diff --git a/quiche/quic/core/crypto/aead_base_decrypter.cc b/quiche/quic/core/crypto/aead_base_decrypter.cc
index 5bd3b2c..c79e74e 100644
--- a/quiche/quic/core/crypto/aead_base_decrypter.cc
+++ b/quiche/quic/core/crypto/aead_base_decrypter.cc
@@ -50,8 +50,7 @@
 }  // namespace
 
 AeadBaseDecrypter::AeadBaseDecrypter(const EVP_AEAD* (*aead_getter)(),
-                                     size_t key_size,
-                                     size_t auth_tag_size,
+                                     size_t key_size, size_t auth_tag_size,
                                      size_t nonce_size,
                                      bool use_ietf_nonce_construction)
     : aead_alg_(InitAndCall(aead_getter)),
@@ -151,8 +150,7 @@
 bool AeadBaseDecrypter::DecryptPacket(uint64_t packet_number,
                                       absl::string_view associated_data,
                                       absl::string_view ciphertext,
-                                      char* output,
-                                      size_t* output_length,
+                                      char* output, size_t* output_length,
                                       size_t max_output_length) {
   if (ciphertext.length() < auth_tag_size_) {
     return false;
@@ -190,17 +188,13 @@
   return true;
 }
 
-size_t AeadBaseDecrypter::GetKeySize() const {
-  return key_size_;
-}
+size_t AeadBaseDecrypter::GetKeySize() const { return key_size_; }
 
 size_t AeadBaseDecrypter::GetNoncePrefixSize() const {
   return nonce_size_ - sizeof(QuicPacketNumber);
 }
 
-size_t AeadBaseDecrypter::GetIVSize() const {
-  return nonce_size_;
-}
+size_t AeadBaseDecrypter::GetIVSize() const { return nonce_size_; }
 
 absl::string_view AeadBaseDecrypter::GetKey() const {
   return absl::string_view(reinterpret_cast<const char*>(key_), key_size_);
diff --git a/quiche/quic/core/crypto/aead_base_decrypter.h b/quiche/quic/core/crypto/aead_base_decrypter.h
index fe908ea..b123b13 100644
--- a/quiche/quic/core/crypto/aead_base_decrypter.h
+++ b/quiche/quic/core/crypto/aead_base_decrypter.h
@@ -19,10 +19,8 @@
  public:
   // This takes the function pointer rather than the EVP_AEAD itself so
   // subclasses do not need to call CRYPTO_library_init.
-  AeadBaseDecrypter(const EVP_AEAD* (*aead_getter)(),
-                    size_t key_size,
-                    size_t auth_tag_size,
-                    size_t nonce_size,
+  AeadBaseDecrypter(const EVP_AEAD* (*aead_getter)(), size_t key_size,
+                    size_t auth_tag_size, size_t nonce_size,
                     bool use_ietf_nonce_construction);
   AeadBaseDecrypter(const AeadBaseDecrypter&) = delete;
   AeadBaseDecrypter& operator=(const AeadBaseDecrypter&) = delete;
@@ -34,12 +32,9 @@
   bool SetIV(absl::string_view iv) override;
   bool SetPreliminaryKey(absl::string_view key) override;
   bool SetDiversificationNonce(const DiversificationNonce& nonce) override;
-  bool DecryptPacket(uint64_t packet_number,
-                     absl::string_view associated_data,
-                     absl::string_view ciphertext,
-                     char* output,
-                     size_t* output_length,
-                     size_t max_output_length) override;
+  bool DecryptPacket(uint64_t packet_number, absl::string_view associated_data,
+                     absl::string_view ciphertext, char* output,
+                     size_t* output_length, size_t max_output_length) override;
   size_t GetKeySize() const override;
   size_t GetNoncePrefixSize() const override;
   size_t GetIVSize() const override;
diff --git a/quiche/quic/core/crypto/aead_base_encrypter.cc b/quiche/quic/core/crypto/aead_base_encrypter.cc
index 198e0b6..a2f0d59 100644
--- a/quiche/quic/core/crypto/aead_base_encrypter.cc
+++ b/quiche/quic/core/crypto/aead_base_encrypter.cc
@@ -42,8 +42,7 @@
 }  // namespace
 
 AeadBaseEncrypter::AeadBaseEncrypter(const EVP_AEAD* (*aead_getter)(),
-                                     size_t key_size,
-                                     size_t auth_tag_size,
+                                     size_t key_size, size_t auth_tag_size,
                                      size_t nonce_size,
                                      bool use_ietf_nonce_construction)
     : aead_alg_(InitAndCall(aead_getter)),
@@ -126,8 +125,7 @@
 
 bool AeadBaseEncrypter::EncryptPacket(uint64_t packet_number,
                                       absl::string_view associated_data,
-                                      absl::string_view plaintext,
-                                      char* output,
+                                      absl::string_view plaintext, char* output,
                                       size_t* output_length,
                                       size_t max_output_length) {
   size_t ciphertext_size = GetCiphertextSize(plaintext.length());
@@ -156,17 +154,13 @@
   return true;
 }
 
-size_t AeadBaseEncrypter::GetKeySize() const {
-  return key_size_;
-}
+size_t AeadBaseEncrypter::GetKeySize() const { return key_size_; }
 
 size_t AeadBaseEncrypter::GetNoncePrefixSize() const {
   return nonce_size_ - sizeof(QuicPacketNumber);
 }
 
-size_t AeadBaseEncrypter::GetIVSize() const {
-  return nonce_size_;
-}
+size_t AeadBaseEncrypter::GetIVSize() const { return nonce_size_; }
 
 size_t AeadBaseEncrypter::GetMaxPlaintextSize(size_t ciphertext_size) const {
   return ciphertext_size - std::min(ciphertext_size, auth_tag_size_);
diff --git a/quiche/quic/core/crypto/aead_base_encrypter.h b/quiche/quic/core/crypto/aead_base_encrypter.h
index 5cd695d..205b232 100644
--- a/quiche/quic/core/crypto/aead_base_encrypter.h
+++ b/quiche/quic/core/crypto/aead_base_encrypter.h
@@ -19,10 +19,8 @@
  public:
   // This takes the function pointer rather than the EVP_AEAD itself so
   // subclasses do not need to call CRYPTO_library_init.
-  AeadBaseEncrypter(const EVP_AEAD* (*aead_getter)(),
-                    size_t key_size,
-                    size_t auth_tag_size,
-                    size_t nonce_size,
+  AeadBaseEncrypter(const EVP_AEAD* (*aead_getter)(), size_t key_size,
+                    size_t auth_tag_size, size_t nonce_size,
                     bool use_ietf_nonce_construction);
   AeadBaseEncrypter(const AeadBaseEncrypter&) = delete;
   AeadBaseEncrypter& operator=(const AeadBaseEncrypter&) = delete;
@@ -32,12 +30,9 @@
   bool SetKey(absl::string_view key) override;
   bool SetNoncePrefix(absl::string_view nonce_prefix) override;
   bool SetIV(absl::string_view iv) override;
-  bool EncryptPacket(uint64_t packet_number,
-                     absl::string_view associated_data,
-                     absl::string_view plaintext,
-                     char* output,
-                     size_t* output_length,
-                     size_t max_output_length) override;
+  bool EncryptPacket(uint64_t packet_number, absl::string_view associated_data,
+                     absl::string_view plaintext, char* output,
+                     size_t* output_length, size_t max_output_length) override;
   size_t GetKeySize() const override;
   size_t GetNoncePrefixSize() const override;
   size_t GetIVSize() const override;
@@ -48,10 +43,8 @@
 
   // Necessary so unit tests can explicitly specify a nonce, instead of an IV
   // (or nonce prefix) and packet number.
-  bool Encrypt(absl::string_view nonce,
-               absl::string_view associated_data,
-               absl::string_view plaintext,
-               unsigned char* output);
+  bool Encrypt(absl::string_view nonce, absl::string_view associated_data,
+               absl::string_view plaintext, unsigned char* output);
 
  protected:
   // Make these constants available to the subclasses so that the subclasses
diff --git a/quiche/quic/core/crypto/aes_128_gcm_12_decrypter.cc b/quiche/quic/core/crypto/aes_128_gcm_12_decrypter.cc
index 8a6f4a9..66f2ad2 100644
--- a/quiche/quic/core/crypto/aes_128_gcm_12_decrypter.cc
+++ b/quiche/quic/core/crypto/aes_128_gcm_12_decrypter.cc
@@ -17,10 +17,7 @@
 }  // namespace
 
 Aes128Gcm12Decrypter::Aes128Gcm12Decrypter()
-    : AesBaseDecrypter(EVP_aead_aes_128_gcm,
-                       kKeySize,
-                       kAuthTagSize,
-                       kNonceSize,
+    : AesBaseDecrypter(EVP_aead_aes_128_gcm, kKeySize, kAuthTagSize, kNonceSize,
                        /* use_ietf_nonce_construction */ false) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
   static_assert(kNonceSize <= kMaxNonceSize, "nonce size too big");
diff --git a/quiche/quic/core/crypto/aes_128_gcm_12_encrypter.cc b/quiche/quic/core/crypto/aes_128_gcm_12_encrypter.cc
index c1c8929..5bbaeba 100644
--- a/quiche/quic/core/crypto/aes_128_gcm_12_encrypter.cc
+++ b/quiche/quic/core/crypto/aes_128_gcm_12_encrypter.cc
@@ -16,10 +16,7 @@
 }  // namespace
 
 Aes128Gcm12Encrypter::Aes128Gcm12Encrypter()
-    : AesBaseEncrypter(EVP_aead_aes_128_gcm,
-                       kKeySize,
-                       kAuthTagSize,
-                       kNonceSize,
+    : AesBaseEncrypter(EVP_aead_aes_128_gcm, kKeySize, kAuthTagSize, kNonceSize,
                        /* use_ietf_nonce_construction */ false) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
   static_assert(kNonceSize <= kMaxNonceSize, "nonce size too big");
diff --git a/quiche/quic/core/crypto/aes_128_gcm_decrypter.cc b/quiche/quic/core/crypto/aes_128_gcm_decrypter.cc
index 4c1fb97..c43123b 100644
--- a/quiche/quic/core/crypto/aes_128_gcm_decrypter.cc
+++ b/quiche/quic/core/crypto/aes_128_gcm_decrypter.cc
@@ -19,10 +19,7 @@
 }  // namespace
 
 Aes128GcmDecrypter::Aes128GcmDecrypter()
-    : AesBaseDecrypter(EVP_aead_aes_128_gcm,
-                       kKeySize,
-                       kAuthTagSize,
-                       kNonceSize,
+    : AesBaseDecrypter(EVP_aead_aes_128_gcm, kKeySize, kAuthTagSize, kNonceSize,
                        /* use_ietf_nonce_construction */ true) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
   static_assert(kNonceSize <= kMaxNonceSize, "nonce size too big");
diff --git a/quiche/quic/core/crypto/aes_128_gcm_encrypter.cc b/quiche/quic/core/crypto/aes_128_gcm_encrypter.cc
index ec85d03..22f9b2a 100644
--- a/quiche/quic/core/crypto/aes_128_gcm_encrypter.cc
+++ b/quiche/quic/core/crypto/aes_128_gcm_encrypter.cc
@@ -16,10 +16,7 @@
 }  // namespace
 
 Aes128GcmEncrypter::Aes128GcmEncrypter()
-    : AesBaseEncrypter(EVP_aead_aes_128_gcm,
-                       kKeySize,
-                       kAuthTagSize,
-                       kNonceSize,
+    : AesBaseEncrypter(EVP_aead_aes_128_gcm, kKeySize, kAuthTagSize, kNonceSize,
                        /* use_ietf_nonce_construction */ true) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
   static_assert(kNonceSize <= kMaxNonceSize, "nonce size too big");
diff --git a/quiche/quic/core/crypto/aes_256_gcm_decrypter.cc b/quiche/quic/core/crypto/aes_256_gcm_decrypter.cc
index e914693..58d4e3c 100644
--- a/quiche/quic/core/crypto/aes_256_gcm_decrypter.cc
+++ b/quiche/quic/core/crypto/aes_256_gcm_decrypter.cc
@@ -19,10 +19,7 @@
 }  // namespace
 
 Aes256GcmDecrypter::Aes256GcmDecrypter()
-    : AesBaseDecrypter(EVP_aead_aes_256_gcm,
-                       kKeySize,
-                       kAuthTagSize,
-                       kNonceSize,
+    : AesBaseDecrypter(EVP_aead_aes_256_gcm, kKeySize, kAuthTagSize, kNonceSize,
                        /* use_ietf_nonce_construction */ true) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
   static_assert(kNonceSize <= kMaxNonceSize, "nonce size too big");
diff --git a/quiche/quic/core/crypto/aes_256_gcm_encrypter.cc b/quiche/quic/core/crypto/aes_256_gcm_encrypter.cc
index e7441d4..802ff99 100644
--- a/quiche/quic/core/crypto/aes_256_gcm_encrypter.cc
+++ b/quiche/quic/core/crypto/aes_256_gcm_encrypter.cc
@@ -16,10 +16,7 @@
 }  // namespace
 
 Aes256GcmEncrypter::Aes256GcmEncrypter()
-    : AesBaseEncrypter(EVP_aead_aes_256_gcm,
-                       kKeySize,
-                       kAuthTagSize,
-                       kNonceSize,
+    : AesBaseEncrypter(EVP_aead_aes_256_gcm, kKeySize, kAuthTagSize, kNonceSize,
                        /* use_ietf_nonce_construction */ true) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
   static_assert(kNonceSize <= kMaxNonceSize, "nonce size too big");
diff --git a/quiche/quic/core/crypto/cert_compressor.cc b/quiche/quic/core/crypto/cert_compressor.cc
index 6a69c50..4357b9c 100644
--- a/quiche/quic/core/crypto/cert_compressor.cc
+++ b/quiche/quic/core/crypto/cert_compressor.cc
@@ -510,8 +510,7 @@
 
