diff --git a/quiche/quic/masque/masque_connection_pool.cc b/quiche/quic/masque/masque_connection_pool.cc
index 5413c27..8481f98 100644
--- a/quiche/quic/masque/masque_connection_pool.cc
+++ b/quiche/quic/masque/masque_connection_pool.cc
@@ -35,40 +35,41 @@
 namespace quic {
 
 MasqueConnectionPool::MasqueConnectionPool(
-    QuicEventLoop *event_loop, SSL_CTX *ssl_ctx,
+    QuicEventLoop* event_loop, SSL_CTX* ssl_ctx,
     bool disable_certificate_verification, int address_family_for_lookup,
-    Visitor *visitor)
+    Visitor* visitor)
     : event_loop_(event_loop),
       ssl_ctx_(ssl_ctx),
       disable_certificate_verification_(disable_certificate_verification),
       address_family_for_lookup_(address_family_for_lookup),
       visitor_(visitor) {}
 
-void MasqueConnectionPool::OnConnectionReady(MasqueH2Connection *connection) {
+void MasqueConnectionPool::OnConnectionReady(MasqueH2Connection* connection) {
   SendPendingRequests(connection);
 }
 
 void MasqueConnectionPool::OnConnectionFinished(
-    MasqueH2Connection *connection) {
+    MasqueH2Connection* connection) {
   FailPendingRequests(
       connection,
       absl::InternalError("Connection finished before receiving request"));
 }
 
-void MasqueConnectionPool::OnRequest(
-    MasqueH2Connection * /*connection*/, int32_t /*stream_id*/,
-    const quiche::HttpHeaderBlock & /*headers*/, const std::string & /*body*/) {
+void MasqueConnectionPool::OnRequest(MasqueH2Connection* /*connection*/,
+                                     int32_t /*stream_id*/,
+                                     const quiche::HttpHeaderBlock& /*headers*/,
+                                     const std::string& /*body*/) {
   QUICHE_LOG(FATAL) << "Client cannot receive requests";
 }
 
-void MasqueConnectionPool::OnResponse(MasqueH2Connection *connection,
+void MasqueConnectionPool::OnResponse(MasqueH2Connection* connection,
                                       int32_t stream_id,
-                                      const quiche::HttpHeaderBlock &headers,
-                                      const std::string &body) {
+                                      const quiche::HttpHeaderBlock& headers,
+                                      const std::string& body) {
   bool found = false;
   for (auto it = pending_requests_.begin(); it != pending_requests_.end();) {
     RequestId request_id = it->first;
-    PendingRequest &pending_request = *it->second;
+    PendingRequest& pending_request = *it->second;
     if (pending_request.connection == connection &&
         pending_request.stream_id == stream_id) {
       pending_requests_.erase(it++);
@@ -88,12 +89,12 @@
 }
 
 absl::StatusOr<MasqueConnectionPool::RequestId>
-MasqueConnectionPool::SendRequest(const Message &request) {
+MasqueConnectionPool::SendRequest(const Message& request) {
   auto authority = request.headers.find(":authority");
   if (authority == request.headers.end()) {
     return absl::InvalidArgumentError("Request missing :authority header");
   }
-  ConnectionState *connection =
+  ConnectionState* connection =
       GetOrCreateConnectionState(std::string(authority->second));
   if (connection == nullptr) {
     return absl::InternalError(
@@ -116,8 +117,8 @@
   return request_id;
 }
 
-MasqueConnectionPool::ConnectionState *
-MasqueConnectionPool::GetOrCreateConnectionState(const std::string &authority) {
+MasqueConnectionPool::ConnectionState*
+MasqueConnectionPool::GetOrCreateConnectionState(const std::string& authority) {
   auto connection_state_it = connections_.find(authority);
   if (connection_state_it != connections_.end()) {
     return connection_state_it->second.get();
@@ -134,10 +135,10 @@
 }
 
 void MasqueConnectionPool::AttachConnectionToPendingRequests(
-    const std::string &authority, MasqueH2Connection *connection) {
+    const std::string& authority, MasqueH2Connection* connection) {
   for (auto it = pending_requests_.begin(); it != pending_requests_.end();
        ++it) {
-    PendingRequest &pending_request = *it->second;
+    PendingRequest& pending_request = *it->second;
     auto authority_header = pending_request.request.headers.find(":authority");
     if (authority_header == pending_request.request.headers.end()) {
       QUICHE_LOG(ERROR) << "Request missing :authority header";
@@ -150,10 +151,10 @@
   }
 }
 
-void MasqueConnectionPool::SendPendingRequests(MasqueH2Connection *connection) {
+void MasqueConnectionPool::SendPendingRequests(MasqueH2Connection* connection) {
   for (auto it = pending_requests_.begin(); it != pending_requests_.end();) {
     RequestId request_id = it->first;
-    PendingRequest &pending_request = *it->second;
+    PendingRequest& pending_request = *it->second;
     if (pending_request.connection != connection) {
       ++it;
       continue;
@@ -172,11 +173,11 @@
   }
 }
 
-void MasqueConnectionPool::FailPendingRequests(MasqueH2Connection *connection,
-                                               const absl::Status &error) {
+void MasqueConnectionPool::FailPendingRequests(MasqueH2Connection* connection,
+                                               const absl::Status& error) {
   for (auto it = pending_requests_.begin(); it != pending_requests_.end();) {
     RequestId request_id = it->first;
-    PendingRequest &pending_request = *it->second;
+    PendingRequest& pending_request = *it->second;
     if (pending_request.connection != connection) {
       ++it;
       continue;
@@ -187,7 +188,7 @@
 }
 
 MasqueConnectionPool::ConnectionState::ConnectionState(
-    MasqueConnectionPool *connection_pool)
+    MasqueConnectionPool* connection_pool)
     : connection_pool_(connection_pool) {}
 
