Bug 1251185, NSS clang-format: else line-break fixes, r=ttaubertNSS_3_23_BETA7

11 files changed, 159 insertions, 311 deletions

diff --git a/lib/certdb/alg1485.c b/lib/certdb/alg1485.c
index 9415531ed..e5e1f84be 100644
--- a/lib/certdb/alg1485.c
+++ b/lib/certdb/alg1485.c
@@ -261,8 +261,7 @@ scanVal(const char** pbp, const char* endptr, char* valBuf, int valBufSize)
         isQuoted = PR_TRUE;
         /* skip over it */
         bp++;
-    }
-    else {
+    } else {
         isQuoted = PR_FALSE;
     }
 
@@ -282,15 +281,12 @@ scanVal(const char** pbp, const char* endptr, char* valBuf, int valBufSize)
                 bp++;
                 c = (char)((x2b[(PRUint8)c] << 4) | x2b[(PRUint8)*bp]);
             }
-        }
-        else if (c == '#' && bp == *pbp) {
+        } else if (c == '#' && bp == *pbp) {
             /* ignore leading #, quotation not required for it. */
-        }
-        else if (!isQuoted && SPECIAL_CHAR(c)) {
+        } else if (!isQuoted && SPECIAL_CHAR(c)) {
             /* unescaped special and not within quoted value */
             break;
-        }
-        else if (c == C_DOUBLE_QUOTE) {
+        } else if (c == C_DOUBLE_QUOTE) {
             /* reached unescaped double quote */
             break;
         }
@@ -404,8 +400,7 @@ ParseRFC1485AVA(PLArenaPool* arena, const char** pbp, const char* endptr)
     /* is this a dotted decimal OID attribute type ? */
     if (!PL_strncasecmp("oid.", tagBuf, 4)) {
         rv = SEC_StringToOID(arena, &derOid, tagBuf, strlen(tagBuf));
-    }
-    else {
+    } else {
         for (n2k = name2kinds; n2k->name; n2k++) {
             SECOidData* oidrec;
             if (PORT_Strcasecmp(n2k->name, tagBuf) == 0) {
@@ -429,8 +424,7 @@ ParseRFC1485AVA(PLArenaPool* arena, const char** pbp, const char* endptr)
         if (rv)
             goto loser;
         a = CERT_CreateAVAFromRaw(arena, &derOid, &derVal);
-    }
-    else {
+    } else {
         if (kind == SEC_OID_UNKNOWN)
             goto loser;
         if (kind == SEC_OID_AVA_COUNTRY_NAME && valLen != 2)
@@ -483,8 +477,7 @@ ParseRFC1485Name(const char* buf, int len)
             if (rdn == 0)
                 goto loser;
             rv = CERT_AddRDN(name, rdn);
-        }
-        else {
+        } else {
             rv = CERT_AddAVA(name->arena, rdn, ava);
         }
         if (rv)
@@ -565,8 +558,7 @@ AppendStr(stringBuf* bufp, char* str)
         size = PR_MAX(DEFAULT_BUFFER_SIZE, bufSize * 2);
         buf = (char*)PORT_Alloc(size);
         bufp->size = size;
-    }
-    else if (bufp->size < bufSize) {
+    } else if (bufp->size < bufSize) {
         size = bufSize * 2;
         buf = (char*)PORT_Realloc(buf, size);
         bufp->size = size;
@@ -615,17 +607,14 @@ cert_RFC1485_GetRequiredLen(const char* src, int srclen, EQMode* pEQMode)
         reqLen++;
         if (NEEDS_HEX_ESCAPE(c)) { /* c -> \xx  */
             reqLen += 2;
-        }
-        else if (NEEDS_ESCAPE(c)) { /* c -> \c   */
+        } else if (NEEDS_ESCAPE(c)) { /* c -> \c   */
             reqLen++;
-        }
-        else if (SPECIAL_CHAR(c)) {
+        } else if (SPECIAL_CHAR(c)) {
             if (mode == minimalEscapeAndQuote) /* quoting is allowed */
                 needsQuoting = PR_TRUE;        /* entirety will need quoting */
             else if (mode == fullEscape)
                 reqLen++; /* MAY escape this character */
-        }
-        else if (OPTIONAL_SPACE(c) && OPTIONAL_SPACE(lastC)) {
+        } else if (OPTIONAL_SPACE(c) && OPTIONAL_SPACE(lastC)) {
             if (mode == minimalEscapeAndQuote) /* quoting is allowed */
                 needsQuoting = PR_TRUE;        /* entirety will need quoting */
         }
@@ -667,8 +656,7 @@ escapeAndQuote(char* dst, int dstlen, char* src, int srclen, EQMode* pEQMode)
             *dst++ = C_BACKSLASH;
             *dst++ = hexChars[(c >> 4) & 0x0f];
             *dst++ = hexChars[c & 0x0f];
-        }
-        else {
+        } else {
             if (NEEDS_ESCAPE(c) || (SPECIAL_CHAR(c) && mode == fullEscape)) {
                 *dst++ = C_BACKSLASH;
             }
@@ -766,13 +754,11 @@ CERT_GetOidString(const SECItem* oid)
                 PRUint32 two = n - (one * 40);
 
                 rvString = PR_smprintf("OID.%lu.%lu", one, two);
-            }
-            else {
+            } else {
                 prefix = rvString;
                 rvString = PR_smprintf("%s.%lu", prefix, n);
             }
-        }
-        else if (bytesBeforeLast <= 9U) { /* 29-64 bit number */
+        } else if (bytesBeforeLast <= 9U) { /* 29-64 bit number */
             PRUint64 n = 0;
             PRUint64 c;
 
@@ -798,13 +784,11 @@ CERT_GetOidString(const SECItem* oid)
                 PRUint64 two = n - (one * 40);
 
                 rvString = PR_smprintf("OID.%llu.%llu", one, two);
-            }
-            else {
+            } else {
                 prefix = rvString;
                 rvString = PR_smprintf("%s.%llu", prefix, n);
             }
-        }
-        else {
+        } else {
         /* More than a 64-bit number, or not minimal encoding. */
         unsupported:
             if (!rvString)
@@ -945,8 +929,7 @@ AppendAVA(stringBuf* bufp, CERTAVA* ava, CertStrictnessLevel strict)
 
     if (pn2k->kind != endKind) {
         n2k = *pn2k;
-    }
-    else if (strict != CERT_N2A_READABLE) {
+    } else if (strict != CERT_N2A_READABLE) {
         useHex = PR_TRUE;
     }
     /* For invertable form, force Directory Strings to use hex form. */
@@ -991,8 +974,7 @@ AppendAVA(stringBuf* bufp, CERTAVA* ava, CertStrictnessLevel strict)
     maxValue = valueLen;
     if (len <= sizeof(tmpBuf)) {
         encodedAVA = tmpBuf;
-    }
-    else if (strict != CERT_N2A_READABLE) {
+    } else if (strict != CERT_N2A_READABLE) {
         encodedAVA = PORT_Alloc(len);
         if (!encodedAVA) {
             SECITEM_FreeItem(avaValue, PR_TRUE);
@@ -1000,8 +982,7 @@ AppendAVA(stringBuf* bufp, CERTAVA* ava, CertStrictnessLevel strict)
                 PR_smprintf_free(unknownTag);
             return SECFailure;
         }
-    }
-    else {
+    } else {
         /* Must make output fit in tmpbuf */
         unsigned int fair = (sizeof tmpBuf) / 2 - 1; /* for = and \0 */
 
