format: replace tabs for indentation in code commentsac/clang-format

sed -i \
     -e 's/^'$'\t'' \*/     */g' \
     -e 's/^'$'\t\t'' \*/         */g' \
     -e 's/^'$'\t\t\t'' \*/             */g' \
     -e 's/^'$'\t\t\t\t'' \*/                 */g' \
     -e 's/^'$'\t\t\t\t\t'' \*/                     */g' \
     -e 's/^'$'\t\t\t\t\t\t'' \*/                         */g' \
     -e 's/^'$'\t\t\t\t\t\t\t'' \*/                             */g' \
     $(git ls-files -- '*.[hc]')

395 files changed, 15940 insertions, 15940 deletions

diff --git a/clients/cli/common.c b/clients/cli/common.c
index b0796dd385..7298dcb7c0 100644
--- a/clients/cli/common.c
+++ b/clients/cli/common.c
@@ -487,7 +487,7 @@ found:
             if (!already_tracked) {
                 if (match_by_uuid) {
                     /* the profile is matched exactly (by UUID). We prepend it
-					 * to the list of all found profiles. */
+                     * to the list of all found profiles. */
                     g_ptr_array_insert(result, result_inital_len, g_object_ref(connection));
                 } else
                     g_ptr_array_add(result, g_object_ref(connection));
@@ -521,10 +521,10 @@ nmc_find_active_connection(const GPtrArray *active_cons,
         con = nm_active_connection_get_connection(candidate);
 
         /* When filter_type is NULL, compare connection ID (filter_val)
-		 * against all types. Otherwise, only compare against the specific
-		 * type. If 'path' or 'apath' filter types are specified, comparison
-		 * against numeric index (in addition to the whole path) is allowed.
-		 */
+         * against all types. Otherwise, only compare against the specific
+         * type. If 'path' or 'apath' filter types are specified, comparison
+         * against numeric index (in addition to the whole path) is allowed.
+         */
         if (NM_IN_STRSET(filter_type, NULL, "id")) {
             v = nm_active_connection_get_id(candidate);
             if (complete)
@@ -683,7 +683,7 @@ get_secrets_from_user(const NmcConfig *nmc_config,
         char *                     pwd    = NULL;
 
         /* First try to find the password in provided passwords file,
-		 * then ask user. */
+         * then ask user. */
         if (pwds_hash && (pwd = g_hash_table_lookup(pwds_hash, secret->entry_id))) {
             pwd = g_strdup(pwd);
         } else {
@@ -787,7 +787,7 @@ nmc_secrets_requested(NMSecretAgentSimple *agent,
         nm_secret_agent_simple_response(agent, request_id, secrets);
     else {
         /* Unregister our secret agent on failure, so that another agent
-		 * may be tried */
+         * may be tried */
         if (nmc->secret_agent) {
             nm_secret_agent_old_unregister(NM_SECRET_AGENT_OLD(nmc->secret_agent), NULL, NULL);
             g_clear_object(&nmc->secret_agent);
@@ -1011,8 +1011,8 @@ nmc_readline_echo(const NmcConfig *nmc_config, gboolean echo_on, const char *pro
         saved_history = history_get_history_state();
         history_set_history_state(&passwd_history);
         /* stifling history is important as it tells readline to
-		 * not store anything, otherwise sensitive data could be
-		 * leaked */
+         * not store anything, otherwise sensitive data could be
+         * leaked */
         stifle_history(0);
         rl_redisplay_function = nmc_secret_redisplay;
     }
diff --git a/clients/cli/connections.c b/clients/cli/connections.c
index 45e49f9616..80b7aa46ec 100644
--- a/clients/cli/connections.c
+++ b/clients/cli/connections.c
@@ -163,7 +163,7 @@ static int
 active_connection_get_state_ord(NMActiveConnection *active)
 {
     /* returns an integer related to @active's state, that can be used for sorting
-	 * active connections based on their activation state. */
+     * active connections based on their activation state. */
     if (!active)
         return -2;
 
@@ -291,8 +291,8 @@ get_vpn_connection_type(NMConnection *connection)
         return NULL;
 
     /* The service type is in form of "org.freedesktop.NetworkManager.vpnc".
-	 * Extract end part after last dot, e.g. "vpnc"
-	 */
+     * Extract end part after last dot, e.g. "vpnc"
+     */
     type = nm_setting_vpn_get_service_type(nm_connection_get_setting_vpn(connection));
     if (!type)
         return NULL;
@@ -481,11 +481,11 @@ _con_show_fcn_get_id(NMConnection *c, NMActiveConnection *ac)
     s = s_con ? nm_setting_connection_get_id(s_con) : NULL;
     if (!s && ac) {
         /* note that if we have no s_con, that usually means that the user has no permissions
-		 * to see the connection. We still fall to get the ID from the active-connection,
-		 * which exposes it despite the user having no permissions.
-		 *
-		 * That might be unexpected, because the user is shown an ID, which he later
-		 * is unable to resolve in other operations. */
+         * to see the connection. We still fall to get the ID from the active-connection,
+         * which exposes it despite the user having no permissions.
+         *
+         * That might be unexpected, because the user is shown an ID, which he later
+         * is unable to resolve in other operations. */
         s = nm_active_connection_get_id(ac);
     }
     return s;
@@ -503,7 +503,7 @@ _con_show_fcn_get_type(NMConnection *c, NMActiveConnection *ac, NMMetaAccessorGe
     s = s_con ? nm_setting_connection_get_connection_type(s_con) : NULL;
     if (!s && ac) {
         /* see _con_show_fcn_get_id() for why we fallback to get the value
-		 * from @ac. */
+         * from @ac. */
         s = nm_active_connection_get_connection_type(ac);
     }
     return connection_type_to_display(s, get_type);
@@ -525,16 +525,16 @@ static gconstpointer _metagen_con_show_get_fcn(NMC_META_GENERIC_INFO_GET_FCN_ARG
 
     if (!row_data->show_active_fields) {
         /* we are not supposed to show any fields of the active connection.
-		 * We only tracked the primary_active to get the coloring right.
-		 * From now on, there is no active connection. */
+         * We only tracked the primary_active to get the coloring right.
+         * From now on, there is no active connection. */
         ac = NULL;
 
         /* in this mode, we expect that we are called only with connections that
-		 * have a [connection] setting and a UUID. Otherwise, the connection is
-		 * effectively invisible to the user, and should be hidden.
-		 *
-		 * But in that case, we expect that the caller pre-filtered this row out.
-		 * So assert(). */
+         * have a [connection] setting and a UUID. Otherwise, the connection is
+         * effectively invisible to the user, and should be hidden.
+         *
+         * But in that case, we expect that the caller pre-filtered this row out.
+         * So assert(). */
         nm_assert(s_con);
         nm_assert(nm_setting_connection_get_uuid(s_con));
     }
@@ -549,7 +549,7 @@ static gconstpointer _metagen_con_show_get_fcn(NMC_META_GENERIC_INFO_GET_FCN_ARG
         s = s_con ? nm_setting_connection_get_uuid(s_con) : NULL;
         if (!s && ac) {
             /* see _con_show_fcn_get_id() for why we fallback to get the value
-			 * from @ac. */
+             * from @ac. */
             s = nm_active_connection_get_uuid(ac);
         }
         return s;
@@ -726,7 +726,7 @@ static gconstpointer _metagen_con_active_general_get_fcn(NMC_META_GENERIC_INFO_G
         return c ? nm_connection_get_path(c) : NULL;
     case NMC_GENERIC_INFO_TYPE_CON_ACTIVE_GENERAL_ZONE:
         /* this is really ugly, because the zone is not a property of the active-connection,
-		 * but the settings-connection profile. There is no guarantee, that they agree. */
+         * but the settings-connection profile. There is no guarantee, that they agree. */
         return s_con ? nm_setting_connection_get_zone(s_con) : NULL;
     case NMC_GENERIC_INFO_TYPE_CON_ACTIVE_GENERAL_MASTER_PATH:
         dev = nm_active_connection_get_master(ac);
@@ -824,7 +824,7 @@ static gconstpointer _metagen_con_active_vpn_get_fcn(NMC_META_GENERIC_INFO_GET_F
                 nm_assert(k);
                 v = nm_setting_vpn_get_data_item(s_vpn, k);
                 /* update the arr array in-place. Previously it contained
-				 * the constant keys, now it contains the strdup'ed output text. */
+                 * the constant keys, now it contains the strdup'ed output text. */
                 arr2[i] = g_strdup_printf("%s = %s", k, v);
             }
 
@@ -1819,8 +1819,8 @@ con_show_get_items_cmp(gconstpointer pa, gconstpointer pb, gpointer user_data)
             static const NmcSortOrder def[] = {NMC_SORT_ACTIVE, NMC_SORT_NAME, NMC_SORT_PATH};
 
             /* Note: the default order does not consider whether a column is shown.
-			 *       That means, the selection of the output fields, does not affect the
-			 *       order (although there could be an argument that it should). */
+             *       That means, the selection of the output fields, does not affect the
+             *       order (although there could be an argument that it should). */
             order_arr = def;
             order_len = G_N_ELEMENTS(def);
         }
@@ -1900,16 +1900,16 @@ con_show_get_items(NmCli *nmc, gboolean active_only, gboolean show_active_fields
     arr = nm_client_get_connections(nmc->client);
     for (i = 0; i < arr->len; i++) {
         /* Note: libnm will not expose connection that are invisible
-		 * to the user but currently inactive.
-		 *
-		 * That differs from get-active-connection(). If an invisible connection
-		 * is active, we can get its NMActiveConnection. We can even obtain
-		 * the corresponding NMRemoteConnection (although, of course it has
-		 * no visible settings).
-		 *
-		 * I think this inconsistency is a bug in libnm. Anyway, the result is,
-		 * that we print invisible connections if they are active, but otherwise
-		 * we exclude them. */
+         * to the user but currently inactive.
+         *
+         * That differs from get-active-connection(). If an invisible connection
+         * is active, we can get its NMActiveConnection. We can even obtain
+         * the corresponding NMRemoteConnection (although, of course it has
+         * no visible settings).
+         *
+         * I think this inconsistency is a bug in libnm. Anyway, the result is,
+         * that we print invisible connections if they are active, but otherwise
+         * we exclude them. */
         c = arr->pdata[i];
         g_hash_table_insert(row_hash,
                             c,
@@ -1923,7 +1923,7 @@ con_show_get_items(NmCli *nmc, gboolean active_only, gboolean show_active_fields
         c = nm_active_connection_get_connection(ac);
         if (!show_active_fields && !c) {
             /* the active connection has no connection, and we don't show
-			 * any active fields. Skip this row. */
+             * any active fields. Skip this row. */
             continue;
         }
 
@@ -1931,11 +1931,11 @@ con_show_get_items(NmCli *nmc, gboolean active_only, gboolean show_active_fields
 
         if (show_active_fields || !c) {
             /* the active connection either has no connection (in which we create a
-			 * connection-less row), or we are interested in showing each active
-			 * connection in its own row. Add a row. */
+             * connection-less row), or we are interested in showing each active
+             * connection in its own row. Add a row. */
             if (row_data) {
                 /* we create a rowdata for this connection earlier. We drop it, because this
-				 * connection is tracked via the rowdata of the active connection. */
+                 * connection is tracked via the rowdata of the active connection. */
                 g_hash_table_remove(row_hash, c);
                 _metagen_con_show_row_data_destroy(row_data);
             }
@@ -1946,11 +1946,11 @@ con_show_get_items(NmCli *nmc, gboolean active_only, gboolean show_active_fields
         }
 
         /* we add the active connection to the row for the referenced
-		 * connection. We need to group them this way, to print the proper
-		 * color (activated or not) based on primary_active. */
+         * connection. We need to group them this way, to print the proper
+         * color (activated or not) based on primary_active. */
         if (!row_data) {
             /* this is unexpected. The active connection references a connection that
-			 * seemingly no longer exists. It's a bug in libnm. Add a row nonetheless. */
+             * seemingly no longer exists. It's a bug in libnm. Add a row nonetheless. */
             row_data = _metagen_con_show_row_data_new_for_connection(c, show_active_fields);
             g_hash_table_insert(row_hash, c, row_data);
         }
@@ -1973,11 +1973,11 @@ con_show_get_items(NmCli *nmc, gboolean active_only, gboolean show_active_fields
             s_con = nm_connection_get_setting_connection(row_data->connection);
             if (!s_con || !nm_setting_connection_get_uuid(s_con)) {
                 /* we are in a mode, where we only print rows for connection.
-				 * For that we require that all rows are visible to the user,
-				 * meaning: the have a [connection] setting and a UUID.
-				 *
-				 * Otherwise, this connection is likely invisible to the user.
-				 * Skip it. */
+                 * For that we require that all rows are visible to the user,
+                 * meaning: the have a [connection] setting and a UUID.
+                 *
+                 * Otherwise, this connection is likely invisible to the user.
+                 * Skip it. */
                 _metagen_con_show_row_data_destroy(row_data);
                 continue;
             }
@@ -2161,11 +2161,11 @@ do_connections_show(const NMCCommand *cmd, NmCli *nmc, int argc, const char *con
             fields_str = nmc->required_fields;
 
         /* determine whether the user wants to see any fields that are related to active-connections
-		 * (e.g. the apath, the current state, or the device where the profile is active).
-		 *
-		 * If that's the case, then we will show one line for each active connection. In case
-		 * a profile has multiple active connections, it will be listed multiple times.
-		 * If that's not the case, we filter out these duplicate lines. */
+         * (e.g. the apath, the current state, or the device where the profile is active).
+         *
+         * If that's the case, then we will show one line for each active connection. In case
+         * a profile has multiple active connections, it will be listed multiple times.
+         * If that's not the case, we filter out these duplicate lines. */
         selection = nm_meta_selection_create_parse_list(
             (const NMMetaAbstractInfo *const *) metagen_con_show,
             fields_str,
@@ -2219,7 +2219,7 @@ do_connections_show(const NMCCommand *cmd, NmCli *nmc, int argc, const char *con
         nm_clear_g_free(&nmc->required_fields);
 
         /* Before printing the connections check if we have a "--show-secret"
-		 * option after the connection ids */
+         * option after the connection ids */
         if (!nmc->nmc_config.show_secrets && !nmc->complete) {
             int                argc_cp = argc;
             const char *const *argv_cp = argv;
@@ -2276,8 +2276,8 @@ do_connections_show(const NMCCommand *cmd, NmCli *nmc, int argc, const char *con
                     if (!selector
                         && !nm_streq0(*argv, nm_object_get_path(NM_OBJECT(explicit_acon)))) {
                         /* we matched the apath based on the last component alone (note the full D-Bus path).
-						 * That is how nmc_find_active_connection() works, if you pass in a selector.
-						 * Reject it. */
+                         * That is how nmc_find_active_connection() works, if you pass in a selector.
+                         * Reject it. */
                         explicit_acon = NULL;
                     }
                     nm_g_object_ref(explicit_acon);
@@ -2293,10 +2293,10 @@ do_connections_show(const NMCCommand *cmd, NmCli *nmc, int argc, const char *con
             }
 
             /* Print connection details:
-			 * Usually we have both static and active connection.
-			 * But when a connection is private to a user, another user
-			 * may see only the active connection.
-			 */
+             * Usually we have both static and active connection.
+             * But when a connection is private to a user, another user
+             * may see only the active connection.
+             */
 
             if (nmc->complete) {
                 next_arg(nmc, &argc, &argv, NULL);
@@ -2313,7 +2313,7 @@ do_connections_show(const NMCCommand *cmd, NmCli *nmc, int argc, const char *con
                         break;
                     explicit_acon_handled = TRUE;
                     /* the user referenced an "apath". In this case, we can only have at most one connection
-					 * and one apath. */
+                     * and one apath. */
                     con = NM_CONNECTION(nm_active_connection_get_connection(explicit_acon));
                 } else {
                     if (i_found_cons >= found_cons->len)
@@ -2353,8 +2353,8 @@ do_connections_show(const NMCCommand *cmd, NmCli *nmc, int argc, const char *con
 
                         if (i > 0) {
                             /* if there are multiple active connections, separate them with newline.
-							 * that is a bit odd, because we already separate connections with newlines,
-							 * and commonly don't separate the connection from the first active connection. */
+                             * that is a bit odd, because we already separate connections with newlines,
+                             * and commonly don't separate the connection from the first active connection. */
                             g_print("\n");
                         }
 
@@ -2419,8 +2419,8 @@ get_default_active_connection(NmCli *nmc, NMDevice **device)
     }
 
     /* Prefer the default connection if one exists, otherwise return the first
-	 * non-default connection.
-	 */
+     * non-default connection.
+     */
     if (!default_ac && non_default_ac) {
         default_ac = non_default_ac;
         *device    = non_default_device;
@@ -2697,7 +2697,7 @@ progress_active_connection_cb(gpointer user_data)
 
     if (ac_state == NM_ACTIVE_CONNECTION_STATE_ACTIVATING) {
         /* If the connection is activating, the device state
-		 * is more interesting. */
+         * is more interesting. */
         ac_devs = nm_active_connection_get_devices(active);
         device  = ac_devs->len > 0 ? g_ptr_array_index(ac_devs, 0) : NULL;
     } else {
@@ -2780,10 +2780,10 @@ activate_connection_cb(GObject *client, GAsyncResult *result, gpointer user_data
                                  G_CALLBACK(device_state_cb),
                                  info);
             /* Both active_connection_state_cb () and device_state_cb () will just
-			 * call check_activated (info). So, just call it once directly after
-			 * connecting on both the signals of the objects and skip the call to
-			 * the callbacks.
-			 */
+             * call check_activated (info). So, just call it once directly after
+             * connecting on both the signals of the objects and skip the call to
+             * the callbacks.
+             */
             check_activated(info);
 
             /* Start progress indication showing VPN states */
@@ -2923,9 +2923,9 @@ do_connection_up(const NMCCommand *cmd, NmCli *nmc, int argc, const char *const
     int *                 argc_ptr;
 
     /*
-	 * Set default timeout for connection activation.
-	 * Activation can take quite a long time, use 90 seconds.
-	 */
+     * Set default timeout for connection activation.
+     * Activation can take quite a long time, use 90 seconds.
+     */
     if (nmc->timeout == -1)
         nmc->timeout = 90;
 
@@ -3008,9 +3008,9 @@ do_connection_up(const NMCCommand *cmd, NmCli *nmc, int argc, const char *const
         return;
 
     /* Use nowait_flag instead of should_wait because exiting has to be postponed till
-	 * active_connection_state_cb() is called. That gives NM time to check our permissions
-	 * and we can follow activation progress.
-	 */
+     * active_connection_state_cb() is called. That gives NM time to check our permissions
+     * and we can follow activation progress.
+     */
     nmc->nowait_flag = (nmc->timeout == 0);
     nmc->should_wait++;
 
@@ -3038,7 +3038,7 @@ do_connection_up(const NMCCommand *cmd, NmCli *nmc, int argc, const char *const
 typedef struct {
     NmCli *nmc;
     /* a list of object that is relevant for the callback. The object
-	 * type differs, and depends on the type of callback. */
+     * type differs, and depends on the type of callback. */
     GPtrArray *   obj_list;
     guint         timeout_id;
     GCancellable *cancellable;
@@ -3386,7 +3386,7 @@ get_valid_settings_array(const char *con_type)
     const NMMetaSettingInfoEditor *setting_info;
 
     /* No connection type yet? Return settings for a generic connection
-	 * (just the "connection" setting), which always makes sense. */
+     * (just the "connection" setting), which always makes sense. */
     if (!con_type)
         return nm_meta_setting_info_valid_parts_default;
 
@@ -3450,11 +3450,11 @@ get_valid_properties_string(const NMMetaSettingValidPartItem *const *array,
             }
 
             /* If postix (so prefix is terminated by a dot), check
-			 * that prefix is not ambiguous */
+             * that prefix is not ambiguous */
             if (postfix) {
                 /* If we have a perfect match, no need to look for others
-				 * prefix and no check on ambiguity should be performed.
-				 * Moreover, erase previous matches from output string */
+                 * prefix and no check on ambiguity should be performed.
+                 * Moreover, erase previous matches from output string */
                 if (nm_streq(prefix, setting_info->general->setting_name)
                     || nm_streq0(prefix, setting_info->alias)) {
                     g_string_erase(str, 0, -1);
@@ -3897,7 +3897,7 @@ static gboolean
 _meta_property_needs_bond_hack(const NMMetaPropertyInfo *property_info)
 {
     /* hack: the bond property data is handled special and not generically.
-	 * Eventually, get rid of explicitly checking whether we handle a bond. */
+     * Eventually, get rid of explicitly checking whether we handle a bond. */
     if (!property_info)
         g_return_val_if_reached(FALSE);
     return property_info->property_typ_data
@@ -4945,8 +4945,8 @@ nmc_process_connection_properties(NmCli *             nmc,
                                   GError **           error)
 {
     /* First check if we have a slave-type, as this would mean we will not
-	 * have ip properties but possibly others, slave-type specific.
-	 */
+     * have ip properties but possibly others, slave-type specific.
+     */
     /* Go through arguments and set properties */
     do {
         const NMMetaSettingValidPartItem *const *type_settings;
@@ -5044,7 +5044,7 @@ nmc_process_connection_properties(NmCli *             nmc,
             GError *      local = NULL;
 
             /* This seems like a <setting>.<property> (such as "connection.id" or "bond.mode"),
-			 * optionally prefixed with "+| or "-". */
+             * optionally prefixed with "+| or "-". */
 
             if (*argc == 1 && nmc->complete)
                 complete_property_name(nmc, connection, modifier, option_sett, option_prop);
@@ -5595,13 +5595,13 @@ read_properties:
     if (argc && !nmc_process_connection_properties(nmc, connection, &argc, &argv, FALSE, &error)) {
         if (g_strcmp0(*argv, "--") == 0 && !seen_dash_dash) {
             /* This is for compatibility with older nmcli that required
-			 * options and properties to be separated with "--" */
+             * options and properties to be separated with "--" */
             seen_dash_dash = TRUE;
             next_arg(nmc, &argc, &argv, NULL);
             goto read_properties;
         } else if (g_strcmp0(*argv, "save") == 0) {
             /* It would be better if "save" was a separate argument and not
-			 * mixed with properties, but there's not much we can do about it now. */
+             * mixed with properties, but there's not much we can do about it now. */
             argc--;
             argv++;
             if (!argc) {
@@ -5634,7 +5634,7 @@ read_properties:
         questionnaire_mandatory(nmc, connection);
 
     /* Traditionally, we didn't ask for these options for ethernet slaves. They don't
-	 * make much sense, since these are likely to be set by the master anyway. */
+     * make much sense, since these are likely to be set by the master anyway. */
     if (nm_setting_connection_get_slave_type(s_con)) {
         disable_options(NM_SETTING_WIRED_SETTING_NAME, NM_SETTING_WIRED_MTU);
         disable_options(NM_SETTING_WIRED_SETTING_NAME, NM_SETTING_WIRED_MAC_ADDRESS);
@@ -5642,14 +5642,14 @@ read_properties:
     }
 
     /* Connection id is special in that it's required but we don't insist
-	 * on getting it from the user -- we just make up something sensible. */
+     * on getting it from the user -- we just make up something sensible. */
     if (!nm_setting_connection_get_id(s_con)) {
         const char *ifname     = nm_setting_connection_get_interface_name(s_con);
         const char *type       = nm_setting_connection_get_connection_type(s_con);
         const char *slave_type = nm_setting_connection_get_slave_type(s_con);
 
         /* If only bother when there's a type, which is not guaranteed at this point.
-		 * Otherwise, the validation will fail anyway. */
+         * Otherwise, the validation will fail anyway. */
         if (type) {
             gs_free char *   try_name     = NULL;
             gs_free char *   default_name = NULL;
@@ -5668,16 +5668,16 @@ read_properties:
     set_default_interface_name(nmc, s_con);
 
     /* Now see if there's something optional that needs to be asked for.
-	 * Keep asking until there's no more things to ask for. */
+     * Keep asking until there's no more things to ask for. */
     do {
         /* This ensures all settings that make sense are present. */
         nm_connection_normalize(connection, NULL, NULL, NULL);
     } while (nmc->ask && questionnaire_one_optional(nmc, connection));
 
     /* Mandatory settings. No good reason to check this other than guarding the user
-	 * from doing something that's not likely to make sense (such as missing ifname
-	 * on a bond/bridge/team, etc.). Added just to preserve traditional behavior, it
-	 * perhaps is a good idea to just remove this. */
+     * from doing something that's not likely to make sense (such as missing ifname
+     * on a bond/bridge/team, etc.). Added just to preserve traditional behavior, it
+     * perhaps is a good idea to just remove this. */
     for (s = 0; s < _NM_META_SETTING_TYPE_NUM; s++) {
         const NMMetaPropertyInfo *const *property_infos;
         guint                            p;
@@ -5972,8 +5972,8 @@ gen_property_names(const char *text, int state)
         valid_settings_main = get_valid_settings_array(nmc_tab_completion.con_type);
 
         /* Support autocompletion of slave-connection parameters
-		 * guessing the slave type from the setting name already
-		 * typed (or autocompleted) */
+         * guessing the slave type from the setting name already
+         * typed (or autocompleted) */
         if (nm_streq0(strv[0], NM_SETTING_TEAM_PORT_SETTING_NAME))
             slv_type = NM_SETTING_TEAM_SETTING_NAME;
         else if (nm_streq0(strv[0], NM_SETTING_BRIDGE_PORT_SETTING_NAME))
@@ -6768,8 +6768,8 @@ editor_main_usage(void)
 {
     g_print("------------------------------------------------------------------------------\n");
     /* TRANSLATORS: do not translate command names and keywords before ::
-	 *              However, you should translate terms enclosed in <>.
-	 */
+     *              However, you should translate terms enclosed in <>.
+     */
     g_print(_("---[ Main menu ]---\n"
               "goto     [<setting> | <prop>]        :: go to a setting or property\n"
               "remove   <setting>[.<prop>] | <prop> :: remove setting or reset property value\n"
@@ -6953,8 +6953,8 @@ editor_sub_help(void)
 {
     g_print("------------------------------------------------------------------------------\n");
     /* TRANSLATORS: do not translate command names and keywords before ::
-	 *              However, you should translate terms enclosed in <>.
-	 */
+     *              However, you should translate terms enclosed in <>.
+     */
     g_print(_("---[ Property menu ]---\n"
               "set      [<value>]               :: set new value\n"
               "add      [<value>]               :: add new option to the property\n"
@@ -7310,9 +7310,9 @@ property_edit_submenu(NmCli *              nmc,
         case NMC_EDITOR_SUB_CMD_SET:
         case NMC_EDITOR_SUB_CMD_ADD:
             /* list, arrays,...: SET replaces the whole property value
-			 *                   ADD adds the new value(s)
-			 * single values:  : both SET and ADD sets the new value
-			 */
+             *                   ADD adds the new value(s)
+             * single values:  : both SET and ADD sets the new value
+             */
             if (!cmd_property_arg) {
                 gs_strfreev char **to_free = NULL;
                 const char *const *avals;
@@ -8266,9 +8266,9 @@ editor_menu_main(NmCli *nmc, NMConnection *connection, const char *connection_ty
                     refresh_remote_connection(&weak, &rem_con);
 
                     /* Replace local connection with the remote one to be sure they are equal.
-					 * This mitigates problems with plugins not preserving some properties or
-					 * adding ipv{4,6} settings when not present.
-					 */
+                     * This mitigates problems with plugins not preserving some properties or
+                     * adding ipv{4,6} settings when not present.
+                     */
                     if (con_tmp) {
                         gs_free char *s_name = NULL;
 
@@ -8547,7 +8547,7 @@ editor_init_existing_connection(NMConnection *connection)
     NMSettingConnection *s_con;
 
     /* FIXME: this approach of connecting handlers to do something is fundamentally
-	 * flawed. See the comment in nmc_setting_ip6_connect_handlers(). */
+     * flawed. See the comment in nmc_setting_ip6_connect_handlers(). */
 
     s_ip4      = nm_connection_get_setting_ip4_config(connection);
     s_ip6      = nm_connection_get_setting_ip6_config(connection);
@@ -8670,8 +8670,8 @@ do_connection_edit(const NMCCommand *cmd, NmCli *nmc, int argc, const char *cons
         }
 
         /* Duplicate the connection and use that so that we need not
-		 * differentiate existing vs. new later
-		 */
+         * differentiate existing vs. new later
+         */
         connection = nm_simple_connection_new_clone(found_con);
 
         /* Merge secrets into the connection */
diff --git a/clients/cli/devices.c b/clients/cli/devices.c
index 999896efce..534596887c 100644
--- a/clients/cli/devices.c
+++ b/clients/cli/devices.c
@@ -2231,9 +2231,9 @@ do_device_connect(const NMCCommand *cmd, NmCli *nmc, int argc, const char *const
         return;
 
     /*
-	 * Use nowait_flag instead of should_wait, because exiting has to be postponed
-	 * till connect_device_cb() is called, giving NM time to check our permissions.
-	 */
+     * Use nowait_flag instead of should_wait, because exiting has to be postponed
+     * till connect_device_cb() is called, giving NM time to check our permissions.
+     */
     nmc->nowait_flag = (nmc->timeout == 0);
     nmc->should_wait++;
 
@@ -2285,8 +2285,8 @@ static void
 device_removed_cb(NMClient *client, NMDevice *device, DeviceCbInfo *info)
 {
     /* Success: device has been removed.
-	 * It can also happen when disconnecting a software device.
-	 */
+     * It can also happen when disconnecting a software device.
+     */
     if (!g_slist_find(info->queue, device))
         return;
 
@@ -2767,7 +2767,7 @@ do_device_set(const NMCCommand *cmd, NmCli *nmc, int argc, const char *const *ar
         return;
 
     /* when multiple properties are specified, set them in the order as they
-	 * are specified on the command line. */
+     * are specified on the command line. */
     if (values[DEV_SET_AUTOCONNECT].idx >= 0 && values[DEV_SET_MANAGED].idx >= 0
         && values[DEV_SET_MANAGED].idx < values[DEV_SET_AUTOCONNECT].idx) {
         nm_device_set_managed(device, values[DEV_SET_MANAGED].value);
@@ -3189,19 +3189,19 @@ wifi_list_rescan_cb(GObject *source_object, GAsyncResult *res, gpointer user_dat
     if (g_error_matches(error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_NOT_ALLOWED)) {
         if (nm_device_get_state(NM_DEVICE(wifi)) < NM_DEVICE_STATE_DISCONNECTED) {
             /* the device is either unmanaged or unavailable.
-			 *
-			 * If it's unmanaged, we don't expect any scan result and are done.
-			 * If it's unavailable, that usually means that we wait for wpa_supplicant
-			 * to start. In that case, also quit (without scan results). */
+             *
+             * If it's unmanaged, we don't expect any scan result and are done.
+             * If it's unavailable, that usually means that we wait for wpa_supplicant
+             * to start. In that case, also quit (without scan results). */
             force_finished = TRUE;
             done           = TRUE;
         } else {
             /* This likely means that scanning is already in progress. There's
-			 * a good chance we'll get updated results soon; wait for them.
-			 *
-			 * But also, NetworkManager ratelimits (and rejects requests). That
-			 * means, possibly we were just ratelimited, so waiting will not lead
-			 * to a new scan result. Instead, repeatedly ask new scans... */
+             * a good chance we'll get updated results soon; wait for them.
+             *
+             * But also, NetworkManager ratelimits (and rejects requests). That
+             * means, possibly we were just ratelimited, so waiting will not lead
+             * to a new scan result. Instead, repeatedly ask new scans... */
             nm_utils_invoke_on_timeout(1000,
                                        wifi_list_data->scan_cancellable,
                                        wifi_list_rescan_retry_cb,
@@ -3837,8 +3837,8 @@ do_device_wifi_connect(const NMCCommand *cmd, NmCli *nmc, int argc, const char *
 
         if (nm_access_point_connection_valid(ap, NM_CONNECTION(avail_con))) {
             /* ap has been checked against bssid1, bssid2 and the ssid
-			 * and now avail_con has been checked against ap.
-			 */
+             * and now avail_con has been checked against ap.
+             */
             connection = g_object_ref(avail_con);
             break;
         }
@@ -3854,7 +3854,7 @@ do_device_wifi_connect(const NMCCommand *cmd, NmCli *nmc, int argc, const char *
 
     if (!connection) {
         /* If there are some connection data from user, create a connection and
-		 * fill them into proper settings. */
+         * fill them into proper settings. */
         if (con_name || private || bssid2_arr || hidden)
             connection = nm_simple_connection_new();
 
@@ -3968,9 +3968,9 @@ do_device_wifi_connect(const NMCCommand *cmd, NmCli *nmc, int argc, const char *
     // implementing add/edit connections support for nmcli.
 
     /* nowait_flag indicates user input. should_wait says whether quit in start().
-	 * We have to delay exit after add_and_activate_cb() is called, even if
-	 * the user doesn't want to wait, in order to give NM time to check our
-	 * permissions. */
+     * We have to delay exit after add_and_activate_cb() is called, even if
+     * the user doesn't want to wait, in order to give NM time to check our
+     * permissions. */
     nmc->nowait_flag = (nmc->timeout == 0);
     nmc->should_wait++;
 
diff --git a/clients/cli/general.c b/clients/cli/general.c
index d9b922b086..db59f5776f 100644
--- a/clients/cli/general.c
+++ b/clients/cli/general.c
@@ -1482,7 +1482,7 @@ nmc_command_func_overview(const NMCCommand *cmd, NmCli *nmc, int argc, const cha
         color = nmc_device_state_to_color(device);
         if (ac) {
             /* TRANSLATORS: prints header line for activated device in plain `nmcli` overview output as
-			 * "<interface-name>: <device-state> to <connection-id>" */
+             * "<interface-name>: <device-state> to <connection-id>" */
             tmp = nmc_colorize(&nmc->nmc_config,
                                color,
                                C_("nmcli-overview", "%s: %s to %s"),
@@ -1491,7 +1491,7 @@ nmc_command_func_overview(const NMCCommand *cmd, NmCli *nmc, int argc, const cha
                                nm_active_connection_get_id(ac));
         } else {
             /* TRANSLATORS: prints header line for not active device in plain `nmcli` overview output as
-			 * "<interface-name>: <device-state>" */
+             * "<interface-name>: <device-state>" */
             tmp = nmc_colorize(&nmc->nmc_config,
                                color,
                                C_("nmcli-overview", "%s: %s"),
diff --git a/clients/cli/nmcli.c b/clients/cli/nmcli.c
index 7058fd1357..f2f44d4618 100644
--- a/clients/cli/nmcli.c
+++ b/clients/cli/nmcli.c
@@ -139,8 +139,8 @@ complete_one(gpointer key, gpointer value, gpointer user_data)
     if ((!*last && !strchr(name, '.')) || matches(last, name)) {
         if (option != prefix) {
             /* value prefix was not a standalone argument,
-			 * it was part of --option=<value> argument.
-			 * Repeat the part leading to "=". */
+             * it was part of --option=<value> argument.
+             * Repeat the part leading to "=". */
             g_print("%s=", option);
         }
         g_print("%.*s%s%s\n",
@@ -201,8 +201,8 @@ complete_option_with_value(const char *option, const char *prefix, ...)
         if (!*prefix || matches(prefix, candidate)) {
             if (option != prefix) {
                 /* value prefix was not a standalone argument,
-				 * it was part of --option=<value> argument.
-				 * Repeat the part leading to "=". */
+                 * it was part of --option=<value> argument.
+                 * Repeat the part leading to "=". */
                 g_print("%s=", option);
             }
             g_print("%s\n", candidate);
@@ -262,13 +262,13 @@ matches_arg(NmCli *nmc, int *argc, const char *const **argv, const char *pattern
 
     if (opt[1] == '-') {
         /* We know one '-' was already seen by the caller.
-		 * Skip it if there's a second one*/
+         * Skip it if there's a second one*/
         opt++;
     }
 
     if (arg) {
         /* If there's a "=" separator, replace it with NUL so that matches()
-		 * works and consider the part after it to be the argument's value. */
+         * works and consider the part after it to be the argument's value. */
         s = strchr(opt, '=');
         if (s) {
             opt     = nm_strndup_a(300, opt, s - opt, &opt_free);
@@ -284,7 +284,7 @@ matches_arg(NmCli *nmc, int *argc, const char *const **argv, const char *pattern
             *arg = g_steal_pointer(&arg_tmp);
         else {
             /* We need a value, but the option didn't contain a "=<value>" part.
-			 * Proceed to the next argument. */
+             * Proceed to the next argument. */
             if (*argc <= 1) {
                 g_string_printf(nmc->return_text,
                                 _("Error: missing argument for '%s' option."),
@@ -564,8 +564,8 @@ parse_color_scheme(char *       palette_buffer,
     int i;
 
     /* This reads through the raw color scheme file contents, identifying the
-	 * color names and sequences, putting in terminating NULs in place, so that
-	 * pointers into the buffer can readily be used as strings in the palette. */
+     * color names and sequences, putting in terminating NULs in place, so that
+     * pointers into the buffer can readily be used as strings in the palette. */
     while (1) {
         /* Leading whitespace. */
         while (nm_utils_is_separator(*p) || *p == '\n')
@@ -819,8 +819,8 @@ process_command_line(NmCli *nmc, int argc, char **argv_orig)
             nmc->required_fields                 = g_strdup(value);
             nmc->nmc_config_mutable.print_output = NMC_PRINT_TERSE;
             /* We want fixed tabular mode here, but just set the mode specified and rely on defaults:
-			 * in this way we allow use of "-m multiline" to swap the output mode also if placed
-			 * before the "-g <field>" option (-g may be still more practical and easy to remember than -t -f).
+             * in this way we allow use of "-m multiline" to swap the output mode also if placed
+             * before the "-g <field>" option (-g may be still more practical and easy to remember than -t -f).
 			*/
             nmc->mode_specified = TRUE;
         } else if (matches_arg(nmc, &argc, &argv, "-nocheck", NULL)) {
diff --git a/clients/cli/settings.c b/clients/cli/settings.c
index 86b493c340..83837af3d0 100644
--- a/clients/cli/settings.c
+++ b/clients/cli/settings.c
@@ -52,8 +52,8 @@ ipv4_addresses_changed_cb(GObject *object, GParamSpec *pspec, gpointer user_data
     g_signal_handlers_block_by_func(object, G_CALLBACK(ipv4_method_changed_cb), NULL);
 
     /* If we have some IP addresses set method to 'manual'.
-	 * Else if the method was 'manual', change it back to 'auto'.
-	 */
+     * Else if the method was 'manual', change it back to 'auto'.
+     */
     if (nm_setting_ip_config_get_num_addresses(NM_SETTING_IP_CONFIG(object))) {
         if (g_strcmp0(nm_setting_ip_config_get_method(NM_SETTING_IP_CONFIG(object)),
                       NM_SETTING_IP4_CONFIG_METHOD_MANUAL)) {
@@ -124,8 +124,8 @@ ipv6_addresses_changed_cb(GObject *object, GParamSpec *pspec, gpointer user_data
     g_signal_handlers_block_by_func(object, G_CALLBACK(ipv6_method_changed_cb), NULL);
 
     /* If we have some IP addresses set method to 'manual'.
-	 * Else if the method was 'manual', change it back to 'auto'.
-	 */
+     * Else if the method was 'manual', change it back to 'auto'.
+     */
     if (nm_setting_ip_config_get_num_addresses(NM_SETTING_IP_CONFIG(object))) {
         if (g_strcmp0(nm_setting_ip_config_get_method(NM_SETTING_IP_CONFIG(object)),
                       NM_SETTING_IP6_CONFIG_METHOD_MANUAL)) {
@@ -142,24 +142,24 @@ ipv6_addresses_changed_cb(GObject *object, GParamSpec *pspec, gpointer user_data
     } else {
         answered = FALSE;
         /* FIXME: editor_init_existing_connection() and registering handlers is not the
-		 *  right approach.
-		 *
-		 * This only happens to work because in nmcli's edit mode
-		 * tends to append addresses -- instead of setting them.
-		 * If we would change that (to behavior I'd expect), we'd get:
-		 *
-		 *   nmcli> set ipv6.addresses fc01::1:5/68
-		 *   Do you also want to set 'ipv6.method' to 'manual'? [yes]: y
-		 *   nmcli> set ipv6.addresses fc01::1:6/68
-		 *   Do you also want to set 'ipv6.method' to 'manual'? [yes]:
-		 *
-		 * That's because nmc_setting_set_property() calls set_fcn(). With modifier '\0'
-		 * (set), it would first clear all addresses before adding the address. Thereby
-		 * emitting multiple property changed signals.
-		 *
-		 * That can be avoided by freezing/thawing the signals, but this solution
-		 * here is ugly in general.
-		 */
+         *  right approach.
+         *
+         * This only happens to work because in nmcli's edit mode
+         * tends to append addresses -- instead of setting them.
+         * If we would change that (to behavior I'd expect), we'd get:
+         *
+         *   nmcli> set ipv6.addresses fc01::1:5/68
+         *   Do you also want to set 'ipv6.method' to 'manual'? [yes]: y
+         *   nmcli> set ipv6.addresses fc01::1:6/68
+         *   Do you also want to set 'ipv6.method' to 'manual'? [yes]:
+         *
+         * That's because nmc_setting_set_property() calls set_fcn(). With modifier '\0'
+         * (set), it would first clear all addresses before adding the address. Thereby
+         * emitting multiple property changed signals.
+         *
+         * That can be avoided by freezing/thawing the signals, but this solution
+         * here is ugly in general.
+         */
         if (!g_strcmp0(nm_setting_ip_config_get_method(NM_SETTING_IP_CONFIG(object)),
                        NM_SETTING_IP6_CONFIG_METHOD_MANUAL))
             g_object_set(object,
@@ -451,7 +451,7 @@ _env_get_nm_devices(const NMMetaEnvironment *environment,
     nm_assert(nmc);
 
     /* the returned list is *not* NULL terminated. Need to
-	 * provide and honor the out_len argument. */
+     * provide and honor the out_len argument. */
     nm_assert(out_len);
 
     devices = nm_client_get_devices(nmc->client);
@@ -475,7 +475,7 @@ _env_get_nm_connections(const NMMetaEnvironment *environment,
     nm_assert(nmc);
 
     /* the returned list is *not* NULL terminated. Need to
-	 * provide and honor the out_len argument. */
+     * provide and honor the out_len argument. */
     nm_assert(out_len);
 
     values = nm_client_get_connections(nmc->client);
@@ -587,8 +587,8 @@ nmc_setting_set_property(NMClient *             client,
     if (modifier == NM_META_ACCESSOR_MODIFIER_DEL
         && !property_info->property_type->set_supports_remove) {
         /* The property is a plain property. It does not support '-'.
-		 *
-		 * Maybe we should fail, but just return silently. */
+         *
+         * Maybe we should fail, but just return silently. */
         return TRUE;
     }
 
@@ -743,8 +743,8 @@ setting_details(const NmcConfig *nmc_config, NMSetting *setting, const char *one
 
     if (one_prop) {
         /* hack around setting-details being called for one setting. Must prefix the
-		 * property name with the setting name. Later we should remove setting_details()
-		 * and merge it into the caller. */
+         * property name with the setting name. Later we should remove setting_details()
+         * and merge it into the caller. */
         fields_str = g_strdup_printf("%s.%s", nm_setting_get_name(setting), one_prop);
     }
 
diff --git a/clients/cli/utils.c b/clients/cli/utils.c
index 8e7014ad1c..5746d4204b 100644
--- a/clients/cli/utils.c
+++ b/clients/cli/utils.c
@@ -264,9 +264,9 @@ nmc_parse_args(nmc_arg_t *         arg_arr,
             if (strcmp(**argv, p->name) == 0) {
                 if (p->found) {
                     /* Don't allow repeated arguments, because the argument of the same
-					 * name could be used later on the line for another purpose. Assume
-					 * that's the case and return.
-					 */
+                     * name could be used later on the line for another purpose. Assume
+                     * that's the case and return.
+                     */
                     return TRUE;
                 }
 
@@ -347,8 +347,8 @@ void
 nmc_terminal_erase_line(void)
 {
     /* We intentionally use printf(), not g_print() here, to ensure that
-	 * GLib doesn't mistakenly try to convert the string.
-	 */
+     * GLib doesn't mistakenly try to convert the string.
+     */
     printf("\33[2K\r");
     fflush(stdout);
 }
@@ -648,10 +648,10 @@ typedef struct _PrintDataCol {
         const struct _PrintDataCol *parent_col;
 
         /* while constructing the list of columns in _output_selection_append(), we keep track
-		 * of the parent by index. The reason is, that at that point our columns are still
-		 * tracked in a GArray which is growing (hence, the pointers are changing).
-		 * Later, _output_selection_complete() converts the index into the actual pointer.
-		 */
+         * of the parent by index. The reason is, that at that point our columns are still
+         * tracked in a GArray which is growing (hence, the pointers are changing).
+         * Later, _output_selection_complete() converts the index into the actual pointer.
+         */
         guint _parent_idx;
     };
     const NMMetaSelectionItem *selection_item;
@@ -932,7 +932,7 @@ typedef struct {
     bool                title_to_free : 1;
 
     /* whether the column should be printed. If not %TRUE,
-	 * the column will be skipped. */
+     * the column will be skipped. */
     bool to_print : 1;
 
     int width;
@@ -1034,7 +1034,7 @@ _print_fill(const NmcConfig *   nmc_config,
         header_cell->col     = col;
 
         /* by default, the entire column is skipped. That is the case,
-		 * unless we have a cell (below) which opts-in to be printed. */
+         * unless we have a cell (below) which opts-in to be printed. */
         header_cell->to_print = FALSE;
 
         header_cell->title = nm_meta_abstract_info_get_name(info, TRUE);
@@ -1096,13 +1096,13 @@ _print_fill(const NmcConfig *   nmc_config,
             if ((is_default && nmc_config->overview)
                 || NM_FLAGS_HAS(text_out_flags, NM_META_ACCESSOR_GET_OUT_FLAGS_HIDE)) {
                 /* don't mark the entry for display. This is to shorten the output in case
-				 * the property is the default value. But we only do that, if the user
-				 * opts in to this behavior (-overview), or of the property marks itself
-				 * eligible to be hidden.
-				 *
-				 * In general, only new API shall mark itself eligible to be hidden.
-				 * Long established properties cannot, because it would be a change
-				 * in behavior. */
+                 * the property is the default value. But we only do that, if the user
+                 * opts in to this behavior (-overview), or of the property marks itself
+                 * eligible to be hidden.
+                 *
+                 * In general, only new API shall mark itself eligible to be hidden.
+                 * Long established properties cannot, because it would be a change
+                 * in behavior. */
             } else
                 header_cell->to_print = TRUE;
 
@@ -1211,7 +1211,7 @@ _print_skip_column(const NmcConfig *nmc_config, const PrintDataHeaderCell *heade
                       &nmc_meta_type_generic_info)
             && selection_item->sub_selection) {
             /* in tabular form, we skip the "name" entry for sections that have sub-selections.
-			 * That is, for "ipv4.may-fail", but not for "ipv4". */
+             * That is, for "ipv4.may-fail", but not for "ipv4". */
             return TRUE;
         }
     }
@@ -1488,7 +1488,7 @@ nmc_terminal_spawn_pager(const NmcConfig *nmc_config)
             _exit(EXIT_FAILURE);
 
         /* Check whether our parent died before we were able
-		 * to set the death signal */
+         * to set the death signal */
         if (getppid() != parent_pid)
             _exit(EXIT_SUCCESS);
 
@@ -1498,11 +1498,11 @@ nmc_terminal_spawn_pager(const NmcConfig *nmc_config)
         }
 
         /* Debian's alternatives command for pagers is
-		 * called 'pager'. Note that we do not call
-		 * sensible-pagers here, since that is just a
-		 * shell script that implements a logic that
-		 * is similar to this one anyway, but is
-		 * Debian-specific. */
+         * called 'pager'. Note that we do not call
+         * sensible-pagers here, since that is just a
+         * shell script that implements a logic that
+         * is similar to this one anyway, but is
+         * Debian-specific. */
         execlp("pager", "pager", NULL);
 
         execlp("less", "less", NULL);
diff --git a/clients/cli/utils.h b/clients/cli/utils.h
index 61e91d0282..dd3913fa43 100644
--- a/clients/cli/utils.h
+++ b/clients/cli/utils.h
@@ -292,8 +292,8 @@ nmc_meta_generic_get_str_i18n_null(const char *s, NMMetaAccessorGetType get_type
 {
     if (get_type == NM_META_ACCESSOR_GET_TYPE_PARSABLE) {
         /* in parsable mode, return NULL. That is useful if @s is a pretty string
-		 * to describe a missing value (like "(unknown)"). We don't want to print
-		 * that for parsable mode. */
+         * to describe a missing value (like "(unknown)"). We don't want to print
+         * that for parsable mode. */
         return NULL;
     }
     return nmc_meta_generic_get_str_i18n(s, get_type);
@@ -339,15 +339,15 @@ nmc_meta_generic_get_enum_with_detail(NmcMetaGenericGetEnumType get_enum_type,
     switch (get_enum_type) {
     case NMC_META_GENERIC_GET_ENUM_TYPE_PARENTHESES:
         /* note that this function will always print "$NUM ($NICK)", also in PARSABLE
-		 * mode. That might not be desired, but it's done for certain properties to preserve
-		 * previous behavior. */
+         * mode. That might not be desired, but it's done for certain properties to preserve
+         * previous behavior. */
         if (get_type == NM_META_ACCESSOR_GET_TYPE_PRETTY)
             return g_strdup_printf(_("%lld (%s)"), (long long) enum_val, gettext(str_val));
         return g_strdup_printf("%lld (%s)", (long long) enum_val, str_val);
     case NMC_META_GENERIC_GET_ENUM_TYPE_DASH:
         /* note that this function will always print "$NUM ($NICK)", also in PARSABLE
-		 * mode. That might not be desired, but it's done for certain properties to preserve
-		 * previous behavior. */
+         * mode. That might not be desired, but it's done for certain properties to preserve
+         * previous behavior. */
         if (get_type == NM_META_ACCESSOR_GET_TYPE_PRETTY)
             return g_strdup_printf(_("%lld - %s"), (long long) enum_val, gettext(str_val));
         return g_strdup_printf("%lld - %s", (long long) enum_val, str_val);
diff --git a/clients/cloud-setup/nm-cloud-setup-utils.c b/clients/cloud-setup/nm-cloud-setup-utils.c
index e302c3da5a..8d28fe8aa0 100644
--- a/clients/cloud-setup/nm-cloud-setup-utils.c
+++ b/clients/cloud-setup/nm-cloud-setup-utils.c
@@ -138,17 +138,17 @@ static gboolean
 _wait_for_objects_iterate_until_done_idle_cb(gpointer user_data)
 {
     /* This avoids a race where:
-	 *
-	 *   - we check whether there are objects to wait for.
-	 *   - the last object to wait for gets removed (issuing g_main_loop_quit()).
-	 *   - we run the mainloop (and missed our signal).
-	 *
-	 * It's really a missing feature of GMainLoop where the "is-running" flag is always set to
-	 * TRUE by g_main_loop_run(). That means, you cannot catch a g_main_loop_quit() in a race
-	 * free way while not iterating the loop.
-	 *
-	 * Avoid this, by checking once again after we start running the mainloop.
-	 */
+     *
+     *   - we check whether there are objects to wait for.
+     *   - the last object to wait for gets removed (issuing g_main_loop_quit()).
+     *   - we run the mainloop (and missed our signal).
+     *
+     * It's really a missing feature of GMainLoop where the "is-running" flag is always set to
+     * TRUE by g_main_loop_run(). That means, you cannot catch a g_main_loop_quit() in a race
+     * free way while not iterating the loop.
+     *
+     * Avoid this, by checking once again after we start running the mainloop.
+     */
 
     G_LOCK(_wait_for_objects_lock);
     _wait_for_objects_maybe_quit_mainloops_with_lock();
@@ -496,7 +496,7 @@ nmcs_utils_hwaddr_normalize(const char *hwaddr, gssize len)
         hwaddr = nm_strndup_a(300, hwaddr, len, &hwaddr_clone);
     }
     /* we cannot use _nm_utils_hwaddr_aton() because that requires a delimiter.
-	 * Azure exposes MAC addresses without delimiter, so accept that too. */
+     * Azure exposes MAC addresses without delimiter, so accept that too. */
     if (!nm_utils_hexstr2bin_full(hwaddr,
                                   FALSE,
                                   FALSE,
@@ -544,7 +544,7 @@ nmcs_utils_parse_get_full_line(GBytes *mem, const char *needle)
 
     if (line != mem_data && line[-1] != '\n') {
         /* the line must be preceeded either by the begin of the data or
-		 * by a newline. */
+         * by a newline. */
         return NULL;
     }
 
@@ -574,9 +574,9 @@ nmcs_utils_uri_build_concat_v(const char *base, const char **components, gsize n
 
     if (n_components > 0 && components[0] && components[0][0] == '/') {
         /* the first component starts with a slash. We allow that, and don't add a duplicate
-		 * slash. Otherwise, we add a separator after base.
-		 *
-		 * We only do that for the first component. */
+         * slash. Otherwise, we add a separator after base.
+         *
+         * We only do that for the first component. */
     } else
         nm_str_buf_append_c(&strbuf, '/');
 
diff --git a/clients/cloud-setup/nm-http-client.c b/clients/cloud-setup/nm-http-client.c
index 9254456506..942bd07906 100644
--- a/clients/cloud-setup/nm-http-client.c
+++ b/clients/cloud-setup/nm-http-client.c
@@ -204,7 +204,7 @@ _ehandle_complete(EHandleData *edata, GError *error_take)
     *get_result = (GetResult){
         .response_code = response_code,
         /* This ensures that response_data is always NUL terminated. This is an important guarantee
-		 * that NMHttpClient makes. */
+         * that NMHttpClient makes. */
         .response_data = nm_str_buf_finalize_to_gbytes(&edata->recv_data),
     };
 
diff --git a/clients/cloud-setup/nmcs-provider-azure.c b/clients/cloud-setup/nmcs-provider-azure.c
index 02774a7b2a..53223f4b74 100644
--- a/clients/cloud-setup/nmcs-provider-azure.c
+++ b/clients/cloud-setup/nmcs-provider-azure.c
@@ -264,7 +264,7 @@ _get_config_ips_prefix_list_cb(GObject *source, GAsyncResult *result, gpointer u
         if (line_len == 0)
             continue;
         /* Truncate the string. It's safe to do, because we own @response_data an it has an
-		 * extra NULL character after the buffer. */
+         * extra NULL character after the buffer. */
         ((char *) line)[line_len] = '\0';
 
         if (line[line_len - 1] == '/')
@@ -432,7 +432,7 @@ _get_net_ifaces_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
             continue;
 
         /* Truncate the string. It's safe to do, because we own @response_data an it has an
-		 * extra NULL character after the buffer. */
+         * extra NULL character after the buffer. */
         ((char *) line)[line_len] = '\0';
 
         if (line[line_len - 1] == '/' && line_len != 0)
diff --git a/clients/cloud-setup/nmcs-provider-ec2.c b/clients/cloud-setup/nmcs-provider-ec2.c
index 6af661cb0b..03bd4776a7 100644
--- a/clients/cloud-setup/nmcs-provider-ec2.c
+++ b/clients/cloud-setup/nmcs-provider-ec2.c
@@ -26,8 +26,8 @@ again:
     base = g_atomic_pointer_get(&base_cached);
     if (G_UNLIKELY(!base)) {
         /* The base URI can be set via environment variable.
-		 * This is mainly for testing, it's not usually supposed to be configured.
-		 * Consider this private API! */
+         * This is mainly for testing, it's not usually supposed to be configured.
+         * Consider this private API! */
         base = g_getenv(NMCS_ENV_VARIABLE("NM_CLOUD_SETUP_EC2_HOST"));
 
         if (base && base[0] && !strchr(base, '/')) {
@@ -307,7 +307,7 @@ _get_config_metadata_ready_cb(GObject *source, GAsyncResult *result, gpointer us
     }
 
     /* We ignore errors. Only if we got no response at all, it's a problem.
-	 * Otherwise, we proceed with whatever we could fetch. */
+     * Otherwise, we proceed with whatever we could fetch. */
     if (!response_parsed) {
         _get_config_task_maybe_return(
             iface_data,
@@ -438,7 +438,7 @@ _get_config_metadata_ready_check(long     response_code,
             continue;
 
         /* Truncate the string. It's safe to do, because we own @response_data an it has an
-		 * extra NUL character after the buffer. */
+         * extra NUL character after the buffer. */
         ((char *) cur_line)[cur_line_len] = '\0';
 
         hwaddr = nmcs_utils_hwaddr_normalize(
@@ -483,9 +483,9 @@ get_config(NMCSProvider *provider, NMCSProviderGetConfigTaskData *get_config_dat
     };
 
     /* First we fetch the "macs/". If the caller requested some particular
-	 * MAC addresses, then we poll until we see them. They might not yet be
-	 * around from the start...
-	 */
+     * MAC addresses, then we poll until we see them. They might not yet be
+     * around from the start...
+     */
     nm_http_client_poll_get(nmcs_provider_get_http_client(provider),
                             (uri = _ec2_uri_interfaces()),
                             HTTP_TIMEOUT_MS,
diff --git a/clients/cloud-setup/nmcs-provider-gcp.c b/clients/cloud-setup/nmcs-provider-gcp.c
index 173a054f9e..099bfe4c50 100644
--- a/clients/cloud-setup/nmcs-provider-gcp.c
+++ b/clients/cloud-setup/nmcs-provider-gcp.c
@@ -219,7 +219,7 @@ _get_config_ips_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
         gint64 fip_index;
 
         /* Truncate the string. It's safe to do, because we own @response_data an it has an
-		 * extra NUL character after the buffer. */
+         * extra NUL character after the buffer. */
         ((char *) line)[line_len] = '\0';
 
         fip_index = _nm_utils_ascii_str_to_int64(line, 10, 0, G_MAXINT64, -1);
@@ -358,7 +358,7 @@ _get_net_ifaces_list_cb(GObject *source, GAsyncResult *result, gpointer user_dat
             continue;
 
         /* Truncate the string. It's safe to do, because we own @response_data an it has an
-		 * extra NUL character after the buffer. */
+         * extra NUL character after the buffer. */
         ((char *) line)[line_len] = '\0';
         if (line[line_len - 1] == '/')
             ((char *) line)[--line_len] = '\0';
diff --git a/clients/cloud-setup/nmcs-provider.h b/clients/cloud-setup/nmcs-provider.h
index f3ed222992..3b7396547e 100644
--- a/clients/cloud-setup/nmcs-provider.h
+++ b/clients/cloud-setup/nmcs-provider.h
@@ -22,7 +22,7 @@ typedef struct {
     gsize       iproutes_len;
 
     /* TRUE, if the configuration was requested via hwaddrs argument to
-	 * nmcs_provider_get_config(). */
+     * nmcs_provider_get_config(). */
     bool was_requested : 1;
 
 } NMCSProviderGetConfigIfaceData;
diff --git a/clients/common/nm-client-utils.c b/clients/common/nm-client-utils.c
index 7ac6d4443f..d9f8692934 100644
--- a/clients/common/nm-client-utils.c
+++ b/clients/common/nm-client-utils.c
@@ -252,8 +252,8 @@ nmc_bond_validate_mode(const char *mode, GError **error)
                                         NULL};
     if (nmc_string_to_uint(mode, TRUE, 0, 6, &mode_int)) {
         /* Translate bonding mode numbers to mode names:
-		 * https://www.kernel.org/doc/Documentation/networking/bonding.txt
-		 */
+         * https://www.kernel.org/doc/Documentation/networking/bonding.txt
+         */
         return valid_modes[mode_int];
     } else
         return nmc_string_is_valid(mode, valid_modes, error);
@@ -500,29 +500,29 @@ nmc_activation_get_effective_state(NMActiveConnection *active,
         if (!device || ac_reason != NM_ACTIVE_CONNECTION_STATE_REASON_DEVICE_DISCONNECTED
             || nm_device_get_active_connection(device) != active) {
             /* (1)
-			 * - we have no device,
-			 * - or, @ac_reason is specific
-			 * - or, @device no longer references the current @active
-			 * >> we complete with @ac_reason. */
+             * - we have no device,
+             * - or, @ac_reason is specific
+             * - or, @device no longer references the current @active
+             * >> we complete with @ac_reason. */
             *reason = gettext(nm_active_connection_state_reason_to_string(ac_reason));
         } else if (dev_state <= NM_DEVICE_STATE_DISCONNECTED
                    || dev_state >= NM_DEVICE_STATE_FAILED) {
             /* (2)
-			 * - not (1)
-			 * - and, the device is no longer in an activated state,
-			 * >> we complete with @dev_reason. */
+             * - not (1)
+             * - and, the device is no longer in an activated state,
+             * >> we complete with @dev_reason. */
             *reason = gettext(nmc_device_reason_to_string(dev_reason));
         } else {
             /* (3)
-			 * we wait for the device go disconnect. We will get a better
-			 * failure reason from the device (2). */
+             * we wait for the device go disconnect. We will get a better
+             * failure reason from the device (2). */
             return NM_ACTIVE_CONNECTION_STATE_UNKNOWN;
         }
         break;
     case NM_ACTIVE_CONNECTION_STATE_ACTIVATING:
         /* activating master connection does not automatically activate any slaves, so their
-		 * active connection state will not progress beyond ACTIVATING state.
-		 * Monitor the device instead. */
+         * active connection state will not progress beyond ACTIVATING state.
+         * Monitor the device instead. */
         if (device
             && (NM_IS_DEVICE_BOND(device) || NM_IS_DEVICE_TEAM(device)
                 || NM_IS_DEVICE_BRIDGE(device))
@@ -844,8 +844,8 @@ nmc_utils_parse_passwd_file(char *   contents /* will be modified */,
 
         if (nm_streq(l_setting, "vpn") && NM_STR_HAS_PREFIX(l_prop, "secret.")) {
             /* in 1.12.0, we wrongly required the VPN secrets to be named
-			 * "vpn.secret". It should be "vpn.secrets". Work around it
-			 * (rh#1628833). */
+             * "vpn.secret". It should be "vpn.secrets". Work around it
+             * (rh#1628833). */
             l_hash_key = g_strdup_printf("vpn.secrets.%s", &l_prop[NM_STRLEN("secret.")]);
         } else
             l_hash_key = g_strdup_printf("%s.%s", l_setting, l_prop);
@@ -866,8 +866,8 @@ nmc_utils_parse_passwd_file(char *   contents /* will be modified */,
 
         if (!g_utf8_validate(l_hash_val, -1, NULL)) {
             /* In some cases it might make sense to support binary secrets (like the WPA-PSK which has no
-			 * defined encoding. However, all API that follows can only handle UTF-8, and no mechanism
-			 * to escape the secrets. Reject non-UTF-8 early. */
+             * defined encoding. However, all API that follows can only handle UTF-8, and no mechanism
+             * to escape the secrets. Reject non-UTF-8 early. */
             NM_SET_OUT(out_error_line, contents_line);
             nm_utils_error_set(error, NM_UTILS_ERROR_UNKNOWN, _("secret is not UTF-8"));
             return NULL;
diff --git a/clients/common/nm-meta-setting-access.c b/clients/common/nm-meta-setting-access.c
index 9384a90b02..a68d0c8c88 100644
--- a/clients/common/nm-meta-setting-access.c
+++ b/clients/common/nm-meta-setting-access.c
@@ -296,7 +296,7 @@ nm_meta_abstract_info_complete(const NMMetaAbstractInfo *    abstract_info,
         return values;
 
     /* for convenience, we allow the complete_fcn() implementations to
-	 * ignore "text". We filter out invalid matches here. */
+     * ignore "text". We filter out invalid matches here. */
 
     text_len = strlen(text);
 
@@ -403,8 +403,8 @@ _output_selection_pack(const NMMetaAbstractInfo *const *fields_array, GArray *ar
     len = array ? array->len : 0;
 
     /* re-organize the collected output data in one buffer that can be freed using
-	 * g_free(). This makes allocation more complicated, but saves us from special
-	 * handling for free. */
+     * g_free(). This makes allocation more complicated, but saves us from special
+     * handling for free. */
     result = g_malloc0(sizeof(NMMetaSelectionResultList) + (len * sizeof(NMMetaSelectionItem))
                        + (str ? str->len : 0));
     *((guint *) &result->num) = len;
diff --git a/clients/common/nm-meta-setting-desc.c b/clients/common/nm-meta-setting-desc.c
index 553772e5de..938eae9813 100644
--- a/clients/common/nm-meta-setting-desc.c
+++ b/clients/common/nm-meta-setting-desc.c
@@ -45,7 +45,7 @@ static GType
 _gtype_property_get_gtype(GType gtype, const char *property_name)
 {
     /* given @gtype, a type for a GObject, lookup the property @property_name
-	 * and return its value_type. */
+     * and return its value_type. */
     if (G_TYPE_IS_CLASSED(gtype)) {
         GParamSpec *             param_spec;
         nm_auto_unref_gtypeclass GTypeClass *gtypeclass = g_type_class_ref(gtype);
@@ -178,8 +178,8 @@ _value_strsplit(const char *value, ValueStrsplitMode split_mode, gsize *out_len)
     gs_free const char **strv = NULL;
 
     /* FIXME: some modes should support backslash escaping.
-	 * In particular, to distinguish from _value_str_as_index_list(), which
-	 * does not accept '\\'. */
+     * In particular, to distinguish from _value_str_as_index_list(), which
+     * does not accept '\\'. */
 
     /* note that all modes remove empty tokens (",", "a,,b", ",,"). */
     switch (split_mode) {
@@ -213,7 +213,7 @@ _value_strsplit_assert_unsplitable(const char *str)
     gsize                j, l;
 
     /* Assert that we cannot split the token and that it
-	 * has no unescaped delimiters. */
+     * has no unescaped delimiters. */
 
     strv_test = _value_strsplit(str, VALUE_STRSPLIT_MODE_ESCAPED_TOKENS, NULL);
     nm_assert(NM_PTRARRAY_LEN(strv_test) == 1);
@@ -378,7 +378,7 @@ _parse_ip_route(int family, const char *str, GError **error)
             while (
                 g_hash_table_iter_next(&iter, (gpointer *) &iter_key, (gpointer *) &iter_value)) {
                 /* need to sink the reference, because nm_utils_parse_variant_attributes() returns
-				 * floating refs. */
+                 * floating refs. */
                 g_variant_ref_sink(iter_value);
 
                 if (!nm_ip_route_attribute_validate(iter_key, iter_value, family, NULL, error)) {
@@ -850,7 +850,7 @@ _get_fcn_gobject_impl(const NMMetaPropertyInfo *property_info,
     g_object_get_property(G_OBJECT(setting), property_info->property_name, &val);
 
     /* Currently, only one particular property asks us to "handle_emptyunset".
-	 * So, don't implement it (yet) for the other types, where it's unneeded. */
+     * So, don't implement it (yet) for the other types, where it's unneeded. */
     nm_assert(!handle_emptyunset || (gtype_prop == G_TYPE_STRV && !glib_handles_str_transform));
 
     if (gtype_prop == G_TYPE_STRING) {
@@ -859,7 +859,7 @@ _get_fcn_gobject_impl(const NMMetaPropertyInfo *property_info,
         if (property_info->property_typ_data
             && property_info->property_typ_data->subtype.gobject_string.handle_emptyunset) {
             /* This string property can both be empty and NULL. We need to
-			 * signal them differently. */
+             * signal them differently. */
             cstr = g_value_get_string(&val);
             nm_assert((!!is_default) == (cstr == NULL));
             RETURN_STR_EMPTYUNSET(get_type, is_default, NULL);
@@ -1188,7 +1188,7 @@ static gconstpointer _get_fcn_gobject_enum(ARGS_GET_FCN)
     }
 
     /* the gobject_enum.value_infos are currently ignored for the getter. They
-	 * only declare additional aliases for the setter. */
+     * only declare additional aliases for the setter. */
 
     if (property_info->property_typ_data)
         value_infos = property_info->property_typ_data->subtype.gobject_enum.value_infos_get;
@@ -1226,14 +1226,14 @@ static gboolean _set_fcn_gobject_string(ARGS_SET_FCN)
         if (property_info->property_typ_data->subtype.gobject_string.handle_emptyunset) {
             if (value && value[0] && NM_STRCHAR_ALL(value, ch, ch == ' ')) {
                 /* this string property can both be %NULL and empty. To express that, we coerce
-				 * a value of all whitespaces to dropping the first whitespace. That means,
-				 * " " gives "", "  " gives " ", and so on.
-				 *
-				 * This way the user can set the string value to "" (meaning NULL) and to
-				 * " " (meaning ""), and any other string.
-				 *
-				 * This is and non-obvious escaping mechanism. But out of all the possible
-				 * solutions, it seems the most sensible one. */
+                 * a value of all whitespaces to dropping the first whitespace. That means,
+                 * " " gives "", "  " gives " ", and so on.
+                 *
+                 * This way the user can set the string value to "" (meaning NULL) and to
+                 * " " (meaning ""), and any other string.
+                 *
+                 * This is and non-obvious escaping mechanism. But out of all the possible
+                 * solutions, it seems the most sensible one. */
                 value++;
             }
         }
@@ -1666,7 +1666,7 @@ static const char *const *_values_fcn_gobject_enum(ARGS_VALUES_FCN)
     }
 
     /* the gobject_enum.value_infos are currently ignored for the list of
-	 * values. They only declare additional (hidden) aliases for the setter. */
+     * values. They only declare additional (hidden) aliases for the setter. */
 
     v = nm_utils_strv_make_deep_copied(nm_utils_enum_get_values(gtype, min, max));
     return (const char *const *) (*out_to_free = v);
@@ -1927,7 +1927,7 @@ static gboolean _set_fcn_multilist(ARGS_SET_FCN)
     else if (property_info->property_typ_data->subtype.multilist.clear_emptyunset_fcn
              && _is_default(property_info, setting)) {
         /* the property is already the default. But we hav here a '+' / '-' modifier, so
-		 * that always makes it non-default (empty) first. */
+         * that always makes it non-default (empty) first. */
         _multilist_clear_property(property_info, setting, TRUE);
     }
 
@@ -2143,7 +2143,7 @@ static const char *const *_complete_fcn_vpn_service_type(ARGS_COMPLETE_FCN)
 
     if (!text || !*text) {
         /* If the prompt text is empty or contains no '.',
-		 * filter out full names. */
+         * filter out full names. */
         for (i = 0, j = 0; values[i]; i++) {
             if (strchr(values[i], '.')) {
                 g_free(values[i]);
@@ -2439,20 +2439,20 @@ _nm_meta_setting_bond_add_option(NMSetting * setting,
         if ((val2 = nm_setting_bond_get_option_by_name(s_bond, NM_SETTING_BOND_OPTION_ACTIVE_SLAVE))
             && !nm_streq(val2, value)) {
             /* "active_slave" option is deprecated and an alias for "primary". When
-			 * setting "primary" to a different value, remove the deprecated "active_slave"
-			 * setting.
-			 *
-			 * If we wouldn't do this, then the profile would work as requested, but ignoring
-			 * the (redundant, differing) "active_slave" option. That is confusing, thus clean
-			 * it up. */
+             * setting "primary" to a different value, remove the deprecated "active_slave"
+             * setting.
+             *
+             * If we wouldn't do this, then the profile would work as requested, but ignoring
+             * the (redundant, differing) "active_slave" option. That is confusing, thus clean
+             * it up. */
             nm_setting_bond_remove_option(s_bond, NM_SETTING_BOND_OPTION_ACTIVE_SLAVE);
         }
     } else if (nm_streq(name, NM_SETTING_BOND_OPTION_ACTIVE_SLAVE)) {
         if ((val2 = nm_setting_bond_get_option_by_name(s_bond, NM_SETTING_BOND_OPTION_PRIMARY))
             && !nm_streq(val2, value)) {
             /* "active_slave" is a deprecated alias for "primary". NetworkManager will ignore
-			 * "active_slave" if "primary" is set, we thus need to coerce the primary option
-			 * too. */
+             * "active_slave" if "primary" is set, we thus need to coerce the primary option
+             * too. */
             nm_setting_bond_add_option(s_bond, NM_SETTING_BOND_OPTION_PRIMARY, value);
         }
     }
@@ -2526,12 +2526,12 @@ static gboolean _set_fcn_connection_type(ARGS_SET_FCN)
 
     if (nm_setting_connection_get_uuid(NM_SETTING_CONNECTION(setting))) {
         /* Don't allow setting type unless the connection is brand new.
-		 * Just because it's a bad idea and the user wouldn't probably want that.
-		 * No technical reason, really.
-		 * Also, using uuid to see if the connection is brand new is a bit
-		 * hacky: we can not see if the type is already set, because
-		 * nmc_setting_set_property() is called only after the property
-		 * we're setting (type) has been removed. */
+         * Just because it's a bad idea and the user wouldn't probably want that.
+         * No technical reason, really.
+         * Also, using uuid to see if the connection is brand new is a bit
+         * hacky: we can not see if the type is already set, because
+         * nmc_setting_set_property() is called only after the property
+         * we're setting (type) has been removed. */
         g_set_error(error, 1, 0, _("Can not change the connection type"));
         return FALSE;
     }
@@ -2661,7 +2661,7 @@ static const char *const *_complete_fcn_connection_master(ARGS_COMPLETE_FCN)
 
     if ((!text || !*text) && operation_context && operation_context->connection) {
         /* if we have no text yet, initially only complete for matching
-		 * slave-type. */
+         * slave-type. */
         s_con = nm_connection_get_setting_connection(operation_context->connection);
         if (s_con)
             expected_type = nm_setting_connection_get_slave_type(s_con);
@@ -3339,16 +3339,16 @@ static gboolean _set_fcn_objlist(ARGS_SET_FCN)
 
     for (i = 0; i < nstrv; i++) {
         /* FIXME: there is the problem here that set_fcn() might succeed on the first item
-		 * (modifying it), and fail to parse the second one.
-		 *
-		 * Optimally, we would first parse all input strings before starting the
-		 * modify the setting. The setting should only be modified if (and only if)
-		 * the entire operation succeeds to set all items.
-		 *
-		 * Currently, in interactive mode this leads to odd behavior.
-		 *
-		 * This does not only affect objlist.set_fcn() or _pt_objlist properties.
-		 * E.g. we also call _gobject_property_reset() before validating the input. */
+         * (modifying it), and fail to parse the second one.
+         *
+         * Optimally, we would first parse all input strings before starting the
+         * modify the setting. The setting should only be modified if (and only if)
+         * the entire operation succeeds to set all items.
+         *
+         * Currently, in interactive mode this leads to odd behavior.
+         *
+         * This does not only affect objlist.set_fcn() or _pt_objlist properties.
+         * E.g. we also call _gobject_property_reset() before validating the input. */
         if (!property_info->property_typ_data->subtype.objlist
                  .set_fcn(setting, !_SET_FCN_DO_REMOVE(modifier, value), strv[i], error))
             return FALSE;
@@ -3395,8 +3395,8 @@ static gboolean _set_fcn_ip_config_gateway(ARGS_SET_FCN)
     }
 
     /* Since commit c1907a218a6b6bfe8175eb6ed87a523aaabc69ae, having a gateway and never-default=yes
-	 * will be normalized away. That means, when we set a gateway, we also want to unset never-default,
-	 * otherwise the operation gets silently reverted. */
+     * will be normalized away. That means, when we set a gateway, we also want to unset never-default,
+     * otherwise the operation gets silently reverted. */
     g_object_set(setting,
                  property_info->property_name,
                  value,
@@ -3467,11 +3467,11 @@ _objlist_set_fcn_ip_config_routing_rules(NMSetting * setting,
         return FALSE;
 
     /* also for @do_add, we first always search whether such a rule already exist
-	 * and remove the first occurrence.
-	 *
-	 * The effect is, that we don't add multiple times the same rule,
-	 * and that if the rule already exists, it gets moved to the end (append).
-	 */
+     * and remove the first occurrence.
+     *
+     * The effect is, that we don't add multiple times the same rule,
+     * and that if the rule already exists, it gets moved to the end (append).
+     */
     n = nm_setting_ip_config_get_num_routing_rules(s_ip);
     for (i = 0; i < n; i++) {
         NMIPRoutingRule *rr;
@@ -4529,7 +4529,7 @@ static const NMMetaPropertyType _pt_objlist = {
 
 #define MTU_GET_FCN(type, func) \
 	/* macro that returns @func as const (guint32(*)(NMSetting*)) type, but checks
-	 * that the actual type is (guint32(*)(type *)). */ \
+     * that the actual type is (guint32(*)(type *)). */ \
 	((guint32 (*) (NMSetting *)) ((sizeof (func == ((guint32 (*) (type *)) func))) ? func : func) )
 
 #define TEAM_DESCRIBE_MESSAGE \
diff --git a/clients/common/nm-meta-setting-desc.h b/clients/common/nm-meta-setting-desc.h
index fed2fa36d4..41551e1523 100644
--- a/clients/common/nm-meta-setting-desc.h
+++ b/clients/common/nm-meta-setting-desc.h
@@ -159,8 +159,8 @@ typedef enum {
     NM_META_ACCESSOR_GET_OUT_FLAGS_STRV = (1LL << 0),
 
     /* the property allows to be hidden, if and only if, it's value is set to the
-	 * default. This should only be set by new properties, to preserve behavior
-	 * of old properties, which were always printed. */
+     * default. This should only be set by new properties, to preserve behavior
+     * of old properties, which were always printed. */
     NM_META_ACCESSOR_GET_OUT_FLAGS_HIDE = (1LL << 1),
 } NMMetaAccessorGetOutFlags;
 
@@ -231,7 +231,7 @@ struct _NMMetaPropertyType {
                                        char ***                      out_to_free);
 
     /* Whether set_fcn() supports the '-' modifier. That is, whether the property
-	 * is a list type. */
+     * is a list type. */
     bool set_supports_remove : 1;
 };
 
@@ -280,8 +280,8 @@ struct _NMMetaPropertyTypData {
             void (*clear_all_fcn)(NMSetting *setting);
 
             /* some multilist properties distinguish between an empty list and
-			 * and unset. If this function pointer is set, certain behaviors come
-			 * into action to handle that. */
+             * and unset. If this function pointer is set, certain behaviors come
+             * into action to handle that. */
             void (*clear_emptyunset_fcn)(NMSetting *setting,
                                          gboolean   is_set /* or else set default */);
 
@@ -417,15 +417,15 @@ struct _NMMetaSettingInfoEditor {
     guint                            properties_num;
 
     /* a NMConnection has a main type (connection.type), which is a
-	 * main NMSetting instance. Depending on the type, a connection
-	 * may have a list of other allowed settings.
-	 *
-	 * For example, a connection of type "vlan" may have settings
-	 * of type "connection", "vlan", and "wired".
-	 *
-	 * Some setting types a not a main type (NMSettingProxy). They
-	 * don't have valid_settings but are usually referenced by other
-	 * settings to be valid for them. */
+     * main NMSetting instance. Depending on the type, a connection
+     * may have a list of other allowed settings.
+     *
+     * For example, a connection of type "vlan" may have settings
+     * of type "connection", "vlan", and "wired".
+     *
+     * Some setting types a not a main type (NMSettingProxy). They
+     * don't have valid_settings but are usually referenced by other
+     * settings to be valid for them. */
     const NMMetaSettingValidPartItem *const *valid_parts;
 
     void (*setting_init_fcn)(const NMMetaSettingInfoEditor *setting_info,
diff --git a/clients/common/nm-polkit-listener.c b/clients/common/nm-polkit-listener.c
index bee1e7a782..270299db74 100644
--- a/clients/common/nm-polkit-listener.c
+++ b/clients/common/nm-polkit-listener.c
@@ -170,7 +170,7 @@ choose_identity(GVariant *identities)
     const char *  user;
 
     /* Choose identity. First try current user, then root, and else
-	 * take the first one we find. */
+     * take the first one we find. */
 
     user = getenv("USER");
 
@@ -428,10 +428,10 @@ io_watch_have_data(int fd, GIOCondition condition, gpointer user_data)
         }
 
         /* Either an error or EOF happened. The data we parsed so far was not relevant.
-		 * Regardless of what we still have unprocessed in the receive buffers, we are done.
-		 *
-		 * We would expect that the other side completed with SUCCESS or FAILURE. Apparently
-		 * it didn't. If we had any good request, we assume success. */
+         * Regardless of what we still have unprocessed in the receive buffers, we are done.
+         *
+         * We would expect that the other side completed with SUCCESS or FAILURE. Apparently
+         * it didn't. If we had any good request, we assume success. */
         auth_result = request->request_any_response;
         goto out;
     }
diff --git a/clients/common/nm-secret-agent-simple.c b/clients/common/nm-secret-agent-simple.c
index 0a8be69a0b..604c7477bb 100644
--- a/clients/common/nm-secret-agent-simple.c
+++ b/clients/common/nm-secret-agent-simple.c
@@ -263,9 +263,9 @@ add_8021x_secrets(RequestData *request, GPtrArray *secrets)
 
     if (NM_IN_STRSET(eap_method, "md5", "leap", "ttls", "peap")) {
         /* TTLS and PEAP are actually much more complicated, but this complication
-		 * is not visible here since we only care about phase2 authentication
-		 * (and don't even care of which one)
-		 */
+         * is not visible here since we only care about phase2 authentication
+         * (and don't even care of which one)
+         */
         secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_PROPERTY,
                                         _("Username"),
                                         NM_SETTING(s_8021x),
@@ -612,8 +612,8 @@ _auth_dialog_exited(GPid pid, int status, gpointer user_data)
 
 out:
     /* Try to fall back to the hardwired VPN support if the auth dialog fails.
-	 * We may eventually get rid of the whole hardwired secrets handling at some point,
-	 * when the auth helpers are goode enough.. */
+     * We may eventually get rid of the whole hardwired secrets handling at some point,
+     * when the auth helpers are goode enough.. */
     if (error && add_vpn_secrets(request, secrets, &message)) {
         g_clear_error(&error);
         if (!message) {
@@ -660,7 +660,7 @@ _auth_dialog_read_done(GObject *source_object, GAsyncResult *res, gpointer user_
         break;
     case 0:
         /* Done reading. Let's wait for the auth dialog to exit so that we're able to collect the status.
-		 * Remember we can be cancelled in between. */
+         * Remember we can be cancelled in between. */
         data->child_watch_id = g_child_watch_add(data->auth_dialog_pid, _auth_dialog_exited, data);
         data->cancellable    = g_object_ref(data->request->cancellable);
         data->cancellable_id =
@@ -688,7 +688,7 @@ _auth_dialog_write_done(GObject *source_object, GAsyncResult *res, gpointer user
     _nm_unused gs_free char *auth_dialog_request_free = user_data;
 
     /* We don't care about write errors. If there are any problems, the
-	 * reader shall notice. */
+     * reader shall notice. */
     g_output_stream_write_finish(auth_dialog_out, res, NULL);
     g_output_stream_close(auth_dialog_out, NULL, NULL);
 }
@@ -1214,7 +1214,7 @@ cancel_get_secrets(NMSecretAgentOld *agent, const char *connection_path, const c
     request    = g_hash_table_lookup(priv->requests, &request_id);
     if (!request) {
         /* this is really a bug of the caller (or us?). We cannot invoke a callback,
-		 * hence the caller cannot cleanup the request. */
+         * hence the caller cannot cleanup the request. */
         g_return_if_reached();
     }
 
@@ -1266,9 +1266,9 @@ nm_secret_agent_simple_enable(NMSecretAgentSimple *self, const char *path)
     gs_free char *        path_full = NULL;
 
     /* The path is only used to match a request_id with the current
-	 * connection. Since the request_id is "${CONNECTION_PATH}/${SETTING}",
-	 * add a trailing '/' to the path to match the full connection path.
-	 */
+     * connection. Since the request_id is "${CONNECTION_PATH}/${SETTING}",
+     * add a trailing '/' to the path to match the full connection path.
+     */
     path_full = path ? g_strdup_printf("%s/", path) : NULL;
 
     if (!nm_streq0(path_full, priv->path)) {
@@ -1365,27 +1365,27 @@ nm_secret_agent_simple_class_init(NMSecretAgentSimpleClass *klass)
     agent_class->delete_secrets     = delete_secrets;
 
     /**
-	 * NMSecretAgentSimple::request-secrets:
-	 * @agent: the #NMSecretAgentSimple
-	 * @request_id: request ID, to eventually pass to
-	 *   nm_secret_agent_simple_response().
-	 * @title: a title for the password dialog
-	 * @prompt: a prompt message for the password dialog
-	 * @secrets: (element-type #NMSecretAgentSimpleSecret): array of secrets
-	 *   being requested.
-	 *
-	 * Emitted when the agent requires secrets from the user.
-	 *
-	 * The application should ask user for the secrets. For example,
-	 * nmtui should create a password dialog (#NmtPasswordDialog)
-	 * with the given title and prompt, and an entry for each
-	 * element of @secrets. If any of the secrets already have a
-	 * <literal>value</literal> filled in, the corresponding entry
-	 * should be initialized to that value.
-	 *
-	 * When the dialog is complete, the app must call
-	 * nm_secret_agent_simple_response() with the results.
-	 */
+     * NMSecretAgentSimple::request-secrets:
+     * @agent: the #NMSecretAgentSimple
+     * @request_id: request ID, to eventually pass to
+     *   nm_secret_agent_simple_response().
+     * @title: a title for the password dialog
+     * @prompt: a prompt message for the password dialog
+     * @secrets: (element-type #NMSecretAgentSimpleSecret): array of secrets
+     *   being requested.
+     *
+     * Emitted when the agent requires secrets from the user.
+     *
+     * The application should ask user for the secrets. For example,
+     * nmtui should create a password dialog (#NmtPasswordDialog)
+     * with the given title and prompt, and an entry for each
+     * element of @secrets. If any of the secrets already have a
+     * <literal>value</literal> filled in, the corresponding entry
+     * should be initialized to that value.
+     *
+     * When the dialog is complete, the app must call
+     * nm_secret_agent_simple_response() with the results.
+     */
     signals[REQUEST_SECRETS] = g_signal_new(NM_SECRET_AGENT_SIMPLE_REQUEST_SECRETS,
                                             G_TYPE_FROM_CLASS(klass),
                                             0,
diff --git a/clients/common/nm-vpn-helpers.c b/clients/common/nm-vpn-helpers.c
index e786fcb2e4..d872f7d5d5 100644
--- a/clients/common/nm-vpn-helpers.c
+++ b/clients/common/nm-vpn-helpers.c
@@ -231,11 +231,11 @@ nm_vpn_openconnect_authenticate_helper(const char *host,
         return FALSE;
 
     /* Parse output and set cookie, gateway and gwcert
-	 * output example:
-	 * COOKIE='loremipsum'
-	 * HOST='1.2.3.4'
-	 * FINGERPRINT='sha1:32bac90cf09a722e10ecc1942c67fe2ac8c21e2e'
-	 */
+     * output example:
+     * COOKIE='loremipsum'
+     * HOST='1.2.3.4'
+     * FINGERPRINT='sha1:32bac90cf09a722e10ecc1942c67fe2ac8c21e2e'
+     */
     output_v = nm_utils_strsplit_set_with_empty(output, "\r\n");
     for (iter = output_v; iter && *iter; iter++) {
         char *s_mutable = (char *) *iter;
@@ -288,9 +288,9 @@ _line_match(char *line, const char *key, gsize key_len, const char **out_key, ch
     nm_assert(out_value && !*out_value);
 
     /* Note that `wg-quick` (linux.bash) does case-insensitive comparison (shopt -s nocasematch).
-	 * `wg setconf` does case-insensitive comparison too (with strncasecmp, which is locale dependent).
-	 *
-	 * We do a case-insensitive comparison of the key, however in a locale-independent manner. */
+     * `wg setconf` does case-insensitive comparison too (with strncasecmp, which is locale dependent).
+     *
+     * We do a case-insensitive comparison of the key, however in a locale-independent manner. */
 
     if (g_ascii_strncasecmp(line, key, key_len) != 0)
         return FALSE;
@@ -366,9 +366,9 @@ nm_vpn_wireguard_import(const char *filename, GError **error)
     g_return_val_if_fail(!error || !*error, NULL);
 
     /* contrary to "wg-quick", we never interpret the filename as "/etc/wireguard/$INTERFACE.conf".
-	 * If the filename has no '/', it is interpreted as relative to the current working directory.
-	 * However, we do require a suitable filename suffix and that the name corresponds to the interface
-	 * name. */
+     * If the filename has no '/', it is interpreted as relative to the current working directory.
+     * However, we do require a suitable filename suffix and that the name corresponds to the interface
+     * name. */
     cstr = strrchr(filename, '/');
     cstr = cstr ? &cstr[1] : filename;
     if (NM_STR_HAS_SUFFIX(cstr, ".conf")) {
@@ -401,14 +401,14 @@ nm_vpn_wireguard_import(const char *filename, GError **error)
         return NULL;
 
         /* We interpret the file like `wg-quick up` and `wg setconf` do.
-	 *
-	 * Of course the WireGuard scripts do something fundamentlly different. They
-	 * perform actions to configure the WireGuard link in kernel, add routes and
-	 * addresses, and call resolvconf. It all happens at the time when the script
-	 * run.
-	 *
-	 * This code here instead generates a NetworkManager connection profile so that
-	 * NetworkManager will apply a similar configuration when later activating the profile. */
+     *
+     * Of course the WireGuard scripts do something fundamentlly different. They
+     * perform actions to configure the WireGuard link in kernel, add routes and
+     * addresses, and call resolvconf. It all happens at the time when the script
+     * run.
+     *
+     * This code here instead generates a NetworkManager connection profile so that
+     * NetworkManager will apply a similar configuration when later activating the profile. */
 
 #define _TABLE_AUTO ((gint64) -1)
 #define _TABLE_OFF  ((gint64) -2)
@@ -433,14 +433,14 @@ nm_vpn_wireguard_import(const char *filename, GError **error)
             (line_remainder++)[0] = '\0';
 
         /* Drop all spaces and truncate at first '#'.
-		 * See wg's config_read_line().
-		 *
-		 * Note that wg-quick doesn't do that.
-		 *
-		 * Neither `wg setconf` nor `wg-quick` does a strict parsing.
-		 * We don't either. Just try to interpret the file (mostly) the same as
-		 * they would.
-		 */
+         * See wg's config_read_line().
+         *
+         * Note that wg-quick doesn't do that.
+         *
+         * Neither `wg setconf` nor `wg-quick` does a strict parsing.
+         * We don't either. Just try to interpret the file (mostly) the same as
+         * they would.
+         */
         {
             gsize l, n;
 
@@ -448,7 +448,7 @@ nm_vpn_wireguard_import(const char *filename, GError **error)
             for (l = 0; (ch = line[l]); l++) {
                 if (g_ascii_isspace(ch)) {
                     /* wg-setconf strips all whitespace before parsing the content. That means,
-					 * *[I nterface]" will be accepted. We do that too. */
+                     * *[I nterface]" will be accepted. We do that too. */
                     continue;
                 }
                 if (ch == '#')
@@ -524,8 +524,8 @@ nm_vpn_wireguard_import(const char *filename, GError **error)
                     goto fail_invalid_value;
 
                 /* wg-quick accepts the "MTU" value, but it also fetches routes to
-				 * autodetect it. NetworkManager won't do that, we can only configure
-				 * an explicit MTU or no autodetection will be performed. */
+                 * autodetect it. NetworkManager won't do that, we can only configure
+                 * an explicit MTU or no autodetection will be performed. */
                 data_mtu = i64;
                 continue;
             }
@@ -562,7 +562,7 @@ nm_vpn_wireguard_import(const char *filename, GError **error)
                     data_table = _TABLE_OFF;
                 else {
                     /* we don't support table names from /etc/iproute2/rt_tables
-					 * But we accept hex like `ip route add` would. */
+                     * But we accept hex like `ip route add` would. */
                     i64 = _nm_utils_ascii_str_to_int64(value, 0, 0, G_MAXINT32, -1);
                     if (i64 == -1)
                         goto fail_invalid_value;
@@ -581,7 +581,7 @@ nm_vpn_wireguard_import(const char *filename, GError **error)
 
             if (line_match(line, "SaveConfig", &matched_key, &value)) {
                 /* we ignore the setting, but enforce that it's either true or false (like
-				 * wg-quick. */
+                 * wg-quick. */
                 if (!NM_IN_STRSET(value, "true", "false"))
                     goto fail_invalid_value;
                 continue;
@@ -589,7 +589,7 @@ nm_vpn_wireguard_import(const char *filename, GError **error)
 
             if (line_match(line, "ListenPort", &matched_key, &value)) {
                 /* we don't use getaddrinfo(), unlike `wg setconf`. Just interpret
-				 * the port as plain decimal number. */
+                 * the port as plain decimal number. */
                 i64 = _nm_utils_ascii_str_to_int64(value, 10, 0, 0xFFFF, -1);
                 if (i64 == -1)
                     goto fail_invalid_value;
@@ -748,10 +748,10 @@ fail_invalid_secret:
 
         if (data_dns && !data_addr) {
             /* When specifying "DNS", we also require an "Address" for the same address
-			 * family. That is because a NMSettingIPConfig cannot have @method_disabled
-			 * and DNS settings at the same time.
-			 *
-			 * We don't have addresses. Silently ignore the DNS setting. */
+             * family. That is because a NMSettingIPConfig cannot have @method_disabled
+             * and DNS settings at the same time.
+             *
+             * We don't have addresses. Silently ignore the DNS setting. */
             data_dns         = NULL;
             data_dns_search2 = NULL;
         }
@@ -762,8 +762,8 @@ fail_invalid_secret:
                      NULL);
 
         /* For WireGuard profiles, always set dns-priority to a negative value,
-		 * so that DNS servers on other profiles get ignored. This is also what
-		 * wg-quick does, by calling `resolvconf -x`. */
+         * so that DNS servers on other profiles get ignored. This is also what
+         * wg-quick does, by calling `resolvconf -x`. */
         g_object_set(s_ip, NM_SETTING_IP_CONFIG_DNS_PRIORITY, (int) -50, NULL);
 
         if (data_addr) {
@@ -775,7 +775,7 @@ fail_invalid_secret:
                 nm_setting_ip_config_add_dns(s_ip, data_dns->pdata[i]);
 
             /* Of the wg-quick doesn't specify a search domain, assume the user
-			 * wants to use the domain server for all searches. */
+             * wants to use the domain server for all searches. */
             if (!data_dns_search2)
                 nm_setting_ip_config_add_dns_search(s_ip, "~");
         }
@@ -786,20 +786,20 @@ fail_invalid_secret:
 
         if (data_table == _TABLE_AUTO) {
             /* in the "auto" setting, wg-quick adds peer-routes automatically to the main
-			 * table. NetworkManager will do that too, but there are differences:
-			 *
-			 * - NetworkManager (contrary to wg-quick) does not check whether the peer-route is necessary.
-			 *   It will always add a route for each allowed-ips range, even if there is already another
-			 *   route that would ensure packets to the endpoint are routed via the WireGuard interface.
-			 *   If you don't want that, disable "wireguard.peer-routes", and add the necessary routes
-			 *   yourself to "ipv4.routes" and "ipv6.routes".
-			 *
-			 * - With "auto", wg-quick also configures policy routing to handle default-routes (/0) to
-			 *   avoid routing loops.
-			 *   The imported connection profile will have wireguard.ip4-auto-default-route and
-			 *   wireguard.ip6-auto-default-route set to "default". It will thus configure wg-quick's
-			 *   policy routing if the profile has any AllowedIPs ranges with /0.
-			 */
+             * table. NetworkManager will do that too, but there are differences:
+             *
+             * - NetworkManager (contrary to wg-quick) does not check whether the peer-route is necessary.
+             *   It will always add a route for each allowed-ips range, even if there is already another
+             *   route that would ensure packets to the endpoint are routed via the WireGuard interface.
+             *   If you don't want that, disable "wireguard.peer-routes", and add the necessary routes
+             *   yourself to "ipv4.routes" and "ipv6.routes".
+             *
+             * - With "auto", wg-quick also configures policy routing to handle default-routes (/0) to
+             *   avoid routing loops.
+             *   The imported connection profile will have wireguard.ip4-auto-default-route and
+             *   wireguard.ip6-auto-default-route set to "default". It will thus configure wg-quick's
+             *   policy routing if the profile has any AllowedIPs ranges with /0.
+             */
         } else if (data_table == _TABLE_OFF) {
             if (is_v4) {
                 g_object_set(s_wg, NM_SETTING_WIREGUARD_PEER_ROUTES, FALSE, NULL);
diff --git a/clients/tui/newt/nmt-newt-button.c b/clients/tui/newt/nmt-newt-button.c
index 402faf7bbf..88a1d7ecb8 100644
--- a/clients/tui/newt/nmt-newt-button.c
+++ b/clients/tui/newt/nmt-newt-button.c
@@ -203,11 +203,11 @@ nmt_newt_button_class_init(NmtNewtButtonClass *button_class)
     /* signals */
 
     /**
-	 * NmtNewtButton::clicked:
-	 * @button: the #NmtNewtButton
-	 *
-	 * Emitted when the button is clicked.
-	 */
+     * NmtNewtButton::clicked:
+     * @button: the #NmtNewtButton
+     *
+     * Emitted when the button is clicked.
+     */
     signals[CLICKED] = g_signal_new("clicked",
                                     G_OBJECT_CLASS_TYPE(object_class),
                                     G_SIGNAL_RUN_FIRST,
@@ -221,10 +221,10 @@ nmt_newt_button_class_init(NmtNewtButtonClass *button_class)
     /* properties */
 
     /**
-	 * NmtNewtButton:label:
-	 *
-	 * The button's label
-	 */
+     * NmtNewtButton:label:
+     *
+     * The button's label
+     */
     g_object_class_install_property(
         object_class,
         PROP_LABEL,
diff --git a/clients/tui/newt/nmt-newt-checkbox.c b/clients/tui/newt/nmt-newt-checkbox.c
index 9e67dbd2f5..1a1cdfa654 100644
--- a/clients/tui/newt/nmt-newt-checkbox.c
+++ b/clients/tui/newt/nmt-newt-checkbox.c
@@ -195,19 +195,19 @@ nmt_newt_checkbox_class_init(NmtNewtCheckboxClass *checkbox_class)
     component_class->build_component = nmt_newt_checkbox_build_component;
 
     /**
-	 * NmtNewtCheckbox:label:
-	 *
-	 * The checkbox's label
-	 */
+     * NmtNewtCheckbox:label:
+     *
+     * The checkbox's label
+     */
     g_object_class_install_property(
         object_class,
         PROP_LABEL,
         g_param_spec_string("label", "", "", NULL, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtCheckbox:active:
-	 *
-	 * The checkbox's checked state
-	 */
+     * NmtNewtCheckbox:active:
+     *
+     * The checkbox's checked state
+     */
     g_object_class_install_property(
         object_class,
         PROP_ACTIVE,
diff --git a/clients/tui/newt/nmt-newt-component.c b/clients/tui/newt/nmt-newt-component.c
index a7007e2c41..3f63ab864c 100644
--- a/clients/tui/newt/nmt-newt-component.c
+++ b/clients/tui/newt/nmt-newt-component.c
@@ -123,8 +123,8 @@ nmt_newt_component_size_allocate(NmtNewtWidget *widget, int x, int y, int width,
     newtGrid                 grid;
 
     /* You can't directly place a newtComponent, so we create a newtGrid,
-	 * position the component within that, and then place the grid.
-	 */
+     * position the component within that, and then place the grid.
+     */
     grid = newtCreateGrid(1, 1);
     newtGridSetField(grid,
                      0,
@@ -267,21 +267,21 @@ nmt_newt_component_class_init(NmtNewtComponentClass *component_class)
     /* properties */
 
     /**
-	 * NmtNewtComponent:component:
-	 *
-	 * The component's #newtComponent
-	 */
+     * NmtNewtComponent:component:
+     *
+     * The component's #newtComponent
+     */
     g_object_class_install_property(
         object_class,
         PROP_COMPONENT,
         g_param_spec_pointer("component", "", "", G_PARAM_READABLE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtComponent:sensitive:
-	 *
-	 * Whether the component is sensitive. Insensitive components will
-	 * be skipped over in the keyboard tab chain, and may be displayed
-	 * differently.
-	 */
+     * NmtNewtComponent:sensitive:
+     *
+     * Whether the component is sensitive. Insensitive components will
+     * be skipped over in the keyboard tab chain, and may be displayed
+     * differently.
+     */
     g_object_class_install_property(
         object_class,
         PROP_SENSITIVE,
diff --git a/clients/tui/newt/nmt-newt-entry-numeric.c b/clients/tui/newt/nmt-newt-entry-numeric.c
index 10d6490c7c..c6c5d0778d 100644
--- a/clients/tui/newt/nmt-newt-entry-numeric.c
+++ b/clients/tui/newt/nmt-newt-entry-numeric.c
@@ -196,12 +196,12 @@ nmt_newt_entry_numeric_class_init(NmtNewtEntryNumericClass *entry_class)
     object_class->get_property = nmt_newt_entry_numeric_get_property;
 
     /**
-	 * NmtNewtEntryNumeric:minimum:
-	 *
-	 * The minimum #NmtNewtWidget:valid value for the entry. If this
-	 * is non-negative, then the entry will not allow negative numbers
-	 * to be entered.
-	 */
+     * NmtNewtEntryNumeric:minimum:
+     *
+     * The minimum #NmtNewtWidget:valid value for the entry. If this
+     * is non-negative, then the entry will not allow negative numbers
+     * to be entered.
+     */
     g_object_class_install_property(
         object_class,
         PROP_MINIMUM,
@@ -213,10 +213,10 @@ nmt_newt_entry_numeric_class_init(NmtNewtEntryNumericClass *entry_class)
                            0,
                            G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtEntryNumeric:maximum:
-	 *
-	 * The maximum #NmtNewtWidget:valid value for the entry.
-	 */
+     * NmtNewtEntryNumeric:maximum:
+     *
+     * The maximum #NmtNewtWidget:valid value for the entry.
+     */
     g_object_class_install_property(
         object_class,
         PROP_MAXIMUM,
@@ -228,11 +228,11 @@ nmt_newt_entry_numeric_class_init(NmtNewtEntryNumericClass *entry_class)
                            G_MAXINT64,
                            G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtEntryNumeric:optional:
-	 *
-	 * If %TRUE, allow empty string to indicate some default value.
-	 * It means the property is optional and can be left at the default
-	 */
+     * NmtNewtEntryNumeric:optional:
+     *
+     * If %TRUE, allow empty string to indicate some default value.
+     * It means the property is optional and can be left at the default
+     */
     g_object_class_install_property(
         object_class,
         PROP_OPTIONAL,
diff --git a/clients/tui/newt/nmt-newt-entry.c b/clients/tui/newt/nmt-newt-entry.c
index 6fbc302134..5ab1f79273 100644
--- a/clients/tui/newt/nmt-newt-entry.c
+++ b/clients/tui/newt/nmt-newt-entry.c
@@ -457,28 +457,28 @@ nmt_newt_entry_class_init(NmtNewtEntryClass *entry_class)
     component_class->build_component = nmt_newt_entry_build_component;
 
     /**
-	 * NmtNewtEntry:text
-	 *
-	 * The entry's text
-	 */
+     * NmtNewtEntry:text
+     *
+     * The entry's text
+     */
     g_object_class_install_property(
         object_class,
         PROP_TEXT,
         g_param_spec_string("text", "", "", NULL, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtEntry:width
-	 *
-	 * The entry's width in characters
-	 */
+     * NmtNewtEntry:width
+     *
+     * The entry's width in characters
+     */
     g_object_class_install_property(
         object_class,
         PROP_WIDTH,
         g_param_spec_int("width", "", "", -1, 80, -1, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtEntry:flags
-	 *
-	 * The entry's #NmtNewtEntryFlags
-	 */
+     * NmtNewtEntry:flags
+     *
+     * The entry's #NmtNewtEntryFlags
+     */
     g_object_class_install_property(
         object_class,
         PROP_FLAGS,
@@ -490,11 +490,11 @@ nmt_newt_entry_class_init(NmtNewtEntryClass *entry_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtEntry:password
-	 *
-	 * %TRUE if #NmtNewtEntry:flags contains %NMT_NEWT_ENTRY_PASSWORD,
-	 * %FALSE if not.
-	 */
+     * NmtNewtEntry:password
+     *
+     * %TRUE if #NmtNewtEntry:flags contains %NMT_NEWT_ENTRY_PASSWORD,
+     * %FALSE if not.
+     */
     g_object_class_install_property(
         object_class,
         PROP_PASSWORD,
diff --git a/clients/tui/newt/nmt-newt-form.c b/clients/tui/newt/nmt-newt-form.c
index d9ad278bc9..76e03c5aa7 100644
--- a/clients/tui/newt/nmt-newt-form.c
+++ b/clients/tui/newt/nmt-newt-form.c
@@ -281,8 +281,8 @@ nmt_newt_form_iterate(NmtNewtForm *form)
 
     if (es.reason == NEWT_EXIT_COMPONENT) {
         /* The user hit Return/Space on a component; update the form focus
-		 * to point that component, and activate it.
-		 */
+         * to point that component, and activate it.
+         */
         focus = nmt_newt_widget_find_component(priv->content, es.u.co);
         if (focus) {
             nmt_newt_form_set_focus(form, focus);
@@ -572,11 +572,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
     /* signals */
 
     /**
-	 * NmtNewtForm::quit:
-	 * @form: the #NmtNewtForm
-	 *
-	 * Emitted when the form quits.
-	 */
+     * NmtNewtForm::quit:
+     * @form: the #NmtNewtForm
+     *
+     * Emitted when the form quits.
+     */
     signals[QUIT] = g_signal_new("quit",
                                  G_OBJECT_CLASS_TYPE(object_class),
                                  G_SIGNAL_RUN_FIRST,
@@ -588,11 +588,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                                  0);
 
     /**
-	 * NmtNewtForm:title:
-	 *
-	 * The form's title. If non-%NULL, this will be displayed above
-	 * the form in its border.
-	 */
+     * NmtNewtForm:title:
+     *
+     * The form's title. If non-%NULL, this will be displayed above
+     * the form in its border.
+     */
     g_object_class_install_property(
         object_class,
         PROP_TITLE,
@@ -602,11 +602,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                             NULL,
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:fullscreen:
-	 *
-	 * If %TRUE, the form will fill the entire "screen" (ie, terminal
-	 * window).
-	 */
+     * NmtNewtForm:fullscreen:
+     *
+     * If %TRUE, the form will fill the entire "screen" (ie, terminal
+     * window).
+     */
     g_object_class_install_property(
         object_class,
         PROP_FULLSCREEN,
@@ -616,11 +616,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                              FALSE,
                              G_PARAM_WRITABLE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:fullscreen-vertical:
-	 *
-	 * If %TRUE, the form will fill the entire "screen" (ie, terminal
-	 * window) vertically, but not necessarily horizontally.
-	 */
+     * NmtNewtForm:fullscreen-vertical:
+     *
+     * If %TRUE, the form will fill the entire "screen" (ie, terminal
+     * window) vertically, but not necessarily horizontally.
+     */
     g_object_class_install_property(
         object_class,
         PROP_FULLSCREEN_VERTICAL,
@@ -630,11 +630,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                              FALSE,
                              G_PARAM_WRITABLE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:fullscreen-horizontal:
-	 *
-	 * If %TRUE, the form will fill the entire "screen" (ie, terminal
-	 * window) horizontally, but not necessarily vertically.
-	 */
+     * NmtNewtForm:fullscreen-horizontal:
+     *
+     * If %TRUE, the form will fill the entire "screen" (ie, terminal
+     * window) horizontally, but not necessarily vertically.
+     */
     g_object_class_install_property(
         object_class,
         PROP_FULLSCREEN_HORIZONTAL,
@@ -644,11 +644,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                              FALSE,
                              G_PARAM_WRITABLE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:x:
-	 *
-	 * The form's x coordinate. By default, the form will be centered
-	 * on the screen.
-	 */
+     * NmtNewtForm:x:
+     *
+     * The form's x coordinate. By default, the form will be centered
+     * on the screen.
+     */
     g_object_class_install_property(
         object_class,
         PROP_X,
@@ -660,11 +660,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:y:
-	 *
-	 * The form's y coordinate. By default, the form will be centered
-	 * on the screen.
-	 */
+     * NmtNewtForm:y:
+     *
+     * The form's y coordinate. By default, the form will be centered
+     * on the screen.
+     */
     g_object_class_install_property(
         object_class,
         PROP_Y,
@@ -676,11 +676,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:width:
-	 *
-	 * The form's width. By default, this will be determined by the
-	 * width of the form's content.
-	 */
+     * NmtNewtForm:width:
+     *
+     * The form's width. By default, this will be determined by the
+     * width of the form's content.
+     */
     g_object_class_install_property(
         object_class,
         PROP_WIDTH,
@@ -692,11 +692,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:height:
-	 *
-	 * The form's height. By default, this will be determined by the
-	 * height of the form's content.
-	 */
+     * NmtNewtForm:height:
+     *
+     * The form's height. By default, this will be determined by the
+     * height of the form's content.
+     */
     g_object_class_install_property(
         object_class,
         PROP_HEIGHT,
@@ -708,10 +708,10 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:padding:
-	 *
-	 * The padding between the form's content and its border.
-	 */
+     * NmtNewtForm:padding:
+     *
+     * The padding between the form's content and its border.
+     */
     g_object_class_install_property(
         object_class,
         PROP_PADDING,
@@ -723,11 +723,11 @@ nmt_newt_form_class_init(NmtNewtFormClass *form_class)
                           1,
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS | G_PARAM_CONSTRUCT_ONLY));
     /**
-	 * NmtNewtForm:escape-exits:
-	 *
-	 * If %TRUE, then hitting the Escape key will cause the form to
-	 * exit.
-	 */
+     * NmtNewtForm:escape-exits:
+     *
+     * If %TRUE, then hitting the Escape key will cause the form to
+     * exit.
+     */
     g_object_class_install_property(
         object_class,
         PROP_ESCAPE_EXITS,
diff --git a/clients/tui/newt/nmt-newt-label.c b/clients/tui/newt/nmt-newt-label.c
index 08b31e9232..d31514f9db 100644
--- a/clients/tui/newt/nmt-newt-label.c
+++ b/clients/tui/newt/nmt-newt-label.c
@@ -265,19 +265,19 @@ nmt_newt_label_class_init(NmtNewtLabelClass *label_class)
     component_class->build_component = nmt_newt_label_build_component;
 
     /**
-	 * NmtNewtLabel:text:
-	 *
-	 * The label's text
-	 */
+     * NmtNewtLabel:text:
+     *
+     * The label's text
+     */
     g_object_class_install_property(
         object_class,
         PROP_TEXT,
         g_param_spec_string("text", "", "", NULL, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtLabel:style:
-	 *
-	 * The label's #NmtNewtLabelStyle
-	 */
+     * NmtNewtLabel:style:
+     *
+     * The label's #NmtNewtLabelStyle
+     */
     g_object_class_install_property(object_class,
                                     PROP_STYLE,
                                     g_param_spec_int("style",
@@ -288,10 +288,10 @@ nmt_newt_label_class_init(NmtNewtLabelClass *label_class)
                                                      0,
                                                      G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtLabel:highlight:
-	 *
-	 * Whether the label is highlighted.
-	 */
+     * NmtNewtLabel:highlight:
+     *
+     * Whether the label is highlighted.
+     */
     g_object_class_install_property(
         object_class,
         PROP_HIGHLIGHT,
diff --git a/clients/tui/newt/nmt-newt-listbox.c b/clients/tui/newt/nmt-newt-listbox.c
index 18da63d634..c6d51dab17 100644
--- a/clients/tui/newt/nmt-newt-listbox.c
+++ b/clients/tui/newt/nmt-newt-listbox.c
@@ -450,10 +450,10 @@ nmt_newt_listbox_class_init(NmtNewtListboxClass *listbox_class)
     /* properties */
 
     /**
-	 * NmtNewtListbox:height:
-	 *
-	 * The listbox's height, or -1 if it has no fixed height.
-	 */
+     * NmtNewtListbox:height:
+     *
+     * The listbox's height, or -1 if it has no fixed height.
+     */
     g_object_class_install_property(object_class,
                                     PROP_HEIGHT,
                                     g_param_spec_int("height",
@@ -464,10 +464,10 @@ nmt_newt_listbox_class_init(NmtNewtListboxClass *listbox_class)
                                                      -1,
                                                      G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtListbox:flags:
-	 *
-	 * The listbox's #NmtNewtListboxFlags.
-	 */
+     * NmtNewtListbox:flags:
+     *
+     * The listbox's #NmtNewtListboxFlags.
+     */
     g_object_class_install_property(
         object_class,
         PROP_FLAGS,
@@ -479,10 +479,10 @@ nmt_newt_listbox_class_init(NmtNewtListboxClass *listbox_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtListbox:active:
-	 *
-	 * The currently-selected row.
-	 */
+     * NmtNewtListbox:active:
+     *
+     * The currently-selected row.
+     */
     g_object_class_install_property(object_class,
                                     PROP_ACTIVE,
                                     g_param_spec_int("active",
@@ -493,20 +493,20 @@ nmt_newt_listbox_class_init(NmtNewtListboxClass *listbox_class)
                                                      0,
                                                      G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtListbox:active-key:
-	 *
-	 * The key of the currently-selected row.
-	 */
+     * NmtNewtListbox:active-key:
+     *
+     * The key of the currently-selected row.
+     */
     g_object_class_install_property(
         object_class,
         PROP_ACTIVE_KEY,
         g_param_spec_pointer("active-key", "", "", G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtListbox:skip-null-keys:
-	 *
-	 * If %TRUE, rows with %NULL key values will be skipped over when
-	 * navigating the list with the arrow keys.
-	 */
+     * NmtNewtListbox:skip-null-keys:
+     *
+     * If %TRUE, rows with %NULL key values will be skipped over when
+     * navigating the list with the arrow keys.
+     */
     g_object_class_install_property(
         object_class,
         PROP_SKIP_NULL_KEYS,
diff --git a/clients/tui/newt/nmt-newt-popup.c b/clients/tui/newt/nmt-newt-popup.c
index 1c1175fd2b..a388cbaf64 100644
--- a/clients/tui/newt/nmt-newt-popup.c
+++ b/clients/tui/newt/nmt-newt-popup.c
@@ -140,14 +140,14 @@ nmt_newt_popup_activated(NmtNewtWidget *widget)
                              &button_x,
                              &button_y);
     /* (window_x + button_x) is the screen X coordinate of the newtComponent. A
-	 * newtButton labelled "Foo" is rendered as " <Foo>" (with a preceding
-	 * space), so the "F" is at (window_x + button_x + 2). We've added 1 column
-	 * of padding to the left of the listbox, so we need to position the popup
-	 * at (window_x + button_x + 1) in order for its text to be aligned with the
-	 * button's text. (The x and y coordinates given to NmtNewtForm are the
-	 * coordinates of the top left of the window content, ignoring the border
-	 * graphics.)
-	 */
+     * newtButton labelled "Foo" is rendered as " <Foo>" (with a preceding
+     * space), so the "F" is at (window_x + button_x + 2). We've added 1 column
+     * of padding to the left of the listbox, so we need to position the popup
+     * at (window_x + button_x + 1) in order for its text to be aligned with the
+     * button's text. (The x and y coordinates given to NmtNewtForm are the
+     * coordinates of the top left of the window content, ignoring the border
+     * graphics.)
+     */
     window_x += button_x + 1;
     window_y += button_y - priv->active;
 
@@ -316,10 +316,10 @@ nmt_newt_popup_class_init(NmtNewtPopupClass *popup_class)
     component_class->build_component = nmt_newt_popup_build_component;
 
     /**
-	 * NmtNewtPopup:active:
-	 *
-	 * The index of the currently-active entry.
-	 */
+     * NmtNewtPopup:active:
+     *
+     * The index of the currently-active entry.
+     */
     g_object_class_install_property(object_class,
                                     PROP_ACTIVE,
                                     g_param_spec_uint("active",
@@ -330,10 +330,10 @@ nmt_newt_popup_class_init(NmtNewtPopupClass *popup_class)
                                                       0,
                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtPopup:active-id:
-	 *
-	 * The textual ID of the currently-active entry.
-	 */
+     * NmtNewtPopup:active-id:
+     *
+     * The textual ID of the currently-active entry.
+     */
     g_object_class_install_property(
         object_class,
         PROP_ACTIVE_ID,
diff --git a/clients/tui/newt/nmt-newt-section.c b/clients/tui/newt/nmt-newt-section.c
index 6f481a0679..2f5d870fd9 100644
--- a/clients/tui/newt/nmt-newt-section.c
+++ b/clients/tui/newt/nmt-newt-section.c
@@ -262,10 +262,10 @@ adjust_border_for_allocation(NmtNewtSectionPrivate *priv, int height)
     int i;
 
     /* We have to use a series of one-line labels rather than a multi-line
-	 * textbox, because newt will hide any component that's partially offscreen,
-	 * but we want the on-screen portion of the border to show even if part of
-	 * it is offscreen.
-	 */
+     * textbox, because newt will hide any component that's partially offscreen,
+     * but we want the on-screen portion of the border to show even if part of
+     * it is offscreen.
+     */
 
     if (height == 1) {
         nmt_newt_widget_set_visible(priv->border_closed_label, TRUE);
@@ -379,10 +379,10 @@ nmt_newt_section_class_init(NmtNewtSectionClass *section_class)
     /* properties */
 
     /**
-	 * NmtNewtSection:show-border:
-	 *
-	 * %TRUE if the section should show a border along the left side.
-	 */
+     * NmtNewtSection:show-border:
+     *
+     * %TRUE if the section should show a border along the left side.
+     */
     g_object_class_install_property(
         object_class,
         PROP_SHOW_BORDER,
@@ -393,11 +393,11 @@ nmt_newt_section_class_init(NmtNewtSectionClass *section_class)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NmtNewtSection:open:
-	 *
-	 * %TRUE if the section is open (ie, its body is visible), %FALSE
-	 * if not.
-	 */
+     * NmtNewtSection:open:
+     *
+     * %TRUE if the section is open (ie, its body is visible), %FALSE
+     * if not.
+     */
     g_object_class_install_property(
         object_class,
         PROP_OPEN,
diff --git a/clients/tui/newt/nmt-newt-stack.c b/clients/tui/newt/nmt-newt-stack.c
index 6f74976af9..2af2a9ddd6 100644
--- a/clients/tui/newt/nmt-newt-stack.c
+++ b/clients/tui/newt/nmt-newt-stack.c
@@ -97,9 +97,9 @@ nmt_newt_stack_size_request(NmtNewtWidget *widget, int *width, int *height)
     }
 
     /* We size-request all pages so that embedded NmtPageGrids will
-	 * participate in their size-grouping (so that switching pages
-	 * won't result in the column widths changing).
-	 */
+     * participate in their size-grouping (so that switching pages
+     * won't result in the column widths changing).
+     */
     for (i = 0; i < priv->children->len; i++) {
         nmt_newt_widget_size_request(priv->children->pdata[i], &child_width, &child_height);
         if (i == priv->active) {
@@ -312,10 +312,10 @@ nmt_newt_stack_class_init(NmtNewtStackClass *stack_class)
     container_class->child_validity_changed = nmt_newt_stack_child_validity_changed;
 
     /**
-	 * NmtNewtStack:active:
-	 *
-	 * The index of the active page
-	 */
+     * NmtNewtStack:active:
+     *
+     * The index of the active page
+     */
     g_object_class_install_property(object_class,
                                     PROP_ACTIVE,
                                     g_param_spec_uint("active",
@@ -326,10 +326,10 @@ nmt_newt_stack_class_init(NmtNewtStackClass *stack_class)
                                                       0,
                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtStack:active-id:
-	 *
-	 * The ID of the active page
-	 */
+     * NmtNewtStack:active-id:
+     *
+     * The ID of the active page
+     */
     g_object_class_install_property(
         object_class,
         PROP_ACTIVE_ID,
diff --git a/clients/tui/newt/nmt-newt-textbox.c b/clients/tui/newt/nmt-newt-textbox.c
index b5de5dc1d7..591f399a81 100644
--- a/clients/tui/newt/nmt-newt-textbox.c
+++ b/clients/tui/newt/nmt-newt-textbox.c
@@ -237,19 +237,19 @@ nmt_newt_textbox_class_init(NmtNewtTextboxClass *textbox_class)
     component_class->build_component = nmt_newt_textbox_build_component;
 
     /**
-	 * NmtNewtTextbox:text:
-	 *
-	 * The textbox's text
-	 */
+     * NmtNewtTextbox:text:
+     *
+     * The textbox's text
+     */
     g_object_class_install_property(
         object_class,
         PROP_TEXT,
         g_param_spec_string("text", "", "", "", G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtTextbox:flags:
-	 *
-	 * The textbox's flags
-	 */
+     * NmtNewtTextbox:flags:
+     *
+     * The textbox's flags
+     */
     g_object_class_install_property(
         object_class,
         PROP_FLAGS,
@@ -261,11 +261,11 @@ nmt_newt_textbox_class_init(NmtNewtTextboxClass *textbox_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtTextbox:wrap-width:
-	 *
-	 * The width in characters at which the textbox's text
-	 * will wrap, or 0 if it does not wrap.
-	 */
+     * NmtNewtTextbox:wrap-width:
+     *
+     * The width in characters at which the textbox's text
+     * will wrap, or 0 if it does not wrap.
+     */
     g_object_class_install_property(
         object_class,
         PROP_WRAP_WIDTH,
diff --git a/clients/tui/newt/nmt-newt-toggle-button.c b/clients/tui/newt/nmt-newt-toggle-button.c
index 60fdd98414..adeb69bc76 100644
--- a/clients/tui/newt/nmt-newt-toggle-button.c
+++ b/clients/tui/newt/nmt-newt-toggle-button.c
@@ -185,28 +185,28 @@ nmt_newt_toggle_button_class_init(NmtNewtToggleButtonClass *button_class)
     widget_class->activated = nmt_newt_toggle_button_activated;
 
     /**
-	 * NmtNewtToggleButton:on-label:
-	 *
-	 * The label the button displays when it is "on".
-	 */
+     * NmtNewtToggleButton:on-label:
+     *
+     * The label the button displays when it is "on".
+     */
     g_object_class_install_property(
         object_class,
         PROP_ON_LABEL,
         g_param_spec_string("on-label", "", "", NULL, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtToggleButton:off-label:
-	 *
-	 * The label the button displays when it is "off".
-	 */
+     * NmtNewtToggleButton:off-label:
+     *
+     * The label the button displays when it is "off".
+     */
     g_object_class_install_property(
         object_class,
         PROP_OFF_LABEL,
         g_param_spec_string("off-label", "", "", NULL, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtToggleButton:active:
-	 *
-	 * Whether the button is currently "on" (%TRUE) or "off" (%FALSE)
-	 */
+     * NmtNewtToggleButton:active:
+     *
+     * Whether the button is currently "on" (%TRUE) or "off" (%FALSE)
+     */
     g_object_class_install_property(
         object_class,
         PROP_ACTIVE,
diff --git a/clients/tui/newt/nmt-newt-utils.c b/clients/tui/newt/nmt-newt-utils.c
index 9c6bb9b4e3..6a67638455 100644
--- a/clients/tui/newt/nmt-newt-utils.c
+++ b/clients/tui/newt/nmt-newt-utils.c
@@ -58,9 +58,9 @@ nmt_newt_dialog_g_log_handler(const char *   log_domain,
                                    message);
 
     /* newtWinMessage() wraps the window too narrowly by default, so
-	 * we don't want to use that. But we intentionally avoid using any
-	 * NmtNewt classes, to avoid possible error recursion.
-	 */
+     * we don't want to use that. But we intentionally avoid using any
+     * NmtNewt classes, to avoid possible error recursion.
+     */
 
     newtGetScreenSize(&screen_width, &screen_height);
     text = newtTextboxReflowed(-1, -1, full_message, MAX(70, screen_width - 10), 0, 0, 0);
diff --git a/clients/tui/newt/nmt-newt-widget.c b/clients/tui/newt/nmt-newt-widget.c
index 1a5ac0ff24..bbce69704d 100644
--- a/clients/tui/newt/nmt-newt-widget.c
+++ b/clients/tui/newt/nmt-newt-widget.c
@@ -557,13 +557,13 @@ nmt_newt_widget_class_init(NmtNewtWidgetClass *widget_class)
     /* signals */
 
     /**
-	 * NmtNewtWidget::needs-rebuild:
-	 * @widget: the #NmtNewtWidget
-	 *
-	 * Emitted when nmt_newt_widget_need_rebuild() is called on @widget
-	 * or any of its children. This signal propagates up the container
-	 * hierarchy, eventually reaching the top-level #NmtNewtForm.
-	 */
+     * NmtNewtWidget::needs-rebuild:
+     * @widget: the #NmtNewtWidget
+     *
+     * Emitted when nmt_newt_widget_need_rebuild() is called on @widget
+     * or any of its children. This signal propagates up the container
+     * hierarchy, eventually reaching the top-level #NmtNewtForm.
+     */
     signals[NEEDS_REBUILD] = g_signal_new("needs-rebuild",
                                           G_OBJECT_CLASS_TYPE(object_class),
                                           G_SIGNAL_RUN_FIRST,
@@ -575,11 +575,11 @@ nmt_newt_widget_class_init(NmtNewtWidgetClass *widget_class)
                                           0);
 
     /**
-	 * NmtNewtWidget::activated:
-	 * @widget: the #NmtNewtWidget
-	 *
-	 * Emitted when the widget's #newtComponent is activated.
-	 */
+     * NmtNewtWidget::activated:
+     * @widget: the #NmtNewtWidget
+     *
+     * Emitted when the widget's #newtComponent is activated.
+     */
     signals[ACTIVATED] = g_signal_new("activated",
                                       G_OBJECT_CLASS_TYPE(object_class),
                                       G_SIGNAL_RUN_FIRST,
@@ -593,10 +593,10 @@ nmt_newt_widget_class_init(NmtNewtWidgetClass *widget_class)
     /* properties */
 
     /**
-	 * NmtNewtWidget:parent:
-	 *
-	 * The widget's parent widget, or %NULL if it has no parent.
-	 */
+     * NmtNewtWidget:parent:
+     *
+     * The widget's parent widget, or %NULL if it has no parent.
+     */
     g_object_class_install_property(object_class,
                                     PROP_PARENT,
                                     g_param_spec_object("parent",
@@ -605,32 +605,32 @@ nmt_newt_widget_class_init(NmtNewtWidgetClass *widget_class)
                                                         NMT_TYPE_NEWT_WIDGET,
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtWidget:visible:
-	 *
-	 * Whether the widget is visible. Invisible widgets do not get
-	 * realized or sized.
-	 */
+     * NmtNewtWidget:visible:
+     *
+     * Whether the widget is visible. Invisible widgets do not get
+     * realized or sized.
+     */
     g_object_class_install_property(
         object_class,
         PROP_VISIBLE,
         g_param_spec_boolean("visible", "", "", TRUE, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtWidget:valid:
-	 *
-	 * Whether the widget's content is considered valid. Components
-	 * determine their own validity. A container, by default, is
-	 * considered valid if all of its children are valid.
-	 */
+     * NmtNewtWidget:valid:
+     *
+     * Whether the widget's content is considered valid. Components
+     * determine their own validity. A container, by default, is
+     * considered valid if all of its children are valid.
+     */
     g_object_class_install_property(
         object_class,
         PROP_VALID,
         g_param_spec_boolean("valid", "", "", TRUE, G_PARAM_READABLE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtNewtWidget:exit-on-activate:
-	 *
-	 * If %TRUE, the widget will call nmt_newt_form_quit() on its form
-	 * when it is activated.
-	 */
+     * NmtNewtWidget:exit-on-activate:
+     *
+     * If %TRUE, the widget will call nmt_newt_form_quit() on its form
+     * when it is activated.
+     */
     g_object_class_install_property(
         object_class,
         PROP_EXIT_ON_ACTIVATE,
diff --git a/clients/tui/nm-editor-bindings.c b/clients/tui/nm-editor-bindings.c
index 442d0355f9..c8863c90b9 100644
--- a/clients/tui/nm-editor-bindings.c
+++ b/clients/tui/nm-editor-bindings.c
@@ -1069,8 +1069,8 @@ vlan_settings_changed(GObject *object, GParamSpec *pspec, gpointer user_data)
         return;
 
     /* If the id in INTERFACE_NAME changed, and ID is either unset, or was previously
-	 * in sync with INTERFACE_NAME, then update ID.
-	 */
+     * in sync with INTERFACE_NAME, then update ID.
+     */
     if (id != ifname_id && (id == binding->last_ifname_id || id == 0)) {
         binding->updating = TRUE;
         g_object_set(G_OBJECT(binding->s_vlan), NM_SETTING_VLAN_ID, ifname_id, NULL);
@@ -1078,8 +1078,8 @@ vlan_settings_changed(GObject *object, GParamSpec *pspec, gpointer user_data)
     }
 
     /* If the PARENT in INTERFACE_NAME changed, and PARENT is either unset, or was
-	 * previously in sync with INTERFACE_NAME, then update PARENT.
-	 */
+     * previously in sync with INTERFACE_NAME, then update PARENT.
+     */
     if (g_strcmp0(parent, ifname_parent) != 0
         && (g_strcmp0(parent, binding->last_ifname_parent) == 0 || !parent || !*parent)) {
         binding->updating = TRUE;
diff --git a/clients/tui/nmt-address-list.c b/clients/tui/nmt-address-list.c
index f859b7ef7f..c62871c05f 100644
--- a/clients/tui/nmt-address-list.c
+++ b/clients/tui/nmt-address-list.c
@@ -237,10 +237,10 @@ nmt_address_list_class_init(NmtAddressListClass *list_class)
     widget_list_class->remove_clicked = nmt_address_list_remove_clicked;
 