 MasqueConnectionPool::ConnectionState::~ConnectionState() {
@@ -203,7 +204,7 @@
 }
 
 bool MasqueConnectionPool::ConnectionState::SetupSocket(
-    const std::string &authority, bool disable_certificate_verification,
+    const std::string& authority, bool disable_certificate_verification,
     int address_family_for_lookup) {
   authority_ = authority;
   std::vector<std::string> authority_split =
@@ -249,7 +250,7 @@
 }
 
 void MasqueConnectionPool::ConnectionState::OnSocketEvent(
-    QuicEventLoop * /*event_loop*/, SocketFd fd, QuicSocketEventMask events) {
+    QuicEventLoop* /*event_loop*/, SocketFd fd, QuicSocketEventMask events) {
   if (fd != socket_) {
     return;
   }
@@ -277,7 +278,7 @@
                               sizeof(kAlpnProtocols)) != 0) {
         QUICHE_LOG(FATAL) << "SSL_set_alpn_protos failed";
       }
-      BIO *bio = BIO_new_socket(socket_, BIO_CLOSE);
+      BIO* bio = BIO_new_socket(socket_, BIO_CLOSE);
       SSL_set_bio(ssl_.get(), bio, bio);
       // `SSL_set_bio` causes `ssl_` to take ownership of `bio`.
       connection_ = std::make_unique<MasqueH2Connection>(
@@ -292,36 +293,36 @@
 
 // static
 enum ssl_verify_result_t MasqueConnectionPool::ConnectionState::VerifyCallback(
-    SSL *ssl, uint8_t *out_alert) {
-  return static_cast<MasqueConnectionPool::ConnectionState *>(
+    SSL* ssl, uint8_t* out_alert) {
+  return static_cast<MasqueConnectionPool::ConnectionState*>(
              SSL_get_app_data(ssl))
       ->VerifyCertificate(ssl, out_alert);
 }
 
 enum ssl_verify_result_t
-MasqueConnectionPool::ConnectionState::VerifyCertificate(SSL *ssl,
-                                                         uint8_t *out_alert) {
-  const STACK_OF(CRYPTO_BUFFER) *cert_chain = SSL_get0_peer_certificates(ssl);
+MasqueConnectionPool::ConnectionState::VerifyCertificate(SSL* ssl,
+                                                         uint8_t* out_alert) {
+  const STACK_OF(CRYPTO_BUFFER)* cert_chain = SSL_get0_peer_certificates(ssl);
   if (cert_chain == nullptr) {
     QUICHE_LOG(ERROR) << "No certificate chain";
     *out_alert = SSL_AD_INTERNAL_ERROR;
     return ssl_verify_invalid;
   }
   std::vector<std::string> certs;
-  for (CRYPTO_BUFFER *cert : cert_chain) {
+  for (CRYPTO_BUFFER* cert : cert_chain) {
     certs.push_back(
-        std::string(reinterpret_cast<const char *>(CRYPTO_BUFFER_data(cert)),
+        std::string(reinterpret_cast<const char*>(CRYPTO_BUFFER_data(cert)),
                     CRYPTO_BUFFER_len(cert)));
   }
-  const uint8_t *ocsp_response_raw;
+  const uint8_t* ocsp_response_raw;
   size_t ocsp_response_len;
   SSL_get0_ocsp_response(ssl, &ocsp_response_raw, &ocsp_response_len);
-  std::string ocsp_response(reinterpret_cast<const char *>(ocsp_response_raw),
+  std::string ocsp_response(reinterpret_cast<const char*>(ocsp_response_raw),
                             ocsp_response_len);
-  const uint8_t *sct_list_raw;
+  const uint8_t* sct_list_raw;
   size_t sct_list_len;
   SSL_get0_signed_cert_timestamp_list(ssl, &sct_list_raw, &sct_list_len);
-  std::string cert_sct(reinterpret_cast<const char *>(sct_list_raw),
+  std::string cert_sct(reinterpret_cast<const char*>(sct_list_raw),
                        sct_list_len);
   std::string error_details;
   std::unique_ptr<ProofVerifyDetails> details;
@@ -342,8 +343,8 @@
 
 // static
 absl::StatusOr<bssl::UniquePtr<SSL_CTX>> MasqueConnectionPool::CreateSslCtx(
-    const std::string &client_cert_file,
-    const std::string &client_cert_key_file) {
+    const std::string& client_cert_file,
+    const std::string& client_cert_key_file) {
   if (client_cert_file.empty() != client_cert_key_file.empty()) {
     return absl::InvalidArgumentError(
         "Both private key and certificate chain are required when using client "
diff --git a/quiche/quic/masque/masque_connection_pool.h b/quiche/quic/masque/masque_connection_pool.h
index 7b61bea..b70c391 100644
--- a/quiche/quic/masque/masque_connection_pool.h
+++ b/quiche/quic/masque/masque_connection_pool.h
@@ -34,57 +34,57 @@
   class QUIC_NO_EXPORT Visitor {
    public:
     virtual ~Visitor() = default;
-    virtual void OnResponse(MasqueConnectionPool *pool, RequestId request_id,
-                            const absl::StatusOr<Message> &response) = 0;
+    virtual void OnResponse(MasqueConnectionPool* pool, RequestId request_id,
+                            const absl::StatusOr<Message>& response) = 0;
   };
 
   // If the request fails immediately, the error will be returned. Otherwise, a
   // request ID will be returned and the result (the response or an error) will
   // be delivered later with that same request ID via Visitor::OnResponse.
-  absl::StatusOr<RequestId> SendRequest(const Message &request);
+  absl::StatusOr<RequestId> SendRequest(const Message& request);
 
   // `event_loop`, `ssl_ctx`, and `visitor` must outlive this object.
-  explicit MasqueConnectionPool(QuicEventLoop *event_loop, SSL_CTX *ssl_ctx,
+  explicit MasqueConnectionPool(QuicEventLoop* event_loop, SSL_CTX* ssl_ctx,
                                 bool disable_certificate_verification,
                                 int address_family_for_lookup,
-                                Visitor *visitor);
+                                Visitor* visitor);
 
-  QuicEventLoop *event_loop() { return event_loop_; }
-  SSL_CTX *ssl_ctx() { return ssl_ctx_; }
+  QuicEventLoop* event_loop() { return event_loop_; }
+  SSL_CTX* ssl_ctx() { return ssl_ctx_; }
 
