceU, 0x61c935b7U, 0x1ce5ede1U, 0x47b13c7aU,
-    0xd2df599cU, 0xf2733f55U, 0x14ce7918U, 0xc737bf73U,
-    0xf7cdea53U, 0xfdaa5b5fU, 0x3d6f14dfU, 0x44db8678U,
-    0xaff381caU, 0x68c43eb9U, 0x24342c38U, 0xa3405fc2U,
-    0x1dc37216U, 0xe2250cbcU, 0x3c498b28U, 0x0d9541ffU,
-    0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
-    0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
+    0xf4a75051U,
+    0x4165537eU,
+    0x17a4c31aU,
+    0x275e963aU,
+    0xab6bcb3bU,
+    0x9d45f11fU,
+    0xfa58abacU,
+    0xe303934bU,
+    0x30fa5520U,
+    0x766df6adU,
+    0xcc769188U,
+    0x024c25f5U,
+    0xe5d7fc4fU,
+    0x2acbd7c5U,
+    0x35448026U,
+    0x62a38fb5U,
+    0xb15a49deU,
+    0xba1b6725U,
+    0xea0e9845U,
+    0xfec0e15dU,
+    0x2f7502c3U,
+    0x4cf01281U,
+    0x4697a38dU,
+    0xd3f9c66bU,
+    0x8f5fe703U,
+    0x929c9515U,
+    0x6d7aebbfU,
+    0x5259da95U,
+    0xbe832dd4U,
+    0x7421d358U,
+    0xe0692949U,
+    0xc9c8448eU,
+    0xc2896a75U,
+    0x8e7978f4U,
+    0x583e6b99U,
+    0xb971dd27U,
+    0xe14fb6beU,
+    0x88ad17f0U,
+    0x20ac66c9U,
+    0xce3ab47dU,
+    0xdf4a1863U,
+    0x1a3182e5U,
+    0x51336097U,
+    0x537f4562U,
+    0x6477e0b1U,
+    0x6bae84bbU,
+    0x81a01cfeU,
+    0x082b94f9U,
+    0x48685870U,
+    0x45fd198fU,
+    0xde6c8794U,
+    0x7bf8b752U,
+    0x73d323abU,
+    0x4b02e272U,
+    0x1f8f57e3U,
+    0x55ab2a66U,
+    0xeb2807b2U,
+    0xb5c2032fU,
+    0xc57b9a86U,
+    0x3708a5d3U,
+    0x2887f230U,
+    0xbfa5b223U,
+    0x036aba02U,
+    0x16825cedU,
+    0xcf1c2b8aU,
+    0x79b492a7U,
+    0x07f2f0f3U,
+    0x69e2a14eU,
+    0xdaf4cd65U,
+    0x05bed506U,
+    0x34621fd1U,
+    0xa6fe8ac4U,
+    0x2e539d34U,
+    0xf355a0a2U,
+    0x8ae13205U,
+    0xf6eb75a4U,
+    0x83ec390bU,
+    0x60efaa40U,
+    0x719f065eU,
+    0x6e1051bdU,
+    0x218af93eU,
+    0xdd063d96U,
+    0x3e05aeddU,
+    0xe6bd464dU,
+    0x548db591U,
+    0xc45d0571U,
+    0x06d46f04U,
+    0x5015ff60U,
+    0x98fb2419U,
+    0xbde997d6U,
+    0x4043cc89U,
+    0xd99e7767U,
+    0xe842bdb0U,
+    0x898b8807U,
+    0x195b38e7U,
+    0xc8eedb79U,
+    0x7c0a47a1U,
+    0x420fe97cU,
+    0x841ec9f8U,
+    0x00000000U,
+    0x80868309U,
+    0x2bed4832U,
+    0x1170ac1eU,
+    0x5a724e6cU,
+    0x0efffbfdU,
+    0x8538560fU,
+    0xaed51e3dU,
+    0x2d392736U,
+    0x0fd9640aU,
+    0x5ca62168U,
+    0x5b54d19bU,
+    0x362e3a24U,
+    0x0a67b10cU,
+    0x57e70f93U,
+    0xee96d2b4U,
+    0x9b919e1bU,
+    0xc0c54f80U,
+    0xdc20a261U,
+    0x774b695aU,
+    0x121a161cU,
+    0x93ba0ae2U,
+    0xa02ae5c0U,
+    0x22e0433cU,
+    0x1b171d12U,
+    0x090d0b0eU,
+    0x8bc7adf2U,
+    0xb6a8b92dU,
+    0x1ea9c814U,
+    0xf1198557U,
+    0x75074cafU,
+    0x99ddbbeeU,
+    0x7f60fda3U,
+    0x01269ff7U,
+    0x72f5bc5cU,
+    0x663bc544U,
+    0xfb7e345bU,
+    0x4329768bU,
+    0x23c6dccbU,
+    0xedfc68b6U,
+    0xe4f163b8U,
+    0x31dccad7U,
+    0x63851042U,
+    0x97224013U,
+    0xc6112084U,
+    0x4a247d85U,
+    0xbb3df8d2U,
+    0xf93211aeU,
+    0x29a16dc7U,
+    0x9e2f4b1dU,
+    0xb230f3dcU,
+    0x8652ec0dU,
+    0xc1e3d077U,
+    0xb3166c2bU,
+    0x70b999a9U,
+    0x9448fa11U,
+    0xe9642247U,
+    0xfc8cc4a8U,
+    0xf03f1aa0U,
+    0x7d2cd856U,
+    0x3390ef22U,
+    0x494ec787U,
+    0x38d1c1d9U,
+    0xcaa2fe8cU,
+    0xd40b3698U,
+    0xf581cfa6U,
+    0x7ade28a5U,
+    0xb78e26daU,
+    0xadbfa43fU,
+    0x3a9de42cU,
+    0x78920d50U,
+    0x5fcc9b6aU,
+    0x7e466254U,
+    0x8d13c2f6U,
+    0xd8b8e890U,
+    0x39f75e2eU,
+    0xc3aff582U,
+    0x5d80be9fU,
+    0xd0937c69U,
+    0xd52da96fU,
+    0x2512b3cfU,
+    0xac993bc8U,
+    0x187da710U,
+    0x9c636ee8U,
+    0x3bbb7bdbU,
+    0x267809cdU,
+    0x5918f46eU,
+    0x9ab701ecU,
+    0x4f9aa883U,
+    0x956e65e6U,
+    0xffe67eaaU,
+    0xbccf0821U,
+    0x15e8e6efU,
+    0xe79bd9baU,
+    0x6f36ce4aU,
+    0x9f09d4eaU,
+    0xb07cd629U,
+    0xa4b2af31U,
+    0x3f23312aU,
+    0xa59430c6U,
+    0xa266c035U,
+    0x4ebc3774U,
+    0x82caa6fcU,
+    0x90d0b0e0U,
+    0xa7d81533U,
+    0x04984af1U,
+    0xecdaf741U,
+    0xcd500e7fU,
+    0x91f62f17U,
+    0x4dd68d76U,
+    0xefb04d43U,
+    0xaa4d54ccU,
+    0x9604dfe4U,
+    0xd1b5e39eU,
+    0x6a881b4cU,
+    0x2c1fb8c1U,
+    0x65517f46U,
+    0x5eea049dU,
+    0x8c355d01U,
+    0x877473faU,
+    0x0b412efbU,
+    0x671d5ab3U,
+    0xdbd25292U,
+    0x105633e9U,
+    0xd647136dU,
+    0xd7618c9aU,
+    0xa10c7a37U,
+    0xf8148e59U,
+    0x133c89ebU,
+    0xa927eeceU,
+    0x61c935b7U,
+    0x1ce5ede1U,
+    0x47b13c7aU,
+    0xd2df599cU,
+    0xf2733f55U,
+    0x14ce7918U,
+    0xc737bf73U,
+    0xf7cdea53U,
+    0xfdaa5b5fU,
+    0x3d6f14dfU,
+    0x44db8678U,
+    0xaff381caU,
+    0x68c43eb9U,
+    0x24342c38U,
+    0xa3405fc2U,
+    0x1dc37216U,
+    0xe2250cbcU,
+    0x3c498b28U,
+    0x0d9541ffU,
+    0xa8017139U,
+    0x0cb3de08U,
+    0xb4e49cd8U,
+    0x56c19064U,
+    0xcb84617bU,
+    0x32b670d5U,
+    0x6c5c7448U,
+    0xb85742d0U,
 };
 static const u8 Td4[256] = {
-    0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U,
-    0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU,
-    0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U,
-    0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU,
-    0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU,
-    0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU,
-    0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U,
-    0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U,
-    0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U,
-    0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U,
-    0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU,
-    0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U,
-    0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU,
-    0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U,
-    0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U,
-    0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU,
-    0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU,
-    0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U,
-    0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U,
-    0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU,
-    0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U,
-    0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU,
-    0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U,
-    0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U,
-    0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U,
-    0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU,
-    0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU,
-    0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU,
-    0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U,
-    0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U,
-    0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U,
-    0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU,
+    0x52U,
+    0x09U,
+    0x6aU,
+    0xd5U,
+    0x30U,
+    0x36U,
+    0xa5U,
+    0x38U,
+    0xbfU,
+    0x40U,
+    0xa3U,
+    0x9eU,
+    0x81U,
+    0xf3U,
+    0xd7U,
+    0xfbU,
+    0x7cU,
+    0xe3U,
+    0x39U,
+    0x82U,
+    0x9bU,
+    0x2fU,
+    0xffU,
+    0x87U,
+    0x34U,
+    0x8eU,
+    0x43U,
+    0x44U,
+    0xc4U,
+    0xdeU,
+    0xe9U,
+    0xcbU,
+    0x54U,
+    0x7bU,
+    0x94U,
+    0x32U,
+    0xa6U,
+    0xc2U,
+    0x23U,
+    0x3dU,
+    0xeeU,
+    0x4cU,
+    0x95U,
+    0x0bU,
+    0x42U,
+    0xfaU,
+    0xc3U,
+    0x4eU,
+    0x08U,
+    0x2eU,
+    0xa1U,
+    0x66U,
+    0x28U,
+    0xd9U,
+    0x24U,
+    0xb2U,
+    0x76U,
+    0x5bU,
+    0xa2U,
+    0x49U,
+    0x6dU,
+    0x8bU,
+    0xd1U,
+    0x25U,
+    0x72U,
+    0xf8U,
+    0xf6U,
+    0x64U,
+    0x86U,
+    0x68U,
+    0x98U,
+    0x16U,
+    0xd4U,
+    0xa4U,
+    0x5cU,
+    0xccU,
+    0x5dU,
+    0x65U,
+    0xb6U,
+    0x92U,
+    0x6cU,
+    0x70U,
+    0x48U,
+    0x50U,
+    0xfdU,
+    0xedU,
+    0xb9U,
+    0xdaU,
+    0x5eU,
+    0x15U,
+    0x46U,
+    0x57U,
+    0xa7U,
+    0x8dU,
+    0x9dU,
+    0x84U,
+    0x90U,
+    0xd8U,
+    0xabU,
+    0x00U,
+    0x8cU,
+    0xbcU,
+    0xd3U,
+    0x0aU,
+    0xf7U,
+    0xe4U,
+    0x58U,
+    0x05U,
+    0xb8U,
+    0xb3U,
+    0x45U,
+    0x06U,
+    0xd0U,
+    0x2cU,
+    0x1eU,
+    0x8fU,
+    0xcaU,
+    0x3fU,
+    0x0fU,
+    0x02U,
+    0xc1U,
+    0xafU,
+    0xbdU,
+    0x03U,
+    0x01U,
+    0x13U,
+    0x8aU,
+    0x6bU,
+    0x3aU,
+    0x91U,
+    0x11U,
+    0x41U,
+    0x4fU,
+    0x67U,
+    0xdcU,
+    0xeaU,
+    0x97U,
+    0xf2U,
+    0xcfU,
+    0xceU,
+    0xf0U,
+    0xb4U,
+    0xe6U,
+    0x73U,
+    0x96U,
+    0xacU,
+    0x74U,
+    0x22U,
+    0xe7U,
+    0xadU,
+    0x35U,
+    0x85U,
+    0xe2U,
+    0xf9U,
+    0x37U,
+    0xe8U,
+    0x1cU,
+    0x75U,
+    0xdfU,
+    0x6eU,
+    0x47U,
+    0xf1U,
+    0x1aU,
+    0x71U,
+    0x1dU,
+    0x29U,
+    0xc5U,
+    0x89U,
+    0x6fU,
+    0xb7U,
+    0x62U,
+    0x0eU,
+    0xaaU,
+    0x18U,
+    0xbeU,
+    0x1bU,
+    0xfcU,
+    0x56U,
+    0x3eU,
+    0x4bU,
+    0xc6U,
+    0xd2U,
+    0x79U,
+    0x20U,
+    0x9aU,
+    0xdbU,
+    0xc0U,
+    0xfeU,
+    0x78U,
+    0xcdU,
+    0x5aU,
+    0xf4U,
+    0x1fU,
+    0xddU,
+    0xa8U,
+    0x33U,
+    0x88U,
+    0x07U,
+    0xc7U,
+    0x31U,
+    0xb1U,
+    0x12U,
+    0x10U,
+    0x59U,
+    0x27U,
+    0x80U,
+    0xecU,
+    0x5fU,
+    0x60U,
+    0x51U,
+    0x7fU,
+    0xa9U,
+    0x19U,
+    0xb5U,
+    0x4aU,
+    0x0dU,
+    0x2dU,
+    0xe5U,
+    0x7aU,
+    0x9fU,
+    0x93U,
+    0xc9U,
+    0x9cU,
+    0xefU,
+    0xa0U,
+    0xe0U,
+    0x3bU,
+    0x4dU,
+    0xaeU,
+    0x2aU,
+    0xf5U,
+    0xb0U,
+    0xc8U,
+    0xebU,
+    0xbbU,
+    0x3cU,
+    0x83U,
+    0x53U,
+    0x99U,
+    0x61U,
+    0x17U,
+    0x2bU,
+    0x04U,
+    0x7eU,
+    0xbaU,
+    0x77U,
+    0xd6U,
+    0x26U,
+    0xe1U,
+    0x69U,
+    0x14U,
+    0x63U,
+    0x55U,
+    0x21U,
+    0x0cU,
+    0x7dU,
 };
 static const u32 rcon[] = {
-    0x01000000, 0x02000000, 0x04000000, 0x08000000,
-    0x10000000, 0x20000000, 0x40000000, 0x80000000,
-    0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+    0x01000000,
+    0x02000000,
+    0x04000000,
+    0x08000000,
+    0x10000000,
+    0x20000000,
+    0x40000000,
+    0x80000000,
+    0x1B000000,
+    0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
 };
 
 /**
  * Expand the cipher key into the encryption key schedule.
  */
 int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key)
+    AES_KEY *key)
 {
 
     u32 *rk;
@@ -1297,19 +3064,14 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     else
         key->rounds = 14;
 
-    rk[0] = GETU32(userKey     );
-    rk[1] = GETU32(userKey +  4);
-    rk[2] = GETU32(userKey +  8);
+    rk[0] = GETU32(userKey);
+    rk[1] = GETU32(userKey + 4);
+    rk[2] = GETU32(userKey + 8);
     rk[3] = GETU32(userKey + 12);
     if (bits == 128) {
         while (1) {
-            temp  = rk[3];
-            rk[4] = rk[0] ^
-                (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
-                (Te3[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                (Te0[(temp      ) & 0xff] & 0x0000ff00) ^
-                (Te1[(temp >> 24)       ] & 0x000000ff) ^
-                rcon[i];
+            temp = rk[3];
+            rk[4] = rk[0] ^ (Te2[(temp >> 16) & 0xff] & 0xff000000) ^ (Te3[(temp >> 8) & 0xff] & 0x00ff0000) ^ (Te0[(temp) & 0xff] & 0x0000ff00) ^ (Te1[(temp >> 24)] & 0x000000ff) ^ rcon[i];
             rk[5] = rk[1] ^ rk[4];
             rk[6] = rk[2] ^ rk[5];
             rk[7] = rk[3] ^ rk[6];
@@ -1323,21 +3085,16 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     rk[5] = GETU32(userKey + 20);
     if (bits == 192) {
         while (1) {
-            temp = rk[ 5];
-            rk[ 6] = rk[ 0] ^
-                (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
-                (Te3[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                (Te0[(temp      ) & 0xff] & 0x0000ff00) ^
-                (Te1[(temp >> 24)       ] & 0x000000ff) ^
-                rcon[i];
-            rk[ 7] = rk[ 1] ^ rk[ 6];
-            rk[ 8] = rk[ 2] ^ rk[ 7];
-            rk[ 9] = rk[ 3] ^ rk[ 8];
+            temp = rk[5];
+            rk[6] = rk[0] ^ (Te2[(temp >> 16) & 0xff] & 0xff000000) ^ (Te3[(temp >> 8) & 0xff] & 0x00ff0000) ^ (Te0[(temp) & 0xff] & 0x0000ff00) ^ (Te1[(temp >> 24)] & 0x000000ff) ^ rcon[i];
+            rk[7] = rk[1] ^ rk[6];
+            rk[8] = rk[2] ^ rk[7];
+            rk[9] = rk[3] ^ rk[8];
             if (++i == 8) {
                 return 0;
             }
-            rk[10] = rk[ 4] ^ rk[ 9];
-            rk[11] = rk[ 5] ^ rk[10];
+            rk[10] = rk[4] ^ rk[9];
+            rk[11] = rk[5] ^ rk[10];
             rk += 6;
         }
     }
@@ -1345,31 +3102,22 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     rk[7] = GETU32(userKey + 28);
     if (bits == 256) {
         while (1) {
-            temp = rk[ 7];
-            rk[ 8] = rk[ 0] ^
-                (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
-                (Te3[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                (Te0[(temp      ) & 0xff] & 0x0000ff00) ^
-                (Te1[(temp >> 24)       ] & 0x000000ff) ^
-                rcon[i];
-            rk[ 9] = rk[ 1] ^ rk[ 8];
-            rk[10] = rk[ 2] ^ rk[ 9];
-            rk[11] = rk[ 3] ^ rk[10];
+            temp = rk[7];
+            rk[8] = rk[0] ^ (Te2[(temp >> 16) & 0xff] & 0xff000000) ^ (Te3[(temp >> 8) & 0xff] & 0x00ff0000) ^ (Te0[(temp) & 0xff] & 0x0000ff00) ^ (Te1[(temp >> 24)] & 0x000000ff) ^ rcon[i];
+            rk[9] = rk[1] ^ rk[8];
+            rk[10] = rk[2] ^ rk[9];
+            rk[11] = rk[3] ^ rk[10];
             if (++i == 7) {
                 return 0;
             }
             temp = rk[11];
-            rk[12] = rk[ 4] ^
-                (Te2[(temp >> 24)       ] & 0xff000000) ^
-                (Te3[(temp >> 16) & 0xff] & 0x00ff0000) ^
-                (Te0[(temp >>  8) & 0xff] & 0x0000ff00) ^
-                (Te1[(temp      ) & 0xff] & 0x000000ff);
-            rk[13] = rk[ 5] ^ rk[12];
-            rk[14] = rk[ 6] ^ rk[13];
-            rk[15] = rk[ 7] ^ rk[14];
+            rk[12] = rk[4] ^ (Te2[(temp >> 24)] & 0xff000000) ^ (Te3[(temp >> 16) & 0xff] & 0x00ff0000) ^ (Te0[(temp >> 8) & 0xff] & 0x0000ff00) ^ (Te1[(temp) & 0xff] & 0x000000ff);
+            rk[13] = rk[5] ^ rk[12];
+            rk[14] = rk[6] ^ rk[13];
+            rk[15] = rk[7] ^ rk[14];
 
             rk += 8;
-            }
+        }
     }
     return 0;
 }
@@ -1378,7 +3126,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
  * Expand the cipher key into the decryption key schedule.
  */
 int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key)
+    AES_KEY *key)
 {
 
     u32 *rk;
@@ -1393,35 +3141,27 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
     rk = key->rd_key;
 
     /* invert the order of the round keys: */
-    for (i = 0, j = 4*(key->rounds); i < j; i += 4, j -= 4) {
-        temp = rk[i    ]; rk[i    ] = rk[j    ]; rk[j    ] = temp;
-        temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp;
-        temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp;
-        temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp;
+    for (i = 0, j = 4 * (key->rounds); i < j; i += 4, j -= 4) {
+        temp = rk[i];
+        rk[i] = rk[j];
+        rk[j] = temp;
+        temp = rk[i + 1];
+        rk[i + 1] = rk[j + 1];
+        rk[j + 1] = temp;
+        temp = rk[i + 2];
+        rk[i + 2] = rk[j + 2];
+        rk[j + 2] = temp;
+        temp = rk[i + 3];
+        rk[i + 3] = rk[j + 3];
+        rk[j + 3] = temp;
     }
     /* apply the inverse MixColumn transform to all round keys but the first and the last: */
     for (i = 1; i < (key->rounds); i++) {
         rk += 4;
-        rk[0] =
-            Td0[Te1[(rk[0] >> 24)       ] & 0xff] ^
-            Td1[Te1[(rk[0] >> 16) & 0xff] & 0xff] ^
-            Td2[Te1[(rk[0] >>  8) & 0xff] & 0xff] ^
-            Td3[Te1[(rk[0]      ) & 0xff] & 0xff];
-        rk[1] =
-            Td0[Te1[(rk[1] >> 24)       ] & 0xff] ^
-            Td1[Te1[(rk[1] >> 16) & 0xff] & 0xff] ^
-            Td2[Te1[(rk[1] >>  8) & 0xff] & 0xff] ^
-            Td3[Te1[(rk[1]      ) & 0xff] & 0xff];
-        rk[2] =
-            Td0[Te1[(rk[2] >> 24)       ] & 0xff] ^
-            Td1[Te1[(rk[2] >> 16) & 0xff] & 0xff] ^
-            Td2[Te1[(rk[2] >>  8) & 0xff] & 0xff] ^
-            Td3[Te1[(rk[2]      ) & 0xff] & 0xff];
-        rk[3] =
-            Td0[Te1[(rk[3] >> 24)       ] & 0xff] ^
-            Td1[Te1[(rk[3] >> 16) & 0xff] & 0xff] ^
-            Td2[Te1[(rk[3] >>  8) & 0xff] & 0xff] ^
-            Td3[Te1[(rk[3]      ) & 0xff] & 0xff];
+        rk[0] = Td0[Te1[(rk[0] >> 24)] & 0xff] ^ Td1[Te1[(rk[0] >> 16) & 0xff] & 0xff] ^ Td2[Te1[(rk[0] >> 8) & 0xff] & 0xff] ^ Td3[Te1[(rk[0]) & 0xff] & 0xff];
+        rk[1] = Td0[Te1[(rk[1] >> 24)] & 0xff] ^ Td1[Te1[(rk[1] >> 16) & 0xff] & 0xff] ^ Td2[Te1[(rk[1] >> 8) & 0xff] & 0xff] ^ Td3[Te1[(rk[1]) & 0xff] & 0xff];
+        rk[2] = Td0[Te1[(rk[2] >> 24)] & 0xff] ^ Td1[Te1[(rk[2] >> 16) & 0xff] & 0xff] ^ Td2[Te1[(rk[2] >> 8) & 0xff] & 0xff] ^ Td3[Te1[(rk[2]) & 0xff] & 0xff];
+        rk[3] = Td0[Te1[(rk[3] >> 24)] & 0xff] ^ Td1[Te1[(rk[3] >> 16) & 0xff] & 0xff] ^ Td2[Te1[(rk[3] >> 8) & 0xff] & 0xff] ^ Td3[Te1[(rk[3]) & 0xff] & 0xff];
     }
     return 0;
 }
@@ -1431,7 +3171,8 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
  * in and out can overlap
  */
 void AES_encrypt(const unsigned char *in, unsigned char *out,
-                 const AES_KEY *key) {
+    const AES_KEY *key)
+{
 
     const u32 *rk;
     u32 s0, s1, s2, s3, t0, t1, t2, t3;
@@ -1446,174 +3187,114 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
      * map byte array block to cipher state
      * and add initial round key:
      */
-    s0 = GETU32(in     ) ^ rk[0];
-    s1 = GETU32(in +  4) ^ rk[1];
-    s2 = GETU32(in +  8) ^ rk[2];
+    s0 = GETU32(in) ^ rk[0];
+    s1 = GETU32(in + 4) ^ rk[1];
+    s2 = GETU32(in + 8) ^ rk[2];
     s3 = GETU32(in + 12) ^ rk[3];
 #ifdef FULL_UNROLL
     /* round 1: */
-    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[ 4];
-    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[ 5];
-    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[ 6];
-    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[ 7];
+    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[4];
+    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[5];
+    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[6];
+    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[7];
     /* round 2: */
-    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[ 8];
-    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[ 9];
-    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[10];
-    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[11];
+    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[8];
+    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[9];
+    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[10];
+    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[11];
     /* round 3: */
-    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[12];
-    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[13];
-    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[14];
-    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[15];
+    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[12];
+    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[13];
+    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[14];
+    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[15];
     /* round 4: */
-    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[16];
-    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[17];
-    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[18];
-    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[19];
+    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[16];
+    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[17];
+    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[18];
+    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[19];
     /* round 5: */
-    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[20];
-    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[21];
-    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[22];
-    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[23];
+    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[20];
+    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[21];
+    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[22];
+    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[23];
     /* round 6: */
-    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[24];
-    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[25];
-    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[26];
-    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[27];
+    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[24];
+    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[25];
+    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[26];
+    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[27];
     /* round 7: */
-    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[28];
-    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[29];
-    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[30];
-    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[31];
+    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[28];
+    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[29];
+    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[30];
+    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[31];
     /* round 8: */
-    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[32];
-    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[33];
-    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[34];
-    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[35];
+    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[32];
+    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[33];
+    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[34];
+    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[35];
     /* round 9: */
-    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[36];
-    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[37];
-    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[38];
-    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[39];
+    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[36];
+    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[37];
+    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[38];
+    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[39];
     if (key->rounds > 10) {
         /* round 10: */
-        s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[40];
-        s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[41];
-        s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[42];
-        s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[43];
+        s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[40];
+        s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[41];
+        s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[42];
+        s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[43];
         /* round 11: */
-        t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[44];
-        t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[45];
-        t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[46];
-        t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[47];
+        t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[44];
+        t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[45];
+        t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[46];
+        t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[47];
         if (key->rounds > 12) {
             /* round 12: */
-            s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[48];
-            s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[49];
-            s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[50];
-            s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[51];
+            s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[48];
+            s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[49];
+            s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[50];
+            s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[51];
             /* round 13: */
-            t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[52];
-            t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[53];
-            t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[54];
-            t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[55];
+            t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[52];
+            t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[53];
+            t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[54];
+            t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[55];
         }
     }
     rk += key->rounds << 2;
-#else  /* !FULL_UNROLL */
+#else /* !FULL_UNROLL */
     /*
      * Nr - 1 full rounds:
      */
     r = key->rounds >> 1;
     for (;;) {
-        t0 =
-            Te0[(s0 >> 24)       ] ^
-            Te1[(s1 >> 16) & 0xff] ^
-            Te2[(s2 >>  8) & 0xff] ^
-            Te3[(s3      ) & 0xff] ^
-            rk[4];
-        t1 =
-            Te0[(s1 >> 24)       ] ^
-            Te1[(s2 >> 16) & 0xff] ^
-            Te2[(s3 >>  8) & 0xff] ^
-            Te3[(s0      ) & 0xff] ^
-            rk[5];
-        t2 =
-            Te0[(s2 >> 24)       ] ^
-            Te1[(s3 >> 16) & 0xff] ^
-            Te2[(s0 >>  8) & 0xff] ^
-            Te3[(s1      ) & 0xff] ^
-            rk[6];
-        t3 =
-            Te0[(s3 >> 24)       ] ^
-            Te1[(s0 >> 16) & 0xff] ^
-            Te2[(s1 >>  8) & 0xff] ^
-            Te3[(s2      ) & 0xff] ^
-            rk[7];
+        t0 = Te0[(s0 >> 24)] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[(s3) & 0xff] ^ rk[4];
+        t1 = Te0[(s1 >> 24)] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[(s0) & 0xff] ^ rk[5];
+        t2 = Te0[(s2 >> 24)] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[(s1) & 0xff] ^ rk[6];
+        t3 = Te0[(s3 >> 24)] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[(s2) & 0xff] ^ rk[7];
 
         rk += 8;
         if (--r == 0) {
             break;
         }
 
-        s0 =
-            Te0[(t0 >> 24)       ] ^
-            Te1[(t1 >> 16) & 0xff] ^
-            Te2[(t2 >>  8) & 0xff] ^
-            Te3[(t3      ) & 0xff] ^
-            rk[0];
-        s1 =
-            Te0[(t1 >> 24)       ] ^
-            Te1[(t2 >> 16) & 0xff] ^
-            Te2[(t3 >>  8) & 0xff] ^
-            Te3[(t0      ) & 0xff] ^
-            rk[1];
-        s2 =
-            Te0[(t2 >> 24)       ] ^
-            Te1[(t3 >> 16) & 0xff] ^
-            Te2[(t0 >>  8) & 0xff] ^
-            Te3[(t1      ) & 0xff] ^
-            rk[2];
-        s3 =
-            Te0[(t3 >> 24)       ] ^
-            Te1[(t0 >> 16) & 0xff] ^
-            Te2[(t1 >>  8) & 0xff] ^
-            Te3[(t2      ) & 0xff] ^
-            rk[3];
+        s0 = Te0[(t0 >> 24)] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[(t3) & 0xff] ^ rk[0];
+        s1 = Te0[(t1 >> 24)] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[(t0) & 0xff] ^ rk[1];
+        s2 = Te0[(t2 >> 24)] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[(t1) & 0xff] ^ rk[2];
+        s3 = Te0[(t3 >> 24)] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[(t2) & 0xff] ^ rk[3];
     }
 #endif /* ?FULL_UNROLL */
     /*
      * apply last round and
      * map cipher state to byte array block:
      */
-    s0 =
-        (Te2[(t0 >> 24)       ] & 0xff000000) ^
-        (Te3[(t1 >> 16) & 0xff] & 0x00ff0000) ^
-        (Te0[(t2 >>  8) & 0xff] & 0x0000ff00) ^
-        (Te1[(t3      ) & 0xff] & 0x000000ff) ^
-        rk[0];
-    PUTU32(out     , s0);
-    s1 =
-        (Te2[(t1 >> 24)       ] & 0xff000000) ^
-        (Te3[(t2 >> 16) & 0xff] & 0x00ff0000) ^
-        (Te0[(t3 >>  8) & 0xff] & 0x0000ff00) ^
-        (Te1[(t0      ) & 0xff] & 0x000000ff) ^
-        rk[1];
-    PUTU32(out +  4, s1);
-    s2 =
-        (Te2[(t2 >> 24)       ] & 0xff000000) ^
-        (Te3[(t3 >> 16) & 0xff] & 0x00ff0000) ^
-        (Te0[(t0 >>  8) & 0xff] & 0x0000ff00) ^
-        (Te1[(t1      ) & 0xff] & 0x000000ff) ^
-        rk[2];
-    PUTU32(out +  8, s2);
-    s3 =
-        (Te2[(t3 >> 24)       ] & 0xff000000) ^
-        (Te3[(t0 >> 16) & 0xff] & 0x00ff0000) ^
-        (Te0[(t1 >>  8) & 0xff] & 0x0000ff00) ^
-        (Te1[(t2      ) & 0xff] & 0x000000ff) ^
-        rk[3];
+    s0 = (Te2[(t0 >> 24)] & 0xff000000) ^ (Te3[(t1 >> 16) & 0xff] & 0x00ff0000) ^ (Te0[(t2 >> 8) & 0xff] & 0x0000ff00) ^ (Te1[(t3) & 0xff] & 0x000000ff) ^ rk[0];
+    PUTU32(out, s0);
+    s1 = (Te2[(t1 >> 24)] & 0xff000000) ^ (Te3[(t2 >> 16) & 0xff] & 0x00ff0000) ^ (Te0[(t3 >> 8) & 0xff] & 0x0000ff00) ^ (Te1[(t0) & 0xff] & 0x000000ff) ^ rk[1];
+    PUTU32(out + 4, s1);
+    s2 = (Te2[(t2 >> 24)] & 0xff000000) ^ (Te3[(t3 >> 16) & 0xff] & 0x00ff0000) ^ (Te0[(t0 >> 8) & 0xff] & 0x0000ff00) ^ (Te1[(t1) & 0xff] & 0x000000ff) ^ rk[2];
+    PUTU32(out + 8, s2);
+    s3 = (Te2[(t3 >> 24)] & 0xff000000) ^ (Te3[(t0 >> 16) & 0xff] & 0x00ff0000) ^ (Te0[(t1 >> 8) & 0xff] & 0x0000ff00) ^ (Te1[(t2) & 0xff] & 0x000000ff) ^ rk[3];
     PUTU32(out + 12, s3);
 }
 
@@ -1622,7 +3303,7 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
  * in and out can overlap
  */
 void AES_decrypt(const unsigned char *in, unsigned char *out,
-                 const AES_KEY *key)
+    const AES_KEY *key)
 {
 
     const u32 *rk;
@@ -1638,174 +3319,114 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
      * map byte array block to cipher state
      * and add initial round key:
      */
-    s0 = GETU32(in     ) ^ rk[0];
-    s1 = GETU32(in +  4) ^ rk[1];
-    s2 = GETU32(in +  8) ^ rk[2];
+    s0 = GETU32(in) ^ rk[0];
+    s1 = GETU32(in + 4) ^ rk[1];
+    s2 = GETU32(in + 8) ^ rk[2];
     s3 = GETU32(in + 12) ^ rk[3];
 #ifdef FULL_UNROLL
     /* round 1: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[ 4];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[ 5];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[ 6];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[ 7];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[4];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[5];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[6];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[7];
     /* round 2: */
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[ 8];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[ 9];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[10];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[11];
+    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[8];
+    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[9];
+    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[10];
+    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[11];
     /* round 3: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[12];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[13];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[14];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[15];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[12];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[13];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[14];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[15];
     /* round 4: */
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[16];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[17];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[18];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[19];
+    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[16];
+    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[17];
+    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[18];
+    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[19];
     /* round 5: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[20];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[21];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[22];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[23];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[20];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[21];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[22];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[23];
     /* round 6: */
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[24];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[25];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[26];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[27];
+    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[24];
+    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[25];
+    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[26];
+    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[27];
     /* round 7: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[28];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[29];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[30];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[31];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[28];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[29];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[30];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[31];
     /* round 8: */
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[32];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[33];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[34];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[35];
+    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[32];
+    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[33];
+    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[34];
+    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[35];
     /* round 9: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[36];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[37];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[38];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[39];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[36];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[37];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[38];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[39];
     if (key->rounds > 10) {
         /* round 10: */
-        s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[40];
-        s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[41];
-        s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[42];
-        s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[43];
+        s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[40];
+        s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[41];
+        s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[42];
+        s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[43];
         /* round 11: */
-        t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[44];
-        t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[45];
-        t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[46];
-        t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[47];
+        t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[44];
+        t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[45];
+        t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[46];
+        t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[47];
         if (key->rounds > 12) {
             /* round 12: */
-            s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[48];
-            s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[49];
-            s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[50];
-            s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[51];
+            s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[48];
+            s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[49];
+            s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[50];
+            s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[51];
             /* round 13: */
-            t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[52];
-            t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[53];
-            t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[54];
-            t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[55];
+            t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[52];
+            t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[53];
+            t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[54];
+            t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[55];
         }
     }
     rk += key->rounds << 2;
-#else  /* !FULL_UNROLL */
+#else /* !FULL_UNROLL */
     /*
      * Nr - 1 full rounds:
      */
     r = key->rounds >> 1;
     for (;;) {
-        t0 =
-            Td0[(s0 >> 24)       ] ^
-            Td1[(s3 >> 16) & 0xff] ^
-            Td2[(s2 >>  8) & 0xff] ^
-            Td3[(s1      ) & 0xff] ^
-            rk[4];
-        t1 =
-            Td0[(s1 >> 24)       ] ^
-            Td1[(s0 >> 16) & 0xff] ^
-            Td2[(s3 >>  8) & 0xff] ^
-            Td3[(s2      ) & 0xff] ^
-            rk[5];
-        t2 =
-            Td0[(s2 >> 24)       ] ^
-            Td1[(s1 >> 16) & 0xff] ^
-            Td2[(s0 >>  8) & 0xff] ^
-            Td3[(s3      ) & 0xff] ^
-            rk[6];
-        t3 =
-            Td0[(s3 >> 24)       ] ^
-            Td1[(s2 >> 16) & 0xff] ^
-            Td2[(s1 >>  8) & 0xff] ^
-            Td3[(s0      ) & 0xff] ^
-            rk[7];
+        t0 = Td0[(s0 >> 24)] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >> 8) & 0xff] ^ Td3[(s1) & 0xff] ^ rk[4];
+        t1 = Td0[(s1 >> 24)] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >> 8) & 0xff] ^ Td3[(s2) & 0xff] ^ rk[5];
+        t2 = Td0[(s2 >> 24)] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >> 8) & 0xff] ^ Td3[(s3) & 0xff] ^ rk[6];
+        t3 = Td0[(s3 >> 24)] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >> 8) & 0xff] ^ Td3[(s0) & 0xff] ^ rk[7];
 
         rk += 8;
         if (--r == 0) {
             break;
         }
 
-        s0 =
-            Td0[(t0 >> 24)       ] ^
-            Td1[(t3 >> 16) & 0xff] ^
-            Td2[(t2 >>  8) & 0xff] ^
-            Td3[(t1      ) & 0xff] ^
-            rk[0];
-        s1 =
-            Td0[(t1 >> 24)       ] ^
-            Td1[(t0 >> 16) & 0xff] ^
-            Td2[(t3 >>  8) & 0xff] ^
-            Td3[(t2      ) & 0xff] ^
-            rk[1];
-        s2 =
-            Td0[(t2 >> 24)       ] ^
-            Td1[(t1 >> 16) & 0xff] ^
-            Td2[(t0 >>  8) & 0xff] ^
-            Td3[(t3      ) & 0xff] ^
-            rk[2];
-        s3 =
-            Td0[(t3 >> 24)       ] ^
-            Td1[(t2 >> 16) & 0xff] ^
-            Td2[(t1 >>  8) & 0xff] ^
-            Td3[(t0      ) & 0xff] ^
-            rk[3];
+        s0 = Td0[(t0 >> 24)] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >> 8) & 0xff] ^ Td3[(t1) & 0xff] ^ rk[0];
+        s1 = Td0[(t1 >> 24)] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >> 8) & 0xff] ^ Td3[(t2) & 0xff] ^ rk[1];
+        s2 = Td0[(t2 >> 24)] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >> 8) & 0xff] ^ Td3[(t3) & 0xff] ^ rk[2];
+        s3 = Td0[(t3 >> 24)] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >> 8) & 0xff] ^ Td3[(t0) & 0xff] ^ rk[3];
     }
 #endif /* ?FULL_UNROLL */
     /*
      * apply last round and
      * map cipher state to byte array block:
      */
-    s0 =
-        ((u32)Td4[(t0 >> 24)       ] << 24) ^
-        ((u32)Td4[(t3 >> 16) & 0xff] << 16) ^
-        ((u32)Td4[(t2 >>  8) & 0xff] <<  8) ^
-        ((u32)Td4[(t1      ) & 0xff])       ^
-        rk[0];
-    PUTU32(out     , s0);
-    s1 =
-        ((u32)Td4[(t1 >> 24)       ] << 24) ^
-        ((u32)Td4[(t0 >> 16) & 0xff] << 16) ^
-        ((u32)Td4[(t3 >>  8) & 0xff] <<  8) ^
-        ((u32)Td4[(t2      ) & 0xff])       ^
-        rk[1];
-    PUTU32(out +  4, s1);
-    s2 =
-        ((u32)Td4[(t2 >> 24)       ] << 24) ^
-        ((u32)Td4[(t1 >> 16) & 0xff] << 16) ^
-        ((u32)Td4[(t0 >>  8) & 0xff] <<  8) ^
-        ((u32)Td4[(t3      ) & 0xff])       ^
-        rk[2];
-    PUTU32(out +  8, s2);
-    s3 =
-        ((u32)Td4[(t3 >> 24)       ] << 24) ^
-        ((u32)Td4[(t2 >> 16) & 0xff] << 16) ^
-        ((u32)Td4[(t1 >>  8) & 0xff] <<  8) ^
-        ((u32)Td4[(t0      ) & 0xff])       ^
-        rk[3];
+    s0 = ((u32)Td4[(t0 >> 24)] << 24) ^ ((u32)Td4[(t3 >> 16) & 0xff] << 16) ^ ((u32)Td4[(t2 >> 8) & 0xff] << 8) ^ ((u32)Td4[(t1) & 0xff]) ^ rk[0];
+    PUTU32(out, s0);
+    s1 = ((u32)Td4[(t1 >> 24)] << 24) ^ ((u32)Td4[(t0 >> 16) & 0xff] << 16) ^ ((u32)Td4[(t3 >> 8) & 0xff] << 8) ^ ((u32)Td4[(t2) & 0xff]) ^ rk[1];
+    PUTU32(out + 4, s1);
+    s2 = ((u32)Td4[(t2 >> 24)] << 24) ^ ((u32)Td4[(t1 >> 16) & 0xff] << 16) ^ ((u32)Td4[(t0 >> 8) & 0xff] << 8) ^ ((u32)Td4[(t3) & 0xff]) ^ rk[2];
+    PUTU32(out + 8, s2);
+    s3 = ((u32)Td4[(t3 >> 24)] << 24) ^ ((u32)Td4[(t2 >> 16) & 0xff] << 16) ^ ((u32)Td4[(t1 >> 8) & 0xff] << 8) ^ ((u32)Td4[(t0) & 0xff]) ^ rk[3];
     PUTU32(out + 12, s3);
 }
 
@@ -1846,16 +3467,23 @@ static const u8 Te4[256] = {
     0x41U, 0x99U, 0x2dU, 0x0fU, 0xb0U, 0x54U, 0xbbU, 0x16U
 };
 static const u32 rcon[] = {
-    0x01000000, 0x02000000, 0x04000000, 0x08000000,
-    0x10000000, 0x20000000, 0x40000000, 0x80000000,
-    0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+    0x01000000,
+    0x02000000,
+    0x04000000,
+    0x08000000,
+    0x10000000,
+    0x20000000,
+    0x40000000,
+    0x80000000,
+    0x1B000000,
+    0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
 };
 
 /**
  * Expand the cipher key into the encryption key schedule.
  */
 int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key)
+    AES_KEY *key)
 {
     u32 *rk;
     int i = 0;
@@ -1875,19 +3503,14 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     else
         key->rounds = 14;
 
-    rk[0] = GETU32(userKey     );
-    rk[1] = GETU32(userKey +  4);
-    rk[2] = GETU32(userKey +  8);
+    rk[0] = GETU32(userKey);
+    rk[1] = GETU32(userKey + 4);
+    rk[2] = GETU32(userKey + 8);
     rk[3] = GETU32(userKey + 12);
     if (bits == 128) {
         while (1) {
-            temp  = rk[3];
-            rk[4] = rk[0] ^
-                ((u32)Te4[(temp >> 16) & 0xff] << 24) ^
-                ((u32)Te4[(temp >>  8) & 0xff] << 16) ^
-                ((u32)Te4[(temp      ) & 0xff] << 8) ^
-                ((u32)Te4[(temp >> 24)       ]) ^
-                rcon[i];
+            temp = rk[3];
+            rk[4] = rk[0] ^ ((u32)Te4[(temp >> 16) & 0xff] << 24) ^ ((u32)Te4[(temp >> 8) & 0xff] << 16) ^ ((u32)Te4[(temp) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)]) ^ rcon[i];
             rk[5] = rk[1] ^ rk[4];
             rk[6] = rk[2] ^ rk[5];
             rk[7] = rk[3] ^ rk[6];
@@ -1901,21 +3524,16 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     rk[5] = GETU32(userKey + 20);
     if (bits == 192) {
         while (1) {
-            temp = rk[ 5];
-            rk[ 6] = rk[ 0] ^
-                ((u32)Te4[(temp >> 16) & 0xff] << 24) ^
-                ((u32)Te4[(temp >>  8) & 0xff] << 16) ^
-                ((u32)Te4[(temp      ) & 0xff] << 8) ^
-                ((u32)Te4[(temp >> 24)       ]) ^
-                rcon[i];
-            rk[ 7] = rk[ 1] ^ rk[ 6];
-            rk[ 8] = rk[ 2] ^ rk[ 7];
-            rk[ 9] = rk[ 3] ^ rk[ 8];
+            temp = rk[5];
+            rk[6] = rk[0] ^ ((u32)Te4[(temp >> 16) & 0xff] << 24) ^ ((u32)Te4[(temp >> 8) & 0xff] << 16) ^ ((u32)Te4[(temp) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)]) ^ rcon[i];
+            rk[7] = rk[1] ^ rk[6];
+            rk[8] = rk[2] ^ rk[7];
+            rk[9] = rk[3] ^ rk[8];
             if (++i == 8) {
                 return 0;
             }
-            rk[10] = rk[ 4] ^ rk[ 9];
-            rk[11] = rk[ 5] ^ rk[10];
+            rk[10] = rk[4] ^ rk[9];
+            rk[11] = rk[5] ^ rk[10];
             rk += 6;
         }
     }
@@ -1923,28 +3541,19 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     rk[7] = GETU32(userKey + 28);
     if (bits == 256) {
         while (1) {
-            temp = rk[ 7];
-            rk[ 8] = rk[ 0] ^
-                ((u32)Te4[(temp >> 16) & 0xff] << 24) ^
-                ((u32)Te4[(temp >>  8) & 0xff] << 16) ^
-                ((u32)Te4[(temp      ) & 0xff] << 8) ^
-                ((u32)Te4[(temp >> 24)       ]) ^
-                rcon[i];
-            rk[ 9] = rk[ 1] ^ rk[ 8];
-            rk[10] = rk[ 2] ^ rk[ 9];
-            rk[11] = rk[ 3] ^ rk[10];
+            temp = rk[7];
+            rk[8] = rk[0] ^ ((u32)Te4[(temp >> 16) & 0xff] << 24) ^ ((u32)Te4[(temp >> 8) & 0xff] << 16) ^ ((u32)Te4[(temp) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)]) ^ rcon[i];
+            rk[9] = rk[1] ^ rk[8];
+            rk[10] = rk[2] ^ rk[9];
+            rk[11] = rk[3] ^ rk[10];
             if (++i == 7) {
                 return 0;
             }
             temp = rk[11];
-            rk[12] = rk[ 4] ^
-                ((u32)Te4[(temp >> 24)       ] << 24) ^
-                ((u32)Te4[(temp >> 16) & 0xff] << 16) ^
-                ((u32)Te4[(temp >>  8) & 0xff] << 8) ^
-                ((u32)Te4[(temp      ) & 0xff]);
-            rk[13] = rk[ 5] ^ rk[12];
-            rk[14] = rk[ 6] ^ rk[13];
-            rk[15] = rk[ 7] ^ rk[14];
+            rk[12] = rk[4] ^ ((u32)Te4[(temp >> 24)] << 24) ^ ((u32)Te4[(temp >> 16) & 0xff] << 16) ^ ((u32)Te4[(temp >> 8) & 0xff] << 8) ^ ((u32)Te4[(temp) & 0xff]);
+            rk[13] = rk[5] ^ rk[12];
+            rk[14] = rk[6] ^ rk[13];
+            rk[15] = rk[7] ^ rk[14];
 
             rk += 8;
         }
@@ -1956,7 +3565,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
  * Expand the cipher key into the decryption key schedule.
  */
 int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key)
+    AES_KEY *key)
 {
 
     u32 *rk;
@@ -1971,11 +3580,19 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
     rk = key->rd_key;
 
     /* invert the order of the round keys: */
-    for (i = 0, j = 4*(key->rounds); i < j; i += 4, j -= 4) {
-        temp = rk[i    ]; rk[i    ] = rk[j    ]; rk[j    ] = temp;
-        temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp;
-        temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp;
-        temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp;
+    for (i = 0, j = 4 * (key->rounds); i < j; i += 4, j -= 4) {
+        temp = rk[i];
+        rk[i] = rk[j];
+        rk[j] = temp;
+        temp = rk[i + 1];
+        rk[i + 1] = rk[j + 1];
+        rk[j + 1] = temp;
+        temp = rk[i + 2];
+        rk[i + 2] = rk[j + 2];
+        rk[j + 2] = temp;
+        temp = rk[i + 3];
+        rk[i + 3] = rk[j + 3];
+        rk[j + 3] = temp;
     }
     /* apply the inverse MixColumn transform to all round keys but the first and the last: */
     for (i = 1; i < (key->rounds); i++) {
@@ -1985,25 +3602,19 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
 
             tp1 = rk[j];
             m = tp1 & 0x80808080;
-            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             m = tp2 & 0x80808080;
-            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             m = tp4 & 0x80808080;
-            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             tp9 = tp8 ^ tp1;
             tpb = tp9 ^ tp2;
             tpd = tp9 ^ tp4;
             tpe = tp8 ^ tp4 ^ tp2;
 #if defined(ROTATE)
-            rk[j] = tpe ^ ROTATE(tpd,16) ^
-                ROTATE(tp9,24) ^ ROTATE(tpb,8);
+            rk[j] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 24) ^ ROTATE(tpb, 8);
 #else
-            rk[j] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^
-                (tp9 >> 8) ^ (tp9 << 24) ^
-                (tpb >> 24) ^ (tpb << 8);
+            rk[j] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 8) ^ (tp9 << 24) ^ (tpb >> 24) ^ (tpb << 8);
 #endif
         }
     }
diff --git a/crypto/openssl/crypto/aes/aes_ecb.c b/crypto/openssl/crypto/aes/aes_ecb.c
index e05afb0449cc..d0e9747ccc3f 100644
--- a/crypto/openssl/crypto/aes/aes_ecb.c
+++ b/crypto/openssl/crypto/aes/aes_ecb.c
@@ -19,7 +19,7 @@
 #include "aes_local.h"
 
 void AES_ecb_encrypt(const unsigned char *in, unsigned char *out,
-                     const AES_KEY *key, const int enc)
+    const AES_KEY *key, const int enc)
 {
 
     assert(in && out && key);
diff --git a/crypto/openssl/crypto/aes/aes_ige.c b/crypto/openssl/crypto/aes/aes_ige.c
index 72fcba7a0cf1..0308f3f22567 100644
--- a/crypto/openssl/crypto/aes/aes_ige.c
+++ b/crypto/openssl/crypto/aes/aes_ige.c
@@ -20,9 +20,9 @@
 
 /* XXX: probably some better way to do this */
 #if defined(__i386__) || defined(__x86_64__)
-# define UNALIGNED_MEMOPS_ARE_FAST 1
+#define UNALIGNED_MEMOPS_ARE_FAST 1
 #else
-# define UNALIGNED_MEMOPS_ARE_FAST 0
+#define UNALIGNED_MEMOPS_ARE_FAST 0
 #endif
 
 #define N_WORDS (AES_BLOCK_SIZE / sizeof(unsigned long))
@@ -35,19 +35,19 @@ typedef struct {
 #endif
 
 #if UNALIGNED_MEMOPS_ARE_FAST
-# define load_block(d, s)        (d) = *(const aes_block_t *)(s)
-# define store_block(d, s)       *(aes_block_t *)(d) = (s)
+#define load_block(d, s) (d) = *(const aes_block_t *)(s)
+#define store_block(d, s) *(aes_block_t *)(d) = (s)
 #else
-# define load_block(d, s)        memcpy((d).data, (s), AES_BLOCK_SIZE)
-# define store_block(d, s)       memcpy((d), (s).data, AES_BLOCK_SIZE)
+#define load_block(d, s) memcpy((d).data, (s), AES_BLOCK_SIZE)
+#define store_block(d, s) memcpy((d), (s).data, AES_BLOCK_SIZE)
 #endif
 
 /* N.B. The IV for this mode is _twice_ the block size */
 
 /*  Use of this function is deprecated. */
 void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
-                     size_t length, const AES_KEY *key,
-                     unsigned char *ivec, const int enc)
+    size_t length, const AES_KEY *key,
+    unsigned char *ivec, const int enc)
 {
     size_t n;
     size_t len = length / AES_BLOCK_SIZE;
@@ -60,21 +60,18 @@ void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
     OPENSSL_assert((length % AES_BLOCK_SIZE) == 0);
 
     if (AES_ENCRYPT == enc) {
-        if (in != out &&
-            (UNALIGNED_MEMOPS_ARE_FAST
-             || ((size_t)in | (size_t)out | (size_t)ivec) % sizeof(long) ==
-             0)) {
-            aes_block_t *ivp = (aes_block_t *) ivec;
-            aes_block_t *iv2p = (aes_block_t *) (ivec + AES_BLOCK_SIZE);
+        if (in != out && (UNALIGNED_MEMOPS_ARE_FAST || ((size_t)in | (size_t)out | (size_t)ivec) % sizeof(long) == 0)) {
+            aes_block_t *ivp = (aes_block_t *)ivec;
+            aes_block_t *iv2p = (aes_block_t *)(ivec + AES_BLOCK_SIZE);
 
             while (len) {
-                aes_block_t *inp = (aes_block_t *) in;
-                aes_block_t *outp = (aes_block_t *) out;
+                aes_block_t *inp = (aes_block_t *)in;
+                aes_block_t *outp = (aes_block_t *)out;
 
                 for (n = 0; n < N_WORDS; ++n)
                     outp->data[n] = inp->data[n] ^ ivp->data[n];
                 AES_encrypt((unsigned char *)outp->data,
-                            (unsigned char *)outp->data, key);
+                    (unsigned char *)outp->data, key);
                 for (n = 0; n < N_WORDS; ++n)
                     outp->data[n] ^= iv2p->data[n];
                 ivp = outp;
@@ -98,7 +95,7 @@ void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
                 for (n = 0; n < N_WORDS; ++n)
                     tmp2.data[n] = tmp.data[n] ^ iv.data[n];
                 AES_encrypt((unsigned char *)tmp2.data,
-                            (unsigned char *)tmp2.data, key);
+                    (unsigned char *)tmp2.data, key);
                 for (n = 0; n < N_WORDS; ++n)
                     tmp2.data[n] ^= iv2.data[n];
                 store_block(out, tmp2);
@@ -112,22 +109,19 @@ void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
             memcpy(ivec + AES_BLOCK_SIZE, iv2.data, AES_BLOCK_SIZE);
         }
     } else {
-        if (in != out &&
-            (UNALIGNED_MEMOPS_ARE_FAST
-             || ((size_t)in | (size_t)out | (size_t)ivec) % sizeof(long) ==
-             0)) {
-            aes_block_t *ivp = (aes_block_t *) ivec;
-            aes_block_t *iv2p = (aes_block_t *) (ivec + AES_BLOCK_SIZE);
+        if (in != out && (UNALIGNED_MEMOPS_ARE_FAST || ((size_t)in | (size_t)out | (size_t)ivec) % sizeof(long) == 0)) {
+            aes_block_t *ivp = (aes_block_t *)ivec;
+            aes_block_t *iv2p = (aes_block_t *)(ivec + AES_BLOCK_SIZE);
 
             while (len) {
                 aes_block_t tmp;
-                aes_block_t *inp = (aes_block_t *) in;
-                aes_block_t *outp = (aes_block_t *) out;
+                aes_block_t *inp = (aes_block_t *)in;
+                aes_block_t *outp = (aes_block_t *)out;
 
                 for (n = 0; n < N_WORDS; ++n)
                     tmp.data[n] = inp->data[n] ^ iv2p->data[n];
                 AES_decrypt((unsigned char *)tmp.data,
-                            (unsigned char *)outp->data, key);
+                    (unsigned char *)outp->data, key);
                 for (n = 0; n < N_WORDS; ++n)
                     outp->data[n] ^= ivp->data[n];
                 ivp = inp;
@@ -152,7 +146,7 @@ void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
                 for (n = 0; n < N_WORDS; ++n)
                     tmp.data[n] ^= iv2.data[n];
                 AES_decrypt((unsigned char *)tmp.data,
-                            (unsigned char *)tmp.data, key);
+                    (unsigned char *)tmp.data, key);
                 for (n = 0; n < N_WORDS; ++n)
                     tmp.data[n] ^= iv.data[n];
                 store_block(out, tmp);
@@ -184,9 +178,9 @@ void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
 /* N.B. The IV for this mode is _four times_ the block size */
 
 void AES_bi_ige_encrypt(const unsigned char *in, unsigned char *out,
-                        size_t length, const AES_KEY *key,
-                        const AES_KEY *key2, const unsigned char *ivec,
-                        const int enc)
+    size_t length, const AES_KEY *key,
+    const AES_KEY *key2, const unsigned char *ivec,
+    const int enc)
 {
     size_t n;
     size_t len = length;
diff --git a/crypto/openssl/crypto/aes/aes_local.h b/crypto/openssl/crypto/aes/aes_local.h
index 69d17d6cde7b..71f9f5c648b9 100644
--- a/crypto/openssl/crypto/aes/aes_local.h
+++ b/crypto/openssl/crypto/aes/aes_local.h
@@ -8,36 +8,45 @@
  */
 
 #ifndef OSSL_CRYPTO_AES_LOCAL_H
-# define OSSL_CRYPTO_AES_LOCAL_H
+#define OSSL_CRYPTO_AES_LOCAL_H
 
-# include <openssl/e_os2.h>
-# include <stdio.h>
-# include <stdlib.h>
-# include <string.h>
+#include <openssl/e_os2.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
 
-# if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64))
-#  define SWAP(x) (_lrotl(x, 8) & 0x00ff00ff | _lrotr(x, 8) & 0xff00ff00)
-#  define GETU32(p) SWAP(*((u32 *)(p)))
-#  define PUTU32(ct, st) { *((u32 *)(ct)) = SWAP((st)); }
-# else
-#  define GETU32(pt) (((u32)(pt)[0] << 24) ^ ((u32)(pt)[1] << 16) ^ ((u32)(pt)[2] <<  8) ^ ((u32)(pt)[3]))
-#  define PUTU32(ct, st) { (ct)[0] = (u8)((st) >> 24); (ct)[1] = (u8)((st) >> 16); (ct)[2] = (u8)((st) >>  8); (ct)[3] = (u8)(st); }
-# endif
+#if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64))
+#define SWAP(x) (_lrotl(x, 8) & 0x00ff00ff | _lrotr(x, 8) & 0xff00ff00)
+#define GETU32(p) SWAP(*((u32 *)(p)))
+#define PUTU32(ct, st)               \
+    {                                \
+        *((u32 *)(ct)) = SWAP((st)); \
+    }
+#else
+#define GETU32(pt) (((u32)(pt)[0] << 24) ^ ((u32)(pt)[1] << 16) ^ ((u32)(pt)[2] << 8) ^ ((u32)(pt)[3]))
+#define PUTU32(ct, st)              \
+    {                               \
+        (ct)[0] = (u8)((st) >> 24); \
+        (ct)[1] = (u8)((st) >> 16); \
+        (ct)[2] = (u8)((st) >> 8);  \
+        (ct)[3] = (u8)(st);         \
+    }
+#endif
 
 typedef uint64_t u64;
-# ifdef AES_LONG
+#ifdef AES_LONG
 typedef unsigned long u32;
-# else
+#else
 typedef unsigned int u32;
-# endif
+#endif
 typedef unsigned short u16;
 typedef unsigned char u8;
 
-# define MAXKC   (256/32)
-# define MAXKB   (256/8)
-# define MAXNR   14
+#define MAXKC (256 / 32)
+#define MAXKB (256 / 8)
+#define MAXNR 14
 
 /* This controls loop-unrolling in aes_core.c */
-# undef FULL_UNROLL
+#undef FULL_UNROLL
 
-#endif                          /* !OSSL_CRYPTO_AES_LOCAL_H */
+#endif /* !OSSL_CRYPTO_AES_LOCAL_H */
diff --git a/crypto/openssl/crypto/aes/aes_misc.c b/crypto/openssl/crypto/aes/aes_misc.c
index 7f39bcf2b35f..e2729dd54960 100644
--- a/crypto/openssl/crypto/aes/aes_misc.c
+++ b/crypto/openssl/crypto/aes/aes_misc.c
@@ -14,10 +14,10 @@
 #ifndef OPENSSL_NO_DEPRECATED_3_0
 const char *AES_options(void)
 {
-# ifdef FULL_UNROLL
+#ifdef FULL_UNROLL
     return "aes(full)";
-# else
+#else
     return "aes(partial)";
-# endif
+#endif
 }
 #endif
diff --git a/crypto/openssl/crypto/aes/aes_ofb.c b/crypto/openssl/crypto/aes/aes_ofb.c
index 58e47dc45e73..57b5a5496de9 100644
--- a/crypto/openssl/crypto/aes/aes_ofb.c
+++ b/crypto/openssl/crypto/aes/aes_ofb.c
@@ -17,9 +17,9 @@
 #include <openssl/modes.h>
 
 void AES_ofb128_encrypt(const unsigned char *in, unsigned char *out,
-                        size_t length, const AES_KEY *key,
-                        unsigned char *ivec, int *num)
+    size_t length, const AES_KEY *key,
+    unsigned char *ivec, int *num)
 {
     CRYPTO_ofb128_encrypt(in, out, length, key, ivec, num,
-                          (block128_f) AES_encrypt);
+        (block128_f)AES_encrypt);
 }
diff --git a/crypto/openssl/crypto/aes/aes_wrap.c b/crypto/openssl/crypto/aes/aes_wrap.c
index 2187883aff91..6b372c67a85a 100644
--- a/crypto/openssl/crypto/aes/aes_wrap.c
+++ b/crypto/openssl/crypto/aes/aes_wrap.c
@@ -18,16 +18,16 @@
 #include <openssl/modes.h>
 
 int AES_wrap_key(AES_KEY *key, const unsigned char *iv,
-                 unsigned char *out,
-                 const unsigned char *in, unsigned int inlen)
+    unsigned char *out,
+    const unsigned char *in, unsigned int inlen)
 {
-    return CRYPTO_128_wrap(key, iv, out, in, inlen, (block128_f) AES_encrypt);
+    return CRYPTO_128_wrap(key, iv, out, in, inlen, (block128_f)AES_encrypt);
 }
 
 int AES_unwrap_key(AES_KEY *key, const unsigned char *iv,
-                   unsigned char *out,
-                   const unsigned char *in, unsigned int inlen)
+    unsigned char *out,
+    const unsigned char *in, unsigned int inlen)
 {
     return CRYPTO_128_unwrap(key, iv, out, in, inlen,
-                             (block128_f) AES_decrypt);
+        (block128_f)AES_decrypt);
 }
diff --git a/crypto/openssl/crypto/aes/aes_x86core.c b/crypto/openssl/crypto/aes/aes_x86core.c
index 3e5b24ed193d..0fa994871b27 100644
--- a/crypto/openssl/crypto/aes/aes_x86core.c
+++ b/crypto/openssl/crypto/aes/aes_x86core.c
@@ -41,7 +41,6 @@
  * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include <assert.h>
 
 #include <stdlib.h>
@@ -53,11 +52,11 @@
  * referenced in outer and respectively inner rounds.
  */
 #define AES_COMPACT_IN_OUTER_ROUNDS
-#ifdef  AES_COMPACT_IN_OUTER_ROUNDS
+#ifdef AES_COMPACT_IN_OUTER_ROUNDS
 /* AES_COMPACT_IN_OUTER_ROUNDS costs ~30% in performance, while
  * adding AES_COMPACT_IN_INNER_ROUNDS reduces benchmark *further*
  * by factor of ~2. */
-# undef  AES_COMPACT_IN_INNER_ROUNDS
+#undef AES_COMPACT_IN_INNER_ROUNDS
 #endif
 
 #if 1
@@ -68,42 +67,43 @@ static void prefetch256(const void *table)
     int i;
 
     /* 32 is common least cache-line size */
-    for (sum = 0, i = 0; i < 256/sizeof(t[0]); i += 32/sizeof(t[0]))
+    for (sum = 0, i = 0; i < 256 / sizeof(t[0]); i += 32 / sizeof(t[0]))
         sum ^= t[i];
 
     ret = sum;
 }
 #else
-# define prefetch256(t)
+#define prefetch256(t)
 #endif
 
 #undef GETU32
-#define GETU32(p) (*((u32*)(p)))
+#define GETU32(p) (*((u32 *)(p)))
 
 #if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
-#define U64(C)  C##UI64
+#define U64(C) C##UI64
 #elif defined(__arch64__)
-#define U64(C)  C##UL
+#define U64(C) C##UL
 #else
-#define U64(C)  C##ULL
+#define U64(C) C##ULL
 #endif
 
 #undef ROTATE
 #if defined(_MSC_VER)
-# define ROTATE(a,n)    _lrotl(a,n)
+#define ROTATE(a, n) _lrotl(a, n)
 #elif defined(__ICC)
-# define ROTATE(a,n)    _rotl(a,n)
-#elif defined(__GNUC__) && __GNUC__>=2
-# if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)
-#   define ROTATE(a,n)  ({ register unsigned int ret;   \
-                asm (           \
-                "roll %1,%0"        \
-                : "=r"(ret)     \
-                : "I"(n), "0"(a)    \
-                : "cc");        \
-               ret;             \
-            })
-# endif
+#define ROTATE(a, n) _rotl(a, n)
+#elif defined(__GNUC__) && __GNUC__ >= 2
+#if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)
+#define ROTATE(a, n) ({        \
+    register unsigned int ret; \
+    asm(                       \
+        "roll %1,%0"           \
+        : "=r"(ret)            \
+        : "I"(n), "0"(a)       \
+        : "cc");               \
+    ret;                       \
+})
+#endif
 #endif
 /*-
 Te [x] = S [x].[02, 01, 01, 03, 02, 01, 01, 03];
@@ -112,10 +112,10 @@ Te1[x] = S [x].[03, 02, 01, 01];
 Te2[x] = S [x].[01, 03, 02, 01];
 Te3[x] = S [x].[01, 01, 03, 02];
 */
-#define Te0 (u32)((u64*)((u8*)Te+0))
-#define Te1 (u32)((u64*)((u8*)Te+3))
-#define Te2 (u32)((u64*)((u8*)Te+2))
-#define Te3 (u32)((u64*)((u8*)Te+1))
+#define Te0 (u32)((u64 *)((u8 *)Te + 0))
+#define Te1 (u32)((u64 *)((u8 *)Te + 3))
+#define Te2 (u32)((u64 *)((u8 *)Te + 2))
+#define Te3 (u32)((u64 *)((u8 *)Te + 1))
 /*-
 Td [x] = Si[x].[0e, 09, 0d, 0b, 0e, 09, 0d, 0b];
 Td0[x] = Si[x].[0e, 09, 0d, 0b];
@@ -124,10 +124,10 @@ Td2[x] = Si[x].[0d, 0b, 0e, 09];
 Td3[x] = Si[x].[09, 0d, 0b, 0e];
 Td4[x] = Si[x].[01];
 */
-#define Td0 (u32)((u64*)((u8*)Td+0))
-#define Td1 (u32)((u64*)((u8*)Td+3))
-#define Td2 (u32)((u64*)((u8*)Td+2))
-#define Td3 (u32)((u64*)((u8*)Td+1))
+#define Td0 (u32)((u64 *)((u8 *)Td + 0))
+#define Td1 (u32)((u64 *)((u8 *)Td + 3))
+#define Td2 (u32)((u64 *)((u8 *)Td + 2))
+#define Td3 (u32)((u64 *)((u8 *)Td + 1))
 
 static const u64 Te[256] = {
     U64(0xa56363c6a56363c6), U64(0x847c7cf8847c7cf8),
@@ -461,16 +461,23 @@ static const u8 Td4[256] = {
 };
 
 static const u32 rcon[] = {
-    0x00000001U, 0x00000002U, 0x00000004U, 0x00000008U,
-    0x00000010U, 0x00000020U, 0x00000040U, 0x00000080U,
-    0x0000001bU, 0x00000036U, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+    0x00000001U,
+    0x00000002U,
+    0x00000004U,
+    0x00000008U,
+    0x00000010U,
+    0x00000020U,
+    0x00000040U,
+    0x00000080U,
+    0x0000001bU,
+    0x00000036U, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
 };
 
 /**
  * Expand the cipher key into the encryption key schedule.
  */
 int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key)
+    AES_KEY *key)
 {
 
     u32 *rk;
@@ -484,26 +491,21 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 
     rk = key->rd_key;
 
-    if (bits==128)
+    if (bits == 128)
         key->rounds = 10;
-    else if (bits==192)
+    else if (bits == 192)
         key->rounds = 12;
     else
         key->rounds = 14;
 
-    rk[0] = GETU32(userKey     );
-    rk[1] = GETU32(userKey +  4);
-    rk[2] = GETU32(userKey +  8);
+    rk[0] = GETU32(userKey);
+    rk[1] = GETU32(userKey + 4);
+    rk[2] = GETU32(userKey + 8);
     rk[3] = GETU32(userKey + 12);
     if (bits == 128) {
         while (1) {
-            temp  = rk[3];
-            rk[4] = rk[0] ^
-                ((u32)Te4[(temp >>  8) & 0xff]      ) ^
-                ((u32)Te4[(temp >> 16) & 0xff] <<  8) ^
-                ((u32)Te4[(temp >> 24)       ] << 16) ^
-                ((u32)Te4[(temp      ) & 0xff] << 24) ^
-                rcon[i];
+            temp = rk[3];
+            rk[4] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i];
             rk[5] = rk[1] ^ rk[4];
             rk[6] = rk[2] ^ rk[5];
             rk[7] = rk[3] ^ rk[6];
@@ -517,21 +519,16 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     rk[5] = GETU32(userKey + 20);
     if (bits == 192) {
         while (1) {
-            temp = rk[ 5];
-            rk[ 6] = rk[ 0] ^
-                ((u32)Te4[(temp >>  8) & 0xff]      ) ^
-                ((u32)Te4[(temp >> 16) & 0xff] <<  8) ^
-                ((u32)Te4[(temp >> 24)       ] << 16) ^
-                ((u32)Te4[(temp      ) & 0xff] << 24) ^
-                rcon[i];
-            rk[ 7] = rk[ 1] ^ rk[ 6];
-            rk[ 8] = rk[ 2] ^ rk[ 7];
-            rk[ 9] = rk[ 3] ^ rk[ 8];
+            temp = rk[5];
+            rk[6] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i];
+            rk[7] = rk[1] ^ rk[6];
+            rk[8] = rk[2] ^ rk[7];
+            rk[9] = rk[3] ^ rk[8];
             if (++i == 8) {
                 return 0;
             }
-            rk[10] = rk[ 4] ^ rk[ 9];
-            rk[11] = rk[ 5] ^ rk[10];
+            rk[10] = rk[4] ^ rk[9];
+            rk[11] = rk[5] ^ rk[10];
             rk += 6;
         }
     }
@@ -539,31 +536,22 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
     rk[7] = GETU32(userKey + 28);
     if (bits == 256) {
         while (1) {
-            temp = rk[ 7];
-            rk[ 8] = rk[ 0] ^
-                ((u32)Te4[(temp >>  8) & 0xff]      ) ^
-                ((u32)Te4[(temp >> 16) & 0xff] <<  8) ^
-                ((u32)Te4[(temp >> 24)       ] << 16) ^
-                ((u32)Te4[(temp      ) & 0xff] << 24) ^
-                rcon[i];
-            rk[ 9] = rk[ 1] ^ rk[ 8];
-            rk[10] = rk[ 2] ^ rk[ 9];
-            rk[11] = rk[ 3] ^ rk[10];
+            temp = rk[7];
+            rk[8] = rk[0] ^ ((u32)Te4[(temp >> 8) & 0xff]) ^ ((u32)Te4[(temp >> 16) & 0xff] << 8) ^ ((u32)Te4[(temp >> 24)] << 16) ^ ((u32)Te4[(temp) & 0xff] << 24) ^ rcon[i];
+            rk[9] = rk[1] ^ rk[8];
+            rk[10] = rk[2] ^ rk[9];
+            rk[11] = rk[3] ^ rk[10];
             if (++i == 7) {
                 return 0;
             }
             temp = rk[11];
-            rk[12] = rk[ 4] ^
-                ((u32)Te4[(temp      ) & 0xff]      ) ^
-                ((u32)Te4[(temp >>  8) & 0xff] <<  8) ^
-                ((u32)Te4[(temp >> 16) & 0xff] << 16) ^
-                ((u32)Te4[(temp >> 24)       ] << 24);
-            rk[13] = rk[ 5] ^ rk[12];
-            rk[14] = rk[ 6] ^ rk[13];
-            rk[15] = rk[ 7] ^ rk[14];
+            rk[12] = rk[4] ^ ((u32)Te4[(temp) & 0xff]) ^ ((u32)Te4[(temp >> 8) & 0xff] << 8) ^ ((u32)Te4[(temp >> 16) & 0xff] << 16) ^ ((u32)Te4[(temp >> 24)] << 24);
+            rk[13] = rk[5] ^ rk[12];
+            rk[14] = rk[6] ^ rk[13];
+            rk[15] = rk[7] ^ rk[14];
 
             rk += 8;
-            }
+        }
     }
     return 0;
 }
@@ -572,7 +560,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
  * Expand the cipher key into the decryption key schedule.
  */
 int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
-                        AES_KEY *key)
+    AES_KEY *key)
 {
 
     u32 *rk;
@@ -587,11 +575,19 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
     rk = key->rd_key;
 
     /* invert the order of the round keys: */
-    for (i = 0, j = 4*(key->rounds); i < j; i += 4, j -= 4) {
-        temp = rk[i    ]; rk[i    ] = rk[j    ]; rk[j    ] = temp;
-        temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp;
-        temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp;
-        temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp;
+    for (i = 0, j = 4 * (key->rounds); i < j; i += 4, j -= 4) {
+        temp = rk[i];
+        rk[i] = rk[j];
+        rk[j] = temp;
+        temp = rk[i + 1];
+        rk[i + 1] = rk[j + 1];
+        rk[j + 1] = temp;
+        temp = rk[i + 2];
+        rk[i + 2] = rk[j + 2];
+        rk[j + 2] = temp;
+        temp = rk[i + 3];
+        rk[i + 3] = rk[j + 3];
+        rk[j + 3] = temp;
     }
     /* apply the inverse MixColumn transform to all round keys but the first and the last: */
     for (i = 1; i < (key->rounds); i++) {
@@ -602,48 +598,26 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
 
             tp1 = rk[j];
             m = tp1 & 0x80808080;
-            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             m = tp2 & 0x80808080;
-            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             m = tp4 & 0x80808080;
-            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             tp9 = tp8 ^ tp1;
             tpb = tp9 ^ tp2;
             tpd = tp9 ^ tp4;
             tpe = tp8 ^ tp4 ^ tp2;
 #if defined(ROTATE)
-            rk[j] = tpe ^ ROTATE(tpd,16) ^
-                ROTATE(tp9,8) ^ ROTATE(tpb,24);
+            rk[j] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24);
 #else
-            rk[j] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^
-                (tp9 >> 24) ^ (tp9 << 8) ^
-                (tpb >> 8) ^ (tpb << 24);
+            rk[j] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24);
 #endif
         }
 #else
-        rk[0] =
-            Td0[Te2[(rk[0]      ) & 0xff] & 0xff] ^
-            Td1[Te2[(rk[0] >>  8) & 0xff] & 0xff] ^
-            Td2[Te2[(rk[0] >> 16) & 0xff] & 0xff] ^
-            Td3[Te2[(rk[0] >> 24)       ] & 0xff];
-        rk[1] =
-            Td0[Te2[(rk[1]      ) & 0xff] & 0xff] ^
-            Td1[Te2[(rk[1] >>  8) & 0xff] & 0xff] ^
-            Td2[Te2[(rk[1] >> 16) & 0xff] & 0xff] ^
-            Td3[Te2[(rk[1] >> 24)       ] & 0xff];
-        rk[2] =
-            Td0[Te2[(rk[2]      ) & 0xff] & 0xff] ^
-            Td1[Te2[(rk[2] >>  8) & 0xff] & 0xff] ^
-            Td2[Te2[(rk[2] >> 16) & 0xff] & 0xff] ^
-            Td3[Te2[(rk[2] >> 24)       ] & 0xff];
-        rk[3] =
-            Td0[Te2[(rk[3]      ) & 0xff] & 0xff] ^
-            Td1[Te2[(rk[3] >>  8) & 0xff] & 0xff] ^
-            Td2[Te2[(rk[3] >> 16) & 0xff] & 0xff] ^
-            Td3[Te2[(rk[3] >> 24)       ] & 0xff];
+        rk[0] = Td0[Te2[(rk[0]) & 0xff] & 0xff] ^ Td1[Te2[(rk[0] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[0] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[0] >> 24)] & 0xff];
+        rk[1] = Td0[Te2[(rk[1]) & 0xff] & 0xff] ^ Td1[Te2[(rk[1] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[1] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[1] >> 24)] & 0xff];
+        rk[2] = Td0[Te2[(rk[2]) & 0xff] & 0xff] ^ Td1[Te2[(rk[2] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[2] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[2] >> 24)] & 0xff];
+        rk[3] = Td0[Te2[(rk[3]) & 0xff] & 0xff] ^ Td1[Te2[(rk[3] >> 8) & 0xff] & 0xff] ^ Td2[Te2[(rk[3] >> 16) & 0xff] & 0xff] ^ Td3[Te2[(rk[3] >> 24)] & 0xff];
 #endif
     }
     return 0;
@@ -654,7 +628,7 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
  * in and out can overlap
  */
 void AES_encrypt(const unsigned char *in, unsigned char *out,
-                 const AES_KEY *key)
+    const AES_KEY *key)
 {
 
     const u32 *rk;
@@ -668,96 +642,56 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
      * map byte array block to cipher state
      * and add initial round key:
      */
-    s0 = GETU32(in     ) ^ rk[0];
-    s1 = GETU32(in +  4) ^ rk[1];
-    s2 = GETU32(in +  8) ^ rk[2];
+    s0 = GETU32(in) ^ rk[0];
+    s1 = GETU32(in + 4) ^ rk[1];
+    s2 = GETU32(in + 8) ^ rk[2];
     s3 = GETU32(in + 12) ^ rk[3];
 
 #if defined(AES_COMPACT_IN_OUTER_ROUNDS)
     prefetch256(Te4);
 
-    t[0] = (u32)Te4[(s0      ) & 0xff]       ^
-           (u32)Te4[(s1 >>  8) & 0xff] <<  8 ^
-           (u32)Te4[(s2 >> 16) & 0xff] << 16 ^
-           (u32)Te4[(s3 >> 24)       ] << 24;
-    t[1] = (u32)Te4[(s1      ) & 0xff]       ^
-           (u32)Te4[(s2 >>  8) & 0xff] <<  8 ^
-           (u32)Te4[(s3 >> 16) & 0xff] << 16 ^
-           (u32)Te4[(s0 >> 24)       ] << 24;
-    t[2] = (u32)Te4[(s2      ) & 0xff]       ^
-           (u32)Te4[(s3 >>  8) & 0xff] <<  8 ^
-           (u32)Te4[(s0 >> 16) & 0xff] << 16 ^
-           (u32)Te4[(s1 >> 24)       ] << 24;
-    t[3] = (u32)Te4[(s3      ) & 0xff]       ^
-           (u32)Te4[(s0 >>  8) & 0xff] <<  8 ^
-           (u32)Te4[(s1 >> 16) & 0xff] << 16 ^
-           (u32)Te4[(s2 >> 24)       ] << 24;
+    t[0] = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24;
+    t[1] = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24;
+    t[2] = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24;
+    t[3] = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24;
 
     /* now do the linear transform using words */
-    {   int i;
+    {
+        int i;
         u32 r0, r1, r2;
 
         for (i = 0; i < 4; i++) {
             r0 = t[i];
             r1 = r0 & 0x80808080;
-            r2 = ((r0 & 0x7f7f7f7f) << 1) ^
-                ((r1 - (r1 >> 7)) & 0x1b1b1b1b);
+            r2 = ((r0 & 0x7f7f7f7f) << 1) ^ ((r1 - (r1 >> 7)) & 0x1b1b1b1b);
 #if defined(ROTATE)
-            t[i] = r2 ^ ROTATE(r2,24) ^ ROTATE(r0,24) ^
-                ROTATE(r0,16) ^ ROTATE(r0,8);
+            t[i] = r2 ^ ROTATE(r2, 24) ^ ROTATE(r0, 24) ^ ROTATE(r0, 16) ^ ROTATE(r0, 8);
 #else
-            t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^
-                (r0 << 16) ^ (r0 >> 16) ^
-                (r0 << 8) ^ (r0 >> 24);
+            t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^ (r0 << 16) ^ (r0 >> 16) ^ (r0 << 8) ^ (r0 >> 24);
 #endif
-            t[i] ^= rk[4+i];
+            t[i] ^= rk[4 + i];
         }
     }
 #else
-    t[0] =  Te0[(s0      ) & 0xff] ^
-        Te1[(s1 >>  8) & 0xff] ^
-        Te2[(s2 >> 16) & 0xff] ^
-        Te3[(s3 >> 24)       ] ^
-        rk[4];
-    t[1] =  Te0[(s1      ) & 0xff] ^
-        Te1[(s2 >>  8) & 0xff] ^
-        Te2[(s3 >> 16) & 0xff] ^
-        Te3[(s0 >> 24)       ] ^
-        rk[5];
-    t[2] =  Te0[(s2      ) & 0xff] ^
-        Te1[(s3 >>  8) & 0xff] ^
-        Te2[(s0 >> 16) & 0xff] ^
-        Te3[(s1 >> 24)       ] ^
-        rk[6];
-    t[3] =  Te0[(s3      ) & 0xff] ^
-        Te1[(s0 >>  8) & 0xff] ^
-        Te2[(s1 >> 16) & 0xff] ^
-        Te3[(s2 >> 24)       ] ^
-        rk[7];
+    t[0] = Te0[(s0) & 0xff] ^ Te1[(s1 >> 8) & 0xff] ^ Te2[(s2 >> 16) & 0xff] ^ Te3[(s3 >> 24)] ^ rk[4];
+    t[1] = Te0[(s1) & 0xff] ^ Te1[(s2 >> 8) & 0xff] ^ Te2[(s3 >> 16) & 0xff] ^ Te3[(s0 >> 24)] ^ rk[5];
+    t[2] = Te0[(s2) & 0xff] ^ Te1[(s3 >> 8) & 0xff] ^ Te2[(s0 >> 16) & 0xff] ^ Te3[(s1 >> 24)] ^ rk[6];
+    t[3] = Te0[(s3) & 0xff] ^ Te1[(s0 >> 8) & 0xff] ^ Te2[(s1 >> 16) & 0xff] ^ Te3[(s2 >> 24)] ^ rk[7];
 #endif
-    s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
+    s0 = t[0];
+    s1 = t[1];
+    s2 = t[2];
+    s3 = t[3];
 
     /*
      * Nr - 2 full rounds:
      */
-    for (rk+=8,r=key->rounds-2; r>0; rk+=4,r--) {
+    for (rk += 8, r = key->rounds - 2; r > 0; rk += 4, r--) {
 #if defined(AES_COMPACT_IN_INNER_ROUNDS)
-        t[0] = (u32)Te4[(s0      ) & 0xff]       ^
-               (u32)Te4[(s1 >>  8) & 0xff] <<  8 ^
-               (u32)Te4[(s2 >> 16) & 0xff] << 16 ^
-               (u32)Te4[(s3 >> 24)       ] << 24;
-        t[1] = (u32)Te4[(s1      ) & 0xff]       ^
-               (u32)Te4[(s2 >>  8) & 0xff] <<  8 ^
-               (u32)Te4[(s3 >> 16) & 0xff] << 16 ^
-               (u32)Te4[(s0 >> 24)       ] << 24;
-        t[2] = (u32)Te4[(s2      ) & 0xff]       ^
-               (u32)Te4[(s3 >>  8) & 0xff] <<  8 ^
-               (u32)Te4[(s0 >> 16) & 0xff] << 16 ^
-               (u32)Te4[(s1 >> 24)       ] << 24;
-        t[3] = (u32)Te4[(s3      ) & 0xff]       ^
-               (u32)Te4[(s0 >>  8) & 0xff] <<  8 ^
-               (u32)Te4[(s1 >> 16) & 0xff] << 16 ^
-               (u32)Te4[(s2 >> 24)       ] << 24;
+        t[0] = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24;
+        t[1] = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24;
+        t[2] = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24;
+        t[3] = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24;
 
         /* now do the linear transform using words */
         {
@@ -767,42 +701,25 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
             for (i = 0; i < 4; i++) {
                 r0 = t[i];
                 r1 = r0 & 0x80808080;
-                r2 = ((r0 & 0x7f7f7f7f) << 1) ^
-                    ((r1 - (r1 >> 7)) & 0x1b1b1b1b);
+                r2 = ((r0 & 0x7f7f7f7f) << 1) ^ ((r1 - (r1 >> 7)) & 0x1b1b1b1b);
 #if defined(ROTATE)
-                t[i] = r2 ^ ROTATE(r2,24) ^ ROTATE(r0,24) ^
-                    ROTATE(r0,16) ^ ROTATE(r0,8);
+                t[i] = r2 ^ ROTATE(r2, 24) ^ ROTATE(r0, 24) ^ ROTATE(r0, 16) ^ ROTATE(r0, 8);
 #else
-                t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^
-                    (r0 << 16) ^ (r0 >> 16) ^
-                    (r0 << 8) ^ (r0 >> 24);
+                t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^ (r0 << 16) ^ (r0 >> 16) ^ (r0 << 8) ^ (r0 >> 24);
 #endif
                 t[i] ^= rk[i];
             }
         }
 #else
-        t[0] =  Te0[(s0      ) & 0xff] ^
-            Te1[(s1 >>  8) & 0xff] ^
-            Te2[(s2 >> 16) & 0xff] ^
-            Te3[(s3 >> 24)       ] ^
-            rk[0];
-        t[1] =  Te0[(s1      ) & 0xff] ^
-            Te1[(s2 >>  8) & 0xff] ^
-            Te2[(s3 >> 16) & 0xff] ^
-            Te3[(s0 >> 24)       ] ^
-            rk[1];
-        t[2] =  Te0[(s2      ) & 0xff] ^
-            Te1[(s3 >>  8) & 0xff] ^
-            Te2[(s0 >> 16) & 0xff] ^
-            Te3[(s1 >> 24)       ] ^
-            rk[2];
-        t[3] =  Te0[(s3      ) & 0xff] ^
-            Te1[(s0 >>  8) & 0xff] ^
-            Te2[(s1 >> 16) & 0xff] ^
-            Te3[(s2 >> 24)       ] ^
-            rk[3];
+        t[0] = Te0[(s0) & 0xff] ^ Te1[(s1 >> 8) & 0xff] ^ Te2[(s2 >> 16) & 0xff] ^ Te3[(s3 >> 24)] ^ rk[0];
+        t[1] = Te0[(s1) & 0xff] ^ Te1[(s2 >> 8) & 0xff] ^ Te2[(s3 >> 16) & 0xff] ^ Te3[(s0 >> 24)] ^ rk[1];
+        t[2] = Te0[(s2) & 0xff] ^ Te1[(s3 >> 8) & 0xff] ^ Te2[(s0 >> 16) & 0xff] ^ Te3[(s1 >> 24)] ^ rk[2];
+        t[3] = Te0[(s3) & 0xff] ^ Te1[(s0 >> 8) & 0xff] ^ Te2[(s1 >> 16) & 0xff] ^ Te3[(s2 >> 24)] ^ rk[3];
 #endif
-        s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
+        s0 = t[0];
+        s1 = t[1];
+        s2 = t[2];
+        s3 = t[3];
     }
     /*
      * apply last round and
@@ -811,55 +728,15 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
 #if defined(AES_COMPACT_IN_OUTER_ROUNDS)
     prefetch256(Te4);
 
-    *(u32*)(out+0) =
-           (u32)Te4[(s0      ) & 0xff]       ^
-           (u32)Te4[(s1 >>  8) & 0xff] <<  8 ^
-           (u32)Te4[(s2 >> 16) & 0xff] << 16 ^
-           (u32)Te4[(s3 >> 24)       ] << 24 ^
-        rk[0];
-    *(u32*)(out+4) =
-           (u32)Te4[(s1      ) & 0xff]       ^
-           (u32)Te4[(s2 >>  8) & 0xff] <<  8 ^
-           (u32)Te4[(s3 >> 16) & 0xff] << 16 ^
-           (u32)Te4[(s0 >> 24)       ] << 24 ^
-        rk[1];
-    *(u32*)(out+8) =
-           (u32)Te4[(s2      ) & 0xff]       ^
-           (u32)Te4[(s3 >>  8) & 0xff] <<  8 ^
-           (u32)Te4[(s0 >> 16) & 0xff] << 16 ^
-           (u32)Te4[(s1 >> 24)       ] << 24 ^
-        rk[2];
-    *(u32*)(out+12) =
-           (u32)Te4[(s3      ) & 0xff]       ^
-           (u32)Te4[(s0 >>  8) & 0xff] <<  8 ^
-           (u32)Te4[(s1 >> 16) & 0xff] << 16 ^
-           (u32)Te4[(s2 >> 24)       ] << 24 ^
-        rk[3];
+    *(u32 *)(out + 0) = (u32)Te4[(s0) & 0xff] ^ (u32)Te4[(s1 >> 8) & 0xff] << 8 ^ (u32)Te4[(s2 >> 16) & 0xff] << 16 ^ (u32)Te4[(s3 >> 24)] << 24 ^ rk[0];
+    *(u32 *)(out + 4) = (u32)Te4[(s1) & 0xff] ^ (u32)Te4[(s2 >> 8) & 0xff] << 8 ^ (u32)Te4[(s3 >> 16) & 0xff] << 16 ^ (u32)Te4[(s0 >> 24)] << 24 ^ rk[1];
+    *(u32 *)(out + 8) = (u32)Te4[(s2) & 0xff] ^ (u32)Te4[(s3 >> 8) & 0xff] << 8 ^ (u32)Te4[(s0 >> 16) & 0xff] << 16 ^ (u32)Te4[(s1 >> 24)] << 24 ^ rk[2];
+    *(u32 *)(out + 12) = (u32)Te4[(s3) & 0xff] ^ (u32)Te4[(s0 >> 8) & 0xff] << 8 ^ (u32)Te4[(s1 >> 16) & 0xff] << 16 ^ (u32)Te4[(s2 >> 24)] << 24 ^ rk[3];
 #else
-    *(u32*)(out+0) =
-        (Te2[(s0      ) & 0xff] & 0x000000ffU) ^
-        (Te3[(s1 >>  8) & 0xff] & 0x0000ff00U) ^
-        (Te0[(s2 >> 16) & 0xff] & 0x00ff0000U) ^
-        (Te1[(s3 >> 24)       ] & 0xff000000U) ^
-        rk[0];
-    *(u32*)(out+4) =
-        (Te2[(s1      ) & 0xff] & 0x000000ffU) ^
-        (Te3[(s2 >>  8) & 0xff] & 0x0000ff00U) ^
-        (Te0[(s3 >> 16) & 0xff] & 0x00ff0000U) ^
-        (Te1[(s0 >> 24)       ] & 0xff000000U) ^
-        rk[1];
-    *(u32*)(out+8) =
-        (Te2[(s2      ) & 0xff] & 0x000000ffU) ^
-        (Te3[(s3 >>  8) & 0xff] & 0x0000ff00U) ^
-        (Te0[(s0 >> 16) & 0xff] & 0x00ff0000U) ^
-        (Te1[(s1 >> 24)       ] & 0xff000000U) ^
-        rk[2];
-    *(u32*)(out+12) =
-        (Te2[(s3      ) & 0xff] & 0x000000ffU) ^
-        (Te3[(s0 >>  8) & 0xff] & 0x0000ff00U) ^
-        (Te0[(s1 >> 16) & 0xff] & 0x00ff0000U) ^
-        (Te1[(s2 >> 24)       ] & 0xff000000U) ^
-        rk[3];
+    *(u32 *)(out + 0) = (Te2[(s0) & 0xff] & 0x000000ffU) ^ (Te3[(s1 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s2 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s3 >> 24)] & 0xff000000U) ^ rk[0];
+    *(u32 *)(out + 4) = (Te2[(s1) & 0xff] & 0x000000ffU) ^ (Te3[(s2 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s3 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s0 >> 24)] & 0xff000000U) ^ rk[1];
+    *(u32 *)(out + 8) = (Te2[(s2) & 0xff] & 0x000000ffU) ^ (Te3[(s3 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s0 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s1 >> 24)] & 0xff000000U) ^ rk[2];
+    *(u32 *)(out + 12) = (Te2[(s3) & 0xff] & 0x000000ffU) ^ (Te3[(s0 >> 8) & 0xff] & 0x0000ff00U) ^ (Te0[(s1 >> 16) & 0xff] & 0x00ff0000U) ^ (Te1[(s2 >> 24)] & 0xff000000U) ^ rk[3];
 #endif
 }
 
@@ -868,7 +745,7 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
  * in and out can overlap
  */
 void AES_decrypt(const unsigned char *in, unsigned char *out,
-                 const AES_KEY *key)
+    const AES_KEY *key)
 {
 
     const u32 *rk;
@@ -882,30 +759,18 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
      * map byte array block to cipher state
      * and add initial round key:
      */
-    s0 = GETU32(in     ) ^ rk[0];
-    s1 = GETU32(in +  4) ^ rk[1];
-    s2 = GETU32(in +  8) ^ rk[2];
+    s0 = GETU32(in) ^ rk[0];
+    s1 = GETU32(in + 4) ^ rk[1];
+    s2 = GETU32(in + 8) ^ rk[2];
     s3 = GETU32(in + 12) ^ rk[3];
 
 #if defined(AES_COMPACT_IN_OUTER_ROUNDS)
     prefetch256(Td4);
 
-    t[0] = (u32)Td4[(s0      ) & 0xff]       ^
-           (u32)Td4[(s3 >>  8) & 0xff] <<  8 ^
-           (u32)Td4[(s2 >> 16) & 0xff] << 16 ^
-           (u32)Td4[(s1 >> 24)       ] << 24;
-    t[1] = (u32)Td4[(s1      ) & 0xff]       ^
-           (u32)Td4[(s0 >>  8) & 0xff] <<  8 ^
-           (u32)Td4[(s3 >> 16) & 0xff] << 16 ^
-           (u32)Td4[(s2 >> 24)       ] << 24;
-    t[2] = (u32)Td4[(s2      ) & 0xff]       ^
-           (u32)Td4[(s1 >>  8) & 0xff] <<  8 ^
-           (u32)Td4[(s0 >> 16) & 0xff] << 16 ^
-           (u32)Td4[(s3 >> 24)       ] << 24;
-    t[3] = (u32)Td4[(s3      ) & 0xff]       ^
-           (u32)Td4[(s2 >>  8) & 0xff] <<  8 ^
-           (u32)Td4[(s1 >> 16) & 0xff] << 16 ^
-           (u32)Td4[(s0 >> 24)       ] << 24;
+    t[0] = (u32)Td4[(s0) & 0xff] ^ (u32)Td4[(s3 >> 8) & 0xff] << 8 ^ (u32)Td4[(s2 >> 16) & 0xff] << 16 ^ (u32)Td4[(s1 >> 24)] << 24;
+    t[1] = (u32)Td4[(s1) & 0xff] ^ (u32)Td4[(s0 >> 8) & 0xff] << 8 ^ (u32)Td4[(s3 >> 16) & 0xff] << 16 ^ (u32)Td4[(s2 >> 24)] << 24;
+    t[2] = (u32)Td4[(s2) & 0xff] ^ (u32)Td4[(s1 >> 8) & 0xff] << 8 ^ (u32)Td4[(s0 >> 16) & 0xff] << 16 ^ (u32)Td4[(s3 >> 24)] << 24;
+    t[3] = (u32)Td4[(s3) & 0xff] ^ (u32)Td4[(s2 >> 8) & 0xff] << 8 ^ (u32)Td4[(s1 >> 16) & 0xff] << 16 ^ (u32)Td4[(s0 >> 24)] << 24;
 
     /* now do the linear transform using words */
     {
@@ -915,129 +780,79 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
         for (i = 0; i < 4; i++) {
             tp1 = t[i];
             m = tp1 & 0x80808080;
-            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             m = tp2 & 0x80808080;
-            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             m = tp4 & 0x80808080;
-            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
+            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
             tp9 = tp8 ^ tp1;
             tpb = tp9 ^ tp2;
             tpd = tp9 ^ tp4;
             tpe = tp8 ^ tp4 ^ tp2;
 #if defined(ROTATE)
-            t[i] = tpe ^ ROTATE(tpd,16) ^
-                ROTATE(tp9,8) ^ ROTATE(tpb,24);
+            t[i] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24);
 #else
-            t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^
-                (tp9 >> 24) ^ (tp9 << 8) ^
-                (tpb >> 8) ^ (tpb << 24);
+            t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24);
 #endif
-            t[i] ^= rk[4+i];
+            t[i] ^= rk[4 + i];
         }
     }
 #else
-    t[0] =  Td0[(s0      ) & 0xff] ^
-        Td1[(s3 >>  8) & 0xff] ^
-        Td2[(s2 >> 16) & 0xff] ^
-        Td3[(s1 >> 24)       ] ^
-        rk[4];
-    t[1] =  Td0[(s1      ) & 0xff] ^
-        Td1[(s0 >>  8) & 0xff] ^
-        Td2[(s3 >> 16) & 0xff] ^
-        Td3[(s2 >> 24)       ] ^
-        rk[5];
-    t[2] =  Td0[(s2      ) & 0xff] ^
-        Td1[(s1 >>  8) & 0xff] ^
-        Td2[(s0 >> 16) & 0xff] ^
-        Td3[(s3 >> 24)       ] ^
-        rk[6];
-    t[3] =  Td0[(s3      ) & 0xff] ^
-        Td1[(s2 >>  8) & 0xff] ^
-        Td2[(s1 >> 16) & 0xff] ^
-        Td3[(s0 >> 24)       ] ^
-        rk[7];
+    t[0] = Td0[(s0) & 0xff] ^ Td1[(s3 >> 8) & 0xff] ^ Td2[(s2 >> 16) & 0xff] ^ Td3[(s1 >> 24)] ^ rk[4];
+    t[1] = Td0[(s1) & 0xff] ^ Td1[(s0 >> 8) & 0xff] ^ Td2[(s3 >> 16) & 0xff] ^ Td3[(s2 >> 24)] ^ rk[5];
+    t[2] = Td0[(s2) & 0xff] ^ Td1[(s1 >> 8) & 0xff] ^ Td2[(s0 >> 16) & 0xff] ^ Td3[(s3 >> 24)] ^ rk[6];
+    t[3] = Td0[(s3) & 0xff] ^ Td1[(s2 >> 8) & 0xff] ^ Td2[(s1 >> 16) & 0xff] ^ Td3[(s0 >> 24)] ^ rk[7];
 #endif
-    s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
+    s0 = t[0];
+    s1 = t[1];
+    s2 = t[2];
+    s3 = t[3];
 
     /*
      * Nr - 2 full rounds:
      */
-    for (rk+=8,r=key->rounds-2; r>0; rk+=4,r--) {
+    for (rk += 8, r = key->rounds - 2; r > 0; rk += 4, r--) {
 #if defined(AES_COMPACT_IN_INNER_ROUNDS)
-        t[0] = (u32)Td4[(s0      ) & 0xff]       ^
-               (u32)Td4[(s3 >>  8) & 0xff] <<  8 ^
-               (u32)Td4[(s2 >> 16) & 0xff] << 16 ^
-               (u32)Td4[(s1 >> 24)       ] << 24;
-        t[1] = (u32)Td4[(s1      ) & 0xff]       ^
-               (u32)Td4[(s0 >>  8) & 0xff] <<  8 ^
-               (u32)Td4[(s3 >> 16) & 0xff] << 16 ^
-               (u32)Td4[(s2 >> 24)       ] << 24;
-        t[2] = (u32)Td4[(s2      ) & 0xff]       ^
-               (u32)Td4[(s1 >>  8) & 0xff] <<  8 ^
-               (u32)Td4[(s0 >> 16) & 0xff] << 16 ^
-               (u32)Td4[(s3 >> 24)       ] << 24;
-        t[3] = (u32)Td4[(s3      ) & 0xff]       ^
-               (u32)Td4[(s2 >>  8) & 0xff] <<  8 ^
-               (u32)Td4[(s1 >> 16) & 0xff] << 16 ^
-               (u32)Td4[(s0 >> 24)       ] << 24;
+        t[0] = (u32)Td4[(s0) & 0xff] ^ (u32)Td4[(s3 >> 8) & 0xff] << 8 ^ (u32)Td4[(s2 >> 16) & 0xff] << 16 ^ (u32)Td4[(s1 >> 24)] << 24;
+        t[1] = (u32)Td4[(s1) & 0xff] ^ (u32)Td4[(s0 >> 8) & 0xff] << 8 ^ (u32)Td4[(s3 >> 16) & 0xff] << 16 ^ (u32)Td4[(s2 >> 24)] << 24;
+        t[2] = (u32)Td4[(s2) & 0xff] ^ (u32)Td4[(s1 >> 8) & 0xff] << 8 ^ (u32)Td4[(s0 >> 16) & 0xff] << 16 ^ (u32)Td4[(s3 >> 24)] << 24;
+        t[3] = (u32)Td4[(s3) & 0xff] ^ (u32)Td4[(s2 >> 8) & 0xff] << 8 ^ (u32)Td4[(s1 >> 16) & 0xff] << 16 ^ (u32)Td4[(s0 >> 24)] << 24;
 
-    /* now do the linear transform using words */
-    {
-        int i;
-        u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;
+        /* now do the linear transform using words */
+        {
+            int i;
+            u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;
 
-        for (i = 0; i < 4; i++) {
-            tp1 = t[i];
-            m = tp1 & 0x80808080;
-            tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
-            m = tp2 & 0x80808080;
-            tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
-            m = tp4 & 0x80808080;
-            tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^
-                ((m - (m >> 7)) & 0x1b1b1b1b);
-            tp9 = tp8 ^ tp1;
-            tpb = tp9 ^ tp2;
-            tpd = tp9 ^ tp4;
-            tpe = tp8 ^ tp4 ^ tp2;
+            for (i = 0; i < 4; i++) {
+                tp1 = t[i];
+                m = tp1 & 0x80808080;
+                tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
+                m = tp2 & 0x80808080;
+                tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
+                m = tp4 & 0x80808080;
+                tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^ ((m - (m >> 7)) & 0x1b1b1b1b);
+                tp9 = tp8 ^ tp1;
+                tpb = tp9 ^ tp2;
+                tpd = tp9 ^ tp4;
+                tpe = tp8 ^ tp4 ^ tp2;
 #if defined(ROTATE)
-            t[i] = tpe ^ ROTATE(tpd,16) ^
-                ROTATE(tp9,8) ^ ROTATE(tpb,24);
+                t[i] = tpe ^ ROTATE(tpd, 16) ^ ROTATE(tp9, 8) ^ ROTATE(tpb, 24);
 #else
-            t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^
-                (tp9 >> 24) ^ (tp9 << 8) ^
-                (tpb >> 8) ^ (tpb << 24);
+                t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ (tp9 >> 24) ^ (tp9 << 8) ^ (tpb >> 8) ^ (tpb << 24);
 #endif
-            t[i] ^= rk[i];
+                t[i] ^= rk[i];
+            }
         }
-    }
 #else
-    t[0] =  Td0[(s0      ) & 0xff] ^
-        Td1[(s3 >>  8) & 0xff] ^
-        Td2[(s2 >> 16) & 0xff] ^
-        Td3[(s1 >> 24)       ] ^
-        rk[0];
-    t[1] =  Td0[(s1      ) & 0xff] ^
-        Td1[(s0 >>  8) & 0xff] ^
-        Td2[(s3 >> 16) & 0xff] ^
-        Td3[(s2 >> 24)       ] ^
-        rk[1];
-    t[2] =  Td0[(s2      ) & 0xff] ^
-        Td1[(s1 >>  8) & 0xff] ^
-        Td2[(s0 >> 16) & 0xff] ^
-        Td3[(s3 >> 24)       ] ^
-        rk[2];
-    t[3] =  Td0[(s3      ) & 0xff] ^
-        Td1[(s2 >>  8) & 0xff] ^
-        Td2[(s1 >> 16) & 0xff] ^
-        Td3[(s0 >> 24)       ] ^
-        rk[3];
+        t[0] = Td0[(s0) & 0xff] ^ Td1[(s3 >> 8) & 0xff] ^ Td2[(s2 >> 16) & 0xff] ^ Td3[(s1 >> 24)] ^ rk[0];
+        t[1] = Td0[(s1) & 0xff] ^ Td1[(s0 >> 8) & 0xff] ^ Td2[(s3 >> 16) & 0xff] ^ Td3[(s2 >> 24)] ^ rk[1];
+        t[2] = Td0[(s2) & 0xff] ^ Td1[(s1 >> 8) & 0xff] ^ Td2[(s0 >> 16) & 0xff] ^ Td3[(s3 >> 24)] ^ rk[2];
+        t[3] = Td0[(s3) & 0xff] ^ Td1[(s2 >> 8) & 0xff] ^ Td2[(s1 >> 16) & 0xff] ^ Td3[(s0 >> 24)] ^ rk[3];
 #endif
-    s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
+        s0 = t[0];
+        s1 = t[1];
+        s2 = t[2];
+        s3 = t[3];
     }
     /*
      * apply last round and
@@ -1045,28 +860,8 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
      */
     prefetch256(Td4);
 
-    *(u32*)(out+0) =
-        ((u32)Td4[(s0      ) & 0xff])    ^
-        ((u32)Td4[(s3 >>  8) & 0xff] <<  8) ^
-        ((u32)Td4[(s2 >> 16) & 0xff] << 16) ^
-        ((u32)Td4[(s1 >> 24)       ] << 24) ^
-        rk[0];
-    *(u32*)(out+4) =
-        ((u32)Td4[(s1      ) & 0xff])     ^
-        ((u32)Td4[(s0 >>  8) & 0xff] <<  8) ^
-        ((u32)Td4[(s3 >> 16) & 0xff] << 16) ^
-        ((u32)Td4[(s2 >> 24)       ] << 24) ^
-        rk[1];
-    *(u32*)(out+8) =
-        ((u32)Td4[(s2      ) & 0xff])     ^
-        ((u32)Td4[(s1 >>  8) & 0xff] <<  8) ^
-        ((u32)Td4[(s0 >> 16) & 0xff] << 16) ^
-        ((u32)Td4[(s3 >> 24)       ] << 24) ^
-        rk[2];
-    *(u32*)(out+12) =
-        ((u32)Td4[(s3      ) & 0xff])     ^
-        ((u32)Td4[(s2 >>  8) & 0xff] <<  8) ^
-        ((u32)Td4[(s1 >> 16) & 0xff] << 16) ^
-        ((u32)Td4[(s0 >> 24)       ] << 24) ^
-        rk[3];
+    *(u32 *)(out + 0) = ((u32)Td4[(s0) & 0xff]) ^ ((u32)Td4[(s3 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s2 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s1 >> 24)] << 24) ^ rk[0];
+    *(u32 *)(out + 4) = ((u32)Td4[(s1) & 0xff]) ^ ((u32)Td4[(s0 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s3 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s2 >> 24)] << 24) ^ rk[1];
+    *(u32 *)(out + 8) = ((u32)Td4[(s2) & 0xff]) ^ ((u32)Td4[(s1 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s0 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s3 >> 24)] << 24) ^ rk[2];
+    *(u32 *)(out + 12) = ((u32)Td4[(s3) & 0xff]) ^ ((u32)Td4[(s2 >> 8) & 0xff] << 8) ^ ((u32)Td4[(s1 >> 16) & 0xff] << 16) ^ ((u32)Td4[(s0 >> 24)] << 24) ^ rk[3];
 }
diff --git a/crypto/openssl/crypto/aes/asm/aesni-xts-avx512.pl b/crypto/openssl/crypto/aes/asm/aesni-xts-avx512.pl
index 0dc69589838b..d89564112e31 100644
--- a/crypto/openssl/crypto/aes/asm/aesni-xts-avx512.pl
+++ b/crypto/openssl/crypto/aes/asm/aesni-xts-avx512.pl
@@ -35,13 +35,15 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 die "can't locate x86_64-xlate.pl";
 
 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
-        =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
-    $avx512vaes = ($1>=2.30);
+        =~ /GNU assembler version ([0-9]+)\.([0-9]+)/) {
+    my $ver = $1 + $2/100.0; # 3.1->3.01, 3.10->3.10
+    $avx512vaes = ($ver >= 2.30);
 }
 
 if (!$avx512vaes && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
-       `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?/) {
-    $avx512vaes = ($1==2.11 && $2>=8) + ($1>=2.12);
+       `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)(?:\.([0-9]+))?/) {
+    my $ver = $1 + $2/100.0 + $3/10000.0; # 3.1.0->3.01, 3.10.1->3.1001
+    $avx512vaes = ($ver >= 2.1108);
 }
 
 if (!$avx512vaes && `$ENV{CC} -v 2>&1`
@@ -2194,7 +2196,7 @@ ___
     vpxorq 	 %zmm6,%zmm5,%zmm5{%k2}
     vpxord 	 %zmm5,%zmm7,%zmm10
 
-    # Make next 8 tweek values by all x 2^8
+    # Make next 8 tweak values by all x 2^8
     vpsrldq 	 \$0xf,%zmm9,%zmm13
     vpclmulqdq 	 \$0x0,%zmm25,%zmm13,%zmm14
     vpslldq 	 \$0x1,%zmm9,%zmm11
@@ -2234,7 +2236,7 @@ ___
     jmp 	 .L_do_n_blocks_${rndsuffix}
 
     .L_start_by8_${rndsuffix}:
-    # Make first 7 tweek values
+    # Make first 7 tweak values
     vbroadcasti32x4 	 ($TW),%zmm0
     vbroadcasti32x4 shufb_15_7(%rip),%zmm8
     mov 	 \$0xaa,$tmp1
diff --git a/crypto/openssl/crypto/aria/aria.c b/crypto/openssl/crypto/aria/aria.c
index 84ddd00cd827..eed9214d4b18 100644
--- a/crypto/openssl/crypto/aria/aria.c
+++ b/crypto/openssl/crypto/aria/aria.c
@@ -32,30 +32,23 @@
 #define rotl32(v, r) (((uint32_t)(v) << (r)) | ((uint32_t)(v) >> (32 - r)))
 #define rotr32(v, r) (((uint32_t)(v) >> (r)) | ((uint32_t)(v) << (32 - r)))
 
-#define bswap32(v)                                          \
-    (((v) << 24) ^ ((v) >> 24) ^                            \
-    (((v) & 0x0000ff00) << 8) ^ (((v) & 0x00ff0000) >> 8))
+#define bswap32(v) \
+    (((v) << 24) ^ ((v) >> 24) ^ (((v) & 0x0000ff00) << 8) ^ (((v) & 0x00ff0000) >> 8))
 
 #define GET_U8_BE(X, Y) ((uint8_t)((X) >> ((3 - Y) * 8)))
-#define GET_U32_BE(X, Y) (                                  \
-    ((uint32_t)((const uint8_t *)(X))[Y * 4    ] << 24) ^   \
-    ((uint32_t)((const uint8_t *)(X))[Y * 4 + 1] << 16) ^   \
-    ((uint32_t)((const uint8_t *)(X))[Y * 4 + 2] <<  8) ^   \
-    ((uint32_t)((const uint8_t *)(X))[Y * 4 + 3]      )     )
+#define GET_U32_BE(X, Y) ( \
+    ((uint32_t)((const uint8_t *)(X))[Y * 4] << 24) ^ ((uint32_t)((const uint8_t *)(X))[Y * 4 + 1] << 16) ^ ((uint32_t)((const uint8_t *)(X))[Y * 4 + 2] << 8) ^ ((uint32_t)((const uint8_t *)(X))[Y * 4 + 3]))
 
-#define PUT_U32_BE(DEST, IDX, VAL)                              \
-    do {                                                        \
-        ((uint8_t *)(DEST))[IDX * 4    ] = GET_U8_BE(VAL, 0);   \
-        ((uint8_t *)(DEST))[IDX * 4 + 1] = GET_U8_BE(VAL, 1);   \
-        ((uint8_t *)(DEST))[IDX * 4 + 2] = GET_U8_BE(VAL, 2);   \
-        ((uint8_t *)(DEST))[IDX * 4 + 3] = GET_U8_BE(VAL, 3);   \
-    } while(0)
+#define PUT_U32_BE(DEST, IDX, VAL)                            \
+    do {                                                      \
+        ((uint8_t *)(DEST))[IDX * 4] = GET_U8_BE(VAL, 0);     \
+        ((uint8_t *)(DEST))[IDX * 4 + 1] = GET_U8_BE(VAL, 1); \
+        ((uint8_t *)(DEST))[IDX * 4 + 2] = GET_U8_BE(VAL, 2); \
+        ((uint8_t *)(DEST))[IDX * 4 + 3] = GET_U8_BE(VAL, 3); \
+    } while (0)
 
-#define MAKE_U32(V0, V1, V2, V3) (      \
-    ((uint32_t)((uint8_t)(V0)) << 24) | \
-    ((uint32_t)((uint8_t)(V1)) << 16) | \
-    ((uint32_t)((uint8_t)(V2)) <<  8) | \
-    ((uint32_t)((uint8_t)(V3))      )   )
+#define MAKE_U32(V0, V1, V2, V3) ( \
+    ((uint32_t)((uint8_t)(V0)) << 24) | ((uint32_t)((uint8_t)(V1)) << 16) | ((uint32_t)((uint8_t)(V2)) << 8) | ((uint32_t)((uint8_t)(V3))))
 
 /* End Macro*/
 
@@ -342,75 +335,43 @@ static const uint32_t X2[256] = {
 };
 
 /* Key XOR Layer */
-#define ARIA_ADD_ROUND_KEY(RK, T0, T1, T2, T3)  \
-    do {                                        \
-        (T0) ^= (RK)->u[0];                     \
-        (T1) ^= (RK)->u[1];                     \
-        (T2) ^= (RK)->u[2];                     \
-        (T3) ^= (RK)->u[3];                     \
-    } while(0)
+#define ARIA_ADD_ROUND_KEY(RK, T0, T1, T2, T3) \
+    do {                                       \
+        (T0) ^= (RK)->u[0];                    \
+        (T1) ^= (RK)->u[1];                    \
+        (T2) ^= (RK)->u[2];                    \
+        (T3) ^= (RK)->u[3];                    \
+    } while (0)
 
 /* S-Box Layer 1 + M */
-#define ARIA_SBOX_LAYER1_WITH_PRE_DIFF(T0, T1, T2, T3)  \
-    do {                                                \
-        (T0) =                                          \
-            S1[GET_U8_BE(T0, 0)] ^                      \
-            S2[GET_U8_BE(T0, 1)] ^                      \
-            X1[GET_U8_BE(T0, 2)] ^                      \
-            X2[GET_U8_BE(T0, 3)];                       \
-        (T1) =                                          \
-            S1[GET_U8_BE(T1, 0)] ^                      \
-            S2[GET_U8_BE(T1, 1)] ^                      \
-            X1[GET_U8_BE(T1, 2)] ^                      \
-            X2[GET_U8_BE(T1, 3)];                       \
-        (T2) =                                          \
-            S1[GET_U8_BE(T2, 0)] ^                      \
-            S2[GET_U8_BE(T2, 1)] ^                      \
-            X1[GET_U8_BE(T2, 2)] ^                      \
-            X2[GET_U8_BE(T2, 3)];                       \
-        (T3) =                                          \
-            S1[GET_U8_BE(T3, 0)] ^                      \
-            S2[GET_U8_BE(T3, 1)] ^                      \
-            X1[GET_U8_BE(T3, 2)] ^                      \
-            X2[GET_U8_BE(T3, 3)];                       \
-    } while(0)
+#define ARIA_SBOX_LAYER1_WITH_PRE_DIFF(T0, T1, T2, T3)                                                    \
+    do {                                                                                                  \
+        (T0) = S1[GET_U8_BE(T0, 0)] ^ S2[GET_U8_BE(T0, 1)] ^ X1[GET_U8_BE(T0, 2)] ^ X2[GET_U8_BE(T0, 3)]; \
+        (T1) = S1[GET_U8_BE(T1, 0)] ^ S2[GET_U8_BE(T1, 1)] ^ X1[GET_U8_BE(T1, 2)] ^ X2[GET_U8_BE(T1, 3)]; \
+        (T2) = S1[GET_U8_BE(T2, 0)] ^ S2[GET_U8_BE(T2, 1)] ^ X1[GET_U8_BE(T2, 2)] ^ X2[GET_U8_BE(T2, 3)]; \
+        (T3) = S1[GET_U8_BE(T3, 0)] ^ S2[GET_U8_BE(T3, 1)] ^ X1[GET_U8_BE(T3, 2)] ^ X2[GET_U8_BE(T3, 3)]; \
+    } while (0)
 
 /* S-Box Layer 2 + M */
-#define ARIA_SBOX_LAYER2_WITH_PRE_DIFF(T0, T1, T2, T3)  \
-    do {                                                \
-        (T0) =                                          \
-            X1[GET_U8_BE(T0, 0)] ^                      \
-            X2[GET_U8_BE(T0, 1)] ^                      \
-            S1[GET_U8_BE(T0, 2)] ^                      \
-            S2[GET_U8_BE(T0, 3)];                       \
-        (T1) =                                          \
-            X1[GET_U8_BE(T1, 0)] ^                      \
-            X2[GET_U8_BE(T1, 1)] ^                      \
-            S1[GET_U8_BE(T1, 2)] ^                      \
-            S2[GET_U8_BE(T1, 3)];                       \
-        (T2) =                                          \
-            X1[GET_U8_BE(T2, 0)] ^                      \
-            X2[GET_U8_BE(T2, 1)] ^                      \
-            S1[GET_U8_BE(T2, 2)] ^                      \
-            S2[GET_U8_BE(T2, 3)];                       \
-        (T3) =                                          \
-            X1[GET_U8_BE(T3, 0)] ^                      \
-            X2[GET_U8_BE(T3, 1)] ^                      \
-            S1[GET_U8_BE(T3, 2)] ^                      \
-            S2[GET_U8_BE(T3, 3)];                       \
-    } while(0)
+#define ARIA_SBOX_LAYER2_WITH_PRE_DIFF(T0, T1, T2, T3)                                                    \
+    do {                                                                                                  \
+        (T0) = X1[GET_U8_BE(T0, 0)] ^ X2[GET_U8_BE(T0, 1)] ^ S1[GET_U8_BE(T0, 2)] ^ S2[GET_U8_BE(T0, 3)]; \
+        (T1) = X1[GET_U8_BE(T1, 0)] ^ X2[GET_U8_BE(T1, 1)] ^ S1[GET_U8_BE(T1, 2)] ^ S2[GET_U8_BE(T1, 3)]; \
+        (T2) = X1[GET_U8_BE(T2, 0)] ^ X2[GET_U8_BE(T2, 1)] ^ S1[GET_U8_BE(T2, 2)] ^ S2[GET_U8_BE(T2, 3)]; \
+        (T3) = X1[GET_U8_BE(T3, 0)] ^ X2[GET_U8_BE(T3, 1)] ^ S1[GET_U8_BE(T3, 2)] ^ S2[GET_U8_BE(T3, 3)]; \
+    } while (0)
 
 /* Word-level diffusion */
-#define ARIA_DIFF_WORD(T0,T1,T2,T3) \
-    do {                            \
-        (T1) ^= (T2);               \
-        (T2) ^= (T3);               \
-        (T0) ^= (T1);               \
-                                    \
-        (T3) ^= (T1);               \
-        (T2) ^= (T0);               \
-        (T1) ^= (T2);               \
-    } while(0)
+#define ARIA_DIFF_WORD(T0, T1, T2, T3) \
+    do {                               \
+        (T1) ^= (T2);                  \
+        (T2) ^= (T3);                  \
+        (T0) ^= (T1);                  \
+                                       \
+        (T3) ^= (T1);                  \
+        (T2) ^= (T0);                  \
+        (T1) ^= (T2);                  \
+    } while (0)
 
 /* Byte-level diffusion */
 #define ARIA_DIFF_BYTE(T0, T1, T2, T3)                                  \
@@ -418,7 +379,7 @@ static const uint32_t X2[256] = {
         (T1) = (((T1) << 8) & 0xff00ff00) ^ (((T1) >> 8) & 0x00ff00ff); \
         (T2) = rotr32(T2, 16);                                          \
         (T3) = bswap32(T3);                                             \
-    } while(0)
+    } while (0)
 
 /* Odd round Substitution & Diffusion */
 #define ARIA_SUBST_DIFF_ODD(T0, T1, T2, T3)             \
@@ -427,7 +388,7 @@ static const uint32_t X2[256] = {
         ARIA_DIFF_WORD(T0, T1, T2, T3);                 \
         ARIA_DIFF_BYTE(T0, T1, T2, T3);                 \
         ARIA_DIFF_WORD(T0, T1, T2, T3);                 \
-    } while(0)
+    } while (0)
 
 /* Even round Substitution & Diffusion */
 #define ARIA_SUBST_DIFF_EVEN(T0, T1, T2, T3)            \
@@ -436,40 +397,28 @@ static const uint32_t X2[256] = {
         ARIA_DIFF_WORD(T0, T1, T2, T3);                 \
         ARIA_DIFF_BYTE(T2, T3, T0, T1);                 \
         ARIA_DIFF_WORD(T0, T1, T2, T3);                 \
-    } while(0)
+    } while (0)
 
 /* Q, R Macro expanded ARIA GSRK */
-#define _ARIA_GSRK(RK, X, Y, Q, R)                  \
-    do {                                            \
-        (RK)->u[0] =                                \
-            ((X)[0]) ^                              \
-            (((Y)[((Q)    ) % 4]) >> (R)) ^         \
-            (((Y)[((Q) + 3) % 4]) << (32 - (R)));   \
-        (RK)->u[1] =                                \
-            ((X)[1]) ^                              \
-            (((Y)[((Q) + 1) % 4]) >> (R)) ^         \
-            (((Y)[((Q)    ) % 4]) << (32 - (R)));   \
-        (RK)->u[2] =                                \
-            ((X)[2]) ^                              \
-            (((Y)[((Q) + 2) % 4]) >> (R)) ^         \
-            (((Y)[((Q) + 1) % 4]) << (32 - (R)));   \
-        (RK)->u[3] =                                \
-            ((X)[3]) ^                              \
-            (((Y)[((Q) + 3) % 4]) >> (R)) ^         \
-            (((Y)[((Q) + 2) % 4]) << (32 - (R)));   \
-    } while(0)
+#define _ARIA_GSRK(RK, X, Y, Q, R)                                                                    \
+    do {                                                                                              \
+        (RK)->u[0] = ((X)[0]) ^ (((Y)[((Q)) % 4]) >> (R)) ^ (((Y)[((Q) + 3) % 4]) << (32 - (R)));     \
+        (RK)->u[1] = ((X)[1]) ^ (((Y)[((Q) + 1) % 4]) >> (R)) ^ (((Y)[((Q)) % 4]) << (32 - (R)));     \
+        (RK)->u[2] = ((X)[2]) ^ (((Y)[((Q) + 2) % 4]) >> (R)) ^ (((Y)[((Q) + 1) % 4]) << (32 - (R))); \
+        (RK)->u[3] = ((X)[3]) ^ (((Y)[((Q) + 3) % 4]) >> (R)) ^ (((Y)[((Q) + 2) % 4]) << (32 - (R))); \
+    } while (0)
 
 #define ARIA_GSRK(RK, X, Y, N) _ARIA_GSRK(RK, X, Y, 4 - ((N) / 32), (N) % 32)
 
-#define ARIA_DEC_DIFF_BYTE(X, Y, TMP, TMP2)         \
-    do {                                            \
-        (TMP) = (X);                                \
-        (TMP2) = rotr32((TMP), 8);                  \
-        (Y) = (TMP2) ^ rotr32((TMP) ^ (TMP2), 16);  \
-    } while(0)
+#define ARIA_DEC_DIFF_BYTE(X, Y, TMP, TMP2)        \
+    do {                                           \
+        (TMP) = (X);                               \
+        (TMP2) = rotr32((TMP), 8);                 \
+        (Y) = (TMP2) ^ rotr32((TMP) ^ (TMP2), 16); \
+    } while (0)
 
 void ossl_aria_encrypt(const unsigned char *in, unsigned char *out,
-                       const ARIA_KEY *key)
+    const ARIA_KEY *key)
 {
     register uint32_t reg0, reg1, reg2, reg3;
     int Nr;
@@ -508,26 +457,10 @@ void ossl_aria_encrypt(const unsigned char *in, unsigned char *out,
         rk++;
     }
 
-    reg0 = rk->u[0] ^ MAKE_U32(
-        (uint8_t)(X1[GET_U8_BE(reg0, 0)]     ),
-        (uint8_t)(X2[GET_U8_BE(reg0, 1)] >> 8),
-        (uint8_t)(S1[GET_U8_BE(reg0, 2)]     ),
-        (uint8_t)(S2[GET_U8_BE(reg0, 3)]     ));
-    reg1 = rk->u[1] ^ MAKE_U32(
-        (uint8_t)(X1[GET_U8_BE(reg1, 0)]     ),
-        (uint8_t)(X2[GET_U8_BE(reg1, 1)] >> 8),
-        (uint8_t)(S1[GET_U8_BE(reg1, 2)]     ),
-        (uint8_t)(S2[GET_U8_BE(reg1, 3)]     ));
-    reg2 = rk->u[2] ^ MAKE_U32(
-        (uint8_t)(X1[GET_U8_BE(reg2, 0)]     ),
-        (uint8_t)(X2[GET_U8_BE(reg2, 1)] >> 8),
-        (uint8_t)(S1[GET_U8_BE(reg2, 2)]     ),
-        (uint8_t)(S2[GET_U8_BE(reg2, 3)]     ));
-    reg3 = rk->u[3] ^ MAKE_U32(
-        (uint8_t)(X1[GET_U8_BE(reg3, 0)]     ),
-        (uint8_t)(X2[GET_U8_BE(reg3, 1)] >> 8),
-        (uint8_t)(S1[GET_U8_BE(reg3, 2)]     ),
-        (uint8_t)(S2[GET_U8_BE(reg3, 3)]     ));
+    reg0 = rk->u[0] ^ MAKE_U32((uint8_t)(X1[GET_U8_BE(reg0, 0)]), (uint8_t)(X2[GET_U8_BE(reg0, 1)] >> 8), (uint8_t)(S1[GET_U8_BE(reg0, 2)]), (uint8_t)(S2[GET_U8_BE(reg0, 3)]));
+    reg1 = rk->u[1] ^ MAKE_U32((uint8_t)(X1[GET_U8_BE(reg1, 0)]), (uint8_t)(X2[GET_U8_BE(reg1, 1)] >> 8), (uint8_t)(S1[GET_U8_BE(reg1, 2)]), (uint8_t)(S2[GET_U8_BE(reg1, 3)]));
+    reg2 = rk->u[2] ^ MAKE_U32((uint8_t)(X1[GET_U8_BE(reg2, 0)]), (uint8_t)(X2[GET_U8_BE(reg2, 1)] >> 8), (uint8_t)(S1[GET_U8_BE(reg2, 2)]), (uint8_t)(S2[GET_U8_BE(reg2, 3)]));
+    reg3 = rk->u[3] ^ MAKE_U32((uint8_t)(X1[GET_U8_BE(reg3, 0)]), (uint8_t)(X2[GET_U8_BE(reg3, 1)] >> 8), (uint8_t)(S1[GET_U8_BE(reg3, 2)]), (uint8_t)(S2[GET_U8_BE(reg3, 3)]));
 
     PUT_U32_BE(out, 0, reg0);
     PUT_U32_BE(out, 1, reg1);
@@ -536,7 +469,7 @@ void ossl_aria_encrypt(const unsigned char *in, unsigned char *out,
 }
 
 int ossl_aria_set_encrypt_key(const unsigned char *userKey, const int bits,
-                              ARIA_KEY *key)
+    ARIA_KEY *key)
 {
     register uint32_t reg0, reg1, reg2, reg3;
     uint32_t w0[4], w1[4], w2[4], w3[4];
@@ -574,12 +507,10 @@ int ossl_aria_set_encrypt_key(const unsigned char *userKey, const int bits,
         if (bits > 192) {
             w1[2] = GET_U32_BE(userKey, 6);
             w1[3] = GET_U32_BE(userKey, 7);
-        }
-        else {
+        } else {
             w1[2] = w1[3] = 0;
         }
-    }
-    else {
+    } else {
         w1[0] = w1[1] = w1[2] = w1[3] = 0;
     }
 
@@ -668,7 +599,7 @@ int ossl_aria_set_encrypt_key(const unsigned char *userKey, const int bits,
 }
 
 int ossl_aria_set_decrypt_key(const unsigned char *userKey, const int bits,
-                              ARIA_KEY *key)
+    ARIA_KEY *key)
 {
     ARIA_u128 *rk_head;
     ARIA_u128 *rk_tail;
@@ -893,20 +824,14 @@ static const unsigned char sb4[256] = {
     0xf7, 0x4c, 0x11, 0x33, 0x03, 0xa2, 0xac, 0x60
 };
 
-static const ARIA_u128 c1 = {{
-    0x51, 0x7c, 0xc1, 0xb7, 0x27, 0x22, 0x0a, 0x94,
-    0xfe, 0x13, 0xab, 0xe8, 0xfa, 0x9a, 0x6e, 0xe0
-}};
+static const ARIA_u128 c1 = { { 0x51, 0x7c, 0xc1, 0xb7, 0x27, 0x22, 0x0a, 0x94,
+    0xfe, 0x13, 0xab, 0xe8, 0xfa, 0x9a, 0x6e, 0xe0 } };
 
-static const ARIA_u128 c2 = {{
-    0x6d, 0xb1, 0x4a, 0xcc, 0x9e, 0x21, 0xc8, 0x20,
-    0xff, 0x28, 0xb1, 0xd5, 0xef, 0x5d, 0xe2, 0xb0
-}};
+static const ARIA_u128 c2 = { { 0x6d, 0xb1, 0x4a, 0xcc, 0x9e, 0x21, 0xc8, 0x20,
+    0xff, 0x28, 0xb1, 0xd5, 0xef, 0x5d, 0xe2, 0xb0 } };
 
-static const ARIA_u128 c3 = {{
-    0xdb, 0x92, 0x37, 0x1d, 0x21, 0x26, 0xe9, 0x70,
-    0x03, 0x24, 0x97, 0x75, 0x04, 0xe8, 0xc9, 0x0e
-}};
+static const ARIA_u128 c3 = { { 0xdb, 0x92, 0x37, 0x1d, 0x21, 0x26, 0xe9, 0x70,
+    0x03, 0x24, 0x97, 0x75, 0x04, 0xe8, 0xc9, 0x0e } };
 
 /*
  * Exclusive or two 128 bit values into the result.
@@ -925,7 +850,7 @@ static void xor128(ARIA_c128 o, const ARIA_c128 x, const ARIA_u128 *y)
  * It is safe for the output to overlap either input.
  */
 static ossl_inline void rotnr(unsigned int n, ARIA_u128 *o,
-                              const ARIA_u128 *xor, const ARIA_u128 *z)
+    const ARIA_u128 *xor, const ARIA_u128 *z)
 {
     const unsigned int bytes = n / 8, bits = n % 8;
     unsigned int i;
@@ -934,9 +859,7 @@ static ossl_inline void rotnr(unsigned int n, ARIA_u128 *o,
     for (i = 0; i < ARIA_BLOCK_SIZE; i++)
         t.c[(i + bytes) % ARIA_BLOCK_SIZE] = z->c[i];
     for (i = 0; i < ARIA_BLOCK_SIZE; i++)
-        o->c[i] = ((t.c[i] >> bits) |
-                (t.c[i ? i - 1 : ARIA_BLOCK_SIZE - 1] << (8 - bits))) ^
-                xor->c[i];
+        o->c[i] = ((t.c[i] >> bits) | (t.c[i ? i - 1 : ARIA_BLOCK_SIZE - 1] << (8 - bits))) ^ xor->c[i];
 }
 