     /**
-	 * NmtAddressList:list-type:
-	 *
-	 * The type of address the list holds.
-	 */
+     * NmtAddressList:list-type:
+     *
+     * The type of address the list holds.
+     */
     g_object_class_install_property(
         object_class,
         PROP_LIST_TYPE,
@@ -252,10 +252,10 @@ nmt_address_list_class_init(NmtAddressListClass *list_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtAddressList:strings:
-	 *
-	 * The strings in the list's entries.
-	 */
+     * NmtAddressList:strings:
+     *
+     * The strings in the list's entries.
+     */
     g_object_class_install_property(object_class,
                                     PROP_STRINGS,
                                     g_param_spec_boxed("strings",
diff --git a/clients/tui/nmt-connect-connection-list.c b/clients/tui/nmt-connect-connection-list.c
index f651c7cfc5..ae346d733a 100644
--- a/clients/tui/nmt-connect-connection-list.c
+++ b/clients/tui/nmt-connect-connection-list.c
@@ -157,8 +157,8 @@ sort_connections(gconstpointer a, gconstpointer b)
     }
 
     /* If one is an NMConnection and the other is an NMAccessPoint, the
-	 * connection comes first.
-	 */
+     * connection comes first.
+     */
     if (nmta->conn)
         return -1;
     else if (nmtb->conn)
diff --git a/clients/tui/nmt-device-entry.c b/clients/tui/nmt-device-entry.c
index 04a2bb4f3e..399f1a623b 100644
--- a/clients/tui/nmt-device-entry.c
+++ b/clients/tui/nmt-device-entry.c
@@ -491,10 +491,10 @@ nmt_device_entry_class_init(NmtDeviceEntryClass *deventry_class)
     object_class->finalize     = nmt_device_entry_finalize;
 
     /**
-	 * NmtDeviceEntry:label:
-	 *
-	 * The entry's label
-	 */
+     * NmtDeviceEntry:label:
+     *
+     * The entry's label
+     */
     g_object_class_install_property(
         object_class,
         PROP_LABEL,
@@ -504,21 +504,21 @@ nmt_device_entry_class_init(NmtDeviceEntryClass *deventry_class)
                             NULL,
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtDeviceEntry:width:
-	 *
-	 * The entry's width in characters
-	 */
+     * NmtDeviceEntry:width:
+     *
+     * The entry's width in characters
+     */
     g_object_class_install_property(
         object_class,
         PROP_WIDTH,
         g_param_spec_int("width", "", "", -1, 80, -1, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtDeviceEntry:hardware-type:
-	 *
-	 * The type of #NMDevice to limit the entry to, or %G_TYPE_NONE
-	 * if the entry is for a virtual device and should not accept
-	 * hardware addresses.
-	 */
+     * NmtDeviceEntry:hardware-type:
+     *
+     * The type of #NMDevice to limit the entry to, or %G_TYPE_NONE
+     * if the entry is for a virtual device and should not accept
+     * hardware addresses.
+     */
     g_object_class_install_property(object_class,
                                     PROP_HARDWARE_TYPE,
                                     g_param_spec_gtype("hardware-type",
@@ -527,10 +527,10 @@ nmt_device_entry_class_init(NmtDeviceEntryClass *deventry_class)
                                                        G_TYPE_NONE,
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtDeviceEntry:interface-name:
-	 *
-	 * The interface name of the device identified by the entry.
-	 */
+     * NmtDeviceEntry:interface-name:
+     *
+     * The interface name of the device identified by the entry.
+     */
     g_object_class_install_property(
         object_class,
         PROP_INTERFACE_NAME,
@@ -540,10 +540,10 @@ nmt_device_entry_class_init(NmtDeviceEntryClass *deventry_class)
                             NULL,
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtDeviceEntry:mac-address:
-	 *
-	 * The hardware address of the device identified by the entry.
-	 */
+     * NmtDeviceEntry:mac-address:
+     *
+     * The hardware address of the device identified by the entry.
+     */
     g_object_class_install_property(
         object_class,
         PROP_MAC_ADDRESS,
diff --git a/clients/tui/nmt-edit-connection-list.c b/clients/tui/nmt-edit-connection-list.c
index c51f80cff2..fb5cc8078e 100644
--- a/clients/tui/nmt-edit-connection-list.c
+++ b/clients/tui/nmt-edit-connection-list.c
@@ -428,11 +428,11 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
     /* signals */
 
     /**
-	 * NmtEditConnectionList::add-connection:
-	 * @list: the #NmtEditConnectionList
-	 *
-	 * Emitted when the user clicks the list's "Add" button.
-	 */
+     * NmtEditConnectionList::add-connection:
+     * @list: the #NmtEditConnectionList
+     *
+     * Emitted when the user clicks the list's "Add" button.
+     */
     signals[ADD_CONNECTION] =
         g_signal_new("add-connection",
                      G_OBJECT_CLASS_TYPE(object_class),
@@ -445,13 +445,13 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
                      0);
 
     /**
-	 * NmtEditConnectionList::edit-connection:
-	 * @list: the #NmtEditConnectionList
-	 * @connection: the connection to edit
-	 *
-	 * Emitted when the user clicks the list's "Edit" button, or
-	 * hits "Return" on the listbox.
-	 */
+     * NmtEditConnectionList::edit-connection:
+     * @list: the #NmtEditConnectionList
+     * @connection: the connection to edit
+     *
+     * Emitted when the user clicks the list's "Edit" button, or
+     * hits "Return" on the listbox.
+     */
     signals[EDIT_CONNECTION] =
         g_signal_new("edit-connection",
                      G_OBJECT_CLASS_TYPE(object_class),
@@ -465,12 +465,12 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
                      NM_TYPE_CONNECTION);
 
     /**
-	 * NmtEditConnectionList::remove-connection:
-	 * @list: the #NmtEditConnectionList
-	 * @connection: the connection to remove
-	 *
-	 * Emitted when the user clicks the list's "Delete" button.
-	 */
+     * NmtEditConnectionList::remove-connection:
+     * @list: the #NmtEditConnectionList
+     * @connection: the connection to remove
+     *
+     * Emitted when the user clicks the list's "Delete" button.
+     */
     signals[REMOVE_CONNECTION] =
         g_signal_new("remove-connection",
                      G_OBJECT_CLASS_TYPE(object_class),
@@ -486,12 +486,12 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
     /* properties */
 
     /**
-	 * NmtEditConnectionList:grouped:
-	 *
-	 * If %TRUE, connections should be grouped by type, with headers
-	 * indicating the types (as in the main connection list). If %FALSE,
-	 * they will not be grouped (as in slave connection lists).
-	 */
+     * NmtEditConnectionList:grouped:
+     *
+     * If %TRUE, connections should be grouped by type, with headers
+     * indicating the types (as in the main connection list). If %FALSE,
+     * they will not be grouped (as in slave connection lists).
+     */
     g_object_class_install_property(
         object_class,
         PROP_GROUPED,
@@ -502,21 +502,21 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
                              G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NmtEditConnectionListFilter:
-	 * @list: the #NmtEditConnectionList
-	 * @connection: an #NMConnection
-	 * @user_data: the user data
-	 *
-	 * Decides whether @connection should be displayed in @list.
-	 *
-	 * Returns: %TRUE or %FALSE
-	 */
+     * NmtEditConnectionListFilter:
+     * @list: the #NmtEditConnectionList
+     * @connection: an #NMConnection
+     * @user_data: the user data
+     *
+     * Decides whether @connection should be displayed in @list.
+     *
+     * Returns: %TRUE or %FALSE
+     */
     /**
-	 * NmtEditConnectionList:connection-filter:
-	 *
-	 * A callback function for filtering which connections appear in
-	 * the list.
-	 */
+     * NmtEditConnectionList:connection-filter:
+     *
+     * A callback function for filtering which connections appear in
+     * the list.
+     */
     g_object_class_install_property(
         object_class,
         PROP_CONNECTION_FILTER,
@@ -525,10 +525,10 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
                              "",
                              G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtEditConnectionList:connection-filter-data:
-	 *
-	 * Data for the #NmtEditConnectionList:connection-filter.
-	 */
+     * NmtEditConnectionList:connection-filter-data:
+     *
+     * Data for the #NmtEditConnectionList:connection-filter.
+     */
     g_object_class_install_property(
         object_class,
         PROP_CONNECTION_FILTER_DATA,
@@ -538,11 +538,11 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
                              G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NmtEditConnectionList:extra-widget:
-	 *
-	 * An extra button widget to display at the bottom of the button
-	 * box.
-	 */
+     * NmtEditConnectionList:extra-widget:
+     *
+     * An extra button widget to display at the bottom of the button
+     * box.
+     */
     g_object_class_install_property(
         object_class,
         PROP_EXTRA_WIDGET,
@@ -553,12 +553,12 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NmtEditConnectionList:connections:
-	 *
-	 * The list of connections in the widget.
-	 *
-	 * Element-Type: #NMConnection
-	 */
+     * NmtEditConnectionList:connections:
+     *
+     * The list of connections in the widget.
+     *
+     * Element-Type: #NMConnection
+     */
     g_object_class_install_property(object_class,
                                     PROP_CONNECTIONS,
                                     g_param_spec_boxed("connections",
@@ -568,10 +568,10 @@ nmt_edit_connection_list_class_init(NmtEditConnectionListClass *list_class)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NmtEditConnectionList:num-connections:
-	 *
-	 * The number of connections in the widget.
-	 */
+     * NmtEditConnectionList:num-connections:
+     *
+     * The number of connections in the widget.
+     */
     g_object_class_install_property(object_class,
                                     PROP_NUM_CONNECTIONS,
                                     g_param_spec_int("num-connections",
diff --git a/clients/tui/nmt-editor-page.c b/clients/tui/nmt-editor-page.c
index dec56ba04e..51b9da66f3 100644
--- a/clients/tui/nmt-editor-page.c
+++ b/clients/tui/nmt-editor-page.c
@@ -160,10 +160,10 @@ nmt_editor_page_class_init(NmtEditorPageClass *page_class)
     /* properties */
 
     /**
-	 * NmtEditorPage:connection:
-	 *
-	 * The page's #NMConnection.
-	 */
+     * NmtEditorPage:connection:
+     *
+     * The page's #NMConnection.
+     */
     g_object_class_install_property(
         object_class,
         PROP_CONNECTION,
diff --git a/clients/tui/nmt-editor-section.c b/clients/tui/nmt-editor-section.c
index 4fbdd16ec7..73fc24dfd4 100644
--- a/clients/tui/nmt-editor-section.c
+++ b/clients/tui/nmt-editor-section.c
@@ -68,8 +68,8 @@ rebuild_header(NmtEditorSection *section)
     NmtEditorSectionPrivate *priv = NMT_EDITOR_SECTION_GET_PRIVATE(section);
 
     /* Removing any widget in an NmtEditorGrid removes its whole row, so we can
-	 * remove the existing title/widget/toggle by asking to remove toggle.
-	 */
+     * remove the existing title/widget/toggle by asking to remove toggle.
+     */
     nmt_newt_container_remove(NMT_NEWT_CONTAINER(priv->header), priv->toggle);
 
     nmt_editor_grid_append(priv->header, priv->title, priv->header_widget, priv->toggle);
@@ -222,10 +222,10 @@ nmt_editor_section_class_init(NmtEditorSectionClass *section_class)
     /* properties */
 
     /**
-	 * NmtEditorSection:title:
-	 *
-	 * The section's title.
-	 */
+     * NmtEditorSection:title:
+     *
+     * The section's title.
+     */
     g_object_class_install_property(
         object_class,
         PROP_TITLE,
@@ -236,10 +236,10 @@ nmt_editor_section_class_init(NmtEditorSectionClass *section_class)
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NmtEditorSection:show-by-default:
-	 *
-	 * Whether the section should be expanded by default.
-	 */
+     * NmtEditorSection:show-by-default:
+     *
+     * Whether the section should be expanded by default.
+     */
     g_object_class_install_property(
         object_class,
         PROP_SHOW_BY_DEFAULT,
@@ -250,11 +250,11 @@ nmt_editor_section_class_init(NmtEditorSectionClass *section_class)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NmtEditorSection:header-widget:
-	 *
-	 * The widget (if any) that appears between the section title and its toggle
-	 * button.
-	 */
+     * NmtEditorSection:header-widget:
+     *
+     * The widget (if any) that appears between the section title and its toggle
+     * button.
+     */
     g_object_class_install_property(
         object_class,
         PROP_HEADER_WIDGET,
diff --git a/clients/tui/nmt-editor.c b/clients/tui/nmt-editor.c
index be68e6c5b6..d94adfa112 100644
--- a/clients/tui/nmt-editor.c
+++ b/clients/tui/nmt-editor.c
@@ -166,8 +166,8 @@ save_connection_and_exit(NmtNewtButton *button, gpointer user_data)
         }
 
         /* Clear secrets so they don't lay around in memory; they'll get
-		 * requested again anyway next time the connection is edited.
-		 */
+         * requested again anyway next time the connection is edited.
+         */
         nm_connection_clear_secrets(priv->orig_connection);
     } else {
         nm_client_add_connection_async(nm_client,
@@ -334,8 +334,8 @@ nmt_editor_constructed(GObject *object)
         hardware_type = priv->type_data->device_type;
 
     /* For connections involving multiple network devices, clarify which one
-	 * NMSettingConnection:interface-name refers to.
-	 */
+     * NMSettingConnection:interface-name refers to.
+     */
     if (nm_connection_is_type(priv->edit_connection, NM_SETTING_PPPOE_SETTING_NAME))
         deventry_label = _("Ethernet device");
     else
@@ -507,10 +507,10 @@ nmt_editor_class_init(NmtEditorClass *entry_class)
     object_class->finalize     = nmt_editor_finalize;
 
     /**
-	 * NmtEditor:connection:
-	 *
-	 * The connection being edited.
-	 */
+     * NmtEditor:connection:
+     *
+     * The connection being edited.
+     */
     g_object_class_install_property(
         object_class,
         PROP_CONNECTION,
@@ -520,10 +520,10 @@ nmt_editor_class_init(NmtEditorClass *entry_class)
                             NM_TYPE_CONNECTION,
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtEditor:type-data:
-	 *
-	 * The #NmEditorConnectionTypeData for #NmtEditor:connection.
-	 */
+     * NmtEditor:type-data:
+     *
+     * The #NmEditorConnectionTypeData for #NmtEditor:connection.
+     */
     g_object_class_install_property(
         object_class,
         PROP_TYPE_DATA,
diff --git a/clients/tui/nmt-ip-entry.c b/clients/tui/nmt-ip-entry.c
index c22775bc7e..9173ad2a70 100644
--- a/clients/tui/nmt-ip-entry.c
+++ b/clients/tui/nmt-ip-entry.c
@@ -175,10 +175,10 @@ nmt_ip_entry_class_init(NmtIPEntryClass *entry_class)
     object_class->get_property = nmt_ip_entry_get_property;
 
     /**
-	 * NmtIPEntry:family:
-	 *
-	 * The address family. Eg, %AF_INET
-	 */
+     * NmtIPEntry:family:
+     *
+     * The address family. Eg, %AF_INET
+     */
     g_object_class_install_property(
         object_class,
         PROP_FAMILY,
@@ -190,11 +190,11 @@ nmt_ip_entry_class_init(NmtIPEntryClass *entry_class)
                          0,
                          G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtIPEntry:prefix:
-	 *
-	 * If %TRUE, the entry accepts address/prefix combinations. If
-	 * %FALSE it accepts just addresses.
-	 */
+     * NmtIPEntry:prefix:
+     *
+     * If %TRUE, the entry accepts address/prefix combinations. If
+     * %FALSE it accepts just addresses.
+     */
     g_object_class_install_property(
         object_class,
         PROP_PREFIX,
@@ -204,12 +204,12 @@ nmt_ip_entry_class_init(NmtIPEntryClass *entry_class)
                              FALSE,
                              G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtIPEntry:optional:
-	 *
-	 * If %TRUE, the entry will be #NmtNewtWidget:valid when it is
-	 * empty. If %FALSE, it will only be valid when it contains a
-	 * valid address or address/prefix.
-	 */
+     * NmtIPEntry:optional:
+     *
+     * If %TRUE, the entry will be #NmtNewtWidget:valid when it is
+     * empty. If %FALSE, it will only be valid when it contains a
+     * valid address or address/prefix.
+     */
     g_object_class_install_property(
         object_class,
         PROP_OPTIONAL,
diff --git a/clients/tui/nmt-mac-entry.c b/clients/tui/nmt-mac-entry.c
index 5101c326da..77804f319d 100644
--- a/clients/tui/nmt-mac-entry.c
+++ b/clients/tui/nmt-mac-entry.c
@@ -110,8 +110,8 @@ mac_validator(NmtNewtEntry *entry, const char *text, gpointer user_data)
         g_free(fixed);
 
         /* FIXME: NmtNewtEntry doesn't correctly deal with us calling set_text()
-		 * from inside the validator.
-		 */
+         * from inside the validator.
+         */
         nmt_newt_widget_needs_rebuild(NMT_NEWT_WIDGET(entry));
     }
 
@@ -193,11 +193,11 @@ nmt_mac_entry_class_init(NmtMacEntryClass *entry_class)
     object_class->get_property = nmt_mac_entry_get_property;
 
     /**
-	 * NmtMacEntry:mac-length:
-	 *
-	 * The length in bytes of the hardware address type the entry
-	 * accepts: either %ETH_ALEN or %INFINIBAND_ALEN.
-	 */
+     * NmtMacEntry:mac-length:
+     *
+     * The length in bytes of the hardware address type the entry
+     * accepts: either %ETH_ALEN or %INFINIBAND_ALEN.
+     */
     g_object_class_install_property(object_class,
                                     PROP_MAC_LENGTH,
                                     g_param_spec_int("mac-length",
@@ -208,11 +208,11 @@ nmt_mac_entry_class_init(NmtMacEntryClass *entry_class)
                                                      ETH_ALEN,
                                                      G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtMacEntry:mac-address:
-	 *
-	 * The MAC address, as a string (as with the various #NMSetting
-	 * "mac-address" properties).
-	 */
+     * NmtMacEntry:mac-address:
+     *
+     * The MAC address, as a string (as with the various #NMSetting
+     * "mac-address" properties).
+     */
     g_object_class_install_property(
         object_class,
         PROP_MAC_ADDRESS,
@@ -222,11 +222,11 @@ nmt_mac_entry_class_init(NmtMacEntryClass *entry_class)
                             NULL,
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtMacEntry:entry-type:
-	 *
-	 * The type of the #NmtMacEntry. Can be either used for plain
-	 * MAC addresses or for the extended format for cloned MAC addresses.
-	 */
+     * NmtMacEntry:entry-type:
+     *
+     * The type of the #NmtMacEntry. Can be either used for plain
+     * MAC addresses or for the extended format for cloned MAC addresses.
+     */
     g_object_class_install_property(
         object_class,
         PROP_ENTRY_TYPE,
diff --git a/clients/tui/nmt-mtu-entry.c b/clients/tui/nmt-mtu-entry.c
index 7b5c304590..980b4c88d8 100644
--- a/clients/tui/nmt-mtu-entry.c
+++ b/clients/tui/nmt-mtu-entry.c
@@ -160,10 +160,10 @@ nmt_mtu_entry_class_init(NmtMtuEntryClass *entry_class)
     object_class->get_property = nmt_mtu_entry_get_property;
 
     /**
-	 * NmtMtuEntry:mtu:
-	 *
-	 * The contents of the entry, as a number.
-	 */
+     * NmtMtuEntry:mtu:
+     *
+     * The contents of the entry, as a number.
+     */
     g_object_class_install_property(object_class,
                                     PROP_MTU,
                                     g_param_spec_int("mtu",
diff --git a/clients/tui/nmt-page-bond.c b/clients/tui/nmt-page-bond.c
index d732b58ba8..553b9943e9 100644
--- a/clients/tui/nmt-page-bond.c
+++ b/clients/tui/nmt-page-bond.c
@@ -36,8 +36,8 @@ typedef struct {
     NmtSlaveList *slaves;
 
     /* Note: when adding new options to the UI also ensure they are
-	 * initialized in bond_connection_setup_func()
-	 */
+     * initialized in bond_connection_setup_func()
+     */
     NmtNewtPopup *  mode;
     NmtNewtEntry *  primary;
     NmtNewtPopup *  monitoring;
diff --git a/clients/tui/nmt-page-wifi.c b/clients/tui/nmt-page-wifi.c
index 279fd80f10..866c045ea3 100644
--- a/clients/tui/nmt-page-wifi.c
+++ b/clients/tui/nmt-page-wifi.c
@@ -172,9 +172,9 @@ nmt_page_wifi_constructed(GObject *object)
     s_wsec = nm_connection_get_setting_wireless_security(conn);
     if (!s_wsec) {
         /* It makes things simpler if we always have a
-		 * NMSettingWirelessSecurity; we'll hold a ref on one, and add
-		 * it to and remove it from the connection as needed.
-		 */
+         * NMSettingWirelessSecurity; we'll hold a ref on one, and add
+         * it to and remove it from the connection as needed.
+         */
         s_wsec = NM_SETTING_WIRELESS_SECURITY(nm_setting_wireless_security_new());
     }
     priv->s_wsec = g_object_ref_sink(s_wsec);
diff --git a/clients/tui/nmt-password-dialog.c b/clients/tui/nmt-password-dialog.c
index 2704312429..fb2cf7d712 100644
--- a/clients/tui/nmt-password-dialog.c
+++ b/clients/tui/nmt-password-dialog.c
@@ -91,8 +91,8 @@ maybe_save_input_and_exit(NmtNewtWidget *widget, gpointer dialog)
     int                       i;
 
     /* This gets invoked when the user types Return in the final entry,
-	 * but the form may not be fully valid in that case.
-	 */
+     * but the form may not be fully valid in that case.
+     */
     if (!nmt_newt_widget_get_valid(priv->secret_grid))
         return;
 
@@ -245,10 +245,10 @@ nmt_password_dialog_class_init(NmtPasswordDialogClass *dialog_class)
     object_class->finalize     = nmt_password_dialog_finalize;
 
     /**
-	 * NmtPasswordDialog:request-id:
-	 *
-	 * The request ID from the #NMSecretAgentSimple
-	 */
+     * NmtPasswordDialog:request-id:
+     *
+     * The request ID from the #NMSecretAgentSimple
+     */
     g_object_class_install_property(
         object_class,
         PROP_REQUEST_ID,
@@ -258,10 +258,10 @@ nmt_password_dialog_class_init(NmtPasswordDialogClass *dialog_class)
                             NULL,
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtPasswordDialog:prompt:
-	 *
-	 * The prompt text.
-	 */
+     * NmtPasswordDialog:prompt:
+     *
+     * The prompt text.
+     */
     g_object_class_install_property(
         object_class,
         PROP_PROMPT,
@@ -271,12 +271,12 @@ nmt_password_dialog_class_init(NmtPasswordDialogClass *dialog_class)
                             NULL,
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtPasswordDialog:secrets:
-	 *
-	 * The array of request secrets
-	 *
-	 * Element-Type: #NMSecretAgentSimpleSecret.
-	 */
+     * NmtPasswordDialog:secrets:
+     *
+     * The array of request secrets
+     *
+     * Element-Type: #NMSecretAgentSimpleSecret.
+     */
     g_object_class_install_property(
         object_class,
         PROP_SECRETS,
diff --git a/clients/tui/nmt-password-fields.c b/clients/tui/nmt-password-fields.c
index 90e2e88246..6c11b3acfa 100644
--- a/clients/tui/nmt-password-fields.c
+++ b/clients/tui/nmt-password-fields.c
@@ -246,19 +246,19 @@ nmt_password_fields_class_init(NmtPasswordFieldsClass *entry_class)
     object_class->finalize     = nmt_password_fields_finalize;
 
     /**
-	 * NmtPasswordFields:width:
-	 *
-	 * The width in characters of the password entry
-	 */
+     * NmtPasswordFields:width:
+     *
+     * The width in characters of the password entry
+     */
     g_object_class_install_property(
         object_class,
         PROP_WIDTH,
         g_param_spec_int("width", "", "", -1, 80, -1, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtPasswordFields:extras:
-	 *
-	 * The extra widgets to show
-	 */
+     * NmtPasswordFields:extras:
+     *
+     * The extra widgets to show
+     */
     g_object_class_install_property(
         object_class,
         PROP_EXTRAS,
@@ -270,19 +270,19 @@ nmt_password_fields_class_init(NmtPasswordFieldsClass *entry_class)
                           0,
                           G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtPasswordFields:password:
-	 *
-	 * The entered password.
-	 */
+     * NmtPasswordFields:password:
+     *
+     * The entered password.
+     */
     g_object_class_install_property(
         object_class,
         PROP_PASSWORD,
         g_param_spec_string("password", "", "", NULL, G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtPasswordFields:always-ask:
-	 *
-	 * The current state of the "Always ask" checkbox.
-	 */
+     * NmtPasswordFields:always-ask:
+     *
+     * The current state of the "Always ask" checkbox.
+     */
     g_object_class_install_property(
         object_class,
         PROP_ALWAYS_ASK,
@@ -292,10 +292,10 @@ nmt_password_fields_class_init(NmtPasswordFieldsClass *entry_class)
                              FALSE,
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtPasswordFields:show-password:
-	 *
-	 * The current state of the "Show password" checkbox.
-	 */
+     * NmtPasswordFields:show-password:
+     *
+     * The current state of the "Show password" checkbox.
+     */
     g_object_class_install_property(
         object_class,
         PROP_SHOW_PASSWORD,
diff --git a/clients/tui/nmt-route-editor.c b/clients/tui/nmt-route-editor.c
index 143e26b0e7..54741c1a5a 100644
--- a/clients/tui/nmt-route-editor.c
+++ b/clients/tui/nmt-route-editor.c
@@ -170,11 +170,11 @@ nmt_route_editor_class_init(NmtRouteEditorClass *entry_class)
     object_class->finalize     = nmt_route_editor_finalize;
 
     /**
-	 * NmtRouteEditor:setting:
-	 *
-	 * The #NMSettingIP4Config or #NMSettingIP6Config whose routes are
-	 * being edited.
-	 */
+     * NmtRouteEditor:setting:
+     *
+     * The #NMSettingIP4Config or #NMSettingIP6Config whose routes are
+     * being edited.
+     */
     g_object_class_install_property(
         object_class,
         PROP_SETTING,
diff --git a/clients/tui/nmt-route-entry.c b/clients/tui/nmt-route-entry.c
index 60e122054d..e8c772152e 100644
--- a/clients/tui/nmt-route-entry.c
+++ b/clients/tui/nmt-route-entry.c
@@ -227,10 +227,10 @@ nmt_route_entry_class_init(NmtRouteEntryClass *entry_class)
     widget_class->get_focus_component = nmt_route_entry_get_focus_component;
 
     /**
-	 * NmtRouteEntry:family:
-	 *
-	 * The address family of the route, eg, %AF_INET
-	 */
+     * NmtRouteEntry:family:
+     *
+     * The address family of the route, eg, %AF_INET
+     */
     g_object_class_install_property(
         object_class,
         PROP_FAMILY,
@@ -242,10 +242,10 @@ nmt_route_entry_class_init(NmtRouteEntryClass *entry_class)
                          0,
                          G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtRouteEntry:ip-entry-width:
-	 *
-	 * The width in characters of the IP address entries
-	 */
+     * NmtRouteEntry:ip-entry-width:
+     *
+     * The width in characters of the IP address entries
+     */
     g_object_class_install_property(
         object_class,
         PROP_IP_ENTRY_WIDTH,
@@ -257,10 +257,10 @@ nmt_route_entry_class_init(NmtRouteEntryClass *entry_class)
                          0,
                          G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtRouteEntry:metric-entry-width:
-	 *
-	 * The width in characters of the metric entry
-	 */
+     * NmtRouteEntry:metric-entry-width:
+     *
+     * The width in characters of the metric entry
+     */
     g_object_class_install_property(
         object_class,
         PROP_METRIC_ENTRY_WIDTH,
@@ -272,10 +272,10 @@ nmt_route_entry_class_init(NmtRouteEntryClass *entry_class)
                          0,
                          G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtRouteEntry:route:
-	 *
-	 * The contents of the entries, as an #NMIPRoute.
-	 */
+     * NmtRouteEntry:route:
+     *
+     * The contents of the entries, as an #NMIPRoute.
+     */
     g_object_class_install_property(object_class,
                                     PROP_ROUTE,
                                     g_param_spec_boxed("route",
diff --git a/clients/tui/nmt-route-table.c b/clients/tui/nmt-route-table.c
index d0f0283512..4b0ea58b7d 100644
--- a/clients/tui/nmt-route-table.c
+++ b/clients/tui/nmt-route-table.c
@@ -272,10 +272,10 @@ nmt_route_table_class_init(NmtRouteTableClass *table_class)
     object_class->finalize     = nmt_route_table_finalize;
 
     /**
-	 * NmtRouteTable:family:
-	 *
-	 * The network address family of the routes, eg %AF_INET
-	 */
+     * NmtRouteTable:family:
+     *
+     * The network address family of the routes, eg %AF_INET
+     */
     g_object_class_install_property(
         object_class,
         PROP_FAMILY,
@@ -287,13 +287,13 @@ nmt_route_table_class_init(NmtRouteTableClass *table_class)
                          -1,
                          G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtRouteTable:routes:
-	 *
-	 * The array of routes, suitable for binding to #NMSettingIP4Config:routes
-	 * or #NMSettingIP6Config:routes.
-	 *
-	 * Element-type: NMIPRoute
-	 */
+     * NmtRouteTable:routes:
+     *
+     * The array of routes, suitable for binding to #NMSettingIP4Config:routes
+     * or #NMSettingIP6Config:routes.
+     *
+     * Element-type: NMIPRoute
+     */
     g_object_class_install_property(object_class,
                                     PROP_ROUTES,
                                     g_param_spec_boxed("routes",
diff --git a/clients/tui/nmt-slave-list.c b/clients/tui/nmt-slave-list.c
index aab4f4ca03..d0faffe8a4 100644
--- a/clients/tui/nmt-slave-list.c
+++ b/clients/tui/nmt-slave-list.c
@@ -208,10 +208,10 @@ nmt_slave_list_class_init(NmtSlaveListClass *list_class)
     connection_list_class->remove_connection = nmt_slave_list_remove_connection;
 
     /**
-	 * NmtSlaveList:master:
-	 *
-	 * The master #NMConnection whose slaves are being displayed.
-	 */
+     * NmtSlaveList:master:
+     *
+     * The master #NMConnection whose slaves are being displayed.
+     */
     g_object_class_install_property(
         object_class,
         PROP_MASTER,
@@ -221,16 +221,16 @@ nmt_slave_list_class_init(NmtSlaveListClass *list_class)
                             NM_TYPE_CONNECTION,
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtSlaveList:type-filter:
-	 *
-	 * If non-%NULL, this will be used to limit the connection types
-	 * that are available when the user clicks on the "Add" button to
-	 * add a new slave. If the filter filters the list down to only a
-	 * single connection type, then the user will not be presented
-	 * with a connection-type dialog, and will instead be immediately
-	 * taken to an editor window for the new slave after clicking
-	 * "Add".
-	 */
+     * NmtSlaveList:type-filter:
+     *
+     * If non-%NULL, this will be used to limit the connection types
+     * that are available when the user clicks on the "Add" button to
+     * add a new slave. If the filter filters the list down to only a
+     * single connection type, then the user will not be presented
+     * with a connection-type dialog, and will instead be immediately
+     * taken to an editor window for the new slave after clicking
+     * "Add".
+     */
     g_object_class_install_property(
         object_class,
         PROP_TYPE_FILTER,
@@ -239,10 +239,10 @@ nmt_slave_list_class_init(NmtSlaveListClass *list_class)
                              "",
                              G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtSlaveList:type-filter-data:
-	 *
-	 * User data passed to #NmtSlaveList:type-filter
-	 */
+     * NmtSlaveList:type-filter-data:
+     *
+     * User data passed to #NmtSlaveList:type-filter
+     */
     g_object_class_install_property(
         object_class,
         PROP_TYPE_FILTER_DATA,
diff --git a/clients/tui/nmt-widget-list.c b/clients/tui/nmt-widget-list.c
index 3a8676789f..19d9f98b58 100644
--- a/clients/tui/nmt-widget-list.c
+++ b/clients/tui/nmt-widget-list.c
@@ -381,16 +381,16 @@ nmt_widget_list_class_init(NmtWidgetListClass *list_class)
     /* signals */
 
     /**
-	 * NmtNewtWidget::add-clicked:
-	 * @list: the #NmtNewtWidgetList
-	 *
-	 * Emitted when the user clicks the "Add" button. The caller can
-	 * decide whether or not to add a new widget, and call
-	 * nmt_widget_list_set_length() with the new length if so.
-	 *
-	 * FIXME: the "Add" button should be insensitive if it's
-	 * not going to work.
-	 */
+     * NmtNewtWidget::add-clicked:
+     * @list: the #NmtNewtWidgetList
+     *
+     * Emitted when the user clicks the "Add" button. The caller can
+     * decide whether or not to add a new widget, and call
+     * nmt_widget_list_set_length() with the new length if so.
+     *
+     * FIXME: the "Add" button should be insensitive if it's
+     * not going to work.
+     */
     signals[ADD_CLICKED] = g_signal_new("add-clicked",
                                         G_OBJECT_CLASS_TYPE(object_class),
                                         G_SIGNAL_RUN_FIRST,
@@ -401,17 +401,17 @@ nmt_widget_list_class_init(NmtWidgetListClass *list_class)
                                         G_TYPE_NONE,
                                         0);
     /**
-	 * NmtNewtWidget::remove-clicked:
-	 * @list: the #NmtNewtWidgetList
-	 * @n: the widget being removed
-	 *
-	 * Emitted when the user clicks one of the "Remove" buttons. The
-	 * caller can decide whether or not to remove the widget, and
-	 * call nmt_widget_list_set_length() with the new length if so.
-	 *
-	 * FIXME: the "Remove" button should be insensitive if it's not
-	 * going to work.
-	 */
+     * NmtNewtWidget::remove-clicked:
+     * @list: the #NmtNewtWidgetList
+     * @n: the widget being removed
+     *
+     * Emitted when the user clicks one of the "Remove" buttons. The
+     * caller can decide whether or not to remove the widget, and
+     * call nmt_widget_list_set_length() with the new length if so.
+     *
+     * FIXME: the "Remove" button should be insensitive if it's not
+     * going to work.
+     */
     signals[REMOVE_CLICKED] = g_signal_new("remove-clicked",
                                            G_OBJECT_CLASS_TYPE(object_class),
                                            G_SIGNAL_RUN_FIRST,
@@ -426,10 +426,10 @@ nmt_widget_list_class_init(NmtWidgetListClass *list_class)
     /* properties */
 
     /**
-	 * NmtWidgetList:create-callback:
-	 *
-	 * Callback called to create a new widget.
-	 */
+     * NmtWidgetList:create-callback:
+     *
+     * Callback called to create a new widget.
+     */
     g_object_class_install_property(
         object_class,
         PROP_CREATE_CALLBACK,
@@ -438,29 +438,29 @@ nmt_widget_list_class_init(NmtWidgetListClass *list_class)
                              "",
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtWidgetList:user-data:
-	 *
-	 * User data for #NmtWidgetList:create-callback
-	 */
+     * NmtWidgetList:user-data:
+     *
+     * User data for #NmtWidgetList:create-callback
+     */
     g_object_class_install_property(
         object_class,
         PROP_USER_DATA,
         g_param_spec_pointer("user-data", "", "", G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtWidgetList:destroy-notify:
-	 *
-	 * #GDestroyNotify for #NmtWidgetList:user-data
-	 */
+     * NmtWidgetList:destroy-notify:
+     *
+     * #GDestroyNotify for #NmtWidgetList:user-data
+     */
     g_object_class_install_property(
         object_class,
         PROP_DESTROY_NOTIFY,
         g_param_spec_pointer("destroy-notify", "", "", G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtWidgetList:length:
-	 *
-	 * The length of the widget list; changing this value will add or
-	 * remove widgets from the list.
-	 */
+     * NmtWidgetList:length:
+     *
+     * The length of the widget list; changing this value will add or
+     * remove widgets from the list.
+     */
     g_object_class_install_property(object_class,
                                     PROP_LENGTH,
                                     g_param_spec_int("length",
@@ -471,11 +471,11 @@ nmt_widget_list_class_init(NmtWidgetListClass *list_class)
                                                      0,
                                                      G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
     /**
-	 * NmtWidgetList:empty-widget:
-	 *
-	 * If non-%NULL, this widget will be displayed when there are
-	 * no "real" widgets in the list.
-	 */
+     * NmtWidgetList:empty-widget:
+     *
+     * If non-%NULL, this widget will be displayed when there are
+     * no "real" widgets in the list.
+     */
     g_object_class_install_property(
         object_class,
         PROP_EMPTY_WIDGET,
diff --git a/clients/tui/nmtui-connect.c b/clients/tui/nmtui-connect.c
index 8948b1d695..7c4edceeab 100644
--- a/clients/tui/nmtui-connect.c
+++ b/clients/tui/nmtui-connect.c
@@ -259,10 +259,10 @@ activate_connection(NMConnection *connection, NMDevice *device, NMObject *specif
     specific_object_path = specific_object ? nm_object_get_path(specific_object) : NULL;
 
     /* There's no way to cancel an nm_client_activate_connection() /
-	 * nm_client_add_and_activate_connection() call, so we always let them
-	 * complete, even if the user hits Esc; they shouldn't normally take long
-	 * to complete anyway.
-	 */
+     * nm_client_add_and_activate_connection() call, so we always let them
+     * complete, even if the user hits Esc; they shouldn't normally take long
+     * to complete anyway.
+     */
 
     nmt_sync_op_init(&op);
     if (connection) {
@@ -306,8 +306,8 @@ activate_connection(NMConnection *connection, NMDevice *device, NMObject *specif
     }
 
     /* Now wait for the connection to actually reach the ACTIVATED state,
-	 * allowing the user to cancel if it takes too long.
-	 */
+     * allowing the user to cancel if it takes too long.
+     */
     nmt_sync_op_init(&op);
     info.active = ac;
     info.device = device;
diff --git a/dispatcher/nm-dispatcher-utils.c b/dispatcher/nm-dispatcher-utils.c
index 7074c9673c..870d602800 100644
--- a/dispatcher/nm-dispatcher-utils.c
+++ b/dispatcher/nm-dispatcher-utils.c
@@ -338,7 +338,7 @@ construct_ip_items(GPtrArray *items, int addr_family, GVariant *ip_config, const
     }
     if (nroutes > 0 || addr_family == AF_INET) {
         /* we also set IP4_NUM_ROUTES=0, but don't do so for addresses and IPv6 routes.
-		 * Historic reasons. */
+         * Historic reasons. */
         _items_add_printf(items, "%sIP%c_NUM_ROUTES=%u", prefix, four_or_six, nroutes);
     }
 }
@@ -375,25 +375,25 @@ construct_device_dhcp_items(GPtrArray *items, int addr_family, GVariant *dhcp_co
                                   g_variant_get_string(val, NULL));
 
                 /* MS Azure sends the server endpoint in the dhcp private
-				 * option 245. cloud-init searches the Azure server endpoint
-				 * value looking for the standard dhclient label used for
-				 * that option, which is "unknown_245".
-				 * The 11-dhclient script shipped with Fedora and RHEL dhcp
-				 * package converts our dispatcher environment vars to the
-				 * dhclient ones (new_<some_option>) and calls dhclient hook
-				 * scripts.
-				 * Let's make cloud-init happy and let's duplicate the dhcp
-				 * option 245 with the legacy name of the default dhclient
-				 * label also when using the internal client.
-				 * Note however that the dhclient plugin will have unknown_
-				 * labels represented as ascii string when possible, falling
-				 * back to hex string otherwise.
-				 * private_ labels instead are always in hex string format.
-				 * This shouldn't affect the MS Azure server endpoint value,
-				 * as it usually belongs to the 240.0.0.0/4 network and so
-				 * is always represented as an hex string. Moreover, cloudinit
-				 * code checks just for an hex value in unknown_245.
-				 */
+                 * option 245. cloud-init searches the Azure server endpoint
+                 * value looking for the standard dhclient label used for
+                 * that option, which is "unknown_245".
+                 * The 11-dhclient script shipped with Fedora and RHEL dhcp
+                 * package converts our dispatcher environment vars to the
+                 * dhclient ones (new_<some_option>) and calls dhclient hook
+                 * scripts.
+                 * Let's make cloud-init happy and let's duplicate the dhcp
+                 * option 245 with the legacy name of the default dhclient
+                 * label also when using the internal client.
+                 * Note however that the dhclient plugin will have unknown_
+                 * labels represented as ascii string when possible, falling
+                 * back to hex string otherwise.
+                 * private_ labels instead are always in hex string format.
+                 * This shouldn't affect the MS Azure server endpoint value,
+                 * as it usually belongs to the 240.0.0.0/4 network and so
+                 * is always represented as an hex string. Moreover, cloudinit
+                 * code checks just for an hex value in unknown_245.
+                 */
                 if (addr_family == AF_INET) {
                     if (nm_streq(key, "private_245"))
                         private_245_val = g_variant_ref(val);
@@ -469,8 +469,8 @@ nm_dispatcher_utils_construct_envp(const char * action,
         _items_add_key(items, NULL, "CONNECTION_FILENAME", filename);
 
     /* Canonicalize the VPN interface name; "" is used when passing it through
-	 * D-Bus so make sure that's fixed up here.
-	 */
+     * D-Bus so make sure that's fixed up here.
+     */
     if (vpn_ip_iface && !vpn_ip_iface[0])
         vpn_ip_iface = NULL;
 
@@ -553,10 +553,10 @@ nm_dispatcher_utils_construct_envp(const char * action,
     }
 
     /* Backwards compat: 'iface' is set in this order:
-	 * 1) VPN interface name
-	 * 2) Device IP interface name
-	 * 3) Device interface anme
-	 */
+     * 1) VPN interface name
+     * 2) Device IP interface name
+     * 3) Device interface anme
+     */
     if (vpn_ip_iface)
         *out_iface = g_strdup(vpn_ip_iface);
     else if (ip_iface)
@@ -566,8 +566,8 @@ nm_dispatcher_utils_construct_envp(const char * action,
 
 done:
     /* The connectivity_state value will only be meaningful for 'connectivity-change' events
-	 * (otherwise it will be "UNKNOWN"), so we only set the environment variable in those cases.
-	 */
+     * (otherwise it will be "UNKNOWN"), so we only set the environment variable in those cases.
+     */
     if (!NM_IN_STRSET(connectivity_state, NULL, "UNKNOWN"))
         _items_add_key(items, NULL, "CONNECTIVITY_STATE", connectivity_state);
 
diff --git a/dispatcher/nm-dispatcher.c b/dispatcher/nm-dispatcher.c
index b135eaef5b..0f0a22b4e9 100644
--- a/dispatcher/nm-dispatcher.c
+++ b/dispatcher/nm-dispatcher.c
@@ -73,7 +73,7 @@ struct Request {
     {                                                                                                  \
         if (FALSE) {                                                                                   \
             /* g_message() alone does not warn about invalid format. Add a dummy printf() statement to
-			 * get a compiler warning about wrong format. */ \
+             * get a compiler warning about wrong format. */ \
             printf(__VA_ARGS__);                                                                       \
         }                                                                                              \
         print_cmd(__VA_ARGS__);                                                                        \
@@ -226,8 +226,8 @@ next_request(Request *request)
         }
     } else {
         /* when calling next_request() without explicit @request, we always
-		 * forcefully clear @current_request. That one is certainly
-		 * handled already. */
+         * forcefully clear @current_request. That one is certainly
+         * handled already. */
         gl.current_request = NULL;
 
         request = g_queue_pop_head(gl.requests_waiting);
@@ -302,7 +302,7 @@ complete_script(ScriptInfo *script)
 
     if (wait) {
         /* for "wait" scripts, try to schedule the next blocking script.
-		 * If that is successful, return (as we must wait for its completion). */
+         * If that is successful, return (as we must wait for its completion). */
         if (dispatch_one_script(request))
             return;
     }
@@ -310,16 +310,16 @@ complete_script(ScriptInfo *script)
     nm_assert(!wait || gl.current_request == request);
 
     /* Try to complete the request. @request will be possibly free'd,
-	 * making @script and @request a dangling pointer. */
+     * making @script and @request a dangling pointer. */
     complete_request(request);
 
     if (!wait) {
         /* this was a "no-wait" script. We either completed the request,
-		 * or there is nothing to do. Especially, there is no need to
-		 * queue the next_request() -- because no-wait scripts don't block
-		 * requests. However, if this was the last "no-wait" script and
-		 * there are "wait" scripts ready to run, launch them.
-		 */
+         * or there is nothing to do. Especially, there is no need to
+         * queue the next_request() -- because no-wait scripts don't block
+         * requests. However, if this was the last "no-wait" script and
+         * there are "wait" scripts ready to run, launch them.
+         */
         if (gl.current_request == request && gl.current_request->num_scripts_nowait == 0) {
             if (dispatch_one_script(gl.current_request))
                 return;
@@ -329,14 +329,14 @@ complete_script(ScriptInfo *script)
             return;
     } else {
         /* if the script is a "wait" script, we already tried above to
-		 * dispatch the next script. As we didn't do that, it means we
-		 * just completed the last script of @request and we can continue
-		 * with the next request...
-		 *
-		 * Also, it cannot be that there is another request currently being
-		 * processed because only requests with "wait" scripts can become
-		 * @current_request. As there can only be one "wait" script running
-		 * at any time, it means complete_request() above completed @request. */
+         * dispatch the next script. As we didn't do that, it means we
+         * just completed the last script of @request and we can continue
+         * with the next request...
+         *
+         * Also, it cannot be that there is another request currently being
+         * processed because only requests with "wait" scripts can become
+         * @current_request. As there can only be one "wait" script running
+         * at any time, it means complete_request() above completed @request. */
         nm_assert(!gl.current_request);
     }
 
@@ -347,12 +347,12 @@ complete_script(ScriptInfo *script)
             return;
 
         /* Try to complete the request. It will be either completed
-		 * now, or when all pending "no-wait" scripts return. */
+         * now, or when all pending "no-wait" scripts return. */
         complete_request(request);
 
         /* We can immediately start next_request(), because our current
-		 * @request has obviously no more "wait" scripts either.
-		 * Repeat... */
+         * @request has obviously no more "wait" scripts either.
+         * Repeat... */
     }
 }
 
@@ -501,7 +501,7 @@ script_dispatch(ScriptInfo *script)
     script->dispatched = TRUE;
 
     /* Only for "hostname" action we coerce the interface name to "none". We don't
-	 * do so for "connectivity-check" action. */
+     * do so for "connectivity-check" action. */
 
     argv[0] = script->script;
     argv[1] = request->iface ?: (nm_streq(request->action, NMD_ACTION_HOSTNAME) ? "none" : "");
@@ -808,34 +808,34 @@ _method_call_action(GDBusMethodInvocation *invocation, GVariant *parameters)
 
     if (num_nowait < request->scripts->len) {
         /* The request has at least one wait script.
-		 * Try next_request() to schedule the request for
-		 * execution. This either enqueues the request or
-		 * sets it as gl.current_request. */
+         * Try next_request() to schedule the request for
+         * execution. This either enqueues the request or
+         * sets it as gl.current_request. */
         if (next_request(request)) {
             /* @request is now @current_request. Go ahead and
-			 * schedule the first wait script. */
+             * schedule the first wait script. */
             if (!dispatch_one_script(request)) {
                 /* If that fails, we might be already finished with the
-				 * request. Try complete_request(). */
+                 * request. Try complete_request(). */
                 complete_request(request);
 
                 if (next_request(NULL)) {
                     /* As @request was successfully scheduled as next_request(), there is no
-					 * other request in queue that can be scheduled afterwards. Assert against
-					 * that, but call next_request() to clear current_request. */
+                     * other request in queue that can be scheduled afterwards. Assert against
+                     * that, but call next_request() to clear current_request. */
                     g_assert_not_reached();
                 }
             }
         }
     } else {
         /* The request contains only no-wait scripts. Try to complete
-		 * the request right away (we might have failed to schedule any
-		 * of the scripts). It will be either completed now, or later
-		 * when the pending scripts return.
-		 * We don't enqueue it to gl.requests_waiting.
-		 * There is no need to handle next_request(), because @request is
-		 * not the current request anyway and does not interfere with requests
-		 * that have any "wait" scripts. */
+         * the request right away (we might have failed to schedule any
+         * of the scripts). It will be either completed now, or later
+         * when the pending scripts return.
+         * We don't enqueue it to gl.requests_waiting.
+         * There is no need to handle next_request(), because @request is
+         * not the current request anyway and does not interfere with requests
+         * that have any "wait" scripts. */
         complete_request(request);
     }
 }
@@ -1017,9 +1017,9 @@ main(int argc, char **argv)
     if (gl.debug) {
         if (!g_getenv("G_MESSAGES_DEBUG")) {
             /* we log our regular messages using g_debug() and g_info().
-			 * When we redirect glib logging to syslog, there is no problem.
-			 * But in "debug" mode, glib will no print these messages unless
-			 * we set G_MESSAGES_DEBUG. */
+             * When we redirect glib logging to syslog, there is no problem.
+             * But in "debug" mode, glib will no print these messages unless
+             * we set G_MESSAGES_DEBUG. */
             g_setenv("G_MESSAGES_DEBUG", "all", TRUE);
         }
     } else
@@ -1067,16 +1067,16 @@ done:
 
     if (gl.num_requests_pending > 0) {
         /* this only happens when we quit due to SIGTERM (not due to the idle timer).
-		 *
-		 * Log a warning about pending scripts.
-		 *
-		 * Maybe we should notify NetworkManager that these scripts are left in an unknown state.
-		 * But this is either a bug of a dispatcher script (not terminating in time).
-		 *
-		 * FIXME(shutdown): Also, currently NetworkManager behaves wrongly on shutdown.
-		 * Note that systemd would not terminate NetworkManager-dispatcher before NetworkManager.
-		 * It's NetworkManager's responsibility to keep running long enough so that all requests
-		 * can complete (with a watchdog timer, and a warning that user provided scripts hang). */
+         *
+         * Log a warning about pending scripts.
+         *
+         * Maybe we should notify NetworkManager that these scripts are left in an unknown state.
+         * But this is either a bug of a dispatcher script (not terminating in time).
+         *
+         * FIXME(shutdown): Also, currently NetworkManager behaves wrongly on shutdown.
+         * Note that systemd would not terminate NetworkManager-dispatcher before NetworkManager.
+         * It's NetworkManager's responsibility to keep running long enough so that all requests
+         * can complete (with a watchdog timer, and a warning that user provided scripts hang). */
         _LOG_X_W("exiting but there are still %u requests pending", gl.num_requests_pending);
     }
 
diff --git a/dispatcher/tests/test-dispatcher-envp.c b/dispatcher/tests/test-dispatcher-envp.c
index ccce945c25..2982ef75f3 100644
--- a/dispatcher/tests/test-dispatcher-envp.c
+++ b/dispatcher/tests/test-dispatcher-envp.c
@@ -216,8 +216,8 @@ parse_ip4(GKeyFile *kf, GVariant **out_props, const char *section, GError **erro
 
     /* search domains */
     /* Use char** for domains. (DBUS_TYPE_G_ARRAY_OF_STRING of NMIP4Config
-	 * becomes G_TYPE_STRV when sending the value over D-Bus)
-	 */
+     * becomes G_TYPE_STRV when sending the value over D-Bus)
+     */
     tmp = g_key_file_get_string(kf, section, "domains", error);
     if (tmp == NULL)
         return FALSE;
@@ -588,7 +588,7 @@ static void
 test_connectivity_changed(void)
 {
     /* These tests will check that the CONNECTIVITY_STATE environment
-	 * variable is only defined for known states, such as 'full'. */
+     * variable is only defined for known states, such as 'full'. */
     test_generic("dispatcher-connectivity-unknown", NULL);
     test_generic("dispatcher-connectivity-full", NULL);
 }
@@ -597,8 +597,8 @@ static void
 test_up_empty_vpn_iface(void)
 {
     /* Test that an empty VPN iface variable, like is passed through D-Bus
-	 * from NM, is ignored by the dispatcher environment construction code.
-	 */
+     * from NM, is ignored by the dispatcher environment construction code.
+     */
     test_generic("dispatcher-up", "");
 }
 
diff --git a/examples/C/glib/add-connection-gdbus.c b/examples/C/glib/add-connection-gdbus.c
index 890d881976..96fb02b166 100644
--- a/examples/C/glib/add-connection-gdbus.c
+++ b/examples/C/glib/add-connection-gdbus.c
@@ -91,10 +91,10 @@ add_connection(GDBusProxy *proxy, const char *con_name)
                           &setting_builder);
 
     /* Call AddConnection with the connection dictionary as argument.
-	 * (g_variant_new() will consume the floating GVariant returned from
-	 * &connection_builder, and g_dbus_proxy_call_sync() will consume the
-	 * floating variant returned from g_variant_new(), so no cleanup is needed.
-	 */
+     * (g_variant_new() will consume the floating GVariant returned from
+     * &connection_builder, and g_dbus_proxy_call_sync() will consume the
+     * floating variant returned from g_variant_new(), so no cleanup is needed.
+     */
     ret = g_dbus_proxy_call_sync(proxy,
                                  "AddConnection",
                                  g_variant_new("(a{sa{sv}})", &connection_builder),
diff --git a/examples/C/glib/add-connection-libnm.c b/examples/C/glib/add-connection-libnm.c
index 90e5f5a25c..393a516735 100644
--- a/examples/C/glib/add-connection-libnm.c
+++ b/examples/C/glib/add-connection-libnm.c
@@ -24,8 +24,8 @@ added_cb(GObject *client, GAsyncResult *result, gpointer user_data)
     GError *            error = NULL;
 
     /* NM responded to our request; either handle the resulting error or
-	 * print out the object path of the connection we just added.
-	 */
+     * print out the object path of the connection we just added.
+     */
     remote = nm_client_add_connection_finish(NM_CLIENT(client), result, &error);
 
     if (error) {
@@ -79,8 +79,8 @@ add_connection(NMClient *client, GMainLoop *loop, const char *con_name)
     nm_connection_add_setting(connection, NM_SETTING(s_ip4));
 
     /* Ask the settings service to add the new connection; we'll quit the
-	 * mainloop and exit when the callback is called.
-	 */
+     * mainloop and exit when the callback is called.
+     */
     nm_client_add_connection_async(client, connection, TRUE, NULL, added_cb, loop);
     g_object_unref(connection);
 }
diff --git a/examples/C/glib/get-active-connections-gdbus.c b/examples/C/glib/get-active-connections-gdbus.c
index f972e45aff..7c410636cb 100644
--- a/examples/C/glib/get-active-connections-gdbus.c
+++ b/examples/C/glib/get-active-connections-gdbus.c
@@ -130,10 +130,10 @@ get_active_connection_details(const char *obj_path)
     GError *    error = NULL;
 
     /* This function gets the backing Connection object that describes the
-	 * network configuration that the ActiveConnection object is actually using.
-	 * The ActiveConnection object contains the mapping between the configuration
-	 * and the actual network interfaces that are using that configuration.
-	 */
+     * network configuration that the ActiveConnection object is actually using.
+     * The ActiveConnection object contains the mapping between the configuration
+     * and the actual network interfaces that are using that configuration.
+     */
 
     /* Create a D-Bus object proxy for the active connection object's properties */
     props_proxy = g_dbus_proxy_new_for_bus_sync(G_BUS_TYPE_SYSTEM,
@@ -241,8 +241,8 @@ main(int argc, char *argv[])
     GDBusProxy *props_proxy;
 
     /* Create a D-Bus proxy to get the object properties from the NM Manager
-	 * object.  NM_DBUS_* defines are from nm-dbus-interface.h.
-	 */
+     * object.  NM_DBUS_* defines are from nm-dbus-interface.h.
+     */
     props_proxy = g_dbus_proxy_new_for_bus_sync(G_BUS_TYPE_SYSTEM,
                                                 G_DBUS_PROXY_FLAGS_NONE,
                                                 NULL,
diff --git a/libnm-core/nm-connection.c b/libnm-core/nm-connection.c
index 87c444d04d..0a08244e86 100644
--- a/libnm-core/nm-connection.c
+++ b/libnm-core/nm-connection.c
@@ -281,9 +281,9 @@ validate_permissions_type(GVariant *variant, GError **error)
     gboolean  valid = TRUE;
 
     /* Ensure the connection::permissions item (if present) is the correct
-	 * type, otherwise the g_object_set() will throw a warning and ignore the
-	 * error, leaving us with no permissions.
-	 */
+     * type, otherwise the g_object_set() will throw a warning and ignore the
+     * error, leaving us with no permissions.
+     */
     s_con = g_variant_lookup_value(variant,
                                    NM_SETTING_CONNECTION_SETTING_NAME,
                                    NM_VARIANT_TYPE_SETTING);
@@ -414,20 +414,20 @@ _nm_connection_replace_settings(NMConnection *      connection,
         changed = (settings != NULL);
 
     /* Note: @settings might be empty in which case the connection
-	 * has no NMSetting instances... which is fine, just something
-	 * to be aware of. */
+     * has no NMSetting instances... which is fine, just something
+     * to be aware of. */
     for (s = settings; s; s = s->next)
         _nm_connection_add_setting(connection, s->data);
 
     g_slist_free(settings);
 
     /* If verification/normalization fails, the original connection
-	 * is already lost. From an API point of view, it would be nicer
-	 * not to touch the input argument if we fail at the end.
-	 * However, that would require creating a temporary connection
-	 * to validate it first. As none of the caller cares about the
-	 * state of the @connection when normalization fails, just do it
-	 * this way. */
+     * is already lost. From an API point of view, it would be nicer
+     * not to touch the input argument if we fail at the end.
+     * However, that would require creating a temporary connection
+     * to validate it first. As none of the caller cares about the
+     * state of the @connection when normalization fails, just do it
+     * this way. */
     if (NM_FLAGS_HAS(parse_flags, NM_SETTING_PARSE_FLAGS_NORMALIZE))
         success = nm_connection_normalize(connection, NULL, NULL, error);
     else
@@ -481,14 +481,14 @@ nm_connection_replace_settings_from_connection(NMConnection *connection,
     g_return_if_fail(NM_IS_CONNECTION(new_connection));
 
     /* When 'connection' and 'new_connection' are the same object simply return
-	 * in order not to destroy 'connection'.
-	 */
+     * in order not to destroy 'connection'.
+     */
     if (connection == new_connection)
         return;
 
     /* No need to validate permissions like nm_connection_replace_settings()
-	 * since we're dealing with an NMConnection which has already done that.
-	 */
+     * since we're dealing with an NMConnection which has already done that.
+     */
 
     priv     = NM_CONNECTION_GET_PRIVATE(connection);
     new_priv = NM_CONNECTION_GET_PRIVATE(new_connection);
@@ -759,7 +759,7 @@ _nm_connection_detect_bluetooth_type(NMConnection *self)
     }
 
     /* NULL means the connection is not a bluetooth type, or it needs
-	 * no normalization, as the type is set explicitly. */
+     * no normalization, as the type is set explicitly. */
     return NULL;
 }
 
@@ -969,8 +969,8 @@ _normalize_ip_config(NMConnection *self, GHashTable *parameters)
             }
 
             /* If no IP6 setting was specified, then assume that means IP6 config is
-			 * allowed to fail.
-			 */
+             * allowed to fail.
+             */
             setting = nm_setting_ip6_config_new();
 
             g_object_set(setting,
@@ -1431,12 +1431,12 @@ _nm_connection_verify(NMConnection *connection, GError **error)
         nm_assert(NM_IS_SETTING_CONNECTION(settings[i]) == (i == 0));
 
         /* verify all settings. We stop if we find the first non-normalizable
-		 * @NM_SETTING_VERIFY_ERROR. If we find normalizable errors we continue
-		 * but remember the error to return it to the user.
-		 * @NM_SETTING_VERIFY_NORMALIZABLE_ERROR has a higher priority then
-		 * @NM_SETTING_VERIFY_NORMALIZABLE, so, if we encounter such an error type,
-		 * we remember it instead (to return it as output).
-		 **/
+         * @NM_SETTING_VERIFY_ERROR. If we find normalizable errors we continue
+         * but remember the error to return it to the user.
+         * @NM_SETTING_VERIFY_NORMALIZABLE_ERROR has a higher priority then
+         * @NM_SETTING_VERIFY_NORMALIZABLE, so, if we encounter such an error type,
+         * we remember it instead (to return it as output).
+         **/
         verify_result = _nm_setting_verify(settings[i], connection, &verify_error);
         if (verify_result == NM_SETTING_VERIFY_NORMALIZABLE
             || verify_result == NM_SETTING_VERIFY_NORMALIZABLE_ERROR) {
@@ -1475,7 +1475,7 @@ _nm_connection_verify(NMConnection *connection, GError **error)
                 g_prefix_error(&normalizable_error, "%s: ", NM_SETTING_IP4_CONFIG_SETTING_NAME);
 
                 /* having a master without IP config was not a verify() error, accept
-				 * it for backward compatibility. */
+                 * it for backward compatibility. */
                 normalizable_error_type = NM_SETTING_VERIFY_NORMALIZABLE;
             }
         } else {
@@ -1500,7 +1500,7 @@ _nm_connection_verify(NMConnection *connection, GError **error)
                 g_prefix_error(&normalizable_error, "%s: ", NM_SETTING_IP6_CONFIG_SETTING_NAME);
 
                 /* having a master without IP config was not a verify() error, accept
-				 * it for backward compatibility. */
+                 * it for backward compatibility. */
                 normalizable_error_type = NM_SETTING_VERIFY_NORMALIZABLE;
             }
         } else {
@@ -1525,7 +1525,7 @@ _nm_connection_verify(NMConnection *connection, GError **error)
                 g_prefix_error(&normalizable_error, "%s: ", NM_SETTING_PROXY_SETTING_NAME);
 
                 /* having a master without proxy config was not a verify() error, accept
-				 * it for backward compatibility. */
+                 * it for backward compatibility. */
                 normalizable_error_type = NM_SETTING_VERIFY_NORMALIZABLE;
             }
         } else {
@@ -1590,15 +1590,15 @@ _connection_normalize(NMConnection *connection,
 
 #if NM_MORE_ASSERTS > 10
     /* only call this _nm_connection_verify() confirms that the connection
-	 * requires normalization and is normalizable. */
+     * requires normalization and is normalizable. */
     nm_assert(NM_IN_SET(_nm_connection_verify(connection, NULL),
                         NM_SETTING_VERIFY_NORMALIZABLE,
                         NM_SETTING_VERIFY_NORMALIZABLE_ERROR));
 #endif
 
     /* Try to perform all kind of normalizations on the settings to fix it.
-	 * We only do this, after verifying that the connection contains no un-normalizable
-	 * errors, because in that case we rather fail without touching the settings. */
+     * We only do this, after verifying that the connection contains no un-normalizable
+     * errors, because in that case we rather fail without touching the settings. */
 
     was_modified = FALSE;
 
@@ -1633,8 +1633,8 @@ _connection_normalize(NMConnection *connection,
 
     if (success != NM_SETTING_VERIFY_SUCCESS) {
         /* we would expect, that after normalization, the connection can be verified.
-		 * Also treat NM_SETTING_VERIFY_NORMALIZABLE as failure, because there is something
-		 * odd going on. */
+         * Also treat NM_SETTING_VERIFY_NORMALIZABLE as failure, because there is something
+         * odd going on. */
         if (error && !*error) {
             g_set_error_literal(error,
                                 NM_CONNECTION_ERROR,
@@ -1755,7 +1755,7 @@ _nm_connection_ensure_normalized(NMConnection * connection,
         if (!allow_modify) {
             if (!out_connection_clone) {
                 /* even NM_SETTING_VERIFY_NORMALIZABLE is treated as an error. We could normalize,
-				 * but are not allowed to (and no out argument is provided for cloning).  */
+                 * but are not allowed to (and no out argument is provided for cloning).  */
                 g_propagate_error(error, g_steal_pointer(&local));
                 return FALSE;
             }
@@ -1899,8 +1899,8 @@ nm_connection_update_secrets(NMConnection *connection,
             setting_dict = g_variant_lookup_value(secrets, setting_name, NM_VARIANT_TYPE_SETTING);
             if (!setting_dict) {
                 /* The connection dictionary didn't contain any secrets for
-				 * @setting_name; just return success.
-				 */
+                 * @setting_name; just return success.
+                 */
                 return TRUE;
             }
         }
@@ -2133,18 +2133,18 @@ _nm_connection_for_each_secret(NMConnection *                 self,
     const char *    setting_name;
 
     /* This function, given a dict of dicts representing new secrets of
-	 * an NMConnection, walks through each toplevel dict (which represents a
-	 * NMSetting), and for each setting, walks through that setting dict's
-	 * properties.  For each property that's a secret, it will check that
-	 * secret's flags in the backing NMConnection object, and call a supplied
-	 * callback.
-	 *
-	 * The one complexity is that the VPN setting's 'secrets' property is
-	 * *also* a dict (since the key/value pairs are arbitrary and known
-	 * only to the VPN plugin itself).  That means we have three levels of
-	 * dicts that we potentially have to traverse here.  The differences
-	 * are handled by the virtual for_each_secret() function.
-	 */
+     * an NMConnection, walks through each toplevel dict (which represents a
+     * NMSetting), and for each setting, walks through that setting dict's
+     * properties.  For each property that's a secret, it will check that
+     * secret's flags in the backing NMConnection object, and call a supplied
+     * callback.
+     *
+     * The one complexity is that the VPN setting's 'secrets' property is
+     * *also* a dict (since the key/value pairs are arbitrary and known
+     * only to the VPN plugin itself).  That means we have three levels of
+     * dicts that we potentially have to traverse here.  The differences
+     * are handled by the virtual for_each_secret() function.
+     */
 
     g_return_val_if_fail(callback, NULL);
 
@@ -2520,13 +2520,13 @@ _nm_connection_get_multi_connect(NMConnection *connection)
     const NMConnectionMultiConnect DEFAULT = NM_CONNECTION_MULTI_CONNECT_SINGLE;
 
     /* connection.multi_connect property cannot be specified via regular
-	 * connection defaults in NetworkManager.conf, because those are per-device,
-	 * and we need to determine the multi_connect independent of a particular
-	 * device.
-	 *
-	 * There is however still a default-value, so theoretically, the default
-	 * value could be specified in NetworkManager.conf. Just not as [connection*]
-	 * and indepdented of a device. */
+     * connection defaults in NetworkManager.conf, because those are per-device,
+     * and we need to determine the multi_connect independent of a particular
+     * device.
+     *
+     * There is however still a default-value, so theoretically, the default
+     * value could be specified in NetworkManager.conf. Just not as [connection*]
+     * and indepdented of a device. */
 
     s_con = nm_connection_get_setting_connection(connection);
     if (!s_con)
@@ -3333,14 +3333,14 @@ static void
 nm_connection_default_init(NMConnectionInterface *iface)
 {
     /**
-	 * NMConnection::secrets-updated:
-	 * @connection: the object on which the signal is emitted
-	 * @setting_name: the setting name of the #NMSetting for which secrets were
-	 * updated
-	 *
-	 * The ::secrets-updated signal is emitted when the secrets of a setting
-	 * have been changed.
-	 */
+     * NMConnection::secrets-updated:
+     * @connection: the object on which the signal is emitted
+     * @setting_name: the setting name of the #NMSetting for which secrets were
+     * updated
+     *
+     * The ::secrets-updated signal is emitted when the secrets of a setting
+     * have been changed.
+     */
     signals[SECRETS_UPDATED] = g_signal_new(NM_CONNECTION_SECRETS_UPDATED,
                                             NM_TYPE_CONNECTION,
                                             G_SIGNAL_RUN_FIRST,
@@ -3353,12 +3353,12 @@ nm_connection_default_init(NMConnectionInterface *iface)
                                             G_TYPE_STRING);
 
     /**
-	 * NMConnection::secrets-cleared:
-	 * @connection: the object on which the signal is emitted
-	 *
-	 * The ::secrets-cleared signal is emitted when the secrets of a connection
-	 * are cleared.
-	 */
+     * NMConnection::secrets-cleared:
+     * @connection: the object on which the signal is emitted
+     *
+     * The ::secrets-cleared signal is emitted when the secrets of a connection
+     * are cleared.
+     */
     signals[SECRETS_CLEARED] = g_signal_new(NM_CONNECTION_SECRETS_CLEARED,
                                             NM_TYPE_CONNECTION,
                                             G_SIGNAL_RUN_FIRST,
@@ -3370,13 +3370,13 @@ nm_connection_default_init(NMConnectionInterface *iface)
                                             0);
 
     /**
-	 * NMConnection::changed:
-	 * @connection: the object on which the signal is emitted
-	 *
-	 * The ::changed signal is emitted when any property of any property
-	 * (including secrets) of any setting of the connection is modified,
-	 * or when settings are added or removed.
-	 */
+     * NMConnection::changed:
+     * @connection: the object on which the signal is emitted
+     *
+     * The ::changed signal is emitted when any property of any property
+     * (including secrets) of any setting of the connection is modified,
+     * or when settings are added or removed.
+     */
     signals[CHANGED] = g_signal_new(NM_CONNECTION_CHANGED,
                                     NM_TYPE_CONNECTION,
                                     G_SIGNAL_RUN_FIRST,
diff --git a/libnm-core/nm-core-internal.h b/libnm-core/nm-core-internal.h
index a8c1a8eabd..7f2de08969 100644
--- a/libnm-core/nm-core-internal.h
+++ b/libnm-core/nm-core-internal.h
@@ -248,17 +248,17 @@ GVariant *nm_connection_to_dbus_full(NMConnection *                          con
 
 typedef enum {
     /* whether the connection has any secrets.
-	 *
-	 * @arg may be %NULL or a pointer to a gboolean for the result. The return
-	 *   value of _nm_connection_aggregate() is likewise the boolean result. */
+     *
+     * @arg may be %NULL or a pointer to a gboolean for the result. The return
+     *   value of _nm_connection_aggregate() is likewise the boolean result. */
     NM_CONNECTION_AGGREGATE_ANY_SECRETS,
 
     /* whether the connection has any secret with flags NM_SETTING_SECRET_FLAG_NONE.
-	 * Note that this only cares about the flags, not whether the secret is actually
-	 * present.
-	 *
-	 * @arg may be %NULL or a pointer to a gboolean for the result. The return
-	 *   value of _nm_connection_aggregate() is likewise the boolean result. */
+     * Note that this only cares about the flags, not whether the secret is actually
+     * present.
+     *
+     * @arg may be %NULL or a pointer to a gboolean for the result. The return
+     *   value of _nm_connection_aggregate() is likewise the boolean result. */
     NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
 } NMConnectionAggregateType;
 
@@ -724,7 +724,7 @@ typedef struct {
     NMSettInfoPropMissingFromDBusFcn missing_from_dbus_fcn;
 
     /* Simpler variants of @to_dbus_fcn/@from_dbus_fcn that operate solely
-	 * on the GValue value of the GObject property. */
+     * on the GValue value of the GObject property. */
     NMSettInfoPropGPropToDBusFcn   gprop_to_dbus_fcn;
     NMSettInfoPropGPropFromDBusFcn gprop_from_dbus_fcn;
 } NMSettInfoPropertType;
@@ -745,16 +745,16 @@ typedef struct {
 
 typedef struct {
     /* if set, then this setting class has no own fields. Instead, its
-	 * data is entirely based on gendata. Meaning: it tracks all data
-	 * as native GVariants.
-	 * It might have some GObject properties, but these are merely accessors
-	 * to the underlying gendata.
-	 *
-	 * Note, that at the moment there are few hooks, to customize the behavior
-	 * of the setting further. They are currently unneeded. This is desired,
-	 * but could be added when there is a good reason.
-	 *
-	 * However, a few hooks there are... see NMSettInfoSettGendata. */
+     * data is entirely based on gendata. Meaning: it tracks all data
+     * as native GVariants.
+     * It might have some GObject properties, but these are merely accessors
+     * to the underlying gendata.
+     *
+     * Note, that at the moment there are few hooks, to customize the behavior
+     * of the setting further. They are currently unneeded. This is desired,
+     * but could be added when there is a good reason.
+     *
+     * However, a few hooks there are... see NMSettInfoSettGendata. */
     const NMSettInfoSettGendata *gendata_info;
 } NMSettInfoSettDetail;
 
@@ -765,15 +765,15 @@ struct _NMSettInfoSetting {
     const NMSettInfoProperty *property_infos;
 
     /* the @property_infos list is sorted by property name. For some uses we need
-	 * a different sort order. If @property_infos_sorted is set, this is the order
-	 * instead. It is used for:
-	 *
-	 *   - nm_setting_enumerate_values()
-	 *   - keyfile writer adding keys to the group.
-	 *
-	 * Note that currently only NMSettingConnection implements here a sort order
-	 * that differs from alphabetical sort of the property names.
-	 */
+     * a different sort order. If @property_infos_sorted is set, this is the order
+     * instead. It is used for:
+     *
+     *   - nm_setting_enumerate_values()
+     *   - keyfile writer adding keys to the group.
+     *
+     * Note that currently only NMSettingConnection implements here a sort order
+     * that differs from alphabetical sort of the property names.
+     */
     const NMSettInfoProperty *const *property_infos_sorted;
 
     guint                property_infos_len;
diff --git a/libnm-core/nm-crypto-gnutls.c b/libnm-core/nm-crypto-gnutls.c
index a3308f4b79..545cc787e7 100644
--- a/libnm-core/nm-crypto-gnutls.c
+++ b/libnm-core/nm-crypto-gnutls.c
@@ -150,8 +150,8 @@ _nmtst_crypto_decrypt(NMCryptoCipherType cipher,
     }
 
     /* Validate tail padding; last byte is the padding size, and all pad bytes
-	 * should contain the padding size.
-	 */
+     * should contain the padding size.
+     */
     for (pad_i = 1; pad_i <= pad_len; ++pad_i) {
         if (output.bin[data_len - pad_i] != pad_len) {
             g_set_error(error,
@@ -215,8 +215,8 @@ _nmtst_crypto_encrypt(NMCryptoCipherType cipher,
     }
 
     /* If data_len % ivlen == 0, then we add another complete block
-	 * onto the end so that the decrypter knows there's padding.
-	 */
+     * onto the end so that the decrypter knows there's padding.
+     */
     pad_len = iv_len - (data_len % iv_len);
 
     padded_buf.len = data_len + pad_len;
@@ -386,11 +386,11 @@ _nm_crypto_verify_pkcs8(const guint8 *data,
     if (err < 0) {
         if (err == GNUTLS_E_UNKNOWN_CIPHER_TYPE) {
             /* HACK: gnutls < 3.5.4 doesn't support all the cipher types that openssl
-			 * can use with PKCS#8, so if we encounter one, we have to assume
-			 * the given password works.  gnutls needs to unsuckify, apparently.
-			 * Specifically, by default openssl uses pbeWithMD5AndDES-CBC
-			 * which gnutls does not support.
-			 */
+             * can use with PKCS#8, so if we encounter one, we have to assume
+             * the given password works.  gnutls needs to unsuckify, apparently.
+             * Specifically, by default openssl uses pbeWithMD5AndDES-CBC
+             * which gnutls does not support.
+             */
         } else {
             g_set_error(error,
                         NM_CRYPTO_ERROR,
diff --git a/libnm-core/nm-crypto-nss.c b/libnm-core/nm-crypto-nss.c
index 10a7d6e2bc..6b99d548a5 100644
--- a/libnm-core/nm-crypto-nss.c
+++ b/libnm-core/nm-crypto-nss.c
@@ -223,8 +223,8 @@ _nmtst_crypto_decrypt(NMCryptoCipherType cipher,
     }
 
     /* Validate tail padding; last byte is the padding size, and all pad bytes
-	 * should contain the padding size.
-	 */
+     * should contain the padding size.
+     */
     for (i = pad_len; i > 0; i--) {
         if (output.bin[data_len - i] != pad_len) {
             g_set_error(error,
@@ -329,8 +329,8 @@ _nmtst_crypto_encrypt(NMCryptoCipherType cipher,
     }
 
     /* If data->len % ivlen == 0, then we add another complete block
-	 * onto the end so that the decrypter knows there's padding.
-	 */
+     * onto the end so that the decrypter knows there's padding.
+     */
     pad_len = iv_len - (data_len % iv_len);
 
     padded_buf.len = data_len + pad_len;
@@ -419,8 +419,8 @@ _nm_crypto_verify_pkcs12(const guint8 *data, gsize data_len, const char *passwor
         return FALSE;
 
     /* PKCS#12 passwords are apparently UCS2 BIG ENDIAN, and NSS doesn't do
-	 * any conversions for us.
-	 */
+     * any conversions for us.
+     */
     if (password && *password) {
         nm_auto_clear_secret_ptr NMSecretPtr ucs2_password = {0};
 
@@ -522,9 +522,9 @@ _nm_crypto_verify_pkcs8(const guint8 *data,
         return FALSE;
 
     /* NSS apparently doesn't do PKCS#8 natively, but you have to put the
-	 * PKCS#8 key into a PKCS#12 file and import that??  So until we figure
-	 * all that out, we can only assume the password is valid.
-	 */
+     * PKCS#8 key into a PKCS#12 file and import that??  So until we figure
+     * all that out, we can only assume the password is valid.
+     */
     return TRUE;
 }
 
diff --git a/libnm-core/nm-crypto.c b/libnm-core/nm-crypto.c
index 6ba7931737..f0282a0e56 100644
--- a/libnm-core/nm-crypto.c
+++ b/libnm-core/nm-crypto.c
@@ -486,7 +486,7 @@ _nmtst_convert_iv(const char *src, gsize *out_len, GError **error)
     c = g_malloc(num + 1);
 
     /* defensively add trailing NUL. This function returns binary data,
-	 * do not assume it's NUL terminated. */
+     * do not assume it's NUL terminated. */
     c[num] = '\0';
 
     for (i = 0; i < num; i++) {
@@ -1034,11 +1034,11 @@ nmtst_crypto_rsa_key_encrypt(const guint8 *data,
         return NULL;
 
     /* What follows is not the most efficient way to construct the pem
-	 * file line-by-line. At least, it makes sure, that the data will be cleared
-	 * again and not left around in memory.
-	 *
-	 * If this would not be test code, we should improve the implementation
-	 * to avoid some of the copying. */
+     * file line-by-line. At least, it makes sure, that the data will be cleared
+     * again and not left around in memory.
+     *
+     * If this would not be test code, we should improve the implementation
+     * to avoid some of the copying. */
     pem = g_ptr_array_new_with_free_func((GDestroyNotify) nm_free_secret);
 
     g_ptr_array_add(pem, g_strdup("-----BEGIN RSA PRIVATE KEY-----\n"));
diff --git a/libnm-core/nm-dbus-utils.c b/libnm-core/nm-dbus-utils.c
index d95c7f513d..a5ec13a8cf 100644
--- a/libnm-core/nm-dbus-utils.c
+++ b/libnm-core/nm-dbus-utils.c
@@ -173,8 +173,8 @@ _nm_dbus_typecheck_response(GVariant *response, const GVariantType *reply_type,
         return TRUE;
 
     /* This is the same error code that g_dbus_connection_call() returns if
-	 * @reply_type doesn't match.
-	 */
+     * @reply_type doesn't match.
+     */
     g_set_error(error,
                 G_IO_ERROR,
                 G_IO_ERROR_INVALID_ARGUMENT,
diff --git a/libnm-core/nm-keyfile/nm-keyfile-utils.c b/libnm-core/nm-keyfile/nm-keyfile-utils.c
index ad5ce6e807..a27af7eb31 100644
--- a/libnm-core/nm-keyfile/nm-keyfile-utils.c
+++ b/libnm-core/nm-keyfile/nm-keyfile-utils.c
@@ -500,23 +500,23 @@ _keyfile_key_encode(const char *name, char **out_to_free)
     nm_assert(out_to_free && !*out_to_free);
 
     /* See g_key_file_is_key_name().
-	 *
-	 * GKeyFile allows all UTF-8 characters (even non-well formed sequences),
-	 * except:
-	 *  - no empty keys
-	 *  - no leading/trailing ' '
-	 *  - no '=', '[', ']'
-	 *
-	 * We do something more strict here. All non-ASCII characters, all non-printable
-	 * characters, and all invalid characters are escaped with "\\XX".
-	 *
-	 * We don't escape \\, unless it is followed by two hex digits.
-	 */
+     *
+     * GKeyFile allows all UTF-8 characters (even non-well formed sequences),
+     * except:
+     *  - no empty keys
+     *  - no leading/trailing ' '
+     *  - no '=', '[', ']'
+     *
+     * We do something more strict here. All non-ASCII characters, all non-printable
+     * characters, and all invalid characters are escaped with "\\XX".
+     *
+     * We don't escape \\, unless it is followed by two hex digits.
+     */
 
     if (!name[0]) {
         /* empty keys are backslash encoded. Note that usually
-		 * \\00 is not a valid encode, the only exception is the empty
-		 * word. */
+         * \\00 is not a valid encode, the only exception is the empty
+         * word. */
         return "\\00";
     }
 
@@ -646,10 +646,10 @@ nm_keyfile_key_encode(const char *name, char **out_to_free)
 
         name2 = _keyfile_key_decode(key, &to_free2);
         /* name2, the result of encode()+decode() is identical to name.
-		 * That is because
-		 *   - encode() is a injective function.
-		 *   - decode() is a surjective function, however for output
-		 *     values of encode() is behaves injective too. */
+         * That is because
+         *   - encode() is a injective function.
+         *   - decode() is a surjective function, however for output
+         *     values of encode() is behaves injective too. */
         nm_assert(nm_streq0(name2, name));
     }
 #endif
@@ -671,10 +671,10 @@ nm_keyfile_key_decode(const char *key, char **out_to_free)
 
         key2 = _keyfile_key_encode(name, &to_free2);
         /* key2, the result of decode+encode may not be identical
-		 * to the original key. That is, decode() is a surjective
-		 * function mapping different keys to the same name.
-		 * However, decode() behaves injective for input that
-		 * are valid output of encode(). */
+         * to the original key. That is, decode() is a surjective
+         * function mapping different keys to the same name.
+         * However, decode() behaves injective for input that
+         * are valid output of encode(). */
         nm_assert(key2);
     }
 #endif
diff --git a/libnm-core/nm-keyfile/nm-keyfile.c b/libnm-core/nm-keyfile/nm-keyfile.c
index 9117da1175..45059ce3ff 100644
--- a/libnm-core/nm-keyfile/nm-keyfile.c
+++ b/libnm-core/nm-keyfile/nm-keyfile.c
@@ -328,13 +328,13 @@ build_route(KeyfileReaderInfo *info,
     if (gateway_str && gateway_str[0]) {
         if (!nm_utils_ipaddr_is_valid(family, gateway_str)) {
             /* Try workaround for routes written by broken keyfile writer.
-			 * Due to bug bgo#719851, an older version of writer would have
-			 * written "a:b:c:d::/plen,metric" if the gateway was ::, instead
-			 * of "a:b:c:d::/plen,,metric" or "a:b:c:d::/plen,::,metric"
-			 * Try workaround by interpreting gateway_str as metric to accept such
-			 * invalid routes. This broken syntax should not be not officially
-			 * supported.
-			 **/
+             * Due to bug bgo#719851, an older version of writer would have
+             * written "a:b:c:d::/plen,metric" if the gateway was ::, instead
+             * of "a:b:c:d::/plen,,metric" or "a:b:c:d::/plen,::,metric"
+             * Try workaround by interpreting gateway_str as metric to accept such
+             * invalid routes. This broken syntax should not be not officially
+             * supported.
+             **/
             if (family == AF_INET6 && !metric_str
                 && get_one_int(NULL, NULL, NULL, gateway_str, G_MAXUINT32, &u32)) {
                 metric      = u32;
@@ -448,10 +448,10 @@ openconnect_fix_secret_flags(NMSetting *setting)
     NMSettingSecretFlags flags;
 
     /* Huge hack.  There were some openconnect changes that needed to happen
-	 * pretty late, too late to get into distros.  Migration has already
-	 * happened for many people, and their secret flags are wrong.  But we
-	 * don't want to require re-migration, so we have to fix it up here. Ugh.
-	 */
+     * pretty late, too late to get into distros.  Migration has already
+     * happened for many people, and their secret flags are wrong.  But we
+     * don't want to require re-migration, so we have to fix it up here. Ugh.
+     */
 
     if (!NM_IS_SETTING_VPN(setting))
         return;
@@ -728,9 +728,9 @@ static gboolean
 _build_list_data_is_shadowed(const BuildListData *build_list, gsize build_list_len, gsize idx)
 {
     /* the keyfile contains duplicate keys, which are both returned
-	 * by g_key_file_get_keys() (WHY??).
-	 *
-	 * Skip the earlier one. */
+     * by g_key_file_get_keys() (WHY??).
+     *
+     * Skip the earlier one. */
     return idx + 1 < build_list_len && build_list[idx].key_idx == build_list[idx + 1].key_idx
            && build_list[idx].key_type == build_list[idx + 1].key_type
            && nm_streq(build_list[idx].s_key, build_list[idx + 1].s_key);
@@ -758,7 +758,7 @@ _build_list_match_key_w_name_impl(const char *key,
     }
 
     /* if base_name is followed by a zero, then it must be
-	 * only a zero, nothing else. */
+     * only a zero, nothing else. */
     if (key[0] == '0') {
         if (key[1] != '\0')
             return FALSE;
@@ -1232,20 +1232,20 @@ get_bytes(KeyfileReaderInfo *info,
     GBytes *                  result;
 
     /* New format: just a string
-	 * Old format: integer list; e.g. 11;25;38;
-	 */
+     * Old format: integer list; e.g. 11;25;38;
+     */
     tmp_string = nm_keyfile_plugin_kf_get_string(info->keyfile, setting_name, key, NULL);
     if (!tmp_string)
         return NULL;
 
     /* if the string is empty, we return an empty GBytes array.
-	 * Note that for NM_SETTING_802_1X_PASSWORD_RAW both %NULL and
-	 * an empty GBytes are valid, and shall be destinguished. */
+     * Note that for NM_SETTING_802_1X_PASSWORD_RAW both %NULL and
+     * an empty GBytes are valid, and shall be destinguished. */
     if (!tmp_string[0]) {
         /* note that even if @zero_terminate is TRUE, we return an empty
-		 * byte-array. The reason is that zero_terminate is there to terminate
-		 * *valid* strings. It's not there to terminated invalid (empty) strings.
-		 */
+         * byte-array. The reason is that zero_terminate is there to terminate
+         * *valid* strings. It's not there to terminated invalid (empty) strings.
+         */
         return g_bytes_new_static("", 0);
     }
 
@@ -1314,20 +1314,20 @@ get_bytes(KeyfileReaderInfo *info,
 #undef DIGIT
 
         /* Old format; list of ints. We already did a strict validation of the
-		 * string format before. We expect that this conversion cannot fail. */
+         * string format before. We expect that this conversion cannot fail. */
         if (d > 0) {
             /* note that @zero_terminate does not add a terminating '\0' to
-			 * binary data as an integer list. If the bytes are expressed as
-			 * an integer list, all potential NUL characters are supposed to
-			 * be included there explicitly.
-			 *
-			 * However, in the spirit of defensive programming, we do append a
-			 * NUL character to the buffer, although this character is hidden
-			 * and only a mitigation for bugs. */
+             * binary data as an integer list. If the bytes are expressed as
+             * an integer list, all potential NUL characters are supposed to
+             * be included there explicitly.
+             *
+             * However, in the spirit of defensive programming, we do append a
+             * NUL character to the buffer, although this character is hidden
+             * and only a mitigation for bugs. */
 
             if (d + 10 < bin->len) {
                 /* hm, too much unused memory. Copy the memory to a suitable
-				 * sized buffer. */
+                 * sized buffer. */
                 return nm_secret_copy_to_gbytes(bin->bin, d);
             }
 
@@ -1447,7 +1447,7 @@ nm_keyfile_detect_unqualified_path_scheme(const char *  base_dir,
     /* If there's a trailing zero tell g_utf8_validate() to validate until the zero */
     if (data[data_len - 1] == '\0') {
         /* setting it to -1, would mean we accept data to contain NUL characters before the
-		 * end. Don't accept any NUL in [0 .. data_len-1[ . */
+         * end. Don't accept any NUL in [0 .. data_len-1[ . */
         validate_len = data_len - 1;
     } else
         validate_len = data_len;
@@ -1455,14 +1455,14 @@ nm_keyfile_detect_unqualified_path_scheme(const char *  base_dir,
         return NULL;
 
     /* Might be a bare path without the file:// prefix; in that case
-	 * if it's an absolute path, use that, otherwise treat it as a
-	 * relative path to the current directory.
-	 */
+     * if it's an absolute path, use that, otherwise treat it as a
+     * relative path to the current directory.
+     */
 
     path = get_cert_path(base_dir, (const guint8 *) data, data_len);
 
     /* FIXME(keyfile-parse-in-memory): it is wrong that keyfile reader makes decisions based on
-	 * the file systems content. The serialization/parsing should be entirely in-memory. */
+     * the file systems content. The serialization/parsing should be entirely in-memory. */
     if (!memchr(data, '/', data_len) && !has_cert_ext(path)) {
         if (!consider_exists)
             return NULL;
@@ -1473,10 +1473,10 @@ nm_keyfile_detect_unqualified_path_scheme(const char *  base_dir,
         exists = g_file_test(path, G_FILE_TEST_EXISTS);
 
     /* Construct the proper value as required for the PATH scheme.
-	 *
-	 * When returning TRUE, we must also be sure that @data_len does not look like
-	 * the deprecated format of list of integers. With this implementation that is the
-	 * case, as long as @consider_exists is FALSE. */
+     *
+     * When returning TRUE, we must also be sure that @data_len does not look like
+     * the deprecated format of list of integers. With this implementation that is the
+     * case, as long as @consider_exists is FALSE. */
     path_len    = strlen(path);
     pathuri_len = (NM_STRLEN(NM_KEYFILE_CERT_SCHEME_PREFIX_PATH) + 1) + path_len;
     pathuri     = g_new(char, pathuri_len);
@@ -1542,7 +1542,7 @@ cert_parser(KeyfileReaderInfo *info, NMSetting *setting, const char *key)
 
         if (path2[0] != '/') {
             /* we want to read absolute paths because we use keyfile as exchange
-			 * between different processes which might not have the same cwd. */
+             * between different processes which might not have the same cwd. */
             path2_free = get_cert_path(info->base_dir,
                                        (const guint8 *) path2,
                                        bin_len - NM_STRLEN(NM_KEYFILE_CERT_SCHEME_PREFIX_PATH) - 1);
@@ -1550,9 +1550,9 @@ cert_parser(KeyfileReaderInfo *info, NMSetting *setting, const char *key)
         }
 
         /* FIXME(keyfile-parse-in-memory): keyfile reader must not access the file system and
-		 * (in a first step) only operate in memory-only. If the presence of files should be checked,
-		 * then by invoking a callback (and possibly keyfile settings plugin would
-		 * collect the file names to be checked and check them later). */
+         * (in a first step) only operate in memory-only. If the presence of files should be checked,
+         * then by invoking a callback (and possibly keyfile settings plugin would
+         * collect the file names to be checked and check them later). */
         if (!g_file_test(path2, G_FILE_TEST_EXISTS)) {
             handle_warn(info,
                         key,
@@ -1590,7 +1590,7 @@ cert_parser(KeyfileReaderInfo *info, NMSetting *setting, const char *key)
         gs_unref_bytes GBytes *val = NULL;
 
         /* Let's be strict here. We expect valid base64, no funny stuff!!
-		 * We didn't write such invalid data ourselfes and refuse to read it as blob. */
+         * We didn't write such invalid data ourselfes and refuse to read it as blob. */
         if ((valid_base64 = (cdata_len % 4 == 0))) {
             for (i = 0; i < cdata_len; i++) {
                 char c = cdata[i];
@@ -1624,8 +1624,8 @@ cert_parser(KeyfileReaderInfo *info, NMSetting *setting, const char *key)
         if (nm_setting_802_1x_check_cert_scheme(bin_decoded, bin_decoded_len, NULL)
             != NM_SETTING_802_1X_CK_SCHEME_BLOB) {
             /* The blob probably starts with "file://". Setting the cert data will confuse NMSetting8021x.
-			 * In fact this is a limitation of NMSetting8021x which does not support setting blobs that start
-			 * with file://. Just warn and return TRUE to signal that we ~handled~ the setting. */
+             * In fact this is a limitation of NMSetting8021x which does not support setting blobs that start
+             * with file://. Just warn and return TRUE to signal that we ~handled~ the setting. */
             handle_warn(info,
                         key,
                         key,
@@ -1664,9 +1664,9 @@ cert_parser(KeyfileReaderInfo *info, NMSetting *setting, const char *key)
     if (nm_setting_802_1x_check_cert_scheme(bin, bin_len, NULL)
         != NM_SETTING_802_1X_CK_SCHEME_BLOB) {
         /* The blob probably starts with "file://" but contains invalid characters for a path.
-		 * Setting the cert data will confuse NMSetting8021x.
-		 * In fact, NMSetting8021x does not support setting such binary data, so just warn and
-		 * continue. */
+         * Setting the cert data will confuse NMSetting8021x.
+         * In fact, NMSetting8021x does not support setting such binary data, so just warn and
+         * continue. */
         handle_warn(info,
                     key,
                     key,
@@ -1693,17 +1693,17 @@ _parity_from_char(int ch)
             check = 1;
 
             /* In older versions, parity was G_TYPE_CHAR/gint8, and the character
-			 * value was stored as integer.
-			 * For example parity=69 equals parity=E, meaning NM_SETTING_SERIAL_PARITY_EVEN.
-			 *
-			 * That means, certain values are reserved. Assert that these numbers
-			 * are not reused when we extend NMSettingSerialParity enum.
-			 * Actually, since NM_SETTING_SERIAL_PARITY is g_param_spec_enum(),
-			 * we anyway cannot extend the enum without breaking API...
-			 *
-			 * [1] commit "a91e60902e libnm-core: make NMSettingSerial:parity an enum"
-			 * [2] https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=a91e60902eabae1de93d61323dae6ac894b5d40f
-			 */
+             * value was stored as integer.
+             * For example parity=69 equals parity=E, meaning NM_SETTING_SERIAL_PARITY_EVEN.
+             *
+             * That means, certain values are reserved. Assert that these numbers
+             * are not reused when we extend NMSettingSerialParity enum.
+             * Actually, since NM_SETTING_SERIAL_PARITY is g_param_spec_enum(),
+             * we anyway cannot extend the enum without breaking API...
+             *
+             * [1] commit "a91e60902e libnm-core: make NMSettingSerial:parity an enum"
+             * [2] https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=a91e60902eabae1de93d61323dae6ac894b5d40f
+             */
             g_assert(G_IS_ENUM_CLASS(klass));
             for (i = 0; i < klass->n_values; i++) {
                 const GEnumValue *v   = &klass->values[i];
@@ -1741,9 +1741,9 @@ parity_parser(KeyfileReaderInfo *info, NMSetting *setting, const char *key)
     gint64                i64;
 
     /* Keyfile traditionally stored this as the ASCII value for 'E', 'o', or 'n'.
-	 * We now accept either that or the (case-insensitive) character itself (but
-	 * still always write it the old way, for backward compatibility).
-	 */
+     * We now accept either that or the (case-insensitive) character itself (but
+     * still always write it the old way, for backward compatibility).
+     */
     tmp_str = nm_keyfile_plugin_kf_get_value(info->keyfile, setting_name, key, &err);
     if (err)
         goto out_err;
@@ -1759,8 +1759,8 @@ parity_parser(KeyfileReaderInfo *info, NMSetting *setting, const char *key)
     if (i64 != G_MININT64 && errno == 0) {
         if ((parity = _parity_from_char(i64)) >= 0) {
             /* another oddity: the string is a valid number. However, if the numeric values
-			 * is one of the supported ASCII codes, accept it (like 69 for 'E').
-			 */
+             * is one of the supported ASCII codes, accept it (like 69 for 'E').
+             */
             goto parity_good;
         }
 
@@ -2102,10 +2102,10 @@ write_ip_values(GKeyFile *  file,
             nm_str_buf_append_printf(&output, "%s/%u", addr, plen);
             if (metric != -1 || gw) {
                 /* Older versions of the plugin do not support the form
-				 * "a.b.c.d/plen,,metric", so, we always have to write the
-				 * gateway, even if there isn't one.
-				 * The current version supports reading of the above form.
-				 */
+                 * "a.b.c.d/plen,,metric", so, we always have to write the
+                 * gateway, even if there isn't one.
+                 * The current version supports reading of the above form.
+                 */
                 if (!gw) {
                     if (addr_family == AF_INET)
                         gw = "0.0.0.0";
@@ -2370,9 +2370,9 @@ write_hash_of_string(GKeyFile *file, NMSetting *setting, const char *key, const
         property = keys[i];
 
         /* Handle VPN secrets specially; they are nested in the property's hash;
-		 * we don't want to write them if the secret is not saved, not required,
-		 * or owned by a user's secret agent.
-		 */
+         * we don't want to write them if the secret is not saved, not required,
+         * or owned by a user's secret agent.
+         */
         if (vpn_secrets) {
             NMSettingSecretFlags secret_flags = NM_SETTING_SECRET_FLAG_NONE;
 
@@ -2413,8 +2413,8 @@ ssid_writer(KeyfileWriterInfo *info, NMSetting *setting, const char *key, const
     }
 
     /* Check whether each byte is printable.  If not, we have to use an
-	 * integer list, otherwise we can just use a string.
-	 */
+     * integer list, otherwise we can just use a string.
+     */
     for (i = 0; i < ssid_len; i++) {
         const char c = ssid_data[i];
 
@@ -2433,7 +2433,7 @@ ssid_writer(KeyfileWriterInfo *info, NMSetting *setting, const char *key, const
             ssid = g_strndup((char *) ssid_data, ssid_len);
         else {
             /* Escape semicolons with backslashes to make strings
-			 * containing ';', such as '16;17;' unambiguous */
+             * containing ';', such as '16;17;' unambiguous */
             gsize j = 0;
 
             ssid = g_malloc(ssid_len + semicolons + 1);
@@ -2497,8 +2497,8 @@ cert_writer_default(NMConnection *                    connection,
         g_assert(path);
 
         /* If the path is relative, make it an absolute path.
-		 * Relative paths make a keyfile not easily usable in another
-		 * context. */
+         * Relative paths make a keyfile not easily usable in another
+         * context. */
         if (path[0] && path[0] != '/') {
             base_dir  = g_get_current_dir();
             path_free = g_strconcat(base_dir, "/", path, NULL);
@@ -2507,8 +2507,8 @@ cert_writer_default(NMConnection *                    connection,
             base_dir = g_path_get_dirname(path);
 
         /* path cannot start with "file://" or "data:;base64,", because it is an absolute path.
-		 * Still, make sure that a prefix-less path will be recognized. This can happen
-		 * for example if the path is longer then 500 chars. */
+         * Still, make sure that a prefix-less path will be recognized. This can happen
+         * for example if the path is longer then 500 chars. */
         tmp = nm_keyfile_detect_unqualified_path_scheme(base_dir, path, -1, FALSE, NULL);
         if (tmp)
             nm_clear_g_free(&tmp);
@@ -2518,7 +2518,7 @@ cert_writer_default(NMConnection *                    connection,
         }
 
         /* Path contains at least a '/', hence it cannot be recognized as the old
-		 * binary format consisting of a list of integers. */
+         * binary format consisting of a list of integers. */
 
         nm_keyfile_plugin_kf_set_string(file, setting_name, vtable->setting_key, path);
     } else if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) {
@@ -2543,11 +2543,11 @@ cert_writer_default(NMConnection *                    connection,
                                         vtable->uri_func(setting));
     } else {
         /* scheme_func() returns UNKNOWN in all other cases. The only valid case
-		 * where a scheme is allowed to be UNKNOWN, is unsetting the value. In this
-		 * case, we don't expect the writer to be called, because the default value
-		 * will not be serialized.
-		 * The only other reason for the scheme to be UNKNOWN is an invalid cert.
-		 * But our connection verifies, so that cannot happen either. */
+         * where a scheme is allowed to be UNKNOWN, is unsetting the value. In this
+         * case, we don't expect the writer to be called, because the default value
+         * will not be serialized.
+         * The only other reason for the scheme to be UNKNOWN is an invalid cert.
+         * But our connection verifies, so that cannot happen either. */
         g_return_if_reached();
     }
 }
@@ -2631,8 +2631,8 @@ struct _ParseInfoProperty {
     bool has_parser_full : 1;
 
     /* usually, we skip to write values that have their
-	 * default value. By setting this flag to TRUE, also
-	 * default values are written. */
+     * default value. By setting this flag to TRUE, also
+     * default values are written. */
     bool writer_persist_default : 1;
 };
 
@@ -3021,10 +3021,10 @@ read_one_setting_value(KeyfileReaderInfo *       info,
               == G_PARAM_WRITABLE);
 
     /* Check for the exact key in the GKeyFile if required.  Most setting
-	 * properties map 1:1 to a key in the GKeyFile, but for those properties
-	 * like IP addresses and routes where more than one value is actually
-	 * encoded by the setting property, this won't be true.
-	 */
+     * properties map 1:1 to a key in the GKeyFile, but for those properties
+     * like IP addresses and routes where more than one value is actually
+     * encoded by the setting property, this won't be true.
+     */
     if ((!pip || !pip->parser_no_check_key)
         && !nm_keyfile_plugin_kf_has_key(keyfile, setting_info->setting_name, key, &err)) {
         /* Key doesn't exist or an error occurred, thus nothing to do. */
@@ -3262,17 +3262,17 @@ _read_setting(KeyfileReaderInfo *info)
                 GVariant *            variant;
 
                 /* a GKeyFile can return duplicate keys, there is just no API to make sense
-				 * of them. Skip them. */
+                 * of them. Skip them. */
                 if (k + 1 < n_keys && nm_streq(key, keys[k + 1]))
                     continue;
 
                 /* currently, the API is very simple. The setting class just returns
-				 * the desired variant type, and keyfile reader will try to parse
-				 * it accordingly. Note, that this does currently not allow, that
-				 * a particular key can contain different variant types, nor is it
-				 * very flexible in general.
-				 *
-				 * We add flexibility when we need it. Keep it simple for now. */
+                 * the desired variant type, and keyfile reader will try to parse
+                 * it accordingly. Note, that this does currently not allow, that
+                 * a particular key can contain different variant types, nor is it
+                 * very flexible in general.
+                 *
+                 * We add flexibility when we need it. Keep it simple for now. */
                 variant_type =
                     sett_info->detail.gendata_info->get_variant_type(sett_info, key, &local);
                 if (!variant_type) {
@@ -3365,7 +3365,7 @@ _read_setting_wireguard_peer(KeyfileReaderInfo *info)
     if (!nm_utils_base64secret_normalize(cstr, NM_WIREGUARD_PUBLIC_KEY_LEN, &str)
         || !nm_streq0(str, cstr)) {
         /* the group name must be identical to the normalized(!) key, so that it
-		 * is uniquely identified. */
+         * is uniquely identified. */
         handle_warn(info,
                     NULL,
                     NM_SETTING_WIREGUARD_PEERS,
@@ -3518,7 +3518,7 @@ _read_setting_vpn_secrets(KeyfileReaderInfo *info)
     s_vpn = nm_connection_get_setting_vpn(info->connection);
     if (!s_vpn) {
         /* if we don't also have a [vpn] section (which must be parsed earlier),
-		 * we don't do anything. */
+         * we don't do anything. */
         nm_assert(!g_key_file_has_group(info->keyfile, "vpn"));
         return;
     }
@@ -3654,8 +3654,8 @@ nm_keyfile_read(GKeyFile *            keyfile,
     }
 
     /* Make sure that we have 'interface-name' even if it was specified in the
-	 * "wrong" (ie, deprecated) group.
-	 */
+     * "wrong" (ie, deprecated) group.
+     */
     if (!nm_setting_connection_get_interface_name(s_con)
         && nm_setting_connection_get_connection_type(s_con)) {
         gs_free char *interface_name = NULL;
@@ -3708,13 +3708,13 @@ write_setting_value(KeyfileWriterInfo *       info,
     if (!pip) {
         if (!setting_info) {
             /* the setting type is unknown. That is highly unexpected
-			 * (and as this is currently only called from NetworkManager
-			 * daemon, not possible).
-			 *
-			 * Still, handle it gracefully, because later keyfile writer will become
-			 * public API of libnm, where @setting is (untrusted) user input.
-			 *
-			 * Gracefully here just means: ignore the setting. */
+             * (and as this is currently only called from NetworkManager
+             * daemon, not possible).
+             *
+             * Still, handle it gracefully, because later keyfile writer will become
+             * public API of libnm, where @setting is (untrusted) user input.
+             *
+             * Gracefully here just means: ignore the setting. */
             return;
         }
         if (!property_info->param_spec)
@@ -3733,10 +3733,10 @@ write_setting_value(KeyfileWriterInfo *       info,
     nm_assert(property_info->param_spec);
 
     /* Don't write secrets that are owned by user secret agents or aren't
-	 * supposed to be saved.  VPN secrets are handled specially though since
-	 * the secret flags there are in a third-level hash in the 'secrets'
-	 * property.
-	 */
+     * supposed to be saved.  VPN secrets are handled specially though since
+     * the secret flags there are in a third-level hash in the 'secrets'
+     * property.
+     */
     if ((property_info->param_spec->flags & NM_SETTING_PARAM_SECRET)
         && !NM_IS_SETTING_VPN(setting)) {
         NMSettingSecretFlags secret_flags = NM_SETTING_SECRET_FLAG_NONE;
@@ -3885,9 +3885,9 @@ _write_setting_wireguard(NMSetting *setting, KeyfileWriterInfo *info)
         }
 
         /* usually, we don't persist the secret-flags 0 (because they are the default).
-		 * For WireGuard peers, the default secret-flags for preshared-key are 4 (not-required).
-		 * So, in this case behave differently: a missing preshared-key-flag setting means
-		 * "not-required". */
+         * For WireGuard peers, the default secret-flags for preshared-key are 4 (not-required).
+         * So, in this case behave differently: a missing preshared-key-flag setting means
+         * "not-required". */
         if (secret_flags != NM_SETTING_SECRET_FLAG_NOT_REQUIRED) {
             g_key_file_set_int64(info->keyfile,
                                  group,
@@ -3998,9 +3998,9 @@ nm_keyfile_write(NMConnection *        connection,
                                               (guint64) g_variant_get_uint32(v));
                     } else {
                         /* BUG: The variant type is not implemented. Since the connection
-						 * verifies, this can only mean we either wrongly didn't reject
-						 * the connection as invalid, or we didn't properly implement the
-						 * variant type. */
+                         * verifies, this can only mean we either wrongly didn't reject
+                         * the connection as invalid, or we didn't properly implement the
+                         * variant type. */
                         nm_assert_not_reached();
                         continue;
                     }
@@ -4023,7 +4023,7 @@ nm_keyfile_write(NMConnection *        connection,
             /* we have a section for the setting. Nothing to do. */
         } else {
             /* ensure the group is present. There is no API for that, so add and remove
-			 * a dummy key. */
+             * a dummy key. */
             g_key_file_set_value(info.keyfile, setting_alias ?: setting_name, ".X", "1");
             g_key_file_remove_key(info.keyfile, setting_alias ?: setting_name, ".X", NULL);
         }
@@ -4090,8 +4090,8 @@ nm_keyfile_utils_ignore_filename(const char *filename, gboolean require_extensio
 
     if (!base[0]) {
         /* this check above with strrchr() also rejects "/some/path/with/trailing/slash/",
-		 * but that is fine, because such a path would name a directory, and we are not
-		 * interested in directories. */
+         * but that is fine, because such a path would name a directory, and we are not
+         * interested in directories. */
         return TRUE;
     }
 
@@ -4113,9 +4113,9 @@ nm_keyfile_utils_ignore_filename(const char *filename, gboolean require_extensio
         return TRUE;
 
     /* Ignore temporary files
-	 *
-	 * This check is also important to ignore .nmload files (see
-	 * %NM_KEYFILE_PATH_SUFFIX_NMMETA). */
+     *
+     * This check is also important to ignore .nmload files (see
+     * %NM_KEYFILE_PATH_SUFFIX_NMMETA). */
     if (check_mkstemp_suffix(base))
         return TRUE;
 
@@ -4131,9 +4131,9 @@ char *
 nm_keyfile_utils_create_filename(const char *name, gboolean with_extension)
 {
     /* keyfile used to escape with '*', do not change that behavior.
-	 *
-	 * But for newly added escapings, use '_' instead.
-	 * Also, @with_extension is new-style. */
+     *
+     * But for newly added escapings, use '_' instead.
+     * Also, @with_extension is new-style. */
     const char ESCAPE_CHAR  = with_extension ? '_' : '*';
     const char ESCAPE_CHAR2 = '_';
     NMStrBuf   str;
@@ -4156,7 +4156,7 @@ nm_keyfile_utils_create_filename(const char *name, gboolean with_extension)
     }
 
     /* nm_keyfile_utils_create_filename() must avoid anything that ignore_filename() would reject.
-	 * We can escape here more aggressively then what we would read back. */
+     * We can escape here more aggressively then what we would read back. */
     if (p[0] == '.')
         p[0] = ESCAPE_CHAR2;
     if (p[str.len - 1] == '~')
@@ -4241,8 +4241,8 @@ _nm_keyfile_handler_data_warn_get_message(const NMKeyfileHandlerData *handler_da
 
     if (!handler_data->warn.message) {
         /* we cast the const away. @handler_data is const w.r.t. visible mutations
-		 * from POV of the user. Internally, we construct the message in
-		 * a lazy manner. It's like a mutable field in C++. */
+         * from POV of the user. Internally, we construct the message in
+         * a lazy manner. It's like a mutable field in C++. */
         NM_PRAGMA_WARNING_DISABLE("-Wformat-nonliteral")
         ((NMKeyfileHandlerData *) handler_data)->warn.message =
             g_strdup_vprintf(handler_data->warn.fmt,
diff --git a/libnm-core/nm-libnm-core-intern/nm-auth-subject.c b/libnm-core/nm-libnm-core-intern/nm-auth-subject.c
index ad77e87b81..68714a3f84 100644
--- a/libnm-core/nm-libnm-core-intern/nm-auth-subject.c
+++ b/libnm-core/nm-libnm-core-intern/nm-auth-subject.c
@@ -360,12 +360,12 @@ constructed(GObject *object)
         return;
     case NM_AUTH_SUBJECT_TYPE_UNIX_PROCESS:
         /* Ensure pid and uid to be representable as int32.
-		 * DBUS treats them as uint32, polkit library as int. */
+         * DBUS treats them as uint32, polkit library as int. */
         if (priv->unix_process.pid > MIN(G_MAXINT, G_MAXINT32))
             break;
         if (priv->unix_process.uid > MIN(G_MAXINT, G_MAXINT32)) {
             /* for uid==-1, libpolkit-gobject-1 detects the user based on the process id.
-			 * Don't bother and require the user id as parameter. */
+             * Don't bother and require the user id as parameter. */
             break;
         }
 
@@ -374,17 +374,17 @@ constructed(GObject *object)
 
         if (!priv->unix_process.start_time) {
             /* Is the process already gone? Then fail creation of the auth subject
-			 * by clearing the type. */
+             * by clearing the type. */
             if (kill(priv->unix_process.pid, 0) != 0)
                 _clear_private(self);
 
             /* Otherwise, although we didn't detect a start_time, the process is still around.
-			 * That could be due to procfs mounted with hidepid. So just accept the request.
-			 *
-			 * Polkit on the other side, will accept 0 and try to lookup /proc/$PID/stat
-			 * itself (and if it fails to do so, assume a start-time of 0 and proceed).
-			 * The only combination that would fail here, is when NM is able to read the
-			 * start-time, but polkit is not. */
+             * That could be due to procfs mounted with hidepid. So just accept the request.
+             *
+             * Polkit on the other side, will accept 0 and try to lookup /proc/$PID/stat
+             * itself (and if it fails to do so, assume a start-time of 0 and proceed).
+             * The only combination that would fail here, is when NM is able to read the
+             * start-time, but polkit is not. */
         }
         return;
     case NM_AUTH_SUBJECT_TYPE_UNIX_SESSION:
diff --git a/libnm-core/nm-libnm-core-intern/nm-ethtool-utils.c b/libnm-core/nm-libnm-core-intern/nm-ethtool-utils.c
index 4cf8b1f447..a3a908f4fc 100644
--- a/libnm-core/nm-libnm-core-intern/nm-ethtool-utils.c
+++ b/libnm-core/nm-libnm-core-intern/nm-ethtool-utils.c
@@ -218,8 +218,8 @@ _ASSERT_data(void)
         d = nm_ethtool_data[id];
         if (i > 0) {
             /* since we assert that all optnames are sorted strictly monotonically increasing,
-			 * it also follows that there are no duplicates in the _by_name.
-			 * It also follows, that all names in nm_ethtool_data are unique. */
+             * it also follows that there are no duplicates in the _by_name.
+             * It also follows, that all names in nm_ethtool_data are unique. */
             if (strcmp(nm_ethtool_data[_by_name[i - 1]]->optname, d->optname) >= 0) {
                 g_error("nm_ethtool_data is not sorted asciibetically: %u/%s should be after %u/%s",
                         i - 1,
diff --git a/libnm-core/nm-setting-6lowpan.c b/libnm-core/nm-setting-6lowpan.c
index 4c4d87ab5e..504ba084fc 100644
--- a/libnm-core/nm-setting-6lowpan.c
+++ b/libnm-core/nm-setting-6lowpan.c
@@ -85,8 +85,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
 
     if (nm_utils_is_uuid(priv->parent)) {
         /* If we have an NMSettingConnection:master with slave-type="6lowpan",
-		 * then it must be the same UUID.
-		 */
+         * then it must be the same UUID.
+         */
         if (s_con) {
             const char *master = NULL, *slave_type = NULL;
 
@@ -208,13 +208,13 @@ nm_setting_6lowpan_class_init(NMSetting6LowpanClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSetting6Lowpan:parent:
-	 *
-	 * If given, specifies the parent interface name or parent connection UUID
-	 * from which this 6LowPAN interface should be created.
-	 *
-	 * Since: 1.14
-	 **/
+     * NMSetting6Lowpan:parent:
+     *
+     * If given, specifies the parent interface name or parent connection UUID
+     * from which this 6LowPAN interface should be created.
+     *
+     * Since: 1.14
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_string(
         NM_SETTING_6LOWPAN_PARENT,
         "",
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c
index 3d3699eedb..94da6c75b1 100644
--- a/libnm-core/nm-setting-8021x.c
+++ b/libnm-core/nm-setting-8021x.c
@@ -238,10 +238,10 @@ nm_setting_802_1x_check_cert_scheme(gconstpointer pdata, gsize length, GError **
 
     if (scheme != NM_SETTING_802_1X_CK_SCHEME_BLOB) {
         /* An actual URI must be NUL terminated, contain at least
-		 * one non-NUL character, and contain only one trailing NUL
-		 * character.
-		 * And ensure it's UTF-8 valid too so we can pass it through
-		 * D-Bus and stuff like that. */
+         * one non-NUL character, and contain only one trailing NUL
+         * character.
+         * And ensure it's UTF-8 valid too so we can pass it through
+         * D-Bus and stuff like that. */
 
         if (data[length - 1] != '\0') {
             g_set_error_literal(error,
@@ -575,8 +575,8 @@ _cert_impl_set(NMSetting8021x *        setting,
     }
 
     /* As required by NM and wpa_supplicant, set the client-cert
-	 * property to the same PKCS#12 data.
-	 */
+     * property to the same PKCS#12 data.
+     */
     if (cert && p_client_cert && format == NM_CRYPTO_FILE_FORMAT_PKCS12
         && !nm_gbytes_equal0(cert, *p_client_cert)) {
         g_bytes_unref(*p_client_cert);
@@ -3121,8 +3121,8 @@ need_secrets(NMSetting *setting)
                 (*eap_methods_table[i].ns_func)(self, secrets, FALSE);
 
                 /* Only break out of the outer loop if this EAP method
-				 * needed secrets.
-				 */
+                 * needed secrets.
+                 */
                 if (secrets->len > 0)
                     eap_method_found = TRUE;
                 break;
@@ -3560,22 +3560,22 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
     setting_class->need_secrets = need_secrets;
 