   // From MasqueH2Connection::Visitor:
-  void OnConnectionReady(MasqueH2Connection *connection) override;
-  void OnConnectionFinished(MasqueH2Connection *connection) override;
-  void OnRequest(MasqueH2Connection *connection, int32_t stream_id,
-                 const quiche::HttpHeaderBlock &headers,
-                 const std::string &body) override;
-  void OnResponse(MasqueH2Connection *connection, int32_t stream_id,
-                  const quiche::HttpHeaderBlock &headers,
-                  const std::string &body) override;
+  void OnConnectionReady(MasqueH2Connection* connection) override;
+  void OnConnectionFinished(MasqueH2Connection* connection) override;
+  void OnRequest(MasqueH2Connection* connection, int32_t stream_id,
+                 const quiche::HttpHeaderBlock& headers,
+                 const std::string& body) override;
+  void OnResponse(MasqueH2Connection* connection, int32_t stream_id,
+                  const quiche::HttpHeaderBlock& headers,
+                  const std::string& body) override;
 
   static absl::StatusOr<bssl::UniquePtr<SSL_CTX>> CreateSslCtx(
-      const std::string &client_cert_file,
-      const std::string &client_cert_key_file);
+      const std::string& client_cert_file,
+      const std::string& client_cert_key_file);
 
  private:
   class ConnectionState : public QuicSocketEventListener {
    public:
-    explicit ConnectionState(MasqueConnectionPool *connection_pool);
+    explicit ConnectionState(MasqueConnectionPool* connection_pool);
     ~ConnectionState() override;
-    bool SetupSocket(const std::string &authority,
+    bool SetupSocket(const std::string& authority,
                      bool disable_certificate_verification,
                      int address_family_for_lookup);
     // From QuicSocketEventListener.
-    void OnSocketEvent(QuicEventLoop *event_loop, SocketFd fd,
+    void OnSocketEvent(QuicEventLoop* event_loop, SocketFd fd,
                        QuicSocketEventMask events) override;
 
-    MasqueH2Connection *connection() { return connection_.get(); }
+    MasqueH2Connection* connection() { return connection_.get(); }
 
    private:
-    static enum ssl_verify_result_t VerifyCallback(SSL *ssl,
-                                                   uint8_t *out_alert);
-    enum ssl_verify_result_t VerifyCertificate(SSL *ssl, uint8_t *out_alert);
-    MasqueConnectionPool *connection_pool_;  // Not owned.
+    static enum ssl_verify_result_t VerifyCallback(SSL* ssl,
+                                                   uint8_t* out_alert);
+    enum ssl_verify_result_t VerifyCertificate(SSL* ssl, uint8_t* out_alert);
+    MasqueConnectionPool* connection_pool_;  // Not owned.
     std::string authority_;
     std::string host_;
     std::unique_ptr<ProofVerifier> proof_verifier_;
@@ -94,22 +94,22 @@
   };
   struct PendingRequest {
     Message request;
-    MasqueH2Connection *connection = nullptr;  // Not owned.
+    MasqueH2Connection* connection = nullptr;  // Not owned.
     int32_t stream_id = -1;
   };
 
-  ConnectionState *GetOrCreateConnectionState(const std::string &authority);
-  void AttachConnectionToPendingRequests(const std::string &authority,
-                                         MasqueH2Connection *connection);
-  void SendPendingRequests(MasqueH2Connection *connection);
-  void FailPendingRequests(MasqueH2Connection *connection,
-                           const absl::Status &error);
+  ConnectionState* GetOrCreateConnectionState(const std::string& authority);
+  void AttachConnectionToPendingRequests(const std::string& authority,
+                                         MasqueH2Connection* connection);
+  void SendPendingRequests(MasqueH2Connection* connection);
+  void FailPendingRequests(MasqueH2Connection* connection,
+                           const absl::Status& error);
 
-  QuicEventLoop *event_loop_;  // Not owned.
-  SSL_CTX *ssl_ctx_;           // Not owned.
+  QuicEventLoop* event_loop_;  // Not owned.
+  SSL_CTX* ssl_ctx_;           // Not owned.
   const bool disable_certificate_verification_;
   const int address_family_for_lookup_;
-  Visitor *visitor_;  // Not owned.
+  Visitor* visitor_;  // Not owned.
   absl::flat_hash_map<std::string, std::unique_ptr<ConnectionState>>
       connections_;
   absl::flat_hash_map<RequestId, std::unique_ptr<PendingRequest>>
diff --git a/quiche/quic/masque/masque_h2_connection.cc b/quiche/quic/masque/masque_h2_connection.cc
index 2feaa2c..11bdfb1 100644
--- a/quiche/quic/masque/masque_h2_connection.cc
+++ b/quiche/quic/masque/masque_h2_connection.cc
@@ -32,8 +32,8 @@
 
 namespace quic {
 
-MasqueH2Connection::MasqueH2Connection(SSL *ssl, bool is_server,
-                                       Visitor *visitor)
+MasqueH2Connection::MasqueH2Connection(SSL* ssl, bool is_server,
+                                       Visitor* visitor)
     : ssl_(ssl), is_server_(is_server), visitor_(visitor) {}
 
 void MasqueH2Connection::OnTransportReadable() {
@@ -110,9 +110,9 @@
   QUICHE_DVLOG(1) << "Read " << ssl_read_ret << " bytes from TLS";
   QUICHE_DVLOG(2) << "Read TLS bytes:" << std::endl
                   << quiche::QuicheTextUtils::HexDump(absl::string_view(
-                         reinterpret_cast<const char *>(buffer), ssl_read_ret));
+                         reinterpret_cast<const char*>(buffer), ssl_read_ret));
   h2_adapter_->ProcessBytes(
-      absl::string_view(reinterpret_cast<const char *>(buffer), ssl_read_ret));
+      absl::string_view(reinterpret_cast<const char*>(buffer), ssl_read_ret));
   return AttemptToSend();
 }
 
@@ -149,7 +149,7 @@
 MasqueH2Connection::DataFrameHeaderInfo
 MasqueH2Connection::OnReadyToSendDataForStream(Http2StreamId stream_id,
                                                size_t max_length) {
-  MasqueH2Stream *stream = GetOrCreateH2Stream(stream_id);
+  MasqueH2Stream* stream = GetOrCreateH2Stream(stream_id);
   DataFrameHeaderInfo info;
   if (max_length < stream->body_to_send.size()) {
     info.payload_length = max_length;
@@ -168,7 +168,7 @@
   if (!WriteDataToTls(frame_header)) {
     return false;
   }
-  MasqueH2Stream *stream = GetOrCreateH2Stream(stream_id);
+  MasqueH2Stream* stream = GetOrCreateH2Stream(stream_id);
   size_t length_to_write = std::min(payload_bytes, stream->body_to_send.size());
   int length_written =
       WriteDataToTls(stream->body_to_send.substr(0, length_to_write));
@@ -230,16 +230,16 @@
 }
 