 /*
@@ -992,7 +915,7 @@ static void sl1(ARIA_u128 *o, const ARIA_u128 *x, const ARIA_u128 *y)
 {
     unsigned int i;
     for (i = 0; i < ARIA_BLOCK_SIZE; i += 4) {
-        o->c[i    ] = sb1[x->c[i    ] ^ y->c[i    ]];
+        o->c[i] = sb1[x->c[i] ^ y->c[i]];
         o->c[i + 1] = sb2[x->c[i + 1] ^ y->c[i + 1]];
         o->c[i + 2] = sb3[x->c[i + 2] ^ y->c[i + 2]];
         o->c[i + 3] = sb4[x->c[i + 3] ^ y->c[i + 3]];
@@ -1007,7 +930,7 @@ static void sl2(ARIA_c128 o, const ARIA_u128 *x, const ARIA_u128 *y)
 {
     unsigned int i;
     for (i = 0; i < ARIA_BLOCK_SIZE; i += 4) {
-        o[i    ] = sb3[x->c[i    ] ^ y->c[i    ]];
+        o[i] = sb3[x->c[i] ^ y->c[i]];
         o[i + 1] = sb4[x->c[i + 1] ^ y->c[i + 1]];
         o[i + 2] = sb1[x->c[i + 2] ^ y->c[i + 2]];
         o[i + 3] = sb2[x->c[i + 3] ^ y->c[i + 3]];
@@ -1020,38 +943,22 @@ static void sl2(ARIA_c128 o, const ARIA_u128 *x, const ARIA_u128 *y)
  */
 static void a(ARIA_u128 *y, const ARIA_u128 *x)
 {
-    y->c[ 0] = x->c[ 3] ^ x->c[ 4] ^ x->c[ 6] ^ x->c[ 8] ^
-               x->c[ 9] ^ x->c[13] ^ x->c[14];
-    y->c[ 1] = x->c[ 2] ^ x->c[ 5] ^ x->c[ 7] ^ x->c[ 8] ^
-               x->c[ 9] ^ x->c[12] ^ x->c[15];
-    y->c[ 2] = x->c[ 1] ^ x->c[ 4] ^ x->c[ 6] ^ x->c[10] ^
-               x->c[11] ^ x->c[12] ^ x->c[15];
-    y->c[ 3] = x->c[ 0] ^ x->c[ 5] ^ x->c[ 7] ^ x->c[10] ^
-               x->c[11] ^ x->c[13] ^ x->c[14];
-    y->c[ 4] = x->c[ 0] ^ x->c[ 2] ^ x->c[ 5] ^ x->c[ 8] ^
-               x->c[11] ^ x->c[14] ^ x->c[15];
-    y->c[ 5] = x->c[ 1] ^ x->c[ 3] ^ x->c[ 4] ^ x->c[ 9] ^
-               x->c[10] ^ x->c[14] ^ x->c[15];
-    y->c[ 6] = x->c[ 0] ^ x->c[ 2] ^ x->c[ 7] ^ x->c[ 9] ^
-               x->c[10] ^ x->c[12] ^ x->c[13];
-    y->c[ 7] = x->c[ 1] ^ x->c[ 3] ^ x->c[ 6] ^ x->c[ 8] ^
-               x->c[11] ^ x->c[12] ^ x->c[13];
-    y->c[ 8] = x->c[ 0] ^ x->c[ 1] ^ x->c[ 4] ^ x->c[ 7] ^
-               x->c[10] ^ x->c[13] ^ x->c[15];
-    y->c[ 9] = x->c[ 0] ^ x->c[ 1] ^ x->c[ 5] ^ x->c[ 6] ^
-               x->c[11] ^ x->c[12] ^ x->c[14];
-    y->c[10] = x->c[ 2] ^ x->c[ 3] ^ x->c[ 5] ^ x->c[ 6] ^
-               x->c[ 8] ^ x->c[13] ^ x->c[15];
-    y->c[11] = x->c[ 2] ^ x->c[ 3] ^ x->c[ 4] ^ x->c[ 7] ^
-               x->c[ 9] ^ x->c[12] ^ x->c[14];
-    y->c[12] = x->c[ 1] ^ x->c[ 2] ^ x->c[ 6] ^ x->c[ 7] ^
-               x->c[ 9] ^ x->c[11] ^ x->c[12];
-    y->c[13] = x->c[ 0] ^ x->c[ 3] ^ x->c[ 6] ^ x->c[ 7] ^
-               x->c[ 8] ^ x->c[10] ^ x->c[13];
-    y->c[14] = x->c[ 0] ^ x->c[ 3] ^ x->c[ 4] ^ x->c[ 5] ^
-               x->c[ 9] ^ x->c[11] ^ x->c[14];
-    y->c[15] = x->c[ 1] ^ x->c[ 2] ^ x->c[ 4] ^ x->c[ 5] ^
-               x->c[ 8] ^ x->c[10] ^ x->c[15];
+    y->c[0] = x->c[3] ^ x->c[4] ^ x->c[6] ^ x->c[8] ^ x->c[9] ^ x->c[13] ^ x->c[14];
+    y->c[1] = x->c[2] ^ x->c[5] ^ x->c[7] ^ x->c[8] ^ x->c[9] ^ x->c[12] ^ x->c[15];
+    y->c[2] = x->c[1] ^ x->c[4] ^ x->c[6] ^ x->c[10] ^ x->c[11] ^ x->c[12] ^ x->c[15];
+    y->c[3] = x->c[0] ^ x->c[5] ^ x->c[7] ^ x->c[10] ^ x->c[11] ^ x->c[13] ^ x->c[14];
+    y->c[4] = x->c[0] ^ x->c[2] ^ x->c[5] ^ x->c[8] ^ x->c[11] ^ x->c[14] ^ x->c[15];
+    y->c[5] = x->c[1] ^ x->c[3] ^ x->c[4] ^ x->c[9] ^ x->c[10] ^ x->c[14] ^ x->c[15];
+    y->c[6] = x->c[0] ^ x->c[2] ^ x->c[7] ^ x->c[9] ^ x->c[10] ^ x->c[12] ^ x->c[13];
+    y->c[7] = x->c[1] ^ x->c[3] ^ x->c[6] ^ x->c[8] ^ x->c[11] ^ x->c[12] ^ x->c[13];
+    y->c[8] = x->c[0] ^ x->c[1] ^ x->c[4] ^ x->c[7] ^ x->c[10] ^ x->c[13] ^ x->c[15];
+    y->c[9] = x->c[0] ^ x->c[1] ^ x->c[5] ^ x->c[6] ^ x->c[11] ^ x->c[12] ^ x->c[14];
+    y->c[10] = x->c[2] ^ x->c[3] ^ x->c[5] ^ x->c[6] ^ x->c[8] ^ x->c[13] ^ x->c[15];
+    y->c[11] = x->c[2] ^ x->c[3] ^ x->c[4] ^ x->c[7] ^ x->c[9] ^ x->c[12] ^ x->c[14];
+    y->c[12] = x->c[1] ^ x->c[2] ^ x->c[6] ^ x->c[7] ^ x->c[9] ^ x->c[11] ^ x->c[12];
+    y->c[13] = x->c[0] ^ x->c[3] ^ x->c[6] ^ x->c[7] ^ x->c[8] ^ x->c[10] ^ x->c[13];
+    y->c[14] = x->c[0] ^ x->c[3] ^ x->c[4] ^ x->c[5] ^ x->c[9] ^ x->c[11] ^ x->c[14];
+    y->c[15] = x->c[1] ^ x->c[2] ^ x->c[4] ^ x->c[5] ^ x->c[8] ^ x->c[10] ^ x->c[15];
 }
 
 /*
@@ -1060,7 +967,7 @@ static void a(ARIA_u128 *y, const ARIA_u128 *x)
  * It is safe for the input and output to overlap.
  */
 static ossl_inline void FO(ARIA_u128 *o, const ARIA_u128 *d,
-                           const ARIA_u128 *rk)
+    const ARIA_u128 *rk)
 {
     ARIA_u128 y;
 
@@ -1074,7 +981,7 @@ static ossl_inline void FO(ARIA_u128 *o, const ARIA_u128 *d,
  * It is safe for the input and output to overlap.
  */
 static ossl_inline void FE(ARIA_u128 *o, const ARIA_u128 *d,
-                           const ARIA_u128 *rk)
+    const ARIA_u128 *rk)
 {
     ARIA_u128 y;
 
@@ -1087,7 +994,7 @@ static ossl_inline void FE(ARIA_u128 *o, const ARIA_u128 *d,
  * in and out can overlap
  */
 static void do_encrypt(unsigned char *o, const unsigned char *pin,
-                       unsigned int rounds, const ARIA_u128 *keys)
+    unsigned int rounds, const ARIA_u128 *keys)
 {
     ARIA_u128 p;
     unsigned int i;
@@ -1107,20 +1014,19 @@ static void do_encrypt(unsigned char *o, const unsigned char *pin,
  * in and out can overlap
  */
 void ossl_aria_encrypt(const unsigned char *in, unsigned char *out,
-                       const ARIA_KEY *key)
+    const ARIA_KEY *key)
 {
     assert(in != NULL && out != NULL && key != NULL);
     do_encrypt(out, in, key->rounds, key->rd_key);
 }
 
-
 /*
  * Expand the cipher key into the encryption key schedule.
  * We short circuit execution of the last two
  * or four rotations based on the key size.
  */
 int ossl_aria_set_encrypt_key(const unsigned char *userKey, const int bits,
-                              ARIA_KEY *key)
+    ARIA_KEY *key)
 {
     const ARIA_u128 *ck1, *ck2, *ck3;
     ARIA_u128 kr, w0, w1, w2, w3;
@@ -1157,22 +1063,25 @@ int ossl_aria_set_encrypt_key(const unsigned char *userKey, const int bits,
         break;
     }
 
-    FO(&w3, &w0, ck1);    xor128(w1.c, w3.c, &kr);
-    FE(&w3, &w1, ck2);    xor128(w2.c, w3.c, &w0);
-    FO(&kr, &w2, ck3);    xor128(w3.c, kr.c, &w1);
+    FO(&w3, &w0, ck1);
+    xor128(w1.c, w3.c, &kr);
+    FE(&w3, &w1, ck2);
+    xor128(w2.c, w3.c, &w0);
+    FO(&kr, &w2, ck3);
+    xor128(w3.c, kr.c, &w1);
 
-    rot19r(&key->rd_key[ 0], &w0, &w1);
-    rot19r(&key->rd_key[ 1], &w1, &w2);
-    rot19r(&key->rd_key[ 2], &w2, &w3);
-    rot19r(&key->rd_key[ 3], &w3, &w0);
+    rot19r(&key->rd_key[0], &w0, &w1);
+    rot19r(&key->rd_key[1], &w1, &w2);
+    rot19r(&key->rd_key[2], &w2, &w3);
+    rot19r(&key->rd_key[3], &w3, &w0);
 
-    rot31r(&key->rd_key[ 4], &w0, &w1);
-    rot31r(&key->rd_key[ 5], &w1, &w2);
-    rot31r(&key->rd_key[ 6], &w2, &w3);
-    rot31r(&key->rd_key[ 7], &w3, &w0);
+    rot31r(&key->rd_key[4], &w0, &w1);
+    rot31r(&key->rd_key[5], &w1, &w2);
+    rot31r(&key->rd_key[6], &w2, &w3);
+    rot31r(&key->rd_key[7], &w3, &w0);
 
-    rot61l(&key->rd_key[ 8], &w0, &w1);
-    rot61l(&key->rd_key[ 9], &w1, &w2);
+    rot61l(&key->rd_key[8], &w0, &w1);
+    rot61l(&key->rd_key[9], &w1, &w2);
     rot61l(&key->rd_key[10], &w2, &w3);
     rot61l(&key->rd_key[11], &w3, &w0);
 
@@ -1193,7 +1102,7 @@ int ossl_aria_set_encrypt_key(const unsigned char *userKey, const int bits,
  * Expand the cipher key into the decryption key schedule.
  */
 int ossl_aria_set_decrypt_key(const unsigned char *userKey, const int bits,
-                              ARIA_KEY *key)
+    ARIA_KEY *key)
 {
     ARIA_KEY ek;
     const int r = ossl_aria_set_encrypt_key(userKey, bits, &ek);
diff --git a/crypto/openssl/crypto/arm_arch.h b/crypto/openssl/crypto/arm_arch.h
index acd8aee4d519..d570d1eba6c1 100644
--- a/crypto/openssl/crypto/arm_arch.h
+++ b/crypto/openssl/crypto/arm_arch.h
@@ -8,87 +8,80 @@
  */
 
 #ifndef OSSL_CRYPTO_ARM_ARCH_H
-# define OSSL_CRYPTO_ARM_ARCH_H
+#define OSSL_CRYPTO_ARM_ARCH_H
 
-# if !defined(__ARM_ARCH__)
-#  if defined(__CC_ARM)
-#   define __ARM_ARCH__ __TARGET_ARCH_ARM
-#   if defined(__BIG_ENDIAN)
-#    define __ARMEB__
-#   else
-#    define __ARMEL__
-#   endif
-#  elif defined(__GNUC__)
-#   if   defined(__aarch64__)
-#    define __ARM_ARCH__ 8
-  /*
-   * Why doesn't gcc define __ARM_ARCH__? Instead it defines
-   * bunch of below macros. See all_architectures[] table in
-   * gcc/config/arm/arm.c. On a side note it defines
-   * __ARMEL__/__ARMEB__ for little-/big-endian.
-   */
-#   elif defined(__ARM_ARCH)
-#    define __ARM_ARCH__ __ARM_ARCH
-#   elif defined(__ARM_ARCH_8A__)
-#    define __ARM_ARCH__ 8
-#   elif defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__)     || \
-        defined(__ARM_ARCH_7R__)|| defined(__ARM_ARCH_7M__)     || \
-        defined(__ARM_ARCH_7EM__)
-#    define __ARM_ARCH__ 7
-#   elif defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__)     || \
-        defined(__ARM_ARCH_6K__)|| defined(__ARM_ARCH_6M__)     || \
-        defined(__ARM_ARCH_6Z__)|| defined(__ARM_ARCH_6ZK__)    || \
-        defined(__ARM_ARCH_6T2__)
-#    define __ARM_ARCH__ 6
-#   elif defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__)     || \
-        defined(__ARM_ARCH_5E__)|| defined(__ARM_ARCH_5TE__)    || \
-        defined(__ARM_ARCH_5TEJ__)
-#    define __ARM_ARCH__ 5
-#   elif defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
-#    define __ARM_ARCH__ 4
-#   else
-#    error "unsupported ARM architecture"
-#   endif
-#  elif defined(__ARM_ARCH)
-#   define __ARM_ARCH__ __ARM_ARCH
-#  endif
-# endif
+#if !defined(__ARM_ARCH__)
+#if defined(__CC_ARM)
+#define __ARM_ARCH__ __TARGET_ARCH_ARM
+#if defined(__BIG_ENDIAN)
+#define __ARMEB__
+#else
+#define __ARMEL__
+#endif
+#elif defined(__GNUC__)
+#if defined(__aarch64__)
+#define __ARM_ARCH__ 8
+/*
+ * Why doesn't gcc define __ARM_ARCH__? Instead it defines
+ * bunch of below macros. See all_architectures[] table in
+ * gcc/config/arm/arm.c. On a side note it defines
+ * __ARMEL__/__ARMEB__ for little-/big-endian.
+ */
+#elif defined(__ARM_ARCH)
+#define __ARM_ARCH__ __ARM_ARCH
+#elif defined(__ARM_ARCH_8A__)
+#define __ARM_ARCH__ 8
+#elif defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__) || defined(__ARM_ARCH_7R__) || defined(__ARM_ARCH_7M__) || defined(__ARM_ARCH_7EM__)
+#define __ARM_ARCH__ 7
+#elif defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__) || defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6M__) || defined(__ARM_ARCH_6Z__) || defined(__ARM_ARCH_6ZK__) || defined(__ARM_ARCH_6T2__)
+#define __ARM_ARCH__ 6
+#elif defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__) || defined(__ARM_ARCH_5E__) || defined(__ARM_ARCH_5TE__) || defined(__ARM_ARCH_5TEJ__)
+#define __ARM_ARCH__ 5
+#elif defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
+#define __ARM_ARCH__ 4
+#else
+#error "unsupported ARM architecture"
+#endif
+#elif defined(__ARM_ARCH)
+#define __ARM_ARCH__ __ARM_ARCH
+#endif
+#endif
 
-# if !defined(__ARM_MAX_ARCH__)
-#  define __ARM_MAX_ARCH__ __ARM_ARCH__
-# endif
+#if !defined(__ARM_MAX_ARCH__)
+#define __ARM_MAX_ARCH__ __ARM_ARCH__
+#endif
 
-# if __ARM_MAX_ARCH__<__ARM_ARCH__
-#  error "__ARM_MAX_ARCH__ can't be less than __ARM_ARCH__"
-# elif __ARM_MAX_ARCH__!=__ARM_ARCH__
-#  if __ARM_ARCH__<7 && __ARM_MAX_ARCH__>=7 && defined(__ARMEB__)
-#   error "can't build universal big-endian binary"
-#  endif
-# endif
+#if __ARM_MAX_ARCH__ < __ARM_ARCH__
+#error "__ARM_MAX_ARCH__ can't be less than __ARM_ARCH__"
+#elif __ARM_MAX_ARCH__ != __ARM_ARCH__
+#if __ARM_ARCH__ < 7 && __ARM_MAX_ARCH__ >= 7 && defined(__ARMEB__)
+#error "can't build universal big-endian binary"
+#endif
+#endif
 
-# ifndef __ASSEMBLER__
+#ifndef __ASSEMBLER__
 extern unsigned int OPENSSL_armcap_P;
 extern unsigned int OPENSSL_arm_midr;
 extern unsigned int OPENSSL_armv8_rsa_neonized;
-# endif
+#endif
 
-# define ARMV7_NEON      (1<<0)
-# define ARMV7_TICK      (1<<1)
-# define ARMV8_AES       (1<<2)
-# define ARMV8_SHA1      (1<<3)
-# define ARMV8_SHA256    (1<<4)
-# define ARMV8_PMULL     (1<<5)
-# define ARMV8_SHA512    (1<<6)
-# define ARMV8_CPUID     (1<<7)
-# define ARMV8_RNG       (1<<8)
-# define ARMV8_SM3       (1<<9)
-# define ARMV8_SM4       (1<<10)
-# define ARMV8_SHA3      (1<<11)
-# define ARMV8_UNROLL8_EOR3      (1<<12)
-# define ARMV8_SVE       (1<<13)
-# define ARMV8_SVE2      (1<<14)
-# define ARMV8_HAVE_SHA3_AND_WORTH_USING     (1<<15)
-# define ARMV8_UNROLL12_EOR3     (1<<16)
+#define ARMV7_NEON (1 << 0)
+#define ARMV7_TICK (1 << 1)
+#define ARMV8_AES (1 << 2)
+#define ARMV8_SHA1 (1 << 3)
+#define ARMV8_SHA256 (1 << 4)
+#define ARMV8_PMULL (1 << 5)
+#define ARMV8_SHA512 (1 << 6)
+#define ARMV8_CPUID (1 << 7)
+#define ARMV8_RNG (1 << 8)
+#define ARMV8_SM3 (1 << 9)
+#define ARMV8_SM4 (1 << 10)
+#define ARMV8_SHA3 (1 << 11)
+#define ARMV8_UNROLL8_EOR3 (1 << 12)
+#define ARMV8_SVE (1 << 13)
+#define ARMV8_SVE2 (1 << 14)
+#define ARMV8_HAVE_SHA3_AND_WORTH_USING (1 << 15)
+#define ARMV8_UNROLL12_EOR3 (1 << 16)
 
 /*
  * MIDR_EL1 system register
@@ -100,120 +93,116 @@ extern unsigned int OPENSSL_armv8_rsa_neonized;
  *
  */
 
-# define ARM_CPU_IMP_ARM           0x41
-# define HISI_CPU_IMP              0x48
-# define ARM_CPU_IMP_APPLE         0x61
-# define ARM_CPU_IMP_MICROSOFT     0x6D
-# define ARM_CPU_IMP_AMPERE        0xC0
+#define ARM_CPU_IMP_ARM 0x41
+#define HISI_CPU_IMP 0x48
+#define ARM_CPU_IMP_APPLE 0x61
+#define ARM_CPU_IMP_MICROSOFT 0x6D
+#define ARM_CPU_IMP_AMPERE 0xC0
 
-# define ARM_CPU_PART_CORTEX_A72   0xD08
-# define ARM_CPU_PART_N1           0xD0C
-# define ARM_CPU_PART_V1           0xD40
-# define ARM_CPU_PART_N2           0xD49
-# define HISI_CPU_PART_KP920       0xD01
-# define ARM_CPU_PART_V2           0xD4F
+#define ARM_CPU_PART_CORTEX_A72 0xD08
+#define ARM_CPU_PART_N1 0xD0C
+#define ARM_CPU_PART_V1 0xD40
+#define ARM_CPU_PART_N2 0xD49
+#define HISI_CPU_PART_KP920 0xD01
+#define ARM_CPU_PART_V2 0xD4F
 
-# define APPLE_CPU_PART_M1_ICESTORM         0x022
-# define APPLE_CPU_PART_M1_FIRESTORM        0x023
-# define APPLE_CPU_PART_M1_ICESTORM_PRO     0x024
-# define APPLE_CPU_PART_M1_FIRESTORM_PRO    0x025
-# define APPLE_CPU_PART_M1_ICESTORM_MAX     0x028
-# define APPLE_CPU_PART_M1_FIRESTORM_MAX    0x029
-# define APPLE_CPU_PART_M2_BLIZZARD         0x032
-# define APPLE_CPU_PART_M2_AVALANCHE        0x033
-# define APPLE_CPU_PART_M2_BLIZZARD_PRO     0x034
-# define APPLE_CPU_PART_M2_AVALANCHE_PRO    0x035
-# define APPLE_CPU_PART_M2_BLIZZARD_MAX     0x038
-# define APPLE_CPU_PART_M2_AVALANCHE_MAX    0x039
+#define APPLE_CPU_PART_M1_ICESTORM 0x022
+#define APPLE_CPU_PART_M1_FIRESTORM 0x023
+#define APPLE_CPU_PART_M1_ICESTORM_PRO 0x024
+#define APPLE_CPU_PART_M1_FIRESTORM_PRO 0x025
+#define APPLE_CPU_PART_M1_ICESTORM_MAX 0x028
+#define APPLE_CPU_PART_M1_FIRESTORM_MAX 0x029
+#define APPLE_CPU_PART_M2_BLIZZARD 0x032
+#define APPLE_CPU_PART_M2_AVALANCHE 0x033
+#define APPLE_CPU_PART_M2_BLIZZARD_PRO 0x034
+#define APPLE_CPU_PART_M2_AVALANCHE_PRO 0x035
+#define APPLE_CPU_PART_M2_BLIZZARD_MAX 0x038
+#define APPLE_CPU_PART_M2_AVALANCHE_MAX 0x039
 
-# define MICROSOFT_CPU_PART_COBALT_100      0xD49
+#define MICROSOFT_CPU_PART_COBALT_100 0xD49
 
-# define MIDR_PARTNUM_SHIFT       4
-# define MIDR_PARTNUM_MASK        (0xfffU << MIDR_PARTNUM_SHIFT)
-# define MIDR_PARTNUM(midr)       \
-           (((midr) & MIDR_PARTNUM_MASK) >> MIDR_PARTNUM_SHIFT)
+#define MIDR_PARTNUM_SHIFT 4
+#define MIDR_PARTNUM_MASK (0xfffU << MIDR_PARTNUM_SHIFT)
+#define MIDR_PARTNUM(midr) \
+    (((midr) & MIDR_PARTNUM_MASK) >> MIDR_PARTNUM_SHIFT)
 
-# define MIDR_IMPLEMENTER_SHIFT   24
-# define MIDR_IMPLEMENTER_MASK    (0xffU << MIDR_IMPLEMENTER_SHIFT)
-# define MIDR_IMPLEMENTER(midr)   \
-           (((midr) & MIDR_IMPLEMENTER_MASK) >> MIDR_IMPLEMENTER_SHIFT)
+#define MIDR_IMPLEMENTER_SHIFT 24
+#define MIDR_IMPLEMENTER_MASK (0xffU << MIDR_IMPLEMENTER_SHIFT)
+#define MIDR_IMPLEMENTER(midr) \
+    (((midr) & MIDR_IMPLEMENTER_MASK) >> MIDR_IMPLEMENTER_SHIFT)
 
-# define MIDR_ARCHITECTURE_SHIFT  16
-# define MIDR_ARCHITECTURE_MASK   (0xfU << MIDR_ARCHITECTURE_SHIFT)
-# define MIDR_ARCHITECTURE(midr)  \
-           (((midr) & MIDR_ARCHITECTURE_MASK) >> MIDR_ARCHITECTURE_SHIFT)
+#define MIDR_ARCHITECTURE_SHIFT 16
+#define MIDR_ARCHITECTURE_MASK (0xfU << MIDR_ARCHITECTURE_SHIFT)
+#define MIDR_ARCHITECTURE(midr) \
+    (((midr) & MIDR_ARCHITECTURE_MASK) >> MIDR_ARCHITECTURE_SHIFT)
 
-# define MIDR_CPU_MODEL_MASK \
-           (MIDR_IMPLEMENTER_MASK | \
-            MIDR_PARTNUM_MASK     | \
-            MIDR_ARCHITECTURE_MASK)
+#define MIDR_CPU_MODEL_MASK \
+    (MIDR_IMPLEMENTER_MASK | MIDR_PARTNUM_MASK | MIDR_ARCHITECTURE_MASK)
 
-# define MIDR_CPU_MODEL(imp, partnum) \
-           (((imp)     << MIDR_IMPLEMENTER_SHIFT)  | \
-            (0xfU      << MIDR_ARCHITECTURE_SHIFT) | \
-            ((partnum) << MIDR_PARTNUM_SHIFT))
+#define MIDR_CPU_MODEL(imp, partnum) \
+    (((imp) << MIDR_IMPLEMENTER_SHIFT) | (0xfU << MIDR_ARCHITECTURE_SHIFT) | ((partnum) << MIDR_PARTNUM_SHIFT))
 
-# define MIDR_IS_CPU_MODEL(midr, imp, partnum) \
-           (((midr) & MIDR_CPU_MODEL_MASK) == MIDR_CPU_MODEL(imp, partnum))
+#define MIDR_IS_CPU_MODEL(midr, imp, partnum) \
+    (((midr) & MIDR_CPU_MODEL_MASK) == MIDR_CPU_MODEL(imp, partnum))
 
 #if defined(__ASSEMBLER__)
 
-   /*
-    * Support macros for
-    *   - Armv8.3-A Pointer Authentication and
-    *   - Armv8.5-A Branch Target Identification
-    * features which require emitting a .note.gnu.property section with the
-    * appropriate architecture-dependent feature bits set.
-    * Read more: "ELF for the Arm® 64-bit Architecture"
-    */
+/*
+ * Support macros for
+ *   - Armv8.3-A Pointer Authentication and
+ *   - Armv8.5-A Branch Target Identification
+ * features which require emitting a .note.gnu.property section with the
+ * appropriate architecture-dependent feature bits set.
+ * Read more: "ELF for the Arm® 64-bit Architecture"
+ */
 
-#  if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
-#   define GNU_PROPERTY_AARCH64_BTI (1 << 0)   /* Has Branch Target Identification */
-#   define AARCH64_VALID_CALL_TARGET hint #34  /* BTI 'c' */
-#  else
-#   define GNU_PROPERTY_AARCH64_BTI 0  /* No Branch Target Identification */
-#   define AARCH64_VALID_CALL_TARGET
-#  endif
+#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
+#define GNU_PROPERTY_AARCH64_BTI (1 << 0) /* Has Branch Target Identification */
+#define AARCH64_VALID_CALL_TARGET hint #34 /* BTI 'c' */
+#else
+#define GNU_PROPERTY_AARCH64_BTI 0 /* No Branch Target Identification */
+#define AARCH64_VALID_CALL_TARGET
+#endif
 
-#  if defined(__ARM_FEATURE_PAC_DEFAULT) && \
-       (__ARM_FEATURE_PAC_DEFAULT & 1) == 1  /* Signed with A-key */
-#   define GNU_PROPERTY_AARCH64_POINTER_AUTH \
-     (1 << 1)                                       /* Has Pointer Authentication */
-#   define AARCH64_SIGN_LINK_REGISTER hint #25      /* PACIASP */
-#   define AARCH64_VALIDATE_LINK_REGISTER hint #29  /* AUTIASP */
-#  elif defined(__ARM_FEATURE_PAC_DEFAULT) && \
-       (__ARM_FEATURE_PAC_DEFAULT & 2) == 2  /* Signed with B-key */
-#   define GNU_PROPERTY_AARCH64_POINTER_AUTH \
-     (1 << 1)                                       /* Has Pointer Authentication */
-#   define AARCH64_SIGN_LINK_REGISTER hint #27      /* PACIBSP */
-#   define AARCH64_VALIDATE_LINK_REGISTER hint #31  /* AUTIBSP */
-#  else
-#   define GNU_PROPERTY_AARCH64_POINTER_AUTH 0  /* No Pointer Authentication */
-#   if GNU_PROPERTY_AARCH64_BTI != 0
-#    define AARCH64_SIGN_LINK_REGISTER AARCH64_VALID_CALL_TARGET
-#   else
-#    define AARCH64_SIGN_LINK_REGISTER
-#   endif
-#   define AARCH64_VALIDATE_LINK_REGISTER
-#  endif
+#if defined(__ARM_FEATURE_PAC_DEFAULT) && (__ARM_FEATURE_PAC_DEFAULT & 1) == 1 /* Signed with A-key */
+#define GNU_PROPERTY_AARCH64_POINTER_AUTH \
+    (1 << 1) /* Has Pointer Authentication */
+#define AARCH64_SIGN_LINK_REGISTER hint #25 /* PACIASP */
+#define AARCH64_VALIDATE_LINK_REGISTER hint #29 /* AUTIASP */
+#elif defined(__ARM_FEATURE_PAC_DEFAULT) && (__ARM_FEATURE_PAC_DEFAULT & 2) == 2 /* Signed with B-key */
+#define GNU_PROPERTY_AARCH64_POINTER_AUTH \
+    (1 << 1) /* Has Pointer Authentication */
+#define AARCH64_SIGN_LINK_REGISTER hint #27 /* PACIBSP */
+#define AARCH64_VALIDATE_LINK_REGISTER hint #31 /* AUTIBSP */
+#else
+#define GNU_PROPERTY_AARCH64_POINTER_AUTH 0 /* No Pointer Authentication */
+#if GNU_PROPERTY_AARCH64_BTI != 0
+#define AARCH64_SIGN_LINK_REGISTER AARCH64_VALID_CALL_TARGET
+#else
+#define AARCH64_SIGN_LINK_REGISTER
+#endif
+#define AARCH64_VALIDATE_LINK_REGISTER
+#endif
 
-#  if GNU_PROPERTY_AARCH64_POINTER_AUTH != 0 || GNU_PROPERTY_AARCH64_BTI != 0
-    .pushsection .note.gnu.property, "a";
-    .balign 8;
-    .long 4;
-    .long 0x10;
-    .long 0x5;
-    .asciz "GNU";
-    .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
-    .long 4;
-    .long (GNU_PROPERTY_AARCH64_POINTER_AUTH | GNU_PROPERTY_AARCH64_BTI);
-    .long 0;
-    .popsection;
-#  endif
+#if GNU_PROPERTY_AARCH64_POINTER_AUTH != 0 || GNU_PROPERTY_AARCH64_BTI != 0
+/* clang-format off */
+.pushsection .note.gnu.property, "a";
+/* clang-format on */
+.balign 8;
+.long 4;
+.long 0x10;
+.long 0x5;
+.asciz "GNU";
+.long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
+.long 4;
+.long(GNU_PROPERTY_AARCH64_POINTER_AUTH | GNU_PROPERTY_AARCH64_BTI);
+.long 0;
+.popsection;
+#endif
 
-# endif  /* defined __ASSEMBLER__ */
+#endif /* defined __ASSEMBLER__ */
 
-# define IS_CPU_SUPPORT_UNROLL8_EOR3() \
-           (OPENSSL_armcap_P & ARMV8_UNROLL8_EOR3)
+#define IS_CPU_SUPPORT_UNROLL8_EOR3() \
+    (OPENSSL_armcap_P & ARMV8_UNROLL8_EOR3)
 
 #endif
diff --git a/crypto/openssl/crypto/armcap.c b/crypto/openssl/crypto/armcap.c
index 66c9001089a5..03e47dc5bbfb 100644
--- a/crypto/openssl/crypto/armcap.c
+++ b/crypto/openssl/crypto/armcap.c
@@ -58,93 +58,92 @@ uint32_t OPENSSL_rdtsc(void)
 }
 #else /* !_WIN32 && __ARM_MAX_ARCH__ >= 7 */
 
- /* 3 ways of handling things here: __APPLE__,  getauxval() or SIGILL detect */
+/* 3 ways of handling things here: __APPLE__,  getauxval() or SIGILL detect */
 
- /* First determine if getauxval() is available (OSSL_IMPLEMENT_GETAUXVAL) */
+/* First determine if getauxval() is available (OSSL_IMPLEMENT_GETAUXVAL) */
 
-# if defined(__GNUC__) && __GNUC__>=2
-void OPENSSL_cpuid_setup(void) __attribute__ ((constructor));
-# endif
+#if defined(__GNUC__) && __GNUC__ >= 2
+void OPENSSL_cpuid_setup(void) __attribute__((constructor));
+#endif
 
-# if defined(__GLIBC__) && defined(__GLIBC_PREREQ)
-#  if __GLIBC_PREREQ(2, 16)
-#   include <sys/auxv.h>
-#   define OSSL_IMPLEMENT_GETAUXVAL
-#  endif
-# elif defined(__ANDROID_API__)
+#if defined(__GLIBC__) && defined(__GLIBC_PREREQ)
+#if __GLIBC_PREREQ(2, 16)
+#include <sys/auxv.h>
+#define OSSL_IMPLEMENT_GETAUXVAL
+#endif
+#elif defined(__ANDROID_API__)
 /* see https://developer.android.google.cn/ndk/guides/cpu-features */
-#  if __ANDROID_API__ >= 18
-#   include <sys/auxv.h>
-#   define OSSL_IMPLEMENT_GETAUXVAL
-#  endif
-# endif
-# if defined(__FreeBSD__) || defined(__OpenBSD__)
-#  include <sys/param.h>
-#  if (defined(__FreeBSD__) && __FreeBSD_version >= 1200000) || \
-    (defined(__OpenBSD__) && OpenBSD >= 202409)
-#   include <sys/auxv.h>
-#   define OSSL_IMPLEMENT_GETAUXVAL
+#if __ANDROID_API__ >= 18
+#include <sys/auxv.h>
+#define OSSL_IMPLEMENT_GETAUXVAL
+#endif
+#endif
+#if defined(__FreeBSD__) || defined(__OpenBSD__)
+#include <sys/param.h>
+#if (defined(__FreeBSD__) && __FreeBSD_version >= 1200000) || (defined(__OpenBSD__) && OpenBSD >= 202409)
+#include <sys/auxv.h>
+#define OSSL_IMPLEMENT_GETAUXVAL
 
 static unsigned long getauxval(unsigned long key)
 {
-  unsigned long val = 0ul;
+    unsigned long val = 0ul;
 
-  if (elf_aux_info((int)key, &val, sizeof(val)) != 0)
-    return 0ul;
+    if (elf_aux_info((int)key, &val, sizeof(val)) != 0)
+        return 0ul;
 
-  return val;
+    return val;
 }
-#  endif
-# endif
+#endif
+#endif
 
 /*
  * Android: according to https://developer.android.com/ndk/guides/cpu-features,
  * getauxval is supported starting with API level 18
  */
-# if defined(__ANDROID__) && defined(__ANDROID_API__) && __ANDROID_API__ >= 18
-#  include <sys/auxv.h>
-#  define OSSL_IMPLEMENT_GETAUXVAL
-# endif
+#if defined(__ANDROID__) && defined(__ANDROID_API__) && __ANDROID_API__ >= 18
+#include <sys/auxv.h>
+#define OSSL_IMPLEMENT_GETAUXVAL
+#endif
 
 /*
  * ARM puts the feature bits for Crypto Extensions in AT_HWCAP2, whereas
  * AArch64 used AT_HWCAP.
  */
-# ifndef AT_HWCAP
-#  define AT_HWCAP               16
-# endif
-# ifndef AT_HWCAP2
-#  define AT_HWCAP2              26
-# endif
-# if defined(__arm__) || defined (__arm)
-#  define OSSL_HWCAP                  AT_HWCAP
-#  define OSSL_HWCAP_NEON             (1 << 12)
+#ifndef AT_HWCAP
+#define AT_HWCAP 16
+#endif
+#ifndef AT_HWCAP2
+#define AT_HWCAP2 26
+#endif
+#if defined(__arm__) || defined(__arm)
+#define OSSL_HWCAP AT_HWCAP
+#define OSSL_HWCAP_NEON (1 << 12)
 
-#  define OSSL_HWCAP_CE               AT_HWCAP2
-#  define OSSL_HWCAP_CE_AES           (1 << 0)
-#  define OSSL_HWCAP_CE_PMULL         (1 << 1)
-#  define OSSL_HWCAP_CE_SHA1          (1 << 2)
-#  define OSSL_HWCAP_CE_SHA256        (1 << 3)
-# elif defined(__aarch64__)
-#  define OSSL_HWCAP                  AT_HWCAP
-#  define OSSL_HWCAP_NEON             (1 << 1)
+#define OSSL_HWCAP_CE AT_HWCAP2
+#define OSSL_HWCAP_CE_AES (1 << 0)
+#define OSSL_HWCAP_CE_PMULL (1 << 1)
+#define OSSL_HWCAP_CE_SHA1 (1 << 2)
+#define OSSL_HWCAP_CE_SHA256 (1 << 3)
+#elif defined(__aarch64__)
+#define OSSL_HWCAP AT_HWCAP
+#define OSSL_HWCAP_NEON (1 << 1)
 
-#  define OSSL_HWCAP_CE               AT_HWCAP
-#  define OSSL_HWCAP_CE_AES           (1 << 3)
-#  define OSSL_HWCAP_CE_PMULL         (1 << 4)
-#  define OSSL_HWCAP_CE_SHA1          (1 << 5)
-#  define OSSL_HWCAP_CE_SHA256        (1 << 6)
-#  define OSSL_HWCAP_CPUID            (1 << 11)
-#  define OSSL_HWCAP_SHA3             (1 << 17)
-#  define OSSL_HWCAP_CE_SM3           (1 << 18)
-#  define OSSL_HWCAP_CE_SM4           (1 << 19)
-#  define OSSL_HWCAP_CE_SHA512        (1 << 21)
-#  define OSSL_HWCAP_SVE              (1 << 22)
-                                      /* AT_HWCAP2 */
-#  define OSSL_HWCAP2                 26
-#  define OSSL_HWCAP2_SVE2            (1 << 1)
-#  define OSSL_HWCAP2_RNG             (1 << 16)
-# endif
+#define OSSL_HWCAP_CE AT_HWCAP
+#define OSSL_HWCAP_CE_AES (1 << 3)
+#define OSSL_HWCAP_CE_PMULL (1 << 4)
+#define OSSL_HWCAP_CE_SHA1 (1 << 5)
+#define OSSL_HWCAP_CE_SHA256 (1 << 6)
+#define OSSL_HWCAP_CPUID (1 << 11)
+#define OSSL_HWCAP_SHA3 (1 << 17)
+#define OSSL_HWCAP_CE_SM3 (1 << 18)
+#define OSSL_HWCAP_CE_SM4 (1 << 19)
+#define OSSL_HWCAP_CE_SHA512 (1 << 21)
+#define OSSL_HWCAP_SVE (1 << 22)
+/* AT_HWCAP2 */
+#define OSSL_HWCAP2 26
+#define OSSL_HWCAP2_SVE2 (1 << 1)
+#define OSSL_HWCAP2_RNG (1 << 16)
+#endif
 
 uint32_t _armv7_tick(void);
 
@@ -156,7 +155,7 @@ uint32_t OPENSSL_rdtsc(void)
         return 0;
 }
 
-# ifdef __aarch64__
+#ifdef __aarch64__
 size_t OPENSSL_rndr_asm(unsigned char *buf, size_t len);
 size_t OPENSSL_rndrrs_asm(unsigned char *buf, size_t len);
 
@@ -172,7 +171,7 @@ static size_t OPENSSL_rndr_wrapper(size_t (*func)(unsigned char *, size_t), unsi
         buffer_size = func(buf, len);
         if (buffer_size == len)
             break;
-        usleep(5000);  /* 5000 microseconds (5 milliseconds) */
+        usleep(5000); /* 5000 microseconds (5 milliseconds) */
     }
     return buffer_size;
 }
@@ -186,9 +185,9 @@ size_t OPENSSL_rndrrs_bytes(unsigned char *buf, size_t len)
 {
     return OPENSSL_rndr_wrapper(OPENSSL_rndrrs_asm, buf, len);
 }
-# endif
+#endif
 
-# if !defined(__APPLE__) && !defined(OSSL_IMPLEMENT_GETAUXVAL)
+#if !defined(__APPLE__) && !defined(OSSL_IMPLEMENT_GETAUXVAL)
 static sigset_t all_masked;
 
 static sigjmp_buf ill_jmp;
@@ -207,7 +206,7 @@ void _armv8_aes_probe(void);
 void _armv8_sha1_probe(void);
 void _armv8_sha256_probe(void);
 void _armv8_pmull_probe(void);
-#  ifdef __aarch64__
+#ifdef __aarch64__
 void _armv8_sm3_probe(void);
 void _armv8_sm4_probe(void);
 void _armv8_sha512_probe(void);
@@ -215,13 +214,13 @@ void _armv8_eor3_probe(void);
 void _armv8_sve_probe(void);
 void _armv8_sve2_probe(void);
 void _armv8_rng_probe(void);
-#  endif
-# endif /* !__APPLE__ && !OSSL_IMPLEMENT_GETAUXVAL */
+#endif
+#endif /* !__APPLE__ && !OSSL_IMPLEMENT_GETAUXVAL */
 
 /* We only call _armv8_cpuid_probe() if (OPENSSL_armcap_P & ARMV8_CPUID) != 0 */
 unsigned int _armv8_cpuid_probe(void);
 
-# if defined(__APPLE__)
+#if defined(__APPLE__)
 /*
  * Checks the specified integer sysctl, returning `value` if it's 1, otherwise returning 0.
  */
@@ -232,7 +231,7 @@ static unsigned int sysctl_query(const char *name, unsigned int value)
 
     return (sysctlbyname(name, &sys_value, &len, NULL, 0) == 0 && sys_value == 1) ? value : 0;
 }
-# elif !defined(OSSL_IMPLEMENT_GETAUXVAL)
+#elif !defined(OSSL_IMPLEMENT_GETAUXVAL)
 /*
  * Calls a provided probe function, which may SIGILL. If it doesn't, return `value`, otherwise return 0.
  */
@@ -246,15 +245,15 @@ static unsigned int arm_probe_for(void (*probe)(void), volatile unsigned int val
         return 0;
     }
 }
-# endif
+#endif
 
 void OPENSSL_cpuid_setup(void)
 {
     const char *e;
-# if !defined(__APPLE__) && !defined(OSSL_IMPLEMENT_GETAUXVAL)
+#if !defined(__APPLE__) && !defined(OSSL_IMPLEMENT_GETAUXVAL)
     struct sigaction ill_oact, ill_act;
     sigset_t oset;
-# endif
+#endif
     static int trigger = 0;
 
     if (trigger)
@@ -268,8 +267,8 @@ void OPENSSL_cpuid_setup(void)
         return;
     }
 
-# if defined(__APPLE__)
-#  if !defined(__aarch64__)
+#if defined(__APPLE__)
+#if !defined(__aarch64__)
     /*
      * Capability probing by catching SIGILL appears to be problematic
      * on iOS. But since Apple universe is "monocultural", it's actually
@@ -279,7 +278,7 @@ void OPENSSL_cpuid_setup(void)
         OPENSSL_armcap_P = ARMV7_NEON;
         return;
     }
-#  else
+#else
     {
         /*
          * From
@@ -297,19 +296,15 @@ void OPENSSL_cpuid_setup(void)
             char uarch[64];
 
             size_t len = sizeof(uarch);
-            if ((sysctlbyname("machdep.cpu.brand_string", uarch, &len, NULL, 0) == 0) &&
-               ((strncmp(uarch, "Apple M1", 8) == 0) ||
-                (strncmp(uarch, "Apple M2", 8) == 0) ||
-                (strncmp(uarch, "Apple M3", 8) == 0) ||
-                (strncmp(uarch, "Apple M4", 8) == 0))) {
+            if ((sysctlbyname("machdep.cpu.brand_string", uarch, &len, NULL, 0) == 0) && ((strncmp(uarch, "Apple M1", 8) == 0) || (strncmp(uarch, "Apple M2", 8) == 0) || (strncmp(uarch, "Apple M3", 8) == 0) || (strncmp(uarch, "Apple M4", 8) == 0))) {
                 OPENSSL_armcap_P |= ARMV8_UNROLL8_EOR3;
                 OPENSSL_armcap_P |= ARMV8_HAVE_SHA3_AND_WORTH_USING;
             }
         }
     }
-#  endif       /* __aarch64__ */
+#endif /* __aarch64__ */
 
-# elif defined(OSSL_IMPLEMENT_GETAUXVAL)
+#elif defined(OSSL_IMPLEMENT_GETAUXVAL)
 
     if (getauxval(OSSL_HWCAP) & OSSL_HWCAP_NEON) {
         unsigned long hwcap = getauxval(OSSL_HWCAP_CE);
@@ -328,7 +323,7 @@ void OPENSSL_cpuid_setup(void)
         if (hwcap & OSSL_HWCAP_CE_SHA256)
             OPENSSL_armcap_P |= ARMV8_SHA256;
 
-#  ifdef __aarch64__
+#ifdef __aarch64__
         if (hwcap & OSSL_HWCAP_CE_SM4)
             OPENSSL_armcap_P |= ARMV8_SM4;
 
@@ -342,20 +337,20 @@ void OPENSSL_cpuid_setup(void)
             OPENSSL_armcap_P |= ARMV8_SM3;
         if (hwcap & OSSL_HWCAP_SHA3)
             OPENSSL_armcap_P |= ARMV8_SHA3;
-#  endif
+#endif
     }
-#  ifdef __aarch64__
-        if (getauxval(OSSL_HWCAP) & OSSL_HWCAP_SVE)
-            OPENSSL_armcap_P |= ARMV8_SVE;
+#ifdef __aarch64__
+    if (getauxval(OSSL_HWCAP) & OSSL_HWCAP_SVE)
+        OPENSSL_armcap_P |= ARMV8_SVE;
 
-        if (getauxval(OSSL_HWCAP2) & OSSL_HWCAP2_SVE2)
-            OPENSSL_armcap_P |= ARMV8_SVE2;
+    if (getauxval(OSSL_HWCAP2) & OSSL_HWCAP2_SVE2)
+        OPENSSL_armcap_P |= ARMV8_SVE2;
 
-        if (getauxval(OSSL_HWCAP2) & OSSL_HWCAP2_RNG)
-            OPENSSL_armcap_P |= ARMV8_RNG;
-#  endif
+    if (getauxval(OSSL_HWCAP2) & OSSL_HWCAP2_RNG)
+        OPENSSL_armcap_P |= ARMV8_RNG;
+#endif
 
-# else /* !__APPLE__ && !OSSL_IMPLEMENT_GETAUXVAL */
+#else /* !__APPLE__ && !OSSL_IMPLEMENT_GETAUXVAL */
 
     /* If all else fails, do brute force SIGILL-based feature detection */
 
@@ -385,18 +380,18 @@ void OPENSSL_cpuid_setup(void)
         OPENSSL_armcap_P |= arm_probe_for(_armv8_sha1_probe, ARMV8_SHA1);
         OPENSSL_armcap_P |= arm_probe_for(_armv8_sha256_probe, ARMV8_SHA256);
 
-#  if defined(__aarch64__)
+#if defined(__aarch64__)
         OPENSSL_armcap_P |= arm_probe_for(_armv8_sm3_probe, ARMV8_SM3);
         OPENSSL_armcap_P |= arm_probe_for(_armv8_sm4_probe, ARMV8_SM4);
         OPENSSL_armcap_P |= arm_probe_for(_armv8_sha512_probe, ARMV8_SHA512);
         OPENSSL_armcap_P |= arm_probe_for(_armv8_eor3_probe, ARMV8_SHA3);
-#  endif
+#endif
     }
-#  ifdef __aarch64__
+#ifdef __aarch64__
     OPENSSL_armcap_P |= arm_probe_for(_armv8_sve_probe, ARMV8_SVE);
     OPENSSL_armcap_P |= arm_probe_for(_armv8_sve2_probe, ARMV8_SVE2);
     OPENSSL_armcap_P |= arm_probe_for(_armv8_rng_probe, ARMV8_RNG);
-#  endif
+#endif
 
     /*
      * Probing for ARMV7_TICK is known to produce unreliable results,
@@ -407,43 +402,21 @@ void OPENSSL_cpuid_setup(void)
     sigaction(SIGILL, &ill_oact, NULL);
     sigprocmask(SIG_SETMASK, &oset, NULL);
 
-# endif /* __APPLE__, OSSL_IMPLEMENT_GETAUXVAL */
+#endif /* __APPLE__, OSSL_IMPLEMENT_GETAUXVAL */
 
-# ifdef __aarch64__
+#ifdef __aarch64__
     if (OPENSSL_armcap_P & ARMV8_CPUID)
         OPENSSL_arm_midr = _armv8_cpuid_probe();
 
-    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N1)) &&
-        (OPENSSL_armcap_P & ARMV7_NEON)) {
-            OPENSSL_armv8_rsa_neonized = 1;
+    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N1)) && (OPENSSL_armcap_P & ARMV7_NEON)) {
+        OPENSSL_armv8_rsa_neonized = 1;
     }
-    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N2) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_COBALT_100) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) ||
-         MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE) &&
-        (OPENSSL_armcap_P & ARMV8_SHA3))
+    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_N2) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_COBALT_100) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE) && (OPENSSL_armcap_P & ARMV8_SHA3))
         OPENSSL_armcap_P |= ARMV8_UNROLL8_EOR3;
-    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) ||
-         MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE) &&
-        (OPENSSL_armcap_P & ARMV8_SHA3))
+    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V1) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_ARM, ARM_CPU_PART_V2) || MIDR_IMPLEMENTER(OPENSSL_arm_midr) == ARM_CPU_IMP_AMPERE) && (OPENSSL_armcap_P & ARMV8_SHA3))
         OPENSSL_armcap_P |= ARMV8_UNROLL12_EOR3;
-    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM)     ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM)      ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_PRO) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO)  ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_MAX) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_MAX)  ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE)     ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD)      ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_PRO) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_PRO)  ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_MAX) ||
-         MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_MAX)) &&
-        (OPENSSL_armcap_P & ARMV8_SHA3))
+    if ((MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_PRO) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_AVALANCHE_MAX) || MIDR_IS_CPU_MODEL(OPENSSL_arm_midr, ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M2_BLIZZARD_MAX)) && (OPENSSL_armcap_P & ARMV8_SHA3))
         OPENSSL_armcap_P |= ARMV8_HAVE_SHA3_AND_WORTH_USING;
-# endif
+#endif
 }
 #endif /* _WIN32, __ARM_MAX_ARCH__ >= 7 */
diff --git a/crypto/openssl/crypto/asn1/a_bitstr.c b/crypto/openssl/crypto/asn1/a_bitstr.c
index a87cb15b44d4..223efc2bb147 100644
--- a/crypto/openssl/crypto/asn1/a_bitstr.c
+++ b/crypto/openssl/crypto/asn1/a_bitstr.c
@@ -58,7 +58,7 @@ int ossl_i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
                 else if (j & 0x80)
                     bits = 7;
                 else
-                    bits = 0;       /* should not happen */
+                    bits = 0; /* should not happen */
             }
         }
     } else
@@ -82,7 +82,7 @@ int ossl_i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
 }
 
 ASN1_BIT_STRING *ossl_c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
-                                          const unsigned char **pp, long len)
+    const unsigned char **pp, long len)
 {
     ASN1_BIT_STRING *ret = NULL;
     const unsigned char *p;
@@ -117,7 +117,7 @@ ASN1_BIT_STRING *ossl_c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
      */
     ossl_asn1_string_set_bits_left(ret, i);
 
-    if (len-- > 1) {            /* using one because of the bits left byte */
+    if (len-- > 1) { /* using one because of the bits left byte */
         s = OPENSSL_malloc((int)len);
         if (s == NULL) {
             goto err;
@@ -134,7 +134,7 @@ ASN1_BIT_STRING *ossl_c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
         (*a) = ret;
     *pp = p;
     return ret;
- err:
+err:
     if (i != 0)
         ERR_raise(ERR_LIB_ASN1, i);
     if ((a == NULL) || (*a != ret))
@@ -166,7 +166,7 @@ int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value)
 
     if ((a->length < (w + 1)) || (a->data == NULL)) {
         if (!value)
-            return 1;         /* Don't need to set */
+            return 1; /* Don't need to set */
         c = OPENSSL_clear_realloc(a->data, a->length, w + 1);
         if (c == NULL)
             return 0;
@@ -202,7 +202,7 @@ int ASN1_BIT_STRING_get_bit(const ASN1_BIT_STRING *a, int n)
  * 'len' is the length of 'flags'.
  */
 int ASN1_BIT_STRING_check(const ASN1_BIT_STRING *a,
-                          const unsigned char *flags, int flags_len)
+    const unsigned char *flags, int flags_len)
 {
     int i, ok;
     /* Check if there is one bit set at all. */
diff --git a/crypto/openssl/crypto/asn1/a_d2i_fp.c b/crypto/openssl/crypto/asn1/a_d2i_fp.c
index 4999ac1f65ba..82d2f7cc902f 100644
--- a/crypto/openssl/crypto/asn1/a_d2i_fp.c
+++ b/crypto/openssl/crypto/asn1/a_d2i_fp.c
@@ -17,9 +17,9 @@
 #include "crypto/asn1.h"
 
 #ifndef NO_OLD_ASN1
-# ifndef OPENSSL_NO_STDIO
+#ifndef OPENSSL_NO_STDIO
 
-void *ASN1_d2i_fp(void *(*xnew) (void), d2i_of_void *d2i, FILE *in, void **x)
+void *ASN1_d2i_fp(void *(*xnew)(void), d2i_of_void *d2i, FILE *in, void **x)
 {
     BIO *b;
     void *ret;
@@ -33,9 +33,9 @@ void *ASN1_d2i_fp(void *(*xnew) (void), d2i_of_void *d2i, FILE *in, void **x)
     BIO_free(b);
     return ret;
 }
-# endif
+#endif
 
-void *ASN1_d2i_bio(void *(*xnew) (void), d2i_of_void *d2i, BIO *in, void **x)
+void *ASN1_d2i_bio(void *(*xnew)(void), d2i_of_void *d2i, BIO *in, void **x)
 {
     BUF_MEM *b = NULL;
     const unsigned char *p;
@@ -48,7 +48,7 @@ void *ASN1_d2i_bio(void *(*xnew) (void), d2i_of_void *d2i, BIO *in, void **x)
 
     p = (unsigned char *)b->data;
     ret = d2i(x, &p, len);
- err:
+err:
     BUF_MEM_free(b);
     return ret;
 }
@@ -56,7 +56,7 @@ void *ASN1_d2i_bio(void *(*xnew) (void), d2i_of_void *d2i, BIO *in, void **x)
 #endif
 
 void *ASN1_item_d2i_bio_ex(const ASN1_ITEM *it, BIO *in, void *x,
-                           OSSL_LIB_CTX *libctx, const char *propq)
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     BUF_MEM *b = NULL;
     const unsigned char *p;
@@ -71,7 +71,7 @@ void *ASN1_item_d2i_bio_ex(const ASN1_ITEM *it, BIO *in, void *x,
 
     p = (const unsigned char *)b->data;
     ret = ASN1_item_d2i_ex(x, &p, len, it, libctx, propq);
- err:
+err:
     BUF_MEM_free(b);
     return ret;
 }
@@ -83,7 +83,7 @@ void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x)
 
 #ifndef OPENSSL_NO_STDIO
 void *ASN1_item_d2i_fp_ex(const ASN1_ITEM *it, FILE *in, void *x,
-                          OSSL_LIB_CTX *libctx, const char *propq)
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     BIO *b;
     char *ret;
@@ -104,7 +104,7 @@ void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x)
 }
 #endif
 
-#define HEADER_SIZE   8
+#define HEADER_SIZE 8
 #define ASN1_CHUNK_INITIAL_SIZE (16 * 1024)
 int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 {
@@ -150,7 +150,6 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
                 len += i;
                 if ((size_t)i < want)
                     continue;
-
             }
         }
         /* else data already loaded */
@@ -168,9 +167,10 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
             if (e != ASN1_R_TOO_LONG)
                 goto err;
             ERR_pop_to_mark();
+            ERR_set_mark();
         }
-        i = q - p;            /* header length */
-        off += i;               /* end of data */
+        i = q - p; /* header length */
+        off += i; /* end of data */
 
         if (inf & 1) {
             /* no data body so go round again */
@@ -194,8 +194,7 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
                 size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;
 
                 want -= (len - off);
-                if (want > INT_MAX /* BIO_read takes an int length */  ||
-                    len + want < len) {
+                if (want > INT_MAX /* BIO_read takes an int length */ || len + want < len) {
                     ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
                     goto err;
                 }
@@ -219,14 +218,14 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
                             ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
                             goto err;
                         }
-                    /*
-                     * This can't overflow because |len+want| didn't
-                     * overflow.
-                     */
+                        /*
+                         * This can't overflow because |len+want| didn't
+                         * overflow.
+                         */
                         len += i;
                         chunk -= i;
                     }
-                    if (chunk_max < INT_MAX/2)
+                    if (chunk_max < INT_MAX / 2)
                         chunk_max *= 2;
                 }
             }
@@ -248,8 +247,9 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
     }
 
     *pb = b;
+    ERR_clear_last_mark();
     return off;
- err:
+err:
     ERR_clear_last_mark();
     BUF_MEM_free(b);
     return -1;
diff --git a/crypto/openssl/crypto/asn1/a_digest.c b/crypto/openssl/crypto/asn1/a_digest.c
index 67e8a96ba15f..c172eef3ea8e 100644
--- a/crypto/openssl/crypto/asn1/a_digest.c
+++ b/crypto/openssl/crypto/asn1/a_digest.c
@@ -26,7 +26,7 @@
 #ifndef OPENSSL_NO_DEPRECATED_3_0
 
 int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data,
-                unsigned char *md, unsigned int *len)
+    unsigned char *md, unsigned int *len)
 {
     int inl;
     unsigned char *str, *p;
@@ -52,8 +52,8 @@ int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data,
 #endif
 
 int ossl_asn1_item_digest_ex(const ASN1_ITEM *it, const EVP_MD *md, void *asn,
-                             unsigned char *data, unsigned int *len,
-                             OSSL_LIB_CTX *libctx, const char *propq)
+    unsigned char *data, unsigned int *len,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     int i, ret = 0;
     unsigned char *str = NULL;
@@ -85,8 +85,7 @@ err:
 }
 
 int ASN1_item_digest(const ASN1_ITEM *it, const EVP_MD *md, void *asn,
-                     unsigned char *data, unsigned int *len)
+    unsigned char *data, unsigned int *len)
 {
     return ossl_asn1_item_digest_ex(it, md, asn, data, len, NULL, NULL);
 }
-
diff --git a/crypto/openssl/crypto/asn1/a_dup.c b/crypto/openssl/crypto/asn1/a_dup.c
index e673023faee8..48f5b3f6a4c8 100644
--- a/crypto/openssl/crypto/asn1/a_dup.c
+++ b/crypto/openssl/crypto/asn1/a_dup.c
@@ -69,8 +69,8 @@ void *ASN1_item_dup(const ASN1_ITEM *it, const void *x)
 
     if (asn1_cb != NULL) {
         if (!asn1_cb(ASN1_OP_DUP_PRE, (ASN1_VALUE **)&x, it, NULL)
-                || !asn1_cb(ASN1_OP_GET0_LIBCTX, (ASN1_VALUE **)&x, it, &libctx)
-                || !asn1_cb(ASN1_OP_GET0_PROPQ, (ASN1_VALUE **)&x, it, &propq))
+            || !asn1_cb(ASN1_OP_GET0_LIBCTX, (ASN1_VALUE **)&x, it, &libctx)
+            || !asn1_cb(ASN1_OP_GET0_PROPQ, (ASN1_VALUE **)&x, it, &propq))
             goto auxerr;
     }
 
@@ -89,7 +89,7 @@ void *ASN1_item_dup(const ASN1_ITEM *it, const void *x)
 
     return ret;
 
- auxerr:
+auxerr:
     ERR_raise_data(ERR_LIB_ASN1, ASN1_R_AUX_ERROR, "Type=%s", it->sname);
     return NULL;
 }
diff --git a/crypto/openssl/crypto/asn1/a_gentm.c b/crypto/openssl/crypto/asn1/a_gentm.c
index 0c06ac3c4163..49e6f2470d8f 100644
--- a/crypto/openssl/crypto/asn1/a_gentm.c
+++ b/crypto/openssl/crypto/asn1/a_gentm.c
@@ -22,7 +22,7 @@ IMPLEMENT_ASN1_DUP_FUNCTION(ASN1_GENERALIZEDTIME)
 
 /* This is the primary function used to parse ASN1_GENERALIZEDTIME */
 static int asn1_generalizedtime_to_tm(struct tm *tm,
-                                      const ASN1_GENERALIZEDTIME *d)
+    const ASN1_GENERALIZEDTIME *d)
 {
     /* wrapper around ossl_asn1_time_to_tm */
     if (d->type != V_ASN1_GENERALIZEDTIME)
@@ -54,14 +54,14 @@ int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, const char *str)
 }
 
 ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
-                                               time_t t)
+    time_t t)
 {
     return ASN1_GENERALIZEDTIME_adj(s, t, 0, 0);
 }
 
 ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,
-                                               time_t t, int offset_day,
-                                               long offset_sec)
+    time_t t, int offset_day,
+    long offset_sec)
 {
     struct tm *ts;
     struct tm data;
diff --git a/crypto/openssl/crypto/asn1/a_i2d_fp.c b/crypto/openssl/crypto/asn1/a_i2d_fp.c
index 23e0b0f70003..e177e20465a4 100644
--- a/crypto/openssl/crypto/asn1/a_i2d_fp.c
+++ b/crypto/openssl/crypto/asn1/a_i2d_fp.c
@@ -14,7 +14,7 @@
 
 #ifndef NO_OLD_ASN1
 
-# ifndef OPENSSL_NO_STDIO
+#ifndef OPENSSL_NO_STDIO
 int ASN1_i2d_fp(i2d_of_void *i2d, FILE *out, const void *x)
 {
     BIO *b;
@@ -29,7 +29,7 @@ int ASN1_i2d_fp(i2d_of_void *i2d, FILE *out, const void *x)
     BIO_free(b);
     return ret;
 }
-# endif
+#endif
 
 int ASN1_i2d_bio(i2d_of_void *i2d, BIO *out, const void *x)
 {
diff --git a/crypto/openssl/crypto/asn1/a_int.c b/crypto/openssl/crypto/asn1/a_int.c
index 854844e7eaf1..3205802c09db 100644
--- a/crypto/openssl/crypto/asn1/a_int.c
+++ b/crypto/openssl/crypto/asn1/a_int.c
@@ -74,7 +74,7 @@ int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y)
  * used elsewhere below...
  */
 static void twos_complement(unsigned char *dst, const unsigned char *src,
-                            size_t len, unsigned char pad)
+    size_t len, unsigned char pad)
 {
     unsigned int carry = pad & 1;
 
@@ -95,7 +95,7 @@ static void twos_complement(unsigned char *dst, const unsigned char *src,
 }
 
 static size_t i2c_ibuf(const unsigned char *b, size_t blen, int neg,
-                       unsigned char **pp)
+    unsigned char **pp)
 {
     unsigned int pad = 0;
     size_t ret, i;
@@ -125,7 +125,7 @@ static size_t i2c_ibuf(const unsigned char *b, size_t blen, int neg,
         ret += pad;
     } else {
         ret = 1;
-        blen = 0;   /* reduce '(b == NULL || blen == 0)' to '(blen == 0)' */
+        blen = 0; /* reduce '(b == NULL || blen == 0)' to '(blen == 0)' */
     }
 
     if (pp == NULL || (p = *pp) == NULL)
@@ -137,8 +137,8 @@ static size_t i2c_ibuf(const unsigned char *b, size_t blen, int neg,
      * by any number of zeros...
      */
     *p = pb;
-    p += pad;       /* yes, p[0] can be written twice, but it's little
-                     * price to pay for eliminated branches */
+    p += pad; /* yes, p[0] can be written twice, but it's little
+               * price to pay for eliminated branches */
     twos_complement(p, b, blen, pb);
 
     *pp += ret;
@@ -152,7 +152,7 @@ static size_t i2c_ibuf(const unsigned char *b, size_t blen, int neg,
  */
 
 static size_t c2i_ibuf(unsigned char *b, int *pneg,
-                       const unsigned char *p, size_t plen)
+    const unsigned char *p, size_t plen)
 {
     int neg, pad;
     /* Zero content length is illegal */
@@ -253,7 +253,7 @@ static size_t asn1_put_uint64(unsigned char b[sizeof(uint64_t)], uint64_t r)
 
 /* signed version of asn1_get_uint64 */
 static int asn1_get_int64(int64_t *pr, const unsigned char *b, size_t blen,
-                          int neg)
+    int neg)
 {
     uint64_t r;
     if (asn1_get_uint64(&r, b, blen) == 0)
@@ -288,7 +288,7 @@ static int asn1_get_int64(int64_t *pr, const unsigned char *b, size_t blen,
 
 /* Convert ASN1 INTEGER content octets to ASN1_INTEGER structure */
 ASN1_INTEGER *ossl_c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp,
-                                    long len)
+    long len)
 {
     ASN1_INTEGER *ret = NULL;
     size_t r;
@@ -323,7 +323,7 @@ ASN1_INTEGER *ossl_c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp,
     if (a != NULL)
         (*a) = ret;
     return ret;
- err:
+err:
     if (a == NULL || *a != ret)
         ASN1_INTEGER_free(ret);
     return NULL;
@@ -366,7 +366,7 @@ static int asn1_string_set_int64(ASN1_STRING *a, int64_t r, int itype)
 }
 
 static int asn1_string_get_uint64(uint64_t *pr, const ASN1_STRING *a,
-                                  int itype)
+    int itype)
 {
     if (a == NULL) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_NULL_PARAMETER);
@@ -400,7 +400,7 @@ static int asn1_string_set_uint64(ASN1_STRING *a, uint64_t r, int itype)
  */
 
 ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp,
-                                long length)
+    long length)
 {
     ASN1_INTEGER *ret = NULL;
     const unsigned char *p;
@@ -454,7 +454,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp,
         (*a) = ret;
     *pp = p;
     return ret;
- err:
+err:
     if (i != 0)
         ERR_raise(ERR_LIB_ASN1, i);
     if ((a == NULL) || (*a != ret))
@@ -463,7 +463,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp,
 }
 
 static ASN1_STRING *bn_to_asn1_string(const BIGNUM *bn, ASN1_STRING *ai,
-                                      int atype)
+    int atype)
 {
     ASN1_INTEGER *ret;
     int len;
@@ -500,14 +500,14 @@ static ASN1_STRING *bn_to_asn1_string(const BIGNUM *bn, ASN1_STRING *ai,
         len = BN_bn2bin(bn, ret->data);
     ret->length = len;
     return ret;
- err:
+err:
     if (ret != ai)
         ASN1_INTEGER_free(ret);
     return NULL;
 }
 
 static BIGNUM *asn1_string_to_bn(const ASN1_INTEGER *ai, BIGNUM *bn,
-                                 int itype)
+    int itype)
 {
     BIGNUM *ret;
 
@@ -620,7 +620,7 @@ BIGNUM *ASN1_ENUMERATED_to_BN(const ASN1_ENUMERATED *ai, BIGNUM *bn)
 
 /* Internal functions used by x_int64.c */
 int ossl_c2i_uint64_int(uint64_t *ret, int *neg,
-                        const unsigned char **pp, long len)
+    const unsigned char **pp, long len)
 {
     unsigned char buf[sizeof(uint64_t)];
     size_t buflen;
@@ -644,4 +644,3 @@ int ossl_i2c_uint64_int(unsigned char *p, uint64_t r, int neg)
     off = asn1_put_uint64(buf, r);
     return i2c_ibuf(buf + off, sizeof(buf) - off, neg, &p);
 }
-
diff --git a/crypto/openssl/crypto/asn1/a_mbstr.c b/crypto/openssl/crypto/asn1/a_mbstr.c
index c8170e16267d..2270e63d51d4 100644
--- a/crypto/openssl/crypto/asn1/a_mbstr.c
+++ b/crypto/openssl/crypto/asn1/a_mbstr.c
@@ -14,8 +14,8 @@
 #include <openssl/asn1.h>
 
 static int traverse_string(const unsigned char *p, int len, int inform,
-                           int (*rfunc) (unsigned long value, void *in),
-                           void *arg);
+    int (*rfunc)(unsigned long value, void *in),
+    void *arg);
 static int in_utf8(unsigned long value, void *arg);
 static int out_utf8(unsigned long value, void *arg);
 static int type_str(unsigned long value, void *arg);
@@ -34,14 +34,14 @@ static int cpy_utf8(unsigned long value, void *arg);
  */
 
 int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
-                       int inform, unsigned long mask)
+    int inform, unsigned long mask)
 {
     return ASN1_mbstring_ncopy(out, in, len, inform, mask, 0, 0);
 }
 
 int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
-                        int inform, unsigned long mask,
-                        long minsize, long maxsize)
+    int inform, unsigned long mask,
+    long minsize, long maxsize)
 {
     int str_type;
     int ret;
@@ -50,7 +50,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
     ASN1_STRING *dest;
     unsigned char *p;
     int nchar;
-    int (*cpyfunc) (unsigned long, void *) = NULL;
+    int (*cpyfunc)(unsigned long, void *) = NULL;
     if (len == -1)
         len = strlen((const char *)in);
     if (!mask)
@@ -98,13 +98,13 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
     if ((minsize > 0) && (nchar < minsize)) {
         ERR_raise_data(ERR_LIB_ASN1, ASN1_R_STRING_TOO_SHORT,
-                       "minsize=%ld", minsize);
+            "minsize=%ld", minsize);
         return -1;
     }
 
     if ((maxsize > 0) && (nchar > maxsize)) {
         ERR_raise_data(ERR_LIB_ASN1, ASN1_R_STRING_TOO_LONG,
-                       "maxsize=%ld", maxsize);
+            "maxsize=%ld", maxsize);
         return -1;
     }
 
@@ -114,7 +114,10 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
         return -1;
     }
 
-    /* Now work out output format and string type */
+    /*
+     * Now work out output format and string type.
+     * These checks should be in sync with the checks in type_str.
+     */
     outform = MBSTRING_ASC;
     if (mask & B_ASN1_NUMERICSTRING)
         str_type = V_ASN1_NUMERICSTRING;
@@ -182,7 +185,11 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
     case MBSTRING_UTF8:
         outlen = 0;
-        traverse_string(in, len, inform, out_utf8, &outlen);
+        ret = traverse_string(in, len, inform, out_utf8, &outlen);
+        if (ret < 0) {
+            ERR_raise(ERR_LIB_ASN1, ASN1_R_INVALID_UTF8STRING);
+            return -1;
+        }
         cpyfunc = cpy_utf8;
         break;
     }
@@ -206,8 +213,8 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
  */
 
 static int traverse_string(const unsigned char *p, int len, int inform,
-                           int (*rfunc) (unsigned long value, void *in),
-                           void *arg)
+    int (*rfunc)(unsigned long value, void *in),
+    void *arg)
 {
     unsigned long value;
     int ret;
@@ -277,11 +284,30 @@ static int out_utf8(unsigned long value, void *arg)
 
 static int type_str(unsigned long value, void *arg)
 {
-    unsigned long types = *((unsigned long *)arg);
+    unsigned long usable_types = *((unsigned long *)arg);
+    unsigned long types = usable_types;
     const int native = value > INT_MAX ? INT_MAX : ossl_fromascii(value);
 
-    if ((types & B_ASN1_NUMERICSTRING) && !(ossl_isdigit(native)
-                                            || native == ' '))
+    /*
+     * Clear out all the types which are not checked later. If any of those
+     * is present in the mask, then the UTF8 type will be added and checked
+     * below.
+     */
+    types &= B_ASN1_NUMERICSTRING | B_ASN1_PRINTABLESTRING
+        | B_ASN1_IA5STRING | B_ASN1_T61STRING | B_ASN1_BMPSTRING
+        | B_ASN1_UNIVERSALSTRING | B_ASN1_UTF8STRING;
+
+    /*
+     * If any other types were in the input mask, they're effectively treated
+     * as UTF8
+     */
+    if (types != usable_types)
+        types |= B_ASN1_UTF8STRING;
+
+    /*
+     * These checks should be in sync with ASN1_mbstring_ncopy.
+     */
+    if ((types & B_ASN1_NUMERICSTRING) && !(ossl_isdigit(native) || native == ' '))
         types &= ~B_ASN1_NUMERICSTRING;
     if ((types & B_ASN1_PRINTABLESTRING) && !ossl_isasn1print(native))
         types &= ~B_ASN1_PRINTABLESTRING;
@@ -348,6 +374,8 @@ static int cpy_utf8(unsigned long value, void *arg)
     p = arg;
     /* We already know there is enough room so pass 0xff as the length */
     ret = UTF8_putc(*p, 0xff, value);
+    if (ret < 0)
+        return ret;
     *p += ret;
     return 1;
 }
diff --git a/crypto/openssl/crypto/asn1/a_object.c b/crypto/openssl/crypto/asn1/a_object.c
index 6eb9feb16c4b..1c7aa31e83fa 100644
--- a/crypto/openssl/crypto/asn1/a_object.c
+++ b/crypto/openssl/crypto/asn1/a_object.c
@@ -121,7 +121,7 @@ int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
                 if (!BN_add_word(bl, first * 40))
                     goto err;
             } else
-                l += (long)first *40;
+                l += (long)first * 40;
         }
         i = 0;
         if (use_bn) {
@@ -150,7 +150,6 @@ int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
                 if (l == 0L)
                     break;
             }
-
         }
         if (out != NULL) {
             if (len + i > olen) {
@@ -167,7 +166,7 @@ int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
         OPENSSL_free(tmp);
     BN_free(bl);
     return len;
- err:
+err:
     if (tmp != ftmp)
         OPENSSL_free(tmp);
     BN_free(bl);
@@ -188,7 +187,7 @@ int i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *a)
         return BIO_write(bp, "NULL", 4);
     i = i2t_ASN1_OBJECT(buf, sizeof(buf), a);
     if (i > (int)(sizeof(buf) - 1)) {
-        if (i > INT_MAX - 1) {  /* catch an integer overflow */
+        if (i > INT_MAX - 1) { /* catch an integer overflow */
             ERR_raise(ERR_LIB_ASN1, ASN1_R_LENGTH_TOO_LONG);
             return -1;
         }
@@ -209,7 +208,7 @@ int i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *a)
 }
 
 ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
-                             long length)
+    long length)
 {
     const unsigned char *p;
     long len;
@@ -231,13 +230,13 @@ ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
     if (ret)
         *pp = p;
     return ret;
- err:
+err:
     ERR_raise(ERR_LIB_ASN1, i);
     return NULL;
 }
 
 ASN1_OBJECT *ossl_c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
-                                  long len)
+    long len)
 {
     ASN1_OBJECT *ret = NULL, tobj;
     const unsigned char *p;
@@ -249,8 +248,7 @@ ASN1_OBJECT *ossl_c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
      * be clear in the last octet. can't have leading 0x80 in subidentifiers,
      * see: X.690 8.19.2
      */
-    if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
-        p[len - 1] & 0x80) {
+    if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL || p[len - 1] & 0x80) {
         ERR_raise(ERR_LIB_ASN1, ASN1_R_INVALID_OBJECT_ENCODING);
         return NULL;
     }
@@ -286,8 +284,7 @@ ASN1_OBJECT *ossl_c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
         }
     }
 
-    if ((a == NULL) || ((*a) == NULL) ||
-        !((*a)->flags & ASN1_OBJECT_FLAG_DYNAMIC)) {
+    if ((a == NULL) || ((*a) == NULL) || !((*a)->flags & ASN1_OBJECT_FLAG_DYNAMIC)) {
         if ((ret = ASN1_OBJECT_new()) == NULL)
             return NULL;
     } else {
@@ -326,7 +323,7 @@ ASN1_OBJECT *ossl_c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
         (*a) = ret;
     *pp = p;
     return ret;
- err:
+err:
     ERR_raise(ERR_LIB_ASN1, i);
     if ((a == NULL) || (*a != ret))
         ASN1_OBJECT_free(ret);
@@ -354,13 +351,13 @@ void ASN1_OBJECT_free(ASN1_OBJECT *a)
          * Disable purely for compile-time strict const checking.  Doing this
          * on a "real" compile will cause memory leaks
          */
-        OPENSSL_free((void*)a->sn);
-        OPENSSL_free((void*)a->ln);
+        OPENSSL_free((void *)a->sn);
+        OPENSSL_free((void *)a->ln);
 #endif
         a->sn = a->ln = NULL;
     }
     if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA) {
-        OPENSSL_free((void*)a->data);
+        OPENSSL_free((void *)a->data);
         a->data = NULL;
         a->length = 0;
     }
@@ -369,7 +366,7 @@ void ASN1_OBJECT_free(ASN1_OBJECT *a)
 }
 
 ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data, int len,
-                                const char *sn, const char *ln)
+    const char *sn, const char *ln)
 {
     ASN1_OBJECT o;
 
@@ -378,7 +375,6 @@ ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data, int len,
     o.data = data;
     o.nid = nid;
     o.length = len;
-    o.flags = ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS |
-        ASN1_OBJECT_FLAG_DYNAMIC_DATA;
+    o.flags = ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS | ASN1_OBJECT_FLAG_DYNAMIC_DATA;
     return OBJ_dup(&o);
 }
diff --git a/crypto/openssl/crypto/asn1/a_octet.c b/crypto/openssl/crypto/asn1/a_octet.c
index fcb2ef0a7d08..4efb8ec5178c 100644
--- a/crypto/openssl/crypto/asn1/a_octet.c
+++ b/crypto/openssl/crypto/asn1/a_octet.c
@@ -17,13 +17,13 @@ ASN1_OCTET_STRING *ASN1_OCTET_STRING_dup(const ASN1_OCTET_STRING *x)
 }
 
 int ASN1_OCTET_STRING_cmp(const ASN1_OCTET_STRING *a,
-                          const ASN1_OCTET_STRING *b)
+    const ASN1_OCTET_STRING *b)
 {
     return ASN1_STRING_cmp(a, b);
 }
 
 int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d,
-                          int len)
+    int len)
 {
     return ASN1_STRING_set(x, d, len);
 }
diff --git a/crypto/openssl/crypto/asn1/a_print.c b/crypto/openssl/crypto/asn1/a_print.c
index d2768f74bdcd..c570e52fbde3 100644
--- a/crypto/openssl/crypto/asn1/a_print.c
+++ b/crypto/openssl/crypto/asn1/a_print.c
@@ -77,8 +77,7 @@ int ASN1_STRING_print(BIO *bp, const ASN1_STRING *v)
     n = 0;
     p = (const char *)v->data;
     for (i = 0; i < v->length; i++) {
-        if ((p[i] > '~') || ((p[i] < ' ') &&
-                             (p[i] != '\n') && (p[i] != '\r')))
+        if ((p[i] > '~') || ((p[i] < ' ') && (p[i] != '\n') && (p[i] != '\r')))
             buf[n] = '.';
         else
             buf[n] = p[i];
diff --git a/crypto/openssl/crypto/asn1/a_sign.c b/crypto/openssl/crypto/asn1/a_sign.c
index 8507fc366811..a85f70d3b711 100644
--- a/crypto/openssl/crypto/asn1/a_sign.c
+++ b/crypto/openssl/crypto/asn1/a_sign.c
@@ -25,8 +25,8 @@
 #ifndef OPENSSL_NO_DEPRECATED_3_0
 
 int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
-              ASN1_BIT_STRING *signature, char *data, EVP_PKEY *pkey,
-              const EVP_MD *type)
+    ASN1_BIT_STRING *signature, char *data, EVP_PKEY *pkey,
+    const EVP_MD *type)
 {
     EVP_MD_CTX *ctx = EVP_MD_CTX_new();
     unsigned char *p, *buf_in = NULL, *buf_out = NULL;
@@ -52,8 +52,7 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
              */
             ASN1_TYPE_free(a->parameter);
             a->parameter = NULL;
-        } else if ((a->parameter == NULL) ||
-                   (a->parameter->type != V_ASN1_NULL)) {
+        } else if ((a->parameter == NULL) || (a->parameter->type != V_ASN1_NULL)) {
             ASN1_TYPE_free(a->parameter);
             if ((a->parameter = ASN1_TYPE_new()) == NULL)
                 goto err;
@@ -67,7 +66,7 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
         }
         if (a->algorithm->length == 0) {
             ERR_raise(ERR_LIB_ASN1,
-                      ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
+                ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
             goto err;
         }
     }
@@ -90,7 +89,7 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
     if (!EVP_SignInit_ex(ctx, type, NULL)
         || !EVP_SignUpdate(ctx, (unsigned char *)buf_in, inl)
         || !EVP_SignFinal(ctx, (unsigned char *)buf_out,
-                          (unsigned int *)&outl, pkey)) {
+            (unsigned int *)&outl, pkey)) {
         outl = 0;
         ERR_raise(ERR_LIB_ASN1, ERR_R_EVP_LIB);
         goto err;
@@ -102,7 +101,7 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
      * has a 'not-used bits' value of 0
      */
     ossl_asn1_string_set_bits_left(signature, 0);
- err:
+err:
     EVP_MD_CTX_free(ctx);
     OPENSSL_clear_free((char *)buf_in, inll);
     OPENSSL_clear_free((char *)buf_out, outll);
@@ -112,18 +111,18 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
 #endif
 
 int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
-                   ASN1_BIT_STRING *signature, const void *data,
-                   EVP_PKEY *pkey, const EVP_MD *md)
+    ASN1_BIT_STRING *signature, const void *data,
+    EVP_PKEY *pkey, const EVP_MD *md)
 {
     return ASN1_item_sign_ex(it, algor1, algor2, signature, data, NULL, pkey,
-                             md, NULL, NULL);
+        md, NULL, NULL);
 }
 
 int ASN1_item_sign_ex(const ASN1_ITEM *it, X509_ALGOR *algor1,
-                      X509_ALGOR *algor2, ASN1_BIT_STRING *signature,
-                      const void *data, const ASN1_OCTET_STRING *id,
-                      EVP_PKEY *pkey, const EVP_MD *md, OSSL_LIB_CTX *libctx,
-                      const char *propq)
+    X509_ALGOR *algor2, ASN1_BIT_STRING *signature,
+    const void *data, const ASN1_OCTET_STRING *id,
+    EVP_PKEY *pkey, const EVP_MD *md, OSSL_LIB_CTX *libctx,
+    const char *propq)
 {
     int rv = 0;
     EVP_MD_CTX *ctx = evp_md_ctx_new_ex(pkey, id, libctx, propq);
@@ -138,15 +137,15 @@ int ASN1_item_sign_ex(const ASN1_ITEM *it, X509_ALGOR *algor1,
 
     rv = ASN1_item_sign_ctx(it, algor1, algor2, signature, data, ctx);
 
- err:
+err:
     EVP_PKEY_CTX_free(EVP_MD_CTX_get_pkey_ctx(ctx));
     EVP_MD_CTX_free(ctx);
     return rv;
 }
 
 int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
-                       X509_ALGOR *algor2, ASN1_BIT_STRING *signature,
-                       const void *data, EVP_MD_CTX *ctx)
+    X509_ALGOR *algor2, ASN1_BIT_STRING *signature,
+    const void *data, EVP_MD_CTX *ctx)
 {
     const EVP_MD *md;
     EVP_PKEY *pkey;
@@ -175,9 +174,8 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
             goto err;
         }
 
-        params[0] =
-            OSSL_PARAM_construct_octet_string(OSSL_SIGNATURE_PARAM_ALGORITHM_ID,
-                                              aid, sizeof(aid));
+        params[0] = OSSL_PARAM_construct_octet_string(OSSL_SIGNATURE_PARAM_ALGORITHM_ID,
+            aid, sizeof(aid));
         params[1] = OSSL_PARAM_construct_end();
 
         if (EVP_PKEY_CTX_get_params(pctx, params) <= 0)
@@ -236,15 +234,14 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
 #ifndef OPENSSL_NO_SM2
             EVP_PKEY_get_id(pkey) == NID_sm2 ? NID_sm2 :
 #endif
-            pkey->ameth->pkey_id;
+                                             pkey->ameth->pkey_id;
 
         if (!OBJ_find_sigid_by_algs(&signid, EVP_MD_nid(md), pkey_id)) {
             ERR_raise(ERR_LIB_ASN1, ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED);
             goto err;
         }
 
-        paramtype = pkey->ameth->pkey_flags & ASN1_PKEY_SIGPARAM_NULL ?
-            V_ASN1_NULL : V_ASN1_UNDEF;
+        paramtype = pkey->ameth->pkey_flags & ASN1_PKEY_SIGPARAM_NULL ? V_ASN1_NULL : V_ASN1_UNDEF;
         if (algor1 != NULL
             && !X509_ALGOR_set0(algor1, OBJ_nid2obj(signid), paramtype, NULL))
             goto err;
@@ -284,7 +281,7 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
      * has a 'not-used bits' value of 0
      */
     ossl_asn1_string_set_bits_left(signature, 0);
- err:
+err:
     OPENSSL_clear_free((char *)buf_in, inl);
     OPENSSL_clear_free((char *)buf_out, outll);
     return outl;
diff --git a/crypto/openssl/crypto/asn1/a_strex.c b/crypto/openssl/crypto/asn1/a_strex.c
index cfe2644f572c..a908ac898c84 100644
--- a/crypto/openssl/crypto/asn1/a_strex.c
+++ b/crypto/openssl/crypto/asn1/a_strex.c
@@ -24,13 +24,9 @@
  * other options.
  */
 
-#define CHARTYPE_BS_ESC         (ASN1_STRFLGS_ESC_2253 | CHARTYPE_FIRST_ESC_2253 | CHARTYPE_LAST_ESC_2253)
+#define CHARTYPE_BS_ESC (ASN1_STRFLGS_ESC_2253 | CHARTYPE_FIRST_ESC_2253 | CHARTYPE_LAST_ESC_2253)
 
-#define ESC_FLAGS (ASN1_STRFLGS_ESC_2253 | \
-                  ASN1_STRFLGS_ESC_2254 | \
-                  ASN1_STRFLGS_ESC_QUOTE | \
-                  ASN1_STRFLGS_ESC_CTRL | \
-                  ASN1_STRFLGS_ESC_MSB)
+#define ESC_FLAGS (ASN1_STRFLGS_ESC_2253 | ASN1_STRFLGS_ESC_2254 | ASN1_STRFLGS_ESC_QUOTE | ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB)
 
 /*
  * Three IO functions for sending data to memory, a BIO and a FILE
@@ -56,7 +52,7 @@ static int send_fp_chars(void *arg, const void *buf, int len)
 }
 #endif
 
-typedef int char_io (void *arg, const void *buf, int len);
+typedef int char_io(void *arg, const void *buf, int len);
 
 /*
  * This function handles display of strings, one character at a time. It is
@@ -65,7 +61,7 @@ typedef int char_io (void *arg, const void *buf, int len);
  */
 
 static int do_esc_char(unsigned long c, unsigned short flags, char *do_quotes,
-                       char_io *io_ch, void *arg)
+    char_io *io_ch, void *arg)
 {
     unsigned short chflgs;
     unsigned char chtmp;
@@ -105,9 +101,7 @@ static int do_esc_char(unsigned long c, unsigned short flags, char *do_quotes,
             return -1;
         return 2;
     }
-    if (chflgs & (ASN1_STRFLGS_ESC_CTRL
-                  | ASN1_STRFLGS_ESC_MSB
-                  | ASN1_STRFLGS_ESC_2254)) {
+    if (chflgs & (ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | ASN1_STRFLGS_ESC_2254)) {
         BIO_snprintf(tmphex, 11, "\\%02X", chtmp);
         if (!io_ch(arg, tmphex, 3))
             return -1;
@@ -127,8 +121,8 @@ static int do_esc_char(unsigned long c, unsigned short flags, char *do_quotes,
     return 1;
 }
 
-#define BUF_TYPE_WIDTH_MASK     0x7
-#define BUF_TYPE_CONVUTF8       0x8
+#define BUF_TYPE_WIDTH_MASK 0x7
+#define BUF_TYPE_CONVUTF8 0x8
 
 /*
  * This function sends each character in a buffer to do_esc_char(). It
@@ -137,8 +131,8 @@ static int do_esc_char(unsigned long c, unsigned short flags, char *do_quotes,
  */
 
 static int do_buf(unsigned char *buf, int buflen,
-                  int type, unsigned short flags, char *quotes, char_io *io_ch,
-                  void *arg)
+    int type, unsigned short flags, char *quotes, char_io *io_ch,
+    void *arg)
 {
     int i, outlen, len, charwidth;
     unsigned short orflags;
@@ -193,12 +187,12 @@ static int do_buf(unsigned char *buf, int buflen,
         case 0:
             i = UTF8_getc(p, buflen, &c);
             if (i < 0)
-                return -1;      /* Invalid UTF8String */
+                return -1; /* Invalid UTF8String */
             buflen -= i;
             p += i;
             break;
         default:
-            return -1;          /* invalid width */
+            return -1; /* invalid width */
         }
         if (p == q && flags & ASN1_STRFLGS_ESC_2253)
             orflags = CHARTYPE_LAST_ESC_2253;
@@ -216,14 +210,14 @@ static int do_buf(unsigned char *buf, int buflen,
                  * character will never be escaped on first and last.
                  */
                 len = do_esc_char(utfbuf[i], flags | orflags, quotes,
-                                  io_ch, arg);
+                    io_ch, arg);
                 if (len < 0)
                     return -1;
                 outlen += len;
             }
         } else {
             len = do_esc_char(c, flags | orflags, quotes,
-                              io_ch, arg);
+                io_ch, arg);
             if (len < 0)
                 return -1;
             outlen += len;
@@ -235,7 +229,7 @@ static int do_buf(unsigned char *buf, int buflen,
 /* This function hex dumps a buffer of characters */
 
 static int do_hex_dump(char_io *io_ch, void *arg, unsigned char *buf,
-                       int buflen)
+    int buflen)
 {
     unsigned char *p, *q;
     char hextmp[2];
@@ -260,7 +254,7 @@ static int do_hex_dump(char_io *io_ch, void *arg, unsigned char *buf,
  */
 
 static int do_dump(unsigned long lflags, char_io *io_ch, void *arg,
-                   const ASN1_STRING *str)
+    const ASN1_STRING *str)
 {
     /*
      * Placing the ASN1_STRING in a temp ASN1_TYPE allows the DER encoding to
@@ -302,24 +296,24 @@ static int do_dump(unsigned long lflags, char_io *io_ch, void *arg,
  */
 
 static const signed char tag2nbyte[] = {
-    -1, -1, -1, -1, -1,         /* 0-4 */
-    -1, -1, -1, -1, -1,         /* 5-9 */
-    -1, -1,                     /* 10-11 */
-     0,                         /* 12 V_ASN1_UTF8STRING */
-    -1, -1, -1, -1, -1,         /* 13-17 */
-     1,                         /* 18 V_ASN1_NUMERICSTRING */
-     1,                         /* 19 V_ASN1_PRINTABLESTRING */
-     1,                         /* 20 V_ASN1_T61STRING */
-    -1,                         /* 21 */
-     1,                         /* 22 V_ASN1_IA5STRING */
-     1,                         /* 23 V_ASN1_UTCTIME */
-     1,                         /* 24 V_ASN1_GENERALIZEDTIME */
-    -1,                         /* 25 */
-     1,                         /* 26 V_ASN1_ISO64STRING */
-    -1,                         /* 27 */
-     4,                         /* 28 V_ASN1_UNIVERSALSTRING */
-    -1,                         /* 29 */
-     2                          /* 30 V_ASN1_BMPSTRING */
+    -1, -1, -1, -1, -1, /* 0-4 */
+    -1, -1, -1, -1, -1, /* 5-9 */
+    -1, -1, /* 10-11 */
+    0, /* 12 V_ASN1_UTF8STRING */
+    -1, -1, -1, -1, -1, /* 13-17 */
+    1, /* 18 V_ASN1_NUMERICSTRING */
+    1, /* 19 V_ASN1_PRINTABLESTRING */
+    1, /* 20 V_ASN1_T61STRING */
+    -1, /* 21 */
+    1, /* 22 V_ASN1_IA5STRING */
+    1, /* 23 V_ASN1_UTCTIME */
+    1, /* 24 V_ASN1_GENERALIZEDTIME */
+    -1, /* 25 */
+    1, /* 26 V_ASN1_ISO64STRING */
+    -1, /* 27 */
+    4, /* 28 V_ASN1_UNIVERSALSTRING */
+    -1, /* 29 */
+    2 /* 30 V_ASN1_BMPSTRING */
 };
 
 /*
@@ -329,7 +323,7 @@ static const signed char tag2nbyte[] = {
  */
 
 static int do_print_ex(char_io *io_ch, void *arg, unsigned long lflags,
-                       const ASN1_STRING *str)
+    const ASN1_STRING *str)
 {
     int outlen, len;
     int type;
@@ -420,11 +414,11 @@ static int do_indent(char_io *io_ch, void *arg, int indent)
     return 1;
 }
 
-#define FN_WIDTH_LN     25
-#define FN_WIDTH_SN     10
+#define FN_WIDTH_LN 25
+#define FN_WIDTH_SN 10
 
 static int do_name_ex(char_io *io_ch, void *arg, const X509_NAME *n,
-                      int indent, unsigned long flags)
+    int indent, unsigned long flags)
 {
     int i, prev = -1, orflags, cnt;
     int fn_opt, fn_nid;
@@ -515,7 +509,7 @@ static int do_name_ex(char_io *io_ch, void *arg, const X509_NAME *n,
             int objlen, fld_len;
             if ((fn_opt == XN_FLAG_FN_OID) || (fn_nid == NID_undef)) {
                 OBJ_obj2txt(objtmp, sizeof(objtmp), fn, 1);
-                fld_len = 0;    /* XXX: what should this be? */
+                fld_len = 0; /* XXX: what should this be? */
                 objbuf = objtmp;
             } else {
                 if (fn_opt == XN_FLAG_FN_SN) {
@@ -562,7 +556,7 @@ static int do_name_ex(char_io *io_ch, void *arg, const X509_NAME *n,
 /* Wrappers round the main functions */
 
 int X509_NAME_print_ex(BIO *out, const X509_NAME *nm, int indent,
-                       unsigned long flags)
+    unsigned long flags)
 {
     if (flags == XN_FLAG_COMPAT)
         return X509_NAME_print(out, nm, indent);
@@ -571,7 +565,7 @@ int X509_NAME_print_ex(BIO *out, const X509_NAME *nm, int indent,
 
 #ifndef OPENSSL_NO_STDIO
 int X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm, int indent,
-                          unsigned long flags)
+    unsigned long flags)
 {
     if (flags == XN_FLAG_COMPAT) {
         BIO *btmp;
@@ -620,9 +614,8 @@ int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in)
     stmp.data = NULL;
     stmp.length = 0;
     stmp.flags = 0;
-    ret =
-        ASN1_mbstring_copy(&str, in->data, in->length, mbflag,
-                           B_ASN1_UTF8STRING);
+    ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag,
+        B_ASN1_UTF8STRING);
     if (ret < 0)
         return ret;
     *out = stmp.data;
diff --git a/crypto/openssl/crypto/asn1/a_strnid.c b/crypto/openssl/crypto/asn1/a_strnid.c
index 8f85971130e7..e6b8d4c79ef3 100644
--- a/crypto/openssl/crypto/asn1/a_strnid.c
+++ b/crypto/openssl/crypto/asn1/a_strnid.c
@@ -15,7 +15,7 @@
 static STACK_OF(ASN1_STRING_TABLE) *stable = NULL;
 static void st_free(ASN1_STRING_TABLE *tbl);
 static int sk_table_cmp(const ASN1_STRING_TABLE *const *a,
-                        const ASN1_STRING_TABLE *const *b);
+    const ASN1_STRING_TABLE *const *b);
 
 /*
  * This is the global mask for the mbstring functions: this is use to mask
@@ -77,8 +77,8 @@ int ASN1_STRING_set_default_mask_asc(const char *p)
  */
 
 ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out,
-                                    const unsigned char *in, int inlen,
-                                    int inform, int nid)
+    const unsigned char *in, int inlen,
+    int inform, int nid)
 {
     ASN1_STRING_TABLE *tbl;
     ASN1_STRING *str = NULL;
@@ -93,10 +93,10 @@ ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out,
         if (!(tbl->flags & STABLE_NO_MASK))
             mask &= global_mask;
         ret = ASN1_mbstring_ncopy(out, in, inlen, inform, mask,
-                                  tbl->minsize, tbl->maxsize);
+            tbl->minsize, tbl->maxsize);
     } else {
         ret = ASN1_mbstring_copy(out, in, inlen, inform,
-                                 DIRSTRING_TYPE & global_mask);
+            DIRSTRING_TYPE & global_mask);
     }
     if (ret <= 0)
         return NULL;
@@ -110,7 +110,7 @@ ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out,
 #include "tbl_standard.h"
 
 static int sk_table_cmp(const ASN1_STRING_TABLE *const *a,
-                        const ASN1_STRING_TABLE *const *b)
+    const ASN1_STRING_TABLE *const *b)
 {
     return (*a)->nid - (*b)->nid;
 }
@@ -185,8 +185,8 @@ static ASN1_STRING_TABLE *stable_get(int nid)
 }
 
 int ASN1_STRING_TABLE_add(int nid,
-                          long minsize, long maxsize, unsigned long mask,
-                          unsigned long flags)
+    long minsize, long maxsize, unsigned long mask,
+    unsigned long flags)
 {
     ASN1_STRING_TABLE *tmp;
 
diff --git a/crypto/openssl/crypto/asn1/a_time.c b/crypto/openssl/crypto/asn1/a_time.c
index 194504415dd1..2472b81ebb18 100644
--- a/crypto/openssl/crypto/asn1/a_time.c
+++ b/crypto/openssl/crypto/asn1/a_time.c
@@ -258,13 +258,13 @@ int ossl_asn1_time_to_tm(struct tm *tm, const ASN1_TIME *d)
             *tm = tmp;
         return 1;
     }
- err:
+err:
     return 0;
 }
 
 ASN1_TIME *ossl_asn1_time_from_tm(ASN1_TIME *s, struct tm *ts, int type)
 {
-    char* p;
+    char *p;
     ASN1_TIME *tmps = NULL;
     const size_t len = 20;
 
@@ -291,7 +291,7 @@ ASN1_TIME *ossl_asn1_time_from_tm(ASN1_TIME *s, struct tm *ts, int type)
         goto err;
 
     tmps->type = type;
-    p = (char*)tmps->data;
+    p = (char *)tmps->data;
 
     if (ts->tm_mon > INT_MAX - 1)
         goto err;
@@ -300,21 +300,21 @@ ASN1_TIME *ossl_asn1_time_from_tm(ASN1_TIME *s, struct tm *ts, int type)
         if (ts->tm_year > INT_MAX - 1900)
             goto err;
         tmps->length = BIO_snprintf(p, len, "%04d%02d%02d%02d%02d%02dZ",
-                                    ts->tm_year + 1900, ts->tm_mon + 1,
-                                    ts->tm_mday, ts->tm_hour, ts->tm_min,
-                                    ts->tm_sec);
+            ts->tm_year + 1900, ts->tm_mon + 1,
+            ts->tm_mday, ts->tm_hour, ts->tm_min,
+            ts->tm_sec);
     } else {
         tmps->length = BIO_snprintf(p, len, "%02d%02d%02d%02d%02d%02dZ",
-                                    ts->tm_year % 100, ts->tm_mon + 1,
-                                    ts->tm_mday, ts->tm_hour, ts->tm_min,
-                                    ts->tm_sec);
+            ts->tm_year % 100, ts->tm_mon + 1,
+            ts->tm_mday, ts->tm_hour, ts->tm_min,
+            ts->tm_sec);
     }
 
 #ifdef CHARSET_EBCDIC
     ebcdic2ascii(tmps->data, tmps->data, tmps->length);
 #endif
     return tmps;
- err:
+err:
     if (tmps != s)
         ASN1_STRING_free(tmps);
     return NULL;
@@ -326,7 +326,7 @@ ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t)
 }
 
 ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t,
-                         int offset_day, long offset_sec)
+    int offset_day, long offset_sec)
 {
     struct tm *ts;
     struct tm data;
@@ -354,7 +354,7 @@ int ASN1_TIME_check(const ASN1_TIME *t)
 
 /* Convert an ASN1_TIME structure to GeneralizedTime */
 ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
-                                                   ASN1_GENERALIZEDTIME **out)
+    ASN1_GENERALIZEDTIME **out)
 {
     ASN1_GENERALIZEDTIME *ret = NULL;
     struct tm tm;
@@ -456,7 +456,7 @@ int ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm)
 }
 
 int ASN1_TIME_diff(int *pday, int *psec,
-                   const ASN1_TIME *from, const ASN1_TIME *to)
+    const ASN1_TIME *from, const ASN1_TIME *to)
 {
     struct tm tm_from, tm_to;
 
@@ -484,7 +484,6 @@ int ASN1_TIME_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
     return ossl_asn1_time_print_ex(bp, tm, flags) > 0;
 }
 
-
 /* prints the time with the date format of ISO 8601 */
 /* returns 0 on BIO write error, else -1 in case of parse failure, else 1 */
 int ossl_asn1_time_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
@@ -520,26 +519,30 @@ int ossl_asn1_time_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
         if (f_len > 0) {
             if ((flags & ASN1_DTFLGS_TYPE_MASK) == ASN1_DTFLGS_ISO8601) {
                 return BIO_printf(bp, "%4d-%02d-%02d %02d:%02d:%02d.%.*sZ",
-                                  stm.tm_year + 1900, stm.tm_mon + 1,
-                                  stm.tm_mday, stm.tm_hour,
-                                  stm.tm_min, stm.tm_sec, f_len, f) > 0;
+                           stm.tm_year + 1900, stm.tm_mon + 1,
+                           stm.tm_mday, stm.tm_hour,
+                           stm.tm_min, stm.tm_sec, f_len, f)
+                    > 0;
             } else {
                 return BIO_printf(bp, "%s %2d %02d:%02d:%02d.%.*s %d GMT",
-                                  _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
-                                  stm.tm_min, stm.tm_sec, f_len, f,
-                                  stm.tm_year + 1900) > 0;
+                           _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
+                           stm.tm_min, stm.tm_sec, f_len, f,
+                           stm.tm_year + 1900)
+                    > 0;
             }
         }
     }
     if ((flags & ASN1_DTFLGS_TYPE_MASK) == ASN1_DTFLGS_ISO8601) {
         return BIO_printf(bp, "%4d-%02d-%02d %02d:%02d:%02dZ",
-                          stm.tm_year + 1900, stm.tm_mon + 1,
-                          stm.tm_mday, stm.tm_hour,
-                          stm.tm_min, stm.tm_sec) > 0;
+                   stm.tm_year + 1900, stm.tm_mon + 1,
+                   stm.tm_mday, stm.tm_hour,
+                   stm.tm_min, stm.tm_sec)
+            > 0;
     } else {
         return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d GMT",
-                          _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
-                          stm.tm_min, stm.tm_sec, stm.tm_year + 1900) > 0;
+                   _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
+                   stm.tm_min, stm.tm_sec, stm.tm_year + 1900)
+            > 0;
     }
 }
 
diff --git a/crypto/openssl/crypto/asn1/a_type.c b/crypto/openssl/crypto/asn1/a_type.c
index 6b638bd80c18..facd1b6afc5b 100644
--- a/crypto/openssl/crypto/asn1/a_type.c
+++ b/crypto/openssl/crypto/asn1/a_type.c
@@ -16,8 +16,8 @@
 int ASN1_TYPE_get(const ASN1_TYPE *a)
 {
     if (a->type == V_ASN1_BOOLEAN
-            || a->type == V_ASN1_NULL
-            || a->value.ptr != NULL)
+        || a->type == V_ASN1_NULL
+        || a->value.ptr != NULL)
         return a->type;
     else
         return 0;
@@ -26,8 +26,8 @@ int ASN1_TYPE_get(const ASN1_TYPE *a)
 void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value)
 {
     if (a->type != V_ASN1_BOOLEAN
-            && a->type != V_ASN1_NULL
-            && a->value.ptr != NULL) {
+        && a->type != V_ASN1_NULL
+        && a->value.ptr != NULL) {
         ASN1_TYPE **tmp_a = &a;
         ossl_asn1_primitive_free((ASN1_VALUE **)tmp_a, NULL, 0);
     }
@@ -75,7 +75,7 @@ int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b)
         result = a->value.boolean - b->value.boolean;
         break;
     case V_ASN1_NULL:
-        result = 0;             /* They do not have content. */
+        result = 0; /* They do not have content. */
         break;
     case V_ASN1_INTEGER:
     case V_ASN1_ENUMERATED:
@@ -99,7 +99,7 @@ int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b)
     case V_ASN1_OTHER:
     default:
         result = ASN1_STRING_cmp((ASN1_STRING *)a->value.ptr,
-                                 (ASN1_STRING *)b->value.ptr);
+            (ASN1_STRING *)b->value.ptr);
         break;
     }
 
diff --git a/crypto/openssl/crypto/asn1/a_utctm.c b/crypto/openssl/crypto/asn1/a_utctm.c
index 323941ba97e2..27eeb1793288 100644
--- a/crypto/openssl/crypto/asn1/a_utctm.c
+++ b/crypto/openssl/crypto/asn1/a_utctm.c
@@ -55,7 +55,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
 }
 
 ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t,
-                               int offset_day, long offset_sec)
+    int offset_day, long offset_sec)
 {
     struct tm *ts;
     struct tm data;
diff --git a/crypto/openssl/crypto/asn1/a_utf8.c b/crypto/openssl/crypto/asn1/a_utf8.c
index 6572726cf1e5..fb5999fa7f14 100644
--- a/crypto/openssl/crypto/asn1/a_utf8.c
+++ b/crypto/openssl/crypto/asn1/a_utf8.c
@@ -73,7 +73,7 @@ int UTF8_getc(const unsigned char *str, int len, unsigned long *val)
         value |= (*p++ & 0x3f) << 12;
         value |= (*p++ & 0x3f) << 6;
         value |= *p++ & 0x3f;
-        if (value < 0x10000)
+        if (value < 0x10000 || value >= UNICODE_LIMIT)
             return -4;
         ret = 4;
     } else
@@ -93,7 +93,7 @@ int UTF8_getc(const unsigned char *str, int len, unsigned long *val)
 int UTF8_putc(unsigned char *str, int len, unsigned long value)
 {
     if (!str)
-        len = 4;                /* Maximum we will need */
+        len = 4; /* Maximum we will need */
     else if (len <= 0)
         return -1;
     if (value < 0x80) {
diff --git a/crypto/openssl/crypto/asn1/a_verify.c b/crypto/openssl/crypto/asn1/a_verify.c
index f6cac8096204..55f86ee83ff5 100644
--- a/crypto/openssl/crypto/asn1/a_verify.c
+++ b/crypto/openssl/crypto/asn1/a_verify.c
@@ -25,7 +25,7 @@
 #ifndef OPENSSL_NO_DEPRECATED_3_0
 
 int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature,
-                char *data, EVP_PKEY *pkey)
+    char *data, EVP_PKEY *pkey)
 {
     EVP_MD_CTX *ctx = EVP_MD_CTX_new();
     const EVP_MD *type;
@@ -71,13 +71,14 @@ int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature,
     ret = -1;
 
     if (EVP_VerifyFinal(ctx, (unsigned char *)signature->data,
-                        (unsigned int)signature->length, pkey) <= 0) {
+            (unsigned int)signature->length, pkey)
+        <= 0) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_EVP_LIB);
         ret = 0;
         goto err;
     }
     ret = 1;
- err:
+err:
     EVP_MD_CTX_free(ctx);
     return ret;
 }
@@ -85,16 +86,16 @@ int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature,
 #endif
 
 int ASN1_item_verify(const ASN1_ITEM *it, const X509_ALGOR *alg,
-                     const ASN1_BIT_STRING *signature, const void *data,
-                     EVP_PKEY *pkey)
+    const ASN1_BIT_STRING *signature, const void *data,
+    EVP_PKEY *pkey)
 {
     return ASN1_item_verify_ex(it, alg, signature, data, NULL, pkey, NULL, NULL);
 }
 
 int ASN1_item_verify_ex(const ASN1_ITEM *it, const X509_ALGOR *alg,
-                        const ASN1_BIT_STRING *signature, const void *data,
-                        const ASN1_OCTET_STRING *id, EVP_PKEY *pkey,
-                        OSSL_LIB_CTX *libctx, const char *propq)
+    const ASN1_BIT_STRING *signature, const void *data,
+    const ASN1_OCTET_STRING *id, EVP_PKEY *pkey,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     EVP_MD_CTX *ctx;
     int rv = -1;
@@ -108,8 +109,8 @@ int ASN1_item_verify_ex(const ASN1_ITEM *it, const X509_ALGOR *alg,
 }
 
 int ASN1_item_verify_ctx(const ASN1_ITEM *it, const X509_ALGOR *alg,
-                         const ASN1_BIT_STRING *signature, const void *data,
-                         EVP_MD_CTX *ctx)
+    const ASN1_BIT_STRING *signature, const void *data,
+    EVP_MD_CTX *ctx)
 {
     EVP_PKEY *pkey;
     unsigned char *buf_in = NULL;
@@ -181,8 +182,8 @@ int ASN1_item_verify_ctx(const ASN1_ITEM *it, const X509_ALGOR *alg,
                 type = EVP_get_digestbynid(mdnid);
                 if (type == NULL) {
                     ERR_raise_data(ERR_LIB_ASN1,
-                                   ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM,
-                                   "nid=0x%x", mdnid);
+                        ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM,
+                        "nid=0x%x", mdnid);
                     goto err;
                 }
             }
@@ -213,13 +214,13 @@ int ASN1_item_verify_ctx(const ASN1_ITEM *it, const X509_ALGOR *alg,
     inll = inl;
 
     ret = EVP_DigestVerify(ctx, signature->data, (size_t)signature->length,
-                           buf_in, inl);
+        buf_in, inl);
     if (ret <= 0) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_EVP_LIB);
         goto err;
     }
     ret = 1;
- err:
+err:
     OPENSSL_clear_free(buf_in, inll);
     return ret;
 }
diff --git a/crypto/openssl/crypto/asn1/ameth_lib.c b/crypto/openssl/crypto/asn1/ameth_lib.c
index 6ba13dd7f22e..14813e60af39 100644
--- a/crypto/openssl/crypto/asn1/ameth_lib.c
+++ b/crypto/openssl/crypto/asn1/ameth_lib.c
@@ -24,16 +24,16 @@ typedef int sk_cmp_fn_type(const char *const *a, const char *const *b);
 static STACK_OF(EVP_PKEY_ASN1_METHOD) *app_methods = NULL;
 
 DECLARE_OBJ_BSEARCH_CMP_FN(const EVP_PKEY_ASN1_METHOD *,
-                           const EVP_PKEY_ASN1_METHOD *, ameth);
+    const EVP_PKEY_ASN1_METHOD *, ameth);
 
 static int ameth_cmp(const EVP_PKEY_ASN1_METHOD *const *a,
-                     const EVP_PKEY_ASN1_METHOD *const *b)
+    const EVP_PKEY_ASN1_METHOD *const *b)
 {
     return ((*a)->pkey_id - (*b)->pkey_id);
 }
 
 IMPLEMENT_OBJ_BSEARCH_CMP_FN(const EVP_PKEY_ASN1_METHOD *,
-                             const EVP_PKEY_ASN1_METHOD *, ameth);
+    const EVP_PKEY_ASN1_METHOD *, ameth);
 
 int EVP_PKEY_asn1_get_count(void)
 {
@@ -104,7 +104,7 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type)
 }
 
 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe,
-                                                   const char *str, int len)
+    const char *str, int len)
 {
     int i;
     const EVP_PKEY_ASN1_METHOD *ameth = NULL;
@@ -128,7 +128,7 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe,
 #endif
         *pe = NULL;
     }
-    for (i = EVP_PKEY_asn1_get_count(); i-- > 0; ) {
+    for (i = EVP_PKEY_asn1_get_count(); i-- > 0;) {
         ameth = EVP_PKEY_asn1_get0(i);
         if (ameth->pkey_flags & ASN1_PKEY_ALIAS)
             continue;
@@ -141,7 +141,9 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe,
 
 int EVP_PKEY_asn1_add0(const EVP_PKEY_ASN1_METHOD *ameth)
 {
-    EVP_PKEY_ASN1_METHOD tmp = { 0, };
+    EVP_PKEY_ASN1_METHOD tmp = {
+        0,
+    };
 
     /*
      * One of the following must be true:
@@ -152,9 +154,9 @@ int EVP_PKEY_asn1_add0(const EVP_PKEY_ASN1_METHOD *ameth)
      * Anything else is an error and may lead to a corrupt ASN1 method table
      */
     if (!((ameth->pem_str == NULL
-           && (ameth->pkey_flags & ASN1_PKEY_ALIAS) != 0)
-          || (ameth->pem_str != NULL
-              && (ameth->pkey_flags & ASN1_PKEY_ALIAS) == 0))) {
+              && (ameth->pkey_flags & ASN1_PKEY_ALIAS) != 0)
+            || (ameth->pem_str != NULL
+                && (ameth->pkey_flags & ASN1_PKEY_ALIAS) == 0))) {
         ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_INVALID_ARGUMENT);
         return 0;
     }
@@ -168,7 +170,7 @@ int EVP_PKEY_asn1_add0(const EVP_PKEY_ASN1_METHOD *ameth)
     tmp.pkey_id = ameth->pkey_id;
     if (sk_EVP_PKEY_ASN1_METHOD_find(app_methods, &tmp) >= 0) {
         ERR_raise(ERR_LIB_EVP,
-                  EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED);
+            EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED);
         return 0;
     }
 
@@ -193,9 +195,9 @@ int EVP_PKEY_asn1_add_alias(int to, int from)
 }
 
 int EVP_PKEY_asn1_get0_info(int *ppkey_id, int *ppkey_base_id,
-                            int *ppkey_flags, const char **pinfo,
-                            const char **ppem_str,
-                            const EVP_PKEY_ASN1_METHOD *ameth)
+    int *ppkey_flags, const char **pinfo,
+    const char **ppem_str,
+    const EVP_PKEY_ASN1_METHOD *ameth)
 {
     if (!ameth)
         return 0;
@@ -218,7 +220,7 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey)
 }
 
 EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_new(int id, int flags,
-                                        const char *pem_str, const char *info)
+    const char *pem_str, const char *info)
 {
     EVP_PKEY_ASN1_METHOD *ameth = OPENSSL_zalloc(sizeof(*ameth));
 
@@ -243,13 +245,13 @@ EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_new(int id, int flags,
 
     return ameth;
 
- err:
+err:
     EVP_PKEY_asn1_free(ameth);
     return NULL;
 }
 
 void EVP_PKEY_asn1_copy(EVP_PKEY_ASN1_METHOD *dst,
-                        const EVP_PKEY_ASN1_METHOD *src)
+    const EVP_PKEY_ASN1_METHOD *src)
 {
     int pkey_id = dst->pkey_id;
     int pkey_base_id = dst->pkey_base_id;
@@ -277,17 +279,17 @@ void EVP_PKEY_asn1_free(EVP_PKEY_ASN1_METHOD *ameth)
 }
 
 void EVP_PKEY_asn1_set_public(EVP_PKEY_ASN1_METHOD *ameth,
-                              int (*pub_decode) (EVP_PKEY *pk,
-                                                 const X509_PUBKEY *pub),
-                              int (*pub_encode) (X509_PUBKEY *pub,
-                                                 const EVP_PKEY *pk),
-                              int (*pub_cmp) (const EVP_PKEY *a,
-                                              const EVP_PKEY *b),
-                              int (*pub_print) (BIO *out,
-                                                const EVP_PKEY *pkey,
-                                                int indent, ASN1_PCTX *pctx),
-                              int (*pkey_size) (const EVP_PKEY *pk),
-                              int (*pkey_bits) (const EVP_PKEY *pk))
+    int (*pub_decode)(EVP_PKEY *pk,
+        const X509_PUBKEY *pub),
+    int (*pub_encode)(X509_PUBKEY *pub,
+        const EVP_PKEY *pk),
+    int (*pub_cmp)(const EVP_PKEY *a,
+        const EVP_PKEY *b),
+    int (*pub_print)(BIO *out,
+        const EVP_PKEY *pkey,
+        int indent, ASN1_PCTX *pctx),
+    int (*pkey_size)(const EVP_PKEY *pk),
+    int (*pkey_bits)(const EVP_PKEY *pk))
 {
     ameth->pub_decode = pub_decode;
     ameth->pub_encode = pub_encode;
@@ -298,15 +300,15 @@ void EVP_PKEY_asn1_set_public(EVP_PKEY_ASN1_METHOD *ameth,
 }
 
 void EVP_PKEY_asn1_set_private(EVP_PKEY_ASN1_METHOD *ameth,
-                               int (*priv_decode) (EVP_PKEY *pk,
-                                                   const PKCS8_PRIV_KEY_INFO
-                                                   *p8inf),
-                               int (*priv_encode) (PKCS8_PRIV_KEY_INFO *p8,
-                                                   const EVP_PKEY *pk),
-                               int (*priv_print) (BIO *out,
-                                                  const EVP_PKEY *pkey,
-                                                  int indent,
-                                                  ASN1_PCTX *pctx))
+    int (*priv_decode)(EVP_PKEY *pk,
+        const PKCS8_PRIV_KEY_INFO
+            *p8inf),
+    int (*priv_encode)(PKCS8_PRIV_KEY_INFO *p8,
+        const EVP_PKEY *pk),
+    int (*priv_print)(BIO *out,
+        const EVP_PKEY *pkey,
+        int indent,
+        ASN1_PCTX *pctx))
 {
     ameth->priv_decode = priv_decode;
     ameth->priv_encode = priv_encode;
@@ -314,19 +316,19 @@ void EVP_PKEY_asn1_set_private(EVP_PKEY_ASN1_METHOD *ameth,
 }
 
 void EVP_PKEY_asn1_set_param(EVP_PKEY_ASN1_METHOD *ameth,
-                             int (*param_decode) (EVP_PKEY *pkey,
-                                                  const unsigned char **pder,
-                                                  int derlen),
-                             int (*param_encode) (const EVP_PKEY *pkey,
-                                                  unsigned char **pder),
-                             int (*param_missing) (const EVP_PKEY *pk),
-                             int (*param_copy) (EVP_PKEY *to,
-                                                const EVP_PKEY *from),
-                             int (*param_cmp) (const EVP_PKEY *a,
-                                               const EVP_PKEY *b),
-                             int (*param_print) (BIO *out,
-                                                 const EVP_PKEY *pkey,
-                                                 int indent, ASN1_PCTX *pctx))
+    int (*param_decode)(EVP_PKEY *pkey,
+        const unsigned char **pder,
+        int derlen),
+    int (*param_encode)(const EVP_PKEY *pkey,
+        unsigned char **pder),
+    int (*param_missing)(const EVP_PKEY *pk),
+    int (*param_copy)(EVP_PKEY *to,
+        const EVP_PKEY *from),
+    int (*param_cmp)(const EVP_PKEY *a,
+        const EVP_PKEY *b),
+    int (*param_print)(BIO *out,
+        const EVP_PKEY *pkey,
+        int indent, ASN1_PCTX *pctx))
 {
     ameth->param_decode = param_decode;
     ameth->param_encode = param_encode;
@@ -337,98 +339,98 @@ void EVP_PKEY_asn1_set_param(EVP_PKEY_ASN1_METHOD *ameth,
 }
 
 void EVP_PKEY_asn1_set_free(EVP_PKEY_ASN1_METHOD *ameth,
-                            void (*pkey_free) (EVP_PKEY *pkey))
+    void (*pkey_free)(EVP_PKEY *pkey))
 {
     ameth->pkey_free = pkey_free;
 }
 
 void EVP_PKEY_asn1_set_ctrl(EVP_PKEY_ASN1_METHOD *ameth,
-                            int (*pkey_ctrl) (EVP_PKEY *pkey, int op,
-                                              long arg1, void *arg2))
+    int (*pkey_ctrl)(EVP_PKEY *pkey, int op,
+        long arg1, void *arg2))
 {
     ameth->pkey_ctrl = pkey_ctrl;
 }
 
 void EVP_PKEY_asn1_set_security_bits(EVP_PKEY_ASN1_METHOD *ameth,
-                                     int (*pkey_security_bits) (const EVP_PKEY
-                                                                *pk))
+    int (*pkey_security_bits)(const EVP_PKEY
+            *pk))
 {
     ameth->pkey_security_bits = pkey_security_bits;
 }
 
 void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
-                            int (*item_verify) (EVP_MD_CTX *ctx,
-                                                const ASN1_ITEM *it,
-                                                const void *data,
-                                                const X509_ALGOR *a,
-                                                const ASN1_BIT_STRING *sig,
-                                                EVP_PKEY *pkey),
-                            int (*item_sign) (EVP_MD_CTX *ctx,
-                                              const ASN1_ITEM *it,
-                                              const void *data,
-                                              X509_ALGOR *alg1,
-                                              X509_ALGOR *alg2,
-                                              ASN1_BIT_STRING *sig))
+    int (*item_verify)(EVP_MD_CTX *ctx,
+        const ASN1_ITEM *it,
+        const void *data,
+        const X509_ALGOR *a,
+        const ASN1_BIT_STRING *sig,
+        EVP_PKEY *pkey),
+    int (*item_sign)(EVP_MD_CTX *ctx,
+        const ASN1_ITEM *it,
+        const void *data,
+        X509_ALGOR *alg1,
+        X509_ALGOR *alg2,
+        ASN1_BIT_STRING *sig))
 {
     ameth->item_sign = item_sign;
     ameth->item_verify = item_verify;
 }
 
 void EVP_PKEY_asn1_set_siginf(EVP_PKEY_ASN1_METHOD *ameth,
-                              int (*siginf_set) (X509_SIG_INFO *siginf,
-                                                 const X509_ALGOR *alg,
-                                                 const ASN1_STRING *sig))
+    int (*siginf_set)(X509_SIG_INFO *siginf,
+        const X509_ALGOR *alg,
+        const ASN1_STRING *sig))
 {
     ameth->siginf_set = siginf_set;
 }
 
 void EVP_PKEY_asn1_set_check(EVP_PKEY_ASN1_METHOD *ameth,
-                             int (*pkey_check) (const EVP_PKEY *pk))
+    int (*pkey_check)(const EVP_PKEY *pk))
 {
     ameth->pkey_check = pkey_check;
 }
 
 void EVP_PKEY_asn1_set_public_check(EVP_PKEY_ASN1_METHOD *ameth,
-                                    int (*pkey_pub_check) (const EVP_PKEY *pk))
+    int (*pkey_pub_check)(const EVP_PKEY *pk))
 {
     ameth->pkey_public_check = pkey_pub_check;
 }
 
 void EVP_PKEY_asn1_set_param_check(EVP_PKEY_ASN1_METHOD *ameth,
-                                   int (*pkey_param_check) (const EVP_PKEY *pk))
+    int (*pkey_param_check)(const EVP_PKEY *pk))
 {
     ameth->pkey_param_check = pkey_param_check;
 }
 
 void EVP_PKEY_asn1_set_set_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
-                                    int (*set_priv_key) (EVP_PKEY *pk,
-                                                         const unsigned char
-                                                            *priv,
-                                                         size_t len))
+    int (*set_priv_key)(EVP_PKEY *pk,
+        const unsigned char
+            *priv,
+        size_t len))
 {
     ameth->set_priv_key = set_priv_key;
 }
 
 void EVP_PKEY_asn1_set_set_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
-                                   int (*set_pub_key) (EVP_PKEY *pk,
-                                                       const unsigned char *pub,
-                                                       size_t len))
+    int (*set_pub_key)(EVP_PKEY *pk,
+        const unsigned char *pub,
+        size_t len))
 {
     ameth->set_pub_key = set_pub_key;
 }
 
 void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
-                                    int (*get_priv_key) (const EVP_PKEY *pk,
-                                                         unsigned char *priv,
-                                                         size_t *len))
+    int (*get_priv_key)(const EVP_PKEY *pk,
+        unsigned char *priv,
+        size_t *len))
 {
     ameth->get_priv_key = get_priv_key;
 }
 
 void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
-                                   int (*get_pub_key) (const EVP_PKEY *pk,
-                                                       unsigned char *pub,
-                                                       size_t *len))
+    int (*get_pub_key)(const EVP_PKEY *pk,
+        unsigned char *pub,
+        size_t *len))
 {
     ameth->get_pub_key = get_pub_key;
 }
diff --git a/crypto/openssl/crypto/asn1/asn1_err.c b/crypto/openssl/crypto/asn1/asn1_err.c
index f52584244970..81ac09bba3c8 100644
--- a/crypto/openssl/crypto/asn1/asn1_err.c
+++ b/crypto/openssl/crypto/asn1/asn1_err.c
@@ -15,193 +15,193 @@
 #ifndef OPENSSL_NO_ERR
 
 static const ERR_STRING_DATA ASN1_str_reasons[] = {
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ADDING_OBJECT), "adding object"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ASN1_PARSE_ERROR), "asn1 parse error"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ASN1_SIG_PARSE_ERROR),
-    "asn1 sig parse error"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_AUX_ERROR), "aux error"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BAD_OBJECT_HEADER), "bad object header"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BAD_TEMPLATE), "bad template"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BMPSTRING_IS_WRONG_LENGTH),
-    "bmpstring is wrong length"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BN_LIB), "bn lib"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BOOLEAN_IS_WRONG_LENGTH),
-    "boolean is wrong length"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BUFFER_TOO_SMALL), "buffer too small"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER),
-    "cipher has no object identifier"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_CONTEXT_NOT_INITIALISED),
-    "context not initialised"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_DATA_IS_WRONG), "data is wrong"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_DECODE_ERROR), "decode error"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_DEPTH_EXCEEDED), "depth exceeded"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED),
-    "digest and key type not supported"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ENCODE_ERROR), "encode error"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ERROR_GETTING_TIME),
-    "error getting time"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ERROR_LOADING_SECTION),
-    "error loading section"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ERROR_SETTING_CIPHER_PARAMS),
-    "error setting cipher params"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_EXPECTING_AN_INTEGER),
-    "expecting an integer"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_EXPECTING_AN_OBJECT),
-    "expecting an object"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_EXPLICIT_LENGTH_MISMATCH),
-    "explicit length mismatch"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED),
-    "explicit tag not constructed"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_FIELD_MISSING), "field missing"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_FIRST_NUM_TOO_LARGE),
-    "first num too large"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_GENERALIZEDTIME_IS_TOO_SHORT),
-    "generalizedtime is too short"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_HEADER_TOO_LONG), "header too long"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_BITSTRING_FORMAT),
-    "illegal bitstring format"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_BOOLEAN), "illegal boolean"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_CHARACTERS),
-    "illegal characters"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_FORMAT), "illegal format"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_HEX), "illegal hex"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_IMPLICIT_TAG),
-    "illegal implicit tag"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_INTEGER), "illegal integer"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_NEGATIVE_VALUE),
-    "illegal negative value"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_NESTED_TAGGING),
-    "illegal nested tagging"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_NULL), "illegal null"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_NULL_VALUE),
-    "illegal null value"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_OBJECT), "illegal object"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_OPTIONAL_ANY),
-    "illegal optional any"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE),
-    "illegal options on item template"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_PADDING), "illegal padding"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_TAGGED_ANY),
-    "illegal tagged any"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_TIME_VALUE),
-    "illegal time value"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_ZERO_CONTENT),
-    "illegal zero content"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INTEGER_NOT_ASCII_FORMAT),
-    "integer not ascii format"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG),
-    "integer too large for long"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_BIT_STRING_BITS_LEFT),
-    "invalid bit string bits left"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_BMPSTRING_LENGTH),
-    "invalid bmpstring length"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_DIGIT), "invalid digit"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_MIME_TYPE), "invalid mime type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_MODIFIER), "invalid modifier"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_NUMBER), "invalid number"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_OBJECT_ENCODING),
-    "invalid object encoding"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_SCRYPT_PARAMETERS),
-    "invalid scrypt parameters"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_SEPARATOR), "invalid separator"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_STRING_TABLE_VALUE),
-    "invalid string table value"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_UNIVERSALSTRING_LENGTH),
-    "invalid universalstring length"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_UTF8STRING),
-    "invalid utf8string"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_VALUE), "invalid value"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_LENGTH_TOO_LONG), "length too long"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_LIST_ERROR), "list error"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MIME_NO_CONTENT_TYPE),
-    "mime no content type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MIME_PARSE_ERROR), "mime parse error"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MIME_SIG_PARSE_ERROR),
-    "mime sig parse error"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MISSING_EOC), "missing eoc"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MISSING_SECOND_NUMBER),
-    "missing second number"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MISSING_VALUE), "missing value"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MSTRING_NOT_UNIVERSAL),
-    "mstring not universal"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MSTRING_WRONG_TAG), "mstring wrong tag"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NESTED_ASN1_STRING),
-    "nested asn1 string"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NESTED_TOO_DEEP), "nested too deep"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NON_HEX_CHARACTERS),
-    "non hex characters"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NOT_ASCII_FORMAT), "not ascii format"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NOT_ENOUGH_DATA), "not enough data"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_CONTENT_TYPE), "no content type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_MATCHING_CHOICE_TYPE),
-    "no matching choice type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_MULTIPART_BODY_FAILURE),
-    "no multipart body failure"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_MULTIPART_BOUNDARY),
-    "no multipart boundary"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_SIG_CONTENT_TYPE),
-    "no sig content type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NULL_IS_WRONG_LENGTH),
-    "null is wrong length"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_OBJECT_NOT_ASCII_FORMAT),
-    "object not ascii format"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ODD_NUMBER_OF_CHARS),
-    "odd number of chars"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SECOND_NUMBER_TOO_LARGE),
-    "second number too large"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SEQUENCE_LENGTH_MISMATCH),
-    "sequence length mismatch"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SEQUENCE_NOT_CONSTRUCTED),
-    "sequence not constructed"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG),
-    "sequence or set needs config"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SHORT_LINE), "short line"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SIG_INVALID_MIME_TYPE),
-    "sig invalid mime type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_STREAMING_NOT_SUPPORTED),
-    "streaming not supported"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_STRING_TOO_LONG), "string too long"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_STRING_TOO_SHORT), "string too short"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD),
-    "the asn1 object identifier is not known for this md"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TIME_NOT_ASCII_FORMAT),
-    "time not ascii format"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TOO_LARGE), "too large"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TOO_LONG), "too long"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TOO_SMALL), "too small"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TYPE_NOT_CONSTRUCTED),
-    "type not constructed"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TYPE_NOT_PRIMITIVE),
-    "type not primitive"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNEXPECTED_EOC), "unexpected eoc"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH),
-    "universalstring is wrong length"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_DIGEST), "unknown digest"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_FORMAT), "unknown format"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM),
-    "unknown message digest algorithm"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_OBJECT_TYPE),
-    "unknown object type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE),
-    "unknown public key type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM),
-    "unknown signature algorithm"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_TAG), "unknown tag"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE),
-    "unsupported any defined by type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNSUPPORTED_CIPHER),
-    "unsupported cipher"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE),
-    "unsupported public key type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNSUPPORTED_TYPE), "unsupported type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UTCTIME_IS_TOO_SHORT),
-    "utctime is too short"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_WRONG_INTEGER_TYPE),
-    "wrong integer type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_WRONG_PUBLIC_KEY_TYPE),
-    "wrong public key type"},
-    {ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_WRONG_TAG), "wrong tag"},
-    {0, NULL}
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ADDING_OBJECT), "adding object" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ASN1_PARSE_ERROR), "asn1 parse error" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ASN1_SIG_PARSE_ERROR),
+        "asn1 sig parse error" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_AUX_ERROR), "aux error" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BAD_OBJECT_HEADER), "bad object header" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BAD_TEMPLATE), "bad template" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BMPSTRING_IS_WRONG_LENGTH),
+        "bmpstring is wrong length" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BN_LIB), "bn lib" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BOOLEAN_IS_WRONG_LENGTH),
+        "boolean is wrong length" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_BUFFER_TOO_SMALL), "buffer too small" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER),
+        "cipher has no object identifier" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_CONTEXT_NOT_INITIALISED),
+        "context not initialised" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_DATA_IS_WRONG), "data is wrong" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_DECODE_ERROR), "decode error" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_DEPTH_EXCEEDED), "depth exceeded" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED),
+        "digest and key type not supported" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ENCODE_ERROR), "encode error" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ERROR_GETTING_TIME),
+        "error getting time" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ERROR_LOADING_SECTION),
+        "error loading section" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ERROR_SETTING_CIPHER_PARAMS),
+        "error setting cipher params" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_EXPECTING_AN_INTEGER),
+        "expecting an integer" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_EXPECTING_AN_OBJECT),
+        "expecting an object" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_EXPLICIT_LENGTH_MISMATCH),
+        "explicit length mismatch" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED),
+        "explicit tag not constructed" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_FIELD_MISSING), "field missing" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_FIRST_NUM_TOO_LARGE),
+        "first num too large" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_GENERALIZEDTIME_IS_TOO_SHORT),
+        "generalizedtime is too short" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_HEADER_TOO_LONG), "header too long" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_BITSTRING_FORMAT),
+        "illegal bitstring format" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_BOOLEAN), "illegal boolean" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_CHARACTERS),
+        "illegal characters" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_FORMAT), "illegal format" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_HEX), "illegal hex" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_IMPLICIT_TAG),
+        "illegal implicit tag" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_INTEGER), "illegal integer" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_NEGATIVE_VALUE),
+        "illegal negative value" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_NESTED_TAGGING),
+        "illegal nested tagging" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_NULL), "illegal null" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_NULL_VALUE),
+        "illegal null value" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_OBJECT), "illegal object" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_OPTIONAL_ANY),
+        "illegal optional any" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE),
+        "illegal options on item template" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_PADDING), "illegal padding" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_TAGGED_ANY),
+        "illegal tagged any" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_TIME_VALUE),
+        "illegal time value" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ILLEGAL_ZERO_CONTENT),
+        "illegal zero content" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INTEGER_NOT_ASCII_FORMAT),
+        "integer not ascii format" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG),
+        "integer too large for long" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_BIT_STRING_BITS_LEFT),
+        "invalid bit string bits left" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_BMPSTRING_LENGTH),
+        "invalid bmpstring length" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_DIGIT), "invalid digit" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_MIME_TYPE), "invalid mime type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_MODIFIER), "invalid modifier" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_NUMBER), "invalid number" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_OBJECT_ENCODING),
+        "invalid object encoding" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_SCRYPT_PARAMETERS),
+        "invalid scrypt parameters" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_SEPARATOR), "invalid separator" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_STRING_TABLE_VALUE),
+        "invalid string table value" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_UNIVERSALSTRING_LENGTH),
+        "invalid universalstring length" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_UTF8STRING),
+        "invalid utf8string" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_INVALID_VALUE), "invalid value" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_LENGTH_TOO_LONG), "length too long" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_LIST_ERROR), "list error" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MIME_NO_CONTENT_TYPE),
+        "mime no content type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MIME_PARSE_ERROR), "mime parse error" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MIME_SIG_PARSE_ERROR),
+        "mime sig parse error" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MISSING_EOC), "missing eoc" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MISSING_SECOND_NUMBER),
+        "missing second number" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MISSING_VALUE), "missing value" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MSTRING_NOT_UNIVERSAL),
+        "mstring not universal" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_MSTRING_WRONG_TAG), "mstring wrong tag" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NESTED_ASN1_STRING),
+        "nested asn1 string" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NESTED_TOO_DEEP), "nested too deep" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NON_HEX_CHARACTERS),
+        "non hex characters" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NOT_ASCII_FORMAT), "not ascii format" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NOT_ENOUGH_DATA), "not enough data" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_CONTENT_TYPE), "no content type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_MATCHING_CHOICE_TYPE),
+        "no matching choice type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_MULTIPART_BODY_FAILURE),
+        "no multipart body failure" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_MULTIPART_BOUNDARY),
+        "no multipart boundary" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NO_SIG_CONTENT_TYPE),
+        "no sig content type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_NULL_IS_WRONG_LENGTH),
+        "null is wrong length" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_OBJECT_NOT_ASCII_FORMAT),
+        "object not ascii format" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_ODD_NUMBER_OF_CHARS),
+        "odd number of chars" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SECOND_NUMBER_TOO_LARGE),
+        "second number too large" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SEQUENCE_LENGTH_MISMATCH),
+        "sequence length mismatch" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SEQUENCE_NOT_CONSTRUCTED),
+        "sequence not constructed" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG),
+        "sequence or set needs config" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SHORT_LINE), "short line" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_SIG_INVALID_MIME_TYPE),
+        "sig invalid mime type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_STREAMING_NOT_SUPPORTED),
+        "streaming not supported" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_STRING_TOO_LONG), "string too long" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_STRING_TOO_SHORT), "string too short" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD),
+        "the asn1 object identifier is not known for this md" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TIME_NOT_ASCII_FORMAT),
+        "time not ascii format" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TOO_LARGE), "too large" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TOO_LONG), "too long" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TOO_SMALL), "too small" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TYPE_NOT_CONSTRUCTED),
+        "type not constructed" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_TYPE_NOT_PRIMITIVE),
+        "type not primitive" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNEXPECTED_EOC), "unexpected eoc" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH),
+        "universalstring is wrong length" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_DIGEST), "unknown digest" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_FORMAT), "unknown format" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM),
+        "unknown message digest algorithm" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_OBJECT_TYPE),
+        "unknown object type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE),
+        "unknown public key type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM),
+        "unknown signature algorithm" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNKNOWN_TAG), "unknown tag" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE),
+        "unsupported any defined by type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNSUPPORTED_CIPHER),
+        "unsupported cipher" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE),
+        "unsupported public key type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UNSUPPORTED_TYPE), "unsupported type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_UTCTIME_IS_TOO_SHORT),
+        "utctime is too short" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_WRONG_INTEGER_TYPE),
+        "wrong integer type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_WRONG_PUBLIC_KEY_TYPE),
+        "wrong public key type" },
+    { ERR_PACK(ERR_LIB_ASN1, 0, ASN1_R_WRONG_TAG), "wrong tag" },
+    { 0, NULL }
 };
 