     /**
-	 * NMSetting8021x:eap:
-	 *
-	 * The allowed EAP method to be used when authenticating to the network with
-	 * 802.1x.  Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd",
-	 * and "fast".  Each method requires different configuration using the
-	 * properties of this setting; refer to wpa_supplicant documentation for the
-	 * allowed combinations.
-	 **/
+     * NMSetting8021x:eap:
+     *
+     * The allowed EAP method to be used when authenticating to the network with
+     * 802.1x.  Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd",
+     * and "fast".  Each method requires different configuration using the
+     * properties of this setting; refer to wpa_supplicant documentation for the
+     * allowed combinations.
+     **/
     /* ---ifcfg-rh---
-	 * property: eap
-	 * variable: IEEE_8021X_EAP_METHODS(+)
-	 * values: "LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST"
-	 * description: EAP method for 802.1X authentication.
-	 * example: IEEE_8021X_EAP_METHODS=PEAP
-	 * ---end---
-	 */
+     * property: eap
+     * variable: IEEE_8021X_EAP_METHODS(+)
+     * values: "LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST"
+     * description: EAP method for 802.1X authentication.
+     * example: IEEE_8021X_EAP_METHODS=PEAP
+     * ---end---
+     */
     obj_properties[PROP_EAP] = g_param_spec_boxed(NM_SETTING_802_1X_EAP,
                                                   "",
                                                   "",
@@ -3583,18 +3583,18 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                                                   G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:identity:
-	 *
-	 * Identity string for EAP authentication methods.  Often the user's user or
-	 * login name.
-	 **/
+     * NMSetting8021x:identity:
+     *
+     * Identity string for EAP authentication methods.  Often the user's user or
+     * login name.
+     **/
     /* ---ifcfg-rh---
-	 * property: identity
-	 * variable: IEEE_8021X_IDENTITY(+)
-	 * description: Identity for EAP authentication methods.
-	 * example: IEEE_8021X_IDENTITY=itsme
-	 * ---end---
-	 */
+     * property: identity
+     * variable: IEEE_8021X_IDENTITY(+)
+     * description: Identity for EAP authentication methods.
+     * example: IEEE_8021X_IDENTITY=itsme
+     * ---end---
+     */
     obj_properties[PROP_IDENTITY] = g_param_spec_string(NM_SETTING_802_1X_IDENTITY,
                                                         "",
                                                         "",
@@ -3602,18 +3602,18 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:anonymous-identity:
-	 *
-	 * Anonymous identity string for EAP authentication methods.  Used as the
-	 * unencrypted identity with EAP types that support different tunneled
-	 * identity like EAP-TTLS.
-	 **/
+     * NMSetting8021x:anonymous-identity:
+     *
+     * Anonymous identity string for EAP authentication methods.  Used as the
+     * unencrypted identity with EAP types that support different tunneled
+     * identity like EAP-TTLS.
+     **/
     /* ---ifcfg-rh---
-	 * property: anonymous-identity
-	 * variable: IEEE_8021X_ANON_IDENTITY(+)
-	 * description: Anonymous identity for EAP authentication methods.
-	 * ---end---
-	 */
+     * property: anonymous-identity
+     * variable: IEEE_8021X_ANON_IDENTITY(+)
+     * description: Anonymous identity for EAP authentication methods.
+     * ---end---
+     */
     obj_properties[PROP_ANONYMOUS_IDENTITY] =
         g_param_spec_string(NM_SETTING_802_1X_ANONYMOUS_IDENTITY,
                             "",
@@ -3622,17 +3622,17 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:pac-file:
-	 *
-	 * UTF-8 encoded file path containing PAC for EAP-FAST.
-	 **/
+     * NMSetting8021x:pac-file:
+     *
+     * UTF-8 encoded file path containing PAC for EAP-FAST.
+     **/
     /* ---ifcfg-rh---
-	 * property: pac-file
-	 * variable: IEEE_8021X_PAC_FILE(+)
-	 * description: File with PAC (Protected Access Credential) for EAP-FAST.
-	 * example: IEEE_8021X_PAC_FILE=/home/joe/my-fast.pac
-	 * ---end---
-	 */
+     * property: pac-file
+     * variable: IEEE_8021X_PAC_FILE(+)
+     * description: File with PAC (Protected Access Credential) for EAP-FAST.
+     * example: IEEE_8021X_PAC_FILE=/home/joe/my-fast.pac
+     * ---end---
+     */
     obj_properties[PROP_PAC_FILE] = g_param_spec_string(NM_SETTING_802_1X_PAC_FILE,
                                                         "",
                                                         "",
@@ -3640,33 +3640,33 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:ca-cert:
-	 *
-	 * Contains the CA certificate if used by the EAP method specified in the
-	 * #NMSetting8021x:eap property.
-	 *
-	 * Certificate data is specified using a "scheme"; three are currently
-	 * supported: blob, path and pkcs#11 URL. When using the blob scheme this property
-	 * should be set to the certificate's DER encoded data. When using the path
-	 * scheme, this property should be set to the full UTF-8 encoded path of the
-	 * certificate, prefixed with the string "file://" and ending with a terminating
-	 * NUL byte.
-	 * This property can be unset even if the EAP method supports CA certificates,
-	 * but this allows man-in-the-middle attacks and is NOT recommended.
-	 *
-	 * Note that enabling NMSetting8021x:system-ca-certs will override this
-	 * setting to use the built-in path, if the built-in path is not a directory.
-	 *
-	 * Setting this property directly is discouraged; use the
-	 * nm_setting_802_1x_set_ca_cert() function instead.
-	 **/
+     * NMSetting8021x:ca-cert:
+     *
+     * Contains the CA certificate if used by the EAP method specified in the
+     * #NMSetting8021x:eap property.
+     *
+     * Certificate data is specified using a "scheme"; three are currently
+     * supported: blob, path and pkcs#11 URL. When using the blob scheme this property
+     * should be set to the certificate's DER encoded data. When using the path
+     * scheme, this property should be set to the full UTF-8 encoded path of the
+     * certificate, prefixed with the string "file://" and ending with a terminating
+     * NUL byte.
+     * This property can be unset even if the EAP method supports CA certificates,
+     * but this allows man-in-the-middle attacks and is NOT recommended.
+     *
+     * Note that enabling NMSetting8021x:system-ca-certs will override this
+     * setting to use the built-in path, if the built-in path is not a directory.
+     *
+     * Setting this property directly is discouraged; use the
+     * nm_setting_802_1x_set_ca_cert() function instead.
+     **/
     /* ---ifcfg-rh---
-	 * property: ca-cert
-	 * variable: IEEE_8021X_CA_CERT(+)
-	 * description: CA certificate for EAP.
-	 * example: IEEE_8021X_CA_CERT=/home/joe/cacert.crt
-	 * ---end---
-	 */
+     * property: ca-cert
+     * variable: IEEE_8021X_CA_CERT(+)
+     * description: CA certificate for EAP.
+     * example: IEEE_8021X_CA_CERT=/home/joe/cacert.crt
+     * ---end---
+     */
     obj_properties[PROP_CA_CERT] = g_param_spec_boxed(NM_SETTING_802_1X_CA_CERT,
                                                       "",
                                                       "",
@@ -3674,17 +3674,17 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:ca-cert-password:
-	 *
-	 * The password used to access the CA certificate stored in
-	 * #NMSetting8021x:ca-cert property. Only makes sense if the certificate
-	 * is stored on a PKCS#<!-- -->11 token that requires a login.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:ca-cert-password:
+     *
+     * The password used to access the CA certificate stored in
+     * #NMSetting8021x:ca-cert property. Only makes sense if the certificate
+     * is stored on a PKCS#<!-- -->11 token that requires a login.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * ---end---
-	 */
+     * ---end---
+     */
     obj_properties[PROP_CA_CERT_PASSWORD] =
         g_param_spec_string(NM_SETTING_802_1X_CA_CERT_PASSWORD,
                             "",
@@ -3693,15 +3693,15 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:ca-cert-password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSetting8021x:ca-cert-password property.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:ca-cert-password-flags:
+     *
+     * Flags indicating how to handle the #NMSetting8021x:ca-cert-password property.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * ---end---
-	 */
+     * ---end---
+     */
     obj_properties[PROP_CA_CERT_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_802_1X_CA_CERT_PASSWORD_FLAGS,
                            "",
@@ -3711,21 +3711,21 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:ca-path:
-	 *
-	 * UTF-8 encoded path to a directory containing PEM or DER formatted
-	 * certificates to be added to the verification chain in addition to the
-	 * certificate specified in the #NMSetting8021x:ca-cert property.
-	 *
-	 * If NMSetting8021x:system-ca-certs is enabled and the built-in CA
-	 * path is an existing directory, then this setting is ignored.
-	 **/
+     * NMSetting8021x:ca-path:
+     *
+     * UTF-8 encoded path to a directory containing PEM or DER formatted
+     * certificates to be added to the verification chain in addition to the
+     * certificate specified in the #NMSetting8021x:ca-cert property.
+     *
+     * If NMSetting8021x:system-ca-certs is enabled and the built-in CA
+     * path is an existing directory, then this setting is ignored.
+     **/
     /* ---ifcfg-rh---
-	 * property: ca-path
-	 * variable: IEEE_8021X_CA_PATH(+)
-	 * description: The search path for the certificate.
-	 * ---end---
-	 */
+     * property: ca-path
+     * variable: IEEE_8021X_CA_PATH(+)
+     * description: The search path for the certificate.
+     * ---end---
+     */
     obj_properties[PROP_CA_PATH] = g_param_spec_string(NM_SETTING_802_1X_CA_PATH,
                                                        "",
                                                        "",
@@ -3733,21 +3733,21 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:subject-match:
-	 *
-	 * Substring to be matched against the subject of the certificate presented
-	 * by the authentication server. When unset, no verification of the
-	 * authentication server certificate's subject is performed.  This property
-	 * provides little security, if any, and its use is deprecated in favor of
-	 * NMSetting8021x:domain-suffix-match.
-	 **/
+     * NMSetting8021x:subject-match:
+     *
+     * Substring to be matched against the subject of the certificate presented
+     * by the authentication server. When unset, no verification of the
+     * authentication server certificate's subject is performed.  This property
+     * provides little security, if any, and its use is deprecated in favor of
+     * NMSetting8021x:domain-suffix-match.
+     **/
     /* ---ifcfg-rh---
-	 * property: subject-match
-	 * variable: IEEE_8021X_SUBJECT_MATCH(+)
-	 * description: Substring to match subject of server certificate against.
-	 * example: IEEE_8021X_SUBJECT_MATCH="Red Hat"
-	 * ---end---
-	 */
+     * property: subject-match
+     * variable: IEEE_8021X_SUBJECT_MATCH(+)
+     * description: Substring to match subject of server certificate against.
+     * example: IEEE_8021X_SUBJECT_MATCH="Red Hat"
+     * ---end---
+     */
     obj_properties[PROP_SUBJECT_MATCH] =
         g_param_spec_string(NM_SETTING_802_1X_SUBJECT_MATCH,
                             "",
@@ -3756,19 +3756,19 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:altsubject-matches:
-	 *
-	 * List of strings to be matched against the altSubjectName of the
-	 * certificate presented by the authentication server. If the list is empty,
-	 * no verification of the server certificate's altSubjectName is performed.
-	 **/
+     * NMSetting8021x:altsubject-matches:
+     *
+     * List of strings to be matched against the altSubjectName of the
+     * certificate presented by the authentication server. If the list is empty,
+     * no verification of the server certificate's altSubjectName is performed.
+     **/
     /* ---ifcfg-rh---
-	 * property: altsubject-matches
-	 * variable: IEEE_8021X_ALTSUBJECT_MATCHES(+)
-	 * description: List of strings to be matched against the altSubjectName.
-	 * example: IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc"
-	 * ---end---
-	 */
+     * property: altsubject-matches
+     * variable: IEEE_8021X_ALTSUBJECT_MATCHES(+)
+     * description: List of strings to be matched against the altSubjectName.
+     * example: IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc"
+     * ---end---
+     */
     obj_properties[PROP_ALTSUBJECT_MATCHES] =
         g_param_spec_boxed(NM_SETTING_802_1X_ALTSUBJECT_MATCHES,
                            "",
@@ -3777,24 +3777,24 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:domain-suffix-match:
-	 *
-	 * Constraint for server domain name. If set, this FQDN is used as a suffix
-	 * match requirement for dNSName element(s) of the certificate presented by
-	 * the authentication server.  If a matching dNSName is found, this
-	 * constraint is met.  If no dNSName values are present, this constraint is
-	 * matched against SubjectName CN using same suffix match comparison.
-	 * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited
-	 * list.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSetting8021x:domain-suffix-match:
+     *
+     * Constraint for server domain name. If set, this FQDN is used as a suffix
+     * match requirement for dNSName element(s) of the certificate presented by
+     * the authentication server.  If a matching dNSName is found, this
+     * constraint is met.  If no dNSName values are present, this constraint is
+     * matched against SubjectName CN using same suffix match comparison.
+     * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited
+     * list.
+     *
+     * Since: 1.2
+     **/
     /* ---ifcfg-rh---
-	 * property: domain-suffix-match
-	 * description: Suffix to match domain of server certificate against.
-	 * variable: IEEE_8021X_DOMAIN_SUFFIX_MATCH(+)
-	 * ---end---
-	 */
+     * property: domain-suffix-match
+     * description: Suffix to match domain of server certificate against.
+     * variable: IEEE_8021X_DOMAIN_SUFFIX_MATCH(+)
+     * ---end---
+     */
     obj_properties[PROP_DOMAIN_SUFFIX_MATCH] =
         g_param_spec_string(NM_SETTING_802_1X_DOMAIN_SUFFIX_MATCH,
                             "",
@@ -3803,23 +3803,23 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:domain-match:
-	 *
-	 * Constraint for server domain name. If set, this list of FQDNs is used as
-	 * a match requirement for dNSName element(s) of the certificate presented
-	 * by the authentication server.  If a matching dNSName is found, this
-	 * constraint is met.  If no dNSName values are present, this constraint is
-	 * matched against SubjectName CN using the same comparison.
-	 * Multiple valid FQDNs can be passed as a ";" delimited list.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMSetting8021x:domain-match:
+     *
+     * Constraint for server domain name. If set, this list of FQDNs is used as
+     * a match requirement for dNSName element(s) of the certificate presented
+     * by the authentication server.  If a matching dNSName is found, this
+     * constraint is met.  If no dNSName values are present, this constraint is
+     * matched against SubjectName CN using the same comparison.
+     * Multiple valid FQDNs can be passed as a ";" delimited list.
+     *
+     * Since: 1.24
+     **/
     /* ---ifcfg-rh---
-	 * property: domain-match
-	 * description: Value to match domain of server certificate against.
-	 * variable: IEEE_8021X_DOMAIN_MATCH(+)
-	 * ---end---
-	 */
+     * property: domain-match
+     * description: Value to match domain of server certificate against.
+     * variable: IEEE_8021X_DOMAIN_MATCH(+)
+     * ---end---
+     */
     obj_properties[PROP_DOMAIN_MATCH] =
         g_param_spec_string(NM_SETTING_802_1X_DOMAIN_MATCH,
                             "",
@@ -3828,28 +3828,28 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:client-cert:
-	 *
-	 * Contains the client certificate if used by the EAP method specified in
-	 * the #NMSetting8021x:eap property.
-	 *
-	 * Certificate data is specified using a "scheme"; two are currently
-	 * supported: blob and path. When using the blob scheme (which is backwards
-	 * compatible with NM 0.7.x) this property should be set to the
-	 * certificate's DER encoded data. When using the path scheme, this property
-	 * should be set to the full UTF-8 encoded path of the certificate, prefixed
-	 * with the string "file://" and ending with a terminating NUL byte.
-	 *
-	 * Setting this property directly is discouraged; use the
-	 * nm_setting_802_1x_set_client_cert() function instead.
-	 **/
+     * NMSetting8021x:client-cert:
+     *
+     * Contains the client certificate if used by the EAP method specified in
+     * the #NMSetting8021x:eap property.
+     *
+     * Certificate data is specified using a "scheme"; two are currently
+     * supported: blob and path. When using the blob scheme (which is backwards
+     * compatible with NM 0.7.x) this property should be set to the
+     * certificate's DER encoded data. When using the path scheme, this property
+     * should be set to the full UTF-8 encoded path of the certificate, prefixed
+     * with the string "file://" and ending with a terminating NUL byte.
+     *
+     * Setting this property directly is discouraged; use the
+     * nm_setting_802_1x_set_client_cert() function instead.
+     **/
     /* ---ifcfg-rh---
-	 * property: client-cert
-	 * variable: IEEE_8021X_CLIENT_CERT(+)
-	 * description: Client certificate for EAP.
-	 * example: IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crt
-	 * ---end---
-	 */
+     * property: client-cert
+     * variable: IEEE_8021X_CLIENT_CERT(+)
+     * description: Client certificate for EAP.
+     * example: IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crt
+     * ---end---
+     */
     obj_properties[PROP_CLIENT_CERT] =
         g_param_spec_boxed(NM_SETTING_802_1X_CLIENT_CERT,
                            "",
@@ -3858,17 +3858,17 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:client-cert-password:
-	 *
-	 * The password used to access the client certificate stored in
-	 * #NMSetting8021x:client-cert property. Only makes sense if the certificate
-	 * is stored on a PKCS#<!-- -->11 token that requires a login.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:client-cert-password:
+     *
+     * The password used to access the client certificate stored in
+     * #NMSetting8021x:client-cert property. Only makes sense if the certificate
+     * is stored on a PKCS#<!-- -->11 token that requires a login.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * ---end---
-	 */
+     * ---end---
+     */
     obj_properties[PROP_CLIENT_CERT_PASSWORD] =
         g_param_spec_string(NM_SETTING_802_1X_CLIENT_CERT_PASSWORD,
                             "",
@@ -3877,15 +3877,15 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:client-cert-password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSetting8021x:client-cert-password property.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:client-cert-password-flags:
+     *
+     * Flags indicating how to handle the #NMSetting8021x:client-cert-password property.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * ---end---
-	 */
+     * ---end---
+     */
     obj_properties[PROP_CLIENT_CERT_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_802_1X_CLIENT_CERT_PASSWORD_FLAGS,
                            "",
@@ -3895,22 +3895,22 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase1-peapver:
-	 *
-	 * Forces which PEAP version is used when PEAP is set as the EAP method in
-	 * the #NMSetting8021x:eap property.  When unset, the version reported by
-	 * the server will be used.  Sometimes when using older RADIUS servers, it
-	 * is necessary to force the client to use a particular PEAP version.  To do
-	 * so, this property may be set to "0" or "1" to force that specific PEAP
-	 * version.
-	 **/
+     * NMSetting8021x:phase1-peapver:
+     *
+     * Forces which PEAP version is used when PEAP is set as the EAP method in
+     * the #NMSetting8021x:eap property.  When unset, the version reported by
+     * the server will be used.  Sometimes when using older RADIUS servers, it
+     * is necessary to force the client to use a particular PEAP version.  To do
+     * so, this property may be set to "0" or "1" to force that specific PEAP
+     * version.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase1-peapver
-	 * variable: IEEE_8021X_PEAP_VERSION(+)
-	 * values: 0, 1
-	 * description: Use to force a specific PEAP version.
-	 * ---end---
-	 */
+     * property: phase1-peapver
+     * variable: IEEE_8021X_PEAP_VERSION(+)
+     * values: 0, 1
+     * description: Use to force a specific PEAP version.
+     * ---end---
+     */
     obj_properties[PROP_PHASE1_PEAPVER] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE1_PEAPVER,
                             "",
@@ -3919,21 +3919,21 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase1-peaplabel:
-	 *
-	 * Forces use of the new PEAP label during key derivation.  Some RADIUS
-	 * servers may require forcing the new PEAP label to interoperate with
-	 * PEAPv1.  Set to "1" to force use of the new PEAP label.  See the
-	 * wpa_supplicant documentation for more details.
-	 **/
+     * NMSetting8021x:phase1-peaplabel:
+     *
+     * Forces use of the new PEAP label during key derivation.  Some RADIUS
+     * servers may require forcing the new PEAP label to interoperate with
+     * PEAPv1.  Set to "1" to force use of the new PEAP label.  See the
+     * wpa_supplicant documentation for more details.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase1-peaplabel
-	 * variable: IEEE_8021X_PEAP_FORCE_NEW_LABEL(+)
-	 * values: yes, no
-	 * default: no
-	 * description: Use to force the new PEAP label during key derivation.
-	 * ---end---
-	 */
+     * property: phase1-peaplabel
+     * variable: IEEE_8021X_PEAP_FORCE_NEW_LABEL(+)
+     * values: yes, no
+     * default: no
+     * description: Use to force the new PEAP label during key derivation.
+     * ---end---
+     */
     obj_properties[PROP_PHASE1_PEAPLABEL] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE1_PEAPLABEL,
                             "",
@@ -3942,23 +3942,23 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase1-fast-provisioning:
-	 *
-	 * Enables or disables in-line provisioning of EAP-FAST credentials when
-	 * FAST is specified as the EAP method in the #NMSetting8021x:eap property.
-	 * Recognized values are "0" (disabled), "1" (allow unauthenticated
-	 * provisioning), "2" (allow authenticated provisioning), and "3" (allow
-	 * both authenticated and unauthenticated provisioning).  See the
-	 * wpa_supplicant documentation for more details.
-	 **/
+     * NMSetting8021x:phase1-fast-provisioning:
+     *
+     * Enables or disables in-line provisioning of EAP-FAST credentials when
+     * FAST is specified as the EAP method in the #NMSetting8021x:eap property.
+     * Recognized values are "0" (disabled), "1" (allow unauthenticated
+     * provisioning), "2" (allow authenticated provisioning), and "3" (allow
+     * both authenticated and unauthenticated provisioning).  See the
+     * wpa_supplicant documentation for more details.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase1-fast-provisioning
-	 * variable: IEEE_8021X_FAST_PROVISIONING(+)
-	 * values: space-separated list of these values [allow-auth, allow-unauth]
-	 * description: Enable in-line provisioning of EAP-FAST credentials.
-	 * example: IEEE_8021X_FAST_PROVISIONING="allow-auth allow-unauth"
-	 * ---end---
-	 */
+     * property: phase1-fast-provisioning
+     * variable: IEEE_8021X_FAST_PROVISIONING(+)
+     * values: space-separated list of these values [allow-auth, allow-unauth]
+     * description: Enable in-line provisioning of EAP-FAST credentials.
+     * example: IEEE_8021X_FAST_PROVISIONING="allow-auth allow-unauth"
+     * ---end---
+     */
     obj_properties[PROP_PHASE1_FAST_PROVISIONING] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING,
                             "",
@@ -3967,25 +3967,25 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase1-auth-flags:
-	 *
-	 * Specifies authentication flags to use in "phase 1" outer
-	 * authentication using #NMSetting8021xAuthFlags options.
-	 * The individual TLS versions can be explicitly disabled. If a certain
-	 * TLS disable flag is not set, it is up to the supplicant to allow
-	 * or forbid it. The TLS options map to tls_disable_tlsv1_x settings.
-	 * See the wpa_supplicant documentation for more details.
-	 *
-	 * Since: 1.8
-	 */
+     * NMSetting8021x:phase1-auth-flags:
+     *
+     * Specifies authentication flags to use in "phase 1" outer
+     * authentication using #NMSetting8021xAuthFlags options.
+     * The individual TLS versions can be explicitly disabled. If a certain
+     * TLS disable flag is not set, it is up to the supplicant to allow
+     * or forbid it. The TLS options map to tls_disable_tlsv1_x settings.
+     * See the wpa_supplicant documentation for more details.
+     *
+     * Since: 1.8
+     */
     /* ---ifcfg-rh---
-	 * property: phase1-auth-flags
-	 * variable: IEEE_8021X_PHASE1_AUTH_FLAGS(+)
-	 * values: space-separated list of authentication flags names
-	 * description: Authentication flags for the supplicant
-	 * example: IEEE_8021X_PHASE1_AUTH_FLAGS="tls-1-0-disable tls-1-1-disable"
-	 * ---end---
-	 */
+     * property: phase1-auth-flags
+     * variable: IEEE_8021X_PHASE1_AUTH_FLAGS(+)
+     * values: space-separated list of authentication flags names
+     * description: Authentication flags for the supplicant
+     * example: IEEE_8021X_PHASE1_AUTH_FLAGS="tls-1-0-disable tls-1-1-disable"
+     * ---end---
+     */
     obj_properties[PROP_PHASE1_AUTH_FLAGS] =
         g_param_spec_uint(NM_SETTING_802_1X_PHASE1_AUTH_FLAGS,
                           "",
@@ -3996,24 +3996,24 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-auth:
-	 *
-	 * Specifies the allowed "phase 2" inner non-EAP authentication method when
-	 * an EAP method that uses an inner TLS tunnel is specified in the
-	 * #NMSetting8021x:eap property.  Recognized non-EAP "phase 2" methods are
-	 * "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls".
-	 * Each "phase 2" inner method requires specific parameters for successful
-	 * authentication; see the wpa_supplicant documentation for more details.
-	 **/
+     * NMSetting8021x:phase2-auth:
+     *
+     * Specifies the allowed "phase 2" inner non-EAP authentication method when
+     * an EAP method that uses an inner TLS tunnel is specified in the
+     * #NMSetting8021x:eap property.  Recognized non-EAP "phase 2" methods are
+     * "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls".
+     * Each "phase 2" inner method requires specific parameters for successful
+     * authentication; see the wpa_supplicant documentation for more details.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-auth
-	 * variable: IEEE_8021X_INNER_AUTH_METHODS(+)
-	 * values: "PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS"
-	 * description: Inner non-EAP authentication methods. IEEE_8021X_INNER_AUTH_METHODS
-	 *   can contain values both for 'phase2-auth' and 'phase2-autheap' properties.
-	 * example: IEEE_8021X_INNER_AUTH_METHODS=PAP
-	 * ---end---
-	 */
+     * property: phase2-auth
+     * variable: IEEE_8021X_INNER_AUTH_METHODS(+)
+     * values: "PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS"
+     * description: Inner non-EAP authentication methods. IEEE_8021X_INNER_AUTH_METHODS
+     *   can contain values both for 'phase2-auth' and 'phase2-autheap' properties.
+     * example: IEEE_8021X_INNER_AUTH_METHODS=PAP
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_AUTH] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_AUTH,
                             "",
@@ -4022,24 +4022,24 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-autheap:
-	 *
-	 * Specifies the allowed "phase 2" inner EAP-based authentication method
-	 * when an EAP method that uses an inner TLS tunnel is specified in the
-	 * #NMSetting8021x:eap property.  Recognized EAP-based "phase 2" methods are
-	 * "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method
-	 * requires specific parameters for successful authentication; see the
-	 * wpa_supplicant documentation for more details.
-	 **/
+     * NMSetting8021x:phase2-autheap:
+     *
+     * Specifies the allowed "phase 2" inner EAP-based authentication method
+     * when an EAP method that uses an inner TLS tunnel is specified in the
+     * #NMSetting8021x:eap property.  Recognized EAP-based "phase 2" methods are
+     * "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method
+     * requires specific parameters for successful authentication; see the
+     * wpa_supplicant documentation for more details.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-autheap
-	 * variable: IEEE_8021X_INNER_AUTH_METHODS(+)
-	 * values: "EAP-MD5", "EAP-MSCHAPV2", "EAP-GTC", "EAP-OTP" and "EAP-TLS"
-	 * description: Inner EAP-based authentication methods. Note that
-	 *   IEEE_8021X_INNER_AUTH_METHODS is also used for 'phase2-auth' values.
-	 * example: IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS"
-	 * ---end---
-	 */
+     * property: phase2-autheap
+     * variable: IEEE_8021X_INNER_AUTH_METHODS(+)
+     * values: "EAP-MD5", "EAP-MSCHAPV2", "EAP-GTC", "EAP-OTP" and "EAP-TLS"
+     * description: Inner EAP-based authentication methods. Note that
+     *   IEEE_8021X_INNER_AUTH_METHODS is also used for 'phase2-auth' values.
+     * example: IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS"
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_AUTHEAP] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_AUTHEAP,
                             "",
@@ -4048,27 +4048,27 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-ca-cert:
-	 *
-	 * Contains the "phase 2" CA certificate if used by the EAP method specified
-	 * in the #NMSetting8021x:phase2-auth or #NMSetting8021x:phase2-autheap
-	 * properties.
-	 *
-	 * Certificate data is specified using a "scheme"; three are currently
-	 * supported: blob, path and pkcs#11 URL. When using the blob scheme this property
-	 * should be set to the certificate's DER encoded data. When using the path
-	 * scheme, this property should be set to the full UTF-8 encoded path of the
-	 * certificate, prefixed with the string "file://" and ending with a terminating
-	 * NUL byte.
-	 * This property can be unset even if the EAP method supports CA certificates,
-	 * but this allows man-in-the-middle attacks and is NOT recommended.
-	 *
-	 * Note that enabling NMSetting8021x:system-ca-certs will override this
-	 * setting to use the built-in path, if the built-in path is not a directory.
-	 *
-	 * Setting this property directly is discouraged; use the
-	 * nm_setting_802_1x_set_phase2_ca_cert() function instead.
-	 **/
+     * NMSetting8021x:phase2-ca-cert:
+     *
+     * Contains the "phase 2" CA certificate if used by the EAP method specified
+     * in the #NMSetting8021x:phase2-auth or #NMSetting8021x:phase2-autheap
+     * properties.
+     *
+     * Certificate data is specified using a "scheme"; three are currently
+     * supported: blob, path and pkcs#11 URL. When using the blob scheme this property
+     * should be set to the certificate's DER encoded data. When using the path
+     * scheme, this property should be set to the full UTF-8 encoded path of the
+     * certificate, prefixed with the string "file://" and ending with a terminating
+     * NUL byte.
+     * This property can be unset even if the EAP method supports CA certificates,
+     * but this allows man-in-the-middle attacks and is NOT recommended.
+     *
+     * Note that enabling NMSetting8021x:system-ca-certs will override this
+     * setting to use the built-in path, if the built-in path is not a directory.
+     *
+     * Setting this property directly is discouraged; use the
+     * nm_setting_802_1x_set_phase2_ca_cert() function instead.
+     **/
     obj_properties[PROP_PHASE2_CA_CERT] =
         g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_CA_CERT,
                            "",
@@ -4077,17 +4077,17 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-ca-cert-password:
-	 *
-	 * The password used to access the "phase2" CA certificate stored in
-	 * #NMSetting8021x:phase2-ca-cert property. Only makes sense if the certificate
-	 * is stored on a PKCS#<!-- -->11 token that requires a login.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:phase2-ca-cert-password:
+     *
+     * The password used to access the "phase2" CA certificate stored in
+     * #NMSetting8021x:phase2-ca-cert property. Only makes sense if the certificate
+     * is stored on a PKCS#<!-- -->11 token that requires a login.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * ---end---
-	 */
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_CA_CERT_PASSWORD] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD,
                             "",
@@ -4096,15 +4096,15 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-ca-cert-password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSetting8021x:phase2-ca-cert-password property.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:phase2-ca-cert-password-flags:
+     *
+     * Flags indicating how to handle the #NMSetting8021x:phase2-ca-cert-password property.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * ---end---
-	 */
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_CA_CERT_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD_FLAGS,
                            "",
@@ -4114,21 +4114,21 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-ca-path:
-	 *
-	 * UTF-8 encoded path to a directory containing PEM or DER formatted
-	 * certificates to be added to the verification chain in addition to the
-	 * certificate specified in the #NMSetting8021x:phase2-ca-cert property.
-	 *
-	 * If NMSetting8021x:system-ca-certs is enabled and the built-in CA
-	 * path is an existing directory, then this setting is ignored.
-	 **/
+     * NMSetting8021x:phase2-ca-path:
+     *
+     * UTF-8 encoded path to a directory containing PEM or DER formatted
+     * certificates to be added to the verification chain in addition to the
+     * certificate specified in the #NMSetting8021x:phase2-ca-cert property.
+     *
+     * If NMSetting8021x:system-ca-certs is enabled and the built-in CA
+     * path is an existing directory, then this setting is ignored.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-ca-path
-	 * variable: IEEE_8021X_PHASE2_CA_PATH(+)
-	 * description: The search path for the certificate.
-	 * ---end---
-	 */
+     * property: phase2-ca-path
+     * variable: IEEE_8021X_PHASE2_CA_PATH(+)
+     * description: The search path for the certificate.
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_CA_PATH] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_CA_PATH,
                             "",
@@ -4137,22 +4137,22 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-subject-match:
-	 *
-	 * Substring to be matched against the subject of the certificate presented
-	 * by the authentication server during the inner "phase 2"
-	 * authentication. When unset, no verification of the authentication server
-	 * certificate's subject is performed.  This property provides little security,
-	 * if any, and its use is deprecated in favor of
-	 * NMSetting8021x:phase2-domain-suffix-match.
-	 **/
+     * NMSetting8021x:phase2-subject-match:
+     *
+     * Substring to be matched against the subject of the certificate presented
+     * by the authentication server during the inner "phase 2"
+     * authentication. When unset, no verification of the authentication server
+     * certificate's subject is performed.  This property provides little security,
+     * if any, and its use is deprecated in favor of
+     * NMSetting8021x:phase2-domain-suffix-match.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-subject-match
-	 * variable: IEEE_8021X_PHASE2_SUBJECT_MATCH(+)
-	 * description: Substring to match subject of server certificate against.
-	 * example: IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat"
-	 * ---end---
-	 */
+     * property: phase2-subject-match
+     * variable: IEEE_8021X_PHASE2_SUBJECT_MATCH(+)
+     * description: Substring to match subject of server certificate against.
+     * example: IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat"
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_SUBJECT_MATCH] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH,
                             "",
@@ -4161,18 +4161,18 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-altsubject-matches:
-	 *
-	 * List of strings to be matched against the altSubjectName of the
-	 * certificate presented by the authentication server during the inner
-	 * "phase 2" authentication. If the list is empty, no verification of the
-	 * server certificate's altSubjectName is performed.
-	 **/
+     * NMSetting8021x:phase2-altsubject-matches:
+     *
+     * List of strings to be matched against the altSubjectName of the
+     * certificate presented by the authentication server during the inner
+     * "phase 2" authentication. If the list is empty, no verification of the
+     * server certificate's altSubjectName is performed.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-altsubject-matches
-	 * variable: IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES(+)
-	 * ---end---
-	 */
+     * property: phase2-altsubject-matches
+     * variable: IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES(+)
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_ALTSUBJECT_MATCHES] =
         g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_ALTSUBJECT_MATCHES,
                            "",
@@ -4181,25 +4181,25 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-domain-suffix-match:
-	 *
-	 * Constraint for server domain name. If set, this FQDN is used as a suffix
-	 * match requirement for dNSName element(s) of the certificate presented by
-	 * the authentication server during the inner "phase 2" authentication.  If
-	 * a matching dNSName is found, this constraint is met.  If no dNSName
-	 * values are present, this constraint is matched against SubjectName CN
-	 * using same suffix match comparison.
-	 * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited
-	 * list.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSetting8021x:phase2-domain-suffix-match:
+     *
+     * Constraint for server domain name. If set, this FQDN is used as a suffix
+     * match requirement for dNSName element(s) of the certificate presented by
+     * the authentication server during the inner "phase 2" authentication.  If
+     * a matching dNSName is found, this constraint is met.  If no dNSName
+     * values are present, this constraint is matched against SubjectName CN
+     * using same suffix match comparison.
+     * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited
+     * list.
+     *
+     * Since: 1.2
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-domain-suffix-match
-	 * description: Suffix to match domain of server certificate for phase 2 against.
-	 * variable: IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH(+)
-	 * ---end---
-	 */
+     * property: phase2-domain-suffix-match
+     * description: Suffix to match domain of server certificate for phase 2 against.
+     * variable: IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH(+)
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_DOMAIN_SUFFIX_MATCH] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_DOMAIN_SUFFIX_MATCH,
                             "",
@@ -4208,24 +4208,24 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-domain-match:
-	 *
-	 * Constraint for server domain name. If set, this list of FQDNs is used as
-	 * a match requirement for dNSName element(s) of the certificate presented
-	 * by the authentication server during the inner "phase 2" authentication.
-	 * If a matching dNSName is found, this constraint is met.  If no dNSName
-	 * values are present, this constraint is matched against SubjectName CN
-	 * using the same comparison.
-	 * Multiple valid FQDNs can be passed as a ";" delimited list.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMSetting8021x:phase2-domain-match:
+     *
+     * Constraint for server domain name. If set, this list of FQDNs is used as
+     * a match requirement for dNSName element(s) of the certificate presented
+     * by the authentication server during the inner "phase 2" authentication.
+     * If a matching dNSName is found, this constraint is met.  If no dNSName
+     * values are present, this constraint is matched against SubjectName CN
+     * using the same comparison.
+     * Multiple valid FQDNs can be passed as a ";" delimited list.
+     *
+     * Since: 1.24
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-domain-match
-	 * description: Value to match domain of server certificate for phase 2 against.
-	 * variable: IEEE_8021X_PHASE2_DOMAIN_MATCH(+)
-	 * ---end---
-	 */
+     * property: phase2-domain-match
+     * description: Value to match domain of server certificate for phase 2 against.
+     * variable: IEEE_8021X_PHASE2_DOMAIN_MATCH(+)
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_DOMAIN_MATCH] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_DOMAIN_MATCH,
                             "",
@@ -4234,31 +4234,31 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-client-cert:
-	 *
-	 * Contains the "phase 2" client certificate if used by the EAP method
-	 * specified in the #NMSetting8021x:phase2-auth or
-	 * #NMSetting8021x:phase2-autheap properties.
-	 *
-	 * Certificate data is specified using a "scheme"; two are currently
-	 * supported: blob and path. When using the blob scheme (which is backwards
-	 * compatible with NM 0.7.x) this property should be set to the
-	 * certificate's DER encoded data. When using the path scheme, this property
-	 * should be set to the full UTF-8 encoded path of the certificate, prefixed
-	 * with the string "file://" and ending with a terminating NUL byte. This
-	 * property can be unset even if the EAP method supports CA certificates,
-	 * but this allows man-in-the-middle attacks and is NOT recommended.
-	 *
-	 * Setting this property directly is discouraged; use the
-	 * nm_setting_802_1x_set_phase2_client_cert() function instead.
-	 **/
+     * NMSetting8021x:phase2-client-cert:
+     *
+     * Contains the "phase 2" client certificate if used by the EAP method
+     * specified in the #NMSetting8021x:phase2-auth or
+     * #NMSetting8021x:phase2-autheap properties.
+     *
+     * Certificate data is specified using a "scheme"; two are currently
+     * supported: blob and path. When using the blob scheme (which is backwards
+     * compatible with NM 0.7.x) this property should be set to the
+     * certificate's DER encoded data. When using the path scheme, this property
+     * should be set to the full UTF-8 encoded path of the certificate, prefixed
+     * with the string "file://" and ending with a terminating NUL byte. This
+     * property can be unset even if the EAP method supports CA certificates,
+     * but this allows man-in-the-middle attacks and is NOT recommended.
+     *
+     * Setting this property directly is discouraged; use the
+     * nm_setting_802_1x_set_phase2_client_cert() function instead.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-client-cert
-	 * variable: IEEE_8021X_INNER_CLIENT_CERT(+)
-	 * description: Client certificate for inner EAP method.
-	 * example: IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crt
-	 * ---end---
-	 */
+     * property: phase2-client-cert
+     * variable: IEEE_8021X_INNER_CLIENT_CERT(+)
+     * description: Client certificate for inner EAP method.
+     * example: IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crt
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_CLIENT_CERT] =
         g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_CLIENT_CERT,
                            "",
@@ -4267,17 +4267,17 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-client-cert-password:
-	 *
-	 * The password used to access the "phase2" client certificate stored in
-	 * #NMSetting8021x:phase2-client-cert property. Only makes sense if the certificate
-	 * is stored on a PKCS#<!-- -->11 token that requires a login.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:phase2-client-cert-password:
+     *
+     * The password used to access the "phase2" client certificate stored in
+     * #NMSetting8021x:phase2-client-cert property. Only makes sense if the certificate
+     * is stored on a PKCS#<!-- -->11 token that requires a login.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * ---end---
-	 */
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_CLIENT_CERT_PASSWORD] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD,
                             "",
@@ -4286,15 +4286,15 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-client-cert-password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSetting8021x:phase2-client-cert-password property.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:phase2-client-cert-password-flags:
+     *
+     * Flags indicating how to handle the #NMSetting8021x:phase2-client-cert-password property.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * ---end---
-	 */
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD_FLAGS,
                            "",
@@ -4304,19 +4304,19 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:password:
-	 *
-	 * UTF-8 encoded password used for EAP authentication methods. If both the
-	 * #NMSetting8021x:password property and the #NMSetting8021x:password-raw
-	 * property are specified, #NMSetting8021x:password is preferred.
-	 **/
+     * NMSetting8021x:password:
+     *
+     * UTF-8 encoded password used for EAP authentication methods. If both the
+     * #NMSetting8021x:password property and the #NMSetting8021x:password-raw
+     * property are specified, #NMSetting8021x:password is preferred.
+     **/
     /* ---ifcfg-rh---
-	 * property: password
-	 * variable: IEEE_8021X_PASSWORD(+)
-	 * description: UTF-8 encoded password used for EAP. It can also go to "key-"
-	 *   lookaside file, or it can be owned by a secret agent.
-	 * ---end---
-	 */
+     * property: password
+     * variable: IEEE_8021X_PASSWORD(+)
+     * description: UTF-8 encoded password used for EAP. It can also go to "key-"
+     *   lookaside file, or it can be owned by a secret agent.
+     * ---end---
+     */
     obj_properties[PROP_PASSWORD] =
         g_param_spec_string(NM_SETTING_802_1X_PASSWORD,
                             "",
@@ -4325,17 +4325,17 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSetting8021x:password property.
-	 **/
+     * NMSetting8021x:password-flags:
+     *
+     * Flags indicating how to handle the #NMSetting8021x:password property.
+     **/
     /* ---ifcfg-rh---
-	 * property: password-flags
-	 * variable: IEEE_8021X_PASSWORD_FLAGS(+)
-	 * format: NMSettingSecretFlags
-	 * description: Password flags for IEEE_8021X_PASSWORD password.
-	 * ---end---
-	 */
+     * property: password-flags
+     * variable: IEEE_8021X_PASSWORD_FLAGS(+)
+     * format: NMSettingSecretFlags
+     * description: Password flags for IEEE_8021X_PASSWORD password.
+     * ---end---
+     */
     obj_properties[PROP_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_802_1X_PASSWORD_FLAGS,
                            "",
@@ -4345,21 +4345,21 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:password-raw:
-	 *
-	 * Password used for EAP authentication methods, given as a byte array to
-	 * allow passwords in other encodings than UTF-8 to be used. If both the
-	 * #NMSetting8021x:password property and the #NMSetting8021x:password-raw
-	 * property are specified, #NMSetting8021x:password is preferred.
-	 **/
+     * NMSetting8021x:password-raw:
+     *
+     * Password used for EAP authentication methods, given as a byte array to
+     * allow passwords in other encodings than UTF-8 to be used. If both the
+     * #NMSetting8021x:password property and the #NMSetting8021x:password-raw
+     * property are specified, #NMSetting8021x:password is preferred.
+     **/
     /* ---ifcfg-rh---
-	 * property: password-raw
-	 * variable: IEEE_8021X_PASSWORD_RAW(+)
-	 * description: password used for EAP, encoded as a hexadecimal string. It
-	 *   can also go to "key-" lookaside file.
-	 * example: IEEE_8021X_PASSWORD_RAW=041c8320083aa4bf
-	 * ---end---
-	 */
+     * property: password-raw
+     * variable: IEEE_8021X_PASSWORD_RAW(+)
+     * description: password used for EAP, encoded as a hexadecimal string. It
+     *   can also go to "key-" lookaside file.
+     * example: IEEE_8021X_PASSWORD_RAW=041c8320083aa4bf
+     * ---end---
+     */
     obj_properties[PROP_PASSWORD_RAW] =
         g_param_spec_boxed(NM_SETTING_802_1X_PASSWORD_RAW,
                            "",
@@ -4368,16 +4368,16 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:password-raw-flags:
-	 *
-	 * Flags indicating how to handle the #NMSetting8021x:password-raw property.
-	 **/
+     * NMSetting8021x:password-raw-flags:
+     *
+     * Flags indicating how to handle the #NMSetting8021x:password-raw property.
+     **/
     /* ---ifcfg-rh---
-	 * property: password-raw-flags
-	 * variable: IEEE_8021X_PASSWORD_RAW_FLAGS(+)
-	 * description: The secret flags for password-raw.
-	 * ---end---
-	 */
+     * property: password-raw-flags
+     * variable: IEEE_8021X_PASSWORD_RAW_FLAGS(+)
+     * description: The secret flags for password-raw.
+     * ---end---
+     */
     obj_properties[PROP_PASSWORD_RAW_FLAGS] =
         g_param_spec_flags(NM_SETTING_802_1X_PASSWORD_RAW_FLAGS,
                            "",
@@ -4387,43 +4387,43 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:private-key:
-	 *
-	 * Contains the private key when the #NMSetting8021x:eap property is set to
-	 * "tls".
-	 *
-	 * Key data is specified using a "scheme"; two are currently supported: blob
-	 * and path. When using the blob scheme and private keys, this property
-	 * should be set to the key's encrypted PEM encoded data. When using private
-	 * keys with the path scheme, this property should be set to the full UTF-8
-	 * encoded path of the key, prefixed with the string "file://" and ending
-	 * with a terminating NUL byte. When using PKCS#<!-- -->12 format private
-	 * keys and the blob scheme, this property should be set to the
-	 * PKCS#<!-- -->12 data and the #NMSetting8021x:private-key-password
-	 * property must be set to password used to decrypt the PKCS#<!-- -->12
-	 * certificate and key. When using PKCS#<!-- -->12 files and the path
-	 * scheme, this property should be set to the full UTF-8 encoded path of the
-	 * key, prefixed with the string "file://" and ending with a terminating
-	 * NUL byte, and as with the blob scheme the "private-key-password" property
-	 * must be set to the password used to decode the PKCS#<!-- -->12 private
-	 * key and certificate.
-	 *
-	 * Setting this property directly is discouraged; use the
-	 * nm_setting_802_1x_set_private_key() function instead.
-	 *
-	 * WARNING: #NMSetting8021x:private-key is not a "secret" property, and thus
-	 * unencrypted private key data using the BLOB scheme may be readable by
-	 * unprivileged users.  Private keys should always be encrypted with a
-	 * private key password to prevent unauthorized access to unencrypted
-	 * private key data.
-	 **/
+     * NMSetting8021x:private-key:
+     *
+     * Contains the private key when the #NMSetting8021x:eap property is set to
+     * "tls".
+     *
+     * Key data is specified using a "scheme"; two are currently supported: blob
+     * and path. When using the blob scheme and private keys, this property
+     * should be set to the key's encrypted PEM encoded data. When using private
+     * keys with the path scheme, this property should be set to the full UTF-8
+     * encoded path of the key, prefixed with the string "file://" and ending
+     * with a terminating NUL byte. When using PKCS#<!-- -->12 format private
+     * keys and the blob scheme, this property should be set to the
+     * PKCS#<!-- -->12 data and the #NMSetting8021x:private-key-password
+     * property must be set to password used to decrypt the PKCS#<!-- -->12
+     * certificate and key. When using PKCS#<!-- -->12 files and the path
+     * scheme, this property should be set to the full UTF-8 encoded path of the
+     * key, prefixed with the string "file://" and ending with a terminating
+     * NUL byte, and as with the blob scheme the "private-key-password" property
+     * must be set to the password used to decode the PKCS#<!-- -->12 private
+     * key and certificate.
+     *
+     * Setting this property directly is discouraged; use the
+     * nm_setting_802_1x_set_private_key() function instead.
+     *
+     * WARNING: #NMSetting8021x:private-key is not a "secret" property, and thus
+     * unencrypted private key data using the BLOB scheme may be readable by
+     * unprivileged users.  Private keys should always be encrypted with a
+     * private key password to prevent unauthorized access to unencrypted
+     * private key data.
+     **/
     /* ---ifcfg-rh---
-	 * property: private-key
-	 * variable: IEEE_8021X_PRIVATE_KEY(+)
-	 * description: Private key for EAP-TLS.
-	 * example: IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12
-	 * ---end---
-	 */
+     * property: private-key
+     * variable: IEEE_8021X_PRIVATE_KEY(+)
+     * description: Private key for EAP-TLS.
+     * example: IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12
+     * ---end---
+     */
     obj_properties[PROP_PRIVATE_KEY] =
         g_param_spec_boxed(NM_SETTING_802_1X_PRIVATE_KEY,
                            "",
@@ -4432,22 +4432,22 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:private-key-password:
-	 *
-	 * The password used to decrypt the private key specified in the
-	 * #NMSetting8021x:private-key property when the private key either uses the
-	 * path scheme, or if the private key is a PKCS#<!-- -->12 format key.  Setting this
-	 * property directly is not generally necessary except when returning
-	 * secrets to NetworkManager; it is generally set automatically when setting
-	 * the private key by the nm_setting_802_1x_set_private_key() function.
-	 **/
+     * NMSetting8021x:private-key-password:
+     *
+     * The password used to decrypt the private key specified in the
+     * #NMSetting8021x:private-key property when the private key either uses the
+     * path scheme, or if the private key is a PKCS#<!-- -->12 format key.  Setting this
+     * property directly is not generally necessary except when returning
+     * secrets to NetworkManager; it is generally set automatically when setting
+     * the private key by the nm_setting_802_1x_set_private_key() function.
+     **/
     /* ---ifcfg-rh---
-	 * property: private-key-password
-	 * variable: IEEE_8021X_PRIVATE_KEY_PASSWORD(+)
-	 * description: Password for IEEE_8021X_PRIVATE_KEY. It can also go to "key-"
-	 *   lookaside file, or it can be owned by a secret agent.
-	 * ---end---
-	 */
+     * property: private-key-password
+     * variable: IEEE_8021X_PRIVATE_KEY_PASSWORD(+)
+     * description: Password for IEEE_8021X_PRIVATE_KEY. It can also go to "key-"
+     *   lookaside file, or it can be owned by a secret agent.
+     * ---end---
+     */
     obj_properties[PROP_PRIVATE_KEY_PASSWORD] =
         g_param_spec_string(NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD,
                             "",
@@ -4456,18 +4456,18 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:private-key-password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSetting8021x:private-key-password
-	 * property.
-	 **/
+     * NMSetting8021x:private-key-password-flags:
+     *
+     * Flags indicating how to handle the #NMSetting8021x:private-key-password
+     * property.
+     **/
     /* ---ifcfg-rh---
-	 * property: private-key-password-flags
-	 * variable: IEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS(+)
-	 * format: NMSettingSecretFlags
-	 * description: Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password.
-	 * ---end---
-	 */
+     * property: private-key-password-flags
+     * variable: IEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS(+)
+     * format: NMSettingSecretFlags
+     * description: Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password.
+     * ---end---
+     */
     obj_properties[PROP_PRIVATE_KEY_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS,
                            "",
@@ -4477,37 +4477,37 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-private-key:
-	 *
-	 * Contains the "phase 2" inner private key when the
-	 * #NMSetting8021x:phase2-auth or #NMSetting8021x:phase2-autheap property is
-	 * set to "tls".
-	 *
-	 * Key data is specified using a "scheme"; two are currently supported: blob
-	 * and path. When using the blob scheme and private keys, this property
-	 * should be set to the key's encrypted PEM encoded data. When using private
-	 * keys with the path scheme, this property should be set to the full UTF-8
-	 * encoded path of the key, prefixed with the string "file://" and ending
-	 * with a terminating NUL byte. When using PKCS#<!-- -->12 format private
-	 * keys and the blob scheme, this property should be set to the
-	 * PKCS#<!-- -->12 data and the #NMSetting8021x:phase2-private-key-password
-	 * property must be set to password used to decrypt the PKCS#<!-- -->12
-	 * certificate and key. When using PKCS#<!-- -->12 files and the path
-	 * scheme, this property should be set to the full UTF-8 encoded path of the
-	 * key, prefixed with the string "file://" and ending with a terminating
-	 * NUL byte, and as with the blob scheme the
-	 * #NMSetting8021x:phase2-private-key-password property must be set to the
-	 * password used to decode the PKCS#<!-- -->12 private key and certificate.
-	 *
-	 * Setting this property directly is discouraged; use the
-	 * nm_setting_802_1x_set_phase2_private_key() function instead.
-	 **/
+     * NMSetting8021x:phase2-private-key:
+     *
+     * Contains the "phase 2" inner private key when the
+     * #NMSetting8021x:phase2-auth or #NMSetting8021x:phase2-autheap property is
+     * set to "tls".
+     *
+     * Key data is specified using a "scheme"; two are currently supported: blob
+     * and path. When using the blob scheme and private keys, this property
+     * should be set to the key's encrypted PEM encoded data. When using private
+     * keys with the path scheme, this property should be set to the full UTF-8
+     * encoded path of the key, prefixed with the string "file://" and ending
+     * with a terminating NUL byte. When using PKCS#<!-- -->12 format private
+     * keys and the blob scheme, this property should be set to the
+     * PKCS#<!-- -->12 data and the #NMSetting8021x:phase2-private-key-password
+     * property must be set to password used to decrypt the PKCS#<!-- -->12
+     * certificate and key. When using PKCS#<!-- -->12 files and the path
+     * scheme, this property should be set to the full UTF-8 encoded path of the
+     * key, prefixed with the string "file://" and ending with a terminating
+     * NUL byte, and as with the blob scheme the
+     * #NMSetting8021x:phase2-private-key-password property must be set to the
+     * password used to decode the PKCS#<!-- -->12 private key and certificate.
+     *
+     * Setting this property directly is discouraged; use the
+     * nm_setting_802_1x_set_phase2_private_key() function instead.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-private-key
-	 * variable: IEEE_8021X_INNER_PRIVATE_KEY(+)
-	 * description: Private key for inner authentication method for EAP-TLS.
-	 * ---end---
-	 */
+     * property: phase2-private-key
+     * variable: IEEE_8021X_INNER_PRIVATE_KEY(+)
+     * description: Private key for inner authentication method for EAP-TLS.
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_PRIVATE_KEY] =
         g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY,
                            "",
@@ -4516,23 +4516,23 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-private-key-password:
-	 *
-	 * The password used to decrypt the "phase 2" private key specified in the
-	 * #NMSetting8021x:phase2-private-key property when the private key either
-	 * uses the path scheme, or is a PKCS#<!-- -->12 format key.  Setting this
-	 * property directly is not generally necessary except when returning
-	 * secrets to NetworkManager; it is generally set automatically when setting
-	 * the private key by the nm_setting_802_1x_set_phase2_private_key()
-	 * function.
-	 **/
+     * NMSetting8021x:phase2-private-key-password:
+     *
+     * The password used to decrypt the "phase 2" private key specified in the
+     * #NMSetting8021x:phase2-private-key property when the private key either
+     * uses the path scheme, or is a PKCS#<!-- -->12 format key.  Setting this
+     * property directly is not generally necessary except when returning
+     * secrets to NetworkManager; it is generally set automatically when setting
+     * the private key by the nm_setting_802_1x_set_phase2_private_key()
+     * function.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-private-key-password
-	 * variable: IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD(+)
-	 * description: Password for IEEE_8021X_INNER_PRIVATE_KEY. It can also go to "key-"
-	 *   lookaside file, or it can be owned by a secret agent.
-	 * ---end---
-	 */
+     * property: phase2-private-key-password
+     * variable: IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD(+)
+     * description: Password for IEEE_8021X_INNER_PRIVATE_KEY. It can also go to "key-"
+     *   lookaside file, or it can be owned by a secret agent.
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_PRIVATE_KEY_PASSWORD] =
         g_param_spec_string(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD,
                             "",
@@ -4541,18 +4541,18 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:phase2-private-key-password-flags:
-	 *
-	 * Flags indicating how to handle the
-	 * #NMSetting8021x:phase2-private-key-password property.
-	 **/
+     * NMSetting8021x:phase2-private-key-password-flags:
+     *
+     * Flags indicating how to handle the
+     * #NMSetting8021x:phase2-private-key-password property.
+     **/
     /* ---ifcfg-rh---
-	 * property: phase2-private-key-password-flags
-	 * variable: IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS(+)
-	 * format: NMSettingSecretFlags
-	 * description: Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password.
-	 * ---end---
-	 */
+     * property: phase2-private-key-password-flags
+     * variable: IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS(+)
+     * format: NMSettingSecretFlags
+     * description: Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password.
+     * ---end---
+     */
     obj_properties[PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS,
                            "",
@@ -4562,16 +4562,16 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:pin:
-	 *
-	 * PIN used for EAP authentication methods.
-	 **/
+     * NMSetting8021x:pin:
+     *
+     * PIN used for EAP authentication methods.
+     **/
     /* ---ifcfg-rh---
-	 * property: pin
-	 * variable: IEEE_8021X_PIN(+)
-	 * description: The pin secret used for EAP authentication methods.
-	 * ---end---
-	 */
+     * property: pin
+     * variable: IEEE_8021X_PIN(+)
+     * description: The pin secret used for EAP authentication methods.
+     * ---end---
+     */
     obj_properties[PROP_PIN] =
         g_param_spec_string(NM_SETTING_802_1X_PIN,
                             "",
@@ -4580,16 +4580,16 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:pin-flags:
-	 *
-	 * Flags indicating how to handle the #NMSetting8021x:pin property.
-	 **/
+     * NMSetting8021x:pin-flags:
+     *
+     * Flags indicating how to handle the #NMSetting8021x:pin property.
+     **/
     /* ---ifcfg-rh---
-	 * property: pin-flags
-	 * variable: IEEE_8021X_PIN_FLAGS(+)
-	 * description: The secret flags for the pin property.
-	 * ---end---
-	 */
+     * property: pin-flags
+     * variable: IEEE_8021X_PIN_FLAGS(+)
+     * description: The secret flags for the pin property.
+     * ---end---
+     */
     obj_properties[PROP_PIN_FLAGS] = g_param_spec_flags(NM_SETTING_802_1X_PIN_FLAGS,
                                                         "",
                                                         "",
@@ -4598,24 +4598,24 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:system-ca-certs:
-	 *
-	 * When %TRUE, overrides the #NMSetting8021x:ca-path and
-	 * #NMSetting8021x:phase2-ca-path properties using the system CA directory
-	 * specified at configure time with the --system-ca-path switch.  The
-	 * certificates in this directory are added to the verification chain in
-	 * addition to any certificates specified by the #NMSetting8021x:ca-cert and
-	 * #NMSetting8021x:phase2-ca-cert properties. If the path provided with
-	 * --system-ca-path is rather a file name (bundle of trusted CA certificates),
-	 * it overrides #NMSetting8021x:ca-cert and #NMSetting8021x:phase2-ca-cert
-	 * properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant).
-	 **/
+     * NMSetting8021x:system-ca-certs:
+     *
+     * When %TRUE, overrides the #NMSetting8021x:ca-path and
+     * #NMSetting8021x:phase2-ca-path properties using the system CA directory
+     * specified at configure time with the --system-ca-path switch.  The
+     * certificates in this directory are added to the verification chain in
+     * addition to any certificates specified by the #NMSetting8021x:ca-cert and
+     * #NMSetting8021x:phase2-ca-cert properties. If the path provided with
+     * --system-ca-path is rather a file name (bundle of trusted CA certificates),
+     * it overrides #NMSetting8021x:ca-cert and #NMSetting8021x:phase2-ca-cert
+     * properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant).
+     **/
     /* ---ifcfg-rh---
-	 * property: system-ca-certs
-	 * variable: IEEE_8021X_SYSTEM_CA_CERTS(+)
-	 * description: a boolean value.
-	 * ---end---
-	 */
+     * property: system-ca-certs
+     * variable: IEEE_8021X_SYSTEM_CA_CERTS(+)
+     * description: a boolean value.
+     * ---end---
+     */
     obj_properties[PROP_SYSTEM_CA_CERTS] =
         g_param_spec_boolean(NM_SETTING_802_1X_SYSTEM_CA_CERTS,
                              "",
@@ -4624,20 +4624,20 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:auth-timeout:
-	 *
-	 * A timeout for the authentication. Zero means the global default; if the
-	 * global default is not set, the authentication timeout is 25 seconds.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSetting8021x:auth-timeout:
+     *
+     * A timeout for the authentication. Zero means the global default; if the
+     * global default is not set, the authentication timeout is 25 seconds.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * property: auth-timeout
-	 * variable: IEEE_8021X_AUTH_TIMEOUT(+)
-	 * default: 0
-	 * description: Timeout in seconds for the 802.1X authentication. Zero means the global default or 25.
-	 * ---end---
-	 */
+     * property: auth-timeout
+     * variable: IEEE_8021X_AUTH_TIMEOUT(+)
+     * default: 0
+     * description: Timeout in seconds for the 802.1X authentication. Zero means the global default or 25.
+     * ---end---
+     */
     obj_properties[PROP_AUTH_TIMEOUT] = g_param_spec_int(
         NM_SETTING_802_1X_AUTH_TIMEOUT,
         "",
@@ -4648,23 +4648,23 @@ nm_setting_802_1x_class_init(NMSetting8021xClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSetting8021x:optional:
-	 *
-	 * Whether the 802.1X authentication is optional. If %TRUE, the activation
-	 * will continue even after a timeout or an authentication failure. Setting
-	 * the property to %TRUE is currently allowed only for Ethernet connections.
-	 * If set to %FALSE, the activation can continue only after a successful
-	 * authentication.
-	 *
-	 * Since: 1.22
-	 **/
+     * NMSetting8021x:optional:
+     *
+     * Whether the 802.1X authentication is optional. If %TRUE, the activation
+     * will continue even after a timeout or an authentication failure. Setting
+     * the property to %TRUE is currently allowed only for Ethernet connections.
+     * If set to %FALSE, the activation can continue only after a successful
+     * authentication.
+     *
+     * Since: 1.22
+     **/
     /* ---ifcfg-rh---
-	 * property: optional
-	 * variable: IEEE_8021X_OPTIONAL(+)
-	 * default=no
-	 * description: whether the 802.1X authentication is optional
-	 * ---end---
-	 */
+     * property: optional
+     * variable: IEEE_8021X_OPTIONAL(+)
+     * default=no
+     * description: whether the 802.1X authentication is optional
+     * ---end---
+     */
     obj_properties[PROP_OPTIONAL] =
         g_param_spec_boolean(NM_SETTING_802_1X_OPTIONAL,
                              "",
diff --git a/libnm-core/nm-setting-adsl.c b/libnm-core/nm-setting-adsl.c
index dc853554f5..37b9d6a292 100644
--- a/libnm-core/nm-setting-adsl.c
+++ b/libnm-core/nm-setting-adsl.c
@@ -349,10 +349,10 @@ nm_setting_adsl_class_init(NMSettingAdslClass *klass)
     setting_class->need_secrets   = need_secrets;
 
     /**
-	 * NMSettingAdsl:username:
-	 *
-	 * Username used to authenticate with the ADSL service.
-	 **/
+     * NMSettingAdsl:username:
+     *
+     * Username used to authenticate with the ADSL service.
+     **/
     obj_properties[PROP_USERNAME] = g_param_spec_string(NM_SETTING_ADSL_USERNAME,
                                                         "",
                                                         "",
@@ -360,10 +360,10 @@ nm_setting_adsl_class_init(NMSettingAdslClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingAdsl:password:
-	 *
-	 * Password used to authenticate with the ADSL service.
-	 **/
+     * NMSettingAdsl:password:
+     *
+     * Password used to authenticate with the ADSL service.
+     **/
     obj_properties[PROP_PASSWORD] =
         g_param_spec_string(NM_SETTING_ADSL_PASSWORD,
                             "",
@@ -372,10 +372,10 @@ nm_setting_adsl_class_init(NMSettingAdslClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingAdsl:password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingAdsl:password property.
-	 **/
+     * NMSettingAdsl:password-flags:
+     *
+     * Flags indicating how to handle the #NMSettingAdsl:password property.
+     **/
     obj_properties[PROP_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_ADSL_PASSWORD_FLAGS,
                            "",
@@ -385,10 +385,10 @@ nm_setting_adsl_class_init(NMSettingAdslClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingAdsl:protocol:
-	 *
-	 * ADSL connection protocol.  Can be "pppoa", "pppoe" or "ipoatm".
-	 **/
+     * NMSettingAdsl:protocol:
+     *
+     * ADSL connection protocol.  Can be "pppoa", "pppoe" or "ipoatm".
+     **/
     obj_properties[PROP_PROTOCOL] = g_param_spec_string(NM_SETTING_ADSL_PROTOCOL,
                                                         "",
                                                         "",
@@ -396,10 +396,10 @@ nm_setting_adsl_class_init(NMSettingAdslClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingAdsl:encapsulation:
-	 *
-	 * Encapsulation of ADSL connection.  Can be "vcmux" or "llc".
-	 **/
+     * NMSettingAdsl:encapsulation:
+     *
+     * Encapsulation of ADSL connection.  Can be "vcmux" or "llc".
+     **/
     obj_properties[PROP_ENCAPSULATION] =
         g_param_spec_string(NM_SETTING_ADSL_ENCAPSULATION,
                             "",
@@ -408,10 +408,10 @@ nm_setting_adsl_class_init(NMSettingAdslClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingAdsl:vpi:
-	 *
-	 * VPI of ADSL connection
-	 **/
+     * NMSettingAdsl:vpi:
+     *
+     * VPI of ADSL connection
+     **/
     obj_properties[PROP_VPI] = g_param_spec_uint(NM_SETTING_ADSL_VPI,
                                                  "",
                                                  "",
@@ -421,10 +421,10 @@ nm_setting_adsl_class_init(NMSettingAdslClass *klass)
                                                  G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingAdsl:vci:
-	 *
-	 * VCI of ADSL connection
-	 **/
+     * NMSettingAdsl:vci:
+     *
+     * VCI of ADSL connection
+     **/
     obj_properties[PROP_VCI] = g_param_spec_uint(NM_SETTING_ADSL_VCI,
                                                  "",
                                                  "",
diff --git a/libnm-core/nm-setting-bluetooth.c b/libnm-core/nm-setting-bluetooth.c
index 47a354e6ad..617f3adef2 100644
--- a/libnm-core/nm-setting-bluetooth.c
+++ b/libnm-core/nm-setting-bluetooth.c
@@ -142,9 +142,9 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
 
         if (!gsm && !cdma) {
             /* We can't return MISSING_SETTING here, because we don't know
-			 * whether to prefix the message with NM_SETTING_GSM_SETTING_NAME or
-			 * NM_SETTING_CDMA_SETTING_NAME.
-			 */
+             * whether to prefix the message with NM_SETTING_GSM_SETTING_NAME or
+             * NM_SETTING_CDMA_SETTING_NAME.
+             */
             g_set_error(error,
                         NM_CONNECTION_ERROR,
                         NM_CONNECTION_ERROR_INVALID_SETTING,
@@ -157,8 +157,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
         }
     }
     /* PANU doesn't need a 'type' setting since no further configuration
-	 * is required at the interface level.
-	 */
+     * is required at the interface level.
+     */
 
     /* NAP mode needs a bridge setting, and a bridge needs a name. */
     if (nm_streq(type, NM_SETTING_BLUETOOTH_TYPE_NAP)) {
@@ -296,10 +296,10 @@ nm_setting_bluetooth_class_init(NMSettingBluetoothClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingBluetooth:bdaddr:
-	 *
-	 * The Bluetooth address of the device.
-	 **/
+     * NMSettingBluetooth:bdaddr:
+     *
+     * The Bluetooth address of the device.
+     **/
     obj_properties[PROP_BDADDR] = g_param_spec_string(
         NM_SETTING_BLUETOOTH_BDADDR,
         "",
@@ -311,11 +311,11 @@ nm_setting_bluetooth_class_init(NMSettingBluetoothClass *klass)
                                  &nm_sett_info_propert_type_mac_address);
 
     /**
-	 * NMSettingBluetooth:type:
-	 *
-	 * Either "dun" for Dial-Up Networking connections or "panu" for Personal
-	 * Area Networking connections to devices supporting the NAP profile.
-	 **/
+     * NMSettingBluetooth:type:
+     *
+     * Either "dun" for Dial-Up Networking connections or "panu" for Personal
+     * Area Networking connections to devices supporting the NAP profile.
+     **/
     obj_properties[PROP_TYPE] = g_param_spec_string(NM_SETTING_BLUETOOTH_TYPE,
                                                     "",
                                                     "",
diff --git a/libnm-core/nm-setting-bond.c b/libnm-core/nm-setting-bond.c
index 6bebb4a885..f8d72458a7 100644
--- a/libnm-core/nm-setting-bond.c
+++ b/libnm-core/nm-setting-bond.c
@@ -279,7 +279,7 @@ _bond_get_option_normalized(NMSettingBond *self, const char *option, gboolean ge
 
     if (mode == NM_BOND_MODE_UNKNOWN) {
         /* the mode is unknown, consequently, there is no normalized/default
-		 * value either. */
+         * value either. */
         return NULL;
     }
 
@@ -294,7 +294,7 @@ _bond_get_option_normalized(NMSettingBond *self, const char *option, gboolean ge
             int miimon;
 
             /* if arp_interval is explicitly set and miimon is not, then disable miimon
-			 * (and related updelay and downdelay) as recommended by the kernel docs */
+             * (and related updelay and downdelay) as recommended by the kernel docs */
             miimon =
                 _nm_utils_ascii_str_to_int64(_bond_get_option(self, NM_SETTING_BOND_OPTION_MIIMON),
                                              10,
@@ -317,7 +317,7 @@ _bond_get_option_normalized(NMSettingBond *self, const char *option, gboolean ge
                 value = _bond_get_option(self, NM_SETTING_BOND_OPTION_NUM_UNSOL_NA);
         } else if (NM_IN_STRSET(option, NM_SETTING_BOND_OPTION_ACTIVE_SLAVE)) {
             /* "active_slave" is deprecated, and an alias for "primary". The property
-			 * itself always normalizes to %NULL. */
+             * itself always normalizes to %NULL. */
             value = NULL;
         } else if (NM_IN_STRSET(option, NM_SETTING_BOND_OPTION_PRIMARY)) {
             /* "active_slave" is deprecated, and an alias for "primary". */
@@ -798,14 +798,14 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     num_unsol_na = _atoi(_bond_get_option_or_default(self, NM_SETTING_BOND_OPTION_NUM_UNSOL_NA));
 
     /* Option restrictions:
-	 *
-	 * arp_interval conflicts [ alb, tlb ]
-	 * arp_interval needs arp_ip_target
-	 * arp_validate does not work with [ BOND_MODE_8023AD, BOND_MODE_TLB, BOND_MODE_ALB ]
-	 * downdelay needs miimon
-	 * updelay needs miimon
-	 * primary needs [ active-backup, tlb, alb ]
-	 */
+     *
+     * arp_interval conflicts [ alb, tlb ]
+     * arp_interval needs arp_ip_target
+     * arp_validate does not work with [ BOND_MODE_8023AD, BOND_MODE_TLB, BOND_MODE_ALB ]
+     * downdelay needs miimon
+     * updelay needs miimon
+     * primary needs [ active-backup, tlb, alb ]
+     */
 
     /* Verify bond mode */
     mode_str = _bond_get_option(self, NM_SETTING_BOND_OPTION_MODE);
@@ -913,8 +913,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     }
 
     /* arp_ip_target can only be used with arp_interval, and must
-	 * contain a comma-separated list of IPv4 addresses.
-	 */
+     * contain a comma-separated list of IPv4 addresses.
+     */
     arp_ip_target = _bond_get_option(self, NM_SETTING_BOND_OPTION_ARP_IP_TARGET);
     if (arp_interval > 0) {
         if (!arp_ip_target) {
@@ -1017,10 +1017,10 @@ options_equal_asym(NMSettingBond *s_bond, NMSettingBond *s_bond2, NMSettingCompa
     while (g_hash_table_iter_next(&iter, (gpointer *) &key, (gpointer *) &value)) {
         if (NM_FLAGS_HAS(flags, NM_SETTING_COMPARE_FLAG_INFERRABLE)) {
             /* when doing an inferrable match, the active-slave should be ignored
-			 * as it might be differ from the setting in the connection.
-			 *
-			 * Also, the fail_over_mac setting can change, see for example
-			 * https://bugzilla.redhat.com/show_bug.cgi?id=1375558#c8 */
+             * as it might be differ from the setting in the connection.
+             *
+             * Also, the fail_over_mac setting can change, see for example
+             * https://bugzilla.redhat.com/show_bug.cgi?id=1375558#c8 */
             if (NM_IN_STRSET(key, "fail_over_mac", "active_slave"))
                 continue;
         }
@@ -1143,19 +1143,19 @@ nm_setting_bond_class_init(NMSettingBondClass *klass)
     setting_class->compare_property = compare_property;
 
     /**
-	 * NMSettingBond:options: (type GHashTable(utf8,utf8)):
-	 *
-	 * Dictionary of key/value pairs of bonding options.  Both keys and values
-	 * must be strings. Option names must contain only alphanumeric characters
-	 * (ie, [a-zA-Z0-9]).
-	 **/
+     * NMSettingBond:options: (type GHashTable(utf8,utf8)):
+     *
+     * Dictionary of key/value pairs of bonding options.  Both keys and values
+     * must be strings. Option names must contain only alphanumeric characters
+     * (ie, [a-zA-Z0-9]).
+     **/
     /* ---ifcfg-rh---
-	 * property: options
-	 * variable: BONDING_OPTS
-	 * description: Bonding options.
-	 * example: BONDING_OPTS="miimon=100 mode=broadcast"
-	 * ---end---
-	 */
+     * property: options
+     * variable: BONDING_OPTS
+     * description: Bonding options.
+     * example: BONDING_OPTS="miimon=100 mode=broadcast"
+     * ---end---
+     */
     obj_properties[PROP_OPTIONS] = g_param_spec_boxed(
         NM_SETTING_BOND_OPTIONS,
         "",
diff --git a/libnm-core/nm-setting-bridge-port.c b/libnm-core/nm-setting-bridge-port.c
index 19ea76c76e..fd7499e1d8 100644
--- a/libnm-core/nm-setting-bridge-port.c
+++ b/libnm-core/nm-setting-bridge-port.c
@@ -482,18 +482,18 @@ nm_setting_bridge_port_class_init(NMSettingBridgePortClass *klass)
     setting_class->verify           = verify;
 
     /**
-	 * NMSettingBridgePort:priority:
-	 *
-	 * The Spanning Tree Protocol (STP) priority of this bridge port.
-	 **/
+     * NMSettingBridgePort:priority:
+     *
+     * The Spanning Tree Protocol (STP) priority of this bridge port.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority
-	 * variable: BRIDGING_OPTS: priority=
-	 * values: 0 - 63
-	 * default: 32
-	 * description: STP priority.
-	 * ---end---
-	 */
+     * property: priority
+     * variable: BRIDGING_OPTS: priority=
+     * values: 0 - 63
+     * default: 32
+     * description: STP priority.
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY] =
         g_param_spec_uint(NM_SETTING_BRIDGE_PORT_PRIORITY,
                           "",
@@ -504,19 +504,19 @@ nm_setting_bridge_port_class_init(NMSettingBridgePortClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridgePort:path-cost:
-	 *
-	 * The Spanning Tree Protocol (STP) port cost for destinations via this
-	 * port.
-	 **/
+     * NMSettingBridgePort:path-cost:
+     *
+     * The Spanning Tree Protocol (STP) port cost for destinations via this
+     * port.
+     **/
     /* ---ifcfg-rh---
-	 * property: path-cost
-	 * variable: BRIDGING_OPTS: path_cost=
-	 * values: 1 - 65535
-	 * default: 100
-	 * description: STP cost.
-	 * ---end---
-	 */
+     * property: path-cost
+     * variable: BRIDGING_OPTS: path_cost=
+     * values: 1 - 65535
+     * default: 100
+     * description: STP cost.
+     * ---end---
+     */
     obj_properties[PROP_PATH_COST] = g_param_spec_uint(NM_SETTING_BRIDGE_PORT_PATH_COST,
                                                        "",
                                                        "",
@@ -526,18 +526,18 @@ nm_setting_bridge_port_class_init(NMSettingBridgePortClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridgePort:hairpin-mode:
-	 *
-	 * Enables or disables "hairpin mode" for the port, which allows frames to
-	 * be sent back out through the port the frame was received on.
-	 **/
+     * NMSettingBridgePort:hairpin-mode:
+     *
+     * Enables or disables "hairpin mode" for the port, which allows frames to
+     * be sent back out through the port the frame was received on.
+     **/
     /* ---ifcfg-rh---
-	 * property: hairpin-mode
-	 * variable: BRIDGING_OPTS: hairpin_mode=
-	 * default: yes
-	 * description: Hairpin mode of the bridge port.
-	 * ---end---
-	 */
+     * property: hairpin-mode
+     * variable: BRIDGING_OPTS: hairpin_mode=
+     * default: yes
+     * description: Hairpin mode of the bridge port.
+     * ---end---
+     */
     obj_properties[PROP_HAIRPIN_MODE] = g_param_spec_boolean(
         NM_SETTING_BRIDGE_PORT_HAIRPIN_MODE,
         "",
@@ -546,30 +546,30 @@ nm_setting_bridge_port_class_init(NMSettingBridgePortClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridgePort:vlans: (type GPtrArray(NMBridgeVlan))
-	 *
-	 * Array of bridge VLAN objects. In addition to the VLANs
-	 * specified here, the port will also have the default-pvid
-	 * VLAN configured on the bridge by the bridge.vlan-default-pvid
-	 * property.
-	 *
-	 * In nmcli the VLAN list can be specified with the following
-	 * syntax:
-	 *
-	 *  $vid [pvid] [untagged] [, $vid [pvid] [untagged]]...
-	 *
-	 * where $vid is either a single id between 1 and 4094 or a
-	 * range, represented as a couple of ids separated by a dash.
-	 *
-	 * Since: 1.18
-	 **/
+     * NMSettingBridgePort:vlans: (type GPtrArray(NMBridgeVlan))
+     *
+     * Array of bridge VLAN objects. In addition to the VLANs
+     * specified here, the port will also have the default-pvid
+     * VLAN configured on the bridge by the bridge.vlan-default-pvid
+     * property.
+     *
+     * In nmcli the VLAN list can be specified with the following
+     * syntax:
+     *
+     *  $vid [pvid] [untagged] [, $vid [pvid] [untagged]]...
+     *
+     * where $vid is either a single id between 1 and 4094 or a
+     * range, represented as a couple of ids separated by a dash.
+     *
+     * Since: 1.18
+     **/
     /* ---ifcfg-rh---
-	 * property: vlans
-	 * variable: BRIDGE_PORT_VLANS
-	 * description: List of VLANs on the bridge port
-	 * example: BRIDGE_PORT_VLANS="1 pvid untagged,20,300-400 untagged"
-	 * ---end---
-	 */
+     * property: vlans
+     * variable: BRIDGE_PORT_VLANS
+     * description: List of VLANs on the bridge port
+     * example: BRIDGE_PORT_VLANS="1 pvid untagged,20,300-400 untagged"
+     * ---end---
+     */
     obj_properties[PROP_VLANS] = g_param_spec_boxed(NM_SETTING_BRIDGE_PORT_VLANS,
                                                     "",
                                                     "",
diff --git a/libnm-core/nm-setting-bridge.c b/libnm-core/nm-setting-bridge.c
index 1a98cac67e..ffbca6a120 100644
--- a/libnm-core/nm-setting-bridge.c
+++ b/libnm-core/nm-setting-bridge.c
@@ -266,9 +266,9 @@ gboolean
 nm_bridge_vlan_get_vid_range(const NMBridgeVlan *vlan, guint16 *vid_start, guint16 *vid_end)
 {
     /* with LTO and optimization, the compiler complains that the
-	 * output variables are not initialized. In practice, the function
-	 * only sets the output on success. But make the compiler happy.
-	 */
+     * output variables are not initialized. In practice, the function
+     * only sets the output on success. But make the compiler happy.
+     */
     NM_SET_OUT(vid_start, 0);
     NM_SET_OUT(vid_end, 0);
 
@@ -431,8 +431,8 @@ nm_bridge_vlan_to_str(const NMBridgeVlan *vlan, GError **error)
     g_return_val_if_fail(!error || !*error, NULL);
 
     /* The function never fails at the moment, but it might in the
-	 * future if more parameters are added to the object that could
-	 * make it invalid. */
+     * future if more parameters are added to the object that could
+     * make it invalid. */
 
     nm_str_buf_init(&string, NM_UTILS_GET_NEXT_REALLOC_SIZE_32, FALSE);
 
@@ -1610,35 +1610,35 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
     setting_class->verify           = verify;
 
     /**
-	 * NMSettingBridge:mac-address:
-	 *
-	 * If specified, the MAC address of bridge. When creating a new bridge, this
-	 * MAC address will be set.
-	 *
-	 * If this field is left unspecified, the "ethernet.cloned-mac-address" is
-	 * referred instead to generate the initial MAC address. Note that setting
-	 * "ethernet.cloned-mac-address" anyway overwrites the MAC address of
-	 * the bridge later while activating the bridge. Hence, this property
-	 * is deprecated.
-	 *
-	 * Deprecated: 1.12: Use the ethernet.cloned-mac-address property instead.
-	 **/
+     * NMSettingBridge:mac-address:
+     *
+     * If specified, the MAC address of bridge. When creating a new bridge, this
+     * MAC address will be set.
+     *
+     * If this field is left unspecified, the "ethernet.cloned-mac-address" is
+     * referred instead to generate the initial MAC address. Note that setting
+     * "ethernet.cloned-mac-address" anyway overwrites the MAC address of
+     * the bridge later while activating the bridge. Hence, this property
+     * is deprecated.
+     *
+     * Deprecated: 1.12: Use the ethernet.cloned-mac-address property instead.
+     **/
     /* ---keyfile---
-	 * property: mac-address
-	 * format: usual hex-digits-and-colons notation
-	 * description: MAC address in traditional hex-digits-and-colons notation,
-	 *   or semicolon separated list of 6 decimal bytes (obsolete)
-	 * example: mac-address=00:22:68:12:79:A2
-	 *  mac-address=0;34;104;18;121;162;
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: mac-address
-	 * variable: BRIDGE_MACADDR(+)
-	 * description: MAC address of the bridge. Note that this requires a recent
-	 *   kernel support, originally introduced in 3.15 upstream kernel)
-	 *   BRIDGE_MACADDR for bridges is an NM extension.
-	 * ---end---
-	 */
+     * property: mac-address
+     * format: usual hex-digits-and-colons notation
+     * description: MAC address in traditional hex-digits-and-colons notation,
+     *   or semicolon separated list of 6 decimal bytes (obsolete)
+     * example: mac-address=00:22:68:12:79:A2
+     *  mac-address=0;34;104;18;121;162;
+     * ---end---
+     * ---ifcfg-rh---
+     * property: mac-address
+     * variable: BRIDGE_MACADDR(+)
+     * description: MAC address of the bridge. Note that this requires a recent
+     *   kernel support, originally introduced in 3.15 upstream kernel)
+     *   BRIDGE_MACADDR for bridges is an NM extension.
+     * ---end---
+     */
     obj_properties[PROP_MAC_ADDRESS] = g_param_spec_string(
         NM_SETTING_BRIDGE_MAC_ADDRESS,
         "",
@@ -1650,17 +1650,17 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                                  &nm_sett_info_propert_type_mac_address);
 
     /**
-	 * NMSettingBridge:stp:
-	 *
-	 * Controls whether Spanning Tree Protocol (STP) is enabled for this bridge.
-	 **/
+     * NMSettingBridge:stp:
+     *
+     * Controls whether Spanning Tree Protocol (STP) is enabled for this bridge.
+     **/
     /* ---ifcfg-rh---
-	 * property: stp
-	 * variable: STP
-	 * default: no
-	 * description: Span tree protocol participation.
-	 * ---end---
-	 */
+     * property: stp
+     * variable: STP
+     * default: no
+     * description: Span tree protocol participation.
+     * ---end---
+     */
     obj_properties[PROP_STP] = g_param_spec_boolean(NM_SETTING_BRIDGE_STP,
                                                     "",
                                                     "",
@@ -1669,20 +1669,20 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                                                         | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:priority:
-	 *
-	 * Sets the Spanning Tree Protocol (STP) priority for this bridge.  Lower
-	 * values are "better"; the lowest priority bridge will be elected the root
-	 * bridge.
-	 **/
+     * NMSettingBridge:priority:
+     *
+     * Sets the Spanning Tree Protocol (STP) priority for this bridge.  Lower
+     * values are "better"; the lowest priority bridge will be elected the root
+     * bridge.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority
-	 * variable: BRIDGING_OPTS: priority=
-	 * values: 0 - 32768
-	 * default: 32768
-	 * description: STP priority.
-	 * ---end---
-	 */
+     * property: priority
+     * variable: BRIDGING_OPTS: priority=
+     * values: 0 - 32768
+     * default: 32768
+     * description: STP priority.
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY] =
         g_param_spec_uint(NM_SETTING_BRIDGE_PRIORITY,
                           "",
@@ -1693,18 +1693,18 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:forward-delay:
-	 *
-	 * The Spanning Tree Protocol (STP) forwarding delay, in seconds.
-	 **/
+     * NMSettingBridge:forward-delay:
+     *
+     * The Spanning Tree Protocol (STP) forwarding delay, in seconds.
+     **/
     /* ---ifcfg-rh---
-	 * property: forward-delay
-	 * variable: DELAY
-	 * values: 2 - 30
-	 * default: 15
-	 * description: STP forwarding delay.
-	 * ---end---
-	 */
+     * property: forward-delay
+     * variable: DELAY
+     * values: 2 - 30
+     * default: 15
+     * description: STP forwarding delay.
+     * ---end---
+     */
     obj_properties[PROP_FORWARD_DELAY] =
         g_param_spec_uint(NM_SETTING_BRIDGE_FORWARD_DELAY,
                           "",
@@ -1715,18 +1715,18 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:hello-time:
-	 *
-	 * The Spanning Tree Protocol (STP) hello time, in seconds.
-	 **/
+     * NMSettingBridge:hello-time:
+     *
+     * The Spanning Tree Protocol (STP) hello time, in seconds.
+     **/
     /* ---ifcfg-rh---
-	 * property: hello-time
-	 * variable: BRIDGING_OPTS: hello_time=
-	 * values: 1 - 10
-	 * default: 2
-	 * description: STP hello time.
-	 * ---end---
-	 */
+     * property: hello-time
+     * variable: BRIDGING_OPTS: hello_time=
+     * values: 1 - 10
+     * default: 2
+     * description: STP hello time.
+     * ---end---
+     */
     obj_properties[PROP_HELLO_TIME] =
         g_param_spec_uint(NM_SETTING_BRIDGE_HELLO_TIME,
                           "",
@@ -1737,18 +1737,18 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:max-age:
-	 *
-	 * The Spanning Tree Protocol (STP) maximum message age, in seconds.
-	 **/
+     * NMSettingBridge:max-age:
+     *
+     * The Spanning Tree Protocol (STP) maximum message age, in seconds.
+     **/
     /* ---ifcfg-rh---
-	 * property: max-age
-	 * variable: BRIDGING_OPTS: max_age=
-	 * values: 6 - 40
-	 * default: 20
-	 * description: STP maximum message age.
-	 * ---end---
-	 */
+     * property: max-age
+     * variable: BRIDGING_OPTS: max_age=
+     * values: 6 - 40
+     * default: 20
+     * description: STP maximum message age.
+     * ---end---
+     */
     obj_properties[PROP_MAX_AGE] =
         g_param_spec_uint(NM_SETTING_BRIDGE_MAX_AGE,
                           "",
@@ -1759,18 +1759,18 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:ageing-time:
-	 *
-	 * The Ethernet MAC address aging time, in seconds.
-	 **/
+     * NMSettingBridge:ageing-time:
+     *
+     * The Ethernet MAC address aging time, in seconds.
+     **/
     /* ---ifcfg-rh---
-	 * property: ageing-time
-	 * variable: BRIDGING_OPTS: ageing_time=
-	 * values: 0 - 1000000
-	 * default: 300
-	 * description: Ethernet MAC ageing time.
-	 * ---end---
-	 */
+     * property: ageing-time
+     * variable: BRIDGING_OPTS: ageing_time=
+     * values: 0 - 1000000
+     * default: 300
+     * description: Ethernet MAC ageing time.
+     * ---end---
+     */
     obj_properties[PROP_AGEING_TIME] =
         g_param_spec_uint(NM_SETTING_BRIDGE_AGEING_TIME,
                           "",
@@ -1781,17 +1781,17 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:group-forward-mask:
-	 *
-	 * A mask of group addresses to forward. Usually, group addresses in
-	 * the range from 01:80:C2:00:00:00 to 01:80:C2:00:00:0F are not
-	 * forwarded according to standards. This property is a mask of 16 bits,
-	 * each corresponding to a group address in that range that must be
-	 * forwarded. The mask can't have bits 0, 1 or 2 set because they are
-	 * used for STP, MAC pause frames and LACP.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingBridge:group-forward-mask:
+     *
+     * A mask of group addresses to forward. Usually, group addresses in
+     * the range from 01:80:C2:00:00:00 to 01:80:C2:00:00:0F are not
+     * forwarded according to standards. This property is a mask of 16 bits,
+     * each corresponding to a group address in that range that must be
+     * forwarded. The mask can't have bits 0, 1 or 2 set because they are
+     * used for STP, MAC pause frames and LACP.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_GROUP_FORWARD_MASK] =
         g_param_spec_uint(NM_SETTING_BRIDGE_GROUP_FORWARD_MASK,
                           "",
@@ -1802,23 +1802,23 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-snooping:
-	 *
-	 * Controls whether IGMP snooping is enabled for this bridge.
-	 * Note that if snooping was automatically disabled due to hash collisions,
-	 * the system may refuse to enable the feature until the collisions are
-	 * resolved.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingBridge:multicast-snooping:
+     *
+     * Controls whether IGMP snooping is enabled for this bridge.
+     * Note that if snooping was automatically disabled due to hash collisions,
+     * the system may refuse to enable the feature until the collisions are
+     * resolved.
+     *
+     * Since: 1.2
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-snooping
-	 * variable: BRIDGING_OPTS: multicast_snooping=
-	 * values: 0 or 1
-	 * default: 1
-	 * description: IGMP snooping support.
-	 * ---end---
-	 */
+     * property: multicast-snooping
+     * variable: BRIDGING_OPTS: multicast_snooping=
+     * values: 0 or 1
+     * default: 1
+     * description: IGMP snooping support.
+     * ---end---
+     */
     obj_properties[PROP_MULTICAST_SNOOPING] = g_param_spec_boolean(
         NM_SETTING_BRIDGE_MULTICAST_SNOOPING,
         "",
@@ -1827,20 +1827,20 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:vlan-filtering:
-	 *
-	 * Control whether VLAN filtering is enabled on the bridge.
-	 *
-	 * Since: 1.18
-	 **/
+     * NMSettingBridge:vlan-filtering:
+     *
+     * Control whether VLAN filtering is enabled on the bridge.
+     *
+     * Since: 1.18
+     **/
     /* ---ifcfg-rh---
-	 * property: vlan-filtering
-	 * variable: BRIDGING_OPTS: vlan_filtering=
-	 * values: 0 or 1
-	 * default: 0
-	 * description: VLAN filtering support.
-	 * ---end---
-	 */
+     * property: vlan-filtering
+     * variable: BRIDGING_OPTS: vlan_filtering=
+     * values: 0 or 1
+     * default: 0
+     * description: VLAN filtering support.
+     * ---end---
+     */
     obj_properties[PROP_VLAN_FILTERING] = g_param_spec_boolean(
         NM_SETTING_BRIDGE_VLAN_FILTERING,
         "",
@@ -1849,21 +1849,21 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:vlan-default-pvid:
-	 *
-	 * The default PVID for the ports of the bridge, that is the VLAN id
-	 * assigned to incoming untagged frames.
-	 *
-	 * Since: 1.18
-	 **/
+     * NMSettingBridge:vlan-default-pvid:
+     *
+     * The default PVID for the ports of the bridge, that is the VLAN id
+     * assigned to incoming untagged frames.
+     *
+     * Since: 1.18
+     **/
     /* ---ifcfg-rh---
-	 * property: vlan-default-pvid
-	 * variable: BRIDGING_OPTS: default_pvid=
-	 * values: 0 - 4094
-	 * default: 1
-	 * description: default VLAN PVID.
-	 * ---end---
-	 */
+     * property: vlan-default-pvid
+     * variable: BRIDGING_OPTS: default_pvid=
+     * values: 0 - 4094
+     * default: 1
+     * description: default VLAN PVID.
+     * ---end---
+     */
     obj_properties[PROP_VLAN_DEFAULT_PVID] =
         g_param_spec_uint(NM_SETTING_BRIDGE_VLAN_DEFAULT_PVID,
                           "",
@@ -1874,29 +1874,29 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:vlans: (type GPtrArray(NMBridgeVlan))
-	 *
-	 * Array of bridge VLAN objects. In addition to the VLANs
-	 * specified here, the bridge will also have the default-pvid
-	 * VLAN configured  by the bridge.vlan-default-pvid property.
-	 *
-	 * In nmcli the VLAN list can be specified with the following
-	 * syntax:
-	 *
-	 *  $vid [pvid] [untagged] [, $vid [pvid] [untagged]]...
-	 *
-	 * where $vid is either a single id between 1 and 4094 or a
-	 * range, represented as a couple of ids separated by a dash.
-	 *
-	 * Since: 1.18
-	 **/
+     * NMSettingBridge:vlans: (type GPtrArray(NMBridgeVlan))
+     *
+     * Array of bridge VLAN objects. In addition to the VLANs
+     * specified here, the bridge will also have the default-pvid
+     * VLAN configured  by the bridge.vlan-default-pvid property.
+     *
+     * In nmcli the VLAN list can be specified with the following
+     * syntax:
+     *
+     *  $vid [pvid] [untagged] [, $vid [pvid] [untagged]]...
+     *
+     * where $vid is either a single id between 1 and 4094 or a
+     * range, represented as a couple of ids separated by a dash.
+     *
+     * Since: 1.18
+     **/
     /* ---ifcfg-rh---
-	 * property: vlans
-	 * variable: BRIDGE_VLANS
-	 * description: List of VLANs on the bridge
-	 * example: BRIDGE_VLANS="1 pvid untagged,20,300-400 untagged"
-	 * ---end---
-	 */
+     * property: vlans
+     * variable: BRIDGE_VLANS
+     * description: List of VLANs on the bridge
+     * example: BRIDGE_VLANS="1 pvid untagged,20,300-400 untagged"
+     * ---end---
+     */
     obj_properties[PROP_VLANS] = g_param_spec_boxed(NM_SETTING_BRIDGE_VLANS,
                                                     "",
                                                     "",
@@ -1908,35 +1908,35 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                                  &nm_sett_info_propert_type_bridge_vlans);
 
     /* ---dbus---
-	 * property: interface-name
-	 * format: string
-	 * description: Deprecated in favor of connection.interface-name, but can
-	 *   be used for backward-compatibility with older daemons, to set the
-	 *   bridge's interface name.
-	 * ---end---
-	 */
+     * property: interface-name
+     * format: string
+     * description: Deprecated in favor of connection.interface-name, but can
+     *   be used for backward-compatibility with older daemons, to set the
+     *   bridge's interface name.
+     * ---end---
+     */
     _nm_properties_override_dbus(properties_override,
                                  "interface-name",
                                  &nm_sett_info_propert_type_deprecated_interface_name);
 
     /**
-	 * NMSettingBridge:group-address:
-	 *
-	 * If specified, The MAC address of the multicast group this bridge uses for STP.
-	 *
-	 * The address must be a link-local address in standard Ethernet MAC address format,
-	 * ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4..F].
-	 * If not specified the default value is 01:80:C2:00:00:00.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMSettingBridge:group-address:
+     *
+     * If specified, The MAC address of the multicast group this bridge uses for STP.
+     *
+     * The address must be a link-local address in standard Ethernet MAC address format,
+     * ie an address of the form 01:80:C2:00:00:0X, with X in [0, 4..F].
+     * If not specified the default value is 01:80:C2:00:00:00.
+     *
+     * Since: 1.24
+     **/
     /* ---ifcfg-rh---
-	 * property: group-address
-	 * variable: BRIDGING_OPTS: group_address=
-	 * description: STP group address.
-	 * example: BRIDGING_OPTS="group_address=01:80:C2:00:00:0A"
-	 * ---end---
-	 */
+     * property: group-address
+     * variable: BRIDGING_OPTS: group_address=
+     * description: STP group address.
+     * example: BRIDGING_OPTS="group_address=01:80:C2:00:00:0A"
+     * ---end---
+     */
     obj_properties[PROP_GROUP_ADDRESS] = g_param_spec_string(
         NM_SETTING_BRIDGE_GROUP_ADDRESS,
         "",
@@ -1948,24 +1948,24 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                                  &nm_sett_info_propert_type_mac_address);
 
     /**
-	 * NMSettingBridge:vlan-protocol:
-	 *
-	 * If specified, the protocol used for VLAN filtering.
-	 *
-	 * Supported values are: '802.1Q', '802.1ad'.
-	 * If not specified the default value is '802.1Q'.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMSettingBridge:vlan-protocol:
+     *
+     * If specified, the protocol used for VLAN filtering.
+     *
+     * Supported values are: '802.1Q', '802.1ad'.
+     * If not specified the default value is '802.1Q'.
+     *
+     * Since: 1.24
+     **/
     /* ---ifcfg-rh---
-	 * property: vlan-protocol
-	 * variable: BRIDGING_OPTS: vlan_protocol=
-	 * description: VLAN filtering protocol.
-	 * example: BRIDGING_OPTS="vlan_protocol=802.1Q"
-	 * ---end---
-	 *
-	 * Since: 1.24
-	 */
+     * property: vlan-protocol
+     * variable: BRIDGING_OPTS: vlan_protocol=
+     * description: VLAN filtering protocol.
+     * example: BRIDGING_OPTS="vlan_protocol=802.1Q"
+     * ---end---
+     *
+     * Since: 1.24
+     */
     obj_properties[PROP_VLAN_PROTOCOL] = g_param_spec_string(
         NM_SETTING_BRIDGE_VLAN_PROTOCOL,
         "",
@@ -1974,19 +1974,19 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:vlan-stats-enabled:
-	 *
-	 * Controls whether per-VLAN stats accounting is enabled.
-	 **/
+     * NMSettingBridge:vlan-stats-enabled:
+     *
+     * Controls whether per-VLAN stats accounting is enabled.
+     **/
     /* ---ifcfg-rh---
-	 * property: vlan-stats-enabled
-	 * variable: BRIDGING_OPTS: vlan_stats_enabled=
-	 * default: 0
-	 * example: BRIDGING_OPTS="vlan_stats_enabled=1"
-	 * ---end---
-	 *
-	 * Since: 1.24
-	 */
+     * property: vlan-stats-enabled
+     * variable: BRIDGING_OPTS: vlan_stats_enabled=
+     * default: 0
+     * example: BRIDGING_OPTS="vlan_stats_enabled=1"
+     * ---end---
+     *
+     * Since: 1.24
+     */
     obj_properties[PROP_VLAN_STATS_ENABLED] = g_param_spec_boolean(
         NM_SETTING_BRIDGE_VLAN_STATS_ENABLED,
         "",
@@ -1995,25 +1995,25 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-router:
-	 *
-	 * Sets bridge's multicast router. Multicast-snooping must be enabled
-	 * for this option to work.
-	 *
-	 * Supported values are: 'auto', 'disabled', 'enabled' to which kernel
-	 * assigns the numbers 1, 0, and 2, respectively.
-	 * If not specified the default value is 'auto' (1).
-	 **/
+     * NMSettingBridge:multicast-router:
+     *
+     * Sets bridge's multicast router. Multicast-snooping must be enabled
+     * for this option to work.
+     *
+     * Supported values are: 'auto', 'disabled', 'enabled' to which kernel
+     * assigns the numbers 1, 0, and 2, respectively.
+     * If not specified the default value is 'auto' (1).
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-router
-	 * variable: BRIDGING_OPTS: multicast_router=
-	 * values: auto, enabled, disabled
-	 * default: auto
-	 * example: BRIDGING_OPTS="multicast_router=enabled"
-	 * ---end---
-	 *
-	 * Since: 1.24
-	 */
+     * property: multicast-router
+     * variable: BRIDGING_OPTS: multicast_router=
+     * values: auto, enabled, disabled
+     * default: auto
+     * example: BRIDGING_OPTS="multicast_router=enabled"
+     * ---end---
+     *
+     * Since: 1.24
+     */
     obj_properties[PROP_MULTICAST_ROUTER] = g_param_spec_string(
         NM_SETTING_BRIDGE_MULTICAST_ROUTER,
         "",
@@ -2022,21 +2022,21 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-query-use-ifaddr:
-	 *
-	 * If enabled the bridge's own IP address is used as
-	 * the source address for IGMP queries otherwise
-	 * the default of 0.0.0.0 is used.
-	 **/
+     * NMSettingBridge:multicast-query-use-ifaddr:
+     *
+     * If enabled the bridge's own IP address is used as
+     * the source address for IGMP queries otherwise
+     * the default of 0.0.0.0 is used.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-query-use-ifaddr
-	 * variable: BRIDGING_OPTS: multicast_query_use_ifaddr=
-	 * default: 0
-	 * example: BRIDGING_OPTS="multicast_query-use_ifaddr=1"
-	 * ---end---
-	 *
-	 * Since: 1.24
-	 */
+     * property: multicast-query-use-ifaddr
+     * variable: BRIDGING_OPTS: multicast_query_use_ifaddr=
+     * default: 0
+     * example: BRIDGING_OPTS="multicast_query-use_ifaddr=1"
+     * ---end---
+     *
+     * Since: 1.24
+     */
     obj_properties[PROP_MULTICAST_QUERY_USE_IFADDR] = g_param_spec_boolean(
         NM_SETTING_BRIDGE_MULTICAST_QUERY_USE_IFADDR,
         "",
@@ -2045,20 +2045,20 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-querier:
-	 *
-	 * Enable or disable sending of multicast queries by the bridge.
-	 * If not specified the option is disabled.
-	 **/
+     * NMSettingBridge:multicast-querier:
+     *
+     * Enable or disable sending of multicast queries by the bridge.
+     * If not specified the option is disabled.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-querier
-	 * variable: BRIDGING_OPTS: multicast_querier=
-	 * default: 0
-	 * example: BRIDGING_OPTS="multicast_querier=1"
-	 * ---end---
-	 *
-	 * Since: 1.24
-	 */
+     * property: multicast-querier
+     * variable: BRIDGING_OPTS: multicast_querier=
+     * default: 0
+     * example: BRIDGING_OPTS="multicast_querier=1"
+     * ---end---
+     *
+     * Since: 1.24
+     */
     obj_properties[PROP_MULTICAST_QUERIER] = g_param_spec_boolean(
         NM_SETTING_BRIDGE_MULTICAST_QUERIER,
         "",
@@ -2067,19 +2067,19 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-hash-max:
-	 *
-	 * Set maximum size of multicast hash table (value must be a power of 2).
-	 **/
+     * NMSettingBridge:multicast-hash-max:
+     *
+     * Set maximum size of multicast hash table (value must be a power of 2).
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-hash-max
-	 * variable: BRIDGING_OPTS: multicast_hash_max=
-	 * default: 4096
-	 * example: BRIDGING_OPTS="multicast_hash_max=8192"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-hash-max
+     * variable: BRIDGING_OPTS: multicast_hash_max=
+     * default: 4096
+     * example: BRIDGING_OPTS="multicast_hash_max=8192"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_HASH_MAX] =
         g_param_spec_uint(NM_SETTING_BRIDGE_MULTICAST_HASH_MAX,
                           "",
@@ -2090,21 +2090,21 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-last-member-count:
-	 *
-	 * Set the number of queries the bridge will send before
-	 * stopping forwarding a multicast group after a "leave"
-	 * message has been received.
-	 **/
+     * NMSettingBridge:multicast-last-member-count:
+     *
+     * Set the number of queries the bridge will send before
+     * stopping forwarding a multicast group after a "leave"
+     * message has been received.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-last-member-count
-	 * variable: BRIDGING_OPTS: multicast_last_member_count=
-	 * default: 2
-	 * example: BRIDGING_OPTS="multicast_last_member_count=4"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-last-member-count
+     * variable: BRIDGING_OPTS: multicast_last_member_count=
+     * default: 2
+     * example: BRIDGING_OPTS="multicast_last_member_count=4"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_LAST_MEMBER_COUNT] =
         g_param_spec_uint(NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_COUNT,
                           "",
@@ -2115,20 +2115,20 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-last-member-interval:
-	 *
-	 * Set interval (in deciseconds) between queries to find remaining
-	 * members of a group, after a "leave" message is received.
-	 **/
+     * NMSettingBridge:multicast-last-member-interval:
+     *
+     * Set interval (in deciseconds) between queries to find remaining
+     * members of a group, after a "leave" message is received.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-last-member-interval
-	 * variable: BRIDGING_OPTS: multicast_last_member_interval=
-	 * default: 100
-	 * example: BRIDGING_OPTS="multicast_last_member_interval=200"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-last-member-interval
+     * variable: BRIDGING_OPTS: multicast_last_member_interval=
+     * default: 100
+     * example: BRIDGING_OPTS="multicast_last_member_interval=200"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_LAST_MEMBER_INTERVAL] = g_param_spec_uint64(
         NM_SETTING_BRIDGE_MULTICAST_LAST_MEMBER_INTERVAL,
         "",
@@ -2139,21 +2139,21 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-membership-interval:
-	 *
-	 * Set delay (in deciseconds) after which the bridge will
-	 * leave a group, if no membership reports for this
-	 * group are received.
-	 **/
+     * NMSettingBridge:multicast-membership-interval:
+     *
+     * Set delay (in deciseconds) after which the bridge will
+     * leave a group, if no membership reports for this
+     * group are received.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-membership-interval
-	 * variable: BRIDGING_OPTS: multicast_membership_interval=
-	 * default: 26000
-	 * example: BRIDGING_OPTS="multicast_membership_interval=16000"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-membership-interval
+     * variable: BRIDGING_OPTS: multicast_membership_interval=
+     * default: 26000
+     * example: BRIDGING_OPTS="multicast_membership_interval=16000"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_MEMBERSHIP_INTERVAL] = g_param_spec_uint64(
         NM_SETTING_BRIDGE_MULTICAST_MEMBERSHIP_INTERVAL,
         "",
@@ -2164,20 +2164,20 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-querier-interval:
-	 *
-	 * If no queries are seen after this delay (in deciseconds) has passed,
-	 * the bridge will start to send its own queries.
-	 **/
+     * NMSettingBridge:multicast-querier-interval:
+     *
+     * If no queries are seen after this delay (in deciseconds) has passed,
+     * the bridge will start to send its own queries.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-querier-interval
-	 * variable: BRIDGING_OPTS: multicast_querier_interval=
-	 * default: 25500
-	 * example: BRIDGING_OPTS="multicast_querier_interval=20000"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-querier-interval
+     * variable: BRIDGING_OPTS: multicast_querier_interval=
+     * default: 25500
+     * example: BRIDGING_OPTS="multicast_querier_interval=20000"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_QUERIER_INTERVAL] = g_param_spec_uint64(
         NM_SETTING_BRIDGE_MULTICAST_QUERIER_INTERVAL,
         "",
@@ -2188,20 +2188,20 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-query-interval:
-	 *
-	 * Interval (in deciseconds) between queries sent
-	 * by the bridge after the end of the startup phase.
-	 **/
+     * NMSettingBridge:multicast-query-interval:
+     *
+     * Interval (in deciseconds) between queries sent
+     * by the bridge after the end of the startup phase.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-query-interval
-	 * variable: BRIDGING_OPTS: multicast_query_interval=
-	 * default: 12500
-	 * example: BRIDGING_OPTS="multicast_query_interval=22500"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-query-interval
+     * variable: BRIDGING_OPTS: multicast_query_interval=
+     * default: 12500
+     * example: BRIDGING_OPTS="multicast_query_interval=22500"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_QUERY_INTERVAL] = g_param_spec_uint64(
         NM_SETTING_BRIDGE_MULTICAST_QUERY_INTERVAL,
         "",
@@ -2212,20 +2212,20 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-query-response-interval:
-	 *
-	 * Set the Max Response Time/Max Response Delay
-	 * (in deciseconds) for IGMP/MLD queries sent by the bridge.
-	 **/
+     * NMSettingBridge:multicast-query-response-interval:
+     *
+     * Set the Max Response Time/Max Response Delay
+     * (in deciseconds) for IGMP/MLD queries sent by the bridge.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-query-response-interval
-	 * variable: BRIDGING_OPTS: multicast_query_response_interval=
-	 * default: 1000
-	 * example: BRIDGING_OPTS="multicast_query_response_interval=2000"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-query-response-interval
+     * variable: BRIDGING_OPTS: multicast_query_response_interval=
+     * default: 1000
+     * example: BRIDGING_OPTS="multicast_query_response_interval=2000"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_QUERY_RESPONSE_INTERVAL] = g_param_spec_uint64(
         NM_SETTING_BRIDGE_MULTICAST_QUERY_RESPONSE_INTERVAL,
         "",
@@ -2236,19 +2236,19 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-startup-query-count:
-	 *
-	 * Set the number of IGMP queries to send during startup phase.
-	 **/
+     * NMSettingBridge:multicast-startup-query-count:
+     *
+     * Set the number of IGMP queries to send during startup phase.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-startup-query-count
-	 * variable: BRIDGING_OPTS: multicast_startup_query_count=
-	 * default: 2
-	 * example: BRIDGING_OPTS="multicast_startup_query_count=4"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-startup-query-count
+     * variable: BRIDGING_OPTS: multicast_startup_query_count=
+     * default: 2
+     * example: BRIDGING_OPTS="multicast_startup_query_count=4"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_STARTUP_QUERY_COUNT] =
         g_param_spec_uint(NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_COUNT,
                           "",
@@ -2259,20 +2259,20 @@ nm_setting_bridge_class_init(NMSettingBridgeClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingBridge:multicast-startup-query-interval:
-	 *
-	 * Sets the time (in deciseconds) between queries sent out
-	 * at startup to determine membership information.
-	 **/
+     * NMSettingBridge:multicast-startup-query-interval:
+     *
+     * Sets the time (in deciseconds) between queries sent out
+     * at startup to determine membership information.
+     **/
     /* ---ifcfg-rh---
-	 * property: multicast-startup-query-interval
-	 * variable: BRIDGING_OPTS: multicast_startup_query_interval=
-	 * default: 3125
-	 * example: BRIDGING_OPTS="multicast_startup_query_interval=4000"
-	 * ---end---
-	 *
-	 * Since: 1.26
-	 */
+     * property: multicast-startup-query-interval
+     * variable: BRIDGING_OPTS: multicast_startup_query_interval=
+     * default: 3125
+     * example: BRIDGING_OPTS="multicast_startup_query_interval=4000"
+     * ---end---
+     *
+     * Since: 1.26
+     */
     obj_properties[PROP_MULTICAST_STARTUP_QUERY_INTERVAL] = g_param_spec_uint64(
         NM_SETTING_BRIDGE_MULTICAST_STARTUP_QUERY_INTERVAL,
         "",
diff --git a/libnm-core/nm-setting-cdma.c b/libnm-core/nm-setting-cdma.c
index c2e932c391..3919421494 100644
--- a/libnm-core/nm-setting-cdma.c
+++ b/libnm-core/nm-setting-cdma.c
@@ -283,12 +283,12 @@ nm_setting_cdma_class_init(NMSettingCdmaClass *klass)
     setting_class->need_secrets   = need_secrets;
 
     /**
-	 * NMSettingCdma:number:
-	 *
-	 * The number to dial to establish the connection to the CDMA-based mobile
-	 * broadband network, if any.  If not specified, the default number (#777)
-	 * is used when required.
-	 **/
+     * NMSettingCdma:number:
+     *
+     * The number to dial to establish the connection to the CDMA-based mobile
+     * broadband network, if any.  If not specified, the default number (#777)
+     * is used when required.
+     **/
     obj_properties[PROP_NUMBER] = g_param_spec_string(NM_SETTING_CDMA_NUMBER,
                                                       "",
                                                       "",
@@ -296,12 +296,12 @@ nm_setting_cdma_class_init(NMSettingCdmaClass *klass)
                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingCdma:username:
-	 *
-	 * The username used to authenticate with the network, if required.  Many
-	 * providers do not require a username, or accept any username.  But if a
-	 * username is required, it is specified here.
-	 **/
+     * NMSettingCdma:username:
+     *
+     * The username used to authenticate with the network, if required.  Many
+     * providers do not require a username, or accept any username.  But if a
+     * username is required, it is specified here.
+     **/
     obj_properties[PROP_USERNAME] = g_param_spec_string(NM_SETTING_CDMA_USERNAME,
                                                         "",
                                                         "",
@@ -309,12 +309,12 @@ nm_setting_cdma_class_init(NMSettingCdmaClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingCdma:password:
-	 *
-	 * The password used to authenticate with the network, if required.  Many
-	 * providers do not require a password, or accept any password.  But if a
-	 * password is required, it is specified here.
-	 **/
+     * NMSettingCdma:password:
+     *
+     * The password used to authenticate with the network, if required.  Many
+     * providers do not require a password, or accept any password.  But if a
+     * password is required, it is specified here.
+     **/
     obj_properties[PROP_PASSWORD] =
         g_param_spec_string(NM_SETTING_CDMA_PASSWORD,
                             "",
@@ -323,10 +323,10 @@ nm_setting_cdma_class_init(NMSettingCdmaClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingCdma:password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingCdma:password property.
-	 **/
+     * NMSettingCdma:password-flags:
+     *
+     * Flags indicating how to handle the #NMSettingCdma:password property.
+     **/
     obj_properties[PROP_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_CDMA_PASSWORD_FLAGS,
                            "",
@@ -336,13 +336,13 @@ nm_setting_cdma_class_init(NMSettingCdmaClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingCdma:mtu:
-	 *
-	 * If non-zero, only transmit packets of the specified size or smaller,
-	 * breaking larger packets up into multiple frames.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSettingCdma:mtu:
+     *
+     * If non-zero, only transmit packets of the specified size or smaller,
+     * breaking larger packets up into multiple frames.
+     *
+     * Since: 1.8
+     **/
     obj_properties[PROP_MTU] = g_param_spec_uint(NM_SETTING_CDMA_MTU,
                                                  "",
                                                  "",
diff --git a/libnm-core/nm-setting-connection.c b/libnm-core/nm-setting-connection.c
index 936cd27a30..9a2ab4988e 100644
--- a/libnm-core/nm-setting-connection.c
+++ b/libnm-core/nm-setting-connection.c
@@ -1084,13 +1084,13 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
                 NULL);
             if (!ovs_iface_type) {
                 /* We cannot determine to OVS interface type. Consequently, we cannot
-				 * fully validate the interface name.
-				 *
-				 * If we have a connection (and we do a full validation anyway), skip the
-				 * check. The connection will fail validation when we validate the OVS setting.
-				 *
-				 * Otherwise, do the most basic validation.
-				 */
+                 * fully validate the interface name.
+                 *
+                 * If we have a connection (and we do a full validation anyway), skip the
+                 * check. The connection will fail validation when we validate the OVS setting.
+                 *
+                 * Otherwise, do the most basic validation.
+                 */
                 if (connection)
                     goto after_interface_name;
                 iface_type = NMU_IFACE_ANY;
@@ -1099,7 +1099,7 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
                 iface_type = NMU_IFACE_OVS;
             } else {
                 /* This interface type also requires a netdev. We need to validate
-				 * for both OVS and KERNEL. */
+                 * for both OVS and KERNEL. */
                 nm_assert(NM_IN_STRSET(ovs_iface_type, "internal", "system", "dpdk"));
                 iface_type = NMU_IFACE_OVS_AND_KERNEL;
             }
@@ -1752,17 +1752,17 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
     setting_class->compare_property = compare_property;
 
     /**
-	 * NMSettingConnection:id:
-	 *
-	 * A human readable unique identifier for the connection, like "Work Wi-Fi"
-	 * or "T-Mobile 3G".
-	 **/
+     * NMSettingConnection:id:
+     *
+     * A human readable unique identifier for the connection, like "Work Wi-Fi"
+     * or "T-Mobile 3G".
+     **/
     /* ---ifcfg-rh---
-	 * property: id
-	 * variable: NAME(+)
-	 * description: User friendly name for the connection profile.
-	 * ---end---
-	 */
+     * property: id
+     * variable: NAME(+)
+     * description: User friendly name for the connection profile.
+     * ---end---
+     */
     obj_properties[PROP_ID] = g_param_spec_string(NM_SETTING_CONNECTION_ID,
                                                   "",
                                                   "",
@@ -1771,28 +1771,28 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                                       | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:uuid:
-	 *
-	 * A universally unique identifier for the connection, for example generated
-	 * with libuuid.  It should be assigned when the connection is created, and
-	 * never changed as long as the connection still applies to the same
-	 * network.  For example, it should not be changed when the
-	 * #NMSettingConnection:id property or #NMSettingIP4Config changes, but
-	 * might need to be re-created when the Wi-Fi SSID, mobile broadband network
-	 * provider, or #NMSettingConnection:type property changes.
-	 *
-	 * The UUID must be in the format "2815492f-7e56-435e-b2e9-246bd7cdc664"
-	 * (ie, contains only hexadecimal characters and "-").  A suitable UUID may
-	 * be generated by nm_utils_uuid_generate() or
-	 * nm_utils_uuid_generate_from_string().
-	 **/
+     * NMSettingConnection:uuid:
+     *
+     * A universally unique identifier for the connection, for example generated
+     * with libuuid.  It should be assigned when the connection is created, and
+     * never changed as long as the connection still applies to the same
+     * network.  For example, it should not be changed when the
+     * #NMSettingConnection:id property or #NMSettingIP4Config changes, but
+     * might need to be re-created when the Wi-Fi SSID, mobile broadband network
+     * provider, or #NMSettingConnection:type property changes.
+     *
+     * The UUID must be in the format "2815492f-7e56-435e-b2e9-246bd7cdc664"
+     * (ie, contains only hexadecimal characters and "-").  A suitable UUID may
+     * be generated by nm_utils_uuid_generate() or
+     * nm_utils_uuid_generate_from_string().
+     **/
     /* ---ifcfg-rh---
-	 * property: uuid
-	 * variable: UUID(+)
-	 * description: UUID for the connection profile. When missing, NetworkManager
-	 *   creates the UUID itself (by hashing the filename).
-	 * ---end---
-	 */
+     * property: uuid
+     * variable: UUID(+)
+     * description: UUID for the connection profile. When missing, NetworkManager
+     *   creates the UUID itself (by hashing the filename).
+     * ---end---
+     */
     obj_properties[PROP_UUID] = g_param_spec_string(
         NM_SETTING_CONNECTION_UUID,
         "",
@@ -1801,52 +1801,52 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:stable-id:
-	 *
-	 * This represents the identity of the connection used for various purposes.
-	 * It allows to configure multiple profiles to share the identity. Also,
-	 * the stable-id can contain placeholders that are substituted dynamically and
-	 * deterministically depending on the context.
-	 *
-	 * The stable-id is used for generating IPv6 stable private addresses
-	 * with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the
-	 * generated cloned MAC address for ethernet.cloned-mac-address=stable
-	 * and wifi.cloned-mac-address=stable. It is also used as DHCP client
-	 * identifier with ipv4.dhcp-client-id=stable and to derive the DHCP
-	 * DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid].
-	 *
-	 * Note that depending on the context where it is used, other parameters are
-	 * also seeded into the generation algorithm. For example, a per-host key
-	 * is commonly also included, so that different systems end up generating
-	 * different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's
-	 * name is included, so that different interfaces yield different addresses.
-	 * The per-host key is the identity of your machine and stored in /var/lib/NetworkManager/secret-key.
-	 *
-	 * The '$' character is treated special to perform dynamic substitutions
-	 * at runtime. Currently, supported are "${CONNECTION}", "${DEVICE}", "${MAC}",
-	 * "${BOOT}", "${RANDOM}".
-	 * These effectively create unique IDs per-connection, per-device, per-boot,
-	 * or every time. Note that "${DEVICE}" corresponds to the interface name of the
-	 * device and "${MAC}" is the permanent MAC address of the device.
-	 * Any unrecognized patterns following '$' are treated verbatim, however
-	 * are reserved for future use. You are thus advised to avoid '$' or
-	 * escape it as "$$".
-	 * For example, set it to "${CONNECTION}-${BOOT}-${DEVICE}" to create a unique id for
-	 * this connection that changes with every reboot and differs depending on the
-	 * interface where the profile activates.
-	 *
-	 * If the value is unset, a global connection default is consulted. If the
-	 * value is still unset, the default is similar to "${CONNECTION}" and uses
-	 * a unique, fixed ID for the connection.
-	 *
-	 * Since: 1.4
-	 **/
+     * NMSettingConnection:stable-id:
+     *
+     * This represents the identity of the connection used for various purposes.
+     * It allows to configure multiple profiles to share the identity. Also,
+     * the stable-id can contain placeholders that are substituted dynamically and
+     * deterministically depending on the context.
+     *
+     * The stable-id is used for generating IPv6 stable private addresses
+     * with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the
+     * generated cloned MAC address for ethernet.cloned-mac-address=stable
+     * and wifi.cloned-mac-address=stable. It is also used as DHCP client
+     * identifier with ipv4.dhcp-client-id=stable and to derive the DHCP
+     * DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid].
+     *
+     * Note that depending on the context where it is used, other parameters are
+     * also seeded into the generation algorithm. For example, a per-host key
+     * is commonly also included, so that different systems end up generating
+     * different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's
+     * name is included, so that different interfaces yield different addresses.
+     * The per-host key is the identity of your machine and stored in /var/lib/NetworkManager/secret-key.
+     *
+     * The '$' character is treated special to perform dynamic substitutions
+     * at runtime. Currently, supported are "${CONNECTION}", "${DEVICE}", "${MAC}",
+     * "${BOOT}", "${RANDOM}".
+     * These effectively create unique IDs per-connection, per-device, per-boot,
+     * or every time. Note that "${DEVICE}" corresponds to the interface name of the
+     * device and "${MAC}" is the permanent MAC address of the device.
+     * Any unrecognized patterns following '$' are treated verbatim, however
+     * are reserved for future use. You are thus advised to avoid '$' or
+     * escape it as "$$".
+     * For example, set it to "${CONNECTION}-${BOOT}-${DEVICE}" to create a unique id for
+     * this connection that changes with every reboot and differs depending on the
+     * interface where the profile activates.
+     *
+     * If the value is unset, a global connection default is consulted. If the
+     * value is still unset, the default is similar to "${CONNECTION}" and uses
+     * a unique, fixed ID for the connection.
+     *
+     * Since: 1.4
+     **/
     /* ---ifcfg-rh---
-	 * property: stable-id
-	 * variable: STABLE_ID(+)
-	 * description: Token to generate stable IDs.
-	 * ---end---
-	 */
+     * property: stable-id
+     * variable: STABLE_ID(+)
+     * description: Token to generate stable IDs.
+     * ---end---
+     */
     obj_properties[PROP_STABLE_ID] = g_param_spec_string(
         NM_SETTING_CONNECTION_STABLE_ID,
         "",
@@ -1855,28 +1855,28 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:interface-name:
-	 *
-	 * The name of the network interface this connection is bound to. If not
-	 * set, then the connection can be attached to any interface of the
-	 * appropriate type (subject to restrictions imposed by other settings).
-	 *
-	 * For software devices this specifies the name of the created device.
-	 *
-	 * For connection types where interface names cannot easily be made
-	 * persistent (e.g. mobile broadband or USB Ethernet), this property should
-	 * not be used. Setting this property restricts the interfaces a connection
-	 * can be used with, and if interface names change or are reordered the
-	 * connection may be applied to the wrong interface.
-	 **/
+     * NMSettingConnection:interface-name:
+     *
+     * The name of the network interface this connection is bound to. If not
+     * set, then the connection can be attached to any interface of the
+     * appropriate type (subject to restrictions imposed by other settings).
+     *
+     * For software devices this specifies the name of the created device.
+     *
+     * For connection types where interface names cannot easily be made
+     * persistent (e.g. mobile broadband or USB Ethernet), this property should
+     * not be used. Setting this property restricts the interfaces a connection
+     * can be used with, and if interface names change or are reordered the
+     * connection may be applied to the wrong interface.
+     **/
     /* ---ifcfg-rh---
-	 * property: interface-name
-	 * variable: DEVICE
-	 * description: Interface name of the device this profile is bound to. The variable
-	 *   can be left out when the profile should apply for more devices. Note that DEVICE
-	 *   can be required for some connection types.
-	 * ---end---
-	 */
+     * property: interface-name
+     * variable: DEVICE
+     * description: Interface name of the device this profile is bound to. The variable
+     *   can be left out when the profile should apply for more devices. Note that DEVICE
+     *   can be required for some connection types.
+     * ---end---
+     */
     obj_properties[PROP_INTERFACE_NAME] = g_param_spec_string(
         NM_SETTING_CONNECTION_INTERFACE_NAME,
         "",
@@ -1891,23 +1891,23 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                       nm_setting_connection_no_interface_name, ));
 
     /**
-	 * NMSettingConnection:type:
-	 *
-	 * Base type of the connection. For hardware-dependent connections, should
-	 * contain the setting name of the hardware-type specific setting (ie,
-	 * "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for
-	 * non-hardware dependent connections like VPN or otherwise, should contain
-	 * the setting name of that setting type (ie, "vpn" or "bridge", etc).
-	 **/
+     * NMSettingConnection:type:
+     *
+     * Base type of the connection. For hardware-dependent connections, should
+     * contain the setting name of the hardware-type specific setting (ie,
+     * "802-3-ethernet" or "802-11-wireless" or "bluetooth", etc), and for
+     * non-hardware dependent connections like VPN or otherwise, should contain
+     * the setting name of that setting type (ie, "vpn" or "bridge", etc).
+     **/
     /* ---ifcfg-rh---
-	 * property: type
-	 * variable: TYPE (DEVICETYPE, DEVICE)
-	 * values: Ethernet, Wireless, InfiniBand, Bridge, Bond, Vlan, Team, TeamPort
-	 * description: Base type of the connection. DEVICETYPE is used for teaming
-	 *   connections.
-	 * example: TYPE=Ethernet; TYPE=Bond; TYPE=Bridge; DEVICETYPE=TeamPort
-	 * ---end---
-	 */
+     * property: type
+     * variable: TYPE (DEVICETYPE, DEVICE)
+     * values: Ethernet, Wireless, InfiniBand, Bridge, Bond, Vlan, Team, TeamPort
+     * description: Base type of the connection. DEVICETYPE is used for teaming
+     *   connections.
+     * example: TYPE=Ethernet; TYPE=Bond; TYPE=Bridge; DEVICETYPE=TeamPort
+     * ---end---
+     */
     obj_properties[PROP_TYPE] = g_param_spec_string(NM_SETTING_CONNECTION_TYPE,
                                                     "",
                                                     "",
@@ -1916,30 +1916,30 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                                         | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:permissions:
-	 *
-	 * An array of strings defining what access a given user has to this
-	 * connection.  If this is %NULL or empty, all users are allowed to access
-	 * this connection; otherwise users are allowed if and only if they are in
-	 * this list.  When this is not empty, the connection can be active only when
-	 * one of the specified users is logged into an active session.  Each entry
-	 * is of the form "[type]:[id]:[reserved]"; for example, "user:dcbw:blah".
-	 *
-	 * At this time only the "user" [type] is allowed.  Any other values are
-	 * ignored and reserved for future use.  [id] is the username that this
-	 * permission refers to, which may not contain the ":" character. Any
-	 * [reserved] information present must be ignored and is reserved for future
-	 * use.  All of [type], [id], and [reserved] must be valid UTF-8.
-	 */
+     * NMSettingConnection:permissions:
+     *
+     * An array of strings defining what access a given user has to this
+     * connection.  If this is %NULL or empty, all users are allowed to access
+     * this connection; otherwise users are allowed if and only if they are in
+     * this list.  When this is not empty, the connection can be active only when
+     * one of the specified users is logged into an active session.  Each entry
+     * is of the form "[type]:[id]:[reserved]"; for example, "user:dcbw:blah".
+     *
+     * At this time only the "user" [type] is allowed.  Any other values are
+     * ignored and reserved for future use.  [id] is the username that this
+     * permission refers to, which may not contain the ":" character. Any
+     * [reserved] information present must be ignored and is reserved for future
+     * use.  All of [type], [id], and [reserved] must be valid UTF-8.
+     */
     /* ---ifcfg-rh---
-	 * property: permissions
-	 * variable: USERS(+)
-	 * description: Restrict to certain users the access to this connection, and
-	 *     allow the connection to be active only when at least one of the
-	 *     specified users is logged into an active session.
-	 * example: USERS="joe bob"
-	 * ---end---
-	 */
+     * property: permissions
+     * variable: USERS(+)
+     * description: Restrict to certain users the access to this connection, and
+     *     allow the connection to be active only when at least one of the
+     *     specified users is logged into an active session.
+     * example: USERS="joe bob"
+     * ---end---
+     */
     obj_properties[PROP_PERMISSIONS] =
         g_param_spec_boxed(NM_SETTING_CONNECTION_PERMISSIONS,
                            "",
@@ -1948,24 +1948,24 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:autoconnect:
-	 *
-	 * Whether or not the connection should be automatically connected by
-	 * NetworkManager when the resources for the connection are available.
-	 * %TRUE to automatically activate the connection, %FALSE to require manual
-	 * intervention to activate the connection.
-	 *
-	 * Note that autoconnect is not implemented for VPN profiles. See
-	 * #NMSettingConnection:secondaries as an alternative to automatically
-	 * connect VPN profiles.
-	 **/
+     * NMSettingConnection:autoconnect:
+     *
+     * Whether or not the connection should be automatically connected by
+     * NetworkManager when the resources for the connection are available.
+     * %TRUE to automatically activate the connection, %FALSE to require manual
+     * intervention to activate the connection.
+     *
+     * Note that autoconnect is not implemented for VPN profiles. See
+     * #NMSettingConnection:secondaries as an alternative to automatically
+     * connect VPN profiles.
+     **/
     /* ---ifcfg-rh---
-	 * property: autoconnect
-	 * variable: ONBOOT
-	 * default: yes
-	 * description: Whether the connection should be autoconnected (not only while booting).
-	 * ---end---
-	 */
+     * property: autoconnect
+     * variable: ONBOOT
+     * default: yes
+     * description: Whether the connection should be autoconnected (not only while booting).
+     * ---end---
+     */
     obj_properties[PROP_AUTOCONNECT] = g_param_spec_boolean(
         NM_SETTING_CONNECTION_AUTOCONNECT,
         "",
@@ -1974,22 +1974,22 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:autoconnect-priority:
-	 *
-	 * The autoconnect priority. If the connection is set to autoconnect,
-	 * connections with higher priority will be preferred. Defaults to 0.
-	 * The higher number means higher priority.
-	 **/
+     * NMSettingConnection:autoconnect-priority:
+     *
+     * The autoconnect priority. If the connection is set to autoconnect,
+     * connections with higher priority will be preferred. Defaults to 0.
+     * The higher number means higher priority.
+     **/
     /* ---ifcfg-rh---
-	 * property: autoconnect-priority
-	 * variable: AUTOCONNECT_PRIORITY(+)
-	 * values: -999 to 999
-	 * default: 0
-	 * description: Connection priority for automatic activation. Connections with
-	 *  higher numbers are preferred when selecting profiles for automatic activation.
-	 * example: AUTOCONNECT_PRIORITY=20
-	 * ---end---
-	 */
+     * property: autoconnect-priority
+     * variable: AUTOCONNECT_PRIORITY(+)
+     * values: -999 to 999
+     * default: 0
+     * description: Connection priority for automatic activation. Connections with
+     *  higher numbers are preferred when selecting profiles for automatic activation.
+     * example: AUTOCONNECT_PRIORITY=20
+     * ---end---
+     */
     obj_properties[PROP_AUTOCONNECT_PRIORITY] = g_param_spec_int(
         NM_SETTING_CONNECTION_AUTOCONNECT_PRIORITY,
         "",
@@ -2000,23 +2000,23 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:autoconnect-retries:
-	 *
-	 * The number of times a connection should be tried when autoactivating before
-	 * giving up. Zero means forever, -1 means the global default (4 times if not
-	 * overridden). Setting this to 1 means to try activation only once before
-	 * blocking autoconnect. Note that after a timeout, NetworkManager will try
-	 * to autoconnect again.
-	 */
+     * NMSettingConnection:autoconnect-retries:
+     *
+     * The number of times a connection should be tried when autoactivating before
+     * giving up. Zero means forever, -1 means the global default (4 times if not
+     * overridden). Setting this to 1 means to try activation only once before
+     * blocking autoconnect. Note that after a timeout, NetworkManager will try
+     * to autoconnect again.
+     */
     /* ---ifcfg-rh---
-	 * property: autoconnect-retries
-	 * variable: AUTOCONNECT_RETRIES(+)
-	 * description: The number of times a connection should be autoactivated
-	 * before giving up and switching to the next one.
-	 * values: -1 (use global default), 0 (forever) or a positive value
-	 * example: AUTOCONNECT_RETRIES=1
-	 * ---end---
-	 */
+     * property: autoconnect-retries
+     * variable: AUTOCONNECT_RETRIES(+)
+     * description: The number of times a connection should be autoactivated
+     * before giving up and switching to the next one.
+     * values: -1 (use global default), 0 (forever) or a positive value
+     * example: AUTOCONNECT_RETRIES=1
+     * ---end---
+     */
     obj_properties[PROP_AUTOCONNECT_RETRIES] = g_param_spec_int(
         NM_SETTING_CONNECTION_AUTOCONNECT_RETRIES,
         "",
@@ -2027,21 +2027,21 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:multi-connect:
-	 *
-	 * Specifies whether the profile can be active multiple times at a particular
-	 * moment. The value is of type #NMConnectionMultiConnect.
-	 *
-	 * Since: 1.14
-	 */
+     * NMSettingConnection:multi-connect:
+     *
+     * Specifies whether the profile can be active multiple times at a particular
+     * moment. The value is of type #NMConnectionMultiConnect.
+     *
+     * Since: 1.14
+     */
     /* ---ifcfg-rh---
-	 * property: multi-connect
-	 * variable: MULTI_CONNECT(+)
-	 * description: whether the profile can be active on multiple devices at a given
-	 *   moment. The values are numbers corresponding to #NMConnectionMultiConnect enum.
-	 * example: MULTI_CONNECT=3
-	 * ---end---
-	 */
+     * property: multi-connect
+     * variable: MULTI_CONNECT(+)
+     * description: whether the profile can be active on multiple devices at a given
+     *   moment. The values are numbers corresponding to #NMConnectionMultiConnect enum.
+     * example: MULTI_CONNECT=3
+     * ---end---
+     */
     obj_properties[PROP_MULTI_CONNECT] = g_param_spec_int(
         NM_SETTING_CONNECTION_MULTI_CONNECT,
         "",
@@ -2052,16 +2052,16 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:timestamp:
-	 *
-	 * The time, in seconds since the Unix Epoch, that the connection was last
-	 * _successfully_ fully activated.
-	 *
-	 * NetworkManager updates the connection timestamp periodically when the
-	 * connection is active to ensure that an active connection has the latest
-	 * timestamp. The property is only meant for reading (changes to this
-	 * property will not be preserved).
-	 **/
+     * NMSettingConnection:timestamp:
+     *
+     * The time, in seconds since the Unix Epoch, that the connection was last
+     * _successfully_ fully activated.
+     *
+     * NetworkManager updates the connection timestamp periodically when the
+     * connection is active to ensure that an active connection has the latest
+     * timestamp. The property is only meant for reading (changes to this
+     * property will not be preserved).
+     **/
     obj_properties[PROP_TIMESTAMP] = g_param_spec_uint64(
         NM_SETTING_CONNECTION_TIMESTAMP,
         "",
@@ -2077,12 +2077,12 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                   .to_dbus_fcn = _to_dbus_fcn_timestamp, ));
 