@@ -1009,12 +990,10 @@ AppendAVA(stringBuf* bufp, CERTAVA* ava, CertStrictnessLevel strict)
             /* just truncate the value */
             maxValue = (sizeof tmpBuf) - (nameLen + 6); /* for "=...\0",
                                                      and possibly '"' */
-        }
-        else if (valueLen < fair) {
+        } else if (valueLen < fair) {
             /* just truncate the name */
             maxName = (sizeof tmpBuf) - (valueLen + 5); /* for "=...\0" */
-        }
-        else {
+        } else {
             /* truncate both */
             maxName = maxValue = fair - 3; /* for "..." */
         }
@@ -1056,12 +1035,10 @@ AppendAVA(stringBuf* bufp, CERTAVA* ava, CertStrictnessLevel strict)
             end[-3] = '.';
         }
         rv = SECSuccess;
-    }
-    else if (!truncateValue) {
+    } else if (!truncateValue) {
         rv = escapeAndQuote(encodedAVA + nameLen, len - nameLen,
                             (char*)avaValue->data, avaValue->len, &mode);
-    }
-    else {
+    } else {
         /* must truncate the escaped and quoted value */
         char bigTmpBuf[TMPBUF_LEN * 3 + 3];
         PORT_Assert(valueLen < sizeof tmpBuf);
@@ -1136,8 +1113,7 @@ CERT_NameToAsciiInvertible(CERTName* name, CertStrictnessLevel strict)
                 rv = AppendStr(&strBuf, newRDN ? "," : "+");
                 if (rv)
                     goto loser;
-            }
-            else {
+            } else {
                 first = PR_FALSE;
             }
 
@@ -1211,8 +1187,7 @@ avaToString(PLArenaPool* arena, CERTAVA* ava)
         cert_RFC1485_GetRequiredLen((char*)avaValue->data, avaValue->len, NULL) + 1;
     if (arena) {
         buf = (char*)PORT_ArenaZAlloc(arena, valueLen);
-    }
-    else {
+    } else {
         buf = (char*)PORT_ZAlloc(valueLen);
     }
     if (buf) {
@@ -1321,8 +1296,7 @@ CERT_GetCertificateEmailAddress(CERTCertificate* cert)
                             CERT_GetNameElement(cert->arena, &(current->name.directoryName),
                                                 SEC_OID_RFC1274_MAIL);
                     }
-                }
-                else if (current->type == certRFC822Name) {
+                } else if (current->type == certRFC822Name) {
                     rawEmailAddr =
                         (char*)PORT_ArenaZAlloc(cert->arena, current->name.other.len +
                                                                  1);
@@ -1402,8 +1376,7 @@ appendItemToBuf(char* dest, SECItem* src, PRUint32* pRemaining)
                         hexChars[(c >> 4) & 0x0f];
                     *dest++ =
                         hexChars[c & 0x0f];
-                }
-                else {
+                } else {
                     *dest++ =
                         tolower(c);
                 }
@@ -1471,8 +1444,7 @@ cert_GetCertificateEmailAddresses(CERTCertificate* cert)
                             tmpArena, &current->name.directoryName, SEC_OID_RFC1274_MAIL);
                     pBuf =
                         appendStringToBuf(pBuf, rawEmailAddr, &maxLen);
-                }
-                else if (current->type == certRFC822Name) {
+                } else if (current->type == certRFC822Name) {
                     pBuf =
                         appendItemToBuf(pBuf, &current->name.other, &maxLen);
                 }
diff --git a/lib/certdb/certdb.c b/lib/certdb/certdb.c
index 086728963..80b83ed43 100644
--- a/lib/certdb/certdb.c
+++ b/lib/certdb/certdb.c
@@ -400,8 +400,7 @@ GetKeyUsage(CERTCertificate *cert)
 
         PORT_Free(tmpitem.data);
         tmpitem.data = NULL;
-    }
-    else {
+    } else {
         /* if the extension is not present, then we allow all uses */
         cert->keyUsage = KU_ALL;
         cert->rawKeyUsage = KU_ALL;
@@ -483,8 +482,7 @@ cert_ComputeCertType(CERTCertificate *cert)
     if (tmpitem.data != NULL || extKeyUsage != NULL) {
         if (tmpitem.data == NULL) {
             nsCertType = 0;
-        }
-        else {
+        } else {
             nsCertType = tmpitem.data[0];
         }
 
@@ -517,8 +515,7 @@ cert_ComputeCertType(CERTCertificate *cert)
             SECSuccess) {
             if (basicConstraintPresent == PR_TRUE && (basicConstraint.isCA)) {
                 nsCertType |= NS_CERT_TYPE_EMAIL_CA;
-            }
-            else {
+            } else {
                 nsCertType |= NS_CERT_TYPE_EMAIL;
             }
         }
@@ -526,8 +523,7 @@ cert_ComputeCertType(CERTCertificate *cert)
                 extKeyUsage, SEC_OID_EXT_KEY_USAGE_SERVER_AUTH) == SECSuccess) {
             if (basicConstraintPresent == PR_TRUE && (basicConstraint.isCA)) {
                 nsCertType |= NS_CERT_TYPE_SSL_CA;
-            }
-            else {
+            } else {
                 nsCertType |= NS_CERT_TYPE_SSL_SERVER;
             }
         }
@@ -540,8 +536,7 @@ cert_ComputeCertType(CERTCertificate *cert)
             SECSuccess) {
             if (basicConstraintPresent == PR_TRUE && (basicConstraint.isCA)) {
                 nsCertType |= NS_CERT_TYPE_SSL_CA;
-            }
-            else {
+            } else {
                 nsCertType |= NS_CERT_TYPE_SSL_SERVER;
             }
         }
@@ -549,8 +544,7 @@ cert_ComputeCertType(CERTCertificate *cert)
                 extKeyUsage, SEC_OID_EXT_KEY_USAGE_CLIENT_AUTH) == SECSuccess) {
             if (basicConstraintPresent == PR_TRUE && (basicConstraint.isCA)) {
                 nsCertType |= NS_CERT_TYPE_SSL_CA;
-            }
-            else {
+            } else {
                 nsCertType |= NS_CERT_TYPE_SSL_CLIENT;
             }
         }
@@ -558,8 +552,7 @@ cert_ComputeCertType(CERTCertificate *cert)
                 extKeyUsage, SEC_OID_EXT_KEY_USAGE_CODE_SIGN) == SECSuccess) {
             if (basicConstraintPresent == PR_TRUE && (basicConstraint.isCA)) {
                 nsCertType |= NS_CERT_TYPE_OBJECT_SIGNING_CA;
-            }
-            else {
+            } else {
                 nsCertType |= NS_CERT_TYPE_OBJECT_SIGNING;
             }
         }
@@ -571,8 +564,7 @@ cert_ComputeCertType(CERTCertificate *cert)
             SECSuccess) {
             nsCertType |= EXT_KEY_USAGE_STATUS_RESPONDER;
         }
-    }
-    else {
+    } else {
         /* If no NS Cert Type extension and no EKU extension, then */
         nsCertType = 0;
         if (CERT_IsCACert(cert, &nsCertType))
@@ -674,8 +666,7 @@ cert_IsRootCert(CERTCertificate *cert)
                 PORT_Free(tmpitem.data);
                 if (!match)
                     return PR_FALSE; /* else fall through */
-            }
-            else {
+            } else {
                 /* the subject key ID is required when AKI is present */
                 return PR_FALSE;
             }
@@ -743,8 +734,7 @@ CERT_DecodeDERCertificate(SECItem *derSignedCert, PRBool copyDER,
         cert->derCert.data = (unsigned char *)data;
         cert->derCert.len = derSignedCert->len;
         PORT_Memcpy(data, derSignedCert->data, derSignedCert->len);
-    }
-    else {
+    } else {
         /* point to passed in DER data */
         cert->derCert = *derSignedCert;
     }
@@ -771,8 +761,7 @@ CERT_DecodeDERCertificate(SECItem *derSignedCert, PRBool copyDER,
     /* set the nickname */
     if (nickname == NULL) {
         cert->nickname = NULL;
-    }
-    else {
+    } else {
         /* copy and install the nickname */
         len = PORT_Strlen(nickname) + 1;
         cert->nickname = (char *)PORT_ArenaAlloc(arena, len);
@@ -1007,8 +996,7 @@ SEC_GetCrlTimes(CERTCrl *date, PRTime *notBefore, PRTime *notAfter)
         if (rv) {
             return (SECFailure);
         }
-    }
-    else {
+    } else {
         LL_I2L(*notAfter, 0L);
     }
     return (SECSuccess);
@@ -1132,8 +1120,7 @@ CERT_KeyUsageAndTypeForCertUsage(SECCertUsage usage, PRBool ca,
                 PORT_Assert(0);
                 goto loser;
         }
-    }
-    else {
+    } else {
         switch (usage) {
             case certUsageSSLClient:
                 /*
@@ -1356,15 +1343,13 @@ cert_TestHostName(char *cn, const char *hn)
 