 #endif
diff --git a/crypto/openssl/crypto/asn1/asn1_gen.c b/crypto/openssl/crypto/asn1/asn1_gen.c
index 50b4db97aa65..1c8d3d585940 100644
--- a/crypto/openssl/crypto/asn1/asn1_gen.c
+++ b/crypto/openssl/crypto/asn1/asn1_gen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -12,30 +12,30 @@
 #include "internal/cryptlib.h"
 #include "crypto/asn1.h"
 
-#define ASN1_GEN_FLAG           0x10000
-#define ASN1_GEN_FLAG_IMP       (ASN1_GEN_FLAG|1)
-#define ASN1_GEN_FLAG_EXP       (ASN1_GEN_FLAG|2)
-#define ASN1_GEN_FLAG_TAG       (ASN1_GEN_FLAG|3)
-#define ASN1_GEN_FLAG_BITWRAP   (ASN1_GEN_FLAG|4)
-#define ASN1_GEN_FLAG_OCTWRAP   (ASN1_GEN_FLAG|5)
-#define ASN1_GEN_FLAG_SEQWRAP   (ASN1_GEN_FLAG|6)
-#define ASN1_GEN_FLAG_SETWRAP   (ASN1_GEN_FLAG|7)
-#define ASN1_GEN_FLAG_FORMAT    (ASN1_GEN_FLAG|8)
+#define ASN1_GEN_FLAG 0x10000
+#define ASN1_GEN_FLAG_IMP (ASN1_GEN_FLAG | 1)
+#define ASN1_GEN_FLAG_EXP (ASN1_GEN_FLAG | 2)
+#define ASN1_GEN_FLAG_TAG (ASN1_GEN_FLAG | 3)
+#define ASN1_GEN_FLAG_BITWRAP (ASN1_GEN_FLAG | 4)
+#define ASN1_GEN_FLAG_OCTWRAP (ASN1_GEN_FLAG | 5)
+#define ASN1_GEN_FLAG_SEQWRAP (ASN1_GEN_FLAG | 6)
+#define ASN1_GEN_FLAG_SETWRAP (ASN1_GEN_FLAG | 7)
+#define ASN1_GEN_FLAG_FORMAT (ASN1_GEN_FLAG | 8)
 
-#define ASN1_GEN_STR(str,val)   {str, sizeof(str) - 1, val}
+#define ASN1_GEN_STR(str, val) { str, sizeof(str) - 1, val }
 
-#define ASN1_FLAG_EXP_MAX       20
+#define ASN1_FLAG_EXP_MAX 20
 /* Maximum number of nested sequences */
-#define ASN1_GEN_SEQ_MAX_DEPTH  50
+#define ASN1_GEN_SEQ_MAX_DEPTH 50
 
 /* Input formats */
 
 /* ASCII: default */
-#define ASN1_GEN_FORMAT_ASCII   1
+#define ASN1_GEN_FORMAT_ASCII 1
 /* UTF8 */
-#define ASN1_GEN_FORMAT_UTF8    2
+#define ASN1_GEN_FORMAT_UTF8 2
 /* Hex */
-#define ASN1_GEN_FORMAT_HEX     3
+#define ASN1_GEN_FORMAT_HEX 3
 /* List of bits */
 #define ASN1_GEN_FORMAT_BITLIST 4
 
@@ -64,15 +64,15 @@ typedef struct {
 } tag_exp_arg;
 
 static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
-                              int *perr);
+    int *perr);
 static int bitstr_cb(const char *elem, int len, void *bitstr);
 static int asn1_cb(const char *elem, int len, void *bitstr);
 static int append_exp(tag_exp_arg *arg, int exp_tag, int exp_class,
-                      int exp_constructed, int exp_pad, int imp_ok);
+    int exp_constructed, int exp_pad, int imp_ok);
 static int parse_tagging(const char *vstart, int vlen, int *ptag,
-                         int *pclass);
+    int *pclass);
 static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
-                             int depth, int *perr);
+    int depth, int *perr);
 static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype);
 static int asn1_str2tag(const char *tagstr, int len);
 
@@ -97,7 +97,7 @@ ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf)
 }
 
 static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
-                              int *perr)
+    int *perr)
 {
     ASN1_TYPE *ret;
     tag_exp_arg asn1_tags;
@@ -134,8 +134,9 @@ static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
             return NULL;
         }
         ret = asn1_multi(asn1_tags.utype, asn1_tags.str, cnf, depth, perr);
-    } else
+    } else {
         ret = asn1_str2type(asn1_tags.str, asn1_tags.format, asn1_tags.utype);
+    }
 
     if (!ret)
         return NULL;
@@ -148,6 +149,8 @@ static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
     cpy_len = i2d_ASN1_TYPE(ret, &orig_der);
     ASN1_TYPE_free(ret);
     ret = NULL;
+    if (orig_der == NULL)
+        return NULL;
     /* Set point to start copying for modified encoding */
     cpy_start = orig_der;
 
@@ -156,7 +159,7 @@ static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
         /* If IMPLICIT we will replace the underlying tag */
         /* Skip existing tag+len */
         r = ASN1_get_object(&cpy_start, &hdr_len, &hdr_tag, &hdr_class,
-                            cpy_len);
+            cpy_len);
         if (r & 0x80)
             goto err;
         /* Update copy length */
@@ -169,26 +172,32 @@ static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
             /* Indefinite length constructed */
             hdr_constructed = 2;
             hdr_len = 0;
-        } else
+        } else {
             /* Just retain constructed flag */
             hdr_constructed = r & V_ASN1_CONSTRUCTED;
+        }
         /*
          * Work out new length with IMPLICIT tag: ignore constructed because
          * it will mess up if indefinite length
          */
         len = ASN1_object_size(0, hdr_len, asn1_tags.imp_tag);
-    } else
+        if (len == -1)
+            goto err;
+    } else {
         len = cpy_len;
+    }
 
     /* Work out length in any EXPLICIT, starting from end */
 
     for (i = 0, etmp = asn1_tags.exp_list + asn1_tags.exp_count - 1;
-         i < asn1_tags.exp_count; i++, etmp--) {
+        i < asn1_tags.exp_count; i++, etmp--) {
         /* Content length: number of content octets + any padding */
         len += etmp->exp_pad;
         etmp->exp_len = len;
         /* Total object length: length including new header */
         len = ASN1_object_size(0, len, etmp->exp_tag);
+        if (len == -1)
+            goto err;
     }
 
     /* Allocate buffer for new encoding */
@@ -204,9 +213,9 @@ static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
     /* Output explicit tags first */
 
     for (i = 0, etmp = asn1_tags.exp_list; i < asn1_tags.exp_count;
-         i++, etmp++) {
+        i++, etmp++) {
         ASN1_put_object(&p, etmp->exp_constructed, etmp->exp_len,
-                        etmp->exp_tag, etmp->exp_class);
+            etmp->exp_tag, etmp->exp_class);
         if (etmp->exp_pad)
             *p++ = 0;
     }
@@ -219,7 +228,7 @@ static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
                 || asn1_tags.imp_tag == V_ASN1_SET))
             hdr_constructed = V_ASN1_CONSTRUCTED;
         ASN1_put_object(&p, hdr_constructed, hdr_len,
-                        asn1_tags.imp_tag, asn1_tags.imp_class);
+            asn1_tags.imp_tag, asn1_tags.imp_class);
     }
 
     /* Copy across original encoding */
@@ -230,12 +239,11 @@ static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
     /* Obtain new ASN1_TYPE structure */
     ret = d2i_ASN1_TYPE(NULL, &cp, len);
 
- err:
+err:
     OPENSSL_free(orig_der);
     OPENSSL_free(new_der);
 
     return ret;
-
 }
 
 static int asn1_cb(const char *elem, int len, void *bitstr)
@@ -338,11 +346,9 @@ static int asn1_cb(const char *elem, int len, void *bitstr)
             return -1;
         }
         break;
-
     }
 
     return 1;
-
 }
 
 static int parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
@@ -386,21 +392,19 @@ static int parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
 
         default:
             ERR_raise_data(ERR_LIB_ASN1, ASN1_R_INVALID_MODIFIER,
-                           "Char=%c", *eptr);
+                "Char=%c", *eptr);
             return 0;
-
         }
     } else
         *pclass = V_ASN1_CONTEXT_SPECIFIC;
 
     return 1;
-
 }
 
 /* Handle multiple types: SET and SEQUENCE */
 
 static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
-                             int depth, int *perr)
+    int depth, int *perr)
 {
     ASN1_TYPE *ret = NULL;
     STACK_OF(ASN1_TYPE) *sk = NULL;
@@ -418,9 +422,8 @@ static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
         if (!sect)
             goto bad;
         for (i = 0; i < sk_CONF_VALUE_num(sect); i++) {
-            ASN1_TYPE *typ =
-                generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf,
-                            depth + 1, perr);
+            ASN1_TYPE *typ = generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf,
+                depth + 1, perr);
             if (!typ)
                 goto bad;
             if (!sk_ASN1_TYPE_push(sk, typ))
@@ -450,7 +453,7 @@ static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
 
     der = NULL;
 
- bad:
+bad:
 
     OPENSSL_free(der);
 
@@ -461,7 +464,7 @@ static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
 }
 
 static int append_exp(tag_exp_arg *arg, int exp_tag, int exp_class,
-                      int exp_constructed, int exp_pad, int imp_ok)
+    int exp_constructed, int exp_pad, int imp_ok)
 {
     tag_exp_type *exp_tmp;
     /* Can only have IMPLICIT if permitted */
@@ -620,7 +623,8 @@ static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype)
             goto bad_form;
         }
         if ((atmp->value.integer
-                    = s2i_ASN1_INTEGER(NULL, str)) == NULL) {
+                = s2i_ASN1_INTEGER(NULL, str))
+            == NULL) {
             ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_INTEGER);
             goto bad_str;
         }
@@ -678,7 +682,8 @@ static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype)
         }
 
         if (ASN1_mbstring_copy(&atmp->value.asn1_string, (unsigned char *)str,
-                               -1, format, ASN1_tag2bit(utype)) <= 0) {
+                -1, format, ASN1_tag2bit(utype))
+            <= 0) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
             goto bad_str;
         }
@@ -706,9 +711,8 @@ static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype)
                 goto bad_str;
             }
         } else if ((format == ASN1_GEN_FORMAT_BITLIST)
-                 && (utype == V_ASN1_BIT_STRING)) {
-            if (!CONF_parse_list
-                (str, ',', 1, bitstr_cb, atmp->value.bit_string)) {
+            && (utype == V_ASN1_BIT_STRING)) {
+            if (!CONF_parse_list(str, ',', 1, bitstr_cb, atmp->value.bit_string)) {
                 ERR_raise(ERR_LIB_ASN1, ASN1_R_LIST_ERROR);
                 goto bad_str;
             }
@@ -732,13 +736,12 @@ static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype)
     atmp->type = utype;
     return atmp;
 
- bad_str:
+bad_str:
     ERR_add_error_data(2, "string=", str);
- bad_form:
+bad_form:
 
     ASN1_TYPE_free(atmp);
     return NULL;
-
 }
 
 static int bitstr_cb(const char *elem, int len, void *bitstr)
diff --git a/crypto/openssl/crypto/asn1/asn1_item_list.h b/crypto/openssl/crypto/asn1/asn1_item_list.h
index 3d678ae18fd5..f26954ecb71c 100644
--- a/crypto/openssl/crypto/asn1/asn1_item_list.h
+++ b/crypto/openssl/crypto/asn1/asn1_item_list.h
@@ -64,10 +64,10 @@ static ASN1_ITEM_EXP *asn1_item_list[] = {
     ASN1_ITEM_ref(DIST_POINT_NAME),
     ASN1_ITEM_ref(DIST_POINT),
 #ifndef OPENSSL_NO_EC
-# ifndef OPENSSL_NO_DEPRECATED_3_0
+#ifndef OPENSSL_NO_DEPRECATED_3_0
     ASN1_ITEM_ref(ECPARAMETERS),
     ASN1_ITEM_ref(ECPKPARAMETERS),
-# endif
+#endif
 #endif
     ASN1_ITEM_ref(EDIPARTYNAME),
     ASN1_ITEM_ref(EXTENDED_KEY_USAGE),
diff --git a/crypto/openssl/crypto/asn1/asn1_lib.c b/crypto/openssl/crypto/asn1/asn1_lib.c
index e3a8480eef3f..ae234bb5ea46 100644
--- a/crypto/openssl/crypto/asn1/asn1_lib.c
+++ b/crypto/openssl/crypto/asn1/asn1_lib.c
@@ -14,7 +14,7 @@
 #include "asn1_local.h"
 
 static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
-                           long max);
+    long max);
 static void asn1_put_length(unsigned char **pp, int length);
 
 static int _asn1_check_infinite_end(const unsigned char **p, long len)
@@ -44,7 +44,7 @@ int ASN1_const_check_infinite_end(const unsigned char **p, long len)
 }
 
 int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
-                    int *pclass, long omax)
+    int *pclass, long omax)
 {
     int i, ret;
     long len;
@@ -101,7 +101,7 @@ int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
     }
     *pp = p;
     return ret | inf;
- err:
+err:
     ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
     return 0x80;
 }
@@ -114,7 +114,7 @@ int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
  * are stored most significant digit first.
  */
 static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
-                           long max)
+    long max)
 {
     const unsigned char *p = *pp;
     unsigned long ret = 0;
@@ -158,7 +158,7 @@ static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
  * constructed == 2 for indefinite length constructed
  */
 void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
-                     int xclass)
+    int xclass)
 {
     unsigned char *p = *pp;
     int i, ttag;
@@ -433,7 +433,7 @@ unsigned char *ASN1_STRING_data(ASN1_STRING *x)
 
 /* |max_len| excludes NUL terminator and may be 0 to indicate no restriction */
 char *ossl_sk_ASN1_UTF8STRING2text(STACK_OF(ASN1_UTF8STRING) *text,
-                                   const char *sep, size_t max_len)
+    const char *sep, size_t max_len)
 {
     int i;
     ASN1_UTF8STRING *current;
diff --git a/crypto/openssl/crypto/asn1/asn1_local.h b/crypto/openssl/crypto/asn1/asn1_local.h
index 10e9fcb7de45..fe9228977df8 100644
--- a/crypto/openssl/crypto/asn1/asn1_local.h
+++ b/crypto/openssl/crypto/asn1/asn1_local.h
@@ -37,10 +37,10 @@ struct asn1_sctx_st {
     /* The field value itself */
     ASN1_VALUE **field;
     /* Callback to pass information to */
-    int (*scan_cb) (ASN1_SCTX *ctx);
+    int (*scan_cb)(ASN1_SCTX *ctx);
     /* Context specific application data */
     void *app_data;
-} /* ASN1_SCTX */ ;
+} /* ASN1_SCTX */;
 
 typedef struct mime_param_st MIME_PARAM;
 DEFINE_STACK_OF(MIME_PARAM)
@@ -51,46 +51,46 @@ void ossl_asn1_string_embed_free(ASN1_STRING *a, int embed);
 
 int ossl_asn1_get_choice_selector(ASN1_VALUE **pval, const ASN1_ITEM *it);
 int ossl_asn1_get_choice_selector_const(const ASN1_VALUE **pval,
-                                        const ASN1_ITEM *it);
+    const ASN1_ITEM *it);
 int ossl_asn1_set_choice_selector(ASN1_VALUE **pval, int value,
-                                  const ASN1_ITEM *it);
+    const ASN1_ITEM *it);
 
 ASN1_VALUE **ossl_asn1_get_field_ptr(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
 const ASN1_VALUE **ossl_asn1_get_const_field_ptr(const ASN1_VALUE **pval,
-                                                 const ASN1_TEMPLATE *tt);
+    const ASN1_TEMPLATE *tt);
 
 const ASN1_TEMPLATE *ossl_asn1_do_adb(const ASN1_VALUE *val,
-                                      const ASN1_TEMPLATE *tt,
-                                      int nullerr);
+    const ASN1_TEMPLATE *tt,
+    int nullerr);
 
 int ossl_asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM *it);
 
 void ossl_asn1_enc_init(ASN1_VALUE **pval, const ASN1_ITEM *it);
 void ossl_asn1_enc_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 int ossl_asn1_enc_restore(int *len, unsigned char **out, const ASN1_VALUE **pval,
-                          const ASN1_ITEM *it);
+    const ASN1_ITEM *it);
 int ossl_asn1_enc_save(ASN1_VALUE **pval, const unsigned char *in, int inlen,
-                       const ASN1_ITEM *it);
+    const ASN1_ITEM *it);
 
 void ossl_asn1_item_embed_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed);
 void ossl_asn1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed);
 void ossl_asn1_template_free(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
 
 ASN1_OBJECT *ossl_c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
-                                  long length);
+    long length);
 int ossl_i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp);
 ASN1_BIT_STRING *ossl_c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
-                                          const unsigned char **pp, long length);
+    const unsigned char **pp, long length);
 int ossl_i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp);
 ASN1_INTEGER *ossl_c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp,
-                                    long length);
+    long length);
 
 /* Internal functions used by x_int64.c */
 int ossl_c2i_uint64_int(uint64_t *ret, int *neg, const unsigned char **pp,
-                        long len);
+    long len);
 int ossl_i2c_uint64_int(unsigned char *p, uint64_t r, int neg);
 
 ASN1_TIME *ossl_asn1_time_from_tm(ASN1_TIME *s, struct tm *ts, int type);
 
 int ossl_asn1_item_ex_new_intern(ASN1_VALUE **pval, const ASN1_ITEM *it,
-                                 OSSL_LIB_CTX *libctx, const char *propq);
+    OSSL_LIB_CTX *libctx, const char *propq);
diff --git a/crypto/openssl/crypto/asn1/asn1_parse.c b/crypto/openssl/crypto/asn1/asn1_parse.c
index 6a4618d253d5..4feb161e33b1 100644
--- a/crypto/openssl/crypto/asn1/asn1_parse.c
+++ b/crypto/openssl/crypto/asn1/asn1_parse.c
@@ -18,9 +18,9 @@
 #endif
 
 static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
-                       int offset, int depth, int indent, int dump);
+    int offset, int depth, int indent, int dump);
 static int asn1_print_info(BIO *bp, long offset, int depth, int hl, long len,
-                           int tag, int xclass, int constructed, int indent)
+    int tag, int xclass, int constructed, int indent)
 {
     char str[128];
     const char *p;
@@ -35,17 +35,19 @@ static int asn1_print_info(BIO *bp, long offset, int depth, int hl, long len,
         p = "prim: ";
     if (constructed != (V_ASN1_CONSTRUCTED | 1)) {
         if (BIO_snprintf(str, sizeof(str), "%5ld:d=%-2d hl=%ld l=%4ld %s",
-                         offset, depth, (long)hl, len, p) <= 0)
+                offset, depth, (long)hl, len, p)
+            <= 0)
             goto err;
     } else {
         if (BIO_snprintf(str, sizeof(str), "%5ld:d=%-2d hl=%ld l=inf  %s",
-                         offset, depth, (long)hl, p) <= 0)
+                offset, depth, (long)hl, p)
+            <= 0)
             goto err;
     }
     if (bp != NULL) {
         if (BIO_set_prefix(bp, str) <= 0) {
             if ((bio = BIO_new(BIO_f_prefix())) == NULL
-                    || (bp = BIO_push(bio, bp)) == NULL)
+                || (bp = BIO_push(bio, bp)) == NULL)
                 goto err;
             pop_f_prefix = 1;
         }
@@ -71,7 +73,7 @@ static int asn1_print_info(BIO *bp, long offset, int depth, int hl, long len,
         p = ASN1_tag2str(tag);
 
     i = (BIO_printf(bp, "%-18s", p) > 0);
- err:
+err:
     if (saved_indent >= 0)
         BIO_set_indent(bp, saved_indent);
     if (pop_f_prefix)
@@ -86,13 +88,13 @@ int ASN1_parse(BIO *bp, const unsigned char *pp, long len, int indent)
 }
 
 int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent,
-                    int dump)
+    int dump)
 {
     return asn1_parse2(bp, &pp, len, 0, 0, indent, dump);
 }
 
 static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
-                       int offset, int depth, int indent, int dump)
+    int offset, int depth, int indent, int dump)
 {
     const unsigned char *p, *ep, *tot, *op, *opp;
     long len;
@@ -110,7 +112,7 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
         return 0;
     }
 
-    dump_indent = 6;            /* Because we know BIO_dump_indent() */
+    dump_indent = 6; /* Because we know BIO_dump_indent() */
     p = *pp;
     tot = p + length;
     while (length > 0) {
@@ -126,7 +128,7 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
          * if j == 0x21 it is a constructed indefinite length object
          */
         if (!asn1_print_info(bp, (long)offset + (long)(op - *pp), depth,
-                             hl, len, tag, xclass, j, (indent) ? depth : 0))
+                hl, len, tag, xclass, j, (indent) ? depth : 0))
             goto end;
         if (j & V_ASN1_CONSTRUCTED) {
             const unsigned char *sp = p;
@@ -141,8 +143,8 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
             if ((j == 0x21) && (len == 0)) {
                 for (;;) {
                     r = asn1_parse2(bp, &p, (long)(tot - p),
-                                    offset + (p - *pp), depth + 1,
-                                    indent, dump);
+                        offset + (p - *pp), depth + 1,
+                        indent, dump);
                     if (r == 0)
                         goto end;
                     if ((r == 2) || (p >= tot)) {
@@ -156,8 +158,8 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
                 while (p < ep) {
                     sp = p;
                     r = asn1_parse2(bp, &p, tmp,
-                                    offset + (p - *pp), depth + 1,
-                                    indent, dump);
+                        offset + (p - *pp), depth + 1,
+                        indent, dump);
                     if (r == 0)
                         goto end;
                     tmp -= p - sp;
@@ -169,17 +171,10 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
                 goto end;
         } else {
             nl = 0;
-            if ((tag == V_ASN1_PRINTABLESTRING) ||
-                (tag == V_ASN1_T61STRING) ||
-                (tag == V_ASN1_IA5STRING) ||
-                (tag == V_ASN1_VISIBLESTRING) ||
-                (tag == V_ASN1_NUMERICSTRING) ||
-                (tag == V_ASN1_UTF8STRING) ||
-                (tag == V_ASN1_UTCTIME) || (tag == V_ASN1_GENERALIZEDTIME)) {
+            if ((tag == V_ASN1_PRINTABLESTRING) || (tag == V_ASN1_T61STRING) || (tag == V_ASN1_IA5STRING) || (tag == V_ASN1_VISIBLESTRING) || (tag == V_ASN1_NUMERICSTRING) || (tag == V_ASN1_UTF8STRING) || (tag == V_ASN1_UTCTIME) || (tag == V_ASN1_GENERALIZEDTIME)) {
                 if (BIO_write(bp, ":", 1) <= 0)
                     goto end;
-                if ((len > 0) && BIO_write(bp, (const char *)p, (int)len)
-                    != (int)len)
+                if ((len > 0) && BIO_write(bp, (const char *)p, (int)len) != (int)len)
                     goto end;
             } else if (tag == V_ASN1_OBJECT) {
                 opp = op;
@@ -213,25 +208,22 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
                      * testing whether the octet string is printable
                      */
                     for (i = 0; i < os->length; i++) {
-                        if (((opp[i] < ' ') &&
-                             (opp[i] != '\n') &&
-                             (opp[i] != '\r') &&
-                             (opp[i] != '\t')) || (opp[i] > '~')) {
+                        if (((opp[i] < ' ') && (opp[i] != '\n') && (opp[i] != '\r') && (opp[i] != '\t')) || (opp[i] > '~')) {
                             printable = 0;
                             break;
                         }
                     }
                     if (printable)
-                        /* printable string */
+                    /* printable string */
                     {
                         if (BIO_write(bp, ":", 1) <= 0)
                             goto end;
                         if (BIO_write(bp, (const char *)opp, os->length) <= 0)
                             goto end;
                     } else if (!dump)
-                        /*
-                         * not printable => print octet string as hex dump
-                         */
+                    /*
+                     * not printable => print octet string as hex dump
+                     */
                     {
                         if (BIO_write(bp, "[HEX DUMP]:", 11) <= 0)
                             goto end;
@@ -240,18 +232,17 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
                                 goto end;
                         }
                     } else
-                        /* print the normal dump */
+                    /* print the normal dump */
                     {
                         if (!nl) {
                             if (BIO_write(bp, "\n", 1) <= 0)
                                 goto end;
                         }
                         if (BIO_dump_indent(bp,
-                                            (const char *)opp,
-                                            ((dump == -1 || dump >
-                                              os->
-                                              length) ? os->length : dump),
-                                            dump_indent) <= 0)
+                                (const char *)opp,
+                                ((dump == -1 || dump > os->length) ? os->length : dump),
+                                dump_indent)
+                            <= 0)
                             goto end;
                         nl = 1;
                     }
@@ -316,8 +307,9 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
                         goto end;
                 }
                 if (BIO_dump_indent(bp, (const char *)p,
-                                    ((dump == -1 || dump > len) ? len : dump),
-                                    dump_indent) <= 0)
+                        ((dump == -1 || dump > len) ? len : dump),
+                        dump_indent)
+                    <= 0)
                     goto end;
                 nl = 1;
             }
@@ -341,14 +333,14 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
             }
             p += len;
             if ((tag == V_ASN1_EOC) && (xclass == 0)) {
-                ret = 2;        /* End of sequence */
+                ret = 2; /* End of sequence */
                 goto end;
             }
         }
         length -= len;
     }
     ret = 1;
- end:
+end:
     ASN1_OBJECT_free(o);
     ASN1_OCTET_STRING_free(os);
     ASN1_INTEGER_free(ai);
diff --git a/crypto/openssl/crypto/asn1/asn_mime.c b/crypto/openssl/crypto/asn1/asn_mime.c
index 9afe249965e9..212c34f4bc0f 100644
--- a/crypto/openssl/crypto/asn1/asn_mime.c
+++ b/crypto/openssl/crypto/asn1/asn_mime.c
@@ -30,18 +30,18 @@
  */
 
 struct mime_param_st {
-    char *param_name;           /* Param name e.g. "micalg" */
-    char *param_value;          /* Param value e.g. "sha1" */
+    char *param_name; /* Param name e.g. "micalg" */
+    char *param_value; /* Param value e.g. "sha1" */
 };
 
 struct mime_header_st {
-    char *name;                 /* Name of line e.g. "content-type" */
-    char *value;                /* Value of line e.g. "text/plain" */
+    char *name; /* Name of line e.g. "content-type" */
+    char *value; /* Value of line e.g. "text/plain" */
     STACK_OF(MIME_PARAM) *params; /* Zero or more parameters */
 };
 
 static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
-                            const ASN1_ITEM *it);
+    const ASN1_ITEM *it);
 static char *strip_ends(char *name);
 static char *strip_start(char *name);
 static char *strip_end(char *name);
@@ -49,9 +49,9 @@ static MIME_HEADER *mime_hdr_new(const char *name, const char *value);
 static int mime_hdr_addparam(MIME_HEADER *mhdr, const char *name, const char *value);
 static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio);
 static int mime_hdr_cmp(const MIME_HEADER *const *a,
-                        const MIME_HEADER *const *b);
+    const MIME_HEADER *const *b);
 static int mime_param_cmp(const MIME_PARAM *const *a,
-                          const MIME_PARAM *const *b);
+    const MIME_PARAM *const *b);
 static void mime_param_free(MIME_PARAM *param);
 static int mime_bound_check(char *line, int linelen, const char *bound, int blen);
 static int multi_split(BIO *bio, int flags, const char *bound, STACK_OF(BIO) **ret);
@@ -61,13 +61,13 @@ static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, const char *name);
 static void mime_hdr_free(MIME_HEADER *hdr);
 
 #define MAX_SMLEN 1024
-#define mime_debug(x)           /* x */
+#define mime_debug(x) /* x */
 
 /* Output an ASN1 structure in BER format streaming if necessary */
 
 /* unfortunately cannot constify this due to CMS_stream() and PKCS7_stream() */
 int i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-                        const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     int rv = 1;
 
@@ -103,7 +103,7 @@ int i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
 /* Base 64 read and write of ASN1 structure */
 
 static int B64_write_ASN1(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-                          const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     BIO *b64;
     int r;
@@ -126,7 +126,7 @@ static int B64_write_ASN1(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
 /* Streaming ASN1 PEM write */
 
 int PEM_write_bio_ASN1_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-                              const char *hdr, const ASN1_ITEM *it)
+    const char *hdr, const ASN1_ITEM *it)
 {
     int r;
     BIO_printf(out, "-----BEGIN %s-----\n", hdr);
@@ -136,7 +136,7 @@ int PEM_write_bio_ASN1_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
 }
 
 static ASN1_VALUE *b64_read_asn1(BIO *bio, const ASN1_ITEM *it, ASN1_VALUE **x,
-                                 OSSL_LIB_CTX *libctx, const char *propq)
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     BIO *b64;
     ASN1_VALUE *val;
@@ -235,23 +235,21 @@ static int asn1_write_micalg(BIO *out, STACK_OF(X509_ALGOR) *mdalgs)
                 have_unknown = 1;
             }
             break;
-
         }
     }
 
     ret = 1;
- err:
+err:
 
     return ret;
-
 }
 
 /* SMIME sender */
 
 int SMIME_write_ASN1_ex(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
-                        int ctype_nid, int econt_nid,
-                        STACK_OF(X509_ALGOR) *mdalgs, const ASN1_ITEM *it,
-                        OSSL_LIB_CTX *libctx, const char *propq)
+    int ctype_nid, int econt_nid,
+    STACK_OF(X509_ALGOR) *mdalgs, const ASN1_ITEM *it,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     char bound[33], c;
     int i;
@@ -288,9 +286,9 @@ int SMIME_write_ASN1_ex(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
         if (!asn1_write_micalg(bio, mdalgs))
             return 0;
         BIO_printf(bio, "\"; boundary=\"----%s\"%s%s",
-                   bound, mime_eol, mime_eol);
+            bound, mime_eol, mime_eol);
         BIO_printf(bio, "This is an S/MIME signed message%s%s",
-                   mime_eol, mime_eol);
+            mime_eol, mime_eol);
         /* Now write out the first part */
         BIO_printf(bio, "------%s%s", bound, mime_eol);
         if (!asn1_output_data(bio, data, val, flags, it))
@@ -306,7 +304,7 @@ int SMIME_write_ASN1_ex(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
         BIO_printf(bio, " filename=\"smime.p7s\"%s%s", mime_eol, mime_eol);
         B64_write_ASN1(bio, val, NULL, 0, it);
         BIO_printf(bio, "%s------%s--%s%s", mime_eol, bound,
-                   mime_eol, mime_eol);
+            mime_eol, mime_eol);
         return 1;
     }
 
@@ -336,7 +334,7 @@ int SMIME_write_ASN1_ex(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
         BIO_printf(bio, " smime-type=%s;", msg_type);
     BIO_printf(bio, " name=\"%s\"%s", cname, mime_eol);
     BIO_printf(bio, "Content-Transfer-Encoding: base64%s%s",
-               mime_eol, mime_eol);
+        mime_eol, mime_eol);
     if (!B64_write_ASN1(bio, val, data, flags, it))
         return 0;
     BIO_printf(bio, "%s", mime_eol);
@@ -344,18 +342,18 @@ int SMIME_write_ASN1_ex(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
 }
 
 int SMIME_write_ASN1(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
-                     int ctype_nid, int econt_nid,
-                     STACK_OF(X509_ALGOR) *mdalgs, const ASN1_ITEM *it)
+    int ctype_nid, int econt_nid,
+    STACK_OF(X509_ALGOR) *mdalgs, const ASN1_ITEM *it)
 {
     return SMIME_write_ASN1_ex(bio, val, data, flags, ctype_nid, econt_nid,
-                               mdalgs, it, NULL, NULL);
+        mdalgs, it, NULL, NULL);
 }
 
 /* Handle output of ASN1 data */
 
 /* cannot constify val because of CMS_dataFinal() */
 static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
-                            const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     BIO *tmpbio;
     const ASN1_AUX *aux = it->funcs;
@@ -401,7 +399,6 @@ static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
     }
 
     return rv;
-
 }
 
 /*
@@ -411,8 +408,8 @@ static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
  */
 
 ASN1_VALUE *SMIME_read_ASN1_ex(BIO *bio, int flags, BIO **bcont,
-                               const ASN1_ITEM *it, ASN1_VALUE **x,
-                               OSSL_LIB_CTX *libctx, const char *propq)
+    const ASN1_ITEM *it, ASN1_VALUE **x,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     BIO *asnin;
     STACK_OF(MIME_HEADER) *headers = NULL;
@@ -474,10 +471,9 @@ ASN1_VALUE *SMIME_read_ASN1_ex(BIO *bio, int flags, BIO **bcont,
             return NULL;
         }
 
-        if (strcmp(hdr->value, "application/x-pkcs7-signature") &&
-            strcmp(hdr->value, "application/pkcs7-signature")) {
+        if (strcmp(hdr->value, "application/x-pkcs7-signature") && strcmp(hdr->value, "application/pkcs7-signature")) {
             ERR_raise_data(ERR_LIB_ASN1, ASN1_R_SIG_INVALID_MIME_TYPE,
-                           "type: %s", hdr->value);
+                "type: %s", hdr->value);
             sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
             sk_BIO_pop_free(parts, BIO_vfree);
             return NULL;
@@ -502,10 +498,9 @@ ASN1_VALUE *SMIME_read_ASN1_ex(BIO *bio, int flags, BIO **bcont,
 
     /* OK, if not multipart/signed try opaque signature */
 
-    if (strcmp(hdr->value, "application/x-pkcs7-mime") &&
-        strcmp(hdr->value, "application/pkcs7-mime")) {
+    if (strcmp(hdr->value, "application/x-pkcs7-mime") && strcmp(hdr->value, "application/pkcs7-mime")) {
         ERR_raise_data(ERR_LIB_ASN1, ASN1_R_INVALID_MIME_TYPE,
-                       "type: %s", hdr->value);
+            "type: %s", hdr->value);
         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
         return NULL;
     }
@@ -604,7 +599,7 @@ int SMIME_text(BIO *in, BIO *out)
     }
     if (strcmp(hdr->value, "text/plain")) {
         ERR_raise_data(ERR_LIB_ASN1, ASN1_R_INVALID_MIME_TYPE,
-                       "type: %s", hdr->value);
+            "type: %s", hdr->value);
         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
         return 0;
     }
@@ -670,7 +665,7 @@ static int multi_split(BIO *bio, int flags, const char *bound, STACK_OF(BIO) **r
 #else
                     1
 #endif
-                        || (flags & SMIME_CRLFEOL) != 0)
+                    || (flags & SMIME_CRLFEOL) != 0)
                     BIO_write(bpart, "\r\n", 2);
                 else
                     BIO_write(bpart, "\n", 1);
@@ -686,13 +681,13 @@ static int multi_split(BIO *bio, int flags, const char *bound, STACK_OF(BIO) **r
 
 /* This is the big one: parse MIME header lines up to message body */
 
-#define MIME_INVALID    0
-#define MIME_START      1
-#define MIME_TYPE       2
-#define MIME_NAME       3
-#define MIME_VALUE      4
-#define MIME_QUOTE      5
-#define MIME_COMMENT    6
+#define MIME_INVALID 0
+#define MIME_START 1
+#define MIME_TYPE 2
+#define MIME_NAME 3
+#define MIME_VALUE 4
+#define MIME_QUOTE 5
+#define MIME_COMMENT 6
 
 static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio)
 {
@@ -715,7 +710,7 @@ static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio)
         ntmp = NULL;
         /* Go through all characters */
         for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
-             p++) {
+            p++) {
 
             /*
              * State machine to handle MIME headers if this looks horrible
@@ -804,18 +799,18 @@ static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio)
             mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
         }
         if (p == linebuf)
-            break;              /* Blank line means end of headers */
+            break; /* Blank line means end of headers */
     }
 
     /* Sort the headers and their params for faster searching */
     sk_MIME_HEADER_sort(headers);
     for (i = 0; i < sk_MIME_HEADER_num(headers); i++)
         if ((mhdr = sk_MIME_HEADER_value(headers, i)) != NULL
-                && mhdr->params != NULL)
+            && mhdr->params != NULL)
             sk_MIME_PARAM_sort(mhdr->params);
     return headers;
 
- err:
+err:
     mime_hdr_free(new_hdr);
     sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
     return NULL;
@@ -894,7 +889,7 @@ static MIME_HEADER *mime_hdr_new(const char *name, const char *value)
         goto err;
     return mhdr;
 
- err:
+err:
     OPENSSL_free(tmpname);
     OPENSSL_free(tmpval);
     OPENSSL_free(mhdr);
@@ -927,7 +922,7 @@ static int mime_hdr_addparam(MIME_HEADER *mhdr, const char *name, const char *va
     if (!sk_MIME_PARAM_push(mhdr->params, mparam))
         goto err;
     return 1;
- err:
+err:
     OPENSSL_free(tmpname);
     OPENSSL_free(tmpval);
     OPENSSL_free(mparam);
@@ -935,7 +930,7 @@ static int mime_hdr_addparam(MIME_HEADER *mhdr, const char *name, const char *va
 }
 
 static int mime_hdr_cmp(const MIME_HEADER *const *a,
-                        const MIME_HEADER *const *b)
+    const MIME_HEADER *const *b)
 {
     if ((*a)->name == NULL || (*b)->name == NULL)
         return ((*a)->name != NULL) - ((*b)->name != NULL);
@@ -944,7 +939,7 @@ static int mime_hdr_cmp(const MIME_HEADER *const *a,
 }
 
 static int mime_param_cmp(const MIME_PARAM *const *a,
-                          const MIME_PARAM *const *b)
+    const MIME_PARAM *const *b)
 {
     if ((*a)->param_name == NULL || (*b)->param_name == NULL)
         return ((*a)->param_name != NULL) - ((*b)->param_name != NULL);
diff --git a/crypto/openssl/crypto/asn1/asn_mstbl.c b/crypto/openssl/crypto/asn1/asn_mstbl.c
index b9309576559b..cc9dba8e0318 100644
--- a/crypto/openssl/crypto/asn1/asn_mstbl.c
+++ b/crypto/openssl/crypto/asn1/asn_mstbl.c
@@ -96,19 +96,19 @@ static int do_tcreate(const char *value, const char *name)
             goto err;
     }
     rv = 1;
- err:
+err:
     if (rv == 0) {
         if (cnf)
             ERR_raise_data(ERR_LIB_ASN1, ASN1_R_INVALID_STRING_TABLE_VALUE,
-                           "field=%s, value=%s", cnf->name,
-                                                 cnf->value != NULL ? cnf->value
-                                                 : value);
+                "field=%s, value=%s", cnf->name,
+                cnf->value != NULL ? cnf->value
+                                   : value);
         else
             ERR_raise_data(ERR_LIB_ASN1, ASN1_R_INVALID_STRING_TABLE_VALUE,
-                           "name=%s, value=%s", name, value);
+                "name=%s, value=%s", name, value);
     } else {
         rv = ASN1_STRING_TABLE_add(nid, tbl_min, tbl_max,
-                                   tbl_mask, tbl_flags);
+            tbl_mask, tbl_flags);
         if (!rv)
             ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
     }
diff --git a/crypto/openssl/crypto/asn1/asn_pack.c b/crypto/openssl/crypto/asn1/asn_pack.c
index 54f4ae3a67b2..e8b93030a283 100644
--- a/crypto/openssl/crypto/asn1/asn_pack.c
+++ b/crypto/openssl/crypto/asn1/asn_pack.c
@@ -41,7 +41,7 @@ ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_STRING **oct)
         *oct = octmp;
 
     return octmp;
- err:
+err:
     if (oct == NULL || *oct == NULL)
         ASN1_STRING_free(octmp);
     return NULL;
@@ -61,14 +61,15 @@ void *ASN1_item_unpack(const ASN1_STRING *oct, const ASN1_ITEM *it)
 }
 
 void *ASN1_item_unpack_ex(const ASN1_STRING *oct, const ASN1_ITEM *it,
-                          OSSL_LIB_CTX *libctx, const char *propq)
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     const unsigned char *p;
     void *ret;
 
     p = oct->data;
-    if ((ret = ASN1_item_d2i_ex(NULL, &p, oct->length, it,\
-                                libctx, propq)) == NULL)
+    if ((ret = ASN1_item_d2i_ex(NULL, &p, oct->length, it,
+             libctx, propq))
+        == NULL)
         ERR_raise(ERR_LIB_ASN1, ASN1_R_DECODE_ERROR);
     return ret;
 }
diff --git a/crypto/openssl/crypto/asn1/bio_asn1.c b/crypto/openssl/crypto/asn1/bio_asn1.c
index f1499425010d..a5f423b41cf5 100644
--- a/crypto/openssl/crypto/asn1/bio_asn1.c
+++ b/crypto/openssl/crypto/asn1/bio_asn1.c
@@ -70,11 +70,11 @@ static long asn1_bio_callback_ctrl(BIO *h, int cmd, BIO_info_cb *fp);
 
 static int asn1_bio_init(BIO_ASN1_BUF_CTX *ctx, int size);
 static int asn1_bio_flush_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx,
-                             asn1_ps_func *cleanup, asn1_bio_state_t next);
+    asn1_ps_func *cleanup, asn1_bio_state_t next);
 static int asn1_bio_setup_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx,
-                             asn1_ps_func *setup,
-                             asn1_bio_state_t ex_state,
-                             asn1_bio_state_t other_state);
+    asn1_ps_func *setup,
+    asn1_bio_state_t ex_state,
+    asn1_bio_state_t other_state);
 
 static const BIO_METHOD methods_asn1 = {
     BIO_TYPE_ASN1,
@@ -171,7 +171,7 @@ static int asn1_bio_write(BIO *b, const char *in, int inl)
             /* Setup prefix data, call it */
         case ASN1_STATE_START:
             if (!asn1_bio_setup_ex(b, ctx, ctx->prefix,
-                                   ASN1_STATE_PRE_COPY, ASN1_STATE_HEADER))
+                    ASN1_STATE_PRE_COPY, ASN1_STATE_HEADER))
                 return -1;
             break;
 
@@ -179,7 +179,7 @@ static int asn1_bio_write(BIO *b, const char *in, int inl)
         case ASN1_STATE_PRE_COPY:
 
             ret = asn1_bio_flush_ex(b, ctx, ctx->prefix_free,
-                                    ASN1_STATE_HEADER);
+                ASN1_STATE_HEADER);
 
             if (ret <= 0)
                 goto done;
@@ -238,21 +238,18 @@ static int asn1_bio_write(BIO *b, const char *in, int inl)
         case ASN1_STATE_DONE:
             BIO_clear_retry_flags(b);
             return 0;
-
         }
-
     }
 
- done:
+done:
     BIO_clear_retry_flags(b);
     BIO_copy_next_retry(b);
 
     return (wrlen > 0) ? wrlen : ret;
-
 }
 
 static int asn1_bio_flush_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx,
-                             asn1_ps_func *cleanup, asn1_bio_state_t next)
+    asn1_ps_func *cleanup, asn1_bio_state_t next)
 {
     int ret;
 
@@ -277,9 +274,9 @@ static int asn1_bio_flush_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx,
 }
 
 static int asn1_bio_setup_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx,
-                             asn1_ps_func *setup,
-                             asn1_bio_state_t ex_state,
-                             asn1_bio_state_t other_state)
+    asn1_ps_func *setup,
+    asn1_bio_state_t ex_state,
+    asn1_bio_state_t other_state)
 {
     if (setup && !setup(b, &ctx->ex_buf, &ctx->ex_len, &ctx->ex_arg)) {
         BIO_clear_retry_flags(b);
@@ -373,13 +370,13 @@ static long asn1_bio_ctrl(BIO *b, int cmd, long arg1, void *arg2)
         /* Call post function if possible */
         if (ctx->state == ASN1_STATE_HEADER) {
             if (!asn1_bio_setup_ex(b, ctx, ctx->suffix,
-                                   ASN1_STATE_POST_COPY, ASN1_STATE_DONE))
+                    ASN1_STATE_POST_COPY, ASN1_STATE_DONE))
                 return 0;
         }
 
         if (ctx->state == ASN1_STATE_POST_COPY) {
             ret = asn1_bio_flush_ex(b, ctx, ctx->suffix_free,
-                                    ASN1_STATE_DONE);
+                ASN1_STATE_DONE);
             if (ret <= 0)
                 return ret;
         }
@@ -395,14 +392,13 @@ static long asn1_bio_ctrl(BIO *b, int cmd, long arg1, void *arg2)
         if (next == NULL)
             return 0;
         return BIO_ctrl(next, cmd, arg1, arg2);
-
     }
 
     return ret;
 }
 
 static int asn1_bio_set_ex(BIO *b, int cmd,
-                           asn1_ps_func *ex_func, asn1_ps_func *ex_free_func)
+    asn1_ps_func *ex_func, asn1_ps_func *ex_free_func)
 {
     BIO_ASN1_EX_FUNCS extmp;
     extmp.ex_func = ex_func;
@@ -411,8 +407,8 @@ static int asn1_bio_set_ex(BIO *b, int cmd,
 }
 
 static int asn1_bio_get_ex(BIO *b, int cmd,
-                           asn1_ps_func **ex_func,
-                           asn1_ps_func **ex_free_func)
+    asn1_ps_func **ex_func,
+    asn1_ps_func **ex_free_func)
 {
     BIO_ASN1_EX_FUNCS extmp;
     int ret;
@@ -425,25 +421,25 @@ static int asn1_bio_get_ex(BIO *b, int cmd,
 }
 
 int BIO_asn1_set_prefix(BIO *b, asn1_ps_func *prefix,
-                        asn1_ps_func *prefix_free)
+    asn1_ps_func *prefix_free)
 {
     return asn1_bio_set_ex(b, BIO_C_SET_PREFIX, prefix, prefix_free);
 }
 
 int BIO_asn1_get_prefix(BIO *b, asn1_ps_func **pprefix,
-                        asn1_ps_func **pprefix_free)
+    asn1_ps_func **pprefix_free)
 {
     return asn1_bio_get_ex(b, BIO_C_GET_PREFIX, pprefix, pprefix_free);
 }
 
 int BIO_asn1_set_suffix(BIO *b, asn1_ps_func *suffix,
-                        asn1_ps_func *suffix_free)
+    asn1_ps_func *suffix_free)
 {
     return asn1_bio_set_ex(b, BIO_C_SET_SUFFIX, suffix, suffix_free);
 }
 
 int BIO_asn1_get_suffix(BIO *b, asn1_ps_func **psuffix,
-                        asn1_ps_func **psuffix_free)
+    asn1_ps_func **psuffix_free)
 {
     return asn1_bio_get_ex(b, BIO_C_GET_SUFFIX, psuffix, psuffix_free);
 }
diff --git a/crypto/openssl/crypto/asn1/bio_ndef.c b/crypto/openssl/crypto/asn1/bio_ndef.c
index 279609e60354..62d936d76b11 100644
--- a/crypto/openssl/crypto/asn1/bio_ndef.c
+++ b/crypto/openssl/crypto/asn1/bio_ndef.c
@@ -44,10 +44,10 @@ typedef struct ndef_aux_st {
 
 static int ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg);
 static int ndef_prefix_free(BIO *b, unsigned char **pbuf, int *plen,
-                            void *parg);
+    void *parg);
 static int ndef_suffix(BIO *b, unsigned char **pbuf, int *plen, void *parg);
 static int ndef_suffix_free(BIO *b, unsigned char **pbuf, int *plen,
-                            void *parg);
+    void *parg);
 
 /*
  * On success, the returned BIO owns the input BIO as part of its BIO chain.
@@ -79,8 +79,8 @@ BIO *BIO_new_NDEF(BIO *out, ASN1_VALUE *val, const ASN1_ITEM *it)
     pop_bio = asn_bio;
 
     if (BIO_asn1_set_prefix(asn_bio, ndef_prefix, ndef_prefix_free) <= 0
-            || BIO_asn1_set_suffix(asn_bio, ndef_suffix, ndef_suffix_free) <= 0
-            || BIO_ctrl(asn_bio, BIO_C_SET_EX_ARG, 0, ndef_aux) <= 0)
+        || BIO_asn1_set_suffix(asn_bio, ndef_suffix, ndef_suffix_free) <= 0
+        || BIO_ctrl(asn_bio, BIO_C_SET_EX_ARG, 0, ndef_aux) <= 0)
         goto err;
 
     /*
@@ -118,7 +118,7 @@ BIO *BIO_new_NDEF(BIO *out, ASN1_VALUE *val, const ASN1_ITEM *it)
 
     return sarg.ndef_bio;
 
- err:
+err:
     /* BIO_pop() is NULL safe */
     (void)BIO_pop(pop_bio);
     BIO_free(asn_bio);
@@ -156,7 +156,7 @@ static int ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg)
 }
 
 static int ndef_prefix_free(BIO *b, unsigned char **pbuf, int *plen,
-                            void *parg)
+    void *parg)
 {
     NDEF_SUPPORT *ndef_aux;
 
@@ -177,7 +177,7 @@ static int ndef_prefix_free(BIO *b, unsigned char **pbuf, int *plen,
 }
 
 static int ndef_suffix_free(BIO *b, unsigned char **pbuf, int *plen,
-                            void *parg)
+    void *parg)
 {
     NDEF_SUPPORT **pndef_aux = (NDEF_SUPPORT **)parg;
     if (!ndef_prefix_free(b, pbuf, plen, parg))
@@ -207,7 +207,8 @@ static int ndef_suffix(BIO *b, unsigned char **pbuf, int *plen, void *parg)
     sarg.out = ndef_aux->out;
     sarg.boundary = ndef_aux->boundary;
     if (aux->asn1_cb(ASN1_OP_STREAM_POST,
-                     &ndef_aux->val, ndef_aux->it, &sarg) <= 0)
+            &ndef_aux->val, ndef_aux->it, &sarg)
+        <= 0)
         return 0;
 
     derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
diff --git a/crypto/openssl/crypto/asn1/d2i_param.c b/crypto/openssl/crypto/asn1/d2i_param.c
index 1a0e2bfe6da4..ac76c57b68c3 100644
--- a/crypto/openssl/crypto/asn1/d2i_param.c
+++ b/crypto/openssl/crypto/asn1/d2i_param.c
@@ -16,7 +16,7 @@
 #include "crypto/evp.h"
 
 EVP_PKEY *d2i_KeyParams(int type, EVP_PKEY **a, const unsigned char **pp,
-                        long length)
+    long length)
 {
     EVP_PKEY *ret = NULL;
 
diff --git a/crypto/openssl/crypto/asn1/d2i_pr.c b/crypto/openssl/crypto/asn1/d2i_pr.c
index 7f68e5732800..2546050c6af6 100644
--- a/crypto/openssl/crypto/asn1/d2i_pr.c
+++ b/crypto/openssl/crypto/asn1/d2i_pr.c
@@ -27,7 +27,7 @@
 
 static EVP_PKEY *
 d2i_PrivateKey_decoder(int keytype, EVP_PKEY **a, const unsigned char **pp,
-                       long length, OSSL_LIB_CTX *libctx, const char *propq)
+    long length, OSSL_LIB_CTX *libctx, const char *propq)
 {
     OSSL_DECODER_CTX *dctx = NULL;
     size_t len = length;
@@ -63,8 +63,8 @@ d2i_PrivateKey_decoder(int keytype, EVP_PKEY **a, const unsigned char **pp,
             return NULL;
         }
         if (key_name == NULL
-                && PKCS8_pkey_get0(&algoid, NULL, NULL, NULL, p8info)
-                && OBJ_obj2txt(keytypebuf, sizeof(keytypebuf), algoid, 0))
+            && PKCS8_pkey_get0(&algoid, NULL, NULL, NULL, p8info)
+            && OBJ_obj2txt(keytypebuf, sizeof(keytypebuf), algoid, 0))
             key_name = keytypebuf;
         structure = "PrivateKeyInfo";
         PKCS8_PRIV_KEY_INFO_free(p8info);
@@ -76,7 +76,7 @@ d2i_PrivateKey_decoder(int keytype, EVP_PKEY **a, const unsigned char **pp,
     if (a != NULL && (bak_a = *a) != NULL)
         ppkey = a;
     dctx = OSSL_DECODER_CTX_new_for_pkey(ppkey, "DER", structure, key_name,
-                                         EVP_PKEY_KEYPAIR, libctx, propq);
+        EVP_PKEY_KEYPAIR, libctx, propq);
     if (a != NULL)
         *a = bak_a;
     if (dctx == NULL)
@@ -92,7 +92,7 @@ d2i_PrivateKey_decoder(int keytype, EVP_PKEY **a, const unsigned char **pp,
         return *ppkey;
     }
 
- err:
+err:
     if (ppkey != a)
         EVP_PKEY_free(*ppkey);
     return NULL;
@@ -100,7 +100,7 @@ d2i_PrivateKey_decoder(int keytype, EVP_PKEY **a, const unsigned char **pp,
 
 EVP_PKEY *
 ossl_d2i_PrivateKey_legacy(int keytype, EVP_PKEY **a, const unsigned char **pp,
-                           long length, OSSL_LIB_CTX *libctx, const char *propq)
+    long length, OSSL_LIB_CTX *libctx, const char *propq)
 {
     EVP_PKEY *ret;
     const unsigned char *p = *pp;
@@ -124,10 +124,9 @@ ossl_d2i_PrivateKey_legacy(int keytype, EVP_PKEY **a, const unsigned char **pp,
     }
 
     ERR_set_mark();
-    if (!ret->ameth->old_priv_decode ||
-        !ret->ameth->old_priv_decode(ret, &p, length)) {
+    if (!ret->ameth->old_priv_decode || !ret->ameth->old_priv_decode(ret, &p, length)) {
         if (ret->ameth->priv_decode != NULL
-                || ret->ameth->priv_decode_ex != NULL) {
+            || ret->ameth->priv_decode_ex != NULL) {
             EVP_PKEY *tmp;
             PKCS8_PRIV_KEY_INFO *p8 = NULL;
             p8 = d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, length);
@@ -152,21 +151,21 @@ ossl_d2i_PrivateKey_legacy(int keytype, EVP_PKEY **a, const unsigned char **pp,
             goto err;
         }
     } else {
-      ERR_clear_last_mark();
+        ERR_clear_last_mark();
     }
     *pp = p;
     if (a != NULL)
         *a = ret;
     return ret;
- err:
+err:
     if (a == NULL || *a != ret)
         EVP_PKEY_free(ret);
     return NULL;
 }
 
 EVP_PKEY *d2i_PrivateKey_ex(int keytype, EVP_PKEY **a, const unsigned char **pp,
-                            long length, OSSL_LIB_CTX *libctx,
-                            const char *propq)
+    long length, OSSL_LIB_CTX *libctx,
+    const char *propq)
 {
     EVP_PKEY *ret;
 
@@ -178,16 +177,16 @@ EVP_PKEY *d2i_PrivateKey_ex(int keytype, EVP_PKEY **a, const unsigned char **pp,
 }
 
 EVP_PKEY *d2i_PrivateKey(int type, EVP_PKEY **a, const unsigned char **pp,
-                         long length)
+    long length)
 {
     return d2i_PrivateKey_ex(type, a, pp, length, NULL, NULL);
 }
 
 static EVP_PKEY *d2i_AutoPrivateKey_legacy(EVP_PKEY **a,
-                                           const unsigned char **pp,
-                                           long length,
-                                           OSSL_LIB_CTX *libctx,
-                                           const char *propq)
+    const unsigned char **pp,
+    long length,
+    OSSL_LIB_CTX *libctx,
+    const char *propq)
 {
     STACK_OF(ASN1_TYPE) *inkey;
     const unsigned char *p;
@@ -210,7 +209,7 @@ static EVP_PKEY *d2i_AutoPrivateKey_legacy(EVP_PKEY **a,
     } else if (sk_ASN1_TYPE_num(inkey) == 4) {
         keytype = EVP_PKEY_EC;
     } else if (sk_ASN1_TYPE_num(inkey) == 3) { /* This seems to be PKCS8, not
-                                              * traditional format */
+                                                * traditional format */
         PKCS8_PRIV_KEY_INFO *p8 = d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, length);
         EVP_PKEY *ret;
 
@@ -240,8 +239,8 @@ static EVP_PKEY *d2i_AutoPrivateKey_legacy(EVP_PKEY **a,
  * EVP_PKEY_NONE, which then figures out the type during decoding.
  */
 EVP_PKEY *d2i_AutoPrivateKey_ex(EVP_PKEY **a, const unsigned char **pp,
-                                long length, OSSL_LIB_CTX *libctx,
-                                const char *propq)
+    long length, OSSL_LIB_CTX *libctx,
+    const char *propq)
 {
     EVP_PKEY *ret;
 
@@ -253,7 +252,7 @@ EVP_PKEY *d2i_AutoPrivateKey_ex(EVP_PKEY **a, const unsigned char **pp,
 }
 
 EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, const unsigned char **pp,
-                             long length)
+    long length)
 {
     return d2i_AutoPrivateKey_ex(a, pp, length, NULL, NULL);
 }
diff --git a/crypto/openssl/crypto/asn1/d2i_pu.c b/crypto/openssl/crypto/asn1/d2i_pu.c
index cf7825c43903..60b21880351c 100644
--- a/crypto/openssl/crypto/asn1/d2i_pu.c
+++ b/crypto/openssl/crypto/asn1/d2i_pu.c
@@ -26,7 +26,7 @@
 #include "crypto/evp.h"
 
 EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp,
-                        long length)
+    long length)
 {
     EVP_PKEY *ret;
     EVP_PKEY *copy = NULL;
@@ -90,7 +90,7 @@ EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp,
         (*a) = ret;
     EVP_PKEY_free(copy);
     return ret;
- err:
+err:
     if (a == NULL || *a != ret)
         EVP_PKEY_free(ret);
     EVP_PKEY_free(copy);
diff --git a/crypto/openssl/crypto/asn1/evp_asn1.c b/crypto/openssl/crypto/asn1/evp_asn1.c
index 6aca0117bc11..caa079fad0ec 100644
--- a/crypto/openssl/crypto/asn1/evp_asn1.c
+++ b/crypto/openssl/crypto/asn1/evp_asn1.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -52,7 +52,7 @@ int ASN1_TYPE_get_octetstring(const ASN1_TYPE *a, unsigned char *data, int max_l
 }
 
 static ossl_inline void asn1_type_init_oct(ASN1_OCTET_STRING *oct,
-                                           unsigned char *data, int len)
+    unsigned char *data, int len)
 {
     oct->data = data;
     oct->type = V_ASN1_OCTET_STRING;
@@ -67,7 +67,7 @@ static ossl_inline void asn1_type_init_oct(ASN1_OCTET_STRING *oct,
  * whether all the data was copied.
  */
 static int asn1_type_get_int_oct(ASN1_OCTET_STRING *oct, int32_t anum,
-                                 long *num, unsigned char *data, int max_len)
+    long *num, unsigned char *data, int max_len)
 {
     int ret = ASN1_STRING_length(oct), n;
 
@@ -91,14 +91,14 @@ typedef struct {
 } asn1_int_oct;
 
 ASN1_SEQUENCE(asn1_int_oct) = {
-        ASN1_EMBED(asn1_int_oct, num, INT32),
-        ASN1_SIMPLE(asn1_int_oct, oct, ASN1_OCTET_STRING)
+    ASN1_EMBED(asn1_int_oct, num, INT32),
+    ASN1_SIMPLE(asn1_int_oct, oct, ASN1_OCTET_STRING)
 } static_ASN1_SEQUENCE_END(asn1_int_oct)
 
-DECLARE_ASN1_ITEM(asn1_int_oct)
+    DECLARE_ASN1_ITEM(asn1_int_oct)
 
 int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, unsigned char *data,
-                                  int len)
+    int len)
 {
     asn1_int_oct atmp;
     ASN1_OCTET_STRING oct;
@@ -120,7 +120,7 @@ int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, unsigned char *data,
  * whether all the data was copied.
  */
 int ASN1_TYPE_get_int_octetstring(const ASN1_TYPE *a, long *num,
-                                  unsigned char *data, int max_len)
+    unsigned char *data, int max_len)
 {
     asn1_int_oct *atmp = NULL;
     int ret = -1;
@@ -137,7 +137,7 @@ int ASN1_TYPE_get_int_octetstring(const ASN1_TYPE *a, long *num,
     ret = asn1_type_get_int_oct(atmp->oct, atmp->num, num, data, max_len);
 
     if (ret == -1) {
- err:
+    err:
         ERR_raise(ERR_LIB_ASN1, ASN1_R_DATA_IS_WRONG);
     }
     M_ASN1_free_of(atmp, asn1_int_oct);
@@ -154,14 +154,14 @@ typedef struct {
  * Section 2. "Content-Authenticated Encryption Algorithms"
  */
 ASN1_SEQUENCE(asn1_oct_int) = {
-        ASN1_SIMPLE(asn1_oct_int, oct, ASN1_OCTET_STRING),
-        ASN1_EMBED(asn1_oct_int, num, INT32)
+    ASN1_SIMPLE(asn1_oct_int, oct, ASN1_OCTET_STRING),
+    ASN1_EMBED(asn1_oct_int, num, INT32)
 } static_ASN1_SEQUENCE_END(asn1_oct_int)
 
-DECLARE_ASN1_ITEM(asn1_oct_int)
+    DECLARE_ASN1_ITEM(asn1_oct_int)
 
 int ossl_asn1_type_set_octetstring_int(ASN1_TYPE *a, long num,
-                                       unsigned char *data, int len)
+    unsigned char *data, int len)
 {
     asn1_oct_int atmp;
     ASN1_OCTET_STRING oct;
@@ -183,7 +183,7 @@ int ossl_asn1_type_set_octetstring_int(ASN1_TYPE *a, long num,
  * whether all the data was copied.
  */
 int ossl_asn1_type_get_octetstring_int(const ASN1_TYPE *a, long *num,
-                                       unsigned char *data, int max_len)
+    unsigned char *data, int max_len)
 {
     asn1_oct_int *atmp = NULL;
     int ret = -1;
@@ -199,7 +199,7 @@ int ossl_asn1_type_get_octetstring_int(const ASN1_TYPE *a, long *num,
     ret = asn1_type_get_int_oct(atmp->oct, atmp->num, num, data, max_len);
 
     if (ret == -1) {
- err:
+    err:
         ERR_raise(ERR_LIB_ASN1, ASN1_R_DATA_IS_WRONG);
     }
     M_ASN1_free_of(atmp, asn1_oct_int);
diff --git a/crypto/openssl/crypto/asn1/f_int.c b/crypto/openssl/crypto/asn1/f_int.c
index 5b5dda4ce120..b1fd3f9467c3 100644
--- a/crypto/openssl/crypto/asn1/f_int.c
+++ b/crypto/openssl/crypto/asn1/f_int.c
@@ -45,7 +45,7 @@ int i2a_ASN1_INTEGER(BIO *bp, const ASN1_INTEGER *a)
         }
     }
     return n;
- err:
+err:
     return -1;
 }
 
@@ -131,7 +131,7 @@ int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
     bs->length = num;
     bs->data = s;
     return 1;
- err:
+err:
     ERR_raise(ERR_LIB_ASN1, ASN1_R_SHORT_LINE);
     OPENSSL_free(s);
     return 0;
diff --git a/crypto/openssl/crypto/asn1/f_string.c b/crypto/openssl/crypto/asn1/f_string.c
index 7e4e5985149d..9fb34f495e10 100644
--- a/crypto/openssl/crypto/asn1/f_string.c
+++ b/crypto/openssl/crypto/asn1/f_string.c
@@ -39,7 +39,7 @@ int i2a_ASN1_STRING(BIO *bp, const ASN1_STRING *a, int type)
         }
     }
     return n;
- err:
+err:
     return -1;
 }
 
@@ -125,7 +125,7 @@ int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size)
     bs->data = s;
     return 1;
 
- err:
+err:
     ERR_raise(ERR_LIB_ASN1, ASN1_R_SHORT_LINE);
     OPENSSL_free(s);
     return 0;
diff --git a/crypto/openssl/crypto/asn1/i2d_evp.c b/crypto/openssl/crypto/asn1/i2d_evp.c
index 106ea152733c..92f7158cffd5 100644
--- a/crypto/openssl/crypto/asn1/i2d_evp.c
+++ b/crypto/openssl/crypto/asn1/i2d_evp.c
@@ -19,9 +19,9 @@
 #include <openssl/encoder.h>
 #include <openssl/buffer.h>
 #include <openssl/x509.h>
-#include <openssl/rsa.h>         /* For i2d_RSAPublicKey */
-#include <openssl/dsa.h>         /* For i2d_DSAPublicKey */
-#include <openssl/ec.h>          /* For i2o_ECPublicKey */
+#include <openssl/rsa.h> /* For i2d_RSAPublicKey */
+#include <openssl/dsa.h> /* For i2d_DSAPublicKey */
+#include <openssl/ec.h> /* For i2o_ECPublicKey */
 #include "crypto/asn1.h"
 #include "crypto/evp.h"
 
@@ -31,14 +31,14 @@ struct type_and_structure_st {
 };
 
 static int i2d_provided(const EVP_PKEY *a, int selection,
-                        const struct type_and_structure_st *output_info,
-                        unsigned char **pp)
+    const struct type_and_structure_st *output_info,
+    unsigned char **pp)
 {
     int ret;
 
     for (ret = -1;
-         ret == -1 && output_info->output_type != NULL;
-         output_info++) {
+        ret == -1 && output_info->output_type != NULL;
+        output_info++) {
         /*
          * The i2d_ calls don't take a boundary length for *pp.  However,
          * OSSL_ENCODER_to_data() needs one, so we make one up.  Because
@@ -51,9 +51,9 @@ static int i2d_provided(const EVP_PKEY *a, int selection,
         OSSL_ENCODER_CTX *ctx;
 
         ctx = OSSL_ENCODER_CTX_new_for_pkey(a, selection,
-                                            output_info->output_type,
-                                            output_info->output_structure,
-                                            NULL);
+            output_info->output_type,
+            output_info->output_structure,
+            NULL);
         if (ctx == NULL)
             return -1;
         if (OSSL_ENCODER_to_data(ctx, pp, &len)) {
@@ -75,7 +75,9 @@ int i2d_KeyParams(const EVP_PKEY *a, unsigned char **pp)
     if (evp_pkey_is_provided(a)) {
         static const struct type_and_structure_st output_info[] = {
             { "DER", "type-specific" },
-            { NULL, }
+            {
+                NULL,
+            }
         };
 
         return i2d_provided(a, EVP_PKEY_KEY_PARAMETERS, output_info, pp);
@@ -97,7 +99,9 @@ int i2d_PrivateKey(const EVP_PKEY *a, unsigned char **pp)
         static const struct type_and_structure_st output_info[] = {
             { "DER", "type-specific" },
             { "DER", "PrivateKeyInfo" },
-            { NULL, }
+            {
+                NULL,
+            }
         };
 
         return i2d_provided(a, EVP_PKEY_KEYPAIR, output_info, pp);
@@ -124,8 +128,10 @@ int i2d_PublicKey(const EVP_PKEY *a, unsigned char **pp)
     if (evp_pkey_is_provided(a)) {
         static const struct type_and_structure_st output_info[] = {
             { "DER", "type-specific" },
-            { "blob", NULL },    /* for EC */
-            { NULL, }
+            { "blob", NULL }, /* for EC */
+            {
+                NULL,
+            }
         };
 
         return i2d_provided(a, EVP_PKEY_PUBLIC_KEY, output_info, pp);
diff --git a/crypto/openssl/crypto/asn1/n_pkey.c b/crypto/openssl/crypto/asn1/n_pkey.c
index eb0918f79f97..7b70d6c7a0cf 100644
--- a/crypto/openssl/crypto/asn1/n_pkey.c
+++ b/crypto/openssl/crypto/asn1/n_pkey.c
@@ -16,11 +16,11 @@
 #include <openssl/evp.h>
 #include <openssl/x509.h>
 
-#define ASN1_BROKEN_SEQUENCE(tname) \
-        static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_BROKEN, 0, 0, 0, 0}; \
-        ASN1_SEQUENCE(tname)
+#define ASN1_BROKEN_SEQUENCE(tname)                                             \
+    static const ASN1_AUX tname##_aux = { NULL, ASN1_AFLG_BROKEN, 0, 0, 0, 0 }; \
+    ASN1_SEQUENCE(tname)
 #define static_ASN1_BROKEN_SEQUENCE_END(stname) \
-        static_ASN1_SEQUENCE_END_ref(stname, stname)
+    static_ASN1_SEQUENCE_END_ref(stname, stname)
 
 typedef struct netscape_pkey_st {
     int32_t version;
@@ -37,22 +37,21 @@ typedef struct netscape_encrypted_pkey_st {
     X509_SIG *enckey;
 } NETSCAPE_ENCRYPTED_PKEY;
 
-
 ASN1_BROKEN_SEQUENCE(NETSCAPE_ENCRYPTED_PKEY) = {
-        ASN1_SIMPLE(NETSCAPE_ENCRYPTED_PKEY, os, ASN1_OCTET_STRING),
-        ASN1_SIMPLE(NETSCAPE_ENCRYPTED_PKEY, enckey, X509_SIG)
+    ASN1_SIMPLE(NETSCAPE_ENCRYPTED_PKEY, os, ASN1_OCTET_STRING),
+    ASN1_SIMPLE(NETSCAPE_ENCRYPTED_PKEY, enckey, X509_SIG)
 } static_ASN1_BROKEN_SEQUENCE_END(NETSCAPE_ENCRYPTED_PKEY)
 
-DECLARE_ASN1_FUNCTIONS(NETSCAPE_ENCRYPTED_PKEY)
+    DECLARE_ASN1_FUNCTIONS(NETSCAPE_ENCRYPTED_PKEY)
 DECLARE_ASN1_ENCODE_FUNCTIONS_name(NETSCAPE_ENCRYPTED_PKEY, NETSCAPE_ENCRYPTED_PKEY)
 IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_ENCRYPTED_PKEY)
 
 ASN1_SEQUENCE(NETSCAPE_PKEY) = {
-        ASN1_EMBED(NETSCAPE_PKEY, version, INT32),
-        ASN1_SIMPLE(NETSCAPE_PKEY, algor, X509_ALGOR),
-        ASN1_SIMPLE(NETSCAPE_PKEY, private_key, ASN1_OCTET_STRING)
+    ASN1_EMBED(NETSCAPE_PKEY, version, INT32),
+    ASN1_SIMPLE(NETSCAPE_PKEY, algor, X509_ALGOR),
+    ASN1_SIMPLE(NETSCAPE_PKEY, private_key, ASN1_OCTET_STRING)
 } static_ASN1_SEQUENCE_END(NETSCAPE_PKEY)
 
-DECLARE_ASN1_FUNCTIONS(NETSCAPE_PKEY)
+    DECLARE_ASN1_FUNCTIONS(NETSCAPE_PKEY)
 DECLARE_ASN1_ENCODE_FUNCTIONS_name(NETSCAPE_PKEY, NETSCAPE_PKEY)
 IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_PKEY)
diff --git a/crypto/openssl/crypto/asn1/nsseq.c b/crypto/openssl/crypto/asn1/nsseq.c
index 09dc24f25f8d..1b3653194181 100644
--- a/crypto/openssl/crypto/asn1/nsseq.c
+++ b/crypto/openssl/crypto/asn1/nsseq.c
@@ -14,7 +14,7 @@
 #include <openssl/objects.h>
 
 static int nsseq_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
-                    void *exarg)
+    void *exarg)
 {
     if (operation == ASN1_OP_NEW_POST) {
         NETSCAPE_CERT_SEQUENCE *nsseq;
@@ -27,8 +27,8 @@ static int nsseq_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 /* Netscape certificate sequence structure */
 
 ASN1_SEQUENCE_cb(NETSCAPE_CERT_SEQUENCE, nsseq_cb) = {
-        ASN1_SIMPLE(NETSCAPE_CERT_SEQUENCE, type, ASN1_OBJECT),
-        ASN1_EXP_SEQUENCE_OF_OPT(NETSCAPE_CERT_SEQUENCE, certs, X509, 0)
+    ASN1_SIMPLE(NETSCAPE_CERT_SEQUENCE, type, ASN1_OBJECT),
+    ASN1_EXP_SEQUENCE_OF_OPT(NETSCAPE_CERT_SEQUENCE, certs, X509, 0)
 } ASN1_SEQUENCE_END_cb(NETSCAPE_CERT_SEQUENCE, NETSCAPE_CERT_SEQUENCE)
 
 IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_CERT_SEQUENCE)
diff --git a/crypto/openssl/crypto/asn1/p5_pbe.c b/crypto/openssl/crypto/asn1/p5_pbe.c
index a90c200d42a5..11782cd31560 100644
--- a/crypto/openssl/crypto/asn1/p5_pbe.c
+++ b/crypto/openssl/crypto/asn1/p5_pbe.c
@@ -17,8 +17,8 @@
 /* PKCS#5 password based encryption structure */
 
 ASN1_SEQUENCE(PBEPARAM) = {
-        ASN1_SIMPLE(PBEPARAM, salt, ASN1_OCTET_STRING),
-        ASN1_SIMPLE(PBEPARAM, iter, ASN1_INTEGER)
+    ASN1_SIMPLE(PBEPARAM, salt, ASN1_OCTET_STRING),
+    ASN1_SIMPLE(PBEPARAM, iter, ASN1_INTEGER)
 } ASN1_SEQUENCE_END(PBEPARAM)
 
 IMPLEMENT_ASN1_FUNCTIONS(PBEPARAM)
@@ -26,8 +26,8 @@ IMPLEMENT_ASN1_FUNCTIONS(PBEPARAM)
 /* Set an algorithm identifier for a PKCS#5 PBE algorithm */
 
 int PKCS5_pbe_set0_algor_ex(X509_ALGOR *algor, int alg, int iter,
-                            const unsigned char *salt, int saltlen,
-                            OSSL_LIB_CTX *ctx)
+    const unsigned char *salt, int saltlen,
+    OSSL_LIB_CTX *ctx)
 {
     PBEPARAM *pbe = NULL;
     ASN1_STRING *pbe_str = NULL;
@@ -72,7 +72,7 @@ int PKCS5_pbe_set0_algor_ex(X509_ALGOR *algor, int alg, int iter,
     if (X509_ALGOR_set0(algor, OBJ_nid2obj(alg), V_ASN1_SEQUENCE, pbe_str))
         return 1;
 
- err:
+err:
     OPENSSL_free(sstr);
     PBEPARAM_free(pbe);
     ASN1_STRING_free(pbe_str);
@@ -80,7 +80,7 @@ int PKCS5_pbe_set0_algor_ex(X509_ALGOR *algor, int alg, int iter,
 }
 
 int PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter,
-                         const unsigned char *salt, int saltlen)
+    const unsigned char *salt, int saltlen)
 {
     return PKCS5_pbe_set0_algor_ex(algor, alg, iter, salt, saltlen, NULL);
 }
@@ -88,8 +88,8 @@ int PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter,
 /* Return an algorithm identifier for a PKCS#5 PBE algorithm */
 
 X509_ALGOR *PKCS5_pbe_set_ex(int alg, int iter,
-                             const unsigned char *salt, int saltlen,
-                             OSSL_LIB_CTX *ctx)
+    const unsigned char *salt, int saltlen,
+    OSSL_LIB_CTX *ctx)
 {
     X509_ALGOR *ret;
     ret = X509_ALGOR_new();
@@ -106,8 +106,7 @@ X509_ALGOR *PKCS5_pbe_set_ex(int alg, int iter,
 }
 
 X509_ALGOR *PKCS5_pbe_set(int alg, int iter,
-                          const unsigned char *salt, int saltlen)
+    const unsigned char *salt, int saltlen)
 {
     return PKCS5_pbe_set_ex(alg, iter, salt, saltlen, NULL);
 }
-
diff --git a/crypto/openssl/crypto/asn1/p5_pbev2.c b/crypto/openssl/crypto/asn1/p5_pbev2.c
index b9ad4db4a79a..468e9fc769d4 100644
--- a/crypto/openssl/crypto/asn1/p5_pbev2.c
+++ b/crypto/openssl/crypto/asn1/p5_pbev2.c
@@ -20,17 +20,17 @@
 /* PKCS#5 v2.0 password based encryption structures */
 
 ASN1_SEQUENCE(PBE2PARAM) = {
-        ASN1_SIMPLE(PBE2PARAM, keyfunc, X509_ALGOR),
-        ASN1_SIMPLE(PBE2PARAM, encryption, X509_ALGOR)
+    ASN1_SIMPLE(PBE2PARAM, keyfunc, X509_ALGOR),
+    ASN1_SIMPLE(PBE2PARAM, encryption, X509_ALGOR)
 } ASN1_SEQUENCE_END(PBE2PARAM)
 
 IMPLEMENT_ASN1_FUNCTIONS(PBE2PARAM)
 
 ASN1_SEQUENCE(PBKDF2PARAM) = {
-        ASN1_SIMPLE(PBKDF2PARAM, salt, ASN1_ANY),
-        ASN1_SIMPLE(PBKDF2PARAM, iter, ASN1_INTEGER),
-        ASN1_OPT(PBKDF2PARAM, keylength, ASN1_INTEGER),
-        ASN1_OPT(PBKDF2PARAM, prf, X509_ALGOR)
+    ASN1_SIMPLE(PBKDF2PARAM, salt, ASN1_ANY),
+    ASN1_SIMPLE(PBKDF2PARAM, iter, ASN1_INTEGER),
+    ASN1_OPT(PBKDF2PARAM, keylength, ASN1_INTEGER),
+    ASN1_OPT(PBKDF2PARAM, prf, X509_ALGOR)
 } ASN1_SEQUENCE_END(PBKDF2PARAM)
 
 IMPLEMENT_ASN1_FUNCTIONS(PBKDF2PARAM)
@@ -49,9 +49,9 @@ IMPLEMENT_ASN1_FUNCTIONS(PBMAC1PARAM)
  */
 
 X509_ALGOR *PKCS5_pbe2_set_iv_ex(const EVP_CIPHER *cipher, int iter,
-                                 unsigned char *salt, int saltlen,
-                                 unsigned char *aiv, int prf_nid,
-                                 OSSL_LIB_CTX *libctx)
+    unsigned char *salt, int saltlen,
+    unsigned char *aiv, int prf_nid,
+    OSSL_LIB_CTX *libctx)
 {
     X509_ALGOR *scheme = NULL, *ret = NULL;
     int alg_nid, keylen, ivlen;
@@ -105,8 +105,7 @@ X509_ALGOR *PKCS5_pbe2_set_iv_ex(const EVP_CIPHER *cipher, int iter,
      * here: just means use default PRF.
      */
     ERR_set_mark();
-    if ((prf_nid == -1) &&
-        EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_PBE_PRF_NID, 0, &prf_nid) <= 0) {
+    if ((prf_nid == -1) && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_PBE_PRF_NID, 0, &prf_nid) <= 0) {
         prf_nid = NID_hmacWithSHA256;
     }
     ERR_pop_to_mark();
@@ -125,7 +124,7 @@ X509_ALGOR *PKCS5_pbe2_set_iv_ex(const EVP_CIPHER *cipher, int iter,
     X509_ALGOR_free(pbe2->keyfunc);
 
     pbe2->keyfunc = PKCS5_pbkdf2_set_ex(iter, salt, saltlen, prf_nid, keylen,
-                                        libctx);
+        libctx);
 
     if (pbe2->keyfunc == NULL) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
@@ -144,7 +143,7 @@ X509_ALGOR *PKCS5_pbe2_set_iv_ex(const EVP_CIPHER *cipher, int iter,
     /* Encode PBE2PARAM into parameter */
 
     if (!ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(PBE2PARAM), pbe2,
-                                 &ret->parameter)) {
+            &ret->parameter)) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
         goto err;
     }
@@ -154,7 +153,7 @@ X509_ALGOR *PKCS5_pbe2_set_iv_ex(const EVP_CIPHER *cipher, int iter,
 
     return ret;
 
- err:
+err:
     EVP_CIPHER_CTX_free(ctx);
     PBE2PARAM_free(pbe2);
     /* Note 'scheme' is freed as part of pbe2 */
@@ -164,24 +163,23 @@ X509_ALGOR *PKCS5_pbe2_set_iv_ex(const EVP_CIPHER *cipher, int iter,
 }
 
 X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
-                              unsigned char *salt, int saltlen,
-                              unsigned char *aiv, int prf_nid)
+    unsigned char *salt, int saltlen,
+    unsigned char *aiv, int prf_nid)
 {
     return PKCS5_pbe2_set_iv_ex(cipher, iter, salt, saltlen, aiv, prf_nid,
-                                NULL);
+        NULL);
 }
 
 X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
-                           unsigned char *salt, int saltlen)
+    unsigned char *salt, int saltlen)
 {
     return PKCS5_pbe2_set_iv_ex(cipher, iter, salt, saltlen, NULL, -1,
-                                NULL);
+        NULL);
 }
 
-
 X509_ALGOR *PKCS5_pbkdf2_set_ex(int iter, unsigned char *salt, int saltlen,
-                                int prf_nid, int keylen,
-                                OSSL_LIB_CTX *libctx)
+    int prf_nid, int keylen,
+    OSSL_LIB_CTX *libctx)
 {
     X509_ALGOR *keyfunc = NULL;
     PBKDF2PARAM *kdf = NULL;
@@ -208,7 +206,6 @@ X509_ALGOR *PKCS5_pbkdf2_set_ex(int iter, unsigned char *salt, int saltlen,
     if ((osalt->data = OPENSSL_malloc(saltlen)) == NULL)
         goto err;
 
-
     osalt->length = saltlen;
 
     if (salt) {
@@ -261,7 +258,7 @@ X509_ALGOR *PKCS5_pbkdf2_set_ex(int iter, unsigned char *salt, int saltlen,
     /* Encode PBKDF2PARAM into parameter of pbe2 */
 
     if (!ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM), kdf,
-                                 &keyfunc->parameter)) {
+            &keyfunc->parameter)) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
         goto err;
     }
@@ -269,15 +266,14 @@ X509_ALGOR *PKCS5_pbkdf2_set_ex(int iter, unsigned char *salt, int saltlen,
     PBKDF2PARAM_free(kdf);
     return keyfunc;
 
- err:
+err:
     PBKDF2PARAM_free(kdf);
     X509_ALGOR_free(keyfunc);
     return NULL;
 }
 
 X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen,
-                             int prf_nid, int keylen)
+    int prf_nid, int keylen)
 {
     return PKCS5_pbkdf2_set_ex(iter, salt, saltlen, prf_nid, keylen, NULL);
 }
-
diff --git a/crypto/openssl/crypto/asn1/p5_scrypt.c b/crypto/openssl/crypto/asn1/p5_scrypt.c
index 4f3dcecd41ab..b6d7eee3c95e 100644
--- a/crypto/openssl/crypto/asn1/p5_scrypt.c
+++ b/crypto/openssl/crypto/asn1/p5_scrypt.c
@@ -21,27 +21,27 @@
 /* PKCS#5 scrypt password based encryption structures */
 
 ASN1_SEQUENCE(SCRYPT_PARAMS) = {
-        ASN1_SIMPLE(SCRYPT_PARAMS, salt, ASN1_OCTET_STRING),
-        ASN1_SIMPLE(SCRYPT_PARAMS, costParameter, ASN1_INTEGER),
-        ASN1_SIMPLE(SCRYPT_PARAMS, blockSize, ASN1_INTEGER),
-        ASN1_SIMPLE(SCRYPT_PARAMS, parallelizationParameter, ASN1_INTEGER),
-        ASN1_OPT(SCRYPT_PARAMS, keyLength, ASN1_INTEGER),
+    ASN1_SIMPLE(SCRYPT_PARAMS, salt, ASN1_OCTET_STRING),
+    ASN1_SIMPLE(SCRYPT_PARAMS, costParameter, ASN1_INTEGER),
+    ASN1_SIMPLE(SCRYPT_PARAMS, blockSize, ASN1_INTEGER),
+    ASN1_SIMPLE(SCRYPT_PARAMS, parallelizationParameter, ASN1_INTEGER),
+    ASN1_OPT(SCRYPT_PARAMS, keyLength, ASN1_INTEGER),
 } ASN1_SEQUENCE_END(SCRYPT_PARAMS)
 
 IMPLEMENT_ASN1_FUNCTIONS(SCRYPT_PARAMS)
 
 static X509_ALGOR *pkcs5_scrypt_set(const unsigned char *salt, size_t saltlen,
-                                    size_t keylen, uint64_t N, uint64_t r,
-                                    uint64_t p);
+    size_t keylen, uint64_t N, uint64_t r,
+    uint64_t p);
 
 /*
  * Return an algorithm identifier for a PKCS#5 v2.0 PBE algorithm using scrypt
  */
 
 X509_ALGOR *PKCS5_pbe2_set_scrypt(const EVP_CIPHER *cipher,
-                                  const unsigned char *salt, int saltlen,
-                                  unsigned char *aiv, uint64_t N, uint64_t r,
-                                  uint64_t p)
+    const unsigned char *salt, int saltlen,
+    unsigned char *aiv, uint64_t N, uint64_t r,
+    uint64_t p)
 {
     X509_ALGOR *scheme = NULL, *ret = NULL;
     int alg_nid;
@@ -135,7 +135,8 @@ X509_ALGOR *PKCS5_pbe2_set_scrypt(const EVP_CIPHER *cipher,
     /* Encode PBE2PARAM into parameter */
 
     if (ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(PBE2PARAM), pbe2,
-                                &ret->parameter) == NULL) {
+            &ret->parameter)
+        == NULL) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
         goto err;
     }
@@ -145,7 +146,7 @@ X509_ALGOR *PKCS5_pbe2_set_scrypt(const EVP_CIPHER *cipher,
 
     return ret;
 
- err:
+err:
     PBE2PARAM_free(pbe2);
     X509_ALGOR_free(ret);
     EVP_CIPHER_CTX_free(ctx);
@@ -154,8 +155,8 @@ X509_ALGOR *PKCS5_pbe2_set_scrypt(const EVP_CIPHER *cipher,
 }
 
 static X509_ALGOR *pkcs5_scrypt_set(const unsigned char *salt, size_t saltlen,
-                                    size_t keylen, uint64_t N, uint64_t r,
-                                    uint64_t p)
+    size_t keylen, uint64_t N, uint64_t r,
+    uint64_t p)
 {
     X509_ALGOR *keyfunc = NULL;
     SCRYPT_PARAMS *sparam = SCRYPT_PARAMS_new();
@@ -219,7 +220,8 @@ static X509_ALGOR *pkcs5_scrypt_set(const unsigned char *salt, size_t saltlen,
     /* Encode SCRYPT_PARAMS into parameter of pbe2 */
 
     if (ASN1_TYPE_pack_sequence(ASN1_ITEM_rptr(SCRYPT_PARAMS), sparam,
-                                &keyfunc->parameter) == NULL) {
+            &keyfunc->parameter)
+        == NULL) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
         goto err;
     }
@@ -227,16 +229,16 @@ static X509_ALGOR *pkcs5_scrypt_set(const unsigned char *salt, size_t saltlen,
     SCRYPT_PARAMS_free(sparam);
     return keyfunc;
 
- err:
+err:
     SCRYPT_PARAMS_free(sparam);
     X509_ALGOR_free(keyfunc);
     return NULL;
 }
 
 int PKCS5_v2_scrypt_keyivgen_ex(EVP_CIPHER_CTX *ctx, const char *pass,
-                                int passlen, ASN1_TYPE *param,
-                                const EVP_CIPHER *c, const EVP_MD *md, int en_de,
-                                OSSL_LIB_CTX *libctx, const char *propq)
+    int passlen, ASN1_TYPE *param,
+    const EVP_CIPHER *c, const EVP_MD *md, int en_de,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     unsigned char *salt, key[EVP_MAX_KEY_LENGTH];
     uint64_t p, r, N;
@@ -281,7 +283,8 @@ int PKCS5_v2_scrypt_keyivgen_ex(EVP_CIPHER_CTX *ctx, const char *pass,
         || ASN1_INTEGER_get_uint64(&r, sparam->blockSize) == 0
         || ASN1_INTEGER_get_uint64(&p, sparam->parallelizationParameter) == 0
         || EVP_PBE_scrypt_ex(NULL, 0, NULL, 0, N, r, p, 0, NULL, 0,
-                             libctx, propq) == 0) {
+               libctx, propq)
+            == 0) {
         ERR_raise(ERR_LIB_EVP, EVP_R_ILLEGAL_SCRYPT_PARAMETERS);
         goto err;
     }
@@ -291,10 +294,11 @@ int PKCS5_v2_scrypt_keyivgen_ex(EVP_CIPHER_CTX *ctx, const char *pass,
     salt = sparam->salt->data;
     saltlen = sparam->salt->length;
     if (EVP_PBE_scrypt_ex(pass, passlen, salt, saltlen, N, r, p, 0, key,
-                          keylen, libctx, propq) == 0)
+            keylen, libctx, propq)
+        == 0)
         goto err;
     rv = EVP_CipherInit_ex(ctx, NULL, NULL, key, NULL, en_de);
- err:
+err:
     if (keylen)
         OPENSSL_cleanse(key, keylen);
     SCRYPT_PARAMS_free(sparam);
@@ -302,8 +306,8 @@ int PKCS5_v2_scrypt_keyivgen_ex(EVP_CIPHER_CTX *ctx, const char *pass,
 }
 
 int PKCS5_v2_scrypt_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass,
-                             int passlen, ASN1_TYPE *param,
-                             const EVP_CIPHER *c, const EVP_MD *md, int en_de)
+    int passlen, ASN1_TYPE *param,
+    const EVP_CIPHER *c, const EVP_MD *md, int en_de)
 {
     return PKCS5_v2_scrypt_keyivgen_ex(ctx, pass, passlen, param, c, md, en_de, NULL, NULL);
 }
diff --git a/crypto/openssl/crypto/asn1/p8_pkey.c b/crypto/openssl/crypto/asn1/p8_pkey.c
index a33445d49e76..143f503dea34 100644
--- a/crypto/openssl/crypto/asn1/p8_pkey.c
+++ b/crypto/openssl/crypto/asn1/p8_pkey.c
@@ -15,7 +15,7 @@
 
 /* Minor tweak to operation: zero private key data */
 static int pkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
-                   void *exarg)
+    void *exarg)
 {
     PKCS8_PRIV_KEY_INFO *key;
     int version;
@@ -41,18 +41,18 @@ static int pkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 }
 
 ASN1_SEQUENCE_cb(PKCS8_PRIV_KEY_INFO, pkey_cb) = {
-        ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, version, ASN1_INTEGER),
-        ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkeyalg, X509_ALGOR),
-        ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkey, ASN1_OCTET_STRING),
-        ASN1_IMP_SET_OF_OPT(PKCS8_PRIV_KEY_INFO, attributes, X509_ATTRIBUTE, 0),
-        ASN1_IMP_OPT(PKCS8_PRIV_KEY_INFO, kpub, ASN1_BIT_STRING, 1)
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, version, ASN1_INTEGER),
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkeyalg, X509_ALGOR),
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkey, ASN1_OCTET_STRING),
+    ASN1_IMP_SET_OF_OPT(PKCS8_PRIV_KEY_INFO, attributes, X509_ATTRIBUTE, 0),
+    ASN1_IMP_OPT(PKCS8_PRIV_KEY_INFO, kpub, ASN1_BIT_STRING, 1)
 } ASN1_SEQUENCE_END_cb(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO)
 
 int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj,
-                    int version,
-                    int ptype, void *pval, unsigned char *penc, int penclen)
+    int version,
+    int ptype, void *pval, unsigned char *penc, int penclen)
 {
     if (version >= 0) {
         /* We only support PKCS#8 v1 (0) and v2 (1). */
@@ -69,8 +69,8 @@ int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj,
 }
 
 int PKCS8_pkey_get0(const ASN1_OBJECT **ppkalg,
-                    const unsigned char **pk, int *ppklen,
-                    const X509_ALGOR **pa, const PKCS8_PRIV_KEY_INFO *p8)
+    const unsigned char **pk, int *ppklen,
+    const X509_ALGOR **pa, const PKCS8_PRIV_KEY_INFO *p8)
 {
     if (ppkalg)
         *ppkalg = p8->pkeyalg->algorithm;
@@ -90,7 +90,7 @@ PKCS8_pkey_get0_attrs(const PKCS8_PRIV_KEY_INFO *p8)
 }
 
 int PKCS8_pkey_add1_attr_by_NID(PKCS8_PRIV_KEY_INFO *p8, int nid, int type,
-                                const unsigned char *bytes, int len)
+    const unsigned char *bytes, int len)
 {
     if (X509at_add1_attr_by_NID(&p8->attributes, nid, type, bytes, len) != NULL)
         return 1;
@@ -98,7 +98,7 @@ int PKCS8_pkey_add1_attr_by_NID(PKCS8_PRIV_KEY_INFO *p8, int nid, int type,
 }
 
 int PKCS8_pkey_add1_attr_by_OBJ(PKCS8_PRIV_KEY_INFO *p8, const ASN1_OBJECT *obj, int type,
-                                const unsigned char *bytes, int len)
+    const unsigned char *bytes, int len)
 {
     return (X509at_add1_attr_by_OBJ(&p8->attributes, obj, type, bytes, len) != NULL);
 }
diff --git a/crypto/openssl/crypto/asn1/t_bitst.c b/crypto/openssl/crypto/asn1/t_bitst.c
index e7b817f78e15..a02df91fc2e8 100644
--- a/crypto/openssl/crypto/asn1/t_bitst.c
+++ b/crypto/openssl/crypto/asn1/t_bitst.c
@@ -13,7 +13,7 @@
 #include <openssl/x509v3.h>
 
 int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
-                               BIT_STRING_BITNAME *tbl, int indent)
+    BIT_STRING_BITNAME *tbl, int indent)
 {
     BIT_STRING_BITNAME *bnam;
     char first = 1;
@@ -31,7 +31,7 @@ int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
 }
 
 int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, const char *name, int value,
-                            BIT_STRING_BITNAME *tbl)
+    BIT_STRING_BITNAME *tbl)
 {
     int bitnum;
     bitnum = ASN1_BIT_STRING_num_asc(name, tbl);
diff --git a/crypto/openssl/crypto/asn1/t_pkey.c b/crypto/openssl/crypto/asn1/t_pkey.c
index 03579c877cfc..45becc58d09b 100644
--- a/crypto/openssl/crypto/asn1/t_pkey.c
+++ b/crypto/openssl/crypto/asn1/t_pkey.c
@@ -14,7 +14,7 @@
 #include "crypto/bn.h"
 
 /* Number of octets per line */
-#define ASN1_BUF_PRINT_WIDTH    15
+#define ASN1_BUF_PRINT_WIDTH 15
 /* Maximum indent */
 #define ASN1_PRINT_MAX_INDENT 128
 
@@ -34,8 +34,9 @@ int ASN1_buf_print(BIO *bp, const unsigned char *buf, size_t buflen, int indent)
          * this function is used to print out key components.
          */
         if (BIO_printf(bp, "%02x%s", buf[i],
-                       (i == buflen - 1) ? "" : ":") <= 0)
-                return 0;
+                (i == buflen - 1) ? "" : ":")
+            <= 0)
+            return 0;
     }
     if (BIO_write(bp, "\n", 1) <= 0)
         return 0;
@@ -43,7 +44,7 @@ int ASN1_buf_print(BIO *bp, const unsigned char *buf, size_t buflen, int indent)
 }
 
 int ASN1_bn_print(BIO *bp, const char *number, const BIGNUM *num,
-                  unsigned char *ign, int indent)
+    unsigned char *ign, int indent)
 {
     int n, rv = 0;
     const char *neg;
@@ -63,8 +64,9 @@ int ASN1_bn_print(BIO *bp, const char *number, const BIGNUM *num,
 
     if (BN_num_bytes(num) <= BN_BYTES) {
         if (BIO_printf(bp, "%s %s%lu (%s0x%lx)\n", number, neg,
-                       (unsigned long)bn_get_words(num)[0], neg,
-                       (unsigned long)bn_get_words(num)[0]) <= 0)
+                (unsigned long)bn_get_words(num)[0], neg,
+                (unsigned long)bn_get_words(num)[0])
+            <= 0)
             return 0;
         return 1;
     }
@@ -75,7 +77,8 @@ int ASN1_bn_print(BIO *bp, const char *number, const BIGNUM *num,
         goto err;
     buf[0] = 0;
     if (BIO_printf(bp, "%s%s\n", number,
-                   (neg[0] == '-') ? " (Negative)" : "") <= 0)
+            (neg[0] == '-') ? " (Negative)" : "")
+        <= 0)
         goto err;
     n = BN_bn2bin(num, buf + 1);
 
@@ -87,7 +90,7 @@ int ASN1_bn_print(BIO *bp, const char *number, const BIGNUM *num,
     if (ASN1_buf_print(bp, tmp, n, indent + 4) == 0)
         goto err;
     rv = 1;
-    err:
+err:
     OPENSSL_clear_free(buf, buflen);
     return rv;
 }
diff --git a/crypto/openssl/crypto/asn1/t_spki.c b/crypto/openssl/crypto/asn1/t_spki.c
index 0397f1f9ee50..c0c647a0e526 100644
--- a/crypto/openssl/crypto/asn1/t_spki.c
+++ b/crypto/openssl/crypto/asn1/t_spki.c
@@ -28,7 +28,7 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
     X509_PUBKEY_get0_param(&spkioid, NULL, NULL, NULL, spki->spkac->pubkey);
     i = OBJ_obj2nid(spkioid);
     BIO_printf(out, "  Public Key Algorithm: %s\n",
-               (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
+        (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
     pkey = X509_PUBKEY_get(spki->spkac->pubkey);
     if (pkey == NULL)
         BIO_printf(out, "  Unable to load public key\n");
@@ -41,7 +41,7 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
         BIO_printf(out, "  Challenge String: %.*s\n", chal->length, chal->data);
     i = OBJ_obj2nid(spki->sig_algor.algorithm);
     BIO_printf(out, "  Signature Algorithm: %s",
-               (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
+        (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
 
     n = spki->signature->length;
     s = (char *)spki->signature->data;
@@ -49,7 +49,7 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
         if ((i % 18) == 0)
             BIO_write(out, "\n      ", 7);
         BIO_printf(out, "%02x%s", (unsigned char)s[i],
-                   ((i + 1) == n) ? "" : ":");
+            ((i + 1) == n) ? "" : ":");
     }
     BIO_write(out, "\n", 1);
     return 1;
diff --git a/crypto/openssl/crypto/asn1/tasn_dec.c b/crypto/openssl/crypto/asn1/tasn_dec.c
index c4f9d61514eb..91c2e524f55b 100644
--- a/crypto/openssl/crypto/asn1/tasn_dec.c
+++ b/crypto/openssl/crypto/asn1/tasn_dec.c
@@ -14,6 +14,7 @@
 #include <openssl/objects.h>
 #include <openssl/buffer.h>
 #include <openssl/err.h>
+#include "crypto/asn1.h"
 #include "internal/numbers.h"
 #include "asn1_local.h"
 
@@ -25,63 +26,80 @@
  */
 #define ASN1_MAX_CONSTRUCTED_NEST 30
 
-static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
-                               long len, const ASN1_ITEM *it,
-                               int tag, int aclass, char opt, ASN1_TLC *ctx,
-                               int depth, OSSL_LIB_CTX *libctx,
-                               const char *propq);
-
 static int asn1_check_eoc(const unsigned char **in, long len);
 static int asn1_find_end(const unsigned char **in, long len, char inf);
 
 static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
-                        char inf, int tag, int aclass, int depth);
+    char inf, int tag, int aclass, int depth);
 
 static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen);
 
 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
-                           char *inf, char *cst,
-                           const unsigned char **in, long len,
-                           int exptag, int expclass, char opt, ASN1_TLC *ctx);
+    char *inf, char *cst,
+    const unsigned char **in, long len,
+    int exptag, int expclass, char opt, ASN1_TLC *ctx);
 
 static int asn1_template_ex_d2i(ASN1_VALUE **pval,
-                                const unsigned char **in, long len,
-                                const ASN1_TEMPLATE *tt, char opt,
-                                ASN1_TLC *ctx, int depth, OSSL_LIB_CTX *libctx,
-                                const char *propq);
+    const unsigned char **in, long len,
+    const ASN1_TEMPLATE *tt, char opt,
+    ASN1_TLC *ctx, int depth, OSSL_LIB_CTX *libctx,
+    const char *propq);
 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
-                                   const unsigned char **in, long len,
-                                   const ASN1_TEMPLATE *tt, char opt,
-                                   ASN1_TLC *ctx, int depth,
-                                   OSSL_LIB_CTX *libctx, const char *propq);
+    const unsigned char **in, long len,
+    const ASN1_TEMPLATE *tt, char opt,
+    ASN1_TLC *ctx, int depth,
+    OSSL_LIB_CTX *libctx, const char *propq);
 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
-                                 const unsigned char **in, long len,
-                                 const ASN1_ITEM *it,
-                                 int tag, int aclass, char opt,
-                                 ASN1_TLC *ctx);
+    const unsigned char **in, long len,
+    const ASN1_ITEM *it,
+    int tag, int aclass, char opt,
+    ASN1_TLC *ctx);
 static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                       int utype, char *free_cont, const ASN1_ITEM *it);
+    int utype, char *free_cont, const ASN1_ITEM *it);
 
 /* Table to convert tags to bit values, used for MSTRING type */
 static const unsigned long tag2bit[32] = {
     /* tags  0 -  3 */
-    0, 0, 0, B_ASN1_BIT_STRING,
+    0,
+    0,
+    0,
+    B_ASN1_BIT_STRING,
     /* tags  4- 7 */
-    B_ASN1_OCTET_STRING, 0, 0, B_ASN1_UNKNOWN,
+    B_ASN1_OCTET_STRING,
+    0,
+    0,
+    B_ASN1_UNKNOWN,
     /* tags  8-11 */
-    B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, 0, B_ASN1_UNKNOWN,
+    B_ASN1_UNKNOWN,
+    B_ASN1_UNKNOWN,
+    0,
+    B_ASN1_UNKNOWN,
     /* tags 12-15 */
-    B_ASN1_UTF8STRING, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN,
+    B_ASN1_UTF8STRING,
+    B_ASN1_UNKNOWN,
+    B_ASN1_UNKNOWN,
+    B_ASN1_UNKNOWN,
     /* tags 16-19 */
-    B_ASN1_SEQUENCE, 0, B_ASN1_NUMERICSTRING, B_ASN1_PRINTABLESTRING,
+    B_ASN1_SEQUENCE,
+    0,
+    B_ASN1_NUMERICSTRING,
+    B_ASN1_PRINTABLESTRING,
     /* tags 20-22 */
-    B_ASN1_T61STRING, B_ASN1_VIDEOTEXSTRING, B_ASN1_IA5STRING,
+    B_ASN1_T61STRING,
+    B_ASN1_VIDEOTEXSTRING,
+    B_ASN1_IA5STRING,
     /* tags 23-24 */
-    B_ASN1_UTCTIME, B_ASN1_GENERALIZEDTIME,
+    B_ASN1_UTCTIME,
+    B_ASN1_GENERALIZEDTIME,
     /* tags 25-27 */
-    B_ASN1_GRAPHICSTRING, B_ASN1_ISO64STRING, B_ASN1_GENERALSTRING,
+    B_ASN1_GRAPHICSTRING,
+    B_ASN1_ISO64STRING,
+    B_ASN1_GENERALSTRING,
     /* tags 28-31 */
-    B_ASN1_UNIVERSALSTRING, B_ASN1_UNKNOWN, B_ASN1_BMPSTRING, B_ASN1_UNKNOWN,
+    B_ASN1_UNIVERSALSTRING,
+    B_ASN1_UNKNOWN,
+    B_ASN1_BMPSTRING,
+    B_ASN1_UNKNOWN,
 };
 
 unsigned long ASN1_tag2bit(int tag)
@@ -93,9 +111,16 @@ unsigned long ASN1_tag2bit(int tag)
 
 /* Macro to initialize and invalidate the cache */
 
-#define asn1_tlc_clear(c)       do { if ((c) != NULL) (c)->valid = 0; } while (0)
+#define asn1_tlc_clear(c)   \
+    do {                    \
+        if ((c) != NULL)    \
+            (c)->valid = 0; \
+    } while (0)
 /* Version to avoid compiler warning about 'c' always non-NULL */
-#define asn1_tlc_clear_nc(c)    do {(c)->valid = 0; } while (0)
+#define asn1_tlc_clear_nc(c) \
+    do {                     \
+        (c)->valid = 0;      \
+    } while (0)
 
 /*
  * Decode an ASN1 item, this currently behaves just like a standard 'd2i'
@@ -105,9 +130,9 @@ unsigned long ASN1_tag2bit(int tag)
  */
 
 static int asn1_item_ex_d2i_intern(ASN1_VALUE **pval, const unsigned char **in,
-                                   long len, const ASN1_ITEM *it, int tag,
-                                   int aclass, char opt, ASN1_TLC *ctx,
-                                   OSSL_LIB_CTX *libctx, const char *propq)
+    long len, const ASN1_ITEM *it, int tag,
+    int aclass, char opt, ASN1_TLC *ctx,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     int rv;
 
@@ -116,24 +141,24 @@ static int asn1_item_ex_d2i_intern(ASN1_VALUE **pval, const unsigned char **in,
         return 0;
     }
     rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0,
-                             libctx, propq);
+        libctx, propq);
     if (rv <= 0)
         ASN1_item_ex_free(pval, it);
     return rv;
 }
 
 int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
-                     const ASN1_ITEM *it,
-                     int tag, int aclass, char opt, ASN1_TLC *ctx)
+    const ASN1_ITEM *it,
+    int tag, int aclass, char opt, ASN1_TLC *ctx)
 {
     return asn1_item_ex_d2i_intern(pval, in, len, it, tag, aclass, opt, ctx,
-                                   NULL, NULL);
+        NULL, NULL);
 }
 
 ASN1_VALUE *ASN1_item_d2i_ex(ASN1_VALUE **pval,
-                             const unsigned char **in, long len,
-                             const ASN1_ITEM *it, OSSL_LIB_CTX *libctx,
-                             const char *propq)
+    const unsigned char **in, long len,
+    const ASN1_ITEM *it, OSSL_LIB_CTX *libctx,
+    const char *propq)
 {
     ASN1_TLC c;
     ASN1_VALUE *ptmpval = NULL;
@@ -142,14 +167,15 @@ ASN1_VALUE *ASN1_item_d2i_ex(ASN1_VALUE **pval,
         pval = &ptmpval;
     asn1_tlc_clear_nc(&c);
     if (asn1_item_ex_d2i_intern(pval, in, len, it, -1, 0, 0, &c, libctx,
-                                propq) > 0)
+            propq)
+        > 0)
         return *pval;
     return NULL;
 }
 
 ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
-                          const unsigned char **in, long len,
-                          const ASN1_ITEM *it)
+    const unsigned char **in, long len,
+    const ASN1_ITEM *it)
 {
     return ASN1_item_d2i_ex(pval, in, len, it, NULL, NULL);
 }
@@ -159,11 +185,11 @@ ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
  * tag mismatch return -1 to handle OPTIONAL
  */
 
-static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
-                               long len, const ASN1_ITEM *it,
-                               int tag, int aclass, char opt, ASN1_TLC *ctx,
-                               int depth, OSSL_LIB_CTX *libctx,
-                               const char *propq)
+int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
+    long len, const ASN1_ITEM *it,
+    int tag, int aclass, char opt, ASN1_TLC *ctx,
+    int depth, OSSL_LIB_CTX *libctx,
+    const char *propq)
 {
     const ASN1_TEMPLATE *tt, *errtt = NULL;
     const ASN1_EXTERN_FUNCS *ef;
@@ -208,14 +234,14 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
              */
             if ((tag != -1) || opt) {
                 ERR_raise(ERR_LIB_ASN1,
-                          ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
+                    ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
                 goto err;
             }
             return asn1_template_ex_d2i(pval, in, len, it->templates, opt, ctx,
-                                        depth, libctx, propq);
+                depth, libctx, propq);
         }
         return asn1_d2i_ex_primitive(pval, in, len, it,
-                                     tag, aclass, opt, ctx);
+            tag, aclass, opt, ctx);
 
     case ASN1_ITYPE_MSTRING:
         /*
@@ -230,7 +256,7 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
         p = *in;
         /* Just read in tag and class */
         ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
-                              &p, len, -1, 0, 1, ctx);
+            &p, len, -1, 0, 1, ctx);
         if (!ret) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             goto err;
@@ -260,7 +286,7 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
         ef = it->funcs;
         if (ef->asn1_ex_d2i_ex != NULL)
             return ef->asn1_ex_d2i_ex(pval, in, len, it, tag, aclass, opt, ctx,
-                                      libctx, propq);
+                libctx, propq);
         return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);
 
     case ASN1_ITYPE_CHOICE:
@@ -296,7 +322,7 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
              * We mark field as OPTIONAL so its absence can be recognised.
              */
             ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx, depth,
-                                       libctx, propq);
+                libctx, propq);
             /* If field not present, try the next one */
             if (ret == -1)
                 continue;
@@ -344,7 +370,7 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
         }
         /* Get SEQUENCE length and update len, p */
         ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,
-                              &p, len, tag, aclass, opt, ctx);
+            &p, len, tag, aclass, opt, ctx);
         if (!ret) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             goto err;
@@ -363,7 +389,7 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
         }
 
         if (*pval == NULL
-                && !ossl_asn1_item_ex_new_intern(pval, it, libctx, propq)) {
+            && !ossl_asn1_item_ex_new_intern(pval, it, libctx, propq)) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             goto err;
         }
@@ -420,7 +446,7 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
              */
 
             ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx,
-                                       depth, libctx, propq);
+                depth, libctx, propq);
             if (!ret) {
                 errtt = seqtt;
                 goto err;
@@ -477,12 +503,12 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
     default:
         return 0;
     }
- auxerr:
+auxerr:
     ERR_raise(ERR_LIB_ASN1, ASN1_R_AUX_ERROR);
- err:
+err:
     if (errtt)
         ERR_add_error_data(4, "Field=", errtt->field_name,
-                           ", Type=", it->sname);
+            ", Type=", it->sname);
     else
         ERR_add_error_data(2, "Type=", it->sname);
     return 0;
@@ -494,10 +520,10 @@ static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
  */
 
 static int asn1_template_ex_d2i(ASN1_VALUE **val,
-                                const unsigned char **in, long inlen,
-                                const ASN1_TEMPLATE *tt, char opt,
-                                ASN1_TLC *ctx, int depth,
-                                OSSL_LIB_CTX *libctx, const char *propq)
+    const unsigned char **in, long inlen,
+    const ASN1_TEMPLATE *tt, char opt,
+    ASN1_TLC *ctx, int depth,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     int flags, aclass;
     int ret;
@@ -519,7 +545,7 @@ static int asn1_template_ex_d2i(ASN1_VALUE **val,
          * where it starts: so read in EXPLICIT header to get the info.
          */
         ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst,
-                              &p, inlen, tt->tag, aclass, opt, ctx);
+            &p, inlen, tt->tag, aclass, opt, ctx);
         q = p;
         if (!ret) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
@@ -532,7 +558,7 @@ static int asn1_template_ex_d2i(ASN1_VALUE **val,
         }
         /* We've found the field so it can't be OPTIONAL now */
         ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx, depth, libctx,
-                                      propq);
+            propq);
         if (!ret) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             return 0;
@@ -556,20 +582,20 @@ static int asn1_template_ex_d2i(ASN1_VALUE **val,
         }
     } else
         return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx, depth,
-                                       libctx, propq);
+            libctx, propq);
 
     *in = p;
     return 1;
 
- err:
+err:
     return 0;
 }
 
 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
-                                   const unsigned char **in, long len,
-                                   const ASN1_TEMPLATE *tt, char opt,
-                                   ASN1_TLC *ctx, int depth,
-                                   OSSL_LIB_CTX *libctx, const char *propq)
+    const unsigned char **in, long len,
+    const ASN1_TEMPLATE *tt, char opt,
+    ASN1_TLC *ctx, int depth,
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     int flags, aclass;
     int ret;
@@ -608,7 +634,7 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
         }
         /* Get the tag */
         ret = asn1_check_tlen(&len, NULL, NULL, &sk_eoc, NULL,
-                              &p, len, sktag, skaclass, opt, ctx);
+            &p, len, sktag, skaclass, opt, ctx);
         if (!ret) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             return 0;
@@ -649,8 +675,9 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
             }
             skfield = NULL;
             if (asn1_item_embed_d2i(&skfield, &p, len,
-                                     ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx,
-                                     depth, libctx, propq) <= 0) {
+                    ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx,
+                    depth, libctx, propq)
+                <= 0) {
                 ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
                 /* |skfield| may be partially allocated despite failure. */
                 ASN1_item_free(skfield, ASN1_ITEM_ptr(tt->item));
@@ -670,8 +697,8 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
     } else if (flags & ASN1_TFLG_IMPTAG) {
         /* IMPLICIT tagging */
         ret = asn1_item_embed_d2i(val, &p, len,
-                                  ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt,
-                                  ctx, depth, libctx, propq);
+            ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt,
+            ctx, depth, libctx, propq);
         if (!ret) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             goto err;
@@ -680,7 +707,7 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
     } else {
         /* Nothing special */
         ret = asn1_item_embed_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
-                                  -1, 0, opt, ctx, depth, libctx, propq);
+            -1, 0, opt, ctx, depth, libctx, propq);
         if (!ret) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             goto err;
@@ -691,14 +718,14 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
     *in = p;
     return 1;
 
- err:
+err:
     return 0;
 }
 
 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
-                                 const unsigned char **in, long inlen,
-                                 const ASN1_ITEM *it,
-                                 int tag, int aclass, char opt, ASN1_TLC *ctx)
+    const unsigned char **in, long inlen,
+    const ASN1_ITEM *it,
+    int tag, int aclass, char opt, ASN1_TLC *ctx)
 {
     int ret = 0, utype;
     long plen;
@@ -710,7 +737,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
 
     if (pval == NULL) {
         ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_NULL);
-        return 0;               /* Should never happen */
+        return 0; /* Should never happen */
     }
 
     if (it->itype == ASN1_ITYPE_MSTRING) {
@@ -732,7 +759,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
         }
         p = *in;
         ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL,
-                              &p, inlen, -1, 0, 0, ctx);
+            &p, inlen, -1, 0, 0, ctx);
         if (!ret) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             return 0;
@@ -747,7 +774,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
     p = *in;
     /* Check header */
     ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst,
-                          &p, inlen, tag, aclass, opt, ctx);
+        &p, inlen, tag, aclass, opt, ctx);
     if (!ret) {
         ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
         return 0;
@@ -820,7 +847,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
 
     *in = p;
     ret = 1;
- err:
+err:
     if (free_cont)
         OPENSSL_free(buf.data);
     return ret;
@@ -829,7 +856,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
 /* Translate ASN1 content octets into a structure */
 
 static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                       int utype, char *free_cont, const ASN1_ITEM *it)
+    int utype, char *free_cont, const ASN1_ITEM *it)
 {
     ASN1_VALUE **opval = NULL;
     ASN1_STRING *stmp;
@@ -960,7 +987,7 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
         typ->value.ptr = NULL;
 
     ret = 1;
- err:
+err:
     if (!ret) {
         ASN1_TYPE_free(typ);
         if (opval)
@@ -1004,7 +1031,7 @@ static int asn1_find_end(const unsigned char **in, long len, char inf)
         q = p;
         /* Just read in a header: only care about the length */
         if (!asn1_check_tlen(&plen, NULL, NULL, &inf, NULL, &p, len,
-                             -1, 0, 0, NULL)) {
+                -1, 0, 0, NULL)) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             return 0;
         }
@@ -1040,11 +1067,11 @@ static int asn1_find_end(const unsigned char **in, long len, char inf)
  * recursion is allowed at all. Although zero should be adequate examples
  * exist that require a value of 1. So 5 should be more than enough.
  */
-# define ASN1_MAX_STRING_NEST 5
+#define ASN1_MAX_STRING_NEST 5
 #endif
 
 static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
-                        char inf, int tag, int aclass, int depth)
+    char inf, int tag, int aclass, int depth)
 {
     const unsigned char *p, *q;
     long plen;
@@ -1075,7 +1102,7 @@ static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
         }
 
         if (!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p,
-                             len, tag, aclass, 0, NULL)) {
+                len, tag, aclass, 0, NULL)) {
             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
             return 0;
         }
@@ -1139,9 +1166,9 @@ static int asn1_check_eoc(const unsigned char **in, long len)
  */
 
 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
-                           char *inf, char *cst,
-                           const unsigned char **in, long len,
-                           int exptag, int expclass, char opt, ASN1_TLC *ctx)
+    char *inf, char *cst,
+    const unsigned char **in, long len,
+    int exptag, int expclass, char opt, ASN1_TLC *ctx)
 {
     int i;
     int ptag, pclass;
@@ -1222,7 +1249,7 @@ static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
     *in = p;
     return 1;
 
- err:
+err:
     asn1_tlc_clear(ctx);
     return 0;
 }
diff --git a/crypto/openssl/crypto/asn1/tasn_enc.c b/crypto/openssl/crypto/asn1/tasn_enc.c
index f302b4b2e1e8..8dea9f365392 100644
--- a/crypto/openssl/crypto/asn1/tasn_enc.c
+++ b/crypto/openssl/crypto/asn1/tasn_enc.c
@@ -17,17 +17,17 @@
 #include "asn1_local.h"
 
 static int asn1_i2d_ex_primitive(const ASN1_VALUE **pval, unsigned char **out,
-                                 const ASN1_ITEM *it, int tag, int aclass);
+    const ASN1_ITEM *it, int tag, int aclass);
 static int asn1_set_seq_out(STACK_OF(const_ASN1_VALUE) *sk,
-                            unsigned char **out,
-                            int skcontlen, const ASN1_ITEM *item,
-                            int do_sort, int iclass);
+    unsigned char **out,
+    int skcontlen, const ASN1_ITEM *item,
+    int do_sort, int iclass);
 static int asn1_template_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
-                                const ASN1_TEMPLATE *tt, int tag, int aclass);
+    const ASN1_TEMPLATE *tt, int tag, int aclass);
 static int asn1_item_flags_i2d(const ASN1_VALUE *val, unsigned char **out,
-                               const ASN1_ITEM *it, int flags);
+    const ASN1_ITEM *it, int flags);
 static int asn1_ex_i2c(const ASN1_VALUE **pval, unsigned char *cout, int *putype,
-                       const ASN1_ITEM *it);
+    const ASN1_ITEM *it);
 
 /*
  * Top level i2d equivalents: the 'ndef' variant instructs the encoder to use
@@ -35,7 +35,7 @@ static int asn1_ex_i2c(const ASN1_VALUE **pval, unsigned char *cout, int *putype
  */
 
 int ASN1_item_ndef_i2d(const ASN1_VALUE *val, unsigned char **out,
-                       const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     return asn1_item_flags_i2d(val, out, it, ASN1_TFLG_NDEF);
 }
@@ -53,7 +53,7 @@ int ASN1_item_i2d(const ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *i
  */
 
 static int asn1_item_flags_i2d(const ASN1_VALUE *val, unsigned char **out,
-                               const ASN1_ITEM *it, int flags)
+    const ASN1_ITEM *it, int flags)
 {
     if (out != NULL && *out == NULL) {
         unsigned char *p, *buf;
@@ -79,7 +79,7 @@ static int asn1_item_flags_i2d(const ASN1_VALUE *val, unsigned char **out,
  */
 
 int ASN1_item_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
-                     const ASN1_ITEM *it, int tag, int aclass)
+    const ASN1_ITEM *it, int tag, int aclass)
 {
     const ASN1_TEMPLATE *tt = NULL;
     int i, seqcontlen, seqlen, ndef = 1;
@@ -92,7 +92,7 @@ int ASN1_item_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
 
     if (aux != NULL) {
         asn1_cb = ((aux->flags & ASN1_AFLG_CONST_CB) != 0) ? aux->asn1_const_cb
-            : (ASN1_aux_const_cb *)aux->asn1_cb; /* backward compatibility */
+                                                           : (ASN1_aux_const_cb *)aux->asn1_cb; /* backward compatibility */
     }
 
     switch (it->itype) {
@@ -100,7 +100,7 @@ int ASN1_item_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
     case ASN1_ITYPE_PRIMITIVE:
         if (it->templates)
             return asn1_template_ex_i2d(pval, out, it->templates,
-                                        tag, aclass);
+                tag, aclass);
         return asn1_i2d_ex_primitive(pval, out, it, tag, aclass);
 
     case ASN1_ITYPE_MSTRING:
@@ -206,13 +206,12 @@ int ASN1_item_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
 
     default:
         return 0;
-
     }
     return 0;
 }
 
 static int asn1_template_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
-                                const ASN1_TEMPLATE *tt, int tag, int iclass)
+    const ASN1_TEMPLATE *tt, int tag, int iclass)
 {
     const int flags = tt->flags;
     int i, ret, ttag, tclass, ndef, len;
@@ -303,7 +302,7 @@ static int asn1_template_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
         for (i = 0; i < sk_const_ASN1_VALUE_num(sk); i++) {
             skitem = sk_const_ASN1_VALUE_value(sk, i);
             len = ASN1_item_ex_i2d(&skitem, NULL, ASN1_ITEM_ptr(tt->item),
-                                   -1, iclass);
+                -1, iclass);
             if (len == -1 || (skcontlen > INT_MAX - len))
                 return -1;
             if (len == 0 && (tt->flags & ASN1_TFLG_OPTIONAL) == 0) {
@@ -332,7 +331,7 @@ static int asn1_template_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
         ASN1_put_object(out, ndef, skcontlen, sktag, skaclass);
         /* And the stuff itself */
         asn1_set_seq_out(sk, out, skcontlen, ASN1_ITEM_ptr(tt->item),
-                         isset, iclass);
+            isset, iclass);
         if (ndef == 2) {
             ASN1_put_eoc(out);
             if (flags & ASN1_TFLG_EXPTAG)
@@ -367,7 +366,7 @@ static int asn1_template_ex_i2d(const ASN1_VALUE **pval, unsigned char **out,
 
     /* Either normal or IMPLICIT tagging: combine class and flags */
     len = ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item),
-                              ttag, tclass | iclass);
+        ttag, tclass | iclass);
     if (len == 0 && (tt->flags & ASN1_TFLG_OPTIONAL) == 0) {
         ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_ZERO_CONTENT);
         return -1;
@@ -397,9 +396,9 @@ static int der_cmp(const void *a, const void *b)
 /* Output the content octets of SET OF or SEQUENCE OF */
 
 static int asn1_set_seq_out(STACK_OF(const_ASN1_VALUE) *sk,
-                            unsigned char **out,
-                            int skcontlen, const ASN1_ITEM *item,
-                            int do_sort, int iclass)
+    unsigned char **out,
+    int skcontlen, const ASN1_ITEM *item,
+    int do_sort, int iclass)
 {
     int i, ret = 0;
     const ASN1_VALUE *skitem;
@@ -412,7 +411,7 @@ static int asn1_set_seq_out(STACK_OF(const_ASN1_VALUE) *sk,
             do_sort = 0;
         else {
             derlst = OPENSSL_malloc(sk_const_ASN1_VALUE_num(sk)
-                                    * sizeof(*derlst));
+                * sizeof(*derlst));
             if (derlst == NULL)
                 return 0;
             tmpdat = OPENSSL_malloc(skcontlen);
@@ -460,7 +459,7 @@ err:
 }
 
 static int asn1_i2d_ex_primitive(const ASN1_VALUE **pval, unsigned char **out,
-                                 const ASN1_ITEM *it, int tag, int aclass)
+    const ASN1_ITEM *it, int tag, int aclass)
 {
     int len;
     int utype;
@@ -480,8 +479,7 @@ static int asn1_i2d_ex_primitive(const ASN1_VALUE **pval, unsigned char **out,
      * octets so don't include tag+length. We need to check here because the
      * call to asn1_ex_i2c() could change utype.
      */
-    if ((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) ||
-        (utype == V_ASN1_OTHER))
+    if ((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER))
         usetag = 0;
     else
         usetag = 1;
@@ -520,7 +518,7 @@ static int asn1_i2d_ex_primitive(const ASN1_VALUE **pval, unsigned char **out,
 /* Produce content octets from a structure */
 
 static int asn1_ex_i2c(const ASN1_VALUE **pval, unsigned char *cout, int *putype,
-                       const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     ASN1_BOOLEAN *tbool = NULL;
     ASN1_STRING *strtmp;
@@ -593,7 +591,7 @@ static int asn1_ex_i2c(const ASN1_VALUE **pval, unsigned char *cout, int *putype
 
     case V_ASN1_BIT_STRING:
         return ossl_i2c_ASN1_BIT_STRING((ASN1_BIT_STRING *)*pval,
-                                        cout ? &cout : NULL);
+            cout ? &cout : NULL);
 
     case V_ASN1_INTEGER:
     case V_ASN1_ENUMERATED:
@@ -635,7 +633,6 @@ static int asn1_ex_i2c(const ASN1_VALUE **pval, unsigned char *cout, int *putype
         len = strtmp->length;
 
         break;
-
     }
     if (cout && len)
         memcpy(cout, cont, len);
diff --git a/crypto/openssl/crypto/asn1/tasn_new.c b/crypto/openssl/crypto/asn1/tasn_new.c
index 00a5397a5e6c..721bb14b2acb 100644
--- a/crypto/openssl/crypto/asn1/tasn_new.c
+++ b/crypto/openssl/crypto/asn1/tasn_new.c
@@ -16,13 +16,13 @@
 #include "asn1_local.h"
 
 static int asn1_item_embed_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
-                               int embed, OSSL_LIB_CTX *libctx,
-                               const char *propq);
+    int embed, OSSL_LIB_CTX *libctx,
+    const char *propq);
 static int asn1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
-                              int embed);
+    int embed);
 static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it);
 static int asn1_template_new(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt,
-                             OSSL_LIB_CTX *libctx, const char *propq);
+    OSSL_LIB_CTX *libctx, const char *propq);
 static void asn1_template_clear(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
 static void asn1_primitive_clear(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
@@ -35,7 +35,7 @@ ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it)
 }
 