 // static
 bool CertCompressor::DecompressChain(
-    absl::string_view in,
-    const std::vector<std::string>& cached_certs,
+    absl::string_view in, const std::vector<std::string>& cached_certs,
     std::vector<std::string>* out_certs) {
   std::vector<CertEntry> entries;
   if (!ParseEntries(&in, cached_certs, &entries, out_certs)) {
diff --git a/quiche/quic/core/crypto/certificate_view.cc b/quiche/quic/core/crypto/certificate_view.cc
index db8eb81..1c4d3a2 100644
--- a/quiche/quic/core/crypto/certificate_view.cc
+++ b/quiche/quic/core/crypto/certificate_view.cc
@@ -137,8 +137,7 @@
 
 namespace {
 
-template <unsigned inner_tag,
-          char separator,
+template <unsigned inner_tag, char separator,
           absl::optional<std::string> (*parser)(CBS)>
 absl::optional<std::string> ParseAndJoin(CBS input) {
   std::vector<std::string> pieces;
diff --git a/quiche/quic/core/crypto/certificate_view.h b/quiche/quic/core/crypto/certificate_view.h
index cff9225..a0ca3c3 100644
--- a/quiche/quic/core/crypto/certificate_view.h
+++ b/quiche/quic/core/crypto/certificate_view.h
@@ -75,8 +75,7 @@
   absl::optional<std::string> GetHumanReadableSubject() const;
 
   // |signature_algorithm| is a TLS signature algorithm ID.
-  bool VerifySignature(absl::string_view data,
-                       absl::string_view signature,
+  bool VerifySignature(absl::string_view data, absl::string_view signature,
                        uint16_t signature_algorithm) const;
 
   // Returns the type of the key used in the certificate's SPKI.
@@ -143,8 +142,7 @@
 // Parses a DER time based on the specified ASN.1 tag.  Exposed primarily for
 // testing.
 QUIC_EXPORT_PRIVATE absl::optional<quic::QuicWallTime> ParseDerTime(
-    unsigned tag,
-    absl::string_view payload);
+    unsigned tag, absl::string_view payload);
 
 }  // namespace quic
 
diff --git a/quiche/quic/core/crypto/chacha20_poly1305_decrypter.cc b/quiche/quic/core/crypto/chacha20_poly1305_decrypter.cc
index f1102d6..31758b4 100644
--- a/quiche/quic/core/crypto/chacha20_poly1305_decrypter.cc
+++ b/quiche/quic/core/crypto/chacha20_poly1305_decrypter.cc
@@ -17,9 +17,7 @@
 }  // namespace
 
 ChaCha20Poly1305Decrypter::ChaCha20Poly1305Decrypter()
-    : ChaChaBaseDecrypter(EVP_aead_chacha20_poly1305,
-                          kKeySize,
-                          kAuthTagSize,
+    : ChaChaBaseDecrypter(EVP_aead_chacha20_poly1305, kKeySize, kAuthTagSize,
                           kNonceSize,
                           /* use_ietf_nonce_construction */ false) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
diff --git a/quiche/quic/core/crypto/chacha20_poly1305_encrypter.cc b/quiche/quic/core/crypto/chacha20_poly1305_encrypter.cc
index d71804c..1adad07 100644
--- a/quiche/quic/core/crypto/chacha20_poly1305_encrypter.cc
+++ b/quiche/quic/core/crypto/chacha20_poly1305_encrypter.cc
@@ -16,9 +16,7 @@
 }  // namespace
 
 ChaCha20Poly1305Encrypter::ChaCha20Poly1305Encrypter()
-    : ChaChaBaseEncrypter(EVP_aead_chacha20_poly1305,
-                          kKeySize,
-                          kAuthTagSize,
+    : ChaChaBaseEncrypter(EVP_aead_chacha20_poly1305, kKeySize, kAuthTagSize,
                           kNonceSize,
                           /* use_ietf_nonce_construction */ false) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
diff --git a/quiche/quic/core/crypto/chacha20_poly1305_tls_decrypter.cc b/quiche/quic/core/crypto/chacha20_poly1305_tls_decrypter.cc
index 218be83..93b0993 100644
--- a/quiche/quic/core/crypto/chacha20_poly1305_tls_decrypter.cc
+++ b/quiche/quic/core/crypto/chacha20_poly1305_tls_decrypter.cc
@@ -19,9 +19,7 @@
 }  // namespace
 
 ChaCha20Poly1305TlsDecrypter::ChaCha20Poly1305TlsDecrypter()
-    : ChaChaBaseDecrypter(EVP_aead_chacha20_poly1305,
-                          kKeySize,
-                          kAuthTagSize,
+    : ChaChaBaseDecrypter(EVP_aead_chacha20_poly1305, kKeySize, kAuthTagSize,
                           kNonceSize,
                           /* use_ietf_nonce_construction */ true) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
diff --git a/quiche/quic/core/crypto/chacha20_poly1305_tls_encrypter.cc b/quiche/quic/core/crypto/chacha20_poly1305_tls_encrypter.cc
index baae93c..fe6f6b4 100644
--- a/quiche/quic/core/crypto/chacha20_poly1305_tls_encrypter.cc
+++ b/quiche/quic/core/crypto/chacha20_poly1305_tls_encrypter.cc
@@ -16,9 +16,7 @@
 }  // namespace
 
 ChaCha20Poly1305TlsEncrypter::ChaCha20Poly1305TlsEncrypter()
-    : ChaChaBaseEncrypter(EVP_aead_chacha20_poly1305,
-                          kKeySize,
-                          kAuthTagSize,
+    : ChaChaBaseEncrypter(EVP_aead_chacha20_poly1305, kKeySize, kAuthTagSize,
                           kNonceSize,
                           /* use_ietf_nonce_construction */ true) {
   static_assert(kKeySize <= kMaxKeySize, "key size too big");
diff --git a/quiche/quic/core/crypto/channel_id.h b/quiche/quic/core/crypto/channel_id.h
index 9d20215..2f8a527 100644
--- a/quiche/quic/core/crypto/channel_id.h
+++ b/quiche/quic/core/crypto/channel_id.h
@@ -30,16 +30,14 @@
 
   // Verify returns true iff |signature| is a valid signature of |signed_data|
   // by |key|.
-  static bool Verify(absl::string_view key,
-                     absl::string_view signed_data,
+  static bool Verify(absl::string_view key, absl::string_view signed_data,
                      absl::string_view signature);
 
   // FOR TESTING ONLY: VerifyRaw returns true iff |signature| is a valid
   // signature of |signed_data| by |key|. |is_channel_id_signature| indicates
   // whether |signature| is a ChannelID signature (with kContextStr prepended
   // to the data to be signed).
-  static bool VerifyRaw(absl::string_view key,
-                        absl::string_view signed_data,
+  static bool VerifyRaw(absl::string_view key, absl::string_view signed_data,
                         absl::string_view signature,
                         bool is_channel_id_signature);
 };
diff --git a/quiche/quic/core/crypto/channel_id_test.cc b/quiche/quic/core/crypto/channel_id_test.cc
index 40e5090..ff3d73d 100644
--- a/quiche/quic/core/crypto/channel_id_test.cc
+++ b/quiche/quic/core/crypto/channel_id_test.cc
@@ -218,9 +218,7 @@
 // Converts |in| to bytes and stores the bytes in the |out| buffer. The
 // number of bytes converted is returned in |*out_len|. Returns true on
 // success, false on failure.
-bool DecodeHexString(const char* in,
-                     char* out,
-                     size_t* out_len,
+bool DecodeHexString(const char* in, char* out, size_t* out_len,
                      size_t max_len) {
   if (!in) {
     *out_len = static_cast<size_t>(-1);
diff --git a/quiche/quic/core/crypto/crypto_framer.cc b/quiche/quic/core/crypto/crypto_framer.cc
index db4e0b0..57a949e 100644
--- a/quiche/quic/core/crypto/crypto_framer.cc
+++ b/quiche/quic/core/crypto/crypto_framer.cc
@@ -73,13 +73,9 @@
   return visitor.release();
 }
 
-QuicErrorCode CryptoFramer::error() const {
-  return error_;
-}
+QuicErrorCode CryptoFramer::error() const { return error_; }
 
-const std::string& CryptoFramer::error_detail() const {
-  return error_detail_;
-}
+const std::string& CryptoFramer::error_detail() const { return error_detail_; }
 
 bool CryptoFramer::ProcessInput(absl::string_view input,
                                 EncryptionLevel /*level*/) {
@@ -101,9 +97,7 @@
   return true;
 }
 
-size_t CryptoFramer::InputBytesRemaining() const {
-  return buffer_.length();
-}
+size_t CryptoFramer::InputBytesRemaining() const { return buffer_.length(); }
 
 bool CryptoFramer::HasTag(QuicTag tag) const {
   if (state_ != STATE_READING_VALUES) {
@@ -340,8 +334,7 @@
 }
 
 // static
-bool CryptoFramer::WritePadTag(QuicDataWriter* writer,
-                               size_t pad_length,
+bool CryptoFramer::WritePadTag(QuicDataWriter* writer, size_t pad_length,
                                uint32_t* end_offset) {
   if (!writer->WriteTag(kPAD)) {
     QUICHE_DCHECK(false) << "Failed to write tag.";
diff --git a/quiche/quic/core/crypto/crypto_framer.h b/quiche/quic/core/crypto/crypto_framer.h
index 919ec09..8d20bdc 100644
--- a/quiche/quic/core/crypto/crypto_framer.h
+++ b/quiche/quic/core/crypto/crypto_framer.h
@@ -97,8 +97,7 @@
   // doesn't set error_ and doesn't call |visitor_->OnError()|.
   QuicErrorCode Process(absl::string_view input);
 
-  static bool WritePadTag(QuicDataWriter* writer,
-                          size_t pad_length,
+  static bool WritePadTag(QuicDataWriter* writer, size_t pad_length,
                           uint32_t* end_offset);
 
   // Represents the current state of the parsing state machine.
diff --git a/quiche/quic/core/crypto/crypto_handshake_message.cc b/quiche/quic/core/crypto/crypto_handshake_message.cc
index 474036e..9fa4dfa 100644
--- a/quiche/quic/core/crypto/crypto_handshake_message.cc
+++ b/quiche/quic/core/crypto/crypto_handshake_message.cc
@@ -75,13 +75,10 @@
   return *serialized_;
 }
 
-void CryptoHandshakeMessage::MarkDirty() {
-  serialized_.reset();
-}
+void CryptoHandshakeMessage::MarkDirty() { serialized_.reset(); }
 
 void CryptoHandshakeMessage::SetVersionVector(
-    QuicTag tag,
-    ParsedQuicVersionVector versions) {
+    QuicTag tag, ParsedQuicVersionVector versions) {
   QuicVersionLabelVector version_labels;
   for (const ParsedQuicVersion& version : versions) {
     version_labels.push_back(
@@ -101,13 +98,10 @@
   tag_value_map_[tag] = std::string(value);
 }
 
-void CryptoHandshakeMessage::Erase(QuicTag tag) {
-  tag_value_map_.erase(tag);
-}
+void CryptoHandshakeMessage::Erase(QuicTag tag) { tag_value_map_.erase(tag); }
 
 QuicErrorCode CryptoHandshakeMessage::GetTaglist(
-    QuicTag tag,
-    QuicTagVector* out_tags) const {
+    QuicTag tag, QuicTagVector* out_tags) const {
   auto it = tag_value_map_.find(tag);
   QuicErrorCode ret = QUIC_NO_ERROR;
 
@@ -133,8 +127,7 @@
 }
 
 QuicErrorCode CryptoHandshakeMessage::GetVersionLabelList(
-    QuicTag tag,
-    QuicVersionLabelVector* out) const {
+    QuicTag tag, QuicVersionLabelVector* out) const {
   QuicErrorCode error = GetTaglist(tag, out);
   if (error != QUIC_NO_ERROR) {
     return error;
@@ -148,8 +141,7 @@
 }
 
 QuicErrorCode CryptoHandshakeMessage::GetVersionLabel(
-    QuicTag tag,
-    QuicVersionLabel* out) const {
+    QuicTag tag, QuicVersionLabel* out) const {
   QuicErrorCode error = GetUint32(tag, out);
   if (error != QUIC_NO_ERROR) {
     return error;
@@ -174,9 +166,7 @@
 }
 
 QuicErrorCode CryptoHandshakeMessage::GetNthValue24(
-    QuicTag tag,
-    unsigned index,
-    absl::string_view* out) const {
+    QuicTag tag, unsigned index, absl::string_view* out) const {
   absl::string_view value;
   if (!GetStringPiece(tag, &value)) {
     return QUIC_CRYPTO_MESSAGE_PARAMETER_NOT_FOUND;
@@ -221,8 +211,7 @@
 }
 
 QuicErrorCode CryptoHandshakeMessage::GetStatelessResetToken(
-    QuicTag tag,
-    StatelessResetToken* out) const {
+    QuicTag tag, StatelessResetToken* out) const {
   return GetPOD(tag, out, kStatelessResetTokenLength);
 }
 
@@ -246,16 +235,13 @@
   minimum_size_ = min_bytes;
 }
 
-size_t CryptoHandshakeMessage::minimum_size() const {
-  return minimum_size_;
-}
+size_t CryptoHandshakeMessage::minimum_size() const { return minimum_size_; }
 
 std::string CryptoHandshakeMessage::DebugString() const {
   return DebugStringInternal(0);
 }
 