             if (match == 0) {
                 rv = SECSuccess;
-            }
-            else {
+            } else {
                 PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
                 rv = SECFailure;
             }
             return rv;
         }
-    }
-    else {
+    } else {
         /* New approach conforms to RFC 6125. */
         char *wildcard = PORT_Strchr(cn, '*');
         char *firstcndot = PORT_Strchr(cn, '.');
@@ -1379,9 +1364,8 @@ cert_TestHostName(char *cn, const char *hn)
          * - must not be preceded by an IDNA ACE prefix (xn--)
          */
         if (wildcard && secondcndot && secondcndot[1] && firsthndot &&
-            firstcndot - wildcard ==
-                1 /* wildcard is last char in first component */
-            && secondcndot - firstcndot > 1 /* second component is non-empty */
+            firstcndot - wildcard == 1           /* wildcard is last char in first component */
+            && secondcndot - firstcndot > 1      /* second component is non-empty */
             && PORT_Strrchr(cn, '*') == wildcard /* only one wildcard in cn */
             && !PORT_Strncasecmp(cn, hn, wildcard - cn) &&
             !PORT_Strcasecmp(firstcndot, firsthndot)
@@ -1473,23 +1457,20 @@ cert_VerifySubjectAltName(const CERTCertificate *cert, const char *hn)
                         netAddr.inet.family == PR_AF_INET) {
                         match = !memcmp(&netAddr.inet.ip,
                                         current->name.other.data, 4);
-                    }
-                    else if (current->name.other.len ==
-                                 16 && /* IP v6 address */
-                             netAddr.ipv6.family == PR_AF_INET6) {
+                    } else if (current->name.other.len ==
+                                   16 && /* IP v6 address */
+                               netAddr.ipv6.family == PR_AF_INET6) {
                         match = !memcmp(&netAddr.ipv6.ip,
                                         current->name.other.data, 16);
-                    }
-                    else if (current->name.other.len ==
-                                 16 && /* IP v6 address */
-                             netAddr.inet.family == PR_AF_INET) {
+                    } else if (current->name.other.len ==
+                                   16 && /* IP v6 address */
+                               netAddr.inet.family == PR_AF_INET) {
                         /* convert netAddr to ipv6, then compare. */
                         /* ipv4 must be in Network Byte Order on input. */
                         PR_ConvertIPv4AddrToIPv6(netAddr.inet.ip, &v6Addr);
                         match = !memcmp(&v6Addr, current->name.other.data, 16);
-                    }
-                    else if (current->name.other.len == 4 && /* IP v4 address */
-                             netAddr.inet.family == PR_AF_INET6) {
+                    } else if (current->name.other.len == 4 && /* IP v4 address */
+                               netAddr.inet.family == PR_AF_INET6) {
                         /* convert netAddr to ipv6, then compare. */
                         PRUint32 ipv4 = (current->name.other.data[0] << 24) |
                                         (current->name.other.data[1] << 16) |
@@ -1517,8 +1498,7 @@ fail:
     if (!(isIPaddr ? IPextCount : DNSextCount)) {
         /* no relevant value in the extension was found. */
         PORT_SetError(SEC_ERROR_EXTENSION_NOT_FOUND);
-    }
-    else {
+    } else {
         PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
     }
     rv = SECFailure;
@@ -1648,8 +1628,7 @@ cert_GetDNSPatternsFromGeneralNames(CERTGeneralName *firstName,
                     addr.inet.family = PR_AF_INET;
                     memcpy(&addr.inet.ip, currentInput->name.other.data,
                            currentInput->name.other.len);
-                }
-                else if (currentInput->name.other.len == 16) {
+                } else if (currentInput->name.other.len == 16) {
                     addr.ipv6.family = PR_AF_INET6;
                     memcpy(&addr.ipv6.ip, currentInput->name.other.data,
                            currentInput->name.other.len);
@@ -1787,18 +1766,15 @@ CERT_VerifyCertName(const CERTCertificate *cert, const char *hn)
         if (isIPaddr) {
             if (PORT_Strcasecmp(hn, cn) == 0) {
                 rv = SECSuccess;
-            }
-            else {
+            } else {
                 PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
                 rv = SECFailure;
             }
-        }
-        else {
+        } else {
             rv = cert_TestHostName(cn, hn);
         }
         PORT_Free(cn);
-    }
-    else
+    } else
         PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
     return rv;
 }
@@ -1811,8 +1787,7 @@ CERT_CompareCerts(const CERTCertificate *c1, const CERTCertificate *c2)
     comp = SECITEM_CompareItem(&c1->derCert, &c2->derCert);
     if (comp == SECEqual) { /* certs are the same */
         return (PR_TRUE);
-    }
-    else {
+    } else {
         return (PR_FALSE);
     }
 }
@@ -1966,8 +1941,7 @@ CERT_MakeCANickname(CERTCertificate *cert)
             if (firstname) {
                 org = firstname;
                 firstname = NULL;
-            }
-            else {
+            } else {
                 org = PORT_Strdup("Unknown CA");
             }
         }
@@ -1985,16 +1959,13 @@ CERT_MakeCANickname(CERTCertificate *cert)
         if (firstname) {
             if (count == 1) {
                 nickname = PR_smprintf("%s - %s", firstname, org);
-            }
-            else {
+            } else {
                 nickname = PR_smprintf("%s - %s #%d", firstname, org, count);
             }
-        }
-        else {
+        } else {
             if (count == 1) {
                 nickname = PR_smprintf("%s", org);
-            }
-            else {
+            } else {
                 nickname = PR_smprintf("%s #%d", org, count);
             }
         }
@@ -2104,8 +2075,7 @@ CERT_IsCACert(CERTCertificate *cert, unsigned int *rettype)
     if (cType & (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA |
                  NS_CERT_TYPE_OBJECT_SIGNING_CA)) {
         ret = PR_TRUE;
-    }
-    else {
+    } else {
         SECStatus rv;
         CERTBasicConstraints constraints;
 