 ASN1_VALUE *ASN1_item_new_ex(const ASN1_ITEM *it, OSSL_LIB_CTX *libctx,
-                             const char *propq)
+    const char *propq)
 {
     ASN1_VALUE *ret = NULL;
     if (asn1_item_embed_new(&ret, it, 0, libctx, propq) > 0)
@@ -45,9 +45,8 @@ ASN1_VALUE *ASN1_item_new_ex(const ASN1_ITEM *it, OSSL_LIB_CTX *libctx,
 
 /* Allocate an ASN1 structure */
 
-
 int ossl_asn1_item_ex_new_intern(ASN1_VALUE **pval, const ASN1_ITEM *it,
-                                 OSSL_LIB_CTX *libctx, const char *propq)
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     return asn1_item_embed_new(pval, it, 0, libctx, propq);
 }
@@ -58,7 +57,7 @@ int ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
 }
 
 int asn1_item_embed_new(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed,
-                        OSSL_LIB_CTX *libctx, const char *propq)
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     const ASN1_TEMPLATE *tt = NULL;
     const ASN1_EXTERN_FUNCS *ef;
@@ -157,18 +156,17 @@ int asn1_item_embed_new(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed,
     }
     return 1;
 
- asn1err2:
+asn1err2:
     ossl_asn1_item_embed_free(pval, it, embed);
- asn1err:
+asn1err:
     ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
     return 0;
 
- auxerr2:
+auxerr2:
     ossl_asn1_item_embed_free(pval, it, embed);
- auxerr:
+auxerr:
     ERR_raise(ERR_LIB_ASN1, ASN1_R_AUX_ERROR);
     return 0;
-
 }
 
 static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
@@ -205,7 +203,7 @@ static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
 }
 
 static int asn1_template_new(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt,
-                             OSSL_LIB_CTX *libctx, const char *propq)
+    OSSL_LIB_CTX *libctx, const char *propq)
 {
     const ASN1_ITEM *it = ASN1_ITEM_ptr(tt->item);
     int embed = tt->flags & ASN1_TFLG_EMBED;
@@ -240,7 +238,7 @@ static int asn1_template_new(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt,
     }
     /* Otherwise pass it back to the item routine */
     ret = asn1_item_embed_new(pval, it, embed, libctx, propq);
- done:
+done:
     return ret;
 }
 
@@ -259,7 +257,7 @@ static void asn1_template_clear(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
  */
 
 static int asn1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
-                              int embed)
+    int embed)
 {
     ASN1_TYPE *typ;
     ASN1_STRING *str;
diff --git a/crypto/openssl/crypto/asn1/tasn_prn.c b/crypto/openssl/crypto/asn1/tasn_prn.c
index 73eadc5fd4f6..080b5623e422 100644
--- a/crypto/openssl/crypto/asn1/tasn_prn.c
+++ b/crypto/openssl/crypto/asn1/tasn_prn.c
@@ -26,10 +26,10 @@
 
 static ASN1_PCTX default_pctx = {
     ASN1_PCTX_FLAGS_SHOW_ABSENT, /* flags */
-    0,                          /* nm_flags */
-    0,                          /* cert_flags */
-    0,                          /* oid_flags */
-    0                           /* str_flags */
+    0, /* nm_flags */
+    0, /* cert_flags */
+    0, /* oid_flags */
+    0 /* str_flags */
 };
 
 ASN1_PCTX *ASN1_PCTX_new(void)
@@ -100,24 +100,24 @@ void ASN1_PCTX_set_str_flags(ASN1_PCTX *p, unsigned long flags)
 /* Main print routines */
 
 static int asn1_item_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
-                               const ASN1_ITEM *it,
-                               const char *fname, const char *sname,
-                               int nohdr, const ASN1_PCTX *pctx);
+    const ASN1_ITEM *it,
+    const char *fname, const char *sname,
+    int nohdr, const ASN1_PCTX *pctx);
 
 static int asn1_template_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
-                            const ASN1_TEMPLATE *tt, const ASN1_PCTX *pctx);
+    const ASN1_TEMPLATE *tt, const ASN1_PCTX *pctx);
 
 static int asn1_primitive_print(BIO *out, const ASN1_VALUE **fld,
-                                const ASN1_ITEM *it, int indent,
-                                const char *fname, const char *sname,
-                                const ASN1_PCTX *pctx);
+    const ASN1_ITEM *it, int indent,
+    const char *fname, const char *sname,
+    const ASN1_PCTX *pctx);
 
 static int asn1_print_fsname(BIO *out, int indent,
-                             const char *fname, const char *sname,
-                             const ASN1_PCTX *pctx);
+    const char *fname, const char *sname,
+    const ASN1_PCTX *pctx);
 
 int ASN1_item_print(BIO *out, const ASN1_VALUE *ifld, int indent,
-                    const ASN1_ITEM *it, const ASN1_PCTX *pctx)
+    const ASN1_ITEM *it, const ASN1_PCTX *pctx)
 {
     const char *sname;
     if (pctx == NULL)
@@ -130,9 +130,9 @@ int ASN1_item_print(BIO *out, const ASN1_VALUE *ifld, int indent,
 }
 
 static int asn1_item_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
-                               const ASN1_ITEM *it,
-                               const char *fname, const char *sname,
-                               int nohdr, const ASN1_PCTX *pctx)
+    const ASN1_ITEM *it,
+    const char *fname, const char *sname,
+    int nohdr, const ASN1_PCTX *pctx)
 {
     const ASN1_TEMPLATE *tt;
     const ASN1_EXTERN_FUNCS *ef;
@@ -146,11 +146,12 @@ static int asn1_item_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
         parg.indent = indent;
         parg.pctx = pctx;
         asn1_cb = ((aux->flags & ASN1_AFLG_CONST_CB) != 0) ? aux->asn1_const_cb
-            : (ASN1_aux_const_cb *)aux->asn1_cb; /* backward compatibility */
+                                                           : (ASN1_aux_const_cb *)aux->asn1_cb; /* backward compatibility */
     }
 
-   if (((it->itype != ASN1_ITYPE_PRIMITIVE)
-       || (it->utype != V_ASN1_BOOLEAN)) && *fld == NULL) {
+    if (((it->itype != ASN1_ITYPE_PRIMITIVE)
+            || (it->utype != V_ASN1_BOOLEAN))
+        && *fld == NULL) {
         if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_ABSENT) {
             if (!nohdr && !asn1_print_fsname(out, indent, fname, sname, pctx))
                 return 0;
@@ -164,7 +165,7 @@ static int asn1_item_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
     case ASN1_ITYPE_PRIMITIVE:
         if (it->templates) {
             if (!asn1_template_print_ctx(out, fld, indent,
-                                         it->templates, pctx))
+                    it->templates, pctx))
                 return 0;
             break;
         }
@@ -186,8 +187,7 @@ static int asn1_item_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
             if ((i == 2) && (BIO_puts(out, "\n") <= 0))
                 return 0;
             return 1;
-        } else if (sname &&
-                   BIO_printf(out, ":EXTERNAL TYPE %s\n", sname) <= 0)
+        } else if (sname && BIO_printf(out, ":EXTERNAL TYPE %s\n", sname) <= 0)
             return 0;
         break;
 
@@ -236,7 +236,7 @@ static int asn1_item_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
                 return 0;
             tmpfld = ossl_asn1_get_const_field_ptr(fld, seqtt);
             if (!asn1_template_print_ctx(out, tmpfld,
-                                         indent + 2, seqtt, pctx))
+                    indent + 2, seqtt, pctx))
                 return 0;
         }
         if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_SEQUENCE) {
@@ -260,7 +260,7 @@ static int asn1_item_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
 }
 
 static int asn1_template_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
-                            const ASN1_TEMPLATE *tt, const ASN1_PCTX *pctx)
+    const ASN1_TEMPLATE *tt, const ASN1_PCTX *pctx)
 {
     int i, flags;
     const char *sname, *fname;
@@ -297,7 +297,8 @@ static int asn1_template_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
                 else
                     tname = "SEQUENCE";
                 if (BIO_printf(out, "%*s%s OF %s {\n",
-                               indent, "", tname, tt->field_name) <= 0)
+                        indent, "", tname, tt->field_name)
+                    <= 0)
                     return 0;
             } else if (BIO_printf(out, "%*s%s:\n", indent, "", fname) <= 0)
                 return 0;
@@ -309,12 +310,11 @@ static int asn1_template_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
 
             skitem = sk_const_ASN1_VALUE_value(stack, i);
             if (!asn1_item_print_ctx(out, &skitem, indent + 2,
-                                     ASN1_ITEM_ptr(tt->item), NULL, NULL, 1,
-                                     pctx))
+                    ASN1_ITEM_ptr(tt->item), NULL, NULL, 1,
+                    pctx))
                 return 0;
         }
-        if (i == 0 && BIO_printf(out, "%*s<%s>\n", indent + 2, "",
-                                 stack == NULL ? "ABSENT" : "EMPTY") <= 0)
+        if (i == 0 && BIO_printf(out, "%*s<%s>\n", indent + 2, "", stack == NULL ? "ABSENT" : "EMPTY") <= 0)
             return 0;
         if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_SEQUENCE) {
             if (BIO_printf(out, "%*s}\n", indent, "") <= 0)
@@ -323,12 +323,12 @@ static int asn1_template_print_ctx(BIO *out, const ASN1_VALUE **fld, int indent,
         return 1;
     }
     return asn1_item_print_ctx(out, fld, indent, ASN1_ITEM_ptr(tt->item),
-                               fname, sname, 0, pctx);
+        fname, sname, 0, pctx);
 }
 
 static int asn1_print_fsname(BIO *out, int indent,
-                             const char *fname, const char *sname,
-                             const ASN1_PCTX *pctx)
+    const char *fname, const char *sname,
+    const ASN1_PCTX *pctx)
 {
     static const char spaces[] = "                    ";
     static const int nspaces = sizeof(spaces) - 1;
@@ -379,13 +379,11 @@ static int asn1_print_boolean(BIO *out, int boolval)
     default:
         str = "TRUE";
         break;
-
     }
 
     if (BIO_puts(out, str) <= 0)
         return 0;
     return 1;
-
 }
 
 static int asn1_print_integer(BIO *out, const ASN1_INTEGER *str)
@@ -423,15 +421,16 @@ static int asn1_print_obstring(BIO *out, const ASN1_STRING *str, int indent)
         return 0;
     if ((str->length > 0)
         && BIO_dump_indent(out, (const char *)str->data, str->length,
-                           indent + 2) <= 0)
+               indent + 2)
+            <= 0)
         return 0;
     return 1;
 }
 
 static int asn1_primitive_print(BIO *out, const ASN1_VALUE **fld,
-                                const ASN1_ITEM *it, int indent,
-                                const char *fname, const char *sname,
-                                const ASN1_PCTX *pctx)
+    const ASN1_ITEM *it, int indent,
+    const char *fname, const char *sname,
+    const ASN1_PCTX *pctx)
 {
     long utype;
     ASN1_STRING *str;
@@ -483,14 +482,12 @@ static int asn1_primitive_print(BIO *out, const ASN1_VALUE **fld,
     }
 
     switch (utype) {
-    case V_ASN1_BOOLEAN:
-        {
-            int boolval = *(int *)fld;
-            if (boolval == -1)
-                boolval = it->size;
-            ret = asn1_print_boolean(out, boolval);
-        }
-        break;
+    case V_ASN1_BOOLEAN: {
+        int boolval = *(int *)fld;
+        if (boolval == -1)
+            boolval = it->size;
+        ret = asn1_print_boolean(out, boolval);
+    } break;
 
     case V_ASN1_INTEGER:
     case V_ASN1_ENUMERATED:
@@ -527,7 +524,6 @@ static int asn1_primitive_print(BIO *out, const ASN1_VALUE **fld,
 
     default:
         ret = ASN1_STRING_print_ex(out, str, pctx->str_flags);
-
     }
     if (!ret)
         return 0;
diff --git a/crypto/openssl/crypto/asn1/tasn_scn.c b/crypto/openssl/crypto/asn1/tasn_scn.c
index 7ada313b9449..1e46cc90d2d8 100644
--- a/crypto/openssl/crypto/asn1/tasn_scn.c
+++ b/crypto/openssl/crypto/asn1/tasn_scn.c
@@ -22,7 +22,7 @@
  * passing details to a callback.
  */
 
-ASN1_SCTX *ASN1_SCTX_new(int (*scan_cb) (ASN1_SCTX *ctx))
+ASN1_SCTX *ASN1_SCTX_new(int (*scan_cb)(ASN1_SCTX *ctx))
 {
     ASN1_SCTX *ret = OPENSSL_zalloc(sizeof(*ret));
 
diff --git a/crypto/openssl/crypto/asn1/tasn_typ.c b/crypto/openssl/crypto/asn1/tasn_typ.c
index 8095e32370fc..0e25b75b9f05 100644
--- a/crypto/openssl/crypto/asn1/tasn_typ.c
+++ b/crypto/openssl/crypto/asn1/tasn_typ.c
@@ -13,17 +13,17 @@
 
 /* Declarations for string types */
 
-#define IMPLEMENT_ASN1_STRING_FUNCTIONS(sname) \
-    IMPLEMENT_ASN1_TYPE(sname) \
+#define IMPLEMENT_ASN1_STRING_FUNCTIONS(sname)                 \
+    IMPLEMENT_ASN1_TYPE(sname)                                 \
     IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(sname, sname, sname) \
-sname *sname##_new(void) \
-{ \
-    return ASN1_STRING_type_new(V_##sname); \
-} \
-void sname##_free(sname *x) \
-{ \
-    ASN1_STRING_free(x); \
-}
+    sname *sname##_new(void)                                   \
+    {                                                          \
+        return ASN1_STRING_type_new(V_##sname);                \
+    }                                                          \
+    void sname##_free(sname *x)                                \
+    {                                                          \
+        ASN1_STRING_free(x);                                   \
+    }
 
 IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_OCTET_STRING)
 IMPLEMENT_ASN1_STRING_FUNCTIONS(ASN1_INTEGER)
@@ -72,12 +72,10 @@ IMPLEMENT_ASN1_TYPE_ex(ASN1_FBOOLEAN, ASN1_BOOLEAN, 0)
 
 IMPLEMENT_ASN1_TYPE_ex(ASN1_OCTET_STRING_NDEF, ASN1_OCTET_STRING, ASN1_TFLG_NDEF)
 
-ASN1_ITEM_TEMPLATE(ASN1_SEQUENCE_ANY) =
-        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, ASN1_SEQUENCE_ANY, ASN1_ANY)
+ASN1_ITEM_TEMPLATE(ASN1_SEQUENCE_ANY) = ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, ASN1_SEQUENCE_ANY, ASN1_ANY)
 ASN1_ITEM_TEMPLATE_END(ASN1_SEQUENCE_ANY)
 
-ASN1_ITEM_TEMPLATE(ASN1_SET_ANY) =
-        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SET_OF, 0, ASN1_SET_ANY, ASN1_ANY)
+ASN1_ITEM_TEMPLATE(ASN1_SET_ANY) = ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SET_OF, 0, ASN1_SET_ANY, ASN1_ANY)
 ASN1_ITEM_TEMPLATE_END(ASN1_SET_ANY)
 
 IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(ASN1_SEQUENCE_ANY, ASN1_SEQUENCE_ANY, ASN1_SEQUENCE_ANY)
diff --git a/crypto/openssl/crypto/asn1/tasn_utl.c b/crypto/openssl/crypto/asn1/tasn_utl.c
index 67a9ccde62db..48a1f36de87f 100644
--- a/crypto/openssl/crypto/asn1/tasn_utl.c
+++ b/crypto/openssl/crypto/asn1/tasn_utl.c
@@ -20,7 +20,7 @@
 /* Utility functions for manipulating fields and offsets */
 
 /* Add 'offset' to 'addr' */
-#define offset2ptr(addr, offset) (void *)(((char *) addr) + offset)
+#define offset2ptr(addr, offset) (void *)(((char *)addr) + offset)
 
 /*
  * Given an ASN1_ITEM CHOICE type return the selector value
@@ -34,7 +34,7 @@ int ossl_asn1_get_choice_selector(ASN1_VALUE **pval, const ASN1_ITEM *it)
 }
 
 int ossl_asn1_get_choice_selector_const(const ASN1_VALUE **pval,
-                                        const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     int *sel = offset2ptr(*pval, it->utype);
 
@@ -46,7 +46,7 @@ int ossl_asn1_get_choice_selector_const(const ASN1_VALUE **pval,
  */
 
 int ossl_asn1_set_choice_selector(ASN1_VALUE **pval, int value,
-                                  const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     int *sel, ret;
 
@@ -99,7 +99,7 @@ int ossl_asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM *it)
         break;
     case -1:
         if (!CRYPTO_DOWN_REF(refcnt, &ret))
-            return -1;  /* failed */
+            return -1; /* failed */
         REF_PRINT_EX(it->sname, ret, (void *)it);
         REF_ASSERT_ISNT(ret < 0);
         if (ret == 0) {
@@ -126,7 +126,7 @@ static ASN1_ENCODING *asn1_get_enc_ptr(ASN1_VALUE **pval, const ASN1_ITEM *it)
 }
 
 static const ASN1_ENCODING *asn1_get_const_enc_ptr(const ASN1_VALUE **pval,
-                                                   const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     const ASN1_AUX *aux;
 
@@ -162,7 +162,7 @@ void ossl_asn1_enc_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
 }
 
 int ossl_asn1_enc_save(ASN1_VALUE **pval, const unsigned char *in, int inlen,
-                       const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     ASN1_ENCODING *enc = asn1_get_enc_ptr(pval, it);
 
@@ -182,7 +182,7 @@ int ossl_asn1_enc_save(ASN1_VALUE **pval, const unsigned char *in, int inlen,
 }
 
 int ossl_asn1_enc_restore(int *len, unsigned char **out, const ASN1_VALUE **pval,
-                          const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     const ASN1_ENCODING *enc = asn1_get_const_enc_ptr(pval, it);
 
@@ -211,7 +211,7 @@ ASN1_VALUE **ossl_asn1_get_field_ptr(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
 
 /* Given an ASN1_TEMPLATE get a const pointer to a field */
 const ASN1_VALUE **ossl_asn1_get_const_field_ptr(const ASN1_VALUE **pval,
-                                                 const ASN1_TEMPLATE *tt)
+    const ASN1_TEMPLATE *tt)
 {
     return offset2ptr(*pval, tt->offset);
 }
@@ -222,8 +222,8 @@ const ASN1_VALUE **ossl_asn1_get_const_field_ptr(const ASN1_VALUE **pval,
  */
 
 const ASN1_TEMPLATE *ossl_asn1_do_adb(const ASN1_VALUE *val,
-                                      const ASN1_TEMPLATE *tt,
-                                      int nullerr)
+    const ASN1_TEMPLATE *tt,
+    int nullerr)
 {
     const ASN1_ADB *adb;
     const ASN1_ADB_TABLE *atbl;
@@ -280,7 +280,7 @@ const ASN1_TEMPLATE *ossl_asn1_do_adb(const ASN1_VALUE *val,
         goto err;
     return adb->default_tt;
 
- err:
+err:
     /* FIXME: should log the value or OID of unsupported type */
     if (nullerr)
         ERR_raise(ERR_LIB_ASN1, ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE);
diff --git a/crypto/openssl/crypto/asn1/tbl_standard.h b/crypto/openssl/crypto/asn1/tbl_standard.h
index 3e8fe81eebdd..da9c299bed8b 100644
--- a/crypto/openssl/crypto/asn1/tbl_standard.h
+++ b/crypto/openssl/crypto/asn1/tbl_standard.h
@@ -9,54 +9,53 @@
 
 /* size limits: this stuff is taken straight from RFC3280 */
 
-#define ub_name                         32768
-#define ub_common_name                  64
-#define ub_locality_name                128
-#define ub_state_name                   128
-#define ub_organization_name            64
-#define ub_organization_unit_name       64
-#define ub_title                        64
-#define ub_email_address                128
-#define ub_serial_number                64
+#define ub_name 32768
+#define ub_common_name 64
+#define ub_locality_name 128
+#define ub_state_name 128
+#define ub_organization_name 64
+#define ub_organization_unit_name 64
+#define ub_title 64
+#define ub_email_address 128
+#define ub_serial_number 64
 
 /* From RFC4524 */
 
-#define ub_rfc822_mailbox               256
+#define ub_rfc822_mailbox 256
 
 /* This table must be kept in NID order */
 
 static const ASN1_STRING_TABLE tbl_standard[] = {
-    {NID_commonName, 1, ub_common_name, DIRSTRING_TYPE, 0},
-    {NID_countryName, 2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
-    {NID_localityName, 1, ub_locality_name, DIRSTRING_TYPE, 0},
-    {NID_stateOrProvinceName, 1, ub_state_name, DIRSTRING_TYPE, 0},
-    {NID_organizationName, 1, ub_organization_name, DIRSTRING_TYPE, 0},
-    {NID_organizationalUnitName, 1, ub_organization_unit_name, DIRSTRING_TYPE,
-     0},
-    {NID_pkcs9_emailAddress, 1, ub_email_address, B_ASN1_IA5STRING,
-     STABLE_NO_MASK},
-    {NID_pkcs9_unstructuredName, 1, -1, PKCS9STRING_TYPE, 0},
-    {NID_pkcs9_challengePassword, 1, -1, PKCS9STRING_TYPE, 0},
-    {NID_pkcs9_unstructuredAddress, 1, -1, DIRSTRING_TYPE, 0},
-    {NID_givenName, 1, ub_name, DIRSTRING_TYPE, 0},
-    {NID_surname, 1, ub_name, DIRSTRING_TYPE, 0},
-    {NID_initials, 1, ub_name, DIRSTRING_TYPE, 0},
-    {NID_serialNumber, 1, ub_serial_number, B_ASN1_PRINTABLESTRING,
-     STABLE_NO_MASK},
-    {NID_friendlyName, -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK},
-    {NID_name, 1, ub_name, DIRSTRING_TYPE, 0},
-    {NID_dnQualifier, -1, -1, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
-    {NID_domainComponent, 1, -1, B_ASN1_IA5STRING, STABLE_NO_MASK},
-    {NID_ms_csp_name, -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK},
-    {NID_rfc822Mailbox, 1, ub_rfc822_mailbox, B_ASN1_IA5STRING,
-     STABLE_NO_MASK},
-    {NID_jurisdictionCountryName, 2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
-    {NID_INN, 1, 12, B_ASN1_NUMERICSTRING, STABLE_NO_MASK},
-    {NID_OGRN, 1, 13, B_ASN1_NUMERICSTRING, STABLE_NO_MASK},
-    {NID_SNILS, 1, 11, B_ASN1_NUMERICSTRING, STABLE_NO_MASK},
-    {NID_countryCode3c, 3, 3, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
-    {NID_countryCode3n, 3, 3, B_ASN1_NUMERICSTRING, STABLE_NO_MASK},
-    {NID_dnsName, 0, -1, B_ASN1_UTF8STRING, STABLE_NO_MASK},
-    {NID_id_on_SmtpUTF8Mailbox, 1, ub_email_address, B_ASN1_UTF8STRING, STABLE_NO_MASK}
+    { NID_commonName, 1, ub_common_name, DIRSTRING_TYPE, 0 },
+    { NID_countryName, 2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK },
+    { NID_localityName, 1, ub_locality_name, DIRSTRING_TYPE, 0 },
+    { NID_stateOrProvinceName, 1, ub_state_name, DIRSTRING_TYPE, 0 },
+    { NID_organizationName, 1, ub_organization_name, DIRSTRING_TYPE, 0 },
+    { NID_organizationalUnitName, 1, ub_organization_unit_name, DIRSTRING_TYPE,
+        0 },
+    { NID_pkcs9_emailAddress, 1, ub_email_address, B_ASN1_IA5STRING,
+        STABLE_NO_MASK },
+    { NID_pkcs9_unstructuredName, 1, -1, PKCS9STRING_TYPE, 0 },
+    { NID_pkcs9_challengePassword, 1, -1, PKCS9STRING_TYPE, 0 },
+    { NID_pkcs9_unstructuredAddress, 1, -1, DIRSTRING_TYPE, 0 },
+    { NID_givenName, 1, ub_name, DIRSTRING_TYPE, 0 },
+    { NID_surname, 1, ub_name, DIRSTRING_TYPE, 0 },
+    { NID_initials, 1, ub_name, DIRSTRING_TYPE, 0 },
+    { NID_serialNumber, 1, ub_serial_number, B_ASN1_PRINTABLESTRING,
+        STABLE_NO_MASK },
+    { NID_friendlyName, -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK },
+    { NID_name, 1, ub_name, DIRSTRING_TYPE, 0 },
+    { NID_dnQualifier, -1, -1, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK },
+    { NID_domainComponent, 1, -1, B_ASN1_IA5STRING, STABLE_NO_MASK },
+    { NID_ms_csp_name, -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK },
+    { NID_rfc822Mailbox, 1, ub_rfc822_mailbox, B_ASN1_IA5STRING,
+        STABLE_NO_MASK },
+    { NID_jurisdictionCountryName, 2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK },
+    { NID_INN, 1, 12, B_ASN1_NUMERICSTRING, STABLE_NO_MASK },
+    { NID_OGRN, 1, 13, B_ASN1_NUMERICSTRING, STABLE_NO_MASK },
+    { NID_SNILS, 1, 11, B_ASN1_NUMERICSTRING, STABLE_NO_MASK },
+    { NID_countryCode3c, 3, 3, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK },
+    { NID_countryCode3n, 3, 3, B_ASN1_NUMERICSTRING, STABLE_NO_MASK },
+    { NID_dnsName, 0, -1, B_ASN1_UTF8STRING, STABLE_NO_MASK },
+    { NID_id_on_SmtpUTF8Mailbox, 1, ub_email_address, B_ASN1_UTF8STRING, STABLE_NO_MASK }
 };
-
diff --git a/crypto/openssl/crypto/asn1/x_algor.c b/crypto/openssl/crypto/asn1/x_algor.c
index db9dd06e4940..f8faf7209b19 100644
--- a/crypto/openssl/crypto/asn1/x_algor.c
+++ b/crypto/openssl/crypto/asn1/x_algor.c
@@ -16,12 +16,11 @@
 #include "crypto/evp.h"
 
 ASN1_SEQUENCE(X509_ALGOR) = {
-        ASN1_SIMPLE(X509_ALGOR, algorithm, ASN1_OBJECT),
-        ASN1_OPT(X509_ALGOR, parameter, ASN1_ANY)
+    ASN1_SIMPLE(X509_ALGOR, algorithm, ASN1_OBJECT),
+    ASN1_OPT(X509_ALGOR, parameter, ASN1_ANY)
 } ASN1_SEQUENCE_END(X509_ALGOR)
 
-ASN1_ITEM_TEMPLATE(X509_ALGORS) =
-        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, algorithms, X509_ALGOR)
+ASN1_ITEM_TEMPLATE(X509_ALGORS) = ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, algorithms, X509_ALGOR)
 ASN1_ITEM_TEMPLATE_END(X509_ALGORS)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_ALGOR)
@@ -34,7 +33,7 @@ int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval)
         return 0;
 
     if (ptype != V_ASN1_UNDEF && alg->parameter == NULL
-            && (alg->parameter = ASN1_TYPE_new()) == NULL)
+        && (alg->parameter = ASN1_TYPE_new()) == NULL)
         return 0;
 
     ASN1_OBJECT_free(alg->algorithm);
@@ -63,14 +62,14 @@ X509_ALGOR *ossl_X509_ALGOR_from_nid(int nid, int ptype, void *pval)
         return alg;
     alg->algorithm = NULL; /* precaution to prevent double free */
 
- err:
+err:
     X509_ALGOR_free(alg);
     /* ASN1_OBJECT_free(algo) is not needed due to OBJ_nid2obj() */
     return NULL;
 }
 
 void X509_ALGOR_get0(const ASN1_OBJECT **paobj, int *pptype,
-                     const void **ppval, const X509_ALGOR *algor)
+    const void **ppval, const X509_ALGOR *algor)
 {
     if (paobj)
         *paobj = algor->algorithm;
@@ -111,7 +110,7 @@ int X509_ALGOR_copy(X509_ALGOR *dest, const X509_ALGOR *src)
         return 0;
 
     if (dest->algorithm)
-         ASN1_OBJECT_free(dest->algorithm);
+        ASN1_OBJECT_free(dest->algorithm);
     dest->algorithm = NULL;
 
     if (dest->parameter)
@@ -131,7 +130,8 @@ int X509_ALGOR_copy(X509_ALGOR *dest, const X509_ALGOR *src)
          * set does copy as a side effect.
          */
         if (ASN1_TYPE_set1(dest->parameter, src->parameter->type,
-                           src->parameter->value.ptr) == 0)
+                src->parameter->value.ptr)
+            == 0)
             return 0;
     }
 
@@ -171,7 +171,7 @@ X509_ALGOR *ossl_x509_algor_mgf1_decode(X509_ALGOR *alg)
     if (OBJ_obj2nid(alg->algorithm) != NID_mgf1)
         return NULL;
     return ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(X509_ALGOR),
-                                     alg->parameter);
+        alg->parameter);
 }
 
 /* Allocate and set MGF1 algorithm ID from EVP_MD */
@@ -187,12 +187,12 @@ int ossl_x509_algor_md_to_mgf1(X509_ALGOR **palg, const EVP_MD *mgf1md)
     if (!ossl_x509_algor_new_from_md(&algtmp, mgf1md))
         goto err;
     if (ASN1_item_pack(algtmp, ASN1_ITEM_rptr(X509_ALGOR), &stmp) == NULL)
-         goto err;
+        goto err;
     *palg = ossl_X509_ALGOR_from_nid(NID_mgf1, V_ASN1_SEQUENCE, stmp);
     if (*palg == NULL)
         goto err;
     stmp = NULL;
- err:
+err:
     ASN1_STRING_free(stmp);
     X509_ALGOR_free(algtmp);
     return *palg != NULL;
diff --git a/crypto/openssl/crypto/asn1/x_bignum.c b/crypto/openssl/crypto/asn1/x_bignum.c
index 3ae58a49f0b2..efa2ade30fad 100644
--- a/crypto/openssl/crypto/asn1/x_bignum.c
+++ b/crypto/openssl/crypto/asn1/x_bignum.c
@@ -19,20 +19,20 @@
  * is normally due to an encoding error.
  */
 
-#define BN_SENSITIVE    1
+#define BN_SENSITIVE 1
 
 static int bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
 static int bn_secure_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
 static void bn_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 static int bn_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
-                  const ASN1_ITEM *it);
+    const ASN1_ITEM *it);
 static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                  int utype, char *free_cont, const ASN1_ITEM *it);
+    int utype, char *free_cont, const ASN1_ITEM *it);
 static int bn_secure_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                         int utype, char *free_cont, const ASN1_ITEM *it);
+    int utype, char *free_cont, const ASN1_ITEM *it);
 static int bn_print(BIO *out, const ASN1_VALUE **pval, const ASN1_ITEM *it,
-                    int indent, const ASN1_PCTX *pctx);
+    int indent, const ASN1_PCTX *pctx);
 
 static ASN1_PRIMITIVE_FUNCS bignum_pf = {
     NULL, 0,
@@ -55,14 +55,13 @@ static ASN1_PRIMITIVE_FUNCS cbignum_pf = {
 };
 
 ASN1_ITEM_start(BIGNUM)
-        ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &bignum_pf, 0, "BIGNUM"
-ASN1_ITEM_end(BIGNUM)
+    ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &bignum_pf, 0, "BIGNUM" ASN1_ITEM_end(BIGNUM)
 
-ASN1_ITEM_start(CBIGNUM)
-        ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &cbignum_pf, BN_SENSITIVE, "CBIGNUM"
-ASN1_ITEM_end(CBIGNUM)
+                                                ASN1_ITEM_start(CBIGNUM) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &cbignum_pf, BN_SENSITIVE, "CBIGNUM" ASN1_ITEM_end(CBIGNUM)
 
-static int bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
+                                                            static int bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
 {
     *pval = (ASN1_VALUE *)BN_new();
     if (*pval != NULL)
@@ -92,7 +91,7 @@ static void bn_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
 }
 
 static int bn_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
-                  const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     BIGNUM *bn;
     int pad;
@@ -113,7 +112,7 @@ static int bn_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
 }
 
 static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                  int utype, char *free_cont, const ASN1_ITEM *it)
+    int utype, char *free_cont, const ASN1_ITEM *it)
 {
     BIGNUM *bn;
 
@@ -128,7 +127,7 @@ static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
 }
 
 static int bn_secure_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                         int utype, char *free_cont, const ASN1_ITEM *it)
+    int utype, char *free_cont, const ASN1_ITEM *it)
 {
     int ret;
     BIGNUM *bn;
@@ -147,7 +146,7 @@ static int bn_secure_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
 }
 
 static int bn_print(BIO *out, const ASN1_VALUE **pval, const ASN1_ITEM *it,
-                    int indent, const ASN1_PCTX *pctx)
+    int indent, const ASN1_PCTX *pctx)
 {
     if (!BN_print(out, *(BIGNUM **)pval))
         return 0;
diff --git a/crypto/openssl/crypto/asn1/x_int64.c b/crypto/openssl/crypto/asn1/x_int64.c
index b7251b8ad8b6..f7cd7cbd95e7 100644
--- a/crypto/openssl/crypto/asn1/x_int64.c
+++ b/crypto/openssl/crypto/asn1/x_int64.c
@@ -23,8 +23,8 @@
 /*
  * We abuse the ASN1_ITEM fields |size| as a flags field
  */
-#define INTxx_FLAG_ZERO_DEFAULT (1<<0)
-#define INTxx_FLAG_SIGNED       (1<<1)
+#define INTxx_FLAG_ZERO_DEFAULT (1 << 0)
+#define INTxx_FLAG_SIGNED (1 << 1)
 
 static int uint64_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
 {
@@ -45,7 +45,7 @@ static void uint64_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
 }
 
 static int uint64_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
-                      const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     uint64_t utmp;
     int neg = 0;
@@ -69,7 +69,7 @@ static int uint64_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
 }
 
 static int uint64_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                      int utype, char *free_cont, const ASN1_ITEM *it)
+    int utype, char *free_cont, const ASN1_ITEM *it)
 {
     uint64_t utmp = 0;
     char *cp;
@@ -96,7 +96,7 @@ static int uint64_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
         return 0;
     }
     if ((it->size & INTxx_FLAG_SIGNED) == INTxx_FLAG_SIGNED
-            && !neg && utmp > INT64_MAX) {
+        && !neg && utmp > INT64_MAX) {
         ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LARGE);
         return 0;
     }
@@ -104,13 +104,13 @@ static int uint64_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
         /* ossl_c2i_uint64_int() returns positive values */
         utmp = 0 - utmp;
 
- long_compat:
+long_compat:
     memcpy(cp, &utmp, sizeof(utmp));
     return 1;
 }
 
 static int uint64_print(BIO *out, const ASN1_VALUE **pval, const ASN1_ITEM *it,
-                        int indent, const ASN1_PCTX *pctx)
+    int indent, const ASN1_PCTX *pctx)
 {
     if ((it->size & INTxx_FLAG_SIGNED) == INTxx_FLAG_SIGNED)
         return BIO_printf(out, "%jd\n", **(int64_t **)pval);
@@ -138,7 +138,7 @@ static void uint32_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
 }
 
 static int uint32_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
-                      const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     uint32_t utmp;
     int neg = 0;
@@ -169,7 +169,7 @@ static int uint32_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
 #define ABS_INT32_MIN ((uint32_t)INT32_MAX + 1)
 
 static int uint32_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                      int utype, char *free_cont, const ASN1_ITEM *it)
+    int utype, char *free_cont, const ASN1_ITEM *it)
 {
     uint64_t utmp = 0;
     uint32_t utmp2 = 0;
@@ -210,21 +210,20 @@ static int uint32_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
         }
     }
 
- long_compat:
+long_compat:
     utmp2 = (uint32_t)utmp;
     memcpy(cp, &utmp2, sizeof(utmp2));
     return 1;
 }
 
 static int uint32_print(BIO *out, const ASN1_VALUE **pval, const ASN1_ITEM *it,
-                        int indent, const ASN1_PCTX *pctx)
+    int indent, const ASN1_PCTX *pctx)
 {
     if ((it->size & INTxx_FLAG_SIGNED) == INTxx_FLAG_SIGNED)
         return BIO_printf(out, "%d\n", (int)**(int32_t **)pval);
     return BIO_printf(out, "%u\n", (unsigned int)**(uint32_t **)pval);
 }
 
-
 /* Define the primitives themselves */
 
 static ASN1_PRIMITIVE_FUNCS uint32_pf = {
@@ -248,40 +247,32 @@ static ASN1_PRIMITIVE_FUNCS uint64_pf = {
 };
 
 ASN1_ITEM_start(INT32)
-    ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &uint32_pf,
-    INTxx_FLAG_SIGNED, "INT32"
-ASN1_ITEM_end(INT32)
-
-ASN1_ITEM_start(UINT32)
-    ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &uint32_pf, 0, "UINT32"
-ASN1_ITEM_end(UINT32)
+    ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &uint32_pf,
+    INTxx_FLAG_SIGNED, "INT32" ASN1_ITEM_end(INT32)
 
-ASN1_ITEM_start(INT64)
-    ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &uint64_pf,
-    INTxx_FLAG_SIGNED, "INT64"
-ASN1_ITEM_end(INT64)
+                           ASN1_ITEM_start(UINT32) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &uint32_pf, 0, "UINT32" ASN1_ITEM_end(UINT32)
 
-ASN1_ITEM_start(UINT64)
-    ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &uint64_pf, 0, "UINT64"
-ASN1_ITEM_end(UINT64)
+                                                ASN1_ITEM_start(INT64) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &uint64_pf,
+    INTxx_FLAG_SIGNED, "INT64" ASN1_ITEM_end(INT64)
 
-ASN1_ITEM_start(ZINT32)
-    ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &uint32_pf,
-    INTxx_FLAG_ZERO_DEFAULT|INTxx_FLAG_SIGNED, "ZINT32"
-ASN1_ITEM_end(ZINT32)
+                           ASN1_ITEM_start(UINT64) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &uint64_pf, 0, "UINT64" ASN1_ITEM_end(UINT64)
 
-ASN1_ITEM_start(ZUINT32)
-    ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &uint32_pf,
-    INTxx_FLAG_ZERO_DEFAULT, "ZUINT32"
-ASN1_ITEM_end(ZUINT32)
+                                                ASN1_ITEM_start(ZINT32) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &uint32_pf,
+    INTxx_FLAG_ZERO_DEFAULT | INTxx_FLAG_SIGNED, "ZINT32" ASN1_ITEM_end(ZINT32)
 
-ASN1_ITEM_start(ZINT64)
-    ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &uint64_pf,
-    INTxx_FLAG_ZERO_DEFAULT|INTxx_FLAG_SIGNED, "ZINT64"
-ASN1_ITEM_end(ZINT64)
+                                                     ASN1_ITEM_start(ZUINT32) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &uint32_pf,
+    INTxx_FLAG_ZERO_DEFAULT, "ZUINT32" ASN1_ITEM_end(ZUINT32)
 
-ASN1_ITEM_start(ZUINT64)
-    ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &uint64_pf,
-    INTxx_FLAG_ZERO_DEFAULT, "ZUINT64"
-ASN1_ITEM_end(ZUINT64)
+                                 ASN1_ITEM_start(ZINT64) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &uint64_pf,
+    INTxx_FLAG_ZERO_DEFAULT | INTxx_FLAG_SIGNED, "ZINT64" ASN1_ITEM_end(ZINT64)
 
+                                                     ASN1_ITEM_start(ZUINT64) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &uint64_pf,
+    INTxx_FLAG_ZERO_DEFAULT, "ZUINT64" ASN1_ITEM_end(ZUINT64)
diff --git a/crypto/openssl/crypto/asn1/x_long.c b/crypto/openssl/crypto/asn1/x_long.c
index 0685780f08a0..4dc9dc6c6bd0 100644
--- a/crypto/openssl/crypto/asn1/x_long.c
+++ b/crypto/openssl/crypto/asn1/x_long.c
@@ -22,31 +22,30 @@ static int long_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
 static void long_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 static int long_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
-                    const ASN1_ITEM *it);
+    const ASN1_ITEM *it);
 static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                    int utype, char *free_cont, const ASN1_ITEM *it);
+    int utype, char *free_cont, const ASN1_ITEM *it);
 static int long_print(BIO *out, const ASN1_VALUE **pval, const ASN1_ITEM *it,
-                      int indent, const ASN1_PCTX *pctx);
+    int indent, const ASN1_PCTX *pctx);
 
 static ASN1_PRIMITIVE_FUNCS long_pf = {
     NULL, 0,
     long_new,
     long_free,
-    long_free,                  /* Clear should set to initial value */
+    long_free, /* Clear should set to initial value */
     long_c2i,
     long_i2c,
     long_print
 };
 
 ASN1_ITEM_start(LONG)
-        ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &long_pf, ASN1_LONG_UNDEF, "LONG"
-ASN1_ITEM_end(LONG)
+    ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &long_pf, ASN1_LONG_UNDEF, "LONG" ASN1_ITEM_end(LONG)
 
-ASN1_ITEM_start(ZLONG)
-        ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &long_pf, 0, "ZLONG"
-ASN1_ITEM_end(ZLONG)
+                                                            ASN1_ITEM_start(ZLONG) ASN1_ITYPE_PRIMITIVE,
+    V_ASN1_INTEGER, NULL, 0, &long_pf, 0, "ZLONG" ASN1_ITEM_end(ZLONG)
 
-static int long_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
+                                              static int long_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
 {
     memcpy(pval, &it->size, COPY_SIZE(*pval, it->size));
     return 1;
@@ -83,7 +82,7 @@ static int num_bits_ulong(unsigned long value)
 }
 
 static int long_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
-                    const ASN1_ITEM *it)
+    const ASN1_ITEM *it)
 {
     long ltmp;
     unsigned long utmp, sign;
@@ -126,7 +125,7 @@ static int long_i2c(const ASN1_VALUE **pval, unsigned char *cont, int *putype,
 }
 
 static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-                    int utype, char *free_cont, const ASN1_ITEM *it)
+    int utype, char *free_cont, const ASN1_ITEM *it)
 {
     int i;
     long ltmp;
@@ -187,7 +186,7 @@ static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
 }
 
 static int long_print(BIO *out, const ASN1_VALUE **pval, const ASN1_ITEM *it,
-                      int indent, const ASN1_PCTX *pctx)
+    int indent, const ASN1_PCTX *pctx)
 {
     long l;
 
diff --git a/crypto/openssl/crypto/asn1/x_sig.c b/crypto/openssl/crypto/asn1/x_sig.c
index 759a9566531e..3932ff6f2cea 100644
--- a/crypto/openssl/crypto/asn1/x_sig.c
+++ b/crypto/openssl/crypto/asn1/x_sig.c
@@ -14,14 +14,14 @@
 #include "crypto/x509.h"
 
 ASN1_SEQUENCE(X509_SIG) = {
-        ASN1_SIMPLE(X509_SIG, algor, X509_ALGOR),
-        ASN1_SIMPLE(X509_SIG, digest, ASN1_OCTET_STRING)
+    ASN1_SIMPLE(X509_SIG, algor, X509_ALGOR),
+    ASN1_SIMPLE(X509_SIG, digest, ASN1_OCTET_STRING)
 } ASN1_SEQUENCE_END(X509_SIG)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_SIG)
 
 void X509_SIG_get0(const X509_SIG *sig, const X509_ALGOR **palg,
-                   const ASN1_OCTET_STRING **pdigest)
+    const ASN1_OCTET_STRING **pdigest)
 {
     if (palg)
         *palg = sig->algor;
@@ -30,7 +30,7 @@ void X509_SIG_get0(const X509_SIG *sig, const X509_ALGOR **palg,
 }
 
 void X509_SIG_getm(X509_SIG *sig, X509_ALGOR **palg,
-                   ASN1_OCTET_STRING **pdigest)
+    ASN1_OCTET_STRING **pdigest)
 {
     if (palg)
         *palg = sig->algor;
diff --git a/crypto/openssl/crypto/asn1/x_spki.c b/crypto/openssl/crypto/asn1/x_spki.c
index 2d7de66eb79c..91fbda8bfc9e 100644
--- a/crypto/openssl/crypto/asn1/x_spki.c
+++ b/crypto/openssl/crypto/asn1/x_spki.c
@@ -13,16 +13,16 @@
 #include <openssl/asn1t.h>
 
 ASN1_SEQUENCE(NETSCAPE_SPKAC) = {
-        ASN1_SIMPLE(NETSCAPE_SPKAC, pubkey, X509_PUBKEY),
-        ASN1_SIMPLE(NETSCAPE_SPKAC, challenge, ASN1_IA5STRING)
+    ASN1_SIMPLE(NETSCAPE_SPKAC, pubkey, X509_PUBKEY),
+    ASN1_SIMPLE(NETSCAPE_SPKAC, challenge, ASN1_IA5STRING)
 } ASN1_SEQUENCE_END(NETSCAPE_SPKAC)
 
 IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKAC)
 
 ASN1_SEQUENCE(NETSCAPE_SPKI) = {
-        ASN1_SIMPLE(NETSCAPE_SPKI, spkac, NETSCAPE_SPKAC),
-        ASN1_EMBED(NETSCAPE_SPKI, sig_algor, X509_ALGOR),
-        ASN1_SIMPLE(NETSCAPE_SPKI, signature, ASN1_BIT_STRING)
+    ASN1_SIMPLE(NETSCAPE_SPKI, spkac, NETSCAPE_SPKAC),
+    ASN1_EMBED(NETSCAPE_SPKI, sig_algor, X509_ALGOR),
+    ASN1_SIMPLE(NETSCAPE_SPKI, signature, ASN1_BIT_STRING)
 } ASN1_SEQUENCE_END(NETSCAPE_SPKI)
 
 IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKI)
diff --git a/crypto/openssl/crypto/asn1/x_val.c b/crypto/openssl/crypto/asn1/x_val.c
index a4e57cbcc714..fdde195b71e0 100644
--- a/crypto/openssl/crypto/asn1/x_val.c
+++ b/crypto/openssl/crypto/asn1/x_val.c
@@ -13,8 +13,8 @@
 #include <openssl/x509.h>
 
 ASN1_SEQUENCE(X509_VAL) = {
-        ASN1_SIMPLE(X509_VAL, notBefore, ASN1_TIME),
-        ASN1_SIMPLE(X509_VAL, notAfter, ASN1_TIME)
+    ASN1_SIMPLE(X509_VAL, notBefore, ASN1_TIME),
+    ASN1_SIMPLE(X509_VAL, notAfter, ASN1_TIME)
 } ASN1_SEQUENCE_END(X509_VAL)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_VAL)
diff --git a/crypto/openssl/crypto/asn1_dsa.c b/crypto/openssl/crypto/asn1_dsa.c
index 0782fe7c2a54..2f338da176a9 100644
--- a/crypto/openssl/crypto/asn1_dsa.c
+++ b/crypto/openssl/crypto/asn1_dsa.c
@@ -43,11 +43,11 @@ int ossl_encode_der_length(WPACKET *pkt, size_t cont_len)
 
     if (cont_len > 0xff) {
         if (!WPACKET_put_bytes_u8(pkt, 0x82)
-                || !WPACKET_put_bytes_u16(pkt, cont_len))
+            || !WPACKET_put_bytes_u16(pkt, cont_len))
             return 0;
     } else {
         if (cont_len > 0x7f
-                && !WPACKET_put_bytes_u8(pkt, 0x81))
+            && !WPACKET_put_bytes_u8(pkt, 0x81))
             return 0;
         if (!WPACKET_put_bytes_u8(pkt, cont_len))
             return 0;
@@ -83,14 +83,14 @@ int ossl_encode_der_integer(WPACKET *pkt, const BIGNUM *n)
     cont_len = BN_num_bits(n) / 8 + 1;
 
     if (!WPACKET_start_sub_packet(pkt)
-            || !WPACKET_put_bytes_u8(pkt, ID_INTEGER)
-            || !ossl_encode_der_length(pkt, cont_len)
-            || !WPACKET_allocate_bytes(pkt, cont_len, &bnbytes)
-            || !WPACKET_close(pkt))
+        || !WPACKET_put_bytes_u8(pkt, ID_INTEGER)
+        || !ossl_encode_der_length(pkt, cont_len)
+        || !WPACKET_allocate_bytes(pkt, cont_len, &bnbytes)
+        || !WPACKET_close(pkt))
         return 0;
 
     if (bnbytes != NULL
-            && BN_bn2binpad(n, bnbytes, (int)cont_len) != (int)cont_len)
+        && BN_bn2binpad(n, bnbytes, (int)cont_len) != (int)cont_len)
         return 0;
 
     return 1;
@@ -123,9 +123,9 @@ int ossl_encode_der_dsa_sig(WPACKET *pkt, const BIGNUM *r, const BIGNUM *s)
 
     /* Calculate the content length */
     if (!ossl_encode_der_integer(dummypkt, r)
-            || !ossl_encode_der_integer(dummypkt, s)
-            || !WPACKET_get_length(dummypkt, &cont_len)
-            || (!isnull && !WPACKET_finish(dummypkt))) {
+        || !ossl_encode_der_integer(dummypkt, s)
+        || !WPACKET_get_length(dummypkt, &cont_len)
+        || (!isnull && !WPACKET_finish(dummypkt))) {
         if (!isnull)
             WPACKET_cleanup(dummypkt);
         return 0;
@@ -133,14 +133,14 @@ int ossl_encode_der_dsa_sig(WPACKET *pkt, const BIGNUM *r, const BIGNUM *s)
 
     /* Add the tag and length bytes */
     if (!WPACKET_put_bytes_u8(pkt, ID_SEQUENCE)
-            || !ossl_encode_der_length(pkt, cont_len)
-               /*
-                * Really encode the integers. We already wrote to the main pkt
-                * if it had a NULL buffer, so don't do it again
-                */
-            || (!isnull && !ossl_encode_der_integer(pkt, r))
-            || (!isnull && !ossl_encode_der_integer(pkt, s))
-            || !WPACKET_close(pkt))
+        || !ossl_encode_der_length(pkt, cont_len)
+        /*
+         * Really encode the integers. We already wrote to the main pkt
+         * if it had a NULL buffer, so don't do it again
+         */
+        || (!isnull && !ossl_encode_der_integer(pkt, r))
+        || (!isnull && !ossl_encode_der_integer(pkt, s))
+        || !WPACKET_close(pkt))
         return 0;
 
     return 1;
@@ -191,25 +191,26 @@ int ossl_decode_der_integer(PACKET *pkt, BIGNUM *n)
 
     /* Check we have an integer and get the content bytes */
     if (!PACKET_get_1(pkt, &tag)
-            || tag != ID_INTEGER
-            || !ossl_decode_der_length(pkt, &contpkt))
+        || tag != ID_INTEGER
+        || !ossl_decode_der_length(pkt, &contpkt))
         return 0;
 
     /* Peek ahead at the first bytes to check for proper encoding */
     tmppkt = contpkt;
     /* The INTEGER must be positive */
     if (!PACKET_get_1(&tmppkt, &tmp)
-            || (tmp & 0x80) != 0)
+        || (tmp & 0x80) != 0)
         return 0;
     /* If there a zero padding byte the next byte must have the msb set */
     if (PACKET_remaining(&tmppkt) > 0 && tmp == 0) {
         if (!PACKET_get_1(&tmppkt, &tmp)
-                || (tmp & 0x80) == 0)
+            || (tmp & 0x80) == 0)
             return 0;
     }
 
     if (BN_bin2bn(PACKET_data(&contpkt),
-                  (int)PACKET_remaining(&contpkt), n) == NULL)
+            (int)PACKET_remaining(&contpkt), n)
+        == NULL)
         return 0;
 
     return 1;
@@ -231,19 +232,19 @@ int ossl_decode_der_integer(PACKET *pkt, BIGNUM *n)
  * were consumed.
  */
 size_t ossl_decode_der_dsa_sig(BIGNUM *r, BIGNUM *s,
-                               const unsigned char **ppin, size_t len)
+    const unsigned char **ppin, size_t len)
 {
     size_t consumed;
     PACKET pkt, contpkt;
     unsigned int tag;
 
     if (!PACKET_buf_init(&pkt, *ppin, len)
-            || !PACKET_get_1(&pkt, &tag)
-            || tag != ID_SEQUENCE
-            || !ossl_decode_der_length(&pkt, &contpkt)
-            || !ossl_decode_der_integer(&contpkt, r)
-            || !ossl_decode_der_integer(&contpkt, s)
-            || PACKET_remaining(&contpkt) != 0)
+        || !PACKET_get_1(&pkt, &tag)
+        || tag != ID_SEQUENCE
+        || !ossl_decode_der_length(&pkt, &contpkt)
+        || !ossl_decode_der_integer(&contpkt, r)
+        || !ossl_decode_der_integer(&contpkt, s)
+        || PACKET_remaining(&contpkt) != 0)
         return 0;
 
     consumed = PACKET_data(&pkt) - *ppin;
diff --git a/crypto/openssl/crypto/async/arch/async_null.c b/crypto/openssl/crypto/async/arch/async_null.c
index 306c43df41f4..28276c1014bc 100644
--- a/crypto/openssl/crypto/async/arch/async_null.c
+++ b/crypto/openssl/crypto/async/arch/async_null.c
@@ -17,13 +17,13 @@ int ASYNC_is_capable(void)
 }
 
 int ASYNC_set_mem_functions(ASYNC_stack_alloc_fn alloc_fn,
-                            ASYNC_stack_free_fn free_fn)
+    ASYNC_stack_free_fn free_fn)
 {
     return 0;
 }
 
 void ASYNC_get_mem_functions(ASYNC_stack_alloc_fn *alloc_fn,
-                             ASYNC_stack_free_fn *free_fn)
+    ASYNC_stack_free_fn *free_fn)
 {
     if (alloc_fn != NULL)
         *alloc_fn = NULL;
@@ -35,4 +35,3 @@ void async_local_cleanup(void)
 {
 }
 #endif
-
diff --git a/crypto/openssl/crypto/async/arch/async_null.h b/crypto/openssl/crypto/async/arch/async_null.h
index 536c9829cd2e..6be0b96f9e6e 100644
--- a/crypto/openssl/crypto/async/arch/async_null.h
+++ b/crypto/openssl/crypto/async/arch/async_null.h
@@ -14,19 +14,18 @@
  * to NULL.
  */
 #ifndef ASYNC_ARCH
-# define ASYNC_NULL
-# define ASYNC_ARCH
+#define ASYNC_NULL
+#define ASYNC_ARCH
 
 typedef struct async_fibre_st {
     int dummy;
 } async_fibre;
 
-
-# define async_fibre_swapcontext(o,n,r)         0
-# define async_fibre_makecontext(c)             0
-# define async_fibre_free(f)
-# define async_fibre_init_dispatcher(f)
-# define async_local_init()                     1
-# define async_local_deinit()
+#define async_fibre_swapcontext(o, n, r) 0
+#define async_fibre_makecontext(c) 0
+#define async_fibre_free(f)
+#define async_fibre_init_dispatcher(f)
+#define async_local_init() 1
+#define async_local_deinit()
 
 #endif
diff --git a/crypto/openssl/crypto/async/arch/async_posix.c b/crypto/openssl/crypto/async/arch/async_posix.c
index f2b507c7d0a6..46e2ce7559cd 100644
--- a/crypto/openssl/crypto/async/arch/async_posix.c
+++ b/crypto/openssl/crypto/async/arch/async_posix.c
@@ -12,12 +12,12 @@
 
 #ifdef ASYNC_POSIX
 
-# include <stddef.h>
-# include <unistd.h>
-# include <openssl/err.h>
-# include <openssl/crypto.h>
+#include <stddef.h>
+#include <unistd.h>
+#include <openssl/err.h>
+#include <openssl/crypto.h>
 
-#define STACKSIZE       32768
+#define STACKSIZE 32768
 
 static CRYPTO_RWLOCK *async_mem_lock;
 
@@ -51,7 +51,7 @@ int ASYNC_is_capable(void)
 }
 
 int ASYNC_set_mem_functions(ASYNC_stack_alloc_fn alloc_fn,
-                            ASYNC_stack_free_fn free_fn)
+    ASYNC_stack_free_fn free_fn)
 {
     OPENSSL_init_crypto(OPENSSL_INIT_ASYNC, NULL);
 
@@ -71,7 +71,7 @@ int ASYNC_set_mem_functions(ASYNC_stack_alloc_fn alloc_fn,
 }
 
 void ASYNC_get_mem_functions(ASYNC_stack_alloc_fn *alloc_fn,
-                             ASYNC_stack_free_fn *free_fn)
+    ASYNC_stack_free_fn *free_fn)
 {
     if (alloc_fn != NULL)
         *alloc_fn = stack_alloc_impl;
diff --git a/crypto/openssl/crypto/async/arch/async_posix.h b/crypto/openssl/crypto/async/arch/async_posix.h
index ceb86e24bf35..449ca27d222f 100644
--- a/crypto/openssl/crypto/async/arch/async_posix.h
+++ b/crypto/openssl/crypto/async/arch/async_posix.h
@@ -11,21 +11,22 @@
 #define OSSL_CRYPTO_ASYNC_POSIX_H
 #include <openssl/e_os2.h>
 
-#if defined(OPENSSL_SYS_UNIX) \
+#if defined(OPENSSL_SYS_UNIX)                                 \
     && defined(OPENSSL_THREADS) && !defined(OPENSSL_NO_ASYNC) \
-    && !defined(__ANDROID__) && !defined(__OpenBSD__)
+    && !defined(__ANDROID__) && !defined(__OpenBSD__)         \
+    && !defined(OPENSSL_SYS_TANDEM)
 
-# include <unistd.h>
+#include <unistd.h>
 
-# if _POSIX_VERSION >= 200112L \
+#if _POSIX_VERSION >= 200112L \
     && (_POSIX_VERSION < 200809L || defined(__GLIBC__) || defined(__FreeBSD__))
 
-# include <pthread.h>
+#include <pthread.h>
 
-#  define ASYNC_POSIX
-#  define ASYNC_ARCH
+#define ASYNC_POSIX
+#define ASYNC_ARCH
 
-#  if defined(__CET__) || defined(__ia64__)
+#if defined(__CET__) || defined(__ia64__)
 /*
  * When Intel CET is enabled, makecontext will create a different
  * shadow stack for each context.  async_fibre_swapcontext cannot
@@ -34,9 +35,9 @@
  * On IA64 the register stack engine is not saved across setjmp/longjmp. Here
  * swapcontext() performs correctly.
  */
-#   define USE_SWAPCONTEXT
-#  endif
-#  if defined(__aarch64__) && defined(__clang__) \
+#define USE_SWAPCONTEXT
+#endif
+#if defined(__aarch64__) && defined(__clang__) \
     && defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
 /*
  * setjmp/longjmp don't currently work with BTI on all libc implementations
@@ -46,19 +47,23 @@
  * So use the swapcontext implementation, which does work.
  * See https://github.com/llvm/llvm-project/issues/48888.
  */
-#   define USE_SWAPCONTEXT
-#  endif
-#  include <ucontext.h>
-#  ifndef USE_SWAPCONTEXT
-#   include <setjmp.h>
-#  endif
+#define USE_SWAPCONTEXT
+#endif
+#if defined(OPENSSL_SYS_TANDEM)
+#include <tdmsig.h>
+#else
+#include <ucontext.h>
+#endif
+#ifndef USE_SWAPCONTEXT
+#include <setjmp.h>
+#endif
 
 typedef struct async_fibre_st {
     ucontext_t fibre;
-#  ifndef USE_SWAPCONTEXT
+#ifndef USE_SWAPCONTEXT
     jmp_buf env;
     int env_init;
-#  endif
+#endif
 } async_fibre;
 
 int async_local_init(void);
@@ -66,9 +71,9 @@ void async_local_deinit(void);
 
 static ossl_inline int async_fibre_swapcontext(async_fibre *o, async_fibre *n, int r)
 {
-#  ifdef USE_SWAPCONTEXT
+#ifdef USE_SWAPCONTEXT
     swapcontext(&o->fibre, &n->fibre);
-#  else
+#else
     o->env_init = 1;
 
     if (!r || !_setjmp(o->env)) {
@@ -77,16 +82,16 @@ static ossl_inline int async_fibre_swapcontext(async_fibre *o, async_fibre *n, i
         else
             setcontext(&n->fibre);
     }
-#  endif
+#endif
 
     return 1;
 }
 
-#  define async_fibre_init_dispatcher(d)
+#define async_fibre_init_dispatcher(d)
 
 int async_fibre_makecontext(async_fibre *fibre);
 void async_fibre_free(async_fibre *fibre);
 
-# endif
+#endif
 #endif
 #endif /* OSSL_CRYPTO_ASYNC_POSIX_H */
diff --git a/crypto/openssl/crypto/async/arch/async_win.c b/crypto/openssl/crypto/async/arch/async_win.c
index cbb8ef24ed78..849da5c3c41b 100644
--- a/crypto/openssl/crypto/async/arch/async_win.c
+++ b/crypto/openssl/crypto/async/arch/async_win.c
@@ -12,8 +12,8 @@
 
 #ifdef ASYNC_WIN
 
-# include <windows.h>
-# include "internal/cryptlib.h"
+#include <windows.h>
+#include "internal/cryptlib.h"
 
 int ASYNC_is_capable(void)
 {
@@ -21,13 +21,13 @@ int ASYNC_is_capable(void)
 }
 
 int ASYNC_set_mem_functions(ASYNC_stack_alloc_fn alloc_fn,
-                            ASYNC_stack_free_fn free_fn)
+    ASYNC_stack_free_fn free_fn)
 {
     return 0;
 }
 
 void ASYNC_get_mem_functions(ASYNC_stack_alloc_fn *alloc_fn,
-                             ASYNC_stack_free_fn *free_fn)
+    ASYNC_stack_free_fn *free_fn)
 {
     if (alloc_fn != NULL)
         *alloc_fn = NULL;
@@ -49,11 +49,11 @@ void async_local_cleanup(void)
 
 int async_fibre_init_dispatcher(async_fibre *fibre)
 {
-# if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600
+#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600
     fibre->fibre = ConvertThreadToFiberEx(NULL, FIBER_FLAG_FLOAT_SWITCH);
-# else
+#else
     fibre->fibre = ConvertThreadToFiber(NULL);
-# endif
+#endif
     if (fibre->fibre == NULL) {
         fibre->converted = 0;
         fibre->fibre = GetCurrentFiber();
diff --git a/crypto/openssl/crypto/async/arch/async_win.h b/crypto/openssl/crypto/async/arch/async_win.h
index 6a61a9a380d1..ef134f53ab2e 100644
--- a/crypto/openssl/crypto/async/arch/async_win.h
+++ b/crypto/openssl/crypto/async/arch/async_win.h
@@ -13,32 +13,32 @@
  */
 #if defined(_WIN32) && !defined(OPENSSL_NO_ASYNC)
 #include <openssl/async.h>
-# define ASYNC_WIN
-# define ASYNC_ARCH
+#define ASYNC_WIN
+#define ASYNC_ARCH
 
-# include <windows.h>
-# include "internal/cryptlib.h"
+#include <windows.h>
+#include "internal/cryptlib.h"
 
 typedef struct async_fibre_st {
     LPVOID fibre;
     int converted;
 } async_fibre;
 
-# define async_fibre_swapcontext(o,n,r) \
-        (SwitchToFiber((n)->fibre), 1)
+#define async_fibre_swapcontext(o, n, r) \
+    (SwitchToFiber((n)->fibre), 1)
 
-# if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600
-#   define async_fibre_makecontext(c) \
-        ((c)->fibre = CreateFiberEx(0, 0, FIBER_FLAG_FLOAT_SWITCH, \
-                                    async_start_func_win, 0))
-# else
-#   define async_fibre_makecontext(c) \
-        ((c)->fibre = CreateFiber(0, async_start_func_win, 0))
-# endif
+#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600
+#define async_fibre_makecontext(c)                             \
+    ((c)->fibre = CreateFiberEx(0, 0, FIBER_FLAG_FLOAT_SWITCH, \
+         async_start_func_win, 0))
+#else
+#define async_fibre_makecontext(c) \
+    ((c)->fibre = CreateFiber(0, async_start_func_win, 0))
+#endif
 
-# define async_fibre_free(f)             (DeleteFiber((f)->fibre))
-# define async_local_init()              1
-# define async_local_deinit()
+#define async_fibre_free(f) (DeleteFiber((f)->fibre))
+#define async_local_init() 1
+#define async_local_deinit()
 
 int async_fibre_init_dispatcher(async_fibre *fibre);
 VOID CALLBACK async_start_func_win(PVOID unused);
diff --git a/crypto/openssl/crypto/async/async.c b/crypto/openssl/crypto/async/async.c
index 46c87d6a5af2..dfd7a14a0b26 100644
--- a/crypto/openssl/crypto/async/async.c
+++ b/crypto/openssl/crypto/async/async.c
@@ -22,10 +22,10 @@
 #include "crypto/cryptlib.h"
 #include <string.h>
 
-#define ASYNC_JOB_RUNNING   0
-#define ASYNC_JOB_PAUSING   1
-#define ASYNC_JOB_PAUSED    2
-#define ASYNC_JOB_STOPPING  3
+#define ASYNC_JOB_RUNNING 0
+#define ASYNC_JOB_PAUSING 1
+#define ASYNC_JOB_PAUSED 2
+#define ASYNC_JOB_STOPPING 3
 
 static CRYPTO_THREAD_LOCAL ctxkey;
 static CRYPTO_THREAD_LOCAL poolkey;
@@ -97,7 +97,8 @@ static void async_job_free(ASYNC_JOB *job)
     }
 }
 
-static ASYNC_JOB *async_get_pool_job(void) {
+static ASYNC_JOB *async_get_pool_job(void)
+{
     ASYNC_JOB *job;
     async_pool *pool;
 
@@ -120,7 +121,7 @@ static ASYNC_JOB *async_get_pool_job(void) {
 
         job = async_job_new();
         if (job != NULL) {
-            if (! async_fibre_makecontext(&job->fibrectx)) {
+            if (!async_fibre_makecontext(&job->fibrectx)) {
                 async_job_free(job);
                 return NULL;
             }
@@ -130,7 +131,8 @@ static ASYNC_JOB *async_get_pool_job(void) {
     return job;
 }
 
-static void async_release_job(ASYNC_JOB *job) {
+static void async_release_job(ASYNC_JOB *job)
+{
     async_pool *pool;
 
     pool = (async_pool *)CRYPTO_THREAD_get_local(&poolkey);
@@ -160,7 +162,7 @@ void async_start_func(void)
         /* Stop the job */
         job->status = ASYNC_JOB_STOPPING;
         if (!async_fibre_swapcontext(&job->fibrectx,
-                                     &ctx->dispatcher, 1)) {
+                &ctx->dispatcher, 1)) {
             /*
              * Should not happen. Getting here will close the thread...can't do
              * much about it
@@ -171,7 +173,7 @@ void async_start_func(void)
 }
 
 int ASYNC_start_job(ASYNC_JOB **job, ASYNC_WAIT_CTX *wctx, int *ret,
-                    int (*func)(void *), void *args, size_t size)
+    int (*func)(void *), void *args, size_t size)
 {
     async_ctx *ctx;
     OSSL_LIB_CTX *libctx;
@@ -249,7 +251,8 @@ int ASYNC_start_job(ASYNC_JOB **job, ASYNC_WAIT_CTX *wctx, int *ret,
         if ((ctx->currjob = async_get_pool_job()) == NULL)
             return ASYNC_NO_JOBS;
 
-        if (args != NULL) {
+        /* Check for size > 0 to avoid malloc(0) */
+        if (args != NULL && size > 0) {
             ctx->currjob->funcargs = OPENSSL_malloc(size);
             if (ctx->currjob->funcargs == NULL) {
                 async_release_job(ctx->currjob);
@@ -289,8 +292,8 @@ int ASYNC_pause_job(void)
     async_ctx *ctx = async_get_ctx();
 
     if (ctx == NULL
-            || ctx->currjob == NULL
-            || ctx->blocked) {
+        || ctx->currjob == NULL
+        || ctx->blocked) {
         /*
          * Could be we've deliberately not been started within a job so this is
          * counted as success.
@@ -302,7 +305,7 @@ int ASYNC_pause_job(void)
     job->status = ASYNC_JOB_PAUSING;
 
     if (!async_fibre_swapcontext(&job->fibrectx,
-                                 &ctx->dispatcher, 1)) {
+            &ctx->dispatcher, 1)) {
         ERR_raise(ERR_LIB_ASYNC, ASYNC_R_FAILED_TO_SWAP_CONTEXT);
         return 0;
     }
diff --git a/crypto/openssl/crypto/async/async_err.c b/crypto/openssl/crypto/async/async_err.c
index 34db12fb969c..1e28eb78234b 100644
--- a/crypto/openssl/crypto/async/async_err.c
+++ b/crypto/openssl/crypto/async/async_err.c
@@ -15,14 +15,14 @@
 #ifndef OPENSSL_NO_ERR
 
 static const ERR_STRING_DATA ASYNC_str_reasons[] = {
-    {ERR_PACK(ERR_LIB_ASYNC, 0, ASYNC_R_FAILED_TO_SET_POOL),
-    "failed to set pool"},
-    {ERR_PACK(ERR_LIB_ASYNC, 0, ASYNC_R_FAILED_TO_SWAP_CONTEXT),
-    "failed to swap context"},
-    {ERR_PACK(ERR_LIB_ASYNC, 0, ASYNC_R_INIT_FAILED), "init failed"},
-    {ERR_PACK(ERR_LIB_ASYNC, 0, ASYNC_R_INVALID_POOL_SIZE),
-    "invalid pool size"},
-    {0, NULL}
+    { ERR_PACK(ERR_LIB_ASYNC, 0, ASYNC_R_FAILED_TO_SET_POOL),
+        "failed to set pool" },
+    { ERR_PACK(ERR_LIB_ASYNC, 0, ASYNC_R_FAILED_TO_SWAP_CONTEXT),
+        "failed to swap context" },
+    { ERR_PACK(ERR_LIB_ASYNC, 0, ASYNC_R_INIT_FAILED), "init failed" },
+    { ERR_PACK(ERR_LIB_ASYNC, 0, ASYNC_R_INVALID_POOL_SIZE),
+        "invalid pool size" },
+    { 0, NULL }
 };
 
 #endif
diff --git a/crypto/openssl/crypto/async/async_local.h b/crypto/openssl/crypto/async/async_local.h
index c06f413cf604..9690adbb1e95 100644
--- a/crypto/openssl/crypto/async/async_local.h
+++ b/crypto/openssl/crypto/async/async_local.h
@@ -12,12 +12,12 @@
  * includes <signal.h> which includes <ucontext.h>
  */
 #if defined(__APPLE__) && defined(__MACH__) && !defined(_XOPEN_SOURCE)
-# define _XOPEN_SOURCE          /* Otherwise incomplete ucontext_t structure */
-# pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#define _XOPEN_SOURCE /* Otherwise incomplete ucontext_t structure */
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 #endif
 
 #if defined(_WIN32)
-# include <windows.h>
+#include <windows.h>
 #endif
 
 #include "crypto/async.h"
@@ -38,7 +38,7 @@ struct async_ctx_st {
 
 struct async_job_st {
     async_fibre fibrectx;
-    int (*func) (void *);
+    int (*func)(void *);
     void *funcargs;
     int ret;
     int status;
@@ -78,4 +78,3 @@ void async_start_func(void);
 async_ctx *async_get_ctx(void);
 
 void async_wait_ctx_reset_counts(ASYNC_WAIT_CTX *ctx);
-
diff --git a/crypto/openssl/crypto/async/async_wait.c b/crypto/openssl/crypto/async/async_wait.c
index cf4db49dae39..662cd74dd12e 100644
--- a/crypto/openssl/crypto/async/async_wait.c
+++ b/crypto/openssl/crypto/async/async_wait.c
@@ -42,9 +42,9 @@ void ASYNC_WAIT_CTX_free(ASYNC_WAIT_CTX *ctx)
 }
 
 int ASYNC_WAIT_CTX_set_wait_fd(ASYNC_WAIT_CTX *ctx, const void *key,
-                               OSSL_ASYNC_FD fd, void *custom_data,
-                               void (*cleanup)(ASYNC_WAIT_CTX *, const void *,
-                                               OSSL_ASYNC_FD, void *))
+    OSSL_ASYNC_FD fd, void *custom_data,
+    void (*cleanup)(ASYNC_WAIT_CTX *, const void *,
+        OSSL_ASYNC_FD, void *))
 {
     struct fd_lookup_st *fdlookup;
 
@@ -63,7 +63,7 @@ int ASYNC_WAIT_CTX_set_wait_fd(ASYNC_WAIT_CTX *ctx, const void *key,
 }
 
 int ASYNC_WAIT_CTX_get_fd(ASYNC_WAIT_CTX *ctx, const void *key,
-                          OSSL_ASYNC_FD *fd, void **custom_data)
+    OSSL_ASYNC_FD *fd, void **custom_data)
 {
     struct fd_lookup_st *curr;
 
@@ -85,7 +85,7 @@ int ASYNC_WAIT_CTX_get_fd(ASYNC_WAIT_CTX *ctx, const void *key,
 }
 
 int ASYNC_WAIT_CTX_get_all_fds(ASYNC_WAIT_CTX *ctx, OSSL_ASYNC_FD *fd,
-                               size_t *numfds)
+    size_t *numfds)
 {
     struct fd_lookup_st *curr;
 
@@ -108,8 +108,8 @@ int ASYNC_WAIT_CTX_get_all_fds(ASYNC_WAIT_CTX *ctx, OSSL_ASYNC_FD *fd,
 }
 
 int ASYNC_WAIT_CTX_get_changed_fds(ASYNC_WAIT_CTX *ctx, OSSL_ASYNC_FD *addfd,
-                                   size_t *numaddfds, OSSL_ASYNC_FD *delfd,
-                                   size_t *numdelfds)
+    size_t *numaddfds, OSSL_ASYNC_FD *delfd,
+    size_t *numdelfds)
 {
     struct fd_lookup_st *curr;
 
@@ -182,38 +182,38 @@ int ASYNC_WAIT_CTX_clear_fd(ASYNC_WAIT_CTX *ctx, const void *key)
 }
 
 int ASYNC_WAIT_CTX_set_callback(ASYNC_WAIT_CTX *ctx,
-                                ASYNC_callback_fn callback,
-                                void *callback_arg)
+    ASYNC_callback_fn callback,
+    void *callback_arg)
 {
-      if (ctx == NULL)
-          return 0;
+    if (ctx == NULL)
+        return 0;
 
-      ctx->callback = callback;
-      ctx->callback_arg = callback_arg;
-      return 1;
+    ctx->callback = callback;
+    ctx->callback_arg = callback_arg;
+    return 1;
 }
 
 int ASYNC_WAIT_CTX_get_callback(ASYNC_WAIT_CTX *ctx,
-                                ASYNC_callback_fn *callback,
-                                void **callback_arg)
+    ASYNC_callback_fn *callback,
+    void **callback_arg)
 {
-      if (ctx->callback == NULL)
-          return 0;
+    if (ctx->callback == NULL)
+        return 0;
 
-      *callback = ctx->callback;
-      *callback_arg = ctx->callback_arg;
-      return 1;
+    *callback = ctx->callback;
+    *callback_arg = ctx->callback_arg;
+    return 1;
 }
 
 int ASYNC_WAIT_CTX_set_status(ASYNC_WAIT_CTX *ctx, int status)
 {
-      ctx->status = status;
-      return 1;
+    ctx->status = status;
+    return 1;
 }
 
 int ASYNC_WAIT_CTX_get_status(ASYNC_WAIT_CTX *ctx)
 {
-      return ctx->status;
+    return ctx->status;
 }
 
 void async_wait_ctx_reset_counts(ASYNC_WAIT_CTX *ctx)
diff --git a/crypto/openssl/crypto/bf/bf_cfb64.c b/crypto/openssl/crypto/bf/bf_cfb64.c
index d7a92662042b..e380972dbdc9 100644
--- a/crypto/openssl/crypto/bf/bf_cfb64.c
+++ b/crypto/openssl/crypto/bf/bf_cfb64.c
@@ -23,8 +23,8 @@
  */
 
 void BF_cfb64_encrypt(const unsigned char *in, unsigned char *out,
-                      long length, const BF_KEY *schedule,
-                      unsigned char *ivec, int *num, int encrypt)
+    long length, const BF_KEY *schedule,
+    unsigned char *ivec, int *num, int encrypt)
 {
     register BF_LONG v0, v1, t;
     register int n = *num;
diff --git a/crypto/openssl/crypto/bf/bf_ecb.c b/crypto/openssl/crypto/bf/bf_ecb.c
index b02768261d8b..cee1bf138eef 100644
--- a/crypto/openssl/crypto/bf/bf_ecb.c
+++ b/crypto/openssl/crypto/bf/bf_ecb.c
@@ -29,7 +29,7 @@ const char *BF_options(void)
 }
 
 void BF_ecb_encrypt(const unsigned char *in, unsigned char *out,
-                    const BF_KEY *key, int encrypt)
+    const BF_KEY *key, int encrypt)
 {
     BF_LONG l, d[2];
 
diff --git a/crypto/openssl/crypto/bf/bf_enc.c b/crypto/openssl/crypto/bf/bf_enc.c
index 40ddaf4af61b..39a6e1bbb95c 100644
--- a/crypto/openssl/crypto/bf/bf_enc.c
+++ b/crypto/openssl/crypto/bf/bf_enc.c
@@ -23,7 +23,7 @@
  */
 
 #if (BF_ROUNDS != 16) && (BF_ROUNDS != 20)
-# error If you set BF_ROUNDS to some value other than 16 or 20, you will have \
+#error If you set BF_ROUNDS to some value other than 16 or 20, you will have \
 to modify the code.
 #endif
 
@@ -54,12 +54,12 @@ void BF_encrypt(BF_LONG *data, const BF_KEY *key)
     BF_ENC(l, r, s, p[14]);
     BF_ENC(r, l, s, p[15]);
     BF_ENC(l, r, s, p[16]);
-# if BF_ROUNDS == 20
+#if BF_ROUNDS == 20
     BF_ENC(r, l, s, p[17]);
     BF_ENC(l, r, s, p[18]);
     BF_ENC(r, l, s, p[19]);
     BF_ENC(l, r, s, p[20]);
-# endif
+#endif
     r ^= p[BF_ROUNDS + 1];
 
     data[1] = l & 0xffffffffU;
@@ -77,12 +77,12 @@ void BF_decrypt(BF_LONG *data, const BF_KEY *key)
     r = data[1];
 
     l ^= p[BF_ROUNDS + 1];
-#  if BF_ROUNDS == 20
+#if BF_ROUNDS == 20
     BF_ENC(r, l, s, p[20]);
     BF_ENC(l, r, s, p[19]);
     BF_ENC(r, l, s, p[18]);
     BF_ENC(l, r, s, p[17]);
-#  endif
+#endif
     BF_ENC(r, l, s, p[16]);
     BF_ENC(l, r, s, p[15]);
     BF_ENC(r, l, s, p[14]);
@@ -106,7 +106,7 @@ void BF_decrypt(BF_LONG *data, const BF_KEY *key)
 }
 
 void BF_cbc_encrypt(const unsigned char *in, unsigned char *out, long length,
-                    const BF_KEY *schedule, unsigned char *ivec, int encrypt)
+    const BF_KEY *schedule, unsigned char *ivec, int encrypt)
 {
     register BF_LONG tin0, tin1;
     register BF_LONG tout0, tout1, xor0, xor1;
diff --git a/crypto/openssl/crypto/bf/bf_local.h b/crypto/openssl/crypto/bf/bf_local.h
index 53c6963e6b08..8634a57ceb75 100644
--- a/crypto/openssl/crypto/bf/bf_local.h
+++ b/crypto/openssl/crypto/bf/bf_local.h
@@ -8,77 +8,91 @@
  */
 
 #ifndef OSSL_CRYPTO_BF_LOCAL_H
-# define OSSL_CRYPTO_BF_LOCAL_H
-# include <openssl/opensslconf.h>
+#define OSSL_CRYPTO_BF_LOCAL_H
+#include <openssl/opensslconf.h>
 
 /* NOTE - c is not incremented as per n2l */
-# define n2ln(c,l1,l2,n) { \
-                        c+=n; \
-                        l1=l2=0; \
-                        switch (n) { \
-                        case 8: l2 =((unsigned long)(*(--(c))))    ; \
-                        /* fall through */                              \
-                        case 7: l2|=((unsigned long)(*(--(c))))<< 8; \
-                        /* fall through */                              \
-                        case 6: l2|=((unsigned long)(*(--(c))))<<16; \
-                        /* fall through */                              \
-                        case 5: l2|=((unsigned long)(*(--(c))))<<24; \
-                        /* fall through */                              \
-                        case 4: l1 =((unsigned long)(*(--(c))))    ; \
-                        /* fall through */                              \
-                        case 3: l1|=((unsigned long)(*(--(c))))<< 8; \
-                        /* fall through */                              \
-                        case 2: l1|=((unsigned long)(*(--(c))))<<16; \
-                        /* fall through */                              \
-                        case 1: l1|=((unsigned long)(*(--(c))))<<24; \
-                                } \
-                        }
+#define n2ln(c, l1, l2, n)                           \
+    {                                                \
+        c += n;                                      \
+        l1 = l2 = 0;                                 \
+        switch (n) {                                 \
+        case 8:                                      \
+            l2 = ((unsigned long)(*(--(c))));        \
+        /* fall through */                           \
+        case 7:                                      \
+            l2 |= ((unsigned long)(*(--(c)))) << 8;  \
+        /* fall through */                           \
+        case 6:                                      \
+            l2 |= ((unsigned long)(*(--(c)))) << 16; \
+        /* fall through */                           \
+        case 5:                                      \
+            l2 |= ((unsigned long)(*(--(c)))) << 24; \
+        /* fall through */                           \
+        case 4:                                      \
+            l1 = ((unsigned long)(*(--(c))));        \
+        /* fall through */                           \
+        case 3:                                      \
+            l1 |= ((unsigned long)(*(--(c)))) << 8;  \
+        /* fall through */                           \
+        case 2:                                      \
+            l1 |= ((unsigned long)(*(--(c)))) << 16; \
+        /* fall through */                           \
+        case 1:                                      \
+            l1 |= ((unsigned long)(*(--(c)))) << 24; \
+        }                                            \
+    }
 
 /* NOTE - c is not incremented as per l2n */
-# define l2nn(l1,l2,c,n) { \
-                        c+=n; \
-                        switch (n) { \
-                        case 8: *(--(c))=(unsigned char)(((l2)    )&0xff); \
-                        /* fall through */                                    \
-                        case 7: *(--(c))=(unsigned char)(((l2)>> 8)&0xff); \
-                        /* fall through */                                    \
-                        case 6: *(--(c))=(unsigned char)(((l2)>>16)&0xff); \
-                        /* fall through */                                    \
-                        case 5: *(--(c))=(unsigned char)(((l2)>>24)&0xff); \
-                        /* fall through */                                    \
-                        case 4: *(--(c))=(unsigned char)(((l1)    )&0xff); \
-                        /* fall through */                                    \
-                        case 3: *(--(c))=(unsigned char)(((l1)>> 8)&0xff); \
-                        /* fall through */                                    \
-                        case 2: *(--(c))=(unsigned char)(((l1)>>16)&0xff); \
-                        /* fall through */                                    \
-                        case 1: *(--(c))=(unsigned char)(((l1)>>24)&0xff); \
-                                } \
-                        }
+#define l2nn(l1, l2, c, n)                                   \
+    {                                                        \
+        c += n;                                              \
+        switch (n) {                                         \
+        case 8:                                              \
+            *(--(c)) = (unsigned char)(((l2)) & 0xff);       \
+        /* fall through */                                   \
+        case 7:                                              \
+            *(--(c)) = (unsigned char)(((l2) >> 8) & 0xff);  \
+        /* fall through */                                   \
+        case 6:                                              \
+            *(--(c)) = (unsigned char)(((l2) >> 16) & 0xff); \
+        /* fall through */                                   \
+        case 5:                                              \
+            *(--(c)) = (unsigned char)(((l2) >> 24) & 0xff); \
+        /* fall through */                                   \
+        case 4:                                              \
+            *(--(c)) = (unsigned char)(((l1)) & 0xff);       \
+        /* fall through */                                   \
+        case 3:                                              \
+            *(--(c)) = (unsigned char)(((l1) >> 8) & 0xff);  \
+        /* fall through */                                   \
+        case 2:                                              \
+            *(--(c)) = (unsigned char)(((l1) >> 16) & 0xff); \
+        /* fall through */                                   \
+        case 1:                                              \
+            *(--(c)) = (unsigned char)(((l1) >> 24) & 0xff); \
+        }                                                    \
+    }
 
-# undef n2l
-# define n2l(c,l)        (l =((unsigned long)(*((c)++)))<<24L, \
-                         l|=((unsigned long)(*((c)++)))<<16L, \
-                         l|=((unsigned long)(*((c)++)))<< 8L, \
-                         l|=((unsigned long)(*((c)++))))
+#undef n2l
+#define n2l(c, l) (l = ((unsigned long)(*((c)++))) << 24L, \
+    l |= ((unsigned long)(*((c)++))) << 16L,               \
+    l |= ((unsigned long)(*((c)++))) << 8L,                \
+    l |= ((unsigned long)(*((c)++))))
 
-# undef l2n
-# define l2n(l,c)        (*((c)++)=(unsigned char)(((l)>>24L)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16L)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8L)&0xff), \
-                         *((c)++)=(unsigned char)(((l)     )&0xff))
+#undef l2n
+#define l2n(l, c) (*((c)++) = (unsigned char)(((l) >> 24L) & 0xff), \
+    *((c)++) = (unsigned char)(((l) >> 16L) & 0xff),                \
+    *((c)++) = (unsigned char)(((l) >> 8L) & 0xff),                 \
+    *((c)++) = (unsigned char)(((l)) & 0xff))
 
 /*
  * This is actually a big endian algorithm, the most significant byte is used
  * to lookup array 0
  */
 
-# define BF_ENC(LL,R,S,P) ( \
-        LL^=P, \
-        LL^=((( S[       ((R>>24)&0xff)] + \
-                S[0x0100+((R>>16)&0xff)])^ \
-                S[0x0200+((R>> 8)&0xff)])+ \
-                S[0x0300+((R    )&0xff)])&0xffffffffU \
-        )
+#define BF_ENC(LL, R, S, P) ( \
+    LL ^= P,                  \
+    LL ^= (((S[((R >> 24) & 0xff)] + S[0x0100 + ((R >> 16) & 0xff)]) ^ S[0x0200 + ((R >> 8) & 0xff)]) + S[0x0300 + ((R) & 0xff)]) & 0xffffffffU)
 
 #endif
diff --git a/crypto/openssl/crypto/bf/bf_ofb64.c b/crypto/openssl/crypto/bf/bf_ofb64.c
index 086c3f07f0bc..5c9193add17e 100644
--- a/crypto/openssl/crypto/bf/bf_ofb64.c
+++ b/crypto/openssl/crypto/bf/bf_ofb64.c
@@ -22,8 +22,8 @@
  * used is contained in *num;
  */
 void BF_ofb64_encrypt(const unsigned char *in, unsigned char *out,
-                      long length, const BF_KEY *schedule,
-                      unsigned char *ivec, int *num)
+    long length, const BF_KEY *schedule,
+    unsigned char *ivec, int *num)
 {
     register BF_LONG v0, v1, t;
     register int n = *num;
diff --git a/crypto/openssl/crypto/bf/bf_pi.h b/crypto/openssl/crypto/bf/bf_pi.h
index 8b9896e7f3e0..ffb3b3e9b35f 100644
--- a/crypto/openssl/crypto/bf/bf_pi.h
+++ b/crypto/openssl/crypto/bf/bf_pi.h
@@ -8,523 +8,1035 @@
  */
 
 static const BF_KEY bf_init = {
+    { 0x243f6a88L, 0x85a308d3L, 0x13198a2eL, 0x03707344L,
+        0xa4093822L, 0x299f31d0L, 0x082efa98L, 0xec4e6c89L,
+        0x452821e6L, 0x38d01377L, 0xbe5466cfL, 0x34e90c6cL,
+        0xc0ac29b7L, 0xc97c50ddL, 0x3f84d5b5L, 0xb5470917L,
+        0x9216d5d9L, 0x8979fb1b },
     {
-     0x243f6a88L, 0x85a308d3L, 0x13198a2eL, 0x03707344L,
-     0xa4093822L, 0x299f31d0L, 0x082efa98L, 0xec4e6c89L,
-     0x452821e6L, 0x38d01377L, 0xbe5466cfL, 0x34e90c6cL,
-     0xc0ac29b7L, 0xc97c50ddL, 0x3f84d5b5L, 0xb5470917L,
-     0x9216d5d9L, 0x8979fb1b}, {
-                                0xd1310ba6L, 0x98dfb5acL, 0x2ffd72dbL,
-                                0xd01adfb7L,
-                                0xb8e1afedL, 0x6a267e96L, 0xba7c9045L,
-                                0xf12c7f99L,
-                                0x24a19947L, 0xb3916cf7L, 0x0801f2e2L,
-                                0x858efc16L,
-                                0x636920d8L, 0x71574e69L, 0xa458fea3L,
-                                0xf4933d7eL,
-                                0x0d95748fL, 0x728eb658L, 0x718bcd58L,
-                                0x82154aeeL,
-                                0x7b54a41dL, 0xc25a59b5L, 0x9c30d539L,
-                                0x2af26013L,
-                                0xc5d1b023L, 0x286085f0L, 0xca417918L,
-                                0xb8db38efL,
-                                0x8e79dcb0L, 0x603a180eL, 0x6c9e0e8bL,
-                                0xb01e8a3eL,
-                                0xd71577c1L, 0xbd314b27L, 0x78af2fdaL,
-                                0x55605c60L,
-                                0xe65525f3L, 0xaa55ab94L, 0x57489862L,
-                                0x63e81440L,
-                                0x55ca396aL, 0x2aab10b6L, 0xb4cc5c34L,
-                                0x1141e8ceL,
-                                0xa15486afL, 0x7c72e993L, 0xb3ee1411L,
-                                0x636fbc2aL,
-                                0x2ba9c55dL, 0x741831f6L, 0xce5c3e16L,
-                                0x9b87931eL,
-                                0xafd6ba33L, 0x6c24cf5cL, 0x7a325381L,
-                                0x28958677L,
-                                0x3b8f4898L, 0x6b4bb9afL, 0xc4bfe81bL,
-                                0x66282193L,
-                                0x61d809ccL, 0xfb21a991L, 0x487cac60L,
-                                0x5dec8032L,
-                                0xef845d5dL, 0xe98575b1L, 0xdc262302L,
-                                0xeb651b88L,
-                                0x23893e81L, 0xd396acc5L, 0x0f6d6ff3L,
-                                0x83f44239L,
-                                0x2e0b4482L, 0xa4842004L, 0x69c8f04aL,
-                                0x9e1f9b5eL,
-                                0x21c66842L, 0xf6e96c9aL, 0x670c9c61L,
-                                0xabd388f0L,
-                                0x6a51a0d2L, 0xd8542f68L, 0x960fa728L,
-                                0xab5133a3L,
-                                0x6eef0b6cL, 0x137a3be4L, 0xba3bf050L,
-                                0x7efb2a98L,
-                                0xa1f1651dL, 0x39af0176L, 0x66ca593eL,
-                                0x82430e88L,
-                                0x8cee8619L, 0x456f9fb4L, 0x7d84a5c3L,
-                                0x3b8b5ebeL,
-                                0xe06f75d8L, 0x85c12073L, 0x401a449fL,
-                                0x56c16aa6L,
-                                0x4ed3aa62L, 0x363f7706L, 0x1bfedf72L,
-                                0x429b023dL,
-                                0x37d0d724L, 0xd00a1248L, 0xdb0fead3L,
-                                0x49f1c09bL,
-                                0x075372c9L, 0x80991b7bL, 0x25d479d8L,
-                                0xf6e8def7L,
-                                0xe3fe501aL, 0xb6794c3bL, 0x976ce0bdL,
-                                0x04c006baL,
-                                0xc1a94fb6L, 0x409f60c4L, 0x5e5c9ec2L,
-                                0x196a2463L,
-                                0x68fb6fafL, 0x3e6c53b5L, 0x1339b2ebL,
-                                0x3b52ec6fL,
-                                0x6dfc511fL, 0x9b30952cL, 0xcc814544L,
-                                0xaf5ebd09L,
-                                0xbee3d004L, 0xde334afdL, 0x660f2807L,
-                                0x192e4bb3L,
-                                0xc0cba857L, 0x45c8740fL, 0xd20b5f39L,
-                                0xb9d3fbdbL,
-                                0x5579c0bdL, 0x1a60320aL, 0xd6a100c6L,
-                                0x402c7279L,
-                                0x679f25feL, 0xfb1fa3ccL, 0x8ea5e9f8L,
-                                0xdb3222f8L,
-                                0x3c7516dfL, 0xfd616b15L, 0x2f501ec8L,
-                                0xad0552abL,
-                                0x323db5faL, 0xfd238760L, 0x53317b48L,
-                                0x3e00df82L,
-                                0x9e5c57bbL, 0xca6f8ca0L, 0x1a87562eL,
-                                0xdf1769dbL,
-                                0xd542a8f6L, 0x287effc3L, 0xac6732c6L,
-                                0x8c4f5573L,
-                                0x695b27b0L, 0xbbca58c8L, 0xe1ffa35dL,
-                                0xb8f011a0L,
-                                0x10fa3d98L, 0xfd2183b8L, 0x4afcb56cL,
-                                0x2dd1d35bL,
-                                0x9a53e479L, 0xb6f84565L, 0xd28e49bcL,
-                                0x4bfb9790L,
-                                0xe1ddf2daL, 0xa4cb7e33L, 0x62fb1341L,
-                                0xcee4c6e8L,
-                                0xef20cadaL, 0x36774c01L, 0xd07e9efeL,
-                                0x2bf11fb4L,
-                                0x95dbda4dL, 0xae909198L, 0xeaad8e71L,
-                                0x6b93d5a0L,
-                                0xd08ed1d0L, 0xafc725e0L, 0x8e3c5b2fL,
-                                0x8e7594b7L,
-                                0x8ff6e2fbL, 0xf2122b64L, 0x8888b812L,
-                                0x900df01cL,
-                                0x4fad5ea0L, 0x688fc31cL, 0xd1cff191L,
-                                0xb3a8c1adL,
-                                0x2f2f2218L, 0xbe0e1777L, 0xea752dfeL,
-                                0x8b021fa1L,
-                                0xe5a0cc0fL, 0xb56f74e8L, 0x18acf3d6L,
-                                0xce89e299L,
-                                0xb4a84fe0L, 0xfd13e0b7L, 0x7cc43b81L,
-                                0xd2ada8d9L,
-                                0x165fa266L, 0x80957705L, 0x93cc7314L,
-                                0x211a1477L,
-                                0xe6ad2065L, 0x77b5fa86L, 0xc75442f5L,
-                                0xfb9d35cfL,
-                                0xebcdaf0cL, 0x7b3e89a0L, 0xd6411bd3L,
-                                0xae1e7e49L,
-                                0x00250e2dL, 0x2071b35eL, 0x226800bbL,
-                                0x57b8e0afL,
-                                0x2464369bL, 0xf009b91eL, 0x5563911dL,
-                                0x59dfa6aaL,
-                                0x78c14389L, 0xd95a537fL, 0x207d5ba2L,
-                                0x02e5b9c5L,
-                                0x83260376L, 0x6295cfa9L, 0x11c81968L,
-                                0x4e734a41L,
-                                0xb3472dcaL, 0x7b14a94aL, 0x1b510052L,
-                                0x9a532915L,
-                                0xd60f573fL, 0xbc9bc6e4L, 0x2b60a476L,
-                                0x81e67400L,
-                                0x08ba6fb5L, 0x571be91fL, 0xf296ec6bL,
-                                0x2a0dd915L,
-                                0xb6636521L, 0xe7b9f9b6L, 0xff34052eL,
-                                0xc5855664L,
-                                0x53b02d5dL, 0xa99f8fa1L, 0x08ba4799L,
-                                0x6e85076aL,
-                                0x4b7a70e9L, 0xb5b32944L, 0xdb75092eL,
-                                0xc4192623L,
-                                0xad6ea6b0L, 0x49a7df7dL, 0x9cee60b8L,
-                                0x8fedb266L,
-                                0xecaa8c71L, 0x699a17ffL, 0x5664526cL,
-                                0xc2b19ee1L,
-                                0x193602a5L, 0x75094c29L, 0xa0591340L,
-                                0xe4183a3eL,
-                                0x3f54989aL, 0x5b429d65L, 0x6b8fe4d6L,
-                                0x99f73fd6L,
-                                0xa1d29c07L, 0xefe830f5L, 0x4d2d38e6L,
-                                0xf0255dc1L,
-                                0x4cdd2086L, 0x8470eb26L, 0x6382e9c6L,
-                                0x021ecc5eL,
-                                0x09686b3fL, 0x3ebaefc9L, 0x3c971814L,
-                                0x6b6a70a1L,
-                                0x687f3584L, 0x52a0e286L, 0xb79c5305L,
-                                0xaa500737L,
-                                0x3e07841cL, 0x7fdeae5cL, 0x8e7d44ecL,
-                                0x5716f2b8L,
-                                0xb03ada37L, 0xf0500c0dL, 0xf01c1f04L,
-                                0x0200b3ffL,
-                                0xae0cf51aL, 0x3cb574b2L, 0x25837a58L,
-                                0xdc0921bdL,
-                                0xd19113f9L, 0x7ca92ff6L, 0x94324773L,
-                                0x22f54701L,
-                                0x3ae5e581L, 0x37c2dadcL, 0xc8b57634L,
-                                0x9af3dda7L,
-                                0xa9446146L, 0x0fd0030eL, 0xecc8c73eL,
-                                0xa4751e41L,
-                                0xe238cd99L, 0x3bea0e2fL, 0x3280bba1L,
-                                0x183eb331L,
-                                0x4e548b38L, 0x4f6db908L, 0x6f420d03L,
-                                0xf60a04bfL,
-                                0x2cb81290L, 0x24977c79L, 0x5679b072L,
-                                0xbcaf89afL,
-                                0xde9a771fL, 0xd9930810L, 0xb38bae12L,
-                                0xdccf3f2eL,
-                                0x5512721fL, 0x2e6b7124L, 0x501adde6L,
-                                0x9f84cd87L,
-                                0x7a584718L, 0x7408da17L, 0xbc9f9abcL,
-                                0xe94b7d8cL,
-                                0xec7aec3aL, 0xdb851dfaL, 0x63094366L,
-                                0xc464c3d2L,
-                                0xef1c1847L, 0x3215d908L, 0xdd433b37L,
-                                0x24c2ba16L,
-                                0x12a14d43L, 0x2a65c451L, 0x50940002L,
-                                0x133ae4ddL,
-                                0x71dff89eL, 0x10314e55L, 0x81ac77d6L,
-                                0x5f11199bL,
-                                0x043556f1L, 0xd7a3c76bL, 0x3c11183bL,
-                                0x5924a509L,
-                                0xf28fe6edL, 0x97f1fbfaL, 0x9ebabf2cL,
-                                0x1e153c6eL,
-                                0x86e34570L, 0xeae96fb1L, 0x860e5e0aL,
-                                0x5a3e2ab3L,
-                                0x771fe71cL, 0x4e3d06faL, 0x2965dcb9L,
-                                0x99e71d0fL,
-                                0x803e89d6L, 0x5266c825L, 0x2e4cc978L,
-                                0x9c10b36aL,
-                                0xc6150ebaL, 0x94e2ea78L, 0xa5fc3c53L,
-                                0x1e0a2df4L,
-                                0xf2f74ea7L, 0x361d2b3dL, 0x1939260fL,
-                                0x19c27960L,
-                                0x5223a708L, 0xf71312b6L, 0xebadfe6eL,
-                                0xeac31f66L,
-                                0xe3bc4595L, 0xa67bc883L, 0xb17f37d1L,
-                                0x018cff28L,
-                                0xc332ddefL, 0xbe6c5aa5L, 0x65582185L,
-                                0x68ab9802L,
-                                0xeecea50fL, 0xdb2f953bL, 0x2aef7dadL,
-                                0x5b6e2f84L,
-                                0x1521b628L, 0x29076170L, 0xecdd4775L,
-                                0x619f1510L,
-                                0x13cca830L, 0xeb61bd96L, 0x0334fe1eL,
-                                0xaa0363cfL,
-                                0xb5735c90L, 0x4c70a239L, 0xd59e9e0bL,
-                                0xcbaade14L,
-                                0xeecc86bcL, 0x60622ca7L, 0x9cab5cabL,
-                                0xb2f3846eL,
-                                0x648b1eafL, 0x19bdf0caL, 0xa02369b9L,
-                                0x655abb50L,
-                                0x40685a32L, 0x3c2ab4b3L, 0x319ee9d5L,
-                                0xc021b8f7L,
-                                0x9b540b19L, 0x875fa099L, 0x95f7997eL,
-                                0x623d7da8L,
-                                0xf837889aL, 0x97e32d77L, 0x11ed935fL,
-                                0x16681281L,
-                                0x0e358829L, 0xc7e61fd6L, 0x96dedfa1L,
-                                0x7858ba99L,
-                                0x57f584a5L, 0x1b227263L, 0x9b83c3ffL,
-                                0x1ac24696L,
-                                0xcdb30aebL, 0x532e3054L, 0x8fd948e4L,
-                                0x6dbc3128L,
-                                0x58ebf2efL, 0x34c6ffeaL, 0xfe28ed61L,
-                                0xee7c3c73L,
-                                0x5d4a14d9L, 0xe864b7e3L, 0x42105d14L,
-                                0x203e13e0L,
-                                0x45eee2b6L, 0xa3aaabeaL, 0xdb6c4f15L,
-                                0xfacb4fd0L,
-                                0xc742f442L, 0xef6abbb5L, 0x654f3b1dL,
-                                0x41cd2105L,
-                                0xd81e799eL, 0x86854dc7L, 0xe44b476aL,
-                                0x3d816250L,
-                                0xcf62a1f2L, 0x5b8d2646L, 0xfc8883a0L,
-                                0xc1c7b6a3L,
-                                0x7f1524c3L, 0x69cb7492L, 0x47848a0bL,
-                                0x5692b285L,
-                                0x095bbf00L, 0xad19489dL, 0x1462b174L,
-                                0x23820e00L,
-                                0x58428d2aL, 0x0c55f5eaL, 0x1dadf43eL,
-                                0x233f7061L,
-                                0x3372f092L, 0x8d937e41L, 0xd65fecf1L,
-                                0x6c223bdbL,
-                                0x7cde3759L, 0xcbee7460L, 0x4085f2a7L,
-                                0xce77326eL,
-                                0xa6078084L, 0x19f8509eL, 0xe8efd855L,
-                                0x61d99735L,
-                                0xa969a7aaL, 0xc50c06c2L, 0x5a04abfcL,
-                                0x800bcadcL,
-                                0x9e447a2eL, 0xc3453484L, 0xfdd56705L,
-                                0x0e1e9ec9L,
-                                0xdb73dbd3L, 0x105588cdL, 0x675fda79L,
-                                0xe3674340L,
-                                0xc5c43465L, 0x713e38d8L, 0x3d28f89eL,
-                                0xf16dff20L,
-                                0x153e21e7L, 0x8fb03d4aL, 0xe6e39f2bL,
-                                0xdb83adf7L,
-                                0xe93d5a68L, 0x948140f7L, 0xf64c261cL,
-                                0x94692934L,
-                                0x411520f7L, 0x7602d4f7L, 0xbcf46b2eL,
-                                0xd4a20068L,
-                                0xd4082471L, 0x3320f46aL, 0x43b7d4b7L,
-                                0x500061afL,
-                                0x1e39f62eL, 0x97244546L, 0x14214f74L,
-                                0xbf8b8840L,
-                                0x4d95fc1dL, 0x96b591afL, 0x70f4ddd3L,
-                                0x66a02f45L,
-                                0xbfbc09ecL, 0x03bd9785L, 0x7fac6dd0L,
-                                0x31cb8504L,
-                                0x96eb27b3L, 0x55fd3941L, 0xda2547e6L,
-                                0xabca0a9aL,
-                                0x28507825L, 0x530429f4L, 0x0a2c86daL,
-                                0xe9b66dfbL,
-                                0x68dc1462L, 0xd7486900L, 0x680ec0a4L,
-                                0x27a18deeL,
-                                0x4f3ffea2L, 0xe887ad8cL, 0xb58ce006L,
-                                0x7af4d6b6L,
-                                0xaace1e7cL, 0xd3375fecL, 0xce78a399L,
-                                0x406b2a42L,
-                                0x20fe9e35L, 0xd9f385b9L, 0xee39d7abL,
-                                0x3b124e8bL,
-                                0x1dc9faf7L, 0x4b6d1856L, 0x26a36631L,
-                                0xeae397b2L,
-                                0x3a6efa74L, 0xdd5b4332L, 0x6841e7f7L,
-                                0xca7820fbL,
-                                0xfb0af54eL, 0xd8feb397L, 0x454056acL,
-                                0xba489527L,
-                                0x55533a3aL, 0x20838d87L, 0xfe6ba9b7L,
-                                0xd096954bL,
-                                0x55a867bcL, 0xa1159a58L, 0xcca92963L,
-                                0x99e1db33L,
-                                0xa62a4a56L, 0x3f3125f9L, 0x5ef47e1cL,
-                                0x9029317cL,
-                                0xfdf8e802L, 0x04272f70L, 0x80bb155cL,
-                                0x05282ce3L,
-                                0x95c11548L, 0xe4c66d22L, 0x48c1133fL,
-                                0xc70f86dcL,
-                                0x07f9c9eeL, 0x41041f0fL, 0x404779a4L,
-                                0x5d886e17L,
-                                0x325f51ebL, 0xd59bc0d1L, 0xf2bcc18fL,
-                                0x41113564L,
-                                0x257b7834L, 0x602a9c60L, 0xdff8e8a3L,
-                                0x1f636c1bL,
-                                0x0e12b4c2L, 0x02e1329eL, 0xaf664fd1L,
-                                0xcad18115L,
-                                0x6b2395e0L, 0x333e92e1L, 0x3b240b62L,
-                                0xeebeb922L,
-                                0x85b2a20eL, 0xe6ba0d99L, 0xde720c8cL,
-                                0x2da2f728L,
-                                0xd0127845L, 0x95b794fdL, 0x647d0862L,
-                                0xe7ccf5f0L,
-                                0x5449a36fL, 0x877d48faL, 0xc39dfd27L,
-                                0xf33e8d1eL,
-                                0x0a476341L, 0x992eff74L, 0x3a6f6eabL,
-                                0xf4f8fd37L,
-                                0xa812dc60L, 0xa1ebddf8L, 0x991be14cL,
-                                0xdb6e6b0dL,
-                                0xc67b5510L, 0x6d672c37L, 0x2765d43bL,
-                                0xdcd0e804L,
-                                0xf1290dc7L, 0xcc00ffa3L, 0xb5390f92L,
-                                0x690fed0bL,
-                                0x667b9ffbL, 0xcedb7d9cL, 0xa091cf0bL,
-                                0xd9155ea3L,
-                                0xbb132f88L, 0x515bad24L, 0x7b9479bfL,
-                                0x763bd6ebL,
-                                0x37392eb3L, 0xcc115979L, 0x8026e297L,
-                                0xf42e312dL,
-                                0x6842ada7L, 0xc66a2b3bL, 0x12754cccL,
-                                0x782ef11cL,
-                                0x6a124237L, 0xb79251e7L, 0x06a1bbe6L,
-                                0x4bfb6350L,
-                                0x1a6b1018L, 0x11caedfaL, 0x3d25bdd8L,
-                                0xe2e1c3c9L,
-                                0x44421659L, 0x0a121386L, 0xd90cec6eL,
-                                0xd5abea2aL,
-                                0x64af674eL, 0xda86a85fL, 0xbebfe988L,
-                                0x64e4c3feL,
-                                0x9dbc8057L, 0xf0f7c086L, 0x60787bf8L,
-                                0x6003604dL,
-                                0xd1fd8346L, 0xf6381fb0L, 0x7745ae04L,
-                                0xd736fcccL,
-                                0x83426b33L, 0xf01eab71L, 0xb0804187L,
-                                0x3c005e5fL,
-                                0x77a057beL, 0xbde8ae24L, 0x55464299L,
-                                0xbf582e61L,
-                                0x4e58f48fL, 0xf2ddfda2L, 0xf474ef38L,
-                                0x8789bdc2L,
-                                0x5366f9c3L, 0xc8b38e74L, 0xb475f255L,
-                                0x46fcd9b9L,
-                                0x7aeb2661L, 0x8b1ddf84L, 0x846a0e79L,
-                                0x915f95e2L,
-                                0x466e598eL, 0x20b45770L, 0x8cd55591L,
-                                0xc902de4cL,
-                                0xb90bace1L, 0xbb8205d0L, 0x11a86248L,
-                                0x7574a99eL,
-                                0xb77f19b6L, 0xe0a9dc09L, 0x662d09a1L,
-                                0xc4324633L,
-                                0xe85a1f02L, 0x09f0be8cL, 0x4a99a025L,
-                                0x1d6efe10L,
-                                0x1ab93d1dL, 0x0ba5a4dfL, 0xa186f20fL,
-                                0x2868f169L,
-                                0xdcb7da83L, 0x573906feL, 0xa1e2ce9bL,
-                                0x4fcd7f52L,
-                                0x50115e01L, 0xa70683faL, 0xa002b5c4L,
-                                0x0de6d027L,
-                                0x9af88c27L, 0x773f8641L, 0xc3604c06L,
-                                0x61a806b5L,
-                                0xf0177a28L, 0xc0f586e0L, 0x006058aaL,
-                                0x30dc7d62L,
-                                0x11e69ed7L, 0x2338ea63L, 0x53c2dd94L,
-                                0xc2c21634L,
-                                0xbbcbee56L, 0x90bcb6deL, 0xebfc7da1L,
-                                0xce591d76L,
-                                0x6f05e409L, 0x4b7c0188L, 0x39720a3dL,
-                                0x7c927c24L,
-                                0x86e3725fL, 0x724d9db9L, 0x1ac15bb4L,
-                                0xd39eb8fcL,
-                                0xed545578L, 0x08fca5b5L, 0xd83d7cd3L,
-                                0x4dad0fc4L,
-                                0x1e50ef5eL, 0xb161e6f8L, 0xa28514d9L,
-                                0x6c51133cL,
-                                0x6fd5c7e7L, 0x56e14ec4L, 0x362abfceL,
-                                0xddc6c837L,
-                                0xd79a3234L, 0x92638212L, 0x670efa8eL,
-                                0x406000e0L,
-                                0x3a39ce37L, 0xd3faf5cfL, 0xabc27737L,
-                                0x5ac52d1bL,
-                                0x5cb0679eL, 0x4fa33742L, 0xd3822740L,
-                                0x99bc9bbeL,
-                                0xd5118e9dL, 0xbf0f7315L, 0xd62d1c7eL,
-                                0xc700c47bL,
-                                0xb78c1b6bL, 0x21a19045L, 0xb26eb1beL,
-                                0x6a366eb4L,
-                                0x5748ab2fL, 0xbc946e79L, 0xc6a376d2L,
-                                0x6549c2c8L,
-                                0x530ff8eeL, 0x468dde7dL, 0xd5730a1dL,
-                                0x4cd04dc6L,
-                                0x2939bbdbL, 0xa9ba4650L, 0xac9526e8L,
-                                0xbe5ee304L,
-                                0xa1fad5f0L, 0x6a2d519aL, 0x63ef8ce2L,
-                                0x9a86ee22L,
-                                0xc089c2b8L, 0x43242ef6L, 0xa51e03aaL,
-                                0x9cf2d0a4L,
-                                0x83c061baL, 0x9be96a4dL, 0x8fe51550L,
-                                0xba645bd6L,
-                                0x2826a2f9L, 0xa73a3ae1L, 0x4ba99586L,
-                                0xef5562e9L,
-                                0xc72fefd3L, 0xf752f7daL, 0x3f046f69L,
-                                0x77fa0a59L,
-                                0x80e4a915L, 0x87b08601L, 0x9b09e6adL,
-                                0x3b3ee593L,
-                                0xe990fd5aL, 0x9e34d797L, 0x2cf0b7d9L,
-                                0x022b8b51L,
-                                0x96d5ac3aL, 0x017da67dL, 0xd1cf3ed6L,
-                                0x7c7d2d28L,
-                                0x1f9f25cfL, 0xadf2b89bL, 0x5ad6b472L,
-                                0x5a88f54cL,
-                                0xe029ac71L, 0xe019a5e6L, 0x47b0acfdL,
-                                0xed93fa9bL,
-                                0xe8d3c48dL, 0x283b57ccL, 0xf8d56629L,
-                                0x79132e28L,
-                                0x785f0191L, 0xed756055L, 0xf7960e44L,
-                                0xe3d35e8cL,
-                                0x15056dd4L, 0x88f46dbaL, 0x03a16125L,
-                                0x0564f0bdL,
-                                0xc3eb9e15L, 0x3c9057a2L, 0x97271aecL,
-                                0xa93a072aL,
-                                0x1b3f6d9bL, 0x1e6321f5L, 0xf59c66fbL,
-                                0x26dcf319L,
-                                0x7533d928L, 0xb155fdf5L, 0x03563482L,
-                                0x8aba3cbbL,
-                                0x28517711L, 0xc20ad9f8L, 0xabcc5167L,
-                                0xccad925fL,
-                                0x4de81751L, 0x3830dc8eL, 0x379d5862L,
-                                0x9320f991L,
-                                0xea7a90c2L, 0xfb3e7bceL, 0x5121ce64L,
-                                0x774fbe32L,
-                                0xa8b6e37eL, 0xc3293d46L, 0x48de5369L,
-                                0x6413e680L,
-                                0xa2ae0810L, 0xdd6db224L, 0x69852dfdL,
-                                0x09072166L,
-                                0xb39a460aL, 0x6445c0ddL, 0x586cdecfL,
-                                0x1c20c8aeL,
-                                0x5bbef7ddL, 0x1b588d40L, 0xccd2017fL,
-                                0x6bb4e3bbL,
-                                0xdda26a7eL, 0x3a59ff45L, 0x3e350a44L,
-                                0xbcb4cdd5L,
-                                0x72eacea8L, 0xfa6484bbL, 0x8d6612aeL,
-                                0xbf3c6f47L,
-                                0xd29be463L, 0x542f5d9eL, 0xaec2771bL,
-                                0xf64e6370L,
-                                0x740e0d8dL, 0xe75b1357L, 0xf8721671L,
-                                0xaf537d5dL,
-                                0x4040cb08L, 0x4eb4e2ccL, 0x34d2466aL,
-                                0x0115af84L,
-                                0xe1b00428L, 0x95983a1dL, 0x06b89fb4L,
-                                0xce6ea048L,
-                                0x6f3f3b82L, 0x3520ab82L, 0x011a1d4bL,
-                                0x277227f8L,
-                                0x611560b1L, 0xe7933fdcL, 0xbb3a792bL,
-                                0x344525bdL,
-                                0xa08839e1L, 0x51ce794bL, 0x2f32c9b7L,
-                                0xa01fbac9L,
-                                0xe01cc87eL, 0xbcc7d1f6L, 0xcf0111c3L,
-                                0xa1e8aac7L,
-                                0x1a908749L, 0xd44fbd9aL, 0xd0dadecbL,
-                                0xd50ada38L,
-                                0x0339c32aL, 0xc6913667L, 0x8df9317cL,
-                                0xe0b12b4fL,
-                                0xf79e59b7L, 0x43f5bb3aL, 0xf2d519ffL,
-                                0x27d9459cL,
-                                0xbf97222cL, 0x15e6fc2aL, 0x0f91fc71L,
-                                0x9b941525L,
-                                0xfae59361L, 0xceb69cebL, 0xc2a86459L,
-                                0x12baa8d1L,
-                                0xb6c1075eL, 0xe3056a0cL, 0x10d25065L,
-                                0xcb03a442L,
-                                0xe0ec6e0eL, 0x1698db3bL, 0x4c98a0beL,
-                                0x3278e964L,
-                                0x9f1f9532L, 0xe0d392dfL, 0xd3a0342bL,
-                                0x8971f21eL,
-                                0x1b0a7441L, 0x4ba3348cL, 0xc5be7120L,
-                                0xc37632d8L,
-                                0xdf359f8dL, 0x9b992f2eL, 0xe60b6f47L,
-                                0x0fe3f11dL,
-                                0xe54cda54L, 0x1edad891L, 0xce6279cfL,
-                                0xcd3e7e6fL,
-                                0x1618b166L, 0xfd2c1d05L, 0x848fd2c5L,
-                                0xf6fb2299L,
-                                0xf523f357L, 0xa6327623L, 0x93a83531L,
-                                0x56cccd02L,
-                                0xacf08162L, 0x5a75ebb5L, 0x6e163697L,
-                                0x88d273ccL,
-                                0xde966292L, 0x81b949d0L, 0x4c50901bL,
-                                0x71c65614L,
-                                0xe6c6c7bdL, 0x327a140aL, 0x45e1d006L,
-                                0xc3f27b9aL,
-                                0xc9aa53fdL, 0x62a80f00L, 0xbb25bfe2L,
-                                0x35bdd2f6L,
-                                0x71126905L, 0xb2040222L, 0xb6cbcf7cL,
-                                0xcd769c2bL,
-                                0x53113ec0L, 0x1640e3d3L, 0x38abbd60L,
-                                0x2547adf0L,
-                                0xba38209cL, 0xf746ce76L, 0x77afa1c5L,
-                                0x20756060L,
-                                0x85cbfe4eL, 0x8ae88dd8L, 0x7aaaf9b0L,
-                                0x4cf9aa7eL,
-                                0x1948c25cL, 0x02fb8a8cL, 0x01c36ae4L,
-                                0xd6ebe1f9L,
-                                0x90d4f869L, 0xa65cdea0L, 0x3f09252dL,
-                                0xc208e69fL,
-                                0xb74e6132L, 0xce77e25bL, 0x578fdfe3L,
-                                0x3ac372e6L,
-                                }
+        0xd1310ba6L,
+        0x98dfb5acL,
+        0x2ffd72dbL,
+        0xd01adfb7L,
+        0xb8e1afedL,
+        0x6a267e96L,
+        0xba7c9045L,
+        0xf12c7f99L,
+        0x24a19947L,
+        0xb3916cf7L,
+        0x0801f2e2L,
+        0x858efc16L,
+        0x636920d8L,
+        0x71574e69L,
+        0xa458fea3L,
+        0xf4933d7eL,
+        0x0d95748fL,
+        0x728eb658L,
+        0x718bcd58L,
+        0x82154aeeL,
+        0x7b54a41dL,
+        0xc25a59b5L,
+        0x9c30d539L,
+        0x2af26013L,
+        0xc5d1b023L,
+        0x286085f0L,
+        0xca417918L,
+        0xb8db38efL,
+        0x8e79dcb0L,
+        0x603a180eL,
+        0x6c9e0e8bL,
+        0xb01e8a3eL,
+        0xd71577c1L,
+        0xbd314b27L,
+        0x78af2fdaL,
+        0x55605c60L,
+        0xe65525f3L,
+        0xaa55ab94L,
+        0x57489862L,
+        0x63e81440L,
+        0x55ca396aL,
+        0x2aab10b6L,
+        0xb4cc5c34L,
+        0x1141e8ceL,
+        0xa15486afL,
+        0x7c72e993L,
+        0xb3ee1411L,
+        0x636fbc2aL,
+        0x2ba9c55dL,
+        0x741831f6L,
+        0xce5c3e16L,
+        0x9b87931eL,
+        0xafd6ba33L,
+        0x6c24cf5cL,
+        0x7a325381L,
+        0x28958677L,
+        0x3b8f4898L,
+        0x6b4bb9afL,
+        0xc4bfe81bL,
+        0x66282193L,
+        0x61d809ccL,
+        0xfb21a991L,
+        0x487cac60L,
+        0x5dec8032L,
+        0xef845d5dL,
+        0xe98575b1L,
+        0xdc262302L,
+        0xeb651b88L,
+        0x23893e81L,
+        0xd396acc5L,
+        0x0f6d6ff3L,
+        0x83f44239L,
+        0x2e0b4482L,
+        0xa4842004L,
+        0x69c8f04aL,
+        0x9e1f9b5eL,
+        0x21c66842L,
+        0xf6e96c9aL,
+        0x670c9c61L,
+        0xabd388f0L,
+        0x6a51a0d2L,
+        0xd8542f68L,
+        0x960fa728L,
+        0xab5133a3L,
+        0x6eef0b6cL,
+        0x137a3be4L,
+        0xba3bf050L,
+        0x7efb2a98L,
+        0xa1f1651dL,
+        0x39af0176L,
+        0x66ca593eL,
+        0x82430e88L,
+        0x8cee8619L,
+        0x456f9fb4L,
+        0x7d84a5c3L,
+        0x3b8b5ebeL,
+        0xe06f75d8L,
+        0x85c12073L,
+        0x401a449fL,
+        0x56c16aa6L,
+        0x4ed3aa62L,
+        0x363f7706L,
+        0x1bfedf72L,
+        0x429b023dL,
+        0x37d0d724L,
+        0xd00a1248L,
+        0xdb0fead3L,
+        0x49f1c09bL,
+        0x075372c9L,
+        0x80991b7bL,
+        0x25d479d8L,
+        0xf6e8def7L,
+        0xe3fe501aL,
+        0xb6794c3bL,
+        0x976ce0bdL,
+        0x04c006baL,
+        0xc1a94fb6L,
+        0x409f60c4L,
+        0x5e5c9ec2L,
+        0x196a2463L,
+        0x68fb6fafL,
+        0x3e6c53b5L,
+        0x1339b2ebL,
+        0x3b52ec6fL,
+        0x6dfc511fL,
+        0x9b30952cL,
+        0xcc814544L,
+        0xaf5ebd09L,
+        0xbee3d004L,
+        0xde334afdL,
+        0x660f2807L,
+        0x192e4bb3L,
+        0xc0cba857L,
+        0x45c8740fL,
+        0xd20b5f39L,
+        0xb9d3fbdbL,
+        0x5579c0bdL,
+        0x1a60320aL,
+        0xd6a100c6L,
+        0x402c7279L,
+        0x679f25feL,
+        0xfb1fa3ccL,
+        0x8ea5e9f8L,
+        0xdb3222f8L,
+        0x3c7516dfL,
+        0xfd616b15L,
+        0x2f501ec8L,
+        0xad0552abL,
+        0x323db5faL,
+        0xfd238760L,
+        0x53317b48L,
+        0x3e00df82L,
+        0x9e5c57bbL,
+        0xca6f8ca0L,
+        0x1a87562eL,
+        0xdf1769dbL,
+        0xd542a8f6L,
+        0x287effc3L,
+        0xac6732c6L,
+        0x8c4f5573L,
+        0x695b27b0L,
+        0xbbca58c8L,
+        0xe1ffa35dL,
+        0xb8f011a0L,
+        0x10fa3d98L,
+        0xfd2183b8L,
+        0x4afcb56cL,
+        0x2dd1d35bL,
+        0x9a53e479L,
+        0xb6f84565L,
+        0xd28e49bcL,
+        0x4bfb9790L,
+        0xe1ddf2daL,
+        0xa4cb7e33L,
+        0x62fb1341L,
+        0xcee4c6e8L,
+        0xef20cadaL,
+        0x36774c01L,
+        0xd07e9efeL,
+        0x2bf11fb4L,
+        0x95dbda4dL,
+        0xae909198L,
+        0xeaad8e71L,
+        0x6b93d5a0L,
+        0xd08ed1d0L,
+        0xafc725e0L,
+        0x8e3c5b2fL,
+        0x8e7594b7L,
+        0x8ff6e2fbL,
+        0xf2122b64L,
+        0x8888b812L,
+        0x900df01cL,
+        0x4fad5ea0L,
+        0x688fc31cL,
+        0xd1cff191L,
+        0xb3a8c1adL,
+        0x2f2f2218L,
+        0xbe0e1777L,
+        0xea752dfeL,
+        0x8b021fa1L,
+        0xe5a0cc0fL,
+        0xb56f74e8L,
+        0x18acf3d6L,
+        0xce89e299L,
+        0xb4a84fe0L,
+        0xfd13e0b7L,
+        0x7cc43b81L,
+        0xd2ada8d9L,
+        0x165fa266L,
+        0x80957705L,
+        0x93cc7314L,
+        0x211a1477L,
+        0xe6ad2065L,
+        0x77b5fa86L,
+        0xc75442f5L,
+        0xfb9d35cfL,
+        0xebcdaf0cL,
+        0x7b3e89a0L,
+        0xd6411bd3L,
+        0xae1e7e49L,
+        0x00250e2dL,
+        0x2071b35eL,
+        0x226800bbL,
+        0x57b8e0afL,
+        0x2464369bL,
+        0xf009b91eL,
+        0x5563911dL,
+        0x59dfa6aaL,
+        0x78c14389L,
+        0xd95a537fL,
+        0x207d5ba2L,
+        0x02e5b9c5L,
+        0x83260376L,
+        0x6295cfa9L,
+        0x11c81968L,
+        0x4e734a41L,
+        0xb3472dcaL,
+        0x7b14a94aL,
+        0x1b510052L,
+        0x9a532915L,
+        0xd60f573fL,
+        0xbc9bc6e4L,
+        0x2b60a476L,
+        0x81e67400L,
+        0x08ba6fb5L,
+        0x571be91fL,
+        0xf296ec6bL,
+        0x2a0dd915L,
+        0xb6636521L,
+        0xe7b9f9b6L,
+        0xff34052eL,
+        0xc5855664L,
+        0x53b02d5dL,
+        0xa99f8fa1L,
+        0x08ba4799L,
+        0x6e85076aL,
+        0x4b7a70e9L,
+        0xb5b32944L,
+        0xdb75092eL,
+        0xc4192623L,
+        0xad6ea6b0L,
+        0x49a7df7dL,
+        0x9cee60b8L,
+        0x8fedb266L,
+        0xecaa8c71L,
+        0x699a17ffL,
+        0x5664526cL,
+        0xc2b19ee1L,
+        0x193602a5L,
+        0x75094c29L,
+        0xa0591340L,
+        0xe4183a3eL,
+        0x3f54989aL,
+        0x5b429d65L,
+        0x6b8fe4d6L,
+        0x99f73fd6L,
+        0xa1d29c07L,
+        0xefe830f5L,
+        0x4d2d38e6L,
+        0xf0255dc1L,
+        0x4cdd2086L,
+        0x8470eb26L,
+        0x6382e9c6L,
+        0x021ecc5eL,
+        0x09686b3fL,
+        0x3ebaefc9L,
+        0x3c971814L,
+        0x6b6a70a1L,
+        0x687f3584L,
+        0x52a0e286L,
+        0xb79c5305L,
+        0xaa500737L,
+        0x3e07841cL,
+        0x7fdeae5cL,
+        0x8e7d44ecL,
+        0x5716f2b8L,
+        0xb03ada37L,
+        0xf0500c0dL,
+        0xf01c1f04L,
+        0x0200b3ffL,
+        0xae0cf51aL,
+        0x3cb574b2L,
+        0x25837a58L,
+        0xdc0921bdL,
+        0xd19113f9L,
+        0x7ca92ff6L,
+        0x94324773L,
+        0x22f54701L,
+        0x3ae5e581L,
+        0x37c2dadcL,
+        0xc8b57634L,
+        0x9af3dda7L,
+        0xa9446146L,
+        0x0fd0030eL,
+        0xecc8c73eL,
+        0xa4751e41L,
+        0xe238cd99L,
+        0x3bea0e2fL,
+        0x3280bba1L,
+        0x183eb331L,
+        0x4e548b38L,
+        0x4f6db908L,
+        0x6f420d03L,
+        0xf60a04bfL,
+        0x2cb81290L,
+        0x24977c79L,
+        0x5679b072L,
+        0xbcaf89afL,
+        0xde9a771fL,
+        0xd9930810L,
+        0xb38bae12L,
+        0xdccf3f2eL,
+        0x5512721fL,
+        0x2e6b7124L,
+        0x501adde6L,
+        0x9f84cd87L,
+        0x7a584718L,
+        0x7408da17L,
+        0xbc9f9abcL,
+        0xe94b7d8cL,
+        0xec7aec3aL,
+        0xdb851dfaL,
+        0x63094366L,
+        0xc464c3d2L,
+        0xef1c1847L,
+        0x3215d908L,
+        0xdd433b37L,
+        0x24c2ba16L,
+        0x12a14d43L,
+        0x2a65c451L,
+        0x50940002L,
+        0x133ae4ddL,
+        0x71dff89eL,
+        0x10314e55L,
+        0x81ac77d6L,
+        0x5f11199bL,
+        0x043556f1L,
+        0xd7a3c76bL,
+        0x3c11183bL,
+        0x5924a509L,
+        0xf28fe6edL,
+        0x97f1fbfaL,
+        0x9ebabf2cL,
+        0x1e153c6eL,
+        0x86e34570L,
+        0xeae96fb1L,
+        0x860e5e0aL,
+        0x5a3e2ab3L,
+        0x771fe71cL,
+        0x4e3d06faL,
+        0x2965dcb9L,
+        0x99e71d0fL,
+        0x803e89d6L,
+        0x5266c825L,
+        0x2e4cc978L,
+        0x9c10b36aL,
+        0xc6150ebaL,
+        0x94e2ea78L,
+        0xa5fc3c53L,
+        0x1e0a2df4L,
+        0xf2f74ea7L,
+        0x361d2b3dL,
+        0x1939260fL,
+        0x19c27960L,
+        0x5223a708L,
+        0xf71312b6L,
+        0xebadfe6eL,
+        0xeac31f66L,
+        0xe3bc4595L,
+        0xa67bc883L,
+        0xb17f37d1L,
+        0x018cff28L,
+        0xc332ddefL,
+        0xbe6c5aa5L,
+        0x65582185L,
+        0x68ab9802L,
+        0xeecea50fL,
+        0xdb2f953bL,
+        0x2aef7dadL,
+        0x5b6e2f84L,
+        0x1521b628L,
+        0x29076170L,
+        0xecdd4775L,
+        0x619f1510L,
+        0x13cca830L,
+        0xeb61bd96L,
+        0x0334fe1eL,
+        0xaa0363cfL,
+        0xb5735c90L,
+        0x4c70a239L,
+        0xd59e9e0bL,
+        0xcbaade14L,
+        0xeecc86bcL,
+        0x60622ca7L,
+        0x9cab5cabL,
+        0xb2f3846eL,
+        0x648b1eafL,
+        0x19bdf0caL,
+        0xa02369b9L,
+        0x655abb50L,
+        0x40685a32L,
+        0x3c2ab4b3L,
+        0x319ee9d5L,
+        0xc021b8f7L,
+        0x9b540b19L,
+        0x875fa099L,
+        0x95f7997eL,
+        0x623d7da8L,
+        0xf837889aL,
+        0x97e32d77L,
+        0x11ed935fL,
+        0x16681281L,
+        0x0e358829L,
+        0xc7e61fd6L,
+        0x96dedfa1L,
+        0x7858ba99L,
+        0x57f584a5L,
+        0x1b227263L,
+        0x9b83c3ffL,
+        0x1ac24696L,
+        0xcdb30aebL,
+        0x532e3054L,
+        0x8fd948e4L,
+        0x6dbc3128L,
+        0x58ebf2efL,
+        0x34c6ffeaL,
+        0xfe28ed61L,
+        0xee7c3c73L,
+        0x5d4a14d9L,
+        0xe864b7e3L,
+        0x42105d14L,
+        0x203e13e0L,
+        0x45eee2b6L,
+        0xa3aaabeaL,
+        0xdb6c4f15L,
+        0xfacb4fd0L,
+        0xc742f442L,
+        0xef6abbb5L,
+        0x654f3b1dL,
+        0x41cd2105L,
+        0xd81e799eL,
+        0x86854dc7L,
+        0xe44b476aL,
+        0x3d816250L,
+        0xcf62a1f2L,
+        0x5b8d2646L,
+        0xfc8883a0L,
+        0xc1c7b6a3L,
+        0x7f1524c3L,
+        0x69cb7492L,
+        0x47848a0bL,
+        0x5692b285L,
+        0x095bbf00L,
+        0xad19489dL,
+        0x1462b174L,
+        0x23820e00L,
+        0x58428d2aL,
+        0x0c55f5eaL,
+        0x1dadf43eL,
+        0x233f7061L,
+        0x3372f092L,
+        0x8d937e41L,
+        0xd65fecf1L,
+        0x6c223bdbL,
+        0x7cde3759L,
+        0xcbee7460L,
+        0x4085f2a7L,
+        0xce77326eL,
+        0xa6078084L,
+        0x19f8509eL,
+        0xe8efd855L,
+        0x61d99735L,
+        0xa969a7aaL,
+        0xc50c06c2L,
+        0x5a04abfcL,
+        0x800bcadcL,
+        0x9e447a2eL,
+        0xc3453484L,
+        0xfdd56705L,
+        0x0e1e9ec9L,
+        0xdb73dbd3L,
+        0x105588cdL,
+        0x675fda79L,
+        0xe3674340L,
+        0xc5c43465L,
+        0x713e38d8L,
+        0x3d28f89eL,
+        0xf16dff20L,
+        0x153e21e7L,
+        0x8fb03d4aL,
+        0xe6e39f2bL,
+        0xdb83adf7L,
+        0xe93d5a68L,
+        0x948140f7L,
+        0xf64c261cL,
+        0x94692934L,
+        0x411520f7L,
+        0x7602d4f7L,
+        0xbcf46b2eL,
+        0xd4a20068L,
+        0xd4082471L,
+        0x3320f46aL,
+        0x43b7d4b7L,
+        0x500061afL,
+        0x1e39f62eL,
+        0x97244546L,
+        0x14214f74L,
+        0xbf8b8840L,
+        0x4d95fc1dL,
+        0x96b591afL,
+        0x70f4ddd3L,
+        0x66a02f45L,
+        0xbfbc09ecL,
+        0x03bd9785L,
+        0x7fac6dd0L,
+        0x31cb8504L,
+        0x96eb27b3L,
+        0x55fd3941L,
+        0xda2547e6L,
+        0xabca0a9aL,
+        0x28507825L,
+        0x530429f4L,
+        0x0a2c86daL,
+        0xe9b66dfbL,
+        0x68dc1462L,
+        0xd7486900L,
+        0x680ec0a4L,
+        0x27a18deeL,
+        0x4f3ffea2L,
+        0xe887ad8cL,
+        0xb58ce006L,
+        0x7af4d6b6L,
+        0xaace1e7cL,
+        0xd3375fecL,
+        0xce78a399L,
+        0x406b2a42L,
+        0x20fe9e35L,
+        0xd9f385b9L,
+        0xee39d7abL,
+        0x3b124e8bL,
+        0x1dc9faf7L,
+        0x4b6d1856L,
+        0x26a36631L,
+        0xeae397b2L,
+        0x3a6efa74L,
+        0xdd5b4332L,
+        0x6841e7f7L,
+        0xca7820fbL,
+        0xfb0af54eL,
+        0xd8feb397L,
+        0x454056acL,
+        0xba489527L,
+        0x55533a3aL,
+        0x20838d87L,
+        0xfe6ba9b7L,
+        0xd096954bL,
+        0x55a867bcL,
+        0xa1159a58L,
+        0xcca92963L,
+        0x99e1db33L,
+        0xa62a4a56L,
+        0x3f3125f9L,
+        0x5ef47e1cL,
+        0x9029317cL,
+        0xfdf8e802L,
+        0x04272f70L,
+        0x80bb155cL,
+        0x05282ce3L,
+        0x95c11548L,
+        0xe4c66d22L,
+        0x48c1133fL,
+        0xc70f86dcL,
+        0x07f9c9eeL,
+        0x41041f0fL,
+        0x404779a4L,
+        0x5d886e17L,
+        0x325f51ebL,
+        0xd59bc0d1L,
+        0xf2bcc18fL,
+        0x41113564L,
+        0x257b7834L,
+        0x602a9c60L,
+        0xdff8e8a3L,
+        0x1f636c1bL,
+        0x0e12b4c2L,
+        0x02e1329eL,
+        0xaf664fd1L,
+        0xcad18115L,
+        0x6b2395e0L,
+        0x333e92e1L,
+        0x3b240b62L,
+        0xeebeb922L,
+        0x85b2a20eL,
+        0xe6ba0d99L,
+        0xde720c8cL,
+        0x2da2f728L,
+        0xd0127845L,
+        0x95b794fdL,
+        0x647d0862L,
+        0xe7ccf5f0L,
+        0x5449a36fL,
+        0x877d48faL,
+        0xc39dfd27L,
+        0xf33e8d1eL,
+        0x0a476341L,
+        0x992eff74L,
+        0x3a6f6eabL,
+        0xf4f8fd37L,
+        0xa812dc60L,
+        0xa1ebddf8L,
+        0x991be14cL,
+        0xdb6e6b0dL,
+        0xc67b5510L,
+        0x6d672c37L,
+        0x2765d43bL,
+        0xdcd0e804L,
+        0xf1290dc7L,
+        0xcc00ffa3L,
+        0xb5390f92L,
+        0x690fed0bL,
+        0x667b9ffbL,
+        0xcedb7d9cL,
+        0xa091cf0bL,
+        0xd9155ea3L,
+        0xbb132f88L,
+        0x515bad24L,
+        0x7b9479bfL,
+        0x763bd6ebL,
+        0x37392eb3L,
+        0xcc115979L,
+        0x8026e297L,
+        0xf42e312dL,
+        0x6842ada7L,
+        0xc66a2b3bL,
+        0x12754cccL,
+        0x782ef11cL,
+        0x6a124237L,
+        0xb79251e7L,
+        0x06a1bbe6L,
+        0x4bfb6350L,
+        0x1a6b1018L,
+        0x11caedfaL,
+        0x3d25bdd8L,
+        0xe2e1c3c9L,
+        0x44421659L,
+        0x0a121386L,
+        0xd90cec6eL,
+        0xd5abea2aL,
+        0x64af674eL,
+        0xda86a85fL,
+        0xbebfe988L,
+        0x64e4c3feL,
+        0x9dbc8057L,
+        0xf0f7c086L,
+        0x60787bf8L,
+        0x6003604dL,
+        0xd1fd8346L,
+        0xf6381fb0L,
+        0x7745ae04L,
+        0xd736fcccL,
+        0x83426b33L,
+        0xf01eab71L,
+        0xb0804187L,
+        0x3c005e5fL,
+        0x77a057beL,
+        0xbde8ae24L,
+        0x55464299L,
+        0xbf582e61L,
+        0x4e58f48fL,
+        0xf2ddfda2L,
+        0xf474ef38L,
+        0x8789bdc2L,
+        0x5366f9c3L,
+        0xc8b38e74L,
+        0xb475f255L,
+        0x46fcd9b9L,
+        0x7aeb2661L,
+        0x8b1ddf84L,
+        0x846a0e79L,
+        0x915f95e2L,
+        0x466e598eL,
+        0x20b45770L,
+        0x8cd55591L,
+        0xc902de4cL,
+        0xb90bace1L,
+        0xbb8205d0L,
+        0x11a86248L,
+        0x7574a99eL,
+        0xb77f19b6L,
+        0xe0a9dc09L,
+        0x662d09a1L,
+        0xc4324633L,
+        0xe85a1f02L,
+        0x09f0be8cL,
+        0x4a99a025L,
+        0x1d6efe10L,
+        0x1ab93d1dL,
+        0x0ba5a4dfL,
+        0xa186f20fL,
+        0x2868f169L,
+        0xdcb7da83L,
+        0x573906feL,
+        0xa1e2ce9bL,
+        0x4fcd7f52L,
+        0x50115e01L,
+        0xa70683faL,
+        0xa002b5c4L,
+        0x0de6d027L,
+        0x9af88c27L,
+        0x773f8641L,
+        0xc3604c06L,
+        0x61a806b5L,
+        0xf0177a28L,
+        0xc0f586e0L,
+        0x006058aaL,
+        0x30dc7d62L,
+        0x11e69ed7L,
+        0x2338ea63L,
+        0x53c2dd94L,
+        0xc2c21634L,
+        0xbbcbee56L,
+        0x90bcb6deL,
+        0xebfc7da1L,
+        0xce591d76L,
+        0x6f05e409L,
+        0x4b7c0188L,
+        0x39720a3dL,
+        0x7c927c24L,
+        0x86e3725fL,
+        0x724d9db9L,
+        0x1ac15bb4L,
+        0xd39eb8fcL,
+        0xed545578L,
+        0x08fca5b5L,
+        0xd83d7cd3L,
+        0x4dad0fc4L,
+        0x1e50ef5eL,
+        0xb161e6f8L,
+        0xa28514d9L,
+        0x6c51133cL,
+        0x6fd5c7e7L,
+        0x56e14ec4L,
+        0x362abfceL,
+        0xddc6c837L,
+        0xd79a3234L,
+        0x92638212L,
+        0x670efa8eL,
+        0x406000e0L,
+        0x3a39ce37L,
+        0xd3faf5cfL,
+        0xabc27737L,
+        0x5ac52d1bL,
+        0x5cb0679eL,
+        0x4fa33742L,
+        0xd3822740L,
+        0x99bc9bbeL,
+        0xd5118e9dL,
+        0xbf0f7315L,
+        0xd62d1c7eL,
+        0xc700c47bL,
+        0xb78c1b6bL,
+        0x21a19045L,
+        0xb26eb1beL,
+        0x6a366eb4L,
+        0x5748ab2fL,
+        0xbc946e79L,
+        0xc6a376d2L,
+        0x6549c2c8L,
+        0x530ff8eeL,
+        0x468dde7dL,
+        0xd5730a1dL,
+        0x4cd04dc6L,
+        0x2939bbdbL,
+        0xa9ba4650L,
+        0xac9526e8L,
+        0xbe5ee304L,
+        0xa1fad5f0L,
+        0x6a2d519aL,
+        0x63ef8ce2L,
+        0x9a86ee22L,
+        0xc089c2b8L,
+        0x43242ef6L,
+        0xa51e03aaL,
+        0x9cf2d0a4L,
+        0x83c061baL,
+        0x9be96a4dL,
+        0x8fe51550L,
+        0xba645bd6L,
+        0x2826a2f9L,
+        0xa73a3ae1L,
+        0x4ba99586L,
+        0xef5562e9L,
+        0xc72fefd3L,
+        0xf752f7daL,
+        0x3f046f69L,
+        0x77fa0a59L,
+        0x80e4a915L,
+        0x87b08601L,
+        0x9b09e6adL,
+        0x3b3ee593L,
+        0xe990fd5aL,
+        0x9e34d797L,
+        0x2cf0b7d9L,
+        0x022b8b51L,
+        0x96d5ac3aL,
+        0x017da67dL,
+        0xd1cf3ed6L,
+        0x7c7d2d28L,
+        0x1f9f25cfL,
+        0xadf2b89bL,
+        0x5ad6b472L,
+        0x5a88f54cL,
+        0xe029ac71L,
+        0xe019a5e6L,
+        0x47b0acfdL,
+        0xed93fa9bL,
+        0xe8d3c48dL,
+        0x283b57ccL,
+        0xf8d56629L,
+        0x79132e28L,
+        0x785f0191L,
+        0xed756055L,
+        0xf7960e44L,
+        0xe3d35e8cL,
+        0x15056dd4L,
+        0x88f46dbaL,
+        0x03a16125L,
+        0x0564f0bdL,
+        0xc3eb9e15L,
+        0x3c9057a2L,
+        0x97271aecL,
+        0xa93a072aL,
+        0x1b3f6d9bL,
+        0x1e6321f5L,
+        0xf59c66fbL,
+        0x26dcf319L,
+        0x7533d928L,
+        0xb155fdf5L,
+        0x03563482L,
+        0x8aba3cbbL,
+        0x28517711L,
+        0xc20ad9f8L,
+        0xabcc5167L,
+        0xccad925fL,
+        0x4de81751L,
+        0x3830dc8eL,
+        0x379d5862L,
+        0x9320f991L,
+        0xea7a90c2L,
+        0xfb3e7bceL,
+        0x5121ce64L,
+        0x774fbe32L,
+        0xa8b6e37eL,
+        0xc3293d46L,
+        0x48de5369L,
+        0x6413e680L,
+        0xa2ae0810L,
+        0xdd6db224L,
+        0x69852dfdL,
+        0x09072166L,
+        0xb39a460aL,
+        0x6445c0ddL,
+        0x586cdecfL,
+        0x1c20c8aeL,
+        0x5bbef7ddL,
+        0x1b588d40L,
+        0xccd2017fL,
+        0x6bb4e3bbL,
+        0xdda26a7eL,
+        0x3a59ff45L,
+        0x3e350a44L,
+        0xbcb4cdd5L,
+        0x72eacea8L,
+        0xfa6484bbL,
+        0x8d6612aeL,
+        0xbf3c6f47L,
+        0xd29be463L,
+        0x542f5d9eL,
+        0xaec2771bL,
+        0xf64e6370L,
+        0x740e0d8dL,
+        0xe75b1357L,
+        0xf8721671L,
+        0xaf537d5dL,
+        0x4040cb08L,
+        0x4eb4e2ccL,
+        0x34d2466aL,
+        0x0115af84L,
+        0xe1b00428L,
+        0x95983a1dL,
+        0x06b89fb4L,
+        0xce6ea048L,
+        0x6f3f3b82L,
+        0x3520ab82L,
+        0x011a1d4bL,
+        0x277227f8L,
+        0x611560b1L,
+        0xe7933fdcL,
+        0xbb3a792bL,
+        0x344525bdL,
+        0xa08839e1L,
+        0x51ce794bL,
+        0x2f32c9b7L,
+        0xa01fbac9L,
+        0xe01cc87eL,
+        0xbcc7d1f6L,
+        0xcf0111c3L,
+        0xa1e8aac7L,
+        0x1a908749L,
+        0xd44fbd9aL,
+        0xd0dadecbL,
+        0xd50ada38L,
+        0x0339c32aL,
+        0xc6913667L,
+        0x8df9317cL,
+        0xe0b12b4fL,
+        0xf79e59b7L,
+        0x43f5bb3aL,
+        0xf2d519ffL,
+        0x27d9459cL,
+        0xbf97222cL,
+        0x15e6fc2aL,
+        0x0f91fc71L,
+        0x9b941525L,
+        0xfae59361L,
+        0xceb69cebL,
+        0xc2a86459L,
+        0x12baa8d1L,
+        0xb6c1075eL,
+        0xe3056a0cL,
+        0x10d25065L,
+        0xcb03a442L,
+        0xe0ec6e0eL,
+        0x1698db3bL,
+        0x4c98a0beL,
+        0x3278e964L,
+        0x9f1f9532L,
+        0xe0d392dfL,
+        0xd3a0342bL,
+        0x8971f21eL,
+        0x1b0a7441L,
+        0x4ba3348cL,
+        0xc5be7120L,
+        0xc37632d8L,
+        0xdf359f8dL,
+        0x9b992f2eL,
+        0xe60b6f47L,
+        0x0fe3f11dL,
+        0xe54cda54L,
+        0x1edad891L,
+        0xce6279cfL,
+        0xcd3e7e6fL,
+        0x1618b166L,
+        0xfd2c1d05L,
+        0x848fd2c5L,
+        0xf6fb2299L,
+        0xf523f357L,
+        0xa6327623L,
+        0x93a83531L,
+        0x56cccd02L,
+        0xacf08162L,
+        0x5a75ebb5L,
+        0x6e163697L,
+        0x88d273ccL,
+        0xde966292L,
+        0x81b949d0L,
+        0x4c50901bL,
+        0x71c65614L,
+        0xe6c6c7bdL,
+        0x327a140aL,
+        0x45e1d006L,
+        0xc3f27b9aL,
+        0xc9aa53fdL,
+        0x62a80f00L,
+        0xbb25bfe2L,
+        0x35bdd2f6L,
+        0x71126905L,
+        0xb2040222L,
+        0xb6cbcf7cL,
+        0xcd769c2bL,
+        0x53113ec0L,
+        0x1640e3d3L,
+        0x38abbd60L,
+        0x2547adf0L,
+        0xba38209cL,
+        0xf746ce76L,
+        0x77afa1c5L,
+        0x20756060L,
+        0x85cbfe4eL,
+        0x8ae88dd8L,
+        0x7aaaf9b0L,
+        0x4cf9aa7eL,
+        0x1948c25cL,
+        0x02fb8a8cL,
+        0x01c36ae4L,
+        0xd6ebe1f9L,
+        0x90d4f869L,
+        0xa65cdea0L,
+        0x3f09252dL,
+        0xc208e69fL,
+        0xb74e6132L,
+        0xce77e25bL,
+        0x578fdfe3L,
+        0x3ac372e6L,
+    }
 };
diff --git a/crypto/openssl/crypto/bio/bf_buff.c b/crypto/openssl/crypto/bio/bf_buff.c
index 737910cc7514..604c327fa70a 100644
--- a/crypto/openssl/crypto/bio/bf_buff.c
+++ b/crypto/openssl/crypto/bio/bf_buff.c
@@ -20,7 +20,7 @@ static long buffer_ctrl(BIO *h, int cmd, long arg1, void *arg2);
 static int buffer_new(BIO *h);
 static int buffer_free(BIO *data);
 static long buffer_callback_ctrl(BIO *h, int cmd, BIO_info_cb *fp);
-#define DEFAULT_BUFFER_SIZE     4096
+#define DEFAULT_BUFFER_SIZE 4096
 
 static const BIO_METHOD methods_buffer = {
     BIO_TYPE_BUFFER,
@@ -98,7 +98,7 @@ static int buffer_read(BIO *b, char *out, int outl)
     num = 0;
     BIO_clear_retry_flags(b);
 