-QuicErrorCode CryptoHandshakeMessage::GetPOD(QuicTag tag,
-                                             void* out,
+QuicErrorCode CryptoHandshakeMessage::GetPOD(QuicTag tag, void* out,
                                              size_t len) const {
   auto it = tag_value_map_.find(tag);
   QuicErrorCode ret = QUIC_NO_ERROR;
diff --git a/quiche/quic/core/crypto/crypto_handshake_message.h b/quiche/quic/core/crypto/crypto_handshake_message.h
index 4785fa8..b50c559 100644
--- a/quiche/quic/core/crypto/crypto_handshake_message.h
+++ b/quiche/quic/core/crypto/crypto_handshake_message.h
@@ -105,8 +105,7 @@
   // GetNthValue24 interprets the value with the given tag to be a series of
   // 24-bit, length prefixed values and it returns the subvalue with the given
   // index.
-  QuicErrorCode GetNthValue24(QuicTag tag,
-                              unsigned index,
+  QuicErrorCode GetNthValue24(QuicTag tag, unsigned index,
                               absl::string_view* out) const;
   QuicErrorCode GetUint32(QuicTag tag, uint32_t* out) const;
   QuicErrorCode GetUint64(QuicTag tag, uint64_t* out) const;
diff --git a/quiche/quic/core/crypto/crypto_secret_boxer.cc b/quiche/quic/core/crypto/crypto_secret_boxer.cc
index 950e3a9..2be495d 100644
--- a/quiche/quic/core/crypto/crypto_secret_boxer.cc
+++ b/quiche/quic/core/crypto/crypto_secret_boxer.cc
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "quiche/quic/core/crypto/crypto_secret_boxer.h"
+
 #include <cstdint>
 #include <string>
 
-#include "quiche/quic/core/crypto/crypto_secret_boxer.h"
-
 #include "absl/strings/string_view.h"
 #include "openssl/aead.h"
 #include "openssl/err.h"
@@ -37,9 +37,7 @@
 CryptoSecretBoxer::~CryptoSecretBoxer() {}
 
 // static
-size_t CryptoSecretBoxer::GetKeySize() {
-  return kBoxKeySize;
-}
+size_t CryptoSecretBoxer::GetKeySize() { return kBoxKeySize; }
 
 // kAEAD is the AEAD used for boxing: AES-256-GCM-SIV.
 static const EVP_AEAD* (*const kAEAD)() = EVP_aead_aes_256_gcm_siv;
diff --git a/quiche/quic/core/crypto/crypto_secret_boxer.h b/quiche/quic/core/crypto/crypto_secret_boxer.h
index 3010e14..e1927f2 100644
--- a/quiche/quic/core/crypto/crypto_secret_boxer.h
+++ b/quiche/quic/core/crypto/crypto_secret_boxer.h
@@ -50,8 +50,7 @@
   // the supplied keys, the function returns false. Otherwise, |out_storage| is
   // used to store the result and |out| is set to point into |out_storage| and
   // contains the original plaintext.
-  bool Unbox(absl::string_view ciphertext,
-             std::string* out_storage,
+  bool Unbox(absl::string_view ciphertext, std::string* out_storage,
              absl::string_view* out) const;
 
  private:
diff --git a/quiche/quic/core/crypto/crypto_server_test.cc b/quiche/quic/core/crypto/crypto_server_test.cc
index 2e5b090..56f7283 100644
--- a/quiche/quic/core/crypto/crypto_server_test.cc
+++ b/quiche/quic/core/crypto/crypto_server_test.cc
@@ -45,8 +45,7 @@
   DummyProofVerifierCallback() {}
   ~DummyProofVerifierCallback() override {}
 
-  void Run(bool /*ok*/,
-           const std::string& /*error_details*/,
+  void Run(bool /*ok*/, const std::string& /*error_details*/,
            std::unique_ptr<ProofVerifyDetails>* /*details*/) override {
     QUICHE_DCHECK(false);
   }
@@ -94,8 +93,7 @@
       : rand_(QuicRandom::GetInstance()),
         client_address_(QuicIpAddress::Loopback4(), 1234),
         client_version_(UnsupportedQuicVersion()),
-        config_(QuicCryptoServerConfig::TESTING,
-                rand_,
+        config_(QuicCryptoServerConfig::TESTING, rand_,
                 crypto_test_utils::ProofSourceForTesting(),
                 KeyExchangeSource::Default()),
         peer_(&config_),
@@ -176,10 +174,8 @@
   // it on to ProcessClientHello.
   class ValidateCallback : public ValidateClientHelloResultCallback {
    public:
-    ValidateCallback(CryptoServerTest* test,
-                     bool should_succeed,
-                     const char* error_substr,
-                     bool* called)
+    ValidateCallback(CryptoServerTest* test, bool should_succeed,
+                     const char* error_substr, bool* called)
         : test_(test),
           should_succeed_(should_succeed),
           error_substr_(error_substr),
@@ -259,8 +255,7 @@
       *called_ = false;
     }
 
-    void Run(QuicErrorCode error,
-             const std::string& error_details,
+    void Run(QuicErrorCode error, const std::string& error_details,
              std::unique_ptr<CryptoHandshakeMessage> message,
              std::unique_ptr<DiversificationNonce> /*diversification_nonce*/,
              std::unique_ptr<ProofSource::Details> /*proof_source_details*/)
@@ -366,8 +361,7 @@
   std::unique_ptr<CryptoHandshakeMessage> server_config_;
 };
 
-INSTANTIATE_TEST_SUITE_P(CryptoServerTests,
-                         CryptoServerTest,
+INSTANTIATE_TEST_SUITE_P(CryptoServerTests, CryptoServerTest,
                          ::testing::ValuesIn(GetTestParams()),
                          ::testing::PrintToStringParamName());
 
diff --git a/quiche/quic/core/crypto/curve25519_key_exchange.cc b/quiche/quic/core/crypto/curve25519_key_exchange.cc
index a303bd9..5340b41 100644
--- a/quiche/quic/core/crypto/curve25519_key_exchange.cc
+++ b/quiche/quic/core/crypto/curve25519_key_exchange.cc
@@ -63,8 +63,7 @@
 }
 
 bool Curve25519KeyExchange::CalculateSharedKeySync(
-    absl::string_view peer_public_value,
-    std::string* shared_key) const {
+    absl::string_view peer_public_value, std::string* shared_key) const {
   if (peer_public_value.size() != X25519_PUBLIC_VALUE_LEN) {
     return false;
   }
diff --git a/quiche/quic/core/crypto/key_exchange.cc b/quiche/quic/core/crypto/key_exchange.cc
index 4a5947b..38dea00 100644
--- a/quiche/quic/core/crypto/key_exchange.cc
+++ b/quiche/quic/core/crypto/key_exchange.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "quiche/quic/core/crypto/key_exchange.h"
+
 #include "absl/strings/string_view.h"
 #include "quiche/quic/core/crypto/curve25519_key_exchange.h"
 #include "quiche/quic/core/crypto/p256_key_exchange.h"
@@ -11,8 +12,7 @@
 namespace quic {
 
 std::unique_ptr<SynchronousKeyExchange> CreateLocalSynchronousKeyExchange(
-    QuicTag type,
-    absl::string_view private_key) {
+    QuicTag type, absl::string_view private_key) {
   switch (type) {
     case kC255:
       return Curve25519KeyExchange::New(private_key);
@@ -26,8 +26,7 @@
 }
 
 std::unique_ptr<SynchronousKeyExchange> CreateLocalSynchronousKeyExchange(
-    QuicTag type,
-    QuicRandom* rand) {
+    QuicTag type, QuicRandom* rand) {
   switch (type) {
     case kC255:
       return Curve25519KeyExchange::New(rand);
diff --git a/quiche/quic/core/crypto/key_exchange.h b/quiche/quic/core/crypto/key_exchange.h
index 74c44ee..a681bf5 100644
--- a/quiche/quic/core/crypto/key_exchange.h
+++ b/quiche/quic/core/crypto/key_exchange.h
@@ -48,8 +48,7 @@
   // that |callback| might be invoked synchronously.  Results will be written
   // into |*shared_key|.
   virtual void CalculateSharedKeyAsync(
-      absl::string_view peer_public_value,
-      std::string* shared_key,
+      absl::string_view peer_public_value, std::string* shared_key,
       std::unique_ptr<Callback> callback) const = 0;
 
   // Tag indicating the key-exchange algorithm this object will use.
@@ -90,15 +89,13 @@
 // must be one of {kC255, kC256}.  Returns nullptr if |private_key| or |type| is
 // invalid.
 std::unique_ptr<SynchronousKeyExchange> CreateLocalSynchronousKeyExchange(
-    QuicTag type,
-    absl::string_view private_key);
+    QuicTag type, absl::string_view private_key);
 
 // Create a SynchronousKeyExchange object which will use a keypair generated
 // from |rand|, and a key-exchange algorithm specified by |type|, which must be
 // one of {kC255, kC256}.  Returns nullptr if |type| is invalid.
 std::unique_ptr<SynchronousKeyExchange> CreateLocalSynchronousKeyExchange(
-    QuicTag type,
-    QuicRandom* rand);
+    QuicTag type, QuicRandom* rand);
 
 }  // namespace quic
 
diff --git a/quiche/quic/core/crypto/null_decrypter.cc b/quiche/quic/core/crypto/null_decrypter.cc
index 5287ce9..af0c444 100644
--- a/quiche/quic/core/crypto/null_decrypter.cc
+++ b/quiche/quic/core/crypto/null_decrypter.cc
@@ -18,17 +18,13 @@
 NullDecrypter::NullDecrypter(Perspective perspective)
     : perspective_(perspective) {}
 
-bool NullDecrypter::SetKey(absl::string_view key) {
-  return key.empty();
-}
+bool NullDecrypter::SetKey(absl::string_view key) { return key.empty(); }
 
 bool NullDecrypter::SetNoncePrefix(absl::string_view nonce_prefix) {
   return nonce_prefix.empty();
 }
 
-bool NullDecrypter::SetIV(absl::string_view iv) {
-  return iv.empty();
-}
+bool NullDecrypter::SetIV(absl::string_view iv) { return iv.empty(); }
 
 bool NullDecrypter::SetHeaderProtectionKey(absl::string_view key) {
   return key.empty();
@@ -47,8 +43,7 @@
 
 bool NullDecrypter::DecryptPacket(uint64_t /*packet_number*/,
                                   absl::string_view associated_data,
-                                  absl::string_view ciphertext,
-                                  char* output,
+                                  absl::string_view ciphertext, char* output,
                                   size_t* output_length,
                                   size_t max_output_length) {
   QuicDataReader reader(ciphertext.data(), ciphertext.length(),
@@ -79,29 +74,19 @@
   return std::string(5, 0);
 }
 
-size_t NullDecrypter::GetKeySize() const {
-  return 0;
-}
+size_t NullDecrypter::GetKeySize() const { return 0; }
 
-size_t NullDecrypter::GetNoncePrefixSize() const {
-  return 0;
-}
+size_t NullDecrypter::GetNoncePrefixSize() const { return 0; }
 
-size_t NullDecrypter::GetIVSize() const {
-  return 0;
-}
+size_t NullDecrypter::GetIVSize() const { return 0; }
 
-absl::string_view NullDecrypter::GetKey() const {
-  return absl::string_view();
-}
+absl::string_view NullDecrypter::GetKey() const { return absl::string_view(); }
 
 absl::string_view NullDecrypter::GetNoncePrefix() const {
   return absl::string_view();
 }
 
-uint32_t NullDecrypter::cipher_id() const {
-  return 0;
-}
+uint32_t NullDecrypter::cipher_id() const { return 0; }
 
 QuicPacketCount NullDecrypter::GetIntegrityLimit() const {
   return std::numeric_limits<QuicPacketCount>::max();
diff --git a/quiche/quic/core/crypto/null_decrypter.h b/quiche/quic/core/crypto/null_decrypter.h
index 05e1103..9b6fb45 100644
--- a/quiche/quic/core/crypto/null_decrypter.h
+++ b/quiche/quic/core/crypto/null_decrypter.h
@@ -35,12 +35,9 @@
   bool SetHeaderProtectionKey(absl::string_view key) override;
   bool SetPreliminaryKey(absl::string_view key) override;
   bool SetDiversificationNonce(const DiversificationNonce& nonce) override;
-  bool DecryptPacket(uint64_t packet_number,
-                     absl::string_view associated_data,
-                     absl::string_view ciphertext,
-                     char* output,
-                     size_t* output_length,
-                     size_t max_output_length) override;
+  bool DecryptPacket(uint64_t packet_number, absl::string_view associated_data,
+                     absl::string_view ciphertext, char* output,
+                     size_t* output_length, size_t max_output_length) override;
   std::string GenerateHeaderProtectionMask(
       QuicDataReader* sample_reader) override;
   size_t GetKeySize() const override;
diff --git a/quiche/quic/core/crypto/null_decrypter_test.cc b/quiche/quic/core/crypto/null_decrypter_test.cc
index ad06bea..e71ed01 100644
--- a/quiche/quic/core/crypto/null_decrypter_test.cc
+++ b/quiche/quic/core/crypto/null_decrypter_test.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "quiche/quic/core/crypto/null_decrypter.h"
+
 #include "absl/base/macros.h"
 #include "quiche/quic/platform/api/quic_test.h"
 #include "quiche/quic/test_tools/quic_test_utils.h"
diff --git a/quiche/quic/core/crypto/null_encrypter.cc b/quiche/quic/core/crypto/null_encrypter.cc
index 8df815b..87a3f32 100644
--- a/quiche/quic/core/crypto/null_encrypter.cc
+++ b/quiche/quic/core/crypto/null_encrypter.cc
@@ -16,17 +16,13 @@
 NullEncrypter::NullEncrypter(Perspective perspective)
     : perspective_(perspective) {}
 
-bool NullEncrypter::SetKey(absl::string_view key) {
-  return key.empty();
-}
+bool NullEncrypter::SetKey(absl::string_view key) { return key.empty(); }
 
 bool NullEncrypter::SetNoncePrefix(absl::string_view nonce_prefix) {
   return nonce_prefix.empty();
 }
 
-bool NullEncrypter::SetIV(absl::string_view iv) {
-  return iv.empty();
-}
+bool NullEncrypter::SetIV(absl::string_view iv) { return iv.empty(); }
 
 bool NullEncrypter::SetHeaderProtectionKey(absl::string_view key) {
   return key.empty();
@@ -34,8 +30,7 @@
 
 bool NullEncrypter::EncryptPacket(uint64_t /*packet_number*/,
                                   absl::string_view associated_data,
-                                  absl::string_view plaintext,
-                                  char* output,
+                                  absl::string_view plaintext, char* output,
                                   size_t* output_length,
                                   size_t max_output_length) {
   const size_t len = plaintext.size() + GetHashLength();
@@ -64,17 +59,11 @@
   return std::string(5, 0);
 }
 