     /**
-	 * NMSettingConnection:read-only:
-	 *
-	 * %FALSE if the connection can be modified using the provided settings
-	 * service's D-Bus interface with the right privileges, or %TRUE if the
-	 * connection is read-only and cannot be modified.
-	 **/
+     * NMSettingConnection:read-only:
+     *
+     * %FALSE if the connection can be modified using the provided settings
+     * service's D-Bus interface with the right privileges, or %TRUE if the
+     * connection is read-only and cannot be modified.
+     **/
     obj_properties[PROP_READ_ONLY] = g_param_spec_boolean(
         NM_SETTING_CONNECTION_READ_ONLY,
         "",
@@ -2091,24 +2091,24 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:zone:
-	 *
-	 * The trust level of a the connection.  Free form case-insensitive string
-	 * (for example "Home", "Work", "Public").  %NULL or unspecified zone means
-	 * the connection will be placed in the default zone as defined by the
-	 * firewall.
-	 *
-	 * When updating this property on a currently activated connection,
-	 * the change takes effect immediately.
-	 **/
+     * NMSettingConnection:zone:
+     *
+     * The trust level of a the connection.  Free form case-insensitive string
+     * (for example "Home", "Work", "Public").  %NULL or unspecified zone means
+     * the connection will be placed in the default zone as defined by the
+     * firewall.
+     *
+     * When updating this property on a currently activated connection,
+     * the change takes effect immediately.
+     **/
     /* ---ifcfg-rh---
-	 * property: zone
-	 * variable: ZONE(+)
-	 * description: Trust level of this connection. The string is usually used
-	 *   for a firewall.
-	 * example: ZONE=Work
-	 * ---end---
-	 */
+     * property: zone
+     * variable: ZONE(+)
+     * description: Trust level of this connection. The string is usually used
+     *   for a firewall.
+     * example: ZONE=Work
+     * ---end---
+     */
     obj_properties[PROP_ZONE] =
         g_param_spec_string(NM_SETTING_CONNECTION_ZONE,
                             "",
@@ -2118,19 +2118,19 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                 | NM_SETTING_PARAM_REAPPLY_IMMEDIATELY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:master:
-	 *
-	 * Interface name of the master device or UUID of the master connection.
-	 **/
+     * NMSettingConnection:master:
+     *
+     * Interface name of the master device or UUID of the master connection.
+     **/
     /* ---ifcfg-rh---
-	 * property: master
-	 * variable: MASTER, MASTER_UUID, TEAM_MASTER, TEAM_MASTER_UUID, BRIDGE, BRIDGE_UUID
-	 * description: Reference to master connection. The variable used depends on
-	 *   the connection type and the value. In general, if the *_UUID variant is present,
-	 *   the variant without *_UUID is ignored. NetworkManager attempts to write both
-	 *   for compatibility with legacy tooling.
-	 * ---end---
-	 */
+     * property: master
+     * variable: MASTER, MASTER_UUID, TEAM_MASTER, TEAM_MASTER_UUID, BRIDGE, BRIDGE_UUID
+     * description: Reference to master connection. The variable used depends on
+     *   the connection type and the value. In general, if the *_UUID variant is present,
+     *   the variant without *_UUID is ignored. NetworkManager attempts to write both
+     *   for compatibility with legacy tooling.
+     * ---end---
+     */
     obj_properties[PROP_MASTER] =
         g_param_spec_string(NM_SETTING_CONNECTION_MASTER,
                             "",
@@ -2140,22 +2140,22 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                 | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:slave-type:
-	 *
-	 * Setting name of the device type of this slave's master connection (eg,
-	 * %NM_SETTING_BOND_SETTING_NAME), or %NULL if this connection is not a
-	 * slave.
-	 **/
+     * NMSettingConnection:slave-type:
+     *
+     * Setting name of the device type of this slave's master connection (eg,
+     * %NM_SETTING_BOND_SETTING_NAME), or %NULL if this connection is not a
+     * slave.
+     **/
     /* ---ifcfg-rh---
-	 * property: slave-type
-	 * variable: MASTER, MASTER_UUID, TEAM_MASTER, TEAM_MASTER_UUID, DEVICETYPE,
-	 *   BRIDGE, BRIDGE_UUID
-	 * description: Slave type doesn't map directly to a variable, but it is
-	 *   recognized using different variables.  MASTER and MASTER_UUID for bonding,
-	 *   TEAM_MASTER, TEAM_MASTER_UUID and DEVICETYPE for teaming, BRIDGE
-	 *   and BRIDGE_UUID for bridging.
-	 * ---end---
-	 */
+     * property: slave-type
+     * variable: MASTER, MASTER_UUID, TEAM_MASTER, TEAM_MASTER_UUID, DEVICETYPE,
+     *   BRIDGE, BRIDGE_UUID
+     * description: Slave type doesn't map directly to a variable, but it is
+     *   recognized using different variables.  MASTER and MASTER_UUID for bonding,
+     *   TEAM_MASTER, TEAM_MASTER_UUID and DEVICETYPE for teaming, BRIDGE
+     *   and BRIDGE_UUID for bridging.
+     * ---end---
+     */
     obj_properties[PROP_SLAVE_TYPE] =
         g_param_spec_string(NM_SETTING_CONNECTION_SLAVE_TYPE,
                             "",
@@ -2165,28 +2165,28 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                 | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:autoconnect-slaves:
-	 *
-	 * Whether or not slaves of this connection should be automatically brought up
-	 * when NetworkManager activates this connection. This only has a real effect
-	 * for master connections. The properties #NMSettingConnection:autoconnect,
-	 * #NMSettingConnection:autoconnect-priority and #NMSettingConnection:autoconnect-retries
-	 * are unrelated to this setting.
-	 * The permitted values are: 0: leave slave connections untouched,
-	 * 1: activate all the slave connections with this connection, -1: default.
-	 * If -1 (default) is set, global connection.autoconnect-slaves is read to
-	 * determine the real value. If it is default as well, this fallbacks to 0.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingConnection:autoconnect-slaves:
+     *
+     * Whether or not slaves of this connection should be automatically brought up
+     * when NetworkManager activates this connection. This only has a real effect
+     * for master connections. The properties #NMSettingConnection:autoconnect,
+     * #NMSettingConnection:autoconnect-priority and #NMSettingConnection:autoconnect-retries
+     * are unrelated to this setting.
+     * The permitted values are: 0: leave slave connections untouched,
+     * 1: activate all the slave connections with this connection, -1: default.
+     * If -1 (default) is set, global connection.autoconnect-slaves is read to
+     * determine the real value. If it is default as well, this fallbacks to 0.
+     *
+     * Since: 1.2
+     **/
     /* ---ifcfg-rh---
-	 * property: autoconnect-slaves
-	 * variable: AUTOCONNECT_SLAVES(+)
-	 * default: missing variable means global default
-	 * description: Whether slaves of this connection should be auto-connected
-	 *   when this connection is activated.
-	 * ---end---
-	 */
+     * property: autoconnect-slaves
+     * variable: AUTOCONNECT_SLAVES(+)
+     * default: missing variable means global default
+     * description: Whether slaves of this connection should be auto-connected
+     *   when this connection is activated.
+     * ---end---
+     */
     obj_properties[PROP_AUTOCONNECT_SLAVES] = g_param_spec_enum(
         NM_SETTING_CONNECTION_AUTOCONNECT_SLAVES,
         "",
@@ -2196,19 +2196,19 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:secondaries:
-	 *
-	 * List of connection UUIDs that should be activated when the base
-	 * connection itself is activated. Currently, only VPN connections are
-	 * supported.
-	 **/
+     * NMSettingConnection:secondaries:
+     *
+     * List of connection UUIDs that should be activated when the base
+     * connection itself is activated. Currently, only VPN connections are
+     * supported.
+     **/
     /* ---ifcfg-rh---
-	 * property: secondaries
-	 * variable: SECONDARY_UUIDS(+)
-	 * description: UUID of VPN connections that should be activated
-	 *   together with this connection.
-	 * ---end---
-	 */
+     * property: secondaries
+     * variable: SECONDARY_UUIDS(+)
+     * description: UUID of VPN connections that should be activated
+     *   together with this connection.
+     * ---end---
+     */
     obj_properties[PROP_SECONDARIES] = g_param_spec_boxed(
         NM_SETTING_CONNECTION_SECONDARIES,
         "",
@@ -2217,20 +2217,20 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:gateway-ping-timeout:
-	 *
-	 * If greater than zero, delay success of IP addressing until either the
-	 * timeout is reached, or an IP gateway replies to a ping.
-	 **/
+     * NMSettingConnection:gateway-ping-timeout:
+     *
+     * If greater than zero, delay success of IP addressing until either the
+     * timeout is reached, or an IP gateway replies to a ping.
+     **/
     /* ---ifcfg-rh---
-	 * property: gateway-ping-timeout
-	 * variable: GATEWAY_PING_TIMEOUT(+)
-	 * default: 0
-	 * description: If greater than zero, the IP connectivity will be checked by
-	 *   pinging the gateway and waiting for the specified timeout (in seconds).
-	 * example: GATEWAY_PING_TIMEOUT=5
-	 * ---end---
-	 */
+     * property: gateway-ping-timeout
+     * variable: GATEWAY_PING_TIMEOUT(+)
+     * default: 0
+     * description: If greater than zero, the IP connectivity will be checked by
+     *   pinging the gateway and waiting for the specified timeout (in seconds).
+     * example: GATEWAY_PING_TIMEOUT=5
+     * ---end---
+     */
     obj_properties[PROP_GATEWAY_PING_TIMEOUT] =
         g_param_spec_uint(NM_SETTING_CONNECTION_GATEWAY_PING_TIMEOUT,
                           "",
@@ -2241,23 +2241,23 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:metered:
-	 *
-	 * Whether the connection is metered.
-	 *
-	 * When updating this property on a currently activated connection,
-	 * the change takes effect immediately.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingConnection:metered:
+     *
+     * Whether the connection is metered.
+     *
+     * When updating this property on a currently activated connection,
+     * the change takes effect immediately.
+     *
+     * Since: 1.2
+     **/
     /* ---ifcfg-rh---
-	 * property: metered
-	 * variable: CONNECTION_METERED(+)
-	 * values: yes,no,unknown
-	 * description: Whether the device is metered
-	 * example: CONNECTION_METERED=yes
-	 * ---end---
-	 */
+     * property: metered
+     * variable: CONNECTION_METERED(+)
+     * values: yes,no,unknown
+     * description: Whether the device is metered
+     * example: CONNECTION_METERED=yes
+     * ---end---
+     */
     obj_properties[PROP_METERED] = g_param_spec_enum(
         NM_SETTING_CONNECTION_METERED,
         "",
@@ -2267,21 +2267,21 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_REAPPLY_IMMEDIATELY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:lldp:
-	 *
-	 * Whether LLDP is enabled for the connection.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingConnection:lldp:
+     *
+     * Whether LLDP is enabled for the connection.
+     *
+     * Since: 1.2
+     **/
     /* ---ifcfg-rh---
-	 * property: lldp
-	 * variable: LLDP(+)
-	 * values: boolean value or 'rx'
-	 * default: missing variable means global default
-	 * description: whether LLDP is enabled for the connection
-	 * example: LLDP=no
-	 * ---end---
-	 */
+     * property: lldp
+     * variable: LLDP(+)
+     * values: boolean value or 'rx'
+     * default: missing variable means global default
+     * description: whether LLDP is enabled for the connection
+     * example: LLDP=no
+     * ---end---
+     */
     obj_properties[PROP_LLDP] = g_param_spec_int(NM_SETTING_CONNECTION_LLDP,
                                                  "",
                                                  "",
@@ -2292,23 +2292,23 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                                      | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:auth-retries:
-	 *
-	 * The number of retries for the authentication. Zero means to try indefinitely; -1 means
-	 * to use a global default. If the global default is not set, the authentication
-	 * retries for 3 times before failing the connection.
-	 *
-	 * Currently, this only applies to 802-1x authentication.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingConnection:auth-retries:
+     *
+     * The number of retries for the authentication. Zero means to try indefinitely; -1 means
+     * to use a global default. If the global default is not set, the authentication
+     * retries for 3 times before failing the connection.
+     *
+     * Currently, this only applies to 802-1x authentication.
+     *
+     * Since: 1.10
+     **/
     /* ---ifcfg-rh---
-	 * property: auth-retries
-	 * variable: AUTH_RETRIES(+)
-	 * default: 0
-	 * description: Number of retries for authentication.
-	 * ---end---
-	 */
+     * property: auth-retries
+     * variable: AUTH_RETRIES(+)
+     * default: 0
+     * description: Number of retries for authentication.
+     * ---end---
+     */
     obj_properties[PROP_AUTH_RETRIES] = g_param_spec_int(
         NM_SETTING_CONNECTION_AUTH_RETRIES,
         "",
@@ -2319,31 +2319,31 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:mdns:
-	 *
-	 * Whether mDNS is enabled for the connection.
-	 *
-	 * The permitted values are: "yes" (2) register hostname and resolving
-	 * for the connection, "no" (0) disable mDNS for the interface, "resolve"
-	 * (1) do not register hostname but allow resolving of mDNS host names
-	 * and "default" (-1) to allow lookup of a global default in NetworkManager.conf.
-	 * If unspecified, "default" ultimately depends on the DNS plugin (which
-	 * for systemd-resolved currently means "no").
-	 *
-	 * This feature requires a plugin which supports mDNS. Otherwise, the
-	 * setting has no effect. One such plugin is dns-systemd-resolved.
+     * NMSettingConnection:mdns:
+     *
+     * Whether mDNS is enabled for the connection.
+     *
+     * The permitted values are: "yes" (2) register hostname and resolving
+     * for the connection, "no" (0) disable mDNS for the interface, "resolve"
+     * (1) do not register hostname but allow resolving of mDNS host names
+     * and "default" (-1) to allow lookup of a global default in NetworkManager.conf.
+     * If unspecified, "default" ultimately depends on the DNS plugin (which
+     * for systemd-resolved currently means "no").
+     *
+     * This feature requires a plugin which supports mDNS. Otherwise, the
+     * setting has no effect. One such plugin is dns-systemd-resolved.
 *
-	 * Since: 1.12
-	 **/
+     * Since: 1.12
+     **/
     /* ---ifcfg-rh---
-	 * property: mdns
-	 * variable: MDNS(+)
-	 * values: yes,no,resolve
-	 * default: missing variable means global default
-	 * description: Whether or not mDNS is enabled for the connection
-	 * example: MDNS=yes
-	 * ---end---
-	 */
+     * property: mdns
+     * variable: MDNS(+)
+     * values: yes,no,resolve
+     * default: missing variable means global default
+     * description: Whether or not mDNS is enabled for the connection
+     * example: MDNS=yes
+     * ---end---
+     */
     obj_properties[PROP_MDNS] = g_param_spec_int(NM_SETTING_CONNECTION_MDNS,
                                                  "",
                                                  "",
@@ -2353,33 +2353,33 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                                  G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:llmnr:
-	 *
-	 * Whether Link-Local Multicast Name Resolution (LLMNR) is enabled
-	 * for the connection. LLMNR is a protocol based on the Domain Name
-	 * System (DNS) packet format that allows both IPv4 and IPv6 hosts
-	 * to perform name resolution for hosts on the same local link.
-	 *
-	 * The permitted values are: "yes" (2) register hostname and resolving
-	 * for the connection, "no" (0) disable LLMNR for the interface, "resolve"
-	 * (1) do not register hostname but allow resolving of LLMNR host names
-	 * If unspecified, "default" ultimately depends on the DNS plugin (which
-	 * for systemd-resolved currently means "yes").
-	 *
-	 * This feature requires a plugin which supports LLMNR. Otherwise, the
-	 * setting has no effect. One such plugin is dns-systemd-resolved.
-	 *
-	 * Since: 1.14
-	 **/
+     * NMSettingConnection:llmnr:
+     *
+     * Whether Link-Local Multicast Name Resolution (LLMNR) is enabled
+     * for the connection. LLMNR is a protocol based on the Domain Name
+     * System (DNS) packet format that allows both IPv4 and IPv6 hosts
+     * to perform name resolution for hosts on the same local link.
+     *
+     * The permitted values are: "yes" (2) register hostname and resolving
+     * for the connection, "no" (0) disable LLMNR for the interface, "resolve"
+     * (1) do not register hostname but allow resolving of LLMNR host names
+     * If unspecified, "default" ultimately depends on the DNS plugin (which
+     * for systemd-resolved currently means "yes").
+     *
+     * This feature requires a plugin which supports LLMNR. Otherwise, the
+     * setting has no effect. One such plugin is dns-systemd-resolved.
+     *
+     * Since: 1.14
+     **/
     /* ---ifcfg-rh---
-	 * property: llmnr
-	 * variable: LLMNR(+)
-	 * values: yes,no,resolve
-	 * default: missing variable means global default
-	 * description: Whether or not LLMNR is enabled for the connection
-	 * example: LLMNR=yes
-	 * ---end---
-	 */
+     * property: llmnr
+     * variable: LLMNR(+)
+     * values: yes,no,resolve
+     * default: missing variable means global default
+     * description: Whether or not LLMNR is enabled for the connection
+     * example: LLMNR=yes
+     * ---end---
+     */
     obj_properties[PROP_LLMNR] = g_param_spec_int(NM_SETTING_CONNECTION_LLMNR,
                                                   "",
                                                   "",
@@ -2389,30 +2389,30 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                                                   G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:wait-device-timeout:
-	 *
-	 * Timeout in milliseconds to wait for device at startup.
-	 * During boot, devices may take a while to be detected by the driver.
-	 * This property will cause to delay NetworkManager-wait-online.service
-	 * and nm-online to give the device a chance to appear. This works by
-	 * waiting for the given timeout until a compatible device for the
-	 * profile is available and managed.
-	 *
-	 * The value 0 means no wait time. The default value is -1, which
-	 * currently has the same meaning as no wait time.
-	 *
-	 * Since: 1.20
-	 **/
+     * NMSettingConnection:wait-device-timeout:
+     *
+     * Timeout in milliseconds to wait for device at startup.
+     * During boot, devices may take a while to be detected by the driver.
+     * This property will cause to delay NetworkManager-wait-online.service
+     * and nm-online to give the device a chance to appear. This works by
+     * waiting for the given timeout until a compatible device for the
+     * profile is available and managed.
+     *
+     * The value 0 means no wait time. The default value is -1, which
+     * currently has the same meaning as no wait time.
+     *
+     * Since: 1.20
+     **/
     /* ---ifcfg-rh---
-	 * property: wait-device-timeout
-	 * variable: DEVTIMEOUT(+)
-	 * values: timeout in seconds.
-	 * description: for initscripts compatibility, this variable must be
-	 *   a whole integer. If necessary, NetworkManager stores also a fractional
-	 *   component for the milliseconds.
-	 * example: DEVTIMEOUT=5
-	 * ---end---
-	 */
+     * property: wait-device-timeout
+     * variable: DEVTIMEOUT(+)
+     * values: timeout in seconds.
+     * description: for initscripts compatibility, this variable must be
+     *   a whole integer. If necessary, NetworkManager stores also a fractional
+     *   component for the milliseconds.
+     * example: DEVTIMEOUT=5
+     * ---end---
+     */
     obj_properties[PROP_WAIT_DEVICE_TIMEOUT] =
         g_param_spec_int(NM_SETTING_CONNECTION_WAIT_DEVICE_TIMEOUT,
                          "",
@@ -2423,27 +2423,27 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
                          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingConnection:mud-url:
-	 *
-	 * If configured, set to a Manufacturer Usage Description (MUD) URL that points
-	 * to manufacturer-recommended network policies for IoT devices. It is transmitted
-	 * as a DHCPv4 or DHCPv6 option. The value must be a valid URL starting with "https://".
-	 *
-	 * The special value "none" is allowed to indicate that no MUD URL is used.
-	 *
-	 * If the per-profile value is unspecified (the default), a global connection default gets
-	 * consulted. If still unspecified, the ultimate default is "none".
-	 *
-	 * Since: 1.26
-	 **/
+     * NMSettingConnection:mud-url:
+     *
+     * If configured, set to a Manufacturer Usage Description (MUD) URL that points
+     * to manufacturer-recommended network policies for IoT devices. It is transmitted
+     * as a DHCPv4 or DHCPv6 option. The value must be a valid URL starting with "https://".
+     *
+     * The special value "none" is allowed to indicate that no MUD URL is used.
+     *
+     * If the per-profile value is unspecified (the default), a global connection default gets
+     * consulted. If still unspecified, the ultimate default is "none".
+     *
+     * Since: 1.26
+     **/
     /* ---ifcfg-rh---
-	 * property: mud-url
-	 * variable: MUD_URL
-	 * values: a valid URL that points to recommended policy for this device
-	 * description: MUD_URL to be sent by device (See RFC 8520).
-	 * example: https://yourdevice.example.com/model.json
-	 * ---end---
-	 */
+     * property: mud-url
+     * variable: MUD_URL
+     * values: a valid URL that points to recommended policy for this device
+     * description: MUD_URL to be sent by device (See RFC 8520).
+     * example: https://yourdevice.example.com/model.json
+     * ---end---
+     */
     obj_properties[PROP_MUD_URL] = g_param_spec_string(NM_SETTING_CONNECTION_MUD_URL,
                                                        "",
                                                        "",
diff --git a/libnm-core/nm-setting-dcb.c b/libnm-core/nm-setting-dcb.c
index e4546837f8..ee62795a8d 100644
--- a/libnm-core/nm-setting-dcb.c
+++ b/libnm-core/nm-setting-dcb.c
@@ -545,8 +545,8 @@ check_uint_array(const guint *     array,
             }
         } else {
             /* If the feature is disabled, sum must equal 0%, which was checked
-			 * by the for() loop above.
-			 */
+             * by the for() loop above.
+             */
             g_assert_cmpint(sum, ==, 0);
         }
     }
@@ -922,20 +922,20 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingDcb:app-fcoe-flags:
-	 *
-	 * Specifies the #NMSettingDcbFlags for the DCB FCoE application.  Flags may
-	 * be any combination of %NM_SETTING_DCB_FLAG_ENABLE,
-	 * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
-	 **/
+     * NMSettingDcb:app-fcoe-flags:
+     *
+     * Specifies the #NMSettingDcbFlags for the DCB FCoE application.  Flags may
+     * be any combination of %NM_SETTING_DCB_FLAG_ENABLE,
+     * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
+     **/
     /* ---ifcfg-rh---
-	 * property: app-fcoe-flags
-	 * variable: DCB_APP_FCOE_ENABLE, DCB_APP_FCOE_ADVERTISE, DCB_APP_FCOE_WILLING
-	 * description: FCOE flags.
-	 * default: no
-	 * example: DCB_APP_FCOE_ENABLE=yes DCB_APP_FCOE_ADVERTISE=yes
-	 * ---end---
-	 */
+     * property: app-fcoe-flags
+     * variable: DCB_APP_FCOE_ENABLE, DCB_APP_FCOE_ADVERTISE, DCB_APP_FCOE_WILLING
+     * description: FCOE flags.
+     * default: no
+     * example: DCB_APP_FCOE_ENABLE=yes DCB_APP_FCOE_ADVERTISE=yes
+     * ---end---
+     */
     obj_properties[PROP_APP_FCOE_FLAGS] =
         g_param_spec_flags(NM_SETTING_DCB_APP_FCOE_FLAGS,
                            "",
@@ -945,19 +945,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:app-fcoe-priority:
-	 *
-	 * The highest User Priority (0 - 7) which FCoE frames should use, or -1 for
-	 * default priority.  Only used when the #NMSettingDcb:app-fcoe-flags
-	 * property includes the %NM_SETTING_DCB_FLAG_ENABLE flag.
-	 **/
+     * NMSettingDcb:app-fcoe-priority:
+     *
+     * The highest User Priority (0 - 7) which FCoE frames should use, or -1 for
+     * default priority.  Only used when the #NMSettingDcb:app-fcoe-flags
+     * property includes the %NM_SETTING_DCB_FLAG_ENABLE flag.
+     **/
     /* ---ifcfg-rh---
-	 * property: app-fcoe-priority
-	 * variable: DCB_APP_FCOE_PRIORITY
-	 * values: 0 - 7
-	 * description: Priority of FCoE frames.
-	 * ---end---
-	 */
+     * property: app-fcoe-priority
+     * variable: DCB_APP_FCOE_PRIORITY
+     * values: 0 - 7
+     * description: Priority of FCoE frames.
+     * ---end---
+     */
     obj_properties[PROP_APP_FCOE_PRIORITY] =
         g_param_spec_int(NM_SETTING_DCB_APP_FCOE_PRIORITY,
                          "",
@@ -968,19 +968,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:app-fcoe-mode:
-	 *
-	 * The FCoE controller mode; either %NM_SETTING_DCB_FCOE_MODE_FABRIC
-	 * (default) or %NM_SETTING_DCB_FCOE_MODE_VN2VN.
-	 **/
+     * NMSettingDcb:app-fcoe-mode:
+     *
+     * The FCoE controller mode; either %NM_SETTING_DCB_FCOE_MODE_FABRIC
+     * (default) or %NM_SETTING_DCB_FCOE_MODE_VN2VN.
+     **/
     /* ---ifcfg-rh---
-	 * property: app-fcoe-mode
-	 * variable: DCB_APP_FCOE_MODE
-	 * values: fabric, vn2vn
-	 * default: fabric
-	 * description: FCoE controller mode.
-	 * ---end---
-	 */
+     * property: app-fcoe-mode
+     * variable: DCB_APP_FCOE_MODE
+     * values: fabric, vn2vn
+     * default: fabric
+     * description: FCoE controller mode.
+     * ---end---
+     */
     obj_properties[PROP_APP_FCOE_MODE] =
         g_param_spec_string(NM_SETTING_DCB_APP_FCOE_MODE,
                             "",
@@ -989,19 +989,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:app-iscsi-flags:
-	 *
-	 * Specifies the #NMSettingDcbFlags for the DCB iSCSI application.  Flags
-	 * may be any combination of %NM_SETTING_DCB_FLAG_ENABLE,
-	 * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
-	 **/
+     * NMSettingDcb:app-iscsi-flags:
+     *
+     * Specifies the #NMSettingDcbFlags for the DCB iSCSI application.  Flags
+     * may be any combination of %NM_SETTING_DCB_FLAG_ENABLE,
+     * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
+     **/
     /* ---ifcfg-rh---
-	 * property: app-iscsi-flags
-	 * variable: DCB_APP_ISCSI_ENABLE, DCB_APP_ISCSI_ADVERTISE, DCB_APP_ISCSI_WILLING
-	 * default: no
-	 * description: iSCSI flags.
-	 * ---end---
-	 */
+     * property: app-iscsi-flags
+     * variable: DCB_APP_ISCSI_ENABLE, DCB_APP_ISCSI_ADVERTISE, DCB_APP_ISCSI_WILLING
+     * default: no
+     * description: iSCSI flags.
+     * ---end---
+     */
     obj_properties[PROP_APP_ISCSI_FLAGS] =
         g_param_spec_flags(NM_SETTING_DCB_APP_ISCSI_FLAGS,
                            "",
@@ -1011,19 +1011,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:app-iscsi-priority:
-	 *
-	 * The highest User Priority (0 - 7) which iSCSI frames should use, or -1
-	 * for default priority. Only used when the #NMSettingDcb:app-iscsi-flags
-	 * property includes the %NM_SETTING_DCB_FLAG_ENABLE flag.
-	 **/
+     * NMSettingDcb:app-iscsi-priority:
+     *
+     * The highest User Priority (0 - 7) which iSCSI frames should use, or -1
+     * for default priority. Only used when the #NMSettingDcb:app-iscsi-flags
+     * property includes the %NM_SETTING_DCB_FLAG_ENABLE flag.
+     **/
     /* ---ifcfg-rh---
-	 * property: app-iscsi-priority
-	 * variable: DCB_APP_ISCSI_PRIORITY
-	 * values: 0 - 7
-	 * description: Priority of iSCSI frames.
-	 * ---end---
-	 */
+     * property: app-iscsi-priority
+     * variable: DCB_APP_ISCSI_PRIORITY
+     * values: 0 - 7
+     * description: Priority of iSCSI frames.
+     * ---end---
+     */
     obj_properties[PROP_APP_ISCSI_PRIORITY] =
         g_param_spec_int(NM_SETTING_DCB_APP_ISCSI_PRIORITY,
                          "",
@@ -1034,19 +1034,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:app-fip-flags:
-	 *
-	 * Specifies the #NMSettingDcbFlags for the DCB FIP application.  Flags may
-	 * be any combination of %NM_SETTING_DCB_FLAG_ENABLE,
-	 * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
-	 **/
+     * NMSettingDcb:app-fip-flags:
+     *
+     * Specifies the #NMSettingDcbFlags for the DCB FIP application.  Flags may
+     * be any combination of %NM_SETTING_DCB_FLAG_ENABLE,
+     * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
+     **/
     /* ---ifcfg-rh---
-	 * property: app-fip-flags
-	 * variable: DCB_APP_FIP_ENABLE, DCB_APP_FIP_ADVERTISE, DCB_APP_FIP_WILLING
-	 * default: no
-	 * description: FIP flags.
-	 * ---end---
-	 */
+     * property: app-fip-flags
+     * variable: DCB_APP_FIP_ENABLE, DCB_APP_FIP_ADVERTISE, DCB_APP_FIP_WILLING
+     * default: no
+     * description: FIP flags.
+     * ---end---
+     */
     obj_properties[PROP_APP_FIP_FLAGS] =
         g_param_spec_flags(NM_SETTING_DCB_APP_FIP_FLAGS,
                            "",
@@ -1056,19 +1056,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:app-fip-priority:
-	 *
-	 * The highest User Priority (0 - 7) which FIP frames should use, or -1 for
-	 * default priority.  Only used when the #NMSettingDcb:app-fip-flags
-	 * property includes the %NM_SETTING_DCB_FLAG_ENABLE flag.
-	 **/
+     * NMSettingDcb:app-fip-priority:
+     *
+     * The highest User Priority (0 - 7) which FIP frames should use, or -1 for
+     * default priority.  Only used when the #NMSettingDcb:app-fip-flags
+     * property includes the %NM_SETTING_DCB_FLAG_ENABLE flag.
+     **/
     /* ---ifcfg-rh---
-	 * property: app-fip-priority
-	 * variable: DCB_APP_FIP_PRIORITY
-	 * values: 0 - 7
-	 * description: Priority of FIP frames.
-	 * ---end---
-	 */
+     * property: app-fip-priority
+     * variable: DCB_APP_FIP_PRIORITY
+     * values: 0 - 7
+     * description: Priority of FIP frames.
+     * ---end---
+     */
     obj_properties[PROP_APP_FIP_PRIORITY] =
         g_param_spec_int(NM_SETTING_DCB_APP_FIP_PRIORITY,
                          "",
@@ -1079,19 +1079,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:priority-flow-control-flags:
-	 *
-	 * Specifies the #NMSettingDcbFlags for DCB Priority Flow Control (PFC).
-	 * Flags may be any combination of %NM_SETTING_DCB_FLAG_ENABLE,
-	 * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
-	 **/
+     * NMSettingDcb:priority-flow-control-flags:
+     *
+     * Specifies the #NMSettingDcbFlags for DCB Priority Flow Control (PFC).
+     * Flags may be any combination of %NM_SETTING_DCB_FLAG_ENABLE,
+     * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority-flow-control-flags
-	 * variable: DCB_PFC_ENABLE, DCB_PFC_ADVERTISE, DCB_PFC_WILLING
-	 * default: no
-	 * description: Priority flow control flags.
-	 * ---end---
-	 */
+     * property: priority-flow-control-flags
+     * variable: DCB_PFC_ENABLE, DCB_PFC_ADVERTISE, DCB_PFC_WILLING
+     * default: no
+     * description: Priority flow control flags.
+     * ---end---
+     */
     obj_properties[PROP_PFC_FLAGS] = g_param_spec_flags(NM_SETTING_DCB_PRIORITY_FLOW_CONTROL_FLAGS,
                                                         "",
                                                         "",
@@ -1100,20 +1100,20 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:priority-flow-control: (type GArray(gboolean))
-	 *
-	 * An array of 8 boolean values, where the array index corresponds to the User
-	 * Priority (0 - 7) and the value indicates whether or not the corresponding
-	 * priority should transmit priority pause.
-	 **/
+     * NMSettingDcb:priority-flow-control: (type GArray(gboolean))
+     *
+     * An array of 8 boolean values, where the array index corresponds to the User
+     * Priority (0 - 7) and the value indicates whether or not the corresponding
+     * priority should transmit priority pause.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority-flow-control
-	 * variable: DCB_PFC_UP
-	 * description: Priority flow control values. String of 8 "0" and "1", where "0".
-	 *   means "do not transmit priority pause", "1" means "transmit pause".
-	 * example: DCB_PFC_UP=01101110
-	 * ---end---
-	 */
+     * property: priority-flow-control
+     * variable: DCB_PFC_UP
+     * description: Priority flow control values. String of 8 "0" and "1", where "0".
+     *   means "do not transmit priority pause", "1" means "transmit pause".
+     * example: DCB_PFC_UP=01101110
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY_FLOW_CONTROL] =
         g_param_spec_boxed(NM_SETTING_DCB_PRIORITY_FLOW_CONTROL,
                            "",
@@ -1125,19 +1125,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                                  &nm_sett_info_propert_type_dcb_au);
 
     /**
-	 * NMSettingDcb:priority-group-flags:
-	 *
-	 * Specifies the #NMSettingDcbFlags for DCB Priority Groups.  Flags may be
-	 * any combination of %NM_SETTING_DCB_FLAG_ENABLE,
-	 * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
-	 **/
+     * NMSettingDcb:priority-group-flags:
+     *
+     * Specifies the #NMSettingDcbFlags for DCB Priority Groups.  Flags may be
+     * any combination of %NM_SETTING_DCB_FLAG_ENABLE,
+     * %NM_SETTING_DCB_FLAG_ADVERTISE, and %NM_SETTING_DCB_FLAG_WILLING.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority-group-flags
-	 * variable: DCB_PG_ENABLE, DCB_PG_ADVERTISE, DCB_PG_WILLING
-	 * default: no
-	 * description: Priority groups flags.
-	 * ---end---
-	 */
+     * property: priority-group-flags
+     * variable: DCB_PG_ENABLE, DCB_PG_ADVERTISE, DCB_PG_WILLING
+     * default: no
+     * description: Priority groups flags.
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY_GROUP_FLAGS] =
         g_param_spec_flags(NM_SETTING_DCB_PRIORITY_GROUP_FLAGS,
                            "",
@@ -1147,20 +1147,20 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingDcb:priority-group-id: (type GArray(guint))
-	 *
-	 * An array of 8 uint values, where the array index corresponds to the User
-	 * Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed
-	 * Priority Group ID values are 0 - 7 or 15 for the unrestricted group.
-	 **/
+     * NMSettingDcb:priority-group-id: (type GArray(guint))
+     *
+     * An array of 8 uint values, where the array index corresponds to the User
+     * Priority (0 - 7) and the value indicates the Priority Group ID.  Allowed
+     * Priority Group ID values are 0 - 7 or 15 for the unrestricted group.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority-group-id
-	 * variable: DCB_PG_ID
-	 * description: Priority groups values. String of eight priorities (0 - 7) or "f"
-	 *   (unrestricted).
-	 * example: DCB_PG_ID=1205f173
-	 * ---end---
-	 */
+     * property: priority-group-id
+     * variable: DCB_PG_ID
+     * description: Priority groups values. String of eight priorities (0 - 7) or "f"
+     *   (unrestricted).
+     * example: DCB_PG_ID=1205f173
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY_GROUP_ID] =
         g_param_spec_boxed(NM_SETTING_DCB_PRIORITY_GROUP_ID,
                            "",
@@ -1172,20 +1172,20 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                                  &nm_sett_info_propert_type_dcb_au);
 
     /**
-	 * NMSettingDcb:priority-group-bandwidth: (type GArray(guint))
-	 *
-	 * An array of 8 uint values, where the array index corresponds to the
-	 * Priority Group ID (0 - 7) and the value indicates the percentage of link
-	 * bandwidth allocated to that group.  Allowed values are 0 - 100, and the
-	 * sum of all values must total 100 percents.
-	 **/
+     * NMSettingDcb:priority-group-bandwidth: (type GArray(guint))
+     *
+     * An array of 8 uint values, where the array index corresponds to the
+     * Priority Group ID (0 - 7) and the value indicates the percentage of link
+     * bandwidth allocated to that group.  Allowed values are 0 - 100, and the
+     * sum of all values must total 100 percents.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority-group-bandwidth
-	 * variable: DCB_PG_PCT
-	 * description: Priority groups values. Eight bandwidths (in percent), separated with commas.
-	 * example: DCB_PG_PCT=10,5,10,15,10,10,10,30
-	 * ---end---
-	 */
+     * property: priority-group-bandwidth
+     * variable: DCB_PG_PCT
+     * description: Priority groups values. Eight bandwidths (in percent), separated with commas.
+     * example: DCB_PG_PCT=10,5,10,15,10,10,10,30
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY_GROUP_BANDWIDTH] =
         g_param_spec_boxed(NM_SETTING_DCB_PRIORITY_GROUP_BANDWIDTH,
                            "",
@@ -1197,22 +1197,22 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                                  &nm_sett_info_propert_type_dcb_au);
 
     /**
-	 * NMSettingDcb:priority-bandwidth: (type GArray(guint))
-	 *
-	 * An array of 8 uint values, where the array index corresponds to the User
-	 * Priority (0 - 7) and the value indicates the percentage of bandwidth of
-	 * the priority's assigned group that the priority may use.  The sum of all
-	 * percentages for priorities which belong to the same group must total 100
-	 * percents.
-	 **/
+     * NMSettingDcb:priority-bandwidth: (type GArray(guint))
+     *
+     * An array of 8 uint values, where the array index corresponds to the User
+     * Priority (0 - 7) and the value indicates the percentage of bandwidth of
+     * the priority's assigned group that the priority may use.  The sum of all
+     * percentages for priorities which belong to the same group must total 100
+     * percents.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority-bandwidth
-	 * variable: DCB_PG_UPPCT
-	 * description: Priority values. Eight bandwidths (in percent), separated with commas.
-	 *   The sum of the numbers must be 100.
-	 * example: DCB_PG_UPPCT=7,13,10,10,15,15,10,20
-	 * ---end---
-	 */
+     * property: priority-bandwidth
+     * variable: DCB_PG_UPPCT
+     * description: Priority values. Eight bandwidths (in percent), separated with commas.
+     *   The sum of the numbers must be 100.
+     * example: DCB_PG_UPPCT=7,13,10,10,15,15,10,20
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY_BANDWIDTH] =
         g_param_spec_boxed(NM_SETTING_DCB_PRIORITY_BANDWIDTH,
                            "",
@@ -1224,20 +1224,20 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                                  &nm_sett_info_propert_type_dcb_au);
 
     /**
-	 * NMSettingDcb:priority-strict-bandwidth: (type GArray(gboolean))
-	 *
-	 * An array of 8 boolean values, where the array index corresponds to the User
-	 * Priority (0 - 7) and the value indicates whether or not the priority may
-	 * use all of the bandwidth allocated to its assigned group.
-	 **/
+     * NMSettingDcb:priority-strict-bandwidth: (type GArray(gboolean))
+     *
+     * An array of 8 boolean values, where the array index corresponds to the User
+     * Priority (0 - 7) and the value indicates whether or not the priority may
+     * use all of the bandwidth allocated to its assigned group.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority-strict-bandwidth
-	 * variable: DCB_PG_STRICT
-	 * description: Priority values. String of eight "0" or "1", where "0" means
-	 *   "may not utilize all bandwidth", "1" means "may utilize all bandwidth".
-	 * example: DCB_PG_STRICT=01101110
-	 * ---end---
-	 */
+     * property: priority-strict-bandwidth
+     * variable: DCB_PG_STRICT
+     * description: Priority values. String of eight "0" or "1", where "0" means
+     *   "may not utilize all bandwidth", "1" means "may utilize all bandwidth".
+     * example: DCB_PG_STRICT=01101110
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY_STRICT_BANDWIDTH] =
         g_param_spec_boxed(NM_SETTING_DCB_PRIORITY_STRICT_BANDWIDTH,
                            "",
@@ -1249,19 +1249,19 @@ nm_setting_dcb_class_init(NMSettingDcbClass *klass)
                                  &nm_sett_info_propert_type_dcb_au);
 
     /**
-	 * NMSettingDcb:priority-traffic-class: (type GArray(guint))
-	 *
-	 * An array of 8 uint values, where the array index corresponds to the User
-	 * Priority (0 - 7) and the value indicates the traffic class (0 - 7) to
-	 * which the priority is mapped.
-	 **/
+     * NMSettingDcb:priority-traffic-class: (type GArray(guint))
+     *
+     * An array of 8 uint values, where the array index corresponds to the User
+     * Priority (0 - 7) and the value indicates the traffic class (0 - 7) to
+     * which the priority is mapped.
+     **/
     /* ---ifcfg-rh---
-	 * property: priority-traffic-class
-	 * variable: DCB_PG_UP2TC
-	 * description: Priority values. String of eight traffic class values (0 - 7).
-	 * example: DCB_PG_UP2TC=01623701
-	 * ---end---
-	 */
+     * property: priority-traffic-class
+     * variable: DCB_PG_UP2TC
+     * description: Priority values. String of eight traffic class values (0 - 7).
+     * example: DCB_PG_UP2TC=01623701
+     * ---end---
+     */
     obj_properties[PROP_PRIORITY_TRAFFIC_CLASS] =
         g_param_spec_boxed(NM_SETTING_DCB_PRIORITY_TRAFFIC_CLASS,
                            "",
diff --git a/libnm-core/nm-setting-gsm.c b/libnm-core/nm-setting-gsm.c
index 15aeb01cfb..e16d8ac5ab 100644
--- a/libnm-core/nm-setting-gsm.c
+++ b/libnm-core/nm-setting-gsm.c
@@ -299,23 +299,23 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
         }
 
         /* APNs roughly follow the same rules as DNS domain names.  Allowed
-		 * characters are a-z, 0-9, . and -.  GSM 03.03 Section 9.1 states:
-		 *
-		 *   The syntax of the APN shall follow the Name Syntax defined in
-		 *   RFC 2181 [14] and RFC 1035 [15]. The APN consists of one or
-		 *   more labels. Each label is coded as one octet length field
-		 *   followed by that number of octets coded as 8 bit ASCII characters.
-		 *   Following RFC 1035 [15] the labels should consist only of the
-		 *   alphabetic characters (A-Z and a-z), digits (0-9) and the
-		 *   dash (-). The case of alphabetic characters is not significant.
-		 *
-		 * A dot (.) is commonly used to separate parts of the APN, and
-		 * apparently the underscore (_) is used as well.  RFC 2181 indicates
-		 * that no restrictions of any kind are placed on DNS labels, and thus
-		 * it would appear that none are placed on APNs either, but many modems
-		 * and networks will fail to accept APNs that include odd characters
-		 * like space ( ) and such.
-		 */
+         * characters are a-z, 0-9, . and -.  GSM 03.03 Section 9.1 states:
+         *
+         *   The syntax of the APN shall follow the Name Syntax defined in
+         *   RFC 2181 [14] and RFC 1035 [15]. The APN consists of one or
+         *   more labels. Each label is coded as one octet length field
+         *   followed by that number of octets coded as 8 bit ASCII characters.
+         *   Following RFC 1035 [15] the labels should consist only of the
+         *   alphabetic characters (A-Z and a-z), digits (0-9) and the
+         *   dash (-). The case of alphabetic characters is not significant.
+         *
+         * A dot (.) is commonly used to separate parts of the APN, and
+         * apparently the underscore (_) is used as well.  RFC 2181 indicates
+         * that no restrictions of any kind are placed on DNS labels, and thus
+         * it would appear that none are placed on APNs either, but many modems
+         * and networks will fail to accept APNs that include odd characters
+         * like space ( ) and such.
+         */
         for (i = 0; i < apn_len; i++) {
             if (!g_ascii_isalnum(priv->apn[i]) && (priv->apn[i] != '.') && (priv->apn[i] != '_')
                 && (priv->apn[i] != '-')) {
@@ -643,14 +643,14 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
     setting_class->need_secrets   = need_secrets;
 
     /**
-	 * NMSettingGsm:auto-config:
-	 *
-	 * When %TRUE, the settings such as APN, username, or password will
-	 * default to values that match the network the modem will register
-	 * to in the Mobile Broadband Provider database.
-	 *
-	 * Since: 1.22
-	 **/
+     * NMSettingGsm:auto-config:
+     *
+     * When %TRUE, the settings such as APN, username, or password will
+     * default to values that match the network the modem will register
+     * to in the Mobile Broadband Provider database.
+     *
+     * Since: 1.22
+     **/
     obj_properties[PROP_AUTO_CONFIG] =
         g_param_spec_boolean(NM_SETTING_GSM_AUTO_CONFIG,
                              "",
@@ -659,13 +659,13 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:number:
-	 *
-	 * Legacy setting that used to help establishing PPP data sessions for
-	 * GSM-based modems.
-	 *
-	 * Deprecated: 1.16: User-provided values for this setting are no longer used.
-	 **/
+     * NMSettingGsm:number:
+     *
+     * Legacy setting that used to help establishing PPP data sessions for
+     * GSM-based modems.
+     *
+     * Deprecated: 1.16: User-provided values for this setting are no longer used.
+     **/
     obj_properties[PROP_NUMBER] = g_param_spec_string(NM_SETTING_GSM_NUMBER,
                                                       "",
                                                       "",
@@ -673,12 +673,12 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:username:
-	 *
-	 * The username used to authenticate with the network, if required.  Many
-	 * providers do not require a username, or accept any username.  But if a
-	 * username is required, it is specified here.
-	 **/
+     * NMSettingGsm:username:
+     *
+     * The username used to authenticate with the network, if required.  Many
+     * providers do not require a username, or accept any username.  But if a
+     * username is required, it is specified here.
+     **/
     obj_properties[PROP_USERNAME] = g_param_spec_string(NM_SETTING_GSM_USERNAME,
                                                         "",
                                                         "",
@@ -686,12 +686,12 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:password:
-	 *
-	 * The password used to authenticate with the network, if required.  Many
-	 * providers do not require a password, or accept any password.  But if a
-	 * password is required, it is specified here.
-	 **/
+     * NMSettingGsm:password:
+     *
+     * The password used to authenticate with the network, if required.  Many
+     * providers do not require a password, or accept any password.  But if a
+     * password is required, it is specified here.
+     **/
     obj_properties[PROP_PASSWORD] =
         g_param_spec_string(NM_SETTING_GSM_PASSWORD,
                             "",
@@ -700,10 +700,10 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingGsm:password property.
-	 **/
+     * NMSettingGsm:password-flags:
+     *
+     * Flags indicating how to handle the #NMSettingGsm:password property.
+     **/
     obj_properties[PROP_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_GSM_PASSWORD_FLAGS,
                            "",
@@ -713,16 +713,16 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:apn:
-	 *
-	 * The GPRS Access Point Name specifying the APN used when establishing a
-	 * data session with the GSM-based network.  The APN often determines how
-	 * the user will be billed for their network usage and whether the user has
-	 * access to the Internet or just a provider-specific walled-garden, so it
-	 * is important to use the correct APN for the user's mobile broadband plan.
-	 * The APN may only be composed of the characters a-z, 0-9, ., and - per GSM
-	 * 03.60 Section 14.9.
-	 **/
+     * NMSettingGsm:apn:
+     *
+     * The GPRS Access Point Name specifying the APN used when establishing a
+     * data session with the GSM-based network.  The APN often determines how
+     * the user will be billed for their network usage and whether the user has
+     * access to the Internet or just a provider-specific walled-garden, so it
+     * is important to use the correct APN for the user's mobile broadband plan.
+     * The APN may only be composed of the characters a-z, 0-9, ., and - per GSM
+     * 03.60 Section 14.9.
+     **/
     obj_properties[PROP_APN] = g_param_spec_string(NM_SETTING_GSM_APN,
                                                    "",
                                                    "",
@@ -730,14 +730,14 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                                                    G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:network-id:
-	 *
-	 * The Network ID (GSM LAI format, ie MCC-MNC) to force specific network
-	 * registration.  If the Network ID is specified, NetworkManager will
-	 * attempt to force the device to register only on the specified network.
-	 * This can be used to ensure that the device does not roam when direct
-	 * roaming control of the device is not otherwise possible.
-	 **/
+     * NMSettingGsm:network-id:
+     *
+     * The Network ID (GSM LAI format, ie MCC-MNC) to force specific network
+     * registration.  If the Network ID is specified, NetworkManager will
+     * attempt to force the device to register only on the specified network.
+     * This can be used to ensure that the device does not roam when direct
+     * roaming control of the device is not otherwise possible.
+     **/
     obj_properties[PROP_NETWORK_ID] =
         g_param_spec_string(NM_SETTING_GSM_NETWORK_ID,
                             "",
@@ -746,12 +746,12 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:pin:
-	 *
-	 * If the SIM is locked with a PIN it must be unlocked before any other
-	 * operations are requested.  Specify the PIN here to allow operation of the
-	 * device.
-	 **/
+     * NMSettingGsm:pin:
+     *
+     * If the SIM is locked with a PIN it must be unlocked before any other
+     * operations are requested.  Specify the PIN here to allow operation of the
+     * device.
+     **/
     obj_properties[PROP_PIN] =
         g_param_spec_string(NM_SETTING_GSM_PIN,
                             "",
@@ -760,10 +760,10 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:pin-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingGsm:pin property.
-	 **/
+     * NMSettingGsm:pin-flags:
+     *
+     * Flags indicating how to handle the #NMSettingGsm:pin property.
+     **/
     obj_properties[PROP_PIN_FLAGS] = g_param_spec_flags(NM_SETTING_GSM_PIN_FLAGS,
                                                         "",
                                                         "",
@@ -772,11 +772,11 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:home-only:
-	 *
-	 * When %TRUE, only connections to the home network will be allowed.
-	 * Connections to roaming networks will not be made.
-	 **/
+     * NMSettingGsm:home-only:
+     *
+     * When %TRUE, only connections to the home network will be allowed.
+     * Connections to roaming networks will not be made.
+     **/
     obj_properties[PROP_HOME_ONLY] =
         g_param_spec_boolean(NM_SETTING_GSM_HOME_ONLY,
                              "",
@@ -785,14 +785,14 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:device-id:
-	 *
-	 * The device unique identifier (as given by the WWAN management service)
-	 * which this connection applies to.  If given, the connection will only
-	 * apply to the specified device.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingGsm:device-id:
+     *
+     * The device unique identifier (as given by the WWAN management service)
+     * which this connection applies to.  If given, the connection will only
+     * apply to the specified device.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_DEVICE_ID] =
         g_param_spec_string(NM_SETTING_GSM_DEVICE_ID,
                             "",
@@ -801,15 +801,15 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:sim-id:
-	 *
-	 * The SIM card unique identifier (as given by the WWAN management service)
-	 * which this connection applies to.  If given, the connection will apply
-	 * to any device also allowed by #NMSettingGsm:device-id which contains a
-	 * SIM card matching the given identifier.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingGsm:sim-id:
+     *
+     * The SIM card unique identifier (as given by the WWAN management service)
+     * which this connection applies to.  If given, the connection will apply
+     * to any device also allowed by #NMSettingGsm:device-id which contains a
+     * SIM card matching the given identifier.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_SIM_ID] = g_param_spec_string(NM_SETTING_GSM_SIM_ID,
                                                       "",
                                                       "",
@@ -817,16 +817,16 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:sim-operator-id:
-	 *
-	 * A MCC/MNC string like "310260" or "21601" identifying the specific
-	 * mobile network operator which this connection applies to.  If given,
-	 * the connection will apply to any device also allowed by
-	 * #NMSettingGsm:device-id and #NMSettingGsm:sim-id which contains a SIM
-	 * card provisioned by the given operator.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingGsm:sim-operator-id:
+     *
+     * A MCC/MNC string like "310260" or "21601" identifying the specific
+     * mobile network operator which this connection applies to.  If given,
+     * the connection will apply to any device also allowed by
+     * #NMSettingGsm:device-id and #NMSettingGsm:sim-id which contains a SIM
+     * card provisioned by the given operator.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_SIM_OPERATOR_ID] =
         g_param_spec_string(NM_SETTING_GSM_SIM_OPERATOR_ID,
                             "",
@@ -835,13 +835,13 @@ nm_setting_gsm_class_init(NMSettingGsmClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingGsm:mtu:
-	 *
-	 * If non-zero, only transmit packets of the specified size or smaller,
-	 * breaking larger packets up into multiple frames.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSettingGsm:mtu:
+     *
+     * If non-zero, only transmit packets of the specified size or smaller,
+     * breaking larger packets up into multiple frames.
+     *
+     * Since: 1.8
+     **/
     obj_properties[PROP_MTU] = g_param_spec_uint(NM_SETTING_GSM_MTU,
                                                  "",
                                                  "",
diff --git a/libnm-core/nm-setting-infiniband.c b/libnm-core/nm-setting-infiniband.c
index 67fe7a7b1d..63debcec7e 100644
--- a/libnm-core/nm-setting-infiniband.c
+++ b/libnm-core/nm-setting-infiniband.c
@@ -225,8 +225,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
 
             if (strcmp(interface_name, priv->virtual_iface_name) != 0) {
                 /* We don't support renaming software infiniband devices. Later we might, but
-				 * for now just reject such connections.
-				 **/
+                 * for now just reject such connections.
+                 **/
                 g_set_error(error,
                             NM_CONNECTION_ERROR,
                             NM_CONNECTION_ERROR_INVALID_PROPERTY,
@@ -247,14 +247,14 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
 
     if (priv->mtu > NM_INFINIBAND_MAX_MTU) {
         /* Traditionally, MTU for "datagram" mode was limited to 2044
-		 * and for "connected" mode it was 65520.
-		 *
-		 * This is no longer the case, and both transport modes use the same
-		 * maximum of 65520 (NM_INFINIBAND_MAX_MTU).
-		 *
-		 * Note that this is the MTU in the connection profile. Whether
-		 * we will be able to configure large MTUs later (during activation)
-		 * is unknown at this point. */
+         * and for "connected" mode it was 65520.
+         *
+         * This is no longer the case, and both transport modes use the same
+         * maximum of 65520 (NM_INFINIBAND_MAX_MTU).
+         *
+         * Note that this is the MTU in the connection profile. Whether
+         * we will be able to configure large MTUs later (during activation)
+         * is unknown at this point. */
         g_set_error(error,
                     NM_CONNECTION_ERROR,
                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
@@ -385,30 +385,30 @@ nm_setting_infiniband_class_init(NMSettingInfinibandClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingInfiniband:mac-address:
-	 *
-	 * If specified, this connection will only apply to the IPoIB device whose
-	 * permanent MAC address matches. This property does not change the MAC
-	 * address of the device (i.e. MAC spoofing).
-	 **/
+     * NMSettingInfiniband:mac-address:
+     *
+     * If specified, this connection will only apply to the IPoIB device whose
+     * permanent MAC address matches. This property does not change the MAC
+     * address of the device (i.e. MAC spoofing).
+     **/
     /* ---keyfile---
-	 * property: mac-address
-	 * format: usual hex-digits-and-colons notation
-	 * description: MAC address in traditional hex-digits-and-colons notation, or
-	 *   or semicolon separated list of 20 decimal bytes (obsolete)
-	 * example: mac-address= 80:00:00:6d:fe:80:00:00:00:00:00:00:00:02:55:00:70:33:cf:01
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: mac-address
-	 * variable: HWADDR
-	 * description: IBoIP 20-byte hardware address of the device (in traditional
-	 *    hex-digits-and-colons notation).
-	 *    Note that for initscripts this is the current MAC address of the device as found
-	 *    during ifup. For NetworkManager this is the permanent MAC address. Or in case no
-	 *    permanent MAC address exists, the MAC address initially configured on the device.
-	 * example: HWADDR=01:02:03:04:05:06:07:08:09:0A:01:02:03:04:05:06:07:08:09:11
-	 * ---end---
-	 */
+     * property: mac-address
+     * format: usual hex-digits-and-colons notation
+     * description: MAC address in traditional hex-digits-and-colons notation, or
+     *   or semicolon separated list of 20 decimal bytes (obsolete)
+     * example: mac-address= 80:00:00:6d:fe:80:00:00:00:00:00:00:00:02:55:00:70:33:cf:01
+     * ---end---
+     * ---ifcfg-rh---
+     * property: mac-address
+     * variable: HWADDR
+     * description: IBoIP 20-byte hardware address of the device (in traditional
+     *    hex-digits-and-colons notation).
+     *    Note that for initscripts this is the current MAC address of the device as found
+     *    during ifup. For NetworkManager this is the permanent MAC address. Or in case no
+     *    permanent MAC address exists, the MAC address initially configured on the device.
+     * example: HWADDR=01:02:03:04:05:06:07:08:09:0A:01:02:03:04:05:06:07:08:09:11
+     * ---end---
+     */
     obj_properties[PROP_MAC_ADDRESS] = g_param_spec_string(
         NM_SETTING_INFINIBAND_MAC_ADDRESS,
         "",
@@ -420,17 +420,17 @@ nm_setting_infiniband_class_init(NMSettingInfinibandClass *klass)
                                  &nm_sett_info_propert_type_mac_address);
 
     /**
-	 * NMSettingInfiniband:mtu:
-	 *
-	 * If non-zero, only transmit packets of the specified size or smaller,
-	 * breaking larger packets up into multiple frames.
-	 **/
+     * NMSettingInfiniband:mtu:
+     *
+     * If non-zero, only transmit packets of the specified size or smaller,
+     * breaking larger packets up into multiple frames.
+     **/
     /* ---ifcfg-rh---
-	 * property: mtu
-	 * variable: MTU
-	 * description: MTU of the interface.
-	 * ---end---
-	 */
+     * property: mtu
+     * variable: MTU
+     * description: MTU of the interface.
+     * ---end---
+     */
     obj_properties[PROP_MTU] = g_param_spec_uint(NM_SETTING_INFINIBAND_MTU,
                                                  "",
                                                  "",
@@ -441,19 +441,19 @@ nm_setting_infiniband_class_init(NMSettingInfinibandClass *klass)
                                                      | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingInfiniband:transport-mode:
-	 *
-	 * The IP-over-InfiniBand transport mode. Either "datagram" or
-	 * "connected".
-	 **/
+     * NMSettingInfiniband:transport-mode:
+     *
+     * The IP-over-InfiniBand transport mode. Either "datagram" or
+     * "connected".
+     **/
     /* ---ifcfg-rh---
-	 * property: transport-mode
-	 * variable: CONNECTED_MODE
-	 * default: CONNECTED_MODE=no
-	 * description: CONNECTED_MODE=yes for "connected" mode, CONNECTED_MODE=no for
-	 *   "datagram" mode
-	 * ---end---
-	 */
+     * property: transport-mode
+     * variable: CONNECTED_MODE
+     * default: CONNECTED_MODE=no
+     * description: CONNECTED_MODE=yes for "connected" mode, CONNECTED_MODE=no for
+     *   "datagram" mode
+     * ---end---
+     */
     obj_properties[PROP_TRANSPORT_MODE] = g_param_spec_string(
         NM_SETTING_INFINIBAND_TRANSPORT_MODE,
         "",
@@ -462,23 +462,23 @@ nm_setting_infiniband_class_init(NMSettingInfinibandClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingInfiniband:p-key:
-	 *
-	 * The InfiniBand P_Key to use for this device. A value of -1 means to use
-	 * the default P_Key (aka "the P_Key at index 0"). Otherwise, it is a 16-bit
-	 * unsigned integer, whose high bit is set if it is a "full membership"
-	 * P_Key.
-	 **/
+     * NMSettingInfiniband:p-key:
+     *
+     * The InfiniBand P_Key to use for this device. A value of -1 means to use
+     * the default P_Key (aka "the P_Key at index 0"). Otherwise, it is a 16-bit
+     * unsigned integer, whose high bit is set if it is a "full membership"
+     * P_Key.
+     **/
     /* ---ifcfg-rh---
-	 * property: p-key
-	 * variable: PKEY_ID (and PKEY=yes)
-	 * default: PKEY=no
-	 * description: InfiniBand P_Key. The value can be a hex number prefixed with "0x"
-	 *   or a decimal number.
-	 *   When PKEY_ID is specified, PHYSDEV and DEVICE also must be specified.
-	 * example: PKEY=yes PKEY_ID=2 PHYSDEV=mlx4_ib0 DEVICE=mlx4_ib0.8002
-	 * ---end---
-	 */
+     * property: p-key
+     * variable: PKEY_ID (and PKEY=yes)
+     * default: PKEY=no
+     * description: InfiniBand P_Key. The value can be a hex number prefixed with "0x"
+     *   or a decimal number.
+     *   When PKEY_ID is specified, PHYSDEV and DEVICE also must be specified.
+     * example: PKEY=yes PKEY_ID=2 PHYSDEV=mlx4_ib0 DEVICE=mlx4_ib0.8002
+     * ---end---
+     */
     obj_properties[PROP_P_KEY] =
         g_param_spec_int(NM_SETTING_INFINIBAND_P_KEY,
                          "",
@@ -489,21 +489,21 @@ nm_setting_infiniband_class_init(NMSettingInfinibandClass *klass)
                          G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingInfiniband:parent:
-	 *
-	 * The interface name of the parent device of this device. Normally %NULL,
-	 * but if the #NMSettingInfiniband:p_key property is set, then you must
-	 * specify the base device by setting either this property or
-	 * #NMSettingInfiniband:mac-address.
-	 **/
+     * NMSettingInfiniband:parent:
+     *
+     * The interface name of the parent device of this device. Normally %NULL,
+     * but if the #NMSettingInfiniband:p_key property is set, then you must
+     * specify the base device by setting either this property or
+     * #NMSettingInfiniband:mac-address.
+     **/
     /* ---ifcfg-rh---
-	 * property: parent
-	 * variable: PHYSDEV (PKEY=yes)
-	 * default: PKEY=no
-	 * description: InfiniBand parent device.
-	 * example: PHYSDEV=ib0
-	 * ---end---
-	 */
+     * property: parent
+     * variable: PHYSDEV (PKEY=yes)
+     * default: PKEY=no
+     * description: InfiniBand parent device.
+     * example: PHYSDEV=ib0
+     * ---end---
+     */
     obj_properties[PROP_PARENT] = g_param_spec_string(
         NM_SETTING_INFINIBAND_PARENT,
         "",
diff --git a/libnm-core/nm-setting-ip-config.c b/libnm-core/nm-setting-ip-config.c
index 64b91c0241..6fff903451 100644
--- a/libnm-core/nm-setting-ip-config.c
+++ b/libnm-core/nm-setting-ip-config.c
@@ -322,13 +322,13 @@ nm_ip_address_cmp_full(const NMIPAddress *a, const NMIPAddress *b, NMIPAddressCm
             while (g_hash_table_iter_next(&iter, (gpointer *) &key, (gpointer *) &value)) {
                 value2 = g_hash_table_lookup(b->attributes, key);
                 /* We cannot really compare GVariants, because g_variant_compare() does
-				 * not work in general. So, don't bother. NM_IP_ADDRESS_CMP_FLAGS_WITH_ATTRS is
-				 * documented to not provide a total order for the attribute contents.
-				 *
-				 * Theoretically, we can implement also a total order. However we should
-				 * not do that by default because it would require us to sort the keys
-				 * first. Most callers don't care about total order, so they shouldn't
-				 * pay the overhead. */
+                 * not work in general. So, don't bother. NM_IP_ADDRESS_CMP_FLAGS_WITH_ATTRS is
+                 * documented to not provide a total order for the attribute contents.
+                 *
+                 * Theoretically, we can implement also a total order. However we should
+                 * not do that by default because it would require us to sort the keys
+                 * first. Most callers don't care about total order, so they shouldn't
+                 * pay the overhead. */
                 if (!value2)
                     return -2;
                 if (!g_variant_equal(value, value2))
@@ -2452,9 +2452,9 @@ nm_ip_routing_rule_cmp(const NMIPRoutingRule *rule, const NMIPRoutingRule *other
     NM_CMP_FIELD(rule, other, ipproto);
 
     /* We compare the plain strings, not the binary values after utf8safe unescaping.
-	 *
-	 * The reason is, that the rules differ already when the direct strings differ, not
-	 * only when the unescaped names differ. */
+     *
+     * The reason is, that the rules differ already when the direct strings differ, not
+     * only when the unescaped names differ. */
     NM_CMP_FIELD_STR0(rule, other, iifname);
     NM_CMP_FIELD_STR0(rule, other, oifname);
 
@@ -2539,19 +2539,19 @@ nm_ip_routing_rule_validate(const NMIPRoutingRule *self, GError **error)
     g_return_val_if_fail(!error || !*error, FALSE);
 
     /* Kernel may be more flexible about validating. We do a strict validation
-	 * here and reject certain settings eagerly. We can always relax it later. */
+     * here and reject certain settings eagerly. We can always relax it later. */
 
     if (!self->priority_has) {
         /* iproute2 accepts not specifying the priority, in which case kernel will select
-		 * an unused priority. We don't allow for that, and will always require the user to
-		 * select a priority.
-		 *
-		 * Note that if the user selects priority 0 or a non-unique priority, this is problematic
-		 * due to kernel bugs rh#1685816 and rh#1685816. It may result in NetworkManager wrongly being
-		 * unable to add a rule or deleting the wrong rule.
-		 * This problem is not at all specific to the priority, it affects all rules that
-		 * have default values which confuse kernel. But setting a unique priority avoids
-		 * this problem nicely. */
+         * an unused priority. We don't allow for that, and will always require the user to
+         * select a priority.
+         *
+         * Note that if the user selects priority 0 or a non-unique priority, this is problematic
+         * due to kernel bugs rh#1685816 and rh#1685816. It may result in NetworkManager wrongly being
+         * unable to add a rule or deleting the wrong rule.
+         * This problem is not at all specific to the priority, it affects all rules that
+         * have default values which confuse kernel. But setting a unique priority avoids
+         * this problem nicely. */
         g_set_error_literal(error,
                             NM_CONNECTION_ERROR,
                             NM_CONNECTION_ERROR_INVALID_PROPERTY,
@@ -2562,9 +2562,9 @@ nm_ip_routing_rule_validate(const NMIPRoutingRule *self, GError **error)
     if (NM_IN_SET(self->action, FR_ACT_TO_TBL)) {
         if (self->table == 0) {
             /* with IPv4, kernel allows a table (in RTM_NEWRULE) of zero to automatically select
-			 * an unused table. We don't. The user needs to specify the table.
-			 *
-			 * For IPv6, kernel doesn't allow a table of zero, so we are consistent here. */
+             * an unused table. We don't. The user needs to specify the table.
+             *
+             * For IPv6, kernel doesn't allow a table of zero, so we are consistent here. */
             g_set_error_literal(error,
                                 NM_CONNECTION_ERROR,
                                 NM_CONNECTION_ERROR_INVALID_PROPERTY,
@@ -3146,38 +3146,38 @@ nm_ip_routing_rule_from_string(const char *                 str,
         return NULL;
 
     /* NM_IP_ROUTING_RULE_TO_STRING_TYPE_IPROUTE gives a string representation that is
-	 * partly compatibly with iproute2. That is, the part after `ip -[46] rule add $ARGS`.
-	 * There are differences though:
-	 *
-	 * - trying to convert an invalid rule to string may not be possible. The reason is for
-	 *   example that an invalid rule can have nm_ip_routing_rule_get_from() like "bogus",
-	 *   but we don't write that as "from bogus". In general, if you try to convert an invalid
-	 *   rule to string, the operation may fail or the result may itself not be parsable.
-	 *   Of course, valid rules can be converted to string and read back the same (round-trip).
-	 *
-	 * - iproute2 in may regards is flexible about the command lines. For example
-	 *   - for tables it accepts table names from /etc/iproute2/rt_tables. We only
-	 *     accept the special aliases "main", "local", and "default".
-	 *   - key names like "preference" can be abbreviated to "pref", we don't do that.
-	 *   - the "preference"/"priority" may be unspecified, in which kernel automatically
-	 *     chooses an unused priority (during `ip rule add`). We don't allow for that, the
-	 *     priority must be explicitly set.
-	 *
-	 * - iproute2 does not support any escaping. Well, it's the shell that supports quoting
-	 *   and escaping and splits the command line. We need to split the command line ourself,
-	 *   but we don't support full shell quotation.
-	 *   from-string tokenizes words at (ASCII) whitespaces (removing the whitespaces).
-	 *   It also supports backslash escaping (e.g. to contain whitespace), but it does
-	 *   not support special escape sequences. Values are taken literally, meaning
-	 *   "\n\ \111" gives results in "n 111".
-	 *   The strings really shouldn't contain any special characters that require escaping,
-	 *   but that's the rule.
-	 *   This also goes together with the @allow_escaping parameter of nm_utils_strsplit_set().
-	 *   If you concatenate multiple rule expressions with a delimiter, the delimiter inside
-	 *   each word can be backslash escaped, and nm_utils_strsplit_set(allow_escaping=TRUE) will
-	 *   properly split the words, preserving the backslashes, which then will be removed by
-	 *   nm_ip_routing_rule_from_string().
-	 */
+     * partly compatibly with iproute2. That is, the part after `ip -[46] rule add $ARGS`.
+     * There are differences though:
+     *
+     * - trying to convert an invalid rule to string may not be possible. The reason is for
+     *   example that an invalid rule can have nm_ip_routing_rule_get_from() like "bogus",
+     *   but we don't write that as "from bogus". In general, if you try to convert an invalid
+     *   rule to string, the operation may fail or the result may itself not be parsable.
+     *   Of course, valid rules can be converted to string and read back the same (round-trip).
+     *
+     * - iproute2 in may regards is flexible about the command lines. For example
+     *   - for tables it accepts table names from /etc/iproute2/rt_tables. We only
+     *     accept the special aliases "main", "local", and "default".
+     *   - key names like "preference" can be abbreviated to "pref", we don't do that.
+     *   - the "preference"/"priority" may be unspecified, in which kernel automatically
+     *     chooses an unused priority (during `ip rule add`). We don't allow for that, the
+     *     priority must be explicitly set.
+     *
+     * - iproute2 does not support any escaping. Well, it's the shell that supports quoting
+     *   and escaping and splits the command line. We need to split the command line ourself,
+     *   but we don't support full shell quotation.
+     *   from-string tokenizes words at (ASCII) whitespaces (removing the whitespaces).
+     *   It also supports backslash escaping (e.g. to contain whitespace), but it does
+     *   not support special escape sequences. Values are taken literally, meaning
+     *   "\n\ \111" gives results in "n 111".
+     *   The strings really shouldn't contain any special characters that require escaping,
+     *   but that's the rule.
+     *   This also goes together with the @allow_escaping parameter of nm_utils_strsplit_set().
+     *   If you concatenate multiple rule expressions with a delimiter, the delimiter inside
+     *   each word can be backslash escaped, and nm_utils_strsplit_set(allow_escaping=TRUE) will
+     *   properly split the words, preserving the backslashes, which then will be removed by
+     *   nm_ip_routing_rule_from_string().
+     */
 
     addr_family = _rr_string_addr_family_from_flags(to_string_flags);
 
@@ -3194,7 +3194,7 @@ nm_ip_routing_rule_from_string(const char *                 str,
         }
 
         /* iproute2 matches keywords with any partial prefix. We don't allow
-		 * for that flexibility. */
+         * for that flexibility. */
 
         if (NM_IN_STRSET(word0, "from")) {
             if (!word1)
@@ -3214,7 +3214,7 @@ nm_ip_routing_rule_from_string(const char *                 str,
         }
         if (NM_IN_STRSET(word0, "not")) {
             /* we accept multiple "not" specifiers. "not not" still means
-			 * not. */
+             * not. */
             val_invert = TRUE;
             goto next_words_consumed;
         }
@@ -3331,8 +3331,8 @@ nm_ip_routing_rule_from_string(const char *                 str,
         }
 
         /* also the action is still unsupported. For the moment, we only support
-		 * FR_ACT_TO_TBL, which is the default (by not expressing it on the command
-		 * line). */
+         * FR_ACT_TO_TBL, which is the default (by not expressing it on the command
+         * line). */
         g_set_error(error,
                     NM_CONNECTION_ERROR,
                     NM_CONNECTION_ERROR_FAILED,
@@ -3541,13 +3541,13 @@ nm_ip_routing_rule_to_string(const NMIPRoutingRule *      self,
     }
 
     /* It is only guaranteed that valid rules can be expressed as string.
-	 *
-	 * Still, unless requested proceed to convert to string without validating and
-	 * hope for the best.
-	 *
-	 * That is, because self->from_str might contain an invalid IP address (indicated
-	 * by self->from_valid). But we don't support serializing such arbitrary strings
-	 * as "from %s". */
+     *
+     * Still, unless requested proceed to convert to string without validating and
+     * hope for the best.
+     *
+     * That is, because self->from_str might contain an invalid IP address (indicated
+     * by self->from_valid). But we don't support serializing such arbitrary strings
+     * as "from %s". */
     if (NM_FLAGS_HAS(to_string_flags, NM_IP_ROUTING_RULE_AS_STRING_FLAGS_VALIDATE)) {
         gs_free_error GError *local = NULL;
 
@@ -5541,11 +5541,11 @@ _nm_sett_info_property_override_create_array_ip_config(void)
                                                            .from_dbus_fcn = ip_gateway_set, ));
 
     /* ---dbus---
-	 * property: routing-rules
-	 * format: array of 'a{sv}'
-	 * description: Array of dictionaries for routing rules.
-	 * ---end---
-	 */
+     * property: routing-rules
+     * format: array of 'a{sv}'
+     * description: Array of dictionaries for routing rules.
+     * ---end---
+     */
     _nm_properties_override_dbus(
         properties_override,
         NM_SETTING_IP_CONFIG_ROUTING_RULES,
@@ -5811,28 +5811,28 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
     setting_class->enumerate_values          = enumerate_values;
 
     /**
-	 * NMSettingIPConfig:method:
-	 *
-	 * IP configuration method.
-	 *
-	 * #NMSettingIP4Config and #NMSettingIP6Config both support "disabled",
-	 * "auto", "manual", and "link-local". See the subclass-specific
-	 * documentation for other values.
-	 *
-	 * In general, for the "auto" method, properties such as
-	 * #NMSettingIPConfig:dns and #NMSettingIPConfig:routes specify information
-	 * that is added on to the information returned from automatic
-	 * configuration.  The #NMSettingIPConfig:ignore-auto-routes and
-	 * #NMSettingIPConfig:ignore-auto-dns properties modify this behavior.
-	 *
-	 * For methods that imply no upstream network, such as "shared" or
-	 * "link-local", these properties must be empty.
-	 *
-	 * For IPv4 method "shared", the IP subnet can be configured by adding one
-	 * manual IPv4 address or otherwise 10.42.x.0/24 is chosen. Note that the
-	 * shared method must be configured on the interface which shares the internet
-	 * to a subnet, not on the uplink which is shared.
-	 **/
+     * NMSettingIPConfig:method:
+     *
+     * IP configuration method.
+     *
+     * #NMSettingIP4Config and #NMSettingIP6Config both support "disabled",
+     * "auto", "manual", and "link-local". See the subclass-specific
+     * documentation for other values.
+     *
+     * In general, for the "auto" method, properties such as
+     * #NMSettingIPConfig:dns and #NMSettingIPConfig:routes specify information
+     * that is added on to the information returned from automatic
+     * configuration.  The #NMSettingIPConfig:ignore-auto-routes and
+     * #NMSettingIPConfig:ignore-auto-dns properties modify this behavior.
+     *
+     * For methods that imply no upstream network, such as "shared" or
+     * "link-local", these properties must be empty.
+     *
+     * For IPv4 method "shared", the IP subnet can be configured by adding one
+     * manual IPv4 address or otherwise 10.42.x.0/24 is chosen. Note that the
+     * shared method must be configured on the interface which shares the internet
+     * to a subnet, not on the uplink which is shared.
+     **/
     obj_properties[PROP_METHOD] = g_param_spec_string(
         NM_SETTING_IP_CONFIG_METHOD,
         "",
@@ -5841,10 +5841,10 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dns:
-	 *
-	 * Array of IP addresses of DNS servers.
-	 **/
+     * NMSettingIPConfig:dns:
+     *
+     * Array of IP addresses of DNS servers.
+     **/
     obj_properties[PROP_DNS] = g_param_spec_boxed(NM_SETTING_IP_CONFIG_DNS,
                                                   "",
                                                   "",
@@ -5852,18 +5852,18 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                                                   G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dns-search:
-	 *
-	 * Array of DNS search domains. Domains starting with a tilde ('~')
-	 * are considered 'routing' domains and are used only to decide the
-	 * interface over which a query must be forwarded; they are not used
-	 * to complete unqualified host names.
-	 *
-	 * When using a DNS plugin that supports Conditional Forwarding or
-	 * Split DNS, then the search domains specify which name servers to
-	 * query. This makes the behavior different from running with plain
-	 * /etc/resolv.conf. For more information see also the dns-priority setting.
-	 **/
+     * NMSettingIPConfig:dns-search:
+     *
+     * Array of DNS search domains. Domains starting with a tilde ('~')
+     * are considered 'routing' domains and are used only to decide the
+     * interface over which a query must be forwarded; they are not used
+     * to complete unqualified host names.
+     *
+     * When using a DNS plugin that supports Conditional Forwarding or
+     * Split DNS, then the search domains specify which name servers to
+     * query. This makes the behavior different from running with plain
+     * /etc/resolv.conf. For more information see also the dns-priority setting.
+     **/
     obj_properties[PROP_DNS_SEARCH] =
         g_param_spec_boxed(NM_SETTING_IP_CONFIG_DNS_SEARCH,
                            "",
@@ -5872,25 +5872,25 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dns-options:
-	 *
-	 * Array of DNS options as described in man 5 resolv.conf.
-	 *
-	 * %NULL means that the options are unset and left at the default.
-	 * In this case NetworkManager will use default options. This is
-	 * distinct from an empty list of properties.
-	 *
-	 * The currently supported options are "attempts", "debug", "edns0",
-	 * "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names",
-	 * "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request",
-	 * "single-request-reopen", "timeout", "trust-ad", "use-vc".
-	 *
-	 * The "trust-ad" setting is only honored if the profile contributes
-	 * name servers to resolv.conf, and if all contributing profiles have
-	 * "trust-ad" enabled.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPConfig:dns-options:
+     *
+     * Array of DNS options as described in man 5 resolv.conf.
+     *
+     * %NULL means that the options are unset and left at the default.
+     * In this case NetworkManager will use default options. This is
+     * distinct from an empty list of properties.
+     *
+     * The currently supported options are "attempts", "debug", "edns0",
+     * "inet6", "ip6-bytestring", "ip6-dotint", "ndots", "no-check-names",
+     * "no-ip6-dotint", "no-reload", "no-tld-query", "rotate", "single-request",
+     * "single-request-reopen", "timeout", "trust-ad", "use-vc".
+     *
+     * The "trust-ad" setting is only honored if the profile contributes
+     * name servers to resolv.conf, and if all contributing profiles have
+     * "trust-ad" enabled.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_DNS_OPTIONS] =
         g_param_spec_boxed(NM_SETTING_IP_CONFIG_DNS_OPTIONS,
                            "",
@@ -5899,58 +5899,58 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dns-priority:
-	 *
-	 * DNS servers priority.
-	 *
-	 * The relative priority for DNS servers specified by this setting.  A lower
-	 * numerical value is better (higher priority).
-	 *
-	 * Negative values have the special effect of excluding other configurations
-	 * with a greater numerical priority value; so in presence of at least one negative
-	 * priority, only DNS servers from connections with the lowest priority value will be used.
-	 * To avoid all DNS leaks, set the priority of the profile that should be used
-	 * to the most negative value of all active connections profiles.
-	 *
-	 * Zero selects a globally configured default value. If the latter is missing
-	 * or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for
-	 * other connections.
-	 *
-	 * Note that the priority is to order DNS settings for multiple active
-	 * connections.  It does not disambiguate multiple DNS servers within the
-	 * same connection profile.
-	 *
-	 * When multiple devices have configurations with the same priority, VPNs will be
-	 * considered first, then devices with the best (lowest metric) default
-	 * route and then all other devices.
-	 *
-	 * When using dns=default, servers with higher priority will be on top of
-	 * resolv.conf. To prioritize a given server over another one within the
-	 * same connection, just specify them in the desired order.
-	 * Note that commonly the resolver tries name servers in /etc/resolv.conf
-	 * in the order listed, proceeding with the next server in the list
-	 * on failure. See for example the "rotate" option of the dns-options setting.
-	 * If there are any negative DNS priorities, then only name servers from
-	 * the devices with that lowest priority will be considered.
-	 *
-	 * When using a DNS resolver that supports Conditional Forwarding or
-	 * Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection
-	 * is used to query domains in its search list. The search domains determine which
-	 * name servers to ask, and the DNS priority is used to prioritize
-	 * name servers based on the domain.  Queries for domains not present in any
-	 * search list are routed through connections having the '~.' special wildcard
-	 * domain, which is added automatically to connections with the default route
-	 * (or can be added manually).  When multiple connections specify the same domain, the
-	 * one with the best priority (lowest numerical value) wins.  If a sub domain
-	 * is configured on another interface it will be accepted regardless the priority,
-	 * unless parent domain on the other interface has a negative priority, which causes
-	 * the sub domain to be shadowed.
-	 * With Split DNS one can avoid undesired DNS leaks by properly configuring
-	 * DNS priorities and the search domains, so that only name servers of the desired
-	 * interface are configured.
-	 *
-	 * Since: 1.4
-	 **/
+     * NMSettingIPConfig:dns-priority:
+     *
+     * DNS servers priority.
+     *
+     * The relative priority for DNS servers specified by this setting.  A lower
+     * numerical value is better (higher priority).
+     *
+     * Negative values have the special effect of excluding other configurations
+     * with a greater numerical priority value; so in presence of at least one negative
+     * priority, only DNS servers from connections with the lowest priority value will be used.
+     * To avoid all DNS leaks, set the priority of the profile that should be used
+     * to the most negative value of all active connections profiles.
+     *
+     * Zero selects a globally configured default value. If the latter is missing
+     * or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for
+     * other connections.
+     *
+     * Note that the priority is to order DNS settings for multiple active
+     * connections.  It does not disambiguate multiple DNS servers within the
+     * same connection profile.
+     *
+     * When multiple devices have configurations with the same priority, VPNs will be
+     * considered first, then devices with the best (lowest metric) default
+     * route and then all other devices.
+     *
+     * When using dns=default, servers with higher priority will be on top of
+     * resolv.conf. To prioritize a given server over another one within the
+     * same connection, just specify them in the desired order.
+     * Note that commonly the resolver tries name servers in /etc/resolv.conf
+     * in the order listed, proceeding with the next server in the list
+     * on failure. See for example the "rotate" option of the dns-options setting.
+     * If there are any negative DNS priorities, then only name servers from
+     * the devices with that lowest priority will be considered.
+     *
+     * When using a DNS resolver that supports Conditional Forwarding or
+     * Split DNS (with dns=dnsmasq or dns=systemd-resolved settings), each connection
+     * is used to query domains in its search list. The search domains determine which
+     * name servers to ask, and the DNS priority is used to prioritize
+     * name servers based on the domain.  Queries for domains not present in any
+     * search list are routed through connections having the '~.' special wildcard
+     * domain, which is added automatically to connections with the default route
+     * (or can be added manually).  When multiple connections specify the same domain, the
+     * one with the best priority (lowest numerical value) wins.  If a sub domain
+     * is configured on another interface it will be accepted regardless the priority,
+     * unless parent domain on the other interface has a negative priority, which causes
+     * the sub domain to be shadowed.
+     * With Split DNS one can avoid undesired DNS leaks by properly configuring
+     * DNS priorities and the search domains, so that only name servers of the desired
+     * interface are configured.
+     *
+     * Since: 1.4
+     **/
     obj_properties[PROP_DNS_PRIORITY] =
         g_param_spec_int(NM_SETTING_IP_CONFIG_DNS_PRIORITY,
                          "",
@@ -5961,10 +5961,10 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:addresses: (type GPtrArray(NMIPAddress))
-	 *
-	 * Array of IP addresses.
-	 **/
+     * NMSettingIPConfig:addresses: (type GPtrArray(NMIPAddress))
+     *
+     * Array of IP addresses.
+     **/
     obj_properties[PROP_ADDRESSES] =
         g_param_spec_boxed(NM_SETTING_IP_CONFIG_ADDRESSES,
                            "",
@@ -5978,18 +5978,18 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                                NM_SETTING_PARAM_LEGACY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:gateway:
-	 *
-	 * The gateway associated with this configuration. This is only meaningful
-	 * if #NMSettingIPConfig:addresses is also set.
-	 *
-	 * The gateway's main purpose is to control the next hop of the standard default route on the device.
-	 * Hence, the gateway property conflicts with #NMSettingIPConfig:never-default and will be
-	 * automatically dropped if the IP configuration is set to never-default.
-	 *
-	 * As an alternative to set the gateway, configure a static default route with /0 as prefix
-	 * length.
-	 **/
+     * NMSettingIPConfig:gateway:
+     *
+     * The gateway associated with this configuration. This is only meaningful
+     * if #NMSettingIPConfig:addresses is also set.
+     *
+     * The gateway's main purpose is to control the next hop of the standard default route on the device.
+     * Hence, the gateway property conflicts with #NMSettingIPConfig:never-default and will be
+     * automatically dropped if the IP configuration is set to never-default.
+     *
+     * As an alternative to set the gateway, configure a static default route with /0 as prefix
+     * length.
+     **/
     obj_properties[PROP_GATEWAY] = g_param_spec_string(
         NM_SETTING_IP_CONFIG_GATEWAY,
         "",
@@ -5998,10 +5998,10 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:routes: (type GPtrArray(NMIPRoute))
-	 *
-	 * Array of IP routes.
-	 **/
+     * NMSettingIPConfig:routes: (type GPtrArray(NMIPRoute))
+     *
+     * Array of IP routes.
+     **/
     obj_properties[PROP_ROUTES] =
         g_param_spec_boxed(NM_SETTING_IP_CONFIG_ROUTES,
                            "",
@@ -6012,19 +6012,19 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                                NM_SETTING_PARAM_LEGACY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:route-metric:
-	 *
-	 * The default metric for routes that don't explicitly specify a metric.
-	 * The default value -1 means that the metric is chosen automatically
-	 * based on the device type.
-	 * The metric applies to dynamic routes, manual (static) routes that
-	 * don't have an explicit metric setting, address prefix routes, and
-	 * the default route.
-	 * Note that for IPv6, the kernel accepts zero (0) but coerces it to
-	 * 1024 (user default). Hence, setting this property to zero effectively
-	 * mean setting it to 1024.
-	 * For IPv4, zero is a regular value for the metric.
-	 **/
+     * NMSettingIPConfig:route-metric:
+     *
+     * The default metric for routes that don't explicitly specify a metric.
+     * The default value -1 means that the metric is chosen automatically
+     * based on the device type.
+     * The metric applies to dynamic routes, manual (static) routes that
+     * don't have an explicit metric setting, address prefix routes, and
+     * the default route.
+     * Note that for IPv6, the kernel accepts zero (0) but coerces it to
+     * 1024 (user default). Hence, setting this property to zero effectively
+     * mean setting it to 1024.
+     * For IPv4, zero is a regular value for the metric.
+     **/
     obj_properties[PROP_ROUTE_METRIC] =
         g_param_spec_int64(NM_SETTING_IP_CONFIG_ROUTE_METRIC,
                            "",
@@ -6035,26 +6035,26 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:route-table:
-	 *
-	 * Enable policy routing (source routing) and set the routing table used when adding routes.
-	 *
-	 * This affects all routes, including device-routes, IPv4LL, DHCP, SLAAC, default-routes
-	 * and static routes. But note that static routes can individually overwrite the setting
-	 * by explicitly specifying a non-zero routing table.
-	 *
-	 * If the table setting is left at zero, it is eligible to be overwritten via global
-	 * configuration. If the property is zero even after applying the global configuration
-	 * value, policy routing is disabled for the address family of this connection.
-	 *
-	 * Policy routing disabled means that NetworkManager will add all routes to the main
-	 * table (except static routes that explicitly configure a different table). Additionally,
-	 * NetworkManager will not delete any extraneous routes from tables except the main table.
-	 * This is to preserve backward compatibility for users who manage routing tables outside
-	 * of NetworkManager.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingIPConfig:route-table:
+     *
+     * Enable policy routing (source routing) and set the routing table used when adding routes.
+     *
+     * This affects all routes, including device-routes, IPv4LL, DHCP, SLAAC, default-routes
+     * and static routes. But note that static routes can individually overwrite the setting
+     * by explicitly specifying a non-zero routing table.
+     *
+     * If the table setting is left at zero, it is eligible to be overwritten via global
+     * configuration. If the property is zero even after applying the global configuration
+     * value, policy routing is disabled for the address family of this connection.
+     *
+     * Policy routing disabled means that NetworkManager will add all routes to the main
+     * table (except static routes that explicitly configure a different table). Additionally,
+     * NetworkManager will not delete any extraneous routes from tables except the main table.
+     * This is to preserve backward compatibility for users who manage routing tables outside
+     * of NetworkManager.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_ROUTE_TABLE] = g_param_spec_uint(
         NM_SETTING_IP_CONFIG_ROUTE_TABLE,
         "",
@@ -6064,12 +6064,12 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
         0,
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
     /**
-	 * NMSettingIPConfig:ignore-auto-routes:
-	 *
-	 * When #NMSettingIPConfig:method is set to "auto" and this property to
-	 * %TRUE, automatically configured routes are ignored and only routes
-	 * specified in the #NMSettingIPConfig:routes property, if any, are used.
-	 **/
+     * NMSettingIPConfig:ignore-auto-routes:
+     *
+     * When #NMSettingIPConfig:method is set to "auto" and this property to
+     * %TRUE, automatically configured routes are ignored and only routes
+     * specified in the #NMSettingIPConfig:routes property, if any, are used.
+     **/
     obj_properties[PROP_IGNORE_AUTO_ROUTES] =
         g_param_spec_boolean(NM_SETTING_IP_CONFIG_IGNORE_AUTO_ROUTES,
                              "",
@@ -6078,14 +6078,14 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:ignore-auto-dns:
-	 *
-	 * When #NMSettingIPConfig:method is set to "auto" and this property to
-	 * %TRUE, automatically configured name servers and search domains are
-	 * ignored and only name servers and search domains specified in the
-	 * #NMSettingIPConfig:dns and #NMSettingIPConfig:dns-search properties, if
-	 * any, are used.
-	 **/
+     * NMSettingIPConfig:ignore-auto-dns:
+     *
+     * When #NMSettingIPConfig:method is set to "auto" and this property to
+     * %TRUE, automatically configured name servers and search domains are
+     * ignored and only name servers and search domains specified in the
+     * #NMSettingIPConfig:dns and #NMSettingIPConfig:dns-search properties, if
+     * any, are used.
+     **/
     obj_properties[PROP_IGNORE_AUTO_DNS] =
         g_param_spec_boolean(NM_SETTING_IP_CONFIG_IGNORE_AUTO_DNS,
                              "",
@@ -6094,13 +6094,13 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dhcp-hostname:
-	 *
-	 * If the #NMSettingIPConfig:dhcp-send-hostname property is %TRUE, then the
-	 * specified name will be sent to the DHCP server when acquiring a lease.
-	 * This property and #NMSettingIP4Config:dhcp-fqdn are mutually exclusive and
-	 * cannot be set at the same time.
-	 **/
+     * NMSettingIPConfig:dhcp-hostname:
+     *
+     * If the #NMSettingIPConfig:dhcp-send-hostname property is %TRUE, then the
+     * specified name will be sent to the DHCP server when acquiring a lease.
+     * This property and #NMSettingIP4Config:dhcp-fqdn are mutually exclusive and
+     * cannot be set at the same time.
+     **/
     obj_properties[PROP_DHCP_HOSTNAME] =
         g_param_spec_string(NM_SETTING_IP_CONFIG_DHCP_HOSTNAME,
                             "",
@@ -6109,14 +6109,14 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dhcp-send-hostname:
-	 *
-	 * If %TRUE, a hostname is sent to the DHCP server when acquiring a lease.
-	 * Some DHCP servers use this hostname to update DNS databases, essentially
-	 * providing a static hostname for the computer.  If the
-	 * #NMSettingIPConfig:dhcp-hostname property is %NULL and this property is
-	 * %TRUE, the current persistent hostname of the computer is sent.
-	 **/
+     * NMSettingIPConfig:dhcp-send-hostname:
+     *
+     * If %TRUE, a hostname is sent to the DHCP server when acquiring a lease.
+     * Some DHCP servers use this hostname to update DNS databases, essentially
+     * providing a static hostname for the computer.  If the
+     * #NMSettingIPConfig:dhcp-hostname property is %NULL and this property is
+     * %TRUE, the current persistent hostname of the computer is sent.
+     **/
     obj_properties[PROP_DHCP_SEND_HOSTNAME] =
         g_param_spec_boolean(NM_SETTING_IP_CONFIG_DHCP_SEND_HOSTNAME,
                              "",
@@ -6125,12 +6125,12 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:never-default:
-	 *
-	 * If %TRUE, this connection will never be the default connection for this
-	 * IP type, meaning it will never be assigned the default route by
-	 * NetworkManager.
-	 **/
+     * NMSettingIPConfig:never-default:
+     *
+     * If %TRUE, this connection will never be the default connection for this
+     * IP type, meaning it will never be assigned the default route by
+     * NetworkManager.
+     **/
     obj_properties[PROP_NEVER_DEFAULT] =
         g_param_spec_boolean(NM_SETTING_IP_CONFIG_NEVER_DEFAULT,
                              "",
@@ -6139,16 +6139,16 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:may-fail:
-	 *
-	 * If %TRUE, allow overall network configuration to proceed even if the
-	 * configuration specified by this property times out.  Note that at least
-	 * one IP configuration must succeed or overall network configuration will
-	 * still fail.  For example, in IPv6-only networks, setting this property to
-	 * %TRUE on the #NMSettingIP4Config allows the overall network configuration
-	 * to succeed if IPv4 configuration fails but IPv6 configuration completes
-	 * successfully.
-	 **/
+     * NMSettingIPConfig:may-fail:
+     *
+     * If %TRUE, allow overall network configuration to proceed even if the
+     * configuration specified by this property times out.  Note that at least
+     * one IP configuration must succeed or overall network configuration will
+     * still fail.  For example, in IPv6-only networks, setting this property to
+     * %TRUE on the #NMSettingIP4Config allows the overall network configuration
+     * to succeed if IPv4 configuration fails but IPv6 configuration completes
+     * successfully.
+     **/
     obj_properties[PROP_MAY_FAIL] =
         g_param_spec_boolean(NM_SETTING_IP_CONFIG_MAY_FAIL,
                              "",
@@ -6157,19 +6157,19 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dad-timeout:
-	 *
-	 * Timeout in milliseconds used to check for the presence of duplicate IP
-	 * addresses on the network.  If an address conflict is detected, the
-	 * activation will fail.  A zero value means that no duplicate address
-	 * detection is performed, -1 means the default value (either configuration
-	 * ipvx.dad-timeout override or zero).  A value greater than zero is a
-	 * timeout in milliseconds.
-	 *
-	 * The property is currently implemented only for IPv4.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPConfig:dad-timeout:
+     *
+     * Timeout in milliseconds used to check for the presence of duplicate IP
+     * addresses on the network.  If an address conflict is detected, the
+     * activation will fail.  A zero value means that no duplicate address
+     * detection is performed, -1 means the default value (either configuration
+     * ipvx.dad-timeout override or zero).  A value greater than zero is a
+     * timeout in milliseconds.
+     *
+     * The property is currently implemented only for IPv4.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_DAD_TIMEOUT] = g_param_spec_int(
         NM_SETTING_IP_CONFIG_DAD_TIMEOUT,
         "",
@@ -6180,14 +6180,14 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dhcp-timeout:
-	 *
-	 * A timeout for a DHCP transaction in seconds. If zero (the default), a
-	 * globally configured default is used. If still unspecified, a device specific
-	 * timeout is used (usually 45 seconds).
-	 *
-	 * Set to 2147483647 (MAXINT32) for infinity.
-	 **/
+     * NMSettingIPConfig:dhcp-timeout:
+     *
+     * A timeout for a DHCP transaction in seconds. If zero (the default), a
+     * globally configured default is used. If still unspecified, a device specific
+     * timeout is used (usually 45 seconds).
+     *
+     * Set to 2147483647 (MAXINT32) for infinity.
+     **/
     obj_properties[PROP_DHCP_TIMEOUT] = g_param_spec_int(
         NM_SETTING_IP_CONFIG_DHCP_TIMEOUT,
         "",
@@ -6198,23 +6198,23 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dhcp-iaid:
-	 *
-	 * A string containing the "Identity Association Identifier" (IAID) used
-	 * by the DHCP client. The property is a 32-bit decimal value or a
-	 * special value among "mac", "perm-mac", "ifname" and "stable". When
-	 * set to "mac" (or "perm-mac"), the last 4 bytes of the current (or
-	 * permanent) MAC address are used as IAID. When set to "ifname", the
-	 * IAID is computed by hashing the interface name. The special value
-	 * "stable" can be used to generate an IAID based on the stable-id (see
-	 * connection.stable-id), a per-host key and the interface name. When
-	 * the property is unset, the value from global configuration is used;
-	 * if no global default is set then the IAID is assumed to be
-	 * "ifname". Note that at the moment this property is ignored for IPv6
-	 * by dhclient, which always derives the IAID from the MAC address.
-	 *
-	 * Since: 1.22
-	 **/
+     * NMSettingIPConfig:dhcp-iaid:
+     *
+     * A string containing the "Identity Association Identifier" (IAID) used
+     * by the DHCP client. The property is a 32-bit decimal value or a
+     * special value among "mac", "perm-mac", "ifname" and "stable". When
+     * set to "mac" (or "perm-mac"), the last 4 bytes of the current (or
+     * permanent) MAC address are used as IAID. When set to "ifname", the
+     * IAID is computed by hashing the interface name. The special value
+     * "stable" can be used to generate an IAID based on the stable-id (see
+     * connection.stable-id), a per-host key and the interface name. When
+     * the property is unset, the value from global configuration is used;
+     * if no global default is set then the IAID is assumed to be
+     * "ifname". Note that at the moment this property is ignored for IPv6
+     * by dhclient, which always derives the IAID from the MAC address.
+     *
+     * Since: 1.22
+     **/
     obj_properties[PROP_DHCP_IAID] =
         g_param_spec_string(NM_SETTING_IP_CONFIG_DHCP_IAID,
                             "",
@@ -6223,30 +6223,30 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dhcp-hostname-flags:
-	 *
-	 * Flags for the DHCP hostname and FQDN.
-	 *
-	 * Currently, this property only includes flags to control the FQDN flags
-	 * set in the DHCP FQDN option. Supported FQDN flags are
-	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE,
-	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED and
-	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_NO_UPDATE.  When no FQDN flag is set and
-	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS is set, the DHCP FQDN option will
-	 * contain no flag. Otherwise, if no FQDN flag is set and
-	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS is not set, the standard FQDN flags
-	 * are set in the request:
-	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE,
-	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED for IPv4 and
-	 * %NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE for IPv6.
-	 *
-	 * When this property is set to the default value %NM_DHCP_HOSTNAME_FLAG_NONE,
-	 * a global default is looked up in NetworkManager configuration. If that value
-	 * is unset or also %NM_DHCP_HOSTNAME_FLAG_NONE, then the standard FQDN flags
-	 * described above are sent in the DHCP requests.
-	 *
-	 * Since: 1.22
-	 */
+     * NMSettingIPConfig:dhcp-hostname-flags:
+     *
+     * Flags for the DHCP hostname and FQDN.
+     *
+     * Currently, this property only includes flags to control the FQDN flags
+     * set in the DHCP FQDN option. Supported FQDN flags are
+     * %NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE,
+     * %NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED and
+     * %NM_DHCP_HOSTNAME_FLAG_FQDN_NO_UPDATE.  When no FQDN flag is set and
+     * %NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS is set, the DHCP FQDN option will
+     * contain no flag. Otherwise, if no FQDN flag is set and
+     * %NM_DHCP_HOSTNAME_FLAG_FQDN_CLEAR_FLAGS is not set, the standard FQDN flags
+     * are set in the request:
+     * %NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE,
+     * %NM_DHCP_HOSTNAME_FLAG_FQDN_ENCODED for IPv4 and
+     * %NM_DHCP_HOSTNAME_FLAG_FQDN_SERV_UPDATE for IPv6.
+     *
+     * When this property is set to the default value %NM_DHCP_HOSTNAME_FLAG_NONE,
+     * a global default is looked up in NetworkManager configuration. If that value
+     * is unset or also %NM_DHCP_HOSTNAME_FLAG_NONE, then the standard FQDN flags
+     * described above are sent in the DHCP requests.
+     *
+     * Since: 1.22
+     */
     obj_properties[PROP_DHCP_HOSTNAME_FLAGS] =
         g_param_spec_uint(NM_SETTING_IP_CONFIG_DHCP_HOSTNAME_FLAGS,
                           "",
@@ -6257,18 +6257,18 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass)
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPConfig:dhcp-reject-servers:
-	 *
-	 * Array of servers from which DHCP offers must be rejected. This property
-	 * is useful to avoid getting a lease from misconfigured or rogue servers.
-	 *
-	 * For DHCPv4, each element must be an IPv4 address, optionally
-	 * followed by a slash and a prefix length (e.g. "192.168.122.0/24").
-	 *
-	 * This property is currently not implemented for DHCPv6.
-	 *
-	 * Since: 1.28
-	 **/
+     * NMSettingIPConfig:dhcp-reject-servers:
+     *
+     * Array of servers from which DHCP offers must be rejected. This property
+     * is useful to avoid getting a lease from misconfigured or rogue servers.
+     *
+     * For DHCPv4, each element must be an IPv4 address, optionally
+     * followed by a slash and a prefix length (e.g. "192.168.122.0/24").
+     *
+     * This property is currently not implemented for DHCPv6.
+     *
+     * Since: 1.28
+     **/
     obj_properties[PROP_DHCP_REJECT_SERVERS] =
         g_param_spec_boxed(NM_SETTING_IP_CONFIG_DHCP_REJECT_SERVERS,
                            "",
diff --git a/libnm-core/nm-setting-ip-tunnel.c b/libnm-core/nm-setting-ip-tunnel.c
index a6c2cfd1a6..ec096b2672 100644
--- a/libnm-core/nm-setting-ip-tunnel.c
+++ b/libnm-core/nm-setting-ip-tunnel.c
@@ -650,14 +650,14 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingIPTunnel:parent:
-	 *
-	 * If given, specifies the parent interface name or parent connection UUID
-	 * the new device will be bound to so that tunneled packets will only be
-	 * routed via that interface.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:parent:
+     *
+     * If given, specifies the parent interface name or parent connection UUID
+     * the new device will be bound to so that tunneled packets will only be
+     * routed via that interface.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_string(
         NM_SETTING_IP_TUNNEL_PARENT,
         "",
@@ -666,13 +666,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:mode:
-	 *
-	 * The tunneling mode, for example %NM_IP_TUNNEL_MODE_IPIP or
-	 * %NM_IP_TUNNEL_MODE_GRE.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:mode:
+     *
+     * The tunneling mode, for example %NM_IP_TUNNEL_MODE_IPIP or
+     * %NM_IP_TUNNEL_MODE_GRE.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_MODE] =
         g_param_spec_uint(NM_SETTING_IP_TUNNEL_MODE,
                           "",
@@ -683,13 +683,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:local:
-	 *
-	 * The local endpoint of the tunnel; the value can be empty, otherwise it
-	 * must contain an IPv4 or IPv6 address.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:local:
+     *
+     * The local endpoint of the tunnel; the value can be empty, otherwise it
+     * must contain an IPv4 or IPv6 address.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_LOCAL] = g_param_spec_string(NM_SETTING_IP_TUNNEL_LOCAL,
                                                      "",
                                                      "",
@@ -698,13 +698,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
                                                          | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:remote:
-	 *
-	 * The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6
-	 * address.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:remote:
+     *
+     * The remote endpoint of the tunnel; the value must contain an IPv4 or IPv6
+     * address.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_REMOTE] = g_param_spec_string(
         NM_SETTING_IP_TUNNEL_REMOTE,
         "",
@@ -713,13 +713,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:ttl
-	 *
-	 * The TTL to assign to tunneled packets. 0 is a special value meaning that
-	 * packets inherit the TTL value.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:ttl
+     *
+     * The TTL to assign to tunneled packets. 0 is a special value meaning that
+     * packets inherit the TTL value.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TTL] =
         g_param_spec_uint(NM_SETTING_IP_TUNNEL_TTL,
                           "",
@@ -730,13 +730,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:tos
-	 *
-	 * The type of service (IPv4) or traffic class (IPv6) field to be set on
-	 * tunneled packets.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:tos
+     *
+     * The type of service (IPv4) or traffic class (IPv6) field to be set on
+     * tunneled packets.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TOS] =
         g_param_spec_uint(NM_SETTING_IP_TUNNEL_TOS,
                           "",
@@ -747,12 +747,12 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:path-mtu-discovery
-	 *
-	 * Whether to enable Path MTU Discovery on this tunnel.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:path-mtu-discovery
+     *
+     * Whether to enable Path MTU Discovery on this tunnel.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PATH_MTU_DISCOVERY] = g_param_spec_boolean(
         NM_SETTING_IP_TUNNEL_PATH_MTU_DISCOVERY,
         "",
@@ -761,13 +761,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:input-key:
-	 *
-	 * The key used for tunnel input packets; the property is valid only for
-	 * certain tunnel modes (GRE, IP6GRE). If empty, no key is used.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:input-key:
+     *
+     * The key used for tunnel input packets; the property is valid only for
+     * certain tunnel modes (GRE, IP6GRE). If empty, no key is used.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_INPUT_KEY] = g_param_spec_string(
         NM_SETTING_IP_TUNNEL_INPUT_KEY,
         "",
@@ -776,13 +776,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:output-key:
-	 *
-	 * The key used for tunnel output packets; the property is valid only for
-	 * certain tunnel modes (GRE, IP6GRE). If empty, no key is used.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:output-key:
+     *
+     * The key used for tunnel output packets; the property is valid only for
+     * certain tunnel modes (GRE, IP6GRE). If empty, no key is used.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_OUTPUT_KEY] = g_param_spec_string(
         NM_SETTING_IP_TUNNEL_OUTPUT_KEY,
         "",
@@ -791,13 +791,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:encapsulation-limit:
-	 *
-	 * How many additional levels of encapsulation are permitted to be prepended
-	 * to packets. This property applies only to IPv6 tunnels.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:encapsulation-limit:
+     *
+     * How many additional levels of encapsulation are permitted to be prepended
+     * to packets. This property applies only to IPv6 tunnels.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_ENCAPSULATION_LIMIT] =
         g_param_spec_uint(NM_SETTING_IP_TUNNEL_ENCAPSULATION_LIMIT,
                           "",
@@ -808,13 +808,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:flow-label:
-	 *
-	 * The flow label to assign to tunnel packets. This property applies only to
-	 * IPv6 tunnels.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:flow-label:
+     *
+     * The flow label to assign to tunnel packets. This property applies only to
+     * IPv6 tunnels.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_FLOW_LABEL] =
         g_param_spec_uint(NM_SETTING_IP_TUNNEL_FLOW_LABEL,
                           "",
@@ -825,13 +825,13 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:mtu:
-	 *
-	 * If non-zero, only transmit packets of the specified size or smaller,
-	 * breaking larger packets up into multiple fragments.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIPTunnel:mtu:
+     *
+     * If non-zero, only transmit packets of the specified size or smaller,
+     * breaking larger packets up into multiple fragments.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_MTU] = g_param_spec_uint(NM_SETTING_IP_TUNNEL_MTU,
                                                  "",
                                                  "",
@@ -842,16 +842,16 @@ nm_setting_ip_tunnel_class_init(NMSettingIPTunnelClass *klass)
                                                      | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIPTunnel:flags:
-	 *
-	 * Tunnel flags. Currently, the following values are supported:
-	 * %NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT, %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS,
-	 * %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL, %NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV,
-	 * %NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY, %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK.
-	 * They are valid only for IPv6 tunnels.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingIPTunnel:flags:
+     *
+     * Tunnel flags. Currently, the following values are supported:
+     * %NM_IP_TUNNEL_FLAG_IP6_IGN_ENCAP_LIMIT, %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_TCLASS,
+     * %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FLOWLABEL, %NM_IP_TUNNEL_FLAG_IP6_MIP6_DEV,
+     * %NM_IP_TUNNEL_FLAG_IP6_RCV_DSCP_COPY, %NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK.
+     * They are valid only for IPv6 tunnels.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_FLAGS] = g_param_spec_uint(NM_SETTING_IP_TUNNEL_FLAGS,
                                                    "",
                                                    "",
diff --git a/libnm-core/nm-setting-ip4-config.c b/libnm-core/nm-setting-ip4-config.c
index 26eb6cc341..1187601780 100644
--- a/libnm-core/nm-setting-ip4-config.c
+++ b/libnm-core/nm-setting-ip4-config.c
@@ -625,208 +625,208 @@ nm_setting_ip4_config_class_init(NMSettingIP4ConfigClass *klass)
     setting_class->verify = verify;
 
     /* ---ifcfg-rh---
-	 * property: method
-	 * variable: BOOTPROTO
-	 * format:   string
-	 * values:   none, dhcp (bootp), static, ibft, autoip, shared
-	 * default:  none
-	 * description: Method used for IPv4 protocol configuration.
-	 * ---end---
-	 */
+     * property: method
+     * variable: BOOTPROTO
+     * format:   string
+     * values:   none, dhcp (bootp), static, ibft, autoip, shared
+     * default:  none
+     * description: Method used for IPv4 protocol configuration.
+     * ---end---
+     */
 
     /* ---keyfile---
-	 * property: dns
-	 * format: list of DNS IP addresses
-	 * description: List of DNS servers.
-	 * example: dns=1.2.3.4;8.8.8.8;8.8.4.4;
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: dns
-	 * variable: DNS1, DNS2, ...
-	 * format:   string
-	 * description: List of DNS servers. Even if NetworkManager supports many DNS
-	 *   servers, initscripts and resolver only care about the first three, usually.
-	 * example: DNS1=1.2.3.4 DNS2=10.0.0.254 DNS3=8.8.8.8
-	 * ---end---
-	 */
+     * property: dns
+     * format: list of DNS IP addresses
+     * description: List of DNS servers.
+     * example: dns=1.2.3.4;8.8.8.8;8.8.4.4;
+     * ---end---
+     * ---ifcfg-rh---
+     * property: dns
+     * variable: DNS1, DNS2, ...
+     * format:   string
+     * description: List of DNS servers. Even if NetworkManager supports many DNS
+     *   servers, initscripts and resolver only care about the first three, usually.
+     * example: DNS1=1.2.3.4 DNS2=10.0.0.254 DNS3=8.8.8.8
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dns-search
-	 * variable: DOMAIN
-	 * format:   string (space-separated domains)
-	 * description: List of DNS search domains.
-	 * ---end---
-	 */
+     * property: dns-search
+     * variable: DOMAIN
+     * format:   string (space-separated domains)
+     * description: List of DNS search domains.
+     * ---end---
+     */
 
     /* ---keyfile---
-	 * property: addresses
-	 * variable: address1, address2, ...
-	 * format: address/plen
-	 * description: List of static IP addresses.
-	 * example: address1=192.168.100.100/24 address2=10.1.1.5/24
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: addresses
-	 * variable: IPADDR, PREFIX, IPADDR1, PREFIX1, ...
-	 * description: List of static IP addresses.
-	 * example: IPADDR=10.5.5.23 PREFIX=24 IPADDR1=1.1.1.2 PREFIX1=16
-	 * ---end---
-	 */
+     * property: addresses
+     * variable: address1, address2, ...
+     * format: address/plen
+     * description: List of static IP addresses.
+     * example: address1=192.168.100.100/24 address2=10.1.1.5/24
+     * ---end---
+     * ---ifcfg-rh---
+     * property: addresses
+     * variable: IPADDR, PREFIX, IPADDR1, PREFIX1, ...
+     * description: List of static IP addresses.
+     * example: IPADDR=10.5.5.23 PREFIX=24 IPADDR1=1.1.1.2 PREFIX1=16
+     * ---end---
+     */
 
     /* ---keyfile---
-	 * property: gateway
-	 * variable: gateway
-	 * format: string
-	 * description: Gateway IP addresses as a string.
-	 * example: gateway=192.168.100.1
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: gateway
-	 * variable: GATEWAY
-	 * description: Gateway IP address.
-	 * example: GATEWAY=10.5.5.1
-	 * ---end---
-	 */
+     * property: gateway
+     * variable: gateway
+     * format: string
+     * description: Gateway IP addresses as a string.
+     * example: gateway=192.168.100.1
+     * ---end---
+     * ---ifcfg-rh---
+     * property: gateway
+     * variable: GATEWAY
+     * description: Gateway IP address.
+     * example: GATEWAY=10.5.5.1
+     * ---end---
+     */
 
     /* ---keyfile---
-	 * property: routes
-	 * variable: route1, route2, ...
-	 * format: route/plen[,gateway,metric]
-	 * description: List of IP routes.
-	 * example: route1=8.8.8.0/24,10.1.1.1,77
-	 *   route2=7.7.0.0/16
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: routes
-	 * variable: ADDRESS1, NETMASK1, GATEWAY1, METRIC1, OPTIONS1, ...
-	 * description: List of static routes. They are not stored in ifcfg-* file,
-	 *   but in route-* file instead.
-	 * ---end---
-	 */
+     * property: routes
+     * variable: route1, route2, ...
+     * format: route/plen[,gateway,metric]
+     * description: List of IP routes.
+     * example: route1=8.8.8.0/24,10.1.1.1,77
+     *   route2=7.7.0.0/16
+     * ---end---
+     * ---ifcfg-rh---
+     * property: routes
+     * variable: ADDRESS1, NETMASK1, GATEWAY1, METRIC1, OPTIONS1, ...
+     * description: List of static routes. They are not stored in ifcfg-* file,
+     *   but in route-* file instead.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: ignore-auto-routes
-	 * variable: PEERROUTES(+)
-	 * default: yes
-	 * description: PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.
-	 * ---end---
-	 */
+     * property: ignore-auto-routes
+     * variable: PEERROUTES(+)
+     * default: yes
+     * description: PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: ignore-auto-dns
-	 * variable: PEERDNS
-	 * default: yes
-	 * description: PEERDNS has the opposite meaning as 'ignore-auto-dns' property.
-	 * ---end---
-	 */
+     * property: ignore-auto-dns
+     * variable: PEERDNS
+     * default: yes
+     * description: PEERDNS has the opposite meaning as 'ignore-auto-dns' property.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dhcp-send-hostname
-	 * variable: DHCP_SEND_HOSTNAME(+)
-	 * default: yes
-	 * description: Whether DHCP_HOSTNAME should be sent to the DHCP server.
-	 * ---end---
-	 */
+     * property: dhcp-send-hostname
+     * variable: DHCP_SEND_HOSTNAME(+)
+     * default: yes
+     * description: Whether DHCP_HOSTNAME should be sent to the DHCP server.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dhcp-hostname
-	 * variable: DHCP_HOSTNAME
-	 * description: Hostname to send to the DHCP server. When both DHCP_HOSTNAME and
-	 *    DHCP_FQDN are specified only the latter is used.
-	 * ---end---
-	 */
+     * property: dhcp-hostname
+     * variable: DHCP_HOSTNAME
+     * description: Hostname to send to the DHCP server. When both DHCP_HOSTNAME and
+     *    DHCP_FQDN are specified only the latter is used.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: never-default
-	 * variable: DEFROUTE (GATEWAYDEV in /etc/sysconfig/network)
-	 * default: yes
-	 * description: DEFROUTE=no tells NetworkManager that this connection
-	 *   should not be assigned the default route. DEFROUTE has the opposite
-	 *   meaning as 'never-default' property.
-	 * ---end---
-	 */
+     * property: never-default
+     * variable: DEFROUTE (GATEWAYDEV in /etc/sysconfig/network)
+     * default: yes
+     * description: DEFROUTE=no tells NetworkManager that this connection
+     *   should not be assigned the default route. DEFROUTE has the opposite
+     *   meaning as 'never-default' property.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: may-fail
-	 * variable: IPV4_FAILURE_FATAL(+)
-	 * default: no
-	 * description: IPV4_FAILURE_FATAL has the opposite meaning as 'may-fail' property.
-	 * ---end---
-	 */
+     * property: may-fail
+     * variable: IPV4_FAILURE_FATAL(+)
+     * default: no
+     * description: IPV4_FAILURE_FATAL has the opposite meaning as 'may-fail' property.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: route-metric
-	 * variable: IPV4_ROUTE_METRIC(+)
-	 * default: -1
-	 * description: IPV4_ROUTE_METRIC is the default IPv4 metric for routes on this connection.
-	 *   If set to -1, a default metric based on the device type is used.
-	 * ---end---
-	 */
+     * property: route-metric
+     * variable: IPV4_ROUTE_METRIC(+)
+     * default: -1
+     * description: IPV4_ROUTE_METRIC is the default IPv4 metric for routes on this connection.
+     *   If set to -1, a default metric based on the device type is used.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: route-table
-	 * variable: IPV4_ROUTE_TABLE(+)
-	 * default: 0
-	 * description: IPV4_ROUTE_TABLE enables policy-routing and sets the default routing table.
-	 * ---end---
-	 */
+     * property: route-table
+     * variable: IPV4_ROUTE_TABLE(+)
+     * default: 0
+     * description: IPV4_ROUTE_TABLE enables policy-routing and sets the default routing table.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dns-options
-	 * variable: RES_OPTIONS(+)
-	 * description: List of DNS options to be added to /etc/resolv.conf
-	 * example: RES_OPTIONS=ndots:2 timeout:3
-	 * ---end---
-	 */
+     * property: dns-options
+     * variable: RES_OPTIONS(+)
+     * description: List of DNS options to be added to /etc/resolv.conf
+     * example: RES_OPTIONS=ndots:2 timeout:3
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dns-priority
-	 * variable: IPV4_DNS_PRIORITY(+)
-	 * description: The priority for DNS servers of this connection. Lower values have higher priority.
-	 *    If zero, the default value will be used (50 for VPNs, 100 for other connections).
-	 *    A negative value prevents DNS from other connections with greater values to be used.
-	 * default: 0
-	 * example: IPV4_DNS_PRIORITY=20
-	 * ---end---
-	 */
+     * property: dns-priority
+     * variable: IPV4_DNS_PRIORITY(+)
+     * description: The priority for DNS servers of this connection. Lower values have higher priority.
+     *    If zero, the default value will be used (50 for VPNs, 100 for other connections).
+     *    A negative value prevents DNS from other connections with greater values to be used.
+     * default: 0
+     * example: IPV4_DNS_PRIORITY=20
+     * ---end---
+     */
 
     /**
-	 * NMSettingIP4Config:dhcp-client-id:
-	 *
-	 * A string sent to the DHCP server to identify the local machine which the
-	 * DHCP server may use to customize the DHCP lease and options.
-	 * When the property is a hex string ('aa:bb:cc') it is interpreted as a
-	 * binary client ID, in which case the first byte is assumed to be the
-	 * 'type' field as per RFC 2132 section 9.14 and the remaining bytes may be
-	 * an hardware address (e.g. '01:xx:xx:xx:xx:xx:xx' where 1 is the Ethernet
-	 * ARP type and the rest is a MAC address).
-	 * If the property is not a hex string it is considered as a
-	 * non-hardware-address client ID and the 'type' field is set to 0.
-	 *
-	 * The special values "mac" and "perm-mac" are supported, which use the
-	 * current or permanent MAC address of the device to generate a client identifier
-	 * with type ethernet (01). Currently, these options only work for ethernet
-	 * type of links.
-	 *
-	 * The special value "duid" generates a RFC4361-compliant client identifier based
-	 * on a hash of the interface name as IAID and /etc/machine-id.
-	 *
-	 * The special value "stable" is supported to generate a type 0 client identifier based
-	 * on the stable-id (see connection.stable-id) and a per-host key. If you set the
-	 * stable-id, you may want to include the "${DEVICE}" or "${MAC}" specifier to get a
-	 * per-device key.
-	 *
-	 * If unset, a globally configured default is used. If still unset, the default
-	 * depends on the DHCP plugin.
-	 **/
+     * NMSettingIP4Config:dhcp-client-id:
+     *
+     * A string sent to the DHCP server to identify the local machine which the
+     * DHCP server may use to customize the DHCP lease and options.
+     * When the property is a hex string ('aa:bb:cc') it is interpreted as a
+     * binary client ID, in which case the first byte is assumed to be the
+     * 'type' field as per RFC 2132 section 9.14 and the remaining bytes may be
+     * an hardware address (e.g. '01:xx:xx:xx:xx:xx:xx' where 1 is the Ethernet
+     * ARP type and the rest is a MAC address).
+     * If the property is not a hex string it is considered as a
+     * non-hardware-address client ID and the 'type' field is set to 0.
+     *
+     * The special values "mac" and "perm-mac" are supported, which use the
+     * current or permanent MAC address of the device to generate a client identifier
+     * with type ethernet (01). Currently, these options only work for ethernet
+     * type of links.
+     *
+     * The special value "duid" generates a RFC4361-compliant client identifier based
+     * on a hash of the interface name as IAID and /etc/machine-id.
+     *
+     * The special value "stable" is supported to generate a type 0 client identifier based
+     * on the stable-id (see connection.stable-id) and a per-host key. If you set the
+     * stable-id, you may want to include the "${DEVICE}" or "${MAC}" specifier to get a
+     * per-device key.
+     *
+     * If unset, a globally configured default is used. If still unset, the default
+     * depends on the DHCP plugin.
+     **/
     /* ---ifcfg-rh---
-	 * property: dhcp-client-id
-	 * variable: DHCP_CLIENT_ID(+)
-	 * description: A string sent to the DHCP server to identify the local machine.
-	 *    A binary value can be specified using hex notation ('aa:bb:cc').
-	 * example: DHCP_CLIENT_ID=ax-srv-1; DHCP_CLIENT_ID=01:44:44:44:44:44:44
-	 * ---end---
-	 */
+     * property: dhcp-client-id
+     * variable: DHCP_CLIENT_ID(+)
+     * description: A string sent to the DHCP server to identify the local machine.
+     *    A binary value can be specified using hex notation ('aa:bb:cc').
+     * example: DHCP_CLIENT_ID=ax-srv-1; DHCP_CLIENT_ID=01:44:44:44:44:44:44
+     * ---end---
+     */
     obj_properties[PROP_DHCP_CLIENT_ID] =
         g_param_spec_string(NM_SETTING_IP4_CONFIG_DHCP_CLIENT_ID,
                             "",
@@ -835,49 +835,49 @@ nm_setting_ip4_config_class_init(NMSettingIP4ConfigClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /* ---ifcfg-rh---
-	 * property: dad-timeout
-	 * variable: ACD_TIMEOUT(+), ARPING_WAIT
-	 * default: missing variable means global default (config override or zero)
-	 * description: Timeout (in milliseconds for ACD_TIMEOUT or in seconds
-	 *   for ARPING_WAIT) for address conflict detection before configuring
-	 *   IPv4 addresses. 0 turns off the ACD completely, -1 means default value.
-	 * example: ACD_TIMEOUT=2000 or ARPING_WAIT=2
-	 * ---end---
-	 */
+     * property: dad-timeout
+     * variable: ACD_TIMEOUT(+), ARPING_WAIT
+     * default: missing variable means global default (config override or zero)
+     * description: Timeout (in milliseconds for ACD_TIMEOUT or in seconds
+     *   for ARPING_WAIT) for address conflict detection before configuring
+     *   IPv4 addresses. 0 turns off the ACD completely, -1 means default value.
+     * example: ACD_TIMEOUT=2000 or ARPING_WAIT=2
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dhcp-timeout
-	 * variable: IPV4_DHCP_TIMEOUT(+)
-	 * description: A timeout after which the DHCP transaction fails in case of no response.
-	 * example: IPV4_DHCP_TIMEOUT=10
-	 * ---end---
-	 */
+     * property: dhcp-timeout
+     * variable: IPV4_DHCP_TIMEOUT(+)
+     * description: A timeout after which the DHCP transaction fails in case of no response.
+     * example: IPV4_DHCP_TIMEOUT=10
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dhcp-hostname-flags
-	 * variable: DHCP_HOSTNAME_FLAGS
-	 * description: flags for the DHCP hostname and FQDN properties
-	 * example: DHCP_HOSTNAME_FLAGS=5
-	 */
+     * property: dhcp-hostname-flags
+     * variable: DHCP_HOSTNAME_FLAGS
+     * description: flags for the DHCP hostname and FQDN properties
+     * example: DHCP_HOSTNAME_FLAGS=5
+     */
 
     /**
-	 * NMSettingIP4Config:dhcp-fqdn:
-	 *
-	 * If the #NMSettingIPConfig:dhcp-send-hostname property is %TRUE, then the
-	 * specified FQDN will be sent to the DHCP server when acquiring a lease. This
-	 * property and #NMSettingIPConfig:dhcp-hostname are mutually exclusive and
-	 * cannot be set at the same time.
-	 *
-	 * Since: 1.2
-	 */
+     * NMSettingIP4Config:dhcp-fqdn:
+     *
+     * If the #NMSettingIPConfig:dhcp-send-hostname property is %TRUE, then the
+     * specified FQDN will be sent to the DHCP server when acquiring a lease. This
+     * property and #NMSettingIPConfig:dhcp-hostname are mutually exclusive and
+     * cannot be set at the same time.
+     *
+     * Since: 1.2
+     */
     /* ---ifcfg-rh---
-	 * property: dhcp-fqdn
-	 * variable: DHCP_FQDN
-	 * description: FQDN to send to the DHCP server. When both DHCP_HOSTNAME and
-	 *    DHCP_FQDN are specified only the latter is used.
-	 * example: DHCP_FQDN=foo.bar.com
-	 * ---end---
-	 */
+     * property: dhcp-fqdn
+     * variable: DHCP_FQDN
+     * description: FQDN to send to the DHCP server. When both DHCP_HOSTNAME and
+     *    DHCP_FQDN are specified only the latter is used.
+     * example: DHCP_FQDN=foo.bar.com
+     * ---end---
+     */
     obj_properties[PROP_DHCP_FQDN] =
         g_param_spec_string(NM_SETTING_IP4_CONFIG_DHCP_FQDN,
                             "",
@@ -886,24 +886,24 @@ nm_setting_ip4_config_class_init(NMSettingIP4ConfigClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIP4Config:dhcp-vendor-class-identifier:
-	 *
-	 * The Vendor Class Identifier DHCP option (60).
-	 * Special characters in the data string may be escaped using C-style escapes,
-	 * nevertheless this property cannot contain nul bytes.
-	 * If the per-profile value is unspecified (the default),
-	 * a global connection default gets consulted.
-	 * If still unspecified, the DHCP option is not sent to the server.
-	 *
-	 * Since 1.28
-	 */
+     * NMSettingIP4Config:dhcp-vendor-class-identifier:
+     *
+     * The Vendor Class Identifier DHCP option (60).
+     * Special characters in the data string may be escaped using C-style escapes,
+     * nevertheless this property cannot contain nul bytes.
+     * If the per-profile value is unspecified (the default),
+     * a global connection default gets consulted.
+     * If still unspecified, the DHCP option is not sent to the server.
+     *
+     * Since 1.28
+     */
     /* ---ifcfg-rh---
-	 * property: dhcp-vendor-class-identifier
-	 * variable: DHCP_VENDOR_CLASS_IDENTIFIER(+)
-	 * description: The Vendor Class Identifier DHCP option (60).
-	 * example: DHCP_VENDOR_CLASS_IDENTIFIER=foo
-	 * ---end---
-	 */
+     * property: dhcp-vendor-class-identifier
+     * variable: DHCP_VENDOR_CLASS_IDENTIFIER(+)
+     * description: The Vendor Class Identifier DHCP option (60).
+     * example: DHCP_VENDOR_CLASS_IDENTIFIER=foo
+     * ---end---
+     */
     obj_properties[PROP_DHCP_VENDOR_CLASS_IDENTIFIER] =
         g_param_spec_string(NM_SETTING_IP4_CONFIG_DHCP_VENDOR_CLASS_IDENTIFIER,
                             "",
@@ -914,12 +914,12 @@ nm_setting_ip4_config_class_init(NMSettingIP4ConfigClass *klass)
     /* IP4-specific property overrides */
 
     /* ---dbus---
-	 * property: dns
-	 * format: array of uint32
-	 * description: Array of IP addresses of DNS servers (as network-byte-order
-	 *   integers)
-	 * ---end---
-	 */
+     * property: dns
+     * format: array of uint32
+     * description: Array of IP addresses of DNS servers (as network-byte-order
+     *   integers)
+     * ---end---
+     */
     _nm_properties_override_gobj(
         properties_override,
         g_object_class_find_property(G_OBJECT_CLASS(setting_class), NM_SETTING_IP_CONFIG_DNS),
@@ -928,20 +928,20 @@ nm_setting_ip4_config_class_init(NMSettingIP4ConfigClass *klass)
                                   .gprop_from_dbus_fcn = ip4_dns_from_dbus, ));
 
     /* ---dbus---
-	 * property: addresses
-	 * format: array of array of uint32
-	 * description: Deprecated in favor of the 'address-data' and 'gateway'
-	 *   properties, but this can be used for backward-compatibility with older
-	 *   daemons. Note that if you send this property the daemon will ignore
-	 *   'address-data' and 'gateway'.
-	 *
-	 *   Array of IPv4 address structures.  Each IPv4 address structure is
-	 *   composed of 3 32-bit values; the first being the IPv4 address (network
-	 *   byte order), the second the prefix (1 - 32), and last the IPv4 gateway
-	 *   (network byte order). The gateway may be left as 0 if no gateway exists
-	 *   for that subnet.
-	 * ---end---
-	 */
+     * property: addresses
+     * format: array of array of uint32
+     * description: Deprecated in favor of the 'address-data' and 'gateway'
+     *   properties, but this can be used for backward-compatibility with older
+     *   daemons. Note that if you send this property the daemon will ignore
+     *   'address-data' and 'gateway'.
+     *
+     *   Array of IPv4 address structures.  Each IPv4 address structure is
+     *   composed of 3 32-bit values; the first being the IPv4 address (network
+     *   byte order), the second the prefix (1 - 32), and last the IPv4 gateway
+     *   (network byte order). The gateway may be left as 0 if no gateway exists
+     *   for that subnet.
+     * ---end---
+     */
     _nm_properties_override_gobj(
         properties_override,
         g_object_class_find_property(G_OBJECT_CLASS(setting_class), NM_SETTING_IP_CONFIG_ADDRESSES),
@@ -955,14 +955,14 @@ nm_setting_ip4_config_class_init(NMSettingIP4ConfigClass *klass)
                                   .to_dbus_fcn = ip4_address_labels_get, ));
 
     /* ---dbus---
-	 * property: address-data
-	 * format: array of vardict
-	 * description: Array of IPv4 addresses. Each address dictionary contains at
-	 *   least 'address' and 'prefix' entries, containing the IP address as a
-	 *   string, and the prefix length as a uint32. Additional attributes may
-	 *   also exist on some addresses.
-	 * ---end---
-	 */
+     * property: address-data
+     * format: array of vardict
+     * description: Array of IPv4 addresses. Each address dictionary contains at
+     *   least 'address' and 'prefix' entries, containing the IP address as a
+     *   string, and the prefix length as a uint32. Additional attributes may
+     *   also exist on some addresses.
+     * ---end---
+     */
     _nm_properties_override_dbus(
         properties_override,
         "address-data",
@@ -971,22 +971,22 @@ nm_setting_ip4_config_class_init(NMSettingIP4ConfigClass *klass)
                                   .from_dbus_fcn = ip4_address_data_set, ));
 
     /* ---dbus---
-	 * property: routes
-	 * format: array of array of uint32
-	 * description: Deprecated in favor of the 'route-data' property, but this
-	 *   can be used for backward-compatibility with older daemons. Note that if
-	 *   you send this property the daemon will ignore 'route-data'.
-	 *
-	 *   Array of IPv4 route structures.  Each IPv4 route structure is composed
-	 *   of 4 32-bit values; the first being the destination IPv4 network or
-	 *   address (network byte order), the second the destination network or
-	 *   address prefix (1 - 32), the third being the next-hop (network byte
-	 *   order) if any, and the fourth being the route metric. If the metric is
-	 *   0, NM will choose an appropriate default metric for the device. (There
-	 *   is no way to explicitly specify an actual metric of 0 with this
-	 *   property.)
-	 * ---end---
-	 */
+     * property: routes
+     * format: array of array of uint32
+     * description: Deprecated in favor of the 'route-data' property, but this
+     *   can be used for backward-compatibility with older daemons. Note that if
+     *   you send this property the daemon will ignore 'route-data'.
+     *
+     *   Array of IPv4 route structures.  Each IPv4 route structure is composed
+     *   of 4 32-bit values; the first being the destination IPv4 network or
+     *   address (network byte order), the second the destination network or
+     *   address prefix (1 - 32), the third being the next-hop (network byte
+     *   order) if any, and the fourth being the route metric. If the metric is
+     *   0, NM will choose an appropriate default metric for the device. (There
+     *   is no way to explicitly specify an actual metric of 0 with this
+     *   property.)
+     * ---end---
+     */
     _nm_properties_override_gobj(
         properties_override,
         g_object_class_find_property(G_OBJECT_CLASS(setting_class), NM_SETTING_IP_CONFIG_ROUTES),
@@ -995,18 +995,18 @@ nm_setting_ip4_config_class_init(NMSettingIP4ConfigClass *klass)
                                   .from_dbus_fcn = ip4_routes_set, ));
 
     /* ---dbus---
-	 * property: route-data
-	 * format: array of vardict
-	 * description: Array of IPv4 routes. Each route dictionary contains at
-	 *   least 'dest' and 'prefix' entries, containing the destination IP
-	 *   address as a string, and the prefix length as a uint32. Most routes
-	 *   will also have a 'next-hop' entry, containing the next hop IP address as
-	 *   a string. If the route has a 'metric' entry (containing a uint32), that
-	 *   will be used as the metric for the route (otherwise NM will pick a
-	 *   default value appropriate to the device). Additional attributes may
-	 *   also exist on some routes.
-	 * ---end---
-	 */
+     * property: route-data
+     * format: array of vardict
+     * description: Array of IPv4 routes. Each route dictionary contains at
+     *   least 'dest' and 'prefix' entries, containing the destination IP
+     *   address as a string, and the prefix length as a uint32. Most routes
+     *   will also have a 'next-hop' entry, containing the next hop IP address as
+     *   a string. If the route has a 'metric' entry (containing a uint32), that
+     *   will be used as the metric for the route (otherwise NM will pick a
+     *   default value appropriate to the device). Additional attributes may
+     *   also exist on some routes.
+     * ---end---
+     */
     _nm_properties_override_dbus(properties_override,
                                  "route-data",
                                  NM_SETT_INFO_PROPERT_TYPE(.dbus_type = NM_G_VARIANT_TYPE("aa{sv}"),
diff --git a/libnm-core/nm-setting-ip6-config.c b/libnm-core/nm-setting-ip6-config.c
index 1d6f9ed688..337486ac67 100644
--- a/libnm-core/nm-setting-ip6-config.c
+++ b/libnm-core/nm-setting-ip6-config.c
@@ -623,207 +623,207 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
     setting_class->verify = verify;
 