- start:
+start:
     i = ctx->ibuf_len;
     /* If there is stuff left over, grab it */
     if (i != 0) {
@@ -167,7 +167,7 @@ static int buffer_write(BIO *b, const char *in, int inl)
         return 0;
 
     BIO_clear_retry_flags(b);
- start:
+start:
     i = ctx->obuf_size - (ctx->obuf_len + ctx->obuf_off);
     /* add to buffer and return */
     if (i >= inl) {
@@ -178,7 +178,7 @@ static int buffer_write(BIO *b, const char *in, int inl)
     /* else */
     /* stuff already in buffer, so add to it first, then flush */
     if (ctx->obuf_len != 0) {
-        if (i > 0) {            /* lets fill it up if we can */
+        if (i > 0) { /* lets fill it up if we can */
             memcpy(&(ctx->obuf[ctx->obuf_off + ctx->obuf_len]), in, i);
             in += i;
             inl -= i;
@@ -188,7 +188,7 @@ static int buffer_write(BIO *b, const char *in, int inl)
         /* we now have a full buffer needing flushing */
         for (;;) {
             i = BIO_write(b->next_bio, &(ctx->obuf[ctx->obuf_off]),
-                          ctx->obuf_len);
+                ctx->obuf_len);
             if (i <= 0) {
                 BIO_copy_next_retry(b);
 
@@ -306,7 +306,7 @@ static long buffer_ctrl(BIO *b, int cmd, long num, void *ptr)
             if (*ip == 0) {
                 ibs = (int)num;
                 obs = ctx->obuf_size;
-            } else {            /* if (*ip == 1) */
+            } else { /* if (*ip == 1) */
 
                 ibs = ctx->ibuf_size;
                 obs = (int)num;
@@ -368,7 +368,7 @@ static long buffer_ctrl(BIO *b, int cmd, long num, void *ptr)
             BIO_clear_retry_flags(b);
             if (ctx->obuf_len > 0) {
                 r = BIO_write(b->next_bio,
-                              &(ctx->obuf[ctx->obuf_off]), ctx->obuf_len);
+                    &(ctx->obuf[ctx->obuf_off]), ctx->obuf_len);
                 BIO_copy_next_retry(b);
                 if (r <= 0)
                     return (long)r;
@@ -385,8 +385,7 @@ static long buffer_ctrl(BIO *b, int cmd, long num, void *ptr)
         break;
     case BIO_CTRL_DUP:
         dbio = (BIO *)ptr;
-        if (BIO_set_read_buffer_size(dbio, ctx->ibuf_size) <= 0 ||
-            BIO_set_write_buffer_size(dbio, ctx->obuf_size) <= 0)
+        if (BIO_set_read_buffer_size(dbio, ctx->ibuf_size) <= 0 || BIO_set_write_buffer_size(dbio, ctx->obuf_size) <= 0)
             ret = 0;
         break;
     case BIO_CTRL_PEEK:
@@ -423,7 +422,7 @@ static int buffer_gets(BIO *b, char *buf, int size)
     char *p;
 
     ctx = (BIO_F_BUFFER_CTX *)b->ptr;
-    size--;                     /* reserve space for a '\0' */
+    size--; /* reserve space for a '\0' */
     BIO_clear_retry_flags(b);
 
     for (;;) {
@@ -446,7 +445,7 @@ static int buffer_gets(BIO *b, char *buf, int size)
                 *buf = '\0';
                 return num;
             }
-        } else {                /* read another chunk */
+        } else { /* read another chunk */
 
             i = BIO_read(b->next_bio, ctx->ibuf, ctx->ibuf_size);
             if (i <= 0) {
diff --git a/crypto/openssl/crypto/bio/bf_lbuf.c b/crypto/openssl/crypto/bio/bf_lbuf.c
index ce7123171aa3..8eb6d64a653e 100644
--- a/crypto/openssl/crypto/bio/bf_lbuf.c
+++ b/crypto/openssl/crypto/bio/bf_lbuf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -23,7 +23,7 @@ static int linebuffer_free(BIO *data);
 static long linebuffer_callback_ctrl(BIO *h, int cmd, BIO_info_cb *fp);
 
 /* A 10k maximum should be enough for most purposes */
-#define DEFAULT_LINEBUFFER_SIZE 1024*10
+#define DEFAULT_LINEBUFFER_SIZE 1024 * 10
 
 /* #define DEBUG */
 
@@ -48,9 +48,9 @@ const BIO_METHOD *BIO_f_linebuffer(void)
 }
 
 typedef struct bio_linebuffer_ctx_struct {
-    char *obuf;                 /* the output char array */
-    int obuf_size;              /* how big is the output buffer */
-    int obuf_len;               /* how many bytes are in it */
+    char *obuf; /* the output char array */
+    int obuf_size; /* how big is the output buffer */
+    int obuf_len; /* how many bytes are in it */
 } BIO_LINEBUFFER_CTX;
 
 static int linebuffer_new(BIO *bi)
@@ -119,7 +119,8 @@ static int linebuffer_write(BIO *b, const char *in, int inl)
         const char *p;
         char c;
 
-        for (p = in, c = '\0'; p < in + inl && (c = *p) != '\n'; p++) ;
+        for (p = in, c = '\0'; p < in + inl && (c = *p) != '\n'; p++)
+            ;
         if (c == '\n') {
             p++;
             foundnl = 1;
@@ -131,7 +132,7 @@ static int linebuffer_write(BIO *b, const char *in, int inl)
          * concatenate them and write
          */
         while ((foundnl || p - in > ctx->obuf_size - ctx->obuf_len)
-               && ctx->obuf_len > 0) {
+            && ctx->obuf_len > 0) {
             int orig_olen = ctx->obuf_len;
 
             i = ctx->obuf_size - ctx->obuf_len;
@@ -182,8 +183,7 @@ static int linebuffer_write(BIO *b, const char *in, int inl)
             in += i;
             inl -= i;
         }
-    }
-    while (foundnl && inl > 0);
+    } while (foundnl && inl > 0);
     /*
      * We've written as much as we can.  The rest of the input buffer, if
      * any, is text that doesn't end with a NL and therefore we need to try
diff --git a/crypto/openssl/crypto/bio/bf_prefix.c b/crypto/openssl/crypto/bio/bf_prefix.c
index 872efa13b559..9eebbdca5687 100644
--- a/crypto/openssl/crypto/bio/bf_prefix.c
+++ b/crypto/openssl/crypto/bio/bf_prefix.c
@@ -13,7 +13,7 @@
 #include "bio_local.h"
 
 static int prefix_write(BIO *b, const char *out, size_t outl,
-                        size_t *numwritten);
+    size_t *numwritten);
 static int prefix_read(BIO *b, char *buf, size_t size, size_t *numread);
 static int prefix_puts(BIO *b, const char *str);
 static int prefix_gets(BIO *b, char *str, int size);
@@ -43,10 +43,10 @@ const BIO_METHOD *BIO_f_prefix(void)
 }
 
 typedef struct prefix_ctx_st {
-    char *prefix;              /* Text prefix, given by user */
-    unsigned int indent;       /* Indentation amount, given by user */
+    char *prefix; /* Text prefix, given by user */
+    unsigned int indent; /* Indentation amount, given by user */
 
-    int linestart;             /* flag to indicate we're at the line start */
+    int linestart; /* flag to indicate we're at the line start */
 } PREFIX_CTX;
 
 static int prefix_create(BIO *b)
@@ -79,7 +79,7 @@ static int prefix_read(BIO *b, char *in, size_t size, size_t *numread)
 }
 
 static int prefix_write(BIO *b, const char *out, size_t outl,
-                        size_t *numwritten)
+    size_t *numwritten)
 {
     PREFIX_CTX *ctx = BIO_get_data(b);
 
@@ -97,7 +97,7 @@ static int prefix_write(BIO *b, const char *out, size_t outl,
          * prepared to handle prefix and indentation the next time around.
          */
         if (outl > 0)
-            ctx->linestart = (out[outl-1] == '\n');
+            ctx->linestart = (out[outl - 1] == '\n');
         return BIO_write_ex(BIO_next(b), out, outl, numwritten);
     }
 
@@ -116,7 +116,7 @@ static int prefix_write(BIO *b, const char *out, size_t outl,
 
             if (ctx->prefix != NULL
                 && !BIO_write_ex(BIO_next(b), ctx->prefix, strlen(ctx->prefix),
-                                 &dontcare))
+                    &dontcare))
                 return 0;
             BIO_printf(BIO_next(b), "%*s", ctx->indent, "");
             ctx->linestart = 0;
diff --git a/crypto/openssl/crypto/bio/bf_readbuff.c b/crypto/openssl/crypto/bio/bf_readbuff.c
index 2409c9db97cc..36971a40c692 100644
--- a/crypto/openssl/crypto/bio/bf_readbuff.c
+++ b/crypto/openssl/crypto/bio/bf_readbuff.c
@@ -19,7 +19,7 @@
 #include "bio_local.h"
 #include "internal/cryptlib.h"
 
-#define DEFAULT_BUFFER_SIZE     4096
+#define DEFAULT_BUFFER_SIZE 4096
 
 static int readbuffer_write(BIO *h, const char *buf, int num);
 static int readbuffer_read(BIO *h, char *buf, int size);
@@ -236,8 +236,8 @@ static int readbuffer_gets(BIO *b, char *buf, int size)
         p = ctx->ibuf + ctx->ibuf_off;
         found_newline = 0;
         for (num_chars = 0;
-             (num_chars < ctx->ibuf_len) && (num_chars < size);
-             num_chars++) {
+            (num_chars < ctx->ibuf_len) && (num_chars < size);
+            num_chars++) {
             *buf++ = p[num_chars];
             if (p[num_chars] == '\n') {
                 found_newline = 1;
@@ -259,33 +259,33 @@ static int readbuffer_gets(BIO *b, char *buf, int size)
      * next bio.
      */
 
-     /* Resize if we have to */
-     if (!readbuffer_resize(ctx, 1 + size))
-         return 0;
-     /*
-      * Read more data from the next bio using BIO_read_ex:
-      * Note we cannot use BIO_gets() here as it does not work on a
-      * binary stream that contains 0x00. (Since strlen() will stop at
-      * any 0x00 not at the last read '\n' in a FILE bio).
-      * Also note that some applications open and close the file bio
-      * multiple times and need to read the next available block when using
-      * stdin - so we need to READ one byte at a time!
-      */
-     p = ctx->ibuf + ctx->ibuf_off;
-     for (i = 0; i < size; ++i) {
-         j = BIO_read(b->next_bio, p, 1);
-         if (j <= 0) {
-             BIO_copy_next_retry(b);
-             *buf = '\0';
-             return num > 0 ? num : j;
-         }
-         *buf++ = *p;
-         num++;
-         ctx->ibuf_off++;
-         if (*p == '\n')
-             break;
-         ++p;
-     }
-     *buf = '\0';
-     return num;
+    /* Resize if we have to */
+    if (!readbuffer_resize(ctx, 1 + size))
+        return 0;
+    /*
+     * Read more data from the next bio using BIO_read_ex:
+     * Note we cannot use BIO_gets() here as it does not work on a
+     * binary stream that contains 0x00. (Since strlen() will stop at
+     * any 0x00 not at the last read '\n' in a FILE bio).
+     * Also note that some applications open and close the file bio
+     * multiple times and need to read the next available block when using
+     * stdin - so we need to READ one byte at a time!
+     */
+    p = ctx->ibuf + ctx->ibuf_off;
+    for (i = 0; i < size; ++i) {
+        j = BIO_read(b->next_bio, p, 1);
+        if (j <= 0) {
+            BIO_copy_next_retry(b);
+            *buf = '\0';
+            return num > 0 ? num : j;
+        }
+        *buf++ = *p;
+        num++;
+        ctx->ibuf_off++;
+        if (*p == '\n')
+            break;
+        ++p;
+    }
+    *buf = '\0';
+    return num;
 }
diff --git a/crypto/openssl/crypto/bio/bio_addr.c b/crypto/openssl/crypto/bio/bio_addr.c
index 4bdce0bbe84f..cf3960a35d7b 100644
--- a/crypto/openssl/crypto/bio/bio_addr.c
+++ b/crypto/openssl/crypto/bio/bio_addr.c
@@ -8,7 +8,7 @@
  */
 
 #ifndef _GNU_SOURCE
-# define _GNU_SOURCE
+#define _GNU_SOURCE
 #endif
 
 /*
@@ -126,8 +126,8 @@ int BIO_ADDR_make(BIO_ADDR *ap, const struct sockaddr *sa)
 }
 
 int BIO_ADDR_rawmake(BIO_ADDR *ap, int family,
-                     const void *where, size_t wherelen,
-                     unsigned short port)
+    const void *where, size_t wherelen,
+    unsigned short port)
 {
 #ifndef OPENSSL_NO_UNIX_SOCK
     if (family == AF_UNIX) {
@@ -227,7 +227,7 @@ unsigned short BIO_ADDR_rawport(const BIO_ADDR *ap)
  * stack, and 1 on success.
  */
 static int addr_strings(const BIO_ADDR *ap, int numeric,
-                        char **hostname, char **service)
+    char **hostname, char **service)
 {
     if (BIO_sock_init() != 1)
         return 0;
@@ -242,15 +242,16 @@ static int addr_strings(const BIO_ADDR *ap, int numeric,
             flags |= NI_NUMERICHOST | NI_NUMERICSERV;
 
         if ((ret = getnameinfo(BIO_ADDR_sockaddr(ap),
-                               BIO_ADDR_sockaddr_size(ap),
-                               host, sizeof(host), serv, sizeof(serv),
-                               flags)) != 0) {
-# ifdef EAI_SYSTEM
+                 BIO_ADDR_sockaddr_size(ap),
+                 host, sizeof(host), serv, sizeof(serv),
+                 flags))
+            != 0) {
+#ifdef EAI_SYSTEM
             if (ret == EAI_SYSTEM) {
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling getnameinfo()");
+                    "calling getnameinfo()");
             } else
-# endif
+#endif
             {
                 ERR_raise_data(ERR_LIB_BIO, ERR_R_SYS_LIB, gai_strerror(ret));
             }
@@ -265,7 +266,7 @@ static int addr_strings(const BIO_ADDR *ap, int numeric,
          */
         if (serv[0] == '\0') {
             BIO_snprintf(serv, sizeof(serv), "%d",
-                         ntohs(BIO_ADDR_rawport(ap)));
+                ntohs(BIO_ADDR_rawport(ap)));
         }
 
         if (hostname != NULL)
@@ -277,14 +278,14 @@ static int addr_strings(const BIO_ADDR *ap, int numeric,
         if (hostname != NULL)
             *hostname = OPENSSL_strdup(inet_ntoa(ap->s_in.sin_addr));
         if (service != NULL) {
-            char serv[6];        /* port is 16 bits => max 5 decimal digits */
+            char serv[6]; /* port is 16 bits => max 5 decimal digits */
             BIO_snprintf(serv, sizeof(serv), "%d", ntohs(ap->s_in.sin_port));
             *service = OPENSSL_strdup(serv);
         }
     }
 
     if ((hostname != NULL && *hostname == NULL)
-            || (service != NULL && *service == NULL)) {
+        || (service != NULL && *service == NULL)) {
         if (hostname != NULL) {
             OPENSSL_free(*hostname);
             *hostname = NULL;
@@ -455,11 +456,11 @@ void BIO_ADDRINFO_free(BIO_ADDRINFO *bai)
         return;
 
 #ifdef AI_PASSIVE
-# ifndef OPENSSL_NO_UNIX_SOCK
-#  define _cond bai->bai_family != AF_UNIX
-# else
-#  define _cond 1
-# endif
+#ifndef OPENSSL_NO_UNIX_SOCK
+#define _cond bai->bai_family != AF_UNIX
+#else
+#define _cond 1
+#endif
     if (_cond) {
         freeaddrinfo(bai);
         return;
@@ -503,10 +504,12 @@ void BIO_ADDRINFO_free(BIO_ADDRINFO *bai)
  *
  */
 int BIO_parse_hostserv(const char *hostserv, char **host, char **service,
-                       enum BIO_hostserv_priorities hostserv_prio)
+    enum BIO_hostserv_priorities hostserv_prio)
 {
-    const char *h = NULL; size_t hl = 0;
-    const char *p = NULL; size_t pl = 0;
+    const char *h = NULL;
+    size_t hl = 0;
+    const char *p = NULL;
+    size_t pl = 0;
 
     if (*hostserv == '[') {
         if ((p = strchr(hostserv, ']')) == NULL)
@@ -583,10 +586,10 @@ int BIO_parse_hostserv(const char *hostserv, char **host, char **service,
     }
 
     return 1;
- amb_err:
+amb_err:
     ERR_raise(ERR_LIB_BIO, BIO_R_AMBIGUOUS_HOST_OR_SERVICE);
     return 0;
- spec_err:
+spec_err:
     ERR_raise(ERR_LIB_BIO, BIO_R_MALFORMED_HOST_OR_SERVICE);
     return 0;
 }
@@ -601,9 +604,9 @@ int BIO_parse_hostserv(const char *hostserv, char **host, char **service,
  * only happens if a memory allocation error occurred.
  */
 static int addrinfo_wrap(int family, int socktype,
-                         const void *where, size_t wherelen,
-                         unsigned short port,
-                         BIO_ADDRINFO **bai)
+    const void *where, size_t wherelen,
+    unsigned short port,
+    BIO_ADDRINFO **bai)
 {
     if ((*bai = OPENSSL_zalloc(sizeof(**bai))) == NULL)
         return 0;
@@ -646,8 +649,8 @@ DEFINE_RUN_ONCE_STATIC(do_bio_lookup_init)
 }
 
 int BIO_lookup(const char *host, const char *service,
-               enum BIO_lookup_type lookup_type,
-               int family, int socktype, BIO_ADDRINFO **res)
+    enum BIO_lookup_type lookup_type,
+    int family, int socktype, BIO_ADDRINFO **res)
 {
     return BIO_lookup_ex(host, service, lookup_type, family, socktype, 0, res);
 }
@@ -675,9 +678,9 @@ int BIO_lookup(const char *host, const char *service,
  * The return value is 1 on success or 0 in case of error.
  */
 int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
-                  int family, int socktype, int protocol, BIO_ADDRINFO **res)
+    int family, int socktype, int protocol, BIO_ADDRINFO **res)
 {
-    int ret = 0;                 /* Assume failure */
+    int ret = 0; /* Assume failure */
 
     switch (family) {
     case AF_INET:
@@ -719,12 +722,12 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
         hints.ai_family = family;
         hints.ai_socktype = socktype;
         hints.ai_protocol = protocol;
-# ifdef AI_ADDRCONFIG
-#  ifdef AF_UNSPEC
+#ifdef AI_ADDRCONFIG
+#ifdef AF_UNSPEC
         if (host != NULL && family == AF_UNSPEC)
-#  endif
+#endif
             hints.ai_flags |= AI_ADDRCONFIG;
-# endif
+#endif
 
         if (lookup_type == BIO_LOOKUP_SERVER)
             hints.ai_flags |= AI_PASSIVE;
@@ -732,37 +735,37 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
         /* Note that |res| SHOULD be a 'struct addrinfo **' thanks to
          * macro magic in bio_local.h
          */
-# if defined(AI_ADDRCONFIG) && defined(AI_NUMERICHOST)
-      retry:
-# endif
+#if defined(AI_ADDRCONFIG) && defined(AI_NUMERICHOST)
+    retry:
+#endif
         switch ((gai_ret = getaddrinfo(host, service, &hints, res))) {
-# ifdef EAI_SYSTEM
+#ifdef EAI_SYSTEM
         case EAI_SYSTEM:
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling getaddrinfo()");
+                "calling getaddrinfo()");
             ERR_raise(ERR_LIB_BIO, ERR_R_SYS_LIB);
             break;
-# endif
-# ifdef EAI_MEMORY
+#endif
+#ifdef EAI_MEMORY
         case EAI_MEMORY:
             ERR_raise_data(ERR_LIB_BIO, ERR_R_SYS_LIB,
-                           gai_strerror(old_ret ? old_ret : gai_ret));
+                gai_strerror(old_ret ? old_ret : gai_ret));
             break;
-# endif
+#endif
         case 0:
-            ret = 1;             /* Success */
+            ret = 1; /* Success */
             break;
         default:
-# if defined(AI_ADDRCONFIG) && defined(AI_NUMERICHOST)
+#if defined(AI_ADDRCONFIG) && defined(AI_NUMERICHOST)
             if (hints.ai_flags & AI_ADDRCONFIG) {
                 hints.ai_flags &= ~AI_ADDRCONFIG;
                 hints.ai_flags |= AI_NUMERICHOST;
                 old_ret = gai_ret;
                 goto retry;
             }
-# endif
+#endif
             ERR_raise_data(ERR_LIB_BIO, ERR_R_SYS_LIB,
-                           gai_strerror(old_ret ? old_ret : gai_ret));
+                gai_strerror(old_ret ? old_ret : gai_ret));
             break;
         }
     } else {
@@ -774,8 +777,8 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
  * '&he_fallback_addresses' are 32-bit pointers
  */
 #if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma pointer_size save
-# pragma pointer_size 32
+#pragma pointer_size save
+#pragma pointer_size 32
 #endif
         /* Windows doesn't seem to have in_addr_t */
 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
@@ -794,7 +797,7 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
             (char **)&he_fallback_addresses
         };
 #if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma pointer_size restore
+#pragma pointer_size restore
 #endif
 
         struct servent *se;
@@ -813,7 +816,7 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
 
         if (!CRYPTO_THREAD_write_lock(bio_lookup_lock))
             return 0;
-        
+
         he_fallback_address = INADDR_ANY;
         if (host == NULL) {
             he = &he_fallback;
@@ -847,17 +850,17 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
                  * anyway [above getaddrinfo/gai_strerror is]. We just let
                  * system administrator figure this out...
                  */
-# if defined(OPENSSL_SYS_VXWORKS)
+#if defined(OPENSSL_SYS_VXWORKS)
                 /* h_errno doesn't exist on VxWorks */
                 ERR_raise_data(ERR_LIB_SYS, 1000,
-                               "calling gethostbyname()");
-# else
+                    "calling gethostbyname()");
+#else
                 ERR_raise_data(ERR_LIB_SYS, 1000 + h_errno,
-                               "calling gethostbyname()");
-# endif
+                    "calling gethostbyname()");
+#endif
 #else
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling gethostbyname()");
+                    "calling gethostbyname()");
 #endif
                 ret = 0;
                 goto err;
@@ -877,12 +880,12 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
  * VMS C, we need to make sure that 'proto' is a 32-bit pointer.
  */
 #if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma pointer_size save
-# pragma pointer_size 32
+#pragma pointer_size save
+#pragma pointer_size 32
 #endif
             char *proto = NULL;
 #if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma pointer_size restore
+#pragma pointer_size restore
 #endif
 
             switch (socktype) {
@@ -895,7 +898,7 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
             }
 
             if (endp != service && *endp == '\0'
-                    && portnum > 0 && portnum < 65536) {
+                && portnum > 0 && portnum < 65536) {
                 se_fallback.s_port = htons((unsigned short)portnum);
                 se_fallback.s_proto = proto;
                 se = &se_fallback;
@@ -904,7 +907,7 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
 
                 if (se == NULL) {
                     ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                                   "calling getservbyname()");
+                        "calling getservbyname()");
                     goto err;
                 }
             } else {
@@ -922,12 +925,12 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
  * the pointer size dance.
  */
 #if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma pointer_size save
-# pragma pointer_size 32
+#pragma pointer_size save
+#pragma pointer_size 32
 #endif
             char **addrlistp;
 #if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma pointer_size restore
+#pragma pointer_size restore
 #endif
             size_t addresses;
             BIO_ADDRINFO *tmp_bai = NULL;
@@ -935,19 +938,19 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
             /* The easiest way to create a linked list from an
                array is to start from the back */
             for (addrlistp = he->h_addr_list; *addrlistp != NULL;
-                 addrlistp++)
+                addrlistp++)
                 ;
 
             for (addresses = addrlistp - he->h_addr_list;
-                 addrlistp--, addresses-- > 0; ) {
+                addrlistp--, addresses-- > 0;) {
                 if (!addrinfo_wrap(he->h_addrtype, socktype,
-                                   *addrlistp, he->h_length,
-                                   se->s_port, &tmp_bai))
+                        *addrlistp, he->h_length,
+                        se->s_port, &tmp_bai))
                     goto addrinfo_wrap_err;
                 tmp_bai->bai_next = *res;
                 *res = tmp_bai;
                 continue;
-             addrinfo_wrap_err:
+            addrinfo_wrap_err:
                 BIO_ADDRINFO_free(*res);
                 *res = NULL;
                 ERR_raise(ERR_LIB_BIO, ERR_R_BIO_LIB);
@@ -957,7 +960,7 @@ int BIO_lookup_ex(const char *host, const char *service, int lookup_type,
 
             ret = 1;
         }
-     err:
+    err:
         CRYPTO_THREAD_unlock(bio_lookup_lock);
     }
 
diff --git a/crypto/openssl/crypto/bio/bio_cb.c b/crypto/openssl/crypto/bio/bio_cb.c
index 8e4f79ea3cd7..274adef6ed74 100644
--- a/crypto/openssl/crypto/bio/bio_cb.c
+++ b/crypto/openssl/crypto/bio/bio_cb.c
@@ -17,7 +17,7 @@
 #include <openssl/err.h>
 
 long BIO_debug_callback_ex(BIO *bio, int cmd, const char *argp, size_t len,
-                           int argi, long argl, int ret, size_t *processed)
+    int argi, long argl, int ret, size_t *processed)
 {
     BIO *b;
     char buf[256];
@@ -45,41 +45,41 @@ long BIO_debug_callback_ex(BIO *bio, int cmd, const char *argp, size_t len,
     case BIO_CB_READ:
         if (bio->method->type & BIO_TYPE_DESCRIPTOR)
             BIO_snprintf(p, left, "read(%d,%zu) - %s fd=%d\n",
-                         bio->num, len,
-                         bio->method->name, bio->num);
+                bio->num, len,
+                bio->method->name, bio->num);
         else
             BIO_snprintf(p, left, "read(%d,%zu) - %s\n",
-                    bio->num, len, bio->method->name);
+                bio->num, len, bio->method->name);
         break;
     case BIO_CB_WRITE:
         if (bio->method->type & BIO_TYPE_DESCRIPTOR)
             BIO_snprintf(p, left, "write(%d,%zu) - %s fd=%d\n",
-                         bio->num, len,
-                         bio->method->name, bio->num);
+                bio->num, len,
+                bio->method->name, bio->num);
         else
             BIO_snprintf(p, left, "write(%d,%zu) - %s\n",
-                         bio->num, len, bio->method->name);
+                bio->num, len, bio->method->name);
         break;
     case BIO_CB_PUTS:
         BIO_snprintf(p, left, "puts() - %s\n", bio->method->name);
         break;
     case BIO_CB_GETS:
         BIO_snprintf(p, left, "gets(%zu) - %s\n", len,
-                     bio->method->name);
+            bio->method->name);
         break;
     case BIO_CB_CTRL:
         BIO_snprintf(p, left, "ctrl(%d) - %s\n", argi,
-                     bio->method->name);
+            bio->method->name);
         break;
     case BIO_CB_RECVMMSG:
         args = (BIO_MMSG_CB_ARGS *)argp;
         BIO_snprintf(p, left, "recvmmsg(%zu) - %s",
-                     args->num_msg, bio->method->name);
+            args->num_msg, bio->method->name);
         break;
     case BIO_CB_SENDMMSG:
         args = (BIO_MMSG_CB_ARGS *)argp;
         BIO_snprintf(p, left, "sendmmsg(%zu) - %s",
-                     args->num_msg, bio->method->name);
+            args->num_msg, bio->method->name);
         break;
     case BIO_CB_RETURN | BIO_CB_READ:
         BIO_snprintf(p, left, "read return %d processed: %zu\n", ret, l);
@@ -121,14 +121,14 @@ long BIO_debug_callback_ex(BIO *bio, int cmd, const char *argp, size_t len,
 
 #ifndef OPENSSL_NO_DEPRECATED_3_0
 long BIO_debug_callback(BIO *bio, int cmd, const char *argp,
-                        int argi, long argl, long ret)
+    int argi, long argl, long ret)
 {
     size_t processed = 0;
 
     if (ret > 0)
         processed = (size_t)ret;
     BIO_debug_callback_ex(bio, cmd, argp, (size_t)argi,
-                          argi, argl, ret > 0 ? 1 : (int)ret, &processed);
+        argi, argl, ret > 0 ? 1 : (int)ret, &processed);
     return ret;
 }
 #endif
diff --git a/crypto/openssl/crypto/bio/bio_dump.c b/crypto/openssl/crypto/bio/bio_dump.c
index cd489142bb70..c117998df656 100644
--- a/crypto/openssl/crypto/bio/bio_dump.c
+++ b/crypto/openssl/crypto/bio/bio_dump.c
@@ -14,19 +14,19 @@
 #include <stdio.h>
 #include "bio_local.h"
 
-#define DUMP_WIDTH      16
+#define DUMP_WIDTH 16
 #define DUMP_WIDTH_LESS_INDENT(i) (DUMP_WIDTH - ((i - (i > 6 ? 6 : i) + 3) / 4))
 
-#define SPACE(buf, pos, n)   (sizeof(buf) - (pos) > (n))
+#define SPACE(buf, pos, n) (sizeof(buf) - (pos) > (n))
 
-int BIO_dump_cb(int (*cb) (const void *data, size_t len, void *u),
-                void *u, const void *s, int len)
+int BIO_dump_cb(int (*cb)(const void *data, size_t len, void *u),
+    void *u, const void *s, int len)
 {
     return BIO_dump_indent_cb(cb, u, s, len, 0);
 }
 
-int BIO_dump_indent_cb(int (*cb) (const void *data, size_t len, void *u),
-                       void *u, const void *v, int len, int indent)
+int BIO_dump_indent_cb(int (*cb)(const void *data, size_t len, void *u),
+    void *u, const void *v, int len, int indent)
 {
     const unsigned char *s = v;
     int res, ret = 0;
@@ -46,7 +46,7 @@ int BIO_dump_indent_cb(int (*cb) (const void *data, size_t len, void *u),
         rows++;
     for (i = 0; i < rows; i++) {
         n = BIO_snprintf(buf, sizeof(buf), "%*s%04x - ", indent, "",
-                         i * dump_width);
+            i * dump_width);
         if (n < 0)
             return -1;
         for (j = 0; j < dump_width; j++) {
@@ -56,7 +56,7 @@ int BIO_dump_indent_cb(int (*cb) (const void *data, size_t len, void *u),
                 } else {
                     ch = *(s + i * dump_width + j) & 0xff;
                     BIO_snprintf(buf + n, 4, "%02x%c", ch,
-                                 j == 7 ? '-' : ' ');
+                        j == 7 ? '-' : ' ');
                 }
                 n += 3;
             }
@@ -74,8 +74,8 @@ int BIO_dump_indent_cb(int (*cb) (const void *data, size_t len, void *u),
                 buf[n++] = ((ch >= ' ') && (ch <= '~')) ? ch : '.';
 #else
                 buf[n++] = ((ch >= os_toascii[' ']) && (ch <= os_toascii['~']))
-                           ? os_toebcdic[ch]
-                           : '.';
+                    ? os_toebcdic[ch]
+                    : '.';
 #endif
                 buf[n] = '\0';
             }
@@ -129,7 +129,7 @@ int BIO_dump_indent(BIO *bp, const void *s, int len, int indent)
 }
 
 int BIO_hex_string(BIO *out, int indent, int width, const void *data,
-                   int datalen)
+    int datalen)
 {
     const unsigned char *d = data;
     int i, j = 0;
diff --git a/crypto/openssl/crypto/bio/bio_err.c b/crypto/openssl/crypto/bio/bio_err.c
index 6fe295ee52f2..5883c9b3c122 100644
--- a/crypto/openssl/crypto/bio/bio_err.c
+++ b/crypto/openssl/crypto/bio/bio_err.c
@@ -15,76 +15,76 @@
 #ifndef OPENSSL_NO_ERR
 
 static const ERR_STRING_DATA BIO_str_reasons[] = {
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_ACCEPT_ERROR), "accept error"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_ADDRINFO_ADDR_IS_NOT_AF_INET),
-    "addrinfo addr is not af inet"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_AMBIGUOUS_HOST_OR_SERVICE),
-    "ambiguous host or service"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_BAD_FOPEN_MODE), "bad fopen mode"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_BROKEN_PIPE), "broken pipe"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_CONNECT_ERROR), "connect error"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_CONNECT_TIMEOUT), "connect timeout"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_GETHOSTBYNAME_ADDR_IS_NOT_AF_INET),
-    "gethostbyname addr is not af inet"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_GETSOCKNAME_ERROR), "getsockname error"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_GETSOCKNAME_TRUNCATED_ADDRESS),
-    "getsockname truncated address"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_GETTING_SOCKTYPE), "getting socktype"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_INVALID_ARGUMENT), "invalid argument"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_INVALID_SOCKET), "invalid socket"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_IN_USE), "in use"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_LENGTH_TOO_LONG), "length too long"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_LISTEN_V6_ONLY), "listen v6 only"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_LOOKUP_RETURNED_NOTHING),
-    "lookup returned nothing"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_MALFORMED_HOST_OR_SERVICE),
-    "malformed host or service"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NBIO_CONNECT_ERROR), "nbio connect error"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NO_ACCEPT_ADDR_OR_SERVICE_SPECIFIED),
-    "no accept addr or service specified"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NO_HOSTNAME_OR_SERVICE_SPECIFIED),
-    "no hostname or service specified"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NO_PORT_DEFINED), "no port defined"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NO_SUCH_FILE), "no such file"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_PORT_MISMATCH), "port mismatch"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_TFO_DISABLED), "tfo disabled"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_TFO_NO_KERNEL_SUPPORT),
-    "tfo no kernel support"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_TRANSFER_ERROR), "transfer error"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_TRANSFER_TIMEOUT), "transfer timeout"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_BIND_SOCKET),
-    "unable to bind socket"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_CREATE_SOCKET),
-    "unable to create socket"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_KEEPALIVE),
-    "unable to keepalive"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_LISTEN_SOCKET),
-    "unable to listen socket"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_NODELAY), "unable to nodelay"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_REUSEADDR),
-    "unable to reuseaddr"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_TFO), "unable to tfo"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNAVAILABLE_IP_FAMILY),
-    "unavailable ip family"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNINITIALIZED), "uninitialized"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNKNOWN_INFO_TYPE), "unknown info type"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNSUPPORTED_IP_FAMILY),
-    "unsupported ip family"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNSUPPORTED_METHOD), "unsupported method"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNSUPPORTED_PROTOCOL_FAMILY),
-    "unsupported protocol family"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_WRITE_TO_READ_ONLY_BIO),
-    "write to read only BIO"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_WSASTARTUP), "WSAStartup"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_LOCAL_ADDR_NOT_AVAILABLE),
-     "local address not available"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_PEER_ADDR_NOT_AVAILABLE),
-     "peer address not available"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NON_FATAL),
-     "non-fatal or transient error"},
-    {ERR_PACK(ERR_LIB_BIO, 0, BIO_R_PORT_MISMATCH),
-     "port mismatch"},
-    {0, NULL}
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_ACCEPT_ERROR), "accept error" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_ADDRINFO_ADDR_IS_NOT_AF_INET),
+        "addrinfo addr is not af inet" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_AMBIGUOUS_HOST_OR_SERVICE),
+        "ambiguous host or service" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_BAD_FOPEN_MODE), "bad fopen mode" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_BROKEN_PIPE), "broken pipe" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_CONNECT_ERROR), "connect error" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_CONNECT_TIMEOUT), "connect timeout" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_GETHOSTBYNAME_ADDR_IS_NOT_AF_INET),
+        "gethostbyname addr is not af inet" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_GETSOCKNAME_ERROR), "getsockname error" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_GETSOCKNAME_TRUNCATED_ADDRESS),
+        "getsockname truncated address" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_GETTING_SOCKTYPE), "getting socktype" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_INVALID_ARGUMENT), "invalid argument" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_INVALID_SOCKET), "invalid socket" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_IN_USE), "in use" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_LENGTH_TOO_LONG), "length too long" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_LISTEN_V6_ONLY), "listen v6 only" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_LOOKUP_RETURNED_NOTHING),
+        "lookup returned nothing" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_MALFORMED_HOST_OR_SERVICE),
+        "malformed host or service" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NBIO_CONNECT_ERROR), "nbio connect error" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NO_ACCEPT_ADDR_OR_SERVICE_SPECIFIED),
+        "no accept addr or service specified" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NO_HOSTNAME_OR_SERVICE_SPECIFIED),
+        "no hostname or service specified" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NO_PORT_DEFINED), "no port defined" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NO_SUCH_FILE), "no such file" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_PORT_MISMATCH), "port mismatch" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_TFO_DISABLED), "tfo disabled" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_TFO_NO_KERNEL_SUPPORT),
+        "tfo no kernel support" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_TRANSFER_ERROR), "transfer error" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_TRANSFER_TIMEOUT), "transfer timeout" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_BIND_SOCKET),
+        "unable to bind socket" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_CREATE_SOCKET),
+        "unable to create socket" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_KEEPALIVE),
+        "unable to keepalive" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_LISTEN_SOCKET),
+        "unable to listen socket" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_NODELAY), "unable to nodelay" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_REUSEADDR),
+        "unable to reuseaddr" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNABLE_TO_TFO), "unable to tfo" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNAVAILABLE_IP_FAMILY),
+        "unavailable ip family" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNINITIALIZED), "uninitialized" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNKNOWN_INFO_TYPE), "unknown info type" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNSUPPORTED_IP_FAMILY),
+        "unsupported ip family" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNSUPPORTED_METHOD), "unsupported method" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_UNSUPPORTED_PROTOCOL_FAMILY),
+        "unsupported protocol family" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_WRITE_TO_READ_ONLY_BIO),
+        "write to read only BIO" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_WSASTARTUP), "WSAStartup" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_LOCAL_ADDR_NOT_AVAILABLE),
+        "local address not available" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_PEER_ADDR_NOT_AVAILABLE),
+        "peer address not available" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_NON_FATAL),
+        "non-fatal or transient error" },
+    { ERR_PACK(ERR_LIB_BIO, 0, BIO_R_PORT_MISMATCH),
+        "port mismatch" },
+    { 0, NULL }
 };
 
 #endif
@@ -105,7 +105,7 @@ int BIO_err_is_non_fatal(unsigned int errcode)
     if (ERR_SYSTEM_ERROR(errcode))
         return BIO_sock_non_fatal_error(ERR_GET_REASON(errcode));
     else if (ERR_GET_LIB(errcode) == ERR_LIB_BIO
-             && ERR_GET_REASON(errcode) == BIO_R_NON_FATAL)
+        && ERR_GET_REASON(errcode) == BIO_R_NON_FATAL)
         return 1;
     else
         return 0;
diff --git a/crypto/openssl/crypto/bio/bio_lib.c b/crypto/openssl/crypto/bio/bio_lib.c
index 85ab4afe182a..8617ccb1b08b 100644
--- a/crypto/openssl/crypto/bio/bio_lib.c
+++ b/crypto/openssl/crypto/bio/bio_lib.c
@@ -20,12 +20,12 @@
  * len parameter or not
  */
 #define HAS_LEN_OPER(o) ((o) == BIO_CB_READ || (o) == BIO_CB_WRITE \
-                         || (o) == BIO_CB_GETS)
+    || (o) == BIO_CB_GETS)
 
 #ifndef OPENSSL_NO_DEPRECATED_3_0
-# define HAS_CALLBACK(b) ((b)->callback != NULL || (b)->callback_ex != NULL)
+#define HAS_CALLBACK(b) ((b)->callback != NULL || (b)->callback_ex != NULL)
 #else
-# define HAS_CALLBACK(b) ((b)->callback_ex != NULL)
+#define HAS_CALLBACK(b) ((b)->callback_ex != NULL)
 #endif
 /*
  * Helper function to work out whether to call the new style callback or the old
@@ -35,8 +35,8 @@
  * for the "long" used for "inret"
  */
 static long bio_call_callback(BIO *b, int oper, const char *argp, size_t len,
-                              int argi, long argl, long inret,
-                              size_t *processed)
+    int argi, long argl, long inret,
+    size_t *processed)
 {
     long ret = inret;
 #ifndef OPENSSL_NO_DEPRECATED_3_0
@@ -272,9 +272,7 @@ static int bio_read_intern(BIO *b, void *data, size_t dlen, size_t *readbytes)
         return -2;
     }
 
-    if (HAS_CALLBACK(b) &&
-        ((ret = (int)bio_call_callback(b, BIO_CB_READ, data, dlen, 0, 0L, 1L,
-                                       NULL)) <= 0))
+    if (HAS_CALLBACK(b) && ((ret = (int)bio_call_callback(b, BIO_CB_READ, data, dlen, 0, 0L, 1L, NULL)) <= 0))
         return ret;
 
     if (!b->init) {
@@ -289,7 +287,7 @@ static int bio_read_intern(BIO *b, void *data, size_t dlen, size_t *readbytes)
 
     if (HAS_CALLBACK(b))
         ret = (int)bio_call_callback(b, BIO_CB_READ | BIO_CB_RETURN, data,
-                                     dlen, 0, 0L, ret, readbytes);
+            dlen, 0, 0L, ret, readbytes);
 
     /* Shouldn't happen */
     if (ret > 0 && *readbytes > dlen) {
@@ -324,7 +322,7 @@ int BIO_read_ex(BIO *b, void *data, size_t dlen, size_t *readbytes)
 }
 
 static int bio_write_intern(BIO *b, const void *data, size_t dlen,
-                            size_t *written)
+    size_t *written)
 {
     size_t local_written;
     int ret;
@@ -343,9 +341,7 @@ static int bio_write_intern(BIO *b, const void *data, size_t dlen,
         return -2;
     }
 
-    if (HAS_CALLBACK(b) &&
-        ((ret = (int)bio_call_callback(b, BIO_CB_WRITE, data, dlen, 0, 0L, 1L,
-                                       NULL)) <= 0))
+    if (HAS_CALLBACK(b) && ((ret = (int)bio_call_callback(b, BIO_CB_WRITE, data, dlen, 0, 0L, 1L, NULL)) <= 0))
         return ret;
 
     if (!b->init) {
@@ -360,7 +356,7 @@ static int bio_write_intern(BIO *b, const void *data, size_t dlen,
 
     if (HAS_CALLBACK(b))
         ret = (int)bio_call_callback(b, BIO_CB_WRITE | BIO_CB_RETURN, data,
-                                     dlen, 0, 0L, ret, &local_written);
+            dlen, 0, 0L, ret, &local_written);
 
     if (written != NULL)
         *written = local_written;
@@ -392,8 +388,8 @@ int BIO_write_ex(BIO *b, const void *data, size_t dlen, size_t *written)
 }
 
 int BIO_sendmmsg(BIO *b, BIO_MSG *msg,
-                 size_t stride, size_t num_msg, uint64_t flags,
-                 size_t *msgs_processed)
+    size_t stride, size_t num_msg, uint64_t flags,
+    size_t *msgs_processed)
 {
     size_t ret;
     BIO_MMSG_CB_ARGS args;
@@ -411,14 +407,14 @@ int BIO_sendmmsg(BIO *b, BIO_MSG *msg,
     }
 
     if (HAS_CALLBACK(b)) {
-        args.msg            = msg;
-        args.stride         = stride;
-        args.num_msg        = num_msg;
-        args.flags          = flags;
+        args.msg = msg;
+        args.stride = stride;
+        args.num_msg = num_msg;
+        args.flags = flags;
         args.msgs_processed = msgs_processed;
 
         ret = (size_t)bio_call_callback(b, BIO_CB_SENDMMSG, (void *)&args,
-                                        0, 0, 0, 1, NULL);
+            0, 0, 0, 1, NULL);
         if (ret <= 0)
             return 0;
     }
@@ -433,14 +429,14 @@ int BIO_sendmmsg(BIO *b, BIO_MSG *msg,
 
     if (HAS_CALLBACK(b))
         ret = (size_t)bio_call_callback(b, BIO_CB_SENDMMSG | BIO_CB_RETURN,
-                                        (void *)&args, ret, 0, 0, ret, NULL);
+            (void *)&args, ret, 0, 0, (long)ret, msgs_processed);
 
     return ret;
 }
 
 int BIO_recvmmsg(BIO *b, BIO_MSG *msg,
-                 size_t stride, size_t num_msg, uint64_t flags,
-                 size_t *msgs_processed)
+    size_t stride, size_t num_msg, uint64_t flags,
+    size_t *msgs_processed)
 {
     size_t ret;
     BIO_MMSG_CB_ARGS args;
@@ -458,14 +454,14 @@ int BIO_recvmmsg(BIO *b, BIO_MSG *msg,
     }
 
     if (HAS_CALLBACK(b)) {
-        args.msg            = msg;
-        args.stride         = stride;
-        args.num_msg        = num_msg;
-        args.flags          = flags;
+        args.msg = msg;
+        args.stride = stride;
+        args.num_msg = num_msg;
+        args.flags = flags;
         args.msgs_processed = msgs_processed;
 
         ret = bio_call_callback(b, BIO_CB_RECVMMSG, (void *)&args,
-                                0, 0, 0, 1, NULL);
+            0, 0, 0, 1, NULL);
         if (ret <= 0)
             return 0;
     }
@@ -480,7 +476,7 @@ int BIO_recvmmsg(BIO *b, BIO_MSG *msg,
 
     if (HAS_CALLBACK(b))
         ret = (size_t)bio_call_callback(b, BIO_CB_RECVMMSG | BIO_CB_RETURN,
-                                        (void *)&args, ret, 0, 0, ret, NULL);
+            (void *)&args, ret, 0, 0, (long)ret, msgs_processed);
 
     return ret;
 }
@@ -530,7 +526,7 @@ int BIO_puts(BIO *b, const char *buf)
 
     if (HAS_CALLBACK(b))
         ret = (int)bio_call_callback(b, BIO_CB_PUTS | BIO_CB_RETURN, buf, 0, 0,
-                                     0L, ret, &written);
+            0L, ret, &written);
 
     if (ret > 0) {
         if (written > INT_MAX) {
@@ -583,7 +579,7 @@ int BIO_gets(BIO *b, char *buf, int size)
 
     if (HAS_CALLBACK(b))
         ret = (int)bio_call_callback(b, BIO_CB_GETS | BIO_CB_RETURN, buf, size,
-                                     0, 0L, ret, &readbytes);
+            0, 0L, ret, &readbytes);
 
     if (ret > 0) {
         /* Shouldn't happen */
@@ -678,7 +674,7 @@ long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
 
     if (HAS_CALLBACK(b))
         ret = bio_call_callback(b, BIO_CB_CTRL | BIO_CB_RETURN, parg, 0, cmd,
-                                larg, ret, NULL);
+            larg, ret, NULL);
 
     return ret;
 }
@@ -690,14 +686,14 @@ long BIO_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)
     if (b == NULL)
         return -2;
     if (b->method == NULL || b->method->callback_ctrl == NULL
-            || cmd != BIO_CTRL_SET_CALLBACK) {
+        || cmd != BIO_CTRL_SET_CALLBACK) {
         ERR_raise(ERR_LIB_BIO, BIO_R_UNSUPPORTED_METHOD);
         return -2;
     }
 
     if (HAS_CALLBACK(b)) {
         ret = bio_call_callback(b, BIO_CB_CTRL, (void *)&fp, 0, cmd, 0, 1L,
-                                NULL);
+            NULL);
         if (ret <= 0)
             return ret;
     }
@@ -706,7 +702,7 @@ long BIO_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)
 
     if (HAS_CALLBACK(b))
         ret = bio_call_callback(b, BIO_CB_CTRL | BIO_CB_RETURN, (void *)&fp, 0,
-                                cmd, 0, ret, NULL);
+            cmd, 0, ret, NULL);
 
     return ret;
 }
@@ -888,7 +884,7 @@ BIO *BIO_dup_chain(BIO *in)
 
         /* copy app data */
         if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_BIO, &new_bio->ex_data,
-                                &bio->ex_data)) {
+                &bio->ex_data)) {
             BIO_free(new_bio);
             goto err;
         }
@@ -902,7 +898,7 @@ BIO *BIO_dup_chain(BIO *in)
         }
     }
     return ret;
- err:
+err:
     BIO_free_all(ret);
 
     return NULL;
@@ -1004,7 +1000,7 @@ int BIO_wait(BIO *bio, time_t max_time, unsigned int nap_milliseconds)
 
     if (rv <= 0)
         ERR_raise(ERR_LIB_BIO,
-                  rv == 0 ? BIO_R_TRANSFER_TIMEOUT : BIO_R_TRANSFER_ERROR);
+            rv == 0 ? BIO_R_TRANSFER_TIMEOUT : BIO_R_TRANSFER_ERROR);
     return rv;
 }
 
@@ -1031,7 +1027,7 @@ int BIO_do_connect_retry(BIO *bio, int timeout, int nap_milliseconds)
         nap_milliseconds = 100;
     BIO_set_nbio(bio, !blocking);
 
- retry:
+retry:
     ERR_set_mark();
     rv = BIO_do_connect(bio);
 
@@ -1066,7 +1062,7 @@ int BIO_do_connect_retry(BIO *bio, int timeout, int nap_milliseconds)
             if (rv > 0)
                 goto retry;
             ERR_raise(ERR_LIB_BIO,
-                      rv == 0 ? BIO_R_CONNECT_TIMEOUT : BIO_R_CONNECT_ERROR);
+                rv == 0 ? BIO_R_CONNECT_TIMEOUT : BIO_R_CONNECT_ERROR);
         } else {
             ERR_clear_last_mark();
             rv = -1;
diff --git a/crypto/openssl/crypto/bio/bio_local.h b/crypto/openssl/crypto/bio/bio_local.h
index 05954f85bb2f..60fb944928c0 100644
--- a/crypto/openssl/crypto/bio/bio_local.h
+++ b/crypto/openssl/crypto/bio/bio_local.h
@@ -27,14 +27,14 @@
  * For clarity, we check for internal/cryptlib.h since it's a common header
  * that also includes bio.h.
  */
-# ifdef OSSL_INTERNAL_CRYPTLIB_H
-#  error internal/cryptlib.h included before bio_local.h
-# endif
-# ifdef OPENSSL_BIO_H
-#  error openssl/bio.h included before bio_local.h
-# endif
+#ifdef OSSL_INTERNAL_CRYPTLIB_H
+#error internal/cryptlib.h included before bio_local.h
+#endif
+#ifdef OPENSSL_BIO_H
+#error openssl/bio.h included before bio_local.h
+#endif
 
-# ifdef AI_PASSIVE
+#ifdef AI_PASSIVE
 
 /*
  * There's a bug in VMS C header file netdb.h, where struct addrinfo
@@ -43,18 +43,18 @@
  * size.  The easiest workaround is to force struct addrinfo to be the
  * 64-bit variant when compiling in P64 mode.
  */
-#  if defined(OPENSSL_SYS_VMS) && __INITIAL_POINTER_SIZE == 64
-#   define addrinfo __addrinfo64
-#  endif
+#if defined(OPENSSL_SYS_VMS) && __INITIAL_POINTER_SIZE == 64
+#define addrinfo __addrinfo64
+#endif
 
-#  define bio_addrinfo_st addrinfo
-#  define bai_family      ai_family
-#  define bai_socktype    ai_socktype
-#  define bai_protocol    ai_protocol
-#  define bai_addrlen     ai_addrlen
-#  define bai_addr        ai_addr
-#  define bai_next        ai_next
-# else
+#define bio_addrinfo_st addrinfo
+#define bai_family ai_family
+#define bai_socktype ai_socktype
+#define bai_protocol ai_protocol
+#define bai_addrlen ai_addrlen
+#define bai_addr ai_addr
+#define bai_next ai_next
+#else
 struct bio_addrinfo_st {
     int bai_family;
     int bai_socktype;
@@ -63,7 +63,7 @@ struct bio_addrinfo_st {
     struct sockaddr *bai_addr;
     struct bio_addrinfo_st *bai_next;
 };
-# endif
+#endif
 #endif
 
 /* END BIO_ADDRINFO/BIO_ADDR stuff. */
@@ -82,17 +82,17 @@ typedef struct bio_f_buffer_ctx_struct {
      * +---------------------------------------------------+
      * <-- off --><------- len ------->
      */
-    /*- BIO *bio; *//*
-     * this is now in the BIO struct
-     */
-    int ibuf_size;              /* how big is the input buffer */
-    int obuf_size;              /* how big is the output buffer */
-    char *ibuf;                 /* the char array */
-    int ibuf_len;               /* how many bytes are in it */
-    int ibuf_off;               /* write/read offset */
-    char *obuf;                 /* the char array */
-    int obuf_len;               /* how many bytes are in it */
-    int obuf_off;               /* write/read offset */
+    /*- BIO *bio; */ /*
+                      * this is now in the BIO struct
+                      */
+    int ibuf_size; /* how big is the input buffer */
+    int obuf_size; /* how big is the output buffer */
+    char *ibuf; /* the char array */
+    int ibuf_len; /* how many bytes are in it */
+    int ibuf_off; /* write/read offset */
+    char *obuf; /* the char array */
+    int obuf_len; /* how many bytes are in it */
+    int obuf_off; /* write/read offset */
 } BIO_F_BUFFER_CTX;
 
 struct bio_st {
@@ -103,15 +103,15 @@ struct bio_st {
     BIO_callback_fn callback;
 #endif
     BIO_callback_fn_ex callback_ex;
-    char *cb_arg;               /* first argument for the callback */
+    char *cb_arg; /* first argument for the callback */
     int init;
     int shutdown;
-    int flags;                  /* extra storage */
+    int flags; /* extra storage */
     int retry_reason;
     int num;
     void *ptr;
-    struct bio_st *next_bio;    /* used by filter BIOs */
-    struct bio_st *prev_bio;    /* used by filter BIOs */
+    struct bio_st *next_bio; /* used by filter BIOs */
+    struct bio_st *prev_bio; /* used by filter BIOs */
     CRYPTO_REF_COUNT references;
     uint64_t num_read;
     uint64_t num_write;
@@ -119,9 +119,9 @@ struct bio_st {
 };
 
 #ifndef OPENSSL_NO_SOCK
-# ifdef OPENSSL_SYS_VMS
+#ifdef OPENSSL_SYS_VMS
 typedef unsigned int socklen_t;
-# endif
+#endif
 
 extern CRYPTO_RWLOCK *bio_lookup_lock;
 
@@ -132,50 +132,49 @@ socklen_t BIO_ADDR_sockaddr_size(const BIO_ADDR *ap);
 socklen_t BIO_ADDRINFO_sockaddr_size(const BIO_ADDRINFO *bai);
 const struct sockaddr *BIO_ADDRINFO_sockaddr(const BIO_ADDRINFO *bai);
 
-# if defined(OPENSSL_SYS_WINDOWS) && defined(WSAID_WSARECVMSG)
-#  define BIO_HAVE_WSAMSG
+#if defined(OPENSSL_SYS_WINDOWS) && defined(WSAID_WSARECVMSG)
+#define BIO_HAVE_WSAMSG
 extern LPFN_WSARECVMSG bio_WSARecvMsg;
 extern LPFN_WSASENDMSG bio_WSASendMsg;
-# endif
+#endif
 #endif
 
 extern CRYPTO_REF_COUNT bio_type_count;
 
 void bio_sock_cleanup_int(void);
 
-#if BIO_FLAGS_UPLINK_INTERNAL==0
+#if BIO_FLAGS_UPLINK_INTERNAL == 0
 /* Shortcut UPLINK calls on most platforms... */
-# define UP_stdin        stdin
-# define UP_stdout       stdout
-# define UP_stderr       stderr
-# define UP_fprintf      fprintf
-# define UP_fgets        fgets
-# define UP_fread        fread
-# define UP_fwrite       fwrite
-# undef  UP_fsetmod
-# define UP_feof         feof
-# define UP_fclose       fclose
-
-# define UP_fopen        fopen
-# define UP_fseek        fseek
-# define UP_ftell        ftell
-# define UP_fflush       fflush
-# define UP_ferror       ferror
-# ifdef _WIN32
-#  define UP_fileno       _fileno
-#  define UP_open         _open
-#  define UP_read         _read
-#  define UP_write        _write
-#  define UP_lseek        _lseek
-#  define UP_close        _close
-# else
-#  define UP_fileno       fileno
-#  define UP_open         open
-#  define UP_read         read
-#  define UP_write        write
-#  define UP_lseek        lseek
-#  define UP_close        close
-# endif
+#define UP_stdin stdin
+#define UP_stdout stdout
+#define UP_stderr stderr
+#define UP_fprintf fprintf
+#define UP_fgets fgets
+#define UP_fread fread
+#define UP_fwrite fwrite
+#undef UP_fsetmod
+#define UP_feof feof
+#define UP_fclose fclose
 
+#define UP_fopen fopen
+#define UP_fseek fseek
+#define UP_ftell ftell
+#define UP_fflush fflush
+#define UP_ferror ferror
+#ifdef _WIN32
+#define UP_fileno _fileno
+#define UP_open _open
+#define UP_read _read
+#define UP_write _write
+#define UP_lseek _lseek
+#define UP_close _close
+#else
+#define UP_fileno fileno
+#define UP_open open
+#define UP_read read
+#define UP_write write
+#define UP_lseek lseek
+#define UP_close close
 #endif
 
+#endif
diff --git a/crypto/openssl/crypto/bio/bio_meth.c b/crypto/openssl/crypto/bio/bio_meth.c
index b665929b5fef..0cab60491e77 100644
--- a/crypto/openssl/crypto/bio/bio_meth.c
+++ b/crypto/openssl/crypto/bio/bio_meth.c
@@ -39,7 +39,7 @@ BIO_METHOD *BIO_meth_new(int type, const char *name)
     BIO_METHOD *biom = OPENSSL_zalloc(sizeof(BIO_METHOD));
 
     if (biom == NULL
-            || (biom->name = OPENSSL_strdup(name)) == NULL) {
+        || (biom->name = OPENSSL_strdup(name)) == NULL) {
         OPENSSL_free(biom);
         return NULL;
     }
@@ -56,13 +56,13 @@ void BIO_meth_free(BIO_METHOD *biom)
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-int (*BIO_meth_get_write(const BIO_METHOD *biom)) (BIO *, const char *, int)
+int (*BIO_meth_get_write(const BIO_METHOD *biom))(BIO *, const char *, int)
 {
     return biom->bwrite_old;
 }
 
-int (*BIO_meth_get_write_ex(const BIO_METHOD *biom)) (BIO *, const char *, size_t,
-                                                size_t *)
+int (*BIO_meth_get_write_ex(const BIO_METHOD *biom))(BIO *, const char *, size_t,
+    size_t *)
 {
     return biom->bwrite;
 }
@@ -89,7 +89,7 @@ int bwrite_conv(BIO *bio, const char *data, size_t datal, size_t *written)
 }
 
 int BIO_meth_set_write(BIO_METHOD *biom,
-                       int (*bwrite) (BIO *, const char *, int))
+    int (*bwrite)(BIO *, const char *, int))
 {
     biom->bwrite_old = bwrite;
     biom->bwrite = bwrite_conv;
@@ -97,7 +97,7 @@ int BIO_meth_set_write(BIO_METHOD *biom,
 }
 
 int BIO_meth_set_write_ex(BIO_METHOD *biom,
-                       int (*bwrite) (BIO *, const char *, size_t, size_t *))
+    int (*bwrite)(BIO *, const char *, size_t, size_t *))
 {
     biom->bwrite_old = NULL;
     biom->bwrite = bwrite;
@@ -105,12 +105,12 @@ int BIO_meth_set_write_ex(BIO_METHOD *biom,
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-int (*BIO_meth_get_read(const BIO_METHOD *biom)) (BIO *, char *, int)
+int (*BIO_meth_get_read(const BIO_METHOD *biom))(BIO *, char *, int)
 {
     return biom->bread_old;
 }
 
-int (*BIO_meth_get_read_ex(const BIO_METHOD *biom)) (BIO *, char *, size_t, size_t *)
+int (*BIO_meth_get_read_ex(const BIO_METHOD *biom))(BIO *, char *, size_t, size_t *)
 {
     return biom->bread;
 }
@@ -137,7 +137,7 @@ int bread_conv(BIO *bio, char *data, size_t datal, size_t *readbytes)
 }
 
 int BIO_meth_set_read(BIO_METHOD *biom,
-                      int (*bread) (BIO *, char *, int))
+    int (*bread)(BIO *, char *, int))
 {
     biom->bread_old = bread;
     biom->bread = bread_conv;
@@ -145,7 +145,7 @@ int BIO_meth_set_read(BIO_METHOD *biom,
 }
 
 int BIO_meth_set_read_ex(BIO_METHOD *biom,
-                         int (*bread) (BIO *, char *, size_t, size_t *))
+    int (*bread)(BIO *, char *, size_t, size_t *))
 {
     biom->bread_old = NULL;
     biom->bread = bread;
@@ -153,110 +153,112 @@ int BIO_meth_set_read_ex(BIO_METHOD *biom,
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-int (*BIO_meth_get_puts(const BIO_METHOD *biom)) (BIO *, const char *)
+int (*BIO_meth_get_puts(const BIO_METHOD *biom))(BIO *, const char *)
 {
     return biom->bputs;
 }
 #endif
 
 int BIO_meth_set_puts(BIO_METHOD *biom,
-                      int (*bputs) (BIO *, const char *))
+    int (*bputs)(BIO *, const char *))
 {
     biom->bputs = bputs;
     return 1;
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-int (*BIO_meth_get_gets(const BIO_METHOD *biom)) (BIO *, char *, int)
+int (*BIO_meth_get_gets(const BIO_METHOD *biom))(BIO *, char *, int)
 {
     return biom->bgets;
 }
 #endif
 
 int BIO_meth_set_gets(BIO_METHOD *biom,
-                      int (*bgets) (BIO *, char *, int))
+    int (*bgets)(BIO *, char *, int))
 {
     biom->bgets = bgets;
     return 1;
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-long (*BIO_meth_get_ctrl(const BIO_METHOD *biom)) (BIO *, int, long, void *)
+long (*BIO_meth_get_ctrl(const BIO_METHOD *biom))(BIO *, int, long, void *)
 {
     return biom->ctrl;
 }
 #endif
 
 int BIO_meth_set_ctrl(BIO_METHOD *biom,
-                      long (*ctrl) (BIO *, int, long, void *))
+    long (*ctrl)(BIO *, int, long, void *))
 {
     biom->ctrl = ctrl;
     return 1;
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-int (*BIO_meth_get_create(const BIO_METHOD *biom)) (BIO *)
+int (*BIO_meth_get_create(const BIO_METHOD *biom))(BIO *)
 {
     return biom->create;
 }
 #endif
 
-int BIO_meth_set_create(BIO_METHOD *biom, int (*create) (BIO *))
+int BIO_meth_set_create(BIO_METHOD *biom, int (*create)(BIO *))
 {
     biom->create = create;
     return 1;
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-int (*BIO_meth_get_destroy(const BIO_METHOD *biom)) (BIO *)
+int (*BIO_meth_get_destroy(const BIO_METHOD *biom))(BIO *)
 {
     return biom->destroy;
 }
 #endif
 
-int BIO_meth_set_destroy(BIO_METHOD *biom, int (*destroy) (BIO *))
+int BIO_meth_set_destroy(BIO_METHOD *biom, int (*destroy)(BIO *))
 {
     biom->destroy = destroy;
     return 1;
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-long (*BIO_meth_get_callback_ctrl(const BIO_METHOD *biom)) (BIO *, int, BIO_info_cb *)
+long (*BIO_meth_get_callback_ctrl(const BIO_METHOD *biom))(BIO *, int, BIO_info_cb *)
 {
     return biom->callback_ctrl;
 }
 #endif
 
 int BIO_meth_set_callback_ctrl(BIO_METHOD *biom,
-                               long (*callback_ctrl) (BIO *, int,
-                                                      BIO_info_cb *))
+    long (*callback_ctrl)(BIO *, int,
+        BIO_info_cb *))
 {
     biom->callback_ctrl = callback_ctrl;
     return 1;
 }
 
 int BIO_meth_set_sendmmsg(BIO_METHOD *biom,
-                          int (*bsendmmsg) (BIO *, BIO_MSG *, size_t, size_t, uint64_t, size_t *))
+    int (*bsendmmsg)(BIO *, BIO_MSG *, size_t, size_t, uint64_t, size_t *))
 {
     biom->bsendmmsg = bsendmmsg;
     return 1;
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-int (*BIO_meth_get_sendmmsg(const BIO_METHOD *biom))(BIO *, BIO_MSG *, size_t, size_t, uint64_t, size_t *) {
+int (*BIO_meth_get_sendmmsg(const BIO_METHOD *biom))(BIO *, BIO_MSG *, size_t, size_t, uint64_t, size_t *)
+{
     return biom->bsendmmsg;
 }
 #endif
 
 int BIO_meth_set_recvmmsg(BIO_METHOD *biom,
-                          int (*brecvmmsg) (BIO *, BIO_MSG *, size_t, size_t, uint64_t, size_t *))
+    int (*brecvmmsg)(BIO *, BIO_MSG *, size_t, size_t, uint64_t, size_t *))
 {
     biom->brecvmmsg = brecvmmsg;
     return 1;
 }
 
 #ifndef OPENSSL_NO_DEPRECATED_3_5
-int (*BIO_meth_get_recvmmsg(const BIO_METHOD *biom))(BIO *, BIO_MSG *, size_t, size_t, uint64_t, size_t *) {
+int (*BIO_meth_get_recvmmsg(const BIO_METHOD *biom))(BIO *, BIO_MSG *, size_t, size_t, uint64_t, size_t *)
+{
     return biom->brecvmmsg;
 }
 #endif
diff --git a/crypto/openssl/crypto/bio/bio_print.c b/crypto/openssl/crypto/bio/bio_print.c
index 55fb4877b4c5..b04496a10ba6 100644
--- a/crypto/openssl/crypto/bio/bio_print.c
+++ b/crypto/openssl/crypto/bio/bio_print.c
@@ -23,71 +23,71 @@
  */
 
 #ifdef HAVE_LONG_DOUBLE
-# define LDOUBLE long double
+#define LDOUBLE long double
 #else
-# define LDOUBLE double
+#define LDOUBLE double
 #endif
 
 static int fmtstr(char **, char **, size_t *, size_t *,
-                  const char *, int, int, int);
+    const char *, int, int, int);
 static int fmtint(char **, char **, size_t *, size_t *,
-                  int64_t, int, int, int, int);
+    int64_t, int, int, int, int);
 #ifndef OPENSSL_SYS_UEFI
 static int fmtfp(char **, char **, size_t *, size_t *,
-                 LDOUBLE, int, int, int, int);
+    LDOUBLE, int, int, int, int);
 #endif
 static int doapr_outch(char **, char **, size_t *, size_t *, int);
 static int _dopr(char **sbuffer, char **buffer,
-                 size_t *maxlen, size_t *retlen, int *truncated,
-                 const char *format, va_list args);
+    size_t *maxlen, size_t *retlen, int *truncated,
+    const char *format, va_list args);
 
 /* format read states */
-#define DP_S_DEFAULT    0
-#define DP_S_FLAGS      1
-#define DP_S_MIN        2
-#define DP_S_DOT        3
-#define DP_S_MAX        4
-#define DP_S_MOD        5
-#define DP_S_CONV       6
-#define DP_S_DONE       7
+#define DP_S_DEFAULT 0
+#define DP_S_FLAGS 1
+#define DP_S_MIN 2
+#define DP_S_DOT 3
+#define DP_S_MAX 4
+#define DP_S_MOD 5
+#define DP_S_CONV 6
+#define DP_S_DONE 7
 
 /* format flags - Bits */
 /* left-aligned padding */
-#define DP_F_MINUS      (1 << 0)
+#define DP_F_MINUS (1 << 0)
 /* print an explicit '+' for a value with positive sign */
-#define DP_F_PLUS       (1 << 1)
+#define DP_F_PLUS (1 << 1)
 /* print an explicit ' ' for a value with positive sign */
-#define DP_F_SPACE      (1 << 2)
+#define DP_F_SPACE (1 << 2)
 /* print 0/0x prefix for octal/hex and decimal point for floating point */
-#define DP_F_NUM        (1 << 3)
+#define DP_F_NUM (1 << 3)
 /* print leading zeroes */
-#define DP_F_ZERO       (1 << 4)
+#define DP_F_ZERO (1 << 4)
 /* print HEX in UPPERcase */
-#define DP_F_UP         (1 << 5)
+#define DP_F_UP (1 << 5)
 /* treat value as unsigned */
-#define DP_F_UNSIGNED   (1 << 6)
+#define DP_F_UNSIGNED (1 << 6)
 
 /* conversion flags */
-#define DP_C_SHORT      1
-#define DP_C_LONG       2
-#define DP_C_LDOUBLE    3
-#define DP_C_LLONG      4
-#define DP_C_SIZE       5
+#define DP_C_SHORT 1
+#define DP_C_LONG 2
+#define DP_C_LDOUBLE 3
+#define DP_C_LLONG 4
+#define DP_C_SIZE 5
 
 /* Floating point formats */
-#define F_FORMAT        0
-#define E_FORMAT        1
-#define G_FORMAT        2
+#define F_FORMAT 0
+#define E_FORMAT 1
+#define G_FORMAT 2
 
 /* some handy macros */
 #define char_to_int(p) (p - '0')
-#define OSSL_MAX(p,q) ((p >= q) ? p : q)
+#define OSSL_MAX(p, q) ((p >= q) ? p : q)
 
 static int
 _dopr(char **sbuffer,
-      char **buffer,
-      size_t *maxlen,
-      size_t *retlen, int *truncated, const char *format, va_list args)
+    char **buffer,
+    size_t *maxlen,
+    size_t *retlen, int *truncated, const char *format, va_list args)
 {
     char ch;
     int64_t value;
@@ -115,9 +115,8 @@ _dopr(char **sbuffer,
         case DP_S_DEFAULT:
             if (ch == '%')
                 state = DP_S_FLAGS;
-            else
-                if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
-                    return 0;
+            else if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
+                return 0;
             ch = *format++;
             break;
         case DP_S_FLAGS:
@@ -232,7 +231,7 @@ _dopr(char **sbuffer,
                     break;
                 }
                 if (!fmtint(sbuffer, buffer, &currlen, maxlen, value, 10, min,
-                            max, flags))
+                        max, flags))
                     return 0;
                 break;
             case 'X':
@@ -260,8 +259,8 @@ _dopr(char **sbuffer,
                     break;
                 }
                 if (!fmtint(sbuffer, buffer, &currlen, maxlen, value,
-                            ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),
-                            min, max, flags))
+                        ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),
+                        min, max, flags))
                     return 0;
                 break;
 #ifndef OPENSSL_SYS_UEFI
@@ -271,7 +270,7 @@ _dopr(char **sbuffer,
                 else
                     fvalue = va_arg(args, double);
                 if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,
-                           flags, F_FORMAT))
+                        flags, F_FORMAT))
                     return 0;
                 break;
             case 'E':
@@ -283,7 +282,7 @@ _dopr(char **sbuffer,
                 else
                     fvalue = va_arg(args, double);
                 if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,
-                           flags, E_FORMAT))
+                        flags, E_FORMAT))
                     return 0;
                 break;
             case 'G':
@@ -295,7 +294,7 @@ _dopr(char **sbuffer,
                 else
                     fvalue = va_arg(args, double);
                 if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,
-                           flags, G_FORMAT))
+                        flags, G_FORMAT))
                     return 0;
                 break;
 #else
@@ -310,7 +309,7 @@ _dopr(char **sbuffer,
 #endif
             case 'c':
                 if (!doapr_outch(sbuffer, buffer, &currlen, maxlen,
-                                 va_arg(args, int)))
+                        va_arg(args, int)))
                     return 0;
                 break;
             case 's':
@@ -322,22 +321,20 @@ _dopr(char **sbuffer,
                         max = *maxlen;
                 }
                 if (!fmtstr(sbuffer, buffer, &currlen, maxlen, strvalue,
-                            flags, min, max))
+                        flags, min, max))
                     return 0;
                 break;
             case 'p':
                 value = (size_t)va_arg(args, void *);
                 if (!fmtint(sbuffer, buffer, &currlen, maxlen,
-                            value, 16, min, max, flags | DP_F_NUM))
+                        value, 16, min, max, flags | DP_F_NUM))
                     return 0;
                 break;
-            case 'n':
-                {
-                    int *num;
-                    num = va_arg(args, int *);
-                    *num = currlen;
-                }
-                break;
+            case 'n': {
+                int *num;
+                num = va_arg(args, int *);
+                *num = currlen;
+            } break;
             case '%':
                 if (!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
                     return 0;
@@ -378,9 +375,9 @@ _dopr(char **sbuffer,
 
 static int
 fmtstr(char **sbuffer,
-       char **buffer,
-       size_t *currlen,
-       size_t *maxlen, const char *value, int flags, int min, int max)
+    char **buffer,
+    size_t *currlen,
+    size_t *maxlen, const char *value, int flags, int min, int max)
 {
     int padlen;
     size_t strln;
@@ -430,9 +427,9 @@ fmtstr(char **sbuffer,
 
 static int
 fmtint(char **sbuffer,
-       char **buffer,
-       size_t *currlen,
-       size_t *maxlen, int64_t value, int base, int min, int max, int flags)
+    char **buffer,
+    size_t *currlen,
+    size_t *maxlen, int64_t value, int base, int min, int max, int flags)
 {
     int signvalue = 0;
     const char *prefix = "";
@@ -473,8 +470,7 @@ fmtint(char **sbuffer,
     convert[place] = 0;
 
     zpadlen = max - place;
-    spadlen =
-        min - OSSL_MAX(max, place) - (signvalue ? 1 : 0) - strlen(prefix);
+    spadlen = min - OSSL_MAX(max, place) - (signvalue ? 1 : 0) - strlen(prefix);
     if (zpadlen < 0)
         zpadlen = 0;
     if (spadlen < 0)
@@ -564,9 +560,9 @@ static long roundv(LDOUBLE value)
 
 static int
 fmtfp(char **sbuffer,
-      char **buffer,
-      size_t *currlen,
-      size_t *maxlen, LDOUBLE fvalue, int min, int max, int flags, int style)
+    char **buffer,
+    size_t *currlen,
+    size_t *maxlen, LDOUBLE fvalue, int min, int max, int flags, int style)
 {
     int signvalue = 0;
     LDOUBLE ufvalue;
@@ -609,7 +605,7 @@ fmtfp(char **sbuffer,
         } else if (ufvalue < 0.0001) {
             realstyle = E_FORMAT;
         } else if ((max == 0 && ufvalue >= 10)
-                   || (max > 0 && ufvalue >= pow_10(max))) {
+            || (max > 0 && ufvalue >= pow_10(max))) {
             realstyle = E_FORMAT;
         } else {
             realstyle = F_FORMAT;
@@ -790,7 +786,7 @@ fmtfp(char **sbuffer,
 
         while (fplace > 0) {
             if (!doapr_outch(sbuffer, buffer, currlen, maxlen,
-                             fconvert[--fplace]))
+                    fconvert[--fplace]))
                 return 0;
         }
     }
@@ -807,17 +803,17 @@ fmtfp(char **sbuffer,
         else
             ech = 'E';
         if (!doapr_outch(sbuffer, buffer, currlen, maxlen, ech))
-                return 0;
+            return 0;
         if (exp < 0) {
             if (!doapr_outch(sbuffer, buffer, currlen, maxlen, '-'))
-                    return 0;
+                return 0;
         } else {
             if (!doapr_outch(sbuffer, buffer, currlen, maxlen, '+'))
-                    return 0;
+                return 0;
         }
         while (eplace > 0) {
             if (!doapr_outch(sbuffer, buffer, currlen, maxlen,
-                             econvert[--eplace]))
+                    econvert[--eplace]))
                 return 0;
         }
     }
@@ -832,11 +828,11 @@ fmtfp(char **sbuffer,
 
 #endif /* OPENSSL_SYS_UEFI */
 
-#define BUFFER_INC  1024
+#define BUFFER_INC 1024
 
 static int
 doapr_outch(char **sbuffer,
-            char **buffer, size_t *currlen, size_t *maxlen, int c)
+    char **buffer, size_t *currlen, size_t *maxlen, int c)
 {
     /* If we haven't at least one buffer, someone has done a big booboo */
     if (!ossl_assert(*sbuffer != NULL || buffer != NULL))
@@ -899,9 +895,9 @@ int BIO_vprintf(BIO *bio, const char *format, va_list args)
 {
     int ret;
     size_t retlen;
-    char hugebuf[1024 * 2];     /* Was previously 10k, which is unreasonable
-                                 * in small-stack environments, like threads
-                                 * or DOS programs. */
+    char hugebuf[1024 * 2]; /* Was previously 10k, which is unreasonable
+                             * in small-stack environments, like threads
+                             * or DOS programs. */
     char *hugebufp = hugebuf;
     size_t hugebufsize = sizeof(hugebuf);
     char *dynbuf = NULL;
@@ -909,7 +905,7 @@ int BIO_vprintf(BIO *bio, const char *format, va_list args)
 
     dynbuf = NULL;
     if (!_dopr(&hugebufp, &dynbuf, &hugebufsize, &retlen, &ignored, format,
-                args)) {
+            args)) {
         OPENSSL_free(dynbuf);
         return -1;
     }
diff --git a/crypto/openssl/crypto/bio/bio_sock.c b/crypto/openssl/crypto/bio/bio_sock.c
index be1a74620f69..5b793b9af1d1 100644
--- a/crypto/openssl/crypto/bio/bio_sock.c
+++ b/crypto/openssl/crypto/bio/bio_sock.c
@@ -12,43 +12,43 @@
 #include "bio_local.h"
 
 #ifndef OPENSSL_NO_SOCK
-# define SOCKET_PROTOCOL IPPROTO_TCP
-# ifdef SO_MAXCONN
-#  define MAX_LISTEN  SO_MAXCONN
-# elif defined(SOMAXCONN)
-#  define MAX_LISTEN  SOMAXCONN
-# else
-#  define MAX_LISTEN  32
-# endif
-# if defined(OPENSSL_SYS_WINDOWS)
+#define SOCKET_PROTOCOL IPPROTO_TCP
+#ifdef SO_MAXCONN
+#define MAX_LISTEN SO_MAXCONN
+#elif defined(SOMAXCONN)
+#define MAX_LISTEN SOMAXCONN
+#else
+#define MAX_LISTEN 32
+#endif
+#if defined(OPENSSL_SYS_WINDOWS)
 static int wsa_init_done = 0;
-# endif
+#endif
 
-# if defined __TANDEM
-#  include <unistd.h>
-#  include <sys/time.h> /* select */
-# elif defined _WIN32
-#  include <winsock.h> /* for type fd_set */
-# else
-#  include <unistd.h>
-#  if defined __VMS
-#   include <sys/socket.h>
-#  elif defined _HPUX_SOURCE
-#   include <sys/time.h>
-#  else
-#   include <sys/select.h>
-#  endif
-# endif
-# include "internal/sockets.h" /* for openssl_fdset() */
+#if defined __TANDEM
+#include <unistd.h>
+#include <sys/time.h> /* select */
+#elif defined _WIN32
+#include <winsock.h> /* for type fd_set */
+#else
+#include <unistd.h>
+#if defined __VMS
+#include <sys/socket.h>
+#elif defined _HPUX_SOURCE
+#include <sys/time.h>
+#else
+#include <sys/select.h>
+#endif
+#endif
+#include "internal/sockets.h" /* for openssl_fdset() */
 
-# ifndef OPENSSL_NO_DEPRECATED_1_1_0
+#ifndef OPENSSL_NO_DEPRECATED_1_1_0
 int BIO_get_host_ip(const char *str, unsigned char *ip)
 {
     BIO_ADDRINFO *res = NULL;
     int ret = 0;
 
     if (BIO_sock_init() != 1)
-        return 0;               /* don't generate another error code here */
+        return 0; /* don't generate another error code here */
 
     if (BIO_lookup(str, NULL, BIO_LOOKUP_CLIENT, AF_INET, SOCK_STREAM, &res)) {
         size_t l;
@@ -82,7 +82,7 @@ int BIO_get_port(const char *str, unsigned short *port_ptr)
     }
 
     if (BIO_sock_init() != 1)
-        return 0;               /* don't generate another error code here */
+        return 0; /* don't generate another error code here */
 
     if (BIO_lookup(NULL, str, BIO_LOOKUP_CLIENT, AF_INET, SOCK_STREAM, &res)) {
         if (BIO_ADDRINFO_family(res) != AF_INET) {
@@ -98,7 +98,7 @@ int BIO_get_port(const char *str, unsigned short *port_ptr)
 
     return ret;
 }
-# endif
+#endif
 
 int BIO_sock_error(int sock)
 {
@@ -118,7 +118,7 @@ int BIO_sock_error(int sock)
         return j;
 }
 
-# ifndef OPENSSL_NO_DEPRECATED_1_1_0
+#ifndef OPENSSL_NO_DEPRECATED_1_1_0
 struct hostent *BIO_gethostbyname(const char *name)
 {
     /*
@@ -127,16 +127,16 @@ struct hostent *BIO_gethostbyname(const char *name)
      */
     return gethostbyname(name);
 }
-# endif
+#endif
 
-# ifdef BIO_HAVE_WSAMSG
+#ifdef BIO_HAVE_WSAMSG
 LPFN_WSARECVMSG bio_WSARecvMsg;
 LPFN_WSASENDMSG bio_WSASendMsg;
-# endif
+#endif
 
 int BIO_sock_init(void)
 {
-# ifdef OPENSSL_SYS_WINDOWS
+#ifdef OPENSSL_SYS_WINDOWS
     static struct WSAData wsa_state;
 
     if (!wsa_init_done) {
@@ -150,7 +150,7 @@ int BIO_sock_init(void)
          */
         if (WSAStartup(0x0202, &wsa_state) != 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling wsastartup()");
+                "calling wsastartup()");
             ERR_raise(ERR_LIB_BIO, BIO_R_WSASTARTUP);
             return -1;
         }
@@ -160,7 +160,7 @@ int BIO_sock_init(void)
          * Instead, their function pointers must be loaded via this elaborate
          * process...
          */
-#  ifdef BIO_HAVE_WSAMSG
+#ifdef BIO_HAVE_WSAMSG
         {
             GUID id_WSARecvMsg = WSAID_WSARECVMSG;
             GUID id_WSASendMsg = WSAID_WSASENDMSG;
@@ -170,53 +170,55 @@ int BIO_sock_init(void)
             s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
             if (s != INVALID_SOCKET) {
                 if (WSAIoctl(s, SIO_GET_EXTENSION_FUNCTION_POINTER,
-                             &id_WSARecvMsg, sizeof(id_WSARecvMsg),
-                             &bio_WSARecvMsg, sizeof(bio_WSARecvMsg),
-                             &len_out, NULL, NULL) != 0
+                        &id_WSARecvMsg, sizeof(id_WSARecvMsg),
+                        &bio_WSARecvMsg, sizeof(bio_WSARecvMsg),
+                        &len_out, NULL, NULL)
+                        != 0
                     || len_out != sizeof(bio_WSARecvMsg))
                     bio_WSARecvMsg = NULL;
 
                 if (WSAIoctl(s, SIO_GET_EXTENSION_FUNCTION_POINTER,
-                             &id_WSASendMsg, sizeof(id_WSASendMsg),
-                             &bio_WSASendMsg, sizeof(bio_WSASendMsg),
-                             &len_out, NULL, NULL) != 0
+                        &id_WSASendMsg, sizeof(id_WSASendMsg),
+                        &bio_WSASendMsg, sizeof(bio_WSASendMsg),
+                        &len_out, NULL, NULL)
+                        != 0
                     || len_out != sizeof(bio_WSASendMsg))
                     bio_WSASendMsg = NULL;
 
                 closesocket(s);
             }
         }
-#  endif
+#endif
     }
-# endif                         /* OPENSSL_SYS_WINDOWS */
-# ifdef WATT32
+#endif /* OPENSSL_SYS_WINDOWS */
+#ifdef WATT32
     extern int _watt_do_exit;
-    _watt_do_exit = 0;          /* don't make sock_init() call exit() */
+    _watt_do_exit = 0; /* don't make sock_init() call exit() */
     if (sock_init())
         return -1;
-# endif
+#endif
 
     return 1;
 }
 
 void bio_sock_cleanup_int(void)
 {
-# ifdef OPENSSL_SYS_WINDOWS
+#ifdef OPENSSL_SYS_WINDOWS
     if (wsa_init_done) {
         wsa_init_done = 0;
         WSACleanup();
     }
-# endif
+#endif
 }
 
 int BIO_socket_ioctl(int fd, long type, void *arg)
 {
     int i;
 
-#  ifdef __DJGPP__
+#ifdef __DJGPP__
     i = ioctlsocket(fd, type, (char *)arg);
-#  else
-#   if defined(OPENSSL_SYS_VMS)
+#else
+#if defined(OPENSSL_SYS_VMS)
     /*-
      * 2011-02-18 SMS.
      * VMS ioctl() can't tolerate a 64-bit "void *arg", but we
@@ -224,31 +226,31 @@ int BIO_socket_ioctl(int fd, long type, void *arg)
      * so we arrange a local copy with a short pointer, and use
      * that, instead.
      */
-#    if __INITIAL_POINTER_SIZE == 64
-#     define ARG arg_32p
-#     pragma pointer_size save
-#     pragma pointer_size 32
+#if __INITIAL_POINTER_SIZE == 64
+#define ARG arg_32p
+#pragma pointer_size save
+#pragma pointer_size 32
     unsigned long arg_32;
     unsigned long *arg_32p;
-#     pragma pointer_size restore
+#pragma pointer_size restore
     arg_32p = &arg_32;
     arg_32 = *((unsigned long *)arg);
-#    else                       /* __INITIAL_POINTER_SIZE == 64 */
-#     define ARG arg
-#    endif                      /* __INITIAL_POINTER_SIZE == 64 [else] */
-#   else                        /* defined(OPENSSL_SYS_VMS) */
-#    define ARG arg
-#   endif                       /* defined(OPENSSL_SYS_VMS) [else] */
+#else /* __INITIAL_POINTER_SIZE == 64 */
+#define ARG arg
+#endif /* __INITIAL_POINTER_SIZE == 64 [else] */
+#else /* defined(OPENSSL_SYS_VMS) */
+#define ARG arg
+#endif /* defined(OPENSSL_SYS_VMS) [else] */
 
     i = ioctlsocket(fd, type, ARG);
-#  endif                        /* __DJGPP__ */
+#endif /* __DJGPP__ */
     if (i < 0)
         ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                       "calling ioctlsocket()");
+            "calling ioctlsocket()");
     return i;
 }
 
-# ifndef OPENSSL_NO_DEPRECATED_1_1_0
+#ifndef OPENSSL_NO_DEPRECATED_1_1_0
 int BIO_get_accept_socket(char *host, int bind_mode)
 {
     int s = INVALID_SOCKET;
@@ -261,22 +263,23 @@ int BIO_get_accept_socket(char *host, int bind_mode)
     if (BIO_sock_init() != 1)
         goto err;
 
-    if (BIO_lookup(h, p, BIO_LOOKUP_SERVER, AF_UNSPEC, SOCK_STREAM, &res) != 0)
+    if (BIO_lookup(h, p, BIO_LOOKUP_SERVER, AF_UNSPEC, SOCK_STREAM, &res) == 0)
         goto err;
 
     if ((s = BIO_socket(BIO_ADDRINFO_family(res), BIO_ADDRINFO_socktype(res),
-                        BIO_ADDRINFO_protocol(res), 0)) == INVALID_SOCKET) {
+             BIO_ADDRINFO_protocol(res), 0))
+        == INVALID_SOCKET) {
         s = INVALID_SOCKET;
         goto err;
     }
 
     if (!BIO_listen(s, BIO_ADDRINFO_address(res),
-                    bind_mode ? BIO_SOCK_REUSEADDR : 0)) {
+            bind_mode ? BIO_SOCK_REUSEADDR : 0)) {
         BIO_closesocket(s);
         s = INVALID_SOCKET;
     }
 
- err:
+err:
     BIO_ADDRINFO_free(res);
     OPENSSL_free(h);
     OPENSSL_free(p);
@@ -296,7 +299,7 @@ int BIO_accept(int sock, char **ip_port)
             goto end;
         }
         ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                       "calling accept()");
+            "calling accept()");
         ERR_raise(ERR_LIB_BIO, BIO_R_ACCEPT_ERROR);
         goto end;
     }
@@ -323,27 +326,27 @@ int BIO_accept(int sock, char **ip_port)
         OPENSSL_free(port);
     }
 
- end:
+end:
     return ret;
 }
-# endif
+#endif
 
 int BIO_set_tcp_ndelay(int s, int on)
 {
     int ret = 0;
-# if defined(TCP_NODELAY) && (defined(IPPROTO_TCP) || defined(SOL_TCP))
+#if defined(TCP_NODELAY) && (defined(IPPROTO_TCP) || defined(SOL_TCP))
     int opt;
 
-#  ifdef SOL_TCP
+#ifdef SOL_TCP
     opt = SOL_TCP;
-#  else
-#   ifdef IPPROTO_TCP
+#else
+#ifdef IPPROTO_TCP
     opt = IPPROTO_TCP;
-#   endif
-#  endif
+#endif
+#endif
 
     ret = setsockopt(s, opt, TCP_NODELAY, (char *)&on, sizeof(on));
-# endif
+#endif
     return (ret == 0);
 }
 
@@ -353,69 +356,67 @@ int BIO_socket_nbio(int s, int mode)
     int l;
 
     l = mode;
-# ifdef FIONBIO
+#ifdef FIONBIO
     l = mode;
 
     ret = BIO_socket_ioctl(s, FIONBIO, &l);
-# elif defined(F_GETFL) && defined(F_SETFL) && (defined(O_NONBLOCK) || defined(FNDELAY))
+#elif defined(F_GETFL) && defined(F_SETFL) && (defined(O_NONBLOCK) || defined(FNDELAY))
     /* make sure this call always pushes an error level; BIO_socket_ioctl() does so, so we do too. */
 
     l = fcntl(s, F_GETFL, 0);
     if (l == -1) {
         ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
-                       "calling fcntl()");
+            "calling fcntl()");
         ret = -1;
     } else {
-#  if defined(O_NONBLOCK)
+#if defined(O_NONBLOCK)
         l &= ~O_NONBLOCK;
-#  else
+#else
         l &= ~FNDELAY; /* BSD4.x */
-#  endif
+#endif
         if (mode) {
-#  if defined(O_NONBLOCK)
+#if defined(O_NONBLOCK)
             l |= O_NONBLOCK;
-#  else
+#else
             l |= FNDELAY; /* BSD4.x */
-#  endif
+#endif
         }
         ret = fcntl(s, F_SETFL, l);
 
         if (ret < 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
-                           "calling fcntl()");
+                "calling fcntl()");
         }
     }
-# else
+#else
     /* make sure this call always pushes an error level; BIO_socket_ioctl() does so, so we do too. */
     ERR_raise(ERR_LIB_BIO, ERR_R_PASSED_INVALID_ARGUMENT);
-# endif
+#endif
 
     return (ret == 0);
 }
 
 int BIO_sock_info(int sock,
-                  enum BIO_sock_info_type type, union BIO_sock_info_u *info)
+    enum BIO_sock_info_type type, union BIO_sock_info_u *info)
 {
     switch (type) {
-    case BIO_SOCK_INFO_ADDRESS:
-        {
-            socklen_t addr_len;
-            int ret = 0;
-            addr_len = sizeof(*info->addr);
-            ret = getsockname(sock, BIO_ADDR_sockaddr_noconst(info->addr),
-                              &addr_len);
-            if (ret == -1) {
-                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling getsockname()");
-                ERR_raise(ERR_LIB_BIO, BIO_R_GETSOCKNAME_ERROR);
-                return 0;
-            }
-            if ((size_t)addr_len > sizeof(*info->addr)) {
-                ERR_raise(ERR_LIB_BIO, BIO_R_GETSOCKNAME_TRUNCATED_ADDRESS);
-                return 0;
-            }
+    case BIO_SOCK_INFO_ADDRESS: {
+        socklen_t addr_len;
+        int ret = 0;
+        addr_len = sizeof(*info->addr);
+        ret = getsockname(sock, BIO_ADDR_sockaddr_noconst(info->addr),
+            &addr_len);
+        if (ret == -1) {
+            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
+                "calling getsockname()");
+            ERR_raise(ERR_LIB_BIO, BIO_R_GETSOCKNAME_ERROR);
+            return 0;
+        }
+        if ((size_t)addr_len > sizeof(*info->addr)) {
+            ERR_raise(ERR_LIB_BIO, BIO_R_GETSOCKNAME_TRUNCATED_ADDRESS);
+            return 0;
         }
-        break;
+    } break;
     default:
         ERR_raise(ERR_LIB_BIO, BIO_R_UNKNOWN_INFO_TYPE);
         return 0;
@@ -430,16 +431,16 @@ int BIO_sock_info(int sock,
  */
 int BIO_socket_wait(int fd, int for_read, time_t max_time)
 {
-# if defined(OPENSSL_SYS_WINDOWS) || !defined(POLLIN)
+#if defined(OPENSSL_SYS_WINDOWS) || !defined(POLLIN)
     fd_set confds;
     struct timeval tv;
     time_t now;
 
-#  ifdef _WIN32
+#ifdef _WIN32
     if ((SOCKET)fd == INVALID_SOCKET)
-#  else
+#else
     if (fd < 0 || fd >= FD_SETSIZE)
-#  endif
+#endif
         return -1;
     if (max_time == 0)
         return 1;
@@ -453,8 +454,8 @@ int BIO_socket_wait(int fd, int for_read, time_t max_time)
     tv.tv_usec = 0;
     tv.tv_sec = (long)(max_time - now); /* might overflow */
     return select(fd + 1, for_read ? &confds : NULL,
-                  for_read ? NULL : &confds, NULL, &tv);
-# else
+        for_read ? NULL : &confds, NULL, &tv);
+#else
     struct pollfd confds;
     time_t now;
 
@@ -470,6 +471,6 @@ int BIO_socket_wait(int fd, int for_read, time_t max_time)
     confds.fd = fd;
     confds.events = for_read ? POLLIN : POLLOUT;
     return poll(&confds, 1, (int)(max_time - now) * 1000);
-# endif
+#endif
 }
 #endif /* !defined(OPENSSL_NO_SOCK) */
diff --git a/crypto/openssl/crypto/bio/bio_sock2.c b/crypto/openssl/crypto/bio/bio_sock2.c
index 74f807a36b82..3fb7d26e0d22 100644
--- a/crypto/openssl/crypto/bio/bio_sock2.c
+++ b/crypto/openssl/crypto/bio/bio_sock2.c
@@ -18,13 +18,13 @@
 #include <openssl/err.h>
 
 #ifndef OPENSSL_NO_SOCK
-# ifdef SO_MAXCONN
-#  define MAX_LISTEN  SO_MAXCONN
-# elif defined(SOMAXCONN)
-#  define MAX_LISTEN  SOMAXCONN
-# else
-#  define MAX_LISTEN  32
-# endif
+#ifdef SO_MAXCONN
+#define MAX_LISTEN SO_MAXCONN
+#elif defined(SOMAXCONN)
+#define MAX_LISTEN SOMAXCONN
+#else
+#define MAX_LISTEN 32
+#endif
 
 /*-
  * BIO_socket - create a socket
@@ -49,7 +49,7 @@ int BIO_socket(int domain, int socktype, int protocol, int options)
     sock = socket(domain, socktype, protocol);
     if (sock == -1) {
         ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                       "calling socket()");
+            "calling socket()");
         ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET);
         return INVALID_SOCKET;
     }
@@ -103,9 +103,10 @@ int BIO_connect(int sock, const BIO_ADDR *addr, int options)
 
     if (options & BIO_SOCK_KEEPALIVE) {
         if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
-                       (const void *)&on, sizeof(on)) != 0) {
+                (const void *)&on, sizeof(on))
+            != 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
+                "calling setsockopt()");
             ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
             return 0;
         }
@@ -113,16 +114,17 @@ int BIO_connect(int sock, const BIO_ADDR *addr, int options)
 
     if (options & BIO_SOCK_NODELAY) {
         if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
-                       (const void *)&on, sizeof(on)) != 0) {
+                (const void *)&on, sizeof(on))
+            != 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
+                "calling setsockopt()");
             ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
             return 0;
         }
     }
     if (options & BIO_SOCK_TFO) {
-# if defined(OSSL_TFO_CLIENT_FLAG)
-#  if defined(OSSL_TFO_SYSCTL_CLIENT)
+#if defined(OSSL_TFO_CLIENT_FLAG)
+#if defined(OSSL_TFO_SYSCTL_CLIENT)
         int enabled = 0;
         size_t enabledlen = sizeof(enabled);
 
@@ -136,7 +138,7 @@ int BIO_connect(int sock, const BIO_ADDR *addr, int options)
             ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
             return 0;
         }
-#  elif defined(OSSL_TFO_SYSCTL)
+#elif defined(OSSL_TFO_SYSCTL)
         int enabled = 0;
         size_t enabledlen = sizeof(enabled);
 
@@ -150,57 +152,51 @@ int BIO_connect(int sock, const BIO_ADDR *addr, int options)
             ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
             return 0;
         }
-#  endif
-# endif
-# if defined(OSSL_TFO_CONNECTX)
+#endif
+#endif
+#if defined(OSSL_TFO_CONNECTX)
         sa_endpoints_t sae;
 
         memset(&sae, 0, sizeof(sae));
         sae.sae_dstaddr = BIO_ADDR_sockaddr(addr);
         sae.sae_dstaddrlen = BIO_ADDR_sockaddr_size(addr);
         if (connectx(sock, &sae, SAE_ASSOCID_ANY,
-                     CONNECT_DATA_IDEMPOTENT | CONNECT_RESUME_ON_READ_WRITE,
-                     NULL, 0, NULL, NULL) == -1) {
+                CONNECT_DATA_IDEMPOTENT | CONNECT_RESUME_ON_READ_WRITE,
+                NULL, 0, NULL, NULL)
+            == -1) {
             if (!BIO_sock_should_retry(-1)) {
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling connectx()");
+                    "calling connectx()");
                 ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
             }
             return 0;
         }
-# endif
-# if defined(OSSL_TFO_CLIENT_SOCKOPT)
+#endif
+#if defined(OSSL_TFO_CLIENT_SOCKOPT)
         if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_CLIENT_SOCKOPT,
-                       (const void *)&on, sizeof(on)) != 0) {
+                (const void *)&on, sizeof(on))
+            != 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
+                "calling setsockopt()");
             ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
             return 0;
         }
-# endif
-# if defined(OSSL_TFO_DO_NOT_CONNECT)
+#endif
+#if defined(OSSL_TFO_DO_NOT_CONNECT)
         return 1;
-# endif
+#endif
     }
 
     if (connect(sock, BIO_ADDR_sockaddr(addr),
-                BIO_ADDR_sockaddr_size(addr)) == -1) {
+            BIO_ADDR_sockaddr_size(addr))
+        == -1) {
         if (!BIO_sock_should_retry(-1)) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling connect()");
+                "calling connect()");
             ERR_raise(ERR_LIB_BIO, BIO_R_CONNECT_ERROR);
         }
         return 0;
     }
-# ifndef OPENSSL_NO_KTLS
-    /*
-     * The new socket is created successfully regardless of ktls_enable.
-     * ktls_enable doesn't change any functionality of the socket, except
-     * changing the setsockopt to enable the processing of ktls_start.
-     * Thus, it is not a problem to call it for non-TLS sockets.
-     */
-    ktls_enable(sock);
-# endif
     return 1;
 }
 
@@ -222,34 +218,35 @@ int BIO_connect(int sock, const BIO_ADDR *addr, int options)
  */
 int BIO_bind(int sock, const BIO_ADDR *addr, int options)
 {
-# ifndef OPENSSL_SYS_WINDOWS
+#ifndef OPENSSL_SYS_WINDOWS
     int on = 1;
-# endif
+#endif
 
     if (sock == -1) {
         ERR_raise(ERR_LIB_BIO, BIO_R_INVALID_SOCKET);
         return 0;
     }
 
-# ifndef OPENSSL_SYS_WINDOWS
+#ifndef OPENSSL_SYS_WINDOWS
     /*
      * SO_REUSEADDR has different behavior on Windows than on
      * other operating systems, don't set it there.
      */
     if (options & BIO_SOCK_REUSEADDR) {
         if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
-                       (const void *)&on, sizeof(on)) != 0) {
+                (const void *)&on, sizeof(on))
+            != 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
+                "calling setsockopt()");
             ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_REUSEADDR);
             return 0;
         }
     }
-# endif
+#endif
 
     if (bind(sock, BIO_ADDR_sockaddr(addr), BIO_ADDR_sockaddr_size(addr)) != 0) {
         ERR_raise_data(ERR_LIB_SYS, get_last_socket_error() /* may be 0 */,
-                       "calling bind()");
+            "calling bind()");
         ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_BIND_SOCKET);
         return 0;
     }
@@ -307,10 +304,11 @@ int BIO_listen(int sock, const BIO_ADDR *addr, int options)
     }
 
     if (getsockopt(sock, SOL_SOCKET, SO_TYPE,
-                   (void *)&socktype, &socktype_len) != 0
+            (void *)&socktype, &socktype_len)
+            != 0
         || socktype_len != sizeof(socktype)) {
         ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                       "calling getsockopt()");
+            "calling getsockopt()");
         ERR_raise(ERR_LIB_BIO, BIO_R_GETTING_SOCKTYPE);
         return 0;
     }
@@ -320,9 +318,10 @@ int BIO_listen(int sock, const BIO_ADDR *addr, int options)
 
     if (options & BIO_SOCK_KEEPALIVE) {
         if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
-                       (const void *)&on, sizeof(on)) != 0) {
+                (const void *)&on, sizeof(on))
+            != 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
+                "calling setsockopt()");
             ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE);
             return 0;
         }
@@ -330,16 +329,17 @@ int BIO_listen(int sock, const BIO_ADDR *addr, int options)
 
     if (options & BIO_SOCK_NODELAY) {
         if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY,
-                       (const void *)&on, sizeof(on)) != 0) {
+                (const void *)&on, sizeof(on))
+            != 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
+                "calling setsockopt()");
             ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY);
             return 0;
         }
     }
 
-  /* On OpenBSD it is always IPv6 only with IPv6 sockets thus read-only */
-# if defined(IPV6_V6ONLY) && !defined(__OpenBSD__)
+    /* On OpenBSD it is always IPv6 only with IPv6 sockets thus read-only */
+#if defined(IPV6_V6ONLY) && !defined(__OpenBSD__)
     if (BIO_ADDR_family(addr) == AF_INET6) {
         /*
          * Note: Windows default of IPV6_V6ONLY is ON, and Linux is OFF.
@@ -347,34 +347,35 @@ int BIO_listen(int sock, const BIO_ADDR *addr, int options)
          */
         on = options & BIO_SOCK_V6_ONLY ? 1 : 0;
         if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY,
-                       (const void *)&on, sizeof(on)) != 0) {
+                (const void *)&on, sizeof(on))
+            != 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
+                "calling setsockopt()");
             ERR_raise(ERR_LIB_BIO, BIO_R_LISTEN_V6_ONLY);
             return 0;
         }
     }
-# endif
+#endif
 
     if (!BIO_bind(sock, addr, options))
         return 0;
 
     if (socktype != SOCK_DGRAM && listen(sock, MAX_LISTEN) == -1) {
         ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                       "calling listen()");
+            "calling listen()");
         ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_LISTEN_SOCKET);
         return 0;
     }
 
-# if defined(OSSL_TFO_SERVER_SOCKOPT)
+#if defined(OSSL_TFO_SERVER_SOCKOPT)
     /*
      * Must do it explicitly after listen() for macOS, still
      * works fine on other OS's
      */
     if ((options & BIO_SOCK_TFO) && socktype != SOCK_DGRAM) {
         int q = OSSL_TFO_SERVER_SOCKOPT_VALUE;
-#  if defined(OSSL_TFO_CLIENT_FLAG)
-#   if defined(OSSL_TFO_SYSCTL_SERVER)
+#if defined(OSSL_TFO_CLIENT_FLAG)
+#if defined(OSSL_TFO_SYSCTL_SERVER)
         int enabled = 0;
         size_t enabledlen = sizeof(enabled);
 
@@ -388,7 +389,7 @@ int BIO_listen(int sock, const BIO_ADDR *addr, int options)
             ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
             return 0;
         }
-#   elif defined(OSSL_TFO_SYSCTL)
+#elif defined(OSSL_TFO_SYSCTL)
         int enabled = 0;
         size_t enabledlen = sizeof(enabled);
 
@@ -402,17 +403,18 @@ int BIO_listen(int sock, const BIO_ADDR *addr, int options)
             ERR_raise(ERR_LIB_BIO, BIO_R_TFO_DISABLED);
             return 0;
         }
-#   endif
-#  endif
+#endif
+#endif
         if (setsockopt(sock, IPPROTO_TCP, OSSL_TFO_SERVER_SOCKOPT,
-                       (void *)&q, sizeof(q)) < 0) {
+                (void *)&q, sizeof(q))
+            < 0) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
+                "calling setsockopt()");
             ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_TFO);
             return 0;
         }
     }
-# endif
+#endif
 
     return 1;
 }
@@ -433,11 +435,11 @@ int BIO_accept_ex(int accept_sock, BIO_ADDR *addr_, int options)
 
     len = sizeof(*addr);
     accepted_sock = accept(accept_sock,
-                           BIO_ADDR_sockaddr_noconst(addr), &len);
+        BIO_ADDR_sockaddr_noconst(addr), &len);
     if (accepted_sock == -1) {
         if (!BIO_sock_should_retry(accepted_sock)) {
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling accept()");
+                "calling accept()");
             ERR_raise(ERR_LIB_BIO, BIO_R_ACCEPT_ERROR);
         }
         return INVALID_SOCKET;
diff --git a/crypto/openssl/crypto/bio/bss_acpt.c b/crypto/openssl/crypto/bio/bss_acpt.c
index 24423aa36f73..14bc36d2d875 100644
--- a/crypto/openssl/crypto/bio/bss_acpt.c
+++ b/crypto/openssl/crypto/bio/bss_acpt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -18,7 +18,7 @@
 typedef struct bio_accept_st {
     int state;
     int accept_family;
-    int bind_mode;     /* Socket mode for BIO_listen */
+    int bind_mode; /* Socket mode for BIO_listen */
     int accepted_mode; /* Socket mode for BIO_accept (set on accepted sock) */
     char *param_addr;
     char *param_serv;
@@ -27,7 +27,7 @@ typedef struct bio_accept_st {
 
     BIO_ADDRINFO *addr_first;
     const BIO_ADDRINFO *addr_iter;
-    BIO_ADDR cache_accepting_addr;   /* Useful if we asked for port 0 */
+    BIO_ADDR cache_accepting_addr; /* Useful if we asked for port 0 */
     char *cache_accepting_name, *cache_accepting_serv;
     BIO_ADDR cache_peer_addr;
     char *cache_peer_name, *cache_peer_serv;
@@ -46,12 +46,12 @@ static void acpt_close_socket(BIO *data);
 static BIO_ACCEPT *BIO_ACCEPT_new(void);
 static void BIO_ACCEPT_free(BIO_ACCEPT *a);
 
-# define ACPT_S_BEFORE                   1
-# define ACPT_S_GET_ADDR                 2
-# define ACPT_S_CREATE_SOCKET            3
-# define ACPT_S_LISTEN                   4
-# define ACPT_S_ACCEPT                   5
-# define ACPT_S_OK                       6
+#define ACPT_S_BEFORE 1
+#define ACPT_S_GET_ADDR 2
+#define ACPT_S_CREATE_SOCKET 3
+#define ACPT_S_LISTEN 4
+#define ACPT_S_ACCEPT 5
+#define ACPT_S_OK 6
 
 static const BIO_METHOD methods_acceptp = {
     BIO_TYPE_ACCEPT,
@@ -61,11 +61,11 @@ static const BIO_METHOD methods_acceptp = {
     bread_conv,
     acpt_read,
     acpt_puts,
-    NULL,                       /* connect_gets,         */
+    NULL, /* connect_gets,         */
     acpt_ctrl,
     acpt_new,
     acpt_free,
-    NULL,                       /* connect_callback_ctrl */
+    NULL, /* connect_callback_ctrl */
 };
 
 const BIO_METHOD *BIO_s_accept(void)
@@ -155,9 +155,9 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
         case ACPT_S_BEFORE:
             if (c->param_addr == NULL && c->param_serv == NULL) {
                 ERR_raise_data(ERR_LIB_BIO,
-                               BIO_R_NO_ACCEPT_ADDR_OR_SERVICE_SPECIFIED,
-                               "hostname=%s, service=%s",
-                               c->param_addr, c->param_serv);
+                    BIO_R_NO_ACCEPT_ADDR_OR_SERVICE_SPECIFIED,
+                    "hostname=%s, service=%s",
+                    c->param_addr, c->param_serv);
                 goto exit_loop;
             }
 
@@ -177,37 +177,37 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
             c->state = ACPT_S_GET_ADDR;
             break;
 
-        case ACPT_S_GET_ADDR:
-            {
-                int family = AF_UNSPEC;
-                switch (c->accept_family) {
-                case BIO_FAMILY_IPV6:
-                    if (1) { /* This is a trick we use to avoid bit rot.
-                              * at least the "else" part will always be
-                              * compiled.
-                              */
+        case ACPT_S_GET_ADDR: {
+            int family = AF_UNSPEC;
+            switch (c->accept_family) {
+            case BIO_FAMILY_IPV6:
+                if (1) { /* This is a trick we use to avoid bit rot.
+                          * at least the "else" part will always be
+                          * compiled.
+                          */
 #if OPENSSL_USE_IPV6
-                        family = AF_INET6;
-                    } else {
+                    family = AF_INET6;
+                } else {
 #endif
-                        ERR_raise(ERR_LIB_BIO, BIO_R_UNAVAILABLE_IP_FAMILY);
-                        goto exit_loop;
-                    }
-                    break;
-                case BIO_FAMILY_IPV4:
-                    family = AF_INET;
-                    break;
-                case BIO_FAMILY_IPANY:
-                    family = AF_UNSPEC;
-                    break;
-                default:
-                    ERR_raise(ERR_LIB_BIO, BIO_R_UNSUPPORTED_IP_FAMILY);
+                    ERR_raise(ERR_LIB_BIO, BIO_R_UNAVAILABLE_IP_FAMILY);
                     goto exit_loop;
                 }
-                if (BIO_lookup(c->param_addr, c->param_serv, BIO_LOOKUP_SERVER,
-                               family, SOCK_STREAM, &c->addr_first) == 0)
-                    goto exit_loop;
+                break;
+            case BIO_FAMILY_IPV4:
+                family = AF_INET;
+                break;
+            case BIO_FAMILY_IPANY:
+                family = AF_UNSPEC;
+                break;
+            default:
+                ERR_raise(ERR_LIB_BIO, BIO_R_UNSUPPORTED_IP_FAMILY);
+                goto exit_loop;
             }
+            if (BIO_lookup(c->param_addr, c->param_serv, BIO_LOOKUP_SERVER,
+                    family, SOCK_STREAM, &c->addr_first)
+                == 0)
+                goto exit_loop;
+        }
             if (c->addr_first == NULL) {
                 ERR_raise(ERR_LIB_BIO, BIO_R_LOOKUP_RETURNED_NOTHING);
                 goto exit_loop;
@@ -219,8 +219,8 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
         case ACPT_S_CREATE_SOCKET:
             ERR_set_mark();
             s = BIO_socket(BIO_ADDRINFO_family(c->addr_iter),
-                           BIO_ADDRINFO_socktype(c->addr_iter),
-                           BIO_ADDRINFO_protocol(c->addr_iter), 0);
+                BIO_ADDRINFO_socktype(c->addr_iter),
+                BIO_ADDRINFO_protocol(c->addr_iter), 0);
             if (s == (int)INVALID_SOCKET) {
                 if ((c->addr_iter = BIO_ADDRINFO_next(c->addr_iter)) != NULL) {
                     /*
@@ -231,8 +231,8 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
                 }
                 ERR_clear_last_mark();
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling socket(%s, %s)",
-                                c->param_addr, c->param_serv);
+                    "calling socket(%s, %s)",
+                    c->param_addr, c->param_serv);
                 ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET);
                 goto exit_loop;
             }
@@ -242,31 +242,35 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
             s = -1;
             break;
 
-        case ACPT_S_LISTEN:
-            {
-                if (!BIO_listen(c->accept_sock,
-                                BIO_ADDRINFO_address(c->addr_iter),
-                                c->bind_mode)) {
-                    BIO_closesocket(c->accept_sock);
-                    goto exit_loop;
-                }
+        case ACPT_S_LISTEN: {
+            if (!BIO_listen(c->accept_sock,
+                    BIO_ADDRINFO_address(c->addr_iter),
+                    c->bind_mode)) {
+                BIO_closesocket(c->accept_sock);
+                c->accept_sock = (int)INVALID_SOCKET;
+                b->num = (int)INVALID_SOCKET;
+                goto exit_loop;
             }
+        }
 
             {
                 union BIO_sock_info_u info;
 
                 info.addr = &c->cache_accepting_addr;
                 if (!BIO_sock_info(c->accept_sock, BIO_SOCK_INFO_ADDRESS,
-                                   &info)) {
+                        &info)) {
                     BIO_closesocket(c->accept_sock);
+                    c->accept_sock = (int)INVALID_SOCKET;
+                    b->num = (int)INVALID_SOCKET;
                     goto exit_loop;
                 }
             }
 
-            c->cache_accepting_name =
-                BIO_ADDR_hostname_string(&c->cache_accepting_addr, 1);
-            c->cache_accepting_serv =
-                BIO_ADDR_service_string(&c->cache_accepting_addr, 1);
+            /* Free old values before assigning new ones to prevent memory leak */
+            OPENSSL_free(c->cache_accepting_name);
+            OPENSSL_free(c->cache_accepting_serv);
+            c->cache_accepting_name = BIO_ADDR_hostname_string(&c->cache_accepting_addr, 1);
+            c->cache_accepting_serv = BIO_ADDR_service_string(&c->cache_accepting_addr, 1);
             c->state = ACPT_S_ACCEPT;
             s = -1;
             ret = 1;
@@ -286,7 +290,7 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
             c->cache_peer_serv = NULL;
 
             s = BIO_accept_ex(c->accept_sock, &c->cache_peer_addr,
-                              c->accepted_mode);
+                c->accepted_mode);
 