-size_t NullEncrypter::GetKeySize() const {
-  return 0;
-}
+size_t NullEncrypter::GetKeySize() const { return 0; }
 
-size_t NullEncrypter::GetNoncePrefixSize() const {
-  return 0;
-}
+size_t NullEncrypter::GetNoncePrefixSize() const { return 0; }
 
-size_t NullEncrypter::GetIVSize() const {
-  return 0;
-}
+size_t NullEncrypter::GetIVSize() const { return 0; }
 
 size_t NullEncrypter::GetMaxPlaintextSize(size_t ciphertext_size) const {
   return ciphertext_size - std::min(ciphertext_size, GetHashLength());
@@ -88,16 +77,12 @@
   return std::numeric_limits<QuicPacketCount>::max();
 }
 
-absl::string_view NullEncrypter::GetKey() const {
-  return absl::string_view();
-}
+absl::string_view NullEncrypter::GetKey() const { return absl::string_view(); }
 
 absl::string_view NullEncrypter::GetNoncePrefix() const {
   return absl::string_view();
 }
 
-size_t NullEncrypter::GetHashLength() const {
-  return kHashSizeShort;
-}
+size_t NullEncrypter::GetHashLength() const { return kHashSizeShort; }
 
 }  // namespace quic
diff --git a/quiche/quic/core/crypto/null_encrypter.h b/quiche/quic/core/crypto/null_encrypter.h
index cdcf66c..c5e599f 100644
--- a/quiche/quic/core/crypto/null_encrypter.h
+++ b/quiche/quic/core/crypto/null_encrypter.h
@@ -29,12 +29,9 @@
   bool SetNoncePrefix(absl::string_view nonce_prefix) override;
   bool SetIV(absl::string_view iv) override;
   bool SetHeaderProtectionKey(absl::string_view key) override;
-  bool EncryptPacket(uint64_t packet_number,
-                     absl::string_view associated_data,
-                     absl::string_view plaintext,
-                     char* output,
-                     size_t* output_length,
-                     size_t max_output_length) override;
+  bool EncryptPacket(uint64_t packet_number, absl::string_view associated_data,
+                     absl::string_view plaintext, char* output,
+                     size_t* output_length, size_t max_output_length) override;
   std::string GenerateHeaderProtectionMask(absl::string_view sample) override;
   size_t GetKeySize() const override;
   size_t GetNoncePrefixSize() const override;
diff --git a/quiche/quic/core/crypto/null_encrypter_test.cc b/quiche/quic/core/crypto/null_encrypter_test.cc
index 26a143e..85a3011 100644
--- a/quiche/quic/core/crypto/null_encrypter_test.cc
+++ b/quiche/quic/core/crypto/null_encrypter_test.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "quiche/quic/core/crypto/null_encrypter.h"
+
 #include "absl/base/macros.h"
 #include "quiche/quic/platform/api/quic_test.h"
 #include "quiche/quic/test_tools/quic_test_utils.h"
diff --git a/quiche/quic/core/crypto/p256_key_exchange.cc b/quiche/quic/core/crypto/p256_key_exchange.cc
index 98dd331..6e8e539 100644
--- a/quiche/quic/core/crypto/p256_key_exchange.cc
+++ b/quiche/quic/core/crypto/p256_key_exchange.cc
@@ -84,8 +84,7 @@
 }
 
 bool P256KeyExchange::CalculateSharedKeySync(
-    absl::string_view peer_public_value,
-    std::string* shared_key) const {
+    absl::string_view peer_public_value, std::string* shared_key) const {
   if (peer_public_value.size() != kUncompressedP256PointBytes) {
     QUIC_DLOG(INFO) << "Peer public value is invalid";
     return false;
diff --git a/quiche/quic/core/crypto/proof_source.h b/quiche/quic/core/crypto/proof_source.h
index 786368c..ffa5fec 100644
--- a/quiche/quic/core/crypto/proof_source.h
+++ b/quiche/quic/core/crypto/proof_source.h
@@ -108,8 +108,7 @@
     // |details| holds a pointer to an object representing the statistics, if
     // any, gathered during the operation of ComputeTlsSignature.  If no stats
     // are available, this will be nullptr.
-    virtual void Run(bool ok,
-                     std::string signature,
+    virtual void Run(bool ok, std::string signature,
                      std::unique_ptr<Details> details) = 0;
 
    private:
@@ -164,10 +163,8 @@
   // Callers should expect that |callback| might be invoked synchronously.
   virtual void ComputeTlsSignature(
       const QuicSocketAddress& server_address,
-      const QuicSocketAddress& client_address,
-      const std::string& hostname,
-      uint16_t signature_algorithm,
-      absl::string_view in,
+      const QuicSocketAddress& client_address, const std::string& hostname,
+      uint16_t signature_algorithm, absl::string_view in,
       std::unique_ptr<SignatureCallback> callback) = 0;
 
   // Return the list of TLS signature algorithms that is acceptable by the
@@ -265,9 +262,7 @@
 
   // Called when a ProofSourceHandle::ComputeSignature operation completes.
   virtual void OnComputeSignatureDone(
-      bool ok,
-      bool is_sync,
-      std::string signature,
+      bool ok, bool is_sync, std::string signature,
       std::unique_ptr<ProofSource::Details> details) = 0;
 
   // Return true iff ProofSourceHandle::ComputeSignature won't be called later.
@@ -315,10 +310,8 @@
   virtual QuicAsyncStatus SelectCertificate(
       const QuicSocketAddress& server_address,
       const QuicSocketAddress& client_address,
-      absl::string_view ssl_capabilities,
-      const std::string& hostname,
-      absl::string_view client_hello,
-      const std::string& alpn,
+      absl::string_view ssl_capabilities, const std::string& hostname,
+      absl::string_view client_hello, const std::string& alpn,
       absl::optional<std::string> alps,
       const std::vector<uint8_t>& quic_transport_params,
       const absl::optional<std::vector<uint8_t>>& early_data_context,
@@ -330,10 +323,8 @@
   // See the comments of SelectCertificate for sync vs. async operations.
   virtual QuicAsyncStatus ComputeSignature(
       const QuicSocketAddress& server_address,
-      const QuicSocketAddress& client_address,
-      const std::string& hostname,
-      uint16_t signature_algorithm,
-      absl::string_view in,
+      const QuicSocketAddress& client_address, const std::string& hostname,
+      uint16_t signature_algorithm, absl::string_view in,
       size_t max_signature_size) = 0;
 
  protected:
diff --git a/quiche/quic/core/crypto/proof_source_x509.cc b/quiche/quic/core/crypto/proof_source_x509.cc
index dbfecdc..5f26855 100644
--- a/quiche/quic/core/crypto/proof_source_x509.cc
+++ b/quiche/quic/core/crypto/proof_source_x509.cc
@@ -30,11 +30,9 @@
 
 void ProofSourceX509::GetProof(
     const QuicSocketAddress& /*server_address*/,
-    const QuicSocketAddress& /*client_address*/,
-    const std::string& hostname,
+    const QuicSocketAddress& /*client_address*/, const std::string& hostname,
     const std::string& server_config,
-    QuicTransportVersion /*transport_version*/,
-    absl::string_view chlo_hash,
+    QuicTransportVersion /*transport_version*/, absl::string_view chlo_hash,
     std::unique_ptr<ProofSource::Callback> callback) {
   QuicCryptoProof proof;
 
@@ -71,10 +69,8 @@
 
 void ProofSourceX509::ComputeTlsSignature(
     const QuicSocketAddress& /*server_address*/,
-    const QuicSocketAddress& /*client_address*/,
-    const std::string& hostname,
-    uint16_t signature_algorithm,
-    absl::string_view in,
+    const QuicSocketAddress& /*client_address*/, const std::string& hostname,
+    uint16_t signature_algorithm, absl::string_view in,
     std::unique_ptr<ProofSource::SignatureCallback> callback) {
   bool cert_matched_sni;
   std::string signature = GetCertificate(hostname, &cert_matched_sni)
diff --git a/quiche/quic/core/crypto/proof_source_x509.h b/quiche/quic/core/crypto/proof_source_x509.h
index 107a4c8..d5a3c6f 100644
--- a/quiche/quic/core/crypto/proof_source_x509.h
+++ b/quiche/quic/core/crypto/proof_source_x509.h
@@ -30,8 +30,7 @@
   // ProofSource implementation.
   void GetProof(const QuicSocketAddress& server_address,
                 const QuicSocketAddress& client_address,
-                const std::string& hostname,
-                const std::string& server_config,
+                const std::string& hostname, const std::string& server_config,
                 QuicTransportVersion transport_version,
                 absl::string_view chlo_hash,
                 std::unique_ptr<Callback> callback) override;
diff --git a/quiche/quic/core/crypto/proof_source_x509_test.cc b/quiche/quic/core/crypto/proof_source_x509_test.cc
index 1b7060b..6db9c75 100644
--- a/quiche/quic/core/crypto/proof_source_x509_test.cc
+++ b/quiche/quic/core/crypto/proof_source_x509_test.cc
@@ -118,8 +118,7 @@
 TEST_F(ProofSourceX509Test, TlsSignature) {
   class Callback : public ProofSource::SignatureCallback {
    public:
-    void Run(bool ok,
-             std::string signature,
+    void Run(bool ok, std::string signature,
              std::unique_ptr<ProofSource::Details> /*details*/) override {
       ASSERT_TRUE(ok);
       std::unique_ptr<CertificateView> view =
diff --git a/quiche/quic/core/crypto/proof_verifier.h b/quiche/quic/core/crypto/proof_verifier.h
index 3478ca6..e9c6f03 100644
--- a/quiche/quic/core/crypto/proof_verifier.h
+++ b/quiche/quic/core/crypto/proof_verifier.h
@@ -47,8 +47,7 @@
   // description of the error. |details| contains implementation-specific
   // details of the verification. |Run| may take ownership of |details| by
   // calling |release| on it.
-  virtual void Run(bool ok,
-                   const std::string& error_details,
+  virtual void Run(bool ok, const std::string& error_details,
                    std::unique_ptr<ProofVerifyDetails>* details) = 0;
 };
 
@@ -75,16 +74,11 @@
   // The signature uses SHA-256 as the hash function and PSS padding in the
   // case of RSA.
   virtual QuicAsyncStatus VerifyProof(
-      const std::string& hostname,
-      const uint16_t port,
-      const std::string& server_config,
-      QuicTransportVersion transport_version,
-      absl::string_view chlo_hash,
-      const std::vector<std::string>& certs,
-      const std::string& cert_sct,
-      const std::string& signature,
-      const ProofVerifyContext* context,
-      std::string* error_details,
+      const std::string& hostname, const uint16_t port,
+      const std::string& server_config, QuicTransportVersion transport_version,
+      absl::string_view chlo_hash, const std::vector<std::string>& certs,
+      const std::string& cert_sct, const std::string& signature,
+      const ProofVerifyContext* context, std::string* error_details,
       std::unique_ptr<ProofVerifyDetails>* details,
       std::unique_ptr<ProofVerifierCallback> callback) = 0;
 
@@ -106,16 +100,11 @@
   // will call back, on the original thread, via |callback| when complete.
   // In this case, the ProofVerifier will take ownership of |callback|.
   virtual QuicAsyncStatus VerifyCertChain(
-      const std::string& hostname,
-      const uint16_t port,
-      const std::vector<std::string>& certs,
-      const std::string& ocsp_response,
-      const std::string& cert_sct,
-      const ProofVerifyContext* context,
-      std::string* error_details,
-      std::unique_ptr<ProofVerifyDetails>* details,
-      uint8_t* out_alert,
-      std::unique_ptr<ProofVerifierCallback> callback) = 0;
+      const std::string& hostname, const uint16_t port,
+      const std::vector<std::string>& certs, const std::string& ocsp_response,
+      const std::string& cert_sct, const ProofVerifyContext* context,
+      std::string* error_details, std::unique_ptr<ProofVerifyDetails>* details,
+      uint8_t* out_alert, std::unique_ptr<ProofVerifierCallback> callback) = 0;
 
   // Returns a ProofVerifyContext instance which can be use for subsequent
   // verifications. Applications may chose create a different context and
diff --git a/quiche/quic/core/crypto/quic_compressed_certs_cache.cc b/quiche/quic/core/crypto/quic_compressed_certs_cache.cc
index 9627aba..dabbf24 100644
--- a/quiche/quic/core/crypto/quic_compressed_certs_cache.cc
+++ b/quiche/quic/core/crypto/quic_compressed_certs_cache.cc
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <string>
-
 #include "quiche/quic/core/crypto/quic_compressed_certs_cache.h"
 
+#include <string>
+
 namespace quic {
 
 namespace {
@@ -21,8 +21,7 @@
 const size_t QuicCompressedCertsCache::kQuicCompressedCertsCacheSize = 225;
 
 QuicCompressedCertsCache::UncompressedCerts::UncompressedCerts()
-    : chain(nullptr),
-      client_cached_cert_hashes(nullptr) {}
+    : chain(nullptr), client_cached_cert_hashes(nullptr) {}
 
 QuicCompressedCertsCache::UncompressedCerts::UncompressedCerts(
     const quiche::QuicheReferenceCountedPointer<ProofSource::Chain>& chain,
@@ -98,13 +97,9 @@
   certs_cache_.Insert(key, std::move(cached_certs));
 }
 
-size_t QuicCompressedCertsCache::MaxSize() {
-  return certs_cache_.MaxSize();
-}
+size_t QuicCompressedCertsCache::MaxSize() { return certs_cache_.MaxSize(); }
 