@@ -2254,8 +2224,7 @@ CERT_IsNewer(CERTCertificate *certa, CERTCertificate *certb)
             return (PR_FALSE);
         }
         return (PR_TRUE);
-    }
-    else {
+    } else {
         /* cert B was issued after cert A, but expires sooner */
         /* if B is expired, then pick A */
         if (LL_CMP(notAfterB, <, now)) {
@@ -2371,8 +2340,7 @@ CERT_DecodeTrustString(CERTCertTrust *trust, const char *trusts)
             case ',':
                 if (pflags == &trust->sslFlags) {
                     pflags = &trust->emailFlags;
-                }
-                else {
+                } else {
                     pflags = &trust->objectSigningFlags;
                 }
                 break;
@@ -2489,8 +2457,7 @@ CERT_ImportCerts(CERTCertDBHandle *certdb, SECCertUsage usage,
                      */
                     /* Bug 1192442 - propagate errors from these calls. */
                     (void)CERT_AddTempCertToPerm(certs[i], canickname, NULL);
-                }
-                else {
+                } else {
                     (void)CERT_AddTempCertToPerm(
                         certs[i], nickname ? nickname : canickname, NULL);
                 }
@@ -2503,8 +2470,7 @@ CERT_ImportCerts(CERTCertDBHandle *certdb, SECCertUsage usage,
 
     if (retCerts) {
         *retCerts = certs;
-    }
-    else {
+    } else {
         if (certs) {
             CERT_DestroyCertArray(certs, fcerts);
         }
@@ -2700,8 +2666,7 @@ CERT_SortCBValidity(CERTCertificate *certa, CERTCertificate *certb, void *arg)
     if (newerbefore) {
         /* cert A was issued after cert B, but expires sooner */
         return (PR_TRUE);
-    }
-    else {
+    } else {
         /* cert B was issued after cert A, but expires sooner */
         return (PR_FALSE);
     }
@@ -2800,8 +2765,7 @@ CERT_FilterCertListByUsage(CERTCertList *certList, SECCertUsage usage,
                  * fix the cert decoding code to do this.
                  */
                 (void)CERT_IsCACert(node->cert, &certType);
-            }
-            else {
+            } else {
                 certType = node->cert->nsCertType;
             }
             if (!(certType & requiredCertType)) {
@@ -2814,8 +2778,7 @@ CERT_FilterCertListByUsage(CERTCertList *certList, SECCertUsage usage,
             savenode = CERT_LIST_NEXT(node);
             CERT_RemoveCertListNode(node);
             node = savenode;
-        }
-        else {
+        } else {
             node = CERT_LIST_NEXT(node);
         }
     }
@@ -2836,8 +2799,7 @@ CERT_IsUserCert(CERTCertificate *cert)
         ((trust.sslFlags & CERTDB_USER) || (trust.emailFlags & CERTDB_USER) ||
          (trust.objectSigningFlags & CERTDB_USER))) {
         return PR_TRUE;
-    }
-    else {
+    } else {
         return PR_FALSE;
     }
 }
@@ -2861,8 +2823,7 @@ CERT_FilterCertListForUserCerts(CERTCertList *certList)
             freenode = node;
             node = CERT_LIST_NEXT(node);
             CERT_RemoveCertListNode(freenode);
-        }
-        else {
+        } else {
             /* Is a User cert, so leave it in the list */
             node = CERT_LIST_NEXT(node);
         }
@@ -2954,8 +2915,7 @@ cert_DestroyLocks(void)
     if (certRefCountLock) {
         PZ_DestroyLock(certRefCountLock);
         certRefCountLock = NULL;
-    }
-    else {
+    } else {
         rv = SECFailure;
     }
 
@@ -2963,8 +2923,7 @@ cert_DestroyLocks(void)
     if (certTrustLock) {
         PZ_DestroyLock(certTrustLock);
         certTrustLock = NULL;
-    }
-    else {
+    } else {
         rv = SECFailure;
     }
     return rv;
diff --git a/lib/certdb/certv3.c b/lib/certdb/certv3.c
index da4bb270e..4918ec163 100644
--- a/lib/certdb/certv3.c
+++ b/lib/certdb/certv3.c
@@ -138,8 +138,7 @@ CERT_FindSubjectKeyIDExtension(CERTCertificate *cert, SECItem *retItem)
                 rv = SECITEM_CopyItem(NULL, retItem, &decodedValue);
             }
             PORT_FreeArena(tmpArena, PR_FALSE);
-        }
-        else {
+        } else {
             rv = SECFailure;
         }
     }
@@ -217,8 +216,7 @@ CERT_CheckCertUsage(CERTCertificate *cert, unsigned char usage)
     if (rv == SECFailure) {
         rv = (PORT_GetError() == SEC_ERROR_EXTENSION_NOT_FOUND) ? SECSuccess
                                                                 : SECFailure;
-    }
-    else if (!(keyUsage.data[0] & usage)) {
+    } else if (!(keyUsage.data[0] & usage)) {
         PORT_SetError(SEC_ERROR_CERT_USAGES_INVALID);
         rv = SECFailure;
     }
diff --git a/lib/certdb/certxutl.c b/lib/certdb/certxutl.c
index 81070f3a3..1610da216 100644
--- a/lib/certdb/certxutl.c
+++ b/lib/certdb/certxutl.c
@@ -202,8 +202,7 @@ CERT_AddExtensionByOID(void *exthandle, SECItem *oid, SECItem *value,
         if (rv) {
             return (SECFailure);
         }
-    }
-    else {
+    } else {
         ext->value = *value;
     }
 
@@ -362,8 +361,7 @@ CERT_MergeExtensions(void *exthandle, CERTCertExtension **extensions)
             if (tag == 0) {
                 if (SECITEM_ItemsAreEqual(&ext->id, &node->ext->id))
                     break;
-            }
-            else {
+            } else {
                 if (SECOID_FindOIDTag(&node->ext->id) == tag) {
                     break;
                 }
diff --git a/lib/certdb/crl.c b/lib/certdb/crl.c
index d8fbe04a0..a7baf53bb 100644
--- a/lib/certdb/crl.c
+++ b/lib/certdb/crl.c
@@ -274,8 +274,7 @@ CERT_KeyFromDERCrl(PLArenaPool* arena, SECItem* derCrl, SECItem* key)
     if (!arena) {
         /* arena needed for QuickDER */
         myArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
-    }
-    else {
+    } else {
         myArena = arena;
     }
     PORT_Memset(&sd, 0, sizeof(sd));
@@ -311,8 +310,7 @@ CERT_CompleteCRLDecodeEntries(CERTSignedCrl* crl)
     if ((!crl) || (!(extended = (OpaqueCRLFields*)crl->opaque)) ||
         (PR_TRUE == extended->decodingError)) {
         rv = SECFailure;
-    }
-    else {
+    } else {
         if (PR_FALSE == extended->partial) {
             /* the CRL has already been fully decoded */
             return SECSuccess;
@@ -333,8 +331,7 @@ CERT_CompleteCRLDecodeEntries(CERTSignedCrl* crl)
         if (SECSuccess == rv) {
             extended->partial = PR_FALSE; /* successful decode, avoid
                 decoding again */
-        }
-        else {
+        } else {
             extended->decodingError = PR_TRUE;
             extended->badEntries = PR_TRUE;
             /* cache the decoding failure. If it fails the first time,
@@ -387,8 +384,7 @@ CERT_DecodeDERCrlWithFlags(PLArenaPool* narena, SECItem* derSignedCrl, int type,
         if (!arena) {
             return NULL;
         }
-    }
-    else {
+    } else {
         arena = narena;
     }
 