             /* If the returned socket is invalid, this might still be
              * retryable
@@ -328,10 +332,8 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
             if (BIO_push(b, bio) == NULL)
                 goto exit_loop;
 
-            c->cache_peer_name =
-                BIO_ADDR_hostname_string(&c->cache_peer_addr, 1);
-            c->cache_peer_serv =
-                BIO_ADDR_service_string(&c->cache_peer_addr, 1);
+            c->cache_peer_name = BIO_ADDR_hostname_string(&c->cache_peer_addr, 1);
+            c->cache_peer_serv = BIO_ADDR_service_string(&c->cache_peer_addr, 1);
             c->state = ACPT_S_OK;
             bio = NULL;
             ret = 1;
@@ -351,12 +353,12 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
         }
     }
 
-  exit_loop:
+exit_loop:
     if (bio != NULL)
         BIO_free(bio);
     else if (s >= 0)
         BIO_closesocket(s);
- end:
+end:
     return ret;
 }
 
@@ -414,6 +416,7 @@ static long acpt_ctrl(BIO *b, int cmd, long num, void *ptr)
         acpt_close_socket(b);
         BIO_ADDRINFO_free(data->addr_first);
         data->addr_first = NULL;
+        data->addr_iter = NULL;
         b->flags = 0;
         break;
     case BIO_C_DO_STATE_MACHINE:
@@ -431,12 +434,13 @@ static long acpt_ctrl(BIO *b, int cmd, long num, void *ptr)
                 OPENSSL_free(data->param_addr);
                 data->param_addr = NULL;
                 ret = BIO_parse_hostserv(ptr,
-                                         &data->param_addr,
-                                         &data->param_serv,
-                                         BIO_PARSE_PRIO_SERV);
+                    &data->param_addr,
+                    &data->param_serv,
+                    BIO_PARSE_PRIO_SERV);
                 if (hold_serv != data->param_serv)
                     OPENSSL_free(hold_serv);
-                b->init = 1;
+                if (ret > 0)
+                    b->init = 1;
             } else if (num == 1) {
                 OPENSSL_free(data->param_serv);
                 if ((data->param_serv = OPENSSL_strdup(ptr)) == NULL)
diff --git a/crypto/openssl/crypto/bio/bss_bio.c b/crypto/openssl/crypto/bio/bss_bio.c
index 3af3b27ea5ab..54de5d3f67cc 100644
--- a/crypto/openssl/crypto/bio/bss_bio.c
+++ b/crypto/openssl/crypto/bio/bss_bio.c
@@ -43,11 +43,11 @@ static const BIO_METHOD methods_biop = {
     bread_conv,
     bio_read,
     bio_puts,
-    NULL /* no bio_gets */ ,
+    NULL /* no bio_gets */,
     bio_ctrl,
     bio_new,
     bio_free,
-    NULL                        /* no bio_callback_ctrl */
+    NULL /* no bio_callback_ctrl */
 };
 
 const BIO_METHOD *BIO_s_bio(void)
@@ -56,21 +56,21 @@ const BIO_METHOD *BIO_s_bio(void)
 }
 
 struct bio_bio_st {
-    BIO *peer;                  /* NULL if buf == NULL. If peer != NULL, then
-                                 * peer->ptr is also a bio_bio_st, and its
-                                 * "peer" member points back to us. peer !=
-                                 * NULL iff init != 0 in the BIO. */
+    BIO *peer; /* NULL if buf == NULL. If peer != NULL, then
+                * peer->ptr is also a bio_bio_st, and its
+                * "peer" member points back to us. peer !=
+                * NULL iff init != 0 in the BIO. */
     /* This is for what we write (i.e. reading uses peer's struct): */
-    int closed;                 /* valid iff peer != NULL */
-    size_t len;                 /* valid iff buf != NULL; 0 if peer == NULL */
-    size_t offset;              /* valid iff buf != NULL; 0 if len == 0 */
+    int closed; /* valid iff peer != NULL */
+    size_t len; /* valid iff buf != NULL; 0 if peer == NULL */
+    size_t offset; /* valid iff buf != NULL; 0 if len == 0 */
     size_t size;
-    char *buf;                  /* "size" elements (if != NULL) */
-    size_t request;             /* valid iff peer != NULL; 0 if len != 0,
-                                 * otherwise set by peer to number of bytes
-                                 * it (unsuccessfully) tried to read, never
-                                 * more than buffer space (size-len)
-                                 * warrants. */
+    char *buf; /* "size" elements (if != NULL) */
+    size_t request; /* valid iff peer != NULL; 0 if len != 0,
+                     * otherwise set by peer to number of bytes
+                     * it (unsuccessfully) tried to read, never
+                     * more than buffer space (size-len)
+                     * warrants. */
 };
 
 static int bio_new(BIO *bio)
@@ -124,14 +124,14 @@ static int bio_read(BIO *bio, char *buf, int size_)
     assert(peer_b != NULL);
     assert(peer_b->buf != NULL);
 
-    peer_b->request = 0;        /* will be set in "retry_read" situation */
+    peer_b->request = 0; /* will be set in "retry_read" situation */
 
     if (buf == NULL || size == 0)
         return 0;
 
     if (peer_b->len == 0) {
         if (peer_b->closed)
-            return 0;           /* writer has closed, and no data is left */
+            return 0; /* writer has closed, and no data is left */
         else {
             BIO_set_retry_read(bio); /* buffer is empty */
             if (size <= peer_b->size)
@@ -154,7 +154,7 @@ static int bio_read(BIO *bio, char *buf, int size_)
     rest = size;
 
     assert(rest > 0);
-    do {                        /* one or two iterations */
+    do { /* one or two iterations */
         size_t chunk;
 
         assert(rest <= peer_b->len);
@@ -180,8 +180,7 @@ static int bio_read(BIO *bio, char *buf, int size_)
             peer_b->offset = 0;
         }
         rest -= chunk;
-    }
-    while (rest);
+    } while (rest);
 
     return size;
 }
@@ -242,7 +241,7 @@ static ossl_ssize_t bio_nread(BIO *bio, char **buf, size_t num_)
     if (num_ > OSSL_SSIZE_MAX)
         num = OSSL_SSIZE_MAX;
     else
-        num = (ossl_ssize_t) num_;
+        num = (ossl_ssize_t)num_;
 
     available = bio_nread0(bio, buf);
     if (num > available)
@@ -304,7 +303,7 @@ static int bio_write(BIO *bio, const char *buf, int num_)
     rest = num;
 
     assert(rest > 0);
-    do {                        /* one or two iterations */
+    do { /* one or two iterations */
         size_t write_offset;
         size_t chunk;
 
@@ -329,8 +328,7 @@ static int bio_write(BIO *bio, const char *buf, int num_)
 
         rest -= chunk;
         buf += chunk;
-    }
-    while (rest);
+    } while (rest);
 
     return num;
 }
@@ -398,7 +396,7 @@ static ossl_ssize_t bio_nwrite(BIO *bio, char **buf, size_t num_)
     if (num_ > OSSL_SSIZE_MAX)
         num = OSSL_SSIZE_MAX;
     else
-        num = (ossl_ssize_t) num_;
+        num = (ossl_ssize_t)num_;
 
     space = bio_nwrite0(bio, buf);
     if (num > space)
@@ -446,16 +444,14 @@ static long bio_ctrl(BIO *bio, int cmd, long num, void *ptr)
         ret = (long)b->size;
         break;
 
-    case BIO_C_MAKE_BIO_PAIR:
-        {
-            BIO *other_bio = ptr;
+    case BIO_C_MAKE_BIO_PAIR: {
+        BIO *other_bio = ptr;
 
-            if (bio_make_pair(bio, other_bio))
-                ret = 1;
-            else
-                ret = 0;
-        }
-        break;
+        if (bio_make_pair(bio, other_bio))
+            ret = 1;
+        else
+            ret = 0;
+    } break;
 
     case BIO_C_DESTROY_BIO_PAIR:
         /*
@@ -677,7 +673,7 @@ static void bio_destroy_pair(BIO *bio)
 
 /* Exported convenience functions */
 int BIO_new_bio_pair(BIO **bio1_p, size_t writebuf1,
-                     BIO **bio2_p, size_t writebuf2)
+    BIO **bio2_p, size_t writebuf2)
 {
     BIO *bio1 = NULL, *bio2 = NULL;
     long r;
@@ -706,7 +702,7 @@ int BIO_new_bio_pair(BIO **bio1_p, size_t writebuf1,
         goto err;
     ret = 1;
 
- err:
+err:
     if (ret == 0) {
         BIO_free(bio1);
         bio1 = NULL;
diff --git a/crypto/openssl/crypto/bio/bss_conn.c b/crypto/openssl/crypto/bio/bss_conn.c
index 9d00f18297ff..335704ee3181 100644
--- a/crypto/openssl/crypto/bio/bss_conn.c
+++ b/crypto/openssl/crypto/bio/bss_conn.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -23,9 +23,9 @@ typedef struct bio_connect_st {
     char *param_hostname;
     char *param_service;
     int connect_mode;
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
     unsigned char record_type;
-# endif
+#endif
     int tfo_first;
 
     BIO_ADDRINFO *addr_first;
@@ -56,22 +56,22 @@ static int conn_new(BIO *h);
 static int conn_free(BIO *data);
 static long conn_callback_ctrl(BIO *h, int cmd, BIO_info_cb *);
 static int conn_sendmmsg(BIO *h, BIO_MSG *m, size_t s, size_t n,
-                         uint64_t f, size_t *mp);
+    uint64_t f, size_t *mp);
 static int conn_recvmmsg(BIO *h, BIO_MSG *m, size_t s, size_t n,
-                         uint64_t f, size_t *mp);
+    uint64_t f, size_t *mp);
 
 static int conn_state(BIO *b, BIO_CONNECT *c);
 static void conn_close_socket(BIO *data);
 static BIO_CONNECT *BIO_CONNECT_new(void);
 static void BIO_CONNECT_free(BIO_CONNECT *a);
 
-#define BIO_CONN_S_BEFORE                1
-#define BIO_CONN_S_GET_ADDR              2
-#define BIO_CONN_S_CREATE_SOCKET         3
-#define BIO_CONN_S_CONNECT               4
-#define BIO_CONN_S_OK                    5
-#define BIO_CONN_S_BLOCKED_CONNECT       6
-#define BIO_CONN_S_CONNECT_ERROR         7
+#define BIO_CONN_S_BEFORE 1
+#define BIO_CONN_S_GET_ADDR 2
+#define BIO_CONN_S_CREATE_SOCKET 3
+#define BIO_CONN_S_CONNECT 4
+#define BIO_CONN_S_OK 5
+#define BIO_CONN_S_BLOCKED_CONNECT 6
+#define BIO_CONN_S_CONNECT_ERROR 7
 
 static const BIO_METHOD methods_connectp = {
     BIO_TYPE_CONNECT,
@@ -121,47 +121,47 @@ static int conn_state(BIO *b, BIO_CONNECT *c)
         case BIO_CONN_S_BEFORE:
             if (c->param_hostname == NULL && c->param_service == NULL) {
                 ERR_raise_data(ERR_LIB_BIO,
-                               BIO_R_NO_HOSTNAME_OR_SERVICE_SPECIFIED,
-                               "hostname=%s service=%s",
-                               c->param_hostname, c->param_service);
+                    BIO_R_NO_HOSTNAME_OR_SERVICE_SPECIFIED,
+                    "hostname=%s service=%s",
+                    c->param_hostname, c->param_service);
                 goto exit_loop;
             }
             c->state = BIO_CONN_S_GET_ADDR;
             break;
 
-        case BIO_CONN_S_GET_ADDR:
-            {
-                int family = AF_UNSPEC;
-                switch (c->connect_family) {
-                case BIO_FAMILY_IPV6:
-                    if (1) { /* This is a trick we use to avoid bit rot.
-                              * at least the "else" part will always be
-                              * compiled.
-                              */
+        case BIO_CONN_S_GET_ADDR: {
+            int family = AF_UNSPEC;
+            switch (c->connect_family) {
+            case BIO_FAMILY_IPV6:
+                if (1) { /* This is a trick we use to avoid bit rot.
+                          * at least the "else" part will always be
+                          * compiled.
+                          */
 #if OPENSSL_USE_IPV6
-                        family = AF_INET6;
-                    } else {
+                    family = AF_INET6;
+                } else {
 #endif
-                        ERR_raise(ERR_LIB_BIO, BIO_R_UNAVAILABLE_IP_FAMILY);
-                        goto exit_loop;
-                    }
-                    break;
-                case BIO_FAMILY_IPV4:
-                    family = AF_INET;
-                    break;
-                case BIO_FAMILY_IPANY:
-                    family = AF_UNSPEC;
-                    break;
-                default:
-                    ERR_raise(ERR_LIB_BIO, BIO_R_UNSUPPORTED_IP_FAMILY);
+                    ERR_raise(ERR_LIB_BIO, BIO_R_UNAVAILABLE_IP_FAMILY);
                     goto exit_loop;
                 }
-                if (BIO_lookup(c->param_hostname, c->param_service,
-                               BIO_LOOKUP_CLIENT,
-                               family, c->connect_sock_type,
-                               &c->addr_first) == 0)
-                    goto exit_loop;
+                break;
+            case BIO_FAMILY_IPV4:
+                family = AF_INET;
+                break;
+            case BIO_FAMILY_IPANY:
+                family = AF_UNSPEC;
+                break;
+            default:
+                ERR_raise(ERR_LIB_BIO, BIO_R_UNSUPPORTED_IP_FAMILY);
+                goto exit_loop;
             }
+            if (BIO_lookup(c->param_hostname, c->param_service,
+                    BIO_LOOKUP_CLIENT,
+                    family, c->connect_sock_type,
+                    &c->addr_first)
+                == 0)
+                goto exit_loop;
+        }
             if (c->addr_first == NULL) {
                 ERR_raise(ERR_LIB_BIO, BIO_R_LOOKUP_RETURNED_NOTHING);
                 goto exit_loop;
@@ -172,12 +172,12 @@ static int conn_state(BIO *b, BIO_CONNECT *c)
 
         case BIO_CONN_S_CREATE_SOCKET:
             ret = BIO_socket(BIO_ADDRINFO_family(c->addr_iter),
-                             BIO_ADDRINFO_socktype(c->addr_iter),
-                             BIO_ADDRINFO_protocol(c->addr_iter), 0);
+                BIO_ADDRINFO_socktype(c->addr_iter),
+                BIO_ADDRINFO_protocol(c->addr_iter), 0);
             if (ret == (int)INVALID_SOCKET) {
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling socket(%s, %s)",
-                               c->param_hostname, c->param_service);
+                    "calling socket(%s, %s)",
+                    c->param_hostname, c->param_service);
                 ERR_raise(ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET);
                 goto exit_loop;
             }
@@ -202,7 +202,7 @@ static int conn_state(BIO *b, BIO_CONNECT *c)
                     b->retry_reason = BIO_RR_CONNECT;
                     ERR_pop_to_mark();
                 } else if ((c->addr_iter = BIO_ADDRINFO_next(c->addr_iter))
-                           != NULL) {
+                    != NULL) {
                     /*
                      * if there are more addresses to try, do that first
                      */
@@ -213,8 +213,8 @@ static int conn_state(BIO *b, BIO_CONNECT *c)
                 } else {
                     ERR_clear_last_mark();
                     ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                                   "calling connect(%s, %s)",
-                                    c->param_hostname, c->param_service);
+                        "calling connect(%s, %s)",
+                        c->param_hostname, c->param_service);
                     c->state = BIO_CONN_S_CONNECT_ERROR;
                     break;
                 }
@@ -243,8 +243,8 @@ static int conn_state(BIO *b, BIO_CONNECT *c)
                     break;
                 }
                 ERR_raise_data(ERR_LIB_SYS, i,
-                               "calling connect(%s, %s)",
-                                c->param_hostname, c->param_service);
+                    "calling connect(%s, %s)",
+                    c->param_hostname, c->param_service);
                 ERR_raise(ERR_LIB_BIO, BIO_R_NBIO_CONNECT_ERROR);
                 ret = 0;
                 goto exit_loop;
@@ -252,15 +252,6 @@ static int conn_state(BIO *b, BIO_CONNECT *c)
                 if (!conn_create_dgram_bio(b, c))
                     break;
                 c->state = BIO_CONN_S_OK;
-# ifndef OPENSSL_NO_KTLS
-                /*
-                 * The new socket is created successfully regardless of ktls_enable.
-                 * ktls_enable doesn't change any functionality of the socket, except
-                 * changing the setsockopt to enable the processing of ktls_start.
-                 * Thus, it is not a problem to call it for non-TLS sockets.
-                 */
-                ktls_enable(b->num);
-# endif
             }
             break;
 
@@ -284,10 +275,10 @@ static int conn_state(BIO *b, BIO_CONNECT *c)
     }
 
     /* Loop does not exit */
- exit_loop:
+exit_loop:
     if (cb != NULL)
         ret = cb((BIO *)b, c->state, ret);
- end:
+end:
     return ret;
 }
 
@@ -384,11 +375,11 @@ static int conn_read(BIO *b, char *out, int outl)
 
     if (out != NULL) {
         clear_socket_error();
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
         if (BIO_get_ktls_recv(b))
             ret = ktls_read_record(b->num, out, outl);
         else
-# endif
+#endif
             ret = readsocket(b->num, out, outl);
         BIO_clear_retry_flags(b);
         if (ret <= 0) {
@@ -421,7 +412,7 @@ static int conn_write(BIO *b, const char *in, int inl)
     }
 
     clear_socket_error();
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
     if (BIO_should_ktls_ctrl_msg_flag(b)) {
         ret = ktls_send_ctrl_message(b->num, data->record_type, in, inl);
         if (ret >= 0) {
@@ -429,16 +420,16 @@ static int conn_write(BIO *b, const char *in, int inl)
             BIO_clear_ktls_ctrl_msg_flag(b);
         }
     } else
-# endif
-# if defined(OSSL_TFO_SENDTO)
-    if (data->tfo_first) {
+#endif
+#if defined(OSSL_TFO_SENDTO)
+        if (data->tfo_first) {
         int peerlen = BIO_ADDRINFO_sockaddr_size(data->addr_iter);
 
         ret = sendto(b->num, in, inl, OSSL_TFO_SENDTO,
-                     BIO_ADDRINFO_sockaddr(data->addr_iter), peerlen);
+            BIO_ADDRINFO_sockaddr(data->addr_iter), peerlen);
         data->tfo_first = 0;
     } else
-# endif
+#endif
         ret = writesocket(b->num, in, inl);
     BIO_clear_retry_flags(b);
     if (ret <= 0) {
@@ -456,9 +447,9 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
     long ret = 1;
     BIO_CONNECT *data;
     const BIO_ADDR *dg_addr;
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
     ktls_crypto_info_t *crypto_info;
-# endif
+#endif
 
     data = (BIO_CONNECT *)b->ptr;
 
@@ -469,6 +460,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
         conn_close_socket(b);
         BIO_ADDRINFO_free(data->addr_first);
         data->addr_first = NULL;
+        data->addr_iter = NULL;
         b->flags = 0;
         break;
     case BIO_C_DO_STATE_MACHINE:
@@ -489,11 +481,11 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                 *pptr = (const char *)BIO_ADDRINFO_address(data->addr_iter);
             } else if (num == 3) {
                 switch (BIO_ADDRINFO_family(data->addr_iter)) {
-# if OPENSSL_USE_IPV6
+#if OPENSSL_USE_IPV6
                 case AF_INET6:
                     ret = BIO_FAMILY_IPV6;
                     break;
-# endif
+#endif
                 case AF_INET:
                     ret = BIO_FAMILY_IPV4;
                     break;
@@ -526,9 +518,9 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                 OPENSSL_free(data->param_hostname);
                 data->param_hostname = NULL;
                 ret = BIO_parse_hostserv(ptr,
-                                         &data->param_hostname,
-                                         &data->param_service,
-                                         BIO_PARSE_PRIO_HOST);
+                    &data->param_hostname,
+                    &data->param_service,
+                    BIO_PARSE_PRIO_HOST);
                 if (hold_service != data->param_service)
                     OPENSSL_free(hold_service);
             } else if (num == 1) { /* BIO_set_conn_port */
@@ -602,21 +594,19 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
 
         break;
     case BIO_CTRL_GET_RPOLL_DESCRIPTOR:
-    case BIO_CTRL_GET_WPOLL_DESCRIPTOR:
-        {
-            BIO_POLL_DESCRIPTOR *pd = ptr;
+    case BIO_CTRL_GET_WPOLL_DESCRIPTOR: {
+        BIO_POLL_DESCRIPTOR *pd = ptr;
 
-            if (data->state != BIO_CONN_S_OK)
-                conn_state(b, data); /* best effort */
+        if (data->state != BIO_CONN_S_OK)
+            conn_state(b, data); /* best effort */
 
-            if (data->state >= BIO_CONN_S_CREATE_SOCKET) {
-                pd->type        = BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD;
-                pd->value.fd    = b->num;
-            } else {
-                ret = 0;
-            }
+        if (data->state >= BIO_CONN_S_CREATE_SOCKET) {
+            pd->type = BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD;
+            pd->value.fd = b->num;
+        } else {
+            ret = 0;
         }
-        break;
+    } break;
     case BIO_C_SET_NBIO:
         if (num != 0)
             data->connect_mode |= BIO_SOCK_NONBLOCK;
@@ -666,37 +656,33 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
         break;
     case BIO_CTRL_FLUSH:
         break;
-    case BIO_CTRL_DUP:
-        {
-            dbio = (BIO *)ptr;
-            if (data->param_hostname)
-                BIO_set_conn_hostname(dbio, data->param_hostname);
-            if (data->param_service)
-                BIO_set_conn_port(dbio, data->param_service);
-            BIO_set_conn_ip_family(dbio, data->connect_family);
-            BIO_set_conn_mode(dbio, data->connect_mode);
-            /*
-             * FIXME: the cast of the function seems unlikely to be a good
-             * idea
-             */
-            (void)BIO_set_info_callback(dbio, data->info_callback);
-        }
-        break;
+    case BIO_CTRL_DUP: {
+        dbio = (BIO *)ptr;
+        if (data->param_hostname)
+            BIO_set_conn_hostname(dbio, data->param_hostname);
+        if (data->param_service)
+            BIO_set_conn_port(dbio, data->param_service);
+        BIO_set_conn_ip_family(dbio, data->connect_family);
+        BIO_set_conn_mode(dbio, data->connect_mode);
+        /*
+         * FIXME: the cast of the function seems unlikely to be a good
+         * idea
+         */
+        (void)BIO_set_info_callback(dbio, data->info_callback);
+    } break;
     case BIO_CTRL_SET_CALLBACK:
         ret = 0; /* use callback ctrl */
         break;
-    case BIO_CTRL_GET_CALLBACK:
-        {
-            BIO_info_cb **fptr;
+    case BIO_CTRL_GET_CALLBACK: {
+        BIO_info_cb **fptr;
 
-            fptr = (BIO_info_cb **)ptr;
-            *fptr = data->info_callback;
-        }
-        break;
+        fptr = (BIO_info_cb **)ptr;
+        *fptr = data->info_callback;
+    } break;
     case BIO_CTRL_EOF:
         ret = (b->flags & BIO_FLAGS_IN_EOF) != 0;
         break;
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
     case BIO_CTRL_SET_KTLS:
         crypto_info = (ktls_crypto_info_t *)ptr;
         ret = ktls_start(b->num, crypto_info, num);
@@ -721,7 +707,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
         if (ret)
             BIO_set_ktls_zerocopy_sendfile_flag(b);
         break;
-# endif
+#endif
     default:
         ret = 0;
         break;
@@ -737,11 +723,9 @@ static long conn_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)
     data = (BIO_CONNECT *)b->ptr;
 
     switch (cmd) {
-    case BIO_CTRL_SET_CALLBACK:
-        {
-            data->info_callback = fp;
-        }
-        break;
+    case BIO_CTRL_SET_CALLBACK: {
+        data->info_callback = fp;
+    } break;
     default:
         ret = 0;
         break;
@@ -792,11 +776,11 @@ int conn_gets(BIO *bio, char *buf, int size)
 
     clear_socket_error();
     while (size-- > 1) {
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
         if (BIO_get_ktls_recv(bio))
             ret = ktls_read_record(bio->num, ptr, 1);
         else
-# endif
+#endif
             ret = readsocket(bio->num, ptr, 1);
         BIO_clear_retry_flags(bio);
         if (ret <= 0) {
@@ -814,7 +798,7 @@ int conn_gets(BIO *bio, char *buf, int size)
 }
 
 static int conn_sendmmsg(BIO *bio, BIO_MSG *msg, size_t stride, size_t num_msgs,
-                         uint64_t flags, size_t *msgs_processed)
+    uint64_t flags, size_t *msgs_processed)
 {
     int ret;
     BIO_CONNECT *data;
@@ -841,11 +825,11 @@ static int conn_sendmmsg(BIO *bio, BIO_MSG *msg, size_t stride, size_t num_msgs,
     }
 
     return BIO_sendmmsg(data->dgram_bio, msg, stride, num_msgs,
-                        flags, msgs_processed);
+        flags, msgs_processed);
 }
 
 static int conn_recvmmsg(BIO *bio, BIO_MSG *msg, size_t stride, size_t num_msgs,
-                         uint64_t flags, size_t *msgs_processed)
+    uint64_t flags, size_t *msgs_processed)
 {
     int ret;
     BIO_CONNECT *data;
@@ -872,7 +856,7 @@ static int conn_recvmmsg(BIO *bio, BIO_MSG *msg, size_t stride, size_t num_msgs,
     }
 
     return BIO_recvmmsg(data->dgram_bio, msg, stride, num_msgs,
-                        flags, msgs_processed);
+        flags, msgs_processed);
 }
 
 BIO *BIO_new_connect(const char *str)
diff --git a/crypto/openssl/crypto/bio/bss_core.c b/crypto/openssl/crypto/bio/bss_core.c
index b9a8eff3464a..fb9b59caef17 100644
--- a/crypto/openssl/crypto/bio/bss_core.c
+++ b/crypto/openssl/crypto/bio/bss_core.c
@@ -38,7 +38,7 @@ static ossl_inline BIO_CORE_GLOBALS *get_globals(OSSL_LIB_CTX *libctx)
 }
 
 static int bio_core_read_ex(BIO *bio, char *data, size_t data_len,
-                            size_t *bytes_read)
+    size_t *bytes_read)
 {
     BIO_CORE_GLOBALS *bcgbl = get_globals(bio->libctx);
 
@@ -48,7 +48,7 @@ static int bio_core_read_ex(BIO *bio, char *data, size_t data_len,
 }
 
 static int bio_core_write_ex(BIO *bio, const char *data, size_t data_len,
-                             size_t *written)
+    size_t *written)
 {
     BIO_CORE_GLOBALS *bcgbl = get_globals(bio->libctx);
 
@@ -149,7 +149,7 @@ int ossl_bio_init_core(OSSL_LIB_CTX *libctx, const OSSL_DISPATCH *fns)
     BIO_CORE_GLOBALS *bcgbl = get_globals(libctx);
 
     if (bcgbl == NULL)
-	    return 0;
+        return 0;
 
     for (; fns->function_id != 0; fns++) {
         switch (fns->function_id) {
diff --git a/crypto/openssl/crypto/bio/bss_dgram.c b/crypto/openssl/crypto/bio/bss_dgram.c
index 784a1abb00bb..dd14c393d737 100644
--- a/crypto/openssl/crypto/bio/bss_dgram.c
+++ b/crypto/openssl/crypto/bio/bss_dgram.c
@@ -8,7 +8,7 @@
  */
 
 #ifndef _GNU_SOURCE
-# define _GNU_SOURCE
+#define _GNU_SOURCE
 #endif
 
 #include <stdio.h>
@@ -18,126 +18,136 @@
 #include "bio_local.h"
 #ifndef OPENSSL_NO_DGRAM
 
-# ifndef OPENSSL_NO_SCTP
-#  include <netinet/sctp.h>
-#  include <fcntl.h>
-#  define OPENSSL_SCTP_DATA_CHUNK_TYPE            0x00
-#  define OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE 0xc0
-# endif
+#ifndef OPENSSL_NO_SCTP
+#include <netinet/sctp.h>
+#include <fcntl.h>
+#define OPENSSL_SCTP_DATA_CHUNK_TYPE 0x00
+#define OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE 0xc0
+#endif
 
-# if defined(OPENSSL_SYS_LINUX) && !defined(IP_MTU)
-#  define IP_MTU      14        /* linux is lame */
-# endif
+#if defined(OPENSSL_SYS_LINUX) && !defined(IP_MTU)
+#define IP_MTU 14 /* linux is lame */
+#endif
 
-# if OPENSSL_USE_IPV6 && !defined(IPPROTO_IPV6)
-#  define IPPROTO_IPV6 41       /* windows is lame */
-# endif
+#if OPENSSL_USE_IPV6 && !defined(IPPROTO_IPV6)
+#define IPPROTO_IPV6 41 /* windows is lame */
+#endif
 
-# if defined(__FreeBSD__) && defined(IN6_IS_ADDR_V4MAPPED)
+#if defined(__FreeBSD__) && defined(IN6_IS_ADDR_V4MAPPED)
 /* Standard definition causes type-punning problems. */
-#  undef IN6_IS_ADDR_V4MAPPED
-#  define s6_addr32 __u6_addr.__u6_addr32
-#  define IN6_IS_ADDR_V4MAPPED(a)               \
-        (((a)->s6_addr32[0] == 0) &&          \
-         ((a)->s6_addr32[1] == 0) &&          \
-         ((a)->s6_addr32[2] == htonl(0x0000ffff)))
-# endif
+#undef IN6_IS_ADDR_V4MAPPED
+#define s6_addr32 __u6_addr.__u6_addr32
+#define IN6_IS_ADDR_V4MAPPED(a) \
+    (((a)->s6_addr32[0] == 0) && ((a)->s6_addr32[1] == 0) && ((a)->s6_addr32[2] == htonl(0x0000ffff)))
+#endif
 
 /* Determine what method to use for BIO_sendmmsg and BIO_recvmmsg. */
-# define M_METHOD_NONE       0
-# define M_METHOD_RECVMMSG   1
-# define M_METHOD_RECVMSG    2
-# define M_METHOD_RECVFROM   3
-# define M_METHOD_WSARECVMSG 4
+#define M_METHOD_NONE 0
+#define M_METHOD_RECVMMSG 1
+#define M_METHOD_RECVMSG 2
+#define M_METHOD_RECVFROM 3
+#define M_METHOD_WSARECVMSG 4
 
-# if defined(__GLIBC__) && defined(__GLIBC_PREREQ)
-#  if !(__GLIBC_PREREQ(2, 14))
-#   undef NO_RECVMMSG
-    /*
-     * Some old glibc versions may have recvmmsg and MSG_WAITFORONE flag, but
-     * not sendmmsg. We need both so force this to be disabled on these old
-     * versions
-     */
-#   define NO_RECVMMSG
-#  endif
-# endif
-# if defined(__GNU__)
-   /* GNU/Hurd does not have IP_PKTINFO yet */
-   #undef NO_RECVMSG
-   #define NO_RECVMSG
-# endif
-# if (defined(__ANDROID_API__) && __ANDROID_API__ < 21) || defined(_AIX)
-#  undef NO_RECVMMSG
-#  define NO_RECVMMSG
-# endif
-# if !defined(M_METHOD)
-#  if defined(OPENSSL_SYS_WINDOWS) && defined(BIO_HAVE_WSAMSG) && !defined(NO_WSARECVMSG)
-#   define M_METHOD  M_METHOD_WSARECVMSG
-#  elif !defined(OPENSSL_SYS_WINDOWS) && defined(MSG_WAITFORONE) && !defined(NO_RECVMMSG)
-#   define M_METHOD  M_METHOD_RECVMMSG
-#  elif !defined(OPENSSL_SYS_WINDOWS) && defined(CMSG_LEN) && !defined(NO_RECVMSG)
-#   define M_METHOD  M_METHOD_RECVMSG
-#  elif !defined(NO_RECVFROM)
-#   define M_METHOD  M_METHOD_RECVFROM
-#  else
-#   define M_METHOD  M_METHOD_NONE
-#  endif
-# endif
+#if defined(__GLIBC__) && defined(__GLIBC_PREREQ)
+#if !(__GLIBC_PREREQ(2, 14))
+#undef NO_RECVMMSG
+/*
+ * Some old glibc versions may have recvmmsg and MSG_WAITFORONE flag, but
+ * not sendmmsg. We need both so force this to be disabled on these old
+ * versions
+ */
+#define NO_RECVMMSG
+#endif
+#endif
+#if defined(__GNU__)
+/* GNU/Hurd does not have IP_PKTINFO yet */
+#undef NO_RECVMSG
+#define NO_RECVMSG
+#endif
+#if (defined(__ANDROID_API__) && __ANDROID_API__ < 21)
+#undef NO_RECVMMSG
+#define NO_RECVMMSG
+#endif
+#if defined(_AIX) && !defined(_AIX72)
+/* AIX >= 7.2 provides sendmmsg() and recvmmsg(). */
+#undef NO_RECVMMSG
+#define NO_RECVMMSG
+#endif
+#if !defined(M_METHOD)
+#if defined(OPENSSL_SYS_WINDOWS) && defined(BIO_HAVE_WSAMSG) && !defined(NO_WSARECVMSG)
+#define M_METHOD M_METHOD_WSARECVMSG
+#elif !defined(OPENSSL_SYS_WINDOWS) && defined(MSG_WAITFORONE) && !defined(NO_RECVMMSG)
+#define M_METHOD M_METHOD_RECVMMSG
+#elif !defined(OPENSSL_SYS_WINDOWS) && defined(CMSG_LEN) && !defined(NO_RECVMSG)
+#define M_METHOD M_METHOD_RECVMSG
+#elif !defined(NO_RECVFROM)
+#define M_METHOD M_METHOD_RECVFROM
+#else
+#define M_METHOD M_METHOD_NONE
+#endif
+#endif
 
-# if defined(OPENSSL_SYS_WINDOWS)
-#  define BIO_CMSG_SPACE(x) WSA_CMSG_SPACE(x)
-#  define BIO_CMSG_FIRSTHDR(x) WSA_CMSG_FIRSTHDR(x)
-#  define BIO_CMSG_NXTHDR(x, y) WSA_CMSG_NXTHDR(x, y)
-#  define BIO_CMSG_DATA(x) WSA_CMSG_DATA(x)
-#  define BIO_CMSG_LEN(x) WSA_CMSG_LEN(x)
-#  define MSGHDR_TYPE WSAMSG
-#  define CMSGHDR_TYPE WSACMSGHDR
-# else
-#  define MSGHDR_TYPE struct msghdr
-#  define CMSGHDR_TYPE struct cmsghdr
-#  define BIO_CMSG_SPACE(x) CMSG_SPACE(x)
-#  define BIO_CMSG_FIRSTHDR(x) CMSG_FIRSTHDR(x)
-#  define BIO_CMSG_NXTHDR(x, y) CMSG_NXTHDR(x, y)
-#  define BIO_CMSG_DATA(x) CMSG_DATA(x)
-#  define BIO_CMSG_LEN(x) CMSG_LEN(x)
-# endif
+#if defined(OPENSSL_SYS_WINDOWS)
+#define BIO_CMSG_SPACE(x) WSA_CMSG_SPACE(x)
+#define BIO_CMSG_FIRSTHDR(x) WSA_CMSG_FIRSTHDR(x)
+#define BIO_CMSG_NXTHDR(x, y) WSA_CMSG_NXTHDR(x, y)
+#define BIO_CMSG_DATA(x) WSA_CMSG_DATA(x)
+#define BIO_CMSG_LEN(x) WSA_CMSG_LEN(x)
+#define MSGHDR_TYPE WSAMSG
+#define CMSGHDR_TYPE WSACMSGHDR
+#else
+#define MSGHDR_TYPE struct msghdr
+#define CMSGHDR_TYPE struct cmsghdr
+#define BIO_CMSG_SPACE(x) CMSG_SPACE(x)
+#define BIO_CMSG_FIRSTHDR(x) CMSG_FIRSTHDR(x)
+#define BIO_CMSG_NXTHDR(x, y) CMSG_NXTHDR(x, y)
+#define BIO_CMSG_DATA(x) CMSG_DATA(x)
+#define BIO_CMSG_LEN(x) CMSG_LEN(x)
+#endif
 
-# if   M_METHOD == M_METHOD_RECVMMSG   \
-    || M_METHOD == M_METHOD_RECVMSG    \
+#if M_METHOD == M_METHOD_RECVMMSG   \
+    || M_METHOD == M_METHOD_RECVMSG \
     || M_METHOD == M_METHOD_WSARECVMSG
-#  if defined(__APPLE__)
-    /*
-     * CMSG_SPACE is not a constant expression on OSX even though POSIX
-     * says it's supposed to be. This should be adequate.
-     */
-#   define BIO_CMSG_ALLOC_LEN   64
-#  else
-#   if defined(IPV6_PKTINFO)
-#     define BIO_CMSG_ALLOC_LEN_1   BIO_CMSG_SPACE(sizeof(struct in6_pktinfo))
-#   else
-#     define BIO_CMSG_ALLOC_LEN_1   0
-#   endif
-#   if defined(IP_PKTINFO)
-#     define BIO_CMSG_ALLOC_LEN_2   BIO_CMSG_SPACE(sizeof(struct in_pktinfo))
-#   else
-#     define BIO_CMSG_ALLOC_LEN_2   0
-#   endif
-#   if defined(IP_RECVDSTADDR)
-#     define BIO_CMSG_ALLOC_LEN_3   BIO_CMSG_SPACE(sizeof(struct in_addr))
-#   else
-#     define BIO_CMSG_ALLOC_LEN_3   0
-#   endif
-#   define BIO_MAX(X,Y) ((X) > (Y) ? (X) : (Y))
-#   define BIO_CMSG_ALLOC_LEN                                        \
-        BIO_MAX(BIO_CMSG_ALLOC_LEN_1,                                \
-                BIO_MAX(BIO_CMSG_ALLOC_LEN_2, BIO_CMSG_ALLOC_LEN_3))
-#  endif
-#  if (defined(IP_PKTINFO) || defined(IP_RECVDSTADDR)) && defined(IPV6_RECVPKTINFO)
-#   define SUPPORT_LOCAL_ADDR
-#  endif
-# endif
+#if defined(__APPLE__)
+/*
+ * CMSG_SPACE is not a constant expression on OSX even though POSIX
+ * says it's supposed to be. This should be adequate.
+ */
+#define BIO_CMSG_ALLOC_LEN 64
+#else
+#if defined(IPV6_PKTINFO)
+#define BIO_CMSG_ALLOC_LEN_1 BIO_CMSG_SPACE(sizeof(struct in6_pktinfo))
+#else
+#define BIO_CMSG_ALLOC_LEN_1 0
+#endif
+#if defined(IP_PKTINFO)
+#define BIO_CMSG_ALLOC_LEN_2 BIO_CMSG_SPACE(sizeof(struct in_pktinfo))
+#else
+#define BIO_CMSG_ALLOC_LEN_2 0
+#endif
+#if defined(IP_RECVDSTADDR)
+#define BIO_CMSG_ALLOC_LEN_3 BIO_CMSG_SPACE(sizeof(struct in_addr))
+#else
+#define BIO_CMSG_ALLOC_LEN_3 0
+#endif
+#define BIO_MAX(X, Y) ((X) > (Y) ? (X) : (Y))
+#define BIO_CMSG_ALLOC_LEN        \
+    BIO_MAX(BIO_CMSG_ALLOC_LEN_1, \
+        BIO_MAX(BIO_CMSG_ALLOC_LEN_2, BIO_CMSG_ALLOC_LEN_3))
+#endif
+/*
+ * Although AIX defines IP_RECVDSTADDR and IPV6_RECVPKTINFO, the
+ * implementation requires IP_PKTINFO to be available for AF_INET.
+ * For AF_INET6 there seem to be limitations how local addresses
+ * are handled on AIX. So, disable the support for now.
+ */
+#if (defined(IP_PKTINFO) || defined(IP_RECVDSTADDR)) && defined(IPV6_RECVPKTINFO) \
+    && !defined(_AIX)
+#define SUPPORT_LOCAL_ADDR
+#endif
+#endif
 
-# define BIO_MSG_N(array, stride, n) (*(BIO_MSG *)((char *)(array) + (n)*(stride)))
+#define BIO_MSG_N(array, stride, n) (*(BIO_MSG *)((char *)(array) + (n) * (stride)))
 
 static int dgram_write(BIO *h, const char *buf, int num);
 static int dgram_read(BIO *h, char *buf, int size);
@@ -147,13 +157,13 @@ static int dgram_new(BIO *h);
 static int dgram_free(BIO *data);
 static int dgram_clear(BIO *bio);
 static int dgram_sendmmsg(BIO *b, BIO_MSG *msg,
-                          size_t stride, size_t num_msg,
-                          uint64_t flags, size_t *num_processed);
+    size_t stride, size_t num_msg,
+    uint64_t flags, size_t *num_processed);
 static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
-                          size_t stride, size_t num_msg,
-                          uint64_t flags, size_t *num_processed);
+    size_t stride, size_t num_msg,
+    uint64_t flags, size_t *num_processed);
 
-# ifndef OPENSSL_NO_SCTP
+#ifndef OPENSSL_NO_SCTP
 static int dgram_sctp_write(BIO *h, const char *buf, int num);
 static int dgram_sctp_read(BIO *h, char *buf, int size);
 static int dgram_sctp_puts(BIO *h, const char *str);
@@ -162,11 +172,10 @@ static int dgram_sctp_new(BIO *h);
 static int dgram_sctp_free(BIO *data);
 static int dgram_sctp_wait_for_dry(BIO *b);
 static int dgram_sctp_msg_waiting(BIO *b);
-#  ifdef SCTP_AUTHENTICATION_EVENT
-static void dgram_sctp_handle_auth_free_key_event(BIO *b, union sctp_notification
-                                                  *snp);
-#  endif
-# endif
+#ifdef SCTP_AUTHENTICATION_EVENT
+static void dgram_sctp_handle_auth_free_key_event(BIO *b, union sctp_notification *snp);
+#endif
+#endif
 
 static int BIO_dgram_should_retry(int s);
 
@@ -178,16 +187,16 @@ static const BIO_METHOD methods_dgramp = {
     bread_conv,
     dgram_read,
     dgram_puts,
-    NULL,                       /* dgram_gets,         */
+    NULL, /* dgram_gets,         */
     dgram_ctrl,
     dgram_new,
     dgram_free,
-    NULL,                       /* dgram_callback_ctrl */
+    NULL, /* dgram_callback_ctrl */
     dgram_sendmmsg,
     dgram_recvmmsg,
 };
 
-# ifndef OPENSSL_NO_SCTP
+#ifndef OPENSSL_NO_SCTP
 static const BIO_METHOD methods_dgramp_sctp = {
     BIO_TYPE_DGRAM_SCTP,
     "datagram sctp socket",
@@ -196,15 +205,15 @@ static const BIO_METHOD methods_dgramp_sctp = {
     bread_conv,
     dgram_sctp_read,
     dgram_sctp_puts,
-    NULL,                       /* dgram_gets,         */
+    NULL, /* dgram_gets,         */
     dgram_sctp_ctrl,
     dgram_sctp_new,
     dgram_sctp_free,
-    NULL,                       /* dgram_callback_ctrl */
-    NULL,                       /* sendmmsg */
-    NULL,                       /* recvmmsg */
+    NULL, /* dgram_callback_ctrl */
+    NULL, /* sendmmsg */
+    NULL, /* recvmmsg */
 };
-# endif
+#endif
 
 typedef struct bio_dgram_data_st {
     BIO_ADDR peer;
@@ -218,7 +227,7 @@ typedef struct bio_dgram_data_st {
     char local_addr_enabled;
 } bio_dgram_data;
 
-# ifndef OPENSSL_NO_SCTP
+#ifndef OPENSSL_NO_SCTP
 typedef struct bio_dgram_sctp_save_message_st {
     BIO *bio;
     char *data;
@@ -243,7 +252,7 @@ typedef struct bio_dgram_sctp_data_st {
     int save_shutdown;
     int peer_auth_tested;
 } bio_dgram_sctp_data;
-# endif
+#endif
 
 const BIO_METHOD *BIO_s_datagram(void)
 {
@@ -302,33 +311,34 @@ static int dgram_clear(BIO *a)
 
 static void dgram_adjust_rcv_timeout(BIO *b)
 {
-# if defined(SO_RCVTIMEO)
+#if defined(SO_RCVTIMEO)
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
     OSSL_TIME timeleft;
 
     /* Is a timer active? */
     if (!ossl_time_is_zero(data->next_timeout)) {
         /* Read current socket timeout */
-#  ifdef OPENSSL_SYS_WINDOWS
+#ifdef OPENSSL_SYS_WINDOWS
         int timeout;
         int sz = sizeof(timeout);
 
         if (getsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
-                       (void *)&timeout, &sz) < 0)
+                (void *)&timeout, &sz)
+            < 0)
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling getsockopt()");
+                "calling getsockopt()");
         else
             data->socket_timeout = ossl_ms2time(timeout);
-#  else
+#else
         struct timeval tv;
         socklen_t sz = sizeof(tv);
 
         if (getsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO, &tv, &sz) < 0)
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling getsockopt()");
+                "calling getsockopt()");
         else
             data->socket_timeout = ossl_time_from_timeval(tv);
-#  endif
+#endif
 
         /* Calculate time left until timer expires */
         timeleft = ossl_time_subtract(data->next_timeout, ossl_time_now());
@@ -341,22 +351,24 @@ static void dgram_adjust_rcv_timeout(BIO *b)
          */
         if (ossl_time_is_zero(data->socket_timeout)
             || ossl_time_compare(data->socket_timeout, timeleft) >= 0) {
-#  ifdef OPENSSL_SYS_WINDOWS
+#ifdef OPENSSL_SYS_WINDOWS
             timeout = (int)ossl_time2ms(timeleft);
             if (setsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
-                           (void *)&timeout, sizeof(timeout)) < 0)
+                    (void *)&timeout, sizeof(timeout))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
-#  else
+                    "calling setsockopt()");
+#else
             tv = ossl_time_to_timeval(timeleft);
             if (setsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO, &tv,
-                           sizeof(tv)) < 0)
+                    sizeof(tv))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
-#  endif
+                    "calling setsockopt()");
+#endif
         }
     }
-# endif
+#endif
 }
 
 static void dgram_update_local_addr(BIO *b)
@@ -372,37 +384,38 @@ static void dgram_update_local_addr(BIO *b)
         BIO_ADDR_clear(&data->local_addr);
 }
 
-# if M_METHOD == M_METHOD_RECVMMSG || M_METHOD == M_METHOD_RECVMSG || M_METHOD == M_METHOD_WSARECVMSG
+#if M_METHOD == M_METHOD_RECVMMSG || M_METHOD == M_METHOD_RECVMSG || M_METHOD == M_METHOD_WSARECVMSG
 static int dgram_get_sock_family(BIO *b)
 {
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
     return data->local_addr.sa.sa_family;
 }
-# endif
+#endif
 
 static void dgram_reset_rcv_timeout(BIO *b)
 {
-# if defined(SO_RCVTIMEO)
+#if defined(SO_RCVTIMEO)
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
 
     /* Is a timer active? */
     if (!ossl_time_is_zero(data->next_timeout)) {
-#  ifdef OPENSSL_SYS_WINDOWS
+#ifdef OPENSSL_SYS_WINDOWS
         int timeout = (int)ossl_time2ms(data->socket_timeout);
 
         if (setsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
-                       (void *)&timeout, sizeof(timeout)) < 0)
+                (void *)&timeout, sizeof(timeout))
+            < 0)
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
-#  else
+                "calling setsockopt()");
+#else
         struct timeval tv = ossl_time_to_timeval(data->socket_timeout);
 
         if (setsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) < 0)
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
-#  endif
+                "calling setsockopt()");
+#endif
     }
-# endif
+#endif
 }
 
 static int dgram_read(BIO *b, char *out, int outl)
@@ -421,7 +434,7 @@ static int dgram_read(BIO *b, char *out, int outl)
         if (data->peekmode)
             flags = MSG_PEEK;
         ret = recvfrom(b->num, out, outl, flags,
-                       BIO_ADDR_sockaddr_noconst(&peer), &len);
+            BIO_ADDR_sockaddr_noconst(&peer), &len);
 
         if (!data->connected && ret >= 0)
             BIO_ctrl(b, BIO_CTRL_DGRAM_SET_PEER, 0, &peer);
@@ -451,7 +464,7 @@ static int dgram_write(BIO *b, const char *in, int inl)
         int peerlen = BIO_ADDR_sockaddr_size(&data->peer);
 
         ret = sendto(b->num, in, inl, 0,
-                     BIO_ADDR_sockaddr(&data->peer), peerlen);
+            BIO_ADDR_sockaddr(&data->peer), peerlen);
     }
 
     BIO_clear_retry_flags(b);
@@ -475,27 +488,25 @@ static long dgram_get_mtu_overhead(BIO_ADDR *addr)
          */
         ret = 28;
         break;
-# if OPENSSL_USE_IPV6
-    case AF_INET6:
-        {
-#  ifdef IN6_IS_ADDR_V4MAPPED
-            struct in6_addr tmp_addr;
+#if OPENSSL_USE_IPV6
+    case AF_INET6: {
+#ifdef IN6_IS_ADDR_V4MAPPED
+        struct in6_addr tmp_addr;
 
-            if (BIO_ADDR_rawaddress(addr, &tmp_addr, NULL)
-                && IN6_IS_ADDR_V4MAPPED(&tmp_addr))
-                /*
-                 * Assume this is UDP - 20 bytes for IP, 8 bytes for UDP
-                 */
-                ret = 28;
-            else
-#  endif
+        if (BIO_ADDR_rawaddress(addr, &tmp_addr, NULL)
+            && IN6_IS_ADDR_V4MAPPED(&tmp_addr))
+            /*
+             * Assume this is UDP - 20 bytes for IP, 8 bytes for UDP
+             */
+            ret = 28;
+        else
+#endif
             /*
              * Assume this is UDP - 40 bytes for IP, 8 bytes for UDP
              */
             ret = 48;
-        }
-        break;
-# endif
+    } break;
+#endif
     default:
         /* We don't know. Go with the historical default */
         ret = 28;
@@ -505,62 +516,66 @@ static long dgram_get_mtu_overhead(BIO_ADDR *addr)
 }
 
 /* Enables appropriate destination address reception option on the socket. */
-# if defined(SUPPORT_LOCAL_ADDR)
-static int enable_local_addr(BIO *b, int enable) {
+#if defined(SUPPORT_LOCAL_ADDR)
+static int enable_local_addr(BIO *b, int enable)
+{
     int af = dgram_get_sock_family(b);
 
     if (af == AF_INET) {
-#  if defined(IP_PKTINFO)
+#if defined(IP_PKTINFO)
         /* IP_PKTINFO is preferred */
         if (setsockopt(b->num, IPPROTO_IP, IP_PKTINFO,
-                       (void *)&enable, sizeof(enable)) < 0)
+                (void *)&enable, sizeof(enable))
+            < 0)
             return 0;
 
         return 1;
 
-#  elif defined(IP_RECVDSTADDR)
+#elif defined(IP_RECVDSTADDR)
         /* Fall back to IP_RECVDSTADDR */
 
         if (setsockopt(b->num, IPPROTO_IP, IP_RECVDSTADDR,
-                       &enable, sizeof(enable)) < 0)
+                &enable, sizeof(enable))
+            < 0)
             return 0;
 
         return 1;
-#  endif
+#endif
     }
 
-#  if OPENSSL_USE_IPV6
+#if OPENSSL_USE_IPV6
     if (af == AF_INET6) {
-#   if defined(IPV6_RECVPKTINFO)
+#if defined(IPV6_RECVPKTINFO)
         if (setsockopt(b->num, IPPROTO_IPV6, IPV6_RECVPKTINFO,
-                       &enable, sizeof(enable)) < 0)
+                &enable, sizeof(enable))
+            < 0)
             return 0;
 
         return 1;
-#   endif
+#endif
     }
-#  endif
+#endif
 
     return 0;
 }
-# endif
+#endif
 
 static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
 {
     long ret = 1;
     int *ip;
     bio_dgram_data *data = NULL;
-# ifndef __DJGPP__
+#ifndef __DJGPP__
     /* There are currently no cases where this is used on djgpp/watt32. */
     int sockopt_val = 0;
-# endif
+#endif
     int d_errno;
-# if defined(OPENSSL_SYS_LINUX) && (defined(IP_MTU_DISCOVER) || defined(IP_MTU))
-    socklen_t sockopt_len;      /* assume that system supporting IP_MTU is
-                                 * modern enough to define socklen_t */
+#if defined(OPENSSL_SYS_LINUX) && (defined(IP_MTU_DISCOVER) || defined(IP_MTU))
+    socklen_t sockopt_len; /* assume that system supporting IP_MTU is
+                            * modern enough to define socklen_t */
     socklen_t addr_len;
     BIO_ADDR addr;
-# endif
+#endif
     struct sockaddr_storage ss;
     socklen_t ss_len = sizeof(ss);
 
@@ -584,12 +599,12 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
             BIO_ADDR_make(&data->peer, BIO_ADDR_sockaddr((BIO_ADDR *)&ss));
             data->connected = 1;
         }
-# if defined(SUPPORT_LOCAL_ADDR)
+#if defined(SUPPORT_LOCAL_ADDR)
         if (data->local_addr_enabled) {
             if (enable_local_addr(b, 1) < 1)
                 data->local_addr_enabled = 0;
         }
-# endif
+#endif
         break;
     case BIO_C_GET_FD:
         if (b->init) {
@@ -619,8 +634,8 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
         break;
         /* (Linux)kernel sets DF bit on outgoing IP packets */
     case BIO_CTRL_DGRAM_MTU_DISCOVER:
-# if defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DO)
-        addr_len = (socklen_t) sizeof(addr);
+#if defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DO)
+        addr_len = (socklen_t)sizeof(addr);
         BIO_ADDR_clear(&addr);
         if (getsockname(b->num, &addr.sa, &addr_len) < 0) {
             ret = 0;
@@ -630,30 +645,32 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
         case AF_INET:
             sockopt_val = IP_PMTUDISC_DO;
             if ((ret = setsockopt(b->num, IPPROTO_IP, IP_MTU_DISCOVER,
-                                  &sockopt_val, sizeof(sockopt_val))) < 0)
+                     &sockopt_val, sizeof(sockopt_val)))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
+                    "calling setsockopt()");
             break;
-#  if OPENSSL_USE_IPV6 && defined(IPV6_MTU_DISCOVER) && defined(IPV6_PMTUDISC_DO)
+#if OPENSSL_USE_IPV6 && defined(IPV6_MTU_DISCOVER) && defined(IPV6_PMTUDISC_DO)
         case AF_INET6:
             sockopt_val = IPV6_PMTUDISC_DO;
             if ((ret = setsockopt(b->num, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
-                                  &sockopt_val, sizeof(sockopt_val))) < 0)
+                     &sockopt_val, sizeof(sockopt_val)))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
+                    "calling setsockopt()");
             break;
-#  endif
+#endif
         default:
             ret = -1;
             break;
         }
-# else
+#else
         ret = -1;
-# endif
+#endif
         break;
     case BIO_CTRL_DGRAM_QUERY_MTU:
-# if defined(OPENSSL_SYS_LINUX) && defined(IP_MTU)
-        addr_len = (socklen_t) sizeof(addr);
+#if defined(OPENSSL_SYS_LINUX) && defined(IP_MTU)
+        addr_len = (socklen_t)sizeof(addr);
         BIO_ADDR_clear(&addr);
         if (getsockname(b->num, &addr.sa, &addr_len) < 0) {
             ret = 0;
@@ -662,20 +679,21 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
         sockopt_len = sizeof(sockopt_val);
         switch (addr.sa.sa_family) {
         case AF_INET:
-            if ((ret =
-                 getsockopt(b->num, IPPROTO_IP, IP_MTU, (void *)&sockopt_val,
-                            &sockopt_len)) < 0 || sockopt_val < 0) {
+            if ((ret = getsockopt(b->num, IPPROTO_IP, IP_MTU, (void *)&sockopt_val,
+                     &sockopt_len))
+                    < 0
+                || sockopt_val < 0) {
                 ret = 0;
             } else {
                 data->mtu = sockopt_val - dgram_get_mtu_overhead(&addr);
                 ret = data->mtu;
             }
             break;
-#  if OPENSSL_USE_IPV6 && defined(IPV6_MTU)
+#if OPENSSL_USE_IPV6 && defined(IPV6_MTU)
         case AF_INET6:
-            if ((ret =
-                 getsockopt(b->num, IPPROTO_IPV6, IPV6_MTU,
-                            (void *)&sockopt_val, &sockopt_len)) < 0
+            if ((ret = getsockopt(b->num, IPPROTO_IPV6, IPV6_MTU,
+                     (void *)&sockopt_val, &sockopt_len))
+                    < 0
                 || sockopt_val < 0) {
                 ret = 0;
             } else {
@@ -683,14 +701,14 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
                 ret = data->mtu;
             }
             break;
-#  endif
+#endif
         default:
             ret = 0;
             break;
         }
-# else
+#else
         ret = 0;
-# endif
+#endif
         break;
     case BIO_CTRL_DGRAM_GET_FALLBACK_MTU:
         ret = -dgram_get_mtu_overhead(&data->peer);
@@ -698,20 +716,18 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
         case AF_INET:
             ret += 576;
             break;
-# if OPENSSL_USE_IPV6
-        case AF_INET6:
-            {
-#  ifdef IN6_IS_ADDR_V4MAPPED
-                struct in6_addr tmp_addr;
-                if (BIO_ADDR_rawaddress(&data->peer, &tmp_addr, NULL)
-                    && IN6_IS_ADDR_V4MAPPED(&tmp_addr))
-                    ret += 576;
-                else
-#  endif
-                    ret += 1280;
-            }
-            break;
-# endif
+#if OPENSSL_USE_IPV6
+        case AF_INET6: {
+#ifdef IN6_IS_ADDR_V4MAPPED
+            struct in6_addr tmp_addr;
+            if (BIO_ADDR_rawaddress(&data->peer, &tmp_addr, NULL)
+                && IN6_IS_ADDR_V4MAPPED(&tmp_addr))
+                ret += 576;
+            else
+#endif
+                ret += 1280;
+        } break;
+#endif
         default:
             ret += 576;
             break;
@@ -743,28 +759,26 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
     case BIO_CTRL_DGRAM_SET_PEER:
         BIO_ADDR_make(&data->peer, BIO_ADDR_sockaddr((BIO_ADDR *)ptr));
         break;
-    case BIO_CTRL_DGRAM_DETECT_PEER_ADDR:
-        {
-            BIO_ADDR xaddr, *p = &data->peer;
-            socklen_t xaddr_len = sizeof(xaddr.sa);
+    case BIO_CTRL_DGRAM_DETECT_PEER_ADDR: {
+        BIO_ADDR xaddr, *p = &data->peer;
+        socklen_t xaddr_len = sizeof(xaddr.sa);
 
-            if (BIO_ADDR_family(p) == AF_UNSPEC) {
-                if (getpeername(b->num, (void *)&xaddr.sa, &xaddr_len) == 0
-                    && BIO_ADDR_family(&xaddr) != AF_UNSPEC) {
-                    p = &xaddr;
-                } else {
-                    ret = 0;
-                    break;
-                }
+        if (BIO_ADDR_family(p) == AF_UNSPEC) {
+            if (getpeername(b->num, (void *)&xaddr.sa, &xaddr_len) == 0
+                && BIO_ADDR_family(&xaddr) != AF_UNSPEC) {
+                p = &xaddr;
+            } else {
+                ret = 0;
+                break;
             }
+        }
 
-            ret = BIO_ADDR_sockaddr_size(p);
-            if (num == 0 || num > ret)
-                num = ret;
+        ret = BIO_ADDR_sockaddr_size(p);
+        if (num == 0 || num > ret)
+            num = ret;
 
-            memcpy(ptr, p, (ret = num));
-        }
-        break;
+        memcpy(ptr, p, (ret = num));
+    } break;
     case BIO_C_SET_NBIO:
         if (!BIO_socket_nbio(b->num, num != 0))
             ret = 0;
@@ -772,122 +786,133 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
     case BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT:
         data->next_timeout = ossl_time_from_timeval(*(struct timeval *)ptr);
         break;
-# if defined(SO_RCVTIMEO)
+#if defined(SO_RCVTIMEO)
     case BIO_CTRL_DGRAM_SET_RECV_TIMEOUT:
-#  ifdef OPENSSL_SYS_WINDOWS
-        {
-            struct timeval *tv = (struct timeval *)ptr;
-            int timeout = tv->tv_sec * 1000 + tv->tv_usec / 1000;
+#ifdef OPENSSL_SYS_WINDOWS
+    {
+        struct timeval *tv = (struct timeval *)ptr;
+        int timeout = tv->tv_sec * 1000 + tv->tv_usec / 1000;
 
-            if ((ret = setsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
-                                  (void *)&timeout, sizeof(timeout))) < 0)
-                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
-        }
-#  else
+        if ((ret = setsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
+                 (void *)&timeout, sizeof(timeout)))
+            < 0)
+            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
+                "calling setsockopt()");
+    }
+#else
         if ((ret = setsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO, ptr,
-                              sizeof(struct timeval))) < 0)
+                 sizeof(struct timeval)))
+            < 0)
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
-#  endif
-        break;
-    case BIO_CTRL_DGRAM_GET_RECV_TIMEOUT:
-        {
-#  ifdef OPENSSL_SYS_WINDOWS
-            int sz = 0;
-            int timeout;
-            struct timeval *tv = (struct timeval *)ptr;
+                "calling setsockopt()");
+#endif
+    break;
+    case BIO_CTRL_DGRAM_GET_RECV_TIMEOUT: {
+#ifdef OPENSSL_SYS_WINDOWS
+        int sz = 0;
+        int timeout;
+        struct timeval *tv = (struct timeval *)ptr;
 
-            sz = sizeof(timeout);
-            if ((ret = getsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
-                                  (void *)&timeout, &sz)) < 0) {
-                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling getsockopt()");
-            } else {
-                tv->tv_sec = timeout / 1000;
-                tv->tv_usec = (timeout % 1000) * 1000;
-                ret = sizeof(*tv);
-            }
-#  else
-            socklen_t sz = sizeof(struct timeval);
-            if ((ret = getsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
-                                  ptr, &sz)) < 0) {
-                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling getsockopt()");
-            } else {
-                OPENSSL_assert((size_t)sz <= sizeof(struct timeval));
-                ret = (int)sz;
-            }
-#  endif
+        sz = sizeof(timeout);
+        if ((ret = getsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
+                 (void *)&timeout, &sz))
+            < 0) {
+            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
+                "calling getsockopt()");
+        } else {
+            tv->tv_sec = timeout / 1000;
+            tv->tv_usec = (timeout % 1000) * 1000;
+            ret = sizeof(*tv);
         }
-        break;
-# endif
-# if defined(SO_SNDTIMEO)
-    case BIO_CTRL_DGRAM_SET_SEND_TIMEOUT:
-#  ifdef OPENSSL_SYS_WINDOWS
-        {
-            struct timeval *tv = (struct timeval *)ptr;
-            int timeout = tv->tv_sec * 1000 + tv->tv_usec / 1000;
+#else
+        socklen_t sz = sizeof(struct timeval);
 
-            if ((ret = setsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO,
-                                  (void *)&timeout, sizeof(timeout))) < 0)
-                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
+        if ((ret = getsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO,
+                 ptr, &sz))
+            < 0) {
+            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
+                "calling getsockopt()");
+        } else if (!ossl_assert((size_t)sz == sizeof(struct timeval))) {
+            ERR_raise_data(ERR_LIB_BIO, ERR_R_INTERNAL_ERROR,
+                "Unexpected getsockopt(SO_RCVTIMEO) return size");
+            ret = -1;
+        } else {
+            ret = (int)sz;
         }
-#  else
+#endif
+    } break;
+#endif
+#if defined(SO_SNDTIMEO)
+    case BIO_CTRL_DGRAM_SET_SEND_TIMEOUT:
+#ifdef OPENSSL_SYS_WINDOWS
+    {
+        struct timeval *tv = (struct timeval *)ptr;
+        int timeout = tv->tv_sec * 1000 + tv->tv_usec / 1000;
+
+        if ((ret = setsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO,
+                 (void *)&timeout, sizeof(timeout)))
+            < 0)
+            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
+                "calling setsockopt()");
+    }
+#else
         if ((ret = setsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO, ptr,
-                              sizeof(struct timeval))) < 0)
+                 sizeof(struct timeval)))
+            < 0)
             ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                           "calling setsockopt()");
-#  endif
-        break;
-    case BIO_CTRL_DGRAM_GET_SEND_TIMEOUT:
-        {
-#  ifdef OPENSSL_SYS_WINDOWS
-            int sz = 0;
-            int timeout;
-            struct timeval *tv = (struct timeval *)ptr;
+                "calling setsockopt()");
+#endif
+    break;
+    case BIO_CTRL_DGRAM_GET_SEND_TIMEOUT: {
+#ifdef OPENSSL_SYS_WINDOWS
+        int sz = 0;
+        int timeout;
+        struct timeval *tv = (struct timeval *)ptr;
 
-            sz = sizeof(timeout);
-            if ((ret = getsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO,
-                                  (void *)&timeout, &sz)) < 0) {
-                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling getsockopt()");
-            } else {
-                tv->tv_sec = timeout / 1000;
-                tv->tv_usec = (timeout % 1000) * 1000;
-                ret = sizeof(*tv);
-            }
-#  else
-            socklen_t sz = sizeof(struct timeval);
+        sz = sizeof(timeout);
+        if ((ret = getsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO,
+                 (void *)&timeout, &sz))
+            < 0) {
+            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
+                "calling getsockopt()");
+        } else {
+            tv->tv_sec = timeout / 1000;
+            tv->tv_usec = (timeout % 1000) * 1000;
+            ret = sizeof(*tv);
+        }
+#else
+        socklen_t sz = sizeof(struct timeval);
 
-            if ((ret = getsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO,
-                                  ptr, &sz)) < 0) {
-                ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling getsockopt()");
-            } else {
-                OPENSSL_assert((size_t)sz <= sizeof(struct timeval));
-                ret = (int)sz;
-            }
-#  endif
+        if ((ret = getsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO,
+                 ptr, &sz))
+            < 0) {
+            ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
+                "calling getsockopt()");
+        } else if (!ossl_assert((size_t)sz == sizeof(struct timeval))) {
+            ERR_raise_data(ERR_LIB_BIO, ERR_R_INTERNAL_ERROR,
+                "Unexpected getsockopt(SO_SNDTIMEO) return size");
+            ret = -1;
+        } else {
+            ret = (int)sz;
         }
-        break;
-# endif
+#endif
+    } break;
+#endif
     case BIO_CTRL_DGRAM_GET_SEND_TIMER_EXP:
         /* fall-through */
     case BIO_CTRL_DGRAM_GET_RECV_TIMER_EXP:
-# ifdef OPENSSL_SYS_WINDOWS
+#ifdef OPENSSL_SYS_WINDOWS
         d_errno = (data->_errno == WSAETIMEDOUT);
-# else
+#else
         d_errno = (data->_errno == EAGAIN);
-# endif
+#endif
         if (d_errno) {
             ret = 1;
             data->_errno = 0;
         } else
             ret = 0;
         break;
-# ifdef EMSGSIZE
+#ifdef EMSGSIZE
     case BIO_CTRL_DGRAM_MTU_EXCEEDED:
         if (data->_errno == EMSGSIZE) {
             ret = 1;
@@ -895,54 +920,59 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
         } else
             ret = 0;
         break;
-# endif
+#endif
     case BIO_CTRL_DGRAM_SET_DONT_FRAG:
         switch (data->peer.sa.sa_family) {
         case AF_INET:
-# if defined(IP_DONTFRAG)
+#if defined(IP_DONTFRAG)
             sockopt_val = num ? 1 : 0;
             if ((ret = setsockopt(b->num, IPPROTO_IP, IP_DONTFRAG,
-                                  &sockopt_val, sizeof(sockopt_val))) < 0)
+                     &sockopt_val, sizeof(sockopt_val)))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
-# elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER) && defined (IP_PMTUDISC_PROBE)
+                    "calling setsockopt()");
+#elif defined(OPENSSL_SYS_LINUX) && defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_PROBE)
             sockopt_val = num ? IP_PMTUDISC_PROBE : IP_PMTUDISC_DONT;
             if ((ret = setsockopt(b->num, IPPROTO_IP, IP_MTU_DISCOVER,
-                                  &sockopt_val, sizeof(sockopt_val))) < 0)
+                     &sockopt_val, sizeof(sockopt_val)))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
-# elif defined(OPENSSL_SYS_WINDOWS) && defined(IP_DONTFRAGMENT)
+                    "calling setsockopt()");
+#elif defined(OPENSSL_SYS_WINDOWS) && defined(IP_DONTFRAGMENT)
             sockopt_val = num ? 1 : 0;
             if ((ret = setsockopt(b->num, IPPROTO_IP, IP_DONTFRAGMENT,
-                                  (const char *)&sockopt_val,
-                                  sizeof(sockopt_val))) < 0)
+                     (const char *)&sockopt_val,
+                     sizeof(sockopt_val)))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
-# else
+                    "calling setsockopt()");
+#else
             ret = -1;
-# endif
+#endif
             break;
-# if OPENSSL_USE_IPV6
+#if OPENSSL_USE_IPV6
         case AF_INET6:
-#  if defined(IPV6_DONTFRAG)
+#if defined(IPV6_DONTFRAG)
             sockopt_val = num ? 1 : 0;
             if ((ret = setsockopt(b->num, IPPROTO_IPV6, IPV6_DONTFRAG,
-                                  (const void *)&sockopt_val,
-                                  sizeof(sockopt_val))) < 0)
+                     (const void *)&sockopt_val,
+                     sizeof(sockopt_val)))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
+                    "calling setsockopt()");
 
-#  elif defined(OPENSSL_SYS_LINUX) && defined(IPV6_MTUDISCOVER)
-            sockopt_val = num ? IP_PMTUDISC_PROBE : IP_PMTUDISC_DONT;
+#elif defined(OPENSSL_SYS_LINUX) && defined(IPV6_MTU_DISCOVER)
+            sockopt_val = num ? IPV6_PMTUDISC_PROBE : IPV6_PMTUDISC_DONT;
             if ((ret = setsockopt(b->num, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
-                                  &sockopt_val, sizeof(sockopt_val))) < 0)
+                     &sockopt_val, sizeof(sockopt_val)))
+                < 0)
                 ERR_raise_data(ERR_LIB_SYS, get_last_socket_error(),
-                               "calling setsockopt()");
-#  else
+                    "calling setsockopt()");
+#else
             ret = -1;
-#  endif
+#endif
             break;
-# endif
+#endif
         default:
             ret = -1;
             break;
@@ -965,15 +995,15 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
         break;
 
     case BIO_CTRL_DGRAM_GET_LOCAL_ADDR_CAP:
-# if defined(SUPPORT_LOCAL_ADDR)
+#if defined(SUPPORT_LOCAL_ADDR)
         ret = 1;
-# else
+#else
         ret = 0;
-# endif
+#endif
         break;
 
     case BIO_CTRL_DGRAM_SET_LOCAL_ADDR_ENABLE:
-# if defined(SUPPORT_LOCAL_ADDR)
+#if defined(SUPPORT_LOCAL_ADDR)
         num = num > 0;
         if (num != data->local_addr_enabled) {
             if (enable_local_addr(b, num) < 1) {
@@ -983,9 +1013,9 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
 
             data->local_addr_enabled = (char)num;
         }
-# else
+#else
         ret = 0;
-# endif
+#endif
         break;
 
     case BIO_CTRL_DGRAM_GET_LOCAL_ADDR_ENABLE:
@@ -994,20 +1024,18 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
 
     case BIO_CTRL_DGRAM_GET_EFFECTIVE_CAPS:
         ret = (long)(BIO_DGRAM_CAP_HANDLES_DST_ADDR
-                     | BIO_DGRAM_CAP_HANDLES_SRC_ADDR
-                     | BIO_DGRAM_CAP_PROVIDES_DST_ADDR
-                     | BIO_DGRAM_CAP_PROVIDES_SRC_ADDR);
+            | BIO_DGRAM_CAP_HANDLES_SRC_ADDR
+            | BIO_DGRAM_CAP_PROVIDES_DST_ADDR
+            | BIO_DGRAM_CAP_PROVIDES_SRC_ADDR);
         break;
 
     case BIO_CTRL_GET_RPOLL_DESCRIPTOR:
-    case BIO_CTRL_GET_WPOLL_DESCRIPTOR:
-        {
-            BIO_POLL_DESCRIPTOR *pd = ptr;
+    case BIO_CTRL_GET_WPOLL_DESCRIPTOR: {
+        BIO_POLL_DESCRIPTOR *pd = ptr;
 
-            pd->type        = BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD;
-            pd->value.fd    = b->num;
-        }
-        break;
+        pd->type = BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD;
+        pd->value.fd = b->num;
+    } break;
 
     default:
         ret = 0;
@@ -1028,9 +1056,9 @@ static int dgram_puts(BIO *bp, const char *str)
     return ret;
 }
 
-# if M_METHOD == M_METHOD_WSARECVMSG
+#if M_METHOD == M_METHOD_WSARECVMSG
 static void translate_msg_win(BIO *b, WSAMSG *mh, WSABUF *iov,
-                              unsigned char *control, BIO_MSG *msg)
+    unsigned char *control, BIO_MSG *msg)
 {
     iov->len = msg->data_len;
     iov->buf = msg->data;
@@ -1039,10 +1067,10 @@ static void translate_msg_win(BIO *b, WSAMSG *mh, WSABUF *iov,
     mh->name = msg->peer != NULL ? &msg->peer->sa : NULL;
     if (msg->peer != NULL && dgram_get_sock_family(b) == AF_INET)
         mh->namelen = sizeof(struct sockaddr_in);
-#  if OPENSSL_USE_IPV6
+#if OPENSSL_USE_IPV6
     else if (msg->peer != NULL && dgram_get_sock_family(b) == AF_INET6)
         mh->namelen = sizeof(struct sockaddr_in6);
-#  endif
+#endif
     else
         mh->namelen = 0;
 
@@ -1053,23 +1081,23 @@ static void translate_msg_win(BIO *b, WSAMSG *mh, WSABUF *iov,
      * the control buffer even if we aren't actually going to examine the
      * result.
      */
-    mh->lpBuffers       = iov;
-    mh->dwBufferCount   = 1;
-    mh->Control.len     = BIO_CMSG_ALLOC_LEN;
-    mh->Control.buf     = control;
-    mh->dwFlags         = 0;
+    mh->lpBuffers = iov;
+    mh->dwBufferCount = 1;
+    mh->Control.len = BIO_CMSG_ALLOC_LEN;
+    mh->Control.buf = control;
+    mh->dwFlags = 0;
 }
-# endif
+#endif
 
-# if M_METHOD == M_METHOD_RECVMMSG || M_METHOD == M_METHOD_RECVMSG
+#if M_METHOD == M_METHOD_RECVMMSG || M_METHOD == M_METHOD_RECVMSG
 /* Translates a BIO_MSG to a msghdr and iovec. */
 static void translate_msg(BIO *b, struct msghdr *mh, struct iovec *iov,
-                          unsigned char *control, BIO_MSG *msg)
+    unsigned char *control, BIO_MSG *msg)
 {
     bio_dgram_data *data;
 
     iov->iov_base = msg->data;
-    iov->iov_len  = msg->data_len;
+    iov->iov_len = msg->data_len;
 
     data = (bio_dgram_data *)b->ptr;
     if (data->connected == 0) {
@@ -1077,10 +1105,10 @@ static void translate_msg(BIO *b, struct msghdr *mh, struct iovec *iov,
         mh->msg_name = msg->peer != NULL ? &msg->peer->sa : NULL;
         if (msg->peer != NULL && dgram_get_sock_family(b) == AF_INET)
             mh->msg_namelen = sizeof(struct sockaddr_in);
-#  if OPENSSL_USE_IPV6
+#if OPENSSL_USE_IPV6
         else if (msg->peer != NULL && dgram_get_sock_family(b) == AF_INET6)
             mh->msg_namelen = sizeof(struct sockaddr_in6);
-#  endif
+#endif
         else
             mh->msg_namelen = 0;
     } else {
@@ -1088,108 +1116,107 @@ static void translate_msg(BIO *b, struct msghdr *mh, struct iovec *iov,
         mh->msg_namelen = 0;
     }
 
-    mh->msg_iov         = iov;
-    mh->msg_iovlen      = 1;
-    mh->msg_control     = msg->local != NULL ? control : NULL;
-    mh->msg_controllen  = msg->local != NULL ? BIO_CMSG_ALLOC_LEN : 0;
-    mh->msg_flags       = 0;
+    mh->msg_iov = iov;
+    mh->msg_iovlen = 1;
+    mh->msg_control = msg->local != NULL ? control : NULL;
+    mh->msg_controllen = msg->local != NULL ? BIO_CMSG_ALLOC_LEN : 0;
+    mh->msg_flags = 0;
 }
-# endif
+#endif
 
-# if M_METHOD == M_METHOD_RECVMMSG || M_METHOD == M_METHOD_RECVMSG || M_METHOD == M_METHOD_WSARECVMSG
+#if M_METHOD == M_METHOD_RECVMMSG || M_METHOD == M_METHOD_RECVMSG || M_METHOD == M_METHOD_WSARECVMSG
 /* Extracts destination address from the control buffer. */
-static int extract_local(BIO *b, MSGHDR_TYPE *mh, BIO_ADDR *local) {
-#  if defined(IP_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IPV6_PKTINFO)
+static int extract_local(BIO *b, MSGHDR_TYPE *mh, BIO_ADDR *local)
+{
+#if defined(IP_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IPV6_PKTINFO)
     CMSGHDR_TYPE *cmsg;
     int af = dgram_get_sock_family(b);
 
     for (cmsg = BIO_CMSG_FIRSTHDR(mh); cmsg != NULL;
-         cmsg = BIO_CMSG_NXTHDR(mh, cmsg)) {
+        cmsg = BIO_CMSG_NXTHDR(mh, cmsg)) {
         if (af == AF_INET) {
             if (cmsg->cmsg_level != IPPROTO_IP)
                 continue;
 
-#   if defined(IP_PKTINFO)
+#if defined(IP_PKTINFO)
             if (cmsg->cmsg_type != IP_PKTINFO)
                 continue;
 
-            local->s_in.sin_addr =
-                ((struct in_pktinfo *)BIO_CMSG_DATA(cmsg))->ipi_addr;
+            local->s_in.sin_addr = ((struct in_pktinfo *)BIO_CMSG_DATA(cmsg))->ipi_addr;
 
-#   elif defined(IP_RECVDSTADDR)
+#elif defined(IP_RECVDSTADDR)
             if (cmsg->cmsg_type != IP_RECVDSTADDR)
                 continue;
 
             local->s_in.sin_addr = *(struct in_addr *)BIO_CMSG_DATA(cmsg);
-#   endif
+#endif
 
-#   if defined(IP_PKTINFO) || defined(IP_RECVDSTADDR)
+#if defined(IP_PKTINFO) || defined(IP_RECVDSTADDR)
             {
                 bio_dgram_data *data = b->ptr;
 
                 local->s_in.sin_family = AF_INET;
-                local->s_in.sin_port   = data->local_addr.s_in.sin_port;
+                local->s_in.sin_port = data->local_addr.s_in.sin_port;
             }
             return 1;
-#   endif
+#endif
         }
-#   if OPENSSL_USE_IPV6
+#if OPENSSL_USE_IPV6
         else if (af == AF_INET6) {
             if (cmsg->cmsg_level != IPPROTO_IPV6)
                 continue;
 
-#    if defined(IPV6_RECVPKTINFO)
+#if defined(IPV6_RECVPKTINFO)
             if (cmsg->cmsg_type != IPV6_PKTINFO)
                 continue;
 
             {
                 bio_dgram_data *data = b->ptr;
 
-                local->s_in6.sin6_addr     =
-                    ((struct in6_pktinfo *)BIO_CMSG_DATA(cmsg))->ipi6_addr;
-                local->s_in6.sin6_family   = AF_INET6;
-                local->s_in6.sin6_port     = data->local_addr.s_in6.sin6_port;
-                local->s_in6.sin6_scope_id =
-                    data->local_addr.s_in6.sin6_scope_id;
+                local->s_in6.sin6_addr = ((struct in6_pktinfo *)BIO_CMSG_DATA(cmsg))->ipi6_addr;
+                local->s_in6.sin6_family = AF_INET6;
+                local->s_in6.sin6_port = data->local_addr.s_in6.sin6_port;
+                local->s_in6.sin6_scope_id = data->local_addr.s_in6.sin6_scope_id;
                 local->s_in6.sin6_flowinfo = 0;
             }
             return 1;
-#    endif
+#endif
         }
-#   endif
+#endif
     }
-#  endif
+#endif
 
     return 0;
 }
 
-static int pack_local(BIO *b, MSGHDR_TYPE *mh, const BIO_ADDR *local) {
+static int pack_local(BIO *b, MSGHDR_TYPE *mh, const BIO_ADDR *local)
+{
     int af = dgram_get_sock_family(b);
-#  if defined(IP_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IPV6_PKTINFO)
+#if defined(IP_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IPV6_PKTINFO)
     CMSGHDR_TYPE *cmsg;
     bio_dgram_data *data = b->ptr;
-#  endif
+#endif
 
     if (af == AF_INET) {
-#  if defined(IP_PKTINFO)
+#if defined(IP_PKTINFO)
         struct in_pktinfo *info;
 
-#   if defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_WINDOWS)
         cmsg = (CMSGHDR_TYPE *)mh->Control.buf;
-#   else
+#else
         cmsg = (CMSGHDR_TYPE *)mh->msg_control;
-#   endif
+#endif
 
-        cmsg->cmsg_len   = BIO_CMSG_LEN(sizeof(struct in_pktinfo));
+        cmsg->cmsg_len = BIO_CMSG_LEN(sizeof(struct in_pktinfo));
         cmsg->cmsg_level = IPPROTO_IP;
-        cmsg->cmsg_type  = IP_PKTINFO;
+        cmsg->cmsg_type = IP_PKTINFO;
 
         info = (struct in_pktinfo *)BIO_CMSG_DATA(cmsg);
-#   if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_CYGWIN) && !defined(__FreeBSD__) && !defined(__QNX__)
-        info->ipi_spec_dst      = local->s_in.sin_addr;
-#   endif
-        info->ipi_addr.s_addr   = 0;
-        info->ipi_ifindex       = 0;
+#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_CYGWIN) && !defined(__FreeBSD__) && !defined(__QNX__)
+        info->ipi_spec_dst = local->s_in.sin_addr;
+#endif
+        info->ipi_addr.s_addr = 0;
+        info->ipi_ifindex = 0;
 
         /*
          * We cannot override source port using this API, therefore
@@ -1203,14 +1230,14 @@ static int pack_local(BIO *b, MSGHDR_TYPE *mh, const BIO_ADDR *local) {
             return 0;
         }
 
-#   if defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_WINDOWS)
         mh->Control.len = BIO_CMSG_SPACE(sizeof(struct in_pktinfo));
-#   else
+#else
         mh->msg_controllen = BIO_CMSG_SPACE(sizeof(struct in_pktinfo));
-#   endif
+#endif
         return 1;
 
-#  elif defined(IP_SENDSRCADDR)
+#elif defined(IP_SENDSRCADDR)
         struct in_addr *info;
 
         /*
@@ -1221,15 +1248,15 @@ static int pack_local(BIO *b, MSGHDR_TYPE *mh, const BIO_ADDR *local) {
          * BSD thing, so we don't need an explicit test for BSD here.
          */
         if (local->s_in.sin_addr.s_addr == data->local_addr.s_in.sin_addr.s_addr) {
-            mh->msg_control    = NULL;
+            mh->msg_control = NULL;
             mh->msg_controllen = 0;
             return 1;
         }
 
         cmsg = (struct cmsghdr *)mh->msg_control;
-        cmsg->cmsg_len   = BIO_CMSG_LEN(sizeof(struct in_addr));
+        cmsg->cmsg_len = BIO_CMSG_LEN(sizeof(struct in_addr));
         cmsg->cmsg_level = IPPROTO_IP;
-        cmsg->cmsg_type  = IP_SENDSRCADDR;
+        cmsg->cmsg_type = IP_SENDSRCADDR;
 
         info = (struct in_addr *)BIO_CMSG_DATA(cmsg);
         *info = local->s_in.sin_addr;
@@ -1243,25 +1270,25 @@ static int pack_local(BIO *b, MSGHDR_TYPE *mh, const BIO_ADDR *local) {
 
         mh->msg_controllen = BIO_CMSG_SPACE(sizeof(struct in_addr));
         return 1;
-#  endif
+#endif
     }
-#  if OPENSSL_USE_IPV6
+#if OPENSSL_USE_IPV6
     else if (af == AF_INET6) {
-#   if defined(IPV6_PKTINFO)
+#if defined(IPV6_PKTINFO)
         struct in6_pktinfo *info;
 
-#    if defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_WINDOWS)
         cmsg = (CMSGHDR_TYPE *)mh->Control.buf;
-#    else
+#else
         cmsg = (CMSGHDR_TYPE *)mh->msg_control;
-#    endif
-        cmsg->cmsg_len   = BIO_CMSG_LEN(sizeof(struct in6_pktinfo));
+#endif
+        cmsg->cmsg_len = BIO_CMSG_LEN(sizeof(struct in6_pktinfo));
         cmsg->cmsg_level = IPPROTO_IPV6;
-        cmsg->cmsg_type  = IPV6_PKTINFO;
+        cmsg->cmsg_type = IPV6_PKTINFO;
 
         info = (struct in6_pktinfo *)BIO_CMSG_DATA(cmsg);
-        info->ipi6_addr     = local->s_in6.sin6_addr;
-        info->ipi6_ifindex  = 0;
+        info->ipi6_addr = local->s_in6.sin6_addr;
+        info->ipi6_ifindex = 0;
 
         /*
          * See comment above, but also applies to the other fields
@@ -1279,39 +1306,40 @@ static int pack_local(BIO *b, MSGHDR_TYPE *mh, const BIO_ADDR *local) {
             return 0;
         }
 
-#    if defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_WINDOWS)
         mh->Control.len = BIO_CMSG_SPACE(sizeof(struct in6_pktinfo));
-#    else
+#else
         mh->msg_controllen = BIO_CMSG_SPACE(sizeof(struct in6_pktinfo));
-#    endif
+#endif
         return 1;
-#   endif
+#endif
     }
-#  endif
+#endif
 
     return 0;
 }
-# endif
+#endif
 
 /*
  * Converts flags passed to BIO_sendmmsg or BIO_recvmmsg to syscall flags. You
  * should mask out any system flags returned by this function you cannot support
  * in a particular circumstance. Currently no flags are defined.
  */
-# if M_METHOD != M_METHOD_NONE
-static int translate_flags(uint64_t flags) {
+#if M_METHOD != M_METHOD_NONE
+static int translate_flags(uint64_t flags)
+{
     return 0;
 }
-# endif
+#endif
 
 static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
-                          size_t num_msg, uint64_t flags, size_t *num_processed)
+    size_t num_msg, uint64_t flags, size_t *num_processed)
 {
-# if M_METHOD != M_METHOD_NONE && M_METHOD != M_METHOD_RECVMSG
+#if M_METHOD != M_METHOD_NONE && M_METHOD != M_METHOD_RECVMSG
     int ret;
-# endif
-# if M_METHOD == M_METHOD_RECVMMSG
-#  define BIO_MAX_MSGS_PER_CALL   64
+#endif
+#if M_METHOD == M_METHOD_RECVMMSG
+#define BIO_MAX_MSGS_PER_CALL 64
     int sysflags;
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
     size_t i;
@@ -1319,7 +1347,7 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
     struct iovec iov[BIO_MAX_MSGS_PER_CALL];
     unsigned char control[BIO_MAX_MSGS_PER_CALL][BIO_CMSG_ALLOC_LEN];
     int have_local_enabled = data->local_addr_enabled;
-# elif M_METHOD == M_METHOD_RECVMSG
+#elif M_METHOD == M_METHOD_RECVMSG
     int sysflags;
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
     ossl_ssize_t l;
@@ -1327,17 +1355,17 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
     struct iovec iov;
     unsigned char control[BIO_CMSG_ALLOC_LEN];
     int have_local_enabled = data->local_addr_enabled;
-# elif M_METHOD == M_METHOD_WSARECVMSG
+#elif M_METHOD == M_METHOD_WSARECVMSG
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
     int have_local_enabled = data->local_addr_enabled;
     WSAMSG wmsg;
     WSABUF wbuf;
     DWORD num_bytes_sent = 0;
     unsigned char control[BIO_CMSG_ALLOC_LEN];
-# endif
-# if M_METHOD == M_METHOD_RECVFROM || M_METHOD == M_METHOD_WSARECVMSG
+#endif
+#if M_METHOD == M_METHOD_RECVFROM || M_METHOD == M_METHOD_WSARECVMSG
     int sysflags;
-# endif
+#endif
 
     if (num_msg == 0) {
         *num_processed = 0;
@@ -1347,11 +1375,11 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
     if (num_msg > OSSL_SSIZE_MAX)
         num_msg = OSSL_SSIZE_MAX;
 
-# if M_METHOD != M_METHOD_NONE
+#if M_METHOD != M_METHOD_NONE
     sysflags = translate_flags(flags);
-# endif
+#endif
 
-# if M_METHOD == M_METHOD_RECVMMSG
+#if M_METHOD == M_METHOD_RECVMMSG
     /*
      * In the sendmmsg/recvmmsg case, we need to allocate our translated struct
      * msghdr and struct iovec on the stack to support multithreaded use. Thus
@@ -1364,7 +1392,7 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
 
     for (i = 0; i < num_msg; ++i) {
         translate_msg(b, &mh[i].msg_hdr, &iov[i],
-                      control[i], &BIO_MSG_N(msg, stride, i));
+            control[i], &BIO_MSG_N(msg, stride, i));
 
         /* If local address was requested, it must have been enabled */
         if (BIO_MSG_N(msg, stride, i).local != NULL) {
@@ -1375,7 +1403,8 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
             }
 
             if (pack_local(b, &mh[i].msg_hdr,
-                           BIO_MSG_N(msg, stride, i).local) < 1) {
+                    BIO_MSG_N(msg, stride, i).local)
+                < 1) {
                 ERR_raise(ERR_LIB_BIO, BIO_R_LOCAL_ADDR_NOT_AVAILABLE);
                 *num_processed = 0;
                 return 0;
@@ -1393,13 +1422,13 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
 
     for (i = 0; i < (size_t)ret; ++i) {
         BIO_MSG_N(msg, stride, i).data_len = mh[i].msg_len;
-        BIO_MSG_N(msg, stride, i).flags    = 0;
+        BIO_MSG_N(msg, stride, i).flags = 0;
     }
 
     *num_processed = (size_t)ret;
     return 1;
 
-# elif M_METHOD == M_METHOD_RECVMSG
+#elif M_METHOD == M_METHOD_RECVMSG
     /*
      * If sendmsg is available, use it.
      */
@@ -1426,13 +1455,13 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
         return 0;
     }
 
-    msg->data_len   = (size_t)l;
-    msg->flags      = 0;
-    *num_processed  = 1;
+    msg->data_len = (size_t)l;
+    msg->flags = 0;
+    *num_processed = 1;
     return 1;
 
-# elif M_METHOD == M_METHOD_WSARECVMSG || M_METHOD == M_METHOD_RECVFROM
-#  if M_METHOD == M_METHOD_WSARECVMSG
+#elif M_METHOD == M_METHOD_WSARECVMSG || M_METHOD == M_METHOD_RECVFROM
+#if M_METHOD == M_METHOD_WSARECVMSG
     if (bio_WSASendMsg != NULL) {
         /* WSASendMsg-based implementation for Windows. */
         translate_msg_win(b, &wmsg, &wbuf, control, msg);
@@ -1459,11 +1488,11 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
         }
 
         msg[0].data_len = num_bytes_sent;
-        msg[0].flags    = 0;
-        *num_processed  = 1;
+        msg[0].flags = 0;
+        *num_processed = 1;
         return 1;
     }
-#  endif
+#endif
 
     /*
      * Fallback to sendto and send a single message.
@@ -1479,14 +1508,14 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
     }
 
     ret = sendto(b->num, msg[0].data,
-#  if defined(OPENSSL_SYS_WINDOWS)
-                 (int)msg[0].data_len,
-#  else
-                 msg[0].data_len,
-#  endif
-                 sysflags,
-                 msg[0].peer != NULL ? BIO_ADDR_sockaddr(msg[0].peer) : NULL,
-                 msg[0].peer != NULL ? BIO_ADDR_sockaddr_size(msg[0].peer) : 0);
+#if defined(OPENSSL_SYS_WINDOWS)
+        (int)msg[0].data_len,
+#else
+        msg[0].data_len,
+#endif
+        sysflags,
+        msg[0].peer != NULL ? BIO_ADDR_sockaddr(msg[0].peer) : NULL,
+        msg[0].peer != NULL ? BIO_ADDR_sockaddr_size(msg[0].peer) : 0);
     if (ret <= 0) {
         ERR_raise(ERR_LIB_SYS, get_last_socket_error());
         *num_processed = 0;
@@ -1494,25 +1523,25 @@ static int dgram_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
     }
 
     msg[0].data_len = ret;
-    msg[0].flags    = 0;
-    *num_processed  = 1;
+    msg[0].flags = 0;
+    *num_processed = 1;
     return 1;
 
-# else
+#else
     ERR_raise(ERR_LIB_BIO, BIO_R_UNSUPPORTED_METHOD);
     *num_processed = 0;
     return 0;
-# endif
+#endif
 }
 
 static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
-                          size_t stride, size_t num_msg,
-                          uint64_t flags, size_t *num_processed)
+    size_t stride, size_t num_msg,
+    uint64_t flags, size_t *num_processed)
 {
-# if M_METHOD != M_METHOD_NONE && M_METHOD != M_METHOD_RECVMSG
+#if M_METHOD != M_METHOD_NONE && M_METHOD != M_METHOD_RECVMSG
     int ret;
-# endif
-# if M_METHOD == M_METHOD_RECVMMSG
+#endif
+#if M_METHOD == M_METHOD_RECVMMSG
     int sysflags;
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
     size_t i;
@@ -1520,7 +1549,7 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
     struct iovec iov[BIO_MAX_MSGS_PER_CALL];
     unsigned char control[BIO_MAX_MSGS_PER_CALL][BIO_CMSG_ALLOC_LEN];
     int have_local_enabled = data->local_addr_enabled;
-# elif M_METHOD == M_METHOD_RECVMSG
+#elif M_METHOD == M_METHOD_RECVMSG
     int sysflags;
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
     ossl_ssize_t l;
@@ -1528,18 +1557,18 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
     struct iovec iov;
     unsigned char control[BIO_CMSG_ALLOC_LEN];
     int have_local_enabled = data->local_addr_enabled;
-# elif M_METHOD == M_METHOD_WSARECVMSG
+#elif M_METHOD == M_METHOD_WSARECVMSG
     bio_dgram_data *data = (bio_dgram_data *)b->ptr;
     int have_local_enabled = data->local_addr_enabled;
     WSAMSG wmsg;
     WSABUF wbuf;
     DWORD num_bytes_received = 0;
     unsigned char control[BIO_CMSG_ALLOC_LEN];
-# endif
-# if M_METHOD == M_METHOD_RECVFROM || M_METHOD == M_METHOD_WSARECVMSG
+#endif
+#if M_METHOD == M_METHOD_RECVFROM || M_METHOD == M_METHOD_WSARECVMSG
     int sysflags;
     socklen_t slen;
-# endif
+#endif
 
     if (num_msg == 0) {
         *num_processed = 0;
@@ -1549,11 +1578,11 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
     if (num_msg > OSSL_SSIZE_MAX)
         num_msg = OSSL_SSIZE_MAX;
 
-# if M_METHOD != M_METHOD_NONE
+#if M_METHOD != M_METHOD_NONE
     sysflags = translate_flags(flags);
-# endif
+#endif
 
-# if M_METHOD == M_METHOD_RECVMMSG
+#if M_METHOD == M_METHOD_RECVMMSG
     /*
      * In the sendmmsg/recvmmsg case, we need to allocate our translated struct
      * msghdr and struct iovec on the stack to support multithreaded use. Thus
@@ -1566,7 +1595,7 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
 
     for (i = 0; i < num_msg; ++i) {
         translate_msg(b, &mh[i].msg_hdr, &iov[i],
-                      control[i], &BIO_MSG_N(msg, stride, i));
+            control[i], &BIO_MSG_N(msg, stride, i));
 
         /* If local address was requested, it must have been enabled */
         if (BIO_MSG_N(msg, stride, i).local != NULL && !have_local_enabled) {
@@ -1586,27 +1615,28 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
 
     for (i = 0; i < (size_t)ret; ++i) {
         BIO_MSG_N(msg, stride, i).data_len = mh[i].msg_len;
-        BIO_MSG_N(msg, stride, i).flags    = 0;
+        BIO_MSG_N(msg, stride, i).flags = 0;
         /*
          * *(msg->peer) will have been filled in by recvmmsg;
          * for msg->local we parse the control data returned
          */
         if (BIO_MSG_N(msg, stride, i).local != NULL)
             if (extract_local(b, &mh[i].msg_hdr,
-                              BIO_MSG_N(msg, stride, i).local) < 1)
+                    BIO_MSG_N(msg, stride, i).local)
+                < 1)
                 /*
                  * It appears BSDs do not support local addresses for
                  * loopback sockets. In this case, just clear the local
                  * address, as for OS X and Windows in some circumstances
                  * (see below).
                  */
-                BIO_ADDR_clear(msg->local);
+                BIO_ADDR_clear(BIO_MSG_N(msg, stride, i).local);
     }
 
     *num_processed = (size_t)ret;
     return 1;
 
-# elif M_METHOD == M_METHOD_RECVMSG
+#elif M_METHOD == M_METHOD_RECVMSG
     /*
      * If recvmsg is available, use it.
      */
@@ -1630,8 +1660,8 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
         return 0;
     }
 
-    msg->data_len   = (size_t)l;
-    msg->flags      = 0;
+    msg->data_len = (size_t)l;
+    msg->flags = 0;
 
     if (msg->local != NULL)
         if (extract_local(b, &mh, msg->local) < 1)
@@ -1661,8 +1691,8 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
     *num_processed = 1;
     return 1;
 
-# elif M_METHOD == M_METHOD_RECVFROM || M_METHOD == M_METHOD_WSARECVMSG
-#  if M_METHOD == M_METHOD_WSARECVMSG
+#elif M_METHOD == M_METHOD_RECVFROM || M_METHOD == M_METHOD_WSARECVMSG
+#if M_METHOD == M_METHOD_WSARECVMSG
     if (bio_WSARecvMsg != NULL) {
         /* WSARecvMsg-based implementation for Windows. */
         translate_msg_win(b, &wmsg, &wbuf, control, msg);
@@ -1682,7 +1712,7 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
         }
 
         msg[0].data_len = num_bytes_received;
-        msg[0].flags    = 0;
+        msg[0].flags = 0;
         if (msg[0].local != NULL)
             if (extract_local(b, &wmsg, msg[0].local) < 1)
                 /*
@@ -1706,7 +1736,7 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
         *num_processed = 1;
         return 1;
     }
-#  endif
+#endif
 
     /*
      * Fallback to recvfrom and receive a single message.
@@ -1723,32 +1753,33 @@ static int dgram_recvmmsg(BIO *b, BIO_MSG *msg,
 
     slen = sizeof(*msg[0].peer);
     ret = recvfrom(b->num, msg[0].data,
-#  if defined(OPENSSL_SYS_WINDOWS)
-                   (int)msg[0].data_len,
-#  else
-                   msg[0].data_len,
-#  endif
-                   sysflags,
-                   msg[0].peer != NULL ? &msg[0].peer->sa : NULL,
-                   msg[0].peer != NULL ? &slen : NULL);
+#if defined(OPENSSL_SYS_WINDOWS)
+        (int)msg[0].data_len,
+#else
+        msg[0].data_len,
+#endif
+        sysflags,
+        msg[0].peer != NULL ? &msg[0].peer->sa : NULL,
+        msg[0].peer != NULL ? &slen : NULL);
     if (ret <= 0) {
         ERR_raise(ERR_LIB_SYS, get_last_socket_error());
+        *num_processed = 0;
         return 0;
     }
 
     msg[0].data_len = ret;
-    msg[0].flags    = 0;
+    msg[0].flags = 0;
     *num_processed = 1;
     return 1;
 
-# else
+#else
     ERR_raise(ERR_LIB_BIO, BIO_R_UNSUPPORTED_METHOD);
     *num_processed = 0;
     return 0;
-# endif
+#endif
 }
 
-# ifndef OPENSSL_NO_SCTP
+#ifndef OPENSSL_NO_SCTP
 const BIO_METHOD *BIO_s_datagram_sctp(void)
 {
     return &methods_dgramp_sctp;
@@ -1763,13 +1794,13 @@ BIO *BIO_new_dgram_sctp(int fd, int close_flag)
     struct sctp_authchunk auth;
     struct sctp_authchunks *authchunks;
     socklen_t sockopt_len;
-#  ifdef SCTP_AUTHENTICATION_EVENT
-#   ifdef SCTP_EVENT
+#ifdef SCTP_AUTHENTICATION_EVENT
+#ifdef SCTP_EVENT
     struct sctp_event event;
-#   else
+#else
     struct sctp_event_subscribe event;
-#   endif
-#  endif
+#endif
+#endif
 
     bio = BIO_new(BIO_s_datagram_sctp());
     if (bio == NULL)
@@ -1778,23 +1809,21 @@ BIO *BIO_new_dgram_sctp(int fd, int close_flag)
 
     /* Activate SCTP-AUTH for DATA and FORWARD-TSN chunks */
     auth.sauth_chunk = OPENSSL_SCTP_DATA_CHUNK_TYPE;
-    ret =
-        setsockopt(fd, IPPROTO_SCTP, SCTP_AUTH_CHUNK, &auth,
-                   sizeof(struct sctp_authchunk));
+    ret = setsockopt(fd, IPPROTO_SCTP, SCTP_AUTH_CHUNK, &auth,
+        sizeof(struct sctp_authchunk));
     if (ret < 0) {
         BIO_vfree(bio);
         ERR_raise_data(ERR_LIB_BIO, ERR_R_SYS_LIB,
-                       "Ensure SCTP AUTH chunks are enabled in kernel");
+            "Ensure SCTP AUTH chunks are enabled in kernel");
         return NULL;
     }
     auth.sauth_chunk = OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE;
-    ret =
-        setsockopt(fd, IPPROTO_SCTP, SCTP_AUTH_CHUNK, &auth,
-                   sizeof(struct sctp_authchunk));
+    ret = setsockopt(fd, IPPROTO_SCTP, SCTP_AUTH_CHUNK, &auth,
+        sizeof(struct sctp_authchunk));
     if (ret < 0) {
         BIO_vfree(bio);
         ERR_raise_data(ERR_LIB_BIO, ERR_R_SYS_LIB,
-                       "Ensure SCTP AUTH chunks are enabled in kernel");
+            "Ensure SCTP AUTH chunks are enabled in kernel");
         return NULL;
     }
 
@@ -1804,14 +1833,14 @@ BIO *BIO_new_dgram_sctp(int fd, int close_flag)
      * connected socket won't use it. Similarly with connect(): the socket
      * prior to connection must be activated for SCTP-AUTH
      */
-    sockopt_len = (socklen_t) (sizeof(sctp_assoc_t) + 256 * sizeof(uint8_t));
+    sockopt_len = (socklen_t)(sizeof(sctp_assoc_t) + 256 * sizeof(uint8_t));
     authchunks = OPENSSL_zalloc(sockopt_len);
     if (authchunks == NULL) {
         BIO_vfree(bio);
         return NULL;
     }
     ret = getsockopt(fd, IPPROTO_SCTP, SCTP_LOCAL_AUTH_CHUNKS, authchunks,
-                   &sockopt_len);
+        &sockopt_len);
     if (ret < 0) {
         OPENSSL_free(authchunks);
         BIO_vfree(bio);
@@ -1819,8 +1848,8 @@ BIO *BIO_new_dgram_sctp(int fd, int close_flag)
     }
 
     for (p = (unsigned char *)authchunks->gauth_chunks;
-         p < (unsigned char *)authchunks + sockopt_len;
-         p += sizeof(uint8_t)) {
+        p < (unsigned char *)authchunks + sockopt_len;
+        p += sizeof(uint8_t)) {
         if (*p == OPENSSL_SCTP_DATA_CHUNK_TYPE)
             auth_data = 1;
         if (*p == OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE)
@@ -1832,26 +1861,25 @@ BIO *BIO_new_dgram_sctp(int fd, int close_flag)
     if (!auth_data || !auth_forward) {
         BIO_vfree(bio);
         ERR_raise_data(ERR_LIB_BIO, ERR_R_SYS_LIB,
-                       "Ensure SCTP AUTH chunks are enabled on the "
-                       "underlying socket");
+            "Ensure SCTP AUTH chunks are enabled on the "
+            "underlying socket");
         return NULL;
     }
 
-#  ifdef SCTP_AUTHENTICATION_EVENT
-#   ifdef SCTP_EVENT
+#ifdef SCTP_AUTHENTICATION_EVENT
+#ifdef SCTP_EVENT
     memset(&event, 0, sizeof(event));
     event.se_assoc_id = 0;
     event.se_type = SCTP_AUTHENTICATION_EVENT;
     event.se_on = 1;
-    ret =
-        setsockopt(fd, IPPROTO_SCTP, SCTP_EVENT, &event,
-                   sizeof(struct sctp_event));
+    ret = setsockopt(fd, IPPROTO_SCTP, SCTP_EVENT, &event,
+        sizeof(struct sctp_event));
     if (ret < 0) {
         BIO_vfree(bio);
         return NULL;
     }
-#   else
-    sockopt_len = (socklen_t) sizeof(struct sctp_event_subscribe);
+#else
+    sockopt_len = (socklen_t)sizeof(struct sctp_event_subscribe);
     ret = getsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &event, &sockopt_len);
     if (ret < 0) {
         BIO_vfree(bio);
@@ -1860,23 +1888,21 @@ BIO *BIO_new_dgram_sctp(int fd, int close_flag)
 
     event.sctp_authentication_event = 1;
 
-    ret =
-        setsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &event,
-                   sizeof(struct sctp_event_subscribe));
+    ret = setsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &event,
+        sizeof(struct sctp_event_subscribe));
     if (ret < 0) {
         BIO_vfree(bio);
         return NULL;
     }
-#   endif
-#  endif
+#endif
+#endif
 
     /*
      * Disable partial delivery by setting the min size larger than the max
      * record size of 2^14 + 2048 + 13
      */
-    ret =
-        setsockopt(fd, IPPROTO_SCTP, SCTP_PARTIAL_DELIVERY_POINT, &optval,
-                   sizeof(optval));
+    ret = setsockopt(fd, IPPROTO_SCTP, SCTP_PARTIAL_DELIVERY_POINT, &optval,
+        sizeof(optval));
     if (ret < 0) {
         BIO_vfree(bio);
         return NULL;
@@ -1898,9 +1924,9 @@ static int dgram_sctp_new(BIO *bi)
     bi->num = 0;
     if ((data = OPENSSL_zalloc(sizeof(*data))) == NULL)
         return 0;
-#  ifdef SCTP_PR_SCTP_NONE
+#ifdef SCTP_PR_SCTP_NONE
     data->prinfo.pr_policy = SCTP_PR_SCTP_NONE;
-#  endif
+#endif
     bi->ptr = data;
 
     bi->flags = 0;
@@ -1916,16 +1942,16 @@ static int dgram_sctp_free(BIO *a)
     if (!dgram_clear(a))
         return 0;
 
-    data = (bio_dgram_sctp_data *) a->ptr;
+    data = (bio_dgram_sctp_data *)a->ptr;
     if (data != NULL)
         OPENSSL_free(data);
 
     return 1;
 }
 
-#  ifdef SCTP_AUTHENTICATION_EVENT
+#ifdef SCTP_AUTHENTICATION_EVENT
 void dgram_sctp_handle_auth_free_key_event(BIO *b,
-                                           union sctp_notification *snp)
+    union sctp_notification *snp)
 {
     int ret;
     struct sctp_authkey_event *authkeyevent = &snp->sn_auth_event;
@@ -1936,16 +1962,16 @@ void dgram_sctp_handle_auth_free_key_event(BIO *b,
         /* delete key */
         authkeyid.scact_keynumber = authkeyevent->auth_keynumber;
         ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_DELETE_KEY,
-                         &authkeyid, sizeof(struct sctp_authkeyid));
+            &authkeyid, sizeof(struct sctp_authkeyid));
     }
 }
-#  endif
+#endif
 
 static int dgram_sctp_read(BIO *b, char *out, int outl)
 {
     int ret = 0, n = 0, i, optval;
     socklen_t optlen;
-    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr;
+    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
     struct msghdr msg;
     struct iovec iov;
     struct cmsghdr *cmsg;
@@ -1975,10 +2001,10 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
 
             if (msg.msg_controllen > 0) {
                 for (cmsg = CMSG_FIRSTHDR(&msg); cmsg;
-                     cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+                    cmsg = CMSG_NXTHDR(&msg, cmsg)) {
                     if (cmsg->cmsg_level != IPPROTO_SCTP)
                         continue;
-#  ifdef SCTP_RCVINFO
+#ifdef SCTP_RCVINFO
                     if (cmsg->cmsg_type == SCTP_RCVINFO) {
                         struct sctp_rcvinfo *rcvinfo;
 
@@ -1991,13 +2017,12 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
                         data->rcvinfo.rcv_cumtsn = rcvinfo->rcv_cumtsn;
                         data->rcvinfo.rcv_context = rcvinfo->rcv_context;
                     }
-#  endif
-#  ifdef SCTP_SNDRCV
+#endif
+#ifdef SCTP_SNDRCV
                     if (cmsg->cmsg_type == SCTP_SNDRCV) {
                         struct sctp_sndrcvinfo *sndrcvinfo;
 
-                        sndrcvinfo =
-                            (struct sctp_sndrcvinfo *)CMSG_DATA(cmsg);
+                        sndrcvinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmsg);
                         data->rcvinfo.rcv_sid = sndrcvinfo->sinfo_stream;
                         data->rcvinfo.rcv_ssn = sndrcvinfo->sinfo_ssn;
                         data->rcvinfo.rcv_flags = sndrcvinfo->sinfo_flags;
@@ -2006,38 +2031,41 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
                         data->rcvinfo.rcv_cumtsn = sndrcvinfo->sinfo_cumtsn;
                         data->rcvinfo.rcv_context = sndrcvinfo->sinfo_context;
                     }
-#  endif
+#endif
                 }
             }
 
             if (msg.msg_flags & MSG_NOTIFICATION) {
                 union sctp_notification snp;
 
-                memcpy(&snp, out, sizeof(snp));
+                if (n < (int)sizeof(snp.sn_header))
+                    return -1;
+                memset(&snp, 0, sizeof(snp));
+                memcpy(&snp, out, (size_t)n < sizeof(snp) ? (size_t)n : sizeof(snp));
                 if (snp.sn_header.sn_type == SCTP_SENDER_DRY_EVENT) {
-#  ifdef SCTP_EVENT
+#ifdef SCTP_EVENT
                     struct sctp_event event;
-#  else
+#else
                     struct sctp_event_subscribe event;
                     socklen_t eventsize;
-#  endif
+#endif
 
                     /* disable sender dry event */
-#  ifdef SCTP_EVENT
+#ifdef SCTP_EVENT
                     memset(&event, 0, sizeof(event));
                     event.se_assoc_id = 0;
                     event.se_type = SCTP_SENDER_DRY_EVENT;
                     event.se_on = 0;
                     i = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENT, &event,
-                                   sizeof(struct sctp_event));
+                        sizeof(struct sctp_event));
                     if (i < 0) {
                         ret = i;
                         break;
                     }
-#  else
+#else
                     eventsize = sizeof(struct sctp_event_subscribe);
                     i = getsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event,
-                                   &eventsize);
+                        &eventsize);
                     if (i < 0) {
                         ret = i;
                         break;
@@ -2046,30 +2074,28 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
                     event.sctp_sender_dry_event = 0;
 
                     i = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event,
-                                   sizeof(struct sctp_event_subscribe));
+                        sizeof(struct sctp_event_subscribe));
                     if (i < 0) {
                         ret = i;
                         break;
                     }
-#  endif
+#endif
                 }
-#  ifdef SCTP_AUTHENTICATION_EVENT
+#ifdef SCTP_AUTHENTICATION_EVENT
                 if (snp.sn_header.sn_type == SCTP_AUTHENTICATION_EVENT)
                     dgram_sctp_handle_auth_free_key_event(b, &snp);
-#  endif
+#endif
 
                 if (data->handle_notifications != NULL)
                     data->handle_notifications(b, data->notification_context,
-                                               (void *)out);
+                        (void *)out);
 
-                memset(&snp, 0, sizeof(snp));
                 memset(out, 0, outl);
             } else {
                 ret += n;
             }
-        }
-        while ((msg.msg_flags & MSG_NOTIFICATION) && (msg.msg_flags & MSG_EOR)
-               && (ret < outl));
+        } while ((msg.msg_flags & MSG_NOTIFICATION) && (msg.msg_flags & MSG_EOR)
+            && (ret < outl));
 
         if (ret > 0 && !(msg.msg_flags & MSG_EOR)) {
             /* Partial message read, this should never happen! */
@@ -2085,26 +2111,26 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
              * Test if socket buffer can handle max record size (2^14 + 2048
              * + 13)
              */
-            optlen = (socklen_t) sizeof(int);
+            optlen = (socklen_t)sizeof(int);
             ret = getsockopt(b->num, SOL_SOCKET, SO_RCVBUF, &optval, &optlen);
-            if (ret >= 0)
-                OPENSSL_assert(optval >= 18445);
+            if (ret >= 0 && !ossl_assert(optval >= 18445))
+                return -1;
 
             /*
              * Test if SCTP doesn't partially deliver below max record size
              * (2^14 + 2048 + 13)
              */
-            optlen = (socklen_t) sizeof(int);
-            ret =
-                getsockopt(b->num, IPPROTO_SCTP, SCTP_PARTIAL_DELIVERY_POINT,
-                           &optval, &optlen);
-            if (ret >= 0)
-                OPENSSL_assert(optval >= 18445);
+            optlen = (socklen_t)sizeof(int);
+            ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_PARTIAL_DELIVERY_POINT,
+                &optval, &optlen);
+            if (ret >= 0 && !ossl_assert(optval >= 18445))
+                return -1;
 
             /*
              * Partially delivered notification??? Probably a bug....
              */
-            OPENSSL_assert(!(msg.msg_flags & MSG_NOTIFICATION));
+            if (!ossl_assert((msg.msg_flags & MSG_NOTIFICATION) == 0))
+                return -1;
 
             /*
              * Everything seems ok till now, so it's most likely a message
@@ -2129,19 +2155,18 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
             unsigned char *p;
             struct sctp_authchunks *authchunks;
 
-            optlen =
-                (socklen_t) (sizeof(sctp_assoc_t) + 256 * sizeof(uint8_t));
+            optlen = (socklen_t)(sizeof(sctp_assoc_t) + 256 * sizeof(uint8_t));
             authchunks = OPENSSL_malloc(optlen);
             if (authchunks == NULL)
                 return -1;
             memset(authchunks, 0, optlen);
             ii = getsockopt(b->num, IPPROTO_SCTP, SCTP_PEER_AUTH_CHUNKS,
-                            authchunks, &optlen);
+                authchunks, &optlen);
 
             if (ii >= 0)
                 for (p = (unsigned char *)authchunks->gauth_chunks;
-                     p < (unsigned char *)authchunks + optlen;
-                     p += sizeof(uint8_t)) {
+                    p < (unsigned char *)authchunks + optlen;
+                    p += sizeof(uint8_t)) {
                     if (*p == OPENSSL_SCTP_DATA_CHUNK_TYPE)
                         auth_data = 1;
                     if (*p == OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE)
@@ -2172,22 +2197,21 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
 static int dgram_sctp_write(BIO *b, const char *in, int inl)
 {
     int ret;
-    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr;
+    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
     struct bio_dgram_sctp_sndinfo *sinfo = &(data->sndinfo);
     struct bio_dgram_sctp_prinfo *pinfo = &(data->prinfo);
     struct bio_dgram_sctp_sndinfo handshake_sinfo;
     struct iovec iov[1];
     struct msghdr msg;
     struct cmsghdr *cmsg;
-#  if defined(SCTP_SNDINFO) && defined(SCTP_PRINFO)
-    char cmsgbuf[CMSG_SPACE(sizeof(struct sctp_sndinfo)) +
-                 CMSG_SPACE(sizeof(struct sctp_prinfo))];
+#if defined(SCTP_SNDINFO) && defined(SCTP_PRINFO)
+    char cmsgbuf[CMSG_SPACE(sizeof(struct sctp_sndinfo)) + CMSG_SPACE(sizeof(struct sctp_prinfo))];
     struct sctp_sndinfo *sndinfo;
     struct sctp_prinfo *prinfo;
-#  else
+#else
     char cmsgbuf[CMSG_SPACE(sizeof(struct sctp_sndrcvinfo))];
     struct sctp_sndrcvinfo *sndrcvinfo;
-#  endif
+#endif
 
     clear_socket_error();
 
@@ -2197,9 +2221,9 @@ static int dgram_sctp_write(BIO *b, const char *in, int inl)
      */
     if (in[0] != 23) {
         memset(&handshake_sinfo, 0, sizeof(handshake_sinfo));
-#  ifdef SCTP_SACK_IMMEDIATELY
+#ifdef SCTP_SACK_IMMEDIATELY
         handshake_sinfo.snd_flags = SCTP_SACK_IMMEDIATELY;
-#  endif
+#endif
         sinfo = &handshake_sinfo;
     }
 
@@ -2221,10 +2245,10 @@ static int dgram_sctp_write(BIO *b, const char *in, int inl)
     msg.msg_namelen = 0;
     msg.msg_iov = iov;
     msg.msg_iovlen = 1;
-    msg.msg_control = (caddr_t) cmsgbuf;
+    msg.msg_control = (caddr_t)cmsgbuf;
     msg.msg_controllen = 0;
     msg.msg_flags = 0;
-#  if defined(SCTP_SNDINFO) && defined(SCTP_PRINFO)
+#if defined(SCTP_SNDINFO) && defined(SCTP_PRINFO)
     cmsg = (struct cmsghdr *)cmsgbuf;
     cmsg->cmsg_level = IPPROTO_SCTP;
     cmsg->cmsg_type = SCTP_SNDINFO;
@@ -2237,8 +2261,7 @@ static int dgram_sctp_write(BIO *b, const char *in, int inl)
     sndinfo->snd_context = sinfo->snd_context;
     msg.msg_controllen += CMSG_SPACE(sizeof(struct sctp_sndinfo));
 
-    cmsg =
-        (struct cmsghdr *)&cmsgbuf[CMSG_SPACE(sizeof(struct sctp_sndinfo))];
+    cmsg = (struct cmsghdr *)&cmsgbuf[CMSG_SPACE(sizeof(struct sctp_sndinfo))];
     cmsg->cmsg_level = IPPROTO_SCTP;
     cmsg->cmsg_type = SCTP_PRINFO;
     cmsg->cmsg_len = CMSG_LEN(sizeof(struct sctp_prinfo));
@@ -2247,7 +2270,7 @@ static int dgram_sctp_write(BIO *b, const char *in, int inl)
     prinfo->pr_policy = pinfo->pr_policy;
     prinfo->pr_value = pinfo->pr_value;
     msg.msg_controllen += CMSG_SPACE(sizeof(struct sctp_prinfo));
-#  else
+#else
     cmsg = (struct cmsghdr *)cmsgbuf;
     cmsg->cmsg_level = IPPROTO_SCTP;
     cmsg->cmsg_type = SCTP_SNDRCV;
@@ -2256,14 +2279,14 @@ static int dgram_sctp_write(BIO *b, const char *in, int inl)
     memset(sndrcvinfo, 0, sizeof(*sndrcvinfo));
     sndrcvinfo->sinfo_stream = sinfo->snd_sid;
     sndrcvinfo->sinfo_flags = sinfo->snd_flags;
-#   ifdef __FreeBSD__
+#ifdef __FreeBSD__
     sndrcvinfo->sinfo_flags |= pinfo->pr_policy;
-#   endif
+#endif
     sndrcvinfo->sinfo_ppid = sinfo->snd_ppid;
     sndrcvinfo->sinfo_context = sinfo->snd_context;
     sndrcvinfo->sinfo_timetolive = pinfo->pr_value;
     msg.msg_controllen += CMSG_SPACE(sizeof(struct sctp_sndrcvinfo));
-#  endif
+#endif
 
     ret = sendmsg(b->num, &msg, 0);
 
@@ -2285,7 +2308,7 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
     struct sctp_authkeyid authkeyid;
     struct sctp_authkey *authkey = NULL;
 
-    data = (bio_dgram_sctp_data *) b->ptr;
+    data = (bio_dgram_sctp_data *)b->ptr;
 
     switch (cmd) {
     case BIO_CTRL_DGRAM_QUERY_MTU:
@@ -2326,9 +2349,8 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
         else
             data->in_handshake = 0;
 
-        ret =
-            setsockopt(b->num, IPPROTO_SCTP, SCTP_NODELAY,
-                       &data->in_handshake, sizeof(int));
+        ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_NODELAY,
+            &data->in_handshake, sizeof(int));
         break;
     case BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY:
         /*
@@ -2337,9 +2359,8 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
 
         /* Get active key */
         sockopt_len = sizeof(struct sctp_authkeyid);
-        ret =
-            getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY, &authkeyid,
-                       &sockopt_len);
+        ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY, &authkeyid,
+            &sockopt_len);
         if (ret < 0)
             break;
 
@@ -2352,18 +2373,17 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
         }
         memset(authkey, 0, sockopt_len);
         authkey->sca_keynumber = authkeyid.scact_keynumber + 1;
-#  ifndef __FreeBSD__
+#ifndef __FreeBSD__
         /*
          * This field is missing in FreeBSD 8.2 and earlier, and FreeBSD 8.3
          * and higher work without it.
          */
         authkey->sca_keylength = 64;
-#  endif
+#endif
         memcpy(&authkey->sca_key[0], ptr, 64 * sizeof(uint8_t));
 
-        ret =
-            setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_KEY, authkey,
-                       sockopt_len);
+        ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_KEY, authkey,
+            sockopt_len);
         OPENSSL_free(authkey);
         authkey = NULL;
         if (ret < 0)
@@ -2371,7 +2391,7 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
 
         /* Reset active key */
         ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY,
-                         &authkeyid, sizeof(struct sctp_authkeyid));
+            &authkeyid, sizeof(struct sctp_authkeyid));
         if (ret < 0)
             break;
 
@@ -2381,16 +2401,15 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
 
         /* Get active key */
         sockopt_len = sizeof(struct sctp_authkeyid);
-        ret =
-            getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY, &authkeyid,
-                       &sockopt_len);
+        ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY, &authkeyid,
+            &sockopt_len);
         if (ret < 0)
             break;
 
         /* Set active key */
         authkeyid.scact_keynumber = authkeyid.scact_keynumber + 1;
         ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY,
-                         &authkeyid, sizeof(struct sctp_authkeyid));
+            &authkeyid, sizeof(struct sctp_authkeyid));
         if (ret < 0)
             break;
 
@@ -2417,9 +2436,8 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
         if (data->ccs_rcvd == 1 && data->ccs_sent == 1) {
             /* Get active key */
             sockopt_len = sizeof(struct sctp_authkeyid);
-            ret =
-                getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY,
-                           &authkeyid, &sockopt_len);
+            ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY,
+                &authkeyid, &sockopt_len);
             if (ret < 0)
                 break;
 
@@ -2428,22 +2446,22 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
              * SCTP_AUTHENTICATION_EVENT is not available.
              */
             authkeyid.scact_keynumber = authkeyid.scact_keynumber - 1;
-#  ifdef SCTP_AUTH_DEACTIVATE_KEY
+#ifdef SCTP_AUTH_DEACTIVATE_KEY
             sockopt_len = sizeof(struct sctp_authkeyid);
             ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_DEACTIVATE_KEY,
-                             &authkeyid, sockopt_len);
+                &authkeyid, sockopt_len);
             if (ret < 0)
                 break;
-#  endif
-#  ifndef SCTP_AUTHENTICATION_EVENT
+#endif
+#ifndef SCTP_AUTHENTICATION_EVENT
             if (authkeyid.scact_keynumber > 0) {
                 authkeyid.scact_keynumber = authkeyid.scact_keynumber - 1;
                 ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_DELETE_KEY,
-                                 &authkeyid, sizeof(struct sctp_authkeyid));
+                    &authkeyid, sizeof(struct sctp_authkeyid));
                 if (ret < 0)
                     break;
             }
-#  endif
+#endif
 
             data->ccs_rcvd = 0;
             data->ccs_sent = 0;
@@ -2518,10 +2536,10 @@ static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
 }
 
 int BIO_dgram_sctp_notification_cb(BIO *b,
-                BIO_dgram_sctp_notification_handler_fn handle_notifications,
-                void *context)
+    BIO_dgram_sctp_notification_handler_fn handle_notifications,
+    void *context)
 {
-    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr;
+    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
 
     if (handle_notifications != NULL) {
         data->handle_notifications = handle_notifications;
@@ -2558,24 +2576,23 @@ static int dgram_sctp_wait_for_dry(BIO *b)
     union sctp_notification snp;
     struct msghdr msg;
     struct iovec iov;
-#  ifdef SCTP_EVENT
+#ifdef SCTP_EVENT
     struct sctp_event event;
-#  else
+#else
     struct sctp_event_subscribe event;
     socklen_t eventsize;
-#  endif
-    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr;
+#endif
+    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
 
     /* set sender dry event */
-#  ifdef SCTP_EVENT
+#ifdef SCTP_EVENT
     memset(&event, 0, sizeof(event));
     event.se_assoc_id = 0;
     event.se_type = SCTP_SENDER_DRY_EVENT;
     event.se_on = 1;
-    ret =
-        setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENT, &event,
-                   sizeof(struct sctp_event));
-#  else
+    ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENT, &event,
+        sizeof(struct sctp_event));
+#else
     eventsize = sizeof(struct sctp_event_subscribe);
     ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event, &eventsize);
     if (ret < 0)
@@ -2583,10 +2600,9 @@ static int dgram_sctp_wait_for_dry(BIO *b)
 
     event.sctp_sender_dry_event = 1;
 
-    ret =
-        setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event,
-                   sizeof(struct sctp_event_subscribe));
-#  endif
+    ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event,
+        sizeof(struct sctp_event_subscribe));
+#endif
     if (ret < 0)
         return -1;
 
@@ -2637,39 +2653,36 @@ static int dgram_sctp_wait_for_dry(BIO *b)
             is_dry = 1;
 
             /* disable sender dry event */
-#  ifdef SCTP_EVENT
+#ifdef SCTP_EVENT
             memset(&event, 0, sizeof(event));
             event.se_assoc_id = 0;
             event.se_type = SCTP_SENDER_DRY_EVENT;
             event.se_on = 0;
-            ret =
-                setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENT, &event,
-                           sizeof(struct sctp_event));
-#  else
-            eventsize = (socklen_t) sizeof(struct sctp_event_subscribe);
-            ret =
-                getsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event,
-                           &eventsize);
+            ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENT, &event,
+                sizeof(struct sctp_event));
+#else
+            eventsize = (socklen_t)sizeof(struct sctp_event_subscribe);
+            ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event,
+                &eventsize);
             if (ret < 0)
                 return -1;
 
             event.sctp_sender_dry_event = 0;
 
-            ret =
-                setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event,
-                           sizeof(struct sctp_event_subscribe));
-#  endif
+            ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event,
+                sizeof(struct sctp_event_subscribe));
+#endif
             if (ret < 0)
                 return -1;
         }
-#  ifdef SCTP_AUTHENTICATION_EVENT
+#ifdef SCTP_AUTHENTICATION_EVENT
         if (snp.sn_header.sn_type == SCTP_AUTHENTICATION_EVENT)
             dgram_sctp_handle_auth_free_key_event(b, &snp);
-#  endif
+#endif
 
         if (data->handle_notifications != NULL)
             data->handle_notifications(b, data->notification_context,
-                                       (void *)&snp);
+                (void *)&snp);
 
         /* found notification, peek again */
         memset(&snp, 0, sizeof(snp));
@@ -2719,7 +2732,7 @@ static int dgram_sctp_msg_waiting(BIO *b)
     union sctp_notification snp;
     struct msghdr msg;
     struct iovec iov;
-    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr;
+    bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
 
     /* Check if there are any messages waiting to be read */
     do {
@@ -2741,10 +2754,10 @@ static int dgram_sctp_msg_waiting(BIO *b)
 
         /* if notification, process and try again */
         if (n > 0 && (msg.msg_flags & MSG_NOTIFICATION)) {
-#  ifdef SCTP_AUTHENTICATION_EVENT
+#ifdef SCTP_AUTHENTICATION_EVENT
             if (snp.sn_header.sn_type == SCTP_AUTHENTICATION_EVENT)
                 dgram_sctp_handle_auth_free_key_event(b, &snp);
-#  endif
+#endif
 
             memset(&snp, 0, sizeof(snp));
             iov.iov_base = (char *)&snp;
@@ -2760,7 +2773,7 @@ static int dgram_sctp_msg_waiting(BIO *b)
 
             if (data->handle_notifications != NULL)
                 data->handle_notifications(b, data->notification_context,
-                                           (void *)&snp);
+                    (void *)&snp);
         }
 
     } while (n > 0 && (msg.msg_flags & MSG_NOTIFICATION));
@@ -2780,7 +2793,7 @@ static int dgram_sctp_puts(BIO *bp, const char *str)
     ret = dgram_sctp_write(bp, str, n);
     return ret;
 }
-# endif
+#endif
 
 static int BIO_dgram_should_retry(int i)
 {
@@ -2789,13 +2802,13 @@ static int BIO_dgram_should_retry(int i)
     if ((i == 0) || (i == -1)) {
         err = get_last_socket_error();
 
-# if defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_WINDOWS)
         /*
          * If the socket return value (i) is -1 and err is unexpectedly 0 at
          * this point, the error code was overwritten by another system call
          * before this error handling is called.
          */
-# endif
+#endif
 
         return BIO_dgram_non_fatal_error(err);
     }
@@ -2805,43 +2818,43 @@ static int BIO_dgram_should_retry(int i)
 int BIO_dgram_non_fatal_error(int err)
 {
     switch (err) {
-# if defined(OPENSSL_SYS_WINDOWS)
-#  if defined(WSAEWOULDBLOCK)
+#if defined(OPENSSL_SYS_WINDOWS)
+#if defined(WSAEWOULDBLOCK)
     case WSAEWOULDBLOCK:
-#  endif
-# endif
+#endif
+#endif
 
-# ifdef EWOULDBLOCK
-#  ifdef WSAEWOULDBLOCK
-#   if WSAEWOULDBLOCK != EWOULDBLOCK
+#ifdef EWOULDBLOCK
+#ifdef WSAEWOULDBLOCK
+#if WSAEWOULDBLOCK != EWOULDBLOCK
     case EWOULDBLOCK:
-#   endif
-#  else
+#endif
+#else
     case EWOULDBLOCK:
-#  endif
-# endif
+#endif
+#endif
 
-# ifdef EINTR
+#ifdef EINTR
     case EINTR:
-# endif
+#endif
 
-# ifdef EAGAIN
-#  if EWOULDBLOCK != EAGAIN
+#ifdef EAGAIN
+#if EWOULDBLOCK != EAGAIN
     case EAGAIN:
-#  endif
-# endif
+#endif
+#endif
 