 bool MasqueH2Connection::OnEndHeadersForStream(Http2StreamId stream_id) {
-  MasqueH2Stream *stream = GetOrCreateH2Stream(stream_id);
+  MasqueH2Stream* stream = GetOrCreateH2Stream(stream_id);
   QUICHE_LOG(INFO) << "OnEndHeadersForStream " << stream_id
                    << " headers: " << stream->received_headers.DebugString();
   return true;
 }
 
 void MasqueH2Connection::SendResponse(int32_t stream_id,
-                                      const quiche::HttpHeaderBlock &headers,
-                                      const std::string &body) {
-  MasqueH2Stream *stream = GetOrCreateH2Stream(stream_id);
+                                      const quiche::HttpHeaderBlock& headers,
+                                      const std::string& body) {
+  MasqueH2Stream* stream = GetOrCreateH2Stream(stream_id);
   std::vector<Header> h2_headers = ConvertHeaders(headers);
   stream->body_to_send = body;
   if (h2_adapter_->SubmitResponse(
@@ -250,8 +250,8 @@
   }
 }
 
-int32_t MasqueH2Connection::SendRequest(const quiche::HttpHeaderBlock &headers,
-                                        const std::string &body) {
+int32_t MasqueH2Connection::SendRequest(const quiche::HttpHeaderBlock& headers,
+                                        const std::string& body) {
   if (is_server_) {
     QUICHE_LOG(FATAL) << "Server cannot send requests";
   }
@@ -275,9 +275,9 @@
 }
 
 std::vector<Header> MasqueH2Connection::ConvertHeaders(
-    const quiche::HttpHeaderBlock &headers) {
+    const quiche::HttpHeaderBlock& headers) {
   std::vector<Header> h2_headers;
-  for (const auto &[key, value] : headers) {
+  for (const auto& [key, value] : headers) {
     h2_headers.push_back({http2::adapter::HeaderRep(std::string(key)),
                           http2::adapter::HeaderRep(std::string(value))});
   }
@@ -307,7 +307,7 @@
 }
 
 bool MasqueH2Connection::OnEndStream(Http2StreamId stream_id) {
-  MasqueH2Stream *stream = GetOrCreateH2Stream(stream_id);
+  MasqueH2Stream* stream = GetOrCreateH2Stream(stream_id);
   QUICHE_LOG(INFO) << "Received END_STREAM for stream " << stream_id
                    << " body length: " << stream->received_body.size()
                    << std::endl
@@ -420,7 +420,7 @@
   QUICHE_LOG(ERROR) << "OnErrorDebug: " << message;
 }
 
-MasqueH2Connection::MasqueH2Stream *MasqueH2Connection::GetOrCreateH2Stream(
+MasqueH2Connection::MasqueH2Stream* MasqueH2Connection::GetOrCreateH2Stream(
     Http2StreamId stream_id) {
   auto it = h2_streams_.find(stream_id);
   if (it != h2_streams_.end()) {
@@ -430,7 +430,7 @@
       .first->second.get();
 }
 
-void PrintSSLError(const char *msg, int ssl_err, int ret) {
+void PrintSSLError(const char* msg, int ssl_err, int ret) {
   switch (ssl_err) {
     case SSL_ERROR_SSL:
       QUICHE_LOG(ERROR) << msg << ": "
diff --git a/quiche/quic/masque/masque_h2_connection.h b/quiche/quic/masque/masque_h2_connection.h
index 58c8159..91f883c 100644
--- a/quiche/quic/masque/masque_h2_connection.h
+++ b/quiche/quic/masque/masque_h2_connection.h
@@ -37,23 +37,23 @@
   class QUICHE_NO_EXPORT Visitor {
    public:
     virtual ~Visitor() = default;
-    virtual void OnConnectionReady(MasqueH2Connection *connection) = 0;
-    virtual void OnConnectionFinished(MasqueH2Connection *connection) = 0;
-    virtual void OnRequest(MasqueH2Connection *connection, int32_t stream_id,
-                           const quiche::HttpHeaderBlock &headers,
-                           const std::string &body) = 0;
-    virtual void OnResponse(MasqueH2Connection *connection, int32_t stream_id,
-                            const quiche::HttpHeaderBlock &headers,
-                            const std::string &body) = 0;
+    virtual void OnConnectionReady(MasqueH2Connection* connection) = 0;
+    virtual void OnConnectionFinished(MasqueH2Connection* connection) = 0;
+    virtual void OnRequest(MasqueH2Connection* connection, int32_t stream_id,
+                           const quiche::HttpHeaderBlock& headers,
+                           const std::string& body) = 0;
+    virtual void OnResponse(MasqueH2Connection* connection, int32_t stream_id,
+                            const quiche::HttpHeaderBlock& headers,
+                            const std::string& body) = 0;
   };
 
   // `ssl` and `visitor` must outlive this object.
-  explicit MasqueH2Connection(SSL *ssl, bool is_server, Visitor *visitor);
+  explicit MasqueH2Connection(SSL* ssl, bool is_server, Visitor* visitor);
 
-  MasqueH2Connection(const MasqueH2Connection &) = delete;
-  MasqueH2Connection(MasqueH2Connection &&) = delete;
-  MasqueH2Connection &operator=(const MasqueH2Connection &) = delete;
-  MasqueH2Connection &operator=(MasqueH2Connection &&) = delete;
+  MasqueH2Connection(const MasqueH2Connection&) = delete;
+  MasqueH2Connection(MasqueH2Connection&&) = delete;
+  MasqueH2Connection& operator=(const MasqueH2Connection&) = delete;
+  MasqueH2Connection& operator=(MasqueH2Connection&&) = delete;
 
   ~MasqueH2Connection();
 
@@ -62,10 +62,10 @@
   void OnTransportReadable();
   // Call when there is more data to be written to SSL.
   bool AttemptToSend();
-  int32_t SendRequest(const quiche::HttpHeaderBlock &headers,
-                      const std::string &body);
-  void SendResponse(int32_t stream_id, const quiche::HttpHeaderBlock &headers,
-                    const std::string &body);
+  int32_t SendRequest(const quiche::HttpHeaderBlock& headers,
+                      const std::string& body);
+  void SendResponse(int32_t stream_id, const quiche::HttpHeaderBlock& headers,
+                    const std::string& body);
 
  private:
   struct MasqueH2Stream {
@@ -77,9 +77,9 @@
   void Abort();
   void StartH2();
   bool TryRead();
-  MasqueH2Stream *GetOrCreateH2Stream(Http2StreamId stream_id);
+  MasqueH2Stream* GetOrCreateH2Stream(Http2StreamId stream_id);
   std::vector<http2::adapter::Header> ConvertHeaders(
-      const quiche::HttpHeaderBlock &headers);
+      const quiche::HttpHeaderBlock& headers);
 
   int WriteDataToTls(absl::string_view data);
 