@@ -414,8 +410,7 @@ CERT_DecodeDERCrlWithFlags(PLArenaPool* narena, SECItem* derSignedCrl, int type,
         crl->derCrl = derSignedCrl; /* DER is not copied . The application
                                        must keep derSignedCrl until it
                                        destroys the CRL */
-    }
-    else {
+    } else {
         crl->derCrl = (SECItem*)PORT_ArenaZAlloc(arena, sizeof(SECItem));
         if (crl->derCrl == NULL) {
             goto loser;
@@ -561,8 +556,7 @@ SEC_FindCrlByKeyOnSlot(PK11SlotInfo* slot, SECItem* crlKey, int type,
         if (url) {
             crl->url = PORT_ArenaStrdup(crl->arena, url);
         }
-    }
-    else {
+    } else {
         rv = SECFailure;
     }
 
@@ -735,8 +729,7 @@ SEC_DestroyCrl(CERTSignedCrl* crl)
             }
         }
         return SECSuccess;
-    }
-    else {
+    } else {
         return SECFailure;
     }
 }
@@ -1015,15 +1008,13 @@ InitCRLCache(void)
         }
         crlcache_initialized = PR_TRUE;
         return SECSuccess;
-    }
-    else {
+    } else {
         PORT_Assert(crlcache.lock);
         PORT_Assert(crlcache.issuers);
         if ((NULL == crlcache.lock) || (NULL == crlcache.issuers)) {
             /* CRL cache not fully initialized */
             return SECFailure;
-        }
-        else {
+        } else {
             /* CRL cache already initialized */
             return SECSuccess;
         }
@@ -1047,8 +1038,7 @@ DPCache_Destroy(CRLDPCache* cache)
 #else
         PR_DestroyLock(cache->lock);
 #endif
-    }
-    else {
+    } else {
         PORT_Assert(0);
         return SECFailure;
     }
@@ -1092,8 +1082,7 @@ IssuerCache_Destroy(CRLIssuerCache* cache)
 #ifdef XCRL
     if (cache->lock) {
         NSSRWLock_Destroy(cache->lock);
-    }
-    else {
+    } else {
         PORT_Assert(0);
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
@@ -1407,7 +1396,7 @@ TokenCRLStillExists(CERTSignedCrl* crl)
     }
 