-size_t QuicCompressedCertsCache::Size() {
-  return certs_cache_.Size();
-}
+size_t QuicCompressedCertsCache::Size() { return certs_cache_.Size(); }
 
 uint64_t QuicCompressedCertsCache::ComputeUncompressedCertsHash(
     const UncompressedCerts& uncompressed_certs) {
diff --git a/quiche/quic/core/crypto/quic_crypter.cc b/quiche/quic/core/crypto/quic_crypter.cc
index 05c8e3a..9650236 100644
--- a/quiche/quic/core/crypto/quic_crypter.cc
+++ b/quiche/quic/core/crypto/quic_crypter.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "quiche/quic/core/crypto/quic_crypter.h"
+
 #include "absl/strings/string_view.h"
 
 namespace quic {
diff --git a/quiche/quic/core/crypto/quic_crypto_client_config.cc b/quiche/quic/core/crypto/quic_crypto_client_config.cc
index 0680c5d..caf6c77 100644
--- a/quiche/quic/core/crypto/quic_crypto_client_config.cc
+++ b/quiche/quic/core/crypto/quic_crypto_client_config.cc
@@ -133,9 +133,7 @@
 
 QuicCryptoClientConfig::CachedState::ServerConfigState
 QuicCryptoClientConfig::CachedState::SetServerConfig(
-    absl::string_view server_config,
-    QuicWallTime now,
-    QuicWallTime expiry_time,
+    absl::string_view server_config, QuicWallTime now, QuicWallTime expiry_time,
     std::string* error_details) {
   const bool matches_existing = server_config == server_config_;
 
@@ -187,10 +185,8 @@
 }
 
 void QuicCryptoClientConfig::CachedState::SetProof(
-    const std::vector<std::string>& certs,
-    absl::string_view cert_sct,
-    absl::string_view chlo_hash,
-    absl::string_view signature) {
+    const std::vector<std::string>& certs, absl::string_view cert_sct,
+    absl::string_view chlo_hash, absl::string_view signature) {
   bool has_changed = signature != server_config_sig_ ||
                      chlo_hash != chlo_hash_ || certs_.size() != certs.size();
 
@@ -246,13 +242,9 @@
 }
 
 bool QuicCryptoClientConfig::CachedState::Initialize(
-    absl::string_view server_config,
-    absl::string_view source_address_token,
-    const std::vector<std::string>& certs,
-    const std::string& cert_sct,
-    absl::string_view chlo_hash,
-    absl::string_view signature,
-    QuicWallTime now,
+    absl::string_view server_config, absl::string_view source_address_token,
+    const std::vector<std::string>& certs, const std::string& cert_sct,
+    absl::string_view chlo_hash, absl::string_view signature, QuicWallTime now,
     QuicWallTime expiration_time) {
   QUICHE_DCHECK(server_config_.empty());
 
@@ -382,8 +374,7 @@
 
 void QuicCryptoClientConfig::ClearCachedStates(const ServerIdFilter& filter) {
   for (auto it = cached_states_.begin(); it != cached_states_.end(); ++it) {
-    if (filter.Matches(it->first))
-      it->second->Clear();
+    if (filter.Matches(it->first)) it->second->Clear();
   }
 }
 
@@ -601,12 +592,9 @@
 }
 
 QuicErrorCode QuicCryptoClientConfig::CacheNewServerConfig(
-    const CryptoHandshakeMessage& message,
-    QuicWallTime now,
-    QuicTransportVersion /*version*/,
-    absl::string_view chlo_hash,
-    const std::vector<std::string>& cached_certs,
-    CachedState* cached,
+    const CryptoHandshakeMessage& message, QuicWallTime now,
+    QuicTransportVersion /*version*/, absl::string_view chlo_hash,
+    const std::vector<std::string>& cached_certs, CachedState* cached,
     std::string* error_details) {
   QUICHE_DCHECK(error_details != nullptr);
 
@@ -796,13 +784,10 @@
   proof_source_ = std::move(proof_source);
 }
 
-SSL_CTX* QuicCryptoClientConfig::ssl_ctx() const {
-  return ssl_ctx_.get();
-}
+SSL_CTX* QuicCryptoClientConfig::ssl_ctx() const { return ssl_ctx_.get(); }
 
 void QuicCryptoClientConfig::InitializeFrom(
-    const QuicServerId& server_id,
-    const QuicServerId& canonical_server_id,
+    const QuicServerId& server_id, const QuicServerId& canonical_server_id,
     QuicCryptoClientConfig* canonical_crypto_config) {
   CachedState* canonical_cached =
       canonical_crypto_config->LookupOrCreate(canonical_server_id);
diff --git a/quiche/quic/core/crypto/quic_crypto_client_config.h b/quiche/quic/core/crypto/quic_crypto_client_config.h
index a0c6987..f44aac1 100644
--- a/quiche/quic/core/crypto/quic_crypto_client_config.h
+++ b/quiche/quic/core/crypto/quic_crypto_client_config.h
@@ -153,8 +153,7 @@
 
     // SetProof stores a cert chain, cert signed timestamp and signature.
     void SetProof(const std::vector<std::string>& certs,
-                  absl::string_view cert_sct,
-                  absl::string_view chlo_hash,
+                  absl::string_view cert_sct, absl::string_view chlo_hash,
                   absl::string_view signature);
 
     // Clears all the data.
@@ -201,10 +200,8 @@
     bool Initialize(absl::string_view server_config,
                     absl::string_view source_address_token,
                     const std::vector<std::string>& certs,
-                    const std::string& cert_sct,
-                    absl::string_view chlo_hash,
-                    absl::string_view signature,
-                    QuicWallTime now,
+                    const std::string& cert_sct, absl::string_view chlo_hash,
+                    absl::string_view signature, QuicWallTime now,
                     QuicWallTime expiration_time);
 
    private:
@@ -404,12 +401,9 @@
   // This is used on receipt of a REJ from a server, or when a server sends
   // updated server config during a connection.
   QuicErrorCode CacheNewServerConfig(
-      const CryptoHandshakeMessage& message,
-      QuicWallTime now,
-      QuicTransportVersion version,
-      absl::string_view chlo_hash,
-      const std::vector<std::string>& cached_certs,
-      CachedState* cached,
+      const CryptoHandshakeMessage& message, QuicWallTime now,
+      QuicTransportVersion version, absl::string_view chlo_hash,
+      const std::vector<std::string>& cached_certs, CachedState* cached,
       std::string* error_details);
 
   // If the suffix of the hostname in |server_id| is in |canonical_suffixes_|,
diff --git a/quiche/quic/core/crypto/quic_crypto_server_config.cc b/quiche/quic/core/crypto/quic_crypto_server_config.cc
index c7bd60c..11ccc2f 100644
--- a/quiche/quic/core/crypto/quic_crypto_server_config.cc
+++ b/quiche/quic/core/crypto/quic_crypto_server_config.cc
@@ -80,9 +80,7 @@
   ~DefaultKeyExchangeSource() override = default;
 
   std::unique_ptr<AsynchronousKeyExchange> Create(
-      std::string /*server_config_id*/,
-      bool /* is_fallback */,
-      QuicTag type,
+      std::string /*server_config_id*/, bool /* is_fallback */, QuicTag type,
       absl::string_view private_key) override {
     if (private_key.empty()) {
       QUIC_LOG(WARNING) << "Server config contains key exchange method without "
@@ -179,8 +177,7 @@
   }
 
   void ValidationComplete(
-      QuicErrorCode error_code,
-      const char* error_details,
+      QuicErrorCode error_code, const char* error_details,
       std::unique_ptr<ProofSource::Details> proof_source_details) {
     result_->error_code = error_code;
     result_->error_details = error_details;
@@ -217,8 +214,7 @@
 PrimaryConfigChangedCallback::~PrimaryConfigChangedCallback() {}
 
 ValidateClientHelloResultCallback::Result::Result(
-    const CryptoHandshakeMessage& in_client_hello,
-    QuicIpAddress in_client_ip,
+    const CryptoHandshakeMessage& in_client_hello, QuicIpAddress in_client_ip,
     QuicWallTime in_now)
     : client_hello(in_client_hello),
       info(in_client_ip, in_now),
@@ -253,8 +249,7 @@
 }
 
 void QuicCryptoServerConfig::ProcessClientHelloContext::Fail(
-    QuicErrorCode error,
-    const std::string& error_details) {
+    QuicErrorCode error, const std::string& error_details) {
   QUIC_TRACEPRINTF("ProcessClientHello failed: error=%s, details=%s",
                    QuicErrorCodeToString(error), error_details);
   done_cb_->Run(error, error_details, nullptr, nullptr, nullptr);
@@ -276,8 +271,7 @@
 
 QuicCryptoServerConfig::QuicCryptoServerConfig(
     absl::string_view source_address_token_secret,
-    QuicRandom* server_nonce_entropy,
-    std::unique_ptr<ProofSource> proof_source,
+    QuicRandom* server_nonce_entropy, std::unique_ptr<ProofSource> proof_source,
     std::unique_ptr<KeyExchangeSource> key_exchange_source)
     : replay_protection_(true),
       chlo_multiplier_(kMultiplier),
@@ -314,9 +308,7 @@
 
 // static
 QuicServerConfigProtobuf QuicCryptoServerConfig::GenerateConfig(
-    QuicRandom* rand,
-    const QuicClock* clock,
-    const ConfigOptions& options) {
+    QuicRandom* rand, const QuicClock* clock, const ConfigOptions& options) {
   CryptoHandshakeMessage msg;
 
   const std::string curve25519_private_key =
@@ -428,8 +420,7 @@
 }
 
 std::unique_ptr<CryptoHandshakeMessage> QuicCryptoServerConfig::AddConfig(
-    const QuicServerConfigProtobuf& protobuf,
-    const QuicWallTime now) {
+    const QuicServerConfigProtobuf& protobuf, const QuicWallTime now) {
   std::unique_ptr<CryptoHandshakeMessage> msg =
       CryptoFramer::ParseMessage(protobuf.config());
 
@@ -473,8 +464,7 @@
 
 bool QuicCryptoServerConfig::SetConfigs(
     const std::vector<QuicServerConfigProtobuf>& protobufs,
-    const QuicServerConfigProtobuf* fallback_protobuf,
-    const QuicWallTime now) {
+    const QuicServerConfigProtobuf* fallback_protobuf, const QuicWallTime now) {
   std::vector<quiche::QuicheReferenceCountedPointer<Config>> parsed_configs;
   for (auto& protobuf : protobufs) {
     quiche::QuicheReferenceCountedPointer<Config> config =
@@ -642,8 +632,7 @@
   ProcessClientHelloAfterGetProofCallback(
       const QuicCryptoServerConfig* config,
       std::unique_ptr<ProofSource::Details> proof_source_details,
-      QuicTag key_exchange_type,
-      std::unique_ptr<CryptoHandshakeMessage> out,
+      QuicTag key_exchange_type, std::unique_ptr<CryptoHandshakeMessage> out,
       absl::string_view public_value,
       std::unique_ptr<ProcessClientHelloContext> context,
       const Configs& configs)
@@ -880,8 +869,7 @@
 void QuicCryptoServerConfig::ProcessClientHelloAfterCalculateSharedKeys(
     bool found_error,
     std::unique_ptr<ProofSource::Details> proof_source_details,
-    QuicTag key_exchange_type,
-    std::unique_ptr<CryptoHandshakeMessage> out,
+    QuicTag key_exchange_type, std::unique_ptr<CryptoHandshakeMessage> out,
     absl::string_view public_value,
     std::unique_ptr<ProcessClientHelloContext> context,
     const Configs& configs) const {
@@ -1358,14 +1346,11 @@
 }
 
 void QuicCryptoServerConfig::BuildServerConfigUpdateMessage(
-    QuicTransportVersion version,
-    absl::string_view chlo_hash,
+    QuicTransportVersion version, absl::string_view chlo_hash,
     const SourceAddressTokens& previous_source_address_tokens,
     const QuicSocketAddress& server_address,
-    const QuicSocketAddress& client_address,
-    const QuicClock* clock,
-    QuicRandom* rand,
-    QuicCompressedCertsCache* compressed_certs_cache,
+    const QuicSocketAddress& client_address, const QuicClock* clock,
+    QuicRandom* rand, QuicCompressedCertsCache* compressed_certs_cache,
     const QuicCryptoNegotiatedParameters& params,
     const CachedNetworkParameters* cached_network_params,
     std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const {
@@ -1457,8 +1442,7 @@
 }
 
 void QuicCryptoServerConfig::BuildRejectionAndRecordStats(
-    const ProcessClientHelloContext& context,
-    const Config& config,
+    const ProcessClientHelloContext& context, const Config& config,
     const std::vector<uint32_t>& reject_reasons,
     CryptoHandshakeMessage* out) const {
   BuildRejection(context, config, reject_reasons, out);
@@ -1468,8 +1452,7 @@
 }
 
 void QuicCryptoServerConfig::BuildRejection(
-    const ProcessClientHelloContext& context,
-    const Config& config,
+    const ProcessClientHelloContext& context, const Config& config,
     const std::vector<uint32_t>& reject_reasons,
     CryptoHandshakeMessage* out) const {
   const QuicWallTime now = context.clock()->WallNow();
@@ -1549,15 +1532,15 @@
             context.signed_config()->chain->certs;
         std::string ca_subject;
         if (!certs.empty()) {
-            std::unique_ptr<CertificateView> view =
-                CertificateView::ParseSingleCertificate(certs[0]);
-            if (view != nullptr) {
-              absl::optional<std::string> maybe_ca_subject =
-                  view->GetHumanReadableSubject();
-              if (maybe_ca_subject.has_value()) {
-                ca_subject = *maybe_ca_subject;
-              }
+          std::unique_ptr<CertificateView> view =
+              CertificateView::ParseSingleCertificate(certs[0]);
+          if (view != nullptr) {
+            absl::optional<std::string> maybe_ca_subject =
+                view->GetHumanReadableSubject();
+            if (maybe_ca_subject.has_value()) {
+              ca_subject = *maybe_ca_subject;
             }
+          }
         }
         QUIC_LOG_EVERY_N_SEC(WARNING, 60)
             << "SCT is expected but it is empty. sni: '"
@@ -1735,10 +1718,8 @@
 
 std::string QuicCryptoServerConfig::NewSourceAddressToken(
     const CryptoSecretBoxer& crypto_secret_boxer,
-    const SourceAddressTokens& previous_tokens,
-    const QuicIpAddress& ip,
-    QuicRandom* rand,
-    QuicWallTime now,
+    const SourceAddressTokens& previous_tokens, const QuicIpAddress& ip,
+    QuicRandom* rand, QuicWallTime now,
     const CachedNetworkParameters* cached_network_params) const {
   SourceAddressTokens source_address_tokens;
   SourceAddressToken* source_address_token = source_address_tokens.add_tokens();
@@ -1780,9 +1761,7 @@
   return proof_source_.get();
 }
 