@@ -132,18 +132,18 @@
   bool OnMetadataEndForStream(Http2StreamId stream_id) override;
   void OnErrorDebug(absl::string_view message) override;
 
-  SSL *ssl_;
+  SSL* ssl_;
   std::unique_ptr<http2::adapter::OgHttp2Adapter> h2_adapter_;
   const bool is_server_;
   bool tls_connected_ = false;
   bool aborted_ = false;
   absl::flat_hash_map<Http2StreamId, std::unique_ptr<MasqueH2Stream>>
       h2_streams_;
-  Visitor *visitor_;
+  Visitor* visitor_;
 };
 
 // Logs an SSL error that was provided by BoringSSL.
-void PrintSSLError(const char *msg, int ssl_err, int ret);
+void PrintSSLError(const char* msg, int ssl_err, int ret);
 
 }  // namespace quic
 
diff --git a/quiche/quic/masque/masque_ohttp_client_bin.cc b/quiche/quic/masque/masque_ohttp_client_bin.cc
index 9fa7868..eaa3822 100644
--- a/quiche/quic/masque/masque_ohttp_client_bin.cc
+++ b/quiche/quic/masque/masque_ohttp_client_bin.cc
@@ -67,11 +67,11 @@
  public:
   using RequestId = MasqueConnectionPool::RequestId;
   using Message = MasqueConnectionPool::Message;
-  explicit MasqueOhttpClient(QuicEventLoop *event_loop, SSL_CTX *ssl_ctx,
+  explicit MasqueOhttpClient(QuicEventLoop* event_loop, SSL_CTX* ssl_ctx,
                              std::vector<std::string> urls,
                              bool disable_certificate_verification,
                              int address_family_for_lookup,
-                             const std::string &post_data)
+                             const std::string& post_data)
       : urls_(urls),
         post_data_(post_data),
         connection_pool_(event_loop, ssl_ctx, disable_certificate_verification,
@@ -101,8 +101,8 @@
   }
 
   // From MasqueConnectionPool::Visitor.
-  void OnResponse(MasqueConnectionPool * /*pool*/, RequestId request_id,
-                  const absl::StatusOr<Message> &response) override {
+  void OnResponse(MasqueConnectionPool* /*pool*/, RequestId request_id,
+                  const absl::StatusOr<Message>& response) override {
     if (key_fetch_request_id_.has_value() &&
         *key_fetch_request_id_ == request_id) {
       key_fetch_request_id_ = std::nullopt;
@@ -152,7 +152,7 @@
   }
 
  private:
-  bool StartKeyFetch(const std::string &url_string) {
+  bool StartKeyFetch(const std::string& url_string) {
     QuicUrl url(url_string, "https");
     if (url.host().empty() && !absl::StrContains(url_string, "://")) {
       url = QuicUrl(absl::StrCat("https://", url_string));
@@ -178,7 +178,7 @@
     return true;
   }
 
-  void HandleKeyResponse(const absl::StatusOr<Message> &response) {
+  void HandleKeyResponse(const absl::StatusOr<Message>& response) {
     if (!response.ok()) {
       QUICHE_LOG(ERROR) << "Failed to fetch key: " << response.status();
       return;
@@ -230,7 +230,7 @@
     }
   }
 
-  void SendOhttpRequestForUrl(const std::string &url_string) {
+  void SendOhttpRequestForUrl(const std::string& url_string) {
     QuicUrl url(url_string, "https");
     if (url.host().empty() && !absl::StrContains(url_string, "://")) {
       url = QuicUrl(absl::StrCat("https://", url_string));
@@ -297,8 +297,8 @@
       pending_ohttp_requests_;
 };
 
-int RunMasqueOhttpClient(int argc, char *argv[]) {
-  const char *usage =
+int RunMasqueOhttpClient(int argc, char* argv[]) {
+  const char* usage =
       "Usage: masque_ohttp_client <key-url> <relay-url> <url>...";
   std::vector<std::string> urls =
       quiche::QuicheParseCommandLineFlags(usage, argc, argv);
@@ -348,6 +348,6 @@
 }  // namespace
 }  // namespace quic
 
-int main(int argc, char *argv[]) {
+int main(int argc, char* argv[]) {
   return quic::RunMasqueOhttpClient(argc, argv);
 }
diff --git a/quiche/quic/masque/masque_tcp_client_bin.cc b/quiche/quic/masque/masque_tcp_client_bin.cc
index fc57693..5a0b4fd 100644
--- a/quiche/quic/masque/masque_tcp_client_bin.cc
+++ b/quiche/quic/masque/masque_tcp_client_bin.cc
@@ -73,8 +73,8 @@
 namespace {
 
 std::optional<bssl::UniquePtr<SSL_CTX>> CreateSslCtx(
-    const std::string &client_cert_file,
-    const std::string &client_cert_key_file) {
+    const std::string& client_cert_file,
+    const std::string& client_cert_key_file) {
   if (client_cert_file.empty() != client_cert_key_file.empty()) {
     QUICHE_LOG(ERROR) << "Both private key and certificate chain are required "
                          "when using client certificates";
@@ -105,7 +105,7 @@
 class MasqueTlsTcpClientHandler : public ConnectingClientSocket::AsyncVisitor,
                                   public MasqueH2Connection::Visitor {
  public:
-  explicit MasqueTlsTcpClientHandler(QuicEventLoop *event_loop, SSL_CTX *ctx,
+  explicit MasqueTlsTcpClientHandler(QuicEventLoop* event_loop, SSL_CTX* ctx,
                                      QuicUrl url,
                                      bool disable_certificate_verification,
                                      int address_family_for_lookup)
@@ -149,13 +149,13 @@
     return true;
   }
 