     status =
-        nssCryptokiCRL_GetAttributes(&instance, NULL, /* XXX sessionOpt */
+        nssCryptokiCRL_GetAttributes(&instance, NULL,          /* XXX sessionOpt */
                                      arena, NULL, &newsubject, /* subject */
                                      &crl_class,               /* class */
                                      NULL, NULL);
@@ -1420,8 +1409,7 @@ TokenCRLStillExists(CERTSignedCrl* crl)
         if (CKO_NETSCAPE_CRL != crl_class) {
             xstatus = PR_FALSE;
         }
-    }
-    else {
+    } else {
         xstatus = PR_FALSE;
     }
     NSSArena_Destroy(arena);
@@ -1464,8 +1452,7 @@ CachedCrl_Verify(CRLDPCache* cache, CachedCrl* crlobject, PRTime vfdate,
             with bogus DER. Mark it checked so we won't try again */
         PORT_SetError(SEC_ERROR_BAD_DER);
         return SECSuccess;
-    }
-    else {
+    } else {
         SECStatus signstatus = SECFailure;
         if (cache->issuerDERCert) {
             CERTCertificate* issuer = CERT_NewTempCertificate(
@@ -1484,14 +1471,12 @@ CachedCrl_Verify(CRLDPCache* cache, CachedCrl* crlobject, PRTime vfdate,
                    So, we don't cache this verification failure. We'll try
                    to verify the CRL again when a certificate from that issuer
                    becomes available */
-            }
-            else {
+            } else {
                 crlobject->sigChecked = PR_TRUE;
             }
             PORT_SetError(SEC_ERROR_CRL_BAD_SIGNATURE);
             return SECSuccess;
-        }
-        else {
+        } else {
             crlobject->sigChecked = PR_TRUE;
             crlobject->sigValid = PR_TRUE;
         }
@@ -1522,8 +1507,7 @@ DPCache_FetchFromTokens(CRLDPCache* cache, PRTime vfdate, void* wincx)
     if (SECFailure == rv) {
         /* fetch failed, add error bit */
         cache->invalid |= CRL_CACHE_LAST_FETCH_FAILED;
-    }
-    else {
+    } else {
         /* fetch was successful, clear this error bit */
         cache->invalid &= (~CRL_CACHE_LAST_FETCH_FAILED);
     }
@@ -1546,12 +1530,10 @@ DPCache_FetchFromTokens(CRLDPCache* cache, PRTime vfdate, void* wincx)
                 if (PR_TRUE != added) {
                     rv = CachedCrl_Destroy(returned);
                     returned = NULL;
-                }
-                else if (vfdate) {
+                } else if (vfdate) {
                     rv = CachedCrl_Verify(cache, returned, vfdate, wincx);
                 }
-            }
-            else {
+            } else {
                 /* not enough memory to add the CRL to the cache. mark it
                    invalid so we will try again . */
                 cache->invalid |= CRL_CACHE_LAST_FETCH_FAILED;
@@ -1595,8 +1577,7 @@ CachedCrl_GetEntry(CachedCrl* crl, const SECItem* sn, CERTCrlEntry** returned)
     acrlEntry = PL_HashTableLookup(crl->entries, (void*)sn);
     if (acrlEntry) {
         *returned = acrlEntry;
-    }
-    else {
+    } else {
         *returned = NULL;
     }
     return SECSuccess;
@@ -1626,12 +1607,10 @@ DPCache_Lookup(CRLDPCache* cache, const SECItem* sn, CERTCrlEntry** returned)
     rv = CachedCrl_GetEntry(cache->selected, sn, returned);
     if (SECSuccess != rv) {
         return dpcacheLookupError;
-    }
-    else {
+    } else {
         if (*returned) {
             return dpcacheFoundEntry;
-        }
-        else {
+        } else {
             return dpcacheNoEntry;
         }
     }
@@ -1908,8 +1887,7 @@ SortImperfectCRLs(const void* arg1, const void* arg2)
     if (!a || !b) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         PORT_Assert(0);
-    }
-    else {
+    } else {
         PRBool aDecoded = PR_FALSE, bDecoded = PR_FALSE;
         if ((PR_TRUE == a->sigValid) && (PR_TRUE == b->sigValid)) {
             /* both CRLs have been validated, choose the latest one */
@@ -1966,8 +1944,7 @@ DPCache_SelectCRL(CRLDPCache* cache)
     if (PR_TRUE == valid) {
         /* all CRLs are valid, clear this error */
         cache->invalid &= (~CRL_CACHE_INVALID_CRLS);
-    }
-    else {
+    } else {
         /* some CRLs are invalid, set this error */
         cache->invalid |= CRL_CACHE_INVALID_CRLS;
     }
@@ -2098,8 +2075,7 @@ IssuerCache_AddDP(CRLIssuerCache* cache, CERTCertificate* issuer,
             *newdpc = cache->dpp;
             return SECSuccess;
         }
-    }
-    else {
+    } else {
         /* we should never hit this until we support multiple DPs */
         PORT_Assert(dp);
         /* XCRL allocate a new distribution point cache object, initialize it,
@@ -2294,8 +2270,7 @@ AcquireDPCache(CERTCertificate* issuer, const SECItem* subject,
                     rv = SECFailure;
                 }
 #ifdef GLOBAL_RWLOCK
-            }
-            else {
+            } else {
                 /* somebody else updated before we did */
                 IssuerCache_Destroy(issuercache); /* destroy the new object */
                 issuercache = existing;           /* use the existing one */
@@ -2310,8 +2285,7 @@ AcquireDPCache(CERTCertificate* issuer, const SECItem* subject,
         if (PR_TRUE == globalwrite) {
             NSSRWLock_UnlockWrite(crlcache.lock);
             globalwrite = PR_FALSE;
-        }
-        else {
+        } else {
             NSSRWLock_UnlockRead(crlcache.lock);
         }
 #else
@@ -2334,8 +2308,7 @@ AcquireDPCache(CERTCertificate* issuer, const SECItem* subject,
         if (SECSuccess != rv) {
             return SECFailure;
         }
-    }
-    else {
+    } else {
 #ifdef GLOBAL_RWLOCK
         NSSRWLock_UnlockRead(crlcache.lock);
 #else
@@ -2360,8 +2333,7 @@ AcquireDPCache(CERTCertificate* issuer, const SECItem* subject,
             /* make sure the DP cache is up to date before using it */
             rv = DPCache_GetUpToDate(*dpcache, issuer, PR_FALSE == *writeLocked,
                                      t, wincx);
-        }
-        else {
+        } else {
             rv = SECFailure;
         }
     }
@@ -2379,8 +2351,7 @@ ReleaseDPCache(CRLDPCache* dpcache, PRBool writeLocked)
 #ifdef DPC_RWLOCK
     if (PR_TRUE == writeLocked) {
         NSSRWLock_UnlockWrite(dpcache->lock);
-    }
-    else {
+    } else {
         NSSRWLock_UnlockRead(dpcache->lock);
     }
 #else
@@ -2446,18 +2417,15 @@ cert_CheckCertRevocationStatus(CERTCertificate* cert, CERTCertificate* issuer,
                        is past the revocation date */
                     if (t >= revocationDate) {
                         rv = SECFailure;
-                    }
-                    else {
+                    } else {
                         status = certRevocationStatusValid;
                     }
-                }
-                else {
+                } else {
                     /* invalid revocation date, consider the certificate
                        permanently revoked */
                     rv = SECFailure;
                 }
-            }
-            else {
+            } else {
                 /* no revocation date, certificate is permanently revoked */
                 rv = SECFailure;
             }
@@ -2761,8 +2729,7 @@ addCRLToCache(CERTCertDBHandle* dbhandle, SECItem* crl,
     if (SECSuccess == CERT_CacheCRL(dbhandle, entry->crl)) {
         entry->inCRLCache = PR_TRUE;
         entry->successfulInsertionTime = entry->lastAttemptTime;
-    }
-    else {
+    } else {
         switch (PR_GetError()) {
             case SEC_ERROR_CRL_ALREADY_EXISTS:
                 entry->dupe = PR_TRUE;
@@ -2829,8 +2796,7 @@ cert_CacheCRLByGeneralName(CERTCertDBHandle* dbhandle, SECItem* crl,
                 NamedCRLCacheEntry_Destroy(newEntry);
                 rv = SECFailure;
             }
-        }
-        else {
+        } else {
             PRBool removed;
             /* remove the old CRL from the cache if needed */
             if (oldEntry->inCRLCache) {
@@ -2844,8 +2810,7 @@ cert_CacheCRLByGeneralName(CERTCertDBHandle* dbhandle, SECItem* crl,
                 rv = SECFailure;
                 /* leak old entry since we couldn't remove it from the hash
                  * table */
-            }
-            else {
+            } else {
                 PORT_CheckSuccess(NamedCRLCacheEntry_Destroy(oldEntry));
             }
             if (NULL == PL_HashTableAdd(namedCRLCache.entries,
@@ -2855,8 +2820,7 @@ cert_CacheCRLByGeneralName(CERTCertDBHandle* dbhandle, SECItem* crl,
                 rv = SECFailure;
             }
         }
-    }
-    else {
+    } else {
         /* error adding new CRL to cache */
         if (!oldEntry) {
             /* no old cache entry, use the new one even though it's bad */
@@ -2866,16 +2830,14 @@ cert_CacheCRLByGeneralName(CERTCertDBHandle* dbhandle, SECItem* crl,
                 PORT_Assert(0);
                 rv = SECFailure;
             }
-        }
-        else {
+        } else {
             if (oldEntry->inCRLCache) {
                 /* previous cache entry was good, keep it and update time */
                 oldEntry->lastAttemptTime = newEntry->lastAttemptTime;
                 /* throw away new bad entry */
                 rv = NamedCRLCacheEntry_Destroy(newEntry);
                 PORT_Assert(SECSuccess == rv);
-            }
-            else {
+            } else {
                 /* previous cache entry was bad, just replace it */
                 PRBool removed = PL_HashTableRemove(
                     namedCRLCache.entries, (void*)oldEntry->canonicalizedName);
@@ -2884,8 +2846,7 @@ cert_CacheCRLByGeneralName(CERTCertDBHandle* dbhandle, SECItem* crl,
                     /* leak old entry since we couldn't remove it from the hash
                      * table */
                     rv = SECFailure;
-                }
-                else {
+                } else {
                     PORT_CheckSuccess(NamedCRLCacheEntry_Destroy(oldEntry));
                 }
                 if (NULL == PL_HashTableAdd(namedCRLCache.entries,
@@ -3064,8 +3025,7 @@ CachedCrl_Compare(CachedCrl* a, CachedCrl* b, PRBool* isDupe, PRBool* isUpdated)
             if (SECEqual ==
                 SECITEM_CompareItem(b->crl->derCrl, a->crl->derCrl)) {
                 *isDupe = PR_TRUE;
-            }
-            else {
+            } else {
                 *isUpdated = PR_TRUE;
             }
         }
diff --git a/lib/certdb/genname.c b/lib/certdb/genname.c
index 8e679415e..fe48df839 100644
--- a/lib/certdb/genname.c
+++ b/lib/certdb/genname.c
@@ -199,8 +199,7 @@ cert_CopyOneGeneralName(PLArenaPool *arena, CERTGeneralName *dest,
     }
     if (rv != SECSuccess) {
         PORT_ArenaRelease(arena, mark);
-    }
-    else {
+    } else {
         PORT_ArenaUnmark(arena, mark);
     }
     return rv;
@@ -218,8 +217,7 @@ CERT_DestroyGeneralNameList(CERTGeneralNameList *list)
             PORT_FreeArena(list->arena, PR_FALSE);
             PZ_Unlock(lock);
             PZ_DestroyLock(lock);
-        }
-        else {
+        } else {
             PZ_Unlock(lock);
         }
     }
@@ -438,8 +436,7 @@ CERT_DecodeGeneralName(PLArenaPool *reqArena, SECItem *encodedName,
         genName = CERT_NewGeneralName(reqArena, genNameType);
         if (!genName)
             goto loser;
-    }
-    else {
+    } else {
         genName->type = genNameType;
         genName->l.prev = genName->l.next = &genName->l;
     }
@@ -706,8 +703,7 @@ cert_DecodeNameConstraintSubTree(PLArenaPool *arena, SECItem **subTree,
         }
         if (first == NULL) {
             first = current;
-        }
-        else {
+        } else {
             current->l.prev = &(last->l);
             last->l.next = &(current->l);
         }
@@ -816,8 +812,7 @@ CERT_CopyGeneralName(PLArenaPool *arena, CERTGeneralName *dest,
                 destHead->l.prev = &temp->l;
                 dest->l.next = &temp->l;
                 dest = temp;
-            }
-            else {
+            } else {
                 dest = CERT_GetNextGeneralName(dest);
             }
         }
@@ -889,11 +884,9 @@ cert_CombineNamesLists(CERTGeneralName *list1, CERTGeneralName *list2)
 