-SSL_CTX* QuicCryptoServerConfig::ssl_ctx() const {
-  return ssl_ctx_.get();
-}
+SSL_CTX* QuicCryptoServerConfig::ssl_ctx() const { return ssl_ctx_.get(); }
 
 HandshakeFailureReason QuicCryptoServerConfig::ParseSourceAddressToken(
     const CryptoSecretBoxer& crypto_secret_boxer, absl::string_view token,
@@ -1808,10 +1787,8 @@
 }
 
 HandshakeFailureReason QuicCryptoServerConfig::ValidateSourceAddressTokens(
-    const SourceAddressTokens& source_address_tokens,
-    const QuicIpAddress& ip,
-    QuicWallTime now,
-    CachedNetworkParameters* cached_network_params) const {
+    const SourceAddressTokens& source_address_tokens, const QuicIpAddress& ip,
+    QuicWallTime now, CachedNetworkParameters* cached_network_params) const {
   HandshakeFailureReason reason =
       SOURCE_ADDRESS_TOKEN_DIFFERENT_IP_ADDRESS_FAILURE;
   for (const SourceAddressToken& token : source_address_tokens.tokens()) {
@@ -1828,8 +1805,7 @@
 }
 
 HandshakeFailureReason QuicCryptoServerConfig::ValidateSingleSourceAddressToken(
-    const SourceAddressToken& source_address_token,
-    const QuicIpAddress& ip,
+    const SourceAddressToken& source_address_token, const QuicIpAddress& ip,
     QuicWallTime now) const {
   if (source_address_token.ip() != ip.DualStacked().ToPackedString()) {
     // It's for a different IP address.
@@ -1841,8 +1817,7 @@
 
 HandshakeFailureReason
 QuicCryptoServerConfig::ValidateSourceAddressTokenTimestamp(
-    const SourceAddressToken& source_address_token,
-    QuicWallTime now) const {
+    const SourceAddressToken& source_address_token, QuicWallTime now) const {
   const QuicWallTime timestamp(
       QuicWallTime::FromUNIXSeconds(source_address_token.timestamp()));
   const QuicTime::Delta delta(now.AbsoluteDifference(timestamp));
diff --git a/quiche/quic/core/crypto/quic_crypto_server_config.h b/quiche/quic/core/crypto/quic_crypto_server_config.h
index 9ab5a22..c3febdc 100644
--- a/quiche/quic/core/crypto/quic_crypto_server_config.h
+++ b/quiche/quic/core/crypto/quic_crypto_server_config.h
@@ -85,8 +85,7 @@
   // its validity.  Can be interpreted by calling ProcessClientHello.
   struct QUIC_EXPORT_PRIVATE Result : public quiche::QuicheReferenceCounted {
     Result(const CryptoHandshakeMessage& in_client_hello,
-           QuicIpAddress in_client_ip,
-           QuicWallTime in_now);
+           QuicIpAddress in_client_ip, QuicWallTime in_now);
 
     CryptoHandshakeMessage client_hello;
     ClientHelloInfo info;
@@ -119,8 +118,7 @@
   ProcessClientHelloResultCallback& operator=(
       const ProcessClientHelloResultCallback&) = delete;
   virtual ~ProcessClientHelloResultCallback();
-  virtual void Run(QuicErrorCode error,
-                   const std::string& error_details,
+  virtual void Run(QuicErrorCode error, const std::string& error_details,
                    std::unique_ptr<CryptoHandshakeMessage> message,
                    std::unique_ptr<DiversificationNonce> diversification_nonce,
                    std::unique_ptr<ProofSource::Details> details) = 0;
@@ -166,9 +164,7 @@
   // is set, |private_key| is required to be set, and a local key-exchange
   // object should be returned.
   virtual std::unique_ptr<AsynchronousKeyExchange> Create(
-      std::string server_config_id,
-      bool is_fallback,
-      QuicTag type,
+      std::string server_config_id, bool is_fallback, QuicTag type,
       absl::string_view private_key) = 0;
 };
 
@@ -235,16 +231,13 @@
   // conjunction with |protobuf->primary_time()| to determine whether the
   // config should be made primary.
   std::unique_ptr<CryptoHandshakeMessage> AddConfig(
-      const QuicServerConfigProtobuf& protobuf,
-      QuicWallTime now);
+      const QuicServerConfigProtobuf& protobuf, QuicWallTime now);
 
   // AddDefaultConfig calls GenerateConfig to create a config and then calls
   // AddConfig to add it. See the comment for |GenerateConfig| for details of
   // the arguments.
   std::unique_ptr<CryptoHandshakeMessage> AddDefaultConfig(
-      QuicRandom* rand,
-      const QuicClock* clock,
-      const ConfigOptions& options);
+      QuicRandom* rand, const QuicClock* clock, const ConfigOptions& options);
 
   // SetConfigs takes a vector of config protobufs and the current time.
   // Configs are assumed to be uniquely identified by their server config ID.
@@ -352,14 +345,11 @@
   //
   // |cached_network_params| is optional, and can be nullptr.
   void BuildServerConfigUpdateMessage(
-      QuicTransportVersion version,
-      absl::string_view chlo_hash,
+      QuicTransportVersion version, absl::string_view chlo_hash,
       const SourceAddressTokens& previous_source_address_tokens,
       const QuicSocketAddress& server_address,
-      const QuicSocketAddress& client_address,
-      const QuicClock* clock,
-      QuicRandom* rand,
-      QuicCompressedCertsCache* compressed_certs_cache,
+      const QuicSocketAddress& client_address, const QuicClock* clock,
+      QuicRandom* rand, QuicCompressedCertsCache* compressed_certs_cache,
       const QuicCryptoNegotiatedParameters& params,
       const CachedNetworkParameters* cached_network_params,
       std::unique_ptr<BuildServerConfigUpdateMessageResultCallback> cb) const;
@@ -418,10 +408,8 @@
   // |cached_network_params| is optional, and can be nullptr.
   std::string NewSourceAddressToken(
       const CryptoSecretBoxer& crypto_secret_boxer,
-      const SourceAddressTokens& previous_tokens,
-      const QuicIpAddress& ip,
-      QuicRandom* rand,
-      QuicWallTime now,
+      const SourceAddressTokens& previous_tokens, const QuicIpAddress& ip,
+      QuicRandom* rand, QuicWallTime now,
       const CachedNetworkParameters* cached_network_params) const;
 
   // ParseSourceAddressToken parses the source address tokens contained in
@@ -438,10 +426,8 @@
   // reason for failure. |cached_network_params| is populated if the valid
   // token contains a CachedNetworkParameters proto.
   HandshakeFailureReason ValidateSourceAddressTokens(
-      const SourceAddressTokens& tokens,
-      const QuicIpAddress& ip,
-      QuicWallTime now,
-      CachedNetworkParameters* cached_network_params) const;
+      const SourceAddressTokens& tokens, const QuicIpAddress& ip,
+      QuicWallTime now, CachedNetworkParameters* cached_network_params) const;
 
   // Callers retain the ownership of |rejection_observer| which must outlive the
   // config.
@@ -712,8 +698,7 @@
   void ProcessClientHelloAfterCalculateSharedKeys(
       bool found_error,
       std::unique_ptr<ProofSource::Details> proof_source_details,
-      QuicTag key_exchange_type,
-      std::unique_ptr<CryptoHandshakeMessage> out,
+      QuicTag key_exchange_type, std::unique_ptr<CryptoHandshakeMessage> out,
       absl::string_view public_value,
       std::unique_ptr<ProcessClientHelloContext> context,
       const Configs& configs) const;
@@ -773,16 +758,14 @@
   // given that the current time is |now|. Otherwise it returns the reason
   // for failure.
   HandshakeFailureReason ValidateSingleSourceAddressToken(
-      const SourceAddressToken& token,
-      const QuicIpAddress& ip,
+      const SourceAddressToken& token, const QuicIpAddress& ip,
       QuicWallTime now) const;
 
   // Returns HANDSHAKE_OK if the source address token in |token| is a timely
   // token given that the current time is |now|. Otherwise it returns the
   // reason for failure.
   HandshakeFailureReason ValidateSourceAddressTokenTimestamp(
-      const SourceAddressToken& token,
-      QuicWallTime now) const;
+      const SourceAddressToken& token, QuicWallTime now) const;
 
   // NewServerNonce generates and encrypts a random nonce.
   std::string NewServerNonce(QuicRandom* rand, QuicWallTime now) const;
diff --git a/quiche/quic/core/crypto/quic_crypto_server_config_test.cc b/quiche/quic/core/crypto/quic_crypto_server_config_test.cc
index 5a24881..ed7ffdb 100644
--- a/quiche/quic/core/crypto/quic_crypto_server_config_test.cc
+++ b/quiche/quic/core/crypto/quic_crypto_server_config_test.cc
@@ -145,8 +145,7 @@
         ip6_(QuicIpAddress::Loopback6()),
         original_time_(QuicWallTime::Zero()),
         rand_(QuicRandom::GetInstance()),
-        server_(QuicCryptoServerConfig::TESTING,
-                rand_,
+        server_(QuicCryptoServerConfig::TESTING, rand_,
                 crypto_test_utils::ProofSourceForTesting(),
                 KeyExchangeSource::Default()),
         peer_(&server_) {
@@ -164,16 +163,14 @@
   }
 
   std::string NewSourceAddressToken(
-      std::string config_id,
-      const QuicIpAddress& ip,
+      std::string config_id, const QuicIpAddress& ip,
       const SourceAddressTokens& previous_tokens) {
     return peer_.NewSourceAddressToken(config_id, previous_tokens, ip, rand_,
                                        clock_.WallNow(), nullptr);
   }
 
   std::string NewSourceAddressToken(
-      std::string config_id,
-      const QuicIpAddress& ip,
+      std::string config_id, const QuicIpAddress& ip,
       CachedNetworkParameters* cached_network_params) {
     SourceAddressTokens previous_tokens;
     return peer_.NewSourceAddressToken(config_id, previous_tokens, ip, rand_,
@@ -187,9 +184,7 @@
   }
 
   HandshakeFailureReason ValidateSourceAddressTokens(
-      std::string config_id,
-      absl::string_view srct,
-      const QuicIpAddress& ip,
+      std::string config_id, absl::string_view srct, const QuicIpAddress& ip,
       CachedNetworkParameters* cached_network_params) {
     return peer_.ValidateSourceAddressTokens(
         config_id, srct, ip, clock_.WallNow(), cached_network_params);
@@ -287,8 +282,7 @@
  public:
   CryptoServerConfigsTest()
       : rand_(QuicRandom::GetInstance()),
-        config_(QuicCryptoServerConfig::TESTING,
-                rand_,
+        config_(QuicCryptoServerConfig::TESTING, rand_,
                 crypto_test_utils::ProofSourceForTesting(),
                 KeyExchangeSource::Default()),
         test_peer_(&config_) {}
diff --git a/quiche/quic/core/crypto/quic_decrypter.cc b/quiche/quic/core/crypto/quic_decrypter.cc
index 8d256fd..da0e809 100644
--- a/quiche/quic/core/crypto/quic_decrypter.cc
+++ b/quiche/quic/core/crypto/quic_decrypter.cc
@@ -24,8 +24,7 @@
 
 // static
 std::unique_ptr<QuicDecrypter> QuicDecrypter::Create(
-    const ParsedQuicVersion& version,
-    QuicTag algorithm) {
+    const ParsedQuicVersion& version, QuicTag algorithm) {
   switch (algorithm) {
     case kAESG:
       if (version.UsesInitialObfuscators()) {
diff --git a/quiche/quic/core/crypto/quic_decrypter.h b/quiche/quic/core/crypto/quic_decrypter.h
index 2cd799c..8e3c754 100644
--- a/quiche/quic/core/crypto/quic_decrypter.h
+++ b/quiche/quic/core/crypto/quic_decrypter.h
@@ -57,8 +57,7 @@
   // to non-authentic inputs, as opposed to other reasons for failure.
   virtual bool DecryptPacket(uint64_t packet_number,
                              absl::string_view associated_data,
-                             absl::string_view ciphertext,
-                             char* output,
+                             absl::string_view ciphertext, char* output,
                              size_t* output_length,
                              size_t max_output_length) = 0;
 
@@ -84,8 +83,7 @@
   static void DiversifyPreliminaryKey(absl::string_view preliminary_key,
                                       absl::string_view nonce_prefix,
                                       const DiversificationNonce& nonce,
-                                      size_t key_size,
-                                      size_t nonce_prefix_size,
+                                      size_t key_size, size_t nonce_prefix_size,
                                       std::string* out_key,
                                       std::string* out_nonce_prefix);
 };
diff --git a/quiche/quic/core/crypto/quic_encrypter.cc b/quiche/quic/core/crypto/quic_encrypter.cc
index 2780482..151b8d0 100644
--- a/quiche/quic/core/crypto/quic_encrypter.cc
+++ b/quiche/quic/core/crypto/quic_encrypter.cc
@@ -21,8 +21,7 @@
 