-  static enum ssl_verify_result_t VerifyCallback(SSL *ssl, uint8_t *out_alert) {
-    return static_cast<MasqueTlsTcpClientHandler *>(SSL_get_app_data(ssl))
+  static enum ssl_verify_result_t VerifyCallback(SSL* ssl, uint8_t* out_alert) {
+    return static_cast<MasqueTlsTcpClientHandler*>(SSL_get_app_data(ssl))
         ->VerifyCertificate(out_alert);
   }
 
-  enum ssl_verify_result_t VerifyCertificate(uint8_t *out_alert) {
-    const STACK_OF(CRYPTO_BUFFER) *cert_chain =
+  enum ssl_verify_result_t VerifyCertificate(uint8_t* out_alert) {
+    const STACK_OF(CRYPTO_BUFFER)* cert_chain =
         SSL_get0_peer_certificates(ssl_.get());
     if (cert_chain == nullptr) {
       QUICHE_LOG(ERROR) << "No certificate chain";
@@ -163,21 +163,21 @@
       return ssl_verify_invalid;
     }
     std::vector<std::string> certs;
-    for (CRYPTO_BUFFER *cert : cert_chain) {
+    for (CRYPTO_BUFFER* cert : cert_chain) {
       certs.push_back(
-          std::string(reinterpret_cast<const char *>(CRYPTO_BUFFER_data(cert)),
+          std::string(reinterpret_cast<const char*>(CRYPTO_BUFFER_data(cert)),
                       CRYPTO_BUFFER_len(cert)));
     }
-    const uint8_t *ocsp_response_raw;
+    const uint8_t* ocsp_response_raw;
     size_t ocsp_response_len;
     SSL_get0_ocsp_response(ssl_.get(), &ocsp_response_raw, &ocsp_response_len);
-    std::string ocsp_response(reinterpret_cast<const char *>(ocsp_response_raw),
+    std::string ocsp_response(reinterpret_cast<const char*>(ocsp_response_raw),
                               ocsp_response_len);
-    const uint8_t *sct_list_raw;
+    const uint8_t* sct_list_raw;
     size_t sct_list_len;
     SSL_get0_signed_cert_timestamp_list(ssl_.get(), &sct_list_raw,
                                         &sct_list_len);
-    std::string cert_sct(reinterpret_cast<const char *>(sct_list_raw),
+    std::string cert_sct(reinterpret_cast<const char*>(sct_list_raw),
                          sct_list_len);
     std::string error_details;
     std::unique_ptr<ProofVerifyDetails> details;
@@ -230,7 +230,7 @@
       return;
     }
 
-    BIO *tls_io = nullptr;
+    BIO* tls_io = nullptr;
     if (BIO_new_bio_pair(&transport_io_, kBioBufferSize, &tls_io,
                          kBioBufferSize) != 1) {
       QUICHE_LOG(FATAL) << "BIO_new_bio_pair failed";
@@ -350,20 +350,20 @@
   bool IsDone() const { return done_; }
 
   // From MasqueH2Connection::Visitor.
-  void OnConnectionReady(MasqueH2Connection * /*connection*/) override {}
-  void OnConnectionFinished(MasqueH2Connection * /*connection*/) override {
+  void OnConnectionReady(MasqueH2Connection* /*connection*/) override {}
+  void OnConnectionFinished(MasqueH2Connection* /*connection*/) override {
     done_ = true;
   }
 
-  void OnRequest(MasqueH2Connection * /*connection*/, int32_t /*stream_id*/,
-                 const quiche::HttpHeaderBlock & /*headers*/,
-                 const std::string & /*body*/) override {
+  void OnRequest(MasqueH2Connection* /*connection*/, int32_t /*stream_id*/,
+                 const quiche::HttpHeaderBlock& /*headers*/,
+                 const std::string& /*body*/) override {
     QUICHE_LOG(FATAL) << "Client cannot receive requests";
   }
 
-  void OnResponse(MasqueH2Connection *connection, int32_t stream_id,
-                  const quiche::HttpHeaderBlock &headers,
-                  const std::string &body) override {
+  void OnResponse(MasqueH2Connection* connection, int32_t stream_id,
+                  const quiche::HttpHeaderBlock& headers,
+                  const std::string& body) override {
     if (connection != h2_connection_.get()) {
       QUICHE_LOG(FATAL) << "Unexpected connection";
     }
@@ -380,16 +380,16 @@
     if (request_sent_ || done_ || !tls_connected_) {
       return;
     }
-    const uint8_t *alpn_data;
+    const uint8_t* alpn_data;
     unsigned alpn_len;
     SSL_get0_alpn_selected(ssl_.get(), &alpn_data, &alpn_len);
     if (alpn_len != 0) {
-      std::string alpn(reinterpret_cast<const char *>(alpn_data), alpn_len);
+      std::string alpn(reinterpret_cast<const char*>(alpn_data), alpn_len);
       if (alpn == "h2") {
         h2_selected_ = true;
       }
       QUICHE_DVLOG(1) << "ALPN selected: "
-                      << std::string(reinterpret_cast<const char *>(alpn_data),
+                      << std::string(reinterpret_cast<const char*>(alpn_data),
                                      alpn_len);
     } else {
       QUICHE_DVLOG(1) << "No ALPN selected";
@@ -489,8 +489,8 @@
   }
 
   static constexpr size_t kBioBufferSize = 16384;
-  QuicEventLoop *event_loop_;  // Not owned.
-  SSL_CTX *ctx_;               // Not owned.
+  QuicEventLoop* event_loop_;  // Not owned.
+  SSL_CTX* ctx_;               // Not owned.
   std::unique_ptr<EventLoopSocketFactory> socket_factory_;
   QuicUrl url_;
   bool disable_certificate_verification_;
@@ -498,7 +498,7 @@
   std::unique_ptr<ProofVerifier> proof_verifier_;
   QuicSocketAddress socket_address_;
   std::unique_ptr<ConnectingClientSocket> socket_;
-  BIO *transport_io_ = nullptr;
+  BIO* transport_io_ = nullptr;
   bssl::UniquePtr<SSL> ssl_;
   bool tls_connected_ = false;
   bool h2_selected_ = false;
@@ -508,8 +508,8 @@
   std::unique_ptr<MasqueH2Connection> h2_connection_;
 };
 
-int RunMasqueTcpClient(int argc, char *argv[]) {
-  const char *usage = "Usage: masque_tcp_client <url>";
+int RunMasqueTcpClient(int argc, char* argv[]) {
+  const char* usage = "Usage: masque_tcp_client <url>";
   std::vector<std::string> urls =
       quiche::QuicheParseCommandLineFlags(usage, argc, argv);
   if (urls.size() != 1) {
@@ -570,6 +570,6 @@
 