     if (list1 == NULL) {
         return list2;
-    }
-    else if (list2 == NULL) {
+    } else if (list2 == NULL) {
         return list1;
-    }
-    else {
+    } else {
         begin1 = &list1->l;
         begin2 = &list2->l;
         end1 = list1->l.prev;
@@ -917,11 +910,9 @@ cert_CombineConstraintsLists(CERTNameConstraint *list1,
 
     if (list1 == NULL) {
         return list2;
-    }
-    else if (list2 == NULL) {
+    } else if (list2 == NULL) {
         return list1;
-    }
-    else {
+    } else {
         begin1 = &list1->l;
         begin2 = &list2->l;
         end1 = list1->l.prev;
@@ -1548,16 +1539,14 @@ CERT_AddNameConstraintByGeneralName(PLArenaPool *arena,
     if (first == NULL) {
         *constraints = current;
         PR_INIT_CLIST(&current->l);
-    }
-    else {
+    } else {
         PR_INSERT_BEFORE(&current->l, &first->l);
     }
 
 done:
     if (rv == SECFailure) {
         PORT_ArenaRelease(arena, mark);
-    }
-    else {
+    } else {
         PORT_ArenaUnmark(arena, mark);
     }
     return rv;
@@ -1694,8 +1683,7 @@ CERT_FindNameConstraintsExten(PLArenaPool *arena, CERTCertificate *cert,
 
     if (rv == SECFailure) {
         PORT_ArenaRelease(arena, mark);
-    }
-    else {
+    } else {
         PORT_ArenaUnmark(arena, mark);
     }
 
diff --git a/lib/certdb/polcyxtn.c b/lib/certdb/polcyxtn.c
index 664d7dd78..aae34e243 100644
--- a/lib/certdb/polcyxtn.c
+++ b/lib/certdb/polcyxtn.c
@@ -291,16 +291,14 @@ CERT_DecodePolicyConstraintsExtension(
 
         if (decodeContext.explicitPolicySkipCerts.len == 0) {
             *(PRInt32 *)decodedValue->explicitPolicySkipCerts.data = -1;
-        }
-        else {
+        } else {
             *(PRInt32 *)decodedValue->explicitPolicySkipCerts.data =
                 DER_GetInteger(&decodeContext.explicitPolicySkipCerts);
         }
 
         if (decodeContext.inhibitMappingSkipCerts.len == 0) {
             *(PRInt32 *)decodedValue->inhibitMappingSkipCerts.data = -1;
-        }
-        else {
+        } else {
             *(PRInt32 *)decodedValue->inhibitMappingSkipCerts.data =
                 DER_GetInteger(&decodeContext.inhibitMappingSkipCerts);
         }
@@ -475,8 +473,7 @@ stringFromUserNotice(SECItem *noticeItem)
                 if (policystr != NULL) {
                     if (retstr != NULL) {
                         retstr = PR_sprintf_append(retstr, "\n%s", policystr);
-                    }
-                    else {
+                    } else {
                         retstr = PR_sprintf_append(retstr, "%s", policystr);
                     }
 
diff --git a/lib/certdb/secname.c b/lib/certdb/secname.c
index fad76adf1..1fcae9776 100644
--- a/lib/certdb/secname.c
+++ b/lib/certdb/secname.c
@@ -54,8 +54,7 @@ AddToArray(PLArenaPool *arena, void **array, void *element)
         array =
             (void **)PORT_ArenaGrow(arena, array, (count + 1) * sizeof(void *),
                                     (count + 2) * sizeof(void *));
-    }
-    else {
+    } else {
         array = (void **)PORT_ArenaAlloc(arena, (count + 2) * sizeof(void *));
     }
     if (array) {
@@ -346,8 +345,7 @@ CERT_CreateName(CERTRDN *rdn0, ...)
         /* Count number of RDNs going into the Name */
         if (!rdn0) {
             count = 0;
-        }
-        else {
+        } else {
             count = 1;
             va_start(ap, rdn0);
             while ((rdn = va_arg(ap, CERTRDN *)) != 0) {
@@ -468,8 +466,7 @@ canonicalize(SECItem *foo)
             ch = ' ';
             if (ch == lastch)
                 continue;
-        }
-        else if (ch >= 'A' && ch <= 'Z') {
+        } else if (ch >= 'A' && ch <= 'Z') {
             ch |= 0x20; /* downshift */
         }
         foo->data[dest++] = lastch = ch;
@@ -522,8 +519,7 @@ CERT_CompareAVA(const CERTAVA *a, const CERTAVA *b)
             }
             SECITEM_FreeItem(aVal, PR_TRUE);
             SECITEM_FreeItem(bVal, PR_TRUE);
-        }
-        else if (a->value.data[0] == 0x13) { /* both are printable strings. */
+        } else if (a->value.data[0] == 0x13) { /* both are printable strings. */
             /* printable strings */
             rv = CERT_CompareDERPrintableStrings(&a->value, &b->value);
         }
diff --git a/lib/certdb/stanpcertdb.c b/lib/certdb/stanpcertdb.c
index 20a4fdfdc..a65ad5cb8 100644
--- a/lib/certdb/stanpcertdb.c
+++ b/lib/certdb/stanpcertdb.c
@@ -93,8 +93,7 @@ CERT_GetCertTrust(const CERTCertificate *cert, CERTCertTrust *trust)
     CERT_LockCertTrust(cert);
     if (cert->trust == NULL) {
         rv = SECFailure;
-    }
-    else {
+    } else {
         *trust = *cert->trust;
         rv = SECSuccess;
     }
@@ -359,8 +358,7 @@ CERT_NewTempCertificate(CERTCertDBHandle *handle, SECItem *derCert,
                 nssCertificate_Destroy(c);
                 PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
                 cc = NULL;
-            }
-            else {
+            } else {
                 cc = STAN_GetCERTCertificateOrRelease(c);
                 if (cc == NULL) {
                     CERT_MapStanError();
@@ -384,8 +382,7 @@ CERT_NewTempCertificate(CERTCertDBHandle *handle, SECItem *derCert,
     if (copyDER) {
         nssItem_Create(c->object.arena, &c->encoding, derCert->len,
                        derCert->data);
-    }
-    else {
+    } else {
         NSSITEM_FROM_SECITEM(&c->encoding, derCert);
     }
     /* Forces a decoding of the cert in order to obtain the parts used
@@ -481,8 +478,7 @@ get_best_temp_or_perm(NSSCertificate *ct, NSSCertificate *cp)
     NSSCertificate *arr[3];
     if (!ct) {
         return nssCertificate_AddRef(cp);
-    }
-    else if (!cp) {
+    } else if (!cp) {
         return nssCertificate_AddRef(ct);
     }
     arr[0] = ct;
@@ -565,8 +561,7 @@ CERT_FindCertByNickname(CERTCertDBHandle *handle, const char *nickname)
         if (ct) {
             CERT_DestroyCertificate(STAN_GetCERTCertificateOrRelease(ct));
         }
-    }
-    else {
+    } else {
         c = ct;
     }
     return c ? STAN_GetCERTCertificateOrRelease(c) : NULL;
@@ -627,8 +622,7 @@ common_FindCertByNicknameOrEmailAddrForUsage(CERTCertDBHandle *handle,
 