     /* ---ifcfg-rh---
-	 * property: method
-	 * variable: IPV6INIT, IPV6FORWARDING, IPV6_AUTOCONF, DHCPV6C, IPV6_DISABLED
-	 * default:  IPV6INIT=yes; IPV6FORWARDING=no; IPV6_AUTOCONF=!IPV6FORWARDING, DHCPV6=no
-	 * description: Method used for IPv6 protocol configuration.
-	 *   ignore ~ IPV6INIT=no; auto ~ IPV6_AUTOCONF=yes; dhcp ~ IPV6_AUTOCONF=no and DHCPV6C=yes;
-	 *   disabled ~ IPV6_DISABLED=yes
-	 * ---end---
-	 */
+     * property: method
+     * variable: IPV6INIT, IPV6FORWARDING, IPV6_AUTOCONF, DHCPV6C, IPV6_DISABLED
+     * default:  IPV6INIT=yes; IPV6FORWARDING=no; IPV6_AUTOCONF=!IPV6FORWARDING, DHCPV6=no
+     * description: Method used for IPv6 protocol configuration.
+     *   ignore ~ IPV6INIT=no; auto ~ IPV6_AUTOCONF=yes; dhcp ~ IPV6_AUTOCONF=no and DHCPV6C=yes;
+     *   disabled ~ IPV6_DISABLED=yes
+     * ---end---
+     */
 
     /* ---keyfile---
-	 * property: dns
-	 * format: list of DNS IP addresses
-	 * description: List of DNS servers.
-	 * example: dns=2001:4860:4860::8888;2001:4860:4860::8844;
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: dns
-	 * variable: DNS1, DNS2, ...
-	 * format:   string
-	 * description: List of DNS servers. NetworkManager uses the variables both
-	 *   for IPv4 and IPv6.
-	 * ---end---
-	 */
+     * property: dns
+     * format: list of DNS IP addresses
+     * description: List of DNS servers.
+     * example: dns=2001:4860:4860::8888;2001:4860:4860::8844;
+     * ---end---
+     * ---ifcfg-rh---
+     * property: dns
+     * variable: DNS1, DNS2, ...
+     * format:   string
+     * description: List of DNS servers. NetworkManager uses the variables both
+     *   for IPv4 and IPv6.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dns-search
-	 * variable: IPV6_DOMAIN(+)
-	 * format:   string (space-separated domains)
-	 * description: List of DNS search domains.
-	 * ---end---
-	 */
+     * property: dns-search
+     * variable: IPV6_DOMAIN(+)
+     * format:   string (space-separated domains)
+     * description: List of DNS search domains.
+     * ---end---
+     */
 
     /* ---keyfile---
-	 * property: addresses
-	 * variable: address1, address2, ...
-	 * format: address/plen
-	 * description: List of static IP addresses.
-	 * example: address1=abbe::cafe/96 address2=2001::1234
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: addresses
-	 * variable: IPV6ADDR, IPV6ADDR_SECONDARIES
-	 * description: List of static IP addresses.
-	 * example: IPV6ADDR=ab12:9876::1
-	 *   IPV6ADDR_SECONDARIES="ab12:9876::2 ab12:9876::3"
-	 * ---end---
-	 */
+     * property: addresses
+     * variable: address1, address2, ...
+     * format: address/plen
+     * description: List of static IP addresses.
+     * example: address1=abbe::cafe/96 address2=2001::1234
+     * ---end---
+     * ---ifcfg-rh---
+     * property: addresses
+     * variable: IPV6ADDR, IPV6ADDR_SECONDARIES
+     * description: List of static IP addresses.
+     * example: IPV6ADDR=ab12:9876::1
+     *   IPV6ADDR_SECONDARIES="ab12:9876::2 ab12:9876::3"
+     * ---end---
+     */
 
     /* ---keyfile---
-	 * property: gateway
-	 * variable: gateway
-	 * format: string
-	 * description: Gateway IP addresses as a string.
-	 * example: gateway=abbe::1
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: gateway
-	 * variable: IPV6_DEFAULTGW
-	 * description: Gateway IP address.
-	 * example: IPV6_DEFAULTGW=abbe::1
-	 * ---end---
-	 */
+     * property: gateway
+     * variable: gateway
+     * format: string
+     * description: Gateway IP addresses as a string.
+     * example: gateway=abbe::1
+     * ---end---
+     * ---ifcfg-rh---
+     * property: gateway
+     * variable: IPV6_DEFAULTGW
+     * description: Gateway IP address.
+     * example: IPV6_DEFAULTGW=abbe::1
+     * ---end---
+     */
 
     /* ---keyfile---
-	 * property: routes
-	 * variable: route1, route2, ...
-	 * format: route/plen[,gateway,metric]
-	 * description: List of IP routes.
-	 * example: route1=2001:4860:4860::/64,2620:52:0:2219:222:68ff:fe11:5403
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: routes
-	 * variable: (none)
-	 * description: List of static routes. They are not stored in ifcfg-* file,
-	 *   but in route6-* file instead in the form of command line for 'ip route add'.
-	 * ---end---
-	 */
+     * property: routes
+     * variable: route1, route2, ...
+     * format: route/plen[,gateway,metric]
+     * description: List of IP routes.
+     * example: route1=2001:4860:4860::/64,2620:52:0:2219:222:68ff:fe11:5403
+     * ---end---
+     * ---ifcfg-rh---
+     * property: routes
+     * variable: (none)
+     * description: List of static routes. They are not stored in ifcfg-* file,
+     *   but in route6-* file instead in the form of command line for 'ip route add'.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: ignore-auto-routes
-	 * variable: IPV6_PEERROUTES(+)
-	 * default: yes
-	 * description: IPV6_PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.
-	 * ---end---
-	 */
+     * property: ignore-auto-routes
+     * variable: IPV6_PEERROUTES(+)
+     * default: yes
+     * description: IPV6_PEERROUTES has the opposite meaning as 'ignore-auto-routes' property.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: ignore-auto-dns
-	 * variable: IPV6_PEERDNS(+)
-	 * default: yes
-	 * description: IPV6_PEERDNS has the opposite meaning as 'ignore-auto-dns' property.
-	 * ---end---
-	 */
+     * property: ignore-auto-dns
+     * variable: IPV6_PEERDNS(+)
+     * default: yes
+     * description: IPV6_PEERDNS has the opposite meaning as 'ignore-auto-dns' property.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dhcp-hostname
-	 * variable: DHCPV6_HOSTNAME
-	 * description: Hostname to send the DHCP server.
-	 * ---end---
-	 */
+     * property: dhcp-hostname
+     * variable: DHCPV6_HOSTNAME
+     * description: Hostname to send the DHCP server.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dhcp-timeout
-	 * variable: IPV6_DHCP_TIMEOUT(+)
-	 * description: A timeout after which the DHCP transaction fails in case of no response.
-	 * example: IPV6_DHCP_TIMEOUT=10
-	 * ---end---
-	 */
+     * property: dhcp-timeout
+     * variable: IPV6_DHCP_TIMEOUT(+)
+     * description: A timeout after which the DHCP transaction fails in case of no response.
+     * example: IPV6_DHCP_TIMEOUT=10
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dhcp-hostname-flags
-	 * variable: DHCPV6_HOSTNAME_FLAGS
-	 * description: flags for the DHCP hostname property
-	 * example: DHCPV6_HOSTNAME_FLAGS=5
-	 */
+     * property: dhcp-hostname-flags
+     * variable: DHCPV6_HOSTNAME_FLAGS
+     * description: flags for the DHCP hostname property
+     * example: DHCPV6_HOSTNAME_FLAGS=5
+     */
 
     /* ---ifcfg-rh---
-	 * property: never-default
-	 * variable: IPV6_DEFROUTE(+), (and IPV6_DEFAULTGW, IPV6_DEFAULTDEV in /etc/sysconfig/network)
-	 * default: IPV6_DEFROUTE=yes (when no variable specified)
-	 * description: IPV6_DEFROUTE=no tells NetworkManager that this connection
-	 *   should not be assigned the default IPv6 route. IPV6_DEFROUTE has the opposite
-	 *   meaning as 'never-default' property.
-	 * ---end---
-	 */
+     * property: never-default
+     * variable: IPV6_DEFROUTE(+), (and IPV6_DEFAULTGW, IPV6_DEFAULTDEV in /etc/sysconfig/network)
+     * default: IPV6_DEFROUTE=yes (when no variable specified)
+     * description: IPV6_DEFROUTE=no tells NetworkManager that this connection
+     *   should not be assigned the default IPv6 route. IPV6_DEFROUTE has the opposite
+     *   meaning as 'never-default' property.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: may-fail
-	 * variable: IPV6_FAILURE_FATAL(+)
-	 * default: no
-	 * description: IPV6_FAILURE_FATAL has the opposite meaning as 'may-fail' property.
-	 * ---end---
-	 */
+     * property: may-fail
+     * variable: IPV6_FAILURE_FATAL(+)
+     * default: no
+     * description: IPV6_FAILURE_FATAL has the opposite meaning as 'may-fail' property.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: route-metric
-	 * variable: IPV6_ROUTE_METRIC(+)
-	 * default: -1
-	 * description: IPV6_ROUTE_METRIC is the default IPv6 metric for routes on this connection.
-	 *   If set to -1, a default metric based on the device type is used.
-	 * ---end---
-	 */
+     * property: route-metric
+     * variable: IPV6_ROUTE_METRIC(+)
+     * default: -1
+     * description: IPV6_ROUTE_METRIC is the default IPv6 metric for routes on this connection.
+     *   If set to -1, a default metric based on the device type is used.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: route-table
-	 * variable: IPV6_ROUTE_TABLE(+)
-	 * default: 0
-	 * description: IPV6_ROUTE_TABLE enables policy-routing and sets the default routing table.
-	 * ---end---
-	 */
+     * property: route-table
+     * variable: IPV6_ROUTE_TABLE(+)
+     * default: 0
+     * description: IPV6_ROUTE_TABLE enables policy-routing and sets the default routing table.
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dns-priority
-	 * variable: IPV6_DNS_PRIORITY(+)
-	 * description: The priority for DNS servers of this connection. Lower values have higher priority.
-	 *    If zero, the default value will be used (50 for VPNs, 100 for other connections).
-	 *    A negative value prevents DNS from other connections with greater values to be used.
-	 * default: 0
-	 * example: IPV6_DNS_PRIORITY=20
-	 * ---end---
-	 */
+     * property: dns-priority
+     * variable: IPV6_DNS_PRIORITY(+)
+     * description: The priority for DNS servers of this connection. Lower values have higher priority.
+     *    If zero, the default value will be used (50 for VPNs, 100 for other connections).
+     *    A negative value prevents DNS from other connections with greater values to be used.
+     * default: 0
+     * example: IPV6_DNS_PRIORITY=20
+     * ---end---
+     */
 
     /* ---ifcfg-rh---
-	 * property: dns-options
-	 * variable: IPV6_RES_OPTIONS(+)
-	 * description: List of DNS options to be added to /etc/resolv.conf
-	 * example: IPV6_RES_OPTIONS=ndots:2 timeout:3
-	 * ---end---
-	 */
+     * property: dns-options
+     * variable: IPV6_RES_OPTIONS(+)
+     * description: List of DNS options to be added to /etc/resolv.conf
+     * example: IPV6_RES_OPTIONS=ndots:2 timeout:3
+     * ---end---
+     */
 
     /**
-	 * NMSettingIP6Config:ip6-privacy:
-	 *
-	 * Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If
-	 * enabled, it makes the kernel generate a temporary IPv6 address in
-	 * addition to the public one generated from MAC address via modified
-	 * EUI-64.  This enhances privacy, but could cause problems in some
-	 * applications, on the other hand.  The permitted values are: -1: unknown,
-	 * 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary
-	 * addresses).
-	 *
-	 * Having a per-connection setting set to "-1" (unknown) means fallback to
-	 * global configuration "ipv6.ip6-privacy".
-	 *
-	 * If also global configuration is unspecified or set to "-1", fallback to read
-	 * "/proc/sys/net/ipv6/conf/default/use_tempaddr".
-	 *
-	 * Note that this setting is distinct from the Stable Privacy addresses
-	 * that can be enabled with the "addr-gen-mode" property's "stable-privacy"
-	 * setting as another way of avoiding host tracking with IPv6 addresses.
-	 **/
+     * NMSettingIP6Config:ip6-privacy:
+     *
+     * Configure IPv6 Privacy Extensions for SLAAC, described in RFC4941.  If
+     * enabled, it makes the kernel generate a temporary IPv6 address in
+     * addition to the public one generated from MAC address via modified
+     * EUI-64.  This enhances privacy, but could cause problems in some
+     * applications, on the other hand.  The permitted values are: -1: unknown,
+     * 0: disabled, 1: enabled (prefer public address), 2: enabled (prefer temporary
+     * addresses).
+     *
+     * Having a per-connection setting set to "-1" (unknown) means fallback to
+     * global configuration "ipv6.ip6-privacy".
+     *
+     * If also global configuration is unspecified or set to "-1", fallback to read
+     * "/proc/sys/net/ipv6/conf/default/use_tempaddr".
+     *
+     * Note that this setting is distinct from the Stable Privacy addresses
+     * that can be enabled with the "addr-gen-mode" property's "stable-privacy"
+     * setting as another way of avoiding host tracking with IPv6 addresses.
+     **/
     /* ---ifcfg-rh---
-	 * property: ip6-privacy
-	 * variable: IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP(+)
-	 * values: IPV6_PRIVACY: no, yes (rfc3041 or rfc4941);
-	 *   IPV6_PRIVACY_PREFER_PUBLIC_IP: yes, no
-	 * default: no
-	 * description: Configure IPv6 Privacy Extensions for SLAAC (RFC4941).
-	 * example: IPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes
-	 * ---end---
-	 */
+     * property: ip6-privacy
+     * variable: IPV6_PRIVACY, IPV6_PRIVACY_PREFER_PUBLIC_IP(+)
+     * values: IPV6_PRIVACY: no, yes (rfc3041 or rfc4941);
+     *   IPV6_PRIVACY_PREFER_PUBLIC_IP: yes, no
+     * default: no
+     * description: Configure IPv6 Privacy Extensions for SLAAC (RFC4941).
+     * example: IPV6_PRIVACY=rfc3041 IPV6_PRIVACY_PREFER_PUBLIC_IP=yes
+     * ---end---
+     */
     obj_properties[PROP_IP6_PRIVACY] =
         g_param_spec_enum(NM_SETTING_IP6_CONFIG_IP6_PRIVACY,
                           "",
@@ -833,46 +833,46 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIP6Config:addr-gen-mode:
-	 *
-	 * Configure method for creating the address for use with RFC4862 IPv6
-	 * Stateless Address Autoconfiguration. The permitted values are:
-	 * %NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE_EUI64 or
-	 * %NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE_STABLE_PRIVACY.
-	 *
-	 * If the property is set to EUI64, the addresses will be generated
-	 * using the interface tokens derived from hardware address. This makes
-	 * the host part of the address to stay constant, making it possible
-	 * to track host's presence when it changes networks. The address changes
-	 * when the interface hardware is replaced.
-	 *
-	 * The value of stable-privacy enables use of cryptographically
-	 * secure hash of a secret host-specific key along with the connection's
-	 * stable-id and the network address as specified by RFC7217.
-	 * This makes it impossible to use the address track host's presence,
-	 * and makes the address stable when the network interface hardware is
-	 * replaced.
-	 *
-	 * On D-Bus, the absence of an addr-gen-mode setting equals enabling
-	 * stable-privacy. For keyfile plugin, the absence of the setting
-	 * on disk means EUI64 so that the property doesn't change on upgrade
-	 * from older versions.
-	 *
-	 * Note that this setting is distinct from the Privacy Extensions as
-	 * configured by "ip6-privacy" property and it does not affect the
-	 * temporary addresses configured with this option.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingIP6Config:addr-gen-mode:
+     *
+     * Configure method for creating the address for use with RFC4862 IPv6
+     * Stateless Address Autoconfiguration. The permitted values are:
+     * %NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE_EUI64 or
+     * %NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE_STABLE_PRIVACY.
+     *
+     * If the property is set to EUI64, the addresses will be generated
+     * using the interface tokens derived from hardware address. This makes
+     * the host part of the address to stay constant, making it possible
+     * to track host's presence when it changes networks. The address changes
+     * when the interface hardware is replaced.
+     *
+     * The value of stable-privacy enables use of cryptographically
+     * secure hash of a secret host-specific key along with the connection's
+     * stable-id and the network address as specified by RFC7217.
+     * This makes it impossible to use the address track host's presence,
+     * and makes the address stable when the network interface hardware is
+     * replaced.
+     *
+     * On D-Bus, the absence of an addr-gen-mode setting equals enabling
+     * stable-privacy. For keyfile plugin, the absence of the setting
+     * on disk means EUI64 so that the property doesn't change on upgrade
+     * from older versions.
+     *
+     * Note that this setting is distinct from the Privacy Extensions as
+     * configured by "ip6-privacy" property and it does not affect the
+     * temporary addresses configured with this option.
+     *
+     * Since: 1.2
+     **/
     /* ---ifcfg-rh---
-	 * property: addr-gen-mode
-	 * variable: IPV6_ADDR_GEN_MODE
-	 * values: IPV6_ADDR_GEN_MODE: eui64, stable-privacy
-	 * default: eui64
-	 * description: Configure IPv6 Stable Privacy addressing for SLAAC (RFC7217).
-	 * example: IPV6_ADDR_GEN_MODE=stable-privacy
-	 * ---end---
-	 */
+     * property: addr-gen-mode
+     * variable: IPV6_ADDR_GEN_MODE
+     * values: IPV6_ADDR_GEN_MODE: eui64, stable-privacy
+     * default: eui64
+     * description: Configure IPv6 Stable Privacy addressing for SLAAC (RFC7217).
+     * example: IPV6_ADDR_GEN_MODE=stable-privacy
+     * ---end---
+     */
     obj_properties[PROP_ADDR_GEN_MODE] =
         g_param_spec_int(NM_SETTING_IP6_CONFIG_ADDR_GEN_MODE,
                          "",
@@ -883,20 +883,20 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIP6Config:token:
-	 *
-	 * Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02
-	 * IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.
-	 *
-	 * Since: 1.4
-	 **/
+     * NMSettingIP6Config:token:
+     *
+     * Configure the token for draft-chown-6man-tokenised-ipv6-identifiers-02
+     * IPv6 tokenized interface identifiers. Useful with eui64 addr-gen-mode.
+     *
+     * Since: 1.4
+     **/
     /* ---ifcfg-rh---
-	 * property: token
-	 * variable: IPV6_TOKEN
-	 * description: The IPv6 tokenized interface identifier token
-	 * example: IPV6_TOKEN=::53
-	 * ---end---
-	 */
+     * property: token
+     * variable: IPV6_TOKEN
+     * description: The IPv6 tokenized interface identifier token
+     * example: IPV6_TOKEN=::53
+     * ---end---
+     */
     obj_properties[PROP_TOKEN] = g_param_spec_string(NM_SETTING_IP6_CONFIG_TOKEN,
                                                      "",
                                                      "",
@@ -905,23 +905,23 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                                                          | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIP6Config:ra-timeout:
-	 *
-	 * A timeout for waiting Router Advertisements in seconds. If zero (the default), a
-	 * globally configured default is used. If still unspecified, the timeout depends on the
-	 * sysctl settings of the device.
-	 *
-	 * Set to 2147483647 (MAXINT32) for infinity.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMSettingIP6Config:ra-timeout:
+     *
+     * A timeout for waiting Router Advertisements in seconds. If zero (the default), a
+     * globally configured default is used. If still unspecified, the timeout depends on the
+     * sysctl settings of the device.
+     *
+     * Set to 2147483647 (MAXINT32) for infinity.
+     *
+     * Since: 1.24
+     **/
     /* ---ifcfg-rh---
-	 * property: dhcp-timeout
-	 * variable: IPV6_RA_TIMEOUT(+)
-	 * description: A timeout for waiting Router Advertisements in seconds.
-	 * example: IPV6_RA_TIMEOUT=10
-	 * ---end---
-	 */
+     * property: dhcp-timeout
+     * variable: IPV6_RA_TIMEOUT(+)
+     * description: A timeout for waiting Router Advertisements in seconds.
+     * example: IPV6_RA_TIMEOUT=10
+     * ---end---
+     */
 
     obj_properties[PROP_RA_TIMEOUT] = g_param_spec_int(
         NM_SETTING_IP6_CONFIG_RA_TIMEOUT,
@@ -933,50 +933,50 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingIP6Config:dhcp-duid:
-	 *
-	 * A string containing the DHCPv6 Unique Identifier (DUID) used by the dhcp
-	 * client to identify itself to DHCPv6 servers (RFC 3315). The DUID is carried
-	 * in the Client Identifier option.
-	 * If the property is a hex string ('aa:bb:cc') it is interpreted as a binary
-	 * DUID and filled as an opaque value in the Client Identifier option.
-	 *
-	 * The special value "lease" will retrieve the DUID previously used from the
-	 * lease file belonging to the connection. If no DUID is found and "dhclient"
-	 * is the configured dhcp client, the DUID is searched in the system-wide
-	 * dhclient lease file. If still no DUID is found, or another dhcp client is
-	 * used, a global and permanent DUID-UUID (RFC 6355) will be generated based
-	 * on the machine-id.
-	 *
-	 * The special values "llt" and "ll" will generate a DUID of type LLT or LL
-	 * (see RFC 3315) based on the current MAC address of the device. In order to
-	 * try providing a stable DUID-LLT, the time field will contain a constant
-	 * timestamp that is used globally (for all profiles) and persisted to disk.
-	 *
-	 * The special values "stable-llt", "stable-ll" and "stable-uuid" will generate
-	 * a DUID of the corresponding type, derived from the connection's stable-id and
-	 * a per-host unique key. You may want to include the "${DEVICE}" or "${MAC}" specifier
-	 * in the stable-id, in case this profile gets activated on multiple devices.
-	 * So, the link-layer address of "stable-ll" and "stable-llt" will be a generated
-	 * address derived from the stable id. The DUID-LLT time value in the "stable-llt"
-	 * option will be picked among a static timespan of three years (the upper bound
-	 * of the interval is the same constant timestamp used in "llt").
-	 *
-	 * When the property is unset, the global value provided for "ipv6.dhcp-duid" is
-	 * used. If no global value is provided, the default "lease" value is assumed.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingIP6Config:dhcp-duid:
+     *
+     * A string containing the DHCPv6 Unique Identifier (DUID) used by the dhcp
+     * client to identify itself to DHCPv6 servers (RFC 3315). The DUID is carried
+     * in the Client Identifier option.
+     * If the property is a hex string ('aa:bb:cc') it is interpreted as a binary
+     * DUID and filled as an opaque value in the Client Identifier option.
+     *
+     * The special value "lease" will retrieve the DUID previously used from the
+     * lease file belonging to the connection. If no DUID is found and "dhclient"
+     * is the configured dhcp client, the DUID is searched in the system-wide
+     * dhclient lease file. If still no DUID is found, or another dhcp client is
+     * used, a global and permanent DUID-UUID (RFC 6355) will be generated based
+     * on the machine-id.
+     *
+     * The special values "llt" and "ll" will generate a DUID of type LLT or LL
+     * (see RFC 3315) based on the current MAC address of the device. In order to
+     * try providing a stable DUID-LLT, the time field will contain a constant
+     * timestamp that is used globally (for all profiles) and persisted to disk.
+     *
+     * The special values "stable-llt", "stable-ll" and "stable-uuid" will generate
+     * a DUID of the corresponding type, derived from the connection's stable-id and
+     * a per-host unique key. You may want to include the "${DEVICE}" or "${MAC}" specifier
+     * in the stable-id, in case this profile gets activated on multiple devices.
+     * So, the link-layer address of "stable-ll" and "stable-llt" will be a generated
+     * address derived from the stable id. The DUID-LLT time value in the "stable-llt"
+     * option will be picked among a static timespan of three years (the upper bound
+     * of the interval is the same constant timestamp used in "llt").
+     *
+     * When the property is unset, the global value provided for "ipv6.dhcp-duid" is
+     * used. If no global value is provided, the default "lease" value is assumed.
+     *
+     * Since: 1.12
+     **/
     /* ---ifcfg-rh---
-	 * property: dhcp-duid
-	 * variable: DHCPV6_DUID(+)
-	 * description: A string sent to the DHCPv6 server to identify the local machine.
-	 *   Apart from the special values "lease", "stable-llt", "stable-ll", "stable-uuid",
-	 *   "llt" and "ll" a binary value in hex format is expected. An hex string where
-	 *   each octet is separated by a colon is also accepted.
-	 * example: DHCPV6_DUID=LL; DHCPV6_DUID=0301deadbeef0001; DHCPV6_DUID=03:01:de:ad:be:ef:00:01
-	 * ---end---
-	 */
+     * property: dhcp-duid
+     * variable: DHCPV6_DUID(+)
+     * description: A string sent to the DHCPv6 server to identify the local machine.
+     *   Apart from the special values "lease", "stable-llt", "stable-ll", "stable-uuid",
+     *   "llt" and "ll" a binary value in hex format is expected. An hex string where
+     *   each octet is separated by a colon is also accepted.
+     * example: DHCPV6_DUID=LL; DHCPV6_DUID=0301deadbeef0001; DHCPV6_DUID=03:01:de:ad:be:ef:00:01
+     * ---end---
+     */
     obj_properties[PROP_DHCP_DUID] =
         g_param_spec_string(NM_SETTING_IP6_CONFIG_DHCP_DUID,
                             "",
@@ -987,11 +987,11 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
     /* IP6-specific property overrides */
 
     /* ---dbus---
-	 * property: dns
-	 * format: array of byte array
-	 * description: Array of IP addresses of DNS servers (in network byte order)
-	 * ---end---
-	 */
+     * property: dns
+     * format: array of byte array
+     * description: Array of IP addresses of DNS servers (in network byte order)
+     * ---end---
+     */
     _nm_properties_override_gobj(
         properties_override,
         g_object_class_find_property(G_OBJECT_CLASS(setting_class), NM_SETTING_IP_CONFIG_DNS),
@@ -1000,19 +1000,19 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                                   .gprop_from_dbus_fcn = ip6_dns_from_dbus, ));
 
     /* ---dbus---
-	 * property: addresses
-	 * format: array of legacy IPv6 address struct (a(ayuay))
-	 * description: Deprecated in favor of the 'address-data' and 'gateway'
-	 *   properties, but this can be used for backward-compatibility with older
-	 *   daemons. Note that if you send this property the daemon will ignore
-	 *   'address-data' and 'gateway'.
-	 *
-	 *   Array of IPv6 address structures.  Each IPv6 address structure is
-	 *   composed of an IPv6 address, a prefix length (1 - 128), and an IPv6
-	 *   gateway address. The gateway may be zeroed out if no gateway exists for
-	 *   that subnet.
-	 * ---end---
-	 */
+     * property: addresses
+     * format: array of legacy IPv6 address struct (a(ayuay))
+     * description: Deprecated in favor of the 'address-data' and 'gateway'
+     *   properties, but this can be used for backward-compatibility with older
+     *   daemons. Note that if you send this property the daemon will ignore
+     *   'address-data' and 'gateway'.
+     *
+     *   Array of IPv6 address structures.  Each IPv6 address structure is
+     *   composed of an IPv6 address, a prefix length (1 - 128), and an IPv6
+     *   gateway address. The gateway may be zeroed out if no gateway exists for
+     *   that subnet.
+     * ---end---
+     */
     _nm_properties_override_gobj(
         properties_override,
         g_object_class_find_property(G_OBJECT_CLASS(setting_class), NM_SETTING_IP_CONFIG_ADDRESSES),
@@ -1021,14 +1021,14 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                                   .from_dbus_fcn = ip6_addresses_set, ));
 
     /* ---dbus---
-	 * property: address-data
-	 * format: array of vardict
-	 * description: Array of IPv6 addresses. Each address dictionary contains at
-	 *   least 'address' and 'prefix' entries, containing the IP address as a
-	 *   string, and the prefix length as a uint32. Additional attributes may
-	 *   also exist on some addresses.
-	 * ---end---
-	 */
+     * property: address-data
+     * format: array of vardict
+     * description: Array of IPv6 addresses. Each address dictionary contains at
+     *   least 'address' and 'prefix' entries, containing the IP address as a
+     *   string, and the prefix length as a uint32. Additional attributes may
+     *   also exist on some addresses.
+     * ---end---
+     */
     _nm_properties_override_dbus(
         properties_override,
         "address-data",
@@ -1037,19 +1037,19 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                                   .from_dbus_fcn = ip6_address_data_set, ));
 
     /* ---dbus---
-	 * property: routes
-	 * format: array of legacy IPv6 route struct (a(ayuayu))
-	 * description: Deprecated in favor of the 'route-data' property, but this
-	 *   can be used for backward-compatibility with older daemons. Note that if
-	 *   you send this property the daemon will ignore 'route-data'.
-	 *
-	 *   Array of IPv6 route structures.  Each IPv6 route structure is
-	 *   composed of an IPv6 address, a prefix length (1 - 128), an IPv6
-	 *   next hop address (which may be zeroed out if there is no next hop),
-	 *   and a metric. If the metric is 0, NM will choose an appropriate
-	 *   default metric for the device.
-	 * ---end---
-	 */
+     * property: routes
+     * format: array of legacy IPv6 route struct (a(ayuayu))
+     * description: Deprecated in favor of the 'route-data' property, but this
+     *   can be used for backward-compatibility with older daemons. Note that if
+     *   you send this property the daemon will ignore 'route-data'.
+     *
+     *   Array of IPv6 route structures.  Each IPv6 route structure is
+     *   composed of an IPv6 address, a prefix length (1 - 128), an IPv6
+     *   next hop address (which may be zeroed out if there is no next hop),
+     *   and a metric. If the metric is 0, NM will choose an appropriate
+     *   default metric for the device.
+     * ---end---
+     */
     _nm_properties_override_gobj(
         properties_override,
         g_object_class_find_property(G_OBJECT_CLASS(setting_class), NM_SETTING_IP_CONFIG_ROUTES),
@@ -1058,18 +1058,18 @@ nm_setting_ip6_config_class_init(NMSettingIP6ConfigClass *klass)
                                   .from_dbus_fcn = ip6_routes_set, ));
 
     /* ---dbus---
-	 * property: route-data
-	 * format: array of vardict
-	 * description: Array of IPv6 routes. Each route dictionary contains at
-	 *   least 'dest' and 'prefix' entries, containing the destination IP
-	 *   address as a string, and the prefix length as a uint32. Most routes
-	 *   will also have a 'next-hop' entry, containing the next hop IP address as
-	 *   a string. If the route has a 'metric' entry (containing a uint32), that
-	 *   will be used as the metric for the route (otherwise NM will pick a
-	 *   default value appropriate to the device). Additional attributes may
-	 *   also exist on some routes.
-	 * ---end---
-	 */
+     * property: route-data
+     * format: array of vardict
+     * description: Array of IPv6 routes. Each route dictionary contains at
+     *   least 'dest' and 'prefix' entries, containing the destination IP
+     *   address as a string, and the prefix length as a uint32. Most routes
+     *   will also have a 'next-hop' entry, containing the next hop IP address as
+     *   a string. If the route has a 'metric' entry (containing a uint32), that
+     *   will be used as the metric for the route (otherwise NM will pick a
+     *   default value appropriate to the device). Additional attributes may
+     *   also exist on some routes.
+     * ---end---
+     */
     _nm_properties_override_dbus(properties_override,
                                  "route-data",
                                  NM_SETT_INFO_PROPERT_TYPE(.dbus_type = NM_G_VARIANT_TYPE("aa{sv}"),
diff --git a/libnm-core/nm-setting-macsec.c b/libnm-core/nm-setting-macsec.c
index 37bcdcd8a5..7a2beaae3b 100644
--- a/libnm-core/nm-setting-macsec.c
+++ b/libnm-core/nm-setting-macsec.c
@@ -218,8 +218,8 @@ verify_macsec_key(const char *key, gboolean cak, GError **error)
     int req_len;
 
     /* CAK is a connection secret and can be NULL for various
-	 * reasons (agent-owned, no permissions to get secrets, etc.)
-	 */
+     * reasons (agent-owned, no permissions to get secrets, etc.)
+     */
     if (cak && !key)
         return TRUE;
 
@@ -269,8 +269,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     if (priv->parent) {
         if (nm_utils_is_uuid(priv->parent)) {
             /* If we have an NMSettingConnection:master with slave-type="macsec",
-			 * then it must be the same UUID.
-			 */
+             * then it must be the same UUID.
+             */
             if (s_con) {
                 const char *master = NULL, *slave_type = NULL;
 
@@ -308,8 +308,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
         }
     } else {
         /* If parent is NULL, the parent must be specified via
-		 * NMSettingWired:mac-address.
-		 */
+         * NMSettingWired:mac-address.
+         */
         if (connection && (!s_wired || !nm_setting_wired_get_mac_address(s_wired))) {
             g_set_error(error,
                         NM_CONNECTION_ERROR,
@@ -527,15 +527,15 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
     setting_class->need_secrets = need_secrets;
 
     /**
-	 * NMSettingMacsec:parent:
-	 *
-	 * If given, specifies the parent interface name or parent connection UUID
-	 * from which this MACSEC interface should be created.  If this property is
-	 * not specified, the connection must contain an #NMSettingWired setting
-	 * with a #NMSettingWired:mac-address property.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingMacsec:parent:
+     *
+     * If given, specifies the parent interface name or parent connection UUID
+     * from which this MACSEC interface should be created.  If this property is
+     * not specified, the connection must contain an #NMSettingWired setting
+     * with a #NMSettingWired:mac-address property.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_string(
         NM_SETTING_MACSEC_PARENT,
         "",
@@ -544,13 +544,13 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacsec:mode:
-	 *
-	 * Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key
-	 * Agreement) is obtained.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingMacsec:mode:
+     *
+     * Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key
+     * Agreement) is obtained.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_MODE] =
         g_param_spec_int(NM_SETTING_MACSEC_MODE,
                          "",
@@ -561,12 +561,12 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                          G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacsec:encrypt:
-	 *
-	 * Whether the transmitted traffic must be encrypted.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingMacsec:encrypt:
+     *
+     * Whether the transmitted traffic must be encrypted.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_ENCRYPT] = g_param_spec_boolean(NM_SETTING_MACSEC_ENCRYPT,
                                                         "",
                                                         "",
@@ -574,13 +574,13 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacsec:mka-cak:
-	 *
-	 * The pre-shared CAK (Connectivity Association Key) for MACsec
-	 * Key Agreement.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingMacsec:mka-cak:
+     *
+     * The pre-shared CAK (Connectivity Association Key) for MACsec
+     * Key Agreement.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_MKA_CAK] =
         g_param_spec_string(NM_SETTING_MACSEC_MKA_CAK,
                             "",
@@ -589,13 +589,13 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacsec:mka-cak-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingMacsec:mka-cak
-	 * property.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingMacsec:mka-cak-flags:
+     *
+     * Flags indicating how to handle the #NMSettingMacsec:mka-cak
+     * property.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_MKA_CAK_FLAGS] =
         g_param_spec_flags(NM_SETTING_MACSEC_MKA_CAK_FLAGS,
                            "",
@@ -605,13 +605,13 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacsec:mka-ckn:
-	 *
-	 * The pre-shared CKN (Connectivity-association Key Name) for
-	 * MACsec Key Agreement.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingMacsec:mka-ckn:
+     *
+     * The pre-shared CKN (Connectivity-association Key Name) for
+     * MACsec Key Agreement.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_MKA_CKN] = g_param_spec_string(NM_SETTING_MACSEC_MKA_CKN,
                                                        "",
                                                        "",
@@ -619,12 +619,12 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacsec:port:
-	 *
-	 * The port component of the SCI (Secure Channel Identifier), between 1 and 65534.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingMacsec:port:
+     *
+     * The port component of the SCI (Secure Channel Identifier), between 1 and 65534.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_PORT] =
         g_param_spec_int(NM_SETTING_MACSEC_PORT,
                          "",
@@ -635,12 +635,12 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                          G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacsec:validation:
-	 *
-	 * Specifies the validation mode for incoming frames.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingMacsec:validation:
+     *
+     * Specifies the validation mode for incoming frames.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_VALIDATION] =
         g_param_spec_int(NM_SETTING_MACSEC_VALIDATION,
                          "",
@@ -651,13 +651,13 @@ nm_setting_macsec_class_init(NMSettingMacsecClass *klass)
                          G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacsec:send-sci:
-	 *
-	 * Specifies whether the SCI (Secure Channel Identifier) is included
-	 * in every packet.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingMacsec:send-sci:
+     *
+     * Specifies whether the SCI (Secure Channel Identifier) is included
+     * in every packet.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_SEND_SCI] =
         g_param_spec_boolean(NM_SETTING_MACSEC_SEND_SCI,
                              "",
diff --git a/libnm-core/nm-setting-macvlan.c b/libnm-core/nm-setting-macvlan.c
index d5bfe53db4..85566c0764 100644
--- a/libnm-core/nm-setting-macvlan.c
+++ b/libnm-core/nm-setting-macvlan.c
@@ -129,8 +129,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
         }
     } else {
         /* If parent is NULL, the parent must be specified via
-		 * NMSettingWired:mac-address.
-		 */
+         * NMSettingWired:mac-address.
+         */
         if (connection && (!s_wired || !nm_setting_wired_get_mac_address(s_wired))) {
             g_set_error(error,
                         NM_CONNECTION_ERROR,
@@ -265,15 +265,15 @@ nm_setting_macvlan_class_init(NMSettingMacvlanClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingMacvlan:parent:
-	 *
-	 * If given, specifies the parent interface name or parent connection UUID
-	 * from which this MAC-VLAN interface should be created.  If this property is
-	 * not specified, the connection must contain an #NMSettingWired setting
-	 * with a #NMSettingWired:mac-address property.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingMacvlan:parent:
+     *
+     * If given, specifies the parent interface name or parent connection UUID
+     * from which this MAC-VLAN interface should be created.  If this property is
+     * not specified, the connection must contain an #NMSettingWired setting
+     * with a #NMSettingWired:mac-address property.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_string(
         NM_SETTING_MACVLAN_PARENT,
         "",
@@ -282,13 +282,13 @@ nm_setting_macvlan_class_init(NMSettingMacvlanClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacvlan:mode:
-	 *
-	 * The macvlan mode, which specifies the communication mechanism between multiple
-	 * macvlans on the same lower device.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingMacvlan:mode:
+     *
+     * The macvlan mode, which specifies the communication mechanism between multiple
+     * macvlans on the same lower device.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_MODE] =
         g_param_spec_uint(NM_SETTING_MACVLAN_MODE,
                           "",
@@ -299,12 +299,12 @@ nm_setting_macvlan_class_init(NMSettingMacvlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacvlan:promiscuous:
-	 *
-	 * Whether the interface should be put in promiscuous mode.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingMacvlan:promiscuous:
+     *
+     * Whether the interface should be put in promiscuous mode.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PROMISCUOUS] = g_param_spec_boolean(
         NM_SETTING_MACVLAN_PROMISCUOUS,
         "",
@@ -313,12 +313,12 @@ nm_setting_macvlan_class_init(NMSettingMacvlanClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMacvlan:tap:
-	 *
-	 * Whether the interface should be a MACVTAP.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingMacvlan:tap:
+     *
+     * Whether the interface should be a MACVTAP.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TAP] = g_param_spec_boolean(NM_SETTING_MACVLAN_TAP,
                                                     "",
                                                     "",
diff --git a/libnm-core/nm-setting-match.c b/libnm-core/nm-setting-match.c
index 85c816499d..d2dbbc249f 100644
--- a/libnm-core/nm-setting-match.c
+++ b/libnm-core/nm-setting-match.c
@@ -785,25 +785,25 @@ nm_setting_match_class_init(NMSettingMatchClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingMatch:interface-name
-	 *
-	 * A list of interface names to match. Each element is a shell wildcard
-	 * pattern.
-	 *
-	 * An element can be prefixed with a pipe symbol (|) or an ampersand (&).
-	 * The former means that the element is optional and the latter means that
-	 * it is mandatory. If there are any optional elements, than the match
-	 * evaluates to true if at least one of the optional element matches
-	 * (logical OR). If there are any mandatory elements, then they all
-	 * must match (logical AND). By default, an element is optional. This means
-	 * that an element "foo" behaves the same as "|foo". An element can also be inverted
-	 * with exclamation mark (!) between the pipe symbol (or the ampersand) and before
-	 * the pattern. Note that "!foo" is a shortcut for the mandatory match "&!foo". Finally,
-	 * a backslash can be used at the beginning of the element (after the optional special characters)
-	 * to escape the start of the pattern. For example, "&\\!a" is an mandatory match for literally "!a".
-	 *
-	 * Since: 1.14
-	 **/
+     * NMSettingMatch:interface-name
+     *
+     * A list of interface names to match. Each element is a shell wildcard
+     * pattern.
+     *
+     * An element can be prefixed with a pipe symbol (|) or an ampersand (&).
+     * The former means that the element is optional and the latter means that
+     * it is mandatory. If there are any optional elements, than the match
+     * evaluates to true if at least one of the optional element matches
+     * (logical OR). If there are any mandatory elements, then they all
+     * must match (logical AND). By default, an element is optional. This means
+     * that an element "foo" behaves the same as "|foo". An element can also be inverted
+     * with exclamation mark (!) between the pipe symbol (or the ampersand) and before
+     * the pattern. Note that "!foo" is a shortcut for the mandatory match "&!foo". Finally,
+     * a backslash can be used at the beginning of the element (after the optional special characters)
+     * to escape the start of the pattern. For example, "&\\!a" is an mandatory match for literally "!a".
+     *
+     * Since: 1.14
+     **/
     obj_properties[PROP_INTERFACE_NAME] = g_param_spec_boxed(
         NM_SETTING_MATCH_INTERFACE_NAME,
         "",
@@ -812,22 +812,22 @@ nm_setting_match_class_init(NMSettingMatchClass *klass)
         NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMatch:kernel-command-line
-	 *
-	 * A list of kernel command line arguments to match. This may be used to check
-	 * whether a specific kernel command line option is set (or if prefixed with
-	 * the exclamation mark unset). The argument must either be a single word, or
-	 * an assignment (i.e. two words, separated "="). In the former case the kernel
-	 * command line is searched for the word appearing as is, or as left hand side
-	 * of an assignment. In the latter case, the exact assignment is looked for
-	 * with right and left hand side matching.
-	 *
-	 * See NMSettingMatch:interface-name for how special characters '|', '&',
-	 * '!' and '\\' are used for optional and mandatory matches and inverting the
-	 * pattern.
-	 *
-	 * Since: 1.26
-	 **/
+     * NMSettingMatch:kernel-command-line
+     *
+     * A list of kernel command line arguments to match. This may be used to check
+     * whether a specific kernel command line option is set (or if prefixed with
+     * the exclamation mark unset). The argument must either be a single word, or
+     * an assignment (i.e. two words, separated "="). In the former case the kernel
+     * command line is searched for the word appearing as is, or as left hand side
+     * of an assignment. In the latter case, the exact assignment is looked for
+     * with right and left hand side matching.
+     *
+     * See NMSettingMatch:interface-name for how special characters '|', '&',
+     * '!' and '\\' are used for optional and mandatory matches and inverting the
+     * pattern.
+     *
+     * Since: 1.26
+     **/
     obj_properties[PROP_KERNEL_COMMAND_LINE] = g_param_spec_boxed(
         NM_SETTING_MATCH_KERNEL_COMMAND_LINE,
         "",
@@ -836,16 +836,16 @@ nm_setting_match_class_init(NMSettingMatchClass *klass)
         NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMatch:driver
-	 *
-	 * A list of driver names to match. Each element is a shell wildcard pattern.
-	 *
-	 * See NMSettingMatch:interface-name for how special characters '|', '&',
-	 * '!' and '\\' are used for optional and mandatory matches and inverting the
-	 * pattern.
-	 *
-	 * Since: 1.26
-	 **/
+     * NMSettingMatch:driver
+     *
+     * A list of driver names to match. Each element is a shell wildcard pattern.
+     *
+     * See NMSettingMatch:interface-name for how special characters '|', '&',
+     * '!' and '\\' are used for optional and mandatory matches and inverting the
+     * pattern.
+     *
+     * Since: 1.26
+     **/
     obj_properties[PROP_DRIVER] = g_param_spec_boxed(
         NM_SETTING_MATCH_DRIVER,
         "",
@@ -854,38 +854,38 @@ nm_setting_match_class_init(NMSettingMatchClass *klass)
         NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingMatch:path
-	 *
-	 * A list of paths to match against the ID_PATH udev property of
-	 * devices. ID_PATH represents the topological persistent path of a
-	 * device. It typically contains a subsystem string (pci, usb, platform,
-	 * etc.) and a subsystem-specific identifier.
-	 *
-	 * For PCI devices the path has the form
-	 * "pci-$domain:$bus:$device.$function", where each variable is an
-	 * hexadecimal value; for example "pci-0000:0a:00.0".
-	 *
-	 * The path of a device can be obtained with "udevadm info
-	 * /sys/class/net/$dev | grep ID_PATH=" or by looking at the "path"
-	 * property exported by NetworkManager ("nmcli -f general.path device
-	 * show $dev").
-	 *
-	 * Each element of the list is a shell wildcard pattern.
-	 *
-	 * See NMSettingMatch:interface-name for how special characters '|', '&',
-	 * '!' and '\\' are used for optional and mandatory matches and inverting the
-	 * pattern.
-	 *
-	 * Since: 1.26
-	 **/
+     * NMSettingMatch:path
+     *
+     * A list of paths to match against the ID_PATH udev property of
+     * devices. ID_PATH represents the topological persistent path of a
+     * device. It typically contains a subsystem string (pci, usb, platform,
+     * etc.) and a subsystem-specific identifier.
+     *
+     * For PCI devices the path has the form
+     * "pci-$domain:$bus:$device.$function", where each variable is an
+     * hexadecimal value; for example "pci-0000:0a:00.0".
+     *
+     * The path of a device can be obtained with "udevadm info
+     * /sys/class/net/$dev | grep ID_PATH=" or by looking at the "path"
+     * property exported by NetworkManager ("nmcli -f general.path device
+     * show $dev").
+     *
+     * Each element of the list is a shell wildcard pattern.
+     *
+     * See NMSettingMatch:interface-name for how special characters '|', '&',
+     * '!' and '\\' are used for optional and mandatory matches and inverting the
+     * pattern.
+     *
+     * Since: 1.26
+     **/
     /* ---ifcfg-rh---
-	 * property: path
-	 * variable: MATCH_PATH
-	 * description: space-separated list of paths to match against the udev
-	 *   property ID_PATHS of devices
-	 * example: MATCH_PATH="pci-0000:01:00.0 pci-0000:0c:00.0"
-	 * ---end---
-	 */
+     * property: path
+     * variable: MATCH_PATH
+     * description: space-separated list of paths to match against the udev
+     *   property ID_PATHS of devices
+     * example: MATCH_PATH="pci-0000:01:00.0 pci-0000:0c:00.0"
+     * ---end---
+     */
     obj_properties[PROP_PATH] = g_param_spec_boxed(NM_SETTING_MATCH_PATH,
                                                    "",
                                                    "",
diff --git a/libnm-core/nm-setting-olpc-mesh.c b/libnm-core/nm-setting-olpc-mesh.c
index edaeb17e5c..101190d1a2 100644
--- a/libnm-core/nm-setting-olpc-mesh.c
+++ b/libnm-core/nm-setting-olpc-mesh.c
@@ -221,10 +221,10 @@ nm_setting_olpc_mesh_class_init(NMSettingOlpcMeshClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingOlpcMesh:ssid:
-	 *
-	 * SSID of the mesh network to join.
-	 **/
+     * NMSettingOlpcMesh:ssid:
+     *
+     * SSID of the mesh network to join.
+     **/
     obj_properties[PROP_SSID] = g_param_spec_boxed(NM_SETTING_OLPC_MESH_SSID,
                                                    "",
                                                    "",
@@ -233,10 +233,10 @@ nm_setting_olpc_mesh_class_init(NMSettingOlpcMeshClass *klass)
                                                        | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOlpcMesh:channel:
-	 *
-	 * Channel on which the mesh network to join is located.
-	 **/
+     * NMSettingOlpcMesh:channel:
+     *
+     * Channel on which the mesh network to join is located.
+     **/
     obj_properties[PROP_CHANNEL] =
         g_param_spec_uint(NM_SETTING_OLPC_MESH_CHANNEL,
                           "",
@@ -247,12 +247,12 @@ nm_setting_olpc_mesh_class_init(NMSettingOlpcMeshClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOlpcMesh:dhcp-anycast-address:
-	 *
-	 * Anycast DHCP MAC address used when requesting an IP address via DHCP.
-	 * The specific anycast address used determines which DHCP server class
-	 * answers the request.
-	 **/
+     * NMSettingOlpcMesh:dhcp-anycast-address:
+     *
+     * Anycast DHCP MAC address used when requesting an IP address via DHCP.
+     * The specific anycast address used determines which DHCP server class
+     * answers the request.
+     **/
     obj_properties[PROP_DHCP_ANYCAST_ADDRESS] =
         g_param_spec_string(NM_SETTING_OLPC_MESH_DHCP_ANYCAST_ADDRESS,
                             "",
diff --git a/libnm-core/nm-setting-ovs-bridge.c b/libnm-core/nm-setting-ovs-bridge.c
index 5726962ebc..05f0126c31 100644
--- a/libnm-core/nm-setting-ovs-bridge.c
+++ b/libnm-core/nm-setting-ovs-bridge.c
@@ -299,12 +299,12 @@ nm_setting_ovs_bridge_class_init(NMSettingOvsBridgeClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingOvsBridge:fail-mode:
-	 *
-	 * The bridge failure mode. One of "secure", "standalone" or empty.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsBridge:fail-mode:
+     *
+     * The bridge failure mode. One of "secure", "standalone" or empty.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_FAIL_MODE] = g_param_spec_string(
         NM_SETTING_OVS_BRIDGE_FAIL_MODE,
         "",
@@ -313,12 +313,12 @@ nm_setting_ovs_bridge_class_init(NMSettingOvsBridgeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsBridge:mcast-snooping-enable:
-	 *
-	 * Enable or disable multicast snooping.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsBridge:mcast-snooping-enable:
+     *
+     * Enable or disable multicast snooping.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_MCAST_SNOOPING_ENABLE] =
         g_param_spec_boolean(NM_SETTING_OVS_BRIDGE_MCAST_SNOOPING_ENABLE,
                              "",
@@ -327,12 +327,12 @@ nm_setting_ovs_bridge_class_init(NMSettingOvsBridgeClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsBridge:rstp-enable:
-	 *
-	 * Enable or disable RSTP.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsBridge:rstp-enable:
+     *
+     * Enable or disable RSTP.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_RSTP_ENABLE] =
         g_param_spec_boolean(NM_SETTING_OVS_BRIDGE_RSTP_ENABLE,
                              "",
@@ -341,12 +341,12 @@ nm_setting_ovs_bridge_class_init(NMSettingOvsBridgeClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsBridge:stp-enable:
-	 *
-	 * Enable or disable STP.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsBridge:stp-enable:
+     *
+     * Enable or disable STP.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_STP_ENABLE] =
         g_param_spec_boolean(NM_SETTING_OVS_BRIDGE_STP_ENABLE,
                              "",
@@ -355,12 +355,12 @@ nm_setting_ovs_bridge_class_init(NMSettingOvsBridgeClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsBridge:datapath-type:
-	 *
-	 * The data path type. One of "system", "netdev" or empty.
-	 *
-	 * Since: 1.20
-	 **/
+     * NMSettingOvsBridge:datapath-type:
+     *
+     * The data path type. One of "system", "netdev" or empty.
+     *
+     * Since: 1.20
+     **/
     obj_properties[PROP_DATAPATH_TYPE] = g_param_spec_string(
         NM_SETTING_OVS_BRIDGE_DATAPATH_TYPE,
         "",
diff --git a/libnm-core/nm-setting-ovs-dpdk.c b/libnm-core/nm-setting-ovs-dpdk.c
index 394b52e966..1d6442331d 100644
--- a/libnm-core/nm-setting-ovs-dpdk.c
+++ b/libnm-core/nm-setting-ovs-dpdk.c
@@ -133,12 +133,12 @@ nm_setting_ovs_dpdk_class_init(NMSettingOvsDpdkClass *klass)
     object_class->finalize     = finalize;
 
     /**
-	 * NMSettingOvsDpdk:devargs:
-	 *
-	 * Open vSwitch DPDK device arguments.
-	 *
-	 * Since: 1.20
-	 **/
+     * NMSettingOvsDpdk:devargs:
+     *
+     * Open vSwitch DPDK device arguments.
+     *
+     * Since: 1.20
+     **/
     obj_properties[PROP_DEVARGS] = g_param_spec_string(
         NM_SETTING_OVS_DPDK_DEVARGS,
         "",
diff --git a/libnm-core/nm-setting-ovs-interface.c b/libnm-core/nm-setting-ovs-interface.c
index de188c0188..941bfd71bd 100644
--- a/libnm-core/nm-setting-ovs-interface.c
+++ b/libnm-core/nm-setting-ovs-interface.c
@@ -107,13 +107,13 @@ _nm_setting_ovs_interface_verify_interface_type(NMSettingOvsInterface *self,
     connection_type = nm_connection_get_connection_type(connection);
     if (!connection_type) {
         /* if we have an ovs-interface, then the connection type must be either
-		 * "ovs-interface" (for non "system" type) or anything else (for "system" type).
-		 *
-		 * The connection type usually can be normalized based on the presence of a
-		 * base setting. However, in this case, if the connection type is missing,
-		 * that is too complicate to guess what the user wanted.
-		 *
-		 * Require the use to be explicit and fail. */
+         * "ovs-interface" (for non "system" type) or anything else (for "system" type).
+         *
+         * The connection type usually can be normalized based on the presence of a
+         * base setting. However, in this case, if the connection type is missing,
+         * that is too complicate to guess what the user wanted.
+         *
+         * Require the use to be explicit and fail. */
         g_set_error(error,
                     NM_CONNECTION_ERROR,
                     NM_CONNECTION_ERROR_INVALID_PROPERTY,
@@ -408,12 +408,12 @@ nm_setting_ovs_interface_class_init(NMSettingOvsInterfaceClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingOvsInterface:type:
-	 *
-	 * The interface type. Either "internal", "system", "patch", "dpdk", or empty.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsInterface:type:
+     *
+     * The interface type. Either "internal", "system", "patch", "dpdk", or empty.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_TYPE] = g_param_spec_string(NM_SETTING_OVS_INTERFACE_TYPE,
                                                     "",
                                                     "",
diff --git a/libnm-core/nm-setting-ovs-patch.c b/libnm-core/nm-setting-ovs-patch.c
index 3a2236228f..7ef019e318 100644
--- a/libnm-core/nm-setting-ovs-patch.c
+++ b/libnm-core/nm-setting-ovs-patch.c
@@ -168,13 +168,13 @@ nm_setting_ovs_patch_class_init(NMSettingOvsPatchClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingOvsPatch:peer:
-	 *
-	 * Specifies the name of the interface for the other side of the patch.
-	 * The patch on the other side must also set this interface as peer.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsPatch:peer:
+     *
+     * Specifies the name of the interface for the other side of the patch.
+     * The patch on the other side must also set this interface as peer.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_PEER] = g_param_spec_string(NM_SETTING_OVS_PATCH_PEER,
                                                     "",
                                                     "",
diff --git a/libnm-core/nm-setting-ovs-port.c b/libnm-core/nm-setting-ovs-port.c
index b68fd32797..07735aec8b 100644
--- a/libnm-core/nm-setting-ovs-port.c
+++ b/libnm-core/nm-setting-ovs-port.c
@@ -371,13 +371,13 @@ nm_setting_ovs_port_class_init(NMSettingOvsPortClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingOvsPort:vlan-mode:
-	 *
-	 * The VLAN mode. One of "access", "native-tagged", "native-untagged",
-	 * "trunk" or unset.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsPort:vlan-mode:
+     *
+     * The VLAN mode. One of "access", "native-tagged", "native-untagged",
+     * "trunk" or unset.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_VLAN_MODE] = g_param_spec_string(
         NM_SETTING_OVS_PORT_VLAN_MODE,
         "",
@@ -386,12 +386,12 @@ nm_setting_ovs_port_class_init(NMSettingOvsPortClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsPort:tag:
-	 *
-	 * The VLAN tag in the range 0-4095.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsPort:tag:
+     *
+     * The VLAN tag in the range 0-4095.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_TAG] =
         g_param_spec_uint(NM_SETTING_OVS_PORT_TAG,
                           "",
@@ -402,12 +402,12 @@ nm_setting_ovs_port_class_init(NMSettingOvsPortClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsPort:lacp:
-	 *
-	 * LACP mode. One of "active", "off", or "passive".
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsPort:lacp:
+     *
+     * LACP mode. One of "active", "off", or "passive".
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_LACP] = g_param_spec_string(NM_SETTING_OVS_PORT_LACP,
                                                     "",
                                                     "",
@@ -416,12 +416,12 @@ nm_setting_ovs_port_class_init(NMSettingOvsPortClass *klass)
                                                         | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsPort:bond-mode:
-	 *
-	 * Bonding mode. One of "active-backup", "balance-slb", or "balance-tcp".
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsPort:bond-mode:
+     *
+     * Bonding mode. One of "active-backup", "balance-slb", or "balance-tcp".
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_BOND_MODE] = g_param_spec_string(
         NM_SETTING_OVS_PORT_BOND_MODE,
         "",
@@ -430,12 +430,12 @@ nm_setting_ovs_port_class_init(NMSettingOvsPortClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsPort:bond-updelay:
-	 *
-	 * The time port must be active before it starts forwarding traffic.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsPort:bond-updelay:
+     *
+     * The time port must be active before it starts forwarding traffic.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_BOND_UPDELAY] =
         g_param_spec_uint(NM_SETTING_OVS_PORT_BOND_UPDELAY,
                           "",
@@ -446,12 +446,12 @@ nm_setting_ovs_port_class_init(NMSettingOvsPortClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingOvsPort:bond-downdelay:
-	 *
-	 * The time port must be inactive in order to be considered down.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingOvsPort:bond-downdelay:
+     *
+     * The time port must be inactive in order to be considered down.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_BOND_DOWNDELAY] =
         g_param_spec_uint(NM_SETTING_OVS_PORT_BOND_DOWNDELAY,
                           "",
diff --git a/libnm-core/nm-setting-ppp.c b/libnm-core/nm-setting-ppp.c
index 9504d94e1c..2aad6d0ed2 100644
--- a/libnm-core/nm-setting-ppp.c
+++ b/libnm-core/nm-setting-ppp.c
@@ -529,12 +529,12 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingPpp:noauth:
-	 *
-	 * If %TRUE, do not require the other side (usually the PPP server) to
-	 * authenticate itself to the client.  If %FALSE, require authentication
-	 * from the remote side.  In almost all cases, this should be %TRUE.
-	 **/
+     * NMSettingPpp:noauth:
+     *
+     * If %TRUE, do not require the other side (usually the PPP server) to
+     * authenticate itself to the client.  If %FALSE, require authentication
+     * from the remote side.  In almost all cases, this should be %TRUE.
+     **/
     obj_properties[PROP_NOAUTH] = g_param_spec_boolean(NM_SETTING_PPP_NOAUTH,
                                                        "",
                                                        "",
@@ -542,10 +542,10 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:refuse-eap:
-	 *
-	 * If %TRUE, the EAP authentication method will not be used.
-	 **/
+     * NMSettingPpp:refuse-eap:
+     *
+     * If %TRUE, the EAP authentication method will not be used.
+     **/
     obj_properties[PROP_REFUSE_EAP] =
         g_param_spec_boolean(NM_SETTING_PPP_REFUSE_EAP,
                              "",
@@ -554,10 +554,10 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:refuse-pap:
-	 *
-	 * If %TRUE, the PAP authentication method will not be used.
-	 **/
+     * NMSettingPpp:refuse-pap:
+     *
+     * If %TRUE, the PAP authentication method will not be used.
+     **/
     obj_properties[PROP_REFUSE_PAP] =
         g_param_spec_boolean(NM_SETTING_PPP_REFUSE_PAP,
                              "",
@@ -566,10 +566,10 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:refuse-chap:
-	 *
-	 * If %TRUE, the CHAP authentication method will not be used.
-	 **/
+     * NMSettingPpp:refuse-chap:
+     *
+     * If %TRUE, the CHAP authentication method will not be used.
+     **/
     obj_properties[PROP_REFUSE_CHAP] =
         g_param_spec_boolean(NM_SETTING_PPP_REFUSE_CHAP,
                              "",
@@ -578,10 +578,10 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:refuse-mschap:
-	 *
-	 * If %TRUE, the MSCHAP authentication method will not be used.
-	 **/
+     * NMSettingPpp:refuse-mschap:
+     *
+     * If %TRUE, the MSCHAP authentication method will not be used.
+     **/
     obj_properties[PROP_REFUSE_MSCHAP] =
         g_param_spec_boolean(NM_SETTING_PPP_REFUSE_MSCHAP,
                              "",
@@ -590,10 +590,10 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:refuse-mschapv2:
-	 *
-	 * If %TRUE, the MSCHAPv2 authentication method will not be used.
-	 **/
+     * NMSettingPpp:refuse-mschapv2:
+     *
+     * If %TRUE, the MSCHAPv2 authentication method will not be used.
+     **/
     obj_properties[PROP_REFUSE_MSCHAPV2] =
         g_param_spec_boolean(NM_SETTING_PPP_REFUSE_MSCHAPV2,
                              "",
@@ -602,10 +602,10 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:nobsdcomp:
-	 *
-	 * If %TRUE, BSD compression will not be requested.
-	 **/
+     * NMSettingPpp:nobsdcomp:
+     *
+     * If %TRUE, BSD compression will not be requested.
+     **/
     obj_properties[PROP_NOBSDCOMP] = g_param_spec_boolean(
         NM_SETTING_PPP_NOBSDCOMP,
         "",
@@ -614,10 +614,10 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:nodeflate:
-	 *
-	 * If %TRUE, "deflate" compression will not be requested.
-	 **/
+     * NMSettingPpp:nodeflate:
+     *
+     * If %TRUE, "deflate" compression will not be requested.
+     **/
     obj_properties[PROP_NODEFLATE] = g_param_spec_boolean(
         NM_SETTING_PPP_NODEFLATE,
         "",
@@ -626,10 +626,10 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:no-vj-comp:
-	 *
-	 * If %TRUE, Van Jacobsen TCP header compression will not be requested.
-	 **/
+     * NMSettingPpp:no-vj-comp:
+     *
+     * If %TRUE, Van Jacobsen TCP header compression will not be requested.
+     **/
     obj_properties[PROP_NO_VJ_COMP] = g_param_spec_boolean(
         NM_SETTING_PPP_NO_VJ_COMP,
         "",
@@ -638,13 +638,13 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:require-mppe:
-	 *
-	 * If %TRUE, MPPE (Microsoft Point-to-Point Encryption) will be required for
-	 * the PPP session.  If either 64-bit or 128-bit MPPE is not available the
-	 * session will fail.  Note that MPPE is not used on mobile broadband
-	 * connections.
-	 **/
+     * NMSettingPpp:require-mppe:
+     *
+     * If %TRUE, MPPE (Microsoft Point-to-Point Encryption) will be required for
+     * the PPP session.  If either 64-bit or 128-bit MPPE is not available the
+     * session will fail.  Note that MPPE is not used on mobile broadband
+     * connections.
+     **/
     obj_properties[PROP_REQUIRE_MPPE] =
         g_param_spec_boolean(NM_SETTING_PPP_REQUIRE_MPPE,
                              "",
@@ -653,12 +653,12 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:require-mppe-128:
-	 *
-	 * If %TRUE, 128-bit MPPE (Microsoft Point-to-Point Encryption) will be
-	 * required for the PPP session, and the "require-mppe" property must also
-	 * be set to %TRUE.  If 128-bit MPPE is not available the session will fail.
-	 **/
+     * NMSettingPpp:require-mppe-128:
+     *
+     * If %TRUE, 128-bit MPPE (Microsoft Point-to-Point Encryption) will be
+     * required for the PPP session, and the "require-mppe" property must also
+     * be set to %TRUE.  If 128-bit MPPE is not available the session will fail.
+     **/
     obj_properties[PROP_REQUIRE_MPPE_128] =
         g_param_spec_boolean(NM_SETTING_PPP_REQUIRE_MPPE_128,
                              "",
@@ -667,11 +667,11 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:mppe-stateful:
-	 *
-	 * If %TRUE, stateful MPPE is used.  See pppd documentation for more
-	 * information on stateful MPPE.
-	 **/
+     * NMSettingPpp:mppe-stateful:
+     *
+     * If %TRUE, stateful MPPE is used.  See pppd documentation for more
+     * information on stateful MPPE.
+     **/
     obj_properties[PROP_MPPE_STATEFUL] =
         g_param_spec_boolean(NM_SETTING_PPP_MPPE_STATEFUL,
                              "",
@@ -680,12 +680,12 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:crtscts:
-	 *
-	 * If %TRUE, specify that pppd should set the serial port to use hardware
-	 * flow control with RTS and CTS signals.  This value should normally be set
-	 * to %FALSE.
-	 **/
+     * NMSettingPpp:crtscts:
+     *
+     * If %TRUE, specify that pppd should set the serial port to use hardware
+     * flow control with RTS and CTS signals.  This value should normally be set
+     * to %FALSE.
+     **/
     obj_properties[PROP_CRTSCTS] = g_param_spec_boolean(NM_SETTING_PPP_CRTSCTS,
                                                         "",
                                                         "",
@@ -693,12 +693,12 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:baud:
-	 *
-	 * If non-zero, instruct pppd to set the serial port to the specified
-	 * baudrate.  This value should normally be left as 0 to automatically
-	 * choose the speed.
-	 **/
+     * NMSettingPpp:baud:
+     *
+     * If non-zero, instruct pppd to set the serial port to the specified
+     * baudrate.  This value should normally be left as 0 to automatically
+     * choose the speed.
+     **/
     obj_properties[PROP_BAUD] = g_param_spec_uint(NM_SETTING_PPP_BAUD,
                                                   "",
                                                   "",
@@ -709,12 +709,12 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                                                       | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:mru:
-	 *
-	 * If non-zero, instruct pppd to request that the peer send packets no
-	 * larger than the specified size.  If non-zero, the MRU should be between
-	 * 128 and 16384.
-	 */
+     * NMSettingPpp:mru:
+     *
+     * If non-zero, instruct pppd to request that the peer send packets no
+     * larger than the specified size.  If non-zero, the MRU should be between
+     * 128 and 16384.
+     */
     obj_properties[PROP_MRU] = g_param_spec_uint(NM_SETTING_PPP_MRU,
                                                  "",
                                                  "",
@@ -724,11 +724,11 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                                                  G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:mtu:
-	 *
-	 * If non-zero, instruct pppd to send packets no larger than the specified
-	 * size.
-	 **/
+     * NMSettingPpp:mtu:
+     *
+     * If non-zero, instruct pppd to send packets no larger than the specified
+     * size.
+     **/
     obj_properties[PROP_MTU] = g_param_spec_uint(NM_SETTING_PPP_MTU,
                                                  "",
                                                  "",
@@ -739,13 +739,13 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
                                                      | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:lcp-echo-failure:
-	 *
-	 * If non-zero, instruct pppd to presume the connection to the peer has
-	 * failed if the specified number of LCP echo-requests go unanswered by the
-	 * peer.  The "lcp-echo-interval" property must also be set to a non-zero
-	 * value if this property is used.
-	 **/
+     * NMSettingPpp:lcp-echo-failure:
+     *
+     * If non-zero, instruct pppd to presume the connection to the peer has
+     * failed if the specified number of LCP echo-requests go unanswered by the
+     * peer.  The "lcp-echo-interval" property must also be set to a non-zero
+     * value if this property is used.
+     **/
     obj_properties[PROP_LCP_ECHO_FAILURE] = g_param_spec_uint(
         NM_SETTING_PPP_LCP_ECHO_FAILURE,
         "",
@@ -756,13 +756,13 @@ nm_setting_ppp_class_init(NMSettingPppClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPpp:lcp-echo-interval:
-	 *
-	 * If non-zero, instruct pppd to send an LCP echo-request frame to the peer
-	 * every n seconds (where n is the specified value).  Note that some PPP
-	 * peers will respond to echo requests and some will not, and it is not
-	 * possible to autodetect this.
-	 **/
+     * NMSettingPpp:lcp-echo-interval:
+     *
+     * If non-zero, instruct pppd to send an LCP echo-request frame to the peer
+     * every n seconds (where n is the specified value).  Note that some PPP
+     * peers will respond to echo requests and some will not, and it is not
+     * possible to autodetect this.
+     **/
     obj_properties[PROP_LCP_ECHO_INTERVAL] = g_param_spec_uint(
         NM_SETTING_PPP_LCP_ECHO_INTERVAL,
         "",
diff --git a/libnm-core/nm-setting-pppoe.c b/libnm-core/nm-setting-pppoe.c
index dbdec20b8c..1d89409748 100644
--- a/libnm-core/nm-setting-pppoe.c
+++ b/libnm-core/nm-setting-pppoe.c
@@ -286,15 +286,15 @@ nm_setting_pppoe_class_init(NMSettingPppoeClass *klass)
     setting_class->need_secrets = need_secrets;
 
     /**
-	 * NMSettingPppoe:parent:
-	 *
-	 * If given, specifies the parent interface name on which this PPPoE
-	 * connection should be created.  If this property is not specified,
-	 * the connection is activated on the interface specified in
-	 * #NMSettingConnection:interface-name of #NMSettingConnection.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingPppoe:parent:
+     *
+     * If given, specifies the parent interface name on which this PPPoE
+     * connection should be created.  If this property is not specified,
+     * the connection is activated on the interface specified in
+     * #NMSettingConnection:interface-name of #NMSettingConnection.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_string(
         NM_SETTING_PPPOE_PARENT,
         "",
@@ -303,13 +303,13 @@ nm_setting_pppoe_class_init(NMSettingPppoeClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPppoe:service:
-	 *
-	 * If specified, instruct PPPoE to only initiate sessions with access
-	 * concentrators that provide the specified service.  For most providers,
-	 * this should be left blank.  It is only required if there are multiple
-	 * access concentrators or a specific service is known to be required.
-	 **/
+     * NMSettingPppoe:service:
+     *
+     * If specified, instruct PPPoE to only initiate sessions with access
+     * concentrators that provide the specified service.  For most providers,
+     * this should be left blank.  It is only required if there are multiple
+     * access concentrators or a specific service is known to be required.
+     **/
     obj_properties[PROP_SERVICE] = g_param_spec_string(NM_SETTING_PPPOE_SERVICE,
                                                        "",
                                                        "",
@@ -317,10 +317,10 @@ nm_setting_pppoe_class_init(NMSettingPppoeClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPppoe:username:
-	 *
-	 * Username used to authenticate with the PPPoE service.
-	 **/
+     * NMSettingPppoe:username:
+     *
+     * Username used to authenticate with the PPPoE service.
+     **/
     obj_properties[PROP_USERNAME] = g_param_spec_string(NM_SETTING_PPPOE_USERNAME,
                                                         "",
                                                         "",
@@ -328,10 +328,10 @@ nm_setting_pppoe_class_init(NMSettingPppoeClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPppoe:password:
-	 *
-	 * Password used to authenticate with the PPPoE service.
-	 **/
+     * NMSettingPppoe:password:
+     *
+     * Password used to authenticate with the PPPoE service.
+     **/
     obj_properties[PROP_PASSWORD] =
         g_param_spec_string(NM_SETTING_PPPOE_PASSWORD,
                             "",
@@ -340,10 +340,10 @@ nm_setting_pppoe_class_init(NMSettingPppoeClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingPppoe:password-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingPppoe:password property.
-	 **/
+     * NMSettingPppoe:password-flags:
+     *
+     * Flags indicating how to handle the #NMSettingPppoe:password property.
+     **/
     obj_properties[PROP_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_PPPOE_PASSWORD_FLAGS,
                            "",
diff --git a/libnm-core/nm-setting-proxy.c b/libnm-core/nm-setting-proxy.c
index ae13bbe367..eceb48e8e9 100644
--- a/libnm-core/nm-setting-proxy.c
+++ b/libnm-core/nm-setting-proxy.c
@@ -292,21 +292,21 @@ nm_setting_proxy_class_init(NMSettingProxyClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingProxy:method:
-	 *
-	 * Method for proxy configuration, Default is %NM_SETTING_PROXY_METHOD_NONE
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingProxy:method:
+     *
+     * Method for proxy configuration, Default is %NM_SETTING_PROXY_METHOD_NONE
+     *
+     * Since: 1.6
+     **/
     /* ---ifcfg-rh---
-	 * property: method
-	 * variable: PROXY_METHOD(+)
-	 * default: none
-	 * description: Method for proxy configuration. For "auto", WPAD is used for
-	 *   proxy configuration, or set the PAC file via PAC_URL or PAC_SCRIPT.
-	 * values: none, auto
-	 * ---end---
-	 */
+     * property: method
+     * variable: PROXY_METHOD(+)
+     * default: none
+     * description: Method for proxy configuration. For "auto", WPAD is used for
+     *   proxy configuration, or set the PAC file via PAC_URL or PAC_SCRIPT.
+     * values: none, auto
+     * ---end---
+     */
     obj_properties[PROP_METHOD] = g_param_spec_int(NM_SETTING_PROXY_METHOD,
                                                    "",
                                                    "",
@@ -316,19 +316,19 @@ nm_setting_proxy_class_init(NMSettingProxyClass *klass)
                                                    G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingProxy:browser-only:
-	 *
-	 * Whether the proxy configuration is for browser only.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingProxy:browser-only:
+     *
+     * Whether the proxy configuration is for browser only.
+     *
+     * Since: 1.6
+     **/
     /* ---ifcfg-rh---
-	 * property: browser-only
-	 * variable: BROWSER_ONLY(+)
-	 * default: no
-	 * description: Whether the proxy configuration is for browser only.
-	 * ---end---
-	 */
+     * property: browser-only
+     * variable: BROWSER_ONLY(+)
+     * default: no
+     * description: Whether the proxy configuration is for browser only.
+     * ---end---
+     */
     obj_properties[PROP_BROWSER_ONLY] =
         g_param_spec_boolean(NM_SETTING_PROXY_BROWSER_ONLY,
                              "",
@@ -337,19 +337,19 @@ nm_setting_proxy_class_init(NMSettingProxyClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingProxy:pac-url:
-	 *
-	 * PAC URL for obtaining PAC file.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingProxy:pac-url:
+     *
+     * PAC URL for obtaining PAC file.
+     *
+     * Since: 1.6
+     **/
     /* ---ifcfg-rh---
-	 * property: pac-url
-	 * variable: PAC_URL(+)
-	 * description: URL for PAC file.
-	 * example: PAC_URL=http://wpad.mycompany.com/wpad.dat
-	 * ---end---
-	 */
+     * property: pac-url
+     * variable: PAC_URL(+)
+     * description: URL for PAC file.
+     * example: PAC_URL=http://wpad.mycompany.com/wpad.dat
+     * ---end---
+     */
     obj_properties[PROP_PAC_URL] = g_param_spec_string(NM_SETTING_PROXY_PAC_URL,
                                                        "",
                                                        "",
@@ -357,19 +357,19 @@ nm_setting_proxy_class_init(NMSettingProxyClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingProxy:pac-script:
-	 *
-	 * PAC script for the connection.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMSettingProxy:pac-script:
+     *
+     * PAC script for the connection.
+     *
+     * Since: 1.6
+     **/
     /* ---ifcfg-rh---
-	 * property: pac-script
-	 * variable: PAC_SCRIPT(+)
-	 * description: Path of the PAC script.
-	 * example: PAC_SCRIPT=/home/joe/proxy.pac
-	 * ---end---
-	 */
+     * property: pac-script
+     * variable: PAC_SCRIPT(+)
+     * description: Path of the PAC script.
+     * example: PAC_SCRIPT=/home/joe/proxy.pac
+     * ---end---
+     */
     obj_properties[PROP_PAC_SCRIPT] =
         g_param_spec_string(NM_SETTING_PROXY_PAC_SCRIPT,
                             "",
diff --git a/libnm-core/nm-setting-serial.c b/libnm-core/nm-setting-serial.c
index 65eb52630d..ed20a20106 100644
--- a/libnm-core/nm-setting-serial.c
+++ b/libnm-core/nm-setting-serial.c
@@ -239,12 +239,12 @@ nm_setting_serial_class_init(NMSettingSerialClass *klass)
     object_class->set_property = set_property;
 
     /**
-	 * NMSettingSerial:baud:
-	 *
-	 * Speed to use for communication over the serial port.  Note that this
-	 * value usually has no effect for mobile broadband modems as they generally
-	 * ignore speed settings and use the highest available speed.
-	 **/
+     * NMSettingSerial:baud:
+     *
+     * Speed to use for communication over the serial port.  Note that this
+     * value usually has no effect for mobile broadband modems as they generally
+     * ignore speed settings and use the highest available speed.
+     **/
     obj_properties[PROP_BAUD] = g_param_spec_uint(NM_SETTING_SERIAL_BAUD,
                                                   "",
                                                   "",
@@ -254,10 +254,10 @@ nm_setting_serial_class_init(NMSettingSerialClass *klass)
                                                   G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingSerial:bits:
-	 *
-	 * Byte-width of the serial communication. The 8 in "8n1" for example.
-	 **/
+     * NMSettingSerial:bits:
+     *
+     * Byte-width of the serial communication. The 8 in "8n1" for example.
+     **/
     obj_properties[PROP_BITS] = g_param_spec_uint(NM_SETTING_SERIAL_BITS,
                                                   "",
                                                   "",
@@ -267,25 +267,25 @@ nm_setting_serial_class_init(NMSettingSerialClass *klass)
                                                   G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingSerial:parity:
-	 *
-	 * Parity setting of the serial port.
-	 **/
+     * NMSettingSerial:parity:
+     *
+     * Parity setting of the serial port.
+     **/
     /* ---keyfile---
-	 * property: parity
-	 * format: 'e', 'o', or 'n'
-	 * description: The connection parity; even, odd, or none. Note that older
-	 *   versions of NetworkManager stored this as an integer: 69 ('E') for even,
-	 *   111 ('o') for odd, or 110 ('n') for none.
-	 * example: parity=n
-	 * ---end---
-	 * ---dbus---
-	 * property: parity
-	 * format: byte
-	 * description: The connection parity: 69 (ASCII 'E') for even parity,
-	 *   111 (ASCII 'o') for odd, 110 (ASCII 'n') for none.
-	 * ---end---
-	 */
+     * property: parity
+     * format: 'e', 'o', or 'n'
+     * description: The connection parity; even, odd, or none. Note that older
+     *   versions of NetworkManager stored this as an integer: 69 ('E') for even,
+     *   111 ('o') for odd, or 110 ('n') for none.
+     * example: parity=n
+     * ---end---
+     * ---dbus---
+     * property: parity
+     * format: byte
+     * description: The connection parity: 69 (ASCII 'E') for even parity,
+     *   111 (ASCII 'o') for odd, 110 (ASCII 'n') for none.
+     * ---end---
+     */
     obj_properties[PROP_PARITY] = g_param_spec_enum(NM_SETTING_SERIAL_PARITY,
                                                     "",
                                                     "",
@@ -300,11 +300,11 @@ nm_setting_serial_class_init(NMSettingSerialClass *klass)
                                   .gprop_from_dbus_fcn = parity_from_dbus, ));
 
     /**
-	 * NMSettingSerial:stopbits:
-	 *
-	 * Number of stop bits for communication on the serial port.  Either 1 or 2.
-	 * The 1 in "8n1" for example.
-	 **/
+     * NMSettingSerial:stopbits:
+     *
+     * Number of stop bits for communication on the serial port.  Either 1 or 2.
+     * The 1 in "8n1" for example.
+     **/
     obj_properties[PROP_STOPBITS] = g_param_spec_uint(NM_SETTING_SERIAL_STOPBITS,
                                                       "",
                                                       "",
@@ -314,10 +314,10 @@ nm_setting_serial_class_init(NMSettingSerialClass *klass)
                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingSerial:send-delay:
-	 *
-	 * Time to delay between each byte sent to the modem, in microseconds.
-	 **/
+     * NMSettingSerial:send-delay:
+     *
+     * Time to delay between each byte sent to the modem, in microseconds.
+     **/
     obj_properties[PROP_SEND_DELAY] =
         g_param_spec_uint64(NM_SETTING_SERIAL_SEND_DELAY,
                             "",
diff --git a/libnm-core/nm-setting-sriov.c b/libnm-core/nm-setting-sriov.c
index a4af95cf8d..cf10104c8a 100644
--- a/libnm-core/nm-setting-sriov.c
+++ b/libnm-core/nm-setting-sriov.c
@@ -560,7 +560,7 @@ nm_sriov_vf_get_vlan_ids(const NMSriovVF *vf, guint *length)
         return NULL;
 
     /* vf is const, however, vlan_ids is a mutable field caching the
-	 * result ("mutable" in C++ terminology) */
+     * result ("mutable" in C++ terminology) */
     ((NMSriovVF *) vf)->vlan_ids = g_new0(guint, num);
 
     i = 0;
@@ -915,8 +915,8 @@ vfs_to_dbus(const NMSettInfoSetting *               sett_info,
             }
 
             /* VLANs are translated into an array of maps, where each map has
-			 * keys 'id', 'qos' and 'proto'. This guarantees enough flexibility
-			 * to accommodate any future new option. */
+             * keys 'id', 'qos' and 'proto'. This guarantees enough flexibility
+             * to accommodate any future new option. */
             vlan_ids = nm_sriov_vf_get_vlan_ids(vf, &num_vlans);
             if (num_vlans) {
                 GVariantBuilder vlans_builder;
@@ -1250,25 +1250,25 @@ nm_setting_sriov_class_init(NMSettingSriovClass *klass)
     setting_class->verify           = verify;
 
     /**
-	 * NMSettingSriov:total-vfs
-	 *
-	 * The total number of virtual functions to create.
-	 *
-	 * Note that when the sriov setting is present NetworkManager
-	 * enforces the number of virtual functions on the interface
-	 * (also when it is zero) during activation and resets it
-	 * upon deactivation. To prevent any changes to SR-IOV
-	 * parameters don't add a sriov setting to the connection.
-	 *
-	 * Since: 1.14
-	 **/
+     * NMSettingSriov:total-vfs
+     *
+     * The total number of virtual functions to create.
+     *
+     * Note that when the sriov setting is present NetworkManager
+     * enforces the number of virtual functions on the interface
+     * (also when it is zero) during activation and resets it
+     * upon deactivation. To prevent any changes to SR-IOV
+     * parameters don't add a sriov setting to the connection.
+     *
+     * Since: 1.14
+     **/
     /* ---ifcfg-rh---
-	 * property: total-vfs
-	 * variable: SRIOV_TOTAL_VFS(+)
-	 * description: The total number of virtual functions to create
-	 * example: SRIOV_TOTAL_VFS=16
-	 * ---end---
-	 */
+     * property: total-vfs
+     * variable: SRIOV_TOTAL_VFS(+)
+     * description: The total number of virtual functions to create
+     * example: SRIOV_TOTAL_VFS=16
+     * ---end---
+     */
     obj_properties[PROP_TOTAL_VFS] = g_param_spec_uint(
         NM_SETTING_SRIOV_TOTAL_VFS,
         "",
@@ -1279,44 +1279,44 @@ nm_setting_sriov_class_init(NMSettingSriovClass *klass)
         NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingSriov:vfs: (type GPtrArray(NMSriovVF))
-	 *
-	 * Array of virtual function descriptors.
-	 *
-	 * Each VF descriptor is a dictionary mapping attribute names
-	 * to GVariant values. The 'index' entry is mandatory for
-	 * each VF.
-	 *
-	 * When represented as string a VF is in the form:
-	 *
-	 *   "INDEX [ATTR=VALUE[ ATTR=VALUE]...]".
-	 *
-	 * for example:
-	 *
-	 *   "2 mac=00:11:22:33:44:55 spoof-check=true".
-	 *
-	 * Multiple VFs can be specified using a comma as separator.
-	 * Currently, the following attributes are supported: mac,
-	 * spoof-check, trust, min-tx-rate, max-tx-rate, vlans.
-	 *
-	 * The "vlans" attribute is represented as a semicolon-separated
-	 * list of VLAN descriptors, where each descriptor has the form
-	 *
-	 *   "ID[.PRIORITY[.PROTO]]".
-	 *
-	 * PROTO can be either 'q' for 802.1Q (the default) or 'ad' for
-	 * 802.1ad.
-	 *
-
-	 * Since: 1.14
-	 **/
+     * NMSettingSriov:vfs: (type GPtrArray(NMSriovVF))
+     *
+     * Array of virtual function descriptors.
+     *
+     * Each VF descriptor is a dictionary mapping attribute names
+     * to GVariant values. The 'index' entry is mandatory for
+     * each VF.
+     *
+     * When represented as string a VF is in the form:
+     *
+     *   "INDEX [ATTR=VALUE[ ATTR=VALUE]...]".
+     *
+     * for example:
+     *
+     *   "2 mac=00:11:22:33:44:55 spoof-check=true".
+     *
+     * Multiple VFs can be specified using a comma as separator.
+     * Currently, the following attributes are supported: mac,
+     * spoof-check, trust, min-tx-rate, max-tx-rate, vlans.
+     *
+     * The "vlans" attribute is represented as a semicolon-separated
+     * list of VLAN descriptors, where each descriptor has the form
+     *
+     *   "ID[.PRIORITY[.PROTO]]".
+     *
+     * PROTO can be either 'q' for 802.1Q (the default) or 'ad' for
+     * 802.1ad.
+     *
+
+     * Since: 1.14
+     **/
     /* ---ifcfg-rh---
-	 * property: vfs
-	 * variable: SRIOV_VF1(+), SRIOV_VF2(+), ...
-	 * description: SR-IOV virtual function descriptors
-	 * example: SRIOV_VF10="mac=00:11:22:33:44:55", ...
-	 * ---end---
-	 */
+     * property: vfs
+     * variable: SRIOV_VF1(+), SRIOV_VF2(+), ...
+     * description: SR-IOV virtual function descriptors
+     * example: SRIOV_VF10="mac=00:11:22:33:44:55", ...
+     * ---end---
+     */
     obj_properties[PROP_VFS] = g_param_spec_boxed(NM_SETTING_SRIOV_VFS,
                                                   "",
                                                   "",
@@ -1330,31 +1330,31 @@ nm_setting_sriov_class_init(NMSettingSriovClass *klass)
                                                            .from_dbus_fcn = vfs_from_dbus, ));
 
     /**
-	 * NMSettingSriov:autoprobe-drivers
-	 *
-	 * Whether to autoprobe virtual functions by a compatible driver.
-	 *
-	 * If set to %NM_TERNARY_TRUE, the kernel will try to bind VFs to
-	 * a compatible driver and if this succeeds a new network
-	 * interface will be instantiated for each VF.
-	 *
-	 * If set to %NM_TERNARY_FALSE, VFs will not be claimed and no
-	 * network interfaces will be created for them.
-	 *
-	 * When set to %NM_TERNARY_DEFAULT, the global default is used; in
-	 * case the global default is unspecified it is assumed to be
-	 * %NM_TERNARY_TRUE.
-	 *
-	 * Since: 1.14
-	 **/
+     * NMSettingSriov:autoprobe-drivers
+     *
+     * Whether to autoprobe virtual functions by a compatible driver.
+     *
+     * If set to %NM_TERNARY_TRUE, the kernel will try to bind VFs to
+     * a compatible driver and if this succeeds a new network
+     * interface will be instantiated for each VF.
+     *
+     * If set to %NM_TERNARY_FALSE, VFs will not be claimed and no
+     * network interfaces will be created for them.
+     *
+     * When set to %NM_TERNARY_DEFAULT, the global default is used; in
+     * case the global default is unspecified it is assumed to be
+     * %NM_TERNARY_TRUE.
+     *
+     * Since: 1.14
+     **/
     /* ---ifcfg-rh---
-	 * property: autoprobe-drivers
-	 * variable: SRIOV_AUTOPROBE_DRIVERS(+)
-	 * default: missing variable means global default
-	 * description: Whether to autoprobe virtual functions by a compatible driver
-	 * example: SRIOV_AUTOPROBE_DRIVERS=0,1
-	 * ---end---
-	 */
+     * property: autoprobe-drivers
+     * variable: SRIOV_AUTOPROBE_DRIVERS(+)
+     * default: missing variable means global default
+     * description: Whether to autoprobe virtual functions by a compatible driver
+     * example: SRIOV_AUTOPROBE_DRIVERS=0,1
+     * ---end---
+     */
     obj_properties[PROP_AUTOPROBE_DRIVERS] = g_param_spec_enum(
         NM_SETTING_SRIOV_AUTOPROBE_DRIVERS,
         "",
diff --git a/libnm-core/nm-setting-tc-config.c b/libnm-core/nm-setting-tc-config.c
index c15febdce6..c33d3622f4 100644
--- a/libnm-core/nm-setting-tc-config.c
+++ b/libnm-core/nm-setting-tc-config.c
@@ -824,8 +824,8 @@ _nm_tc_tfilter_hash(NMTCTfilter *tfilter)
                 guint attr_hash;
 
                 /* g_variant_hash() works only for basic types, thus
-				 * we ignore any non-basic attribute. Actions differing
-				 * only for non-basic attributes will collide. */
+                 * we ignore any non-basic attribute. Actions differing
+                 * only for non-basic attributes will collide. */
                 attr_hash = g_variant_hash(variant);
                 nm_hash_update_val(&h, attr_hash);
             }
@@ -1807,17 +1807,17 @@ nm_setting_tc_config_class_init(NMSettingTCConfigClass *klass)
     setting_class->verify           = verify;
 
     /**
-	 * NMSettingTCConfig:qdiscs: (type GPtrArray(NMTCQdisc))
-	 *
-	 * Array of TC queueing disciplines.
-	 **/
+     * NMSettingTCConfig:qdiscs: (type GPtrArray(NMTCQdisc))
+     *
+     * Array of TC queueing disciplines.
+     **/
     /* ---ifcfg-rh---
-	 * property: qdiscs
-	 * variable: QDISC1(+), QDISC2(+), ...
-	 * description: Queueing disciplines
-	 * example: QDISC1=ingress, QDISC2="root handle 1234: fq_codel"
-	 * ---end---
-	 */
+     * property: qdiscs
+     * variable: QDISC1(+), QDISC2(+), ...
+     * description: Queueing disciplines
+     * example: QDISC1=ingress, QDISC2="root handle 1234: fq_codel"
+     * ---end---
+     */
     obj_properties[PROP_QDISCS] = g_param_spec_boxed(NM_SETTING_TC_CONFIG_QDISCS,
                                                      "",
                                                      "",
@@ -1831,17 +1831,17 @@ nm_setting_tc_config_class_init(NMSettingTCConfigClass *klass)
                                                            .from_dbus_fcn = tc_qdiscs_set, ));
 
     /**
-	 * NMSettingTCConfig:tfilters: (type GPtrArray(NMTCTfilter))
-	 *
-	 * Array of TC traffic filters.
-	 **/
+     * NMSettingTCConfig:tfilters: (type GPtrArray(NMTCTfilter))
+     *
+     * Array of TC traffic filters.
+     **/
     /* ---ifcfg-rh---
-	 * property: qdiscs
-	 * variable: FILTER1(+), FILTER2(+), ...
-	 * description: Traffic filters
-	 * example: FILTER1="parent ffff: matchall action simple sdata Input", ...
-	 * ---end---
-	 */
+     * property: qdiscs
+     * variable: FILTER1(+), FILTER2(+), ...
+     * description: Traffic filters
+     * example: FILTER1="parent ffff: matchall action simple sdata Input", ...
+     * ---end---
+     */
     obj_properties[PROP_TFILTERS] = g_param_spec_boxed(
         NM_SETTING_TC_CONFIG_TFILTERS,
         "",
diff --git a/libnm-core/nm-setting-team-port.c b/libnm-core/nm-setting-team-port.c
index 05d49d59f4..e56d7ad7a1 100644
--- a/libnm-core/nm-setting-team-port.c
+++ b/libnm-core/nm-setting-team-port.c
@@ -362,9 +362,9 @@ compare_property(const NMSettInfoSetting *sett_info,
         if (set_b) {
             if (NM_FLAGS_HAS(flags, NM_SETTING_COMPARE_FLAG_INFERRABLE)) {
                 /* If we are trying to match a connection in order to assume it (and thus
-				 * @flags contains INFERRABLE), use the "relaxed" matching for team
-				 * configuration. Otherwise, for all other purposes (including connection
-				 * comparison before an update), resort to the default string comparison. */
+                 * @flags contains INFERRABLE), use the "relaxed" matching for team
+                 * configuration. Otherwise, for all other purposes (including connection
+                 * comparison before an update), resort to the default string comparison. */
                 return TRUE;
             }
 
@@ -535,19 +535,19 @@ nm_setting_team_port_class_init(NMSettingTeamPortClass *klass)
     setting_class->init_from_dbus            = init_from_dbus;
 
     /**
-	 * NMSettingTeamPort:config:
-	 *
-	 * The JSON configuration for the team port. The property should contain raw
-	 * JSON configuration data suitable for teamd, because the value is passed
-	 * directly to teamd. If not specified, the default configuration is
-	 * used. See man teamd.conf for the format details.
-	 **/
+     * NMSettingTeamPort:config:
+     *
+     * The JSON configuration for the team port. The property should contain raw
+     * JSON configuration data suitable for teamd, because the value is passed
+     * directly to teamd. If not specified, the default configuration is
+     * used. See man teamd.conf for the format details.
+     **/
     /* ---ifcfg-rh---
-	 * property: config
-	 * variable: TEAM_PORT_CONFIG
-	 * description: Team port configuration in JSON. See man teamd.conf for details.
-	 * ---end---
-	 */
+     * property: config
+     * variable: TEAM_PORT_CONFIG
+     * description: Team port configuration in JSON. See man teamd.conf for details.
+     * ---end---
+     */
     obj_properties[NM_TEAM_ATTRIBUTE_CONFIG] = g_param_spec_string(
         NM_SETTING_TEAM_PORT_CONFIG,
         "",
@@ -559,13 +559,13 @@ nm_setting_team_port_class_init(NMSettingTeamPortClass *klass)
                                  &nm_sett_info_propert_type_team_s);
 
     /**
-	 * NMSettingTeamPort:queue-id:
-	 *
-	 * Corresponds to the teamd ports.PORTIFNAME.queue_id.
-	 * When set to -1 means the parameter is skipped from the json config.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeamPort:queue-id:
+     *
+     * Corresponds to the teamd ports.PORTIFNAME.queue_id.
+     * When set to -1 means the parameter is skipped from the json config.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_PORT_QUEUE_ID] =
         g_param_spec_int(NM_SETTING_TEAM_PORT_QUEUE_ID,
                          "",
@@ -579,12 +579,12 @@ nm_setting_team_port_class_init(NMSettingTeamPortClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeamPort:prio:
-	 *
-	 * Corresponds to the teamd ports.PORTIFNAME.prio.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeamPort:prio:
+     *
+     * Corresponds to the teamd ports.PORTIFNAME.prio.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_PORT_PRIO] =
         g_param_spec_int(NM_SETTING_TEAM_PORT_PRIO,
                          "",
@@ -598,12 +598,12 @@ nm_setting_team_port_class_init(NMSettingTeamPortClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeamPort:sticky:
-	 *
-	 * Corresponds to the teamd ports.PORTIFNAME.sticky.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeamPort:sticky:
+     *
+     * Corresponds to the teamd ports.PORTIFNAME.sticky.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_PORT_STICKY] =
         g_param_spec_boolean(NM_SETTING_TEAM_PORT_STICKY,
                              "",
@@ -615,12 +615,12 @@ nm_setting_team_port_class_init(NMSettingTeamPortClass *klass)
                                  &nm_sett_info_propert_type_team_b);
 
     /**
-	 * NMSettingTeamPort:lacp-prio:
-	 *
-	 * Corresponds to the teamd ports.PORTIFNAME.lacp_prio.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeamPort:lacp-prio:
+     *
+     * Corresponds to the teamd ports.PORTIFNAME.lacp_prio.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_PORT_LACP_PRIO] =
         g_param_spec_int(NM_SETTING_TEAM_PORT_LACP_PRIO,
                          "",
@@ -634,12 +634,12 @@ nm_setting_team_port_class_init(NMSettingTeamPortClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeamPort:lacp-key:
-	 *
-	 * Corresponds to the teamd ports.PORTIFNAME.lacp_key.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeamPort:lacp-key:
+     *
+     * Corresponds to the teamd ports.PORTIFNAME.lacp_key.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_PORT_LACP_KEY] =
         g_param_spec_int(NM_SETTING_TEAM_PORT_LACP_KEY,
                          "",
@@ -653,19 +653,19 @@ nm_setting_team_port_class_init(NMSettingTeamPortClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeamPort:link-watchers: (type GPtrArray(NMTeamLinkWatcher))
-	 *
-	 * Link watchers configuration for the connection: each link watcher is
-	 * defined by a dictionary, whose keys depend upon the selected link
-	 * watcher. Available link watchers are 'ethtool', 'nsna_ping' and
-	 * 'arp_ping' and it is specified in the dictionary with the key 'name'.
-	 * Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait';
-	 * nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host';
-	 * arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active',
-	 * 'validate-inactive', 'send-always'. See teamd.conf man for more details.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeamPort:link-watchers: (type GPtrArray(NMTeamLinkWatcher))
+     *
+     * Link watchers configuration for the connection: each link watcher is
+     * defined by a dictionary, whose keys depend upon the selected link
+     * watcher. Available link watchers are 'ethtool', 'nsna_ping' and
+     * 'arp_ping' and it is specified in the dictionary with the key 'name'.
+     * Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait';
+     * nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host';
+     * arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active',
+     * 'validate-inactive', 'send-always'. See teamd.conf man for more details.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_LINK_WATCHERS] =
         g_param_spec_boxed(NM_SETTING_TEAM_PORT_LINK_WATCHERS,
                            "",
diff --git a/libnm-core/nm-setting-team.c b/libnm-core/nm-setting-team.c
index c785c87836..e061175a68 100644
--- a/libnm-core/nm-setting-team.c
+++ b/libnm-core/nm-setting-team.c
@@ -1281,9 +1281,9 @@ compare_property(const NMSettInfoSetting *sett_info,
         if (set_b) {
             if (NM_FLAGS_HAS(flags, NM_SETTING_COMPARE_FLAG_INFERRABLE)) {
                 /* If we are trying to match a connection in order to assume it (and thus
-				 * @flags contains INFERRABLE), use the "relaxed" matching for team
-				 * configuration. Otherwise, for all other purposes (including connection
-				 * comparison before an update), resort to the default string comparison. */
+                 * @flags contains INFERRABLE), use the "relaxed" matching for team
+                 * configuration. Otherwise, for all other purposes (including connection
+                 * comparison before an update), resort to the default string comparison. */
                 return TRUE;
             }
 
@@ -1491,19 +1491,19 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
     setting_class->init_from_dbus            = init_from_dbus;
 
     /**
-	 * NMSettingTeam:config:
-	 *
-	 * The JSON configuration for the team network interface.  The property
-	 * should contain raw JSON configuration data suitable for teamd, because
-	 * the value is passed directly to teamd. If not specified, the default
-	 * configuration is used.  See man teamd.conf for the format details.
-	 **/
+     * NMSettingTeam:config:
+     *
+     * The JSON configuration for the team network interface.  The property
+     * should contain raw JSON configuration data suitable for teamd, because
+     * the value is passed directly to teamd. If not specified, the default
+     * configuration is used.  See man teamd.conf for the format details.
+     **/
     /* ---ifcfg-rh---
-	 * property: config
-	 * variable: TEAM_CONFIG
-	 * description: Team configuration in JSON. See man teamd.conf for details.
-	 * ---end---
-	 */
+     * property: config
+     * variable: TEAM_CONFIG
+     * description: Team configuration in JSON. See man teamd.conf for details.
+     * ---end---
+     */
     obj_properties[NM_TEAM_ATTRIBUTE_CONFIG] = g_param_spec_string(
         NM_SETTING_TEAM_CONFIG,
         "",
@@ -1515,12 +1515,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_s);
 
     /**
-	 * NMSettingTeam:notify-peers-count:
-	 *
-	 * Corresponds to the teamd notify_peers.count.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:notify-peers-count:
+     *
+     * Corresponds to the teamd notify_peers.count.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_NOTIFY_PEERS_COUNT] =
         g_param_spec_int(NM_SETTING_TEAM_NOTIFY_PEERS_COUNT,
                          "",
@@ -1534,12 +1534,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeam:notify-peers-interval:
-	 *
-	 * Corresponds to the teamd notify_peers.interval.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:notify-peers-interval:
+     *
+     * Corresponds to the teamd notify_peers.interval.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_NOTIFY_PEERS_INTERVAL] =
         g_param_spec_int(NM_SETTING_TEAM_NOTIFY_PEERS_INTERVAL,
                          "",
@@ -1553,12 +1553,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeam:mcast-rejoin-count:
-	 *
-	 * Corresponds to the teamd mcast_rejoin.count.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:mcast-rejoin-count:
+     *
+     * Corresponds to the teamd mcast_rejoin.count.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_MCAST_REJOIN_COUNT] =
         g_param_spec_int(NM_SETTING_TEAM_MCAST_REJOIN_COUNT,
                          "",
@@ -1572,12 +1572,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeam:mcast-rejoin-interval:
-	 *
-	 * Corresponds to the teamd mcast_rejoin.interval.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:mcast-rejoin-interval:
+     *
+     * Corresponds to the teamd mcast_rejoin.interval.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_MCAST_REJOIN_INTERVAL] =
         g_param_spec_int(NM_SETTING_TEAM_MCAST_REJOIN_INTERVAL,
                          "",
@@ -1591,14 +1591,14 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeam:runner:
-	 *
-	 * Corresponds to the teamd runner.name.
-	 * Permitted values are: "roundrobin", "broadcast", "activebackup",
-	 * "loadbalance", "lacp", "random".
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner:
+     *
+     * Corresponds to the teamd runner.name.
+     * Permitted values are: "roundrobin", "broadcast", "activebackup",
+     * "loadbalance", "lacp", "random".
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER] =
         g_param_spec_string(NM_SETTING_TEAM_RUNNER,
                             "",
@@ -1610,12 +1610,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_s);
 
     /**
-	 * NMSettingTeam:runner-hwaddr-policy:
-	 *
-	 * Corresponds to the teamd runner.hwaddr_policy.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-hwaddr-policy:
+     *
+     * Corresponds to the teamd runner.hwaddr_policy.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_HWADDR_POLICY] =
         g_param_spec_string(NM_SETTING_TEAM_RUNNER_HWADDR_POLICY,
                             "",
@@ -1627,12 +1627,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_s);
 
     /**
-	 * NMSettingTeam:runner-tx-hash:
-	 *
-	 * Corresponds to the teamd runner.tx_hash.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-tx-hash:
+     *
+     * Corresponds to the teamd runner.tx_hash.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_TX_HASH] = g_param_spec_boxed(
         NM_SETTING_TEAM_RUNNER_TX_HASH,
         "",
@@ -1644,12 +1644,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_as);
 
     /**
-	 * NMSettingTeam:runner-tx-balancer:
-	 *
-	 * Corresponds to the teamd runner.tx_balancer.name.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-tx-balancer:
+     *
+     * Corresponds to the teamd runner.tx_balancer.name.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_TX_BALANCER] =
         g_param_spec_string(NM_SETTING_TEAM_RUNNER_TX_BALANCER,
                             "",
@@ -1661,12 +1661,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_s);
 
     /**
-	 * NMSettingTeam:runner-tx-balancer-interval:
-	 *
-	 * Corresponds to the teamd runner.tx_balancer.interval.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-tx-balancer-interval:
+     *
+     * Corresponds to the teamd runner.tx_balancer.interval.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_TX_BALANCER_INTERVAL] =
         g_param_spec_int(NM_SETTING_TEAM_RUNNER_TX_BALANCER_INTERVAL,
                          "",
@@ -1681,12 +1681,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
         &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeam:runner-active:
-	 *
-	 * Corresponds to the teamd runner.active.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-active:
+     *
+     * Corresponds to the teamd runner.active.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_ACTIVE] =
         g_param_spec_boolean(NM_SETTING_TEAM_RUNNER_ACTIVE,
                              "",
@@ -1698,12 +1698,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_b);
 
     /**
-	 * NMSettingTeam:runner-fast-rate:
-	 *
-	 * Corresponds to the teamd runner.fast_rate.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-fast-rate:
+     *
+     * Corresponds to the teamd runner.fast_rate.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_FAST_RATE] =
         g_param_spec_boolean(NM_SETTING_TEAM_RUNNER_FAST_RATE,
                              "",
@@ -1715,12 +1715,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_b);
 
     /**
-	 * NMSettingTeam:runner-sys-prio:
-	 *
-	 * Corresponds to the teamd runner.sys_prio.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-sys-prio:
+     *
+     * Corresponds to the teamd runner.sys_prio.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_SYS_PRIO] =
         g_param_spec_int(NM_SETTING_TEAM_RUNNER_SYS_PRIO,
                          "",
@@ -1734,12 +1734,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeam:runner-min-ports:
-	 *
-	 * Corresponds to the teamd runner.min_ports.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-min-ports:
+     *
+     * Corresponds to the teamd runner.min_ports.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_MIN_PORTS] =
         g_param_spec_int(NM_SETTING_TEAM_RUNNER_MIN_PORTS,
                          "",
@@ -1753,12 +1753,12 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_i);
 
     /**
-	 * NMSettingTeam:runner-agg-select-policy:
-	 *
-	 * Corresponds to the teamd runner.agg_select_policy.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:runner-agg-select-policy:
+     *
+     * Corresponds to the teamd runner.agg_select_policy.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_MASTER_RUNNER_AGG_SELECT_POLICY] =
         g_param_spec_string(NM_SETTING_TEAM_RUNNER_AGG_SELECT_POLICY,
                             "",
@@ -1770,19 +1770,19 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_s);
 
     /**
-	 * NMSettingTeam:link-watchers: (type GPtrArray(NMTeamLinkWatcher))
-	 *
-	 * Link watchers configuration for the connection: each link watcher is
-	 * defined by a dictionary, whose keys depend upon the selected link
-	 * watcher. Available link watchers are 'ethtool', 'nsna_ping' and
-	 * 'arp_ping' and it is specified in the dictionary with the key 'name'.
-	 * Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait';
-	 * nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host';
-	 * arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active',
-	 * 'validate-inactive', 'send-always'. See teamd.conf man for more details.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingTeam:link-watchers: (type GPtrArray(NMTeamLinkWatcher))
+     *
+     * Link watchers configuration for the connection: each link watcher is
+     * defined by a dictionary, whose keys depend upon the selected link
+     * watcher. Available link watchers are 'ethtool', 'nsna_ping' and
+     * 'arp_ping' and it is specified in the dictionary with the key 'name'.
+     * Available keys are:   ethtool: 'delay-up', 'delay-down', 'init-wait';
+     * nsna_ping: 'init-wait', 'interval', 'missed-max', 'target-host';
+     * arp_ping: all the ones in nsna_ping and 'source-host', 'validate-active',
+     * 'validate-inactive', 'send-always'. See teamd.conf man for more details.
+     *
+     * Since: 1.12
+     **/
     obj_properties[NM_TEAM_ATTRIBUTE_LINK_WATCHERS] =
         g_param_spec_boxed(NM_SETTING_TEAM_LINK_WATCHERS,
                            "",
@@ -1794,13 +1794,13 @@ nm_setting_team_class_init(NMSettingTeamClass *klass)
                                  &nm_sett_info_propert_type_team_link_watchers);
 
     /* ---dbus---
-	 * property: interface-name
-	 * format: string
-	 * description: Deprecated in favor of connection.interface-name, but can
-	 *   be used for backward-compatibility with older daemons, to set the
-	 *   team's interface name.
-	 * ---end---
-	 */
+     * property: interface-name
+     * format: string
+     * description: Deprecated in favor of connection.interface-name, but can
+     *   be used for backward-compatibility with older daemons, to set the
+     *   team's interface name.
+     * ---end---
+     */
     _nm_properties_override_dbus(properties_override,
                                  "interface-name",
                                  &nm_sett_info_propert_type_deprecated_interface_name);
diff --git a/libnm-core/nm-setting-tun.c b/libnm-core/nm-setting-tun.c
index 85c8ba39c6..6e65d84dfd 100644
--- a/libnm-core/nm-setting-tun.c
+++ b/libnm-core/nm-setting-tun.c
@@ -296,15 +296,15 @@ nm_setting_tun_class_init(NMSettingTunClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingTun:mode:
-	 *
-	 * The operating mode of the virtual device. Allowed values are
-	 * %NM_SETTING_TUN_MODE_TUN to create a layer 3 device and
-	 * %NM_SETTING_TUN_MODE_TAP to create an Ethernet-like layer 2
-	 * one.
-	 *
-	 * Since: 1.2
-	 */
+     * NMSettingTun:mode:
+     *
+     * The operating mode of the virtual device. Allowed values are
+     * %NM_SETTING_TUN_MODE_TUN to create a layer 3 device and
+     * %NM_SETTING_TUN_MODE_TAP to create an Ethernet-like layer 2
+     * one.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_MODE] =
         g_param_spec_uint(NM_SETTING_TUN_MODE,
                           "",
@@ -315,13 +315,13 @@ nm_setting_tun_class_init(NMSettingTunClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingTun:owner:
-	 *
-	 * The user ID which will own the device. If set to %NULL everyone
-	 * will be able to use the device.
-	 *
-	 * Since: 1.2
-	 */
+     * NMSettingTun:owner:
+     *
+     * The user ID which will own the device. If set to %NULL everyone
+     * will be able to use the device.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_OWNER] = g_param_spec_string(NM_SETTING_TUN_OWNER,
                                                      "",
                                                      "",
@@ -330,13 +330,13 @@ nm_setting_tun_class_init(NMSettingTunClass *klass)
                                                          | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingTun:group:
-	 *
-	 * The group ID which will own the device. If set to %NULL everyone
-	 * will be able to use the device.
-	 *
-	 * Since: 1.2
-	 */
+     * NMSettingTun:group:
+     *
+     * The group ID which will own the device. If set to %NULL everyone
+     * will be able to use the device.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_GROUP] = g_param_spec_string(NM_SETTING_TUN_GROUP,
                                                      "",
                                                      "",
@@ -345,13 +345,13 @@ nm_setting_tun_class_init(NMSettingTunClass *klass)
                                                          | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingTun:pi:
-	 *
-	 * If %TRUE the interface will prepend a 4 byte header describing the
-	 * physical interface to the packets.
-	 *
-	 * Since: 1.2
-	 */
+     * NMSettingTun:pi:
+     *
+     * If %TRUE the interface will prepend a 4 byte header describing the
+     * physical interface to the packets.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_PI] = g_param_spec_boolean(NM_SETTING_TUN_PI,
                                                    "",
                                                    "",
@@ -360,13 +360,13 @@ nm_setting_tun_class_init(NMSettingTunClass *klass)
                                                        | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingTun:vnet-hdr:
-	 *
-	 * If %TRUE the IFF_VNET_HDR the tunnel packets will include a virtio
-	 * network header.
-	 *
-	 * Since: 1.2
-	 */
+     * NMSettingTun:vnet-hdr:
+     *
+     * If %TRUE the IFF_VNET_HDR the tunnel packets will include a virtio
+     * network header.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_VNET_HDR] = g_param_spec_boolean(
         NM_SETTING_TUN_VNET_HDR,
         "",
@@ -375,15 +375,15 @@ nm_setting_tun_class_init(NMSettingTunClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingTun:multi-queue:
-	 *
-	 * If the property is set to %TRUE, the interface will support
-	 * multiple file descriptors (queues) to parallelize packet
-	 * sending or receiving. Otherwise, the interface will only
-	 * support a single queue.
-	 *
-	 * Since: 1.2
-	 */
+     * NMSettingTun:multi-queue:
+     *
+     * If the property is set to %TRUE, the interface will support
+     * multiple file descriptors (queues) to parallelize packet
+     * sending or receiving. Otherwise, the interface will only
+     * support a single queue.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_MULTI_QUEUE] = g_param_spec_boolean(
         NM_SETTING_TUN_MULTI_QUEUE,
         "",
diff --git a/libnm-core/nm-setting-user.c b/libnm-core/nm-setting-user.c
index f881c5bcfb..9a079fe2cb 100644
--- a/libnm-core/nm-setting-user.c
+++ b/libnm-core/nm-setting-user.c
@@ -55,7 +55,7 @@ static gboolean
 _key_char_is_regular(char ch)
 {
     /* allow words of printable characters, plus some
-	 * special characters, for example to support base64 encoding. */
+     * special characters, for example to support base64 encoding. */
     return (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9')
            || NM_IN_SET(ch, '-', '_', '+', '/', '=');
 }
@@ -112,9 +112,9 @@ nm_setting_user_check_key(const char *key, GError **error)
         ch = (key++)[0];
 
         /* Allow something that looks like a FQN, separating namespaces by a single '.'
-		 * We want to print the keys nicely in nmcli requiring escaping.
-		 *
-		 * If a user really has to encode special values in the name, he may base64 encode it. */
+         * We want to print the keys nicely in nmcli requiring escaping.
+         *
+         * If a user really has to encode special values in the name, he may base64 encode it. */
 
         if (!_key_char_is_regular(ch))
             break;
@@ -235,7 +235,7 @@ nm_setting_user_get_keys(NMSettingUser *setting, guint *out_len)
     priv->keys = nm_utils_strdict_get_keys(priv->data, TRUE, out_len);
 
     /* don't return %NULL, but hijack the @keys fields as a pseudo
-	 * empty strv array. */
+     * empty strv array. */
     return priv->keys ?: ((const char **) &priv->keys);
 }
 
@@ -334,7 +334,7 @@ nm_setting_user_set_data(NMSettingUser *setting, const char *key, const char *va
 out:
     if (priv->data_invalid) {
         /* setting a value purges all invalid values that were set
-		 * via GObject property. */
+         * via GObject property. */
         changed = TRUE;
         nm_clear_pointer(&priv->data_invalid, g_hash_table_unref);
     }
@@ -556,26 +556,26 @@ nm_setting_user_class_init(NMSettingUserClass *klass)
     setting_class->verify           = verify;
 
     /**
-	 * NMSettingUser:data: (type GHashTable(utf8,utf8))
-	 *
-	 * A dictionary of key/value pairs with user data. This data is ignored by NetworkManager
-	 * and can be used at the users discretion. The keys only support a strict ascii format,
-	 * but the values can be arbitrary UTF8 strings up to a certain length.
-	 *
-	 * Since: 1.8
-	 **/
+     * NMSettingUser:data: (type GHashTable(utf8,utf8))
+     *
+     * A dictionary of key/value pairs with user data. This data is ignored by NetworkManager
+     * and can be used at the users discretion. The keys only support a strict ascii format,
+     * but the values can be arbitrary UTF8 strings up to a certain length.
+     *
+     * Since: 1.8
+     **/
     /* ---ifcfg-rh---
-	 * property: data
-	 * variable: NM_USER_*
-	 * description: each key/value pair is stored as a separate variable with
-	 *   name composed by concatenating NM_USER_ with the encoded key. The key is
-	 *   encoded by substituting lowercase letters with uppercase and prepending
-	 *   uppercase letters with an underscore. A dot is encoded as a double
-	 *   underscore. Remaining characters are encoded as underscore followed by a
-	 *   3 digit octal representation of the character.
-	 * example: NM_USER_FOO__BAR=something
-	 * ---end---
-	 */
+     * property: data
+     * variable: NM_USER_*
+     * description: each key/value pair is stored as a separate variable with
+     *   name composed by concatenating NM_USER_ with the encoded key. The key is
+     *   encoded by substituting lowercase letters with uppercase and prepending
+     *   uppercase letters with an underscore. A dot is encoded as a double
+     *   underscore. Remaining characters are encoded as underscore followed by a
+     *   3 digit octal representation of the character.
+     * example: NM_USER_FOO__BAR=something
+     * ---end---
+     */
     obj_properties[PROP_DATA] = g_param_spec_boxed(NM_SETTING_USER_DATA,
                                                    "",
                                                    "",
diff --git a/libnm-core/nm-setting-vlan.c b/libnm-core/nm-setting-vlan.c
index 05e68f4263..b1607dee61 100644
--- a/libnm-core/nm-setting-vlan.c
+++ b/libnm-core/nm-setting-vlan.c
@@ -576,8 +576,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     if (priv->parent) {
         if (nm_utils_is_uuid(priv->parent)) {
             /* If we have an NMSettingConnection:master with slave-type="vlan",
-			 * then it must be the same UUID.
-			 */
+             * then it must be the same UUID.
+             */
             if (s_con) {
                 const char *master = NULL, *slave_type = NULL;
 
@@ -612,8 +612,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
         }
     } else {
         /* If parent is NULL, the parent must be specified via
-		 * NMSettingWired:mac-address.
-		 */
+         * NMSettingWired:mac-address.
+         */
         if (connection && (!s_wired || !nm_setting_wired_get_mac_address(s_wired))) {
             g_set_error(error,
                         NM_CONNECTION_ERROR,
@@ -647,8 +647,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
 
     if (connection && !s_wired) {
         /* technically, a VLAN setting does not require an ethernet setting. However,
-		 * the ifcfg-rh reader always adds a ethernet setting when reading a vlan setting.
-		 * Thus, in order to be consistent, always add one via normalization. */
+         * the ifcfg-rh reader always adds a ethernet setting when reading a vlan setting.
+         * Thus, in order to be consistent, always add one via normalization. */
         g_set_error_literal(error,
                             NM_CONNECTION_ERROR,
                             NM_CONNECTION_ERROR_SETTING_NOT_FOUND,
@@ -679,7 +679,7 @@ _override_flags_not_set(NMSetting *         setting,
                         GError **           error)
 {
     /* we changed the default value for FLAGS. When an older client
-	 * doesn't serialize the property, we assume it is the old default. */
+     * doesn't serialize the property, we assume it is the old default. */
     g_object_set(G_OBJECT(setting), NM_SETTING_VLAN_FLAGS, (NMVlanFlags) 0, NULL);
     return TRUE;
 }
@@ -835,19 +835,19 @@ nm_setting_vlan_class_init(NMSettingVlanClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingVlan:parent:
-	 *
-	 * If given, specifies the parent interface name or parent connection UUID
-	 * from which this VLAN interface should be created.  If this property is
-	 * not specified, the connection must contain an #NMSettingWired setting
-	 * with a #NMSettingWired:mac-address property.
-	 **/
+     * NMSettingVlan:parent:
+     *
+     * If given, specifies the parent interface name or parent connection UUID
+     * from which this VLAN interface should be created.  If this property is
+     * not specified, the connection must contain an #NMSettingWired setting
+     * with a #NMSettingWired:mac-address property.
+     **/
     /* ---ifcfg-rh---
-	 * property: parent
-	 * variable: DEVICE or PHYSDEV
-	 * description: Parent interface of the VLAN.
-	 * ---end---
-	 */
+     * property: parent
+     * variable: DEVICE or PHYSDEV
+     * description: Parent interface of the VLAN.
+     * ---end---
+     */
     obj_properties[PROP_PARENT] = g_param_spec_string(
         NM_SETTING_VLAN_PARENT,
         "",
@@ -856,17 +856,17 @@ nm_setting_vlan_class_init(NMSettingVlanClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVlan:id:
-	 *
-	 * The VLAN identifier that the interface created by this connection should
-	 * be assigned. The valid range is from 0 to 4094, without the reserved id 4095.
-	 **/
+     * NMSettingVlan:id:
+     *
+     * The VLAN identifier that the interface created by this connection should
+     * be assigned. The valid range is from 0 to 4094, without the reserved id 4095.
+     **/
     /* ---ifcfg-rh---
-	 * property: id
-	 * variable: VLAN_ID or DEVICE
-	 * description: VLAN identifier.
-	 * ---end---
-	 */
+     * property: id
+     * variable: VLAN_ID or DEVICE
+     * description: VLAN identifier.
+     * ---end---
+     */
     obj_properties[PROP_ID] =
         g_param_spec_uint(NM_SETTING_VLAN_ID,
                           "",
@@ -877,27 +877,27 @@ nm_setting_vlan_class_init(NMSettingVlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVlan:flags:
-	 *
-	 * One or more flags which control the behavior and features of the VLAN
-	 * interface.  Flags include %NM_VLAN_FLAG_REORDER_HEADERS (reordering of
-	 * output packet headers), %NM_VLAN_FLAG_GVRP (use of the GVRP protocol),
-	 * and %NM_VLAN_FLAG_LOOSE_BINDING (loose binding of the interface to its
-	 * master device's operating state). %NM_VLAN_FLAG_MVRP (use of the MVRP
-	 * protocol).
-	 *
-	 * The default value of this property is NM_VLAN_FLAG_REORDER_HEADERS,
-	 * but it used to be 0. To preserve backward compatibility, the default-value
-	 * in the D-Bus API continues to be 0 and a missing property on D-Bus
-	 * is still considered as 0.
-	 **/
+     * NMSettingVlan:flags:
+     *
+     * One or more flags which control the behavior and features of the VLAN
+     * interface.  Flags include %NM_VLAN_FLAG_REORDER_HEADERS (reordering of
+     * output packet headers), %NM_VLAN_FLAG_GVRP (use of the GVRP protocol),
+     * and %NM_VLAN_FLAG_LOOSE_BINDING (loose binding of the interface to its
+     * master device's operating state). %NM_VLAN_FLAG_MVRP (use of the MVRP
+     * protocol).
+     *
+     * The default value of this property is NM_VLAN_FLAG_REORDER_HEADERS,
+     * but it used to be 0. To preserve backward compatibility, the default-value
+     * in the D-Bus API continues to be 0 and a missing property on D-Bus
+     * is still considered as 0.
+     **/
     /* ---ifcfg-rh---
-	 * property: flags
-	 * variable: GVRP, MVRP, VLAN_FLAGS
-	 * values: "yes or "no" for GVRP and MVRP; "LOOSE_BINDING" and "NO_REORDER_HDR" for VLAN_FLAGS
-	 * description: VLAN flags.
-	 * ---end---
-	 */
+     * property: flags
+     * variable: GVRP, MVRP, VLAN_FLAGS
+     * values: "yes or "no" for GVRP and MVRP; "LOOSE_BINDING" and "NO_REORDER_HDR" for VLAN_FLAGS
+     * description: VLAN flags.
+     * ---end---
+     */
     obj_properties[PROP_FLAGS] = g_param_spec_flags(NM_SETTING_VLAN_FLAGS,
                                                     "",
                                                     "",
@@ -913,19 +913,19 @@ nm_setting_vlan_class_init(NMSettingVlanClass *klass)
                                   .missing_from_dbus_fcn = _override_flags_not_set, ));
 
     /**
-	 * NMSettingVlan:ingress-priority-map:
-	 *
-	 * For incoming packets, a list of mappings from 802.1p priorities to Linux
-	 * SKB priorities.  The mapping is given in the format "from:to" where both
-	 * "from" and "to" are unsigned integers, ie "7:3".
-	 **/
+     * NMSettingVlan:ingress-priority-map:
+     *
+     * For incoming packets, a list of mappings from 802.1p priorities to Linux
+     * SKB priorities.  The mapping is given in the format "from:to" where both
+     * "from" and "to" are unsigned integers, ie "7:3".
+     **/
     /* ---ifcfg-rh---
-	 * property: ingress-priority-map
-	 * variable: VLAN_INGRESS_PRIORITY_MAP
-	 * description: Ingress priority mapping.
-	 * example: VLAN_INGRESS_PRIORITY_MAP=4:2,3:5
-	 * ---end---
-	 */
+     * property: ingress-priority-map
+     * variable: VLAN_INGRESS_PRIORITY_MAP
+     * description: Ingress priority mapping.
+     * example: VLAN_INGRESS_PRIORITY_MAP=4:2,3:5
+     * ---end---
+     */
     obj_properties[PROP_INGRESS_PRIORITY_MAP] = g_param_spec_boxed(
         NM_SETTING_VLAN_INGRESS_PRIORITY_MAP,
         "",
@@ -934,19 +934,19 @@ nm_setting_vlan_class_init(NMSettingVlanClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVlan:egress-priority-map:
-	 *
-	 * For outgoing packets, a list of mappings from Linux SKB priorities to
-	 * 802.1p priorities.  The mapping is given in the format "from:to" where
-	 * both "from" and "to" are unsigned integers, ie "7:3".
-	 **/
+     * NMSettingVlan:egress-priority-map:
+     *
+     * For outgoing packets, a list of mappings from Linux SKB priorities to
+     * 802.1p priorities.  The mapping is given in the format "from:to" where
+     * both "from" and "to" are unsigned integers, ie "7:3".
+     **/
     /* ---ifcfg-rh---
-	 * property: egress-priority-map
-	 * variable: VLAN_EGRESS_PRIORITY_MAP
-	 * description: Egress priority mapping.
-	 * example: VLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7
-	 * ---end---
-	 */
+     * property: egress-priority-map
+     * variable: VLAN_EGRESS_PRIORITY_MAP
+     * description: Egress priority mapping.
+     * example: VLAN_EGRESS_PRIORITY_MAP=5:4,4:1,3:7
+     * ---end---
+     */
     obj_properties[PROP_EGRESS_PRIORITY_MAP] = g_param_spec_boxed(
         NM_SETTING_VLAN_EGRESS_PRIORITY_MAP,
         "",
@@ -955,21 +955,21 @@ nm_setting_vlan_class_init(NMSettingVlanClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /* ---ifcfg-rh---
-	 * property: interface-name
-	 * variable: PHYSDEV and VLAN_ID, or DEVICE
-	 * description: VLAN interface name.
-	 *   If all variables are set, parent device from PHYSDEV takes precedence over DEVICE,
-	 *   but VLAN id from DEVICE takes precedence over VLAN_ID.
-	 * example: PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12
-	 * ---end---
-	 * ---dbus---
-	 * property: interface-name
-	 * format: string
-	 * description: Deprecated in favor of connection.interface-name, but can
-	 *   be used for backward-compatibility with older daemons, to set the
-	 *   vlan's interface name.
-	 * ---end---
-	 */
+     * property: interface-name
+     * variable: PHYSDEV and VLAN_ID, or DEVICE
+     * description: VLAN interface name.
+     *   If all variables are set, parent device from PHYSDEV takes precedence over DEVICE,
+     *   but VLAN id from DEVICE takes precedence over VLAN_ID.
+     * example: PHYSDEV=eth0, VLAN_ID=12; or DEVICE=eth0.12
+     * ---end---
+     * ---dbus---
+     * property: interface-name
+     * format: string
+     * description: Deprecated in favor of connection.interface-name, but can
+     *   be used for backward-compatibility with older daemons, to set the
+     *   vlan's interface name.
+     * ---end---
+     */
     _nm_properties_override_dbus(properties_override,
                                  "interface-name",
                                  &nm_sett_info_propert_type_deprecated_interface_name);
diff --git a/libnm-core/nm-setting-vlan.h b/libnm-core/nm-setting-vlan.h
index 5cfd68709a..9fb202a2fb 100644
--- a/libnm-core/nm-setting-vlan.h
+++ b/libnm-core/nm-setting-vlan.h
@@ -87,7 +87,7 @@ typedef enum { /*< flags >*/
                /* NOTE: if adding flags update nm-setting-vlan.c::verify() */
 
                /* NOTE: these flags must correspond to the value from the kernel
-	 * header files. */
+     * header files. */
 } NMVlanFlags;
 
 #define NM_VLAN_FLAGS_ALL                                                          \
diff --git a/libnm-core/nm-setting-vpn.c b/libnm-core/nm-setting-vpn.c
index b1d4e3f57b..6aba1f073f 100644
--- a/libnm-core/nm-setting-vpn.c
+++ b/libnm-core/nm-setting-vpn.c
@@ -42,32 +42,32 @@ typedef struct {
     char *service_type;
 
     /* username of the user requesting this connection, thus
-	 * it's really only valid for user connections, and it also
-	 * should never be saved out to persistent config.
-	 */
+     * it's really only valid for user connections, and it also
+     * should never be saved out to persistent config.
+     */
     char *user_name;
 