 }  // namespace quic
 
-int main(int argc, char *argv[]) {
+int main(int argc, char* argv[]) {
   return quic::RunMasqueTcpClient(argc, argv);
 }
diff --git a/quiche/quic/masque/masque_tcp_server_bin.cc b/quiche/quic/masque/masque_tcp_server_bin.cc
index db52903..1f33213 100644
--- a/quiche/quic/masque/masque_tcp_server_bin.cc
+++ b/quiche/quic/masque/masque_tcp_server_bin.cc
@@ -79,7 +79,7 @@
  public:
   MasqueOhttpGateway() {}
 
-  bool Setup(const std::string &ohttp_key) {
+  bool Setup(const std::string& ohttp_key) {
     hpke_key_.reset(EVP_HPKE_KEY_new());
     if (!ohttp_key.empty()) {
       if (!absl::HexStringToBytes(ohttp_key, &hpke_private_key_)) {
@@ -88,7 +88,7 @@
       }
       if (EVP_HPKE_KEY_init(
               hpke_key_.get(), kem_,
-              reinterpret_cast<const uint8_t *>(hpke_private_key_.data()),
+              reinterpret_cast<const uint8_t*>(hpke_private_key_.data()),
               hpke_private_key_.size()) != 1) {
         QUICHE_LOG(ERROR) << "Failed to ingest HPKE key";
         return false;
@@ -102,7 +102,7 @@
       hpke_private_key_ = std::string(private_key_len, '0');
       if (EVP_HPKE_KEY_private_key(
               hpke_key_.get(),
-              reinterpret_cast<uint8_t *>(hpke_private_key_.data()),
+              reinterpret_cast<uint8_t*>(hpke_private_key_.data()),
               &private_key_len, private_key_len) != 1 ||
           private_key_len != hpke_private_key_.size()) {
         QUICHE_LOG(ERROR) << "Failed to extract new HPKE private key";
@@ -115,7 +115,7 @@
     hpke_public_key_ = std::string(public_key_len, '0');
     if (EVP_HPKE_KEY_public_key(
             hpke_key_.get(),
-            reinterpret_cast<uint8_t *>(hpke_public_key_.data()),
+            reinterpret_cast<uint8_t*>(hpke_public_key_.data()),
             &public_key_len, public_key_len) != 1 ||
         public_key_len != hpke_public_key_.size()) {
       QUICHE_LOG(ERROR) << "Failed to extract new HPKE public key";
@@ -165,8 +165,8 @@
     return true;
   }
 
-  bool HandleRequest(MasqueH2Connection *connection, int32_t stream_id,
-                     const std::string &encapsulated_request) {
+  bool HandleRequest(MasqueH2Connection* connection, int32_t stream_id,
+                     const std::string& encapsulated_request) {
     if (!ohttp_gateway_.has_value()) {
       QUICHE_LOG(ERROR) << "Not ready to handle OHTTP request";
       return false;
@@ -185,7 +185,7 @@
                         << binary_request.status();
       return false;
     }
-    const BinaryHttpRequest::ControlData &control_data =
+    const BinaryHttpRequest::ControlData& control_data =
         binary_request->control_data();
     // TODO(dschinazi): Send the decapsulated request to the authority instead
     // of replying with a fake local response.
@@ -230,15 +230,15 @@
  private:
   std::string hpke_private_key_;
   std::string hpke_public_key_;
-  const EVP_HPKE_KEM *kem_ = EVP_hpke_x25519_hkdf_sha256();
+  const EVP_HPKE_KEM* kem_ = EVP_hpke_x25519_hkdf_sha256();
   bssl::UniquePtr<EVP_HPKE_KEY> hpke_key_;
   std::string concatenated_keys_;
   std::optional<ObliviousHttpGateway> ohttp_gateway_;
 };
 
-static int SelectAlpnCallback(SSL * /*ssl*/, const uint8_t **out,
-                              uint8_t *out_len, const uint8_t *in,
-                              unsigned in_len, void * /*arg*/) {
+static int SelectAlpnCallback(SSL* /*ssl*/, const uint8_t** out,
+                              uint8_t* out_len, const uint8_t* in,
+                              unsigned in_len, void* /*arg*/) {
   unsigned i = 0;
   while (i < in_len) {
     uint8_t alpn_length = in[i];
@@ -262,9 +262,9 @@
 class MasqueH2SocketConnection : public QuicSocketEventListener {
  public:
   explicit MasqueH2SocketConnection(SocketFd connected_socket,
-                                    QuicEventLoop *event_loop, SSL_CTX *ctx,
+                                    QuicEventLoop* event_loop, SSL_CTX* ctx,
                                     bool is_server,
-                                    MasqueH2Connection::Visitor *visitor)
+                                    MasqueH2Connection::Visitor* visitor)
       : socket_(connected_socket),
         event_loop_(event_loop),
         connection_(CreateSsl(ctx), is_server, visitor) {
@@ -290,7 +290,7 @@
   }
 
   // From QuicSocketEventListener.
-  void OnSocketEvent(QuicEventLoop * /*event_loop*/, SocketFd fd,
+  void OnSocketEvent(QuicEventLoop* /*event_loop*/, SocketFd fd,
                      QuicSocketEventMask events) {
     if (fd != socket_ || ((events & kSocketEventReadable) == 0)) {
       return;
@@ -298,13 +298,13 @@
     connection_.OnTransportReadable();
   }
 
-  MasqueH2Connection *connection() { return &connection_; }
+  MasqueH2Connection* connection() { return &connection_; }
 
  private:
-  SSL *CreateSsl(SSL_CTX *ctx) {
+  SSL* CreateSsl(SSL_CTX* ctx) {
     ssl_.reset(SSL_new(ctx));
     SSL_set_accept_state(ssl_.get());
-    BIO *bio = BIO_new_socket(socket_, BIO_CLOSE);
+    BIO* bio = BIO_new_socket(socket_, BIO_CLOSE);
     SSL_set_bio(ssl_.get(), bio, bio);
     // `SSL_set_bio` causes `ssl_` to take ownership of `bio`.
     return ssl_.get();
@@ -312,21 +312,21 @@
 