-# ifdef EPROTO
+#ifdef EPROTO
     case EPROTO:
-# endif
+#endif
 
-# ifdef EINPROGRESS
+#ifdef EINPROGRESS
     case EINPROGRESS:
-# endif
+#endif
 
-# ifdef EALREADY
+#ifdef EALREADY
     case EALREADY:
-# endif
+#endif
 
         return 1;
     default:
diff --git a/crypto/openssl/crypto/bio/bss_dgram_pair.c b/crypto/openssl/crypto/bio/bss_dgram_pair.c
index 540f061ff59a..780fe8d00e50 100644
--- a/crypto/openssl/crypto/bio/bss_dgram_pair.c
+++ b/crypto/openssl/crypto/bio/bss_dgram_pair.c
@@ -46,9 +46,9 @@ static int ring_buf_init(struct ring_buf *r, size_t nbytes)
 static void ring_buf_destroy(struct ring_buf *r)
 {
     OPENSSL_free(r->start);
-    r->start    = NULL;
-    r->len      = 0;
-    r->count    = 0;
+    r->start = NULL;
+    r->len = 0;
+    r->count = 0;
 }
 
 /*
@@ -141,7 +141,7 @@ static int ring_buf_resize(struct ring_buf *r, size_t nbytes)
             size_t offset = nbytes - r->len;
 
             memmove(new_start + r->idx[1] + offset, new_start + r->idx[1],
-                    r->len - r->idx[1]);
+                r->len - r->idx[1]);
             r->idx[1] += offset;
         }
     } else {
@@ -184,17 +184,17 @@ static int dgram_pair_init(BIO *bio);
 static int dgram_mem_init(BIO *bio);
 static int dgram_pair_free(BIO *bio);
 static int dgram_pair_sendmmsg(BIO *b, BIO_MSG *msg, size_t stride,
-                               size_t num_msg, uint64_t flags,
-                               size_t *num_processed);
+    size_t num_msg, uint64_t flags,
+    size_t *num_processed);
 static int dgram_pair_recvmmsg(BIO *b, BIO_MSG *msg, size_t stride,
-                               size_t num_msg, uint64_t flags,
-                               size_t *num_processed);
+    size_t num_msg, uint64_t flags,
+    size_t *num_processed);
 
 static int dgram_pair_ctrl_destroy_bio_pair(BIO *bio1);
 static size_t dgram_pair_read_inner(struct bio_dgram_pair_st *b, uint8_t *buf,
-                                    size_t sz);
+    size_t sz);
 
-#define BIO_MSG_N(array, n) (*(BIO_MSG *)((char *)(array) + (n)*stride))
+#define BIO_MSG_N(array, n) (*(BIO_MSG *)((char *)(array) + (n) * stride))
 
 static const BIO_METHOD dgram_pair_method = {
     BIO_TYPE_DGRAM_PAIR,
@@ -264,10 +264,10 @@ struct bio_dgram_pair_st {
      * reads.
      */
     CRYPTO_RWLOCK *lock;
-    unsigned int no_trunc          : 1; /* Reads fail if they would truncate */
+    unsigned int no_trunc : 1; /* Reads fail if they would truncate */
     unsigned int local_addr_enable : 1; /* Can use BIO_MSG->local? */
-    unsigned int role              : 1; /* Determines lock order */
-    unsigned int grows_on_write    : 1; /* Set for BIO_s_dgram_mem only */
+    unsigned int role : 1; /* Determines lock order */
+    unsigned int grows_on_write : 1; /* Set for BIO_s_dgram_mem only */
 };
 
 #define MIN_BUF_LEN (1024)
@@ -281,7 +281,7 @@ static int dgram_pair_init(BIO *bio)
     if (b == NULL)
         return 0;
 
-    b->mtu         = 1472;    /* conservative default MTU */
+    b->mtu = 1472; /* conservative default MTU */
     /* default buffer size */
     b->req_buf_len = 9 * (sizeof(struct dgram_hdr) + b->mtu);
 
@@ -348,7 +348,7 @@ static int dgram_pair_ctrl_make_bio_pair(BIO *bio1, BIO *bio2)
     /* Ensure the BIO we have been passed is actually a dgram pair BIO. */
     if (bio1->method != &dgram_pair_method || bio2->method != &dgram_pair_method) {
         ERR_raise_data(ERR_LIB_BIO, BIO_R_INVALID_ARGUMENT,
-                       "both BIOs must be BIO_dgram_pair");
+            "both BIOs must be BIO_dgram_pair");
         return 0;
     }
 
@@ -366,12 +366,12 @@ static int dgram_pair_ctrl_make_bio_pair(BIO *bio1, BIO *bio2)
      */
     if (b1->peer != NULL || b2->peer != NULL) {
         ERR_raise_data(ERR_LIB_BIO, BIO_R_IN_USE,
-                       "cannot associate a BIO_dgram_pair which is already in use");
+            "cannot associate a BIO_dgram_pair which is already in use");
         return 0;
     }
 
     if (!ossl_assert(b1->req_buf_len >= MIN_BUF_LEN
-                        && b2->req_buf_len >= MIN_BUF_LEN)) {
+            && b2->req_buf_len >= MIN_BUF_LEN)) {
         ERR_raise(ERR_LIB_BIO, BIO_R_UNINITIALIZED);
         return 0;
     }
@@ -389,12 +389,12 @@ static int dgram_pair_ctrl_make_bio_pair(BIO *bio1, BIO *bio2)
             return 0;
         }
 
-    b1->peer    = bio2;
-    b2->peer    = bio1;
-    b1->role    = 0;
-    b2->role    = 1;
-    bio1->init  = 1;
-    bio2->init  = 1;
+    b1->peer = bio2;
+    b2->peer = bio1;
+    b1->role = 0;
+    b2->role = 1;
+    bio1->init = 1;
+    bio2->init = 1;
     return 1;
 }
 
@@ -443,7 +443,6 @@ static int dgram_pair_ctrl_eof(BIO *bio)
     if (!is_dgram_pair(b))
         return 0;
 
-
     peerb = b->peer->ptr;
     if (!ossl_assert(peerb != NULL))
         return -1;
@@ -508,13 +507,13 @@ static size_t dgram_pair_ctrl_pending(BIO *bio)
     if (CRYPTO_THREAD_write_lock(readb->lock) == 0)
         return 0;
 
-    saved_idx   = readb->rbuf.idx[1];
+    saved_idx = readb->rbuf.idx[1];
     saved_count = readb->rbuf.count;
 
     l = dgram_pair_read_inner(readb, (uint8_t *)&hdr, sizeof(hdr));
 
     readb->rbuf.idx[1] = saved_idx;
-    readb->rbuf.count  = saved_count;
+    readb->rbuf.count = saved_count;
 
     CRYPTO_THREAD_unlock(readb->lock);
 
@@ -561,8 +560,7 @@ static int dgram_pair_ctrl_get_local_addr_cap(BIO *bio)
     else
         readb = b;
 
-    return (~readb->cap & (BIO_DGRAM_CAP_HANDLES_SRC_ADDR
-                           | BIO_DGRAM_CAP_PROVIDES_DST_ADDR)) == 0;
+    return (~readb->cap & (BIO_DGRAM_CAP_HANDLES_SRC_ADDR | BIO_DGRAM_CAP_PROVIDES_DST_ADDR)) == 0;
 }
 
 /* BIO_dgram_get_effective_caps (BIO_CTRL_DGRAM_GET_EFFECTIVE_CAPS) */
@@ -801,7 +799,7 @@ static long dgram_pair_ctrl(BIO *bio, int cmd, long num, void *ptr)
 }
 
 int BIO_new_bio_dgram_pair(BIO **pbio1, size_t writebuf1,
-                           BIO **pbio2, size_t writebuf2)
+    BIO **pbio2, size_t writebuf2)
 {
     int ret = 0;
     long r;
@@ -878,8 +876,8 @@ static size_t dgram_pair_read_inner(struct bio_dgram_pair_st *b, uint8_t *buf, s
 
         if (buf != NULL)
             buf += src_len;
-        total_read  += src_len;
-        sz          -= src_len;
+        total_read += src_len;
+        sz -= src_len;
     }
 
     return total_read;
@@ -890,8 +888,8 @@ static size_t dgram_pair_read_inner(struct bio_dgram_pair_st *b, uint8_t *buf, s
  * response code.
  */
 static ossl_ssize_t dgram_pair_read_actual(BIO *bio, char *buf, size_t sz,
-                                           BIO_ADDR *local, BIO_ADDR *peer,
-                                           int is_multi)
+    BIO_ADDR *local, BIO_ADDR *peer,
+    int is_multi)
 {
     size_t l, trunc = 0, saved_idx, saved_count;
     struct bio_dgram_pair_st *b = bio->ptr, *readb;
@@ -921,7 +919,7 @@ static ossl_ssize_t dgram_pair_read_actual(BIO *bio, char *buf, size_t sz,
         return -BIO_R_LOCAL_ADDR_NOT_AVAILABLE;
 
     /* Read the header. */
-    saved_idx   = readb->rbuf.idx[1];
+    saved_idx = readb->rbuf.idx[1];
     saved_count = readb->rbuf.count;
     l = dgram_pair_read_inner(readb, (uint8_t *)&hdr, sizeof(hdr));
     if (l == 0) {
@@ -946,7 +944,7 @@ static ossl_ssize_t dgram_pair_read_actual(BIO *bio, char *buf, size_t sz,
         if (b->no_trunc) {
             /* Restore original state. */
             readb->rbuf.idx[1] = saved_idx;
-            readb->rbuf.count  = saved_count;
+            readb->rbuf.count = saved_count;
             return -BIO_R_NON_FATAL;
         }
     }
@@ -967,14 +965,14 @@ static ossl_ssize_t dgram_pair_read_actual(BIO *bio, char *buf, size_t sz,
     if (local != NULL)
         *local = hdr.dst_addr;
     if (peer != NULL)
-        *peer  = hdr.src_addr;
+        *peer = hdr.src_addr;
 
     return (ossl_ssize_t)l;
 }
 
 /* Threadsafe */
 static int dgram_pair_lock_both_write(struct bio_dgram_pair_st *a,
-                                      struct bio_dgram_pair_st *b)
+    struct bio_dgram_pair_st *b)
 {
     struct bio_dgram_pair_st *x, *y;
 
@@ -999,7 +997,7 @@ static int dgram_pair_lock_both_write(struct bio_dgram_pair_st *a,
 }
 
 static void dgram_pair_unlock_both(struct bio_dgram_pair_st *a,
-                                   struct bio_dgram_pair_st *b)
+    struct bio_dgram_pair_st *b)
 {
     CRYPTO_THREAD_unlock(a->lock);
     CRYPTO_THREAD_unlock(b->lock);
@@ -1049,9 +1047,9 @@ static int dgram_pair_read(BIO *bio, char *buf, int sz_)
 
 /* Threadsafe */
 static int dgram_pair_recvmmsg(BIO *bio, BIO_MSG *msg,
-                               size_t stride, size_t num_msg,
-                               uint64_t flags,
-                               size_t *num_processed)
+    size_t stride, size_t num_msg,
+    uint64_t flags,
+    size_t *num_processed)
 {
     int ret;
     ossl_ssize_t l;
@@ -1084,7 +1082,7 @@ static int dgram_pair_recvmmsg(BIO *bio, BIO_MSG *msg,
     for (i = 0; i < num_msg; ++i) {
         m = &BIO_MSG_N(msg, i);
         l = dgram_pair_read_actual(bio, m->data, m->data_len,
-                                   m->local, m->peer, 1);
+            m->local, m->peer, 1);
         if (l < 0) {
             *num_processed = i;
             if (i > 0) {
@@ -1097,7 +1095,7 @@ static int dgram_pair_recvmmsg(BIO *bio, BIO_MSG *msg,
         }
 
         m->data_len = l;
-        m->flags    = 0;
+        m->flags = 0;
     }
 
     *num_processed = i;
@@ -1167,7 +1165,7 @@ static ossl_inline size_t compute_rbuf_growth(size_t target, size_t current)
 
 /* Must hold local write lock */
 static size_t dgram_pair_write_inner(struct bio_dgram_pair_st *b,
-                                     const uint8_t *buf, size_t sz)
+    const uint8_t *buf, size_t sz)
 {
     size_t total_written = 0;
 
@@ -1203,9 +1201,9 @@ static size_t dgram_pair_write_inner(struct bio_dgram_pair_st *b,
         memcpy(dst_buf, buf, dst_len);
         ring_buf_push(&b->rbuf, dst_len);
 
-        buf             += dst_len;
-        sz              -= dst_len;
-        total_written   += dst_len;
+        buf += dst_len;
+        sz -= dst_len;
+        total_written += dst_len;
     }
 
     return total_written;
@@ -1216,13 +1214,13 @@ static size_t dgram_pair_write_inner(struct bio_dgram_pair_st *b,
  * response code.
  */
 static ossl_ssize_t dgram_pair_write_actual(BIO *bio, const char *buf, size_t sz,
-                                            const BIO_ADDR *local, const BIO_ADDR *peer,
-                                            int is_multi)
+    const BIO_ADDR *local, const BIO_ADDR *peer,
+    int is_multi)
 {
     static const BIO_ADDR zero_addr;
     size_t saved_idx, saved_count;
     struct bio_dgram_pair_st *b = bio->ptr, *readb;
-    struct dgram_hdr hdr = {0};
+    struct dgram_hdr hdr = { 0 };
 
     if (!is_multi)
         BIO_clear_retry_flags(bio);
@@ -1252,16 +1250,16 @@ static ossl_ssize_t dgram_pair_write_actual(BIO *bio, const char *buf, size_t sz
         local = b->local_addr;
     hdr.src_addr = (local != NULL ? *local : zero_addr);
 
-    saved_idx   = b->rbuf.idx[0];
+    saved_idx = b->rbuf.idx[0];
     saved_count = b->rbuf.count;
     if (dgram_pair_write_inner(b, (const uint8_t *)&hdr, sizeof(hdr)) != sizeof(hdr)
-            || dgram_pair_write_inner(b, (const uint8_t *)buf, sz) != sz) {
+        || dgram_pair_write_inner(b, (const uint8_t *)buf, sz) != sz) {
         /*
          * We were not able to push the header and the entirety of the payload
          * onto the ring buffer, so abort and roll back the ring buffer state.
          */
         b->rbuf.idx[0] = saved_idx;
-        b->rbuf.count  = saved_count;
+        b->rbuf.count = saved_count;
         if (!is_multi)
             BIO_set_retry_write(bio);
         return -BIO_R_NON_FATAL;
@@ -1301,8 +1299,8 @@ static int dgram_pair_write(BIO *bio, const char *buf, int sz_)
 
 /* Threadsafe */
 static int dgram_pair_sendmmsg(BIO *bio, BIO_MSG *msg,
-                               size_t stride, size_t num_msg,
-                               uint64_t flags, size_t *num_processed)
+    size_t stride, size_t num_msg,
+    uint64_t flags, size_t *num_processed)
 {
     ossl_ssize_t ret, l;
     BIO_MSG *m;
@@ -1323,7 +1321,7 @@ static int dgram_pair_sendmmsg(BIO *bio, BIO_MSG *msg,
     for (i = 0; i < num_msg; ++i) {
         m = &BIO_MSG_N(msg, i);
         l = dgram_pair_write_actual(bio, m->data, m->data_len,
-                                    m->local, m->peer, 1);
+            m->local, m->peer, 1);
         if (l < 0) {
             *num_processed = i;
             if (i > 0) {
diff --git a/crypto/openssl/crypto/bio/bss_fd.c b/crypto/openssl/crypto/bio/bss_fd.c
index 41514589a5dd..6046dd8582e1 100644
--- a/crypto/openssl/crypto/bio/bss_fd.c
+++ b/crypto/openssl/crypto/bio/bss_fd.c
@@ -69,7 +69,7 @@ static const BIO_METHOD methods_fdp = {
     fd_ctrl,
     fd_new,
     fd_free,
-    NULL,                       /* fd_callback_ctrl */
+    NULL, /* fd_callback_ctrl */
 };
 
 const BIO_METHOD *BIO_s_fd(void)
@@ -213,7 +213,7 @@ static int fd_gets(BIO *bp, char *buf, int size)
 
     while (ptr < end && fd_read(bp, ptr, 1) > 0) {
         if (*ptr++ == '\n')
-           break;
+            break;
     }
 
     ptr[0] = '\0';
@@ -239,41 +239,41 @@ int BIO_fd_non_fatal_error(int err)
 {
     switch (err) {
 
-# ifdef EWOULDBLOCK
-#  ifdef WSAEWOULDBLOCK
-#   if WSAEWOULDBLOCK != EWOULDBLOCK
+#ifdef EWOULDBLOCK
+#ifdef WSAEWOULDBLOCK
+#if WSAEWOULDBLOCK != EWOULDBLOCK
     case EWOULDBLOCK:
-#   endif
-#  else
+#endif
+#else
     case EWOULDBLOCK:
-#  endif
-# endif
+#endif
+#endif
 
-# if defined(ENOTCONN)
+#if defined(ENOTCONN)
     case ENOTCONN:
-# endif
+#endif
 
-# ifdef EINTR
+#ifdef EINTR
     case EINTR:
-# endif
+#endif
 
-# ifdef EAGAIN
-#  if EWOULDBLOCK != EAGAIN
+#ifdef EAGAIN
+#if EWOULDBLOCK != EAGAIN
     case EAGAIN:
-#  endif
-# endif
+#endif
+#endif
 
-# ifdef EPROTO
+#ifdef EPROTO
     case EPROTO:
-# endif
+#endif
 
-# ifdef EINPROGRESS
+#ifdef EINPROGRESS
     case EINPROGRESS:
-# endif
+#endif
 
-# ifdef EALREADY
+#ifdef EALREADY
     case EALREADY:
-# endif
+#endif
         return 1;
     default:
         break;
diff --git a/crypto/openssl/crypto/bio/bss_file.c b/crypto/openssl/crypto/bio/bss_file.c
index ddcb4feb6a58..c5bdda498bd0 100644
--- a/crypto/openssl/crypto/bio/bss_file.c
+++ b/crypto/openssl/crypto/bio/bss_file.c
@@ -20,9 +20,9 @@
  * of 32-bit platforms which allow for sequential access of large files
  * without extra "magic" comprise *BSD, Darwin, IRIX...
  */
-# ifndef _FILE_OFFSET_BITS
-#  define _FILE_OFFSET_BITS 64
-# endif
+#ifndef _FILE_OFFSET_BITS
+#define _FILE_OFFSET_BITS 64
+#endif
 #endif
 
 #include <stdio.h>
@@ -51,12 +51,12 @@ static const BIO_METHOD methods_filep = {
     file_ctrl,
     file_new,
     file_free,
-    NULL,                      /* file_callback_ctrl */
+    NULL, /* file_callback_ctrl */
 };
 
 BIO *BIO_new_file(const char *filename, const char *mode)
 {
-    BIO  *ret;
+    BIO *ret;
     FILE *file = openssl_fopen(filename, mode);
     int fp_flags = BIO_CLOSE;
 
@@ -65,13 +65,13 @@ BIO *BIO_new_file(const char *filename, const char *mode)
 
     if (file == NULL) {
         ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
-                       "calling fopen(%s, %s)",
-                       filename, mode);
+            "calling fopen(%s, %s)",
+            filename, mode);
         if (errno == ENOENT
 #ifdef ENXIO
             || errno == ENXIO
 #endif
-            )
+        )
             ERR_raise(ERR_LIB_BIO, BIO_R_NO_SUCH_FILE);
         else
             ERR_raise(ERR_LIB_BIO, ERR_R_SYS_LIB);
@@ -144,9 +144,10 @@ static int file_read(BIO *b, char *out, int outl)
             ret = fread(out, 1, (int)outl, (FILE *)b->ptr);
         if (ret == 0
             && (b->flags & BIO_FLAGS_UPLINK_INTERNAL
-                ? UP_ferror((FILE *)b->ptr) : ferror((FILE *)b->ptr))) {
+                    ? UP_ferror((FILE *)b->ptr)
+                    : ferror((FILE *)b->ptr))) {
             ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
-                           "calling fread()");
+                "calling fread()");
             ERR_raise(ERR_LIB_BIO, ERR_R_SYS_LIB);
             ret = -1;
         }
@@ -209,33 +210,32 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
         b->shutdown = (int)num & BIO_CLOSE;
         b->ptr = ptr;
         b->init = 1;
-# if BIO_FLAGS_UPLINK_INTERNAL!=0
-#  if defined(__MINGW32__) && defined(__MSVCRT__) && !defined(_IOB_ENTRIES)
-#   define _IOB_ENTRIES 20
-#  endif
+#if BIO_FLAGS_UPLINK_INTERNAL != 0
+#if defined(__MINGW32__) && defined(__MSVCRT__) && !defined(_IOB_ENTRIES)
+#define _IOB_ENTRIES 20
+#endif
         /* Safety net to catch purely internal BIO_set_fp calls */
-#  if (defined(_MSC_VER) && _MSC_VER>=1900) || defined(__BORLANDC__)
+#if (defined(_MSC_VER) && _MSC_VER >= 1900) || defined(__BORLANDC__)
         if (ptr == stdin || ptr == stdout || ptr == stderr)
             BIO_clear_flags(b, BIO_FLAGS_UPLINK_INTERNAL);
-#  elif defined(_IOB_ENTRIES)
-        if ((size_t)ptr >= (size_t)stdin &&
-            (size_t)ptr < (size_t)(stdin + _IOB_ENTRIES))
+#elif defined(_IOB_ENTRIES)
+        if ((size_t)ptr >= (size_t)stdin && (size_t)ptr < (size_t)(stdin + _IOB_ENTRIES))
             BIO_clear_flags(b, BIO_FLAGS_UPLINK_INTERNAL);
-#  endif
-# endif
-# ifdef UP_fsetmod
+#endif
+#endif
+#ifdef UP_fsetmod
         if (b->flags & BIO_FLAGS_UPLINK_INTERNAL)
             UP_fsetmod(b->ptr, (char)((num & BIO_FP_TEXT) ? 't' : 'b'));
         else
-# endif
+#endif
         {
-# if defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_WINDOWS)
             int fd = _fileno((FILE *)ptr);
             if (num & BIO_FP_TEXT)
                 _setmode(fd, _O_TEXT);
             else
                 _setmode(fd, _O_BINARY);
-# elif defined(OPENSSL_SYS_MSDOS)
+#elif defined(OPENSSL_SYS_MSDOS)
             int fd = fileno((FILE *)ptr);
             /* Set correct text/binary mode */
             if (num & BIO_FP_TEXT)
@@ -248,11 +248,11 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
                 } else
                     _setmode(fd, _O_BINARY);
             }
-# elif defined(OPENSSL_SYS_WIN32_CYGWIN)
+#elif defined(OPENSSL_SYS_WIN32_CYGWIN)
             int fd = fileno((FILE *)ptr);
             if (!(num & BIO_FP_TEXT))
                 setmode(fd, O_BINARY);
-# endif
+#endif
         }
         break;
     case BIO_C_SET_FILENAME:
@@ -274,20 +274,20 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
             ret = 0;
             break;
         }
-# if defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_WINDOWS)
         if (!(num & BIO_FP_TEXT))
             OPENSSL_strlcat(p, "b", sizeof(p));
         else
             OPENSSL_strlcat(p, "t", sizeof(p));
-# elif defined(OPENSSL_SYS_WIN32_CYGWIN)
+#elif defined(OPENSSL_SYS_WIN32_CYGWIN)
         if (!(num & BIO_FP_TEXT))
             OPENSSL_strlcat(p, "b", sizeof(p));
-# endif
+#endif
         fp = openssl_fopen(ptr, p);
         if (fp == NULL) {
             ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
-                           "calling fopen(%s, %s)",
-                           (const char *)ptr, p);
+                "calling fopen(%s, %s)",
+                (const char *)ptr, p);
             ERR_raise(ERR_LIB_BIO, ERR_R_SYS_LIB);
             ret = 0;
             break;
@@ -312,10 +312,11 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr)
         break;
     case BIO_CTRL_FLUSH:
         st = b->flags & BIO_FLAGS_UPLINK_INTERNAL
-                ? UP_fflush(b->ptr) : fflush((FILE *)b->ptr);
+            ? UP_fflush(b->ptr)
+            : fflush((FILE *)b->ptr);
         if (st == EOF) {
             ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
-                           "calling fflush()");
+                "calling fflush()");
             ERR_raise(ERR_LIB_BIO, ERR_R_SYS_LIB);
             ret = 0;
         }
@@ -349,7 +350,7 @@ static int file_gets(BIO *bp, char *buf, int size)
     }
     if (buf[0] != '\0')
         ret = strlen(buf);
- err:
+err:
     return ret;
 }
 
@@ -405,7 +406,7 @@ static const BIO_METHOD methods_filep = {
     file_ctrl,
     file_new,
     file_free,
-    NULL,                      /* file_callback_ctrl */
+    NULL, /* file_callback_ctrl */
 };
 
 const BIO_METHOD *BIO_s_file(void)
@@ -418,4 +419,4 @@ BIO *BIO_new_file(const char *filename, const char *mode)
     return NULL;
 }
 
-#endif                         /* OPENSSL_NO_STDIO */
+#endif /* OPENSSL_NO_STDIO */
diff --git a/crypto/openssl/crypto/bio/bss_log.c b/crypto/openssl/crypto/bio/bss_log.c
index f587cab2f833..8f8e180468e1 100644
--- a/crypto/openssl/crypto/bio/bss_log.c
+++ b/crypto/openssl/crypto/bio/bss_log.c
@@ -25,26 +25,26 @@
 #if defined(OPENSSL_SYS_WINCE)
 #elif defined(OPENSSL_SYS_WIN32)
 #elif defined(__wasi__)
-# define NO_SYSLOG
+#define NO_SYSLOG
 #elif defined(OPENSSL_SYS_VMS)
-# include <opcdef.h>
-# include <descrip.h>
-# include <lib$routines.h>
-# include <starlet.h>
+#include <opcdef.h>
+#include <descrip.h>
+#include <lib$routines.h>
+#include <starlet.h>
 /* Some compiler options may mask the declaration of "_malloc32". */
-# if __INITIAL_POINTER_SIZE && defined _ANSI_C_SOURCE
-#  if __INITIAL_POINTER_SIZE == 64
-#   pragma pointer_size save
-#   pragma pointer_size 32
+#if __INITIAL_POINTER_SIZE && defined _ANSI_C_SOURCE
+#if __INITIAL_POINTER_SIZE == 64
+#pragma pointer_size save
+#pragma pointer_size 32
 void *_malloc32(__size_t);
-#   pragma pointer_size restore
-#  endif                        /* __INITIAL_POINTER_SIZE == 64 */
-# endif                         /* __INITIAL_POINTER_SIZE && defined
-                                 * _ANSI_C_SOURCE */
+#pragma pointer_size restore
+#endif /* __INITIAL_POINTER_SIZE == 64 */
+#endif /* __INITIAL_POINTER_SIZE && defined \
+        * _ANSI_C_SOURCE */
 #elif defined(__DJGPP__) && defined(OPENSSL_NO_SOCK)
-# define NO_SYSLOG
+#define NO_SYSLOG
 #elif (!defined(MSDOS) || defined(WATT32)) && !defined(OPENSSL_SYS_VXWORKS) && !defined(NO_SYSLOG)
-# include <syslog.h>
+#include <syslog.h>
 #endif
 
 #include <openssl/buffer.h>
@@ -52,30 +52,30 @@ void *_malloc32(__size_t);
 
 #ifndef NO_SYSLOG
 
-# if defined(OPENSSL_SYS_WIN32)
-#  define LOG_EMERG       0
-#  define LOG_ALERT       1
-#  define LOG_CRIT        2
-#  define LOG_ERR         3
-#  define LOG_WARNING     4
-#  define LOG_NOTICE      5
-#  define LOG_INFO        6
-#  define LOG_DEBUG       7
+#if defined(OPENSSL_SYS_WIN32)
+#define LOG_EMERG 0
+#define LOG_ALERT 1
+#define LOG_CRIT 2
+#define LOG_ERR 3
+#define LOG_WARNING 4
+#define LOG_NOTICE 5
+#define LOG_INFO 6
+#define LOG_DEBUG 7
 
-#  define LOG_DAEMON      (3<<3)
-# elif defined(OPENSSL_SYS_VMS)
+#define LOG_DAEMON (3 << 3)
+#elif defined(OPENSSL_SYS_VMS)
 /* On VMS, we don't really care about these, but we need them to compile */
-#  define LOG_EMERG       0
-#  define LOG_ALERT       1
-#  define LOG_CRIT        2
-#  define LOG_ERR         3
-#  define LOG_WARNING     4
-#  define LOG_NOTICE      5
-#  define LOG_INFO        6
-#  define LOG_DEBUG       7
+#define LOG_EMERG 0
+#define LOG_ALERT 1
+#define LOG_CRIT 2
+#define LOG_ERR 3
+#define LOG_WARNING 4
+#define LOG_NOTICE 5
+#define LOG_INFO 6
+#define LOG_DEBUG 7
 
-#  define LOG_DAEMON      OPC$M_NM_NTWORK
-# endif
+#define LOG_DAEMON OPC$M_NM_NTWORK
+#endif
 
 static int slg_write(BIO *h, const char *buf, int num);
 static int slg_puts(BIO *h, const char *str);
@@ -91,14 +91,14 @@ static const BIO_METHOD methods_slg = {
     "syslog",
     bwrite_conv,
     slg_write,
-    NULL,                      /* slg_write_old,    */
-    NULL,                      /* slg_read,         */
+    NULL, /* slg_write_old,    */
+    NULL, /* slg_read,         */
     slg_puts,
     NULL,
     slg_ctrl,
     slg_new,
     slg_free,
-    NULL,                      /* slg_callback_ctrl */
+    NULL, /* slg_callback_ctrl */
 };
 
 const BIO_METHOD *BIO_s_log(void)
@@ -134,66 +134,26 @@ static int slg_write(BIO *b, const char *in, int inl)
         char str[10];
         int log_level;
     } mapping[] = {
-        {
-            6, "PANIC ", LOG_EMERG
-        },
-        {
-            6, "EMERG ", LOG_EMERG
-        },
-        {
-            4, "EMR ", LOG_EMERG
-        },
-        {
-            6, "ALERT ", LOG_ALERT
-        },
-        {
-            4, "ALR ", LOG_ALERT
-        },
-        {
-            5, "CRIT ", LOG_CRIT
-        },
-        {
-            4, "CRI ", LOG_CRIT
-        },
-        {
-            6, "ERROR ", LOG_ERR
-        },
-        {
-            4, "ERR ", LOG_ERR
-        },
-        {
-            8, "WARNING ", LOG_WARNING
-        },
-        {
-            5, "WARN ", LOG_WARNING
-        },
-        {
-            4, "WAR ", LOG_WARNING
-        },
-        {
-            7, "NOTICE ", LOG_NOTICE
-        },
-        {
-            5, "NOTE ", LOG_NOTICE
-        },
-        {
-            4, "NOT ", LOG_NOTICE
-        },
-        {
-            5, "INFO ", LOG_INFO
-        },
-        {
-            4, "INF ", LOG_INFO
-        },
-        {
-            6, "DEBUG ", LOG_DEBUG
-        },
-        {
-            4, "DBG ", LOG_DEBUG
-        },
-        {
-            0, "", LOG_ERR
-        }
+        { 6, "PANIC ", LOG_EMERG },
+        { 6, "EMERG ", LOG_EMERG },
+        { 4, "EMR ", LOG_EMERG },
+        { 6, "ALERT ", LOG_ALERT },
+        { 4, "ALR ", LOG_ALERT },
+        { 5, "CRIT ", LOG_CRIT },
+        { 4, "CRI ", LOG_CRIT },
+        { 6, "ERROR ", LOG_ERR },
+        { 4, "ERR ", LOG_ERR },
+        { 8, "WARNING ", LOG_WARNING },
+        { 5, "WARN ", LOG_WARNING },
+        { 4, "WAR ", LOG_WARNING },
+        { 7, "NOTICE ", LOG_NOTICE },
+        { 5, "NOTE ", LOG_NOTICE },
+        { 4, "NOT ", LOG_NOTICE },
+        { 5, "INFO ", LOG_INFO },
+        { 4, "INF ", LOG_INFO },
+        { 6, "DEBUG ", LOG_DEBUG },
+        { 4, "DBG ", LOG_DEBUG },
+        { 0, "", LOG_ERR }
         /* The default */
     };
 
@@ -238,7 +198,7 @@ static int slg_puts(BIO *bp, const char *str)
     return ret;
 }
 
-# if defined(OPENSSL_SYS_WIN32)
+#if defined(OPENSSL_SYS_WIN32)
 
 static void xopenlog(BIO *bp, char *name, int level)
 {
@@ -291,11 +251,11 @@ static void xsyslog(BIO *bp, int priority, const char *string)
 static void xcloselog(BIO *bp)
 {
     if (bp->ptr)
-        DeregisterEventSource((HANDLE) (bp->ptr));
+        DeregisterEventSource((HANDLE)(bp->ptr));
     bp->ptr = NULL;
 }
 
-# elif defined(OPENSSL_SYS_VMS)
+#elif defined(OPENSSL_SYS_VMS)
 
 static int VMS_OPC_target = LOG_DAEMON;
 
@@ -309,21 +269,21 @@ static void xsyslog(BIO *bp, int priority, const char *string)
     struct dsc$descriptor_s opc_dsc;
 
 /* Arrange 32-bit pointer to opcdef buffer and malloc(), if needed. */
-#  if __INITIAL_POINTER_SIZE == 64
-#   pragma pointer_size save
-#   pragma pointer_size 32
-#   define OPCDEF_TYPE __char_ptr32
-#   define OPCDEF_MALLOC _malloc32
-#  else                         /* __INITIAL_POINTER_SIZE == 64 */
-#   define OPCDEF_TYPE char *
-#   define OPCDEF_MALLOC OPENSSL_malloc
-#  endif                        /* __INITIAL_POINTER_SIZE == 64 [else] */
+#if __INITIAL_POINTER_SIZE == 64
+#pragma pointer_size save
+#pragma pointer_size 32
+#define OPCDEF_TYPE __char_ptr32
+#define OPCDEF_MALLOC _malloc32
+#else /* __INITIAL_POINTER_SIZE == 64 */
+#define OPCDEF_TYPE char *
+#define OPCDEF_MALLOC OPENSSL_malloc
+#endif /* __INITIAL_POINTER_SIZE == 64 [else] */
 
     struct opcdef *opcdef_p;
 
-#  if __INITIAL_POINTER_SIZE == 64
-#   pragma pointer_size restore
-#  endif                        /* __INITIAL_POINTER_SIZE == 64 */
+#if __INITIAL_POINTER_SIZE == 64
+#pragma pointer_size restore
+#endif /* __INITIAL_POINTER_SIZE == 64 */
 
     char buf[10240];
     unsigned int len;
@@ -374,7 +334,7 @@ static void xsyslog(BIO *bp, int priority, const char *string)
 
     opc_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
     opc_dsc.dsc$b_class = DSC$K_CLASS_S;
-    opc_dsc.dsc$a_pointer = (OPCDEF_TYPE) opcdef_p;
+    opc_dsc.dsc$a_pointer = (OPCDEF_TYPE)opcdef_p;
     opc_dsc.dsc$w_length = len + 8;
 
     sys$sndopr(opc_dsc, 0);
@@ -386,15 +346,15 @@ static void xcloselog(BIO *bp)
 {
 }
 
-# else                          /* Unix/Watt32 */
+#else /* Unix/Watt32 */
 
 static void xopenlog(BIO *bp, char *name, int level)
 {
-#  ifdef WATT32                 /* djgpp/DOS */
+#ifdef WATT32 /* djgpp/DOS */
     openlog(name, LOG_PID | LOG_CONS | LOG_NDELAY, level);
-#  else
+#else
     openlog(name, LOG_PID | LOG_CONS, level);
-#  endif
+#endif
 }
 
 static void xsyslog(BIO *bp, int priority, const char *string)
@@ -407,11 +367,11 @@ static void xcloselog(BIO *bp)
     closelog();
 }
 
-# endif                         /* Unix */
+#endif /* Unix */
 
-#else                           /* NO_SYSLOG */
+#else /* NO_SYSLOG */
 const BIO_METHOD *BIO_s_log(void)
 {
     return NULL;
 }
-#endif                          /* NO_SYSLOG */
+#endif /* NO_SYSLOG */
diff --git a/crypto/openssl/crypto/bio/bss_mem.c b/crypto/openssl/crypto/bio/bss_mem.c
index 8cbea38a9021..4b21025c38b5 100644
--- a/crypto/openssl/crypto/bio/bss_mem.c
+++ b/crypto/openssl/crypto/bio/bss_mem.c
@@ -35,7 +35,7 @@ static const BIO_METHOD mem_method = {
     mem_ctrl,
     mem_new,
     mem_free,
-    NULL,                      /* mem_callback_ctrl */
+    NULL, /* mem_callback_ctrl */
 };
 
 static const BIO_METHOD secmem_method = {
@@ -50,7 +50,7 @@ static const BIO_METHOD secmem_method = {
     mem_ctrl,
     secmem_new,
     mem_free,
-    NULL,                      /* mem_callback_ctrl */
+    NULL, /* mem_callback_ctrl */
 };
 
 /*
@@ -60,7 +60,7 @@ static const BIO_METHOD secmem_method = {
  * to be used for reset.
  */
 typedef struct bio_buf_mem_st {
-    struct buf_mem_st *buf;   /* allocated buffer */
+    struct buf_mem_st *buf; /* allocated buffer */
     struct buf_mem_st *readp; /* read pointer */
 } BIO_BUF_MEM;
 
@@ -235,7 +235,7 @@ static int mem_write(BIO *b, const char *in, int inl)
     memcpy(bbm->buf->data + blen, in, inl);
     *bbm->readp = *bbm->buf;
     ret = inl;
- end:
+end:
     return ret;
 }
 
@@ -244,7 +244,7 @@ static long mem_ctrl(BIO *b, int cmd, long num, void *ptr)
     long ret = 1;
     char **pptr;
     BIO_BUF_MEM *bbm = (BIO_BUF_MEM *)b->ptr;
-    BUF_MEM *bm, *bo;            /* bio_mem, bio_other */
+    BUF_MEM *bm, *bo; /* bio_mem, bio_other */
     long off, remain;
 
     if (b->flags & BIO_FLAGS_MEM_RDONLY) {
@@ -275,7 +275,7 @@ static long mem_ctrl(BIO *b, int cmd, long num, void *ptr)
         break;
     case BIO_C_FILE_SEEK:
         if (num < 0 || num > off + remain)
-            return -1;   /* Can't see outside of the current buffer */
+            return -1; /* Can't see outside of the current buffer */
 
         bm->data = (num != 0) ? bo->data + num : bo->data;
         bm->length = bo->length - num;
diff --git a/crypto/openssl/crypto/bio/bss_null.c b/crypto/openssl/crypto/bio/bss_null.c
index ba266f186c21..96ecdabcc4eb 100644
--- a/crypto/openssl/crypto/bio/bss_null.c
+++ b/crypto/openssl/crypto/bio/bss_null.c
@@ -29,7 +29,7 @@ static const BIO_METHOD null_method = {
     null_ctrl,
     NULL,
     NULL,
-    NULL,                     /* null_callback_ctrl */
+    NULL, /* null_callback_ctrl */
 };
 
 const BIO_METHOD *BIO_s_null(void)
diff --git a/crypto/openssl/crypto/bio/bss_sock.c b/crypto/openssl/crypto/bio/bss_sock.c
index 82f7be85ae0c..70a538c2a509 100644
--- a/crypto/openssl/crypto/bio/bss_sock.c
+++ b/crypto/openssl/crypto/bio/bss_sock.c
@@ -16,17 +16,17 @@
 
 #ifndef OPENSSL_NO_SOCK
 
-# include <openssl/bio.h>
+#include <openssl/bio.h>
 
-# ifdef WATT32
+#ifdef WATT32
 /* Watt-32 uses same names */
-#  undef sock_write
-#  undef sock_read
-#  undef sock_puts
-#  define sock_write SockWrite
-#  define sock_read  SockRead
-#  define sock_puts  SockPuts
-# endif
+#undef sock_write
+#undef sock_read
+#undef sock_puts
+#define sock_write SockWrite
+#define sock_read SockRead
+#define sock_puts SockPuts
+#endif
 
 struct bss_sock_st {
     BIO_ADDR tfo_peer;
@@ -52,11 +52,11 @@ static const BIO_METHOD methods_sockp = {
     bread_conv,
     sock_read,
     sock_puts,
-    NULL,                       /* sock_gets,         */
+    NULL, /* sock_gets,         */
     sock_ctrl,
     sock_new,
     sock_free,
-    NULL,                       /* sock_callback_ctrl */
+    NULL, /* sock_callback_ctrl */
 };
 
 const BIO_METHOD *BIO_s_socket(void)
@@ -72,17 +72,6 @@ BIO *BIO_new_socket(int fd, int close_flag)
     if (ret == NULL)
         return NULL;
     BIO_set_fd(ret, fd, close_flag);
-# ifndef OPENSSL_NO_KTLS
-    {
-        /*
-         * The new socket is created successfully regardless of ktls_enable.
-         * ktls_enable doesn't change any functionality of the socket, except
-         * changing the setsockopt to enable the processing of ktls_start.
-         * Thus, it is not a problem to call it for non-TLS sockets.
-         */
-        ktls_enable(fd);
-    }
-# endif
     return ret;
 }
 
@@ -119,11 +108,11 @@ static int sock_read(BIO *b, char *out, int outl)
 
     if (out != NULL) {
         clear_socket_error();
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
         if (BIO_get_ktls_recv(b))
             ret = ktls_read_record(b->num, out, outl);
         else
-# endif
+#endif
             ret = readsocket(b->num, out, outl);
         BIO_clear_retry_flags(b);
         if (ret <= 0) {
@@ -139,12 +128,12 @@ static int sock_read(BIO *b, char *out, int outl)
 static int sock_write(BIO *b, const char *in, int inl)
 {
     int ret = 0;
-# if !defined(OPENSSL_NO_KTLS) || defined(OSSL_TFO_SENDTO)
+#if !defined(OPENSSL_NO_KTLS) || defined(OSSL_TFO_SENDTO)
     struct bss_sock_st *data = (struct bss_sock_st *)b->ptr;
-# endif
+#endif
 
     clear_socket_error();
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
     if (BIO_should_ktls_ctrl_msg_flag(b)) {
         unsigned char record_type = data->ktls_record_type;
         ret = ktls_send_ctrl_message(b->num, record_type, in, inl);
@@ -153,17 +142,17 @@ static int sock_write(BIO *b, const char *in, int inl)
             BIO_clear_ktls_ctrl_msg_flag(b);
         }
     } else
-# endif
-# if defined(OSSL_TFO_SENDTO)
-    if (data->tfo_first) {
+#endif
+#if defined(OSSL_TFO_SENDTO)
+        if (data->tfo_first) {
         struct bss_sock_st *data = (struct bss_sock_st *)b->ptr;
         socklen_t peerlen = BIO_ADDR_sockaddr_size(&data->tfo_peer);
 
         ret = sendto(b->num, in, inl, OSSL_TFO_SENDTO,
-                     BIO_ADDR_sockaddr(&data->tfo_peer), peerlen);
+            BIO_ADDR_sockaddr(&data->tfo_peer), peerlen);
         data->tfo_first = 0;
     } else
-# endif
+#endif
         ret = writesocket(b->num, in, inl);
     BIO_clear_retry_flags(b);
     if (ret <= 0) {
@@ -178,9 +167,9 @@ static long sock_ctrl(BIO *b, int cmd, long num, void *ptr)
     long ret = 1;
     int *ip;
     struct bss_sock_st *data = (struct bss_sock_st *)b->ptr;
-# ifndef OPENSSL_NO_KTLS
+#ifndef OPENSSL_NO_KTLS
     ktls_crypto_info_t *crypto_info;
-# endif
+#endif
 
     switch (cmd) {
     case BIO_C_SET_FD:
@@ -216,20 +205,18 @@ static long sock_ctrl(BIO *b, int cmd, long num, void *ptr)
         ret = 1;
         break;
     case BIO_CTRL_GET_RPOLL_DESCRIPTOR:
-    case BIO_CTRL_GET_WPOLL_DESCRIPTOR:
-        {
-            BIO_POLL_DESCRIPTOR *pd = ptr;
-
-            if (!b->init) {
-                ret = 0;
-                break;
-            }
+    case BIO_CTRL_GET_WPOLL_DESCRIPTOR: {
+        BIO_POLL_DESCRIPTOR *pd = ptr;
 
-            pd->type        = BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD;
-            pd->value.fd    = b->num;
+        if (!b->init) {
+            ret = 0;
+            break;
         }
-        break;
-# ifndef OPENSSL_NO_KTLS
+
+        pd->type = BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD;
+        pd->value.fd = b->num;
+    } break;
+#ifndef OPENSSL_NO_KTLS
     case BIO_CTRL_SET_KTLS:
         crypto_info = (ktls_crypto_info_t *)ptr;
         ret = ktls_start(b->num, crypto_info, num);
@@ -254,7 +241,7 @@ static long sock_ctrl(BIO *b, int cmd, long num, void *ptr)
         if (ret)
             BIO_set_ktls_zerocopy_sendfile_flag(b);
         break;
-# endif
+#endif
     case BIO_CTRL_EOF:
         ret = (b->flags & BIO_FLAGS_IN_EOF) != 0;
         break;
@@ -270,7 +257,7 @@ static long sock_ctrl(BIO *b, int cmd, long num, void *ptr)
     case BIO_C_SET_CONNECT:
         if (ptr != NULL && num == 2) {
             ret = BIO_ADDR_make(&data->tfo_peer,
-                                BIO_ADDR_sockaddr((const BIO_ADDR *)ptr));
+                BIO_ADDR_sockaddr((const BIO_ADDR *)ptr));
             if (ret)
                 data->tfo_first = 1;
         } else {
@@ -308,47 +295,47 @@ int BIO_sock_should_retry(int i)
 int BIO_sock_non_fatal_error(int err)
 {
     switch (err) {
-# if defined(OPENSSL_SYS_WINDOWS)
-#  if defined(WSAEWOULDBLOCK)
+#if defined(OPENSSL_SYS_WINDOWS)
+#if defined(WSAEWOULDBLOCK)
     case WSAEWOULDBLOCK:
-#  endif
-# endif
+#endif
+#endif
 
-# ifdef EWOULDBLOCK
-#  ifdef WSAEWOULDBLOCK
-#   if WSAEWOULDBLOCK != EWOULDBLOCK
+#ifdef EWOULDBLOCK
+#ifdef WSAEWOULDBLOCK
+#if WSAEWOULDBLOCK != EWOULDBLOCK
     case EWOULDBLOCK:
-#   endif
-#  else
+#endif
+#else
     case EWOULDBLOCK:
-#  endif
-# endif
+#endif
+#endif
 
-# if defined(ENOTCONN)
+#if defined(ENOTCONN)
     case ENOTCONN:
-# endif
+#endif
 
-# ifdef EINTR
+#ifdef EINTR
     case EINTR:
-# endif
+#endif
 
-# ifdef EAGAIN
-#  if EWOULDBLOCK != EAGAIN
+#ifdef EAGAIN
+#if EWOULDBLOCK != EAGAIN
     case EAGAIN:
-#  endif
-# endif
+#endif
+#endif
 
-# ifdef EPROTO
+#ifdef EPROTO
     case EPROTO:
-# endif
+#endif
 
-# ifdef EINPROGRESS
+#ifdef EINPROGRESS
     case EINPROGRESS:
-# endif
+#endif
 
-# ifdef EALREADY
+#ifdef EALREADY
     case EALREADY:
-# endif
+#endif
         return 1;
     default:
         break;
@@ -356,4 +343,4 @@ int BIO_sock_non_fatal_error(int err)
     return 0;
 }
 
-#endif                          /* #ifndef OPENSSL_NO_SOCK */
+#endif /* #ifndef OPENSSL_NO_SOCK */
diff --git a/crypto/openssl/crypto/bio/ossl_core_bio.c b/crypto/openssl/crypto/bio/ossl_core_bio.c
index 8d21115b652d..79fb54abd9db 100644
--- a/crypto/openssl/crypto/bio/ossl_core_bio.c
+++ b/crypto/openssl/crypto/bio/ossl_core_bio.c
@@ -90,13 +90,13 @@ OSSL_CORE_BIO *ossl_core_bio_new_mem_buf(const void *buf, int len)
 }
 
 int ossl_core_bio_read_ex(OSSL_CORE_BIO *cb, void *data, size_t dlen,
-                          size_t *readbytes)
+    size_t *readbytes)
 {
     return BIO_read_ex(cb->bio, data, dlen, readbytes);
 }
 
 int ossl_core_bio_write_ex(OSSL_CORE_BIO *cb, const void *data, size_t dlen,
-                           size_t *written)
+    size_t *written)
 {
     return BIO_write_ex(cb->bio, data, dlen, written);
 }
diff --git a/crypto/openssl/crypto/bn/asm/rsaz-2k-avx512.pl b/crypto/openssl/crypto/bn/asm/rsaz-2k-avx512.pl
index 131e315324c1..27f2e9b4b938 100644
--- a/crypto/openssl/crypto/bn/asm/rsaz-2k-avx512.pl
+++ b/crypto/openssl/crypto/bn/asm/rsaz-2k-avx512.pl
@@ -40,13 +40,15 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 die "can't locate x86_64-xlate.pl";
 
 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
-        =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
-    $avx512ifma = ($1>=2.26);
+        =~ /GNU assembler version ([0-9]+)\.([0-9]+)/) {
+    my $ver = $1 + $2/100.0; # 3.1->3.01, 3.10->3.10
+    $avx512ifma = ($ver >= 2.26);
 }
 
 if (!$avx512ifma && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
-       `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?/) {
-    $avx512ifma = ($1==2.11 && $2>=8) + ($1>=2.12);
+       `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)(?:\.([0-9]+))?/) {
+    my $ver = $1 + $2/100.0 + $3/10000.0; # 3.1.0->3.01, 3.10.1->3.1001
+    $avx512ifma = ($ver >= 2.1108);
 }
 
 if (!$avx512ifma && `$ENV{CC} -v 2>&1`
diff --git a/crypto/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl b/crypto/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl
index 0c962f248dd9..ea45d2051a70 100644
--- a/crypto/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl
+++ b/crypto/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl
@@ -28,8 +28,9 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 die "can't locate x86_64-xlate.pl";
 
 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
-        =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
-    $avxifma = ($1>=2.40);
+        =~ /GNU assembler version ([0-9]+)\.([0-9]+)/) {
+    my $ver = $1 + $2/100.0;	# 3.1->3.01, 3.10->3.10
+    $avxifma = ($ver >= 2.40);
 }
 
 if (!$avxifma && `$ENV{CC} -v 2>&1`
@@ -39,8 +40,9 @@ if (!$avxifma && `$ENV{CC} -v 2>&1`
 }
 
 if ($win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
-       `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?(rc[0-9]+)?/) {
-    $avxifma = ($1>2.16) + ($1==2.16 && ((!defined($2) && !defined($3)) || (defined($2))));
+       `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)(?:\.([0-9]+))?(rc[0-9]+)?/) {
+    my $ver = $1 + $2/100.0 + $3/10000.0; # 3.1.0->3.01, 3.10.1->3.1001
+    $avxifma = ($ver > 2.16) + ($ver == 2.16 && !defined($4));
 }
 
 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
diff --git a/crypto/openssl/crypto/bn/asm/rsaz-3k-avx512.pl b/crypto/openssl/crypto/bn/asm/rsaz-3k-avx512.pl
index 235268a68ad7..b2ed3e8ca7cf 100644
--- a/crypto/openssl/crypto/bn/asm/rsaz-3k-avx512.pl
+++ b/crypto/openssl/crypto/bn/asm/rsaz-3k-avx512.pl
@@ -39,13 +39,15 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 die "can't locate x86_64-xlate.pl";
 
 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
-        =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
-    $avx512ifma = ($1>=2.26);
+        =~ /GNU assembler version ([0-9]+)\.([0-9]+)/) {
+    my $ver = $1 + $2/100.0; # 3.1->3.01, 3.10->3.10
+    $avx512ifma = ($ver >= 2.26);
 }
 
 if (!$avx512ifma && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
-       `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?/) {
-    $avx512ifma = ($1==2.11 && $2>=8) + ($1>=2.12);
+       `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)(?:\.([0-9]+))?/) {
+    my $ver = $1 + $2/100.0 + $3/10000.0; # 3.1.0->3.01, 3.10.1->3.1001
+    $avx512ifma = ($ver >= 2.1108);
 }
 
 if (!$avx512ifma && `$ENV{CC} -v 2>&1`
diff --git a/crypto/openssl/crypto/bn/asm/rsaz-4k-avx512.pl b/crypto/openssl/crypto/bn/asm/rsaz-4k-avx512.pl
index e39374362b6e..b76ab5904c88 100644
--- a/crypto/openssl/crypto/bn/asm/rsaz-4k-avx512.pl
+++ b/crypto/openssl/crypto/bn/asm/rsaz-4k-avx512.pl
@@ -39,13 +39,15 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 die "can't locate x86_64-xlate.pl";
 
 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
-        =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
-    $avx512ifma = ($1>=2.26);
+        =~ /GNU assembler version ([0-9]+)\.([0-9]+)/) {
+    my $ver = $1 + $2/100.0; # 3.1->3.01, 3.10->3.10
+    $avx512ifma = ($ver >= 2.26);
 }
 
 if (!$avx512ifma && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
-       `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)(?:\.([0-9]+))?/) {
-    $avx512ifma = ($1==2.11 && $2>=8) + ($1>=2.12);
+       `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)(?:\.([0-9]+))?/) {
+    my $ver = $1 + $2/100.0 + $3/10000.0; # 3.1.0->3.01, 3.10.1->3.1001
+    $avx512ifma = ($ver >= 2.1108);
 }
 
 if (!$avx512ifma && `$ENV{CC} -v 2>&1`
diff --git a/crypto/openssl/crypto/bn/asm/rsaz-x86_64.pl b/crypto/openssl/crypto/bn/asm/rsaz-x86_64.pl
index 36bf229477aa..64acf8f0d84d 100755
--- a/crypto/openssl/crypto/bn/asm/rsaz-x86_64.pl
+++ b/crypto/openssl/crypto/bn/asm/rsaz-x86_64.pl
@@ -69,13 +69,15 @@ open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
 *STDOUT=*OUT;
 
 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
-		=~ /GNU assembler version ([2-9]\.[0-9]+)/) {
-	$addx = ($1>=2.23);
+		=~ /GNU assembler version ([0-9]+)\.([0-9]+)/) {
+	my $ver = $1 + $2/100.0;	# 3.1->3.01, 3.10->3.10
+	$addx = ($ver >= 2.23);
 }
 
 if (!$addx && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
-	    `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)/) {
-	$addx = ($1>=2.10);
+	    `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)/) {
+	my $ver = $1 + $2/100.0;	# 3.1->3.01, 3.10->3.10
+	$addx = ($ver >= 2.10);
 }
 
 if (!$addx && $win64 && ($flavour =~ /masm/ || $ENV{ASM} =~ /ml64/) &&
diff --git a/crypto/openssl/crypto/bn/asm/x86_64-gcc.c b/crypto/openssl/crypto/bn/asm/x86_64-gcc.c
index 68453b3d5276..1e123ede7731 100644
--- a/crypto/openssl/crypto/bn/asm/x86_64-gcc.c
+++ b/crypto/openssl/crypto/bn/asm/x86_64-gcc.c
@@ -8,8 +8,10 @@
  */
 
 #include "../bn_local.h"
-#if !(defined(__GNUC__) && __GNUC__>=2)
+#if !(defined(__GNUC__) && __GNUC__ >= 2)
+/* clang-format off */
 # include "../bn_asm.c"         /* kind of dirty hack for Sun Studio */
+/* clang-format on */
 #else
 /*-
  * x86_64 BIGNUM accelerator version 0.1, December 2002.
@@ -63,52 +65,54 @@
  *    machine.
  */
 
-# undef mul
-# undef mul_add
+#undef mul
+#undef mul_add
 
 /*-
  * "m"(a), "+m"(r)      is the way to favor DirectPath µ-code;
  * "g"(0)               let the compiler to decide where does it
  *                      want to keep the value of zero;
  */
-# define mul_add(r,a,word,carry) do {   \
-        register BN_ULONG high,low;     \
-        asm ("mulq %3"                  \
-                : "=a"(low),"=d"(high)  \
-                : "a"(word),"m"(a)      \
-                : "cc");                \
-        asm ("addq %2,%0; adcq %3,%1"   \
-                : "+r"(carry),"+d"(high)\
-                : "a"(low),"g"(0)       \
-                : "cc");                \
-        asm ("addq %2,%0; adcq %3,%1"   \
-                : "+m"(r),"+d"(high)    \
-                : "r"(carry),"g"(0)     \
-                : "cc");                \
-        carry=high;                     \
-        } while (0)
+#define mul_add(r, a, word, carry)    \
+    do {                              \
+        register BN_ULONG high, low;  \
+        asm("mulq %3"                 \
+            : "=a"(low), "=d"(high)   \
+            : "a"(word), "m"(a)       \
+            : "cc");                  \
+        asm("addq %2,%0; adcq %3,%1"  \
+            : "+r"(carry), "+d"(high) \
+            : "a"(low), "g"(0)        \
+            : "cc");                  \
+        asm("addq %2,%0; adcq %3,%1"  \
+            : "+m"(r), "+d"(high)     \
+            : "r"(carry), "g"(0)      \
+            : "cc");                  \
+        carry = high;                 \
+    } while (0)
 
-# define mul(r,a,word,carry) do {       \
-        register BN_ULONG high,low;     \
-        asm ("mulq %3"                  \
-                : "=a"(low),"=d"(high)  \
-                : "a"(word),"g"(a)      \
-                : "cc");                \
-        asm ("addq %2,%0; adcq %3,%1"   \
-                : "+r"(carry),"+d"(high)\
-                : "a"(low),"g"(0)       \
-                : "cc");                \
-        (r)=carry, carry=high;          \
-        } while (0)
-# undef sqr
-# define sqr(r0,r1,a)                   \
-        asm ("mulq %2"                  \
-                : "=a"(r0),"=d"(r1)     \
-                : "a"(a)                \
-                : "cc");
+#define mul(r, a, word, carry)        \
+    do {                              \
+        register BN_ULONG high, low;  \
+        asm("mulq %3"                 \
+            : "=a"(low), "=d"(high)   \
+            : "a"(word), "g"(a)       \
+            : "cc");                  \
+        asm("addq %2,%0; adcq %3,%1"  \
+            : "+r"(carry), "+d"(high) \
+            : "a"(low), "g"(0)        \
+            : "cc");                  \
+        (r) = carry, carry = high;    \
+    } while (0)
+#undef sqr
+#define sqr(r0, r1, a)       \
+    asm("mulq %2"            \
+        : "=a"(r0), "=d"(r1) \
+        : "a"(a)             \
+        : "cc");
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num,
-                          BN_ULONG w)
+    BN_ULONG w)
 {
     BN_ULONG c1 = 0;
 
@@ -195,15 +199,15 @@ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
 {
     BN_ULONG ret, waste;
 
- asm("divq      %4":"=a"(ret), "=d"(waste)
- :     "a"(l), "d"(h), "r"(d)
- :     "cc");
+    asm("divq      %4" : "=a"(ret), "=d"(waste)
+        : "a"(l), "d"(h), "r"(d)
+        : "cc");
 
     return ret;
 }
 
 BN_ULONG bn_add_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                      int n)
+    int n)
 {
     BN_ULONG ret;
     size_t i = 0;
@@ -211,26 +215,26 @@ BN_ULONG bn_add_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
     if (n <= 0)
         return 0;
 
-    asm volatile ("       subq    %0,%0           \n" /* clear carry */
-                  "       jmp     1f              \n"
-                  ".p2align 4                     \n"
-                  "1:     movq    (%4,%2,8),%0    \n"
-                  "       adcq    (%5,%2,8),%0    \n"
-                  "       movq    %0,(%3,%2,8)    \n"
-                  "       lea     1(%2),%2        \n"
-                  "       dec     %1              \n"
-                  "       jnz     1b              \n"
-                  "       sbbq    %0,%0           \n"
-                  :"=&r" (ret), "+c"(n), "+r"(i)
-                  :"r"(rp), "r"(ap), "r"(bp)
-                  :"cc", "memory");
+    asm volatile("       subq    %0,%0           \n" /* clear carry */
+                 "       jmp     1f              \n"
+                 ".p2align 4                     \n"
+                 "1:     movq    (%4,%2,8),%0    \n"
+                 "       adcq    (%5,%2,8),%0    \n"
+                 "       movq    %0,(%3,%2,8)    \n"
+                 "       lea     1(%2),%2        \n"
+                 "       dec     %1              \n"
+                 "       jnz     1b              \n"
+                 "       sbbq    %0,%0           \n"
+        : "=&r"(ret), "+c"(n), "+r"(i)
+        : "r"(rp), "r"(ap), "r"(bp)
+        : "cc", "memory");
 
     return ret & 1;
 }
 
-# ifndef SIMICS
+#ifndef SIMICS
 BN_ULONG bn_sub_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                      int n)
+    int n)
 {
     BN_ULONG ret;
     size_t i = 0;
@@ -238,25 +242,25 @@ BN_ULONG bn_sub_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
     if (n <= 0)
         return 0;
 
-    asm volatile ("       subq    %0,%0           \n" /* clear borrow */
-                  "       jmp     1f              \n"
-                  ".p2align 4                     \n"
-                  "1:     movq    (%4,%2,8),%0    \n"
-                  "       sbbq    (%5,%2,8),%0    \n"
-                  "       movq    %0,(%3,%2,8)    \n"
-                  "       lea     1(%2),%2        \n"
-                  "       dec     %1              \n"
-                  "       jnz     1b              \n"
-                  "       sbbq    %0,%0           \n"
-                  :"=&r" (ret), "+c"(n), "+r"(i)
-                  :"r"(rp), "r"(ap), "r"(bp)
-                  :"cc", "memory");
+    asm volatile("       subq    %0,%0           \n" /* clear borrow */
+                 "       jmp     1f              \n"
+                 ".p2align 4                     \n"
+                 "1:     movq    (%4,%2,8),%0    \n"
+                 "       sbbq    (%5,%2,8),%0    \n"
+                 "       movq    %0,(%3,%2,8)    \n"
+                 "       lea     1(%2),%2        \n"
+                 "       dec     %1              \n"
+                 "       jnz     1b              \n"
+                 "       sbbq    %0,%0           \n"
+        : "=&r"(ret), "+c"(n), "+r"(i)
+        : "r"(rp), "r"(ap), "r"(bp)
+        : "cc", "memory");
 
     return ret & 1;
 }
-# else
+#else
 /* Simics 1.4<7 has buggy sbbq:-( */
-#  define BN_MASK2 0xffffffffffffffffL
+#define BN_MASK2 0xffffffffffffffffL
 BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
 {
     BN_ULONG t1, t2;
@@ -304,7 +308,7 @@ BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
     }
     return c;
 }
-# endif
+#endif
 
 /* mul_add_c(a,b,c0,c1,c2)  -- c+=a*b for three word number c=(c2,c1,c0) */
 /* mul_add_c2(a,b,c0,c1,c2) -- c+=2*a*b for three word number c=(c2,c1,c0) */
@@ -318,77 +322,91 @@ BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
  * Keep in mind that carrying into high part of multiplication result
  * can not overflow, because it cannot be all-ones.
  */
-# if 0
+#if 0
 /* original macros are kept for reference purposes */
-#  define mul_add_c(a,b,c0,c1,c2)       do {    \
-        BN_ULONG ta = (a), tb = (b);            \
-        BN_ULONG lo, hi;                        \
-        BN_UMULT_LOHI(lo,hi,ta,tb);             \
-        c0 += lo; hi += (c0<lo)?1:0;            \
-        c1 += hi; c2 += (c1<hi)?1:0;            \
-        } while(0)
+#define mul_add_c(a, b, c0, c1, c2)    \
+    do {                               \
+        BN_ULONG ta = (a), tb = (b);   \
+        BN_ULONG lo, hi;               \
+        BN_UMULT_LOHI(lo, hi, ta, tb); \
+        c0 += lo;                      \
+        hi += (c0 < lo) ? 1 : 0;       \
+        c1 += hi;                      \
+        c2 += (c1 < hi) ? 1 : 0;       \
+    } while (0)
 
-#  define mul_add_c2(a,b,c0,c1,c2)      do {    \
-        BN_ULONG ta = (a), tb = (b);            \
-        BN_ULONG lo, hi, tt;                    \
-        BN_UMULT_LOHI(lo,hi,ta,tb);             \
-        c0 += lo; tt = hi+((c0<lo)?1:0);        \
-        c1 += tt; c2 += (c1<tt)?1:0;            \
-        c0 += lo; hi += (c0<lo)?1:0;            \
-        c1 += hi; c2 += (c1<hi)?1:0;            \
-        } while(0)
+#define mul_add_c2(a, b, c0, c1, c2)   \
+    do {                               \
+        BN_ULONG ta = (a), tb = (b);   \
+        BN_ULONG lo, hi, tt;           \
+        BN_UMULT_LOHI(lo, hi, ta, tb); \
+        c0 += lo;                      \
+        tt = hi + ((c0 < lo) ? 1 : 0); \
+        c1 += tt;                      \
+        c2 += (c1 < tt) ? 1 : 0;       \
+        c0 += lo;                      \
+        hi += (c0 < lo) ? 1 : 0;       \
+        c1 += hi;                      \
+        c2 += (c1 < hi) ? 1 : 0;       \
+    } while (0)
 
-#  define sqr_add_c(a,i,c0,c1,c2)       do {    \
-        BN_ULONG ta = (a)[i];                   \
-        BN_ULONG lo, hi;                        \
-        BN_UMULT_LOHI(lo,hi,ta,ta);             \
-        c0 += lo; hi += (c0<lo)?1:0;            \
-        c1 += hi; c2 += (c1<hi)?1:0;            \
-        } while(0)
-# else
-#  define mul_add_c(a,b,c0,c1,c2) do {  \
-        BN_ULONG t1,t2;                 \
-        asm ("mulq %3"                  \
-                : "=a"(t1),"=d"(t2)     \
-                : "a"(a),"m"(b)         \
-                : "cc");                \
-        asm ("addq %3,%0; adcq %4,%1; adcq %5,%2"       \
-                : "+r"(c0),"+r"(c1),"+r"(c2)            \
-                : "r"(t1),"r"(t2),"g"(0)                \
-                : "cc");                                \
-        } while (0)
+#define sqr_add_c(a, i, c0, c1, c2)    \
+    do {                               \
+        BN_ULONG ta = (a)[i];          \
+        BN_ULONG lo, hi;               \
+        BN_UMULT_LOHI(lo, hi, ta, ta); \
+        c0 += lo;                      \
+        hi += (c0 < lo) ? 1 : 0;       \
+        c1 += hi;                      \
+        c2 += (c1 < hi) ? 1 : 0;       \
+    } while (0)
+#else
+#define mul_add_c(a, b, c0, c1, c2)              \
+    do {                                         \
+        BN_ULONG t1, t2;                         \
+        asm("mulq %3"                            \
+            : "=a"(t1), "=d"(t2)                 \
+            : "a"(a), "m"(b)                     \
+            : "cc");                             \
+        asm("addq %3,%0; adcq %4,%1; adcq %5,%2" \
+            : "+r"(c0), "+r"(c1), "+r"(c2)       \
+            : "r"(t1), "r"(t2), "g"(0)           \
+            : "cc");                             \
+    } while (0)
 
-#  define sqr_add_c(a,i,c0,c1,c2) do {  \
-        BN_ULONG t1,t2;                 \
-        asm ("mulq %2"                  \
-                : "=a"(t1),"=d"(t2)     \
-                : "a"(a[i])             \
-                : "cc");                \
-        asm ("addq %3,%0; adcq %4,%1; adcq %5,%2"       \
-                : "+r"(c0),"+r"(c1),"+r"(c2)            \
-                : "r"(t1),"r"(t2),"g"(0)                \
-                : "cc");                                \
-        } while (0)
+#define sqr_add_c(a, i, c0, c1, c2)              \
+    do {                                         \
+        BN_ULONG t1, t2;                         \
+        asm("mulq %2"                            \
+            : "=a"(t1), "=d"(t2)                 \
+            : "a"(a[i])                          \
+            : "cc");                             \
+        asm("addq %3,%0; adcq %4,%1; adcq %5,%2" \
+            : "+r"(c0), "+r"(c1), "+r"(c2)       \
+            : "r"(t1), "r"(t2), "g"(0)           \
+            : "cc");                             \
+    } while (0)
 
-#  define mul_add_c2(a,b,c0,c1,c2) do { \
-        BN_ULONG t1,t2;                 \
-        asm ("mulq %3"                  \
-                : "=a"(t1),"=d"(t2)     \
-                : "a"(a),"m"(b)         \
-                : "cc");                \
-        asm ("addq %3,%0; adcq %4,%1; adcq %5,%2"       \
-                : "+r"(c0),"+r"(c1),"+r"(c2)            \
-                : "r"(t1),"r"(t2),"g"(0)                \
-                : "cc");                                \
-        asm ("addq %3,%0; adcq %4,%1; adcq %5,%2"       \
-                : "+r"(c0),"+r"(c1),"+r"(c2)            \
-                : "r"(t1),"r"(t2),"g"(0)                \
-                : "cc");                                \
-        } while (0)
-# endif
+#define mul_add_c2(a, b, c0, c1, c2)             \
+    do {                                         \
+        BN_ULONG t1, t2;                         \
+        asm("mulq %3"                            \
+            : "=a"(t1), "=d"(t2)                 \
+            : "a"(a), "m"(b)                     \
+            : "cc");                             \
+        asm("addq %3,%0; adcq %4,%1; adcq %5,%2" \
+            : "+r"(c0), "+r"(c1), "+r"(c2)       \
+            : "r"(t1), "r"(t2), "g"(0)           \
+            : "cc");                             \
+        asm("addq %3,%0; adcq %4,%1; adcq %5,%2" \
+            : "+r"(c0), "+r"(c1), "+r"(c2)       \
+            : "r"(t1), "r"(t2), "g"(0)           \
+            : "cc");                             \
+    } while (0)
+#endif
 
-# define sqr_add_c2(a,i,j,c0,c1,c2)      \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
+#define sqr_add_c2(a, i, j, c0, c1, c2) \
+    mul_add_c2((a)[i], (a)[j], c0, c1, c2)
 
 void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
 {
diff --git a/crypto/openssl/crypto/bn/asm/x86_64-mont5.pl b/crypto/openssl/crypto/bn/asm/x86_64-mont5.pl
index 07dd40d9228c..e06d13d74aea 100755
--- a/crypto/openssl/crypto/bn/asm/x86_64-mont5.pl
+++ b/crypto/openssl/crypto/bn/asm/x86_64-mont5.pl
@@ -48,13 +48,15 @@ open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\""
 *STDOUT=*OUT;
 
 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
-		=~ /GNU assembler version ([2-9]\.[0-9]+)/) {
-	$addx = ($1>=2.23);
+		=~ /GNU assembler version ([0-9]+)\.([0-9]+)/) {
+	my $ver = $1 + $2/100.0;	# 3.1->3.01, 3.10->3.10
+	$addx = ($ver >= 2.23);
 }
 
 if (!$addx && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
-	    `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)/) {
-	$addx = ($1>=2.10);
+	    `nasm -v 2>&1` =~ /NASM version ([0-9]+)\.([0-9]+)/) {
+	my $ver = $1 + $2/100.0;	# 3.1->3.01, 3.10->3.10
+	$addx = ($ver >= 2.10);
 }
 
 if (!$addx && $win64 && ($flavour =~ /masm/ || $ENV{ASM} =~ /ml64/) &&
diff --git a/crypto/openssl/crypto/bn/bn_add.c b/crypto/openssl/crypto/bn/bn_add.c
index ae3e549e4430..38de39d1b8ac 100644
--- a/crypto/openssl/crypto/bn/bn_add.c
+++ b/crypto/openssl/crypto/bn/bn_add.c
@@ -135,7 +135,7 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
     min = b->top;
     dif = max - min;
 
-    if (dif < 0) {              /* hmm... should not be happening */
+    if (dif < 0) { /* hmm... should not be happening */
         ERR_raise(ERR_LIB_BN, BN_R_ARG2_LT_ARG3);
         return 0;
     }
@@ -168,4 +168,3 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
 
     return 1;
 }
-
diff --git a/crypto/openssl/crypto/bn/bn_asm.c b/crypto/openssl/crypto/bn/bn_asm.c
index c39907a7dfd3..0a77f1b070e1 100644
--- a/crypto/openssl/crypto/bn/bn_asm.c
+++ b/crypto/openssl/crypto/bn/bn_asm.c
@@ -15,7 +15,7 @@
 #if defined(BN_LLONG) || defined(BN_UMULT_HIGH)
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num,
-                          BN_ULONG w)
+    BN_ULONG w)
 {
     BN_ULONG c1 = 0;
 
@@ -23,7 +23,7 @@ BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num,
     if (num <= 0)
         return c1;
 
-# ifndef OPENSSL_SMALL_FOOTPRINT
+#ifndef OPENSSL_SMALL_FOOTPRINT
     while (num & ~3) {
         mul_add(rp[0], ap[0], w, c1);
         mul_add(rp[1], ap[1], w, c1);
@@ -33,7 +33,7 @@ BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num,
         rp += 4;
         num -= 4;
     }
-# endif
+#endif
     while (num) {
         mul_add(rp[0], ap[0], w, c1);
         ap++;
@@ -52,7 +52,7 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, const BN_ULONG *ap, int num, BN_ULONG w)
     if (num <= 0)
         return c1;
 
-# ifndef OPENSSL_SMALL_FOOTPRINT
+#ifndef OPENSSL_SMALL_FOOTPRINT
     while (num & ~3) {
         mul(rp[0], ap[0], w, c1);
         mul(rp[1], ap[1], w, c1);
@@ -62,7 +62,7 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, const BN_ULONG *ap, int num, BN_ULONG w)
         rp += 4;
         num -= 4;
     }
-# endif
+#endif
     while (num) {
         mul(rp[0], ap[0], w, c1);
         ap++;
@@ -78,7 +78,7 @@ void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, int n)
     if (n <= 0)
         return;
 
-# ifndef OPENSSL_SMALL_FOOTPRINT
+#ifndef OPENSSL_SMALL_FOOTPRINT
     while (n & ~3) {
         sqr(r[0], r[1], a[0]);
         sqr(r[2], r[3], a[1]);
@@ -88,7 +88,7 @@ void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, int n)
         r += 8;
         n -= 4;
     }
-# endif
+#endif
     while (n) {
         sqr(r[0], r[1], a[0]);
         a++;
@@ -97,11 +97,11 @@ void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, int n)
     }
 }
 
-#else                           /* !(defined(BN_LLONG) ||
-                                 * defined(BN_UMULT_HIGH)) */
+#else /* !(defined(BN_LLONG) || \
+       * defined(BN_UMULT_HIGH)) */
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num,
-                          BN_ULONG w)
+    BN_ULONG w)
 {
     BN_ULONG c = 0;
     BN_ULONG bl, bh;
@@ -113,7 +113,7 @@ BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num,
     bl = LBITS(w);
     bh = HBITS(w);
 
-# ifndef OPENSSL_SMALL_FOOTPRINT
+#ifndef OPENSSL_SMALL_FOOTPRINT
     while (num & ~3) {
         mul_add(rp[0], ap[0], bl, bh, c);
         mul_add(rp[1], ap[1], bl, bh, c);
@@ -123,7 +123,7 @@ BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num,
         rp += 4;
         num -= 4;
     }
-# endif
+#endif
     while (num) {
         mul_add(rp[0], ap[0], bl, bh, c);
         ap++;
@@ -145,7 +145,7 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, const BN_ULONG *ap, int num, BN_ULONG w)
     bl = LBITS(w);
     bh = HBITS(w);
 
-# ifndef OPENSSL_SMALL_FOOTPRINT
+#ifndef OPENSSL_SMALL_FOOTPRINT
     while (num & ~3) {
         mul(rp[0], ap[0], bl, bh, carry);
         mul(rp[1], ap[1], bl, bh, carry);
@@ -155,7 +155,7 @@ BN_ULONG bn_mul_words(BN_ULONG *rp, const BN_ULONG *ap, int num, BN_ULONG w)
         rp += 4;
         num -= 4;
     }
-# endif
+#endif
     while (num) {
         mul(rp[0], ap[0], bl, bh, carry);
         ap++;
@@ -171,7 +171,7 @@ void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, int n)
     if (n <= 0)
         return;
 
-# ifndef OPENSSL_SMALL_FOOTPRINT
+#ifndef OPENSSL_SMALL_FOOTPRINT
     while (n & ~3) {
         sqr64(r[0], r[1], a[0]);
         sqr64(r[2], r[3], a[1]);
@@ -181,7 +181,7 @@ void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, int n)
         r += 8;
         n -= 4;
     }
-# endif
+#endif
     while (n) {
         sqr64(r[0], r[1], a[0]);
         a++;
@@ -190,14 +190,14 @@ void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, int n)
     }
 }
 
-#endif                          /* !(defined(BN_LLONG) ||
-                                 * defined(BN_UMULT_HIGH)) */
+#endif /* !(defined(BN_LLONG) || \
+        * defined(BN_UMULT_HIGH)) */
 
 #if defined(BN_LLONG) && defined(BN_DIV2W)
 
 BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
 {
-    return ((BN_ULONG)(((((BN_ULLONG) h) << BN_BITS2) | l) / (BN_ULLONG) d));
+    return ((BN_ULONG)(((((BN_ULLONG)h) << BN_BITS2) | l) / (BN_ULLONG)d));
 }
 
 #else
@@ -236,8 +236,7 @@ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
         tl = dl * q;
         for (;;) {
             t = h - th;
-            if ((t & BN_MASK2h) ||
-                ((tl) <= ((t << BN_BITS4) | ((l & BN_MASK2h) >> BN_BITS4))))
+            if ((t & BN_MASK2h) || ((tl) <= ((t << BN_BITS4) | ((l & BN_MASK2h) >> BN_BITS4))))
                 break;
             q--;
             th -= dh;
@@ -266,11 +265,11 @@ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
     ret |= q;
     return ret;
 }
-#endif                          /* !defined(BN_LLONG) && defined(BN_DIV2W) */
+#endif /* !defined(BN_LLONG) && defined(BN_DIV2W) */
 
 #ifdef BN_LLONG
 BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
-                      int n)
+    int n)
 {
     BN_ULLONG ll = 0;
 
@@ -278,18 +277,18 @@ BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
     if (n <= 0)
         return (BN_ULONG)0;
 
-# ifndef OPENSSL_SMALL_FOOTPRINT
+#ifndef OPENSSL_SMALL_FOOTPRINT
     while (n & ~3) {
-        ll += (BN_ULLONG) a[0] + b[0];
+        ll += (BN_ULLONG)a[0] + b[0];
         r[0] = (BN_ULONG)ll & BN_MASK2;
         ll >>= BN_BITS2;
-        ll += (BN_ULLONG) a[1] + b[1];
+        ll += (BN_ULLONG)a[1] + b[1];
         r[1] = (BN_ULONG)ll & BN_MASK2;
         ll >>= BN_BITS2;
-        ll += (BN_ULLONG) a[2] + b[2];
+        ll += (BN_ULLONG)a[2] + b[2];
         r[2] = (BN_ULONG)ll & BN_MASK2;
         ll >>= BN_BITS2;
-        ll += (BN_ULLONG) a[3] + b[3];
+        ll += (BN_ULLONG)a[3] + b[3];
         r[3] = (BN_ULONG)ll & BN_MASK2;
         ll >>= BN_BITS2;
         a += 4;
@@ -297,9 +296,9 @@ BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
         r += 4;
         n -= 4;
     }
-# endif
+#endif
     while (n) {
-        ll += (BN_ULLONG) a[0] + b[0];
+        ll += (BN_ULLONG)a[0] + b[0];
         r[0] = (BN_ULONG)ll & BN_MASK2;
         ll >>= BN_BITS2;
         a++;
@@ -309,9 +308,9 @@ BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
     }
     return (BN_ULONG)ll;
 }
-#else                           /* !BN_LLONG */
+#else /* !BN_LLONG */
 BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
-                      int n)
+    int n)
 {
     BN_ULONG c, l, t;
 
@@ -320,7 +319,7 @@ BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
         return (BN_ULONG)0;
 
     c = 0;
-# ifndef OPENSSL_SMALL_FOOTPRINT
+#ifndef OPENSSL_SMALL_FOOTPRINT
     while (n & ~3) {
         t = a[0];
         t = (t + c) & BN_MASK2;
@@ -351,7 +350,7 @@ BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
         r += 4;
         n -= 4;
     }
-# endif
+#endif
     while (n) {
         t = a[0];
         t = (t + c) & BN_MASK2;
@@ -366,10 +365,10 @@ BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
     }
     return (BN_ULONG)c;
 }
-#endif                          /* !BN_LLONG */
+#endif /* !BN_LLONG */
 
 BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
-                      int n)
+    int n)
 {
     BN_ULONG t1, t2;
     int c = 0;
@@ -382,28 +381,28 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
     while (n & ~3) {
         t1 = a[0];
         t2 = (t1 - c) & BN_MASK2;
-        c  = (t2 > t1);
+        c = (t2 > t1);
         t1 = b[0];
         t1 = (t2 - t1) & BN_MASK2;
         r[0] = t1;
         c += (t1 > t2);
         t1 = a[1];
         t2 = (t1 - c) & BN_MASK2;
-        c  = (t2 > t1);
+        c = (t2 > t1);
         t1 = b[1];
         t1 = (t2 - t1) & BN_MASK2;
         r[1] = t1;
         c += (t1 > t2);
         t1 = a[2];
         t2 = (t1 - c) & BN_MASK2;
-        c  = (t2 > t1);
+        c = (t2 > t1);
         t1 = b[2];
         t1 = (t2 - t1) & BN_MASK2;
         r[2] = t1;
         c += (t1 > t2);
         t1 = a[3];
         t2 = (t1 - c) & BN_MASK2;
-        c  = (t2 > t1);
+        c = (t2 > t1);
         t1 = b[3];
         t1 = (t2 - t1) & BN_MASK2;
         r[3] = t1;
@@ -417,7 +416,7 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
     while (n) {
         t1 = a[0];
         t2 = (t1 - c) & BN_MASK2;
-        c  = (t2 > t1);
+        c = (t2 > t1);
         t1 = b[0];
         t1 = (t2 - t1) & BN_MASK2;
         r[0] = t1;
@@ -440,148 +439,188 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
  * c=(c2,c1,c0)
  */
 
-# ifdef BN_LLONG
+#ifdef BN_LLONG
 /*
  * Keep in mind that additions to multiplication result can not
  * overflow, because its high half cannot be all-ones.
  */
-#  define mul_add_c(a,b,c0,c1,c2)       do {    \
-        BN_ULONG hi;                            \
-        BN_ULLONG t = (BN_ULLONG)(a)*(b);       \
-        t += c0;                /* no carry */  \
-        c0 = (BN_ULONG)Lw(t);                   \
-        hi = (BN_ULONG)Hw(t);                   \
-        c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi);   \
-        } while(0)
+#define mul_add_c(a, b, c0, c1, c2)         \
+    do {                                    \
+        BN_ULONG hi;                        \
+        BN_ULLONG t = (BN_ULLONG)(a) * (b); \
+        t += c0; /* no carry */             \
+        c0 = (BN_ULONG)Lw(t);               \
+        hi = (BN_ULONG)Hw(t);               \
+        c1 = (c1 + hi) & BN_MASK2;          \
+        c2 += (c1 < hi);                    \
+    } while (0)
 
-#  define mul_add_c2(a,b,c0,c1,c2)      do {    \
-        BN_ULONG hi;                            \
-        BN_ULLONG t = (BN_ULLONG)(a)*(b);       \
-        BN_ULLONG tt = t+c0;    /* no carry */  \
-        c0 = (BN_ULONG)Lw(tt);                  \
-        hi = (BN_ULONG)Hw(tt);                  \
-        c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi);   \
-        t += c0;                /* no carry */  \
-        c0 = (BN_ULONG)Lw(t);                   \
-        hi = (BN_ULONG)Hw(t);                   \
-        c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi);   \
-        } while(0)
+#define mul_add_c2(a, b, c0, c1, c2)          \
+    do {                                      \
+        BN_ULONG hi;                          \
+        BN_ULLONG t = (BN_ULLONG)(a) * (b);   \
+        BN_ULLONG tt = t + c0; /* no carry */ \
+        c0 = (BN_ULONG)Lw(tt);                \
+        hi = (BN_ULONG)Hw(tt);                \
+        c1 = (c1 + hi) & BN_MASK2;            \
+        c2 += (c1 < hi);                      \
+        t += c0; /* no carry */               \
+        c0 = (BN_ULONG)Lw(t);                 \
+        hi = (BN_ULONG)Hw(t);                 \
+        c1 = (c1 + hi) & BN_MASK2;            \
+        c2 += (c1 < hi);                      \
+    } while (0)
 
-#  define sqr_add_c(a,i,c0,c1,c2)       do {    \
-        BN_ULONG hi;                            \
-        BN_ULLONG t = (BN_ULLONG)a[i]*a[i];     \
-        t += c0;                /* no carry */  \
-        c0 = (BN_ULONG)Lw(t);                   \
-        hi = (BN_ULONG)Hw(t);                   \
-        c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi);   \
-        } while(0)
+#define sqr_add_c(a, i, c0, c1, c2)           \
+    do {                                      \
+        BN_ULONG hi;                          \
+        BN_ULLONG t = (BN_ULLONG)a[i] * a[i]; \
+        t += c0; /* no carry */               \
+        c0 = (BN_ULONG)Lw(t);                 \
+        hi = (BN_ULONG)Hw(t);                 \
+        c1 = (c1 + hi) & BN_MASK2;            \
+        c2 += (c1 < hi);                      \
+    } while (0)
 
-#  define sqr_add_c2(a,i,j,c0,c1,c2) \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
+#define sqr_add_c2(a, i, j, c0, c1, c2) \
+    mul_add_c2((a)[i], (a)[j], c0, c1, c2)
 
-# elif defined(BN_UMULT_LOHI)
+#elif defined(BN_UMULT_LOHI)
 /*
  * Keep in mind that additions to hi can not overflow, because
  * the high word of a multiplication result cannot be all-ones.
  */
-#  define mul_add_c(a,b,c0,c1,c2)       do {    \
-        BN_ULONG ta = (a), tb = (b);            \
-        BN_ULONG lo, hi;                        \
-        BN_UMULT_LOHI(lo,hi,ta,tb);             \
-        c0 += lo; hi += (c0<lo);                \
-        c1 += hi; c2 += (c1<hi);                \
-        } while(0)
+#define mul_add_c(a, b, c0, c1, c2)    \
+    do {                               \
+        BN_ULONG ta = (a), tb = (b);   \
+        BN_ULONG lo, hi;               \
+        BN_UMULT_LOHI(lo, hi, ta, tb); \
+        c0 += lo;                      \
+        hi += (c0 < lo);               \
+        c1 += hi;                      \
+        c2 += (c1 < hi);               \
+    } while (0)
 
-#  define mul_add_c2(a,b,c0,c1,c2)      do {    \
-        BN_ULONG ta = (a), tb = (b);            \
-        BN_ULONG lo, hi, tt;                    \
-        BN_UMULT_LOHI(lo,hi,ta,tb);             \
-        c0 += lo; tt = hi + (c0<lo);            \
-        c1 += tt; c2 += (c1<tt);                \
-        c0 += lo; hi += (c0<lo);                \
-        c1 += hi; c2 += (c1<hi);                \
-        } while(0)
+#define mul_add_c2(a, b, c0, c1, c2)   \
+    do {                               \
+        BN_ULONG ta = (a), tb = (b);   \
+        BN_ULONG lo, hi, tt;           \
+        BN_UMULT_LOHI(lo, hi, ta, tb); \
+        c0 += lo;                      \
+        tt = hi + (c0 < lo);           \
+        c1 += tt;                      \
+        c2 += (c1 < tt);               \
+        c0 += lo;                      \
+        hi += (c0 < lo);               \
+        c1 += hi;                      \
+        c2 += (c1 < hi);               \
+    } while (0)
 
-#  define sqr_add_c(a,i,c0,c1,c2)       do {    \
-        BN_ULONG ta = (a)[i];                   \
-        BN_ULONG lo, hi;                        \
-        BN_UMULT_LOHI(lo,hi,ta,ta);             \
-        c0 += lo; hi += (c0<lo);                \
-        c1 += hi; c2 += (c1<hi);                \
-        } while(0)
+#define sqr_add_c(a, i, c0, c1, c2)    \
+    do {                               \
+        BN_ULONG ta = (a)[i];          \
+        BN_ULONG lo, hi;               \
+        BN_UMULT_LOHI(lo, hi, ta, ta); \
+        c0 += lo;                      \
+        hi += (c0 < lo);               \
+        c1 += hi;                      \
+        c2 += (c1 < hi);               \
+    } while (0)
 
-#  define sqr_add_c2(a,i,j,c0,c1,c2)    \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
+#define sqr_add_c2(a, i, j, c0, c1, c2) \
+    mul_add_c2((a)[i], (a)[j], c0, c1, c2)
 
-# elif defined(BN_UMULT_HIGH)
+#elif defined(BN_UMULT_HIGH)
 /*
  * Keep in mind that additions to hi can not overflow, because
  * the high word of a multiplication result cannot be all-ones.
  */
-#  define mul_add_c(a,b,c0,c1,c2)       do {    \
-        BN_ULONG ta = (a), tb = (b);            \
-        BN_ULONG lo = ta * tb;                  \
-        BN_ULONG hi = BN_UMULT_HIGH(ta,tb);     \
-        c0 += lo; hi += (c0<lo);                \
-        c1 += hi; c2 += (c1<hi);                \
-        } while(0)
+#define mul_add_c(a, b, c0, c1, c2)          \
+    do {                                     \
+        BN_ULONG ta = (a), tb = (b);         \
+        BN_ULONG lo = ta * tb;               \
+        BN_ULONG hi = BN_UMULT_HIGH(ta, tb); \
+        c0 += lo;                            \
+        hi += (c0 < lo);                     \
+        c1 += hi;                            \
+        c2 += (c1 < hi);                     \
+    } while (0)
 
-#  define mul_add_c2(a,b,c0,c1,c2)      do {    \
-        BN_ULONG ta = (a), tb = (b), tt;        \
-        BN_ULONG lo = ta * tb;                  \
-        BN_ULONG hi = BN_UMULT_HIGH(ta,tb);     \
-        c0 += lo; tt = hi + (c0<lo);            \
-        c1 += tt; c2 += (c1<tt);                \
-        c0 += lo; hi += (c0<lo);                \
-        c1 += hi; c2 += (c1<hi);                \
-        } while(0)
+#define mul_add_c2(a, b, c0, c1, c2)         \
+    do {                                     \
+        BN_ULONG ta = (a), tb = (b), tt;     \
+        BN_ULONG lo = ta * tb;               \
+        BN_ULONG hi = BN_UMULT_HIGH(ta, tb); \
+        c0 += lo;                            \
+        tt = hi + (c0 < lo);                 \
+        c1 += tt;                            \
+        c2 += (c1 < tt);                     \
+        c0 += lo;                            \
+        hi += (c0 < lo);                     \
+        c1 += hi;                            \
+        c2 += (c1 < hi);                     \
+    } while (0)
 
-#  define sqr_add_c(a,i,c0,c1,c2)       do {    \
-        BN_ULONG ta = (a)[i];                   \
-        BN_ULONG lo = ta * ta;                  \
-        BN_ULONG hi = BN_UMULT_HIGH(ta,ta);     \
-        c0 += lo; hi += (c0<lo);                \
-        c1 += hi; c2 += (c1<hi);                \
-        } while(0)
+#define sqr_add_c(a, i, c0, c1, c2)          \
+    do {                                     \
+        BN_ULONG ta = (a)[i];                \
+        BN_ULONG lo = ta * ta;               \
+        BN_ULONG hi = BN_UMULT_HIGH(ta, ta); \
+        c0 += lo;                            \
+        hi += (c0 < lo);                     \
+        c1 += hi;                            \
+        c2 += (c1 < hi);                     \
+    } while (0)
 
-#  define sqr_add_c2(a,i,j,c0,c1,c2)      \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
+#define sqr_add_c2(a, i, j, c0, c1, c2) \
+    mul_add_c2((a)[i], (a)[j], c0, c1, c2)
 
-# else                          /* !BN_LLONG */
+#else /* !BN_LLONG */
 /*
  * Keep in mind that additions to hi can not overflow, because
  * the high word of a multiplication result cannot be all-ones.
  */
-#  define mul_add_c(a,b,c0,c1,c2)       do {    \
-        BN_ULONG lo = LBITS(a), hi = HBITS(a);  \
-        BN_ULONG bl = LBITS(b), bh = HBITS(b);  \
-        mul64(lo,hi,bl,bh);                     \
-        c0 = (c0+lo)&BN_MASK2; hi += (c0<lo);   \
-        c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi);   \
-        } while(0)
+#define mul_add_c(a, b, c0, c1, c2)            \
+    do {                                       \
+        BN_ULONG lo = LBITS(a), hi = HBITS(a); \
+        BN_ULONG bl = LBITS(b), bh = HBITS(b); \
+        mul64(lo, hi, bl, bh);                 \
+        c0 = (c0 + lo) & BN_MASK2;             \
+        hi += (c0 < lo);                       \
+        c1 = (c1 + hi) & BN_MASK2;             \
+        c2 += (c1 < hi);                       \
+    } while (0)
 
-#  define mul_add_c2(a,b,c0,c1,c2)      do {    \
-        BN_ULONG tt;                            \
-        BN_ULONG lo = LBITS(a), hi = HBITS(a);  \
-        BN_ULONG bl = LBITS(b), bh = HBITS(b);  \
-        mul64(lo,hi,bl,bh);                     \
-        tt = hi;                                \
-        c0 = (c0+lo)&BN_MASK2; tt += (c0<lo);   \
-        c1 = (c1+tt)&BN_MASK2; c2 += (c1<tt);   \
-        c0 = (c0+lo)&BN_MASK2; hi += (c0<lo);   \
-        c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi);   \
-        } while(0)
+#define mul_add_c2(a, b, c0, c1, c2)           \
+    do {                                       \
+        BN_ULONG tt;                           \
+        BN_ULONG lo = LBITS(a), hi = HBITS(a); \
+        BN_ULONG bl = LBITS(b), bh = HBITS(b); \
+        mul64(lo, hi, bl, bh);                 \
+        tt = hi;                               \
+        c0 = (c0 + lo) & BN_MASK2;             \
+        tt += (c0 < lo);                       \
+        c1 = (c1 + tt) & BN_MASK2;             \
+        c2 += (c1 < tt);                       \
+        c0 = (c0 + lo) & BN_MASK2;             \
+        hi += (c0 < lo);                       \
+        c1 = (c1 + hi) & BN_MASK2;             \
+        c2 += (c1 < hi);                       \
+    } while (0)
 
-#  define sqr_add_c(a,i,c0,c1,c2)       do {    \
-        BN_ULONG lo, hi;                        \
-        sqr64(lo,hi,(a)[i]);                    \
-        c0 = (c0+lo)&BN_MASK2; hi += (c0<lo);   \
-        c1 = (c1+hi)&BN_MASK2; c2 += (c1<hi);   \
-        } while(0)
+#define sqr_add_c(a, i, c0, c1, c2) \
+    do {                            \
+        BN_ULONG lo, hi;            \
+        sqr64(lo, hi, (a)[i]);      \
+        c0 = (c0 + lo) & BN_MASK2;  \
+        hi += (c0 < lo);            \
+        c1 = (c1 + hi) & BN_MASK2;  \
+        c2 += (c1 < hi);            \
+    } while (0)
 
-#  define sqr_add_c2(a,i,j,c0,c1,c2) \
-        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
-# endif                         /* !BN_LLONG */
+#define sqr_add_c2(a, i, j, c0, c1, c2) \
+    mul_add_c2((a)[i], (a)[j], c0, c1, c2)
+#endif /* !BN_LLONG */
 
 void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
 {
@@ -833,9 +872,9 @@ void bn_sqr_comba4(BN_ULONG *r, const BN_ULONG *a)
     r[7] = c2;
 }
 
-# ifdef OPENSSL_NO_ASM
-#  ifdef OPENSSL_BN_ASM_MONT
-#   include <alloca.h>
+#ifdef OPENSSL_NO_ASM
+#ifdef OPENSSL_BN_ASM_MONT
+#include <alloca.h>
 /*
  * This is essentially reference implementation, which may or may not
  * result in performance improvement. E.g. on IA-32 this routine was
@@ -850,35 +889,35 @@ void bn_sqr_comba4(BN_ULONG *r, const BN_ULONG *a)
  * [and are known to] differ and are to be documented elsewhere.
  */
 int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                const BN_ULONG *np, const BN_ULONG *n0p, int num)
+    const BN_ULONG *np, const BN_ULONG *n0p, int num)
 {
     BN_ULONG c0, c1, ml, *tp, n0;
-#   ifdef mul64
+#ifdef mul64
     BN_ULONG mh;
-#   endif
+#endif
     volatile BN_ULONG *vp;
     int i = 0, j;
 
-#   if 0                        /* template for platform-specific
-                                 * implementation */
+#if 0 /* template for platform-specific \
+       * implementation */
     if (ap == bp)
         return bn_sqr_mont(rp, ap, np, n0p, num);
-#   endif
+#endif
     vp = tp = alloca((num + 2) * sizeof(BN_ULONG));
 
     n0 = *n0p;
 
     c0 = 0;
     ml = bp[0];
-#   ifdef mul64
+#ifdef mul64
     mh = HBITS(ml);
     ml = LBITS(ml);
     for (j = 0; j < num; ++j)
         mul(tp[j], ap[j], ml, mh, c0);
-#   else
+#else
     for (j = 0; j < num; ++j)
         mul(tp[j], ap[j], ml, c0);
-#   endif
+#endif
 
     tp[num] = c0;
     tp[num + 1] = 0;
@@ -887,36 +926,36 @@ int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
     for (i = 0; i < num; i++) {
         c0 = 0;
         ml = bp[i];
-#   ifdef mul64
+#ifdef mul64
         mh = HBITS(ml);
         ml = LBITS(ml);
         for (j = 0; j < num; ++j)
             mul_add(tp[j], ap[j], ml, mh, c0);
-#   else
+#else
         for (j = 0; j < num; ++j)
             mul_add(tp[j], ap[j], ml, c0);
-#   endif
+#endif
         c1 = (tp[num] + c0) & BN_MASK2;
         tp[num] = c1;
         tp[num + 1] = (c1 < c0 ? 1 : 0);
- enter:
+    enter:
         c1 = tp[0];
         ml = (c1 * n0) & BN_MASK2;
         c0 = 0;
-#   ifdef mul64
+#ifdef mul64
         mh = HBITS(ml);
         ml = LBITS(ml);
         mul_add(c1, np[0], ml, mh, c0);
-#   else
+#else
         mul_add(c1, ml, np[0], c0);
-#   endif
+#endif
         for (j = 1; j < num; j++) {
             c1 = tp[j];
-#   ifdef mul64
+#ifdef mul64
             mul_add(c1, np[j], ml, mh, c0);
-#   else
+#else
             mul_add(c1, ml, np[j], c0);
-#   endif
+#endif
             tp[j - 1] = c1 & BN_MASK2;
         }
         c1 = (tp[num] + c0) & BN_MASK2;
@@ -938,21 +977,21 @@ int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
     vp[num + 1] = 0;
     return 1;
 }
-#  else
+#else
 /*
  * Return value of 0 indicates that multiplication/convolution was not
  * performed to signal the caller to fall down to alternative/original
  * code-path.
  */
 int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                const BN_ULONG *np, const BN_ULONG *n0, int num)
+    const BN_ULONG *np, const BN_ULONG *n0, int num)
 {
     return 0;
 }
-#  endif                        /* OPENSSL_BN_ASM_MONT */
-# endif
+#endif /* OPENSSL_BN_ASM_MONT */
+#endif
 
-#else                           /* !BN_MUL_COMBA */
+#else /* !BN_MUL_COMBA */
 
 /* hmm... is it faster just to do a multiply? */
 void bn_sqr_comba4(BN_ULONG *r, const BN_ULONG *a)
@@ -987,11 +1026,11 @@ void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
     r[15] = bn_mul_add_words(&(r[7]), a, 8, b[7]);
 }
 
-# ifdef OPENSSL_NO_ASM
-#  ifdef OPENSSL_BN_ASM_MONT
-#   include <alloca.h>
+#ifdef OPENSSL_NO_ASM
+#ifdef OPENSSL_BN_ASM_MONT
+#include <alloca.h>
 int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                const BN_ULONG *np, const BN_ULONG *n0p, int num)
+    const BN_ULONG *np, const BN_ULONG *n0p, int num)
 {
     BN_ULONG c0, c1, *tp, n0 = *n0p;
     volatile BN_ULONG *vp;
@@ -1030,13 +1069,13 @@ int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
     vp[num + 1] = 0;
     return 1;
 }
-#  else
+#else
 int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                const BN_ULONG *np, const BN_ULONG *n0, int num)
+    const BN_ULONG *np, const BN_ULONG *n0, int num)
 {
     return 0;
 }
-#  endif                        /* OPENSSL_BN_ASM_MONT */
-# endif
+#endif /* OPENSSL_BN_ASM_MONT */
+#endif
 
-#endif                          /* !BN_MUL_COMBA */
+#endif /* !BN_MUL_COMBA */
diff --git a/crypto/openssl/crypto/bn/bn_blind.c b/crypto/openssl/crypto/bn/bn_blind.c
index 6c6de1a30f54..73592ee96bb8 100644
--- a/crypto/openssl/crypto/bn/bn_blind.c
+++ b/crypto/openssl/crypto/bn/bn_blind.c
@@ -11,19 +11,19 @@
 #include "internal/cryptlib.h"
 #include "bn_local.h"
 
-#define BN_BLINDING_COUNTER     32
+#define BN_BLINDING_COUNTER 32
 
 struct bn_blinding_st {
     BIGNUM *A;
     BIGNUM *Ai;
     BIGNUM *e;
-    BIGNUM *mod;                /* just a reference */
+    BIGNUM *mod; /* just a reference */
     CRYPTO_THREAD_ID tid;
     int counter;
     unsigned long flags;
     BN_MONT_CTX *m_ctx;
-    int (*bn_mod_exp) (BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                       const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+    int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
     CRYPTO_RWLOCK *lock;
 };
 
@@ -71,7 +71,7 @@ BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod)
 
     return ret;
 
- err:
+err:
     BN_BLINDING_free(ret);
     return NULL;
 }
@@ -100,8 +100,7 @@ int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
     if (b->counter == -1)
         b->counter = 0;
 
-    if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL &&
-        !(b->flags & BN_BLINDING_NO_RECREATE)) {
+    if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL && !(b->flags & BN_BLINDING_NO_RECREATE)) {
         /* re-create blinding parameters */
         if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))
             goto err;
@@ -118,7 +117,7 @@ int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
     }
 
     ret = 1;
- err:
+err:
     if (b->counter == BN_BLINDING_COUNTER)
         b->counter = 0;
     return ret;
@@ -163,7 +162,7 @@ int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx)
 }
 
 int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b,
-                          BN_CTX *ctx)
+    BN_CTX *ctx)
 {
     int ret;
 
@@ -230,14 +229,14 @@ void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags)
 }
 
 BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
-                                      const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
-                                      int (*bn_mod_exp) (BIGNUM *r,
-                                                         const BIGNUM *a,
-                                                         const BIGNUM *p,
-                                                         const BIGNUM *m,
-                                                         BN_CTX *ctx,
-                                                         BN_MONT_CTX *m_ctx),
-                                      BN_MONT_CTX *m_ctx)
+    const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
+    int (*bn_mod_exp)(BIGNUM *r,
+        const BIGNUM *a,
+        const BIGNUM *p,
+        const BIGNUM *m,
+        BN_CTX *ctx,
+        BN_MONT_CTX *m_ctx),
+    BN_MONT_CTX *m_ctx)
 {
     int retry_counter = 32;
     BN_BLINDING *ret = NULL;
@@ -301,7 +300,7 @@ BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
     }
 
     return ret;
- err:
+err:
     if (b == NULL) {
         BN_BLINDING_free(ret);
         ret = NULL;
diff --git a/crypto/openssl/crypto/bn/bn_const.c b/crypto/openssl/crypto/bn/bn_const.c
index f7c3fdf9c402..df422d4e88f0 100644
--- a/crypto/openssl/crypto/bn/bn_const.c
+++ b/crypto/openssl/crypto/bn/bn_const.c
@@ -12,7 +12,6 @@
 
 #define COPY_BN(dst, src) (dst != NULL) ? BN_copy(dst, &src) : BN_dup(&src)
 
-
 /*-
  * "First Oakley Default Group" from RFC2409, section 6.1.
  *
@@ -25,18 +24,102 @@
 BIGNUM *BN_get_rfc2409_prime_768(BIGNUM *bn)
 {
     static const unsigned char RFC2409_PRIME_768[] = {
-        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-        0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
-        0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
-        0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
-        0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
-        0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
-        0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
-        0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
-        0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
-        0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
-        0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x3A, 0x36, 0x20,
-        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xC9,
+        0x0F,
+        0xDA,
+        0xA2,
+        0x21,
+        0x68,
+        0xC2,
+        0x34,
+        0xC4,
+        0xC6,
+        0x62,
+        0x8B,
+        0x80,
+        0xDC,
+        0x1C,
+        0xD1,
+        0x29,
+        0x02,
+        0x4E,
+        0x08,
+        0x8A,
+        0x67,
+        0xCC,
+        0x74,
+        0x02,
+        0x0B,
+        0xBE,
+        0xA6,
+        0x3B,
+        0x13,
+        0x9B,
+        0x22,
+        0x51,
+        0x4A,
+        0x08,
+        0x79,
+        0x8E,
+        0x34,
+        0x04,
+        0xDD,
+        0xEF,
+        0x95,
+        0x19,
+        0xB3,
+        0xCD,
+        0x3A,
+        0x43,
+        0x1B,
+        0x30,
+        0x2B,
+        0x0A,
+        0x6D,
+        0xF2,
+        0x5F,
+        0x14,
+        0x37,
+        0x4F,
+        0xE1,
+        0x35,
+        0x6D,
+        0x6D,
+        0x51,
+        0xC2,
+        0x45,
+        0xE4,
+        0x85,
+        0xB5,
+        0x76,
+        0x62,
+        0x5E,
+        0x7E,
+        0xC6,
+        0xF4,
+        0x4C,
+        0x42,
+        0xE9,
+        0xA6,
+        0x3A,
+        0x36,
+        0x20,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
     };
     return BN_bin2bn(RFC2409_PRIME_768, sizeof(RFC2409_PRIME_768), bn);
 }
@@ -53,22 +136,134 @@ BIGNUM *BN_get_rfc2409_prime_768(BIGNUM *bn)
 BIGNUM *BN_get_rfc2409_prime_1024(BIGNUM *bn)
 {
     static const unsigned char RFC2409_PRIME_1024[] = {
-        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-        0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
-        0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
-        0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
-        0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
-        0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
-        0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
-        0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
-        0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
-        0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
-        0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
-        0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
-        0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
-        0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
-        0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81,
-        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xC9,
+        0x0F,
+        0xDA,
+        0xA2,
+        0x21,
+        0x68,
+        0xC2,
+        0x34,
+        0xC4,
+        0xC6,
+        0x62,
+        0x8B,
+        0x80,
+        0xDC,
+        0x1C,
+        0xD1,
+        0x29,
+        0x02,
+        0x4E,
+        0x08,
+        0x8A,
+        0x67,
+        0xCC,
+        0x74,
+        0x02,
+        0x0B,
+        0xBE,
+        0xA6,
+        0x3B,
+        0x13,
+        0x9B,
+        0x22,
+        0x51,
+        0x4A,
+        0x08,
+        0x79,
+        0x8E,
+        0x34,
+        0x04,
+        0xDD,
+        0xEF,
+        0x95,
+        0x19,
+        0xB3,
+        0xCD,
+        0x3A,
+        0x43,
+        0x1B,
+        0x30,
+        0x2B,
+        0x0A,
+        0x6D,
+        0xF2,
+        0x5F,
+        0x14,
+        0x37,
+        0x4F,
+        0xE1,
+        0x35,
+        0x6D,
+        0x6D,
+        0x51,
+        0xC2,
+        0x45,
+        0xE4,
+        0x85,
+        0xB5,
+        0x76,
+        0x62,
+        0x5E,
+        0x7E,
+        0xC6,
+        0xF4,
+        0x4C,
+        0x42,
+        0xE9,
+        0xA6,
+        0x37,
+        0xED,
+        0x6B,
+        0x0B,
+        0xFF,
+        0x5C,
+        0xB6,
+        0xF4,
+        0x06,
+        0xB7,
+        0xED,
+        0xEE,
+        0x38,
+        0x6B,
+        0xFB,
+        0x5A,
+        0x89,
+        0x9F,
+        0xA5,
+        0xAE,
+        0x9F,
+        0x24,
+        0x11,
+        0x7C,
+        0x4B,
+        0x1F,
+        0xE6,
+        0x49,
+        0x28,
+        0x66,
+        0x51,
+        0xEC,
+        0xE6,
+        0x53,
+        0x81,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
+        0xFF,
     };
     return BN_bin2bn(RFC2409_PRIME_1024, sizeof(RFC2409_PRIME_1024), bn);
 }
diff --git a/crypto/openssl/crypto/bn/bn_conv.c b/crypto/openssl/crypto/bn/bn_conv.c
index 57dda04b0d78..6b095238b77e 100644
--- a/crypto/openssl/crypto/bn/bn_conv.c
+++ b/crypto/openssl/crypto/bn/bn_conv.c
@@ -37,7 +37,7 @@ char *BN_bn2hex(const BIGNUM *a)
         }
     }
     *p = '\0';
- err:
+err:
     return buf;
 }
 
@@ -61,7 +61,7 @@ char *BN_bn2dec(const BIGNUM *a)
      */
     i = BN_num_bits(a) * 3;
     num = (i / 10 + i / 1000 + 1) + 1;
-    tbytes = num + 3;   /* negative and terminator and one spare? */
+    tbytes = num + 3; /* negative and terminator and one spare? */
     bn_data_num = num / BN_DEC_NUM + 1;
     bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
     buf = OPENSSL_malloc(tbytes);
@@ -106,7 +106,7 @@ char *BN_bn2dec(const BIGNUM *a)
         }
     }
     ok = 1;
- err:
+err:
     OPENSSL_free(bn_data);
     BN_free(t);
     if (ok)
@@ -158,7 +158,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a)
     if (bn_expand(ret, i * 4) == NULL)
         goto err;
 
-    j = i;                      /* least significant 'hex' */
+    j = i; /* least significant 'hex' */
     m = 0;
     h = 0;
     while (j > 0) {
@@ -168,7 +168,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a)
             c = a[j - m];
             k = OPENSSL_hexchar2int(c);
             if (k < 0)
-                k = 0;          /* paranoia */
+                k = 0; /* paranoia */
             l = (l << 4) | k;
 
             if (--m <= 0) {
@@ -187,7 +187,7 @@ int BN_hex2bn(BIGNUM **bn, const char *a)
     if (ret->top != 0)
         ret->neg = neg;
     return num;
- err:
+err:
     if (*bn == NULL)
         BN_free(ret);
     return 0;
@@ -257,7 +257,7 @@ int BN_dec2bn(BIGNUM **bn, const char *a)
     if (ret->top != 0)
         ret->neg = neg;
     return num;
- err:
+err:
     if (*bn == NULL)
         BN_free(ret);
     return 0;
diff --git a/crypto/openssl/crypto/bn/bn_ctx.c b/crypto/openssl/crypto/bn/bn_ctx.c
index aa70ca7a3fd9..90ac7cee60de 100644
--- a/crypto/openssl/crypto/bn/bn_ctx.c
+++ b/crypto/openssl/crypto/bn/bn_ctx.c
@@ -12,9 +12,9 @@
 #include "bn_local.h"
 
 /* How many bignums are in each "pool item"; */
-#define BN_CTX_POOL_SIZE        16
+#define BN_CTX_POOL_SIZE 16
 /* The stack frame info is resizing, set a first-time expansion size; */
-#define BN_CTX_START_FRAMES     32
+#define BN_CTX_START_FRAMES 32
 
 /***********/
 /* BN_POOL */
@@ -86,10 +86,10 @@ static void ctxdbg(BIO *channel, const char *text, BN_CTX *ctx)
     BN_STACK *stack = &ctx->stack;
 
     BIO_printf(channel, "%s\n", text);
-    BIO_printf(channel, "  (%16p): ", (void*)ctx);
+    BIO_printf(channel, "  (%16p): ", (void *)ctx);
     while (bnidx < ctx->used) {
         BIO_printf(channel, "%03x ",
-                   item->vals[bnidx++ % BN_CTX_POOL_SIZE].dmax);
+            item->vals[bnidx++ % BN_CTX_POOL_SIZE].dmax);
         if (!(bnidx % BN_CTX_POOL_SIZE))
             item = item->next;
     }
@@ -106,13 +106,17 @@ static void ctxdbg(BIO *channel, const char *text, BN_CTX *ctx)
     BIO_printf(channel, "\n");
 }
 
-# define CTXDBG(str, ctx)           \
-    OSSL_TRACE_BEGIN(BN_CTX) {      \
-        ctxdbg(trc_out, str, ctx);  \
-    } OSSL_TRACE_END(BN_CTX)
+#define CTXDBG(str, ctx)           \
+    OSSL_TRACE_BEGIN(BN_CTX)       \
+    {                              \
+        ctxdbg(trc_out, str, ctx); \
+    }                              \
+    OSSL_TRACE_END(BN_CTX)
 #else
 /* We do not want tracing in FIPS module */
-# define CTXDBG(str, ctx) do {} while(0)
+#define CTXDBG(str, ctx) \
+    do {                 \
+    } while (0)
 #endif /* FIPS_MODULE */
 
 BN_CTX *BN_CTX_new_ex(OSSL_LIB_CTX *ctx)
@@ -156,11 +160,12 @@ void BN_CTX_free(BN_CTX *ctx)
     if (ctx == NULL)
         return;
 #ifndef FIPS_MODULE
-    OSSL_TRACE_BEGIN(BN_CTX) {
+    OSSL_TRACE_BEGIN(BN_CTX)
+    {
         BN_POOL_ITEM *pool = ctx->pool.head;
         BIO_printf(trc_out,
-                   "BN_CTX_free(): stack-size=%d, pool-bignums=%d\n",
-                   ctx->stack.size, ctx->pool.size);
+            "BN_CTX_free(): stack-size=%d, pool-bignums=%d\n",
+            ctx->stack.size, ctx->pool.size);
         BIO_printf(trc_out, "  dmaxs: ");
         while (pool) {
             unsigned loop = 0;
@@ -169,7 +174,8 @@ void BN_CTX_free(BN_CTX *ctx)
             pool = pool->next;
         }
         BIO_printf(trc_out, "\n");
-    } OSSL_TRACE_END(BN_CTX);
+    }
+    OSSL_TRACE_END(BN_CTX);
 #endif
     BN_STACK_finish(&ctx->stack);
     BN_POOL_finish(&ctx->pool);
@@ -257,13 +263,11 @@ static void BN_STACK_finish(BN_STACK *st)
     st->indexes = NULL;
 }
 
-
 static int BN_STACK_push(BN_STACK *st, unsigned int idx)
 {
     if (st->depth == st->size) {
         /* Need to expand */
-        unsigned int newsize =
-            st->size ? (st->size * 3 / 2) : BN_CTX_START_FRAMES;
+        unsigned int newsize = st->size ? (st->size * 3 / 2) : BN_CTX_START_FRAMES;
         unsigned int *newitems;
 
         if ((newitems = OPENSSL_malloc(sizeof(*newitems) * newsize)) == NULL)
@@ -308,7 +312,6 @@ static void BN_POOL_finish(BN_POOL *p)
     }
 }
 
-
 static BIGNUM *BN_POOL_get(BN_POOL *p, int flag)
 {
     BIGNUM *bn;
diff --git a/crypto/openssl/crypto/bn/bn_depr.c b/crypto/openssl/crypto/bn/bn_depr.c
index d55397016a51..01f753ba84c3 100644
--- a/crypto/openssl/crypto/bn/bn_depr.c
+++ b/crypto/openssl/crypto/bn/bn_depr.c
@@ -20,8 +20,8 @@
 #include "bn_local.h"
 
 BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe,
-                          const BIGNUM *add, const BIGNUM *rem,
-                          void (*callback) (int, int, void *), void *cb_arg)
+    const BIGNUM *add, const BIGNUM *rem,
+    void (*callback)(int, int, void *), void *cb_arg)
 {
     BN_GENCB cb;
     BIGNUM *rnd = NULL;
@@ -38,14 +38,14 @@ BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe,
 
     /* we have a prime :-) */
     return rnd;
- err:
+err:
     BN_free(rnd);
     return NULL;
 }
 
 int BN_is_prime(const BIGNUM *a, int checks,
-                void (*callback) (int, int, void *), BN_CTX *ctx_passed,
-                void *cb_arg)
+    void (*callback)(int, int, void *), BN_CTX *ctx_passed,
+    void *cb_arg)
 {
     BN_GENCB cb;
     BN_GENCB_set_old(&cb, callback, cb_arg);
@@ -53,9 +53,9 @@ int BN_is_prime(const BIGNUM *a, int checks,
 }
 
 int BN_is_prime_fasttest(const BIGNUM *a, int checks,
-                         void (*callback) (int, int, void *),
-                         BN_CTX *ctx_passed, void *cb_arg,
-                         int do_trial_division)
+    void (*callback)(int, int, void *),
+    BN_CTX *ctx_passed, void *cb_arg,
+    int do_trial_division)
 {
     BN_GENCB cb;
     BN_GENCB_set_old(&cb, callback, cb_arg);
diff --git a/crypto/openssl/crypto/bn/bn_dh.c b/crypto/openssl/crypto/bn/bn_dh.c
index c0967e534c8c..542c33d6a8d7 100644
--- a/crypto/openssl/crypto/bn/bn_dh.c
+++ b/crypto/openssl/crypto/bn/bn_dh.c
@@ -10,18 +10,18 @@
 #include "bn_local.h"
 #include "internal/nelem.h"
 
-# include <openssl/dh.h>
-# include "crypto/bn_dh.h"
+#include <openssl/dh.h>
+#include "crypto/bn_dh.h"
 
-# if BN_BITS2 == 64
-#  define BN_DEF(lo, hi) (BN_ULONG)hi << 32 | lo
-# else
-#  define BN_DEF(lo, hi) lo, hi
-# endif
+#if BN_BITS2 == 64
+#define BN_DEF(lo, hi) (BN_ULONG) hi << 32 | lo
+#else
+#define BN_DEF(lo, hi) lo, hi
+#endif
 
 /* DH parameters from RFC3526 */
 
-# ifndef FIPS_MODULE
+#ifndef FIPS_MODULE
 /*
  * "1536-bit MODP Group" from RFC3526, Section 2.
  *
@@ -59,7 +59,7 @@ static const BN_ULONG modp_1536_q[] = {
     BN_DEF(0x4533E63A, 0x94812704), BN_DEF(0xC06E0E68, 0x62633145),
     BN_DEF(0x10B4611A, 0xE487ED51), BN_DEF(0xFFFFFFFF, 0x7FFFFFFF)
 };
-# endif /* FIPS_MODULE */
+#endif /* FIPS_MODULE */
 