     /* Whether the VPN stays up across link changes, until the user
-	 * explicitly disconnects it.
-	 */
+     * explicitly disconnects it.
+     */
     gboolean persistent;
 
     /* The hash table is created at setting object
-	 * init time and should not be replaced.  It is
-	 * a char * -> char * mapping, and both the key
-	 * and value are owned by the hash table, and should
-	 * be allocated with functions whose value can be
-	 * freed with g_free().  Should not contain secrets.
-	 */
+     * init time and should not be replaced.  It is
+     * a char * -> char * mapping, and both the key
+     * and value are owned by the hash table, and should
+     * be allocated with functions whose value can be
+     * freed with g_free().  Should not contain secrets.
+     */
     GHashTable *data;
 
     /* The hash table is created at setting object
-	 * init time and should not be replaced.  It is
-	 * a char * -> char * mapping, and both the key
-	 * and value are owned by the hash table, and should
-	 * be allocated with functions whose value can be
-	 * freed with g_free().  Should contain secrets only.
-	 */
+     * init time and should not be replaced.  It is
+     * a char * -> char * mapping, and both the key
+     * and value are owned by the hash table, and should
+     * be allocated with functions whose value can be
+     * freed with g_free().  Should contain secrets only.
+     */
     GHashTable *secrets;
 
     /* Timeout for the VPN service to establish the connection */
@@ -272,19 +272,19 @@ foreach_item_helper(NMSettingVpn *self, GHashTable **p_hash, NMVpnIterFunc func,
 
     for (i = 0; i < len; i++) {
         /* NOTE: note that we call the function with a clone of @key,
-		 * not with the actual key from the dictionary.
-		 *
-		 * The @value on the other hand, is not cloned but retrieved before
-		 * invoking @func(). That means, if @func() modifies the setting while
-		 * being called, the values are as they currently are, but the
-		 * keys (and their order) were pre-determined before starting to
-		 * invoke the callbacks.
-		 *
-		 * The idea is to give some sensible, stable behavior in case the user
-		 * modifies the settings. Whether this particular behavior is optimal
-		 * is unclear. It's probably a bad idea to modify the settings while
-		 * iterating the values. But at least, it's a safe thing to do and we
-		 * do something sensible. */
+         * not with the actual key from the dictionary.
+         *
+         * The @value on the other hand, is not cloned but retrieved before
+         * invoking @func(). That means, if @func() modifies the setting while
+         * being called, the values are as they currently are, but the
+         * keys (and their order) were pre-determined before starting to
+         * invoke the callbacks.
+         *
+         * The idea is to give some sensible, stable behavior in case the user
+         * modifies the settings. Whether this particular behavior is optimal
+         * is unclear. It's probably a bad idea to modify the settings while
+         * iterating the values. But at least, it's a safe thing to do and we
+         * do something sensible. */
         func(keys[i], nm_g_hash_table_lookup(*p_hash, keys[i]), user_data);
     }
 }
@@ -474,7 +474,7 @@ aggregate(NMSetting *setting, int type_i, gpointer arg)
         }
 
         /* OK, we have no secrets with system-secret flags.
-		 * But do we have any secret-flags (without secrets) that indicate system secrets? */
+         * But do we have any secret-flags (without secrets) that indicate system secrets? */
         if (priv->data) {
             g_hash_table_iter_init(&iter, priv->data);
             while (g_hash_table_iter_next(&iter, (gpointer *) &key_name, NULL)) {
@@ -625,10 +625,10 @@ update_one_secret(NMSetting *setting, const char *key, GVariant *value, GError *
 
     if (g_variant_is_of_type(value, G_VARIANT_TYPE_STRING)) {
         /* Passing the string properties individually isn't correct, and won't
-		 * produce the correct result, but for some reason that's how it used
-		 * to be done.  So even though it's not correct, keep the code around
-		 * for compatibility's sake.
-		 */
+         * produce the correct result, but for some reason that's how it used
+         * to be done.  So even though it's not correct, keep the code around
+         * for compatibility's sake.
+         */
         success = update_secret_string(setting, key, g_variant_get_string(value, NULL), error);
     } else if (g_variant_is_of_type(value, G_VARIANT_TYPE("a{ss}"))) {
         if (!nm_streq(key, NM_SETTING_VPN_SECRETS)) {
@@ -681,7 +681,7 @@ for_each_secret(NMSetting *                    setting,
 
     if (!g_variant_is_of_type(val, G_VARIANT_TYPE("a{ss}"))) {
         /* invalid type. Silently ignore the secrets as we cannot find out the
-		 * secret-flags. */
+         * secret-flags. */
         return;
     }
 
@@ -692,9 +692,9 @@ for_each_secret(NMSetting *                    setting,
         NMSettingSecretFlags secret_flags = NM_SETTING_SECRET_FLAG_NONE;
 
         /* we ignore the return value of get_secret_flags. The function may determine
-		 * that this is not a secret, based on having not secret-flags and no secrets.
-		 * But we have the secret at hand. We know it would be a valid secret, if we
-		 * only add it to the VPN settings. */
+         * that this is not a secret, based on having not secret-flags and no secrets.
+         * But we have the secret at hand. We know it would be a valid secret, if we
+         * only add it to the VPN settings. */
         nm_setting_get_secret_flags(setting, vpn_secret_name, &secret_flags, NULL);
 
         if (callback(secret_flags, callback_data))
@@ -736,7 +736,7 @@ get_secret_flags(NMSetting *           setting,
         NM_SET_OUT(out_flags, NM_SETTING_SECRET_FLAG_NONE);
 
         /* having no secret flag for the secret is fine, as long as there
-		 * is the secret itself... */
+         * is the secret itself... */
         if (!nm_g_hash_table_lookup(priv->secrets, secret_name)) {
             g_set_error_literal(error,
                                 NM_CONNECTION_ERROR,
@@ -751,10 +751,10 @@ get_secret_flags(NMSetting *           setting,
     i64 = _nm_utils_ascii_str_to_int64(flags_val, 10, 0, NM_SETTING_SECRET_FLAG_ALL, -1);
     if (i64 == -1 || !_nm_setting_secret_flags_valid(i64)) {
         /* The flags keys is set to an unexpected value. That is a configuration
-		 * error. Note that keys named "*-flags" are reserved for secrets. The user
-		 * must not use this for anything but secret flags. Hence, we cannot fail
-		 * to read the secret, we pretend that the secret flag is set to the default
-		 * NM_SETTING_SECRET_FLAG_NONE. */
+         * error. Note that keys named "*-flags" are reserved for secrets. The user
+         * must not use this for anything but secret flags. Hence, we cannot fail
+         * to read the secret, we pretend that the secret flag is set to the default
+         * NM_SETTING_SECRET_FLAG_NONE. */
         NM_SET_OUT(out_flags, NM_SETTING_SECRET_FLAG_NONE);
         return TRUE;
     }
@@ -1032,9 +1032,9 @@ set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *ps
             while (g_hash_table_iter_next(&iter, (gpointer *) &key, (gpointer *) &val)) {
                 if (!key || !key[0] || !val) {
                     /* NULL keys/values and empty key are not allowed. Usually, we would reject them in verify(), but
-						 * then our nm_setting_vpn_remove_data_item() also doesn't allow empty keys. So, if we failed
-						 * it in verify(), it would be only fixable by setting PROP_DATA again. Instead,
-						 * silently ignore them. */
+                         * then our nm_setting_vpn_remove_data_item() also doesn't allow empty keys. So, if we failed
+                         * it in verify(), it would be only fixable by setting PROP_DATA again. Instead,
+                         * silently ignore them. */
                     continue;
                 }
                 g_hash_table_insert(_ensure_strdict(p_hash, is_secrets),
@@ -1110,12 +1110,12 @@ nm_setting_vpn_class_init(NMSettingVpnClass *klass)
     setting_class->aggregate         = aggregate;
 
     /**
-	 * NMSettingVpn:service-type:
-	 *
-	 * D-Bus service name of the VPN plugin that this setting uses to connect to
-	 * its network.  i.e. org.freedesktop.NetworkManager.vpnc for the vpnc
-	 * plugin.
-	 **/
+     * NMSettingVpn:service-type:
+     *
+     * D-Bus service name of the VPN plugin that this setting uses to connect to
+     * its network.  i.e. org.freedesktop.NetworkManager.vpnc for the vpnc
+     * plugin.
+     **/
     obj_properties[PROP_SERVICE_TYPE] =
         g_param_spec_string(NM_SETTING_VPN_SERVICE_TYPE,
                             "",
@@ -1124,15 +1124,15 @@ nm_setting_vpn_class_init(NMSettingVpnClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVpn:user-name:
-	 *
-	 * If the VPN connection requires a user name for authentication, that name
-	 * should be provided here.  If the connection is available to more than one
-	 * user, and the VPN requires each user to supply a different name, then
-	 * leave this property empty.  If this property is empty, NetworkManager
-	 * will automatically supply the username of the user which requested the
-	 * VPN connection.
-	 **/
+     * NMSettingVpn:user-name:
+     *
+     * If the VPN connection requires a user name for authentication, that name
+     * should be provided here.  If the connection is available to more than one
+     * user, and the VPN requires each user to supply a different name, then
+     * leave this property empty.  If this property is empty, NetworkManager
+     * will automatically supply the username of the user which requested the
+     * VPN connection.
+     **/
     obj_properties[PROP_USER_NAME] =
         g_param_spec_string(NM_SETTING_VPN_USER_NAME,
                             "",
@@ -1141,12 +1141,12 @@ nm_setting_vpn_class_init(NMSettingVpnClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVpn:persistent:
-	 *
-	 * If the VPN service supports persistence, and this property is %TRUE,
-	 * the VPN will attempt to stay connected across link changes and outages,
-	 * until explicitly disconnected.
-	 **/
+     * NMSettingVpn:persistent:
+     *
+     * If the VPN service supports persistence, and this property is %TRUE,
+     * the VPN will attempt to stay connected across link changes and outages,
+     * until explicitly disconnected.
+     **/
     obj_properties[PROP_PERSISTENT] =
         g_param_spec_boolean(NM_SETTING_VPN_PERSISTENT,
                              "",
@@ -1155,19 +1155,19 @@ nm_setting_vpn_class_init(NMSettingVpnClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVpn:data: (type GHashTable(utf8,utf8)):
-	 *
-	 * Dictionary of key/value pairs of VPN plugin specific data.  Both keys and
-	 * values must be strings.
-	 **/
+     * NMSettingVpn:data: (type GHashTable(utf8,utf8)):
+     *
+     * Dictionary of key/value pairs of VPN plugin specific data.  Both keys and
+     * values must be strings.
+     **/
     /* ---keyfile---
-	 * property: data
-	 * variable: separate variables named after keys of the dictionary
-	 * description: The keys of the data dictionary are used as variable names directly
-	 *   under [vpn] section.
-	 * example: remote=ovpn.corp.com cipher=AES-256-CBC username=joe
-	 * ---end---
-	 */
+     * property: data
+     * variable: separate variables named after keys of the dictionary
+     * description: The keys of the data dictionary are used as variable names directly
+     *   under [vpn] section.
+     * example: remote=ovpn.corp.com cipher=AES-256-CBC username=joe
+     * ---end---
+     */
     obj_properties[PROP_DATA] = g_param_spec_boxed(NM_SETTING_VPN_DATA,
                                                    "",
                                                    "",
@@ -1178,19 +1178,19 @@ nm_setting_vpn_class_init(NMSettingVpnClass *klass)
                                  &nm_sett_info_propert_type_strdict);
 
     /**
-	 * NMSettingVpn:secrets: (type GHashTable(utf8,utf8)):
-	 *
-	 * Dictionary of key/value pairs of VPN plugin specific secrets like
-	 * passwords or private keys.  Both keys and values must be strings.
-	 **/
+     * NMSettingVpn:secrets: (type GHashTable(utf8,utf8)):
+     *
+     * Dictionary of key/value pairs of VPN plugin specific secrets like
+     * passwords or private keys.  Both keys and values must be strings.
+     **/
     /* ---keyfile---
-	 * property: secrets
-	 * variable: separate variables named after keys of the dictionary
-	 * description: The keys of the secrets dictionary are used as variable names directly
-	 *   under [vpn-secrets] section.
-	 * example: password=Popocatepetl
-	 * ---end---
-	 */
+     * property: secrets
+     * variable: separate variables named after keys of the dictionary
+     * description: The keys of the secrets dictionary are used as variable names directly
+     *   under [vpn-secrets] section.
+     * example: password=Popocatepetl
+     * ---end---
+     */
     obj_properties[PROP_SECRETS] =
         g_param_spec_boxed(NM_SETTING_VPN_SECRETS,
                            "",
@@ -1206,16 +1206,16 @@ nm_setting_vpn_class_init(NMSettingVpnClass *klass)
                                   .from_dbus_fcn = vpn_secrets_from_dbus, ));
 
     /**
-	 * NMSettingVpn:timeout:
-	 *
-	 * Timeout for the VPN service to establish the connection. Some services
-	 * may take quite a long time to connect.
-	 * Value of 0 means a default timeout, which is 60 seconds (unless overridden
-	 * by vpn.timeout in configuration file). Values greater than zero mean
-	 * timeout in seconds.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVpn:timeout:
+     *
+     * Timeout for the VPN service to establish the connection. Some services
+     * may take quite a long time to connect.
+     * Value of 0 means a default timeout, which is 60 seconds (unless overridden
+     * by vpn.timeout in configuration file). Values greater than zero mean
+     * timeout in seconds.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TIMEOUT] = g_param_spec_uint(NM_SETTING_VPN_TIMEOUT,
                                                      "",
                                                      "",
diff --git a/libnm-core/nm-setting-vrf.c b/libnm-core/nm-setting-vrf.c
index bb4757fe7d..198b9d718a 100644
--- a/libnm-core/nm-setting-vrf.c
+++ b/libnm-core/nm-setting-vrf.c
@@ -143,12 +143,12 @@ nm_setting_vrf_class_init(NMSettingVrfClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingVrf:table:
-	 *
-	 * The routing table for this VRF.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMSettingVrf:table:
+     *
+     * The routing table for this VRF.
+     *
+     * Since: 1.24
+     **/
     obj_properties[PROP_TABLE] =
         g_param_spec_uint(NM_SETTING_VRF_TABLE,
                           "",
diff --git a/libnm-core/nm-setting-vxlan.c b/libnm-core/nm-setting-vxlan.c
index b3bae13bf5..38bd6e2c15 100644
--- a/libnm-core/nm-setting-vxlan.c
+++ b/libnm-core/nm-setting-vxlan.c
@@ -562,12 +562,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingVxlan:parent:
-	 *
-	 * If given, specifies the parent interface name or parent connection UUID.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:parent:
+     *
+     * If given, specifies the parent interface name or parent connection UUID.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_string(
         NM_SETTING_VXLAN_PARENT,
         "",
@@ -575,13 +575,13 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
         NULL,
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
     /**
-	 * NMSettingVxlan:id:
-	 *
-	 * Specifies the VXLAN Network Identifier (or VXLAN Segment Identifier) to
-	 * use.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:id:
+     *
+     * Specifies the VXLAN Network Identifier (or VXLAN Segment Identifier) to
+     * use.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_ID] =
         g_param_spec_uint(NM_SETTING_VXLAN_ID,
                           "",
@@ -592,12 +592,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:local:
-	 *
-	 * If given, specifies the source IP address to use in outgoing packets.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:local:
+     *
+     * If given, specifies the source IP address to use in outgoing packets.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_LOCAL] = g_param_spec_string(NM_SETTING_VXLAN_LOCAL,
                                                      "",
                                                      "",
@@ -606,14 +606,14 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                                                          | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:remote:
-	 *
-	 * Specifies the unicast destination IP address to use in outgoing packets
-	 * when the destination link layer address is not known in the VXLAN device
-	 * forwarding database, or the multicast IP address to join.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:remote:
+     *
+     * Specifies the unicast destination IP address to use in outgoing packets
+     * when the destination link layer address is not known in the VXLAN device
+     * forwarding database, or the multicast IP address to join.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_REMOTE] = g_param_spec_string(
         NM_SETTING_VXLAN_REMOTE,
         "",
@@ -622,13 +622,13 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:source-port-min:
-	 *
-	 * Specifies the minimum UDP source port to communicate to the remote VXLAN
-	 * tunnel endpoint.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:source-port-min:
+     *
+     * Specifies the minimum UDP source port to communicate to the remote VXLAN
+     * tunnel endpoint.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_SOURCE_PORT_MIN] =
         g_param_spec_uint(NM_SETTING_VXLAN_SOURCE_PORT_MIN,
                           "",
@@ -639,13 +639,13 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:source-port-max:
-	 *
-	 * Specifies the maximum UDP source port to communicate to the remote VXLAN
-	 * tunnel endpoint.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:source-port-max:
+     *
+     * Specifies the maximum UDP source port to communicate to the remote VXLAN
+     * tunnel endpoint.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_SOURCE_PORT_MAX] =
         g_param_spec_uint(NM_SETTING_VXLAN_SOURCE_PORT_MAX,
                           "",
@@ -656,13 +656,13 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:destination-port:
-	 *
-	 * Specifies the UDP destination port to communicate to the remote VXLAN
-	 * tunnel endpoint.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:destination-port:
+     *
+     * Specifies the UDP destination port to communicate to the remote VXLAN
+     * tunnel endpoint.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_DESTINATION_PORT] =
         g_param_spec_uint(NM_SETTING_VXLAN_DESTINATION_PORT,
                           "",
@@ -673,12 +673,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:ageing:
-	 *
-	 * Specifies the lifetime in seconds of FDB entries learnt by the kernel.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:ageing:
+     *
+     * Specifies the lifetime in seconds of FDB entries learnt by the kernel.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_AGEING] =
         g_param_spec_uint(NM_SETTING_VXLAN_AGEING,
                           "",
@@ -689,13 +689,13 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:limit:
-	 *
-	 * Specifies the maximum number of FDB entries. A value of zero means that
-	 * the kernel will store unlimited entries.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:limit:
+     *
+     * Specifies the maximum number of FDB entries. A value of zero means that
+     * the kernel will store unlimited entries.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_LIMIT] =
         g_param_spec_uint(NM_SETTING_VXLAN_LIMIT,
                           "",
@@ -706,12 +706,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:tos:
-	 *
-	 * Specifies the TOS value to use in outgoing packets.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:tos:
+     *
+     * Specifies the TOS value to use in outgoing packets.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TOS] =
         g_param_spec_uint(NM_SETTING_VXLAN_TOS,
                           "",
@@ -722,12 +722,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:ttl:
-	 *
-	 * Specifies the time-to-live value to use in outgoing packets.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:ttl:
+     *
+     * Specifies the time-to-live value to use in outgoing packets.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TTL] =
         g_param_spec_uint(NM_SETTING_VXLAN_TTL,
                           "",
@@ -738,12 +738,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:proxy:
-	 *
-	 * Specifies whether ARP proxy is turned on.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:proxy:
+     *
+     * Specifies whether ARP proxy is turned on.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PROXY] = g_param_spec_boolean(
         NM_SETTING_VXLAN_PROXY,
         "",
@@ -752,13 +752,13 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:learning:
-	 *
-	 * Specifies whether unknown source link layer addresses and IP addresses
-	 * are entered into the VXLAN device forwarding database.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:learning:
+     *
+     * Specifies whether unknown source link layer addresses and IP addresses
+     * are entered into the VXLAN device forwarding database.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_LEARNING] = g_param_spec_boolean(
         NM_SETTING_VXLAN_LEARNING,
         "",
@@ -766,12 +766,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
         TRUE,
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
     /**
-	 * NMSettingVxlan:rsc:
-	 *
-	 * Specifies whether route short circuit is turned on.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:rsc:
+     *
+     * Specifies whether route short circuit is turned on.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_RSC] = g_param_spec_boolean(NM_SETTING_VXLAN_RSC,
                                                     "",
                                                     "",
@@ -779,12 +779,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
                                                     G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE
                                                         | G_PARAM_STATIC_STRINGS);
     /**
-	 * NMSettingVxlan:l2-miss:
-	 *
-	 * Specifies whether netlink LL ADDR miss notifications are generated.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:l2-miss:
+     *
+     * Specifies whether netlink LL ADDR miss notifications are generated.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_L2_MISS] = g_param_spec_boolean(
         NM_SETTING_VXLAN_L2_MISS,
         "",
@@ -793,12 +793,12 @@ nm_setting_vxlan_class_init(NMSettingVxlanClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingVxlan:l3-miss:
-	 *
-	 * Specifies whether netlink IP ADDR miss notifications are generated.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingVxlan:l3-miss:
+     *
+     * Specifies whether netlink IP ADDR miss notifications are generated.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_L3_MISS] = g_param_spec_boolean(
         NM_SETTING_VXLAN_L3_MISS,
         "",
diff --git a/libnm-core/nm-setting-wifi-p2p.c b/libnm-core/nm-setting-wifi-p2p.c
index 23c2b7cb42..2a0b72a11b 100644
--- a/libnm-core/nm-setting-wifi-p2p.c
+++ b/libnm-core/nm-setting-wifi-p2p.c
@@ -239,21 +239,21 @@ nm_setting_wifi_p2p_class_init(NMSettingWifiP2PClass *setting_wifi_p2p_class)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingWifiP2P:peer:
-	 *
-	 * The P2P device that should be connected to. Currently, this is the only
-	 * way to create or join a group.
-	 *
-	 * Since: 1.16
-	 */
+     * NMSettingWifiP2P:peer:
+     *
+     * The P2P device that should be connected to. Currently, this is the only
+     * way to create or join a group.
+     *
+     * Since: 1.16
+     */
     /* ---keyfile---
-	 * property: peer
-	 * format: usual hex-digits-and-colons notation
-	 * description: MAC address in traditional hex-digits-and-colons notation
-	 *   (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete)
-	 *   (e.g. 0;34;104;18;121;162).
-	 * ---end---
-	 */
+     * property: peer
+     * format: usual hex-digits-and-colons notation
+     * description: MAC address in traditional hex-digits-and-colons notation
+     *   (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete)
+     *   (e.g. 0;34;104;18;121;162).
+     * ---end---
+     */
     obj_properties[PROP_PEER] = g_param_spec_string(NM_SETTING_WIFI_P2P_PEER,
                                                     "",
                                                     "",
@@ -261,15 +261,15 @@ nm_setting_wifi_p2p_class_init(NMSettingWifiP2PClass *setting_wifi_p2p_class)
                                                     G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWifiP2P:wps-method:
-	 *
-	 * Flags indicating which mode of WPS is to be used.
-	 *
-	 * There's little point in changing the default setting as NetworkManager will
-	 * automatically determine the best method to use.
-	 *
-	 * Since: 1.16
-	 */
+     * NMSettingWifiP2P:wps-method:
+     *
+     * Flags indicating which mode of WPS is to be used.
+     *
+     * There's little point in changing the default setting as NetworkManager will
+     * automatically determine the best method to use.
+     *
+     * Since: 1.16
+     */
     obj_properties[PROP_WPS_METHOD] = g_param_spec_uint(
         NM_SETTING_WIFI_P2P_WPS_METHOD,
         "",
@@ -280,17 +280,17 @@ nm_setting_wifi_p2p_class_init(NMSettingWifiP2PClass *setting_wifi_p2p_class)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWifiP2P:wfd-ies:
-	 *
-	 * The Wi-Fi Display (WFD) Information Elements (IEs) to set.
-	 *
-	 * Wi-Fi Display requires a protocol specific information element to be
-	 * set in certain Wi-Fi frames. These can be specified here for the
-	 * purpose of establishing a connection.
-	 * This setting is only useful when implementing a Wi-Fi Display client.
-	 *
-	 * Since: 1.16
-	 */
+     * NMSettingWifiP2P:wfd-ies:
+     *
+     * The Wi-Fi Display (WFD) Information Elements (IEs) to set.
+     *
+     * Wi-Fi Display requires a protocol specific information element to be
+     * set in certain Wi-Fi frames. These can be specified here for the
+     * purpose of establishing a connection.
+     * This setting is only useful when implementing a Wi-Fi Display client.
+     *
+     * Since: 1.16
+     */
     obj_properties[PROP_WFD_IES] = g_param_spec_boxed(
         NM_SETTING_WIFI_P2P_WFD_IES,
         "",
diff --git a/libnm-core/nm-setting-wimax.c b/libnm-core/nm-setting-wimax.c
index a9ebc32f0f..9c7ed74154 100644
--- a/libnm-core/nm-setting-wimax.c
+++ b/libnm-core/nm-setting-wimax.c
@@ -213,13 +213,13 @@ nm_setting_wimax_class_init(NMSettingWimaxClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingWimax:network-name:
-	 *
-	 * Network Service Provider (NSP) name of the WiMAX network this connection
-	 * should use.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMSettingWimax:network-name:
+     *
+     * Network Service Provider (NSP) name of the WiMAX network this connection
+     * should use.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_NETWORK_NAME] =
         g_param_spec_string(NM_SETTING_WIMAX_NETWORK_NAME,
                             "",
@@ -228,14 +228,14 @@ nm_setting_wimax_class_init(NMSettingWimaxClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWimax:mac-address:
-	 *
-	 * If specified, this connection will only apply to the WiMAX device whose
-	 * MAC address matches. This property does not change the MAC address of the
-	 * device (known as MAC spoofing).
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMSettingWimax:mac-address:
+     *
+     * If specified, this connection will only apply to the WiMAX device whose
+     * MAC address matches. This property does not change the MAC address of the
+     * device (known as MAC spoofing).
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_MAC_ADDRESS] =
         g_param_spec_string(NM_SETTING_WIMAX_MAC_ADDRESS,
                             "",
diff --git a/libnm-core/nm-setting-wired.c b/libnm-core/nm-setting-wired.c
index d74bc2a187..376138361e 100644
--- a/libnm-core/nm-setting-wired.c
+++ b/libnm-core/nm-setting-wired.c
@@ -492,9 +492,9 @@ nm_setting_wired_get_s390_option(NMSettingWired *setting,
     NMSettingWiredPrivate *priv;
 
     /* with LTO and optimization, the compiler complains that the
-	 * output variables are not initialized. In practice, the function
-	 * only sets the output on success. But make the compiler happy.
-	 */
+     * output variables are not initialized. In practice, the function
+     * only sets the output on success. But make the compiler happy.
+     */
     NM_SET_OUT(out_key, NULL);
     NM_SET_OUT(out_value, NULL);
 
@@ -840,8 +840,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     }
 
     /* generate-mac-address-mask only makes sense with cloned-mac-address "random" or
-	 * "stable". Still, let's not be so strict about that and accept the value
-	 * even if it is unused. */
+     * "stable". Still, let's not be so strict about that and accept the value
+     * even if it is unused. */
     if (!_nm_utils_generate_mac_address_mask_parse(priv->generate_mac_address_mask,
                                                    NULL,
                                                    NULL,
@@ -898,8 +898,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     }
 
     /* Normalizable properties - just return NM_SETTING_VERIFY_NORMALIZABLE for compatibility
-	 * with legacy nm-connection-editor which used to save "full" duplex connection as default
-	 */
+     * with legacy nm-connection-editor which used to save "full" duplex connection as default
+     */
 
     if (((priv->speed) && (!priv->duplex)) || ((!priv->speed) && (priv->duplex))) {
         g_set_error_literal(
@@ -1116,10 +1116,10 @@ set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *ps
                                                NULL,
                                                NULL);
                 /* prune duplicate keys. This is only possible if @hash does not use
-					 * g_str_equal() as compare function (which would be a bug).
-					 * Still, handle this, because we use later binary sort and rely
-					 * on unique names. One bug here, should not bork the remainder
-					 * of the program. */
+                     * g_str_equal() as compare function (which would be a bug).
+                     * Still, handle this, because we use later binary sort and rely
+                     * on unique names. One bug here, should not bork the remainder
+                     * of the program. */
                 j = 1;
                 for (i = 1; i < priv->s390_options.len; i++) {
                     if (nm_streq(priv->s390_options.arr[j - 1].name,
@@ -1218,19 +1218,19 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
     setting_class->compare_property = compare_property;
 
     /**
-	 * NMSettingWired:port:
-	 *
-	 * Specific port type to use if the device supports multiple
-	 * attachment methods.  One of "tp" (Twisted Pair), "aui" (Attachment Unit
-	 * Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface).
-	 * If the device supports only one port type, this setting is ignored.
-	 **/
+     * NMSettingWired:port:
+     *
+     * Specific port type to use if the device supports multiple
+     * attachment methods.  One of "tp" (Twisted Pair), "aui" (Attachment Unit
+     * Interface), "bnc" (Thin Ethernet) or "mii" (Media Independent Interface).
+     * If the device supports only one port type, this setting is ignored.
+     **/
     /* ---ifcfg-rh---
-	 * property: port
-	 * variable: (none)
-	 * description: The property is not saved by the plugin.
-	 * ---end---
-	 */
+     * property: port
+     * variable: (none)
+     * description: The property is not saved by the plugin.
+     * ---end---
+     */
     obj_properties[PROP_PORT] = g_param_spec_string(NM_SETTING_WIRED_PORT,
                                                     "",
                                                     "",
@@ -1238,29 +1238,29 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                                                     G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:speed:
-	 *
-	 * When a value greater than 0 is set, configures the device to use
-	 * the specified speed. If "auto-negotiate" is "yes" the specified
-	 * speed will be the only one advertised during link negotiation:
-	 * this works only for BASE-T 802.3 specifications and is useful for
-	 * enforcing gigabit speeds, as in this case link negotiation is
-	 * mandatory.
-	 * If the value is unset (0, the default), the link configuration will be
-	 * either skipped (if "auto-negotiate" is "no", the default) or will
-	 * be auto-negotiated (if "auto-negotiate" is "yes") and the local device
-	 * will advertise all the supported speeds.
-	 * In Mbit/s, ie 100 == 100Mbit/s.
-	 * Must be set together with the "duplex" property when non-zero.
-	 * Before specifying a speed value be sure your device supports it.
-	 **/
+     * NMSettingWired:speed:
+     *
+     * When a value greater than 0 is set, configures the device to use
+     * the specified speed. If "auto-negotiate" is "yes" the specified
+     * speed will be the only one advertised during link negotiation:
+     * this works only for BASE-T 802.3 specifications and is useful for
+     * enforcing gigabit speeds, as in this case link negotiation is
+     * mandatory.
+     * If the value is unset (0, the default), the link configuration will be
+     * either skipped (if "auto-negotiate" is "no", the default) or will
+     * be auto-negotiated (if "auto-negotiate" is "yes") and the local device
+     * will advertise all the supported speeds.
+     * In Mbit/s, ie 100 == 100Mbit/s.
+     * Must be set together with the "duplex" property when non-zero.
+     * Before specifying a speed value be sure your device supports it.
+     **/
     /* ---ifcfg-rh---
-	 * property: speed
-	 * variable: ETHTOOL_OPTS
-	 * description: Fixed speed for the ethernet link. It is added as "speed"
-	 *    parameter in the ETHTOOL_OPTS variable.
-	 * ---end---
-	 */
+     * property: speed
+     * variable: ETHTOOL_OPTS
+     * description: Fixed speed for the ethernet link. It is added as "speed"
+     *    parameter in the ETHTOOL_OPTS variable.
+     * ---end---
+     */
     obj_properties[PROP_SPEED] = g_param_spec_uint(NM_SETTING_WIRED_SPEED,
                                                    "",
                                                    "",
@@ -1270,28 +1270,28 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                                                    G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:duplex:
-	 *
-	 * When a value is set, either "half" or "full", configures the device
-	 * to use the specified duplex mode. If "auto-negotiate" is "yes" the
-	 * specified duplex mode will be the only one advertised during link
-	 * negotiation: this works only for BASE-T 802.3 specifications and is
-	 * useful for enforcing gigabits modes, as in these cases link negotiation
-	 * is mandatory.
-	 * If the value is unset (the default), the link configuration will be
-	 * either skipped (if "auto-negotiate" is "no", the default) or will
-	 * be auto-negotiated (if "auto-negotiate" is "yes") and the local device
-	 * will advertise all the supported duplex modes.
-	 * Must be set together with the "speed" property if specified.
-	 * Before specifying a duplex mode be sure your device supports it.
-	 **/
+     * NMSettingWired:duplex:
+     *
+     * When a value is set, either "half" or "full", configures the device
+     * to use the specified duplex mode. If "auto-negotiate" is "yes" the
+     * specified duplex mode will be the only one advertised during link
+     * negotiation: this works only for BASE-T 802.3 specifications and is
+     * useful for enforcing gigabits modes, as in these cases link negotiation
+     * is mandatory.
+     * If the value is unset (the default), the link configuration will be
+     * either skipped (if "auto-negotiate" is "no", the default) or will
+     * be auto-negotiated (if "auto-negotiate" is "yes") and the local device
+     * will advertise all the supported duplex modes.
+     * Must be set together with the "speed" property if specified.
+     * Before specifying a duplex mode be sure your device supports it.
+     **/
     /* ---ifcfg-rh---
-	 * property: duplex
-	 * variable: ETHTOOL_OPTS
-	 * description: Fixed duplex mode for the ethernet link. It is added as
-	 *    "duplex" parameter in the ETHOOL_OPTS variable.
-	 * ---end---
-	 */
+     * property: duplex
+     * variable: ETHTOOL_OPTS
+     * description: Fixed duplex mode for the ethernet link. It is added as
+     *    "duplex" parameter in the ETHOOL_OPTS variable.
+     * ---end---
+     */
     obj_properties[PROP_DUPLEX] = g_param_spec_string(NM_SETTING_WIRED_DUPLEX,
                                                       "",
                                                       "",
@@ -1299,25 +1299,25 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                                                       G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:auto-negotiate:
-	 *
-	 * When %TRUE, enforce auto-negotiation of speed and duplex mode.
-	 * If "speed" and "duplex" properties are both specified, only that
-	 * single mode will be advertised and accepted during the link
-	 * auto-negotiation process: this works only for BASE-T 802.3 specifications
-	 * and is useful for enforcing gigabits modes, as in these cases link
-	 * negotiation is mandatory.
-	 * When %FALSE, "speed" and "duplex" properties should be both set or
-	 * link configuration will be skipped.
-	 **/
+     * NMSettingWired:auto-negotiate:
+     *
+     * When %TRUE, enforce auto-negotiation of speed and duplex mode.
+     * If "speed" and "duplex" properties are both specified, only that
+     * single mode will be advertised and accepted during the link
+     * auto-negotiation process: this works only for BASE-T 802.3 specifications
+     * and is useful for enforcing gigabits modes, as in these cases link
+     * negotiation is mandatory.
+     * When %FALSE, "speed" and "duplex" properties should be both set or
+     * link configuration will be skipped.
+     **/
     /* ---ifcfg-rh---
-	 * property: auto-negotiate
-	 * variable: ETHTOOL_OPTS
-	 * description: Whether link speed and duplex autonegotiation is enabled.
-	 *    It is not saved only if disabled and no values are provided for the
-	 *    "speed" and "duplex" parameters (skips link configuration).
-	 * ---end---
-	 */
+     * property: auto-negotiate
+     * variable: ETHTOOL_OPTS
+     * description: Whether link speed and duplex autonegotiation is enabled.
+     *    It is not saved only if disabled and no values are provided for the
+     *    "speed" and "duplex" parameters (skips link configuration).
+     * ---end---
+     */
     obj_properties[PROP_AUTO_NEGOTIATE] =
         g_param_spec_boolean(NM_SETTING_WIRED_AUTO_NEGOTIATE,
                              "",
@@ -1330,29 +1330,29 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                                                            .to_dbus_fcn = _override_autoneg_get, ));
 
     /**
-	 * NMSettingWired:mac-address:
-	 *
-	 * If specified, this connection will only apply to the Ethernet device
-	 * whose permanent MAC address matches. This property does not change the
-	 * MAC address of the device (i.e. MAC spoofing).
-	 **/
+     * NMSettingWired:mac-address:
+     *
+     * If specified, this connection will only apply to the Ethernet device
+     * whose permanent MAC address matches. This property does not change the
+     * MAC address of the device (i.e. MAC spoofing).
+     **/
     /* ---keyfile---
-	 * property: mac-address
-	 * format: usual hex-digits-and-colons notation
-	 * description: MAC address in traditional hex-digits-and-colons notation
-	 *   (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete)
-	 *   (e.g. 0;34;104;18;121;162)
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: mac-address
-	 * variable: HWADDR
-	 * description: Hardware address of the device in traditional hex-digits-and-colons
-	 *    notation (e.g. 00:22:68:14:5A:05).
-	 *    Note that for initscripts this is the current MAC address of the device as found
-	 *    during ifup. For NetworkManager this is the permanent MAC address. Or in case no
-	 *    permanent MAC address exists, the MAC address initially configured on the device.
-	 * ---end---
-	 */
+     * property: mac-address
+     * format: usual hex-digits-and-colons notation
+     * description: MAC address in traditional hex-digits-and-colons notation
+     *   (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete)
+     *   (e.g. 0;34;104;18;121;162)
+     * ---end---
+     * ---ifcfg-rh---
+     * property: mac-address
+     * variable: HWADDR
+     * description: Hardware address of the device in traditional hex-digits-and-colons
+     *    notation (e.g. 00:22:68:14:5A:05).
+     *    Note that for initscripts this is the current MAC address of the device as found
+     *    during ifup. For NetworkManager this is the permanent MAC address. Or in case no
+     *    permanent MAC address exists, the MAC address initially configured on the device.
+     * ---end---
+     */
     obj_properties[PROP_MAC_ADDRESS] = g_param_spec_string(
         NM_SETTING_WIRED_MAC_ADDRESS,
         "",
@@ -1364,48 +1364,48 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                                  &nm_sett_info_propert_type_mac_address);
 
     /**
-	 * NMSettingWired:cloned-mac-address:
-	 *
-	 * If specified, request that the device use this MAC address instead.
-	 * This is known as MAC cloning or spoofing.
-	 *
-	 * Beside explicitly specifying a MAC address, the special values "preserve", "permanent",
-	 * "random" and "stable" are supported.
-	 * "preserve" means not to touch the MAC address on activation.
-	 * "permanent" means to use the permanent hardware address if the device
-	 * has one (otherwise this is treated as "preserve").
-	 * "random" creates a random MAC address on each connect.
-	 * "stable" creates a hashed MAC address based on connection.stable-id and a
-	 * machine dependent key.
-	 *
-	 * If unspecified, the value can be overwritten via global defaults, see manual
-	 * of NetworkManager.conf. If still unspecified, it defaults to "preserve"
-	 * (older versions of NetworkManager may use a different default value).
-	 *
-	 * On D-Bus, this field is expressed as "assigned-mac-address" or the deprecated
-	 * "cloned-mac-address".
-	 **/
+     * NMSettingWired:cloned-mac-address:
+     *
+     * If specified, request that the device use this MAC address instead.
+     * This is known as MAC cloning or spoofing.
+     *
+     * Beside explicitly specifying a MAC address, the special values "preserve", "permanent",
+     * "random" and "stable" are supported.
+     * "preserve" means not to touch the MAC address on activation.
+     * "permanent" means to use the permanent hardware address if the device
+     * has one (otherwise this is treated as "preserve").
+     * "random" creates a random MAC address on each connect.
+     * "stable" creates a hashed MAC address based on connection.stable-id and a
+     * machine dependent key.
+     *
+     * If unspecified, the value can be overwritten via global defaults, see manual
+     * of NetworkManager.conf. If still unspecified, it defaults to "preserve"
+     * (older versions of NetworkManager may use a different default value).
+     *
+     * On D-Bus, this field is expressed as "assigned-mac-address" or the deprecated
+     * "cloned-mac-address".
+     **/
     /* ---keyfile---
-	 * property: cloned-mac-address
-	 * format: usual hex-digits-and-colons notation
-	 * description: Cloned MAC address in traditional hex-digits-and-colons notation
-	 *   (e.g. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete)
-	 *   (e.g. 0;34;104;18;121;178).
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: cloned-mac-address
-	 * variable: MACADDR
-	 * description: Cloned (spoofed) MAC address in traditional hex-digits-and-colons
-	 *    notation (e.g. 00:22:68:14:5A:99).
-	 * ---end---
-	 * ---dbus---
-	 * property: cloned-mac-address
-	 * format: byte array
-	 * description: This D-Bus field is deprecated in favor of "assigned-mac-address"
-	 *    which is more flexible and allows specifying special variants like "random".
-	 *    For libnm and nmcli, this field is called "cloned-mac-address".
-	 * ---end---
-	 */
+     * property: cloned-mac-address
+     * format: usual hex-digits-and-colons notation
+     * description: Cloned MAC address in traditional hex-digits-and-colons notation
+     *   (e.g. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete)
+     *   (e.g. 0;34;104;18;121;178).
+     * ---end---
+     * ---ifcfg-rh---
+     * property: cloned-mac-address
+     * variable: MACADDR
+     * description: Cloned (spoofed) MAC address in traditional hex-digits-and-colons
+     *    notation (e.g. 00:22:68:14:5A:99).
+     * ---end---
+     * ---dbus---
+     * property: cloned-mac-address
+     * format: byte array
+     * description: This D-Bus field is deprecated in favor of "assigned-mac-address"
+     *    which is more flexible and allows specifying special variants like "random".
+     *    For libnm and nmcli, this field is called "cloned-mac-address".
+     * ---end---
+     */
     obj_properties[PROP_CLONED_MAC_ADDRESS] = g_param_spec_string(
         NM_SETTING_WIRED_CLONED_MAC_ADDRESS,
         "",
@@ -1417,60 +1417,60 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                                  &nm_sett_info_propert_type_cloned_mac_address);
 
     /* ---dbus---
-	 * property: assigned-mac-address
-	 * format: string
-	 * description: The new field for the cloned MAC address. It can be either
-	 *   a hardware address in ASCII representation, or one of the special values
-	 *   "preserve", "permanent", "random" or "stable".
-	 *   This field replaces the deprecated "cloned-mac-address" on D-Bus, which
-	 *   can only contain explicit hardware addresses. Note that this property
-	 *   only exists in D-Bus API. libnm and nmcli continue to call this property
-	 *   "cloned-mac-address".
-	 * ---end---
-	 */
+     * property: assigned-mac-address
+     * format: string
+     * description: The new field for the cloned MAC address. It can be either
+     *   a hardware address in ASCII representation, or one of the special values
+     *   "preserve", "permanent", "random" or "stable".
+     *   This field replaces the deprecated "cloned-mac-address" on D-Bus, which
+     *   can only contain explicit hardware addresses. Note that this property
+     *   only exists in D-Bus API. libnm and nmcli continue to call this property
+     *   "cloned-mac-address".
+     * ---end---
+     */
     _nm_properties_override_dbus(properties_override,
                                  "assigned-mac-address",
                                  &nm_sett_info_propert_type_assigned_mac_address);
 
     /**
-	 * NMSettingWired:generate-mac-address-mask:
-	 *
-	 * With #NMSettingWired:cloned-mac-address setting "random" or "stable",
-	 * by default all bits of the MAC address are scrambled and a locally-administered,
-	 * unicast MAC address is created. This property allows to specify that certain bits
-	 * are fixed. Note that the least significant bit of the first MAC address will
-	 * always be unset to create a unicast MAC address.
-	 *
-	 * If the property is %NULL, it is eligible to be overwritten by a default
-	 * connection setting. If the value is still %NULL or an empty string, the
-	 * default is to create a locally-administered, unicast MAC address.
-	 *
-	 * If the value contains one MAC address, this address is used as mask. The set
-	 * bits of the mask are to be filled with the current MAC address of the device,
-	 * while the unset bits are subject to randomization.
-	 * Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address
-	 * and only randomize the lower 3 bytes using the "random" or "stable" algorithm.
-	 *
-	 * If the value contains one additional MAC address after the mask,
-	 * this address is used instead of the current MAC address to fill the bits
-	 * that shall not be randomized. For example, a value of
-	 * "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address
-	 * to 68:F7:28, while the lower bits are randomized. A value of
-	 * "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled
-	 * globally-administered, burned-in MAC address.
-	 *
-	 * If the value contains more than one additional MAC addresses, one of
-	 * them is chosen randomly. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00"
-	 * will create a fully scrambled MAC address, randomly locally or globally
-	 * administered.
-	 **/
+     * NMSettingWired:generate-mac-address-mask:
+     *
+     * With #NMSettingWired:cloned-mac-address setting "random" or "stable",
+     * by default all bits of the MAC address are scrambled and a locally-administered,
+     * unicast MAC address is created. This property allows to specify that certain bits
+     * are fixed. Note that the least significant bit of the first MAC address will
+     * always be unset to create a unicast MAC address.
+     *
+     * If the property is %NULL, it is eligible to be overwritten by a default
+     * connection setting. If the value is still %NULL or an empty string, the
+     * default is to create a locally-administered, unicast MAC address.
+     *
+     * If the value contains one MAC address, this address is used as mask. The set
+     * bits of the mask are to be filled with the current MAC address of the device,
+     * while the unset bits are subject to randomization.
+     * Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address
+     * and only randomize the lower 3 bytes using the "random" or "stable" algorithm.
+     *
+     * If the value contains one additional MAC address after the mask,
+     * this address is used instead of the current MAC address to fill the bits
+     * that shall not be randomized. For example, a value of
+     * "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address
+     * to 68:F7:28, while the lower bits are randomized. A value of
+     * "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled
+     * globally-administered, burned-in MAC address.
+     *
+     * If the value contains more than one additional MAC addresses, one of
+     * them is chosen randomly. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00"
+     * will create a fully scrambled MAC address, randomly locally or globally
+     * administered.
+     **/
     /* ---ifcfg-rh---
-	 * property: generate-mac-address-mask
-	 * variable: GENERATE_MAC_ADDRESS_MASK(+)
-	 * description: the MAC address mask for generating randomized and stable
-	 *   cloned-mac-address.
-	 * ---end---
-	 */
+     * property: generate-mac-address-mask
+     * variable: GENERATE_MAC_ADDRESS_MASK(+)
+     * description: the MAC address mask for generating randomized and stable
+     *   cloned-mac-address.
+     * ---end---
+     */
     obj_properties[PROP_GENERATE_MAC_ADDRESS_MASK] = g_param_spec_string(
         NM_SETTING_WIRED_GENERATE_MAC_ADDRESS_MASK,
         "",
@@ -1479,27 +1479,27 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:mac-address-blacklist:
-	 *
-	 * If specified, this connection will never apply to the Ethernet device
-	 * whose permanent MAC address matches an address in the list.  Each MAC
-	 * address is in the standard hex-digits-and-colons notation
-	 * (00:11:22:33:44:55).
-	 **/
+     * NMSettingWired:mac-address-blacklist:
+     *
+     * If specified, this connection will never apply to the Ethernet device
+     * whose permanent MAC address matches an address in the list.  Each MAC
+     * address is in the standard hex-digits-and-colons notation
+     * (00:11:22:33:44:55).
+     **/
     /* ---keyfile---
-	 * property: mac-address-blacklist
-	 * format: list of MACs (separated with semicolons)
-	 * description: MAC address blacklist.
-	 * example: mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: mac-address-blacklist
-	 * variable: HWADDR_BLACKLIST(+)
-	 * description: It denies usage of the connection for any device whose address
-	 *   is listed.
-	 * example: HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"
-	 * ---end---
-	 */
+     * property: mac-address-blacklist
+     * format: list of MACs (separated with semicolons)
+     * description: MAC address blacklist.
+     * example: mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78
+     * ---end---
+     * ---ifcfg-rh---
+     * property: mac-address-blacklist
+     * variable: HWADDR_BLACKLIST(+)
+     * description: It denies usage of the connection for any device whose address
+     *   is listed.
+     * example: HWADDR_BLACKLIST="00:22:68:11:69:08 00:11:22:11:44:55"
+     * ---end---
+     */
     obj_properties[PROP_MAC_ADDRESS_BLACKLIST] = g_param_spec_boxed(
         NM_SETTING_WIRED_MAC_ADDRESS_BLACKLIST,
         "",
@@ -1508,17 +1508,17 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:mtu:
-	 *
-	 * If non-zero, only transmit packets of the specified size or smaller,
-	 * breaking larger packets up into multiple Ethernet frames.
-	 **/
+     * NMSettingWired:mtu:
+     *
+     * If non-zero, only transmit packets of the specified size or smaller,
+     * breaking larger packets up into multiple Ethernet frames.
+     **/
     /* ---ifcfg-rh---
-	 * property: mtu
-	 * variable: MTU
-	 * description: MTU of the interface.
-	 * ---end---
-	 */
+     * property: mtu
+     * variable: MTU
+     * description: MTU of the interface.
+     * ---end---
+     */
     obj_properties[PROP_MTU] = g_param_spec_uint(NM_SETTING_WIRED_MTU,
                                                  "",
                                                  "",
@@ -1529,23 +1529,23 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                                                      | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:s390-subchannels:
-	 *
-	 * Identifies specific subchannels that this network device uses for
-	 * communication with z/VM or s390 host.  Like the
-	 * #NMSettingWired:mac-address property for non-z/VM devices, this property
-	 * can be used to ensure this connection only applies to the network device
-	 * that uses these subchannels.  The list should contain exactly 3 strings,
-	 * and each string may only be composed of hexadecimal characters and the
-	 * period (.) character.
-	 **/
+     * NMSettingWired:s390-subchannels:
+     *
+     * Identifies specific subchannels that this network device uses for
+     * communication with z/VM or s390 host.  Like the
+     * #NMSettingWired:mac-address property for non-z/VM devices, this property
+     * can be used to ensure this connection only applies to the network device
+     * that uses these subchannels.  The list should contain exactly 3 strings,
+     * and each string may only be composed of hexadecimal characters and the
+     * period (.) character.
+     **/
     /* ---ifcfg-rh---
-	 * property: s390-subchannels
-	 * variable: SUBCHANNELS
-	 * description: Subchannels for IBM S390 hosts.
-	 * example: SUBCHANNELS=0.0.b00a,0.0.b00b,0.0.b00c
-	 * ---end---
-	 */
+     * property: s390-subchannels
+     * variable: SUBCHANNELS
+     * description: Subchannels for IBM S390 hosts.
+     * example: SUBCHANNELS=0.0.b00a,0.0.b00b,0.0.b00c
+     * ---end---
+     */
     obj_properties[PROP_S390_SUBCHANNELS] = g_param_spec_boxed(
         NM_SETTING_WIRED_S390_SUBCHANNELS,
         "",
@@ -1554,19 +1554,19 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:s390-nettype:
-	 *
-	 * s390 network device type; one of "qeth", "lcs", or "ctc", representing
-	 * the different types of virtual network devices available on s390 systems.
-	 **/
+     * NMSettingWired:s390-nettype:
+     *
+     * s390 network device type; one of "qeth", "lcs", or "ctc", representing
+     * the different types of virtual network devices available on s390 systems.
+     **/
     /* ---ifcfg-rh---
-	 * property: s390-nettype
-	 * variable: NETTYPE
-	 * values: "qeth", "lcs" or "ctc"
-	 * description: Network type of the S390 host.
-	 * example: NETTYPE=qeth
-	 * ---end---
-	 */
+     * property: s390-nettype
+     * variable: NETTYPE
+     * values: "qeth", "lcs" or "ctc"
+     * description: Network type of the S390 host.
+     * example: NETTYPE=qeth
+     * ---end---
+     */
     obj_properties[PROP_S390_NETTYPE] = g_param_spec_string(
         NM_SETTING_WIRED_S390_NETTYPE,
         "",
@@ -1575,20 +1575,20 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:s390-options: (type GHashTable(utf8,utf8)):
-	 *
-	 * Dictionary of key/value pairs of s390-specific device options.  Both keys
-	 * and values must be strings.  Allowed keys include "portno", "layer2",
-	 * "portname", "protocol", among others.  Key names must contain only
-	 * alphanumeric characters (ie, [a-zA-Z0-9]).
-	 **/
+     * NMSettingWired:s390-options: (type GHashTable(utf8,utf8)):
+     *
+     * Dictionary of key/value pairs of s390-specific device options.  Both keys
+     * and values must be strings.  Allowed keys include "portno", "layer2",
+     * "portname", "protocol", among others.  Key names must contain only
+     * alphanumeric characters (ie, [a-zA-Z0-9]).
+     **/
     /* ---ifcfg-rh---
-	 * property: s390-options
-	 * variable: OPTIONS and PORTNAME, CTCPROTO,
-	 * description: S390 device options. All options go to OPTIONS, except for
-	 *   "portname" and "ctcprot" that have their own variables.
-	 * ---end---
-	 */
+     * property: s390-options
+     * variable: OPTIONS and PORTNAME, CTCPROTO,
+     * description: S390 device options. All options go to OPTIONS, except for
+     *   "portname" and "ctcprot" that have their own variables.
+     * ---end---
+     */
     obj_properties[PROP_S390_OPTIONS] = g_param_spec_boxed(
         NM_SETTING_WIRED_S390_OPTIONS,
         "",
@@ -1600,19 +1600,19 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                                  &nm_sett_info_propert_type_strdict);
 
     /**
-	 * NMSettingWired:wake-on-lan:
-	 *
-	 * The #NMSettingWiredWakeOnLan options to enable. Not all devices support all options.
-	 * May be any combination of %NM_SETTING_WIRED_WAKE_ON_LAN_PHY,
-	 * %NM_SETTING_WIRED_WAKE_ON_LAN_UNICAST, %NM_SETTING_WIRED_WAKE_ON_LAN_MULTICAST,
-	 * %NM_SETTING_WIRED_WAKE_ON_LAN_BROADCAST, %NM_SETTING_WIRED_WAKE_ON_LAN_ARP,
-	 * %NM_SETTING_WIRED_WAKE_ON_LAN_MAGIC or the special values
-	 * %NM_SETTING_WIRED_WAKE_ON_LAN_DEFAULT (to use global settings) and
-	 * %NM_SETTING_WIRED_WAKE_ON_LAN_IGNORE (to disable management of Wake-on-LAN in
-	 * NetworkManager).
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingWired:wake-on-lan:
+     *
+     * The #NMSettingWiredWakeOnLan options to enable. Not all devices support all options.
+     * May be any combination of %NM_SETTING_WIRED_WAKE_ON_LAN_PHY,
+     * %NM_SETTING_WIRED_WAKE_ON_LAN_UNICAST, %NM_SETTING_WIRED_WAKE_ON_LAN_MULTICAST,
+     * %NM_SETTING_WIRED_WAKE_ON_LAN_BROADCAST, %NM_SETTING_WIRED_WAKE_ON_LAN_ARP,
+     * %NM_SETTING_WIRED_WAKE_ON_LAN_MAGIC or the special values
+     * %NM_SETTING_WIRED_WAKE_ON_LAN_DEFAULT (to use global settings) and
+     * %NM_SETTING_WIRED_WAKE_ON_LAN_IGNORE (to disable management of Wake-on-LAN in
+     * NetworkManager).
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_WAKE_ON_LAN] =
         g_param_spec_uint(NM_SETTING_WIRED_WAKE_ON_LAN,
                           "",
@@ -1623,14 +1623,14 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWired:wake-on-lan-password:
-	 *
-	 * If specified, the password used with magic-packet-based
-	 * Wake-on-LAN, represented as an Ethernet MAC address.  If %NULL,
-	 * no password will be required.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingWired:wake-on-lan-password:
+     *
+     * If specified, the password used with magic-packet-based
+     * Wake-on-LAN, represented as an Ethernet MAC address.  If %NULL,
+     * no password will be required.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_WAKE_ON_LAN_PASSWORD] =
         g_param_spec_string(NM_SETTING_WIRED_WAKE_ON_LAN_PASSWORD,
                             "",
diff --git a/libnm-core/nm-setting-wireguard.c b/libnm-core/nm-setting-wireguard.c
index 0d2ce04d7b..23d4538189 100644
--- a/libnm-core/nm-setting-wireguard.c
+++ b/libnm-core/nm-setting-wireguard.c
@@ -578,8 +578,8 @@ nm_wireguard_peer_get_allowed_ip(const NMWireGuardPeer *self, guint idx, gboolea
     const char *s;
 
     /* With LTO, the compiler might warn about the g_return_val_if_fail()
-	 * code path not initializing the output argument. Workaround that by
-	 * always setting the out argument. */
+     * code path not initializing the output argument. Workaround that by
+     * always setting the out argument. */
     NM_SET_OUT(out_is_valid, FALSE);
 
     g_return_val_if_fail(NM_IS_WIREGUARD_PEER(self, TRUE), NULL);
@@ -624,7 +624,7 @@ _peer_append_allowed_ip(NMWireGuardPeer *self, const char *allowed_ip, gboolean
     nm_assert(allowed_ip);
 
     /* normalize the address (if it is valid. Otherwise, take it
-	 * as-is (it will render the instance invalid). */
+     * as-is (it will render the instance invalid). */
     if (!nm_utils_parse_inaddr_prefix_bin(AF_UNSPEC, allowed_ip, &addr_family, &addrbin, &prefix)) {
         if (!accept_invalid)
             return FALSE;
@@ -831,7 +831,7 @@ nm_wireguard_peer_cmp(const NMWireGuardPeer *a,
     NM_CMP_SELF(a, b);
 
     /* regardless of the @compare_flags, the public-key is the ID of the peer. It must
-	 * always be compared. */
+     * always be compared. */
     NM_CMP_FIELD_BOOL(a, b, public_key_valid);
     NM_CMP_FIELD_STR0(a, b, public_key);
 
@@ -1665,8 +1665,8 @@ _peers_dbus_only_set(NMSetting *         setting,
         }
 
         /* we could easily reject duplicate peers (by public-key) or duplicate GVariant attributes.
-		 * However, don't do that. In case of duplicate values, the latter peer overwrite the earlier
-		 * and GVariant attributes are ignored by g_variant_lookup() above. */
+         * However, don't do that. In case of duplicate values, the latter peer overwrite the earlier
+         * and GVariant attributes are ignored by g_variant_lookup() above. */
         if (_peers_append(NM_SETTING_WIREGUARD_GET_PRIVATE(setting), peer, TRUE))
             peers_changed = TRUE;
     }
@@ -1717,8 +1717,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
         const char *       method;
 
         /* WireGuard is Layer 3 only. For the moment, we only support a restricted set of
-		 * IP methods. We may relax that later, once we fix the implementations so they
-		 * actually work. */
+         * IP methods. We may relax that later, once we fix the implementations so they
+         * actually work. */
 
         if ((s_ip4 = nm_connection_get_setting_ip4_config(connection))
             && (method = nm_setting_ip_config_get_method(s_ip4))
@@ -1957,8 +1957,8 @@ update_one_secret(NMSetting *setting, const char *key, GVariant *value, GError *
 
         if (!g_variant_lookup(peer_var, NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY, "&s", &cstr)) {
             /* no preshared-key. Ignore the rest.
-			 *
-			 * In particular, we don't reject all unknown fields. */
+             *
+             * In particular, we don't reject all unknown fields. */
             continue;
         }
 
@@ -2032,7 +2032,7 @@ duplicate_copy_properties(const NMSettInfoSetting *sett_info, NMSetting *src, NM
         ->duplicate_copy_properties(sett_info, src, dst);
 
     /* We don't bother comparing the existing peers with what we are about to set.
-	 * Always reset all. */
+     * Always reset all. */
     if (_peers_clear(priv_dst) > 0)
         peers_changed = TRUE;
     for (i = 0; i < priv_src->peers_arr->len; i++) {
@@ -2203,7 +2203,7 @@ for_each_secret(NMSetting *                    setting,
 
     if (!g_variant_is_of_type(data_val, G_VARIANT_TYPE("aa{sv}"))) {
         /* invalid type. Silently ignore content as we cannot find secret-keys
-		 * here. */
+         * here. */
         return;
     }
 
@@ -2242,7 +2242,7 @@ for_each_secret(NMSetting *                    setting,
 
         if (pd && preshared_key) {
             /* without specifying a public-key of an existing peer, the secret is
-			 * ignored. */
+             * ignored. */
             secret_flags = nm_wireguard_peer_get_preshared_key_flags(pd->peer);
             if (callback(secret_flags, callback_data))
                 g_variant_builder_add(&peer_builder,
@@ -2415,12 +2415,12 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
     setting_class->for_each_secret           = for_each_secret;
 
     /**
-	 * NMSettingWireGuard:private-key:
-	 *
-	 * The 256 bit private-key in base64 encoding.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMSettingWireGuard:private-key:
+     *
+     * The 256 bit private-key in base64 encoding.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_PRIVATE_KEY] =
         g_param_spec_string(NM_SETTING_WIREGUARD_PRIVATE_KEY,
                             "",
@@ -2429,13 +2429,13 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireGuard:private-key-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingWirelessSecurity:private-key
-	 * property.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMSettingWireGuard:private-key-flags:
+     *
+     * Flags indicating how to handle the #NMSettingWirelessSecurity:private-key
+     * property.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_PRIVATE_KEY_FLAGS] =
         g_param_spec_flags(NM_SETTING_WIREGUARD_PRIVATE_KEY_FLAGS,
                            "",
@@ -2445,16 +2445,16 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireGuard:fwmark:
-	 *
-	 * The use of fwmark is optional and is by default off. Setting it to 0
-	 * disables it. Otherwise, it is a 32-bit fwmark for outgoing packets.
-	 *
-	 * Note that "ip4-auto-default-route" or "ip6-auto-default-route" enabled,
-	 * implies to automatically choose a fwmark.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMSettingWireGuard:fwmark:
+     *
+     * The use of fwmark is optional and is by default off. Setting it to 0
+     * disables it. Otherwise, it is a 32-bit fwmark for outgoing packets.
+     *
+     * Note that "ip4-auto-default-route" or "ip6-auto-default-route" enabled,
+     * implies to automatically choose a fwmark.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_FWMARK] =
         g_param_spec_uint(NM_SETTING_WIREGUARD_FWMARK,
                           "",
@@ -2465,13 +2465,13 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireGuard:listen-port:
-	 *
-	 * The listen-port. If listen-port is not specified, the port will be chosen
-	 * randomly when the interface comes up.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMSettingWireGuard:listen-port:
+     *
+     * The listen-port. If listen-port is not specified, the port will be chosen
+     * randomly when the interface comes up.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_LISTEN_PORT] =
         g_param_spec_uint(NM_SETTING_WIREGUARD_LISTEN_PORT,
                           "",
@@ -2482,22 +2482,22 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireGuard:peer-routes:
-	 *
-	 * Whether to automatically add routes for the AllowedIPs ranges
-	 * of the peers. If %TRUE (the default), NetworkManager will automatically
-	 * add routes in the routing tables according to ipv4.route-table and
-	 * ipv6.route-table. Usually you want this automatism enabled.
-	 * If %FALSE, no such routes are added automatically. In this case, the
-	 * user may want to configure static routes in ipv4.routes and ipv6.routes,
-	 * respectively.
-	 *
-	 * Note that if the peer's AllowedIPs is "0.0.0.0/0" or "::/0" and the profile's
-	 * ipv4.never-default or ipv6.never-default setting is enabled, the peer route for
-	 * this peer won't be added automatically.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMSettingWireGuard:peer-routes:
+     *
+     * Whether to automatically add routes for the AllowedIPs ranges
+     * of the peers. If %TRUE (the default), NetworkManager will automatically
+     * add routes in the routing tables according to ipv4.route-table and
+     * ipv6.route-table. Usually you want this automatism enabled.
+     * If %FALSE, no such routes are added automatically. In this case, the
+     * user may want to configure static routes in ipv4.routes and ipv6.routes,
+     * respectively.
+     *
+     * Note that if the peer's AllowedIPs is "0.0.0.0/0" or "::/0" and the profile's
+     * ipv4.never-default or ipv6.never-default setting is enabled, the peer route for
+     * this peer won't be added automatically.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_PEER_ROUTES] = g_param_spec_boolean(
         NM_SETTING_WIREGUARD_PEER_ROUTES,
         "",
@@ -2506,17 +2506,17 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireGuard:mtu:
-	 *
-	 * If non-zero, only transmit packets of the specified size or smaller,
-	 * breaking larger packets up into multiple fragments.
-	 *
-	 * If zero a default MTU is used. Note that contrary to wg-quick's MTU
-	 * setting, this does not take into account the current routes at the
-	 * time of activation.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMSettingWireGuard:mtu:
+     *
+     * If non-zero, only transmit packets of the specified size or smaller,
+     * breaking larger packets up into multiple fragments.
+     *
+     * If zero a default MTU is used. Note that contrary to wg-quick's MTU
+     * setting, this does not take into account the current routes at the
+     * time of activation.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_MTU] =
         g_param_spec_uint(NM_SETTING_WIREGUARD_MTU,
                           "",
@@ -2527,25 +2527,25 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
                           G_PARAM_READWRITE | NM_SETTING_PARAM_INFERRABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireGuard:ip4-auto-default-route:
-	 *
-	 * Whether to enable special handling of the IPv4 default route.
-	 * If enabled, the IPv4 default route from wireguard.peer-routes
-	 * will be placed to a dedicated routing-table and two policy routing rules
-	 * will be added. The fwmark number is also used as routing-table for the default-route,
-	 * and if fwmark is zero, an unused fwmark/table is chosen automatically.
-	 * This corresponds to what wg-quick does with Table=auto and what WireGuard
-	 * calls "Improved Rule-based Routing".
-	 *
-	 * Note that for this automatism to work, you usually don't want to set
-	 * ipv4.gateway, because that will result in a conflicting default route.
-	 *
-	 * Leaving this at the default will enable this option automatically
-	 * if ipv4.never-default is not set and there are any peers that use
-	 * a default-route as allowed-ips.
-	 *
-	 * Since: 1.20
-	 **/
+     * NMSettingWireGuard:ip4-auto-default-route:
+     *
+     * Whether to enable special handling of the IPv4 default route.
+     * If enabled, the IPv4 default route from wireguard.peer-routes
+     * will be placed to a dedicated routing-table and two policy routing rules
+     * will be added. The fwmark number is also used as routing-table for the default-route,
+     * and if fwmark is zero, an unused fwmark/table is chosen automatically.
+     * This corresponds to what wg-quick does with Table=auto and what WireGuard
+     * calls "Improved Rule-based Routing".
+     *
+     * Note that for this automatism to work, you usually don't want to set
+     * ipv4.gateway, because that will result in a conflicting default route.
+     *
+     * Leaving this at the default will enable this option automatically
+     * if ipv4.never-default is not set and there are any peers that use
+     * a default-route as allowed-ips.
+     *
+     * Since: 1.20
+     **/
     obj_properties[PROP_IP4_AUTO_DEFAULT_ROUTE] = g_param_spec_enum(
         NM_SETTING_WIREGUARD_IP4_AUTO_DEFAULT_ROUTE,
         "",
@@ -2555,12 +2555,12 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
         NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireGuard:ip6-auto-default-route:
-	 *
-	 * Like ip4-auto-default-route, but for the IPv6 default route.
-	 *
-	 * Since: 1.20
-	 **/
+     * NMSettingWireGuard:ip6-auto-default-route:
+     *
+     * Like ip4-auto-default-route, but for the IPv6 default route.
+     *
+     * Since: 1.20
+     **/
     obj_properties[PROP_IP6_AUTO_DEFAULT_ROUTE] = g_param_spec_enum(
         NM_SETTING_WIREGUARD_IP6_AUTO_DEFAULT_ROUTE,
         "",
@@ -2570,11 +2570,11 @@ nm_setting_wireguard_class_init(NMSettingWireGuardClass *klass)
         NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /* ---dbus---
-	 * property: peers
-	 * format: array of 'a{sv}'
-	 * description: Array of dictionaries for the WireGuard peers.
-	 * ---end---
-	 */
+     * property: peers
+     * format: array of 'a{sv}'
+     * description: Array of dictionaries for the WireGuard peers.
+     * ---end---
+     */
     _nm_properties_override_dbus(
         properties_override,
         NM_SETTING_WIREGUARD_PEERS,
diff --git a/libnm-core/nm-setting-wireless-security.c b/libnm-core/nm-setting-wireless-security.c
index 87f669fa4d..0e1acf9a81 100644
--- a/libnm-core/nm-setting-wireless-security.c
+++ b/libnm-core/nm-setting-wireless-security.c
@@ -1206,7 +1206,7 @@ get_secret_flags(NMSetting *           setting,
                      NM_SETTING_WIRELESS_SECURITY_WEP_KEY2,
                      NM_SETTING_WIRELESS_SECURITY_WEP_KEY3)) {
         /* There's only one 'flags' property for WEP keys, so alias all the WEP key
-		 * property names to that flags property. */
+         * property names to that flags property. */
         nm_assert(_nm_setting_property_is_regular_secret(setting, secret_name));
         nm_assert(_nm_setting_property_is_regular_secret_flags(
             setting,
@@ -1233,7 +1233,7 @@ set_secret_flags(NMSetting *          setting,
                      NM_SETTING_WIRELESS_SECURITY_WEP_KEY2,
                      NM_SETTING_WIRELESS_SECURITY_WEP_KEY3)) {
         /* There's only one 'flags' property for WEP keys, so alias all the WEP key
-		 * property names to that flags property. */
+         * property names to that flags property. */
         nm_assert(_nm_setting_property_is_regular_secret(setting, secret_name));
         nm_assert(_nm_setting_property_is_regular_secret_flags(
             setting,
@@ -1491,21 +1491,21 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
     setting_class->set_secret_flags = set_secret_flags;
 
     /**
-	 * NMSettingWirelessSecurity:key-mgmt:
-	 *
-	 * Key management used for the connection.  One of "none" (WEP),
-	 * "ieee8021x" (Dynamic WEP), "wpa-psk" (infrastructure WPA-PSK), "sae"
-	 * (SAE), "owe" (Opportunistic Wireless Encryption) or "wpa-eap"
-	 * (WPA-Enterprise).  This property must be set for
-	 * any Wi-Fi connection that uses security.
-	 **/
+     * NMSettingWirelessSecurity:key-mgmt:
+     *
+     * Key management used for the connection.  One of "none" (WEP),
+     * "ieee8021x" (Dynamic WEP), "wpa-psk" (infrastructure WPA-PSK), "sae"
+     * (SAE), "owe" (Opportunistic Wireless Encryption) or "wpa-eap"
+     * (WPA-Enterprise).  This property must be set for
+     * any Wi-Fi connection that uses security.
+     **/
     /* ---ifcfg-rh---
-	 * property: key-mgmt
-	 * variable: KEY_MGMT(+)
-	 * values: IEEE8021X, WPA-PSK, WPA-EAP
-	 * description: Key management menthod.
-	 * ---end---
-	 */
+     * property: key-mgmt
+     * variable: KEY_MGMT(+)
+     * values: IEEE8021X, WPA-PSK, WPA-EAP
+     * description: Key management menthod.
+     * ---end---
+     */
     obj_properties[PROP_KEY_MGMT] =
         g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_KEY_MGMT,
                             "",
@@ -1514,21 +1514,21 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_REQUIRED | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:wep-tx-keyidx:
-	 *
-	 * When static WEP is used (ie, key-mgmt = "none") and a non-default WEP key
-	 * index is used by the AP, put that WEP key index here.  Valid values are 0
-	 * (default key) through 3.  Note that some consumer access points (like the
-	 * Linksys WRT54G) number the keys 1 - 4.
-	 **/
+     * NMSettingWirelessSecurity:wep-tx-keyidx:
+     *
+     * When static WEP is used (ie, key-mgmt = "none") and a non-default WEP key
+     * index is used by the AP, put that WEP key index here.  Valid values are 0
+     * (default key) through 3.  Note that some consumer access points (like the
+     * Linksys WRT54G) number the keys 1 - 4.
+     **/
     /* ---ifcfg-rh---
-	 * property: wep-tx-keyidx
-	 * variable: DEFAULTKEY
-	 * values: 1, 2, 3, 4
-	 * default: 1
-	 * description: Index of active WEP key.
-	 * ---end---
-	 */
+     * property: wep-tx-keyidx
+     * variable: DEFAULTKEY
+     * values: 1, 2, 3, 4
+     * default: 1
+     * description: Index of active WEP key.
+     * ---end---
+     */
     obj_properties[PROP_WEP_TX_KEYIDX] =
         g_param_spec_uint(NM_SETTING_WIRELESS_SECURITY_WEP_TX_KEYIDX,
                           "",
@@ -1539,21 +1539,21 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:auth-alg:
-	 *
-	 * When WEP is used (ie, key-mgmt = "none" or "ieee8021x") indicate the
-	 * 802.11 authentication algorithm required by the AP here.  One of "open"
-	 * for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP.  When
-	 * using Cisco LEAP (ie, key-mgmt = "ieee8021x" and auth-alg = "leap") the
-	 * "leap-username" and "leap-password" properties must be specified.
-	 **/
+     * NMSettingWirelessSecurity:auth-alg:
+     *
+     * When WEP is used (ie, key-mgmt = "none" or "ieee8021x") indicate the
+     * 802.11 authentication algorithm required by the AP here.  One of "open"
+     * for Open System, "shared" for Shared Key, or "leap" for Cisco LEAP.  When
+     * using Cisco LEAP (ie, key-mgmt = "ieee8021x" and auth-alg = "leap") the
+     * "leap-username" and "leap-password" properties must be specified.
+     **/
     /* ---ifcfg-rh---
-	 * property: auth-alg
-	 * variable: SECURITYMODE(+)
-	 * values: restricted, open, leap
-	 * description: Authentication algorithm for WEP.
-	 * ---end---
-	 */
+     * property: auth-alg
+     * variable: SECURITYMODE(+)
+     * values: restricted, open, leap
+     * description: Authentication algorithm for WEP.
+     * ---end---
+     */
     obj_properties[PROP_AUTH_ALG] = g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_AUTH_ALG,
                                                         "",
                                                         "",
@@ -1561,20 +1561,20 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:proto:
-	 *
-	 * List of strings specifying the allowed WPA protocol versions to use.
-	 * Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN).  If
-	 * not specified, both WPA and RSN connections are allowed.
-	 **/
+     * NMSettingWirelessSecurity:proto:
+     *
+     * List of strings specifying the allowed WPA protocol versions to use.
+     * Each element may be one "wpa" (allow WPA) or "rsn" (allow WPA2/RSN).  If
+     * not specified, both WPA and RSN connections are allowed.
+     **/
     /* ---ifcfg-rh---
-	 * property: proto
-	 * variable: WPA_ALLOW_WPA(+), WPA_ALLOW_WPA2(+)
-	 * values: yes, no
-	 * default: no
-	 * description: Allowed WPA protocols, WPA and WPA2 (RSN).
-	 * ---end---
-	 */
+     * property: proto
+     * variable: WPA_ALLOW_WPA(+), WPA_ALLOW_WPA2(+)
+     * values: yes, no
+     * default: no
+     * description: Allowed WPA protocols, WPA and WPA2 (RSN).
+     * ---end---
+     */
     obj_properties[PROP_PROTO] = g_param_spec_boxed(NM_SETTING_WIRELESS_SECURITY_PROTO,
                                                     "",
                                                     "",
@@ -1582,21 +1582,21 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                                                     G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:pairwise:
-	 *
-	 * A list of pairwise encryption algorithms which prevents connections to
-	 * Wi-Fi networks that do not utilize one of the algorithms in the list.
-	 * For maximum compatibility leave this property empty.  Each list element
-	 * may be one of "tkip" or "ccmp".
-	 **/
+     * NMSettingWirelessSecurity:pairwise:
+     *
+     * A list of pairwise encryption algorithms which prevents connections to
+     * Wi-Fi networks that do not utilize one of the algorithms in the list.
+     * For maximum compatibility leave this property empty.  Each list element
+     * may be one of "tkip" or "ccmp".
+     **/
     /* ---ifcfg-rh---
-	 * property: pairwise
-	 * variable: CIPHER_PAIRWISE(+)
-	 * values: CCMP, TKIP
-	 * description: Restrict pairwise encryption algorithms, specified as a space
-	 *   separated list.
-	 * ---end---
-	 */
+     * property: pairwise
+     * variable: CIPHER_PAIRWISE(+)
+     * values: CCMP, TKIP
+     * description: Restrict pairwise encryption algorithms, specified as a space
+     *   separated list.
+     * ---end---
+     */
     obj_properties[PROP_PAIRWISE] = g_param_spec_boxed(NM_SETTING_WIRELESS_SECURITY_PAIRWISE,
                                                        "",
                                                        "",
@@ -1604,21 +1604,21 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:group:
-	 *
-	 * A list of group/broadcast encryption algorithms which prevents
-	 * connections to Wi-Fi networks that do not utilize one of the algorithms
-	 * in the list.  For maximum compatibility leave this property empty.  Each
-	 * list element may be one of "wep40", "wep104", "tkip", or "ccmp".
-	 **/
+     * NMSettingWirelessSecurity:group:
+     *
+     * A list of group/broadcast encryption algorithms which prevents
+     * connections to Wi-Fi networks that do not utilize one of the algorithms
+     * in the list.  For maximum compatibility leave this property empty.  Each
+     * list element may be one of "wep40", "wep104", "tkip", or "ccmp".
+     **/
     /* ---ifcfg-rh---
-	 * property: group
-	 * variable: CIPHER_GROUP(+)
-	 * values: CCMP, TKIP, WEP40, WEP104
-	 * description: Restrict group/broadcast encryption algorithms, specified as a space
-	 *   separated list.
-	 * ---end---
-	 */
+     * property: group
+     * variable: CIPHER_GROUP(+)
+     * values: CCMP, TKIP, WEP40, WEP104
+     * description: Restrict group/broadcast encryption algorithms, specified as a space
+     *   separated list.
+     * ---end---
+     */
     obj_properties[PROP_GROUP] = g_param_spec_boxed(NM_SETTING_WIRELESS_SECURITY_GROUP,
                                                     "",
                                                     "",
@@ -1626,27 +1626,27 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                                                     G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:pmf:
-	 *
-	 * Indicates whether Protected Management Frames (802.11w) must be enabled
-	 * for the connection.  One of %NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT
-	 * (use global default value), %NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE
-	 * (disable PMF), %NM_SETTING_WIRELESS_SECURITY_PMF_OPTIONAL (enable PMF if
-	 * the supplicant and the access point support it) or
-	 * %NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED (enable PMF and fail if not
-	 * supported).  When set to %NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT and no
-	 * global default is set, PMF will be optionally enabled.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingWirelessSecurity:pmf:
+     *
+     * Indicates whether Protected Management Frames (802.11w) must be enabled
+     * for the connection.  One of %NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT
+     * (use global default value), %NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE
+     * (disable PMF), %NM_SETTING_WIRELESS_SECURITY_PMF_OPTIONAL (enable PMF if
+     * the supplicant and the access point support it) or
+     * %NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED (enable PMF and fail if not
+     * supported).  When set to %NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT and no
+     * global default is set, PMF will be optionally enabled.
+     *
+     * Since: 1.10
+     **/
     /* ---ifcfg-rh---
-	 * property: pmf
-	 * variable: PMF(+)
-	 * values: default, disable, optional, required
-	 * description: Enables or disables PMF (802.11w)
-	 * example: PMF=required
-	 * ---end---
-	 */
+     * property: pmf
+     * variable: PMF(+)
+     * values: default, disable, optional, required
+     * description: Enables or disables PMF (802.11w)
+     * example: PMF=required
+     * ---end---
+     */
     obj_properties[PROP_PMF] = g_param_spec_int(NM_SETTING_WIRELESS_SECURITY_PMF,
                                                 "",
                                                 "",
@@ -1657,17 +1657,17 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                                                     | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:leap-username:
-	 *
-	 * The login username for legacy LEAP connections (ie, key-mgmt =
-	 * "ieee8021x" and auth-alg = "leap").
-	 **/
+     * NMSettingWirelessSecurity:leap-username:
+     *
+     * The login username for legacy LEAP connections (ie, key-mgmt =
+     * "ieee8021x" and auth-alg = "leap").
+     **/
     /* ---ifcfg-rh---
-	 * property: leap-username
-	 * variable: IEEE_8021X_IDENTITY(+)
-	 * description: Login name for LEAP.
-	 * ---end---
-	 */
+     * property: leap-username
+     * variable: IEEE_8021X_IDENTITY(+)
+     * description: Login name for LEAP.
+     * ---end---
+     */
     obj_properties[PROP_LEAP_USERNAME] =
         g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_LEAP_USERNAME,
                             "",
@@ -1676,17 +1676,17 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:wep-key0:
-	 *
-	 * Index 0 WEP key.  This is the WEP key used in most networks.  See the
-	 * "wep-key-type" property for a description of how this key is interpreted.
-	 **/
+     * NMSettingWirelessSecurity:wep-key0:
+     *
+     * Index 0 WEP key.  This is the WEP key used in most networks.  See the
+     * "wep-key-type" property for a description of how this key is interpreted.
+     **/
     /* ---ifcfg-rh---
-	 * property: wep-key0
-	 * variable: KEY1, KEY_PASSPHRASE1(+)
-	 * description: The first WEP key (used in most networks). See also DEFAULTKEY for key index.
-	 * ---end---
-	 */
+     * property: wep-key0
+     * variable: KEY1, KEY_PASSPHRASE1(+)
+     * description: The first WEP key (used in most networks). See also DEFAULTKEY for key index.
+     * ---end---
+     */
     obj_properties[PROP_WEP_KEY0] =
         g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_WEP_KEY0,
                             "",
@@ -1695,17 +1695,17 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:wep-key1:
-	 *
-	 * Index 1 WEP key.  This WEP index is not used by most networks.  See the
-	 * "wep-key-type" property for a description of how this key is interpreted.
-	 **/
+     * NMSettingWirelessSecurity:wep-key1:
+     *
+     * Index 1 WEP key.  This WEP index is not used by most networks.  See the
+     * "wep-key-type" property for a description of how this key is interpreted.
+     **/
     /* ---ifcfg-rh---
-	 * property: wep-key1
-	 * variable: KEY2, KEY_PASSPHRASE2(+)
-	 * description: WEP key with index 1. See also DEFAULTKEY for key index.
-	 * ---end---
-	 */
+     * property: wep-key1
+     * variable: KEY2, KEY_PASSPHRASE2(+)
+     * description: WEP key with index 1. See also DEFAULTKEY for key index.
+     * ---end---
+     */
     obj_properties[PROP_WEP_KEY1] =
         g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_WEP_KEY1,
                             "",
@@ -1714,17 +1714,17 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:wep-key2:
-	 *
-	 * Index 2 WEP key.  This WEP index is not used by most networks.  See the
-	 * "wep-key-type" property for a description of how this key is interpreted.
-	 **/
+     * NMSettingWirelessSecurity:wep-key2:
+     *
+     * Index 2 WEP key.  This WEP index is not used by most networks.  See the
+     * "wep-key-type" property for a description of how this key is interpreted.
+     **/
     /* ---ifcfg-rh---
-	 * property: wep-key2
-	 * variable: KEY3, KEY_PASSPHRASE3(+)
-	 * description: WEP key with index 2. See also DEFAULTKEY for key index.
-	 * ---end---
-	 */
+     * property: wep-key2
+     * variable: KEY3, KEY_PASSPHRASE3(+)
+     * description: WEP key with index 2. See also DEFAULTKEY for key index.
+     * ---end---
+     */
     obj_properties[PROP_WEP_KEY2] =
         g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_WEP_KEY2,
                             "",
@@ -1733,17 +1733,17 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:wep-key3:
-	 *
-	 * Index 3 WEP key.  This WEP index is not used by most networks.  See the
-	 * "wep-key-type" property for a description of how this key is interpreted.
-	 **/
+     * NMSettingWirelessSecurity:wep-key3:
+     *
+     * Index 3 WEP key.  This WEP index is not used by most networks.  See the
+     * "wep-key-type" property for a description of how this key is interpreted.
+     **/
     /* ---ifcfg-rh---
-	 * property: wep-key3
-	 * variable: KEY4, KEY_PASSPHRASE4(+)
-	 * description: WEP key with index 3. See also DEFAULTKEY for key index.
-	 * ---end---
-	 */
+     * property: wep-key3
+     * variable: KEY4, KEY_PASSPHRASE4(+)
+     * description: WEP key with index 3. See also DEFAULTKEY for key index.
+     * ---end---
+     */
     obj_properties[PROP_WEP_KEY3] =
         g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_WEP_KEY3,
                             "",
@@ -1752,19 +1752,19 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:wep-key-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingWirelessSecurity:wep-key0,
-	 * #NMSettingWirelessSecurity:wep-key1, #NMSettingWirelessSecurity:wep-key2,
-	 * and #NMSettingWirelessSecurity:wep-key3 properties.
-	 **/
+     * NMSettingWirelessSecurity:wep-key-flags:
+     *
+     * Flags indicating how to handle the #NMSettingWirelessSecurity:wep-key0,
+     * #NMSettingWirelessSecurity:wep-key1, #NMSettingWirelessSecurity:wep-key2,
+     * and #NMSettingWirelessSecurity:wep-key3 properties.
+     **/
     /* ---ifcfg-rh---
-	 * property: wep-key-flags
-	 * variable: WEP_KEY_FLAGS(+)
-	 * format: NMSettingSecretFlags
-	 * description: Password flags for KEY<i>, KEY_PASSPHRASE<i> password.
-	 * ---end---
-	 */
+     * property: wep-key-flags
+     * variable: WEP_KEY_FLAGS(+)
+     * format: NMSettingSecretFlags
+     * description: Password flags for KEY<i>, KEY_PASSPHRASE<i> password.
+     * ---end---
+     */
     obj_properties[PROP_WEP_KEY_FLAGS] =
         g_param_spec_flags(NM_SETTING_WIRELESS_SECURITY_WEP_KEY_FLAGS,
                            "",
@@ -1774,20 +1774,20 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:psk:
-	 *
-	 * Pre-Shared-Key for WPA networks. For WPA-PSK, it's either an ASCII
-	 * passphrase of 8 to 63 characters that is (as specified in the 802.11i
-	 * standard) hashed to derive the actual key, or the key in form of 64
-	 * hexadecimal character. The WPA3-Personal networks use a passphrase
-	 * of any length for SAE authentication.
-	 **/
+     * NMSettingWirelessSecurity:psk:
+     *
+     * Pre-Shared-Key for WPA networks. For WPA-PSK, it's either an ASCII
+     * passphrase of 8 to 63 characters that is (as specified in the 802.11i
+     * standard) hashed to derive the actual key, or the key in form of 64
+     * hexadecimal character. The WPA3-Personal networks use a passphrase
+     * of any length for SAE authentication.
+     **/
     /* ---ifcfg-rh---
-	 * property: psk
-	 * variable: WPA_PSK
-	 * description: Pre-Shared-Key for WPA networks.
-	 * ---end---
-	 */
+     * property: psk
+     * variable: WPA_PSK
+     * description: Pre-Shared-Key for WPA networks.
+     * ---end---
+     */
     obj_properties[PROP_PSK] =
         g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_PSK,
                             "",
@@ -1796,19 +1796,19 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:psk-flags:
-	 *
-	 * Flags indicating how to handle the #NMSettingWirelessSecurity:psk
-	 * property.
-	 **/
+     * NMSettingWirelessSecurity:psk-flags:
+     *
+     * Flags indicating how to handle the #NMSettingWirelessSecurity:psk
+     * property.
+     **/
     /* ---ifcfg-rh---
-	 * property: psk-flags
-	 * variable: WPA_PSK_FLAGS(+)
-	 * format: NMSettingSecretFlags
-	 * description: Password flags for WPA_PSK_FLAGS.
-	 * example: WPA_PSK_FLAGS=user
-	 * ---end---
-	 */
+     * property: psk-flags
+     * variable: WPA_PSK_FLAGS(+)
+     * format: NMSettingSecretFlags
+     * description: Password flags for WPA_PSK_FLAGS.
+     * example: WPA_PSK_FLAGS=user
+     * ---end---
+     */
     obj_properties[PROP_PSK_FLAGS] = g_param_spec_flags(NM_SETTING_WIRELESS_SECURITY_PSK_FLAGS,
                                                         "",
                                                         "",
@@ -1817,18 +1817,18 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                                                         G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:leap-password:
-	 *
-	 * The login password for legacy LEAP connections (ie, key-mgmt =
-	 * "ieee8021x" and auth-alg = "leap").
-	 **/
+     * NMSettingWirelessSecurity:leap-password:
+     *
+     * The login password for legacy LEAP connections (ie, key-mgmt =
+     * "ieee8021x" and auth-alg = "leap").
+     **/
     /* ---ifcfg-rh---
-	 * property: leap-password
-	 * variable: IEEE_8021X_PASSWORD(+)
-	 * description: Password for LEAP. It can also go to "key-"
-	 *  lookaside file, or it can be owned by a secret agent.
-	 * ---end---
-	 */
+     * property: leap-password
+     * variable: IEEE_8021X_PASSWORD(+)
+     * description: Password for LEAP. It can also go to "key-"
+     *  lookaside file, or it can be owned by a secret agent.
+     * ---end---
+     */
     obj_properties[PROP_LEAP_PASSWORD] =
         g_param_spec_string(NM_SETTING_WIRELESS_SECURITY_LEAP_PASSWORD,
                             "",
@@ -1837,18 +1837,18 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                             G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:leap-password-flags:
-	 *
-	 * Flags indicating how to handle the
-	 * #NMSettingWirelessSecurity:leap-password property.
-	 **/
+     * NMSettingWirelessSecurity:leap-password-flags:
+     *
+     * Flags indicating how to handle the
+     * #NMSettingWirelessSecurity:leap-password property.
+     **/
     /* ---ifcfg-rh---
-	 * property: leap-password-flags
-	 * variable: IEEE_8021X_PASSWORD_FLAGS(+)
-	 * format: NMSettingSecretFlags
-	 * description: Password flags for IEEE_8021X_PASSWORD_FLAGS.
-	 * ---end---
-	 */
+     * property: leap-password-flags
+     * variable: IEEE_8021X_PASSWORD_FLAGS(+)
+     * format: NMSettingSecretFlags
+     * description: Password flags for IEEE_8021X_PASSWORD_FLAGS.
+     * ---end---
+     */
     obj_properties[PROP_LEAP_PASSWORD_FLAGS] =
         g_param_spec_flags(NM_SETTING_WIRELESS_SECURITY_LEAP_PASSWORD_FLAGS,
                            "",
@@ -1858,25 +1858,25 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                            G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:wep-key-type:
-	 *
-	 * Controls the interpretation of WEP keys.  Allowed values are
-	 * %NM_WEP_KEY_TYPE_KEY, in which case the key is either a 10- or
-	 * 26-character hexadecimal string, or a 5- or 13-character ASCII password;
-	 * or %NM_WEP_KEY_TYPE_PASSPHRASE, in which case the passphrase is provided
-	 * as a string and will be hashed using the de-facto MD5 method to derive
-	 * the actual WEP key.
-	 **/
+     * NMSettingWirelessSecurity:wep-key-type:
+     *
+     * Controls the interpretation of WEP keys.  Allowed values are
+     * %NM_WEP_KEY_TYPE_KEY, in which case the key is either a 10- or
+     * 26-character hexadecimal string, or a 5- or 13-character ASCII password;
+     * or %NM_WEP_KEY_TYPE_PASSPHRASE, in which case the passphrase is provided
+     * as a string and will be hashed using the de-facto MD5 method to derive
+     * the actual WEP key.
+     **/
     /* ---ifcfg-rh---
-	 * property: wep-key-type
-	 * variable: KEY<i> or KEY_PASSPHRASE<i>(+); KEY_TYPE(+)
-	 * description: KEY is used for "key" type (10 or 26 hexadecimal characters,
-	 *   or 5 or 13 character string prefixed with "s:"). KEY_PASSPHRASE is used
-	 *   for WEP passphrases. KEY_TYPE specifies the key type and can be either
-	 *   'key' or 'passphrase'. KEY_TYPE is redundant and can be omitted.
-	 * example: KEY1=s:ahoj, KEY1=0a1c45bc02, KEY_PASSPHRASE1=mysupersecretkey
-	 * ---end---
-	 */
+     * property: wep-key-type
+     * variable: KEY<i> or KEY_PASSPHRASE<i>(+); KEY_TYPE(+)
+     * description: KEY is used for "key" type (10 or 26 hexadecimal characters,
+     *   or 5 or 13 character string prefixed with "s:"). KEY_PASSPHRASE is used
+     *   for WEP passphrases. KEY_TYPE specifies the key type and can be either
+     *   'key' or 'passphrase'. KEY_TYPE is redundant and can be omitted.
+     * example: KEY1=s:ahoj, KEY1=0a1c45bc02, KEY_PASSPHRASE1=mysupersecretkey
+     * ---end---
+     */
     obj_properties[PROP_WEP_KEY_TYPE] =
         g_param_spec_enum(NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE,
                           "",
@@ -1891,27 +1891,27 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
                                   .gprop_to_dbus_fcn = wep_key_type_to_dbus, ));
 
     /**
-	 * NMSettingWirelessSecurity:wps-method:
-	 *
-	 * Flags indicating which mode of WPS is to be used if any.
-	 *
-	 * There's little point in changing the default setting as NetworkManager will
-	 * automatically determine whether it's feasible to start WPS enrollment from
-	 * the Access Point capabilities.
-	 *
-	 * WPS can be disabled by setting this property to a value of 1.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMSettingWirelessSecurity:wps-method:
+     *
+     * Flags indicating which mode of WPS is to be used if any.
+     *
+     * There's little point in changing the default setting as NetworkManager will
+     * automatically determine whether it's feasible to start WPS enrollment from
+     * the Access Point capabilities.
+     *
+     * WPS can be disabled by setting this property to a value of 1.
+     *
+     * Since: 1.10
+     **/
     /* ---ifcfg-rh---
-	 * property: wps-method
-	 * variable: WPS_METHOD
-	 * description: Used to control the WPS methods to be used
-	 *    Valid values are "default", "auto", "disabled", "pin" and "pbc".
-	 *    If omitted, whatver the AP announces is used.
-	 * example: WPS_METHOD=disabled, WPS_METHOD="pin pbc"
-	 * ---end---
-	 */
+     * property: wps-method
+     * variable: WPS_METHOD
+     * description: Used to control the WPS methods to be used
+     *    Valid values are "default", "auto", "disabled", "pin" and "pbc".
+     *    If omitted, whatver the AP announces is used.
+     * example: WPS_METHOD=disabled, WPS_METHOD="pin pbc"
+     * ---end---
+     */
     obj_properties[PROP_WPS_METHOD] = g_param_spec_uint(
         NM_SETTING_WIRELESS_SECURITY_WPS_METHOD,
         "",
@@ -1922,27 +1922,27 @@ nm_setting_wireless_security_class_init(NMSettingWirelessSecurityClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWirelessSecurity:fils:
-	 *
-	 * Indicates whether Fast Initial Link Setup (802.11ai) must be enabled for
-	 * the connection.  One of %NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (use
-	 * global default value), %NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE
-	 * (disable FILS), %NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL (enable FILS
-	 * if the supplicant and the access point support it) or
-	 * %NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED (enable FILS and fail if not
-	 * supported).  When set to %NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT and
-	 * no global default is set, FILS will be optionally enabled.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingWirelessSecurity:fils:
+     *
+     * Indicates whether Fast Initial Link Setup (802.11ai) must be enabled for
+     * the connection.  One of %NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT (use
+     * global default value), %NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE
+     * (disable FILS), %NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL (enable FILS
+     * if the supplicant and the access point support it) or
+     * %NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED (enable FILS and fail if not
+     * supported).  When set to %NM_SETTING_WIRELESS_SECURITY_FILS_DEFAULT and
+     * no global default is set, FILS will be optionally enabled.
+     *
+     * Since: 1.12
+     **/
     /* ---ifcfg-rh---
-	 * property: fils
-	 * variable: FILS(+)
-	 * values: default, disable, optional, required
-	 * description: Enables or disables FILS (802.11ai)
-	 * example: FILS=required
-	 * ---end---
-	 */
+     * property: fils
+     * variable: FILS(+)
+     * values: default, disable, optional, required
+     * description: Enables or disables FILS (802.11ai)
+     * example: FILS=required
+     * ---end---
+     */
     obj_properties[PROP_FILS] = g_param_spec_int(NM_SETTING_WIRELESS_SECURITY_FILS,
                                                  "",
                                                  "",
diff --git a/libnm-core/nm-setting-wireless.c b/libnm-core/nm-setting-wireless.c
index 384a6f2871..2c56bf209c 100644
--- a/libnm-core/nm-setting-wireless.c
+++ b/libnm-core/nm-setting-wireless.c
@@ -166,15 +166,15 @@ nm_setting_wireless_ap_security_compatible(NMSettingWireless *        s_wireless
                 return FALSE;
 
             /* quick check; can't use AP if it doesn't support at least one
-			 * WEP cipher in both pairwise and group suites.
-			 */
+             * WEP cipher in both pairwise and group suites.
+             */
             if (!(ap_wpa & (NM_802_11_AP_SEC_PAIR_WEP40 | NM_802_11_AP_SEC_PAIR_WEP104))
                 || !(ap_wpa & (NM_802_11_AP_SEC_GROUP_WEP40 | NM_802_11_AP_SEC_GROUP_WEP104)))
                 return FALSE;
 
             /* Match at least one pairwise cipher with AP's capability if the
-			 * wireless-security setting explicitly lists pairwise ciphers
-			 */
+             * wireless-security setting explicitly lists pairwise ciphers
+             */
             num = nm_setting_wireless_security_get_num_pairwise(s_wireless_sec);
             for (i = 0, found = FALSE; i < num; i++) {
                 cipher = nm_setting_wireless_security_get_pairwise(s_wireless_sec, i);
@@ -195,8 +195,8 @@ nm_setting_wireless_ap_security_compatible(NMSettingWireless *        s_wireless
                 return FALSE;
 
             /* Match at least one group cipher with AP's capability if the
-			 * wireless-security setting explicitly lists group ciphers
-			 */
+             * wireless-security setting explicitly lists group ciphers
+             */
             num = nm_setting_wireless_security_get_num_groups(s_wireless_sec);
             for (i = 0, found = FALSE; i < num; i++) {
                 cipher = nm_setting_wireless_security_get_group(s_wireless_sec, i);
@@ -247,8 +247,8 @@ nm_setting_wireless_ap_security_compatible(NMSettingWireless *        s_wireless
         // the AP's RSN IE instead
 
         /* Match at least one pairwise cipher with AP's capability if the
-		 * wireless-security setting explicitly lists pairwise ciphers
-		 */
+         * wireless-security setting explicitly lists pairwise ciphers
+         */
         num = nm_setting_wireless_security_get_num_pairwise(s_wireless_sec);
         for (i = 0, found = FALSE; i < num; i++) {
             cipher = nm_setting_wireless_security_get_pairwise(s_wireless_sec, i);
@@ -261,8 +261,8 @@ nm_setting_wireless_ap_security_compatible(NMSettingWireless *        s_wireless
             return FALSE;
 
         /* Match at least one group cipher with AP's capability if the
-		 * wireless-security setting explicitly lists group ciphers
-		 */
+         * wireless-security setting explicitly lists group ciphers
+         */
         num = nm_setting_wireless_security_get_num_groups(s_wireless_sec);
         for (i = 0, found = FALSE; i < num; i++) {
             cipher = nm_setting_wireless_security_get_group(s_wireless_sec, i);
@@ -915,8 +915,8 @@ verify(NMSetting *setting, NMConnection *connection, GError **error)
     }
 
     /* generate-mac-address-mask only makes sense with cloned-mac-address "random" or
-	 * "stable". Still, let's not be so strict about that and accept the value
-	 * even if it is unused. */
+     * "stable". Still, let's not be so strict about that and accept the value
+     * even if it is unused. */
     if (!_nm_utils_generate_mac_address_mask_parse(priv->generate_mac_address_mask,
                                                    NULL,
                                                    NULL,
@@ -1236,7 +1236,7 @@ set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *ps
             _nm_utils_hwaddr_canonical_or_invalid(g_value_get_string(value), ETH_ALEN);
         if (bool_val && !priv->cloned_mac_address) {
             /* cloned-mac-address was set before but was now explicitly cleared.
-			 * In this case, we also clear mac-address-randomization flag */
+             * In this case, we also clear mac-address-randomization flag */
             if (priv->mac_address_randomization != NM_SETTING_MAC_RANDOMIZATION_DEFAULT) {
                 priv->mac_address_randomization = NM_SETTING_MAC_RANDOMIZATION_DEFAULT;
                 _notify(NM_SETTING_WIRELESS(object), PROP_MAC_ADDRESS_RANDOMIZATION);
@@ -1366,23 +1366,23 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
     setting_class->compare_property = compare_property;
 
     /**
-	 * NMSettingWireless:ssid:
-	 *
-	 * SSID of the Wi-Fi network. Must be specified.
-	 **/
+     * NMSettingWireless:ssid:
+     *
+     * SSID of the Wi-Fi network. Must be specified.
+     **/
     /* ---keyfile---
-	 * property: ssid
-	 * format: string (or decimal-byte list - obsolete)
-	 * description: SSID of Wi-Fi network.
-	 * example: ssid=Quick Net
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: ssid
-	 * variable: ESSID
-	 * description: SSID of Wi-Fi network.
-	 * example: ESSID="Quick Net"
-	 * ---end---
-	 */
+     * property: ssid
+     * format: string (or decimal-byte list - obsolete)
+     * description: SSID of Wi-Fi network.
+     * example: ssid=Quick Net
+     * ---end---
+     * ---ifcfg-rh---
+     * property: ssid
+     * variable: ESSID
+     * description: SSID of Wi-Fi network.
+     * example: ESSID="Quick Net"
+     * ---end---
+     */
     obj_properties[PROP_SSID] = g_param_spec_boxed(NM_SETTING_WIRELESS_SSID,
                                                    "",
                                                    "",
@@ -1390,18 +1390,18 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                                    G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:mode:
-	 *
-	 * Wi-Fi network mode; one of "infrastructure", "mesh", "adhoc" or "ap".  If blank,
-	 * infrastructure is assumed.
-	 **/
+     * NMSettingWireless:mode:
+     *
+     * Wi-Fi network mode; one of "infrastructure", "mesh", "adhoc" or "ap".  If blank,
+     * infrastructure is assumed.
+     **/
     /* ---ifcfg-rh---
-	 * property: mode
-	 * variable: MODE
-	 * values: Ad-Hoc, Managed (Auto)  [case insensitive]
-	 * description: Wi-Fi network mode.
-	 * ---end---
-	 */
+     * property: mode
+     * variable: MODE
+     * values: Ad-Hoc, Managed (Auto)  [case insensitive]
+     * description: Wi-Fi network mode.
+     * ---end---
+     */
     obj_properties[PROP_MODE] = g_param_spec_string(NM_SETTING_WIRELESS_MODE,
                                                     "",
                                                     "",
@@ -1409,24 +1409,24 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                                     G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:band:
-	 *
-	 * 802.11 frequency band of the network.  One of "a" for 5GHz 802.11a or
-	 * "bg" for 2.4GHz 802.11.  This will lock associations to the Wi-Fi network
-	 * to the specific band, i.e. if "a" is specified, the device will not
-	 * associate with the same network in the 2.4GHz band even if the network's
-	 * settings are compatible.  This setting depends on specific driver
-	 * capability and may not work with all drivers.
-	 **/
+     * NMSettingWireless:band:
+     *
+     * 802.11 frequency band of the network.  One of "a" for 5GHz 802.11a or
+     * "bg" for 2.4GHz 802.11.  This will lock associations to the Wi-Fi network
+     * to the specific band, i.e. if "a" is specified, the device will not
+     * associate with the same network in the 2.4GHz band even if the network's
+     * settings are compatible.  This setting depends on specific driver
+     * capability and may not work with all drivers.
+     **/
     /* ---ifcfg-rh---
-	 * property: band
-	 * variable: BAND(+)
-	 * values: a, bg
-	 * description: BAND alone is honored, but CHANNEL overrides BAND since it
-	 *   implies a band.
-	 * example: BAND=bg
-	 * ---end---
-	 */
+     * property: band
+     * variable: BAND(+)
+     * values: a, bg
+     * description: BAND alone is honored, but CHANNEL overrides BAND since it
+     *   implies a band.
+     * example: BAND=bg
+     * ---end---
+     */
     obj_properties[PROP_BAND] = g_param_spec_string(NM_SETTING_WIRELESS_BAND,
                                                     "",
                                                     "",
@@ -1434,22 +1434,22 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                                     G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:channel:
-	 *
-	 * Wireless channel to use for the Wi-Fi connection.  The device will only
-	 * join (or create for Ad-Hoc networks) a Wi-Fi network on the specified
-	 * channel.  Because channel numbers overlap between bands, this property
-	 * also requires the "band" property to be set.
-	 **/
+     * NMSettingWireless:channel:
+     *
+     * Wireless channel to use for the Wi-Fi connection.  The device will only
+     * join (or create for Ad-Hoc networks) a Wi-Fi network on the specified
+     * channel.  Because channel numbers overlap between bands, this property
+     * also requires the "band" property to be set.
+     **/
     /* ---ifcfg-rh---
-	 * property: channel
-	 * variable: CHANNEL
-	 * description: Channel used for the Wi-Fi communication.
-	 *   Channels greater than 14 mean "a" band, otherwise the
-	 *   band is "bg".
-	 * example: CHANNEL=6
-	 * ---end---
-	 */
+     * property: channel
+     * variable: CHANNEL
+     * description: Channel used for the Wi-Fi communication.
+     *   Channels greater than 14 mean "a" band, otherwise the
+     *   band is "bg".
+     * example: CHANNEL=6
+     * ---end---
+     */
     obj_properties[PROP_CHANNEL] = g_param_spec_uint(NM_SETTING_WIRELESS_CHANNEL,
                                                      "",
                                                      "",
@@ -1459,20 +1459,20 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                                      G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:bssid:
-	 *
-	 * If specified, directs the device to only associate with the given access
-	 * point.  This capability is highly driver dependent and not supported by
-	 * all devices.  Note: this property does not control the BSSID used when
-	 * creating an Ad-Hoc network and is unlikely to in the future.
-	 **/
+     * NMSettingWireless:bssid:
+     *
+     * If specified, directs the device to only associate with the given access
+     * point.  This capability is highly driver dependent and not supported by
+     * all devices.  Note: this property does not control the BSSID used when
+     * creating an Ad-Hoc network and is unlikely to in the future.
+     **/
     /* ---ifcfg-rh---
-	 * property: bssid
-	 * variable: BSSID(+)
-	 * description: Restricts association only to a single AP.
-	 * example: BSSID=00:1E:BD:64:83:21
-	 * ---end---
-	 */
+     * property: bssid
+     * variable: BSSID(+)
+     * description: Restricts association only to a single AP.
+     * example: BSSID=00:1E:BD:64:83:21
+     * ---end---
+     */
     obj_properties[PROP_BSSID] = g_param_spec_string(NM_SETTING_WIRELESS_BSSID,
                                                      "",
                                                      "",
@@ -1483,19 +1483,19 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                  &nm_sett_info_propert_type_mac_address);
 
     /**
-	 * NMSettingWireless:rate:
-	 *
-	 * If non-zero, directs the device to only use the specified bitrate for
-	 * communication with the access point.  Units are in Kb/s, ie 5500 = 5.5
-	 * Mbit/s.  This property is highly driver dependent and not all devices
-	 * support setting a static bitrate.
-	 **/
+     * NMSettingWireless:rate:
+     *
+     * If non-zero, directs the device to only use the specified bitrate for
+     * communication with the access point.  Units are in Kb/s, ie 5500 = 5.5
+     * Mbit/s.  This property is highly driver dependent and not all devices
+     * support setting a static bitrate.
+     **/
     /* ---ifcfg-rh---
-	 * property: rate
-	 * variable: (none)
-	 * description: This property is not handled by ifcfg-rh plugin.
-	 * ---end---
-	 */
+     * property: rate
+     * variable: (none)
+     * description: This property is not handled by ifcfg-rh plugin.
+     * ---end---
+     */
     obj_properties[PROP_RATE] = g_param_spec_uint(NM_SETTING_WIRELESS_RATE,
                                                   "",
                                                   "",
@@ -1506,18 +1506,18 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                                       | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:tx-power:
-	 *
-	 * If non-zero, directs the device to use the specified transmit power.
-	 * Units are dBm.  This property is highly driver dependent and not all
-	 * devices support setting a static transmit power.
-	 **/
+     * NMSettingWireless:tx-power:
+     *
+     * If non-zero, directs the device to use the specified transmit power.
+     * Units are dBm.  This property is highly driver dependent and not all
+     * devices support setting a static transmit power.
+     **/
     /* ---ifcfg-rh---
-	 * property: tx-power
-	 * variable: (none)
-	 * description: This property is not handled by ifcfg-rh plugin.
-	 * ---end---
-	 */
+     * property: tx-power
+     * variable: (none)
+     * description: This property is not handled by ifcfg-rh plugin.
+     * ---end---
+     */
     obj_properties[PROP_TX_POWER] = g_param_spec_uint(
         NM_SETTING_WIRELESS_TX_POWER,
         "",
@@ -1528,29 +1528,29 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:mac-address:
-	 *
-	 * If specified, this connection will only apply to the Wi-Fi device whose
-	 * permanent MAC address matches. This property does not change the MAC
-	 * address of the device (i.e. MAC spoofing).
-	 **/
+     * NMSettingWireless:mac-address:
+     *
+     * If specified, this connection will only apply to the Wi-Fi device whose
+     * permanent MAC address matches. This property does not change the MAC
+     * address of the device (i.e. MAC spoofing).
+     **/
     /* ---keyfile---
-	 * property: mac-address
-	 * format: usual hex-digits-and-colons notation
-	 * description: MAC address in traditional hex-digits-and-colons notation
-	 *   (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete)
-	 *   (e.g. 0;34;104;18;121;162).
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: mac-address
-	 * variable: HWADDR
-	 * description: Hardware address of the device in traditional hex-digits-and-colons
-	 *    notation (e.g. 00:22:68:14:5A:05).
-	 *    Note that for initscripts this is the current MAC address of the device as found
-	 *    during ifup. For NetworkManager this is the permanent MAC address. Or in case no
-	 *    permanent MAC address exists, the MAC address initially configured on the device.
-	 * ---end---
-	 */
+     * property: mac-address
+     * format: usual hex-digits-and-colons notation
+     * description: MAC address in traditional hex-digits-and-colons notation
+     *   (e.g. 00:22:68:12:79:A2), or semicolon separated list of 6 bytes (obsolete)
+     *   (e.g. 0;34;104;18;121;162).
+     * ---end---
+     * ---ifcfg-rh---
+     * property: mac-address
+     * variable: HWADDR
+     * description: Hardware address of the device in traditional hex-digits-and-colons
+     *    notation (e.g. 00:22:68:14:5A:05).
+     *    Note that for initscripts this is the current MAC address of the device as found
+     *    during ifup. For NetworkManager this is the permanent MAC address. Or in case no
+     *    permanent MAC address exists, the MAC address initially configured on the device.
+     * ---end---
+     */
     obj_properties[PROP_MAC_ADDRESS] =
         g_param_spec_string(NM_SETTING_WIRELESS_MAC_ADDRESS,
                             "",
@@ -1562,47 +1562,47 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                  &nm_sett_info_propert_type_mac_address);
 
     /**
-	 * NMSettingWireless:cloned-mac-address:
-	 *
-	 * If specified, request that the device use this MAC address instead.
-	 * This is known as MAC cloning or spoofing.
-	 *
-	 * Beside explicitly specifying a MAC address, the special values "preserve", "permanent",
-	 * "random" and "stable" are supported.
-	 * "preserve" means not to touch the MAC address on activation.
-	 * "permanent" means to use the permanent hardware address of the device.
-	 * "random" creates a random MAC address on each connect.
-	 * "stable" creates a hashed MAC address based on connection.stable-id and a
-	 * machine dependent key.
-	 *
-	 * If unspecified, the value can be overwritten via global defaults, see manual
-	 * of NetworkManager.conf. If still unspecified, it defaults to "preserve"
-	 * (older versions of NetworkManager may use a different default value).
-	 *
-	 * On D-Bus, this field is expressed as "assigned-mac-address" or the deprecated
-	 * "cloned-mac-address".
-	 **/
+     * NMSettingWireless:cloned-mac-address:
+     *
+     * If specified, request that the device use this MAC address instead.
+     * This is known as MAC cloning or spoofing.
+     *
+     * Beside explicitly specifying a MAC address, the special values "preserve", "permanent",
+     * "random" and "stable" are supported.
+     * "preserve" means not to touch the MAC address on activation.
+     * "permanent" means to use the permanent hardware address of the device.
+     * "random" creates a random MAC address on each connect.
+     * "stable" creates a hashed MAC address based on connection.stable-id and a
+     * machine dependent key.
+     *
+     * If unspecified, the value can be overwritten via global defaults, see manual
+     * of NetworkManager.conf. If still unspecified, it defaults to "preserve"
+     * (older versions of NetworkManager may use a different default value).
+     *
+     * On D-Bus, this field is expressed as "assigned-mac-address" or the deprecated
+     * "cloned-mac-address".
+     **/
     /* ---keyfile---
-	 * property: cloned-mac-address
-	 * format: usual hex-digits-and-colons notation
-	 * description: Cloned MAC address in traditional hex-digits-and-colons notation
-	 *   (e.g. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete)
-	 *   (e.g. 0;34;104;18;121;178).
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: cloned-mac-address
-	 * variable: MACADDR
-	 * description: Cloned (spoofed) MAC address in traditional hex-digits-and-colons
-	 *    notation (e.g. 00:22:68:14:5A:99).
-	 * ---end---
-	 * ---dbus---
-	 * property: cloned-mac-address
-	 * format: byte array
-	 * description: This D-Bus field is deprecated in favor of "assigned-mac-address"
-	 *    which is more flexible and allows specifying special variants like "random".
-	 *    For libnm and nmcli, this field is called "cloned-mac-address".
-	 * ---end---
-	 */
+     * property: cloned-mac-address
+     * format: usual hex-digits-and-colons notation
+     * description: Cloned MAC address in traditional hex-digits-and-colons notation
+     *   (e.g. 00:22:68:12:79:B2), or semicolon separated list of 6 bytes (obsolete)
+     *   (e.g. 0;34;104;18;121;178).
+     * ---end---
+     * ---ifcfg-rh---
+     * property: cloned-mac-address
+     * variable: MACADDR
+     * description: Cloned (spoofed) MAC address in traditional hex-digits-and-colons
+     *    notation (e.g. 00:22:68:14:5A:99).
+     * ---end---
+     * ---dbus---
+     * property: cloned-mac-address
+     * format: byte array
+     * description: This D-Bus field is deprecated in favor of "assigned-mac-address"
+     *    which is more flexible and allows specifying special variants like "random".
+     *    For libnm and nmcli, this field is called "cloned-mac-address".
+     * ---end---
+     */
     obj_properties[PROP_CLONED_MAC_ADDRESS] = g_param_spec_string(
         NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS,
         "",
@@ -1614,60 +1614,60 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                  &nm_sett_info_propert_type_cloned_mac_address);
 
     /* ---dbus---
-	 * property: assigned-mac-address
-	 * format: string
-	 * description: The new field for the cloned MAC address. It can be either
-	 *   a hardware address in ASCII representation, or one of the special values
-	 *   "preserve", "permanent", "random" or "stable".
-	 *   This field replaces the deprecated "cloned-mac-address" on D-Bus, which
-	 *   can only contain explicit hardware addresses. Note that this property
-	 *   only exists in D-Bus API. libnm and nmcli continue to call this property
-	 *   "cloned-mac-address".
-	 * ---end---
-	 */
+     * property: assigned-mac-address
+     * format: string
+     * description: The new field for the cloned MAC address. It can be either
+     *   a hardware address in ASCII representation, or one of the special values
+     *   "preserve", "permanent", "random" or "stable".
+     *   This field replaces the deprecated "cloned-mac-address" on D-Bus, which
+     *   can only contain explicit hardware addresses. Note that this property
+     *   only exists in D-Bus API. libnm and nmcli continue to call this property
+     *   "cloned-mac-address".
+     * ---end---
+     */
     _nm_properties_override_dbus(properties_override,
                                  "assigned-mac-address",
                                  &nm_sett_info_propert_type_assigned_mac_address);
 
     /**
-	 * NMSettingWireless:generate-mac-address-mask:
-	 *
-	 * With #NMSettingWireless:cloned-mac-address setting "random" or "stable",
-	 * by default all bits of the MAC address are scrambled and a locally-administered,
-	 * unicast MAC address is created. This property allows to specify that certain bits
-	 * are fixed. Note that the least significant bit of the first MAC address will
-	 * always be unset to create a unicast MAC address.
-	 *
-	 * If the property is %NULL, it is eligible to be overwritten by a default
-	 * connection setting. If the value is still %NULL or an empty string, the
-	 * default is to create a locally-administered, unicast MAC address.
-	 *
-	 * If the value contains one MAC address, this address is used as mask. The set
-	 * bits of the mask are to be filled with the current MAC address of the device,
-	 * while the unset bits are subject to randomization.
-	 * Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address
-	 * and only randomize the lower 3 bytes using the "random" or "stable" algorithm.
-	 *
-	 * If the value contains one additional MAC address after the mask,
-	 * this address is used instead of the current MAC address to fill the bits
-	 * that shall not be randomized. For example, a value of
-	 * "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address
-	 * to 68:F7:28, while the lower bits are randomized. A value of
-	 * "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled
-	 * globally-administered, burned-in MAC address.
-	 *
-	 * If the value contains more than one additional MAC addresses, one of
-	 * them is chosen randomly. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00"
-	 * will create a fully scrambled MAC address, randomly locally or globally
-	 * administered.
-	 **/
+     * NMSettingWireless:generate-mac-address-mask:
+     *
+     * With #NMSettingWireless:cloned-mac-address setting "random" or "stable",
+     * by default all bits of the MAC address are scrambled and a locally-administered,
+     * unicast MAC address is created. This property allows to specify that certain bits
+     * are fixed. Note that the least significant bit of the first MAC address will
+     * always be unset to create a unicast MAC address.
+     *
+     * If the property is %NULL, it is eligible to be overwritten by a default
+     * connection setting. If the value is still %NULL or an empty string, the
+     * default is to create a locally-administered, unicast MAC address.
+     *
+     * If the value contains one MAC address, this address is used as mask. The set
+     * bits of the mask are to be filled with the current MAC address of the device,
+     * while the unset bits are subject to randomization.
+     * Setting "FE:FF:FF:00:00:00" means to preserve the OUI of the current MAC address
+     * and only randomize the lower 3 bytes using the "random" or "stable" algorithm.
+     *
+     * If the value contains one additional MAC address after the mask,
+     * this address is used instead of the current MAC address to fill the bits
+     * that shall not be randomized. For example, a value of
+     * "FE:FF:FF:00:00:00 68:F7:28:00:00:00" will set the OUI of the MAC address
+     * to 68:F7:28, while the lower bits are randomized. A value of
+     * "02:00:00:00:00:00 00:00:00:00:00:00" will create a fully scrambled
+     * globally-administered, burned-in MAC address.
+     *
+     * If the value contains more than one additional MAC addresses, one of
+     * them is chosen randomly. For example, "02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00"
+     * will create a fully scrambled MAC address, randomly locally or globally
+     * administered.
+     **/
     /* ---ifcfg-rh---
-	 * property: generate-mac-address-mask
-	 * variable: GENERATE_MAC_ADDRESS_MASK(+)
-	 * description: the MAC address mask for generating randomized and stable
-	 *   cloned-mac-address.
-	 * ---end---
-	 */
+     * property: generate-mac-address-mask
+     * variable: GENERATE_MAC_ADDRESS_MASK(+)
+     * description: the MAC address mask for generating randomized and stable
+     *   cloned-mac-address.
+     * ---end---
+     */
     obj_properties[PROP_GENERATE_MAC_ADDRESS_MASK] = g_param_spec_string(
         NM_SETTING_WIRELESS_GENERATE_MAC_ADDRESS_MASK,
         "",
@@ -1676,25 +1676,25 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:mac-address-blacklist:
-	 *
-	 * A list of permanent MAC addresses of Wi-Fi devices to which this
-	 * connection should never apply.  Each MAC address should be given in the
-	 * standard hex-digits-and-colons notation (eg "00:11:22:33:44:55").
-	 **/
+     * NMSettingWireless:mac-address-blacklist:
+     *
+     * A list of permanent MAC addresses of Wi-Fi devices to which this
+     * connection should never apply.  Each MAC address should be given in the
+     * standard hex-digits-and-colons notation (eg "00:11:22:33:44:55").
+     **/
     /* ---keyfile---
-	 * property: mac-address-blacklist
-	 * format: list of MACs (separated with semicolons)
-	 * description: MAC address blacklist.
-	 * example: mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78
-	 * ---end---
-	 * ---ifcfg-rh---
-	 * property: mac-address-blacklist
-	 * variable: HWADDR_BLACKLIST(+)
-	 * description: It denies usage of the connection for any device whose address
-	 *   is listed.
-	 * ---end---
-	 */
+     * property: mac-address-blacklist
+     * format: list of MACs (separated with semicolons)
+     * description: MAC address blacklist.
+     * example: mac-address-blacklist= 00:22:68:12:79:A6;00:22:68:12:79:78
+     * ---end---
+     * ---ifcfg-rh---
+     * property: mac-address-blacklist
+     * variable: HWADDR_BLACKLIST(+)
+     * description: It denies usage of the connection for any device whose address
+     *   is listed.
+     * ---end---
+     */
     obj_properties[PROP_MAC_ADDRESS_BLACKLIST] = g_param_spec_boxed(
         NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST,
         "",
@@ -1703,21 +1703,21 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
         G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:seen-bssids:
-	 *
-	 * A list of BSSIDs (each BSSID formatted as a MAC address like
-	 * "00:11:22:33:44:55") that have been detected as part of the Wi-Fi
-	 * network.  NetworkManager internally tracks previously seen BSSIDs. The
-	 * property is only meant for reading and reflects the BSSID list of
-	 * NetworkManager. The changes you make to this property will not be
-	 * preserved.
-	 **/
+     * NMSettingWireless:seen-bssids:
+     *
+     * A list of BSSIDs (each BSSID formatted as a MAC address like
+     * "00:11:22:33:44:55") that have been detected as part of the Wi-Fi
+     * network.  NetworkManager internally tracks previously seen BSSIDs. The
+     * property is only meant for reading and reflects the BSSID list of
+     * NetworkManager. The changes you make to this property will not be
+     * preserved.
+     **/
     /* ---ifcfg-rh---
-	 * property: seen-bssids
-	 * variable: (none)
-	 * description: This property is not handled by ifcfg-rh plugin.
-	 * ---end---
-	 */
+     * property: seen-bssids
+     * variable: (none)
+     * description: This property is not handled by ifcfg-rh plugin.
+     * ---end---
+     */
     obj_properties[PROP_SEEN_BSSIDS] = g_param_spec_boxed(
         NM_SETTING_WIRELESS_SEEN_BSSIDS,
         "",
@@ -1731,17 +1731,17 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                   .to_dbus_fcn = _to_dbus_fcn_seen_bssids, ));
 
     /**
-	 * NMSettingWireless:mtu:
-	 *
-	 * If non-zero, only transmit packets of the specified size or smaller,
-	 * breaking larger packets up into multiple Ethernet frames.
-	 **/
+     * NMSettingWireless:mtu:
+     *
+     * If non-zero, only transmit packets of the specified size or smaller,
+     * breaking larger packets up into multiple Ethernet frames.
+     **/
     /* ---ifcfg-rh---
-	 * property: mtu
-	 * variable: MTU
-	 * description: MTU of the wireless interface.
-	 * ---end---
-	 */
+     * property: mtu
+     * variable: MTU
+     * description: MTU of the wireless interface.
+     * ---end---
+     */
     obj_properties[PROP_MTU] = g_param_spec_uint(NM_SETTING_WIRELESS_MTU,
                                                  "",
                                                  "",
@@ -1752,29 +1752,29 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                                      | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:hidden:
-	 *
-	 * If %TRUE, indicates that the network is a non-broadcasting network that
-	 * hides its SSID. This works both in infrastructure and AP mode.
-	 *
-	 * In infrastructure mode, various workarounds are used for a more reliable
-	 * discovery of hidden networks, such as probe-scanning the SSID.  However,
-	 * these workarounds expose inherent insecurities with hidden SSID networks,
-	 * and thus hidden SSID networks should be used with caution.
-	 *
-	 * In AP mode, the created network does not broadcast its SSID.
-	 *
-	 * Note that marking the network as hidden may be a privacy issue for you
-	 * (in infrastructure mode) or client stations (in AP mode), as the explicit
-	 * probe-scans are distinctly recognizable on the air.
-	 *
-	 **/
+     * NMSettingWireless:hidden:
+     *
+     * If %TRUE, indicates that the network is a non-broadcasting network that
+     * hides its SSID. This works both in infrastructure and AP mode.
+     *
+     * In infrastructure mode, various workarounds are used for a more reliable
+     * discovery of hidden networks, such as probe-scanning the SSID.  However,
+     * these workarounds expose inherent insecurities with hidden SSID networks,
+     * and thus hidden SSID networks should be used with caution.
+     *
+     * In AP mode, the created network does not broadcast its SSID.
+     *
+     * Note that marking the network as hidden may be a privacy issue for you
+     * (in infrastructure mode) or client stations (in AP mode), as the explicit
+     * probe-scans are distinctly recognizable on the air.
+     *
+     **/
     /* ---ifcfg-rh---
-	 * property: hidden
-	 * variable: SSID_HIDDEN(+)
-	 * description: Whether the network hides the SSID.
-	 * ---end---
-	 */
+     * property: hidden
+     * variable: SSID_HIDDEN(+)
+     * description: Whether the network hides the SSID.
+     * ---end---
+     */
     obj_properties[PROP_HIDDEN] = g_param_spec_boolean(NM_SETTING_WIRELESS_HIDDEN,
                                                        "",
                                                        "",
@@ -1782,24 +1782,24 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:powersave:
-	 *
-	 * One of %NM_SETTING_WIRELESS_POWERSAVE_DISABLE (disable Wi-Fi power
-	 * saving), %NM_SETTING_WIRELESS_POWERSAVE_ENABLE (enable Wi-Fi power
-	 * saving), %NM_SETTING_WIRELESS_POWERSAVE_IGNORE (don't touch currently
-	 * configure setting) or %NM_SETTING_WIRELESS_POWERSAVE_DEFAULT (use the
-	 * globally configured value). All other values are reserved.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMSettingWireless:powersave:
+     *
+     * One of %NM_SETTING_WIRELESS_POWERSAVE_DISABLE (disable Wi-Fi power
+     * saving), %NM_SETTING_WIRELESS_POWERSAVE_ENABLE (enable Wi-Fi power
+     * saving), %NM_SETTING_WIRELESS_POWERSAVE_IGNORE (don't touch currently
+     * configure setting) or %NM_SETTING_WIRELESS_POWERSAVE_DEFAULT (use the
+     * globally configured value). All other values are reserved.
+     *
+     * Since: 1.2
+     **/
     /* ---ifcfg-rh---
-	 * property: powersave
-	 * variable: POWERSAVE(+)
-	 * values: default, ignore, enable, disable
-	 * description: Enables or disables Wi-Fi power saving.
-	 * example: POWERSAVE=enable
-	 * ---end---
-	 */
+     * property: powersave
+     * variable: POWERSAVE(+)
+     * values: default, ignore, enable, disable
+     * description: Enables or disables Wi-Fi power saving.
+     * example: POWERSAVE=enable
+     * ---end---
+     */
     obj_properties[PROP_POWERSAVE] = g_param_spec_uint(NM_SETTING_WIRELESS_POWERSAVE,
                                                        "",
                                                        "",
@@ -1809,26 +1809,26 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                                        G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:mac-address-randomization:
-	 *
-	 * One of %NM_SETTING_MAC_RANDOMIZATION_DEFAULT (never randomize unless
-	 * the user has set a global default to randomize and the supplicant
-	 * supports randomization),  %NM_SETTING_MAC_RANDOMIZATION_NEVER (never
-	 * randomize the MAC address), or %NM_SETTING_MAC_RANDOMIZATION_ALWAYS
-	 * (always randomize the MAC address). This property is deprecated for
-	 * 'cloned-mac-address'.
-	 *
-	 * Since: 1.2
-	 * Deprecated: 1.4: Deprecated by NMSettingWireless:cloned-mac-address property.
-	 **/
+     * NMSettingWireless:mac-address-randomization:
+     *
+     * One of %NM_SETTING_MAC_RANDOMIZATION_DEFAULT (never randomize unless
+     * the user has set a global default to randomize and the supplicant
+     * supports randomization),  %NM_SETTING_MAC_RANDOMIZATION_NEVER (never
+     * randomize the MAC address), or %NM_SETTING_MAC_RANDOMIZATION_ALWAYS
+     * (always randomize the MAC address). This property is deprecated for
+     * 'cloned-mac-address'.
+     *
+     * Since: 1.2
+     * Deprecated: 1.4: Deprecated by NMSettingWireless:cloned-mac-address property.
+     **/
     /* ---ifcfg-rh---
-	 * property: mac-address-randomization
-	 * variable: MAC_ADDRESS_RANDOMIZATION(+)
-	 * values: default, never, always
-	 * description: Enables or disables Wi-Fi MAC address randomization.
-	 * example: MAC_ADDRESS_RANDOMIZATION=always
-	 * ---end---
-	 */
+     * property: mac-address-randomization
+     * variable: MAC_ADDRESS_RANDOMIZATION(+)
+     * values: default, never, always
+     * description: Enables or disables Wi-Fi MAC address randomization.
+     * example: MAC_ADDRESS_RANDOMIZATION=always
+     * ---end---
+     */
     obj_properties[PROP_MAC_ADDRESS_RANDOMIZATION] =
         g_param_spec_uint(NM_SETTING_WIRELESS_MAC_ADDRESS_RANDOMIZATION,
                           "",
@@ -1840,18 +1840,18 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
 