   SocketFd socket_;
   bssl::UniquePtr<SSL> ssl_;
-  QuicEventLoop *event_loop_;  // Unowned.
+  QuicEventLoop* event_loop_;  // Unowned.
   MasqueH2Connection connection_;
 };
 
 class MasqueTcpServer : public QuicSocketEventListener,
                         public MasqueH2Connection::Visitor {
  public:
-  explicit MasqueTcpServer(MasqueOhttpGateway *masque_ohttp_gateway)
+  explicit MasqueTcpServer(MasqueOhttpGateway* masque_ohttp_gateway)
       : event_loop_(GetDefaultEventLoop()->Create(QuicDefaultClock::Get())),
         masque_ohttp_gateway_(masque_ohttp_gateway) {}
 
-  MasqueTcpServer(const MasqueTcpServer &) = delete;
-  MasqueTcpServer(MasqueTcpServer &&) = delete;
-  MasqueTcpServer &operator=(const MasqueTcpServer &) = delete;
-  MasqueTcpServer &operator=(MasqueTcpServer &&) = delete;
+  MasqueTcpServer(const MasqueTcpServer&) = delete;
+  MasqueTcpServer(MasqueTcpServer&&) = delete;
+  MasqueTcpServer& operator=(const MasqueTcpServer&) = delete;
+  MasqueTcpServer& operator=(MasqueTcpServer&&) = delete;
 
   ~MasqueTcpServer() {
     if (server_socket_ != kInvalidSocketFd) {
@@ -338,9 +338,9 @@
     }
   }
 
-  bool SetupSslCtx(const std::string &certificate_file,
-                   const std::string &key_file,
-                   const std::string &client_root_ca_file) {
+  bool SetupSslCtx(const std::string& certificate_file,
+                   const std::string& key_file,
+                   const std::string& client_root_ca_file) {
     ctx_.reset(SSL_CTX_new(TLS_method()));
 
     if (!SSL_CTX_use_PrivateKey_file(ctx_.get(), key_file.c_str(),
@@ -354,7 +354,7 @@
       return false;
     }
     if (!client_root_ca_file.empty()) {
-      X509_STORE *store = SSL_CTX_get_cert_store(ctx_.get());
+      X509_STORE* store = SSL_CTX_get_cert_store(ctx_.get());
       if (store == nullptr) {
         QUICHE_LOG(ERROR) << "Failed to get certificate store";
         return false;
@@ -396,7 +396,7 @@
 
     const int enable = 1;
     if (setsockopt(server_socket_, SOL_SOCKET, SO_REUSEADDR,
-                   (const char *)&enable, sizeof(enable)) < 0) {
+                   (const char*)&enable, sizeof(enable)) < 0) {
       QUICHE_LOG(ERROR) << "Failed to set SO_REUSEADDR on socket";
       return false;
     }
@@ -431,7 +431,7 @@
     }
   }
 
-  void OnSocketEvent(QuicEventLoop * /*event_loop*/, SocketFd fd,
+  void OnSocketEvent(QuicEventLoop* /*event_loop*/, SocketFd fd,
                      QuicSocketEventMask events) override {
     if (fd != server_socket_ || ((events & kSocketEventReadable) == 0)) {
       return;
@@ -440,25 +440,25 @@
   }
 
   // From MasqueH2Connection::Visitor.
-  void OnConnectionReady(MasqueH2Connection * /*connection*/) override {}
-  void OnConnectionFinished(MasqueH2Connection *connection) override {
+  void OnConnectionReady(MasqueH2Connection* /*connection*/) override {}
+  void OnConnectionFinished(MasqueH2Connection* connection) override {
     connections_.erase(
         std::remove_if(connections_.begin(), connections_.end(),
-                       [connection](const auto &socket_connection) {
+                       [connection](const auto& socket_connection) {
                          return socket_connection->connection() == connection;
                        }),
         connections_.end());
   }
 
-  bool HandleOhttpRequest(MasqueH2Connection *connection, int32_t stream_id,
-                          const std::string &encapsulated_request) {
+  bool HandleOhttpRequest(MasqueH2Connection* connection, int32_t stream_id,
+                          const std::string& encapsulated_request) {
     return masque_ohttp_gateway_->HandleRequest(connection, stream_id,
                                                 encapsulated_request);
   }
 
-  void OnRequest(MasqueH2Connection *connection, int32_t stream_id,
-                 const quiche::HttpHeaderBlock &headers,
-                 const std::string &body) override {
+  void OnRequest(MasqueH2Connection* connection, int32_t stream_id,
+                 const quiche::HttpHeaderBlock& headers,
+                 const std::string& body) override {
     quiche::HttpHeaderBlock response_headers;
     std::string response_body;
     auto path_pair = headers.find(":path");
@@ -494,9 +494,9 @@
     connection->SendResponse(stream_id, response_headers, response_body);
   }
 
-  void OnResponse(MasqueH2Connection * /*connection*/, int32_t /*stream_id*/,
-                  const quiche::HttpHeaderBlock & /*headers*/,
-                  const std::string & /*body*/) override {
+  void OnResponse(MasqueH2Connection* /*connection*/, int32_t /*stream_id*/,
+                  const quiche::HttpHeaderBlock& /*headers*/,
+                  const std::string& /*body*/) override {
     QUICHE_LOG(FATAL) << "Server cannot receive responses";
   }
 
@@ -528,13 +528,13 @@
 
   std::unique_ptr<QuicEventLoop> event_loop_;
   bssl::UniquePtr<SSL_CTX> ctx_;
-  MasqueOhttpGateway *masque_ohttp_gateway_;  // Unowned.
+  MasqueOhttpGateway* masque_ohttp_gateway_;  // Unowned.
   SocketFd server_socket_ = kInvalidSocketFd;
   std::vector<std::unique_ptr<MasqueH2SocketConnection>> connections_;
 };
 
-int RunMasqueTcpServer(int argc, char *argv[]) {
-  const char *usage = "Usage: masque_server [options]";
+int RunMasqueTcpServer(int argc, char* argv[]) {
+  const char* usage = "Usage: masque_server [options]";
   std::vector<std::string> non_option_args =
       quiche::QuicheParseCommandLineFlags(usage, argc, argv);
   if (!non_option_args.empty()) {
@@ -582,6 +582,6 @@
 }  // namespace
 }  // namespace quic
 
-int main(int argc, char *argv[]) {
+int main(int argc, char* argv[]) {
   return quic::RunMasqueTcpServer(argc, argv);
 }