 // static
 std::unique_ptr<QuicEncrypter> QuicEncrypter::Create(
-    const ParsedQuicVersion& version,
-    QuicTag algorithm) {
+    const ParsedQuicVersion& version, QuicTag algorithm) {
   switch (algorithm) {
     case kAESG:
       if (version.UsesInitialObfuscators()) {
diff --git a/quiche/quic/core/crypto/quic_encrypter.h b/quiche/quic/core/crypto/quic_encrypter.h
index 6caf51b..7b8c4fa 100644
--- a/quiche/quic/core/crypto/quic_encrypter.h
+++ b/quiche/quic/core/crypto/quic_encrypter.h
@@ -37,8 +37,7 @@
   // |plaintext| must be <= |output|.
   virtual bool EncryptPacket(uint64_t packet_number,
                              absl::string_view associated_data,
-                             absl::string_view plaintext,
-                             char* output,
+                             absl::string_view plaintext, char* output,
                              size_t* output_length,
                              size_t max_output_length) = 0;
 
diff --git a/quiche/quic/core/crypto/quic_hkdf.cc b/quiche/quic/core/crypto/quic_hkdf.cc
index 935e33e..14dab76 100644
--- a/quiche/quic/core/crypto/quic_hkdf.cc
+++ b/quiche/quic/core/crypto/quic_hkdf.cc
@@ -16,25 +16,16 @@
 const size_t kSHA256HashLength = 32;
 const size_t kMaxKeyMaterialSize = kSHA256HashLength * 256;
 
-QuicHKDF::QuicHKDF(absl::string_view secret,
-                   absl::string_view salt,
-                   absl::string_view info,
-                   size_t key_bytes_to_generate,
+QuicHKDF::QuicHKDF(absl::string_view secret, absl::string_view salt,
+                   absl::string_view info, size_t key_bytes_to_generate,
                    size_t iv_bytes_to_generate,
                    size_t subkey_secret_bytes_to_generate)
-    : QuicHKDF(secret,
-               salt,
-               info,
-               key_bytes_to_generate,
-               key_bytes_to_generate,
-               iv_bytes_to_generate,
-               iv_bytes_to_generate,
+    : QuicHKDF(secret, salt, info, key_bytes_to_generate, key_bytes_to_generate,
+               iv_bytes_to_generate, iv_bytes_to_generate,
                subkey_secret_bytes_to_generate) {}
 
-QuicHKDF::QuicHKDF(absl::string_view secret,
-                   absl::string_view salt,
-                   absl::string_view info,
-                   size_t client_key_bytes_to_generate,
+QuicHKDF::QuicHKDF(absl::string_view secret, absl::string_view salt,
+                   absl::string_view info, size_t client_key_bytes_to_generate,
                    size_t server_key_bytes_to_generate,
                    size_t client_iv_bytes_to_generate,
                    size_t server_iv_bytes_to_generate,
diff --git a/quiche/quic/core/crypto/quic_hkdf.h b/quiche/quic/core/crypto/quic_hkdf.h
index 0040447..6a300ed 100644
--- a/quiche/quic/core/crypto/quic_hkdf.h
+++ b/quiche/quic/core/crypto/quic_hkdf.h
@@ -31,19 +31,14 @@
   // client and server.
   // |subkey_secret_bytes_to_generate|: the number of bytes of subkey secret to
   // generate, shared between client and server.
-  QuicHKDF(absl::string_view secret,
-           absl::string_view salt,
-           absl::string_view info,
-           size_t key_bytes_to_generate,
-           size_t iv_bytes_to_generate,
-           size_t subkey_secret_bytes_to_generate);
+  QuicHKDF(absl::string_view secret, absl::string_view salt,
+           absl::string_view info, size_t key_bytes_to_generate,
+           size_t iv_bytes_to_generate, size_t subkey_secret_bytes_to_generate);
 
   // An alternative constructor that allows the client and server key/IV
   // lengths to be different.
-  QuicHKDF(absl::string_view secret,
-           absl::string_view salt,
-           absl::string_view info,
-           size_t client_key_bytes_to_generate,
+  QuicHKDF(absl::string_view secret, absl::string_view salt,
+           absl::string_view info, size_t client_key_bytes_to_generate,
            size_t server_key_bytes_to_generate,
            size_t client_iv_bytes_to_generate,
            size_t server_iv_bytes_to_generate,
diff --git a/quiche/quic/core/crypto/quic_random.cc b/quiche/quic/core/crypto/quic_random.cc
index e384aca..bd0dc5b 100644
--- a/quiche/quic/core/crypto/quic_random.cc
+++ b/quiche/quic/core/crypto/quic_random.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "quiche/quic/core/crypto/quic_random.h"
+
 #include <cstdint>
 #include <cstring>
 
@@ -85,9 +86,7 @@
   }
 }
 
-uint64_t DefaultRandom::InsecureRandUint64() {
-  return Xoshiro256PlusPlus();
-}
+uint64_t DefaultRandom::InsecureRandUint64() { return Xoshiro256PlusPlus(); }
 
 }  // namespace
 
diff --git a/quiche/quic/core/crypto/tls_client_connection.cc b/quiche/quic/core/crypto/tls_client_connection.cc
index 9140527..7436b23 100644
--- a/quiche/quic/core/crypto/tls_client_connection.cc
+++ b/quiche/quic/core/crypto/tls_client_connection.cc
@@ -6,11 +6,9 @@
 
 namespace quic {
 
-TlsClientConnection::TlsClientConnection(SSL_CTX* ssl_ctx,
-                                         Delegate* delegate,
+TlsClientConnection::TlsClientConnection(SSL_CTX* ssl_ctx, Delegate* delegate,
                                          QuicSSLConfig ssl_config)
-    : TlsConnection(ssl_ctx,
-                    delegate->ConnectionDelegate(),
+    : TlsConnection(ssl_ctx, delegate->ConnectionDelegate(),
                     std::move(ssl_config)),
       delegate_(delegate) {}
 
diff --git a/quiche/quic/core/crypto/tls_client_connection.h b/quiche/quic/core/crypto/tls_client_connection.h
index 1c98a70..3bf35ce 100644
--- a/quiche/quic/core/crypto/tls_client_connection.h
+++ b/quiche/quic/core/crypto/tls_client_connection.h
@@ -30,8 +30,7 @@
     friend class TlsClientConnection;
   };
 
-  TlsClientConnection(SSL_CTX* ssl_ctx,
-                      Delegate* delegate,
+  TlsClientConnection(SSL_CTX* ssl_ctx, Delegate* delegate,
                       QuicSSLConfig ssl_config);
 
   // Creates and configures an SSL_CTX that is appropriate for clients to use.
diff --git a/quiche/quic/core/crypto/tls_connection.cc b/quiche/quic/core/crypto/tls_connection.cc
index 32399d8..61e4c23 100644
--- a/quiche/quic/core/crypto/tls_connection.cc
+++ b/quiche/quic/core/crypto/tls_connection.cc
@@ -186,8 +186,7 @@
 // static
 int TlsConnection::WriteMessageCallback(SSL* ssl,
                                         enum ssl_encryption_level_t level,
-                                        const uint8_t* data,
-                                        size_t len) {
+                                        const uint8_t* data, size_t len) {
   ConnectionFromSsl(ssl)->delegate_->WriteMessage(
       QuicEncryptionLevel(level),
       absl::string_view(reinterpret_cast<const char*>(data), len));
diff --git a/quiche/quic/core/crypto/tls_connection.h b/quiche/quic/core/crypto/tls_connection.h
index 72189b4..a4887e8 100644
--- a/quiche/quic/core/crypto/tls_connection.h
+++ b/quiche/quic/core/crypto/tls_connection.h
@@ -46,8 +46,7 @@
     // TLS 1.3 key schedule (RFC 8446 section 7.1), in particular the handshake
     // traffic secrets and application traffic secrets. The provided write
     // secret must be used with the provided cipher suite |cipher|.
-    virtual void SetWriteSecret(EncryptionLevel level,
-                                const SSL_CIPHER* cipher,
+    virtual void SetWriteSecret(EncryptionLevel level, const SSL_CIPHER* cipher,
                                 const std::vector<uint8_t>& write_secret) = 0;
 
     // SetReadSecret is similar to SetWriteSecret, except that it is used for
@@ -55,8 +54,7 @@
     // after SetWriteSecret for that level, except for ENCRYPTION_ZERO_RTT,
     // where the EncryptionLevel for SetWriteSecret is
     // ENCRYPTION_FORWARD_SECURE.
-    virtual bool SetReadSecret(EncryptionLevel level,
-                               const SSL_CIPHER* cipher,
+    virtual bool SetReadSecret(EncryptionLevel level, const SSL_CIPHER* cipher,
                                const std::vector<uint8_t>& read_secret) = 0;
 
     // WriteMessage is called when there is |data| from the TLS stack ready for
@@ -133,23 +131,16 @@
   static const SSL_QUIC_METHOD kSslQuicMethod;
 
   // The following static functions make up the members of kSslQuicMethod:
-  static int SetReadSecretCallback(SSL* ssl,
-                                   enum ssl_encryption_level_t level,
+  static int SetReadSecretCallback(SSL* ssl, enum ssl_encryption_level_t level,
                                    const SSL_CIPHER* cipher,
-                                   const uint8_t* secret,
-                                   size_t secret_len);
-  static int SetWriteSecretCallback(SSL* ssl,
-                                    enum ssl_encryption_level_t level,
+                                   const uint8_t* secret, size_t secret_len);
+  static int SetWriteSecretCallback(SSL* ssl, enum ssl_encryption_level_t level,
                                     const SSL_CIPHER* cipher,
-                                    const uint8_t* secret,
-                                    size_t secret_len);
-  static int WriteMessageCallback(SSL* ssl,
-                                  enum ssl_encryption_level_t level,
-                                  const uint8_t* data,
-                                  size_t len);
+                                    const uint8_t* secret, size_t secret_len);
+  static int WriteMessageCallback(SSL* ssl, enum ssl_encryption_level_t level,
+                                  const uint8_t* data, size_t len);
   static int FlushFlightCallback(SSL* ssl);
-  static int SendAlertCallback(SSL* ssl,
-                               enum ssl_encryption_level_t level,
+  static int SendAlertCallback(SSL* ssl, enum ssl_encryption_level_t level,
                                uint8_t desc);
 
   Delegate* delegate_;
diff --git a/quiche/quic/core/crypto/tls_server_connection.cc b/quiche/quic/core/crypto/tls_server_connection.cc
index 3dc03c7..ed7e5b2 100644
--- a/quiche/quic/core/crypto/tls_server_connection.cc
+++ b/quiche/quic/core/crypto/tls_server_connection.cc
@@ -106,31 +106,23 @@
 }
 
 // static
-int TlsServerConnection::TlsExtServernameCallback(SSL* ssl,
-                                                  int* out_alert,
+int TlsServerConnection::TlsExtServernameCallback(SSL* ssl, int* out_alert,
                                                   void* /*arg*/) {
   return ConnectionFromSsl(ssl)->delegate_->TlsExtServernameCallback(out_alert);
 }
 
 // static
-int TlsServerConnection::SelectAlpnCallback(SSL* ssl,
-                                            const uint8_t** out,
-                                            uint8_t* out_len,
-                                            const uint8_t* in,
-                                            unsigned in_len,
-                                            void* /*arg*/) {
+int TlsServerConnection::SelectAlpnCallback(SSL* ssl, const uint8_t** out,
+                                            uint8_t* out_len, const uint8_t* in,
+                                            unsigned in_len, void* /*arg*/) {
   return ConnectionFromSsl(ssl)->delegate_->SelectAlpn(out, out_len, in,
                                                        in_len);
 }
 
 // static
-ssl_private_key_result_t TlsServerConnection::PrivateKeySign(SSL* ssl,
-                                                             uint8_t* out,
-                                                             size_t* out_len,
-                                                             size_t max_out,
-                                                             uint16_t sig_alg,
-                                                             const uint8_t* in,
-                                                             size_t in_len) {
+ssl_private_key_result_t TlsServerConnection::PrivateKeySign(
+    SSL* ssl, uint8_t* out, size_t* out_len, size_t max_out, uint16_t sig_alg,
+    const uint8_t* in, size_t in_len) {
   return ConnectionFromSsl(ssl)->delegate_->PrivateKeySign(
       out, out_len, max_out, sig_alg,
       absl::string_view(reinterpret_cast<const char*>(in), in_len));
@@ -138,10 +130,7 @@
 
 // static
 ssl_private_key_result_t TlsServerConnection::PrivateKeyComplete(
-    SSL* ssl,
-    uint8_t* out,
-    size_t* out_len,
-    size_t max_out) {
+    SSL* ssl, uint8_t* out, size_t* out_len, size_t max_out) {
   return ConnectionFromSsl(ssl)->delegate_->PrivateKeyComplete(out, out_len,
                                                                max_out);
 }
@@ -159,12 +148,9 @@
 }
 
 // static
-int TlsServerConnection::SessionTicketSeal(SSL* ssl,
-                                           uint8_t* out,
-                                           size_t* out_len,
-                                           size_t max_out_len,
-                                           const uint8_t* in,
-                                           size_t in_len) {
+int TlsServerConnection::SessionTicketSeal(SSL* ssl, uint8_t* out,
+                                           size_t* out_len, size_t max_out_len,
+                                           const uint8_t* in, size_t in_len) {
   return ConnectionFromSsl(ssl)->delegate_->SessionTicketSeal(
       out, out_len, max_out_len,
       absl::string_view(reinterpret_cast<const char*>(in), in_len));
@@ -172,12 +158,8 @@
 
 // static
 enum ssl_ticket_aead_result_t TlsServerConnection::SessionTicketOpen(
-    SSL* ssl,
-    uint8_t* out,
-    size_t* out_len,
-    size_t max_out_len,
-    const uint8_t* in,
-    size_t in_len) {
+    SSL* ssl, uint8_t* out, size_t* out_len, size_t max_out_len,
+    const uint8_t* in, size_t in_len) {
   return ConnectionFromSsl(ssl)->delegate_->SessionTicketOpen(
       out, out_len, max_out_len,
       absl::string_view(reinterpret_cast<const char*>(in), in_len));
diff --git a/quiche/quic/core/crypto/tls_server_connection.h b/quiche/quic/core/crypto/tls_server_connection.h
index 85dddd0..3c0eb7e 100644
--- a/quiche/quic/core/crypto/tls_server_connection.h
+++ b/quiche/quic/core/crypto/tls_server_connection.h
@@ -41,10 +41,8 @@
     virtual int TlsExtServernameCallback(int* out_alert) = 0;
 