     /* Compatibility for deprecated property */
     /* ---ifcfg-rh---
-	 * property: security
-	 * variable: (none)
-	 * description: This property is deprecated and not handled by ifcfg-rh-plugin.
-	 * ---end---
-	 * ---dbus---
-	 * property: security
-	 * description: This property is deprecated, but can be set to the value
-	 *   '802-11-wireless-security' when a wireless security setting is also
-	 *   present in the connection dictionary, for compatibility with very old
-	 *   NetworkManager daemons.
-	 * ---end---
-	 */
+     * property: security
+     * variable: (none)
+     * description: This property is deprecated and not handled by ifcfg-rh-plugin.
+     * ---end---
+     * ---dbus---
+     * property: security
+     * description: This property is deprecated, but can be set to the value
+     *   '802-11-wireless-security' when a wireless security setting is also
+     *   present in the connection dictionary, for compatibility with very old
+     *   NetworkManager daemons.
+     * ---end---
+     */
     _nm_properties_override_dbus(
         properties_override,
         "security",
@@ -1859,23 +1859,23 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                                   .to_dbus_fcn = nm_setting_wireless_get_security, ));
 
     /**
-	 * NMSettingWireless:wake-on-wlan:
-	 *
-	 * The #NMSettingWirelessWakeOnWLan options to enable. Not all devices support all options.
-	 * May be any combination of %NM_SETTING_WIRELESS_WAKE_ON_WLAN_ANY,
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_DISCONNECT,
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_MAGIC,
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_GTK_REKEY_FAILURE,
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_EAP_IDENTITY_REQUEST,
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_4WAY_HANDSHAKE,
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_RFKILL_RELEASE,
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_TCP or the special values
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_DEFAULT (to use global settings) and
-	 * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_IGNORE (to disable management of Wake-on-LAN in
-	 * NetworkManager).
-	 *
-	 * Since: 1.12
-	 **/
+     * NMSettingWireless:wake-on-wlan:
+     *
+     * The #NMSettingWirelessWakeOnWLan options to enable. Not all devices support all options.
+     * May be any combination of %NM_SETTING_WIRELESS_WAKE_ON_WLAN_ANY,
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_DISCONNECT,
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_MAGIC,
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_GTK_REKEY_FAILURE,
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_EAP_IDENTITY_REQUEST,
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_4WAY_HANDSHAKE,
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_RFKILL_RELEASE,
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_TCP or the special values
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_DEFAULT (to use global settings) and
+     * %NM_SETTING_WIRELESS_WAKE_ON_WLAN_IGNORE (to disable management of Wake-on-LAN in
+     * NetworkManager).
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_WAKE_ON_WLAN] =
         g_param_spec_uint(NM_SETTING_WIRELESS_WAKE_ON_WLAN,
                           "",
@@ -1886,35 +1886,35 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWireless:ap-isolation
-	 *
-	 * Configures AP isolation, which prevents communication between
-	 * wireless devices connected to this AP. This property can be set
-	 * to a value different from %NM_TERNARY_DEFAULT only when the
-	 * interface is configured in AP mode.
-	 *
-	 * If set to %NM_TERNARY_TRUE, devices are not able to communicate
-	 * with each other. This increases security because it protects
-	 * devices against attacks from other clients in the network. At
-	 * the same time, it prevents devices to access resources on the
-	 * same wireless networks as file shares, printers, etc.
-	 *
-	 * If set to %NM_TERNARY_FALSE, devices can talk to each other.
-	 *
-	 * When set to %NM_TERNARY_DEFAULT, the global default is used; in
-	 * case the global default is unspecified it is assumed to be
-	 * %NM_TERNARY_FALSE.
-	 *
-	 * Since: 1.28
-	 **/
+     * NMSettingWireless:ap-isolation
+     *
+     * Configures AP isolation, which prevents communication between
+     * wireless devices connected to this AP. This property can be set
+     * to a value different from %NM_TERNARY_DEFAULT only when the
+     * interface is configured in AP mode.
+     *
+     * If set to %NM_TERNARY_TRUE, devices are not able to communicate
+     * with each other. This increases security because it protects
+     * devices against attacks from other clients in the network. At
+     * the same time, it prevents devices to access resources on the
+     * same wireless networks as file shares, printers, etc.
+     *
+     * If set to %NM_TERNARY_FALSE, devices can talk to each other.
+     *
+     * When set to %NM_TERNARY_DEFAULT, the global default is used; in
+     * case the global default is unspecified it is assumed to be
+     * %NM_TERNARY_FALSE.
+     *
+     * Since: 1.28
+     **/
     /* ---ifcfg-rh---
-	 * property: ap-isolation
-	 * variable: AP_ISOLATION(+)
-	 * values: "yes", "no"
-	 * default: missing variable means global default
-	 * description: Whether AP isolation is enabled
-	 * ---end---
-	 */
+     * property: ap-isolation
+     * variable: AP_ISOLATION(+)
+     * values: "yes", "no"
+     * default: missing variable means global default
+     * description: Whether AP isolation is enabled
+     * ---end---
+     */
     obj_properties[PROP_AP_ISOLATION] = g_param_spec_enum(
         NM_SETTING_WIRELESS_AP_ISOLATION,
         "",
diff --git a/libnm-core/nm-setting-wpan.c b/libnm-core/nm-setting-wpan.c
index 6eb52b8f72..89de910cd6 100644
--- a/libnm-core/nm-setting-wpan.c
+++ b/libnm-core/nm-setting-wpan.c
@@ -309,18 +309,18 @@ nm_setting_wpan_class_init(NMSettingWpanClass *klass)
     setting_class->verify = verify;
 
     /**
-	 * NMSettingWpan:mac-address:
-	 *
-	 * If specified, this connection will only apply to the IEEE 802.15.4 (WPAN)
-	 * MAC layer device whose permanent MAC address matches.
-	 **/
+     * NMSettingWpan:mac-address:
+     *
+     * If specified, this connection will only apply to the IEEE 802.15.4 (WPAN)
+     * MAC layer device whose permanent MAC address matches.
+     **/
     /* ---keyfile---
-	 * property: mac-address
-	 * format: usual hex-digits-and-colons notation
-	 * description: MAC address in hex-digits-and-colons notation
-	 *   (e.g. 76:d8:9b:87:66:60:84:ee).
-	 * ---end---
-	 */
+     * property: mac-address
+     * format: usual hex-digits-and-colons notation
+     * description: MAC address in hex-digits-and-colons notation
+     *   (e.g. 76:d8:9b:87:66:60:84:ee).
+     * ---end---
+     */
     obj_properties[PROP_MAC_ADDRESS] =
         g_param_spec_string(NM_SETTING_WPAN_MAC_ADDRESS,
                             "",
@@ -329,10 +329,10 @@ nm_setting_wpan_class_init(NMSettingWpanClass *klass)
                             G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWpan:pan-id:
-	 *
-	 * IEEE 802.15.4 Personal Area Network (PAN) identifier.
-	 **/
+     * NMSettingWpan:pan-id:
+     *
+     * IEEE 802.15.4 Personal Area Network (PAN) identifier.
+     **/
     obj_properties[PROP_PAN_ID] = g_param_spec_uint(NM_SETTING_WPAN_PAN_ID,
                                                     "",
                                                     "",
@@ -342,10 +342,10 @@ nm_setting_wpan_class_init(NMSettingWpanClass *klass)
                                                     G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWpan:short-address:
-	 *
-	 * Short IEEE 802.15.4 address to be used within a restricted environment.
-	 **/
+     * NMSettingWpan:short-address:
+     *
+     * Short IEEE 802.15.4 address to be used within a restricted environment.
+     **/
     obj_properties[PROP_SHORT_ADDRESS] =
         g_param_spec_uint(NM_SETTING_WPAN_SHORT_ADDRESS,
                           "",
@@ -356,13 +356,13 @@ nm_setting_wpan_class_init(NMSettingWpanClass *klass)
                           G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWpan:page:
-	 *
-	 * IEEE 802.15.4 channel page. A positive integer or -1, meaning "do not
-	 * set, use whatever the device is already set to".
-	 *
-	 * Since: 1.16
-	 **/
+     * NMSettingWpan:page:
+     *
+     * IEEE 802.15.4 channel page. A positive integer or -1, meaning "do not
+     * set, use whatever the device is already set to".
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_PAGE] = g_param_spec_int(NM_SETTING_WPAN_PAGE,
                                                  "",
                                                  "",
@@ -372,13 +372,13 @@ nm_setting_wpan_class_init(NMSettingWpanClass *klass)
                                                  G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSettingWpan:channel:
-	 *
-	 * IEEE 802.15.4 channel. A positive integer or -1, meaning "do not
-	 * set, use whatever the device is already set to".
-	 *
-	 * Since: 1.16
-	 **/
+     * NMSettingWpan:channel:
+     *
+     * IEEE 802.15.4 channel. A positive integer or -1, meaning "do not
+     * set, use whatever the device is already set to".
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_CHANNEL] = g_param_spec_int(NM_SETTING_WPAN_CHANNEL,
                                                     "",
                                                     "",
diff --git a/libnm-core/nm-setting.c b/libnm-core/nm-setting.c
index c9975e4eb9..bde3330daa 100644
--- a/libnm-core/nm-setting.c
+++ b/libnm-core/nm-setting.c
@@ -61,10 +61,10 @@ static NMSettingPriority
 _get_base_type_priority(const NMMetaSettingInfo *setting_info, GType gtype)
 {
     /* Historical oddity: PPPoE is a base-type even though it's not
-	 * priority 1.  It needs to be sorted *after* lower-level stuff like
-	 * Wi-Fi security or 802.1x for secrets, but it's still allowed as a
-	 * base type.
-	 */
+     * priority 1.  It needs to be sorted *after* lower-level stuff like
+     * Wi-Fi security or 802.1x for secrets, but it's still allowed as a
+     * base type.
+     */
 
     if (setting_info) {
         if (NM_IN_SET(setting_info->setting_priority,
@@ -298,7 +298,7 @@ _property_infos_sort(const NMSettInfoProperty *property_infos,
         return NULL;
     if (G_TYPE_FROM_CLASS(setting_class) != NM_TYPE_SETTING_CONNECTION) {
         /* we only do something special for certain setting types. This one,
-		 * has just alphabetical sorting. */
+         * has just alphabetical sorting. */
         return NULL;
     }
 
@@ -514,26 +514,26 @@ void
 _nm_setting_emit_property_changed(NMSetting *setting)
 {
     /* Some settings have "properties" that are not implemented as GObject properties.
-	 *
-	 * For example:
-	 *
-	 *   - gendata-base settings like NMSettingEthtool. Here properties are just
-	 *     GVariant values in the gendata hash.
-	 *
-	 *   - NMSettingWireGuard's peers are not backed by a GObject property. Instead
-	 *     there is C-API to access/modify peers.
-	 *
-	 * We still want to emit property-changed notifications for such properties,
-	 * in particular because NMConnection registers to such signals to re-emit
-	 * it as NM_CONNECTION_CHANGED signal. In fact, there are unlikely any other
-	 * uses of such a property-changed signal, because generally it doesn't make
-	 * too much sense.
-	 *
-	 * So, instead of adding yet another (artificial) signal "setting-changed",
-	 * hijack the "notify" signal and just notify about changes of the "name".
-	 * Of course, the "name" doesn't really ever change, because it's tied to
-	 * the GObject's type.
-	 */
+     *
+     * For example:
+     *
+     *   - gendata-base settings like NMSettingEthtool. Here properties are just
+     *     GVariant values in the gendata hash.
+     *
+     *   - NMSettingWireGuard's peers are not backed by a GObject property. Instead
+     *     there is C-API to access/modify peers.
+     *
+     * We still want to emit property-changed notifications for such properties,
+     * in particular because NMConnection registers to such signals to re-emit
+     * it as NM_CONNECTION_CHANGED signal. In fact, there are unlikely any other
+     * uses of such a property-changed signal, because generally it doesn't make
+     * too much sense.
+     *
+     * So, instead of adding yet another (artificial) signal "setting-changed",
+     * hijack the "notify" signal and just notify about changes of the "name".
+     * Of course, the "name" doesn't really ever change, because it's tied to
+     * the GObject's type.
+     */
     _notify(setting, PROP_NAME);
 }
 
@@ -786,17 +786,17 @@ _nm_setting_new_from_dbus(GType               setting_type,
                             NM_SETTING_PARSE_FLAGS_STRICT | NM_SETTING_PARSE_FLAGS_BEST_EFFORT));
 
     /* connection_dict is not technically optional, but some tests in test-general
-	 * don't bother with it in cases where they know it's not needed.
-	 */
+     * don't bother with it in cases where they know it's not needed.
+     */
     if (connection_dict)
         g_return_val_if_fail(g_variant_is_of_type(connection_dict, NM_VARIANT_TYPE_CONNECTION),
                              NULL);
 
     /* Build the setting object from the properties we know about; we assume
-	 * that any propreties in @setting_dict that we don't know about can
-	 * either be ignored or else has a backward-compatibility equivalent
-	 * that we do know about.
-	 */
+     * that any propreties in @setting_dict that we don't know about can
+     * either be ignored or else has a backward-compatibility equivalent
+     * that we do know about.
+     */
     setting = (NMSetting *) g_object_new(setting_type, NULL);
 
     if (NM_FLAGS_HAS(parse_flags, NM_SETTING_PARSE_FLAGS_STRICT)) {
@@ -884,12 +884,12 @@ init_from_dbus(NMSetting *                     setting,
         _nm_setting_option_notify(setting, TRUE);
 
         /* Currently, only NMSettingEthtool supports gendata based options, and
-		 * that one has no other properties (except "name"). That means, we
-		 * consumed all options above.
-		 *
-		 * In the future it may be interesting to have settings that are both
-		 * based on gendata and regular properties. In that case, we would need
-		 * to handle this case differently. */
+         * that one has no other properties (except "name"). That means, we
+         * consumed all options above.
+         *
+         * In the future it may be interesting to have settings that are both
+         * based on gendata and regular properties. In that case, we would need
+         * to handle this case differently. */
         nm_assert(nm_streq(G_OBJECT_TYPE_NAME(setting), "NMSettingEthtool"));
         nm_assert(sett_info->property_infos_len == 1);
 
@@ -1294,25 +1294,25 @@ _nm_setting_should_compare_secret_property(NMSetting *           setting,
     if (other) {
         if (!nm_setting_get_secret_flags(other, secret_name, &b_secret_flags, NULL)) {
             /* secret-name may not be a valid secret for @other. That is fine, we ignore that
-			 * and treat @b_secret_flags as NM_SETTING_SECRET_FLAG_NONE.
-			 *
-			 * This can happen with VPN secrets, where the caller knows that @secret_name
-			 * is a secret for setting, but it may not be a secret for @other. Accept that.
-			 *
-			 * Mark @other as missing. */
+             * and treat @b_secret_flags as NM_SETTING_SECRET_FLAG_NONE.
+             *
+             * This can happen with VPN secrets, where the caller knows that @secret_name
+             * is a secret for setting, but it may not be a secret for @other. Accept that.
+             *
+             * Mark @other as missing. */
             other = NULL;
         }
     }
 
     /* when @setting has the secret-flags that should be ignored,
-	 * we skip the comparison if:
-	 *
-	 *   - @other is not present,
-	 *   - @other does not have a secret named @secret_name
-	 *   - @other also has the secret flat to be ignored.
-	 *
-	 * This makes the check symmetric (aside the fact that @setting must
-	 * have the secret while @other may not -- which is asymmetric). */
+     * we skip the comparison if:
+     *
+     *   - @other is not present,
+     *   - @other does not have a secret named @secret_name
+     *   - @other also has the secret flat to be ignored.
+     *
+     * This makes the check symmetric (aside the fact that @setting must
+     * have the secret while @other may not -- which is asymmetric). */
     if (NM_FLAGS_HAS(flags, NM_SETTING_COMPARE_FLAG_IGNORE_AGENT_OWNED_SECRETS)
         && NM_FLAGS_HAS(a_secret_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED)
         && (!other || NM_FLAGS_HAS(b_secret_flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED)))
@@ -1582,14 +1582,14 @@ _nm_setting_diff(NMConnection *        con_a,
     }
 
     /* If the caller is calling this function in a pattern like this to get
-	 * complete diffs:
-	 *
-	 * nm_setting_diff (A, B, FALSE, &results);
-	 * nm_setting_diff (B, A, TRUE, &results);
-	 *
-	 * and wants us to invert the results so that the second invocation comes
-	 * out correctly, do that here.
-	 */
+     * complete diffs:
+     *
+     * nm_setting_diff (A, B, FALSE, &results);
+     * nm_setting_diff (B, A, TRUE, &results);
+     *
+     * and wants us to invert the results so that the second invocation comes
+     * out correctly, do that here.
+     */
     if (invert_results) {
         a_result         = NM_SETTING_DIFF_RESULT_IN_B;
         b_result         = NM_SETTING_DIFF_RESULT_IN_A;
@@ -1658,18 +1658,18 @@ _nm_setting_diff(NMConnection *        con_a,
                                  | NM_SETTING_COMPARE_FLAG_IGNORE_NOT_SAVED_SECRETS)
                 && b && compare_result == NM_TERNARY_FALSE) {
                 /* we have setting @b and the property is not the same. But we also are instructed
-				 * to ignore secrets based on the flags.
-				 *
-				 * Note that compare_property() called with two settings will ignore secrets
-				 * based on the flags, but it will do so if *both* settings have the flag we
-				 * look for. So that is symmetric behavior and good.
-				 *
-				 * But for the purpose of diff(), we do a asymmetric comparison because and
-				 * we want to skip testing the property if setting @a alone indicates to do
-				 * so.
-				 *
-				 * We need to double-check whether the property should be ignored by
-				 * looking at @a alone. */
+                 * to ignore secrets based on the flags.
+                 *
+                 * Note that compare_property() called with two settings will ignore secrets
+                 * based on the flags, but it will do so if *both* settings have the flag we
+                 * look for. So that is symmetric behavior and good.
+                 *
+                 * But for the purpose of diff(), we do a asymmetric comparison because and
+                 * we want to skip testing the property if setting @a alone indicates to do
+                 * so.
+                 *
+                 * We need to double-check whether the property should be ignored by
+                 * looking at @a alone. */
                 if (_compare_property(sett_info, i, con_a, a, NULL, NULL, flags)
                     == NM_TERNARY_DEFAULT)
                     continue;
@@ -1741,14 +1741,14 @@ _nm_setting_diff(NMConnection *        con_a,
 
     if (!compared_any && !b) {
         /* special case: the setting has no properties, and the opposite
-		 * setting @b is not given. The settings differ, and we signal that
-		 * by returning an empty results hash. */
+         * setting @b is not given. The settings differ, and we signal that
+         * by returning an empty results hash. */
         diff_found = TRUE;
     }
 
     if (diff_found) {
         /* if there is a difference, we always return FALSE. It also means, we might
-		 * have allocated a new @results hash, and return it to the caller. */
+         * have allocated a new @results hash, and return it to the caller. */
         return FALSE;
     } else {
         if (results_created) {
@@ -1757,7 +1757,7 @@ _nm_setting_diff(NMConnection *        con_a,
             *results = NULL;
         } else {
             /* we found no diff, and return false. However, the input
-			 * @result is returned unmodified. */
+             * @result is returned unmodified. */
         }
         return TRUE;
     }
@@ -1809,8 +1809,8 @@ nm_setting_enumerate_values(NMSetting *setting, NMSettingValueIterFn func, gpoin
         guint              n_properties;
 
         /* the properties of this setting are not real GObject properties.
-		 * Hence, this API makes little sense (or does it?). Still, call
-		 * @func with each value. */
+         * Hence, this API makes little sense (or does it?). Still, call
+         * @func with each value. */
         n_properties = _nm_setting_option_get_all(setting, &names, NULL);
         if (n_properties > 0) {
             gs_strfreev char **keys = g_strdupv((char **) names);
@@ -1828,7 +1828,7 @@ nm_setting_enumerate_values(NMSetting *setting, NMSettingValueIterFn func, gpoin
                 g_value_init(&value, G_TYPE_VARIANT);
                 g_value_set_variant(&value, val);
                 /* call it will GParamFlags 0. It shall indicate that this
-				 * is not a "real" GObject property. */
+                 * is not a "real" GObject property. */
                 func(setting, keys[i], &value, 0, user_data);
                 g_value_unset(&value);
             }
@@ -2051,9 +2051,9 @@ update_one_secret(NMSetting *setting, const char *key, GVariant *value, GError *
 
     if (g_variant_is_of_type(value, G_VARIANT_TYPE_STRING) && G_IS_PARAM_SPEC_STRING(prop_spec)) {
         /* String is expected to be a common case. Handle it specially and check
-		 * whether the value is already set. Otherwise, we just reset the
-		 * property and assume the value got modified.
-		 */
+         * whether the value is already set. Otherwise, we just reset the
+         * property and assume the value got modified.
+         */
         char *v;
 
         g_object_get(G_OBJECT(setting), prop_spec->name, &v, NULL);
@@ -2419,23 +2419,23 @@ _nm_setting_option_notify(NMSetting *setting, gboolean names_changed)
 
     if (names_changed) {
         /* if only the values changed, it's sufficient to invalidate the
-		 * values cache. Otherwise, the names cache must be invalidated too. */
+         * values cache. Otherwise, the names cache must be invalidated too. */
         nm_clear_g_free(&gendata->names);
     }
 
     /* Note, currently there is no way to notify the subclass when gendata changed.
-	 * gendata is only changed in two situations:
-	 *   1) from within NMSetting itself, for example when creating a NMSetting instance
-	 *      from keyfile or a D-Bus GVariant.
-	 *   2) actively from the subclass itself
-	 * For 2), we don't need the notification, because the subclass knows that something
-	 * changed.
-	 * For 1), we currently don't need the notification either, because all that the subclass
-	 * currently would do, is emit a g_object_notify() signal. However, 1) only happens when
-	 * the setting instance is newly created, at that point, nobody listens to the signal.
-	 *
-	 * If we ever need it, then we would need to call a virtual function to notify the subclass
-	 * that gendata changed. */
+     * gendata is only changed in two situations:
+     *   1) from within NMSetting itself, for example when creating a NMSetting instance
+     *      from keyfile or a D-Bus GVariant.
+     *   2) actively from the subclass itself
+     * For 2), we don't need the notification, because the subclass knows that something
+     * changed.
+     * For 1), we currently don't need the notification either, because all that the subclass
+     * currently would do, is emit a g_object_notify() signal. However, 1) only happens when
+     * the setting instance is newly created, at that point, nobody listens to the signal.
+     *
+     * If we ever need it, then we would need to call a virtual function to notify the subclass
+     * that gendata changed. */
 
 out:
     _nm_setting_emit_property_changed(setting);
@@ -2683,17 +2683,17 @@ nm_setting_option_set(NMSetting *setting, const char *opt_name, GVariant *varian
     }
 
     /* Currently, it is a bug setting any option, unless the setting type supports it.
-	 * And currently, only NMSettingEthtool supports it.
-	 *
-	 * In the future, more setting types may support it. Or we may relax this so
-	 * that options can be attached to all setting types (to indicate "unsupported"
-	 * settings for forward compatibility).
-	 *
-	 * As it is today, internal code will only add gendata options to NMSettingEthtool,
-	 * and there exists not public API to add such options. Still, it is permissible
-	 * to call get(), clear() and set(variant=NULL) also on settings that don't support
-	 * it, as these operations don't add options.
-	 */
+     * And currently, only NMSettingEthtool supports it.
+     *
+     * In the future, more setting types may support it. Or we may relax this so
+     * that options can be attached to all setting types (to indicate "unsupported"
+     * settings for forward compatibility).
+     *
+     * As it is today, internal code will only add gendata options to NMSettingEthtool,
+     * and there exists not public API to add such options. Still, it is permissible
+     * to call get(), clear() and set(variant=NULL) also on settings that don't support
+     * it, as these operations don't add options.
+     */
     g_return_if_fail(
         _nm_setting_class_get_sett_info(NM_SETTING_GET_CLASS(setting))->detail.gendata_info);
 
@@ -2703,9 +2703,9 @@ nm_setting_option_set(NMSetting *setting, const char *opt_name, GVariant *varian
     changed_value = changed_name || !g_variant_equal(old_variant, variant);
 
     /* We always want to replace the variant, even if it has
-	 * the same value according to g_variant_equal(). The reason
-	 * is that we want to take a reference on @variant, because
-	 * that is what the user might expect. */
+     * the same value according to g_variant_equal(). The reason
+     * is that we want to take a reference on @variant, because
+     * that is what the user might expect. */
     g_hash_table_insert(hash, g_strdup(opt_name), g_variant_ref_sink(variant));
 
     if (changed_value)
@@ -2844,12 +2844,12 @@ nm_setting_class_init(NMSettingClass *setting_class)
     setting_class->init_from_dbus            = init_from_dbus;
 
     /**
-	 * NMSetting:name:
-	 *
-	 * The setting's name, which uniquely identifies the setting within the
-	 * connection.  Each setting type has a name unique to that type, for
-	 * example "ppp" or "802-11-wireless" or "802-3-ethernet".
-	 **/
+     * NMSetting:name:
+     *
+     * The setting's name, which uniquely identifies the setting within the
+     * connection.  Each setting type has a name unique to that type, for
+     * example "ppp" or "802-11-wireless" or "802-3-ethernet".
+     **/
     obj_properties[PROP_NAME] = g_param_spec_string(NM_SETTING_NAME,
                                                     "",
                                                     "",
diff --git a/libnm-core/nm-setting.h b/libnm-core/nm-setting.h
index 43c9dedb67..db35c23a9d 100644
--- a/libnm-core/nm-setting.h
+++ b/libnm-core/nm-setting.h
@@ -205,11 +205,11 @@ typedef struct {
                               gpointer                         user_data);
 
     /* compare_property() returns a ternary, where DEFAULT means that the property should not
-	 * be compared due to the compare @flags. A TRUE/FALSE result means that the property is
-	 * equal/not-equal.
-	 *
-	 * @other may be %NULL, in which case the function only determines whether
-	 * the setting should be compared (TRUE) or not (DEFAULT). */
+     * be compared due to the compare @flags. A TRUE/FALSE result means that the property is
+     * equal/not-equal.
+     *
+     * @other may be %NULL, in which case the function only determines whether
+     * the setting should be compared (TRUE) or not (DEFAULT). */
     /*< private >*/
     NMTernary (*compare_property)(const struct _NMSettInfoSetting *sett_info,
                                   guint                            property_idx,
diff --git a/libnm-core/nm-team-utils.c b/libnm-core/nm-team-utils.c
index b338f16c88..c490a1a510 100644
--- a/libnm-core/nm-team-utils.c
+++ b/libnm-core/nm-team-utils.c
@@ -23,12 +23,12 @@ typedef enum {
     SET_FIELD_MODE_SET   = 1,
 
     /* Sets the field as set, unless the field is at the default.
-	 * This is the case for API that is called from NMSettingTeam/NMSettingTeamPort.
-	 * This means, using libnm API to reset the value of a NMSetting to the default,
-	 * will mark the field as unset.
-	 * This is different from initializing the field when parsing JSON/GVariant. In
-	 * that case an explicitly set field (even set to the default value) will be remembered
-	 * to be set. */
+     * This is the case for API that is called from NMSettingTeam/NMSettingTeamPort.
+     * This means, using libnm API to reset the value of a NMSetting to the default,
+     * will mark the field as unset.
+     * This is different from initializing the field when parsing JSON/GVariant. In
+     * that case an explicitly set field (even set to the default value) will be remembered
+     * to be set. */
     SET_FIELD_MODE_SET_UNLESS_DEFAULT = 2,
 } SetFieldModeEnum;
 
@@ -762,14 +762,14 @@ _team_setting_attribute_changed(NMTeamSetting *     self,
 
     if (!changed) {
         /* a regular attribute was set, but the value did not change.
-		 *
-		 * If we previously were in non-strict mode, then
-		 *
-		 * - switch to strict-mode. Clearly the user set a regular attribute
-		 *   and hence now we want to validate the setting.
-		 *
-		 * - clear the JSON string. We need to regenerate it.
-		 */
+         *
+         * If we previously were in non-strict mode, then
+         *
+         * - switch to strict-mode. Clearly the user set a regular attribute
+         *   and hence now we want to validate the setting.
+         *
+         * - clear the JSON string. We need to regenerate it.
+         */
         if (self->_data_priv.strict_validated)
             return 0;
         changed_flags = nm_team_attribute_to_flags(NM_TEAM_ATTRIBUTE_CONFIG);
@@ -1744,7 +1744,7 @@ nm_team_setting_config_get(const NMTeamSetting *self)
 
     if (_team_setting_check_default(self) == 0) {
         /* the default is set. We signal this as a NULL JSON string.
-		 * Nothing to do. */
+         * Nothing to do. */
         js_str = NULL;
     } else {
         gboolean list_is_empty = TRUE;
@@ -1892,7 +1892,7 @@ nm_team_setting_config_get(const NMTeamSetting *self)
     }
 
     /* mutate the constant object. In C++ speak, these fields are "mutable".
-	 * That is because we construct the JSON string lazily/on-demand. */
+     * That is because we construct the JSON string lazily/on-demand. */
     *((char **) &self->_data_priv._js_str)                = js_str;
     *((bool *) &self->_data_priv._js_str_need_synthetize) = FALSE;
 
@@ -2091,7 +2091,7 @@ _js_parse_unpack(const NMJsonVt *vt,
                                 <= 0
                             || !v_string || v_string[0] == '\0') {
                             /* we remember that there was some invalid content, but parts of the
-							 * list could still be parsed. */
+                             * list could still be parsed. */
                             *out_unrecognized_content = TRUE;
                             continue;
                         }
@@ -2364,7 +2364,7 @@ _team_setting_verify_config(const NMTeamSetting *self, GError **error)
     const char *js_str;
 
     /* we always materialize the JSON string. That is because we want to validate the
-	 * string length of the resulting JSON. */
+     * string length of the resulting JSON. */
     js_str = nm_team_setting_config_get(self);
 
     if (js_str) {
@@ -2534,7 +2534,7 @@ nm_team_setting_reset_from_dbus(NMTeamSetting *                 self,
         attr_data = _team_attr_data_find_for_property_name(self->d.is_port, v_key);
         if (!attr_data) {
             /* _nm_setting_new_from_dbus() already checks for unknown keys. Don't
-			 * do that here. */
+             * do that here. */
             continue;
         }
 
@@ -2567,7 +2567,7 @@ nm_team_setting_reset_from_dbus(NMTeamSetting *                 self,
         }
 
         /* _nm_setting_new_from_dbus() already checks for duplicate keys. Don't
-		 * do that here. */
+         * do that here. */
         nm_g_variant_unref(variants[attr_data->team_attr]);
         variants[attr_data->team_attr] = g_steal_pointer(&v_val_free);
     }
@@ -2578,17 +2578,17 @@ nm_team_setting_reset_from_dbus(NMTeamSetting *                 self,
         if (variants[NM_TEAM_ATTRIBUTE_CONFIG] && vt
             && !NM_FLAGS_HAS(parse_flags, NM_SETTING_PARSE_FLAGS_STRICT)) {
             /* we don't require the content of the "link-watchers" and we also
-			 * don't perform strict validation. No need to parse it. */
+             * don't perform strict validation. No need to parse it. */
         } else {
             gs_free_error GError *local = NULL;
 
             /* We might need the parsed v_link_watchers array below (because there is no JSON
-			 * "config" present or because we don't have json support).
-			 *
-			 * Or we might run with NM_SETTING_PARSE_FLAGS_STRICT. In that mode, we may not necessarily
-			 * require that the entire setting as a whole validates (if a JSON config is present and
-			 * we are not "strict_validated") , but we require that we can at least parse the link watchers
-			 * on their own. */
+             * "config" present or because we don't have json support).
+             *
+             * Or we might run with NM_SETTING_PARSE_FLAGS_STRICT. In that mode, we may not necessarily
+             * require that the entire setting as a whole validates (if a JSON config is present and
+             * we are not "strict_validated") , but we require that we can at least parse the link watchers
+             * on their own. */
             v_link_watchers = _nm_utils_team_link_watchers_from_variant(
                 variants[NM_TEAM_ATTRIBUTE_LINK_WATCHERS],
                 NM_FLAGS_HAS(parse_flags, NM_SETTING_PARSE_FLAGS_STRICT),
@@ -2616,8 +2616,8 @@ nm_team_setting_reset_from_dbus(NMTeamSetting *                 self,
 
     if (vt && variants[NM_TEAM_ATTRIBUTE_CONFIG]) {
         /* for team settings, the JSON must be able to express all possible options. That means,
-		 * if the GVariant contains both the JSON "config" and other options, then the other options
-		 * are silently ignored. */
+         * if the GVariant contains both the JSON "config" and other options, then the other options
+         * are silently ignored. */
     } else {
         guint32 extra_changed = 0u;
 
@@ -2670,7 +2670,7 @@ nm_team_setting_reset_from_dbus(NMTeamSetting *                 self,
 
         if (!variants[NM_TEAM_ATTRIBUTE_CONFIG]) {
             /* clear the JSON string so it can be regenerated. But only if we didn't set
-			 * it above. */
+             * it above. */
             self->_data_priv.strict_validated        = TRUE;
             self->_data_priv._js_str_need_synthetize = TRUE;
         }
@@ -2748,10 +2748,10 @@ _nm_team_settings_property_to_dbus(const NMSettInfoSetting *               sett_
 
         if (self->d.strict_validated && !_nm_utils_is_manager_process) {
             /* if we are in strict validating mode on the client side, the JSON is generated
-			 * artificially. In this case, don't send the config via D-Bus to the server.
-			 *
-			 * This also will cause NetworkManager to strictly validate the settings.
-			 * If a JSON "config" is present, strict validation won't be performed. */
+             * artificially. In this case, don't send the config via D-Bus to the server.
+             *
+             * This also will cause NetworkManager to strictly validate the settings.
+             * If a JSON "config" is present, strict validation won't be performed. */
             return NULL;
         }
 
diff --git a/libnm-core/nm-team-utils.h b/libnm-core/nm-team-utils.h
index 09ba42e062..0cfb397804 100644
--- a/libnm-core/nm-team-utils.h
+++ b/libnm-core/nm-team-utils.h
@@ -68,16 +68,16 @@ struct _NMTeamSettingData {
     const GPtrArray *link_watchers;
 
     /* this means that @_js_str is unset and needs to be created by
-	 * converting the properties to JSON. This flag indicates that
-	 * we need to re-generate the JSON string on-demand (lazily). */
+     * converting the properties to JSON. This flag indicates that
+     * we need to re-generate the JSON string on-demand (lazily). */
     bool _js_str_need_synthetize;
 
     bool strict_validated : 1;
 
     /* indicates tha the JSON is invalid. Usually, we do a very relaxed validation of
-	 * the JSON config, in case !@strict_validated and accept all unknown fields. This
-	 * flag indicates that the JSON value is not even parsable as JSON. nm_connection_verify()
-	 * would reject such a setting. */
+     * the JSON config, in case !@strict_validated and accept all unknown fields. This
+     * flag indicates that the JSON value is not even parsable as JSON. nm_connection_verify()
+     * would reject such a setting. */
     bool js_str_invalid : 1;
 
     bool is_port : 1;
diff --git a/libnm-core/nm-utils.c b/libnm-core/nm-utils.c
index b420f9fbf2..d6314bf69e 100644
--- a/libnm-core/nm-utils.c
+++ b/libnm-core/nm-utils.c
@@ -81,9 +81,9 @@ _parse_endpoint(char *str, guint16 *out_port)
     gint16      port;
 
     /* Like
-	 * - https://git.zx2c4.com/WireGuard/tree/src/tools/config.c?id=5e99a6d43fe2351adf36c786f5ea2086a8fe7ab8#n192
-	 * - https://github.com/systemd/systemd/blob/911649fdd43f3a9158b847947724a772a5a45c34/src/network/netdev/wireguard.c#L614
-	 */
+     * - https://git.zx2c4.com/WireGuard/tree/src/tools/config.c?id=5e99a6d43fe2351adf36c786f5ea2086a8fe7ab8#n192
+     * - https://github.com/systemd/systemd/blob/911649fdd43f3a9158b847947724a772a5a45c34/src/network/netdev/wireguard.c#L614
+     */
 
     g_strstrip(str);
 
@@ -272,12 +272,12 @@ nm_sock_addr_endpoint_get_fixed_sockaddr(NMSockAddrEndpoint *self, gpointer sock
         goto good;
 
     /* See if there is an IPv6 scope-id...
-	 *
-	 * Note that it does not make sense to persist connection profiles to disk,
-	 * that refenrence a scope-id (because the interface's ifindex changes on
-	 * reboot). However, we also support runtime only changes like `nmcli device modify`
-	 * where nothing is persisted to disk. At least in that case, passing a scope-id
-	 * might be reasonable. So, parse that too. */
+     *
+     * Note that it does not make sense to persist connection profiles to disk,
+     * that refenrence a scope-id (because the interface's ifindex changes on
+     * reboot). However, we also support runtime only changes like `nmcli device modify`
+     * where nothing is persisted to disk. At least in that case, passing a scope-id
+     * might be reasonable. So, parse that too. */
     s = strchr(self->host, '%');
     if (!s)
         return FALSE;
@@ -500,11 +500,11 @@ static void __attribute__((constructor)) _nm_utils_init(void)
         return;
 
     /* we don't expect this code to run multiple times, nor on multiple threads.
-	 *
-	 * In practice, it would not be a problem if two threads concurrently try to
-	 * run the initialization code below, all code below itself is thread-safe,
-	 * Hence, a poor-man guard "initialized" above is more than sufficient,
-	 * although it does not guarantee that the code is not run concurrently. */
+     *
+     * In practice, it would not be a problem if two threads concurrently try to
+     * run the initialization code below, all code below itself is thread-safe,
+     * Hence, a poor-man guard "initialized" above is more than sufficient,
+     * although it does not guarantee that the code is not run concurrently. */
 
     bindtextdomain(GETTEXT_PACKAGE, NMLOCALEDIR);
     bind_textdomain_codeset(GETTEXT_PACKAGE, "UTF-8");
@@ -585,9 +585,9 @@ nm_utils_ssid_to_utf8(const guint8 *ssid, gsize len)
 
     if (!converted) {
         /* If there is still no converted string, the SSID probably
-		 * contains characters not valid in the current locale. Convert
-		 * the string to ASCII instead.
-		 */
+         * contains characters not valid in the current locale. Convert
+         * the string to ASCII instead.
+         */
 
         /* Use the printable range of 0x20-0x7E */
         char *valid_chars = " !\"#$%&'()*+,-./0123456789:;<=>?@"
@@ -1070,8 +1070,8 @@ nm_utils_ap_mode_security_valid(NMUtilsSecurityType type, NMDeviceWifiCapabiliti
         return FALSE;
 
     /* Return TRUE for any security that wpa_supplicant's lightweight AP
-	 * mode can handle: which is open, WEP, and WPA/WPA2 PSK.
-	 */
+     * mode can handle: which is open, WEP, and WPA/WPA2 PSK.
+     */
     switch (type) {
     case NMU_SEC_NONE:
     case NMU_SEC_STATIC_WEP:
@@ -2327,12 +2327,12 @@ static const NMVariantAttributeSpec *const tc_qdisc_fq_codel_spec[] = {
     NM_VARIANT_ATTRIBUTE_SPEC_DEFINE("quantum", G_VARIANT_TYPE_UINT32, ),
 
     /* 0x83126E97u is not a valid value (it means "disabled"). We should reject that
-	 * value. Or alternatively, reject all values >= MAX_INT(32). */
+     * value. Or alternatively, reject all values >= MAX_INT(32). */
     NM_VARIANT_ATTRIBUTE_SPEC_DEFINE("ce_threshold", G_VARIANT_TYPE_UINT32, ),
 
     /* kernel clamps the value at 2^31. Possibly such values should be rejected from configuration
-	 * as they cannot be configured. Leaving the attribute unspecified causes kernel to choose
-	 * a default (currently 32MB). */
+     * as they cannot be configured. Leaving the attribute unspecified causes kernel to choose
+     * a default (currently 32MB). */
     NM_VARIANT_ATTRIBUTE_SPEC_DEFINE("memory_limit", G_VARIANT_TYPE_UINT32, ),
 
     NM_VARIANT_ATTRIBUTE_SPEC_DEFINE("ecn", G_VARIANT_TYPE_BOOLEAN, .no_value = TRUE, ),
@@ -2946,10 +2946,10 @@ _nm_sriov_vf_parse_vlans(NMSriovVF *vf, const char *str, GError **error)
         gint64             qos    = -1;
 
         /* we accept leading/trailing whitespace around vlans[1]. Hence
-		 * the nm_str_skip_leading_spaces() and g_strchomp() below.
-		 *
-		 * However, we don't accept any whitespace inside the specifier.
-		 * Hence the NM_STRCHAR_ALL() checks. */
+         * the nm_str_skip_leading_spaces() and g_strchomp() below.
+         *
+         * However, we don't accept any whitespace inside the specifier.
+         * Hence the NM_STRCHAR_ALL() checks. */
 
         params = g_strsplit(nm_str_skip_leading_spaces(vlans[i]), ".", 3);
         if (!params || !params[0] || *params[0] == '\0') {
@@ -3123,7 +3123,7 @@ _nm_utils_uuid_unparse(const NMUuid *uuid, char *out_str /*[37]*/)
 
     if (!out_str) {
         /* for convenience, allow %NULL to indicate that a new
-		 * string should be allocated. */
+         * string should be allocated. */
         out_str = g_malloc(37);
     }
     uuid_unparse_lower(uuid->uuid, out_str);
@@ -3454,7 +3454,7 @@ _nm_utils_check_file(const char *              filename,
     }
 
     /* with check_owner enabled, check that the file belongs to the
-	 * owner or root. */
+     * owner or root. */
     if (check_owner >= 0 && (out_st->st_uid != 0 && (gint64) out_st->st_uid != check_owner)) {
         g_set_error(error,
                     NM_VPN_PLUGIN_ERROR,
@@ -3466,7 +3466,7 @@ _nm_utils_check_file(const char *              filename,
     }
 
     /* with check_owner enabled, check that the file cannot be modified
-	 * by other users (except root). */
+     * by other users (except root). */
     if (check_owner >= 0 && NM_FLAGS_ANY(out_st->st_mode, S_IWGRP | S_IWOTH | S_ISUID)) {
         g_set_error(error,
                     NM_VPN_PLUGIN_ERROR,
@@ -3507,11 +3507,11 @@ _nm_utils_check_module_file(const char *              name,
     }
 
     /* Set special error code if the file doesn't exist.
-	 * The VPN package might be split into separate packages,
-	 * so it could be correct that the plugin file is missing.
-	 *
-	 * Note that nm-applet checks for this error code to fail
-	 * gracefully. */
+     * The VPN package might be split into separate packages,
+     * so it could be correct that the plugin file is missing.
+     *
+     * Note that nm-applet checks for this error code to fail
+     * gracefully. */
     if (!g_file_test(name, G_FILE_TEST_EXISTS)) {
         g_set_error(error,
                     G_FILE_ERROR,
@@ -3532,7 +3532,7 @@ _nm_utils_check_module_file(const char *              name,
 
     if (g_str_has_suffix(name, ".la")) {
         /* g_module_open() treats files that end with .la special.
-		 * We don't want to parse the libtool archive. Just error out. */
+         * We don't want to parse the libtool archive. Just error out. */
         g_set_error(error,
                     NM_VPN_PLUGIN_ERROR,
                     NM_VPN_PLUGIN_ERROR_FAILED,
@@ -3582,7 +3582,7 @@ nm_utils_file_search_in_paths(const char *                      progname,
     g_return_val_if_fail(file_test_flags || predicate, NULL);
 
     /* Only consider @try_first if it is a valid, absolute path. This makes
-	 * it simpler to pass in a path from configure checks. */
+     * it simpler to pass in a path from configure checks. */
     if (try_first && try_first[0] == '/'
         && (file_test_flags == 0 || g_file_test(try_first, file_test_flags))
         && (!predicate || predicate(try_first, user_data)))
@@ -4263,8 +4263,8 @@ nm_utils_hwaddr_matches(gconstpointer hwaddr1,
 
     if (G_UNLIKELY(hwaddr1_len <= 0 || hwaddr1_len > NM_UTILS_HWADDR_LEN_MAX)) {
         /* Only valid addresses can compare equal. In particular,
-		 * addresses that are too long or of zero bytes, never
-		 * compare equal. */
+         * addresses that are too long or of zero bytes, never
+         * compare equal. */
         return FALSE;
     }
 
@@ -4377,18 +4377,18 @@ _nm_utils_hwaddr_cloned_data_synth(const NMSettInfoSetting *               sett_
     g_object_get(setting, "cloned-mac-address", &addr, NULL);
 
     /* Before introducing the extended "cloned-mac-address" (and its D-Bus
-	 * field "assigned-mac-address"), libnm's _nm_utils_hwaddr_to_dbus()
-	 * would drop invalid values as it was unable to serialize them.
-	 *
-	 * Now, we would like to send invalid values as "assigned-mac-address"
-	 * over D-Bus and let the server reject them.
-	 *
-	 * However, clients used to set the cloned-mac-address property
-	 * to "" and it just worked as the value was not serialized in
-	 * an ill form.
-	 *
-	 * To preserve that behavior, serialize "" as NULL.
-	 */
+     * field "assigned-mac-address"), libnm's _nm_utils_hwaddr_to_dbus()
+     * would drop invalid values as it was unable to serialize them.
+     *
+     * Now, we would like to send invalid values as "assigned-mac-address"
+     * over D-Bus and let the server reject them.
+     *
+     * However, clients used to set the cloned-mac-address property
+     * to "" and it just worked as the value was not serialized in
+     * an ill form.
+     *
+     * To preserve that behavior, serialize "" as NULL.
+     */
 
     return addr && addr[0] ? g_variant_new_take_string(g_steal_pointer(&addr)) : NULL;
 }
@@ -4547,8 +4547,8 @@ static char *
 _split_word(char *s)
 {
     /* takes @s and truncates the string on the first white-space.
-	 * then it returns the first word afterwards (again seeking
-	 * over leading white-space). */
+     * then it returns the first word afterwards (again seeking
+     * over leading white-space). */
     for (; s[0]; s++) {
         if (g_ascii_isspace(s[0])) {
             s[0] = '\0';
@@ -4577,7 +4577,7 @@ _nm_utils_generate_mac_address_mask_parse(const char *        value,
 
     if (!value || !*value) {
         /* NULL and "" are valid values and both mean the default
-		 * "q */
+         * "q */
         if (out_mask) {
             memset(out_mask, 0, sizeof(*out_mask));
             out_mask->ether_addr_octet[0] |= 0x02;
@@ -4766,10 +4766,10 @@ const char *
 nm_utils_inet4_ntop(in_addr_t inaddr, char *dst)
 {
     /* relying on the static buffer (by leaving @dst as %NULL) is discouraged.
-	 * Don't do that!
-	 *
-	 * However, still support it to be lenient against mistakes and because
-	 * this is public API of libnm. */
+     * Don't do that!
+     *
+     * However, still support it to be lenient against mistakes and because
+     * this is public API of libnm. */
     return _nm_utils_inet4_ntop(inaddr, dst ?: _nm_utils_inet_ntop_buffer);
 }
 
@@ -4796,10 +4796,10 @@ const char *
 nm_utils_inet6_ntop(const struct in6_addr *in6addr, char *dst)
 {
     /* relying on the static buffer (by leaving @dst as %NULL) is discouraged.
-	 * Don't do that!
-	 *
-	 * However, still support it to be lenient against mistakes and because
-	 * this is public API of libnm. */
+     * Don't do that!
+     *
+     * However, still support it to be lenient against mistakes and because
+     * this is public API of libnm. */
     g_return_val_if_fail(in6addr, NULL);
     return _nm_utils_inet6_ntop(in6addr, dst ?: _nm_utils_inet_ntop_buffer);
 }
@@ -5081,8 +5081,8 @@ _nm_utils_strstrdictkey_create(const char *v1, const char *v2)
         return g_malloc0(1);
 
     /* we need to distinguish between ("",NULL) and (NULL,"").
-	 * Thus, in @type we encode which strings we have present
-	 * as not-NULL. */
+     * Thus, in @type we encode which strings we have present
+     * as not-NULL. */
     if (v1) {
         type |= STRSTRDICTKEY_V1_SET;
         l1 = strlen(v1) + 1;
@@ -5367,7 +5367,7 @@ nm_utils_is_json_object(const char *str, GError **error)
     }
 
     /* valid JSON (depending on the definition) can also be a literal.
-	 * Here we only allow objects. */
+     * Here we only allow objects. */
     if (!nm_json_is_object(json)) {
         g_set_error_literal(error,
                             NM_CONNECTION_ERROR,
@@ -5706,9 +5706,9 @@ nm_utils_get_timestamp_msec(void)
 
     if (ts == -EINVAL) {
         /* The fallback to CLOCK_MONOTONIC is taken only if we're running on a
-		 * criminally old kernel, prior to 2.6.39 (released on 18 May, 2011).
-		 * That happens during buildcheck on old builders, we don't expect to
-		 * be actually runs on kernels that old. */
+         * criminally old kernel, prior to 2.6.39 (released on 18 May, 2011).
+         * That happens during buildcheck on old builders, we don't expect to
+         * be actually runs on kernels that old. */
         ts = nm_utils_clock_gettime_msec(CLOCK_MONOTONIC);
         if (ts >= 0)
             return ts;
diff --git a/libnm-core/nm-vpn-editor-plugin.c b/libnm-core/nm-vpn-editor-plugin.c
index 8d875bb172..c39075ccb5 100644
--- a/libnm-core/nm-vpn-editor-plugin.c
+++ b/libnm-core/nm-vpn-editor-plugin.c
@@ -24,10 +24,10 @@ static void
 nm_vpn_editor_plugin_default_init(NMVpnEditorPluginInterface *iface)
 {
     /**
-	 * NMVpnEditorPlugin:name:
-	 *
-	 * Short display name of the VPN plugin.
-	 */
+     * NMVpnEditorPlugin:name:
+     *
+     * Short display name of the VPN plugin.
+     */
     g_object_interface_install_property(
         iface,
         g_param_spec_string(NM_VPN_EDITOR_PLUGIN_NAME,
@@ -37,10 +37,10 @@ nm_vpn_editor_plugin_default_init(NMVpnEditorPluginInterface *iface)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NMVpnEditorPlugin:description:
-	 *
-	 * Longer description of the VPN plugin.
-	 */
+     * NMVpnEditorPlugin:description:
+     *
+     * Longer description of the VPN plugin.
+     */
     g_object_interface_install_property(
         iface,
         g_param_spec_string(NM_VPN_EDITOR_PLUGIN_DESCRIPTION,
@@ -50,10 +50,10 @@ nm_vpn_editor_plugin_default_init(NMVpnEditorPluginInterface *iface)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NMVpnEditorPlugin:service:
-	 *
-	 * D-Bus service name of the plugin's VPN service.
-	 */
+     * NMVpnEditorPlugin:service:
+     *
+     * D-Bus service name of the plugin's VPN service.
+     */
     g_object_interface_install_property(
         iface,
         g_param_spec_string(NM_VPN_EDITOR_PLUGIN_SERVICE,
@@ -239,15 +239,15 @@ _nm_vpn_editor_plugin_load(const char *              plugin_name,
     g_return_val_if_fail(plugin_name && *plugin_name, NULL);
 
     /* if @do_file_checks is FALSE, we pass plugin_name directly to
-	 * g_module_open().
-	 *
-	 * Otherwise, we allow for library names without path component.
-	 * In which case, we prepend the plugin directory and form an
-	 * absolute path. In that case, we perform checks on the file.
-	 *
-	 * One exception is that we don't allow for the "la" suffix. The
-	 * reason is that g_module_open() interprets files with this extension
-	 * special and we don't want that. */
+     * g_module_open().
+     *
+     * Otherwise, we allow for library names without path component.
+     * In which case, we prepend the plugin directory and form an
+     * absolute path. In that case, we perform checks on the file.
+     *
+     * One exception is that we don't allow for the "la" suffix. The
+     * reason is that g_module_open() interprets files with this extension
+     * special and we don't want that. */
     plugin_filename = plugin_name;
     if (do_file_checks) {
         if (!strchr(plugin_name, '/') && !g_str_has_suffix(plugin_name, ".la")) {
@@ -259,9 +259,9 @@ _nm_vpn_editor_plugin_load(const char *              plugin_name,
     dl_module = dlopen(plugin_filename, RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
     if (!dl_module && do_file_checks) {
         /* If the module is already loaded, we skip the file checks.
-		 *
-		 * _nm_utils_check_module_file() fails with ENOENT if the plugin file
-		 * does not exist. That is relevant, because nm-applet checks for that. */
+         *
+         * _nm_utils_check_module_file() fails with ENOENT if the plugin file
+         * does not exist. That is relevant, because nm-applet checks for that. */
         if (!_nm_utils_check_module_file(plugin_filename,
                                          check_owner,
                                          check_file,
@@ -303,10 +303,10 @@ _nm_vpn_editor_plugin_load(const char *              plugin_name,
 
     if (loaded_before) {
         /* we want to leak the library, because the factory will register glib
-		 * types, which cannot be unregistered.
-		 *
-		 * However, if the library was already loaded before, we want to return
-		 * our part of the reference count. */
+         * types, which cannot be unregistered.
+         *
+         * However, if the library was already loaded before, we want to return
+         * our part of the reference count. */
         dlclose(dl_module);
     }
 
diff --git a/libnm-core/nm-vpn-plugin-info.c b/libnm-core/nm-vpn-plugin-info.c
index 8690425faa..8fd56197cf 100644
--- a/libnm-core/nm-vpn-plugin-info.c
+++ b/libnm-core/nm-vpn-plugin-info.c
@@ -33,9 +33,9 @@ typedef struct {
     GKeyFile *keyfile;
 
     /* It is convenient for nm_vpn_plugin_info_lookup_property() to return a const char *,
-	 * contrary to what g_key_file_get_string() does. Hence we must cache the returned
-	 * value somewhere... let's put it in an internal hash table.
-	 * This contains a clone of all the strings in keyfile. */
+     * contrary to what g_key_file_get_string() does. Hence we must cache the returned
+     * value somewhere... let's put it in an internal hash table.
+     * This contains a clone of all the strings in keyfile. */
     GHashTable *keys;
 
     gboolean           editor_plugin_loaded;
@@ -290,9 +290,9 @@ _nm_vpn_plugin_info_list_load_dir(const char *              dirname,
     g_dir_close(dir);
 
     /* sort the files so that we have a stable behavior. The directory might contain
-	 * duplicate VPNs, so while nm_vpn_plugin_info_list_load() would load them all, the
-	 * caller probably wants to reject duplicates. Having a stable order means we always
-	 * reject the same files in face of duplicates. */
+     * duplicate VPNs, so while nm_vpn_plugin_info_list_load() would load them all, the
+     * caller probably wants to reject duplicates. Having a stable order means we always
+     * reject the same files in face of duplicates. */
     g_array_sort(array, (GCompareFunc) _sort_files);
 
     for (i = 0; i < array->len; i++)
@@ -320,16 +320,16 @@ nm_vpn_plugin_info_list_load()
     GSList *          infos, *info;
     const char *const dir[] = {
         /* We load plugins from NM_VPN_PLUGIN_DIR *and* DEFAULT_DIR*, with
-		 * preference to the former.
-		 *
-		 * load user directory with highest priority. */
+         * preference to the former.
+         *
+         * load user directory with highest priority. */
         _nm_vpn_plugin_info_get_default_dir_user(),
 
         /* lib directory has higher priority then etc. The reason is that
-		 * etc is deprecated and used by old plugins. We expect newer plugins
-		 * to install their file in lib, where they have higher priority.
-		 *
-		 * Optimally, there are no duplicates anyway, so it doesn't really matter. */
+         * etc is deprecated and used by old plugins. We expect newer plugins
+         * to install their file in lib, where they have higher priority.
+         *
+         * Optimally, there are no duplicates anyway, so it doesn't really matter. */
         _nm_vpn_plugin_info_get_default_dir_lib(),
         _nm_vpn_plugin_info_get_default_dir_etc(),
     };
@@ -461,7 +461,7 @@ nm_vpn_plugin_info_list_add(GSList **list, NMVpnPluginInfo *plugin_info, GError
         }
 
         /* the plugin must have unique values for certain properties. E.g. two different
-		 * plugins cannot share the same service type. */
+         * plugins cannot share the same service type. */
         if (!_check_no_conflict(plugin_info, iter->data, error))
             return FALSE;
     }
@@ -632,25 +632,25 @@ nm_vpn_plugin_info_list_find_service_type(GSList *list, const char *name)
         return g_strdup(name);
 
     /* try to interpret @name as plugin name, in which case we return
-	 * the main service-type (not an alias). */
+     * the main service-type (not an alias). */
     info = _list_find_by_service(list, name, NULL);
     if (info)
         return g_strdup(NM_VPN_PLUGIN_INFO_GET_PRIVATE(info)->service);
 
     /* check the hard-coded list of short-names. They all have the same
-	 * well-known prefix org.freedesktop.NetworkManager and the name. */
+     * well-known prefix org.freedesktop.NetworkManager and the name. */
     if (nm_utils_strv_find_first((char **) known_names, G_N_ELEMENTS(known_names), name) >= 0)
         return g_strdup_printf("%s.%s", NM_DBUS_INTERFACE, name);
 
     /* try, if there exists a plugin with @name under org.freedesktop.NetworkManager.
-	 * Allow this to be a valid abbreviation. */
+     * Allow this to be a valid abbreviation. */
     n = g_strdup_printf("%s.%s", NM_DBUS_INTERFACE, name);
     if (_list_find_by_service(list, NULL, n))
         return n;
     g_free(n);
 
     /* currently, VPN plugins have no way to define a short-name for their
-	 * alias name, unless the alias name is prefixed by org.freedesktop.NetworkManager. */
+     * alias name, unless the alias name is prefixed by org.freedesktop.NetworkManager. */
 
     return NULL;
 }
@@ -934,8 +934,8 @@ nm_vpn_plugin_info_get_aliases(NMVpnPluginInfo *self)
         return (const char *const *) priv->aliases;
 
     /* For convenience, we always want to return non-NULL, even for empty
-	 * aliases. Hack around that, by making a NULL terminated array using
-	 * the NULL of priv->aliases. */
+     * aliases. Hack around that, by making a NULL terminated array using
+     * the NULL of priv->aliases. */
     return (const char *const *) &priv->aliases;
 }
 
@@ -1052,7 +1052,7 @@ nm_vpn_plugin_info_load_editor_plugin(NMVpnPluginInfo *self, GError **error)
     }
 
     /* We only try once to load the plugin. If we previously tried and it was
-	 * unsuccessful, error out immediately. */
+     * unsuccessful, error out immediately. */
     if (priv->editor_plugin_loaded) {
         g_set_error(error,
                     NM_VPN_PLUGIN_ERROR,
@@ -1151,7 +1151,7 @@ init_sync(GInitable *initable, GCancellable *cancellable, GError **error)
     }
 
     /* we also require "service", because that how we associate NMSettingVpn:service-type with the
-	 * NMVpnPluginInfo. */
+     * NMVpnPluginInfo. */
     priv->service = g_key_file_get_string(priv->keyfile,
                                           NM_VPN_PLUGIN_INFO_KF_GROUP_CONNECTION,
                                           "service",
@@ -1185,7 +1185,7 @@ init_sync(GInitable *initable, GCancellable *cancellable, GError **error)
             char *s;
 
             /* Lookup the value via get_string(). We want that behavior for all our
-			 * values. */
+             * values. */
             s = g_key_file_get_string(priv->keyfile, groups[i], keys[j], NULL);
             if (s)
                 g_hash_table_insert(priv->keys,
@@ -1295,12 +1295,12 @@ nm_vpn_plugin_info_class_init(NMVpnPluginInfoClass *plugin_class)
     object_class->finalize     = finalize;
 
     /**
-	 * NMVpnPluginInfo:name:
-	 *
-	 * The name of the VPN plugin.
-	 *
-	 * Since: 1.2
-	 */
+     * NMVpnPluginInfo:name:
+     *
+     * The name of the VPN plugin.
+     *
+     * Since: 1.2
+     */
     g_object_class_install_property(object_class,
                                     PROP_NAME,
                                     g_param_spec_string(NM_VPN_PLUGIN_INFO_NAME,
@@ -1310,15 +1310,15 @@ nm_vpn_plugin_info_class_init(NMVpnPluginInfoClass *plugin_class)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NMVpnPluginInfo:filename:
-	 *
-	 * The filename from which the info was loaded.
-	 * Can be %NULL if the instance was not loaded from
-	 * a file (i.e. the keyfile instance was passed to the
-	 * constructor).
-	 *
-	 * Since: 1.2
-	 */
+     * NMVpnPluginInfo:filename:
+     *
+     * The filename from which the info was loaded.
+     * Can be %NULL if the instance was not loaded from
+     * a file (i.e. the keyfile instance was passed to the
+     * constructor).
+     *
+     * Since: 1.2
+     */
     g_object_class_install_property(
         object_class,
         PROP_FILENAME,
@@ -1329,14 +1329,14 @@ nm_vpn_plugin_info_class_init(NMVpnPluginInfoClass *plugin_class)
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS));
 
     /**
-	 * NMVpnPluginInfo:keyfile:
-	 *
-	 * Initialize the instance with a different keyfile instance.
-	 * When passing a keyfile instance, the constructor will not
-	 * try to read from filename.
-	 *
-	 * Since: 1.2
-	 */
+     * NMVpnPluginInfo:keyfile:
+     *
+     * Initialize the instance with a different keyfile instance.
+     * When passing a keyfile instance, the constructor will not
+     * try to read from filename.
+     *
+     * Since: 1.2
+     */
     g_object_class_install_property(
         object_class,
         PROP_KEYFILE,
diff --git a/libnm-core/tests/test-crypto.c b/libnm-core/tests/test-crypto.c
index 4c5ba0f7d8..97a574de13 100644
--- a/libnm-core/tests/test-crypto.c
+++ b/libnm-core/tests/test-crypto.c
@@ -326,9 +326,9 @@ test_pkcs8(gconstpointer test_data)
 
     test_is_pkcs12(path, TRUE);
     /* Note: NSS and gnutls < 3.5.4 don't support all the ciphers that openssl
-	 * can use with PKCS#8 and thus the password can't be actually verified with
-	 * such libraries.
-	 */
+     * can use with PKCS#8 and thus the password can't be actually verified with
+     * such libraries.
+     */
     test_load_pkcs8(path, password, -1);
 
     g_free(path);
diff --git a/libnm-core/tests/test-general.c b/libnm-core/tests/test-general.c
index 20b3b222eb..7c10f02756 100644
--- a/libnm-core/tests/test-general.c
+++ b/libnm-core/tests/test-general.c
@@ -142,9 +142,9 @@ _test_hash_str(const char *str)
     v = nm_hash_complete(&h);
 
     /* assert that hashing a string and a buffer yields the
-	 * same result.
-	 *
-	 * I think that is a desirable property. */
+     * same result.
+     *
+     * I think that is a desirable property. */
     nm_hash_init(&h, SEED);
     nm_hash_update_mem(&h, str, strlen(str));
     v2 = nm_hash_complete(&h);
@@ -167,8 +167,8 @@ _test_hash_str(const char *str)
         nm_hash_init(&h3, 10);                                                     \
                                                                                    \
         /* assert that it doesn't matter, whether we hash the values individually,
-		 * or all at once, or via the convenience macros nm_hash_update_val()
-		 * and nm_hash_update_vals(). */ \
+         * or all at once, or via the convenience macros nm_hash_update_val()
+         * and nm_hash_update_vals(). */ \
         for (i = 0; i < G_N_ELEMENTS(v); i++) {                                    \
             nm_hash_update(&h0, &v[i], sizeof(type));                              \
             nm_hash_update_val(&h1, v[i]);                                         \
@@ -300,7 +300,7 @@ _do_test_nm_utils_strsplit_set_f_one(NMUtilsStrsplitSetFlags flags,
     initial_offset = (f_preserve_empty || !str) ? 0u : strspn(str, DELIMITERS);
 
     /* first compare our expected values with what g_strsplit_set() would
-	 * do. */
+     * do. */
     words_g = str ? g_strsplit_set(str, DELIMITERS, -1) : NULL;
     if (str == NULL) {
         g_assert_cmpint(words_len, ==, 0);
@@ -365,9 +365,9 @@ _do_test_nm_utils_strsplit_set_f_one(NMUtilsStrsplitSetFlags flags,
     }
 
     /* while strsplit removes all delimiters, we can relatively easily find them
-	 * in the original string. Assert that the original string and the pointer offsets
-	 * of words correspond. In particular, find idx_delim_after and idx_delim_before
-	 * to determine which delimiter was after/before a word. */
+     * in the original string. Assert that the original string and the pointer offsets
+     * of words correspond. In particular, find idx_delim_after and idx_delim_before
+     * to determine which delimiter was after/before a word. */
     {
         gsize idx_word_start;
         gsize idx_delim_after_old = G_MAXSIZE;
@@ -379,9 +379,9 @@ _do_test_nm_utils_strsplit_set_f_one(NMUtilsStrsplitSetFlags flags,
             gsize       idx_delim_before;
 
             /* find the delimiter *after* words[i]. We can do that by looking at the next
-			 * word and calculating the pointer difference.
-			 *
-			 * The delimiter after the very last word is '\0' and requires strlen() to find. */
+             * word and calculating the pointer difference.
+             *
+             * The delimiter after the very last word is '\0' and requires strlen() to find. */
             idx_delim_after = initial_offset + ((words[i] - words[0]) + l_i);
             if (idx_delim_after != idx_word_start + l_i) {
                 g_assert(!f_preserve_empty);
@@ -408,7 +408,7 @@ _do_test_nm_utils_strsplit_set_f_one(NMUtilsStrsplitSetFlags flags,
             /* find the delimiter *before* words[i]. */
             if (i == 0) {
                 /* there is only a delimiter *before*, with !f_preserve_empty and leading
-				 * delimiters. */
+                 * delimiters. */
                 idx_delim_before = G_MAXSIZE;
                 if (initial_offset > 0) {
                     g_assert(!f_preserve_empty);
@@ -755,8 +755,8 @@ _escaped_tokens_create_random_word_full(const char *const *tokens, gsize n_token
     }
 
     /* reallocate the string, so that we don't have any excess memory from
-	 * the GString buffer. This is so that valgrind may better detect an out
-	 * or range access. */
+     * the GString buffer. This is so that valgrind may better detect an out
+     * or range access. */
     return nm_str_realloc(g_string_free(gstr, FALSE));
 }
 
@@ -967,10 +967,10 @@ test_nm_utils_escaped_tokens(void)
             if (i_option % 2u == 1 && nmtst_get_rand_uint32() % 5 == 0
                 && strlen(options->pdata[options->len - 1]) > 0u) {
                 /* For some options, leave the value unset and only generate a key.
-				 *
-				 * If key is "", then we cannot do that, because the test below would try
-				 * to append "" to the combined list, which the parser then would drop.
-				 * Only test omitting the value, if strlen() of the key is positive. */
+                 *
+                 * If key is "", then we cannot do that, because the test below would try
+                 * to append "" to the combined list, which the parser then would drop.
+                 * Only test omitting the value, if strlen() of the key is positive. */
             } else
                 word = _escaped_tokens_create_random_word();
             g_ptr_array_add(options, word);
@@ -1032,18 +1032,18 @@ test_nm_utils_escaped_tokens(void)
         g_assert_cmpint(NM_PTRARRAY_LEN(strv_split), ==, num_options);
 
         /* Above we show a full round-trip of random option key-value pairs, that they can
-		 * without loss escape, concatenate, split-list, and split. This proofed that every
-		 * option key-value pair can be represented as a combined string and parsed back.
-		 *
-		 * Now, just check that we can also parse arbitrary random words in nm_utils_escaped_tokens_options_split().
-		 * split() is a non-injective surjective function. As we check the round-trip above for random words, where
-		 * options-split() is the last step, we show that every random word can be the output of the function
-		 * (which shows, the surjective part).
-		 *
-		 * But multiple random input arguments, may map to the same output argument (non-injective).
-		 * Just test whether we can handle random input words without crashing. For that, just use the
-		 * above generate list of random words.
-		 */
+         * without loss escape, concatenate, split-list, and split. This proofed that every
+         * option key-value pair can be represented as a combined string and parsed back.
+         *
+         * Now, just check that we can also parse arbitrary random words in nm_utils_escaped_tokens_options_split().
+         * split() is a non-injective surjective function. As we check the round-trip above for random words, where
+         * options-split() is the last step, we show that every random word can be the output of the function
+         * (which shows, the surjective part).
+         *
+         * But multiple random input arguments, may map to the same output argument (non-injective).
+         * Just test whether we can handle random input words without crashing. For that, just use the
+         * above generate list of random words.
+         */
         for (i = 0; i < 1u + 2u * i_option; i++) {
             gs_free char *str = NULL;
             const char *  cstr;
@@ -1726,9 +1726,9 @@ del_iter_func(const char *key, const char *value, gpointer user_data)
     int       i;
 
     /* Record how many times this function gets called; it should get called
-	 * exactly as many times as there are keys in the hash table, regardless
-	 * of what keys we delete from the table.
-	 */
+     * exactly as many times as there are keys in the hash table, regardless
+     * of what keys we delete from the table.
+     */
     info->called++;
 
     /* During the iteration, remove a bunch of stuff from the table */
@@ -1774,8 +1774,8 @@ test_setting_vpn_modify_during_foreach(void)
     }
 
     /* And make sure the foreach callback was called the same number of times
-	 * as there were keys in the table at the beginning of the foreach.
-	 */
+     * as there were keys in the table at the beginning of the foreach.
+     */
     g_assert_cmpint(info.called, ==, TO_DEL_NUM * 2);
 
     g_object_unref(s_vpn);
@@ -1812,8 +1812,8 @@ test_setting_ip4_config_labels(void)
     g_assert(label == NULL);
 
     /* The 'address-labels' property should be omitted from the serialization if
-	 * there are no non-NULL labels.
-	 */
+     * there are no non-NULL labels.
+     */
     conn = nmtst_create_minimal_connection("label test", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
     nm_connection_add_setting(conn, nm_setting_duplicate(NM_SETTING(s_ip4)));
     dict = nm_connection_to_dbus(conn, NM_CONNECTION_SERIALIZE_ALL);
@@ -1876,8 +1876,8 @@ test_setting_ip4_config_labels(void)
     g_assert(label == NULL);
 
     /* If we serialize as the daemon, the labels should appear in the D-Bus
-	 * serialization under both 'address-labels' and 'address-data'.
-	 */
+     * serialization under both 'address-labels' and 'address-data'.
+     */
     conn = nmtst_create_minimal_connection("label test", NULL, NM_SETTING_WIRED_SETTING_NAME, NULL);
     nm_connection_add_setting(conn, NM_SETTING(s_ip4));
     _nm_utils_is_manager_process = TRUE;
@@ -1915,8 +1915,8 @@ test_setting_ip4_config_labels(void)
     g_variant_unref(setting_dict);
 
     /* We should be able to deserialize the labels from either 'address-labels'
-	 * or 'address-data'.
-	 */
+     * or 'address-data'.
+     */
     dict2 = g_variant_ref(dict);
 
     NMTST_VARIANT_EDITOR(
@@ -2018,8 +2018,8 @@ test_setting_ip4_config_address_data(void)
     nmtst_assert_setting_verifies(NM_SETTING(s_ip4));
 
     /* The client-side D-Bus serialization should include the attributes in
-	 * "address-data", and should not have an "addresses" property.
-	 */
+     * "address-data", and should not have an "addresses" property.
+     */
     conn = nmtst_create_minimal_connection("address-data test",
                                            NULL,
                                            NM_SETTING_WIRED_SETTING_NAME,
@@ -2512,8 +2512,8 @@ test_connection_to_dbus_setting_name(void)
     dict = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ALL);
 
     /* Make sure the keys of the first level dict are setting names, not
-	 * the GType name of the setting objects.
-	 */
+     * the GType name of the setting objects.
+     */
     g_assert(_variant_contains(dict, NM_SETTING_WIRELESS_SECURITY_SETTING_NAME));
 
     g_variant_unref(dict);
@@ -2727,15 +2727,15 @@ test_setting_new_from_dbus_bad(void)
     GError *      error = NULL;
 
     /* We want to test:
-	 * - ordinary scalar properties
-	 * - string properties
-	 * - GBytes-valued properties (which are handled specially by set_property_from_dbus())
-	 * - enum/flags-valued properties
-	 * - overridden properties
-	 * - transformed properties
-	 *
-	 * No single setting class has examples of all of these, so we need two settings.
-	 */
+     * - ordinary scalar properties
+     * - string properties
+     * - GBytes-valued properties (which are handled specially by set_property_from_dbus())
+     * - enum/flags-valued properties
+     * - overridden properties
+     * - transformed properties
+     *
+     * No single setting class has examples of all of these, so we need two settings.
+     */
 
     conn = nm_simple_connection_new();
 
@@ -3927,8 +3927,8 @@ test_connection_bad_base_types(void)
     GError *      error = NULL;
 
     /* Test various non-base connection types to make sure they are rejected;
-	 * using a fake 'wired' connection so the rest of it verifies
-	 */
+     * using a fake 'wired' connection so the rest of it verifies
+     */
 
     /* Connection setting */
     connection = nm_simple_connection_new();
@@ -4353,8 +4353,8 @@ test_setting_compare_secrets(gconstpointer test_data)
     gs_unref_object            NMSetting *new = NULL;
 
     /* Make sure that a connection with transient/unsaved secrets compares
-	 * successfully to the same connection without those secrets.
-	 */
+     * successfully to the same connection without those secrets.
+     */
 
     old = nm_setting_wireless_security_new();
     g_object_set(old,
@@ -4433,8 +4433,8 @@ test_setting_compare_vpn_secrets(gconstpointer test_data)
     gboolean                   success;
 
     /* Make sure that a connection with transient/unsaved secrets compares
-	 * successfully to the same connection without those secrets.
-	 */
+     * successfully to the same connection without those secrets.
+     */
 
     old = nm_setting_vpn_new();
     nm_setting_vpn_add_secret(NM_SETTING_VPN(old), "foobarbaz", "really secret password");
@@ -4650,7 +4650,7 @@ _netmask_to_prefix(guint32 netmask)
     g_assert_cmpint(prefix, <=, 32);
 
     /* we re-implemented the netmask-to-prefix code differently. Check
-	 * that they agree. */
+     * that they agree. */
     g_assert_cmpint(prefix, ==, nm_utils_ip4_netmask_to_prefix(netmask));
 
     return prefix;
@@ -4706,7 +4706,7 @@ test_ip4_netmask_to_prefix(void)
                 continue;
 
             /* create an invalid netmask with holes and check that the function
-			 * returns the longest prefix. */
+             * returns the longest prefix. */
             prefix_holey = _netmask_to_prefix(netmask_holey);
 
             g_assert_cmpint(i, ==, prefix_holey);
@@ -5193,7 +5193,7 @@ test_setting_old_uuid(void)
     gs_unref_object NMSetting *setting = NULL;
 
     /* NetworkManager-0.9.4.0 generated 40-character UUIDs with no dashes,
-	 * like this one. Test that we maintain compatibility. */
+     * like this one. Test that we maintain compatibility. */
     const char *uuid = "f43bec2cdd60e5da381ebb1eb1fa39f3cc52660c";
 
     setting = nm_setting_connection_new();
@@ -5312,8 +5312,8 @@ test_connection_normalize_virtual_iface_name(void)
     g_object_unref(con);
 
     /* But removing connection.interface-name should result in vlan.connection-name
-	 * being "promoted".
-	 */
+     * being "promoted".
+     */
     NMTST_VARIANT_EDITOR(connection_dict,
                          NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_CONNECTION_SETTING_NAME,
                                                      NM_SETTING_CONNECTION_INTERFACE_NAME););
@@ -5838,8 +5838,8 @@ test_connection_normalize_gateway_never_default(void)
     g_assert_cmpstr("1.1.1.254", ==, nm_setting_ip_config_get_gateway(s_ip4));
 
     /* Now set never-default to TRUE and check that the gateway is
-	 * removed during normalization
-	 * */
+     * removed during normalization
+     * */
     g_object_set(s_ip4, NM_SETTING_IP_CONFIG_NEVER_DEFAULT, TRUE, NULL);
 
     nmtst_assert_connection_verifies_after_normalization(con,
@@ -5880,8 +5880,8 @@ test_connection_normalize_may_fail(void)
     nmtst_assert_connection_verifies_and_normalizable(con);
 
     /* Now set method=disabled/ignore and check that may-fail becomes TRUE
-	 * after normalization
-	 * */
+     * after normalization
+     * */
     g_object_set(s_ip4, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP4_CONFIG_METHOD_DISABLED, NULL);
     g_object_set(s_ip6, NM_SETTING_IP_CONFIG_METHOD, NM_SETTING_IP6_CONFIG_METHOD_IGNORE, NULL);
 
@@ -5922,8 +5922,8 @@ test_connection_normalize_shared_addresses(void)
     nmtst_assert_connection_verifies_and_normalizable(con);
 
     /* Now we add other addresses and check that they are
-	 * removed during normalization
-	 * */
+     * removed during normalization
+     * */
     addr = nm_ip_address_new(AF_INET, "2.2.2.2", 24, &error);
     g_assert_no_error(error);
     nm_setting_ip_config_add_address(s_ip4, addr);
@@ -6345,8 +6345,8 @@ test_setting_ip4_gateway(void)
     nmtst_assert_ip4_address(addr_vals_0[0], "192.168.1.10");
 
     /* When serializing on the daemon side, ipv4.gateway is copied to the first
-	 * entry of ipv4.addresses
-	 */
+     * entry of ipv4.addresses
+     */
     conn  = nmtst_create_minimal_connection("test_setting_ip4_gateway",
                                            NULL,
                                            NM_SETTING_WIRED_SETTING_NAME,
@@ -6398,8 +6398,8 @@ test_setting_ip4_gateway(void)
     g_variant_unref(ip4_dict);
 
     /* When deserializing an old-style connection, the first non-0 gateway in
-	 * ipv4.addresses is copied to :gateway.
-	 */
+     * ipv4.addresses is copied to :gateway.
+     */
     NMTST_VARIANT_EDITOR(
         conn_dict,
         NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_IP4_CONFIG_SETTING_NAME,
@@ -6500,8 +6500,8 @@ test_setting_ip6_gateway(void)
     GError *           error             = NULL;
 
     /* When serializing on the daemon side, ipv6.gateway is copied to the first
-	 * entry of ipv6.addresses
-	 */
+     * entry of ipv6.addresses
+     */
     conn  = nmtst_create_minimal_connection("test_setting_ip6_gateway",
                                            NULL,
                                            NM_SETTING_WIRED_SETTING_NAME,
@@ -6555,8 +6555,8 @@ test_setting_ip6_gateway(void)
     g_variant_unref(ip6_dict);
 
     /* When deserializing an old-style connection, the first non-0 gateway in
-	 * ipv6.addresses is copied to :gateway.
-	 */
+     * ipv6.addresses is copied to :gateway.
+     */
     NMTST_VARIANT_EDITOR(
         conn_dict,
         NMTST_VARIANT_DROP_PROPERTY(NM_SETTING_IP6_CONFIG_SETTING_NAME,
@@ -8280,7 +8280,7 @@ test_nm_utils_is_power_of_two(void)
         if (xyes != 0) {
 again:
             /* Find another @xno, that is not a power of two. Do that,
-			 * by randomly setting bits. */
+             * by randomly setting bits. */
             numbits = g_rand_int_range(rand, 1, 65);
             while (xno != ~((guint64) 0) && numbits > 0) {
                 guint64 v = (((guint64) 1) << g_rand_int_range(rand, 0, 64));
@@ -8512,7 +8512,7 @@ test_nm_utils_ptrarray_find_binary_search_with_duplicates(void)
     for (i_test = 0; i_test < N_TEST; i_test++) {
         for (i_len = 0; i_len < BIN_SEARCH_W_DUPS_LEN; i_len++) {
             /* fill with random numbers... surely there are some duplicates
-			 * there... or maybe even there are none... */
+             * there... or maybe even there are none... */
             for (i = 0; i < i_len; i++)
                 arr[i] =
                     GINT_TO_POINTER(nmtst_get_rand_uint32() % (i_len + BIN_SEARCH_W_DUPS_JITTER));
@@ -8884,8 +8884,8 @@ _do_test_utils_str_utf8safe(const char *            str,
         g_assert_cmpstr(buf_safe, ==, str_safe);
 
         /* nm_utils_buf_utf8safe_escape() can only return a pointer equal to the input string,
-		 * if and only if str_len is negative. Otherwise, the input str won't be NUL terminated
-		 * and cannot be returned. */
+         * if and only if str_len is negative. Otherwise, the input str won't be NUL terminated
+         * and cannot be returned. */
         g_assert(buf_safe != str);
         g_assert(buf_safe == str_free_1);
     } else
@@ -9425,7 +9425,7 @@ test_nm_set_out(void)
     int       call_count;
 
     /* NM_SET_OUT() has an unexpected non-function like behavior
-	 * wrt. side-effects of the value argument. Test it */
+     * wrt. side-effects of the value argument. Test it */
 
     p_val      = &val;
     call_count = 0;
@@ -10121,14 +10121,14 @@ test_strsplit_quoted(void)
         gs_free char *     str  = NULL;
 
         /* create random strv array and join them carefully so that splitting
-		 * them will yield the original value. */
+         * them will yield the original value. */
         strv = _strsplit_quoted_create_strv_rand();
         str  = _strsplit_quoted_join_strv_rand((const char *const *) strv);
         _strsplit_quoted_test(str, (const char *const *) strv);
     }
 
     /* Create random words and assert that systemd and our implementation can
-	 * both split them (and in the exact same way). */
+     * both split them (and in the exact same way). */
     for (i_run = 0; i_run < 1000; i_run++) {
         gs_free char *s = _strsplit_quoted_create_str_rand(nmtst_get_rand_uint32() % 150);
 
diff --git a/libnm-core/tests/test-keyfile.c b/libnm-core/tests/test-keyfile.c
index f4168e5222..c4d33fe418 100644
--- a/libnm-core/tests/test-keyfile.c
+++ b/libnm-core/tests/test-keyfile.c
@@ -45,7 +45,7 @@ do_test_encode_key_full(GKeyFile *  kf,
         g_assert_cmpstr(key2, ==, key);
 
         /* try to add the encoded key to the keyfile. We expect
-		 * no g_critical warning about invalid key. */
+         * no g_critical warning about invalid key. */
         g_key_file_set_value(kf, "group", key, "dummy");
     }
 
@@ -195,8 +195,8 @@ _nm_keyfile_read(GKeyFile *           keyfile,
             NMSettingConnection *s_con;
 
             /* a non-slave connection must have a proxy setting, but
-			 * keyfile reader does not add that (unless a [proxy] section
-			 * is present. */
+             * keyfile reader does not add that (unless a [proxy] section
+             * is present. */
             s_con = nm_connection_get_setting_connection(con);
             if (s_con && !nm_setting_connection_get_master(s_con)
                 && !nm_connection_get_setting_proxy(con))
@@ -223,7 +223,7 @@ _keyfile_convert(NMConnection **       con,
     nm_auto_unref_keyfile GKeyFile *k0_c1_k2 = NULL, *c0_k1 = NULL, *c0_k1_c2_k3 = NULL;
 
     /* convert from @con to @keyfile and check that we can make
-	 * full round trips and obtaining the same result. */
+     * full round trips and obtaining the same result. */
 
     g_assert(con);
     g_assert(keyfile);
@@ -247,8 +247,8 @@ _keyfile_convert(NMConnection **       con,
         k0_c1_k2_c3 = _nm_keyfile_read(k0_c1_k2, keyfile_name, read_handler, read_data, FALSE);
 
         /* It is a expected behavior, that if @k0 contains a relative path ca-cert, @k0_c1 will
-		 * contain that path as relative. But @k0_c1_k2 and @k0_c1_k2_c3 will have absolute paths.
-		 * In this case, hack up @k0_c1_k2_c3 to contain the same relative path. */
+         * contain that path as relative. But @k0_c1_k2 and @k0_c1_k2_c3 will have absolute paths.
+         * In this case, hack up @k0_c1_k2_c3 to contain the same relative path. */
         s1 = nm_connection_get_setting_802_1x(k0_c1);
         s2 = nm_connection_get_setting_802_1x(k0_c1_k2_c3);
         if (s1 || s2) {
@@ -269,8 +269,8 @@ _keyfile_convert(NMConnection **       con,
                     g_assert(p1[0] != '/' && p2[0] == '/');
 
                     /* one of the paths is a relative path and the other is absolute. This is an
-						 * expected difference.
-						 * Make the paths of s2 identical to s1... */
+                         * expected difference.
+                         * Make the paths of s2 identical to s1... */
                     puri  = g_strconcat(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, p1, NULL);
                     pfile = g_bytes_new(puri, strlen(puri) + 1);
                     g_object_set(s2, NM_SETTING_802_1X_CA_CERT, pfile, NULL);
@@ -301,7 +301,7 @@ _keyfile_convert(NMConnection **       con,
         *con = g_object_ref(k0_c1);
     else {
         /* finally, if both a keyfile and a connection are given, assert that they are equal
-		 * after a round of conversion. */
+         * after a round of conversion. */
         g_assert(_nm_keyfile_equals(c0_k1, k0_c1_k2, TRUE));
         nmtst_assert_connection_equals(k0_c1, FALSE, c0_k1_c2, FALSE);
     }
diff --git a/libnm-core/tests/test-secrets.c b/libnm-core/tests/test-secrets.c
index 347db36c9f..8711d3367f 100644
--- a/libnm-core/tests/test-secrets.c
+++ b/libnm-core/tests/test-secrets.c
@@ -430,8 +430,8 @@ test_update_secrets_wifi_full_hash(void)
     const char *               tmp;
 
     /* Test update with a hashed connection containing only 802-11-wireless
-	 * setting and secrets.
-	 */
+     * setting and secrets.
+     */
 
     connection = wifi_connection_new();
 
@@ -470,8 +470,8 @@ test_update_secrets_wifi_bad_setting_name(void)
     const char *  wepkey = "11111111111111111111111111";
 
     /* Test that passing an invalid setting name to
-	 * nm_connection_update_secrets() fails with the correct error.
-	 */
+     * nm_connection_update_secrets() fails with the correct error.
+     */
 
     connection = wifi_connection_new();
 
@@ -497,8 +497,8 @@ test_update_secrets_whole_connection(void)
     const char *               wepkey = "11111111111111111111111111";
 
     /* Test calling nm_connection_update_secrets() with an entire hashed
-	 * connection including non-secrets.
-	 */
+     * connection including non-secrets.
+     */
 
     connection = wifi_connection_new();
 
@@ -556,8 +556,8 @@ test_update_secrets_whole_connection_bad_setting(void)
     const char *               wepkey = "11111111111111111111111111";
 
     /* Test that sending a hashed connection containing an invalid setting
-	 * name fails with the right error.
-	 */
+     * name fails with the right error.
+     */
 
     connection = wifi_connection_new();
     s_wsec     = nm_connection_get_setting_wireless_security(connection);
@@ -568,9 +568,9 @@ test_update_secrets_whole_connection_bad_setting(void)
     secrets = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ALL);
 
     /* Copy the dict, renaming the wireless-security setting in the process
-	 * (so we ensure libnm is returning the right error when it finds an entry
-	 * in the connection hash that doesn't match any setting in the connection).
-	 */
+     * (so we ensure libnm is returning the right error when it finds an entry
+     * in the connection hash that doesn't match any setting in the connection).
+     */
     g_variant_builder_init(&conn_builder, NM_VARIANT_TYPE_CONNECTION);
     g_variant_iter_init(&conn_iter, secrets);
     while (g_variant_iter_next(&conn_iter, "{&s@a{sv}}", &setting_name, &setting_hash)) {
@@ -601,8 +601,8 @@ test_update_secrets_whole_connection_empty_base_setting(void)
     gboolean      success;
 
     /* Test that a hashed connection which does not have any hashed secrets
-	 * for the requested setting returns success.
-	 */
+     * for the requested setting returns success.
+     */
 
     connection = wifi_connection_new();
     secrets    = nm_connection_to_dbus(connection, NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
diff --git a/libnm-core/tests/test-setting.c b/libnm-core/tests/test-setting.c
index d18c0a44fc..d8518ca853 100644
--- a/libnm-core/tests/test-setting.c
+++ b/libnm-core/tests/test-setting.c
@@ -82,7 +82,7 @@ _connection_new_from_dbus_strict(GVariant *dict, gboolean normalize)
     nmtst_assert_connection_verifies_without_normalization(con_n_s);
 
     /* randomly compare some pairs that we created. They must all be equal,
-	 * after accounting for normalization. */
+     * after accounting for normalization. */
     for (i = 0; i < 10; i++) {
         NMConnection *cons[] = {con_x_0, con_x_s, con_x_e, con_n_0, con_n_s, con_n_e};
         guint         idx_a  = (nmtst_get_rand_uint32() % G_N_ELEMENTS(cons));
@@ -749,9 +749,9 @@ test_dcb_flags_valid(void)
 #define TEST_FLAG(p, f, v)                                                           \
     {                                                                                \
         /* GObject property min/max should ensure the property does not get set to \
-	 * the invalid value, so we ensure the value we just tried to set is 0 and \
-	 * that verify is successful since the property never got set. \
-	 */ \
+     * the invalid value, so we ensure the value we just tried to set is 0 and \
+     * that verify is successful since the property never got set. \
+     */ \
         g_object_set(G_OBJECT(s_dcb), p, v, NULL);                                   \
         g_assert_cmpint(f(s_dcb), ==, 0);                                            \
         success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);                \
@@ -862,8 +862,8 @@ test_dcb_app_priorities(void)
         if (verify) {                                                                             \
             if (val != 0) {                                                                       \
                 /* Assert that verify fails because the flags do not include 'enabled' \
-			 * and a value has been set. \
-			 */          \
+             * and a value has been set. \
+             */          \
                 success = nm_setting_verify(NM_SETTING(s_dcb), NULL, &error);                     \
                 g_assert_error(error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY); \
                 g_assert(success == FALSE);                                                       \
@@ -922,8 +922,8 @@ test_dcb_priorities_valid(void)
         nm_setting_dcb_set_priority_group_bandwidth(s_dcb, i, 0);
 
     /* Priority Group Bandwidth must add up to 100% if enabled, which requires
-	 * some dancing for verifying individual values here.
-	 */
+     * some dancing for verifying individual values here.
+     */
     for (i = 0; i < 8; i++) {
         guint other = 7 - (i % 8);
 
@@ -1577,9 +1577,9 @@ _check_team_setting(NMSetting *setting)
     nmtst_assert_setting_dbus_roundtrip(setting);
 
     /* OK, now parse the setting only from the D-Bus variant, but removing the JSON config.
-	 * For that, we have to "drop" the JSON and we do that by resetting the property.
-	 * This causes JSON to be regenerated and it's in a normalized form that will compare
-	 * equal. */
+     * For that, we have to "drop" the JSON and we do that by resetting the property.
+     * This causes JSON to be regenerated and it's in a normalized form that will compare
+     * equal. */
     setting_clone = nm_setting_duplicate(setting);
     setting       = setting_clone;
     if (is_port) {
@@ -2991,8 +2991,8 @@ _rndt_wg_peers_create(void)
         guint            i_aip, n_aip;
 
         /* we don't bother to create a valid curve25519 public key. Of course, libnm cannot
-		 * check whether the public key is bogus or not. Hence, for our purpose a random
-		 * bogus key is good enough. */
+         * check whether the public key is bogus or not. Hence, for our purpose a random
+         * bogus key is good enough. */
         public_key = g_base64_encode(nmtst_rand_buf(NULL, public_key_buf, sizeof(public_key_buf)),
                                      sizeof(public_key_buf));
 
@@ -3524,8 +3524,8 @@ test_roundtrip_conversion(gconstpointer test_data)
     }
 
     /* the first kf_data_arr entry is special: it is the exact result of what we expect
-	 * when converting @con to keyfile. Write @con to keyfile and compare the expected result
-	 * literally. */
+     * when converting @con to keyfile. Write @con to keyfile and compare the expected result
+     * literally. */
     {
         nm_auto_unref_keyfile GKeyFile *kf = NULL;
 
@@ -3533,7 +3533,7 @@ test_roundtrip_conversion(gconstpointer test_data)
         nmtst_assert_success(kf, error);
 
         /* the first kf_data_arr entry is special: it must be what the writer would
-		 * produce again. */
+         * produce again. */
         nmtst_keyfile_assert_data(kf, kf_data_arr->pdata[0], -1);
     }
 
@@ -3553,12 +3553,12 @@ test_roundtrip_conversion(gconstpointer test_data)
 
             if (ETH_MTU > (guint32) G_MAXINT && kf_data_idx == 1) {
                 /* older versions wrote values > 2^21 as signed integers, but the reader would
-				 * always reject such negative values for G_TYPE_UINT.
-				 *
-				 * The test case kf_data_idx #1 still writes the values in the old style.
-				 * The behavior was fixed, but such values are still rejected as invalid.
-				 *
-				 * Patch the setting so that the comparison below succeeds are usual. */
+                 * always reject such negative values for G_TYPE_UINT.
+                 *
+                 * The test case kf_data_idx #1 still writes the values in the old style.
+                 * The behavior was fixed, but such values are still rejected as invalid.
+                 *
+                 * Patch the setting so that the comparison below succeeds are usual. */
                 g_assert_cmpint(nm_setting_wired_get_mtu(s_eth2), ==, 0);
                 g_object_set(s_eth2, NM_SETTING_WIRED_MTU, ETH_MTU, NULL);
             }
@@ -4127,7 +4127,7 @@ test_setting_metadata(void)
                     default_value = ((const GParamSpecString *) sip->param_spec)->default_value;
                     if (default_value) {
                         /* having a string property with a default != NULL is really ugly. They
-						 * should be best avoided... */
+                         * should be best avoided... */
                         if (meta_type == NM_META_SETTING_TYPE_DCB
                             && nm_streq(sip->name, NM_SETTING_DCB_APP_FCOE_MODE)) {
                             /* Whitelist the properties that have a non-NULL default value. */
@@ -4166,7 +4166,7 @@ test_setting_metadata(void)
             g_assert_cmpint(meta_type, ==, NM_META_SETTING_TYPE_CONNECTION);
 
             /* ensure that there are no duplicates, and that all properties are also
-			 * tracked by sis->property_infos. */
+             * tracked by sis->property_infos. */
             for (prop_idx = 0; prop_idx < sis->property_infos_len; prop_idx++) {
                 const NMSettInfoProperty *sip = sis->property_infos_sorted[prop_idx];
 
@@ -4226,16 +4226,16 @@ test_setting_metadata(void)
                     || (pt_2 == &nm_sett_info_propert_type_plain_u
                         && pt == &nm_sett_info_propert_type_deprecated_ignore_u)) {
                     /* These are known to be duplicated. This is the case for
-					 *   "gsm.network-type"  and plain properties like "802-11-wireless-security.fils" ("i" D-Bus type)
-					 *   "gsm.allowed-bands" and plain properties like "802-11-olpc-mesh.channel" ("u" D-Bus type)
-					 * While the content/behaviour of the property types are identical, their purpose
-					 * is different. So allow them.
-					 */
+                     *   "gsm.network-type"  and plain properties like "802-11-wireless-security.fils" ("i" D-Bus type)
+                     *   "gsm.allowed-bands" and plain properties like "802-11-olpc-mesh.channel" ("u" D-Bus type)
+                     * While the content/behaviour of the property types are identical, their purpose
+                     * is different. So allow them.
+                     */
                     continue;
                 }
 
                 /* the property-types with same content should all be shared. Here we have two that
-				 * are the same content, but different instances. Bug. */
+                 * are the same content, but different instances. Bug. */
                 g_error("The identical property type for D-Bus type \"%s\" is used by: %s and %s",
                         (const char *) pt->dbus_type,
                         _PROP_IDX_OWNER(h_property_types, pt),
diff --git a/libnm-core/tests/test-settings-defaults.c b/libnm-core/tests/test-settings-defaults.c
index 988521e431..228207fc78 100644
--- a/libnm-core/tests/test-settings-defaults.c
+++ b/libnm-core/tests/test-settings-defaults.c
@@ -43,8 +43,8 @@ test_defaults(GType type, const char *name)
         gboolean    ok = FALSE;
 
         /* Ignore non-fundamental types since they won't really have
-		 * defaults.
-		 */
+         * defaults.
+         */
         if (!G_TYPE_IS_FUNDAMENTAL(prop_spec->value_type))
             continue;
 
diff --git a/libnm/nm-access-point.c b/libnm/nm-access-point.c
index 93ceb7c830..deaf5d0810 100644
--- a/libnm/nm-access-point.c
+++ b/libnm/nm-access-point.c
@@ -503,10 +503,10 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
     object_class->finalize     = finalize;
 
     /**
-	 * NMAccessPoint:flags:
-	 *
-	 * The flags of the access point.
-	 **/
+     * NMAccessPoint:flags:
+     *
+     * The flags of the access point.
+     **/
     obj_properties[PROP_FLAGS] = g_param_spec_flags(NM_ACCESS_POINT_FLAGS,
                                                     "",
                                                     "",
@@ -515,10 +515,10 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:wpa-flags:
-	 *
-	 * The WPA flags of the access point.
-	 **/
+     * NMAccessPoint:wpa-flags:
+     *
+     * The WPA flags of the access point.
+     **/
     obj_properties[PROP_WPA_FLAGS] = g_param_spec_flags(NM_ACCESS_POINT_WPA_FLAGS,
                                                         "",
                                                         "",
@@ -527,10 +527,10 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:rsn-flags:
-	 *
-	 * The RSN flags of the access point.
-	 **/
+     * NMAccessPoint:rsn-flags:
+     *
+     * The RSN flags of the access point.
+     **/
     obj_properties[PROP_RSN_FLAGS] = g_param_spec_flags(NM_ACCESS_POINT_RSN_FLAGS,
                                                         "",
                                                         "",
@@ -539,10 +539,10 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:ssid:
-	 *
-	 * The SSID of the access point, or %NULL if it is not known.
-	 **/
+     * NMAccessPoint:ssid:
+     *
+     * The SSID of the access point, or %NULL if it is not known.
+     **/
     obj_properties[PROP_SSID] = g_param_spec_boxed(NM_ACCESS_POINT_SSID,
                                                    "",
                                                    "",
@@ -550,10 +550,10 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:frequency:
-	 *
-	 * The frequency of the access point.
-	 **/
+     * NMAccessPoint:frequency:
+     *
+     * The frequency of the access point.
+     **/
     obj_properties[PROP_FREQUENCY] = g_param_spec_uint(NM_ACCESS_POINT_FREQUENCY,
                                                        "",
                                                        "",
@@ -563,10 +563,10 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:bssid:
-	 *
-	 * The BSSID of the access point.
-	 **/
+     * NMAccessPoint:bssid:
+     *
+     * The BSSID of the access point.
+     **/
     obj_properties[PROP_BSSID] = g_param_spec_string(NM_ACCESS_POINT_BSSID,
                                                      "",
                                                      "",
@@ -574,12 +574,12 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:hw-address:
-	 *
-	 * Alias for #NMAccessPoint:bssid.
-	 *
-	 * Deprecated: 1.0: Use #NMAccessPoint:bssid.
-	 **/
+     * NMAccessPoint:hw-address:
+     *
+     * Alias for #NMAccessPoint:bssid.
+     *
+     * Deprecated: 1.0: Use #NMAccessPoint:bssid.
+     **/
     obj_properties[PROP_HW_ADDRESS] =
         g_param_spec_string(NM_ACCESS_POINT_HW_ADDRESS,
                             "",
@@ -588,12 +588,12 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:mode:
-	 *
-	 * The mode of the access point; either "infrastructure" (a central
-	 * coordinator of the wireless network allowing clients to connect) or
-	 * "ad-hoc" (a network with no central controller).
-	 **/
+     * NMAccessPoint:mode:
+     *
+     * The mode of the access point; either "infrastructure" (a central
+     * coordinator of the wireless network allowing clients to connect) or
+     * "ad-hoc" (a network with no central controller).
+     **/
     obj_properties[PROP_MODE] = g_param_spec_enum(NM_ACCESS_POINT_MODE,
                                                   "",
                                                   "",
@@ -602,10 +602,10 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                   G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:max-bitrate:
-	 *
-	 * The maximum bit rate of the access point in kbit/s.
-	 **/
+     * NMAccessPoint:max-bitrate:
+     *
+     * The maximum bit rate of the access point in kbit/s.
+     **/
     obj_properties[PROP_MAX_BITRATE] = g_param_spec_uint(NM_ACCESS_POINT_MAX_BITRATE,
                                                          "",
                                                          "",
@@ -615,10 +615,10 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:strength:
-	 *
-	 * The current signal strength of the access point.
-	 **/
+     * NMAccessPoint:strength:
+     *
+     * The current signal strength of the access point.
+     **/
     obj_properties[PROP_STRENGTH] = g_param_spec_uchar(NM_ACCESS_POINT_STRENGTH,
                                                        "",
                                                        "",
@@ -628,14 +628,14 @@ nm_access_point_class_init(NMAccessPointClass *ap_class)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMAccessPoint:last-seen:
-	 *
-	 * The timestamp (in CLOCK_BOOTTIME seconds) for the last time the
-	 * access point was found in scan results.  A value of -1 means the
-	 * access point has not been found in a scan.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMAccessPoint:last-seen:
+     *
+     * The timestamp (in CLOCK_BOOTTIME seconds) for the last time the
+     * access point was found in scan results.  A value of -1 means the
+     * access point has not been found in a scan.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_LAST_SEEN] = g_param_spec_int(NM_ACCESS_POINT_LAST_SEEN,
                                                       "",
                                                       "",
diff --git a/libnm/nm-active-connection.c b/libnm/nm-active-connection.c
index 6efa5163fd..906db0615c 100644
--- a/libnm/nm-active-connection.c
+++ b/libnm/nm-active-connection.c
@@ -400,8 +400,8 @@ _notify_event_state_changed(NMClient *client, NMClientNotifyEventWithPtr *notify
     NMActiveConnectionPrivate *         priv = NM_ACTIVE_CONNECTION_GET_PRIVATE(self);
 
     /* we expose here the value cache in @priv. In practice, this is the same
-	 * value as we received from the signal. In the unexpected case where they
-	 * differ, the cached value of the current instance would still be more correct. */
+     * value as we received from the signal. In the unexpected case where they
+     * differ, the cached value of the current instance would still be more correct. */
     g_signal_emit(self, signals[STATE_CHANGED], 0, (guint) priv->state, (guint) priv->reason);
 }
 
@@ -433,20 +433,20 @@ is_ready(NMObject *nmobj)
     NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE(nmobj);
 
     /* Usually, we don't want to expose our NMObject instances until they are fully initialized.
-	 * For NMRemoteSetting this means to wait until GetSettings() returns.
-	 *
-	 * Note that most object types reference each other (directly or indirectly). E.g. the
-	 * NMActiveConnection refers to the NMRemoteConnection and the NMDevice instance. So,
-	 * we don't want to hide them too long, otherwise basically the entire set of objects
-	 * will be hidden until they are all initialized. So, usually, when a NMObject references
-	 * objects that are not yet initialized, that reference will just be NULL but the object
-	 * will be considered ready already.
-	 *
-	 * For NMActiveConnection referencing a NMRemoteConnection don't do that. Here we wait for the
-	 * NMRemoteConnection to be ready as well. This is somewhat arbitrary special casing, but
-	 * the effect is that when nm_client_add_and_activate*() returns, the NMActiveConnection already
-	 * references a initialized NMRemoteConnection.
-	 */
+     * For NMRemoteSetting this means to wait until GetSettings() returns.
+     *
+     * Note that most object types reference each other (directly or indirectly). E.g. the
+     * NMActiveConnection refers to the NMRemoteConnection and the NMDevice instance. So,
+     * we don't want to hide them too long, otherwise basically the entire set of objects
+     * will be hidden until they are all initialized. So, usually, when a NMObject references
+     * objects that are not yet initialized, that reference will just be NULL but the object
+     * will be considered ready already.
+     *
+     * For NMActiveConnection referencing a NMRemoteConnection don't do that. Here we wait for the
+     * NMRemoteConnection to be ready as well. This is somewhat arbitrary special casing, but
+     * the effect is that when nm_client_add_and_activate*() returns, the NMActiveConnection already
+     * references a initialized NMRemoteConnection.
+     */
     if (!nml_dbus_property_o_is_ready_fully(&priv->property_o[PROPERTY_O_IDX_CONNECTION]))
         return FALSE;
 
@@ -623,10 +623,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
     _NM_OBJECT_CLASS_INIT_PROPERTY_AO_FIELDS_1(nm_object_class, NMActiveConnectionPrivate, devices);
 
     /**
-	 * NMActiveConnection:connection:
-	 *
-	 * The connection that this is an active instance of.
-	 **/
+     * NMActiveConnection:connection:
+     *
+     * The connection that this is an active instance of.
+     **/
     obj_properties[PROP_CONNECTION] =
         g_param_spec_object(NM_ACTIVE_CONNECTION_CONNECTION,
                             "",
@@ -635,10 +635,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:id:
-	 *
-	 * The active connection's ID
-	 **/
+     * NMActiveConnection:id:
+     *
+     * The active connection's ID
+     **/
     obj_properties[PROP_ID] = g_param_spec_string(NM_ACTIVE_CONNECTION_ID,
                                                   "",
                                                   "",
@@ -646,10 +646,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                   G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:uuid:
-	 *
-	 * The active connection's UUID
-	 **/
+     * NMActiveConnection:uuid:
+     *
+     * The active connection's UUID
+     **/
     obj_properties[PROP_UUID] = g_param_spec_string(NM_ACTIVE_CONNECTION_UUID,
                                                     "",
                                                     "",
@@ -657,10 +657,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:type:
-	 *
-	 * The active connection's type
-	 **/
+     * NMActiveConnection:type:
+     *
+     * The active connection's type
+     **/
     obj_properties[PROP_TYPE] = g_param_spec_string(NM_ACTIVE_CONNECTION_TYPE,
                                                     "",
                                                     "",
@@ -668,11 +668,11 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:specific-object-path:
-	 *
-	 * The path to the "specific object" of the active connection; see
-	 * nm_active_connection_get_specific_object_path() for more details.
-	 **/
+     * NMActiveConnection:specific-object-path:
+     *
+     * The path to the "specific object" of the active connection; see
+     * nm_active_connection_get_specific_object_path() for more details.
+     **/
     obj_properties[PROP_SPECIFIC_OBJECT_PATH] =
         g_param_spec_string(NM_ACTIVE_CONNECTION_SPECIFIC_OBJECT_PATH,
                             "",
@@ -681,10 +681,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:devices: (type GPtrArray(NMDevice))
-	 *
-	 * The devices of the active connection.
-	 **/
+     * NMActiveConnection:devices: (type GPtrArray(NMDevice))
+     *
+     * The devices of the active connection.
+     **/
     obj_properties[PROP_DEVICES] = g_param_spec_boxed(NM_ACTIVE_CONNECTION_DEVICES,
                                                       "",
                                                       "",
@@ -692,10 +692,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:state:
-	 *
-	 * The state of the active connection.
-	 **/
+     * NMActiveConnection:state:
+     *
+     * The state of the active connection.
+     **/
     obj_properties[PROP_STATE] = g_param_spec_enum(NM_ACTIVE_CONNECTION_STATE,
                                                    "",
                                                    "",
@@ -704,12 +704,12 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:state-flags:
-	 *
-	 * The state flags of the active connection.
-	 *
-	 * Since: 1.10
-	 **/
+     * NMActiveConnection:state-flags:
+     *
+     * The state flags of the active connection.
+     *
+     * Since: 1.10
+     **/
     obj_properties[PROP_STATE_FLAGS] = g_param_spec_uint(NM_ACTIVE_CONNECTION_STATE_FLAGS,
                                                          "",
                                                          "",
@@ -719,10 +719,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:default:
-	 *
-	 * Whether the active connection is the default IPv4 one.
-	 **/
+     * NMActiveConnection:default:
+     *
+     * Whether the active connection is the default IPv4 one.
+     **/
     obj_properties[PROP_DEFAULT] = g_param_spec_boolean(NM_ACTIVE_CONNECTION_DEFAULT,
                                                         "",
                                                         "",
@@ -730,10 +730,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:ip4-config:
-	 *
-	 * The IPv4 #NMIPConfig of the connection.
-	 **/
+     * NMActiveConnection:ip4-config:
+     *
+     * The IPv4 #NMIPConfig of the connection.
+     **/
     obj_properties[PROP_IP4_CONFIG] =
         g_param_spec_object(NM_ACTIVE_CONNECTION_IP4_CONFIG,
                             "",
@@ -742,10 +742,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:dhcp4-config:
-	 *
-	 * The IPv4 #NMDhcpConfig of the connection.
-	 **/
+     * NMActiveConnection:dhcp4-config:
+     *
+     * The IPv4 #NMDhcpConfig of the connection.
+     **/
     obj_properties[PROP_DHCP4_CONFIG] =
         g_param_spec_object(NM_ACTIVE_CONNECTION_DHCP4_CONFIG,
                             "",
@@ -754,10 +754,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:default6:
-	 *
-	 * Whether the active connection is the default IPv6 one.
-	 **/
+     * NMActiveConnection:default6:
+     *
+     * Whether the active connection is the default IPv6 one.
+     **/
     obj_properties[PROP_DEFAULT6] = g_param_spec_boolean(NM_ACTIVE_CONNECTION_DEFAULT6,
                                                          "",
                                                          "",
@@ -765,10 +765,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:ip6-config:
-	 *
-	 * The IPv6 #NMIPConfig of the connection.
-	 **/
+     * NMActiveConnection:ip6-config:
+     *
+     * The IPv6 #NMIPConfig of the connection.
+     **/
     obj_properties[PROP_IP6_CONFIG] =
         g_param_spec_object(NM_ACTIVE_CONNECTION_IP6_CONFIG,
                             "",
@@ -777,10 +777,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:dhcp6-config:
-	 *
-	 * The IPv6 #NMDhcpConfig of the connection.
-	 **/
+     * NMActiveConnection:dhcp6-config:
+     *
+     * The IPv6 #NMDhcpConfig of the connection.
+     **/
     obj_properties[PROP_DHCP6_CONFIG] =
         g_param_spec_object(NM_ACTIVE_CONNECTION_DHCP6_CONFIG,
                             "",
@@ -789,10 +789,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:vpn:
-	 *
-	 * Whether the active connection is a VPN connection.
-	 **/
+     * NMActiveConnection:vpn:
+     *
+     * Whether the active connection is a VPN connection.
+     **/
     obj_properties[PROP_VPN] = g_param_spec_boolean(NM_ACTIVE_CONNECTION_VPN,
                                                     "",
                                                     "",
@@ -800,10 +800,10 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMActiveConnection:master:
-	 *
-	 * The master device if one exists.
-	 **/
+     * NMActiveConnection:master:
+     *
+     * The master device if one exists.
+     **/
     obj_properties[PROP_MASTER] = g_param_spec_object(NM_ACTIVE_CONNECTION_MASTER,
                                                       "",
                                                       "",
@@ -814,17 +814,17 @@ nm_active_connection_class_init(NMActiveConnectionClass *klass)
                                               &_nml_dbus_meta_iface_nm_connection_active);
 
     /* TODO: the state reason should also be exposed as a property in libnm's NMActiveConnection,
-	 * like done for NMDevice's state reason. */
+     * like done for NMDevice's state reason. */
 
     /* TODO: the D-Bus API should also expose the state-reason as a property instead of
-	 * a "StateChanged" signal. Like done for Device's "StateReason".  */
+     * a "StateChanged" signal. Like done for Device's "StateReason".  */
 
     /**
-	 * NMActiveConnection::state-changed:
-	 * @active_connection: the source #NMActiveConnection
-	 * @state: the new state number (#NMActiveConnectionState)
-	 * @reason: the state change reason (#NMActiveConnectionStateReason)
-	 */
+     * NMActiveConnection::state-changed:
+     * @active_connection: the source #NMActiveConnection
+     * @state: the new state number (#NMActiveConnectionState)
+     * @reason: the state change reason (#NMActiveConnectionStateReason)
+     */
     signals[STATE_CHANGED] = g_signal_new("state-changed",
                                           G_OBJECT_CLASS_TYPE(object_class),
                                           G_SIGNAL_RUN_FIRST,
diff --git a/libnm/nm-checkpoint.c b/libnm/nm-checkpoint.c
index 6c1d96d63b..6876e16f9d 100644
--- a/libnm/nm-checkpoint.c
+++ b/libnm/nm-checkpoint.c
@@ -155,12 +155,12 @@ nm_checkpoint_class_init(NMCheckpointClass *klass)
     _NM_OBJECT_CLASS_INIT_PROPERTY_AO_FIELDS_1(nm_object_class, NMCheckpointPrivate, devices);
 
     /**
-	 * NMCheckpoint:devices: (type GPtrArray(NMDevice))
-	 *
-	 * The devices that are part of this checkpoint.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMCheckpoint:devices: (type GPtrArray(NMDevice))
+     *
+     * The devices that are part of this checkpoint.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_DEVICES] = g_param_spec_boxed(NM_CHECKPOINT_DEVICES,
                                                       "",
                                                       "",
@@ -168,12 +168,12 @@ nm_checkpoint_class_init(NMCheckpointClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMCheckpoint:created:
-	 *
-	 * The timestamp (in CLOCK_BOOTTIME milliseconds) of checkpoint creation.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMCheckpoint:created:
+     *
+     * The timestamp (in CLOCK_BOOTTIME milliseconds) of checkpoint creation.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_CREATED] = g_param_spec_int64(NM_CHECKPOINT_CREATED,
                                                       "",
                                                       "",
@@ -183,12 +183,12 @@ nm_checkpoint_class_init(NMCheckpointClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMCheckpoint:rollback-timeout:
-	 *
-	 * Timeout in seconds for automatic rollback, or zero.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMCheckpoint:rollback-timeout:
+     *
+     * Timeout in seconds for automatic rollback, or zero.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_ROLLBACK_TIMEOUT] =
         g_param_spec_uint(NM_CHECKPOINT_ROLLBACK_TIMEOUT,
                           "",
diff --git a/libnm/nm-client.c b/libnm/nm-client.c
index 46f667378e..0d4f2a9a48 100644
--- a/libnm/nm-client.c
+++ b/libnm/nm-client.c
@@ -84,43 +84,43 @@ nm_context_busy_watcher_integrate_source(GMainContext *outer_context,
     g_source_attach(source, outer_context);
 
     /* The problem is...
-	 *
-	 * NMClient is associated with a GMainContext, just like its underlying GDBusConnection
-	 * also queues signals and callbacks on that main context. During operation, NMClient
-	 * will schedule async operations which will return asynchronously on the GMainContext.
-	 *
-	 * Note that depending on whether NMClient got initialized synchronously or asynchronously,
-	 * it has an internal priv->dbus_context that is different from the outer priv->main_context.
-	 * However, the problem is in both cases.
-	 *
-	 * So, as long as there are pending D-Bus calls, the GMainContext is referenced and kept alive.
-	 * When NMClient gets destroyed, the pending calls get cancelled, but the async callback are still
-	 * scheduled to return.
-	 * That means, the main context stays alive until it gets iterated long enough so that all pending
-	 * operations are completed.
-	 *
-	 * Note that pending operations don't keep NMClient alive, so NMClient can already be gone by
-	 * then, but the user still should iterate the main context long enough to process the (cancelled)
-	 * callbacks... at least, if the user cares about whether the remaining memory and file descriptors
-	 * of the GMainContext can be reclaimed.
-	 *
-	 * In hindsight, maybe pending references should kept NMClient alive. But then NMClient would
-	 * need a special "shutdown()" API that the user must invoke, because unrefing would no longer
-	 * be enough to ensure a shutdown (imagine a situation where NMClient receives a constant flow
-	 * of "CheckPermissions" signals, which keeps retriggering an async request). Anyway, we cannot
-	 * add such a shutdown API now, as it would break client's expectations that they can just unref
-	 * the NMClient to destroy it.
-	 *
-	 * So, we allow NMClient to unref, but the user is advised to keep iterating the main context.
-	 * But for how long? Here comes nm_client_get_context_busy_watcher() into play. The user may
-	 * subscribe a weak pointer to that instance and should keep iterating as long as the object
-	 * exists.
-	 *
-	 * Now, back to synchronous initialization. Here we have the internal priv->dbus_context context.
-	 * We also cannot remove that context right away, instead we need to keep it integrated in the
-	 * caller's priv->main_context as long as we have pending calls: that is, as long as the
-	 * context-busy-watcher is alive.
-	 */
+     *
+     * NMClient is associated with a GMainContext, just like its underlying GDBusConnection
+     * also queues signals and callbacks on that main context. During operation, NMClient
+     * will schedule async operations which will return asynchronously on the GMainContext.
+     *
+     * Note that depending on whether NMClient got initialized synchronously or asynchronously,
+     * it has an internal priv->dbus_context that is different from the outer priv->main_context.
+     * However, the problem is in both cases.
+     *
+     * So, as long as there are pending D-Bus calls, the GMainContext is referenced and kept alive.
+     * When NMClient gets destroyed, the pending calls get cancelled, but the async callback are still
+     * scheduled to return.
+     * That means, the main context stays alive until it gets iterated long enough so that all pending
+     * operations are completed.
+     *
+     * Note that pending operations don't keep NMClient alive, so NMClient can already be gone by
+     * then, but the user still should iterate the main context long enough to process the (cancelled)
+     * callbacks... at least, if the user cares about whether the remaining memory and file descriptors
+     * of the GMainContext can be reclaimed.
+     *
+     * In hindsight, maybe pending references should kept NMClient alive. But then NMClient would
+     * need a special "shutdown()" API that the user must invoke, because unrefing would no longer
+     * be enough to ensure a shutdown (imagine a situation where NMClient receives a constant flow
+     * of "CheckPermissions" signals, which keeps retriggering an async request). Anyway, we cannot
+     * add such a shutdown API now, as it would break client's expectations that they can just unref
+     * the NMClient to destroy it.
+     *
+     * So, we allow NMClient to unref, but the user is advised to keep iterating the main context.
+     * But for how long? Here comes nm_client_get_context_busy_watcher() into play. The user may
+     * subscribe a weak pointer to that instance and should keep iterating as long as the object
+     * exists.
+     *
+     * Now, back to synchronous initialization. Here we have the internal priv->dbus_context context.
+     * We also cannot remove that context right away, instead we need to keep it integrated in the
+     * caller's priv->main_context as long as we have pending calls: that is, as long as the
+     * context-busy-watcher is alive.
+     */
 
     g_object_weak_ref(context_busy_watcher,
                       _context_busy_watcher_attach_integration_source_cb,
@@ -131,7 +131,7 @@ nm_context_busy_watcher_integrate_source(GMainContext *outer_context,
 
 typedef struct {
     /* It is quite wasteful to require 2 pointers per property (of an instance) only to track whether
-	 * the property got changed. But it's convenient! */
+     * the property got changed. But it's convenient! */
     CList changed_prop_lst;
 
     GVariant *prop_data_value;
@@ -147,9 +147,9 @@ typedef struct {
     CList changed_prop_lst_head;
 
     /* We also keep track of non-well known interfaces. The presence of a D-Bus interface
-	 * is what makes a D-Bus alive or not. As we should track all D-Bus objects, we also
-	 * need to track whether there are any interfaces on it -- even if we otherwise don't
-	 * care about the interface. */
+     * is what makes a D-Bus alive or not. As we should track all D-Bus objects, we also
+     * need to track whether there are any interfaces on it -- even if we otherwise don't
+     * care about the interface. */
     bool dbus_iface_is_wellknown : 1;
 
     /* if TRUE, the interface is about to be removed. */
@@ -738,7 +738,7 @@ _nm_client_set_property_sync_legacy(NMClient *  self,
     nm_assert(val);
 
     /* A synchronous D-Bus call that is not cancellable an ignores the return value.
-	 * This function only exists for backward compatibility. */
+     * This function only exists for backward compatibility. */
     ret = g_dbus_connection_call_sync(priv->dbus_connection,
                                       priv->name_owner,
                                       object_path,
@@ -797,7 +797,7 @@ _nm_client_queue_notify_object(NMClient *self, gpointer nmobj, const GParamSpec
 
     if (base->is_disposing) {
         /* Don't emit property changed signals once the NMClient
-		 * instance is about to shut down. */
+         * instance is about to shut down. */
         nm_assert(nmobj == self);
         return;
     }
@@ -1182,9 +1182,9 @@ nml_dbus_object_iface_data_get(NMLDBusObject *dbobj,
 
     if (count > 20) {
         /* We track the list of interfaces that an object has in a linked list.
-		 * That is efficient and convenient, if we assume that each object only has a small
-		 * number of interfaces (which very much should be the case). Here, something is very
-		 * odd, maybe there is a bug or the server side is misbehaving. Anyway, error out. */
+         * That is efficient and convenient, if we assume that each object only has a small
+         * number of interfaces (which very much should be the case). Here, something is very
+         * odd, maybe there is a bug or the server side is misbehaving. Anyway, error out. */
         return NULL;
     }
 
@@ -1208,7 +1208,7 @@ nml_dbus_object_iface_data_get(NMLDBusObject *dbobj,
         c_list_link_front(&dbobj->iface_lst_head, &db_iface_data->iface_lst);
     } else {
         /* Intentionally don't initialize the other fields. We are not supposed
-		 * to touch them, and a valgrind warning would be preferable. */
+         * to touch them, and a valgrind warning would be preferable. */
         db_iface_data->dbus_iface.name         = nm_ref_string_new(dbus_iface_name);
         db_iface_data->dbus_iface_is_wellknown = FALSE;
         db_iface_data->iface_removed           = FALSE;
@@ -1336,17 +1336,17 @@ nml_dbus_object_obj_changed_link(NMClient *            self,
         NMClientPrivate *priv;
 
         /* We set the changed-type flag. Need to queue the object in the
-		 * changed list. */
+         * changed list. */
         nm_assert(c_list_is_empty(&dbobj->obj_changed_lst));
         priv = NM_CLIENT_GET_PRIVATE(self);
         c_list_link_tail(&priv->obj_changed_lst_head, &dbobj->obj_changed_lst);
     } else {
         /* The object has changes flags and must be linked already. Note that
-		 * this may be priv->obj_changed_lst_head, or a temporary list on the
-		 * stack.
-		 *
-		 * This dance with the temporary list is done to ensure we can enqueue
-		 * objects while we process the changes. */
+         * this may be priv->obj_changed_lst_head, or a temporary list on the
+         * stack.
+         *
+         * This dance with the temporary list is done to ensure we can enqueue
+         * objects while we process the changes. */
         nm_assert(!c_list_is_empty(&dbobj->obj_changed_lst));
     }
 
@@ -1558,9 +1558,9 @@ _dbobjs_obj_watcher_register_o(NMClient *               self,
     obj_watcher->_priv.notify_fcn = notify_fcn;
 
     /* we must enqueue the item in the front of the list. That is, because while
-	 * invoking notify_fcn(), we iterate the watchers front-to-end. As we want to
-	 * allow the callee to register new watches and unregister itself, this is
-	 * the right way to do it. */
+     * invoking notify_fcn(), we iterate the watchers front-to-end. As we want to
+     * allow the callee to register new watches and unregister itself, this is
+     * the right way to do it. */
     c_list_link_front(&dbobj->watcher_lst_head, &obj_watcher->_priv.watcher_lst);
 
     return obj_watcher;
@@ -2171,16 +2171,16 @@ nml_dbus_property_ao_notify(NMClient *              self,
 
             if (pr_ao_data) {
                 /* With this implementation we cannot track the same path multiple times.
-				 * Of course, for none of the properties where we use this, the server
-				 * should expose the same path more than once, so this limitation is fine
-				 * (maybe even preferable to drop duplicates form NMClient's API). */
+                 * Of course, for none of the properties where we use this, the server
+                 * should expose the same path more than once, so this limitation is fine
+                 * (maybe even preferable to drop duplicates form NMClient's API). */
                 nm_assert(pr_ao_data->obj_watcher.dbobj->dbus_path == dbus_path_r);
                 if (!changed_prop && pr_ao_data->is_notified) {
                     /* The order of a notified entry changed. That means, we need to signal
-					 * a change of the property. This detection of a change is not always
-					 * correct, in particular we might detect some changes when there were
-					 * none. That's not a serious problem, and fixing it would be expensive
-					 * to implement. */
+                     * a change of the property. This detection of a change is not always
+                     * correct, in particular we might detect some changes when there were
+                     * none. That's not a serious problem, and fixing it would be expensive
+                     * to implement. */
                     changed_prop = (c_list_first(&stale_lst_head) != &pr_ao_data->data_lst);
                 }
                 nm_c_list_move_tail(&pr_ao->data_lst_head, &pr_ao_data->data_lst);
@@ -2588,9 +2588,9 @@ _obj_handle_dbus_iface_changes(NMClient *           self,
 
     if (!type_compatible) {
         /* on D-Bus, we have this interface associate with the object, but apparently
-		 * it is not compatible. This is either a bug, or NetworkManager exposed an
-		 * unexpected interface on D-Bus object for which we create a certain NMObject
-		 * type. */
+         * it is not compatible. This is either a bug, or NetworkManager exposed an
+         * unexpected interface on D-Bus object for which we create a certain NMObject
+         * type. */
         return;
     }
 
@@ -2619,12 +2619,12 @@ _obj_handle_dbus_iface_changes(NMClient *           self,
             nm_assert(db_prop_data->prop_data_value);
 
             /* Currently, NMLDBusObject forgets about the variant. Theoretically, it could cache
-			 * it, but there is no need because we update the property in nmobj (which extracts and
-			 * keeps the property value itself).
-			 *
-			 * Note that we only consume the variant here when we process it.
-			 * That implies that we already created a NMObject for the dbobj
-			 * instance. Unless that happens, we cache the last seen property values. */
+             * it, but there is no need because we update the property in nmobj (which extracts and
+             * keeps the property value itself).
+             *
+             * Note that we only consume the variant here when we process it.
+             * That implies that we already created a NMObject for the dbobj
+             * instance. Unless that happens, we cache the last seen property values. */
             prop_data_value = g_steal_pointer(&db_prop_data->prop_data_value);
 
             i_prop = (db_prop_data - &db_iface_data->prop_datas[0]);
@@ -2644,14 +2644,14 @@ _obj_handle_dbus_changes(NMClient *self, NMLDBusObject *dbobj)
     _ASSERT_dbobj(dbobj, self);
 
     /* In a first step we only remember all the changes that a D-Bus message brings
-	 * and queue the object to process them.
-	 *
-	 * Here (in step 2) we look at what changed on D-Bus and propagate those changes
-	 * to the NMObject instance.
-	 *
-	 * Note that here we still must not emit any GObject signals. That follows later,
-	 * and again if the object changes, we will just queue that we handle the changes
-	 * later. */
+     * and queue the object to process them.
+     *
+     * Here (in step 2) we look at what changed on D-Bus and propagate those changes
+     * to the NMObject instance.
+     *
+     * Note that here we still must not emit any GObject signals. That follows later,
+     * and again if the object changes, we will just queue that we handle the changes
+     * later. */
 
     c_list_for_each_entry_safe (db_iface_data,
                                 db_iface_data_safe,
@@ -2667,15 +2667,15 @@ _obj_handle_dbus_changes(NMClient *self, NMLDBusObject *dbobj)
 
     if (G_UNLIKELY(!dbobj->nmobj) && !c_list_is_empty(&dbobj->iface_lst_head)) {
         /* Try to create a NMObject for this D-Bus object. Note that we detect the type
-		 * based on the interfaces that it has, and if we make a choice once, we don't
-		 * change. That means, one D-Bus object can only be of one type. */
+         * based on the interfaces that it has, and if we make a choice once, we don't
+         * change. That means, one D-Bus object can only be of one type. */
 
         if (NM_IN_SET(dbobj->dbus_path,
                       _dbus_path_nm,
                       _dbus_path_settings,
                       _dbus_path_dns_manager)) {
             /* For the main types, we don't detect them based on the interfaces present,
-			 * but on the path names. Of course, both should correspond anyway. */
+             * but on the path names. Of course, both should correspond anyway. */
             NML_NMCLIENT_LOG_T(self,
                                "[%s]: register NMClient for D-Bus object",
                                dbobj->dbus_path->str);
@@ -2785,9 +2785,9 @@ _dbus_handle_obj_changed_nmobj(NMClient *self)
     nm_assert(!nml_dbus_object_obj_changed_any_linked(self, ~NML_DBUS_OBJ_CHANGED_TYPE_NMOBJ));
 