 /*-
  * "2048-bit MODP Group" from RFC3526, Section 3.
@@ -88,22 +88,38 @@ static const BN_ULONG modp_2048_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG modp_2048_q[] = {
-    BN_DEF(0xFFFFFFFF,  0x7FFFFFFF), BN_DEF(0x45565534,  0x0AB9472D),
-    BN_DEF(0x4C7D0288,  0x8AE9130C), BN_DEF(0x754AB572,  0x1CCAA4BE),
-    BN_DEF(0x4AAC0B8C,  0xEF15E5FB), BN_DEF(0x37A62964,  0xDAE2AEF8),
-    BN_DEF(0x7603D147,  0xCD93C1D1), BN_DEF(0x0C074301,  0xF1CF3B96),
-    BN_DEF(0x171B671D,  0x19482F23), BN_DEF(0x650C10BE,  0x78BA3604),
-    BN_DEF(0x255E4C02,  0xB3861AA7), BN_DEF(0xB84B4B36,  0xCF6A9483),
-    BN_DEF(0x1042A95D,  0x0E3179AB), BN_DEF(0xEE51D6CB,  0xC1B2AE91),
-    BN_DEF(0x7E9267AF,  0x348B1FD4), BN_DEF(0x0E2AE9CD,  0xCC6D241B),
-    BN_DEF(0x50B1DF82,  0xE1003E5C), BN_DEF(0xF6722D9E,  0x24943328),
-    BN_DEF(0xBE258FF3,  0xD74F9208), BN_DEF(0xAD44CFD2,  0xF71C35FD),
-    BN_DEF(0x7A035BF6,  0x85FFAE5B), BN_DEF(0xD31BF6B5,  0x7A262174),
-    BN_DEF(0x312F3F63,  0xF242DABB), BN_DEF(0xB6A8E122,  0xA7F09AB6),
-    BN_DEF(0xF92F8A1B,  0x98158536), BN_DEF(0xE69D218D,  0xF7CA8CD9),
-    BN_DEF(0xC71A026E,  0x28A5043C), BN_DEF(0x1D89CD91,  0x0105DF53),
-    BN_DEF(0x4533E63A,  0x94812704), BN_DEF(0xC06E0E68,  0x62633145),
-    BN_DEF(0x10B4611A,  0xE487ED51), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
+    BN_DEF(0x45565534, 0x0AB9472D),
+    BN_DEF(0x4C7D0288, 0x8AE9130C),
+    BN_DEF(0x754AB572, 0x1CCAA4BE),
+    BN_DEF(0x4AAC0B8C, 0xEF15E5FB),
+    BN_DEF(0x37A62964, 0xDAE2AEF8),
+    BN_DEF(0x7603D147, 0xCD93C1D1),
+    BN_DEF(0x0C074301, 0xF1CF3B96),
+    BN_DEF(0x171B671D, 0x19482F23),
+    BN_DEF(0x650C10BE, 0x78BA3604),
+    BN_DEF(0x255E4C02, 0xB3861AA7),
+    BN_DEF(0xB84B4B36, 0xCF6A9483),
+    BN_DEF(0x1042A95D, 0x0E3179AB),
+    BN_DEF(0xEE51D6CB, 0xC1B2AE91),
+    BN_DEF(0x7E9267AF, 0x348B1FD4),
+    BN_DEF(0x0E2AE9CD, 0xCC6D241B),
+    BN_DEF(0x50B1DF82, 0xE1003E5C),
+    BN_DEF(0xF6722D9E, 0x24943328),
+    BN_DEF(0xBE258FF3, 0xD74F9208),
+    BN_DEF(0xAD44CFD2, 0xF71C35FD),
+    BN_DEF(0x7A035BF6, 0x85FFAE5B),
+    BN_DEF(0xD31BF6B5, 0x7A262174),
+    BN_DEF(0x312F3F63, 0xF242DABB),
+    BN_DEF(0xB6A8E122, 0xA7F09AB6),
+    BN_DEF(0xF92F8A1B, 0x98158536),
+    BN_DEF(0xE69D218D, 0xF7CA8CD9),
+    BN_DEF(0xC71A026E, 0x28A5043C),
+    BN_DEF(0x1D89CD91, 0x0105DF53),
+    BN_DEF(0x4533E63A, 0x94812704),
+    BN_DEF(0xC06E0E68, 0x62633145),
+    BN_DEF(0x10B4611A, 0xE487ED51),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 /*-
@@ -141,30 +157,54 @@ static const BN_ULONG modp_3072_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG modp_3072_q[] = {
-    BN_DEF(0xFFFFFFFF,  0x7FFFFFFF), BN_DEF(0x549D6965,  0x25C16890),
-    BN_DEF(0x707E8847,  0xA1EDADFE), BN_DEF(0x3A72D598,  0x047127D0),
-    BN_DEF(0x5D6CA371,  0x3B84C460), BN_DEF(0xBD30AEB6,  0x5DF08BAB),
-    BN_DEF(0x0BBD9006,  0x290F958C), BN_DEF(0x9F643532,  0x6C3B0139),
-    BN_DEF(0x6CC50432,  0xF897FD03), BN_DEF(0x0D697735,  0xE771E913),
-    BN_DEF(0x2512B0CE,  0x8F464A70), BN_DEF(0x6D8499EB,  0xD5FAD746),
-    BN_DEF(0xD370F263,  0xD9CB87C2), BN_DEF(0xAE83063E,  0x457538AB),
-    BN_DEF(0x2C6DF785,  0x767DC282), BN_DEF(0xEF8E5D32,  0xD42A90D5),
-    BN_DEF(0x82283D19,  0xD6998B86), BN_DEF(0x45556216,  0x0AB9472D),
-    BN_DEF(0x4C7D0288,  0x8AE9130C), BN_DEF(0x754AB572,  0x1CCAA4BE),
-    BN_DEF(0x4AAC0B8C,  0xEF15E5FB), BN_DEF(0x37A62964,  0xDAE2AEF8),
-    BN_DEF(0x7603D147,  0xCD93C1D1), BN_DEF(0x0C074301,  0xF1CF3B96),
-    BN_DEF(0x171B671D,  0x19482F23), BN_DEF(0x650C10BE,  0x78BA3604),
-    BN_DEF(0x255E4C02,  0xB3861AA7), BN_DEF(0xB84B4B36,  0xCF6A9483),
-    BN_DEF(0x1042A95D,  0x0E3179AB), BN_DEF(0xEE51D6CB,  0xC1B2AE91),
-    BN_DEF(0x7E9267AF,  0x348B1FD4), BN_DEF(0x0E2AE9CD,  0xCC6D241B),
-    BN_DEF(0x50B1DF82,  0xE1003E5C), BN_DEF(0xF6722D9E,  0x24943328),
-    BN_DEF(0xBE258FF3,  0xD74F9208), BN_DEF(0xAD44CFD2,  0xF71C35FD),
-    BN_DEF(0x7A035BF6,  0x85FFAE5B), BN_DEF(0xD31BF6B5,  0x7A262174),
-    BN_DEF(0x312F3F63,  0xF242DABB), BN_DEF(0xB6A8E122,  0xA7F09AB6),
-    BN_DEF(0xF92F8A1B,  0x98158536), BN_DEF(0xE69D218D,  0xF7CA8CD9),
-    BN_DEF(0xC71A026E,  0x28A5043C), BN_DEF(0x1D89CD91,  0x0105DF53),
-    BN_DEF(0x4533E63A,  0x94812704), BN_DEF(0xC06E0E68,  0x62633145),
-    BN_DEF(0x10B4611A,  0xE487ED51), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
+    BN_DEF(0x549D6965, 0x25C16890),
+    BN_DEF(0x707E8847, 0xA1EDADFE),
+    BN_DEF(0x3A72D598, 0x047127D0),
+    BN_DEF(0x5D6CA371, 0x3B84C460),
+    BN_DEF(0xBD30AEB6, 0x5DF08BAB),
+    BN_DEF(0x0BBD9006, 0x290F958C),
+    BN_DEF(0x9F643532, 0x6C3B0139),
+    BN_DEF(0x6CC50432, 0xF897FD03),
+    BN_DEF(0x0D697735, 0xE771E913),
+    BN_DEF(0x2512B0CE, 0x8F464A70),
+    BN_DEF(0x6D8499EB, 0xD5FAD746),
+    BN_DEF(0xD370F263, 0xD9CB87C2),
+    BN_DEF(0xAE83063E, 0x457538AB),
+    BN_DEF(0x2C6DF785, 0x767DC282),
+    BN_DEF(0xEF8E5D32, 0xD42A90D5),
+    BN_DEF(0x82283D19, 0xD6998B86),
+    BN_DEF(0x45556216, 0x0AB9472D),
+    BN_DEF(0x4C7D0288, 0x8AE9130C),
+    BN_DEF(0x754AB572, 0x1CCAA4BE),
+    BN_DEF(0x4AAC0B8C, 0xEF15E5FB),
+    BN_DEF(0x37A62964, 0xDAE2AEF8),
+    BN_DEF(0x7603D147, 0xCD93C1D1),
+    BN_DEF(0x0C074301, 0xF1CF3B96),
+    BN_DEF(0x171B671D, 0x19482F23),
+    BN_DEF(0x650C10BE, 0x78BA3604),
+    BN_DEF(0x255E4C02, 0xB3861AA7),
+    BN_DEF(0xB84B4B36, 0xCF6A9483),
+    BN_DEF(0x1042A95D, 0x0E3179AB),
+    BN_DEF(0xEE51D6CB, 0xC1B2AE91),
+    BN_DEF(0x7E9267AF, 0x348B1FD4),
+    BN_DEF(0x0E2AE9CD, 0xCC6D241B),
+    BN_DEF(0x50B1DF82, 0xE1003E5C),
+    BN_DEF(0xF6722D9E, 0x24943328),
+    BN_DEF(0xBE258FF3, 0xD74F9208),
+    BN_DEF(0xAD44CFD2, 0xF71C35FD),
+    BN_DEF(0x7A035BF6, 0x85FFAE5B),
+    BN_DEF(0xD31BF6B5, 0x7A262174),
+    BN_DEF(0x312F3F63, 0xF242DABB),
+    BN_DEF(0xB6A8E122, 0xA7F09AB6),
+    BN_DEF(0xF92F8A1B, 0x98158536),
+    BN_DEF(0xE69D218D, 0xF7CA8CD9),
+    BN_DEF(0xC71A026E, 0x28A5043C),
+    BN_DEF(0x1D89CD91, 0x0105DF53),
+    BN_DEF(0x4533E63A, 0x94812704),
+    BN_DEF(0xC06E0E68, 0x62633145),
+    BN_DEF(0x10B4611A, 0xE487ED51),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 /*-
@@ -210,38 +250,70 @@ static const BN_ULONG modp_4096_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG modp_4096_q[] = {
-    BN_DEF(0xFFFFFFFF,  0xFFFFFFFF), BN_DEF(0x9A0318CC,  0xA6FA1AE4),
-    BN_DEF(0x48536047,  0xC37FDBEE), BN_DEF(0x46C7EEE0,  0xC9DA754C),
-    BN_DEF(0xEAD82D54,  0x68034893), BN_DEF(0x10B8240E,  0xDC0DEEBB),
-    BN_DEF(0x67716BD7,  0x8FB094B8), BN_DEF(0x28ADF3F6,  0x119DD0C3),
-    BN_DEF(0xD04861D1,  0xCCD94B27), BN_DEF(0xA735E02E,  0x143E2CA3),
-    BN_DEF(0x0FDF6553,  0x97477E0A), BN_DEF(0x826F477C,  0x6DDDE16D),
-    BN_DEF(0x156A2674,  0x12C1F4E5), BN_DEF(0x5B0A85ED,  0x0D4A341A),
-    BN_DEF(0x357A711E,  0x4CE1938C), BN_DEF(0x5EDD2D93,  0xC438CD08),
-    BN_DEF(0x53C3F36B,  0x8D391E09), BN_DEF(0x54908400,  0x25C16890),
-    BN_DEF(0x707E8847,  0xA1EDADFE), BN_DEF(0x3A72D598,  0x047127D0),
-    BN_DEF(0x5D6CA371,  0x3B84C460), BN_DEF(0xBD30AEB6,  0x5DF08BAB),
-    BN_DEF(0x0BBD9006,  0x290F958C), BN_DEF(0x9F643532,  0x6C3B0139),
-    BN_DEF(0x6CC50432,  0xF897FD03), BN_DEF(0x0D697735,  0xE771E913),
-    BN_DEF(0x2512B0CE,  0x8F464A70), BN_DEF(0x6D8499EB,  0xD5FAD746),
-    BN_DEF(0xD370F263,  0xD9CB87C2), BN_DEF(0xAE83063E,  0x457538AB),
-    BN_DEF(0x2C6DF785,  0x767DC282), BN_DEF(0xEF8E5D32,  0xD42A90D5),
-    BN_DEF(0x82283D19,  0xD6998B86), BN_DEF(0x45556216,  0x0AB9472D),
-    BN_DEF(0x4C7D0288,  0x8AE9130C), BN_DEF(0x754AB572,  0x1CCAA4BE),
-    BN_DEF(0x4AAC0B8C,  0xEF15E5FB), BN_DEF(0x37A62964,  0xDAE2AEF8),
-    BN_DEF(0x7603D147,  0xCD93C1D1), BN_DEF(0x0C074301,  0xF1CF3B96),
-    BN_DEF(0x171B671D,  0x19482F23), BN_DEF(0x650C10BE,  0x78BA3604),
-    BN_DEF(0x255E4C02,  0xB3861AA7), BN_DEF(0xB84B4B36,  0xCF6A9483),
-    BN_DEF(0x1042A95D,  0x0E3179AB), BN_DEF(0xEE51D6CB,  0xC1B2AE91),
-    BN_DEF(0x7E9267AF,  0x348B1FD4), BN_DEF(0x0E2AE9CD,  0xCC6D241B),
-    BN_DEF(0x50B1DF82,  0xE1003E5C), BN_DEF(0xF6722D9E,  0x24943328),
-    BN_DEF(0xBE258FF3,  0xD74F9208), BN_DEF(0xAD44CFD2,  0xF71C35FD),
-    BN_DEF(0x7A035BF6,  0x85FFAE5B), BN_DEF(0xD31BF6B5,  0x7A262174),
-    BN_DEF(0x312F3F63,  0xF242DABB), BN_DEF(0xB6A8E122,  0xA7F09AB6),
-    BN_DEF(0xF92F8A1B,  0x98158536), BN_DEF(0xE69D218D,  0xF7CA8CD9),
-    BN_DEF(0xC71A026E,  0x28A5043C), BN_DEF(0x1D89CD91,  0x0105DF53),
-    BN_DEF(0x4533E63A,  0x94812704), BN_DEF(0xC06E0E68,  0x62633145),
-    BN_DEF(0x10B4611A,  0xE487ED51), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0xFFFFFFFF),
+    BN_DEF(0x9A0318CC, 0xA6FA1AE4),
+    BN_DEF(0x48536047, 0xC37FDBEE),
+    BN_DEF(0x46C7EEE0, 0xC9DA754C),
+    BN_DEF(0xEAD82D54, 0x68034893),
+    BN_DEF(0x10B8240E, 0xDC0DEEBB),
+    BN_DEF(0x67716BD7, 0x8FB094B8),
+    BN_DEF(0x28ADF3F6, 0x119DD0C3),
+    BN_DEF(0xD04861D1, 0xCCD94B27),
+    BN_DEF(0xA735E02E, 0x143E2CA3),
+    BN_DEF(0x0FDF6553, 0x97477E0A),
+    BN_DEF(0x826F477C, 0x6DDDE16D),
+    BN_DEF(0x156A2674, 0x12C1F4E5),
+    BN_DEF(0x5B0A85ED, 0x0D4A341A),
+    BN_DEF(0x357A711E, 0x4CE1938C),
+    BN_DEF(0x5EDD2D93, 0xC438CD08),
+    BN_DEF(0x53C3F36B, 0x8D391E09),
+    BN_DEF(0x54908400, 0x25C16890),
+    BN_DEF(0x707E8847, 0xA1EDADFE),
+    BN_DEF(0x3A72D598, 0x047127D0),
+    BN_DEF(0x5D6CA371, 0x3B84C460),
+    BN_DEF(0xBD30AEB6, 0x5DF08BAB),
+    BN_DEF(0x0BBD9006, 0x290F958C),
+    BN_DEF(0x9F643532, 0x6C3B0139),
+    BN_DEF(0x6CC50432, 0xF897FD03),
+    BN_DEF(0x0D697735, 0xE771E913),
+    BN_DEF(0x2512B0CE, 0x8F464A70),
+    BN_DEF(0x6D8499EB, 0xD5FAD746),
+    BN_DEF(0xD370F263, 0xD9CB87C2),
+    BN_DEF(0xAE83063E, 0x457538AB),
+    BN_DEF(0x2C6DF785, 0x767DC282),
+    BN_DEF(0xEF8E5D32, 0xD42A90D5),
+    BN_DEF(0x82283D19, 0xD6998B86),
+    BN_DEF(0x45556216, 0x0AB9472D),
+    BN_DEF(0x4C7D0288, 0x8AE9130C),
+    BN_DEF(0x754AB572, 0x1CCAA4BE),
+    BN_DEF(0x4AAC0B8C, 0xEF15E5FB),
+    BN_DEF(0x37A62964, 0xDAE2AEF8),
+    BN_DEF(0x7603D147, 0xCD93C1D1),
+    BN_DEF(0x0C074301, 0xF1CF3B96),
+    BN_DEF(0x171B671D, 0x19482F23),
+    BN_DEF(0x650C10BE, 0x78BA3604),
+    BN_DEF(0x255E4C02, 0xB3861AA7),
+    BN_DEF(0xB84B4B36, 0xCF6A9483),
+    BN_DEF(0x1042A95D, 0x0E3179AB),
+    BN_DEF(0xEE51D6CB, 0xC1B2AE91),
+    BN_DEF(0x7E9267AF, 0x348B1FD4),
+    BN_DEF(0x0E2AE9CD, 0xCC6D241B),
+    BN_DEF(0x50B1DF82, 0xE1003E5C),
+    BN_DEF(0xF6722D9E, 0x24943328),
+    BN_DEF(0xBE258FF3, 0xD74F9208),
+    BN_DEF(0xAD44CFD2, 0xF71C35FD),
+    BN_DEF(0x7A035BF6, 0x85FFAE5B),
+    BN_DEF(0xD31BF6B5, 0x7A262174),
+    BN_DEF(0x312F3F63, 0xF242DABB),
+    BN_DEF(0xB6A8E122, 0xA7F09AB6),
+    BN_DEF(0xF92F8A1B, 0x98158536),
+    BN_DEF(0xE69D218D, 0xF7CA8CD9),
+    BN_DEF(0xC71A026E, 0x28A5043C),
+    BN_DEF(0x1D89CD91, 0x0105DF53),
+    BN_DEF(0x4533E63A, 0x94812704),
+    BN_DEF(0xC06E0E68, 0x62633145),
+    BN_DEF(0x10B4611A, 0xE487ED51),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 /*-
@@ -303,54 +375,102 @@ static const BN_ULONG modp_6144_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG modp_6144_q[] = {
-    BN_DEF(0xFFFFFFFF,  0x7FFFFFFF), BN_DEF(0x36E62012,  0x734A7C8F),
-    BN_DEF(0x85BA3A6B,  0x095F96AD), BN_DEF(0x1FA43077,  0x021F47B3),
-    BN_DEF(0xB71E0234,  0x1C3FF46B), BN_DEF(0x17794B19,  0x6D2B64F6),
-    BN_DEF(0xD189EAAE,  0x758CE658), BN_DEF(0xC50FDFF8,  0x7AA8551E),
-    BN_DEF(0xDBE2ED3B,  0x0350EAC5), BN_DEF(0x794DF194,  0x53CB8AF7),
-    BN_DEF(0x07C01BF0,  0x0A662F69), BN_DEF(0x5FA470EC,  0x6647B6BF),
-    BN_DEF(0x15A0AA55,  0xA5EA03D9), BN_DEF(0xFFAC2D62,  0x078EA2DB),
-    BN_DEF(0x1B66445F,  0x91D4BD3F), BN_DEF(0xDF63F479,  0x2CF3E4BF),
-    BN_DEF(0xC8058E4F,  0x5AD42018), BN_DEF(0xA34C0641,  0x6AAF3817),
-    BN_DEF(0x373A7F7B,  0xFA416BE7), BN_DEF(0xE8B90E81,  0x7819750A),
-    BN_DEF(0xE325C976,  0xACC1E500), BN_DEF(0x9BC6695F,  0x37DC7A00),
-    BN_DEF(0x95EBD7A1,  0x999028A8), BN_DEF(0xF36612A5,  0xEDBF8A23),
-    BN_DEF(0x676A5D8D,  0xA267365D), BN_DEF(0xE7CD8A76,  0x6D1F6DF5),
-    BN_DEF(0x432D448C,  0x8BCB93D8), BN_DEF(0xC813EC18,  0x583529F6),
-    BN_DEF(0xA09800D7,  0x72ED9C17), BN_DEF(0x56CF2987,  0xFC7FCA03),
-    BN_DEF(0x1EDD1BDE,  0x64BA8F3B), BN_DEF(0x3013236F,  0x60EA6E59),
-    BN_DEF(0x693E3813,  0x1B61FD5A), BN_DEF(0x9A014249,  0xA6FA1AE4),
-    BN_DEF(0x48536047,  0xC37FDBEE), BN_DEF(0x46C7EEE0,  0xC9DA754C),
-    BN_DEF(0xEAD82D54,  0x68034893), BN_DEF(0x10B8240E,  0xDC0DEEBB),
-    BN_DEF(0x67716BD7,  0x8FB094B8), BN_DEF(0x28ADF3F6,  0x119DD0C3),
-    BN_DEF(0xD04861D1,  0xCCD94B27), BN_DEF(0xA735E02E,  0x143E2CA3),
-    BN_DEF(0x0FDF6553,  0x97477E0A), BN_DEF(0x826F477C,  0x6DDDE16D),
-    BN_DEF(0x156A2674,  0x12C1F4E5), BN_DEF(0x5B0A85ED,  0x0D4A341A),
-    BN_DEF(0x357A711E,  0x4CE1938C), BN_DEF(0x5EDD2D93,  0xC438CD08),
-    BN_DEF(0x53C3F36B,  0x8D391E09), BN_DEF(0x54908400,  0x25C16890),
-    BN_DEF(0x707E8847,  0xA1EDADFE), BN_DEF(0x3A72D598,  0x047127D0),
-    BN_DEF(0x5D6CA371,  0x3B84C460), BN_DEF(0xBD30AEB6,  0x5DF08BAB),
-    BN_DEF(0x0BBD9006,  0x290F958C), BN_DEF(0x9F643532,  0x6C3B0139),
-    BN_DEF(0x6CC50432,  0xF897FD03), BN_DEF(0x0D697735,  0xE771E913),
-    BN_DEF(0x2512B0CE,  0x8F464A70), BN_DEF(0x6D8499EB,  0xD5FAD746),
-    BN_DEF(0xD370F263,  0xD9CB87C2), BN_DEF(0xAE83063E,  0x457538AB),
-    BN_DEF(0x2C6DF785,  0x767DC282), BN_DEF(0xEF8E5D32,  0xD42A90D5),
-    BN_DEF(0x82283D19,  0xD6998B86), BN_DEF(0x45556216,  0x0AB9472D),
-    BN_DEF(0x4C7D0288,  0x8AE9130C), BN_DEF(0x754AB572,  0x1CCAA4BE),
-    BN_DEF(0x4AAC0B8C,  0xEF15E5FB), BN_DEF(0x37A62964,  0xDAE2AEF8),
-    BN_DEF(0x7603D147,  0xCD93C1D1), BN_DEF(0x0C074301,  0xF1CF3B96),
-    BN_DEF(0x171B671D,  0x19482F23), BN_DEF(0x650C10BE,  0x78BA3604),
-    BN_DEF(0x255E4C02,  0xB3861AA7), BN_DEF(0xB84B4B36,  0xCF6A9483),
-    BN_DEF(0x1042A95D,  0x0E3179AB), BN_DEF(0xEE51D6CB,  0xC1B2AE91),
-    BN_DEF(0x7E9267AF,  0x348B1FD4), BN_DEF(0x0E2AE9CD,  0xCC6D241B),
-    BN_DEF(0x50B1DF82,  0xE1003E5C), BN_DEF(0xF6722D9E,  0x24943328),
-    BN_DEF(0xBE258FF3,  0xD74F9208), BN_DEF(0xAD44CFD2,  0xF71C35FD),
-    BN_DEF(0x7A035BF6,  0x85FFAE5B), BN_DEF(0xD31BF6B5,  0x7A262174),
-    BN_DEF(0x312F3F63,  0xF242DABB), BN_DEF(0xB6A8E122,  0xA7F09AB6),
-    BN_DEF(0xF92F8A1B,  0x98158536), BN_DEF(0xE69D218D,  0xF7CA8CD9),
-    BN_DEF(0xC71A026E,  0x28A5043C), BN_DEF(0x1D89CD91,  0x0105DF53),
-    BN_DEF(0x4533E63A,  0x94812704), BN_DEF(0xC06E0E68,  0x62633145),
-    BN_DEF(0x10B4611A,  0xE487ED51), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
+    BN_DEF(0x36E62012, 0x734A7C8F),
+    BN_DEF(0x85BA3A6B, 0x095F96AD),
+    BN_DEF(0x1FA43077, 0x021F47B3),
+    BN_DEF(0xB71E0234, 0x1C3FF46B),
+    BN_DEF(0x17794B19, 0x6D2B64F6),
+    BN_DEF(0xD189EAAE, 0x758CE658),
+    BN_DEF(0xC50FDFF8, 0x7AA8551E),
+    BN_DEF(0xDBE2ED3B, 0x0350EAC5),
+    BN_DEF(0x794DF194, 0x53CB8AF7),
+    BN_DEF(0x07C01BF0, 0x0A662F69),
+    BN_DEF(0x5FA470EC, 0x6647B6BF),
+    BN_DEF(0x15A0AA55, 0xA5EA03D9),
+    BN_DEF(0xFFAC2D62, 0x078EA2DB),
+    BN_DEF(0x1B66445F, 0x91D4BD3F),
+    BN_DEF(0xDF63F479, 0x2CF3E4BF),
+    BN_DEF(0xC8058E4F, 0x5AD42018),
+    BN_DEF(0xA34C0641, 0x6AAF3817),
+    BN_DEF(0x373A7F7B, 0xFA416BE7),
+    BN_DEF(0xE8B90E81, 0x7819750A),
+    BN_DEF(0xE325C976, 0xACC1E500),
+    BN_DEF(0x9BC6695F, 0x37DC7A00),
+    BN_DEF(0x95EBD7A1, 0x999028A8),
+    BN_DEF(0xF36612A5, 0xEDBF8A23),
+    BN_DEF(0x676A5D8D, 0xA267365D),
+    BN_DEF(0xE7CD8A76, 0x6D1F6DF5),
+    BN_DEF(0x432D448C, 0x8BCB93D8),
+    BN_DEF(0xC813EC18, 0x583529F6),
+    BN_DEF(0xA09800D7, 0x72ED9C17),
+    BN_DEF(0x56CF2987, 0xFC7FCA03),
+    BN_DEF(0x1EDD1BDE, 0x64BA8F3B),
+    BN_DEF(0x3013236F, 0x60EA6E59),
+    BN_DEF(0x693E3813, 0x1B61FD5A),
+    BN_DEF(0x9A014249, 0xA6FA1AE4),
+    BN_DEF(0x48536047, 0xC37FDBEE),
+    BN_DEF(0x46C7EEE0, 0xC9DA754C),
+    BN_DEF(0xEAD82D54, 0x68034893),
+    BN_DEF(0x10B8240E, 0xDC0DEEBB),
+    BN_DEF(0x67716BD7, 0x8FB094B8),
+    BN_DEF(0x28ADF3F6, 0x119DD0C3),
+    BN_DEF(0xD04861D1, 0xCCD94B27),
+    BN_DEF(0xA735E02E, 0x143E2CA3),
+    BN_DEF(0x0FDF6553, 0x97477E0A),
+    BN_DEF(0x826F477C, 0x6DDDE16D),
+    BN_DEF(0x156A2674, 0x12C1F4E5),
+    BN_DEF(0x5B0A85ED, 0x0D4A341A),
+    BN_DEF(0x357A711E, 0x4CE1938C),
+    BN_DEF(0x5EDD2D93, 0xC438CD08),
+    BN_DEF(0x53C3F36B, 0x8D391E09),
+    BN_DEF(0x54908400, 0x25C16890),
+    BN_DEF(0x707E8847, 0xA1EDADFE),
+    BN_DEF(0x3A72D598, 0x047127D0),
+    BN_DEF(0x5D6CA371, 0x3B84C460),
+    BN_DEF(0xBD30AEB6, 0x5DF08BAB),
+    BN_DEF(0x0BBD9006, 0x290F958C),
+    BN_DEF(0x9F643532, 0x6C3B0139),
+    BN_DEF(0x6CC50432, 0xF897FD03),
+    BN_DEF(0x0D697735, 0xE771E913),
+    BN_DEF(0x2512B0CE, 0x8F464A70),
+    BN_DEF(0x6D8499EB, 0xD5FAD746),
+    BN_DEF(0xD370F263, 0xD9CB87C2),
+    BN_DEF(0xAE83063E, 0x457538AB),
+    BN_DEF(0x2C6DF785, 0x767DC282),
+    BN_DEF(0xEF8E5D32, 0xD42A90D5),
+    BN_DEF(0x82283D19, 0xD6998B86),
+    BN_DEF(0x45556216, 0x0AB9472D),
+    BN_DEF(0x4C7D0288, 0x8AE9130C),
+    BN_DEF(0x754AB572, 0x1CCAA4BE),
+    BN_DEF(0x4AAC0B8C, 0xEF15E5FB),
+    BN_DEF(0x37A62964, 0xDAE2AEF8),
+    BN_DEF(0x7603D147, 0xCD93C1D1),
+    BN_DEF(0x0C074301, 0xF1CF3B96),
+    BN_DEF(0x171B671D, 0x19482F23),
+    BN_DEF(0x650C10BE, 0x78BA3604),
+    BN_DEF(0x255E4C02, 0xB3861AA7),
+    BN_DEF(0xB84B4B36, 0xCF6A9483),
+    BN_DEF(0x1042A95D, 0x0E3179AB),
+    BN_DEF(0xEE51D6CB, 0xC1B2AE91),
+    BN_DEF(0x7E9267AF, 0x348B1FD4),
+    BN_DEF(0x0E2AE9CD, 0xCC6D241B),
+    BN_DEF(0x50B1DF82, 0xE1003E5C),
+    BN_DEF(0xF6722D9E, 0x24943328),
+    BN_DEF(0xBE258FF3, 0xD74F9208),
+    BN_DEF(0xAD44CFD2, 0xF71C35FD),
+    BN_DEF(0x7A035BF6, 0x85FFAE5B),
+    BN_DEF(0xD31BF6B5, 0x7A262174),
+    BN_DEF(0x312F3F63, 0xF242DABB),
+    BN_DEF(0xB6A8E122, 0xA7F09AB6),
+    BN_DEF(0xF92F8A1B, 0x98158536),
+    BN_DEF(0xE69D218D, 0xF7CA8CD9),
+    BN_DEF(0xC71A026E, 0x28A5043C),
+    BN_DEF(0x1D89CD91, 0x0105DF53),
+    BN_DEF(0x4533E63A, 0x94812704),
+    BN_DEF(0xC06E0E68, 0x62633145),
+    BN_DEF(0x10B4611A, 0xE487ED51),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 /*
@@ -428,70 +548,134 @@ static const BN_ULONG modp_8192_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG modp_8192_q[] = {
-    BN_DEF(0xFFFFFFFF,  0xFFFFFFFF), BN_DEF(0xCC76E9EF,  0xB064C06E),
-    BN_DEF(0x405CB738,  0xE40FAB74), BN_DEF(0x3B2B4A6F,  0x4F182871),
-    BN_DEF(0xAB3BF4D5,  0xCAAC7223), BN_DEF(0x7E013723,  0xE48C86D3),
-    BN_DEF(0x6AF71C15,  0xC44D0017), BN_DEF(0xA40E366B,  0x2004A1C5),
-    BN_DEF(0x75C3CFC9,  0x1AC8237A), BN_DEF(0x8F67D134,  0xFD79B5E1),
-    BN_DEF(0xBF73A6B9,  0xD8EA885E), BN_DEF(0xAEF6BF50,  0xFCD5A40C),
-    BN_DEF(0x8423428E,  0xB2798E62), BN_DEF(0xD012AEE0,  0x22CBF44C),
-    BN_DEF(0x3A55B51B,  0xEF988770), BN_DEF(0x1FA27C16,  0x369509FC),
-    BN_DEF(0xD9D13C53,  0x03159E7A), BN_DEF(0xF6ADEE9D,  0x3CB41981),
-    BN_DEF(0xD16043F4,  0xFD4EA5BF), BN_DEF(0x17C1C2EE,  0xA5E5E443),
-    BN_DEF(0x36751835,  0x9A39FE32), BN_DEF(0x0D11F863,  0x89F5ABD4),
-    BN_DEF(0x5201BE03,  0x91111702), BN_DEF(0x7E42456C,  0xF1FEDC5F),
-    BN_DEF(0xF1CEB296,  0x11C78B65), BN_DEF(0x15F8E4BC,  0x1A11DA3A),
-    BN_DEF(0x2D727AB4,  0x1D55B1CE), BN_DEF(0xB5D21233,  0x92BB7B49),
-    BN_DEF(0xC57E23F6,  0x3A0FD3DF), BN_DEF(0x46CEE980,  0x1DE4195B),
-    BN_DEF(0x39DC98DD,  0x6C5F6268), BN_DEF(0x54996FC6,  0x1C3BBE5B),
-    BN_DEF(0x897F72F2,  0xBA51C937), BN_DEF(0x36DF08AC,  0x734A7C8F),
-    BN_DEF(0x85BA3A6B,  0x095F96AD), BN_DEF(0x1FA43077,  0x021F47B3),
-    BN_DEF(0xB71E0234,  0x1C3FF46B), BN_DEF(0x17794B19,  0x6D2B64F6),
-    BN_DEF(0xD189EAAE,  0x758CE658), BN_DEF(0xC50FDFF8,  0x7AA8551E),
-    BN_DEF(0xDBE2ED3B,  0x0350EAC5), BN_DEF(0x794DF194,  0x53CB8AF7),
-    BN_DEF(0x07C01BF0,  0x0A662F69), BN_DEF(0x5FA470EC,  0x6647B6BF),
-    BN_DEF(0x15A0AA55,  0xA5EA03D9), BN_DEF(0xFFAC2D62,  0x078EA2DB),
-    BN_DEF(0x1B66445F,  0x91D4BD3F), BN_DEF(0xDF63F479,  0x2CF3E4BF),
-    BN_DEF(0xC8058E4F,  0x5AD42018), BN_DEF(0xA34C0641,  0x6AAF3817),
-    BN_DEF(0x373A7F7B,  0xFA416BE7), BN_DEF(0xE8B90E81,  0x7819750A),
-    BN_DEF(0xE325C976,  0xACC1E500), BN_DEF(0x9BC6695F,  0x37DC7A00),
-    BN_DEF(0x95EBD7A1,  0x999028A8), BN_DEF(0xF36612A5,  0xEDBF8A23),
-    BN_DEF(0x676A5D8D,  0xA267365D), BN_DEF(0xE7CD8A76,  0x6D1F6DF5),
-    BN_DEF(0x432D448C,  0x8BCB93D8), BN_DEF(0xC813EC18,  0x583529F6),
-    BN_DEF(0xA09800D7,  0x72ED9C17), BN_DEF(0x56CF2987,  0xFC7FCA03),
-    BN_DEF(0x1EDD1BDE,  0x64BA8F3B), BN_DEF(0x3013236F,  0x60EA6E59),
-    BN_DEF(0x693E3813,  0x1B61FD5A), BN_DEF(0x9A014249,  0xA6FA1AE4),
-    BN_DEF(0x48536047,  0xC37FDBEE), BN_DEF(0x46C7EEE0,  0xC9DA754C),
-    BN_DEF(0xEAD82D54,  0x68034893), BN_DEF(0x10B8240E,  0xDC0DEEBB),
-    BN_DEF(0x67716BD7,  0x8FB094B8), BN_DEF(0x28ADF3F6,  0x119DD0C3),
-    BN_DEF(0xD04861D1,  0xCCD94B27), BN_DEF(0xA735E02E,  0x143E2CA3),
-    BN_DEF(0x0FDF6553,  0x97477E0A), BN_DEF(0x826F477C,  0x6DDDE16D),
-    BN_DEF(0x156A2674,  0x12C1F4E5), BN_DEF(0x5B0A85ED,  0x0D4A341A),
-    BN_DEF(0x357A711E,  0x4CE1938C), BN_DEF(0x5EDD2D93,  0xC438CD08),
-    BN_DEF(0x53C3F36B,  0x8D391E09), BN_DEF(0x54908400,  0x25C16890),
-    BN_DEF(0x707E8847,  0xA1EDADFE), BN_DEF(0x3A72D598,  0x047127D0),
-    BN_DEF(0x5D6CA371,  0x3B84C460), BN_DEF(0xBD30AEB6,  0x5DF08BAB),
-    BN_DEF(0x0BBD9006,  0x290F958C), BN_DEF(0x9F643532,  0x6C3B0139),
-    BN_DEF(0x6CC50432,  0xF897FD03), BN_DEF(0x0D697735,  0xE771E913),
-    BN_DEF(0x2512B0CE,  0x8F464A70), BN_DEF(0x6D8499EB,  0xD5FAD746),
-    BN_DEF(0xD370F263,  0xD9CB87C2), BN_DEF(0xAE83063E,  0x457538AB),
-    BN_DEF(0x2C6DF785,  0x767DC282), BN_DEF(0xEF8E5D32,  0xD42A90D5),
-    BN_DEF(0x82283D19,  0xD6998B86), BN_DEF(0x45556216,  0x0AB9472D),
-    BN_DEF(0x4C7D0288,  0x8AE9130C), BN_DEF(0x754AB572,  0x1CCAA4BE),
-    BN_DEF(0x4AAC0B8C,  0xEF15E5FB), BN_DEF(0x37A62964,  0xDAE2AEF8),
-    BN_DEF(0x7603D147,  0xCD93C1D1), BN_DEF(0x0C074301,  0xF1CF3B96),
-    BN_DEF(0x171B671D,  0x19482F23), BN_DEF(0x650C10BE,  0x78BA3604),
-    BN_DEF(0x255E4C02,  0xB3861AA7), BN_DEF(0xB84B4B36,  0xCF6A9483),
-    BN_DEF(0x1042A95D,  0x0E3179AB), BN_DEF(0xEE51D6CB,  0xC1B2AE91),
-    BN_DEF(0x7E9267AF,  0x348B1FD4), BN_DEF(0x0E2AE9CD,  0xCC6D241B),
-    BN_DEF(0x50B1DF82,  0xE1003E5C), BN_DEF(0xF6722D9E,  0x24943328),
-    BN_DEF(0xBE258FF3,  0xD74F9208), BN_DEF(0xAD44CFD2,  0xF71C35FD),
-    BN_DEF(0x7A035BF6,  0x85FFAE5B), BN_DEF(0xD31BF6B5,  0x7A262174),
-    BN_DEF(0x312F3F63,  0xF242DABB), BN_DEF(0xB6A8E122,  0xA7F09AB6),
-    BN_DEF(0xF92F8A1B,  0x98158536), BN_DEF(0xE69D218D,  0xF7CA8CD9),
-    BN_DEF(0xC71A026E,  0x28A5043C), BN_DEF(0x1D89CD91,  0x0105DF53),
-    BN_DEF(0x4533E63A,  0x94812704), BN_DEF(0xC06E0E68,  0x62633145),
-    BN_DEF(0x10B4611A,  0xE487ED51), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0xFFFFFFFF),
+    BN_DEF(0xCC76E9EF, 0xB064C06E),
+    BN_DEF(0x405CB738, 0xE40FAB74),
+    BN_DEF(0x3B2B4A6F, 0x4F182871),
+    BN_DEF(0xAB3BF4D5, 0xCAAC7223),
+    BN_DEF(0x7E013723, 0xE48C86D3),
+    BN_DEF(0x6AF71C15, 0xC44D0017),
+    BN_DEF(0xA40E366B, 0x2004A1C5),
+    BN_DEF(0x75C3CFC9, 0x1AC8237A),
+    BN_DEF(0x8F67D134, 0xFD79B5E1),
+    BN_DEF(0xBF73A6B9, 0xD8EA885E),
+    BN_DEF(0xAEF6BF50, 0xFCD5A40C),
+    BN_DEF(0x8423428E, 0xB2798E62),
+    BN_DEF(0xD012AEE0, 0x22CBF44C),
+    BN_DEF(0x3A55B51B, 0xEF988770),
+    BN_DEF(0x1FA27C16, 0x369509FC),
+    BN_DEF(0xD9D13C53, 0x03159E7A),
+    BN_DEF(0xF6ADEE9D, 0x3CB41981),
+    BN_DEF(0xD16043F4, 0xFD4EA5BF),
+    BN_DEF(0x17C1C2EE, 0xA5E5E443),
+    BN_DEF(0x36751835, 0x9A39FE32),
+    BN_DEF(0x0D11F863, 0x89F5ABD4),
+    BN_DEF(0x5201BE03, 0x91111702),
+    BN_DEF(0x7E42456C, 0xF1FEDC5F),
+    BN_DEF(0xF1CEB296, 0x11C78B65),
+    BN_DEF(0x15F8E4BC, 0x1A11DA3A),
+    BN_DEF(0x2D727AB4, 0x1D55B1CE),
+    BN_DEF(0xB5D21233, 0x92BB7B49),
+    BN_DEF(0xC57E23F6, 0x3A0FD3DF),
+    BN_DEF(0x46CEE980, 0x1DE4195B),
+    BN_DEF(0x39DC98DD, 0x6C5F6268),
+    BN_DEF(0x54996FC6, 0x1C3BBE5B),
+    BN_DEF(0x897F72F2, 0xBA51C937),
+    BN_DEF(0x36DF08AC, 0x734A7C8F),
+    BN_DEF(0x85BA3A6B, 0x095F96AD),
+    BN_DEF(0x1FA43077, 0x021F47B3),
+    BN_DEF(0xB71E0234, 0x1C3FF46B),
+    BN_DEF(0x17794B19, 0x6D2B64F6),
+    BN_DEF(0xD189EAAE, 0x758CE658),
+    BN_DEF(0xC50FDFF8, 0x7AA8551E),
+    BN_DEF(0xDBE2ED3B, 0x0350EAC5),
+    BN_DEF(0x794DF194, 0x53CB8AF7),
+    BN_DEF(0x07C01BF0, 0x0A662F69),
+    BN_DEF(0x5FA470EC, 0x6647B6BF),
+    BN_DEF(0x15A0AA55, 0xA5EA03D9),
+    BN_DEF(0xFFAC2D62, 0x078EA2DB),
+    BN_DEF(0x1B66445F, 0x91D4BD3F),
+    BN_DEF(0xDF63F479, 0x2CF3E4BF),
+    BN_DEF(0xC8058E4F, 0x5AD42018),
+    BN_DEF(0xA34C0641, 0x6AAF3817),
+    BN_DEF(0x373A7F7B, 0xFA416BE7),
+    BN_DEF(0xE8B90E81, 0x7819750A),
+    BN_DEF(0xE325C976, 0xACC1E500),
+    BN_DEF(0x9BC6695F, 0x37DC7A00),
+    BN_DEF(0x95EBD7A1, 0x999028A8),
+    BN_DEF(0xF36612A5, 0xEDBF8A23),
+    BN_DEF(0x676A5D8D, 0xA267365D),
+    BN_DEF(0xE7CD8A76, 0x6D1F6DF5),
+    BN_DEF(0x432D448C, 0x8BCB93D8),
+    BN_DEF(0xC813EC18, 0x583529F6),
+    BN_DEF(0xA09800D7, 0x72ED9C17),
+    BN_DEF(0x56CF2987, 0xFC7FCA03),
+    BN_DEF(0x1EDD1BDE, 0x64BA8F3B),
+    BN_DEF(0x3013236F, 0x60EA6E59),
+    BN_DEF(0x693E3813, 0x1B61FD5A),
+    BN_DEF(0x9A014249, 0xA6FA1AE4),
+    BN_DEF(0x48536047, 0xC37FDBEE),
+    BN_DEF(0x46C7EEE0, 0xC9DA754C),
+    BN_DEF(0xEAD82D54, 0x68034893),
+    BN_DEF(0x10B8240E, 0xDC0DEEBB),
+    BN_DEF(0x67716BD7, 0x8FB094B8),
+    BN_DEF(0x28ADF3F6, 0x119DD0C3),
+    BN_DEF(0xD04861D1, 0xCCD94B27),
+    BN_DEF(0xA735E02E, 0x143E2CA3),
+    BN_DEF(0x0FDF6553, 0x97477E0A),
+    BN_DEF(0x826F477C, 0x6DDDE16D),
+    BN_DEF(0x156A2674, 0x12C1F4E5),
+    BN_DEF(0x5B0A85ED, 0x0D4A341A),
+    BN_DEF(0x357A711E, 0x4CE1938C),
+    BN_DEF(0x5EDD2D93, 0xC438CD08),
+    BN_DEF(0x53C3F36B, 0x8D391E09),
+    BN_DEF(0x54908400, 0x25C16890),
+    BN_DEF(0x707E8847, 0xA1EDADFE),
+    BN_DEF(0x3A72D598, 0x047127D0),
+    BN_DEF(0x5D6CA371, 0x3B84C460),
+    BN_DEF(0xBD30AEB6, 0x5DF08BAB),
+    BN_DEF(0x0BBD9006, 0x290F958C),
+    BN_DEF(0x9F643532, 0x6C3B0139),
+    BN_DEF(0x6CC50432, 0xF897FD03),
+    BN_DEF(0x0D697735, 0xE771E913),
+    BN_DEF(0x2512B0CE, 0x8F464A70),
+    BN_DEF(0x6D8499EB, 0xD5FAD746),
+    BN_DEF(0xD370F263, 0xD9CB87C2),
+    BN_DEF(0xAE83063E, 0x457538AB),
+    BN_DEF(0x2C6DF785, 0x767DC282),
+    BN_DEF(0xEF8E5D32, 0xD42A90D5),
+    BN_DEF(0x82283D19, 0xD6998B86),
+    BN_DEF(0x45556216, 0x0AB9472D),
+    BN_DEF(0x4C7D0288, 0x8AE9130C),
+    BN_DEF(0x754AB572, 0x1CCAA4BE),
+    BN_DEF(0x4AAC0B8C, 0xEF15E5FB),
+    BN_DEF(0x37A62964, 0xDAE2AEF8),
+    BN_DEF(0x7603D147, 0xCD93C1D1),
+    BN_DEF(0x0C074301, 0xF1CF3B96),
+    BN_DEF(0x171B671D, 0x19482F23),
+    BN_DEF(0x650C10BE, 0x78BA3604),
+    BN_DEF(0x255E4C02, 0xB3861AA7),
+    BN_DEF(0xB84B4B36, 0xCF6A9483),
+    BN_DEF(0x1042A95D, 0x0E3179AB),
+    BN_DEF(0xEE51D6CB, 0xC1B2AE91),
+    BN_DEF(0x7E9267AF, 0x348B1FD4),
+    BN_DEF(0x0E2AE9CD, 0xCC6D241B),
+    BN_DEF(0x50B1DF82, 0xE1003E5C),
+    BN_DEF(0xF6722D9E, 0x24943328),
+    BN_DEF(0xBE258FF3, 0xD74F9208),
+    BN_DEF(0xAD44CFD2, 0xF71C35FD),
+    BN_DEF(0x7A035BF6, 0x85FFAE5B),
+    BN_DEF(0xD31BF6B5, 0x7A262174),
+    BN_DEF(0x312F3F63, 0xF242DABB),
+    BN_DEF(0xB6A8E122, 0xA7F09AB6),
+    BN_DEF(0xF92F8A1B, 0x98158536),
+    BN_DEF(0xE69D218D, 0xF7CA8CD9),
+    BN_DEF(0xC71A026E, 0x28A5043C),
+    BN_DEF(0x1D89CD91, 0x0105DF53),
+    BN_DEF(0x4533E63A, 0x94812704),
+    BN_DEF(0xC06E0E68, 0x62633145),
+    BN_DEF(0x10B4611A, 0xE487ED51),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 /* DH parameters from RFC5114 */
@@ -623,22 +807,38 @@ static const BN_ULONG ffdhe2048_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG ffdhe2048_q[] = {
-    BN_DEF(0xFFFFFFFF,  0xFFFFFFFF), BN_DEF(0x30942E4B,  0x4435A11C),
-    BN_DEF(0x60D977FD,  0x6379A513), BN_DEF(0xBE8B41D9,  0xE2C778C1),
-    BN_DEF(0x17611002,  0x9DDAFE5E), BN_DEF(0xA637D6B9,  0xE1FF1D8D),
-    BN_DEF(0x777940C1,  0xC7278919), BN_DEF(0x74C2C1FF,  0xC8B97F4E),
-    BN_DEF(0x941A17B0,  0x601A0266), BN_DEF(0xE6FBF176,  0x4F017E70),
-    BN_DEF(0x770536B8,  0x8583D3E4), BN_DEF(0xB1B95D8C,  0x572B76F3),
-    BN_DEF(0xEF1CA6FA,  0x0EA7A151), BN_DEF(0xB06BFA34,  0xDCB56D5B),
-    BN_DEF(0xD96471FD,  0xE88454A5), BN_DEF(0x59927DB0,  0x5E0558C1),
-    BN_DEF(0xA41D3CBD,  0x98566527), BN_DEF(0x9B56F39A,  0x0EF8AC50),
-    BN_DEF(0x79F7F439,  0xF15344ED), BN_DEF(0x707345BB,  0xCC278638),
-    BN_DEF(0x3FABE49A,  0xDAAB89AF), BN_DEF(0x9EF68D79,  0x42B1B2AA),
-    BN_DEF(0xAF833768,  0x9219FA8F), BN_DEF(0xEAFEB2B0,  0x69EF8F6A),
-    BN_DEF(0x576230BD,  0x7B40D901), BN_DEF(0xB1863AEC,  0xBE97F1B1),
-    BN_DEF(0x124D9F7C,  0xE649CEE7), BN_DEF(0x8A3219FD,  0xD4F09B20),
-    BN_DEF(0xE7169B4A,  0xEC5CE2C1), BN_DEF(0x139E9E78,  0x57EE2B10),
-    BN_DEF(0x515DA54D,  0xD6FC2A2C), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0xFFFFFFFF),
+    BN_DEF(0x30942E4B, 0x4435A11C),
+    BN_DEF(0x60D977FD, 0x6379A513),
+    BN_DEF(0xBE8B41D9, 0xE2C778C1),
+    BN_DEF(0x17611002, 0x9DDAFE5E),
+    BN_DEF(0xA637D6B9, 0xE1FF1D8D),
+    BN_DEF(0x777940C1, 0xC7278919),
+    BN_DEF(0x74C2C1FF, 0xC8B97F4E),
+    BN_DEF(0x941A17B0, 0x601A0266),
+    BN_DEF(0xE6FBF176, 0x4F017E70),
+    BN_DEF(0x770536B8, 0x8583D3E4),
+    BN_DEF(0xB1B95D8C, 0x572B76F3),
+    BN_DEF(0xEF1CA6FA, 0x0EA7A151),
+    BN_DEF(0xB06BFA34, 0xDCB56D5B),
+    BN_DEF(0xD96471FD, 0xE88454A5),
+    BN_DEF(0x59927DB0, 0x5E0558C1),
+    BN_DEF(0xA41D3CBD, 0x98566527),
+    BN_DEF(0x9B56F39A, 0x0EF8AC50),
+    BN_DEF(0x79F7F439, 0xF15344ED),
+    BN_DEF(0x707345BB, 0xCC278638),
+    BN_DEF(0x3FABE49A, 0xDAAB89AF),
+    BN_DEF(0x9EF68D79, 0x42B1B2AA),
+    BN_DEF(0xAF833768, 0x9219FA8F),
+    BN_DEF(0xEAFEB2B0, 0x69EF8F6A),
+    BN_DEF(0x576230BD, 0x7B40D901),
+    BN_DEF(0xB1863AEC, 0xBE97F1B1),
+    BN_DEF(0x124D9F7C, 0xE649CEE7),
+    BN_DEF(0x8A3219FD, 0xD4F09B20),
+    BN_DEF(0xE7169B4A, 0xEC5CE2C1),
+    BN_DEF(0x139E9E78, 0x57EE2B10),
+    BN_DEF(0x515DA54D, 0xD6FC2A2C),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 static const BN_ULONG ffdhe3072_p[] = {
@@ -669,30 +869,54 @@ static const BN_ULONG ffdhe3072_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG ffdhe3072_q[] = {
-    BN_DEF(0xFFFFFFFF,  0xFFFFFFFF), BN_DEF(0xB363171B,  0x12F20E95),
-    BN_DEF(0x1FEACEBE,  0x9E0D9077), BN_DEF(0xFD29EEF7,  0x055E6835),
-    BN_DEF(0x6AE22427,  0x0EDFCD21), BN_DEF(0xCD86F56D,  0xD5E290CB),
-    BN_DEF(0x911B1D06,  0x743695E2), BN_DEF(0xCE4EFB4F,  0xAE574155),
-    BN_DEF(0x38FAA5FF,  0xB279710F), BN_DEF(0x716BA6E9,  0x7A7EA229),
-    BN_DEF(0xDE21BCA2,  0x5A098649), BN_DEF(0xC289C938,  0x577F0984),
-    BN_DEF(0x60C36C8E,  0x2CC6587D), BN_DEF(0x48FBFBF7,  0xBD6C8E93),
-    BN_DEF(0xEB736483,  0x30DA37E4), BN_DEF(0x7CCE011C,  0xDE1A7A6F),
-    BN_DEF(0xB28C81AD,  0x6F1AAD9D), BN_DEF(0x308FE7EE,  0x4435A11C),
-    BN_DEF(0x60D977FD,  0x6379A513), BN_DEF(0xBE8B41D9,  0xE2C778C1),
-    BN_DEF(0x17611002,  0x9DDAFE5E), BN_DEF(0xA637D6B9,  0xE1FF1D8D),
-    BN_DEF(0x777940C1,  0xC7278919), BN_DEF(0x74C2C1FF,  0xC8B97F4E),
-    BN_DEF(0x941A17B0,  0x601A0266), BN_DEF(0xE6FBF176,  0x4F017E70),
-    BN_DEF(0x770536B8,  0x8583D3E4), BN_DEF(0xB1B95D8C,  0x572B76F3),
-    BN_DEF(0xEF1CA6FA,  0x0EA7A151), BN_DEF(0xB06BFA34,  0xDCB56D5B),
-    BN_DEF(0xD96471FD,  0xE88454A5), BN_DEF(0x59927DB0,  0x5E0558C1),
-    BN_DEF(0xA41D3CBD,  0x98566527), BN_DEF(0x9B56F39A,  0x0EF8AC50),
-    BN_DEF(0x79F7F439,  0xF15344ED), BN_DEF(0x707345BB,  0xCC278638),
-    BN_DEF(0x3FABE49A,  0xDAAB89AF), BN_DEF(0x9EF68D79,  0x42B1B2AA),
-    BN_DEF(0xAF833768,  0x9219FA8F), BN_DEF(0xEAFEB2B0,  0x69EF8F6A),
-    BN_DEF(0x576230BD,  0x7B40D901), BN_DEF(0xB1863AEC,  0xBE97F1B1),
-    BN_DEF(0x124D9F7C,  0xE649CEE7), BN_DEF(0x8A3219FD,  0xD4F09B20),
-    BN_DEF(0xE7169B4A,  0xEC5CE2C1), BN_DEF(0x139E9E78,  0x57EE2B10),
-    BN_DEF(0x515DA54D,  0xD6FC2A2C), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0xFFFFFFFF),
+    BN_DEF(0xB363171B, 0x12F20E95),
+    BN_DEF(0x1FEACEBE, 0x9E0D9077),
+    BN_DEF(0xFD29EEF7, 0x055E6835),
+    BN_DEF(0x6AE22427, 0x0EDFCD21),
+    BN_DEF(0xCD86F56D, 0xD5E290CB),
+    BN_DEF(0x911B1D06, 0x743695E2),
+    BN_DEF(0xCE4EFB4F, 0xAE574155),
+    BN_DEF(0x38FAA5FF, 0xB279710F),
+    BN_DEF(0x716BA6E9, 0x7A7EA229),
+    BN_DEF(0xDE21BCA2, 0x5A098649),
+    BN_DEF(0xC289C938, 0x577F0984),
+    BN_DEF(0x60C36C8E, 0x2CC6587D),
+    BN_DEF(0x48FBFBF7, 0xBD6C8E93),
+    BN_DEF(0xEB736483, 0x30DA37E4),
+    BN_DEF(0x7CCE011C, 0xDE1A7A6F),
+    BN_DEF(0xB28C81AD, 0x6F1AAD9D),
+    BN_DEF(0x308FE7EE, 0x4435A11C),
+    BN_DEF(0x60D977FD, 0x6379A513),
+    BN_DEF(0xBE8B41D9, 0xE2C778C1),
+    BN_DEF(0x17611002, 0x9DDAFE5E),
+    BN_DEF(0xA637D6B9, 0xE1FF1D8D),
+    BN_DEF(0x777940C1, 0xC7278919),
+    BN_DEF(0x74C2C1FF, 0xC8B97F4E),
+    BN_DEF(0x941A17B0, 0x601A0266),
+    BN_DEF(0xE6FBF176, 0x4F017E70),
+    BN_DEF(0x770536B8, 0x8583D3E4),
+    BN_DEF(0xB1B95D8C, 0x572B76F3),
+    BN_DEF(0xEF1CA6FA, 0x0EA7A151),
+    BN_DEF(0xB06BFA34, 0xDCB56D5B),
+    BN_DEF(0xD96471FD, 0xE88454A5),
+    BN_DEF(0x59927DB0, 0x5E0558C1),
+    BN_DEF(0xA41D3CBD, 0x98566527),
+    BN_DEF(0x9B56F39A, 0x0EF8AC50),
+    BN_DEF(0x79F7F439, 0xF15344ED),
+    BN_DEF(0x707345BB, 0xCC278638),
+    BN_DEF(0x3FABE49A, 0xDAAB89AF),
+    BN_DEF(0x9EF68D79, 0x42B1B2AA),
+    BN_DEF(0xAF833768, 0x9219FA8F),
+    BN_DEF(0xEAFEB2B0, 0x69EF8F6A),
+    BN_DEF(0x576230BD, 0x7B40D901),
+    BN_DEF(0xB1863AEC, 0xBE97F1B1),
+    BN_DEF(0x124D9F7C, 0xE649CEE7),
+    BN_DEF(0x8A3219FD, 0xD4F09B20),
+    BN_DEF(0xE7169B4A, 0xEC5CE2C1),
+    BN_DEF(0x139E9E78, 0x57EE2B10),
+    BN_DEF(0x515DA54D, 0xD6FC2A2C),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 static const BN_ULONG ffdhe4096_p[] = {
@@ -731,38 +955,70 @@ static const BN_ULONG ffdhe4096_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG ffdhe4096_q[] = {
-    BN_DEF(0xFFFFFFFF,  0x7FFFFFFF), BN_DEF(0x2F32AFB5,  0xE345003F),
-    BN_DEF(0xFA20C170,  0xA6DAD428), BN_DEF(0x3FC45235,  0xC764DAAD),
-    BN_DEF(0xE764BEE7,  0x054148E6), BN_DEF(0xFCC68566,  0x15276754),
-    BN_DEF(0xB8A0001E,  0x0D0EDC9E), BN_DEF(0x99E5C5BD,  0x0494CCD1),
-    BN_DEF(0xB8D6801C,  0x36E3BC7C), BN_DEF(0x48C09862,  0x5483B005),
-    BN_DEF(0x96CF3419,  0x76B50F00), BN_DEF(0x77DA18C5,  0x389AE443),
-    BN_DEF(0xBF18E63D,  0x43FAADD2), BN_DEF(0xAA81A002,  0x3BB1E78E),
-    BN_DEF(0x6B4FB68C,  0x563EAFA1), BN_DEF(0x72C42BDB,  0xBC9874F2),
-    BN_DEF(0x8B26FA7D,  0xB737A961), BN_DEF(0xB34F0F78,  0x12F20E95),
-    BN_DEF(0x1FEACEBE,  0x9E0D9077), BN_DEF(0xFD29EEF7,  0x055E6835),
-    BN_DEF(0x6AE22427,  0x0EDFCD21), BN_DEF(0xCD86F56D,  0xD5E290CB),
-    BN_DEF(0x911B1D06,  0x743695E2), BN_DEF(0xCE4EFB4F,  0xAE574155),
-    BN_DEF(0x38FAA5FF,  0xB279710F), BN_DEF(0x716BA6E9,  0x7A7EA229),
-    BN_DEF(0xDE21BCA2,  0x5A098649), BN_DEF(0xC289C938,  0x577F0984),
-    BN_DEF(0x60C36C8E,  0x2CC6587D), BN_DEF(0x48FBFBF7,  0xBD6C8E93),
-    BN_DEF(0xEB736483,  0x30DA37E4), BN_DEF(0x7CCE011C,  0xDE1A7A6F),
-    BN_DEF(0xB28C81AD,  0x6F1AAD9D), BN_DEF(0x308FE7EE,  0x4435A11C),
-    BN_DEF(0x60D977FD,  0x6379A513), BN_DEF(0xBE8B41D9,  0xE2C778C1),
-    BN_DEF(0x17611002,  0x9DDAFE5E), BN_DEF(0xA637D6B9,  0xE1FF1D8D),
-    BN_DEF(0x777940C1,  0xC7278919), BN_DEF(0x74C2C1FF,  0xC8B97F4E),
-    BN_DEF(0x941A17B0,  0x601A0266), BN_DEF(0xE6FBF176,  0x4F017E70),
-    BN_DEF(0x770536B8,  0x8583D3E4), BN_DEF(0xB1B95D8C,  0x572B76F3),
-    BN_DEF(0xEF1CA6FA,  0x0EA7A151), BN_DEF(0xB06BFA34,  0xDCB56D5B),
-    BN_DEF(0xD96471FD,  0xE88454A5), BN_DEF(0x59927DB0,  0x5E0558C1),
-    BN_DEF(0xA41D3CBD,  0x98566527), BN_DEF(0x9B56F39A,  0x0EF8AC50),
-    BN_DEF(0x79F7F439,  0xF15344ED), BN_DEF(0x707345BB,  0xCC278638),
-    BN_DEF(0x3FABE49A,  0xDAAB89AF), BN_DEF(0x9EF68D79,  0x42B1B2AA),
-    BN_DEF(0xAF833768,  0x9219FA8F), BN_DEF(0xEAFEB2B0,  0x69EF8F6A),
-    BN_DEF(0x576230BD,  0x7B40D901), BN_DEF(0xB1863AEC,  0xBE97F1B1),
-    BN_DEF(0x124D9F7C,  0xE649CEE7), BN_DEF(0x8A3219FD,  0xD4F09B20),
-    BN_DEF(0xE7169B4A,  0xEC5CE2C1), BN_DEF(0x139E9E78,  0x57EE2B10),
-    BN_DEF(0x515DA54D,  0xD6FC2A2C), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
+    BN_DEF(0x2F32AFB5, 0xE345003F),
+    BN_DEF(0xFA20C170, 0xA6DAD428),
+    BN_DEF(0x3FC45235, 0xC764DAAD),
+    BN_DEF(0xE764BEE7, 0x054148E6),
+    BN_DEF(0xFCC68566, 0x15276754),
+    BN_DEF(0xB8A0001E, 0x0D0EDC9E),
+    BN_DEF(0x99E5C5BD, 0x0494CCD1),
+    BN_DEF(0xB8D6801C, 0x36E3BC7C),
+    BN_DEF(0x48C09862, 0x5483B005),
+    BN_DEF(0x96CF3419, 0x76B50F00),
+    BN_DEF(0x77DA18C5, 0x389AE443),
+    BN_DEF(0xBF18E63D, 0x43FAADD2),
+    BN_DEF(0xAA81A002, 0x3BB1E78E),
+    BN_DEF(0x6B4FB68C, 0x563EAFA1),
+    BN_DEF(0x72C42BDB, 0xBC9874F2),
+    BN_DEF(0x8B26FA7D, 0xB737A961),
+    BN_DEF(0xB34F0F78, 0x12F20E95),
+    BN_DEF(0x1FEACEBE, 0x9E0D9077),
+    BN_DEF(0xFD29EEF7, 0x055E6835),
+    BN_DEF(0x6AE22427, 0x0EDFCD21),
+    BN_DEF(0xCD86F56D, 0xD5E290CB),
+    BN_DEF(0x911B1D06, 0x743695E2),
+    BN_DEF(0xCE4EFB4F, 0xAE574155),
+    BN_DEF(0x38FAA5FF, 0xB279710F),
+    BN_DEF(0x716BA6E9, 0x7A7EA229),
+    BN_DEF(0xDE21BCA2, 0x5A098649),
+    BN_DEF(0xC289C938, 0x577F0984),
+    BN_DEF(0x60C36C8E, 0x2CC6587D),
+    BN_DEF(0x48FBFBF7, 0xBD6C8E93),
+    BN_DEF(0xEB736483, 0x30DA37E4),
+    BN_DEF(0x7CCE011C, 0xDE1A7A6F),
+    BN_DEF(0xB28C81AD, 0x6F1AAD9D),
+    BN_DEF(0x308FE7EE, 0x4435A11C),
+    BN_DEF(0x60D977FD, 0x6379A513),
+    BN_DEF(0xBE8B41D9, 0xE2C778C1),
+    BN_DEF(0x17611002, 0x9DDAFE5E),
+    BN_DEF(0xA637D6B9, 0xE1FF1D8D),
+    BN_DEF(0x777940C1, 0xC7278919),
+    BN_DEF(0x74C2C1FF, 0xC8B97F4E),
+    BN_DEF(0x941A17B0, 0x601A0266),
+    BN_DEF(0xE6FBF176, 0x4F017E70),
+    BN_DEF(0x770536B8, 0x8583D3E4),
+    BN_DEF(0xB1B95D8C, 0x572B76F3),
+    BN_DEF(0xEF1CA6FA, 0x0EA7A151),
+    BN_DEF(0xB06BFA34, 0xDCB56D5B),
+    BN_DEF(0xD96471FD, 0xE88454A5),
+    BN_DEF(0x59927DB0, 0x5E0558C1),
+    BN_DEF(0xA41D3CBD, 0x98566527),
+    BN_DEF(0x9B56F39A, 0x0EF8AC50),
+    BN_DEF(0x79F7F439, 0xF15344ED),
+    BN_DEF(0x707345BB, 0xCC278638),
+    BN_DEF(0x3FABE49A, 0xDAAB89AF),
+    BN_DEF(0x9EF68D79, 0x42B1B2AA),
+    BN_DEF(0xAF833768, 0x9219FA8F),
+    BN_DEF(0xEAFEB2B0, 0x69EF8F6A),
+    BN_DEF(0x576230BD, 0x7B40D901),
+    BN_DEF(0xB1863AEC, 0xBE97F1B1),
+    BN_DEF(0x124D9F7C, 0xE649CEE7),
+    BN_DEF(0x8A3219FD, 0xD4F09B20),
+    BN_DEF(0xE7169B4A, 0xEC5CE2C1),
+    BN_DEF(0x139E9E78, 0x57EE2B10),
+    BN_DEF(0x515DA54D, 0xD6FC2A2C),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 static const BN_ULONG ffdhe6144_p[] = {
@@ -817,54 +1073,102 @@ static const BN_ULONG ffdhe6144_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG ffdhe6144_q[] = {
-    BN_DEF(0xFFFFFFFF,  0xFFFFFFFF), BN_DEF(0x68720732,  0x5207194E),
-    BN_DEF(0xBC9C6D6A,  0xD20EAB86), BN_DEF(0x6A18B0E0,  0xB1534A93),
-    BN_DEF(0x4D6D8F34,  0x1FEEA547), BN_DEF(0xEE35C06B,  0x2D9DB8FC),
-    BN_DEF(0x63139582,  0xF64E8C08), BN_DEF(0xE5677A01,  0xC66796EA),
-    BN_DEF(0xE4ADC88B,  0x724FA91A), BN_DEF(0xDC2A19C5,  0x282EE416),
-    BN_DEF(0x8AB15423,  0x31149618), BN_DEF(0x3573BFAF,  0x6B9581BA),
-    BN_DEF(0xA316A9C6,  0x7CE4848D), BN_DEF(0x23D33E5F,  0x05746DAC),
-    BN_DEF(0x91308B41,  0x59D39CE0), BN_DEF(0x95140DFB,  0x77556011),
-    BN_DEF(0x3BE57CC9,  0xCA63328F), BN_DEF(0xCA595DE0,  0x3B1F2725),
-    BN_DEF(0x003BECDA,  0xAC3F1C6D), BN_DEF(0x0C1811E1,  0x3FD94FC6),
-    BN_DEF(0xFCF1D137,  0x855F60FF), BN_DEF(0x1A8288F1,  0x50077849),
-    BN_DEF(0x6DB1A06C,  0x5C2A9917), BN_DEF(0xD4D4B488,  0xD29238FB),
-    BN_DEF(0xA67EDA3B,  0x9C40A3FD), BN_DEF(0x2723020F,  0xCD8FAE1F),
-    BN_DEF(0xFE67F638,  0x66D6832B), BN_DEF(0xA6380E1D,  0x59C74619),
-    BN_DEF(0x58E07EA6,  0x48BDEEB2), BN_DEF(0x4DBB1264,  0x1DDA2A19),
-    BN_DEF(0x657A9F53,  0x11DD2221), BN_DEF(0x1C29951D,  0x2733BE96),
-    BN_DEF(0x2281B63D,  0x05FEB25B), BN_DEF(0x2F06EC81,  0xE345003F),
-    BN_DEF(0xFA20C170,  0xA6DAD428), BN_DEF(0x3FC45235,  0xC764DAAD),
-    BN_DEF(0xE764BEE7,  0x054148E6), BN_DEF(0xFCC68566,  0x15276754),
-    BN_DEF(0xB8A0001E,  0x0D0EDC9E), BN_DEF(0x99E5C5BD,  0x0494CCD1),
-    BN_DEF(0xB8D6801C,  0x36E3BC7C), BN_DEF(0x48C09862,  0x5483B005),
-    BN_DEF(0x96CF3419,  0x76B50F00), BN_DEF(0x77DA18C5,  0x389AE443),
-    BN_DEF(0xBF18E63D,  0x43FAADD2), BN_DEF(0xAA81A002,  0x3BB1E78E),
-    BN_DEF(0x6B4FB68C,  0x563EAFA1), BN_DEF(0x72C42BDB,  0xBC9874F2),
-    BN_DEF(0x8B26FA7D,  0xB737A961), BN_DEF(0xB34F0F78,  0x12F20E95),
-    BN_DEF(0x1FEACEBE,  0x9E0D9077), BN_DEF(0xFD29EEF7,  0x055E6835),
-    BN_DEF(0x6AE22427,  0x0EDFCD21), BN_DEF(0xCD86F56D,  0xD5E290CB),
-    BN_DEF(0x911B1D06,  0x743695E2), BN_DEF(0xCE4EFB4F,  0xAE574155),
-    BN_DEF(0x38FAA5FF,  0xB279710F), BN_DEF(0x716BA6E9,  0x7A7EA229),
-    BN_DEF(0xDE21BCA2,  0x5A098649), BN_DEF(0xC289C938,  0x577F0984),
-    BN_DEF(0x60C36C8E,  0x2CC6587D), BN_DEF(0x48FBFBF7,  0xBD6C8E93),
-    BN_DEF(0xEB736483,  0x30DA37E4), BN_DEF(0x7CCE011C,  0xDE1A7A6F),
-    BN_DEF(0xB28C81AD,  0x6F1AAD9D), BN_DEF(0x308FE7EE,  0x4435A11C),
-    BN_DEF(0x60D977FD,  0x6379A513), BN_DEF(0xBE8B41D9,  0xE2C778C1),
-    BN_DEF(0x17611002,  0x9DDAFE5E), BN_DEF(0xA637D6B9,  0xE1FF1D8D),
-    BN_DEF(0x777940C1,  0xC7278919), BN_DEF(0x74C2C1FF,  0xC8B97F4E),
-    BN_DEF(0x941A17B0,  0x601A0266), BN_DEF(0xE6FBF176,  0x4F017E70),
-    BN_DEF(0x770536B8,  0x8583D3E4), BN_DEF(0xB1B95D8C,  0x572B76F3),
-    BN_DEF(0xEF1CA6FA,  0x0EA7A151), BN_DEF(0xB06BFA34,  0xDCB56D5B),
-    BN_DEF(0xD96471FD,  0xE88454A5), BN_DEF(0x59927DB0,  0x5E0558C1),
-    BN_DEF(0xA41D3CBD,  0x98566527), BN_DEF(0x9B56F39A,  0x0EF8AC50),
-    BN_DEF(0x79F7F439,  0xF15344ED), BN_DEF(0x707345BB,  0xCC278638),
-    BN_DEF(0x3FABE49A,  0xDAAB89AF), BN_DEF(0x9EF68D79,  0x42B1B2AA),
-    BN_DEF(0xAF833768,  0x9219FA8F), BN_DEF(0xEAFEB2B0,  0x69EF8F6A),
-    BN_DEF(0x576230BD,  0x7B40D901), BN_DEF(0xB1863AEC,  0xBE97F1B1),
-    BN_DEF(0x124D9F7C,  0xE649CEE7), BN_DEF(0x8A3219FD,  0xD4F09B20),
-    BN_DEF(0xE7169B4A,  0xEC5CE2C1), BN_DEF(0x139E9E78,  0x57EE2B10),
-    BN_DEF(0x515DA54D,  0xD6FC2A2C), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0xFFFFFFFF),
+    BN_DEF(0x68720732, 0x5207194E),
+    BN_DEF(0xBC9C6D6A, 0xD20EAB86),
+    BN_DEF(0x6A18B0E0, 0xB1534A93),
+    BN_DEF(0x4D6D8F34, 0x1FEEA547),
+    BN_DEF(0xEE35C06B, 0x2D9DB8FC),
+    BN_DEF(0x63139582, 0xF64E8C08),
+    BN_DEF(0xE5677A01, 0xC66796EA),
+    BN_DEF(0xE4ADC88B, 0x724FA91A),
+    BN_DEF(0xDC2A19C5, 0x282EE416),
+    BN_DEF(0x8AB15423, 0x31149618),
+    BN_DEF(0x3573BFAF, 0x6B9581BA),
+    BN_DEF(0xA316A9C6, 0x7CE4848D),
+    BN_DEF(0x23D33E5F, 0x05746DAC),
+    BN_DEF(0x91308B41, 0x59D39CE0),
+    BN_DEF(0x95140DFB, 0x77556011),
+    BN_DEF(0x3BE57CC9, 0xCA63328F),
+    BN_DEF(0xCA595DE0, 0x3B1F2725),
+    BN_DEF(0x003BECDA, 0xAC3F1C6D),
+    BN_DEF(0x0C1811E1, 0x3FD94FC6),
+    BN_DEF(0xFCF1D137, 0x855F60FF),
+    BN_DEF(0x1A8288F1, 0x50077849),
+    BN_DEF(0x6DB1A06C, 0x5C2A9917),
+    BN_DEF(0xD4D4B488, 0xD29238FB),
+    BN_DEF(0xA67EDA3B, 0x9C40A3FD),
+    BN_DEF(0x2723020F, 0xCD8FAE1F),
+    BN_DEF(0xFE67F638, 0x66D6832B),
+    BN_DEF(0xA6380E1D, 0x59C74619),
+    BN_DEF(0x58E07EA6, 0x48BDEEB2),
+    BN_DEF(0x4DBB1264, 0x1DDA2A19),
+    BN_DEF(0x657A9F53, 0x11DD2221),
+    BN_DEF(0x1C29951D, 0x2733BE96),
+    BN_DEF(0x2281B63D, 0x05FEB25B),
+    BN_DEF(0x2F06EC81, 0xE345003F),
+    BN_DEF(0xFA20C170, 0xA6DAD428),
+    BN_DEF(0x3FC45235, 0xC764DAAD),
+    BN_DEF(0xE764BEE7, 0x054148E6),
+    BN_DEF(0xFCC68566, 0x15276754),
+    BN_DEF(0xB8A0001E, 0x0D0EDC9E),
+    BN_DEF(0x99E5C5BD, 0x0494CCD1),
+    BN_DEF(0xB8D6801C, 0x36E3BC7C),
+    BN_DEF(0x48C09862, 0x5483B005),
+    BN_DEF(0x96CF3419, 0x76B50F00),
+    BN_DEF(0x77DA18C5, 0x389AE443),
+    BN_DEF(0xBF18E63D, 0x43FAADD2),
+    BN_DEF(0xAA81A002, 0x3BB1E78E),
+    BN_DEF(0x6B4FB68C, 0x563EAFA1),
+    BN_DEF(0x72C42BDB, 0xBC9874F2),
+    BN_DEF(0x8B26FA7D, 0xB737A961),
+    BN_DEF(0xB34F0F78, 0x12F20E95),
+    BN_DEF(0x1FEACEBE, 0x9E0D9077),
+    BN_DEF(0xFD29EEF7, 0x055E6835),
+    BN_DEF(0x6AE22427, 0x0EDFCD21),
+    BN_DEF(0xCD86F56D, 0xD5E290CB),
+    BN_DEF(0x911B1D06, 0x743695E2),
+    BN_DEF(0xCE4EFB4F, 0xAE574155),
+    BN_DEF(0x38FAA5FF, 0xB279710F),
+    BN_DEF(0x716BA6E9, 0x7A7EA229),
+    BN_DEF(0xDE21BCA2, 0x5A098649),
+    BN_DEF(0xC289C938, 0x577F0984),
+    BN_DEF(0x60C36C8E, 0x2CC6587D),
+    BN_DEF(0x48FBFBF7, 0xBD6C8E93),
+    BN_DEF(0xEB736483, 0x30DA37E4),
+    BN_DEF(0x7CCE011C, 0xDE1A7A6F),
+    BN_DEF(0xB28C81AD, 0x6F1AAD9D),
+    BN_DEF(0x308FE7EE, 0x4435A11C),
+    BN_DEF(0x60D977FD, 0x6379A513),
+    BN_DEF(0xBE8B41D9, 0xE2C778C1),
+    BN_DEF(0x17611002, 0x9DDAFE5E),
+    BN_DEF(0xA637D6B9, 0xE1FF1D8D),
+    BN_DEF(0x777940C1, 0xC7278919),
+    BN_DEF(0x74C2C1FF, 0xC8B97F4E),
+    BN_DEF(0x941A17B0, 0x601A0266),
+    BN_DEF(0xE6FBF176, 0x4F017E70),
+    BN_DEF(0x770536B8, 0x8583D3E4),
+    BN_DEF(0xB1B95D8C, 0x572B76F3),
+    BN_DEF(0xEF1CA6FA, 0x0EA7A151),
+    BN_DEF(0xB06BFA34, 0xDCB56D5B),
+    BN_DEF(0xD96471FD, 0xE88454A5),
+    BN_DEF(0x59927DB0, 0x5E0558C1),
+    BN_DEF(0xA41D3CBD, 0x98566527),
+    BN_DEF(0x9B56F39A, 0x0EF8AC50),
+    BN_DEF(0x79F7F439, 0xF15344ED),
+    BN_DEF(0x707345BB, 0xCC278638),
+    BN_DEF(0x3FABE49A, 0xDAAB89AF),
+    BN_DEF(0x9EF68D79, 0x42B1B2AA),
+    BN_DEF(0xAF833768, 0x9219FA8F),
+    BN_DEF(0xEAFEB2B0, 0x69EF8F6A),
+    BN_DEF(0x576230BD, 0x7B40D901),
+    BN_DEF(0xB1863AEC, 0xBE97F1B1),
+    BN_DEF(0x124D9F7C, 0xE649CEE7),
+    BN_DEF(0x8A3219FD, 0xD4F09B20),
+    BN_DEF(0xE7169B4A, 0xEC5CE2C1),
+    BN_DEF(0x139E9E78, 0x57EE2B10),
+    BN_DEF(0x515DA54D, 0xD6FC2A2C),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 static const BN_ULONG ffdhe8192_p[] = {
@@ -935,81 +1239,146 @@ static const BN_ULONG ffdhe8192_p[] = {
 };
 /* q = (p - 1) / 2 */
 static const BN_ULONG ffdhe8192_q[] = {
-    BN_DEF(0xFFFFFFFF,  0x7FFFFFFF), BN_DEF(0xE2E32126,  0x6B4645DB),
-    BN_DEF(0x41C7FC46,  0x008F154A), BN_DEF(0x54FA30A7,  0x84117283),
-    BN_DEF(0xFBD4221E,  0xCBE88EA4), BN_DEF(0x9833BF86,  0x535DFEF2),
-    BN_DEF(0x60FF437F,  0x17BA0F7C), BN_DEF(0x2EB8D43F,  0x7D7D5F0E),
-    BN_DEF(0xFDF2C518,  0x6F697DD5), BN_DEF(0x39585337,  0x5B42AEFF),
-    BN_DEF(0x5D4527F4,  0x8F7E4670), BN_DEF(0x1F97D22B,  0xC1FC0EA5),
-    BN_DEF(0xD2BBF118,  0x50FF183A), BN_DEF(0x446CE050,  0xEADC00CA),
-    BN_DEF(0xD6CD4AFC,  0xB1240B66), BN_DEF(0x286090BD,  0x4CF4F18B),
-    BN_DEF(0x07211E7E,  0x28D5348F), BN_DEF(0x1C137296,  0x0E10BF36),
-    BN_DEF(0x84B81FF7,  0x28D45498), BN_DEF(0xB523073A,  0x5DB84CC3),
-    BN_DEF(0x4E435811,  0xAA0FE346), BN_DEF(0x237EC128,  0x2C8B0660),
-    BN_DEF(0x1AE1AFAE,  0x1423605D), BN_DEF(0xC5BAC141,  0x2A282563),
-    BN_DEF(0xE95782F2,  0x149C441C), BN_DEF(0x600DEB81,  0xE596078E),
-    BN_DEF(0x3E499332,  0xAAAD97BA), BN_DEF(0x51D5C414,  0xC35B18A1),
-    BN_DEF(0xFB258877,  0x05C661DE), BN_DEF(0xF6E8E62F,  0xB43FF5B4),
-    BN_DEF(0x64A84EA1,  0x7ED91FE7), BN_DEF(0xECA8D732,  0x0F212D18),
-    BN_DEF(0x7B00641C,  0x1B568026), BN_DEF(0x67FA3555,  0x5207194E),
-    BN_DEF(0xBC9C6D6A,  0xD20EAB86), BN_DEF(0x6A18B0E0,  0xB1534A93),
-    BN_DEF(0x4D6D8F34,  0x1FEEA547), BN_DEF(0xEE35C06B,  0x2D9DB8FC),
-    BN_DEF(0x63139582,  0xF64E8C08), BN_DEF(0xE5677A01,  0xC66796EA),
-    BN_DEF(0xE4ADC88B,  0x724FA91A), BN_DEF(0xDC2A19C5,  0x282EE416),
-    BN_DEF(0x8AB15423,  0x31149618), BN_DEF(0x3573BFAF,  0x6B9581BA),
-    BN_DEF(0xA316A9C6,  0x7CE4848D), BN_DEF(0x23D33E5F,  0x05746DAC),
-    BN_DEF(0x91308B41,  0x59D39CE0), BN_DEF(0x95140DFB,  0x77556011),
-    BN_DEF(0x3BE57CC9,  0xCA63328F), BN_DEF(0xCA595DE0,  0x3B1F2725),
-    BN_DEF(0x003BECDA,  0xAC3F1C6D), BN_DEF(0x0C1811E1,  0x3FD94FC6),
-    BN_DEF(0xFCF1D137,  0x855F60FF), BN_DEF(0x1A8288F1,  0x50077849),
-    BN_DEF(0x6DB1A06C,  0x5C2A9917), BN_DEF(0xD4D4B488,  0xD29238FB),
-    BN_DEF(0xA67EDA3B,  0x9C40A3FD), BN_DEF(0x2723020F,  0xCD8FAE1F),
-    BN_DEF(0xFE67F638,  0x66D6832B), BN_DEF(0xA6380E1D,  0x59C74619),
-    BN_DEF(0x58E07EA6,  0x48BDEEB2), BN_DEF(0x4DBB1264,  0x1DDA2A19),
-    BN_DEF(0x657A9F53,  0x11DD2221), BN_DEF(0x1C29951D,  0x2733BE96),
-    BN_DEF(0x2281B63D,  0x05FEB25B), BN_DEF(0x2F06EC81,  0xE345003F),
-    BN_DEF(0xFA20C170,  0xA6DAD428), BN_DEF(0x3FC45235,  0xC764DAAD),
-    BN_DEF(0xE764BEE7,  0x054148E6), BN_DEF(0xFCC68566,  0x15276754),
-    BN_DEF(0xB8A0001E,  0x0D0EDC9E), BN_DEF(0x99E5C5BD,  0x0494CCD1),
-    BN_DEF(0xB8D6801C,  0x36E3BC7C), BN_DEF(0x48C09862,  0x5483B005),
-    BN_DEF(0x96CF3419,  0x76B50F00), BN_DEF(0x77DA18C5,  0x389AE443),
-    BN_DEF(0xBF18E63D,  0x43FAADD2), BN_DEF(0xAA81A002,  0x3BB1E78E),
-    BN_DEF(0x6B4FB68C,  0x563EAFA1), BN_DEF(0x72C42BDB,  0xBC9874F2),
-    BN_DEF(0x8B26FA7D,  0xB737A961), BN_DEF(0xB34F0F78,  0x12F20E95),
-    BN_DEF(0x1FEACEBE,  0x9E0D9077), BN_DEF(0xFD29EEF7,  0x055E6835),
-    BN_DEF(0x6AE22427,  0x0EDFCD21), BN_DEF(0xCD86F56D,  0xD5E290CB),
-    BN_DEF(0x911B1D06,  0x743695E2), BN_DEF(0xCE4EFB4F,  0xAE574155),
-    BN_DEF(0x38FAA5FF,  0xB279710F), BN_DEF(0x716BA6E9,  0x7A7EA229),
-    BN_DEF(0xDE21BCA2,  0x5A098649), BN_DEF(0xC289C938,  0x577F0984),
-    BN_DEF(0x60C36C8E,  0x2CC6587D), BN_DEF(0x48FBFBF7,  0xBD6C8E93),
-    BN_DEF(0xEB736483,  0x30DA37E4), BN_DEF(0x7CCE011C,  0xDE1A7A6F),
-    BN_DEF(0xB28C81AD,  0x6F1AAD9D), BN_DEF(0x308FE7EE,  0x4435A11C),
-    BN_DEF(0x60D977FD,  0x6379A513), BN_DEF(0xBE8B41D9,  0xE2C778C1),
-    BN_DEF(0x17611002,  0x9DDAFE5E), BN_DEF(0xA637D6B9,  0xE1FF1D8D),
-    BN_DEF(0x777940C1,  0xC7278919), BN_DEF(0x74C2C1FF,  0xC8B97F4E),
-    BN_DEF(0x941A17B0,  0x601A0266), BN_DEF(0xE6FBF176,  0x4F017E70),
-    BN_DEF(0x770536B8,  0x8583D3E4), BN_DEF(0xB1B95D8C,  0x572B76F3),
-    BN_DEF(0xEF1CA6FA,  0x0EA7A151), BN_DEF(0xB06BFA34,  0xDCB56D5B),
-    BN_DEF(0xD96471FD,  0xE88454A5), BN_DEF(0x59927DB0,  0x5E0558C1),
-    BN_DEF(0xA41D3CBD,  0x98566527), BN_DEF(0x9B56F39A,  0x0EF8AC50),
-    BN_DEF(0x79F7F439,  0xF15344ED), BN_DEF(0x707345BB,  0xCC278638),
-    BN_DEF(0x3FABE49A,  0xDAAB89AF), BN_DEF(0x9EF68D79,  0x42B1B2AA),
-    BN_DEF(0xAF833768,  0x9219FA8F), BN_DEF(0xEAFEB2B0,  0x69EF8F6A),
-    BN_DEF(0x576230BD,  0x7B40D901), BN_DEF(0xB1863AEC,  0xBE97F1B1),
-    BN_DEF(0x124D9F7C,  0xE649CEE7), BN_DEF(0x8A3219FD,  0xD4F09B20),
-    BN_DEF(0xE7169B4A,  0xEC5CE2C1), BN_DEF(0x139E9E78,  0x57EE2B10),
-    BN_DEF(0x515DA54D,  0xD6FC2A2C), BN_DEF(0xFFFFFFFF,  0x7FFFFFFF),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
+    BN_DEF(0xE2E32126, 0x6B4645DB),
+    BN_DEF(0x41C7FC46, 0x008F154A),
+    BN_DEF(0x54FA30A7, 0x84117283),
+    BN_DEF(0xFBD4221E, 0xCBE88EA4),
+    BN_DEF(0x9833BF86, 0x535DFEF2),
+    BN_DEF(0x60FF437F, 0x17BA0F7C),
+    BN_DEF(0x2EB8D43F, 0x7D7D5F0E),
+    BN_DEF(0xFDF2C518, 0x6F697DD5),
+    BN_DEF(0x39585337, 0x5B42AEFF),
+    BN_DEF(0x5D4527F4, 0x8F7E4670),
+    BN_DEF(0x1F97D22B, 0xC1FC0EA5),
+    BN_DEF(0xD2BBF118, 0x50FF183A),
+    BN_DEF(0x446CE050, 0xEADC00CA),
+    BN_DEF(0xD6CD4AFC, 0xB1240B66),
+    BN_DEF(0x286090BD, 0x4CF4F18B),
+    BN_DEF(0x07211E7E, 0x28D5348F),
+    BN_DEF(0x1C137296, 0x0E10BF36),
+    BN_DEF(0x84B81FF7, 0x28D45498),
+    BN_DEF(0xB523073A, 0x5DB84CC3),
+    BN_DEF(0x4E435811, 0xAA0FE346),
+    BN_DEF(0x237EC128, 0x2C8B0660),
+    BN_DEF(0x1AE1AFAE, 0x1423605D),
+    BN_DEF(0xC5BAC141, 0x2A282563),
+    BN_DEF(0xE95782F2, 0x149C441C),
+    BN_DEF(0x600DEB81, 0xE596078E),
+    BN_DEF(0x3E499332, 0xAAAD97BA),
+    BN_DEF(0x51D5C414, 0xC35B18A1),
+    BN_DEF(0xFB258877, 0x05C661DE),
+    BN_DEF(0xF6E8E62F, 0xB43FF5B4),
+    BN_DEF(0x64A84EA1, 0x7ED91FE7),
+    BN_DEF(0xECA8D732, 0x0F212D18),
+    BN_DEF(0x7B00641C, 0x1B568026),
+    BN_DEF(0x67FA3555, 0x5207194E),
+    BN_DEF(0xBC9C6D6A, 0xD20EAB86),
+    BN_DEF(0x6A18B0E0, 0xB1534A93),
+    BN_DEF(0x4D6D8F34, 0x1FEEA547),
+    BN_DEF(0xEE35C06B, 0x2D9DB8FC),
+    BN_DEF(0x63139582, 0xF64E8C08),
+    BN_DEF(0xE5677A01, 0xC66796EA),
+    BN_DEF(0xE4ADC88B, 0x724FA91A),
+    BN_DEF(0xDC2A19C5, 0x282EE416),
+    BN_DEF(0x8AB15423, 0x31149618),
+    BN_DEF(0x3573BFAF, 0x6B9581BA),
+    BN_DEF(0xA316A9C6, 0x7CE4848D),
+    BN_DEF(0x23D33E5F, 0x05746DAC),
+    BN_DEF(0x91308B41, 0x59D39CE0),
+    BN_DEF(0x95140DFB, 0x77556011),
+    BN_DEF(0x3BE57CC9, 0xCA63328F),
+    BN_DEF(0xCA595DE0, 0x3B1F2725),
+    BN_DEF(0x003BECDA, 0xAC3F1C6D),
+    BN_DEF(0x0C1811E1, 0x3FD94FC6),
+    BN_DEF(0xFCF1D137, 0x855F60FF),
+    BN_DEF(0x1A8288F1, 0x50077849),
+    BN_DEF(0x6DB1A06C, 0x5C2A9917),
+    BN_DEF(0xD4D4B488, 0xD29238FB),
+    BN_DEF(0xA67EDA3B, 0x9C40A3FD),
+    BN_DEF(0x2723020F, 0xCD8FAE1F),
+    BN_DEF(0xFE67F638, 0x66D6832B),
+    BN_DEF(0xA6380E1D, 0x59C74619),
+    BN_DEF(0x58E07EA6, 0x48BDEEB2),
+    BN_DEF(0x4DBB1264, 0x1DDA2A19),
+    BN_DEF(0x657A9F53, 0x11DD2221),
+    BN_DEF(0x1C29951D, 0x2733BE96),
+    BN_DEF(0x2281B63D, 0x05FEB25B),
+    BN_DEF(0x2F06EC81, 0xE345003F),
+    BN_DEF(0xFA20C170, 0xA6DAD428),
+    BN_DEF(0x3FC45235, 0xC764DAAD),
+    BN_DEF(0xE764BEE7, 0x054148E6),
+    BN_DEF(0xFCC68566, 0x15276754),
+    BN_DEF(0xB8A0001E, 0x0D0EDC9E),
+    BN_DEF(0x99E5C5BD, 0x0494CCD1),
+    BN_DEF(0xB8D6801C, 0x36E3BC7C),
+    BN_DEF(0x48C09862, 0x5483B005),
+    BN_DEF(0x96CF3419, 0x76B50F00),
+    BN_DEF(0x77DA18C5, 0x389AE443),
+    BN_DEF(0xBF18E63D, 0x43FAADD2),
+    BN_DEF(0xAA81A002, 0x3BB1E78E),
+    BN_DEF(0x6B4FB68C, 0x563EAFA1),
+    BN_DEF(0x72C42BDB, 0xBC9874F2),
+    BN_DEF(0x8B26FA7D, 0xB737A961),
+    BN_DEF(0xB34F0F78, 0x12F20E95),
+    BN_DEF(0x1FEACEBE, 0x9E0D9077),
+    BN_DEF(0xFD29EEF7, 0x055E6835),
+    BN_DEF(0x6AE22427, 0x0EDFCD21),
+    BN_DEF(0xCD86F56D, 0xD5E290CB),
+    BN_DEF(0x911B1D06, 0x743695E2),
+    BN_DEF(0xCE4EFB4F, 0xAE574155),
+    BN_DEF(0x38FAA5FF, 0xB279710F),
+    BN_DEF(0x716BA6E9, 0x7A7EA229),
+    BN_DEF(0xDE21BCA2, 0x5A098649),
+    BN_DEF(0xC289C938, 0x577F0984),
+    BN_DEF(0x60C36C8E, 0x2CC6587D),
+    BN_DEF(0x48FBFBF7, 0xBD6C8E93),
+    BN_DEF(0xEB736483, 0x30DA37E4),
+    BN_DEF(0x7CCE011C, 0xDE1A7A6F),
+    BN_DEF(0xB28C81AD, 0x6F1AAD9D),
+    BN_DEF(0x308FE7EE, 0x4435A11C),
+    BN_DEF(0x60D977FD, 0x6379A513),
+    BN_DEF(0xBE8B41D9, 0xE2C778C1),
+    BN_DEF(0x17611002, 0x9DDAFE5E),
+    BN_DEF(0xA637D6B9, 0xE1FF1D8D),
+    BN_DEF(0x777940C1, 0xC7278919),
+    BN_DEF(0x74C2C1FF, 0xC8B97F4E),
+    BN_DEF(0x941A17B0, 0x601A0266),
+    BN_DEF(0xE6FBF176, 0x4F017E70),
+    BN_DEF(0x770536B8, 0x8583D3E4),
+    BN_DEF(0xB1B95D8C, 0x572B76F3),
+    BN_DEF(0xEF1CA6FA, 0x0EA7A151),
+    BN_DEF(0xB06BFA34, 0xDCB56D5B),
+    BN_DEF(0xD96471FD, 0xE88454A5),
+    BN_DEF(0x59927DB0, 0x5E0558C1),
+    BN_DEF(0xA41D3CBD, 0x98566527),
+    BN_DEF(0x9B56F39A, 0x0EF8AC50),
+    BN_DEF(0x79F7F439, 0xF15344ED),
+    BN_DEF(0x707345BB, 0xCC278638),
+    BN_DEF(0x3FABE49A, 0xDAAB89AF),
+    BN_DEF(0x9EF68D79, 0x42B1B2AA),
+    BN_DEF(0xAF833768, 0x9219FA8F),
+    BN_DEF(0xEAFEB2B0, 0x69EF8F6A),
+    BN_DEF(0x576230BD, 0x7B40D901),
+    BN_DEF(0xB1863AEC, 0xBE97F1B1),
+    BN_DEF(0x124D9F7C, 0xE649CEE7),
+    BN_DEF(0x8A3219FD, 0xD4F09B20),
+    BN_DEF(0xE7169B4A, 0xEC5CE2C1),
+    BN_DEF(0x139E9E78, 0x57EE2B10),
+    BN_DEF(0x515DA54D, 0xD6FC2A2C),
+    BN_DEF(0xFFFFFFFF, 0x7FFFFFFF),
 };
 
 /* Macro to make a BIGNUM from static data */
 
-# define make_dh_bn(x)                   \
+#define make_dh_bn(x)                    \
     extern const BIGNUM ossl_bignum_##x; \
     const BIGNUM ossl_bignum_##x = {     \
-        (BN_ULONG *) x,                  \
+        (BN_ULONG *)x,                   \
         OSSL_NELEM(x),                   \
         OSSL_NELEM(x),                   \
-        0, BN_FLG_STATIC_DATA };
+        0, BN_FLG_STATIC_DATA            \
+    };
 
 static const BN_ULONG value_2 = 2;
 
@@ -1018,37 +1387,37 @@ const BIGNUM ossl_bignum_const_2 = {
 };
 
 make_dh_bn(dh1024_160_p)
-make_dh_bn(dh1024_160_q)
-make_dh_bn(dh1024_160_g)
-make_dh_bn(dh2048_224_p)
-make_dh_bn(dh2048_224_q)
-make_dh_bn(dh2048_224_g)
-make_dh_bn(dh2048_256_p)
-make_dh_bn(dh2048_256_q)
-make_dh_bn(dh2048_256_g)
+    make_dh_bn(dh1024_160_q)
+        make_dh_bn(dh1024_160_g)
+            make_dh_bn(dh2048_224_p)
+                make_dh_bn(dh2048_224_q)
+                    make_dh_bn(dh2048_224_g)
+                        make_dh_bn(dh2048_256_p)
+                            make_dh_bn(dh2048_256_q)
+                                make_dh_bn(dh2048_256_g)
 
-make_dh_bn(ffdhe2048_p)
-make_dh_bn(ffdhe2048_q)
-make_dh_bn(ffdhe3072_p)
-make_dh_bn(ffdhe3072_q)
-make_dh_bn(ffdhe4096_p)
-make_dh_bn(ffdhe4096_q)
-make_dh_bn(ffdhe6144_p)
-make_dh_bn(ffdhe6144_q)
-make_dh_bn(ffdhe8192_p)
-make_dh_bn(ffdhe8192_q)
+                                    make_dh_bn(ffdhe2048_p)
+                                        make_dh_bn(ffdhe2048_q)
+                                            make_dh_bn(ffdhe3072_p)
+                                                make_dh_bn(ffdhe3072_q)
+                                                    make_dh_bn(ffdhe4096_p)
+                                                        make_dh_bn(ffdhe4096_q)
+                                                            make_dh_bn(ffdhe6144_p)
+                                                                make_dh_bn(ffdhe6144_q)
+                                                                    make_dh_bn(ffdhe8192_p)
+                                                                        make_dh_bn(ffdhe8192_q)
 
-# ifndef FIPS_MODULE
-make_dh_bn(modp_1536_p)
-make_dh_bn(modp_1536_q)
-# endif
-make_dh_bn(modp_2048_p)
-make_dh_bn(modp_2048_q)
-make_dh_bn(modp_3072_p)
-make_dh_bn(modp_3072_q)
-make_dh_bn(modp_4096_p)
-make_dh_bn(modp_4096_q)
-make_dh_bn(modp_6144_p)
-make_dh_bn(modp_6144_q)
-make_dh_bn(modp_8192_p)
-make_dh_bn(modp_8192_q)
+#ifndef FIPS_MODULE
+                                                                            make_dh_bn(modp_1536_p)
+                                                                                make_dh_bn(modp_1536_q)
+#endif
+                                                                                    make_dh_bn(modp_2048_p)
+                                                                                        make_dh_bn(modp_2048_q)
+                                                                                            make_dh_bn(modp_3072_p)
+                                                                                                make_dh_bn(modp_3072_q)
+                                                                                                    make_dh_bn(modp_4096_p)
+                                                                                                        make_dh_bn(modp_4096_q)
+                                                                                                            make_dh_bn(modp_6144_p)
+                                                                                                                make_dh_bn(modp_6144_q)
+                                                                                                                    make_dh_bn(modp_8192_p)
+                                                                                                                        make_dh_bn(modp_8192_q)
diff --git a/crypto/openssl/crypto/bn/bn_div.c b/crypto/openssl/crypto/bn/bn_div.c
index ff66baa48f22..fc61d70a9da4 100644
--- a/crypto/openssl/crypto/bn/bn_div.c
+++ b/crypto/openssl/crypto/bn/bn_div.c
@@ -87,22 +87,22 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
 
 #else
 
-# if defined(BN_DIV3W)
+#if defined(BN_DIV3W)
 BN_ULONG bn_div_3_words(const BN_ULONG *m, BN_ULONG d1, BN_ULONG d0);
-# elif 0
+#elif 0
 /*
  * This is #if-ed away, because it's a reference for assembly implementations,
  * where it can and should be made constant-time. But if you want to test it,
  * just replace 0 with 1.
  */
-#  if BN_BITS2 == 64 && defined(__SIZEOF_INT128__) && __SIZEOF_INT128__==16
-#   undef BN_ULLONG
-#   define BN_ULLONG uint128_t
-#   define BN_LLONG
-#  endif
+#if BN_BITS2 == 64 && defined(__SIZEOF_INT128__) && __SIZEOF_INT128__ == 16
+#undef BN_ULLONG
+#define BN_ULLONG uint128_t
+#define BN_LLONG
+#endif
 
-#  ifdef BN_LLONG
-#   define BN_DIV3W
+#ifdef BN_LLONG
+#define BN_DIV3W
 /*
  * Interface is somewhat quirky, |m| is pointer to most significant limb,
  * and less significant limb is referred at |m[-1]|. This means that caller
@@ -128,15 +128,15 @@ static BN_ULONG bn_div_3_words(const BN_ULONG *m, BN_ULONG d1, BN_ULONG d0)
         D >>= 1;
     }
 
-    mask = 0 - (Q >> (BN_BITS2 - 1));   /* does it overflow? */
+    mask = 0 - (Q >> (BN_BITS2 - 1)); /* does it overflow? */
 
     Q <<= 1;
     Q |= (R >= D);
 
     return (Q | mask) & BN_MASK2;
 }
-#  endif
-# endif
+#endif
+#endif
 
 static int bn_left_align(BIGNUM *num)
 {
@@ -145,8 +145,8 @@ static int bn_left_align(BIGNUM *num)
     int rshift = BN_num_bits_word(d[top - 1]), lshift, i;
 
     lshift = BN_BITS2 - rshift;
-    rshift %= BN_BITS2;            /* say no to undefined behaviour */
-    rmask = (BN_ULONG)0 - rshift;  /* rmask = 0 - (rshift != 0) */
+    rshift %= BN_BITS2; /* say no to undefined behaviour */
+    rmask = (BN_ULONG)0 - rshift; /* rmask = 0 - (rshift != 0) */
     rmask |= rmask >> 8;
 
     for (i = 0, m = 0; i < top; i++) {
@@ -158,45 +158,47 @@ static int bn_left_align(BIGNUM *num)
     return lshift;
 }
 
-# if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM) \
+#if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM) \
     && !defined(PEDANTIC) && !defined(BN_DIV3W)
-#  if defined(__GNUC__) && __GNUC__>=2
-#   if defined(__i386) || defined (__i386__)
-   /*-
-    * There were two reasons for implementing this template:
-    * - GNU C generates a call to a function (__udivdi3 to be exact)
-    *   in reply to ((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0 (I fail to
-    *   understand why...);
-    * - divl doesn't only calculate quotient, but also leaves
-    *   remainder in %edx which we can definitely use here:-)
-    */
-#    undef bn_div_words
-#    define bn_div_words(n0,n1,d0)                \
-        ({  asm volatile (                      \
-                "divl   %4"                     \
-                : "=a"(q), "=d"(rem)            \
-                : "a"(n1), "d"(n0), "r"(d0)     \
-                : "cc");                        \
-            q;                                  \
-        })
-#    define REMAINDER_IS_ALREADY_CALCULATED
-#   elif defined(__x86_64) && defined(SIXTY_FOUR_BIT_LONG)
-   /*
-    * Same story here, but it's 128-bit by 64-bit division. Wow!
-    */
-#    undef bn_div_words
-#    define bn_div_words(n0,n1,d0)                \
-        ({  asm volatile (                      \
-                "divq   %4"                     \
-                : "=a"(q), "=d"(rem)            \
-                : "a"(n1), "d"(n0), "r"(d0)     \
-                : "cc");                        \
-            q;                                  \
-        })
-#    define REMAINDER_IS_ALREADY_CALCULATED
-#   endif                       /* __<cpu> */
-#  endif                        /* __GNUC__ */
-# endif                         /* OPENSSL_NO_ASM */
+#if defined(__GNUC__) && __GNUC__ >= 2
+#if defined(__i386) || defined(__i386__)
+/*-
+ * There were two reasons for implementing this template:
+ * - GNU C generates a call to a function (__udivdi3 to be exact)
+ *   in reply to ((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0 (I fail to
+ *   understand why...);
+ * - divl doesn't only calculate quotient, but also leaves
+ *   remainder in %edx which we can definitely use here:-)
+ */
+#undef bn_div_words
+#define bn_div_words(n0, n1, d0)        \
+    ({                                  \
+        asm volatile(                   \
+            "divl   %4"                 \
+            : "=a"(q), "=d"(rem)        \
+            : "a"(n1), "d"(n0), "r"(d0) \
+            : "cc");                    \
+        q;                              \
+    })
+#define REMAINDER_IS_ALREADY_CALCULATED
+#elif defined(__x86_64) && defined(SIXTY_FOUR_BIT_LONG)
+/*
+ * Same story here, but it's 128-bit by 64-bit division. Wow!
+ */
+#undef bn_div_words
+#define bn_div_words(n0, n1, d0)        \
+    ({                                  \
+        asm volatile(                   \
+            "divq   %4"                 \
+            : "=a"(q), "=d"(rem)        \
+            : "a"(n1), "d"(n0), "r"(d0) \
+            : "cc");                    \
+        q;                              \
+    })
+#define REMAINDER_IS_ALREADY_CALCULATED
+#endif /* __<cpu> */
+#endif /* __GNUC__ */
+#endif /* OPENSSL_NO_ASM */
 
 /*-
  * BN_div computes  dv := num / divisor, rounding towards
@@ -207,7 +209,7 @@ static int bn_left_align(BIGNUM *num)
  * If 'dv' or 'rm' is NULL, the respective value is not returned.
  */
 int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
-           BN_CTX *ctx)
+    BN_CTX *ctx)
 {
     int ret;
 
@@ -262,7 +264,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  *       divisor's length is considered public;
  */
 int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
-                     const BIGNUM *divisor, BN_CTX *ctx)
+    const BIGNUM *divisor, BN_CTX *ctx)
 {
     int norm_shift, i, j, loop;
     BIGNUM *tmp, *snum, *sdiv, *res;
@@ -342,58 +344,58 @@ int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
          * the first part of the loop uses the top two words of snum and sdiv
          * to calculate a BN_ULONG q such that | wnum - sdiv * q | < sdiv
          */
-# if defined(BN_DIV3W)
+#if defined(BN_DIV3W)
         q = bn_div_3_words(wnumtop, d1, d0);
-# else
+#else
         BN_ULONG n0, n1, rem = 0;
 
         n0 = wnumtop[0];
         n1 = wnumtop[-1];
         if (n0 == d0)
             q = BN_MASK2;
-        else {                  /* n0 < d0 */
+        else { /* n0 < d0 */
             BN_ULONG n2 = (wnumtop == wnum) ? 0 : wnumtop[-2];
-#  ifdef BN_LLONG
+#ifdef BN_LLONG
             BN_ULLONG t2;
 
-#   if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
-            q = (BN_ULONG)(((((BN_ULLONG) n0) << BN_BITS2) | n1) / d0);
-#   else
+#if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
+            q = (BN_ULONG)(((((BN_ULLONG)n0) << BN_BITS2) | n1) / d0);
+#else
             q = bn_div_words(n0, n1, d0);
-#   endif
+#endif
 
-#   ifndef REMAINDER_IS_ALREADY_CALCULATED
+#ifndef REMAINDER_IS_ALREADY_CALCULATED
             /*
              * rem doesn't have to be BN_ULLONG. The least we
              * know it's less that d0, isn't it?
              */
             rem = (n1 - q * d0) & BN_MASK2;
-#   endif
-            t2 = (BN_ULLONG) d1 *q;
+#endif
+            t2 = (BN_ULLONG)d1 * q;
 
             for (;;) {
-                if (t2 <= ((((BN_ULLONG) rem) << BN_BITS2) | n2))
+                if (t2 <= ((((BN_ULLONG)rem) << BN_BITS2) | n2))
                     break;
                 q--;
                 rem += d0;
                 if (rem < d0)
-                    break;      /* don't let rem overflow */
+                    break; /* don't let rem overflow */
                 t2 -= d1;
             }
-#  else                         /* !BN_LLONG */
+#else /* !BN_LLONG */
             BN_ULONG t2l, t2h;
 
             q = bn_div_words(n0, n1, d0);
-#   ifndef REMAINDER_IS_ALREADY_CALCULATED
+#ifndef REMAINDER_IS_ALREADY_CALCULATED
             rem = (n1 - q * d0) & BN_MASK2;
-#   endif
+#endif
 
-#   if defined(BN_UMULT_LOHI)
+#if defined(BN_UMULT_LOHI)
             BN_UMULT_LOHI(t2l, t2h, d1, q);
-#   elif defined(BN_UMULT_HIGH)
+#elif defined(BN_UMULT_HIGH)
             t2l = d1 * q;
             t2h = BN_UMULT_HIGH(d1, q);
-#   else
+#else
             {
                 BN_ULONG ql, qh;
                 t2l = LBITS(d1);
@@ -402,7 +404,7 @@ int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
                 qh = HBITS(q);
                 mul64(t2l, t2h, ql, qh); /* t2=(BN_ULLONG)d1*q; */
             }
-#   endif
+#endif
 
             for (;;) {
                 if ((t2h < rem) || ((t2h == rem) && (t2l <= n2)))
@@ -410,14 +412,14 @@ int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
                 q--;
                 rem += d0;
                 if (rem < d0)
-                    break;      /* don't let rem overflow */
+                    break; /* don't let rem overflow */
                 if (t2l < d1)
                     t2h--;
                 t2l -= d1;
             }
-#  endif                        /* !BN_LLONG */
+#endif /* !BN_LLONG */
         }
-# endif                         /* !BN_DIV3W */
+#endif /* !BN_DIV3W */
 
         l0 = bn_mul_words(tmp->d, sdiv->d, div_n, q);
         tmp->d[div_n] = l0;
@@ -452,7 +454,7 @@ int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
 
     BN_CTX_end(ctx);
     return 1;
- err:
+err:
     bn_check_top(rm);
     BN_CTX_end(ctx);
     return 0;
diff --git a/crypto/openssl/crypto/bn/bn_err.c b/crypto/openssl/crypto/bn/bn_err.c
index 953be9ed4717..84aaf75b529e 100644
--- a/crypto/openssl/crypto/bn/bn_err.c
+++ b/crypto/openssl/crypto/bn/bn_err.c
@@ -15,33 +15,33 @@
 #ifndef OPENSSL_NO_ERR
 
 static const ERR_STRING_DATA BN_str_reasons[] = {
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_ARG2_LT_ARG3), "arg2 lt arg3"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_BAD_RECIPROCAL), "bad reciprocal"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_BIGNUM_TOO_LONG), "bignum too long"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_BITS_TOO_SMALL), "bits too small"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_CALLED_WITH_EVEN_MODULUS),
-    "called with even modulus"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_DIV_BY_ZERO), "div by zero"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_ENCODING_ERROR), "encoding error"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA),
-    "expand on static bignum data"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_INPUT_NOT_REDUCED), "input not reduced"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_INVALID_LENGTH), "invalid length"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_INVALID_RANGE), "invalid range"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_INVALID_SHIFT), "invalid shift"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_NOT_A_SQUARE), "not a square"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_NOT_INITIALIZED), "not initialized"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_INVERSE), "no inverse"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_PRIME_CANDIDATE), "no prime candidate"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_SOLUTION), "no solution"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_SUITABLE_DIGEST), "no suitable digest"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_PRIVATE_KEY_TOO_LARGE),
-    "private key too large"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_P_IS_NOT_PRIME), "p is not prime"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_TOO_MANY_ITERATIONS), "too many iterations"},
-    {ERR_PACK(ERR_LIB_BN, 0, BN_R_TOO_MANY_TEMPORARY_VARIABLES),
-    "too many temporary variables"},
-    {0, NULL}
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_ARG2_LT_ARG3), "arg2 lt arg3" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_BAD_RECIPROCAL), "bad reciprocal" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_BIGNUM_TOO_LONG), "bignum too long" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_BITS_TOO_SMALL), "bits too small" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_CALLED_WITH_EVEN_MODULUS),
+        "called with even modulus" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_DIV_BY_ZERO), "div by zero" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_ENCODING_ERROR), "encoding error" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA),
+        "expand on static bignum data" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_INPUT_NOT_REDUCED), "input not reduced" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_INVALID_LENGTH), "invalid length" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_INVALID_RANGE), "invalid range" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_INVALID_SHIFT), "invalid shift" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_NOT_A_SQUARE), "not a square" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_NOT_INITIALIZED), "not initialized" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_INVERSE), "no inverse" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_PRIME_CANDIDATE), "no prime candidate" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_SOLUTION), "no solution" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_NO_SUITABLE_DIGEST), "no suitable digest" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_PRIVATE_KEY_TOO_LARGE),
+        "private key too large" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_P_IS_NOT_PRIME), "p is not prime" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_TOO_MANY_ITERATIONS), "too many iterations" },
+    { ERR_PACK(ERR_LIB_BN, 0, BN_R_TOO_MANY_TEMPORARY_VARIABLES),
+        "too many temporary variables" },
+    { 0, NULL }
 };
 
 #endif
diff --git a/crypto/openssl/crypto/bn/bn_exp.c b/crypto/openssl/crypto/bn/bn_exp.c
index 1dda2e017f1b..58d38b9ebd2a 100644
--- a/crypto/openssl/crypto/bn/bn_exp.c
+++ b/crypto/openssl/crypto/bn/bn_exp.c
@@ -13,28 +13,28 @@
 
 #include <stdlib.h>
 #ifdef _WIN32
-# include <malloc.h>
-# ifndef alloca
-#  define alloca _alloca
-# endif
+#include <malloc.h>
+#ifndef alloca
+#define alloca _alloca
+#endif
 #elif defined(__GNUC__)
-# ifndef alloca
-#  define alloca(s) __builtin_alloca((s))
-# endif
+#ifndef alloca
+#define alloca(s) __builtin_alloca((s))
+#endif
 #elif defined(__sun)
-# include <alloca.h>
+#include <alloca.h>
 #endif
 
 #include "rsaz_exp.h"
 
 #undef SPARC_T4_MONT
 #if defined(OPENSSL_BN_ASM_MONT) && (defined(__sparc__) || defined(__sparc))
-# include "crypto/sparc_arch.h"
-# define SPARC_T4_MONT
+#include "crypto/sparc_arch.h"
+#define SPARC_T4_MONT
 #endif
 
 /* maximum precomputation table size for *variable* sliding windows */
-#define TABLE_SIZE      32
+#define TABLE_SIZE 32
 
 /*
  * Beyond this limit the constant time code is disabled due to
@@ -52,7 +52,7 @@ int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
     BIGNUM *v, *rr;
 
     if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0
-            || BN_get_flags(a, BN_FLG_CONSTTIME) != 0) {
+        || BN_get_flags(a, BN_FLG_CONSTTIME) != 0) {
         /* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
         ERR_raise(ERR_LIB_BN, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
         return 0;
@@ -88,14 +88,14 @@ int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
         goto err;
 
     ret = 1;
- err:
+err:
     BN_CTX_end(ctx);
     bn_check_top(r);
     return ret;
 }
 
 int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
-               BN_CTX *ctx)
+    BN_CTX *ctx)
 {
     int ret;
 
@@ -140,7 +140,7 @@ int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
 
 #ifdef MONT_MUL_MOD
     if (BN_is_odd(m)) {
-# ifdef MONT_EXP_WORD
+#ifdef MONT_EXP_WORD
         if (a->top == 1 && !a->neg
             && (BN_get_flags(p, BN_FLG_CONSTTIME) == 0)
             && (BN_get_flags(a, BN_FLG_CONSTTIME) == 0)
@@ -148,7 +148,7 @@ int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
             BN_ULONG A = a->d[0];
             ret = BN_mod_exp_mont_word(r, A, p, m, ctx, NULL);
         } else
-# endif
+#endif
             ret = BN_mod_exp_mont(r, a, p, m, ctx, NULL);
     } else
 #endif
@@ -167,7 +167,7 @@ int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
 }
 
 int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                    const BIGNUM *m, BN_CTX *ctx)
+    const BIGNUM *m, BN_CTX *ctx)
 {
     int i, j, bits, ret = 0, wstart, wend, window;
     int start = 1;
@@ -177,8 +177,8 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
     BN_RECP_CTX recp;
 
     if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0
-            || BN_get_flags(a, BN_FLG_CONSTTIME) != 0
-            || BN_get_flags(m, BN_FLG_CONSTTIME) != 0) {
+        || BN_get_flags(a, BN_FLG_CONSTTIME) != 0
+        || BN_get_flags(m, BN_FLG_CONSTTIME) != 0) {
         /* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
         ERR_raise(ERR_LIB_BN, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
         return 0;
@@ -217,7 +217,7 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
     }
 
     if (!BN_nnmod(val[0], a, m, ctx))
-        goto err;               /* 1 */
+        goto err; /* 1 */
     if (BN_is_zero(val[0])) {
         BN_zero(r);
         ret = 1;
@@ -227,20 +227,19 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
     window = BN_window_bits_for_exponent_size(bits);
     if (window > 1) {
         if (!BN_mod_mul_reciprocal(aa, val[0], val[0], &recp, ctx))
-            goto err;           /* 2 */
+            goto err; /* 2 */
         j = 1 << (window - 1);
         for (i = 1; i < j; i++) {
-            if (((val[i] = BN_CTX_get(ctx)) == NULL) ||
-                !BN_mod_mul_reciprocal(val[i], val[i - 1], aa, &recp, ctx))
+            if (((val[i] = BN_CTX_get(ctx)) == NULL) || !BN_mod_mul_reciprocal(val[i], val[i - 1], aa, &recp, ctx))
                 goto err;
         }
     }
 
-    start = 1;                  /* This is used to avoid multiplication etc
-                                 * when there is only the value '1' in the
-                                 * buffer. */
-    wstart = bits - 1;          /* The top bit of the window */
-    wend = 0;                   /* The bottom bit of the window */
+    start = 1; /* This is used to avoid multiplication etc
+                * when there is only the value '1' in the
+                * buffer. */
+    wstart = bits - 1; /* The top bit of the window */
+    wend = 0; /* The bottom bit of the window */
 
     if (r == p) {
         BIGNUM *p_dup = BN_CTX_get(ctx);
@@ -254,7 +253,7 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
         goto err;
 
     for (;;) {
-        int wvalue;             /* The 'value' of the window */
+        int wvalue; /* The 'value' of the window */
 
         if (BN_is_bit_set(p, wstart) == 0) {
             if (!start)
@@ -302,7 +301,7 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
             break;
     }
     ret = 1;
- err:
+err:
     BN_CTX_end(ctx);
     BN_RECP_CTX_free(&recp);
     bn_check_top(r);
@@ -310,7 +309,7 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 }
 
 int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
-                    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
+    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
 {
     int i, j, bits, ret = 0, wstart, wend, window;
     int start = 1;
@@ -375,28 +374,27 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     } else
         aa = a;
     if (!bn_to_mont_fixed_top(val[0], aa, mont, ctx))
-        goto err;               /* 1 */
+        goto err; /* 1 */
 
     window = BN_window_bits_for_exponent_size(bits);
     if (window > 1) {
         if (!bn_mul_mont_fixed_top(d, val[0], val[0], mont, ctx))
-            goto err;           /* 2 */
+            goto err; /* 2 */
         j = 1 << (window - 1);
         for (i = 1; i < j; i++) {
-            if (((val[i] = BN_CTX_get(ctx)) == NULL) ||
-                !bn_mul_mont_fixed_top(val[i], val[i - 1], d, mont, ctx))
+            if (((val[i] = BN_CTX_get(ctx)) == NULL) || !bn_mul_mont_fixed_top(val[i], val[i - 1], d, mont, ctx))
                 goto err;
         }
     }
 
-    start = 1;                  /* This is used to avoid multiplication etc
-                                 * when there is only the value '1' in the
-                                 * buffer. */
-    wstart = bits - 1;          /* The top bit of the window */
-    wend = 0;                   /* The bottom bit of the window */
+    start = 1; /* This is used to avoid multiplication etc
+                * when there is only the value '1' in the
+                * buffer. */
+    wstart = bits - 1; /* The top bit of the window */
+    wend = 0; /* The bottom bit of the window */
 
-#if 1                           /* by Shay Gueron's suggestion */
-    j = m->top;                 /* borrow j */
+#if 1 /* by Shay Gueron's suggestion */
+    j = m->top; /* borrow j */
     if (m->d[j - 1] & (((BN_ULONG)1) << (BN_BITS2 - 1))) {
         if (bn_wexpand(r, j) == NULL)
             goto err;
@@ -408,10 +406,10 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         r->flags |= BN_FLG_FIXED_TOP;
     } else
 #endif
-    if (!bn_to_mont_fixed_top(r, BN_value_one(), mont, ctx))
+        if (!bn_to_mont_fixed_top(r, BN_value_one(), mont, ctx))
         goto err;
     for (;;) {
-        int wvalue;             /* The 'value' of the window */
+        int wvalue; /* The 'value' of the window */
 
         if (BN_is_bit_set(p, wstart) == 0) {
             if (!start) {
@@ -466,8 +464,8 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
      */
 #if defined(SPARC_T4_MONT)
     if (OPENSSL_sparcv9cap_P[0] & (SPARCV9_VIS3 | SPARCV9_PREFER_FPU)) {
-        j = mont->N.top;        /* borrow j */
-        val[0]->d[0] = 1;       /* borrow val[0] */
+        j = mont->N.top; /* borrow j */
+        val[0]->d[0] = 1; /* borrow val[0] */
         for (i = 1; i < j; i++)
             val[0]->d[i] = 0;
         val[0]->top = j;
@@ -475,10 +473,10 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
             goto err;
     } else
 #endif
-    if (!BN_from_montgomery(rr, r, mont, ctx))
+        if (!BN_from_montgomery(rr, r, mont, ctx))
         goto err;
     ret = 1;
- err:
+err:
     if (in_mont == NULL)
         BN_MONT_CTX_free(mont);
     BN_CTX_end(ctx);
@@ -513,16 +511,16 @@ static BN_ULONG bn_get_bits(const BIGNUM *a, int bitpos)
  */
 
 static int MOD_EXP_CTIME_COPY_TO_PREBUF(const BIGNUM *b, int top,
-                                        unsigned char *buf, int idx,
-                                        int window)
+    unsigned char *buf, int idx,
+    int window)
 {
     int i, j;
     int width = 1 << window;
     BN_ULONG *table = (BN_ULONG *)buf;
 
     if (top > b->top)
-        top = b->top;           /* this works because 'buf' is explicitly
-                                 * zeroed */
+        top = b->top; /* this works because 'buf' is explicitly
+                       * zeroed */
     for (i = 0, j = idx; i < top; i++, j += width) {
         table[j] = b->d[i];
     }
@@ -531,8 +529,8 @@ static int MOD_EXP_CTIME_COPY_TO_PREBUF(const BIGNUM *b, int top,
 }
 
 static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
-                                          unsigned char *buf, int idx,
-                                          int window)
+    unsigned char *buf, int idx,
+    int window)
 {
     int i, j;
     int width = 1 << window;
@@ -554,8 +552,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
             BN_ULONG acc = 0;
 
             for (j = 0; j < width; j++) {
-                acc |= table[j] &
-                       ((BN_ULONG)0 - (constant_time_eq_int(j,idx)&1));
+                acc |= table[j] & ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
             }
 
             b->d[i] = acc;
@@ -564,23 +561,20 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
         int xstride = 1 << (window - 2);
         BN_ULONG y0, y1, y2, y3;
 
-        i = idx >> (window - 2);        /* equivalent of idx / xstride */
-        idx &= xstride - 1;             /* equivalent of idx % xstride */
+        i = idx >> (window - 2); /* equivalent of idx / xstride */
+        idx &= xstride - 1; /* equivalent of idx % xstride */
 
-        y0 = (BN_ULONG)0 - (constant_time_eq_int(i,0)&1);
-        y1 = (BN_ULONG)0 - (constant_time_eq_int(i,1)&1);
-        y2 = (BN_ULONG)0 - (constant_time_eq_int(i,2)&1);
-        y3 = (BN_ULONG)0 - (constant_time_eq_int(i,3)&1);
+        y0 = (BN_ULONG)0 - (constant_time_eq_int(i, 0) & 1);
+        y1 = (BN_ULONG)0 - (constant_time_eq_int(i, 1) & 1);
+        y2 = (BN_ULONG)0 - (constant_time_eq_int(i, 2) & 1);
+        y3 = (BN_ULONG)0 - (constant_time_eq_int(i, 3) & 1);
 
         for (i = 0; i < top; i++, table += width) {
             BN_ULONG acc = 0;
 
             for (j = 0; j < xstride; j++) {
-                acc |= ( (table[j + 0 * xstride] & y0) |
-                         (table[j + 1 * xstride] & y1) |
-                         (table[j + 2 * xstride] & y2) |
-                         (table[j + 3 * xstride] & y3) )
-                       & ((BN_ULONG)0 - (constant_time_eq_int(j,idx)&1));
+                acc |= ((table[j + 0 * xstride] & y0) | (table[j + 1 * xstride] & y1) | (table[j + 2 * xstride] & y2) | (table[j + 3 * xstride] & y3))
+                    & ((BN_ULONG)0 - (constant_time_eq_int(j, idx) & 1));
             }
 
             b->d[i] = acc;
@@ -597,7 +591,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
  * multiple.
  */
 #define MOD_EXP_CTIME_ALIGN(x_) \
-        ((unsigned char*)(x_) + (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - (((size_t)(x_)) & (MOD_EXP_CTIME_MIN_CACHE_LINE_MASK))))
+    ((unsigned char *)(x_) + (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - (((size_t)(x_)) & (MOD_EXP_CTIME_MIN_CACHE_LINE_MASK))))
 
 /*
  * This variant of BN_mod_exp_mont() uses fixed windows and the special
@@ -607,8 +601,8 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
  * http://www.daemonology.net/hyperthreading-considered-harmful/)
  */
 int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
-                              const BIGNUM *m, BN_CTX *ctx,
-                              BN_MONT_CTX *in_mont)
+    const BIGNUM *m, BN_CTX *ctx,
+    BN_MONT_CTX *in_mont)
 {
     int i, bits, ret = 0, window, wvalue, wmask, window0;
     int top;
@@ -686,7 +680,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         if (NULL == bn_wexpand(rr, 16))
             goto err;
         RSAZ_1024_mod_exp_avx2(rr->d, a->d, p->d, m->d, mont->RR.d,
-                               mont->n0[0]);
+            mont->n0[0]);
         rr->top = 16;
         rr->neg = 0;
         bn_correct_top(rr);
@@ -707,16 +701,14 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     /* Get the window size to use with size of p. */
     window = BN_window_bits_for_ctime_exponent_size(bits);
 #if defined(SPARC_T4_MONT)
-    if (window >= 5 && (top & 15) == 0 && top <= 64 &&
-        (OPENSSL_sparcv9cap_P[1] & (CFR_MONTMUL | CFR_MONTSQR)) ==
-        (CFR_MONTMUL | CFR_MONTSQR) && (t4 = OPENSSL_sparcv9cap_P[0]))
+    if (window >= 5 && (top & 15) == 0 && top <= 64 && (OPENSSL_sparcv9cap_P[1] & (CFR_MONTMUL | CFR_MONTSQR)) == (CFR_MONTMUL | CFR_MONTSQR) && (t4 = OPENSSL_sparcv9cap_P[0]))
         window = 5;
     else
 #endif
 #if defined(OPENSSL_BN_ASM_MONT5)
-    if (window >= 5 && top <= BN_SOFT_LIMIT) {
-        window = 5;             /* ~5% improvement for RSA2048 sign, and even
-                                 * for RSA4096 */
+        if (window >= 5 && top <= BN_SOFT_LIMIT) {
+        window = 5; /* ~5% improvement for RSA2048 sign, and even
+                     * for RSA4096 */
         /* reserve space for mont->N.d[] copy */
         powerbufLen += top * sizeof(mont->N.d[0]);
     }
@@ -728,17 +720,13 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
      * of am, am itself and tmp.
      */
     numPowers = 1 << window;
-    powerbufLen += sizeof(m->d[0]) * (top * numPowers +
-                                      ((2 * top) >
-                                       numPowers ? (2 * top) : numPowers));
+    powerbufLen += sizeof(m->d[0]) * (top * numPowers + ((2 * top) > numPowers ? (2 * top) : numPowers));
 #ifdef alloca
     if (powerbufLen < 3072)
-        powerbufFree =
-            alloca(powerbufLen + MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH);
+        powerbufFree = alloca(powerbufLen + MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH);
     else
 #endif
-        if ((powerbufFree =
-             OPENSSL_malloc(powerbufLen + MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH))
+        if ((powerbufFree = OPENSSL_malloc(powerbufLen + MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH))
             == NULL)
         goto err;
 
@@ -759,7 +747,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     tmp.flags = am.flags = BN_FLG_STATIC_DATA;
 
     /* prepare a^0 in Montgomery domain */
-#if 1                           /* by Shay Gueron's suggestion */
+#if 1 /* by Shay Gueron's suggestion */
     if (m->d[top - 1] & (((BN_ULONG)1) << (BN_BITS2 - 1))) {
         /* 2^(top*BN_BITS2) - m */
         tmp.d[0] = (0 - m->d[0]) & BN_MASK2;
@@ -768,7 +756,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         tmp.top = top;
     } else
 #endif
-    if (!bn_to_mont_fixed_top(&tmp, BN_value_one(), mont, ctx))
+        if (!bn_to_mont_fixed_top(&tmp, BN_value_one(), mont, ctx))
         goto err;
 
     /* prepare a^1 in Montgomery domain */
@@ -780,61 +768,61 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 
 #if defined(SPARC_T4_MONT)
     if (t4) {
-        typedef int (*bn_pwr5_mont_f) (BN_ULONG *tp, const BN_ULONG *np,
-                                       const BN_ULONG *n0, const void *table,
-                                       int power, int bits);
-        int bn_pwr5_mont_t4_8(BN_ULONG *tp, const BN_ULONG *np,
-                              const BN_ULONG *n0, const void *table,
-                              int power, int bits);
-        int bn_pwr5_mont_t4_16(BN_ULONG *tp, const BN_ULONG *np,
-                               const BN_ULONG *n0, const void *table,
-                               int power, int bits);
-        int bn_pwr5_mont_t4_24(BN_ULONG *tp, const BN_ULONG *np,
-                               const BN_ULONG *n0, const void *table,
-                               int power, int bits);
-        int bn_pwr5_mont_t4_32(BN_ULONG *tp, const BN_ULONG *np,
-                               const BN_ULONG *n0, const void *table,
-                               int power, int bits);
+        typedef int (*bn_pwr5_mont_f)(BN_ULONG *tp, const BN_ULONG *np,
+            const BN_ULONG *n0, const void *table,
+            int power, int bits);
+        int bn_pwr5_mont_t4_8(BN_ULONG * tp, const BN_ULONG *np,
+            const BN_ULONG *n0, const void *table,
+            int power, int bits);
+        int bn_pwr5_mont_t4_16(BN_ULONG * tp, const BN_ULONG *np,
+            const BN_ULONG *n0, const void *table,
+            int power, int bits);
+        int bn_pwr5_mont_t4_24(BN_ULONG * tp, const BN_ULONG *np,
+            const BN_ULONG *n0, const void *table,
+            int power, int bits);
+        int bn_pwr5_mont_t4_32(BN_ULONG * tp, const BN_ULONG *np,
+            const BN_ULONG *n0, const void *table,
+            int power, int bits);
         static const bn_pwr5_mont_f pwr5_funcs[4] = {
             bn_pwr5_mont_t4_8, bn_pwr5_mont_t4_16,
             bn_pwr5_mont_t4_24, bn_pwr5_mont_t4_32
         };
         bn_pwr5_mont_f pwr5_worker = pwr5_funcs[top / 16 - 1];
 
-        typedef int (*bn_mul_mont_f) (BN_ULONG *rp, const BN_ULONG *ap,
-                                      const void *bp, const BN_ULONG *np,
-                                      const BN_ULONG *n0);
-        int bn_mul_mont_t4_8(BN_ULONG *rp, const BN_ULONG *ap, const void *bp,
-                             const BN_ULONG *np, const BN_ULONG *n0);
-        int bn_mul_mont_t4_16(BN_ULONG *rp, const BN_ULONG *ap,
-                              const void *bp, const BN_ULONG *np,
-                              const BN_ULONG *n0);
-        int bn_mul_mont_t4_24(BN_ULONG *rp, const BN_ULONG *ap,
-                              const void *bp, const BN_ULONG *np,
-                              const BN_ULONG *n0);
-        int bn_mul_mont_t4_32(BN_ULONG *rp, const BN_ULONG *ap,
-                              const void *bp, const BN_ULONG *np,
-                              const BN_ULONG *n0);
+        typedef int (*bn_mul_mont_f)(BN_ULONG *rp, const BN_ULONG *ap,
+            const void *bp, const BN_ULONG *np,
+            const BN_ULONG *n0);
+        int bn_mul_mont_t4_8(BN_ULONG * rp, const BN_ULONG *ap, const void *bp,
+            const BN_ULONG *np, const BN_ULONG *n0);
+        int bn_mul_mont_t4_16(BN_ULONG * rp, const BN_ULONG *ap,
+            const void *bp, const BN_ULONG *np,
+            const BN_ULONG *n0);
+        int bn_mul_mont_t4_24(BN_ULONG * rp, const BN_ULONG *ap,
+            const void *bp, const BN_ULONG *np,
+            const BN_ULONG *n0);
+        int bn_mul_mont_t4_32(BN_ULONG * rp, const BN_ULONG *ap,
+            const void *bp, const BN_ULONG *np,
+            const BN_ULONG *n0);
         static const bn_mul_mont_f mul_funcs[4] = {
             bn_mul_mont_t4_8, bn_mul_mont_t4_16,
             bn_mul_mont_t4_24, bn_mul_mont_t4_32
         };
         bn_mul_mont_f mul_worker = mul_funcs[top / 16 - 1];
 
-        void bn_mul_mont_vis3(BN_ULONG *rp, const BN_ULONG *ap,
-                              const void *bp, const BN_ULONG *np,
-                              const BN_ULONG *n0, int num);
-        void bn_mul_mont_t4(BN_ULONG *rp, const BN_ULONG *ap,
-                            const void *bp, const BN_ULONG *np,
-                            const BN_ULONG *n0, int num);
-        void bn_mul_mont_gather5_t4(BN_ULONG *rp, const BN_ULONG *ap,
-                                    const void *table, const BN_ULONG *np,
-                                    const BN_ULONG *n0, int num, int power);
+        void bn_mul_mont_vis3(BN_ULONG * rp, const BN_ULONG *ap,
+            const void *bp, const BN_ULONG *np,
+            const BN_ULONG *n0, int num);
+        void bn_mul_mont_t4(BN_ULONG * rp, const BN_ULONG *ap,
+            const void *bp, const BN_ULONG *np,
+            const BN_ULONG *n0, int num);
+        void bn_mul_mont_gather5_t4(BN_ULONG * rp, const BN_ULONG *ap,
+            const void *table, const BN_ULONG *np,
+            const BN_ULONG *n0, int num, int power);
         void bn_flip_n_scatter5_t4(const BN_ULONG *inp, size_t num,
-                                   void *table, size_t power);
-        void bn_gather5_t4(BN_ULONG *out, size_t num,
-                           void *table, size_t power);
-        void bn_flip_t4(BN_ULONG *dst, BN_ULONG *src, size_t num);
+            void *table, size_t power);
+        void bn_gather5_t4(BN_ULONG * out, size_t num,
+            void *table, size_t power);
+        void bn_flip_t4(BN_ULONG * dst, BN_ULONG * src, size_t num);
 
         BN_ULONG *np = mont->N.d, *n0 = mont->n0;
         int stride = 5 * (6 - (top / 16 - 1)); /* multiple of 5, but less
@@ -851,15 +839,13 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 
         bn_flip_n_scatter5_t4(tmp.d, top, powerbuf, 0);
         bn_flip_n_scatter5_t4(am.d, top, powerbuf, 1);
-        if (!(*mul_worker) (tmp.d, am.d, am.d, np, n0) &&
-            !(*mul_worker) (tmp.d, am.d, am.d, np, n0))
+        if (!(*mul_worker)(tmp.d, am.d, am.d, np, n0) && !(*mul_worker)(tmp.d, am.d, am.d, np, n0))
             bn_mul_mont_vis3(tmp.d, am.d, am.d, np, n0, top);
         bn_flip_n_scatter5_t4(tmp.d, top, powerbuf, 2);
 
         for (i = 3; i < 32; i++) {
             /* Calculate a^i = a^(i-1) * a */
-            if (!(*mul_worker) (tmp.d, tmp.d, am.d, np, n0) &&
-                !(*mul_worker) (tmp.d, tmp.d, am.d, np, n0))
+            if (!(*mul_worker)(tmp.d, tmp.d, am.d, np, n0) && !(*mul_worker)(tmp.d, tmp.d, am.d, np, n0))
                 bn_mul_mont_vis3(tmp.d, tmp.d, am.d, np, n0, top);
             bn_flip_n_scatter5_t4(tmp.d, top, powerbuf, i);
         }
@@ -891,10 +877,10 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
             bits -= stride;
             wvalue = bn_get_bits(p, bits);
 
-            if ((*pwr5_worker) (tmp.d, np, n0, powerbuf, wvalue, stride))
+            if ((*pwr5_worker)(tmp.d, np, n0, powerbuf, wvalue, stride))
                 continue;
             /* retry once and fall back */
-            if ((*pwr5_worker) (tmp.d, np, n0, powerbuf, wvalue, stride))
+            if ((*pwr5_worker)(tmp.d, np, n0, powerbuf, wvalue, stride))
                 continue;
 
             bits += stride - 5;
@@ -906,7 +892,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
             bn_mul_mont_t4(tmp.d, tmp.d, tmp.d, np, n0, top);
             bn_mul_mont_t4(tmp.d, tmp.d, tmp.d, np, n0, top);
             bn_mul_mont_gather5_t4(tmp.d, tmp.d, powerbuf, np, n0, top,
-                                   wvalue);
+                wvalue);
         }
 
         bn_flip_t4(tmp.d, tmp.d, top);
@@ -918,7 +904,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     } else
 #endif
 #if defined(OPENSSL_BN_ASM_MONT5)
-    if (window == 5 && top > 1) {
+        if (window == 5 && top > 1) {
         /*
          * This optimization uses ideas from https://eprint.iacr.org/2011/239,
          * specifically optimization of cache-timing attack countermeasures,
@@ -936,15 +922,15 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
          * Given those inputs, |bn_mul_mont| may not give reduced
          * output, but it will still produce "almost" reduced output.
          */
-        void bn_mul_mont_gather5(BN_ULONG *rp, const BN_ULONG *ap,
-                                 const void *table, const BN_ULONG *np,
-                                 const BN_ULONG *n0, int num, int power);
+        void bn_mul_mont_gather5(BN_ULONG * rp, const BN_ULONG *ap,
+            const void *table, const BN_ULONG *np,
+            const BN_ULONG *n0, int num, int power);
         void bn_scatter5(const BN_ULONG *inp, size_t num,
-                         void *table, size_t power);
-        void bn_gather5(BN_ULONG *out, size_t num, void *table, size_t power);
-        void bn_power5(BN_ULONG *rp, const BN_ULONG *ap,
-                       const void *table, const BN_ULONG *np,
-                       const BN_ULONG *n0, int num, int power);
+            void *table, size_t power);
+        void bn_gather5(BN_ULONG * out, size_t num, void *table, size_t power);
+        void bn_power5(BN_ULONG * rp, const BN_ULONG *ap,
+            const void *table, const BN_ULONG *np,
+            const BN_ULONG *n0, int num, int power);
         int bn_get_bits5(const BN_ULONG *ap, int off);
 
         BN_ULONG *n0 = mont->n0, *np;
@@ -969,13 +955,13 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         bn_mul_mont(tmp.d, am.d, am.d, np, n0, top);
         bn_scatter5(tmp.d, top, powerbuf, 2);
 
-# if 0
+#if 0
         for (i = 3; i < 32; i++) {
             /* Calculate a^i = a^(i-1) * a */
             bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
             bn_scatter5(tmp.d, top, powerbuf, i);
         }
-# else
+#else
         /* same as above, but uses squaring for 1/2 of operations */
         for (i = 4; i < 32; i *= 2) {
             bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
@@ -1000,7 +986,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
             bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
             bn_scatter5(tmp.d, top, powerbuf, i);
         }
-# endif
+#endif
         /*
          * The exponent may not have a whole number of fixed-size windows.
          * To simplify the main loop, the initial window has between 1 and
@@ -1025,12 +1011,12 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                 bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
                 bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
                 bn_mul_mont_gather5(tmp.d, tmp.d, powerbuf, np, n0, top,
-                                    bn_get_bits5(p->d, bits -= 5));
+                    bn_get_bits5(p->d, bits -= 5));
             }
         } else {
             while (bits > 0) {
                 bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top,
-                          bn_get_bits5(p->d, bits -= 5));
+                    bn_get_bits5(p->d, bits -= 5));
             }
         }
 
@@ -1049,7 +1035,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     } else
 #endif
     {
- fallback:
+    fallback:
         if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, 0, window))
             goto err;
         if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&am, top, powerbuf, 1, window))
@@ -1065,14 +1051,14 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
             if (!bn_mul_mont_fixed_top(&tmp, &am, &am, mont, ctx))
                 goto err;
             if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, 2,
-                                              window))
+                    window))
                 goto err;
             for (i = 3; i < numPowers; i++) {
                 /* Calculate a^i = a^(i-1) * a */
                 if (!bn_mul_mont_fixed_top(&tmp, &am, &tmp, mont, ctx))
                     goto err;
                 if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, i,
-                                                  window))
+                        window))
                     goto err;
             }
         }
@@ -1088,7 +1074,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         bits -= window0;
         wvalue = bn_get_bits(p, bits) & wmask;
         if (!MOD_EXP_CTIME_COPY_FROM_PREBUF(&tmp, top, powerbuf, wvalue,
-                                            window))
+                window))
             goto err;
 
         wmask = (1 << window) - 1;
@@ -1119,7 +1105,7 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
              * Fetch the appropriate pre-computed value from the pre-buf
              */
             if (!MOD_EXP_CTIME_COPY_FROM_PREBUF(&am, top, powerbuf, wvalue,
-                                                window))
+                    window))
                 goto err;
 
             /* Multiply the result into the intermediate result */
@@ -1135,17 +1121,17 @@ int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
      */
 #if defined(SPARC_T4_MONT)
     if (OPENSSL_sparcv9cap_P[0] & (SPARCV9_VIS3 | SPARCV9_PREFER_FPU)) {
-        am.d[0] = 1;            /* borrow am */
+        am.d[0] = 1; /* borrow am */
         for (i = 1; i < top; i++)
             am.d[i] = 0;
         if (!BN_mod_mul_montgomery(rr, &tmp, &am, mont, ctx))
             goto err;
     } else
 #endif
-    if (!bn_from_mont_fixed_top(rr, &tmp, mont, ctx))
+        if (!bn_from_mont_fixed_top(rr, &tmp, mont, ctx))
         goto err;
     ret = 1;
- err:
+err:
     if (in_mont == NULL)
         BN_MONT_CTX_free(mont);
     if (powerbuf != NULL) {
@@ -1157,8 +1143,8 @@ int bn_mod_exp_mont_fixed