     // Selects which ALPN to use based on the list sent by the client.
-    virtual int SelectAlpn(const uint8_t** out,
-                           uint8_t* out_len,
-                           const uint8_t* in,
-                           unsigned in_len) = 0;
+    virtual int SelectAlpn(const uint8_t** out, uint8_t* out_len,
+                           const uint8_t* in, unsigned in_len) = 0;
 
     // Signs |in| using the signature algorithm specified by |sig_alg| (an
     // SSL_SIGN_* value). If the signing operation cannot be completed
@@ -82,10 +80,8 @@
     // resulting encrypted ticket in |out|, writing the length of the bytes
     // written to |*out_len|, which is no larger than |max_out_len|. It returns
     // 1 on success and 0 on error.
-    virtual int SessionTicketSeal(uint8_t* out,
-                                  size_t* out_len,
-                                  size_t max_out_len,
-                                  absl::string_view in) = 0;
+    virtual int SessionTicketSeal(uint8_t* out, size_t* out_len,
+                                  size_t max_out_len, absl::string_view in) = 0;
 
     // SessionTicketOpen is called when BoringSSL has an encrypted session
     // ticket |in| and wants the ticket decrypted. This decryption operation can
@@ -108,9 +104,7 @@
     // instead. If a fatal error occurs, ssl_ticket_aead_error can be returned
     // which will terminate the handshake.
     virtual enum ssl_ticket_aead_result_t SessionTicketOpen(
-        uint8_t* out,
-        size_t* out_len,
-        size_t max_out_len,
+        uint8_t* out, size_t* out_len, size_t max_out_len,
         absl::string_view in) = 0;
 
     // Provides the delegate for callbacks that are shared between client and
@@ -120,8 +114,7 @@
     friend class TlsServerConnection;
   };
 
-  TlsServerConnection(SSL_CTX* ssl_ctx,
-                      Delegate* delegate,
+  TlsServerConnection(SSL_CTX* ssl_ctx, Delegate* delegate,
                       QuicSSLConfig ssl_config);
 
   // Creates and configures an SSL_CTX that is appropriate for servers to use.
@@ -144,12 +137,8 @@
   // These functions are registered as callbacks in BoringSSL and delegate their
   // implementation to the matching methods in Delegate above.
   static int TlsExtServernameCallback(SSL* ssl, int* out_alert, void* arg);
-  static int SelectAlpnCallback(SSL* ssl,
-                                const uint8_t** out,
-                                uint8_t* out_len,
-                                const uint8_t* in,
-                                unsigned in_len,
-                                void* arg);
+  static int SelectAlpnCallback(SSL* ssl, const uint8_t** out, uint8_t* out_len,
+                                const uint8_t* in, unsigned in_len, void* arg);
 
   // |kPrivateKeyMethod| is a vtable pointing to PrivateKeySign and
   // PrivateKeyComplete used by the TLS stack to compute the signature for the
@@ -157,15 +146,10 @@
   static const SSL_PRIVATE_KEY_METHOD kPrivateKeyMethod;
 
   // The following functions make up the contents of |kPrivateKeyMethod|.
-  static ssl_private_key_result_t PrivateKeySign(SSL* ssl,
-                                                 uint8_t* out,
-                                                 size_t* out_len,
-                                                 size_t max_out,
-                                                 uint16_t sig_alg,
-                                                 const uint8_t* in,
-                                                 size_t in_len);
-  static ssl_private_key_result_t PrivateKeyComplete(SSL* ssl,
-                                                     uint8_t* out,
+  static ssl_private_key_result_t PrivateKeySign(
+      SSL* ssl, uint8_t* out, size_t* out_len, size_t max_out, uint16_t sig_alg,
+      const uint8_t* in, size_t in_len);
+  static ssl_private_key_result_t PrivateKeyComplete(SSL* ssl, uint8_t* out,
                                                      size_t* out_len,
                                                      size_t max_out);
 
@@ -175,14 +159,10 @@
 
   // The following functions make up the contents of |kSessionTicketMethod|.
   static size_t SessionTicketMaxOverhead(SSL* ssl);
-  static int SessionTicketSeal(SSL* ssl,
-                               uint8_t* out,
-                               size_t* out_len,
-                               size_t max_out_len,
-                               const uint8_t* in,
+  static int SessionTicketSeal(SSL* ssl, uint8_t* out, size_t* out_len,
+                               size_t max_out_len, const uint8_t* in,
                                size_t in_len);
-  static enum ssl_ticket_aead_result_t SessionTicketOpen(SSL* ssl,
-                                                         uint8_t* out,
+  static enum ssl_ticket_aead_result_t SessionTicketOpen(SSL* ssl, uint8_t* out,
                                                          size_t* out_len,
                                                          size_t max_out_len,
                                                          const uint8_t* in,
diff --git a/quiche/quic/core/crypto/transport_parameters.cc b/quiche/quic/core/crypto/transport_parameters.cc
index 8e8b900..ca2adc8 100644
--- a/quiche/quic/core/crypto/transport_parameters.cc
+++ b/quiche/quic/core/crypto/transport_parameters.cc
@@ -167,10 +167,8 @@
 }  // namespace
 
 TransportParameters::IntegerParameter::IntegerParameter(
-    TransportParameters::TransportParameterId param_id,
-    uint64_t default_value,
-    uint64_t min_value,
-    uint64_t max_value)
+    TransportParameters::TransportParameterId param_id, uint64_t default_value,
+    uint64_t min_value, uint64_t max_value)
     : param_id_(param_id),
       value_(default_value),
       default_value_(default_value),
@@ -185,18 +183,13 @@
 TransportParameters::IntegerParameter::IntegerParameter(
     TransportParameters::TransportParameterId param_id)
     : TransportParameters::IntegerParameter::IntegerParameter(
-          param_id,
-          0,
-          0,
-          kVarInt62MaxValue) {}
+          param_id, 0, 0, kVarInt62MaxValue) {}
 
 void TransportParameters::IntegerParameter::set_value(uint64_t value) {
   value_ = value;
 }
 
-uint64_t TransportParameters::IntegerParameter::value() const {
-  return value_;
-}
+uint64_t TransportParameters::IntegerParameter::value() const { return value_; }
 
 bool TransportParameters::IntegerParameter::IsValid() const {
   return min_value_ <= value_ && value_ <= max_value_;
@@ -1195,10 +1188,8 @@
 }
 
 bool ParseTransportParameters(ParsedQuicVersion version,
-                              Perspective perspective,
-                              const uint8_t* in,
-                              size_t in_len,
-                              TransportParameters* out,
+                              Perspective perspective, const uint8_t* in,
+                              size_t in_len, TransportParameters* out,
                               std::string* error_details) {
   out->perspective = perspective;
   QuicDataReader reader(reinterpret_cast<const char*>(in), in_len);
@@ -1504,8 +1495,7 @@
 namespace {
 
 bool DigestUpdateIntegerParam(
-    EVP_MD_CTX* hash_ctx,
-    const TransportParameters::IntegerParameter& param) {
+    EVP_MD_CTX* hash_ctx, const TransportParameters::IntegerParameter& param) {
   uint64_t value = param.value();
   return EVP_DigestUpdate(hash_ctx, &value, sizeof(value));
 }
@@ -1513,8 +1503,7 @@
 }  // namespace
 
 bool SerializeTransportParametersForTicket(
-    const TransportParameters& in,
-    const std::vector<uint8_t>& application_data,
+    const TransportParameters& in, const std::vector<uint8_t>& application_data,
     std::vector<uint8_t>* out) {
   std::string error_details;
   if (!in.AreValid(&error_details)) {
diff --git a/quiche/quic/core/crypto/transport_parameters.h b/quiche/quic/core/crypto/transport_parameters.h
index 7ccd557..5be5ab4 100644
--- a/quiche/quic/core/crypto/transport_parameters.h
+++ b/quiche/quic/core/crypto/transport_parameters.h
@@ -56,8 +56,7 @@
     bool Read(QuicDataReader* reader, std::string* error_details);
     // operator<< allows easily logging integer transport parameters.
     friend QUIC_EXPORT_PRIVATE std::ostream& operator<<(
-        std::ostream& os,
-        const IntegerParameter& param);
+        std::ostream& os, const IntegerParameter& param);
 
    private:
     friend struct TransportParameters;
@@ -65,10 +64,8 @@
     // This constructor sets |default_value| and |min_value| to 0, and
     // |max_value| to kVarInt62MaxValue.
     explicit IntegerParameter(TransportParameterId param_id);
-    IntegerParameter(TransportParameterId param_id,
-                     uint64_t default_value,
-                     uint64_t min_value,
-                     uint64_t max_value);
+    IntegerParameter(TransportParameterId param_id, uint64_t default_value,
+                     uint64_t min_value, uint64_t max_value);
     IntegerParameter(const IntegerParameter& other) = default;
     IntegerParameter(IntegerParameter&& other) = default;
     // Human-readable string representation.
@@ -106,8 +103,7 @@
     // Allows easily logging.
     std::string ToString() const;
     friend QUIC_EXPORT_PRIVATE std::ostream& operator<<(
-        std::ostream& os,
-        const TransportParameters& params);
+        std::ostream& os, const TransportParameters& params);
   };
 
   // LegacyVersionInformation represents the Google QUIC downgrade prevention
@@ -271,16 +267,14 @@
   // Allows easily logging transport parameters.
   std::string ToString() const;
   friend QUIC_EXPORT_PRIVATE std::ostream& operator<<(
-      std::ostream& os,
-      const TransportParameters& params);
+      std::ostream& os, const TransportParameters& params);
 };
 
 // Serializes a TransportParameters struct into the format for sending it in a
 // TLS extension. The serialized bytes are written to |*out|. Returns if the
 // parameters are valid and serialization succeeded.
 QUIC_EXPORT_PRIVATE bool SerializeTransportParameters(
-    ParsedQuicVersion version,
-    const TransportParameters& in,
+    ParsedQuicVersion version, const TransportParameters& in,
     std::vector<uint8_t>* out);
 
 // Parses bytes from the quic_transport_parameters TLS extension and writes the
@@ -289,12 +283,9 @@
 // This method returns true if the input was successfully parsed.
 // On failure, this method will write a human-readable error message to
 // |error_details|.
-QUIC_EXPORT_PRIVATE bool ParseTransportParameters(ParsedQuicVersion version,
-                                                  Perspective perspective,
-                                                  const uint8_t* in,
-                                                  size_t in_len,
-                                                  TransportParameters* out,
-                                                  std::string* error_details);
+QUIC_EXPORT_PRIVATE bool ParseTransportParameters(
+    ParsedQuicVersion version, Perspective perspective, const uint8_t* in,
+    size_t in_len, TransportParameters* out, std::string* error_details);
 
 // Serializes |in| and |application_data| in a deterministic format so that
 // multiple calls to SerializeTransportParametersForTicket with the same inputs
@@ -305,8 +296,7 @@
 // match what they were on the connection that issued an early data capable
 // ticket.
 QUIC_EXPORT_PRIVATE bool SerializeTransportParametersForTicket(
-    const TransportParameters& in,
-    const std::vector<uint8_t>& application_data,
+    const TransportParameters& in, const std::vector<uint8_t>& application_data,
     std::vector<uint8_t>* out);
 
 }  // namespace quic
diff --git a/quiche/quic/core/crypto/transport_parameters_test.cc b/quiche/quic/core/crypto/transport_parameters_test.cc
index fea6608..fe9a2ce 100644
--- a/quiche/quic/core/crypto/transport_parameters_test.cc
+++ b/quiche/quic/core/crypto/transport_parameters_test.cc
@@ -161,8 +161,7 @@
   ParsedQuicVersion version_;
 };
 
-INSTANTIATE_TEST_SUITE_P(TransportParametersTests,
-                         TransportParametersTest,
+INSTANTIATE_TEST_SUITE_P(TransportParametersTests, TransportParametersTest,
                          ::testing::ValuesIn(AllSupportedVersionsWithTls()),
                          ::testing::PrintToStringParamName());
 
diff --git a/quiche/quic/core/crypto/web_transport_fingerprint_proof_verifier.h b/quiche/quic/core/crypto/web_transport_fingerprint_proof_verifier.h
index 6082ca5..ea1908d 100644
--- a/quiche/quic/core/crypto/web_transport_fingerprint_proof_verifier.h
+++ b/quiche/quic/core/crypto/web_transport_fingerprint_proof_verifier.h
@@ -91,27 +91,18 @@
 
   // ProofVerifier implementation.
   QuicAsyncStatus VerifyProof(
-      const std::string& hostname,
-      const uint16_t port,
-      const std::string& server_config,
-      QuicTransportVersion transport_version,
-      absl::string_view chlo_hash,
-      const std::vector<std::string>& certs,
-      const std::string& cert_sct,
-      const std::string& signature,
-      const ProofVerifyContext* context,
-      std::string* error_details,
+      const std::string& hostname, const uint16_t port,
+      const std::string& server_config, QuicTransportVersion transport_version,
+      absl::string_view chlo_hash, const std::vector<std::string>& certs,
+      const std::string& cert_sct, const std::string& signature,
+      const ProofVerifyContext* context, std::string* error_details,
       std::unique_ptr<ProofVerifyDetails>* details,
       std::unique_ptr<ProofVerifierCallback> callback) override;
   QuicAsyncStatus VerifyCertChain(
-      const std::string& hostname,
-      const uint16_t port,
-      const std::vector<std::string>& certs,
-      const std::string& ocsp_response,
-      const std::string& cert_sct,
-      const ProofVerifyContext* context,
-      std::string* error_details,
-      std::unique_ptr<ProofVerifyDetails>* details,
+      const std::string& hostname, const uint16_t port,
+      const std::vector<std::string>& certs, const std::string& ocsp_response,
+      const std::string& cert_sct, const ProofVerifyContext* context,
+      std::string* error_details, std::unique_ptr<ProofVerifyDetails>* details,
       uint8_t* out_alert,
       std::unique_ptr<ProofVerifierCallback> callback) override;
   std::unique_ptr<ProofVerifyContext> CreateDefaultContext() override;