     if (anyUsage) {
         cert = PK11_FindCertFromNickname(name, NULL);
-    }
-    else {
+    } else {
         if (ct) {
             /* Does ct really have the required usage? */
             nssDecodedCert *dc;
@@ -657,8 +651,7 @@ common_FindCertByNicknameOrEmailAddrForUsage(CERTCertDBHandle *handle,
         if (ct) {
             CERT_DestroyCertificate(STAN_GetCERTCertificateOrRelease(ct));
         }
-    }
-    else {
+    } else {
         c = ct;
     }
     return c ? STAN_GetCERTCertificateOrRelease(c) : NULL;
@@ -693,8 +686,7 @@ add_to_subject_list(CERTCertList *certList, CERTCertificate *cert,
         if (secrv != SECSuccess) {
             CERT_DestroyCertificate(cert);
         }
-    }
-    else {
+    } else {
         CERT_DestroyCertificate(cert);
     }
 }
@@ -776,8 +768,7 @@ CERT_DestroyCertificate(CERTCertificate *cert)
         if (tmp) {
             /* delete the NSSCertificate */
             NSSCertificate_Destroy(tmp);
-        }
-        else if (cert->arena) {
+        } else if (cert->arena) {
             PORT_FreeArena(cert->arena, PR_FALSE);
         }
     }
@@ -821,8 +812,7 @@ certdb_SaveSingleProfile(CERTCertificate *cert, const char *emailAddr,
             SECITEM_FROM_NSSITEM(&oldproftime, stanProfile->profileTime);
             oldProfileTime = &oldproftime;
         }
-    }
-    else {
+    } else {
         oldProfile = PK11_FindSMimeProfile(&slot, (char *)emailAddr,
                                            &cert->derSubject, &oldProfileTime);
         freeOldProfile = PR_TRUE;
@@ -833,23 +823,20 @@ certdb_SaveSingleProfile(CERTCertificate *cert, const char *emailAddr,
     /* both profileTime and emailProfile have to exist or not exist */
     if (emailProfile == NULL) {
         profileTime = NULL;
-    }
-    else if (profileTime == NULL) {
+    } else if (profileTime == NULL) {
         emailProfile = NULL;
     }
 
     if (oldProfileTime == NULL) {
         saveit = PR_TRUE;
-    }
-    else {
+    } else {
         /* there was already a profile for this email addr */
         if (profileTime) {
             /* we have an old and new profile - save whichever is more recent*/
             if (oldProfileTime->len == 0) {
                 /* always replace if old entry doesn't have a time */
                 oldtime = LL_MININT;
-            }
-            else {
+            } else {
                 rv = DER_UTCTimeToTime(&oldtime, oldProfileTime);
                 if (rv != SECSuccess) {
                     goto loser;
@@ -865,8 +852,7 @@ certdb_SaveSingleProfile(CERTCertificate *cert, const char *emailAddr,
                 /* this is a newer profile, save it and cert */
                 saveit = PR_TRUE;
             }
-        }
-        else {
+        } else {
             saveit = PR_TRUE;
         }
     }
@@ -882,8 +868,7 @@ certdb_SaveSingleProfile(CERTCertificate *cert, const char *emailAddr,
                     arena, NULL, profileTime->len, profileTime->data);
                 stanProfile->profileData = nssItem_Create(
                     arena, NULL, emailProfile->len, emailProfile->data);
-            }
-            else if (profileTime && emailProfile) {
+            } else if (profileTime && emailProfile) {
                 PRStatus nssrv;
                 NSSItem profTime, profData;
                 NSSITEM_FROM_SECITEM(&profTime, profileTime);
@@ -894,14 +879,12 @@ certdb_SaveSingleProfile(CERTCertificate *cert, const char *emailAddr,
                 nssrv = nssCryptoContext_ImportSMIMEProfile(cc, stanProfile);
                 rv = (nssrv == PR_SUCCESS) ? SECSuccess : SECFailure;
             }
-        }
-        else {
+        } else {
             rv = PK11_SaveSMimeProfile(slot, (char *)emailAddr,
                                        &cert->derSubject, emailProfile,
                                        profileTime);
         }
-    }
-    else {
+    } else {
         rv = SECSuccess;
     }
 
diff --git a/lib/certdb/xauthkid.c b/lib/certdb/xauthkid.c
index 3f95fed9a..c7ef046db 100644
--- a/lib/certdb/xauthkid.c
+++ b/lib/certdb/xauthkid.c
@@ -62,8 +62,7 @@ CERT_EncodeAuthKeyID(PLArenaPool *arena, CERTAuthKeyID *value,
                 PORT_SetError(SEC_ERROR_EXTENSION_VALUE_INVALID);
                 break;
             }
-        }
-        else if (value->authCertSerialNumber.data) {
+        } else if (value->authCertSerialNumber.data) {
             PORT_SetError(SEC_ERROR_EXTENSION_VALUE_INVALID);
             break;
         }
diff --git a/lib/certdb/xbsconst.c b/lib/certdb/xbsconst.c
index a74c28089..8a448eddf 100644
--- a/lib/certdb/xbsconst.c
+++ b/lib/certdb/xbsconst.c
@@ -126,16 +126,14 @@ CERT_DecodeBasicConstraintValue(CERTBasicConstraints *value,
              */
             if (value->isCA)
                 value->pathLenConstraint = CERT_UNLIMITED_PATH_CONSTRAINT;
-        }
-        else if (value->isCA) {
+        } else if (value->isCA) {
             long len = DER_GetInteger(&decodeContext.pathLenConstraint);
             if (len < 0 || len == LONG_MAX) {
                 PORT_SetError(SEC_ERROR_BAD_DER);
                 GEN_BREAK(SECFailure);
             }
             value->pathLenConstraint = len;
-        }
-        else {
+        } else {
             /* here we get an error where the subject is not a CA, but
                the pathLenConstraint is set */
             PORT_SetError(SEC_ERROR_BAD_DER);