     /* First we notify all watchers that these objects changed. Note that we only do that
-	 * here for the list before processing the changes below in a loop. That is, because
-	 * processing changes can again enqueue changed objects, and we only want to want to
-	 * notify watchers for the events that happened earlier (not repeatedly notify them). */
+     * here for the list before processing the changes below in a loop. That is, because
+     * processing changes can again enqueue changed objects, and we only want to want to
+     * notify watchers for the events that happened earlier (not repeatedly notify them). */
     c_list_splice(&obj_changed_tmp_lst_head, &priv->obj_changed_lst_head);
     while (
         (dbobj = c_list_first_entry(&obj_changed_tmp_lst_head, NMLDBusObject, obj_changed_lst))) {
@@ -2846,11 +2846,11 @@ _dbus_handle_obj_changed_dbus(NMClient *self, const char *log_context)
     priv = NM_CLIENT_GET_PRIVATE(self);
 
     /* We move the changed list onto a temporary list and consume that.
-	 * Note that nml_dbus_object_obj_changed_consume() will move the object
-	 * back to the original list if there are changes of another type.
-	 *
-	 * This is done so that we can enqueue more changes while processing the
-	 * change list. */
+     * Note that nml_dbus_object_obj_changed_consume() will move the object
+     * back to the original list if there are changes of another type.
+     *
+     * This is done so that we can enqueue more changes while processing the
+     * change list. */
     c_list_splice(&obj_changed_tmp_lst_head, &priv->obj_changed_lst_head);
 
     while (
@@ -2879,7 +2879,7 @@ _dbus_handle_obj_changed_dbus(NMClient *self, const char *log_context)
     }
 
     /* D-Bus changes can only be enqueued in an earlier stage. We don't expect
-	 * anymore changes of type D-Bus at this point. */
+     * anymore changes of type D-Bus at this point. */
     nm_assert(!nml_dbus_object_obj_changed_any_linked(self, NML_DBUS_OBJ_CHANGED_TYPE_DBUS));
 }
 
@@ -3247,7 +3247,7 @@ _dbus_get_managed_objects_cb(GObject *source, GAsyncResult *result, gpointer use
     if (!managed_objects) {
         NML_NMCLIENT_LOG_D(self, "GetManagedObjects() call failed: %s", error->message);
         /* hm, now that's odd. Maybe NetworkManager just quit and we are about to get
-		 * a name-owner changed signal soon. Treat this as if we got no managed objects at all. */
+         * a name-owner changed signal soon. Treat this as if we got no managed objects at all. */
     } else
         NML_NMCLIENT_LOG_D(self, "GetManagedObjects() completed");
 
@@ -3265,7 +3265,7 @@ _dbus_get_managed_objects_cb(GObject *source, GAsyncResult *result, gpointer use
     }
 
     /* always call _dbus_handle_changes(), even if nothing changed. We need this to complete
-	 * initialization. */
+     * initialization. */
     _dbus_handle_changes(self, "get-managed-objects", TRUE);
 }
 
@@ -3524,7 +3524,7 @@ _dbus_check_permissions_start_cb(GObject *source, GAsyncResult *result, gpointer
 
     if (!ret) {
         /* when the call completes, we always pretend success. Even a failure means
-		 * that we fetched the permissions, however they are all unknown. */
+         * that we fetched the permissions, however they are all unknown. */
         NML_NMCLIENT_LOG_T(self, "GetPermissions call failed: %s", error->message);
         goto out;
     }
@@ -3895,7 +3895,7 @@ _request_wait_start(GTask *     task_take,
                                    NULL);
         if (id == 0) {
             /* the callback was invoked synchronously, which destroyed @request_data.
-			 * We must not touch @info anymore. */
+             * We must not touch @info anymore. */
         } else
             request_data->cancellable_id = id;
     }
@@ -4578,10 +4578,10 @@ nm_client_check_connectivity(NMClient *client, GCancellable *cancellable, GError
     g_variant_get(ret, "(u)", &connectivity);
 
     /* upon receiving the synchronous response, we hack the NMClient state
-	 * and update the property outside the ordered D-Bus messages (like
-	 * "PropertiesChanged" signals).
-	 *
-	 * This is really ugly, we shouldn't do this. */
+     * and update the property outside the ordered D-Bus messages (like
+     * "PropertiesChanged" signals).
+     *
+     * This is really ugly, we shouldn't do this. */
 
     priv = NM_CLIENT_GET_PRIVATE(client);
 
@@ -5636,9 +5636,9 @@ _add_connection_call(NMClient *                    self,
         settings = g_variant_new_array(G_VARIANT_TYPE("{sa{sv}}"), NULL, 0);
 
     /* Although AddConnection2() being capable to handle also AddConnection() and
-	 * AddConnectionUnsaved() variants, we prefer to use the old D-Bus methods when
-	 * they are sufficient. The reason is that libnm should avoid hard dependencies
-	 * on 1.20 API whenever possible. */
+     * AddConnectionUnsaved() variants, we prefer to use the old D-Bus methods when
+     * they are sufficient. The reason is that libnm should avoid hard dependencies
+     * on 1.20 API whenever possible. */
     if (ignore_out_result && flags == NM_SETTINGS_ADD_CONNECTION2_FLAG_TO_DISK) {
         _nm_client_dbus_call(self,
                              self,
@@ -6974,8 +6974,8 @@ _init_release_all(NMClient *self)
     _dbus_handle_changes(self, "release-all", FALSE);
 
     /* We require that when we remove all D-Bus interfaces, that all object will go
-	 * away. Note that a NMLDBusObject can be alive due to a NMLDBusObjWatcher, but
-	 * even those should be all cleaned up. */
+     * away. Note that a NMLDBusObject can be alive due to a NMLDBusObjWatcher, but
+     * even those should be all cleaned up. */
     nm_assert(c_list_is_empty(&priv->obj_changed_lst_head));
     nm_assert(c_list_is_empty(&priv->dbus_objects_lst_head_watched_only));
     nm_assert(c_list_is_empty(&priv->dbus_objects_lst_head_on_dbus));
@@ -7007,9 +7007,9 @@ name_owner_changed(NMClient *self, const char *name_owner)
         nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->name_owner_changed_id);
 
         /* Our instance was initialized synchronously. Usually we must henceforth
-		 * stick to a internal main context. But now we have no name-owner...
-		 * at this point, we anyway are going to do a full resync. Swap the main
-		 * contexts again. */
+         * stick to a internal main context. But now we have no name-owner...
+         * at this point, we anyway are going to do a full resync. Swap the main
+         * contexts again. */
 
         old_context_busy_watcher   = g_steal_pointer(&priv->context_busy_watcher);
         priv->context_busy_watcher = g_object_ref(
@@ -7165,32 +7165,32 @@ nml_cleanup_context_busy_watcher_on_idle(GObject *context_busy_watcher_take, GMa
     nm_assert(context);
 
     /* Technically, we cancelled all pending actions (and these actions
-	 * (GTask) keep the context_busy_watcher object alive). Also, we passed
-	 * no destroy notify to g_dbus_connection_signal_subscribe().
-	 * That means, there should be no other unaccounted GSource'es left.
-	 *
-	 * However, we really need to be sure that the context_busy_watcher's
-	 * lifetime matches the time that the context is busy. That is especially
-	 * important with synchronous initialization, where the context-busy-watcher
-	 * keeps the inner GMainContext integrated in the caller's.
-	 * We must not g_source_destroy() that integration too early.
-	 *
-	 * So to be really sure all this is given, always schedule one last
-	 * cleanup idle action with low priority. This should be the last
-	 * thing related to this instance that keeps the context busy.
-	 *
-	 * Note that we could also *not* take a reference on @context
-	 * and unref @context_busy_watcher via the GDestroyNotify. That would
-	 * allow for the context to be wrapped up early, and when the last user
-	 * gives up the reference to the context, the destroy notify could complete
-	 * without even invoke the idle handler. However, that destroy notify may
-	 * not be called in the right thread. So, we want to be sure that we unref
-	 * the context-busy-watcher in the right context. Hence, we always take an
-	 * additional reference and always cleanup in the idle handler. This means:
-	 * the user *MUST* always keep iterating the context after NMClient got destroyed.
-	 * But that is not a severe limitation, because the user anyway must be prepared
-	 * to do that. That is because in many cases it is necessary anyway (and the user
-	 * wouldn't know a priory when not). This way, it is just always necessary. */
+     * (GTask) keep the context_busy_watcher object alive). Also, we passed
+     * no destroy notify to g_dbus_connection_signal_subscribe().
+     * That means, there should be no other unaccounted GSource'es left.
+     *
+     * However, we really need to be sure that the context_busy_watcher's
+     * lifetime matches the time that the context is busy. That is especially
+     * important with synchronous initialization, where the context-busy-watcher
+     * keeps the inner GMainContext integrated in the caller's.
+     * We must not g_source_destroy() that integration too early.
+     *
+     * So to be really sure all this is given, always schedule one last
+     * cleanup idle action with low priority. This should be the last
+     * thing related to this instance that keeps the context busy.
+     *
+     * Note that we could also *not* take a reference on @context
+     * and unref @context_busy_watcher via the GDestroyNotify. That would
+     * allow for the context to be wrapped up early, and when the last user
+     * gives up the reference to the context, the destroy notify could complete
+     * without even invoke the idle handler. However, that destroy notify may
+     * not be called in the right thread. So, we want to be sure that we unref
+     * the context-busy-watcher in the right context. Hence, we always take an
+     * additional reference and always cleanup in the idle handler. This means:
+     * the user *MUST* always keep iterating the context after NMClient got destroyed.
+     * But that is not a severe limitation, because the user anyway must be prepared
+     * to do that. That is because in many cases it is necessary anyway (and the user
+     * wouldn't know a priory when not). This way, it is just always necessary. */
 
     cleanup_source =
         nm_g_idle_source_new(G_PRIORITY_LOW + 10,
@@ -7511,7 +7511,7 @@ set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *ps
             NMClientInstanceFlags flags = v_uint;
 
             /* After object construction, we only allow to toggle certain flags and
-			 * ignore all other flags. */
+             * ignore all other flags. */
 
             if ((priv->instance_flags ^ flags)
                 & NM_CLIENT_INSTANCE_FLAGS_NO_AUTO_FETCH_PERMISSIONS) {
@@ -7587,36 +7587,36 @@ init_sync(GInitable *initable, GCancellable *cancellable, GError **error)
     g_return_val_if_fail(!priv->dbus_context, FALSE);
 
     /* when using init_sync(), we use a separate internal GMainContext for
-	 * all D-Bus operations and use our regular async-init code. That means,
-	 * also in sync-init, we don't actually block waiting for our D-Bus requests,
-	 * instead, we only block (g_main_loop_run()) for the overall result.
-	 *
-	 * Doing this has a performance overhead. Also, we cannot ever fall back
-	 * to the regular main-context (not unless we lose the main-owner and
-	 * need to re-initialize). The reason is that we receive events on our
-	 * dbus_context, and this cannot be brought in sync -- short of full
-	 * reinitalizing. Therefor, using sync init not only is slower during
-	 * construction of the object, but NMClient will stick to the dual GMainContext
-	 * mode.
-	 *
-	 * Aside from this downside, the solution is good:
-	 *
-	 * - we don't duplicate the implementation of async-init.
-	 * - we don't iterate the main-context of the caller while waiting for
-	 *   initialization to happen
-	 * - we still invoke all changes under the main_context of the caller.
-	 * - all D-Bus events strictly go through dbus_context and are in order.
-	 */
+     * all D-Bus operations and use our regular async-init code. That means,
+     * also in sync-init, we don't actually block waiting for our D-Bus requests,
+     * instead, we only block (g_main_loop_run()) for the overall result.
+     *
+     * Doing this has a performance overhead. Also, we cannot ever fall back
+     * to the regular main-context (not unless we lose the main-owner and
+     * need to re-initialize). The reason is that we receive events on our
+     * dbus_context, and this cannot be brought in sync -- short of full
+     * reinitalizing. Therefor, using sync init not only is slower during
+     * construction of the object, but NMClient will stick to the dual GMainContext
+     * mode.
+     *
+     * Aside from this downside, the solution is good:
+     *
+     * - we don't duplicate the implementation of async-init.
+     * - we don't iterate the main-context of the caller while waiting for
+     *   initialization to happen
+     * - we still invoke all changes under the main_context of the caller.
+     * - all D-Bus events strictly go through dbus_context and are in order.
+     */
 
     dbus_context       = g_main_context_new();
     priv->dbus_context = g_main_context_ref(dbus_context);
 
     /* We have an inner context. Note that if we loose the name owner, we have a chance
-	 * to resync and drop the inner context. That means, requests made against the inner
-	 * context have a different lifetime. Hence, we create a separate tracking
-	 * object. This "wraps" the outer context-busy-watcher and references it, so
-	 * that the work together. Grep for nm_context_busy_watcher_quark() to
-	 * see how this works. */
+     * to resync and drop the inner context. That means, requests made against the inner
+     * context have a different lifetime. Hence, we create a separate tracking
+     * object. This "wraps" the outer context-busy-watcher and references it, so
+     * that the work together. Grep for nm_context_busy_watcher_quark() to
+     * see how this works. */
     parent_context_busy_watcher = g_steal_pointer(&priv->context_busy_watcher);
     priv->context_busy_watcher  = g_object_new(G_TYPE_OBJECT, NULL);
     g_object_set_qdata_full(priv->context_busy_watcher,
@@ -8013,15 +8013,15 @@ nm_client_class_init(NMClientClass *client_class)
     object_class->dispose      = dispose;
 
     /**
-	 * NMClient:dbus-connection:
-	 *
-	 * The #GDBusConnection to use.
-	 *
-	 * If this is not set during object construction, the D-Bus connection will
-	 * automatically be chosen during async/sync initalization via g_bus_get().
-	 *
-	 * Since: 1.22
-	 */
+     * NMClient:dbus-connection:
+     *
+     * The #GDBusConnection to use.
+     *
+     * If this is not set during object construction, the D-Bus connection will
+     * automatically be chosen during async/sync initalization via g_bus_get().
+     *
+     * Since: 1.22
+     */
     obj_properties[PROP_DBUS_CONNECTION] = g_param_spec_object(
         NM_CLIENT_DBUS_CONNECTION,
         "",
@@ -8030,19 +8030,19 @@ nm_client_class_init(NMClientClass *client_class)
         G_PARAM_READABLE | G_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:instance-flags:
-	 *
-	 * #NMClientInstanceFlags for the instance. These affect behavior of #NMClient.
-	 * This is a construct property and you may only set most flags only during
-	 * construction.
-	 *
-	 * The flag %NM_CLIENT_INSTANCE_FLAGS_NO_AUTO_FETCH_PERMISSIONS can be toggled any time,
-	 * even after constructing the instance. Note that you may want to watch NMClient:permissions-state
-	 * property to know whether permissions are ready. Note that permissions are only fetched
-	 * when NMClient has a D-Bus name owner.
-	 *
-	 * Since: 1.24
-	 */
+     * NMClient:instance-flags:
+     *
+     * #NMClientInstanceFlags for the instance. These affect behavior of #NMClient.
+     * This is a construct property and you may only set most flags only during
+     * construction.
+     *
+     * The flag %NM_CLIENT_INSTANCE_FLAGS_NO_AUTO_FETCH_PERMISSIONS can be toggled any time,
+     * even after constructing the instance. Note that you may want to watch NMClient:permissions-state
+     * property to know whether permissions are ready. Note that permissions are only fetched
+     * when NMClient has a D-Bus name owner.
+     *
+     * Since: 1.24
+     */
     obj_properties[PROP_INSTANCE_FLAGS] = g_param_spec_uint(
         NM_CLIENT_INSTANCE_FLAGS,
         "",
@@ -8053,12 +8053,12 @@ nm_client_class_init(NMClientClass *client_class)
         G_PARAM_READABLE | G_PARAM_WRITABLE | G_PARAM_CONSTRUCT | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:dbus-name-owner:
-	 *
-	 * The name owner of the NetworkManager D-Bus service.
-	 *
-	 * Since: 1.22
-	 **/
+     * NMClient:dbus-name-owner:
+     *
+     * The name owner of the NetworkManager D-Bus service.
+     *
+     * Since: 1.22
+     **/
     obj_properties[PROP_DBUS_NAME_OWNER] =
         g_param_spec_string(NM_CLIENT_DBUS_NAME_OWNER,
                             "",
@@ -8067,10 +8067,10 @@ nm_client_class_init(NMClientClass *client_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:version:
-	 *
-	 * The NetworkManager version.
-	 **/
+     * NMClient:version:
+     *
+     * The NetworkManager version.
+     **/
     obj_properties[PROP_VERSION] = g_param_spec_string(NM_CLIENT_VERSION,
                                                        "",
                                                        "",
@@ -8078,10 +8078,10 @@ nm_client_class_init(NMClientClass *client_class)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:state:
-	 *
-	 * The current daemon state.
-	 **/
+     * NMClient:state:
+     *
+     * The current daemon state.
+     **/
     obj_properties[PROP_STATE] = g_param_spec_enum(NM_CLIENT_STATE,
                                                    "",
                                                    "",
@@ -8090,10 +8090,10 @@ nm_client_class_init(NMClientClass *client_class)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:startup:
-	 *
-	 * Whether the daemon is still starting up.
-	 **/
+     * NMClient:startup:
+     *
+     * Whether the daemon is still starting up.
+     **/
     obj_properties[PROP_STARTUP] = g_param_spec_boolean(NM_CLIENT_STARTUP,
                                                         "",
                                                         "",
@@ -8101,10 +8101,10 @@ nm_client_class_init(NMClientClass *client_class)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:nm-running:
-	 *
-	 * Whether the daemon is running.
-	 **/
+     * NMClient:nm-running:
+     *
+     * Whether the daemon is running.
+     **/
     obj_properties[PROP_NM_RUNNING] =
         g_param_spec_boolean(NM_CLIENT_NM_RUNNING,
                              "",
@@ -8113,12 +8113,12 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:networking-enabled:
-	 *
-	 * Whether networking is enabled.
-	 *
-	 * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
-	 */
+     * NMClient:networking-enabled:
+     *
+     * Whether networking is enabled.
+     *
+     * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
+     */
     obj_properties[PROP_NETWORKING_ENABLED] =
         g_param_spec_boolean(NM_CLIENT_NETWORKING_ENABLED,
                              "",
@@ -8127,12 +8127,12 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:wireless-enabled:
-	 *
-	 * Whether wireless is enabled.
-	 *
-	 * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
-	 **/
+     * NMClient:wireless-enabled:
+     *
+     * Whether wireless is enabled.
+     *
+     * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
+     **/
     obj_properties[PROP_WIRELESS_ENABLED] =
         g_param_spec_boolean(NM_CLIENT_WIRELESS_ENABLED,
                              "",
@@ -8141,10 +8141,10 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:wireless-hardware-enabled:
-	 *
-	 * Whether the wireless hardware is enabled.
-	 **/
+     * NMClient:wireless-hardware-enabled:
+     *
+     * Whether the wireless hardware is enabled.
+     **/
     obj_properties[PROP_WIRELESS_HARDWARE_ENABLED] =
         g_param_spec_boolean(NM_CLIENT_WIRELESS_HARDWARE_ENABLED,
                              "",
@@ -8153,12 +8153,12 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:wwan-enabled:
-	 *
-	 * Whether WWAN functionality is enabled.
-	 *
-	 * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
-	 */
+     * NMClient:wwan-enabled:
+     *
+     * Whether WWAN functionality is enabled.
+     *
+     * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
+     */
     obj_properties[PROP_WWAN_ENABLED] =
         g_param_spec_boolean(NM_CLIENT_WWAN_ENABLED,
                              "",
@@ -8167,10 +8167,10 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:wwan-hardware-enabled:
-	 *
-	 * Whether the WWAN hardware is enabled.
-	 **/
+     * NMClient:wwan-hardware-enabled:
+     *
+     * Whether the WWAN hardware is enabled.
+     **/
     obj_properties[PROP_WWAN_HARDWARE_ENABLED] =
         g_param_spec_boolean(NM_CLIENT_WWAN_HARDWARE_ENABLED,
                              "",
@@ -8179,12 +8179,12 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:wimax-enabled:
-	 *
-	 * Whether WiMAX functionality is enabled.
-	 *
-	 * Deprecated: 1.22: WiMAX is no longer supported and this always returns FALSE. The setter has no effect.
-	 */
+     * NMClient:wimax-enabled:
+     *
+     * Whether WiMAX functionality is enabled.
+     *
+     * Deprecated: 1.22: WiMAX is no longer supported and this always returns FALSE. The setter has no effect.
+     */
     obj_properties[PROP_WIMAX_ENABLED] =
         g_param_spec_boolean(NM_CLIENT_WIMAX_ENABLED,
                              "",
@@ -8193,12 +8193,12 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:wimax-hardware-enabled:
-	 *
-	 * Whether the WiMAX hardware is enabled.
-	 *
-	 * Deprecated: 1.22: WiMAX is no longer supported and this always returns FALSE.
-	 **/
+     * NMClient:wimax-hardware-enabled:
+     *
+     * Whether the WiMAX hardware is enabled.
+     *
+     * Deprecated: 1.22: WiMAX is no longer supported and this always returns FALSE.
+     **/
     obj_properties[PROP_WIMAX_HARDWARE_ENABLED] =
         g_param_spec_boolean(NM_CLIENT_WIMAX_HARDWARE_ENABLED,
                              "",
@@ -8207,10 +8207,10 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:active-connections: (type GPtrArray(NMActiveConnection))
-	 *
-	 * The active connections.
-	 **/
+     * NMClient:active-connections: (type GPtrArray(NMActiveConnection))
+     *
+     * The active connections.
+     **/
     obj_properties[PROP_ACTIVE_CONNECTIONS] =
         g_param_spec_boxed(NM_CLIENT_ACTIVE_CONNECTIONS,
                            "",
@@ -8219,10 +8219,10 @@ nm_client_class_init(NMClientClass *client_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:connectivity:
-	 *
-	 * The network connectivity state.
-	 */
+     * NMClient:connectivity:
+     *
+     * The network connectivity state.
+     */
     obj_properties[PROP_CONNECTIVITY] =
         g_param_spec_enum(NM_CLIENT_CONNECTIVITY,
                           "",
@@ -8232,12 +8232,12 @@ nm_client_class_init(NMClientClass *client_class)
                           G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient::connectivity-check-available
-	 *
-	 * Whether a connectivity checking service has been configured.
-	 *
-	 * Since: 1.10
-	 */
+     * NMClient::connectivity-check-available
+     *
+     * Whether a connectivity checking service has been configured.
+     *
+     * Since: 1.10
+     */
     obj_properties[PROP_CONNECTIVITY_CHECK_AVAILABLE] =
         g_param_spec_boolean(NM_CLIENT_CONNECTIVITY_CHECK_AVAILABLE,
                              "",
@@ -8246,14 +8246,14 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient::connectivity-check-enabled
-	 *
-	 * Whether a connectivity checking service has been enabled.
-	 *
-	 * Since: 1.10
-	 *
-	 * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
-	 */
+     * NMClient::connectivity-check-enabled
+     *
+     * Whether a connectivity checking service has been enabled.
+     *
+     * Since: 1.10
+     *
+     * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
+     */
     obj_properties[PROP_CONNECTIVITY_CHECK_ENABLED] =
         g_param_spec_boolean(NM_CLIENT_CONNECTIVITY_CHECK_ENABLED,
                              "",
@@ -8262,12 +8262,12 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:connectivity-check-uri:
-	 *
-	 * The used URI for connectivity checking.
-	 *
-	 * Since: 1.22
-	 **/
+     * NMClient:connectivity-check-uri:
+     *
+     * The used URI for connectivity checking.
+     *
+     * Since: 1.22
+     **/
     obj_properties[PROP_CONNECTIVITY_CHECK_URI] =
         g_param_spec_string(NM_CLIENT_CONNECTIVITY_CHECK_URI,
                             "",
@@ -8276,11 +8276,11 @@ nm_client_class_init(NMClientClass *client_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:primary-connection:
-	 *
-	 * The #NMActiveConnection of the device with the default route;
-	 * see nm_client_get_primary_connection() for more details.
-	 **/
+     * NMClient:primary-connection:
+     *
+     * The #NMActiveConnection of the device with the default route;
+     * see nm_client_get_primary_connection() for more details.
+     **/
     obj_properties[PROP_PRIMARY_CONNECTION] =
         g_param_spec_object(NM_CLIENT_PRIMARY_CONNECTION,
                             "",
@@ -8289,11 +8289,11 @@ nm_client_class_init(NMClientClass *client_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:activating-connection:
-	 *
-	 * The #NMActiveConnection of the activating connection that is
-	 * likely to become the new #NMClient:primary-connection.
-	 **/
+     * NMClient:activating-connection:
+     *
+     * The #NMActiveConnection of the activating connection that is
+     * likely to become the new #NMClient:primary-connection.
+     **/
     obj_properties[PROP_ACTIVATING_CONNECTION] =
         g_param_spec_object(NM_CLIENT_ACTIVATING_CONNECTION,
                             "",
@@ -8302,10 +8302,10 @@ nm_client_class_init(NMClientClass *client_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:devices: (type GPtrArray(NMDevice))
-	 *
-	 * List of real network devices.  Does not include placeholder devices.
-	 **/
+     * NMClient:devices: (type GPtrArray(NMDevice))
+     *
+     * List of real network devices.  Does not include placeholder devices.
+     **/
     obj_properties[PROP_DEVICES] = g_param_spec_boxed(NM_CLIENT_DEVICES,
                                                       "",
                                                       "",
@@ -8313,11 +8313,11 @@ nm_client_class_init(NMClientClass *client_class)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:all-devices: (type GPtrArray(NMDevice))
-	 *
-	 * List of both real devices and device placeholders.
-	 * Since: 1.2
-	 **/
+     * NMClient:all-devices: (type GPtrArray(NMDevice))
+     *
+     * List of both real devices and device placeholders.
+     * Since: 1.2
+     **/
     obj_properties[PROP_ALL_DEVICES] =
         g_param_spec_boxed(NM_CLIENT_ALL_DEVICES,
                            "",
@@ -8326,13 +8326,13 @@ nm_client_class_init(NMClientClass *client_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:connections: (type GPtrArray(NMRemoteConnection))
-	 *
-	 * The list of configured connections that are available to the user. (Note
-	 * that this differs from the underlying D-Bus property, which may also
-	 * contain the object paths of connections that the user does not have
-	 * permission to read the details of.)
-	 */
+     * NMClient:connections: (type GPtrArray(NMRemoteConnection))
+     *
+     * The list of configured connections that are available to the user. (Note
+     * that this differs from the underlying D-Bus property, which may also
+     * contain the object paths of connections that the user does not have
+     * permission to read the details of.)
+     */
     obj_properties[PROP_CONNECTIONS] =
         g_param_spec_boxed(NM_CLIENT_CONNECTIONS,
                            "",
@@ -8341,11 +8341,11 @@ nm_client_class_init(NMClientClass *client_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:hostname:
-	 *
-	 * The machine hostname stored in persistent configuration. This can be
-	 * modified by calling nm_client_save_hostname().
-	 */
+     * NMClient:hostname:
+     *
+     * The machine hostname stored in persistent configuration. This can be
+     * modified by calling nm_client_save_hostname().
+     */
     obj_properties[PROP_HOSTNAME] = g_param_spec_string(NM_CLIENT_HOSTNAME,
                                                         "",
                                                         "",
@@ -8353,10 +8353,10 @@ nm_client_class_init(NMClientClass *client_class)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:can-modify:
-	 *
-	 * If %TRUE, adding and modifying connections is supported.
-	 */
+     * NMClient:can-modify:
+     *
+     * If %TRUE, adding and modifying connections is supported.
+     */
     obj_properties[PROP_CAN_MODIFY] =
         g_param_spec_boolean(NM_CLIENT_CAN_MODIFY,
                              "",
@@ -8365,12 +8365,12 @@ nm_client_class_init(NMClientClass *client_class)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:metered:
-	 *
-	 * Whether the connectivity is metered.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMClient:metered:
+     *
+     * Whether the connectivity is metered.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_METERED] = g_param_spec_uint(NM_CLIENT_METERED,
                                                      "",
                                                      "",
@@ -8380,12 +8380,12 @@ nm_client_class_init(NMClientClass *client_class)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:dns-mode:
-	 *
-	 * The current DNS processing mode.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMClient:dns-mode:
+     *
+     * The current DNS processing mode.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_DNS_MODE] = g_param_spec_string(NM_CLIENT_DNS_MODE,
                                                         "",
                                                         "",
@@ -8393,12 +8393,12 @@ nm_client_class_init(NMClientClass *client_class)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:dns-rc-manager:
-	 *
-	 * The current resolv.conf management mode.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMClient:dns-rc-manager:
+     *
+     * The current resolv.conf management mode.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_DNS_RC_MANAGER] =
         g_param_spec_string(NM_CLIENT_DNS_RC_MANAGER,
                             "",
@@ -8407,13 +8407,13 @@ nm_client_class_init(NMClientClass *client_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:dns-configuration: (type GPtrArray(NMDnsEntry))
-	 *
-	 * The current DNS configuration, represented as an array
-	 * of #NMDnsEntry objects.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMClient:dns-configuration: (type GPtrArray(NMDnsEntry))
+     *
+     * The current DNS configuration, represented as an array
+     * of #NMDnsEntry objects.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_DNS_CONFIGURATION] =
         g_param_spec_boxed(NM_CLIENT_DNS_CONFIGURATION,
                            "",
@@ -8422,12 +8422,12 @@ nm_client_class_init(NMClientClass *client_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:checkpoints: (type GPtrArray(NMCheckpoint))
-	 *
-	 * The list of active checkpoints.
-	 *
-	 * Since: 1.12
-	 */
+     * NMClient:checkpoints: (type GPtrArray(NMCheckpoint))
+     *
+     * The list of active checkpoints.
+     *
+     * Since: 1.12
+     */
     obj_properties[PROP_CHECKPOINTS] =
         g_param_spec_boxed(NM_CLIENT_CHECKPOINTS,
                            "",
@@ -8436,14 +8436,14 @@ nm_client_class_init(NMClientClass *client_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:capabilities: (type GArray(guint32))
-	 *
-	 * The list of capabilities numbers as guint32 or %NULL if
-	 * there are no capabilities. The numeric value correspond
-	 * to %NMCapability enum.
-	 *
-	 * Since: 1.24
-	 */
+     * NMClient:capabilities: (type GArray(guint32))
+     *
+     * The list of capabilities numbers as guint32 or %NULL if
+     * there are no capabilities. The numeric value correspond
+     * to %NMCapability enum.
+     *
+     * Since: 1.24
+     */
     obj_properties[PROP_CAPABILITIES] =
         g_param_spec_boxed(NM_CLIENT_CAPABILITIES,
                            "",
@@ -8452,24 +8452,24 @@ nm_client_class_init(NMClientClass *client_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMClient:permissions-state:
-	 *
-	 * The state of the cached permissions. The value %NM_TERNARY_DEFAULT
-	 * means that no permissions are yet received (or not yet requested).
-	 * %NM_TERNARY_TRUE means that permissions are received, cached and up
-	 * to date. %NM_TERNARY_FALSE means that permissions were received and are
-	 * cached, but in the meantime a "CheckPermissions" signal was received
-	 * that invalidated the cached permissions.
-	 * Note that NMClient will always emit a notify::permissions-state signal
-	 * when a "CheckPermissions" signal got received or after new permissions
-	 * got received (that is regardless whether the value of the permission state
-	 * actually changed). With this you can watch the permissions-state property
-	 * to know whether the permissions are ready. Note that while NMClient has
-	 * no D-Bus name owner, no permissions are fetched (and this property won't
-	 * change).
-	 *
-	 * Since: 1.24
-	 */
+     * NMClient:permissions-state:
+     *
+     * The state of the cached permissions. The value %NM_TERNARY_DEFAULT
+     * means that no permissions are yet received (or not yet requested).
+     * %NM_TERNARY_TRUE means that permissions are received, cached and up
+     * to date. %NM_TERNARY_FALSE means that permissions were received and are
+     * cached, but in the meantime a "CheckPermissions" signal was received
+     * that invalidated the cached permissions.
+     * Note that NMClient will always emit a notify::permissions-state signal
+     * when a "CheckPermissions" signal got received or after new permissions
+     * got received (that is regardless whether the value of the permission state
+     * actually changed). With this you can watch the permissions-state property
+     * to know whether the permissions are ready. Note that while NMClient has
+     * no D-Bus name owner, no permissions are fetched (and this property won't
+     * change).
+     *
+     * Since: 1.24
+     */
     obj_properties[PROP_PERMISSIONS_STATE] =
         g_param_spec_enum(NM_CLIENT_PERMISSIONS_STATE,
                           "",
@@ -8484,13 +8484,13 @@ nm_client_class_init(NMClientClass *client_class)
                                               &_nml_dbus_meta_iface_nm_dnsmanager);
 
     /**
-	 * NMClient::device-added:
-	 * @client: the client that received the signal
-	 * @device: (type NMDevice): the new device
-	 *
-	 * Notifies that a #NMDevice is added.  This signal is not emitted for
-	 * placeholder devices.
-	 **/
+     * NMClient::device-added:
+     * @client: the client that received the signal
+     * @device: (type NMDevice): the new device
+     *
+     * Notifies that a #NMDevice is added.  This signal is not emitted for
+     * placeholder devices.
+     **/
     signals[DEVICE_ADDED] = g_signal_new(NM_CLIENT_DEVICE_ADDED,
                                          G_OBJECT_CLASS_TYPE(object_class),
                                          G_SIGNAL_RUN_FIRST,
@@ -8503,13 +8503,13 @@ nm_client_class_init(NMClientClass *client_class)
                                          G_TYPE_OBJECT);
 
     /**
-	 * NMClient::device-removed:
-	 * @client: the client that received the signal
-	 * @device: (type NMDevice): the removed device
-	 *
-	 * Notifies that a #NMDevice is removed.  This signal is not emitted for
-	 * placeholder devices.
-	 **/
+     * NMClient::device-removed:
+     * @client: the client that received the signal
+     * @device: (type NMDevice): the removed device
+     *
+     * Notifies that a #NMDevice is removed.  This signal is not emitted for
+     * placeholder devices.
+     **/
     signals[DEVICE_REMOVED] = g_signal_new(NM_CLIENT_DEVICE_REMOVED,
                                            G_OBJECT_CLASS_TYPE(object_class),
                                            G_SIGNAL_RUN_FIRST,
@@ -8522,13 +8522,13 @@ nm_client_class_init(NMClientClass *client_class)
                                            G_TYPE_OBJECT);
 
     /**
-	 * NMClient::any-device-added:
-	 * @client: the client that received the signal
-	 * @device: (type NMDevice): the new device
-	 *
-	 * Notifies that a #NMDevice is added.  This signal is emitted for both
-	 * regular devices and placeholder devices.
-	 **/
+     * NMClient::any-device-added:
+     * @client: the client that received the signal
+     * @device: (type NMDevice): the new device
+     *
+     * Notifies that a #NMDevice is added.  This signal is emitted for both
+     * regular devices and placeholder devices.
+     **/
     signals[ANY_DEVICE_ADDED] = g_signal_new(NM_CLIENT_ANY_DEVICE_ADDED,
                                              G_OBJECT_CLASS_TYPE(object_class),
                                              G_SIGNAL_RUN_FIRST,
@@ -8541,13 +8541,13 @@ nm_client_class_init(NMClientClass *client_class)
                                              G_TYPE_OBJECT);
 
     /**
-	 * NMClient::any-device-removed:
-	 * @client: the client that received the signal
-	 * @device: (type NMDevice): the removed device
-	 *
-	 * Notifies that a #NMDevice is removed.  This signal is emitted for both
-	 * regular devices and placeholder devices.
-	 **/
+     * NMClient::any-device-removed:
+     * @client: the client that received the signal
+     * @device: (type NMDevice): the removed device
+     *
+     * Notifies that a #NMDevice is removed.  This signal is emitted for both
+     * regular devices and placeholder devices.
+     **/
     signals[ANY_DEVICE_REMOVED] = g_signal_new(NM_CLIENT_ANY_DEVICE_REMOVED,
                                                G_OBJECT_CLASS_TYPE(object_class),
                                                G_SIGNAL_RUN_FIRST,
@@ -8560,13 +8560,13 @@ nm_client_class_init(NMClientClass *client_class)
                                                G_TYPE_OBJECT);
 
     /**
-	 * NMClient::permission-changed:
-	 * @client: the client that received the signal
-	 * @permission: a permission from #NMClientPermission
-	 * @result: the permission's result, one of #NMClientPermissionResult
-	 *
-	 * Notifies that a permission has changed
-	 **/
+     * NMClient::permission-changed:
+     * @client: the client that received the signal
+     * @permission: a permission from #NMClientPermission
+     * @result: the permission's result, one of #NMClientPermissionResult
+     *
+     * Notifies that a permission has changed
+     **/
     signals[PERMISSION_CHANGED] = g_signal_new(NM_CLIENT_PERMISSION_CHANGED,
                                                G_OBJECT_CLASS_TYPE(object_class),
                                                G_SIGNAL_RUN_FIRST,
@@ -8579,12 +8579,12 @@ nm_client_class_init(NMClientClass *client_class)
                                                G_TYPE_UINT,
                                                G_TYPE_UINT);
     /**
-	 * NMClient::connection-added:
-	 * @client: the settings object that received the signal
-	 * @connection: the new connection
-	 *
-	 * Notifies that a #NMConnection has been added.
-	 **/
+     * NMClient::connection-added:
+     * @client: the settings object that received the signal
+     * @connection: the new connection
+     *
+     * Notifies that a #NMConnection has been added.
+     **/
     signals[CONNECTION_ADDED] = g_signal_new(NM_CLIENT_CONNECTION_ADDED,
                                              G_OBJECT_CLASS_TYPE(object_class),
                                              G_SIGNAL_RUN_FIRST,
@@ -8597,12 +8597,12 @@ nm_client_class_init(NMClientClass *client_class)
                                              NM_TYPE_REMOTE_CONNECTION);
 
     /**
-	 * NMClient::connection-removed:
-	 * @client: the settings object that received the signal
-	 * @connection: the removed connection
-	 *
-	 * Notifies that a #NMConnection has been removed.
-	 **/
+     * NMClient::connection-removed:
+     * @client: the settings object that received the signal
+     * @connection: the removed connection
+     *
+     * Notifies that a #NMConnection has been removed.
+     **/
     signals[CONNECTION_REMOVED] = g_signal_new(NM_CLIENT_CONNECTION_REMOVED,
                                                G_OBJECT_CLASS_TYPE(object_class),
                                                G_SIGNAL_RUN_FIRST,
@@ -8615,12 +8615,12 @@ nm_client_class_init(NMClientClass *client_class)
                                                NM_TYPE_REMOTE_CONNECTION);
 
     /**
-	 * NMClient::active-connection-added:
-	 * @client: the settings object that received the signal
-	 * @active_connection: the new active connection
-	 *
-	 * Notifies that a #NMActiveConnection has been added.
-	 **/
+     * NMClient::active-connection-added:
+     * @client: the settings object that received the signal
+     * @active_connection: the new active connection
+     *
+     * Notifies that a #NMActiveConnection has been added.
+     **/
     signals[ACTIVE_CONNECTION_ADDED] = g_signal_new(NM_CLIENT_ACTIVE_CONNECTION_ADDED,
                                                     G_OBJECT_CLASS_TYPE(object_class),
                                                     G_SIGNAL_RUN_FIRST,
@@ -8633,12 +8633,12 @@ nm_client_class_init(NMClientClass *client_class)
                                                     NM_TYPE_ACTIVE_CONNECTION);
 
     /**
-	 * NMClient::active-connection-removed:
-	 * @client: the settings object that received the signal
-	 * @active_connection: the removed active connection
-	 *
-	 * Notifies that a #NMActiveConnection has been removed.
-	 **/
+     * NMClient::active-connection-removed:
+     * @client: the settings object that received the signal
+     * @active_connection: the removed active connection
+     *
+     * Notifies that a #NMActiveConnection has been removed.
+     **/
     signals[ACTIVE_CONNECTION_REMOVED] = g_signal_new(NM_CLIENT_ACTIVE_CONNECTION_REMOVED,
                                                       G_OBJECT_CLASS_TYPE(object_class),
                                                       G_SIGNAL_RUN_FIRST,
diff --git a/libnm/nm-device-6lowpan.c b/libnm/nm-device-6lowpan.c
index 517d11e7cc..aaef76420e 100644
--- a/libnm/nm-device-6lowpan.c
+++ b/libnm/nm-device-6lowpan.c
@@ -119,12 +119,12 @@ nm_device_6lowpan_class_init(NMDevice6LowpanClass *klass)
     _NM_OBJECT_CLASS_INIT_PROPERTY_O_FIELDS_1(nm_object_class, NMDevice6LowpanPrivate, parent);
 
     /**
-	 * NMDevice6Lowpan:parent:
-	 *
-	 * The devices's parent device.
-	 *
-	 * Since: 1.14
-	 **/
+     * NMDevice6Lowpan:parent:
+     *
+     * The devices's parent device.
+     *
+     * Since: 1.14
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_object(NM_DEVICE_6LOWPAN_PARENT,
                                                       "",
                                                       "",
diff --git a/libnm/nm-device-adsl.c b/libnm/nm-device-adsl.c
index 5465969f2a..e3e2d013ac 100644
--- a/libnm/nm-device-adsl.c
+++ b/libnm/nm-device-adsl.c
@@ -116,10 +116,10 @@ nm_device_adsl_class_init(NMDeviceAdslClass *adsl_class)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceAdsl:carrier:
-	 *
-	 * Whether the device has carrier.
-	 **/
+     * NMDeviceAdsl:carrier:
+     *
+     * Whether the device has carrier.
+     **/
     obj_properties[PROP_CARRIER] = g_param_spec_boolean(NM_DEVICE_ADSL_CARRIER,
                                                         "",
                                                         "",
diff --git a/libnm/nm-device-bond.c b/libnm/nm-device-bond.c
index 4f51aa2420..5295f041cb 100644
--- a/libnm/nm-device-bond.c
+++ b/libnm/nm-device-bond.c
@@ -186,10 +186,10 @@ nm_device_bond_class_init(NMDeviceBondClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceBond:carrier:
-	 *
-	 * Whether the device has carrier.
-	 **/
+     * NMDeviceBond:carrier:
+     *
+     * Whether the device has carrier.
+     **/
     obj_properties[PROP_CARRIER] = g_param_spec_boolean(NM_DEVICE_BOND_CARRIER,
                                                         "",
                                                         "",
@@ -197,10 +197,10 @@ nm_device_bond_class_init(NMDeviceBondClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceBond:slaves: (type GPtrArray(NMDevice))
-	 *
-	 * The devices enslaved to the bond device.
-	 **/
+     * NMDeviceBond:slaves: (type GPtrArray(NMDevice))
+     *
+     * The devices enslaved to the bond device.
+     **/
     obj_properties[PROP_SLAVES] = g_param_spec_boxed(NM_DEVICE_BOND_SLAVES,
                                                      "",
                                                      "",
diff --git a/libnm/nm-device-bridge.c b/libnm/nm-device-bridge.c
index 5b20f76faa..871877d516 100644
--- a/libnm/nm-device-bridge.c
+++ b/libnm/nm-device-bridge.c
@@ -179,10 +179,10 @@ nm_device_bridge_class_init(NMDeviceBridgeClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceBridge:carrier:
-	 *
-	 * Whether the device has carrier.
-	 **/
+     * NMDeviceBridge:carrier:
+     *
+     * Whether the device has carrier.
+     **/
     obj_properties[PROP_CARRIER] = g_param_spec_boolean(NM_DEVICE_BRIDGE_CARRIER,
                                                         "",
                                                         "",
@@ -190,10 +190,10 @@ nm_device_bridge_class_init(NMDeviceBridgeClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceBridge:slaves: (type GPtrArray(NMDevice))
-	 *
-	 * The devices enslaved to the bridge device.
-	 **/
+     * NMDeviceBridge:slaves: (type GPtrArray(NMDevice))
+     *
+     * The devices enslaved to the bridge device.
+     **/
     obj_properties[PROP_SLAVES] = g_param_spec_boxed(NM_DEVICE_BRIDGE_SLAVES,
                                                      "",
                                                      "",
diff --git a/libnm/nm-device-bt.c b/libnm/nm-device-bt.c
index fd89a30e47..ed4ff1eae0 100644
--- a/libnm/nm-device-bt.c
+++ b/libnm/nm-device-bt.c
@@ -243,10 +243,10 @@ nm_device_bt_class_init(NMDeviceBtClass *bt_class)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceBt:name:
-	 *
-	 * The name of the bluetooth device.
-	 **/
+     * NMDeviceBt:name:
+     *
+     * The name of the bluetooth device.
+     **/
     obj_properties[PROP_NAME] = g_param_spec_string(NM_DEVICE_BT_NAME,
                                                     "",
                                                     "",
@@ -254,10 +254,10 @@ nm_device_bt_class_init(NMDeviceBtClass *bt_class)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceBt:bt-capabilities:
-	 *
-	 * The device's bluetooth capabilities, a combination of #NMBluetoothCapabilities.
-	 **/
+     * NMDeviceBt:bt-capabilities:
+     *
+     * The device's bluetooth capabilities, a combination of #NMBluetoothCapabilities.
+     **/
     obj_properties[PROP_BT_CAPABILITIES] =
         g_param_spec_flags(NM_DEVICE_BT_CAPABILITIES,
                            "",
diff --git a/libnm/nm-device-ethernet.c b/libnm/nm-device-ethernet.c
index e337e2d497..22e28f7c22 100644
--- a/libnm/nm-device-ethernet.c
+++ b/libnm/nm-device-ethernet.c
@@ -213,7 +213,7 @@ connection_compatible(NMDevice *device, NMConnection *connection, GError **error
         s_mac     = nm_setting_wired_get_mac_address(s_wired);
         if (perm_addr) {
             /* Virtual devices will have empty permanent addr but they should not be excluded
-			 * from the MAC address check specified in the connection */
+             * from the MAC address check specified in the connection */
             if (*perm_addr == 0)
                 perm_addr = nm_device_get_hw_address(NM_DEVICE(device));
 
@@ -349,10 +349,10 @@ nm_device_ethernet_class_init(NMDeviceEthernetClass *eth_class)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceEthernet:perm-hw-address:
-	 *
-	 * The permanent hardware (MAC) address of the device.
-	 **/
+     * NMDeviceEthernet:perm-hw-address:
+     *
+     * The permanent hardware (MAC) address of the device.
+     **/
     obj_properties[PROP_PERM_HW_ADDRESS] =
         g_param_spec_string(NM_DEVICE_ETHERNET_PERMANENT_HW_ADDRESS,
                             "",
@@ -361,10 +361,10 @@ nm_device_ethernet_class_init(NMDeviceEthernetClass *eth_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceEthernet:speed:
-	 *
-	 * The speed of the device.
-	 **/
+     * NMDeviceEthernet:speed:
+     *
+     * The speed of the device.
+     **/
     obj_properties[PROP_SPEED] = g_param_spec_uint(NM_DEVICE_ETHERNET_SPEED,
                                                    "",
                                                    "",
@@ -374,10 +374,10 @@ nm_device_ethernet_class_init(NMDeviceEthernetClass *eth_class)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceEthernet:carrier:
-	 *
-	 * Whether the device has carrier.
-	 **/
+     * NMDeviceEthernet:carrier:
+     *
+     * Whether the device has carrier.
+     **/
     obj_properties[PROP_CARRIER] = g_param_spec_boolean(NM_DEVICE_ETHERNET_CARRIER,
                                                         "",
                                                         "",
@@ -385,13 +385,13 @@ nm_device_ethernet_class_init(NMDeviceEthernetClass *eth_class)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceEthernet:s390-subchannels:
-	 *
-	 * Identifies subchannels of this network device used for
-	 * communication with z/VM or s390 host.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceEthernet:s390-subchannels:
+     *
+     * Identifies subchannels of this network device used for
+     * communication with z/VM or s390 host.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_S390_SUBCHANNELS] =
         g_param_spec_boxed(NM_DEVICE_ETHERNET_S390_SUBCHANNELS,
                            "",
diff --git a/libnm/nm-device-generic.c b/libnm/nm-device-generic.c
index 4153b974c7..93b03bb093 100644
--- a/libnm/nm-device-generic.c
+++ b/libnm/nm-device-generic.c
@@ -158,11 +158,11 @@ nm_device_generic_class_init(NMDeviceGenericClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceGeneric:type-description:
-	 *
-	 * A description of the specific type of device this is, or %NULL
-	 * if not known.
-	 **/
+     * NMDeviceGeneric:type-description:
+     *
+     * A description of the specific type of device this is, or %NULL
+     * if not known.
+     **/
     obj_properties[PROP_TYPE_DESCRIPTION] =
         g_param_spec_string(NM_DEVICE_GENERIC_TYPE_DESCRIPTION,
                             "",
diff --git a/libnm/nm-device-infiniband.c b/libnm/nm-device-infiniband.c
index 3c998eccaa..050978b2a7 100644
--- a/libnm/nm-device-infiniband.c
+++ b/libnm/nm-device-infiniband.c
@@ -163,10 +163,10 @@ nm_device_infiniband_class_init(NMDeviceInfinibandClass *ib_class)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceInfiniband:carrier:
-	 *
-	 * Whether the device has carrier.
-	 **/
+     * NMDeviceInfiniband:carrier:
+     *
+     * Whether the device has carrier.
+     **/
     obj_properties[PROP_CARRIER] = g_param_spec_boolean(NM_DEVICE_INFINIBAND_CARRIER,
                                                         "",
                                                         "",
diff --git a/libnm/nm-device-ip-tunnel.c b/libnm/nm-device-ip-tunnel.c
index 40c5a69f80..a680bb0bfe 100644
--- a/libnm/nm-device-ip-tunnel.c
+++ b/libnm/nm-device-ip-tunnel.c
@@ -398,12 +398,12 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceIPTunnel:mode:
-	 *
-	 * The tunneling mode of the device.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:mode:
+     *
+     * The tunneling mode of the device.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_MODE] = g_param_spec_uint(NM_DEVICE_IP_TUNNEL_MODE,
                                                   "",
                                                   "",
@@ -413,12 +413,12 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                                                   G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:parent:
-	 *
-	 * The devices's parent device.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:parent:
+     *
+     * The devices's parent device.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_object(NM_DEVICE_IP_TUNNEL_PARENT,
                                                       "",
                                                       "",
@@ -426,12 +426,12 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:local:
-	 *
-	 * The local endpoint of the tunnel.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:local:
+     *
+     * The local endpoint of the tunnel.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_LOCAL] = g_param_spec_string(NM_DEVICE_IP_TUNNEL_LOCAL,
                                                      "",
                                                      "",
@@ -439,12 +439,12 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:remote:
-	 *
-	 * The remote endpoint of the tunnel.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:remote:
+     *
+     * The remote endpoint of the tunnel.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_REMOTE] = g_param_spec_string(NM_DEVICE_IP_TUNNEL_REMOTE,
                                                       "",
                                                       "",
@@ -452,13 +452,13 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:ttl:
-	 *
-	 * The TTL assigned to tunneled packets. 0 is a special value
-	 *  meaning that packets inherit the TTL value
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:ttl:
+     *
+     * The TTL assigned to tunneled packets. 0 is a special value
+     *  meaning that packets inherit the TTL value
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TTL] = g_param_spec_uchar(NM_DEVICE_IP_TUNNEL_TTL,
                                                   "",
                                                   "",
@@ -468,13 +468,13 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                                                   G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:tos:
-	 *
-	 * The type of service (IPv4) or traffic class (IPv6) assigned to
-	 * tunneled packets.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:tos:
+     *
+     * The type of service (IPv4) or traffic class (IPv6) assigned to
+     * tunneled packets.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TOS] = g_param_spec_uchar(NM_DEVICE_IP_TUNNEL_TOS,
                                                   "",
                                                   "",
@@ -484,12 +484,12 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                                                   G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:path-mtu-discovery:
-	 *
-	 * Whether path MTU discovery is enabled on this tunnel.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:path-mtu-discovery:
+     *
+     * Whether path MTU discovery is enabled on this tunnel.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PATH_MTU_DISCOVERY] =
         g_param_spec_boolean(NM_DEVICE_IP_TUNNEL_PATH_MTU_DISCOVERY,
                              "",
@@ -498,12 +498,12 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:input-key:
-	 *
-	 * The key used for tunneled input packets, if applicable.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:input-key:
+     *
+     * The key used for tunneled input packets, if applicable.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_INPUT_KEY] = g_param_spec_string(NM_DEVICE_IP_TUNNEL_INPUT_KEY,
                                                          "",
                                                          "",
@@ -511,12 +511,12 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:output-key:
-	 *
-	 * The key used for tunneled output packets, if applicable.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:output-key:
+     *
+     * The key used for tunneled output packets, if applicable.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_OUTPUT_KEY] =
         g_param_spec_string(NM_DEVICE_IP_TUNNEL_OUTPUT_KEY,
                             "",
@@ -525,14 +525,14 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:encapsulation-limit:
-	 *
-	 * How many additional levels of encapsulation are permitted to
-	 * be prepended to packets. This property applies only to IPv6
-	 * tunnels.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:encapsulation-limit:
+     *
+     * How many additional levels of encapsulation are permitted to
+     * be prepended to packets. This property applies only to IPv6
+     * tunnels.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_ENCAPSULATION_LIMIT] =
         g_param_spec_uchar(NM_DEVICE_IP_TUNNEL_ENCAPSULATION_LIMIT,
                            "",
@@ -543,13 +543,13 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:flow-label:
-	 *
-	 * The flow label to assign to tunnel packets. This property
-	 * applies only to IPv6 tunnels.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceIPTunnel:flow-label:
+     *
+     * The flow label to assign to tunnel packets. This property
+     * applies only to IPv6 tunnels.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_FLOW_LABEL] = g_param_spec_uint(NM_DEVICE_IP_TUNNEL_FLOW_LABEL,
                                                         "",
                                                         "",
@@ -559,12 +559,12 @@ nm_device_ip_tunnel_class_init(NMDeviceIPTunnelClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceIPTunnel:flags:
-	 *
-	 * Tunnel flags.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMDeviceIPTunnel:flags:
+     *
+     * Tunnel flags.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_FLAGS] = g_param_spec_uint(NM_DEVICE_IP_TUNNEL_FLAGS,
                                                    "",
                                                    "",
diff --git a/libnm/nm-device-macsec.c b/libnm/nm-device-macsec.c
index 527829c4d9..998adc2c41 100644
--- a/libnm/nm-device-macsec.c
+++ b/libnm/nm-device-macsec.c
@@ -439,12 +439,12 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
     _NM_OBJECT_CLASS_INIT_PROPERTY_O_FIELDS_1(nm_object_class, NMDeviceMacsecPrivate, parent);
 
     /**
-	 * NMDeviceMacsec:parent:
-	 *
-	 * The devices's parent device.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:parent:
+     *
+     * The devices's parent device.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_object(NM_DEVICE_MACSEC_PARENT,
                                                       "",
                                                       "",
@@ -452,12 +452,12 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:sci:
-	 *
-	 * The Secure Channel Identifier in use.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:sci:
+     *
+     * The Secure Channel Identifier in use.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_SCI] = g_param_spec_uint64(NM_DEVICE_MACSEC_SCI,
                                                    "",
                                                    "",
@@ -467,12 +467,12 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:icv-length:
-	 *
-	 * The length of ICV (Integrity Check Value).
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:icv-length:
+     *
+     * The length of ICV (Integrity Check Value).
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_ICV_LENGTH] = g_param_spec_uchar(NM_DEVICE_MACSEC_ICV_LENGTH,
                                                          "",
                                                          "",
@@ -482,12 +482,12 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:cipher-suite:
-	 *
-	 * The set of cryptographic algorithms in use.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:cipher-suite:
+     *
+     * The set of cryptographic algorithms in use.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_CIPHER_SUITE] =
         g_param_spec_uint64(NM_DEVICE_MACSEC_CIPHER_SUITE,
                             "",
@@ -498,12 +498,12 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:window:
-	 *
-	 * The size of the replay window.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:window:
+     *
+     * The size of the replay window.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_WINDOW] = g_param_spec_uint(NM_DEVICE_MACSEC_WINDOW,
                                                     "",
                                                     "",
@@ -513,13 +513,13 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:encoding-sa:
-	 *
-	 * The value of the Association Number (0..3) for the Security
-	 * Association in use.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:encoding-sa:
+     *
+     * The value of the Association Number (0..3) for the Security
+     * Association in use.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_ENCODING_SA] =
         g_param_spec_uchar(NM_DEVICE_MACSEC_ENCODING_SA,
                            "",
@@ -530,13 +530,13 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:validation:
-	 *
-	 * The validation mode for incoming packets (strict, check,
-	 * disabled).
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:validation:
+     *
+     * The validation mode for incoming packets (strict, check,
+     * disabled).
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_VALIDATION] =
         g_param_spec_string(NM_DEVICE_MACSEC_VALIDATION,
                             "",
@@ -545,12 +545,12 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:encrypt:
-	 *
-	 * Whether encryption of transmitted frames is enabled.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:encrypt:
+     *
+     * Whether encryption of transmitted frames is enabled.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_ENCRYPT] = g_param_spec_boolean(NM_DEVICE_MACSEC_ENCRYPT,
                                                         "",
                                                         "",
@@ -558,12 +558,12 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:protect:
-	 *
-	 * Whether protection of transmitted frames is enabled.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:protect:
+     *
+     * Whether protection of transmitted frames is enabled.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_PROTECT] = g_param_spec_boolean(NM_DEVICE_MACSEC_PROTECT,
                                                         "",
                                                         "",
@@ -571,13 +571,13 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:include-sci:
-	 *
-	 * Whether the SCI is always included in SecTAG for transmitted
-	 * frames.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:include-sci:
+     *
+     * Whether the SCI is always included in SecTAG for transmitted
+     * frames.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_INCLUDE_SCI] =
         g_param_spec_boolean(NM_DEVICE_MACSEC_INCLUDE_SCI,
                              "",
@@ -586,13 +586,13 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:es:
-	 *
-	 * Whether the ES (End station) bit is enabled in SecTAG for
-	 * transmitted frames.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:es:
+     *
+     * Whether the ES (End station) bit is enabled in SecTAG for
+     * transmitted frames.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_ES] = g_param_spec_boolean(NM_DEVICE_MACSEC_ES,
                                                    "",
                                                    "",
@@ -600,13 +600,13 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:scb:
-	 *
-	 * Whether the SCB (Single Copy Broadcast) bit is enabled in
-	 * SecTAG for transmitted frames.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:scb:
+     *
+     * Whether the SCB (Single Copy Broadcast) bit is enabled in
+     * SecTAG for transmitted frames.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_SCB] = g_param_spec_boolean(NM_DEVICE_MACSEC_SCB,
                                                     "",
                                                     "",
@@ -614,12 +614,12 @@ nm_device_macsec_class_init(NMDeviceMacsecClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacsec:replay-protect:
-	 *
-	 * Whether replay protection is enabled.
-	 *
-	 * Since: 1.6
-	 **/
+     * NMDeviceMacsec:replay-protect:
+     *
+     * Whether replay protection is enabled.
+     *
+     * Since: 1.6
+     **/
     obj_properties[PROP_REPLAY_PROTECT] =
         g_param_spec_boolean(NM_DEVICE_MACSEC_REPLAY_PROTECT,
                              "",
diff --git a/libnm/nm-device-macvlan.c b/libnm/nm-device-macvlan.c
index 2be042dc21..2d4337dd60 100644
--- a/libnm/nm-device-macvlan.c
+++ b/libnm/nm-device-macvlan.c
@@ -242,12 +242,12 @@ nm_device_macvlan_class_init(NMDeviceMacvlanClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceMacvlan:parent:
-	 *
-	 * The devices's parent device.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceMacvlan:parent:
+     *
+     * The devices's parent device.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_object(NM_DEVICE_MACVLAN_PARENT,
                                                       "",
                                                       "",
@@ -255,12 +255,12 @@ nm_device_macvlan_class_init(NMDeviceMacvlanClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacvlan:mode:
-	 *
-	 * The MACVLAN mode.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceMacvlan:mode:
+     *
+     * The MACVLAN mode.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_MODE] = g_param_spec_string(NM_DEVICE_MACVLAN_MODE,
                                                     "",
                                                     "",
@@ -268,12 +268,12 @@ nm_device_macvlan_class_init(NMDeviceMacvlanClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacvlan:no-promisc:
-	 *
-	 * Whether the device has the no-promiscuos flag.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceMacvlan:no-promisc:
+     *
+     * Whether the device has the no-promiscuos flag.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_NO_PROMISC] =
         g_param_spec_boolean(NM_DEVICE_MACVLAN_NO_PROMISC,
                              "",
@@ -282,12 +282,12 @@ nm_device_macvlan_class_init(NMDeviceMacvlanClass *klass)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceMacvlan:tap:
-	 *
-	 * Whether the device is a MACVTAP.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceMacvlan:tap:
+     *
+     * Whether the device is a MACVTAP.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_TAP] = g_param_spec_boolean(NM_DEVICE_MACVLAN_TAP,
                                                     "",
                                                     "",
diff --git a/libnm/nm-device-modem.c b/libnm/nm-device-modem.c
index 68f1601967..bbb03a358d 100644
--- a/libnm/nm-device-modem.c
+++ b/libnm/nm-device-modem.c
@@ -293,13 +293,13 @@ nm_device_modem_class_init(NMDeviceModemClass *modem_class)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceModem:modem-capabilities:
-	 *
-	 * The generic family of access technologies the modem supports.  Not all
-	 * capabilities are available at the same time however; some modems require
-	 * a firmware reload or other reinitialization to switch between eg
-	 * CDMA/EVDO and GSM/UMTS.
-	 **/
+     * NMDeviceModem:modem-capabilities:
+     *
+     * The generic family of access technologies the modem supports.  Not all
+     * capabilities are available at the same time however; some modems require
+     * a firmware reload or other reinitialization to switch between eg
+     * CDMA/EVDO and GSM/UMTS.
+     **/
     obj_properties[PROP_MODEM_CAPABILITIES] =
         g_param_spec_flags(NM_DEVICE_MODEM_MODEM_CAPABILITIES,
                            "",
@@ -309,11 +309,11 @@ nm_device_modem_class_init(NMDeviceModemClass *modem_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceModem:current-capabilities:
-	 *
-	 * The generic family of access technologies the modem currently supports
-	 * without a firmware reload or reinitialization.
-	 **/
+     * NMDeviceModem:current-capabilities:
+     *
+     * The generic family of access technologies the modem currently supports
+     * without a firmware reload or reinitialization.
+     **/
     obj_properties[PROP_CURRENT_CAPABILITIES] =
         g_param_spec_flags(NM_DEVICE_MODEM_CURRENT_CAPABILITIES,
                            "",
@@ -323,10 +323,10 @@ nm_device_modem_class_init(NMDeviceModemClass *modem_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceModem:device-id:
-	 *
-	 * Since: 1.20
-	 **/
+     * NMDeviceModem:device-id:
+     *
+     * Since: 1.20
+     **/
     obj_properties[PROP_DEVICE_ID] = g_param_spec_string(NM_DEVICE_MODEM_DEVICE_ID,
                                                          "",
                                                          "",
@@ -334,10 +334,10 @@ nm_device_modem_class_init(NMDeviceModemClass *modem_class)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceModem:operator-code:
-	 *
-	 * Since: 1.20
-	 **/
+     * NMDeviceModem:operator-code:
+     *
+     * Since: 1.20
+     **/
     obj_properties[PROP_OPERATOR_CODE] =
         g_param_spec_string(NM_DEVICE_MODEM_OPERATOR_CODE,
                             "",
@@ -346,10 +346,10 @@ nm_device_modem_class_init(NMDeviceModemClass *modem_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceModem:apn:
-	 *
-	 * Since: 1.20
-	 **/
+     * NMDeviceModem:apn:
+     *
+     * Since: 1.20
+     **/
     obj_properties[PROP_APN] = g_param_spec_string(NM_DEVICE_MODEM_APN,
                                                    "",
                                                    "",
diff --git a/libnm/nm-device-olpc-mesh.c b/libnm/nm-device-olpc-mesh.c
index 86c9bd2b60..534105897b 100644
--- a/libnm/nm-device-olpc-mesh.c
+++ b/libnm/nm-device-olpc-mesh.c
@@ -172,10 +172,10 @@ nm_device_olpc_mesh_class_init(NMDeviceOlpcMeshClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceOlpcMesh:companion:
-	 *
-	 * The companion device.
-	 **/
+     * NMDeviceOlpcMesh:companion:
+     *
+     * The companion device.
+     **/
     obj_properties[PROP_COMPANION] = g_param_spec_object(NM_DEVICE_OLPC_MESH_COMPANION,
                                                          "",
                                                          "",
@@ -183,10 +183,10 @@ nm_device_olpc_mesh_class_init(NMDeviceOlpcMeshClass *klass)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceOlpcMesh:active-channel:
-	 *
-	 * The device's active channel.
-	 **/
+     * NMDeviceOlpcMesh:active-channel:
+     *
+     * The device's active channel.
+     **/
     obj_properties[PROP_ACTIVE_CHANNEL] =
         g_param_spec_uint(NM_DEVICE_OLPC_MESH_ACTIVE_CHANNEL,
                           "",
diff --git a/libnm/nm-device-ovs-bridge.c b/libnm/nm-device-ovs-bridge.c
index cee391d389..6ca501144f 100644
--- a/libnm/nm-device-ovs-bridge.c
+++ b/libnm/nm-device-ovs-bridge.c
@@ -152,12 +152,12 @@ nm_device_ovs_bridge_class_init(NMDeviceOvsBridgeClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceOvsBridge:slaves: (type GPtrArray(NMDevice))
-	 *
-	 * Gets the ports currently enslaved to the device.
-	 *
-	 * Since: 1.22
-	 */
+     * NMDeviceOvsBridge:slaves: (type GPtrArray(NMDevice))
+     *
+     * Gets the ports currently enslaved to the device.
+     *
+     * Since: 1.22
+     */
     obj_properties[PROP_SLAVES] = g_param_spec_boxed(NM_DEVICE_OVS_BRIDGE_SLAVES,
                                                      "",
                                                      "",
diff --git a/libnm/nm-device-ovs-port.c b/libnm/nm-device-ovs-port.c
index 8f56daa499..301ef2ccd6 100644
--- a/libnm/nm-device-ovs-port.c
+++ b/libnm/nm-device-ovs-port.c
@@ -152,12 +152,12 @@ nm_device_ovs_port_class_init(NMDeviceOvsPortClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceOvsPort:slaves: (type GPtrArray(NMDevice))
-	 *
-	 * Gets the interfaces currently enslaved to the device.
-	 *
-	 * Since: 1.22
-	 */
+     * NMDeviceOvsPort:slaves: (type GPtrArray(NMDevice))
+     *
+     * Gets the interfaces currently enslaved to the device.
+     *
+     * Since: 1.22
+     */
     obj_properties[PROP_SLAVES] = g_param_spec_boxed(NM_DEVICE_OVS_PORT_SLAVES,
                                                      "",
                                                      "",
diff --git a/libnm/nm-device-team.c b/libnm/nm-device-team.c
index ec2adedbd8..cfb6e69ddf 100644
--- a/libnm/nm-device-team.c
+++ b/libnm/nm-device-team.c
@@ -209,10 +209,10 @@ nm_device_team_class_init(NMDeviceTeamClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceTeam:carrier:
-	 *
-	 * Whether the device has carrier.
-	 **/
+     * NMDeviceTeam:carrier:
+     *
+     * Whether the device has carrier.
+     **/
     obj_properties[PROP_CARRIER] = g_param_spec_boolean(NM_DEVICE_TEAM_CARRIER,
                                                         "",
                                                         "",
@@ -220,10 +220,10 @@ nm_device_team_class_init(NMDeviceTeamClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceTeam:slaves: (type GPtrArray(NMDevice))
-	 *
-	 * The devices enslaved to the team device.
-	 **/
+     * NMDeviceTeam:slaves: (type GPtrArray(NMDevice))
+     *
+     * The devices enslaved to the team device.
+     **/
     obj_properties[PROP_SLAVES] = g_param_spec_boxed(NM_DEVICE_TEAM_SLAVES,
                                                      "",
                                                      "",
@@ -231,12 +231,12 @@ nm_device_team_class_init(NMDeviceTeamClass *klass)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceTeam:config:
-	 *
-	 * The current JSON configuration of the device.
-	 *
-	 * Since: 1.4
-	 **/
+     * NMDeviceTeam:config:
+     *
+     * The current JSON configuration of the device.
+     *
+     * Since: 1.4
+     **/
     obj_properties[PROP_CONFIG] = g_param_spec_string(NM_DEVICE_TEAM_CONFIG,
                                                       "",
                                                       "",
diff --git a/libnm/nm-device-tun.c b/libnm/nm-device-tun.c
index 1affee9c9d..084d846ed9 100644
--- a/libnm/nm-device-tun.c
+++ b/libnm/nm-device-tun.c
@@ -304,12 +304,12 @@ nm_device_tun_class_init(NMDeviceTunClass *gre_class)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceTun:mode:
-	 *
-	 * The tunnel mode, either "tun" or "tap".
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceTun:mode:
+     *
+     * The tunnel mode, either "tun" or "tap".
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_MODE] = g_param_spec_string(NM_DEVICE_TUN_MODE,
                                                     "",
                                                     "",
@@ -317,12 +317,12 @@ nm_device_tun_class_init(NMDeviceTunClass *gre_class)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceTun:owner:
-	 *
-	 * The uid of the tunnel owner, or -1 if it has no owner.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceTun:owner:
+     *
+     * The uid of the tunnel owner, or -1 if it has no owner.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_OWNER] = g_param_spec_int64(NM_DEVICE_TUN_OWNER,
                                                     "",
                                                     "",
@@ -332,12 +332,12 @@ nm_device_tun_class_init(NMDeviceTunClass *gre_class)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceTun:group:
-	 *
-	 * The gid of the tunnel group, or -1 if it has no owner.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceTun:group:
+     *
+     * The gid of the tunnel group, or -1 if it has no owner.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_GROUP] = g_param_spec_int64(NM_DEVICE_TUN_GROUP,
                                                     "",
                                                     "",
@@ -347,13 +347,13 @@ nm_device_tun_class_init(NMDeviceTunClass *gre_class)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceTun:no-pi:
-	 *
-	 * The tunnel's "TUN_NO_PI" flag; true if no protocol info is
-	 * prepended to the tunnel packets.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceTun:no-pi:
+     *
+     * The tunnel's "TUN_NO_PI" flag; true if no protocol info is
+     * prepended to the tunnel packets.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_NO_PI] = g_param_spec_boolean(NM_DEVICE_TUN_NO_PI,
                                                       "",
                                                       "",
@@ -361,13 +361,13 @@ nm_device_tun_class_init(NMDeviceTunClass *gre_class)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceTun:vnet-hdr:
-	 *
-	 * The tunnel's "TUN_VNET_HDR" flag; true if the tunnel packets
-	 * include a virtio network header.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceTun:vnet-hdr:
+     *
+     * The tunnel's "TUN_VNET_HDR" flag; true if the tunnel packets
+     * include a virtio network header.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_VNET_HDR] = g_param_spec_boolean(NM_DEVICE_TUN_VNET_HDR,
                                                          "",
                                                          "",
@@ -375,14 +375,14 @@ nm_device_tun_class_init(NMDeviceTunClass *gre_class)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceTun:multi-queue:
-	 *
-	 * The tunnel's "TUN_TAP_MQ" flag; true if callers can connect to
-	 * the tap device multiple times, for multiple send/receive
-	 * queues.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceTun:multi-queue:
+     *
+     * The tunnel's "TUN_TAP_MQ" flag; true if callers can connect to
+     * the tap device multiple times, for multiple send/receive
+     * queues.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_MULTI_QUEUE] =
         g_param_spec_boolean(NM_DEVICE_TUN_MULTI_QUEUE,
                              "",
diff --git a/libnm/nm-device-vlan.c b/libnm/nm-device-vlan.c
index 8af2163b6d..1abb046ebb 100644
--- a/libnm/nm-device-vlan.c
+++ b/libnm/nm-device-vlan.c
@@ -219,10 +219,10 @@ nm_device_vlan_class_init(NMDeviceVlanClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceVlan:carrier:
-	 *
-	 * Whether the device has carrier.
-	 **/
+     * NMDeviceVlan:carrier:
+     *
+     * Whether the device has carrier.
+     **/
     obj_properties[PROP_CARRIER] = g_param_spec_boolean(NM_DEVICE_VLAN_CARRIER,
                                                         "",
                                                         "",
@@ -230,10 +230,10 @@ nm_device_vlan_class_init(NMDeviceVlanClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVlan:parent:
-	 *
-	 * The devices's parent device.
-	 **/
+     * NMDeviceVlan:parent:
+     *
+     * The devices's parent device.
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_object(NM_DEVICE_VLAN_PARENT,
                                                       "",
                                                       "",
@@ -241,10 +241,10 @@ nm_device_vlan_class_init(NMDeviceVlanClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVlan:vlan-id:
-	 *
-	 * The device's VLAN ID.
-	 **/
+     * NMDeviceVlan:vlan-id:
+     *
+     * The device's VLAN ID.
+     **/
     obj_properties[PROP_VLAN_ID] = g_param_spec_uint(NM_DEVICE_VLAN_VLAN_ID,
                                                      "",
                                                      "",
diff --git a/libnm/nm-device-vrf.c b/libnm/nm-device-vrf.c
index 0e48ed0aa3..3b86e4d081 100644
--- a/libnm/nm-device-vrf.c
+++ b/libnm/nm-device-vrf.c
@@ -127,12 +127,12 @@ nm_device_vrf_class_init(NMDeviceVrfClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceVrf:table:
-	 *
-	 * The device's VRF table.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMDeviceVrf:table:
+     *
+     * The device's VRF table.
+     *
+     * Since: 1.24
+     **/
     obj_properties[PROP_TABLE] = g_param_spec_uint(NM_DEVICE_VRF_TABLE,
                                                    "",
                                                    "",
diff --git a/libnm/nm-device-vxlan.c b/libnm/nm-device-vxlan.c
index 0d613b6434..bd6de1e1f5 100644
--- a/libnm/nm-device-vxlan.c
+++ b/libnm/nm-device-vxlan.c
@@ -537,14 +537,14 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceVxlan:carrier:
-	 *
-	 * Whether the device has carrier.
-	 *
-	 * Since: 1.2
-	 *
-	 * This property is not implemented yet, and the property is always FALSE.
-	 **/
+     * NMDeviceVxlan:carrier:
+     *
+     * Whether the device has carrier.
+     *
+     * Since: 1.2
+     *
+     * This property is not implemented yet, and the property is always FALSE.
+     **/
     obj_properties[PROP_CARRIER] = g_param_spec_boolean(NM_DEVICE_VXLAN_CARRIER,
                                                         "",
                                                         "",
@@ -552,12 +552,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:parent:
-	 *
-	 * The devices's parent device.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceVxlan:parent:
+     *
+     * The devices's parent device.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_PARENT] = g_param_spec_object(NM_DEVICE_VXLAN_PARENT,
                                                       "",
                                                       "",
@@ -565,12 +565,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:id:
-	 *
-	 * The device's VXLAN ID.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDeviceVxlan:id:
+     *
+     * The device's VXLAN ID.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_ID] = g_param_spec_uint(NM_DEVICE_VXLAN_ID,
                                                 "",
                                                 "",
@@ -580,14 +580,14 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                 G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:group:
-	 *
-	 * The unicast destination IP address used in outgoing packets when the
-	 * destination link layer address is not known in the VXLAN device
-	 * forwarding database or the multicast IP address joined.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:group:
+     *
+     * The unicast destination IP address used in outgoing packets when the
+     * destination link layer address is not known in the VXLAN device
+     * forwarding database or the multicast IP address joined.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_GROUP] = g_param_spec_string(NM_DEVICE_VXLAN_GROUP,
                                                      "",
                                                      "",
@@ -595,12 +595,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:local:
-	 *
-	 * The source IP address to use in outgoing packets.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:local:
+     *
+     * The source IP address to use in outgoing packets.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_LOCAL] = g_param_spec_string(NM_DEVICE_VXLAN_LOCAL,
                                                      "",
                                                      "",
@@ -608,12 +608,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:tos:
-	 *
-	 * The TOS value to use in outgoing packets.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:tos:
+     *
+     * The TOS value to use in outgoing packets.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_TOS] = g_param_spec_uchar(NM_DEVICE_VXLAN_TOS,
                                                   "",
                                                   "",
@@ -623,12 +623,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                   G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:ttl:
-	 *
-	 * The time-to-live value to use in outgoing packets.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:ttl:
+     *
+     * The time-to-live value to use in outgoing packets.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_TTL] = g_param_spec_uchar(NM_DEVICE_VXLAN_TTL,
                                                   "",
                                                   "",
@@ -638,13 +638,13 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                   G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:learning:
-	 *
-	 * Whether unknown source link layer addresses and IP addresses are entered
-	 * into the VXLAN device forwarding database.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:learning:
+     *
+     * Whether unknown source link layer addresses and IP addresses are entered
+     * into the VXLAN device forwarding database.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_LEARNING] = g_param_spec_boolean(NM_DEVICE_VXLAN_LEARNING,
                                                          "",
                                                          "",
@@ -652,12 +652,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:ageing:
-	 *
-	 * The lifetime in seconds of FDB entries learnt by the kernel.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:ageing:
+     *
+     * The lifetime in seconds of FDB entries learnt by the kernel.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_AGEING] = g_param_spec_uint(NM_DEVICE_VXLAN_AGEING,
                                                     "",
                                                     "",
@@ -667,12 +667,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:limit:
-	 *
-	 * The maximum number of entries that can be added to the forwarding table.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:limit:
+     *
+     * The maximum number of entries that can be added to the forwarding table.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_LIMIT] = g_param_spec_uint(NM_DEVICE_VXLAN_LIMIT,
                                                    "",
                                                    "",
@@ -682,13 +682,13 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:dst-port:
-	 *
-	 * The UDP destination port used to communicate with the remote VXLAN tunnel
-	 * endpoint.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:dst-port:
+     *
+     * The UDP destination port used to communicate with the remote VXLAN tunnel
+     * endpoint.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_DST_PORT] = g_param_spec_uint(NM_DEVICE_VXLAN_DST_PORT,
                                                       "",
                                                       "",
@@ -698,13 +698,13 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:src-port-min:
-	 *
-	 * The minimum UDP source port used to communicate with the remote VXLAN
-	 * tunnel endpoint.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:src-port-min:
+     *
+     * The minimum UDP source port used to communicate with the remote VXLAN
+     * tunnel endpoint.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_SRC_PORT_MIN] =
         g_param_spec_uint(NM_DEVICE_VXLAN_SRC_PORT_MIN,
                           "",
@@ -715,13 +715,13 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                           G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:src-port-max:
-	 *
-	 * The maximum UDP source port used to communicate with the remote VXLAN
-	 * tunnel endpoint.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:src-port-max:
+     *
+     * The maximum UDP source port used to communicate with the remote VXLAN
+     * tunnel endpoint.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_SRC_PORT_MAX] =
         g_param_spec_uint(NM_DEVICE_VXLAN_SRC_PORT_MAX,
                           "",
@@ -732,12 +732,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                           G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:proxy:
-	 *
-	 * Whether ARP proxy is turned on.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:proxy:
+     *
+     * Whether ARP proxy is turned on.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_PROXY] = g_param_spec_boolean(NM_DEVICE_VXLAN_PROXY,
                                                       "",
                                                       "",
@@ -745,12 +745,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:rsc:
-	 *
-	 * Whether route short circuit is turned on.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:rsc:
+     *
+     * Whether route short circuit is turned on.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_RSC] = g_param_spec_boolean(NM_DEVICE_VXLAN_RSC,
                                                     "",
                                                     "",
@@ -758,12 +758,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:l2miss:
-	 *
-	 * Whether netlink LL ADDR miss notifications are generated.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:l2miss:
+     *
+     * Whether netlink LL ADDR miss notifications are generated.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_L2MISS] = g_param_spec_boolean(NM_DEVICE_VXLAN_L2MISS,
                                                        "",
                                                        "",
@@ -771,12 +771,12 @@ nm_device_vxlan_class_init(NMDeviceVxlanClass *klass)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceVxlan:l3miss:
-	 *
-	 * Whether netlink IP ADDR miss notifications are generated.
-	 *
-	 * Since: 1.2
-	 */
+     * NMDeviceVxlan:l3miss:
+     *
+     * Whether netlink IP ADDR miss notifications are generated.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_L3MISS] = g_param_spec_boolean(NM_DEVICE_VXLAN_L3MISS,
                                                        "",
                                                        "",
diff --git a/libnm/nm-device-wifi-p2p.c b/libnm/nm-device-wifi-p2p.c
index e731ba4c6d..f9a42bb86e 100644
--- a/libnm/nm-device-wifi-p2p.c
+++ b/libnm/nm-device-wifi-p2p.c
@@ -357,12 +357,12 @@ nm_device_wifi_p2p_class_init(NMDeviceWifiP2PClass *klass)
     device_class->get_type_description  = get_type_description;
 
     /**
-	 * NMDeviceWifiP2P:peers: (type GPtrArray(NMWifiP2PPeer))
-	 *
-	 * List of all Wi-Fi P2P peers the device can see.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMDeviceWifiP2P:peers: (type GPtrArray(NMWifiP2PPeer))
+     *
+     * List of all Wi-Fi P2P peers the device can see.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_PEERS] = g_param_spec_boxed(NM_DEVICE_WIFI_P2P_PEERS,
                                                     "",
                                                     "",
@@ -373,14 +373,14 @@ nm_device_wifi_p2p_class_init(NMDeviceWifiP2PClass *klass)
                                               &_nml_dbus_meta_iface_nm_device_wifip2p);
 
     /**
-	 * NMDeviceWifiP2P::peer-added:
-	 * @device: the Wi-Fi P2P device that received the signal
-	 * @peer: the new access point
-	 *
-	 * Notifies that a #NMWifiP2PPeer is added to the Wi-Fi P2P device.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMDeviceWifiP2P::peer-added:
+     * @device: the Wi-Fi P2P device that received the signal
+     * @peer: the new access point
+     *
+     * Notifies that a #NMWifiP2PPeer is added to the Wi-Fi P2P device.
+     *
+     * Since: 1.16
+     **/
     signals[PEER_ADDED] = g_signal_new("peer-added",
                                        G_OBJECT_CLASS_TYPE(object_class),
                                        G_SIGNAL_RUN_FIRST,
@@ -393,14 +393,14 @@ nm_device_wifi_p2p_class_init(NMDeviceWifiP2PClass *klass)
                                        G_TYPE_OBJECT);
 
     /**
-	 * NMDeviceWifiP2P::peer-removed:
-	 * @device: the Wi-Fi P2P device that received the signal
-	 * @peer: the removed access point
-	 *
-	 * Notifies that a #NMWifiP2PPeer is removed from the Wi-Fi P2P device.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMDeviceWifiP2P::peer-removed:
+     * @device: the Wi-Fi P2P device that received the signal
+     * @peer: the removed access point
+     *
+     * Notifies that a #NMWifiP2PPeer is removed from the Wi-Fi P2P device.
+     *
+     * Since: 1.16
+     **/
     signals[PEER_REMOVED] = g_signal_new("peer-removed",
                                          G_OBJECT_CLASS_TYPE(object_class),
                                          G_SIGNAL_RUN_FIRST,
diff --git a/libnm/nm-device-wifi.c b/libnm/nm-device-wifi.c
index 53c7d32a19..4abc83d80f 100644
--- a/libnm/nm-device-wifi.c
+++ b/libnm/nm-device-wifi.c
@@ -655,10 +655,10 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
     device_class->get_setting_type      = get_setting_type;
 
     /**
-	 * NMDeviceWifi:perm-hw-address:
-	 *
-	 * The hardware (MAC) address of the device.
-	 **/
+     * NMDeviceWifi:perm-hw-address:
+     *
+     * The hardware (MAC) address of the device.
+     **/
     obj_properties[PROP_PERM_HW_ADDRESS] =
         g_param_spec_string(NM_DEVICE_WIFI_PERMANENT_HW_ADDRESS,
                             "",
@@ -667,10 +667,10 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWifi:mode:
-	 *
-	 * The mode of the device.
-	 **/
+     * NMDeviceWifi:mode:
+     *
+     * The mode of the device.
+     **/
     obj_properties[PROP_MODE] = g_param_spec_enum(NM_DEVICE_WIFI_MODE,
                                                   "",
                                                   "",
@@ -679,10 +679,10 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
                                                   G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWifi:bitrate:
-	 *
-	 * The bit rate of the device in kbit/s.
-	 **/
+     * NMDeviceWifi:bitrate:
+     *
+     * The bit rate of the device in kbit/s.
+     **/
     obj_properties[PROP_BITRATE] = g_param_spec_uint(NM_DEVICE_WIFI_BITRATE,
                                                      "",
                                                      "",
@@ -692,10 +692,10 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWifi:active-access-point:
-	 *
-	 * The active #NMAccessPoint of the device.
-	 **/
+     * NMDeviceWifi:active-access-point:
+     *
+     * The active #NMAccessPoint of the device.
+     **/
     obj_properties[PROP_ACTIVE_ACCESS_POINT] =
         g_param_spec_object(NM_DEVICE_WIFI_ACTIVE_ACCESS_POINT,
                             "",
@@ -704,10 +704,10 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWifi:wireless-capabilities:
-	 *
-	 * The wireless capabilities of the device.
-	 **/
+     * NMDeviceWifi:wireless-capabilities:
+     *
+     * The wireless capabilities of the device.
+     **/
     obj_properties[PROP_WIRELESS_CAPABILITIES] =
         g_param_spec_flags(NM_DEVICE_WIFI_CAPABILITIES,
                            "",
@@ -717,10 +717,10 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWifi:access-points: (type GPtrArray(NMAccessPoint))
-	 *
-	 * List of all Wi-Fi access points the device can see.
-	 **/
+     * NMDeviceWifi:access-points: (type GPtrArray(NMAccessPoint))
+     *
+     * List of all Wi-Fi access points the device can see.
+     **/
     obj_properties[PROP_ACCESS_POINTS] =
         g_param_spec_boxed(NM_DEVICE_WIFI_ACCESS_POINTS,
                            "",
@@ -729,14 +729,14 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWifi:last-scan:
-	 *
-	 * The timestamp (in CLOCK_BOOTTIME seconds) for the last finished
-	 * network scan. A value of -1 means the device never scanned for
-	 * access points.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMDeviceWifi:last-scan:
+     *
+     * The timestamp (in CLOCK_BOOTTIME seconds) for the last finished
+     * network scan. A value of -1 means the device never scanned for
+     * access points.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_LAST_SCAN] = g_param_spec_int64(NM_DEVICE_WIFI_LAST_SCAN,
                                                         "",
                                                         "",
@@ -749,12 +749,12 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
                                               &_nml_dbus_meta_iface_nm_device_wireless);
 
     /**
-	 * NMDeviceWifi::access-point-added:
-	 * @device: the Wi-Fi device that received the signal
-	 * @ap: the new access point
-	 *
-	 * Notifies that a #NMAccessPoint is added to the Wi-Fi device.
-	 **/
+     * NMDeviceWifi::access-point-added:
+     * @device: the Wi-Fi device that received the signal
+     * @ap: the new access point
+     *
+     * Notifies that a #NMAccessPoint is added to the Wi-Fi device.
+     **/
     signals[ACCESS_POINT_ADDED] = g_signal_new("access-point-added",
                                                G_OBJECT_CLASS_TYPE(object_class),
                                                G_SIGNAL_RUN_FIRST,
@@ -767,12 +767,12 @@ nm_device_wifi_class_init(NMDeviceWifiClass *klass)
                                                G_TYPE_OBJECT);
 
     /**
-	 * NMDeviceWifi::access-point-removed:
-	 * @device: the Wi-Fi device that received the signal
-	 * @ap: the removed access point
-	 *
-	 * Notifies that a #NMAccessPoint is removed from the Wi-Fi device.
-	 **/
+     * NMDeviceWifi::access-point-removed:
+     * @device: the Wi-Fi device that received the signal
+     * @ap: the removed access point
+     *
+     * Notifies that a #NMAccessPoint is removed from the Wi-Fi device.
+     **/
     signals[ACCESS_POINT_REMOVED] = g_signal_new("access-point-removed",
                                                  G_OBJECT_CLASS_TYPE(object_class),
                                                  G_SIGNAL_RUN_FIRST,
diff --git a/libnm/nm-device-wimax.c b/libnm/nm-device-wimax.c
index d47cc0f5f5..29e1b85cfc 100644
--- a/libnm/nm-device-wimax.c
+++ b/libnm/nm-device-wimax.c
@@ -224,12 +224,12 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
     object_class->get_property = get_property;
 
     /**
-	 * NMDeviceWimax:hw-address:
-	 *
-	 * The hardware (MAC) address of the device.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax:hw-address:
+     *
+     * The hardware (MAC) address of the device.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_HW_ADDRESS] =
         g_param_spec_string(NM_DEVICE_WIMAX_HW_ADDRESS,
                             "",
@@ -238,12 +238,12 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWimax:active-nsp:
-	 *
-	 * The active #NMWimaxNsp of the device.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax:active-nsp:
+     *
+     * The active #NMWimaxNsp of the device.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_ACTIVE_NSP] =
         g_param_spec_object(NM_DEVICE_WIMAX_ACTIVE_NSP,
                             "",
@@ -252,14 +252,14 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWimax:center-frequency:
-	 *
-	 * The center frequency (in KHz) of the radio channel the device is using to
-	 * communicate with the network when connected.  Has no meaning when the
-	 * device is not connected.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax:center-frequency:
+     *
+     * The center frequency (in KHz) of the radio channel the device is using to
+     * communicate with the network when connected.  Has no meaning when the
+     * device is not connected.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_CENTER_FREQ] = g_param_spec_uint(NM_DEVICE_WIMAX_CENTER_FREQUENCY,
                                                          "",
                                                          "",
@@ -269,15 +269,15 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWimax:rssi:
-	 *
-	 * RSSI of the current radio link in dBm.  This value indicates how strong
-	 * the raw received RF signal from the base station is, but does not
-	 * indicate the overall quality of the radio link.  Has no meaning when the
-	 * device is not connected.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax:rssi:
+     *
+     * RSSI of the current radio link in dBm.  This value indicates how strong
+     * the raw received RF signal from the base station is, but does not
+     * indicate the overall quality of the radio link.  Has no meaning when the
+     * device is not connected.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_RSSI] = g_param_spec_int(NM_DEVICE_WIMAX_RSSI,
                                                  "",
                                                  "",
@@ -287,14 +287,14 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
                                                  G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWimax:cinr:
-	 *
-	 * CINR (Carrier to Interference + Noise Ratio) of the current radio link
-	 * in dB.  CINR is a more accurate measure of radio link quality.  Has no
-	 * meaning when the device is not connected.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax:cinr:
+     *
+     * CINR (Carrier to Interference + Noise Ratio) of the current radio link
+     * in dB.  CINR is a more accurate measure of radio link quality.  Has no
+     * meaning when the device is not connected.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_CINR] = g_param_spec_int(NM_DEVICE_WIMAX_CINR,
                                                  "",
                                                  "",
@@ -304,14 +304,14 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
                                                  G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWimax:tx-power:
-	 *
-	 * Average power of the last burst transmitted by the device, in units of
-	 * 0.5 dBm.  i.e. a TxPower of -11 represents an actual device TX power of
-	 * -5.5 dBm.  Has no meaning when the device is not connected.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax:tx-power:
+     *
+     * Average power of the last burst transmitted by the device, in units of
+     * 0.5 dBm.  i.e. a TxPower of -11 represents an actual device TX power of
+     * -5.5 dBm.  Has no meaning when the device is not connected.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_TX_POWER] = g_param_spec_int(NM_DEVICE_WIMAX_TX_POWER,
                                                      "",
                                                      "",
@@ -321,13 +321,13 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWimax:bsid:
-	 *
-	 * The ID of the serving base station as received from the network.  Has
-	 * no meaning when the device is not connected.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax:bsid:
+     *
+     * The ID of the serving base station as received from the network.  Has
+     * no meaning when the device is not connected.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     obj_properties[PROP_BSID] = g_param_spec_string(NM_DEVICE_WIMAX_BSID,
                                                     "",
                                                     "",
@@ -335,10 +335,10 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWimax:nsps: (type GPtrArray(NMWimaxNsp))
-	 *
-	 * List of all WiMAX Network Service Providers the device can see.
-	 **/
+     * NMDeviceWimax:nsps: (type GPtrArray(NMWimaxNsp))
+     *
+     * List of all WiMAX Network Service Providers the device can see.
+     **/
     obj_properties[PROP_NSPS] = g_param_spec_boxed(NM_DEVICE_WIMAX_NSPS,
                                                    "",
                                                    "",
@@ -348,14 +348,14 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
     g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
     /**
-	 * NMDeviceWimax::nsp-added:
-	 * @self: the wimax device that received the signal
-	 * @nsp: the new NSP
-	 *
-	 * Notifies that a #NMWimaxNsp is added to the wimax device.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax::nsp-added:
+     * @self: the wimax device that received the signal
+     * @nsp: the new NSP
+     *
+     * Notifies that a #NMWimaxNsp is added to the wimax device.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     signals[NSP_ADDED] = g_signal_new("nsp-added",
                                       G_OBJECT_CLASS_TYPE(object_class),
                                       G_SIGNAL_RUN_FIRST,
@@ -368,14 +368,14 @@ nm_device_wimax_class_init(NMDeviceWimaxClass *wimax_class)
                                       G_TYPE_OBJECT);
 
     /**
-	 * NMDeviceWimax::nsp-removed:
-	 * @self: the wimax device that received the signal
-	 * @nsp: the removed NSP
-	 *
-	 * Notifies that a #NMWimaxNsp is removed from the wimax device.
-	 *
-	 * Deprecated: 1.2: WiMAX is no longer supported.
-	 **/
+     * NMDeviceWimax::nsp-removed:
+     * @self: the wimax device that received the signal
+     * @nsp: the removed NSP
+     *
+     * Notifies that a #NMWimaxNsp is removed from the wimax device.
+     *
+     * Deprecated: 1.2: WiMAX is no longer supported.
+     **/
     signals[NSP_REMOVED] = g_signal_new("nsp-removed",
                                         G_OBJECT_CLASS_TYPE(object_class),
                                         G_SIGNAL_RUN_FIRST,
diff --git a/libnm/nm-device-wireguard.c b/libnm/nm-device-wireguard.c
index 3af32d0c62..918819b2d3 100644
--- a/libnm/nm-device-wireguard.c
+++ b/libnm/nm-device-wireguard.c
@@ -152,12 +152,12 @@ nm_device_wireguard_class_init(NMDeviceWireGuardClass *wireguard_class)
     object_class->finalize     = finalize;
 
     /**
-	 * NMDeviceWireGuard:public-key:
-	 *
-	 * 32-byte public key, derived from the current private key.
-	 *
-	 * Since: 1.14
-	 **/
+     * NMDeviceWireGuard:public-key:
+     *
+     * 32-byte public key, derived from the current private key.
+     *
+     * Since: 1.14
+     **/
     obj_properties[PROP_PUBLIC_KEY] = g_param_spec_boxed(NM_DEVICE_WIREGUARD_PUBLIC_KEY,
                                                          "",
                                                          "",
@@ -165,13 +165,13 @@ nm_device_wireguard_class_init(NMDeviceWireGuardClass *wireguard_class)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWireGuard:listen-port:
-	 *
-	 * Local UDP listen port.
-	 * Set to 0 to allow a random port to be chosen (default).
-	 *
-	 * Since: 1.14
-	 **/
+     * NMDeviceWireGuard:listen-port:
+     *
+     * Local UDP listen port.
+     * Set to 0 to allow a random port to be chosen (default).
+     *
+     * Since: 1.14
+     **/
     obj_properties[PROP_LISTEN_PORT] = g_param_spec_uint(NM_DEVICE_WIREGUARD_LISTEN_PORT,
                                                          "",
                                                          "",
@@ -181,14 +181,14 @@ nm_device_wireguard_class_init(NMDeviceWireGuardClass *wireguard_class)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDeviceWireGuard:fwmark:
-	 *
-	 * Optional firewall mark - see ip-rule(8).
-	 * Used when setting routing policy for outgoing encrypted packets.
-	 * Set to 0 to disable the mark (default).
-	 *
-	 * Since: 1.14
-	 **/
+     * NMDeviceWireGuard:fwmark:
+     *
+     * Optional firewall mark - see ip-rule(8).
+     * Used when setting routing policy for outgoing encrypted packets.
+     * Set to 0 to disable the mark (default).
+     *
+     * Since: 1.14
+     **/
     obj_properties[PROP_FWMARK] = g_param_spec_uint(NM_DEVICE_WIREGUARD_FWMARK,
                                                     "",
                                                     "",
diff --git a/libnm/nm-device.c b/libnm/nm-device.c
index d5713e085e..9c8219671f 100644
--- a/libnm/nm-device.c
+++ b/libnm/nm-device.c
@@ -190,9 +190,9 @@ _notify_update_prop_state_reason(NMClient *              client,
     guint32          reason    = NM_DEVICE_STATE_REASON_NONE;
 
     /* We ignore the "State" property and the "StateChanged" signal of the device.
-	 * This information is redundant to the "StateReason" property, and we rely
-	 * on that one alone. In the best case, the information is identical. If it
-	 * would not be, then we stick to the information from "StateReason" property. */
+     * This information is redundant to the "StateReason" property, and we rely
+     * on that one alone. In the best case, the information is identical. If it
+     * would not be, then we stick to the information from "StateReason" property. */
 
     if (value)
         g_variant_get(value, "(uu)", &new_state, &reason);
@@ -613,10 +613,10 @@ nm_device_class_init(NMDeviceClass *klass)
     klass->connection_compatible = connection_compatible;
 
     /**
-	 * NMDevice:interface:
-	 *
-	 * The interface of the device.
-	 **/
+     * NMDevice:interface:
+     *
+     * The interface of the device.
+     **/
     obj_properties[PROP_INTERFACE] = g_param_spec_string(NM_DEVICE_INTERFACE,
                                                          "",
                                                          "",
@@ -624,11 +624,11 @@ nm_device_class_init(NMDeviceClass *klass)
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:ip-interface:
-	 *
-	 * The IP interface of the device which should be used for all IP-related
-	 * operations like addressing and routing.
-	 **/
+     * NMDevice:ip-interface:
+     *
+     * The IP interface of the device which should be used for all IP-related
+     * operations like addressing and routing.
+     **/
     obj_properties[PROP_IP_INTERFACE] =
         g_param_spec_string(NM_DEVICE_IP_INTERFACE,
                             "",
@@ -637,10 +637,10 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:device-type:
-	 *
-	 * The numeric type of the device.
-	 **/
+     * NMDevice:device-type:
+     *
+     * The numeric type of the device.
+     **/
     obj_properties[PROP_DEVICE_TYPE] = g_param_spec_enum(NM_DEVICE_DEVICE_TYPE,
                                                          "",
                                                          "",
@@ -648,29 +648,29 @@ nm_device_class_init(NMDeviceClass *klass)
                                                          NM_DEVICE_TYPE_UNKNOWN,
                                                          G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
     /**
-	 * NMDevice:udi:
-	 *
-	 * An operating-system specific device hardware identifier; this is not
-	 * unique to a specific hardware device across reboots or hotplugs.  It
-	 * is an opaque string which for some device types (Bluetooth, Modem)
-	 * contains an identifier provided by the underlying hardware service daemon
-	 * such as Bluez or ModemManager, and clients can use this property to
-	 * request more information about the device from those services.
-	 **/
+     * NMDevice:udi:
+     *
+     * An operating-system specific device hardware identifier; this is not
+     * unique to a specific hardware device across reboots or hotplugs.  It
+     * is an opaque string which for some device types (Bluetooth, Modem)
+     * contains an identifier provided by the underlying hardware service daemon
+     * such as Bluez or ModemManager, and clients can use this property to
+     * request more information about the device from those services.
+     **/
     obj_properties[PROP_UDI] =
         g_param_spec_string(NM_DEVICE_UDI, "", "", NULL, G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:path:
-	 *
-	 * The device path as exposed by the udev property ID_PATH.
-	 *
-	 * The string is backslash escaped (C escaping) for invalid
-	 * characters. The escaping can be reverted with g_strcompress(),
-	 * however the result may not be valid UTF-8.
-	 *
-	 * Since: 1.26
-	 **/
+     * NMDevice:path:
+     *
+     * The device path as exposed by the udev property ID_PATH.
+     *
+     * The string is backslash escaped (C escaping) for invalid
+     * characters. The escaping can be reverted with g_strcompress(),
+     * however the result may not be valid UTF-8.
+     *
+     * Since: 1.26
+     **/
     obj_properties[PROP_PATH] = g_param_spec_string(NM_DEVICE_PATH,
                                                     "",
                                                     "",
@@ -678,10 +678,10 @@ nm_device_class_init(NMDeviceClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:driver:
-	 *
-	 * The driver of the device.
-	 **/
+     * NMDevice:driver:
+     *
+     * The driver of the device.
+     **/
     obj_properties[PROP_DRIVER] = g_param_spec_string(NM_DEVICE_DRIVER,
                                                       "",
                                                       "",
@@ -689,10 +689,10 @@ nm_device_class_init(NMDeviceClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:driver-version:
-	 *
-	 * The version of the device driver.
-	 **/
+     * NMDevice:driver-version:
+     *
+     * The version of the device driver.
+     **/
     obj_properties[PROP_DRIVER_VERSION] =
         g_param_spec_string(NM_DEVICE_DRIVER_VERSION,
                             "",
@@ -701,10 +701,10 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:firmware-version:
-	 *
-	 * The firmware version of the device.
-	 **/
+     * NMDevice:firmware-version:
+     *
+     * The firmware version of the device.
+     **/
     obj_properties[PROP_FIRMWARE_VERSION] =
         g_param_spec_string(NM_DEVICE_FIRMWARE_VERSION,
                             "",
@@ -713,10 +713,10 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:capabilities:
-	 *
-	 * The capabilities of the device.
-	 **/
+     * NMDevice:capabilities:
+     *
+     * The capabilities of the device.
+     **/
     obj_properties[PROP_CAPABILITIES] =
         g_param_spec_flags(NM_DEVICE_CAPABILITIES,
                            "",
@@ -726,14 +726,14 @@ nm_device_class_init(NMDeviceClass *klass)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:real:
-	 *
-	 * Whether the device is real or is a placeholder device that could
-	 * be created automatically by NetworkManager if one of its
-	 * #NMDevice:available-connections was activated.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDevice:real:
+     *
+     * Whether the device is real or is a placeholder device that could
+     * be created automatically by NetworkManager if one of its
+     * #NMDevice:available-connections was activated.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_REAL] = g_param_spec_boolean(NM_DEVICE_REAL,
                                                      "",
                                                      "",
@@ -741,10 +741,10 @@ nm_device_class_init(NMDeviceClass *klass)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:managed:
-	 *
-	 * Whether the device is managed by NetworkManager.
-	 **/
+     * NMDevice:managed:
+     *
+     * Whether the device is managed by NetworkManager.
+     **/
     obj_properties[PROP_MANAGED] = g_param_spec_boolean(NM_DEVICE_MANAGED,
                                                         "",
                                                         "",
@@ -752,12 +752,12 @@ nm_device_class_init(NMDeviceClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:autoconnect:
-	 *
-	 * Whether the device can auto-activate a connection.
-	 *
-	 * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
-	 **/
+     * NMDevice:autoconnect:
+     *
+     * Whether the device can auto-activate a connection.
+     *
+     * The property setter is a synchronous D-Bus call. This is deprecated since 1.22.
+     **/
     obj_properties[PROP_AUTOCONNECT] =
         g_param_spec_boolean(NM_DEVICE_AUTOCONNECT,
                              "",
@@ -766,11 +766,11 @@ nm_device_class_init(NMDeviceClass *klass)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:firmware-missing:
-	 *
-	 * When %TRUE indicates the device is likely missing firmware required
-	 * for its operation.
-	 **/
+     * NMDevice:firmware-missing:
+     *
+     * When %TRUE indicates the device is likely missing firmware required
+     * for its operation.
+     **/
     obj_properties[PROP_FIRMWARE_MISSING] =
         g_param_spec_boolean(NM_DEVICE_FIRMWARE_MISSING,
                              "",
@@ -779,13 +779,13 @@ nm_device_class_init(NMDeviceClass *klass)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:nm-plugin-missing:
-	 *
-	 * When %TRUE indicates that the NetworkManager plugin for the device
-	 * is not installed.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDevice:nm-plugin-missing:
+     *
+     * When %TRUE indicates that the NetworkManager plugin for the device
+     * is not installed.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_NM_PLUGIN_MISSING] =
         g_param_spec_boolean(NM_DEVICE_NM_PLUGIN_MISSING,
                              "",
@@ -794,10 +794,10 @@ nm_device_class_init(NMDeviceClass *klass)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:ip4-config:
-	 *
-	 * The #NMIP4Config of the device.
-	 **/
+     * NMDevice:ip4-config:
+     *
+     * The #NMIP4Config of the device.
+     **/
     obj_properties[PROP_IP4_CONFIG] =
         g_param_spec_object(NM_DEVICE_IP4_CONFIG,
                             "",
@@ -806,10 +806,10 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:dhcp4-config:
-	 *
-	 * The IPv4 #NMDhcpConfig of the device.
-	 **/
+     * NMDevice:dhcp4-config:
+     *
+     * The IPv4 #NMDhcpConfig of the device.
+     **/
     obj_properties[PROP_DHCP4_CONFIG] =
         g_param_spec_object(NM_DEVICE_DHCP4_CONFIG,
                             "",
@@ -818,10 +818,10 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:ip6-config:
-	 *
-	 * The IPv6 #NMIPConfig of the device.
-	 **/
+     * NMDevice:ip6-config:
+     *
+     * The IPv6 #NMIPConfig of the device.
+     **/
     obj_properties[PROP_IP6_CONFIG] =
         g_param_spec_object(NM_DEVICE_IP6_CONFIG,
                             "",
@@ -830,10 +830,10 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:dhcp6-config:
-	 *
-	 * The IPv6 #NMDhcpConfig of the device.
-	 **/
+     * NMDevice:dhcp6-config:
+     *
+     * The IPv6 #NMDhcpConfig of the device.
+     **/
     obj_properties[PROP_DHCP6_CONFIG] =
         g_param_spec_object(NM_DEVICE_DHCP6_CONFIG,
                             "",
@@ -842,12 +842,12 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:ip4-connectivity:
-	 *
-	 * The IPv4 connectivity state of the device.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMDevice:ip4-connectivity:
+     *
+     * The IPv4 connectivity state of the device.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_IP4_CONNECTIVITY] =
         g_param_spec_enum(NM_DEVICE_IP4_CONNECTIVITY,
                           "",
@@ -857,12 +857,12 @@ nm_device_class_init(NMDeviceClass *klass)
                           G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:ip6-connectivity:
-	 *
-	 * The IPv6 connectivity state of the device.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMDevice:ip6-connectivity:
+     *
+     * The IPv6 connectivity state of the device.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_IP6_CONNECTIVITY] =
         g_param_spec_enum(NM_DEVICE_IP6_CONNECTIVITY,
                           "",
@@ -872,10 +872,10 @@ nm_device_class_init(NMDeviceClass *klass)
                           G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:state:
-	 *
-	 * The state of the device.
-	 **/
+     * NMDevice:state:
+     *
+     * The state of the device.
+     **/
     obj_properties[PROP_STATE] = g_param_spec_enum(NM_DEVICE_STATE,
                                                    "",
                                                    "",
@@ -884,10 +884,10 @@ nm_device_class_init(NMDeviceClass *klass)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:state-reason:
-	 *
-	 * The reason for the device state.
-	 **/
+     * NMDevice:state-reason:
+     *
+     * The reason for the device state.
+     **/
     obj_properties[PROP_STATE_REASON] =
         g_param_spec_uint(NM_DEVICE_STATE_REASON,
                           "",
@@ -898,10 +898,10 @@ nm_device_class_init(NMDeviceClass *klass)
                           G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:active-connection:
-	 *
-	 * The #NMActiveConnection object that "owns" this device during activation.
-	 **/
+     * NMDevice:active-connection:
+     *
+     * The #NMActiveConnection object that "owns" this device during activation.
+     **/
     obj_properties[PROP_ACTIVE_CONNECTION] =
         g_param_spec_object(NM_DEVICE_ACTIVE_CONNECTION,
                             "",
@@ -910,10 +910,10 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:available-connections: (type GPtrArray(NMRemoteConnection))
-	 *
-	 * The available connections of the device
-	 **/
+     * NMDevice:available-connections: (type GPtrArray(NMRemoteConnection))
+     *
+     * The available connections of the device
+     **/
     obj_properties[PROP_AVAILABLE_CONNECTIONS] =
         g_param_spec_boxed(NM_DEVICE_AVAILABLE_CONNECTIONS,
                            "",
@@ -922,10 +922,10 @@ nm_device_class_init(NMDeviceClass *klass)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:vendor:
-	 *
-	 * The vendor string of the device.
-	 **/
+     * NMDevice:vendor:
+     *
+     * The vendor string of the device.
+     **/
     obj_properties[PROP_VENDOR] = g_param_spec_string(NM_DEVICE_VENDOR,
                                                       "",
                                                       "",
@@ -933,10 +933,10 @@ nm_device_class_init(NMDeviceClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:product:
-	 *
-	 * The product string of the device.
-	 **/
+     * NMDevice:product:
+     *
+     * The product string of the device.
+     **/
     obj_properties[PROP_PRODUCT] = g_param_spec_string(NM_DEVICE_PRODUCT,
                                                        "",
                                                        "",
@@ -944,11 +944,11 @@ nm_device_class_init(NMDeviceClass *klass)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:physical-port-id:
-	 *
-	 * The physical port ID of the device. (See
-	 * nm_device_get_physical_port_id().)
-	 **/
+     * NMDevice:physical-port-id:
+     *
+     * The physical port ID of the device. (See
+     * nm_device_get_physical_port_id().)
+     **/
     obj_properties[PROP_PHYSICAL_PORT_ID] =
         g_param_spec_string(NM_DEVICE_PHYSICAL_PORT_ID,
                             "",
@@ -957,10 +957,10 @@ nm_device_class_init(NMDeviceClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:mtu:
-	 *
-	 * The MTU of the device.
-	 **/
+     * NMDevice:mtu:
+     *
+     * The MTU of the device.
+     **/
     obj_properties[PROP_MTU] = g_param_spec_uint(NM_DEVICE_MTU,
                                                  "",
                                                  "",
@@ -970,12 +970,12 @@ nm_device_class_init(NMDeviceClass *klass)
                                                  G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:metered:
-	 *
-	 * Whether the device is metered.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMDevice:metered:
+     *
+     * Whether the device is metered.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_METERED] = g_param_spec_uint(NM_DEVICE_METERED,
                                                      "",
                                                      "",
@@ -985,10 +985,10 @@ nm_device_class_init(NMDeviceClass *klass)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:lldp-neighbors:
-	 *
-	 * The LLDP neighbors.
-	 **/
+     * NMDevice:lldp-neighbors:
+     *
+     * The LLDP neighbors.
+     **/
     obj_properties[PROP_LLDP_NEIGHBORS] =
         g_param_spec_boxed(NM_DEVICE_LLDP_NEIGHBORS,
                            "",
@@ -997,12 +997,12 @@ nm_device_class_init(NMDeviceClass *klass)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:interface-flags:
-	 *
-	 * The interface flags.
-	 *
-	 * Since: 1.22
-	 **/
+     * NMDevice:interface-flags:
+     *
+     * The interface flags.
+     *
+     * Since: 1.22
+     **/
     obj_properties[PROP_INTERFACE_FLAGS] =
         g_param_spec_uint(NM_DEVICE_INTERFACE_FLAGS,
                           "",
@@ -1013,12 +1013,12 @@ nm_device_class_init(NMDeviceClass *klass)
                           G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDevice:hw-address:
-	 *
-	 * The hardware address of the device.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMDevice:hw-address:
+     *
+     * The hardware address of the device.
+     *
+     * Since: 1.24
+     **/
     obj_properties[PROP_HW_ADDRESS] =
         g_param_spec_string(NM_DEVICE_HW_ADDRESS,
                             "",
@@ -1029,14 +1029,14 @@ nm_device_class_init(NMDeviceClass *klass)
     _nml_dbus_meta_class_init_with_properties(object_class, &_nml_dbus_meta_iface_nm_device);
 
     /**
-	 * NMDevice::state-changed:
-	 * @device: the device object that received the signal
-	 * @new_state: the new state of the device
-	 * @old_state: the previous state of the device
-	 * @reason: the reason describing the state change
-	 *
-	 * Notifies the state change of a #NMDevice.
-	 **/
+     * NMDevice::state-changed:
+     * @device: the device object that received the signal
+     * @new_state: the new state of the device
+     * @old_state: the previous state of the device
+     * @reason: the reason describing the state change
+     *
+     * Notifies the state change of a #NMDevice.
+     **/
     signals[STATE_CHANGED] = g_signal_new("state-changed",
                                           G_OBJECT_CLASS_TYPE(object_class),
                                           G_SIGNAL_RUN_FIRST,
@@ -1209,7 +1209,7 @@ nm_device_get_type_description(NMDevice *device)
     const char *     desc, *typename;
 
     /* BEWARE: this function should return the same value
-	 * as nm_device_get_type_description() in nm-core. */
+     * as nm_device_get_type_description() in nm-core. */
 
     g_return_val_if_fail(NM_IS_DEVICE(device), NULL);
 
@@ -1244,7 +1244,7 @@ _nm_device_notify_update_prop_hw_address(NMClient *              client,
 
     if (!is_new && priv->hw_address_is_new) {
         /* once the instance is marked to honor the new property, the
-		 * changed signal for the old variant gets ignored. */
+         * changed signal for the old variant gets ignored. */
         goto out;
     }
 
@@ -1260,8 +1260,8 @@ _nm_device_notify_update_prop_hw_address(NMClient *              client,
                           _nml_coerce_property_str_not_empty(g_variant_get_string(value, NULL)));
 
     /* always emit a changed signal here, even if "priv->hw_address" might be unchanged.
-	 * We want to emit the signal because we received a PropertiesChanged signal on D-Bus,
-	 * even if nothing actually changed. */
+     * We want to emit the signal because we received a PropertiesChanged signal on D-Bus,
+     * even if nothing actually changed. */
     changed = TRUE;
 
 out:
@@ -1772,8 +1772,8 @@ get_bus_name(NMDevice *device)
         priv->bus_name = g_strdup(_("USB"));
     else {
         /* Use "" instead of NULL so we can tell later that we've
-		 * already tried.
-		 */
+         * already tried.
+         */
         priv->bus_name = g_strdup("");
     }
     udev_device_unref(udevice);
@@ -1812,8 +1812,8 @@ _get_udev_property(NMDevice *  device,
             return NULL;
     }
     /* Walk up the chain of the device and its parents a few steps to grab
-	 * vendor and device ID information off it.
-	 */
+     * vendor and device ID information off it.
+     */
     tmpdev = udev_device;
     while ((count++ < 3) && tmpdev && !enc_value) {
         if (!enc_value)
@@ -1827,7 +1827,7 @@ _get_udev_property(NMDevice *  device,
     udev_device_unref(udev_device);
 
     /* Prefer the hwdata database value over what comes directly
-	 * from the device. */
+     * from the device. */
     if (db_value) {
         g_free(enc_value);
         return db_value;
@@ -1940,8 +1940,8 @@ ensure_description(NMDevice *device)
         short_product = g_strdup(get_type_name(device));
 
     /* Another quick hack; if all of the fixed up vendor string
-	 * is found in product, ignore the vendor.
-	 */
+     * is found in product, ignore the vendor.
+     */
     {
         gs_free char *pdown = g_ascii_strdown(short_product, -1);
         gs_free char *vdown = g_ascii_strdown(priv->short_vendor, -1);
@@ -2040,8 +2040,8 @@ nm_device_disambiguate_names(NMDevice **devices, int num_devices)
         goto done;
 
     /* Try specific names (eg, "Ethernet" and "InfiniBand" rather
-	 * than "Wired")
-	 */
+     * than "Wired")
+     */
     for (i = 0; i < num_devices; i++) {
         if (duplicates[i]) {
             g_free(names[i]);
@@ -2063,11 +2063,11 @@ nm_device_disambiguate_names(NMDevice **devices, int num_devices)
             g_free(names[i]);
             name = get_device_type_name_with_iface(devices[i]);
             /* TRANSLATORS: the first %s is a bus name (eg, "USB") or
-			 * product name, the second is a device type (eg,
-			 * "Ethernet"). You can change this to something like
-			 * "%2$s (%1$s)" if there's no grammatical way to combine
-			 * the strings otherwise.
-			 */
+             * product name, the second is a device type (eg,
+             * "Ethernet"). You can change this to something like
+             * "%2$s (%1$s)" if there's no grammatical way to combine
+             * the strings otherwise.
+             */
             names[i] = g_strdup_printf(C_("long device name", "%s %s"), bus, name);
             g_free(name);
         }
@@ -2095,8 +2095,8 @@ nm_device_disambiguate_names(NMDevice **devices, int num_devices)
         goto done;
 
     /* If dealing with Bluetooth devices, try to distinguish them by
-	 * device name.
-	 */
+     * device name.
+     */
     for (i = 0; i < num_devices; i++) {
         if (duplicates[i] && NM_IS_DEVICE_BT(devices[i])) {
             const char *devname = nm_device_bt_get_name(NM_DEVICE_BT(devices[i]));
@@ -2115,8 +2115,8 @@ nm_device_disambiguate_names(NMDevice **devices, int num_devices)
         goto done;
 
     /* We have multiple identical network cards, so we have to differentiate
-	 * them by interface name.
-	 */
+     * them by interface name.
+     */
     for (i = 0; i < num_devices; i++) {
         if (duplicates[i]) {
             const char *interface = nm_device_get_iface(devices[i]);
diff --git a/libnm/nm-dhcp-config.c b/libnm/nm-dhcp-config.c
index 5b57d2b194..a8f46120a2 100644
--- a/libnm/nm-dhcp-config.c
+++ b/libnm/nm-dhcp-config.c
@@ -132,11 +132,11 @@ nm_dhcp_config_class_init(NMDhcpConfigClass *config_class)
     object_class->finalize     = finalize;
 
     /**
-	 * NMDhcpConfig:family:
-	 *
-	 * The IP address family of the configuration; either
-	 * <literal>AF_INET</literal> or <literal>AF_INET6</literal>.
-	 **/
+     * NMDhcpConfig:family:
+     *
+     * The IP address family of the configuration; either
+     * <literal>AF_INET</literal> or <literal>AF_INET6</literal>.
+     **/
     obj_properties[PROP_FAMILY] = g_param_spec_int(NM_DHCP_CONFIG_FAMILY,
                                                    "",
                                                    "",
@@ -146,10 +146,10 @@ nm_dhcp_config_class_init(NMDhcpConfigClass *config_class)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMDhcpConfig:options: (type GHashTable(utf8,utf8)):
-	 *
-	 * The #GHashTable containing options of the configuration.
-	 **/
+     * NMDhcpConfig:options: (type GHashTable(utf8,utf8)):
+     *
+     * The #GHashTable containing options of the configuration.
+     **/
     obj_properties[PROP_OPTIONS] = g_param_spec_boxed(NM_DHCP_CONFIG_OPTIONS,
                                                       "",
                                                       "",
diff --git a/libnm/nm-ip-config.c b/libnm/nm-ip-config.c
index ddbe728c83..bb86431ef2 100644
--- a/libnm/nm-ip-config.c
+++ b/libnm/nm-ip-config.c
@@ -406,11 +406,11 @@ nm_ip_config_class_init(NMIPConfigClass *config_class)
     object_class->finalize     = finalize;
 
     /**
-	 * NMIPConfig:family:
-	 *
-	 * The IP address family of the configuration; either
-	 * <literal>AF_INET</literal> or <literal>AF_INET6</literal>.
-	 **/
+     * NMIPConfig:family:
+     *
+     * The IP address family of the configuration; either
+     * <literal>AF_INET</literal> or <literal>AF_INET6</literal>.
+     **/
     obj_properties[PROP_FAMILY] = g_param_spec_int(NM_IP_CONFIG_FAMILY,
                                                    "",
                                                    "",
@@ -420,10 +420,10 @@ nm_ip_config_class_init(NMIPConfigClass *config_class)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMIPConfig:gateway:
-	 *
-	 * The IP gateway address of the configuration as string.
-	 **/
+     * NMIPConfig:gateway:
+     *
+     * The IP gateway address of the configuration as string.
+     **/
     obj_properties[PROP_GATEWAY] = g_param_spec_string(NM_IP_CONFIG_GATEWAY,
                                                        "",
                                                        "",
@@ -431,10 +431,10 @@ nm_ip_config_class_init(NMIPConfigClass *config_class)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMIPConfig:addresses:
-	 *
-	 * A #GPtrArray containing the addresses (#NMIPAddress) of the configuration.
-	 **/
+     * NMIPConfig:addresses:
+     *
+     * A #GPtrArray containing the addresses (#NMIPAddress) of the configuration.
+     **/
     obj_properties[PROP_ADDRESSES] = g_param_spec_boxed(NM_IP_CONFIG_ADDRESSES,
                                                         "",
                                                         "",
@@ -442,10 +442,10 @@ nm_ip_config_class_init(NMIPConfigClass *config_class)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMIPConfig:routes: (type GPtrArray(NMIPRoute))
-	 *
-	 * A #GPtrArray containing the routes (#NMIPRoute) of the configuration.
-	 **/
+     * NMIPConfig:routes: (type GPtrArray(NMIPRoute))
+     *
+     * A #GPtrArray containing the routes (#NMIPRoute) of the configuration.
+     **/
     obj_properties[PROP_ROUTES] = g_param_spec_boxed(NM_IP_CONFIG_ROUTES,
                                                      "",
                                                      "",
@@ -453,10 +453,10 @@ nm_ip_config_class_init(NMIPConfigClass *config_class)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMIPConfig:nameservers:
-	 *
-	 * The array containing name server IP addresses of the configuration.
-	 **/
+     * NMIPConfig:nameservers:
+     *
+     * The array containing name server IP addresses of the configuration.
+     **/
     obj_properties[PROP_NAMESERVERS] =
         g_param_spec_boxed(NM_IP_CONFIG_NAMESERVERS,
                            "",
@@ -465,10 +465,10 @@ nm_ip_config_class_init(NMIPConfigClass *config_class)
                            G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMIPConfig:domains:
-	 *
-	 * The array containing domain strings of the configuration.
-	 **/
+     * NMIPConfig:domains:
+     *
+     * The array containing domain strings of the configuration.
+     **/
     obj_properties[PROP_DOMAINS] = g_param_spec_boxed(NM_IP_CONFIG_DOMAINS,
                                                       "",
                                                       "",
@@ -476,10 +476,10 @@ nm_ip_config_class_init(NMIPConfigClass *config_class)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMIPConfig:searches:
-	 *
-	 * The array containing DNS search strings of the configuration.
-	 **/
+     * NMIPConfig:searches:
+     *
+     * The array containing DNS search strings of the configuration.
+     **/
     obj_properties[PROP_SEARCHES] = g_param_spec_boxed(NM_IP_CONFIG_SEARCHES,
                                                        "",
                                                        "",
@@ -487,11 +487,11 @@ nm_ip_config_class_init(NMIPConfigClass *config_class)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMIPConfig:wins-servers:
-	 *
-	 * The array containing WINS server IP addresses of the configuration.
-	 * (This will always be empty for IPv6 configurations.)
-	 **/
+     * NMIPConfig:wins-servers:
+     *
+     * The array containing WINS server IP addresses of the configuration.
+     * (This will always be empty for IPv6 configurations.)
+     **/
     obj_properties[PROP_WINS_SERVERS] =
         g_param_spec_boxed(NM_IP_CONFIG_WINS_SERVERS,
                            "",
diff --git a/libnm/nm-libnm-aux/nm-libnm-aux.c b/libnm/nm-libnm-aux/nm-libnm-aux.c
index 4c6dc0671c..1efefe2048 100644
--- a/libnm/nm-libnm-aux/nm-libnm-aux.c
+++ b/libnm/nm-libnm-aux/nm-libnm-aux.c
@@ -97,10 +97,10 @@ nmc_client_new_waitsync(GCancellable *cancellable,
 
 #if NM_MORE_ASSERTS > 10
     /* The sync initialization of NMClient is generally a bad idea, because it
-	 * brings the overhead of an additional GMainContext. Anyway, since our own
-	 * code no longer uses that, we hardly test those code paths. But they should
-	 * work just the same. Randomly use instead the sync initialization in a debug
-	 * build... */
+     * brings the overhead of an additional GMainContext. Anyway, since our own
+     * code no longer uses that, we hardly test those code paths. But they should
+     * work just the same. Randomly use instead the sync initialization in a debug
+     * build... */
     if ((g_random_int() % 2) == 0) {
         gboolean success;
 
@@ -109,7 +109,7 @@ nmc_client_new_waitsync(GCancellable *cancellable,
         va_end(ap);
 
         /* iterate the context at least once, just so that the behavior from POV of the
-		 * caller is roughly the same. */
+         * caller is roughly the same. */
         g_main_context_iteration(nm_client_get_main_context(nmc), FALSE);
 
         success = g_initable_init(G_INITABLE(nmc), cancellable, error);
diff --git a/libnm/nm-libnm-utils.c b/libnm/nm-libnm-utils.c
index 51b7ce6fc1..21df8c86b4 100644
--- a/libnm/nm-libnm-utils.c
+++ b/libnm/nm-libnm-utils.c
@@ -48,8 +48,8 @@ _nml_dbus_log(NMLDBusLogLevel level, gboolean use_stdout, const char *fmt, ...)
     gint64          ts;
 
     /* we only call _nml_dbus_log() after nml_dbus_log_enabled(), which already does
-	 * an atomic access to the variable. Since the value is only initialized once and
-	 * never changes, we can just access it without additional locking. */
+     * an atomic access to the variable. Since the value is only initialized once and
+     * never changes, we can just access it without additional locking. */
     configured_log_level = _nml_dbus_log_level;
 
     nm_assert(level & configured_log_level);
@@ -172,16 +172,16 @@ _fixup_string(const char *       desc,
             const char *eow = &p[strlen(ignored_phrases[i])];
 
             /* require that the phrase is delimited by space, or
-			 * at the beginning or end of the description. */
+             * at the beginning or end of the description. */
             if ((p == desc_full || p[-1] == ' ') && NM_IN_SET(eow[0], '\0', ' '))
                 memmove(p, eow, strlen(eow) + 1); /* +1 for the \0 */
         }
     }
 
     /* Attempt to shorten ID by ignoring certain individual words.
-	 * - word-split the description at spaces
-	 * - coalesce multiple spaces
-	 * - skip over ignored_words */
+     * - word-split the description at spaces
+     * - coalesce multiple spaces
+     * - skip over ignored_words */
     p = desc_full;
     q = desc_full;
     for (;;) {
@@ -222,12 +222,12 @@ next:
     p = strchr(desc_full, '[');
     if (p == desc_full) {
         /* All we're left with is in square brackets.
-		 * Always prefer that to a blank string.*/
+         * Always prefer that to a blank string.*/
         square_brackets_sensible = TRUE;
     }
     if (square_brackets_sensible) {
         /* If there's a [<string>] that survived the substitution, then the string
-		 * is a short form that is generally preferable. */
+         * is a short form that is generally preferable. */
         q = strchr(desc_full, ']');
         if (p && q > p) {
             p++;
@@ -236,7 +236,7 @@ next:
         }
     } else {
         /* [<string>] sometimes contains the preferred human-readable name, but
-		 * mostly it's utterly useless. Sigh. Drop it. */
+         * mostly it's utterly useless. Sigh. Drop it. */
         if (p) {
             if (p > desc_full && p[-1] == ' ')
                 p--;
@@ -736,9 +736,9 @@ nml_dbus_meta_iface_get(const char *dbus_iface_name)
     G_STATIC_ASSERT_EXPR(G_STRUCT_OFFSET(NMLDBusMetaIface, dbus_iface_name) == 0);
 
     /* we assume that NetworkManager only uses unique interface names. E.g. one
-	 * interface name always has one particular meaning (and offers one set of
-	 * properties, signals and methods). This is a convenient assumption, and
-	 * we sure would never violate it when extending NM's D-Bus API. */
+     * interface name always has one particular meaning (and offers one set of
+     * properties, signals and methods). This is a convenient assumption, and
+     * we sure would never violate it when extending NM's D-Bus API. */
 
     if (NM_STR_HAS_PREFIX(dbus_iface_name, COMMON_PREFIX)) {
         /* optimize, that in fact all our interfaces have the same prefix. */
@@ -866,6 +866,6 @@ nm_utils_g_param_spec_is_default(const GParamSpec *pspec)
     }
 
     /* This function is only used for asserting/testing. It thus
-	 * strictly asserts and only support argument types that we expect. */
+     * strictly asserts and only support argument types that we expect. */
     g_return_val_if_reached(FALSE);
 }
diff --git a/libnm/nm-libnm-utils.h b/libnm/nm-libnm-utils.h
index 2f29977263..e7d1d9650f 100644
--- a/libnm/nm-libnm-utils.h
+++ b/libnm/nm-libnm-utils.h
@@ -34,18 +34,18 @@ typedef enum {
     _NML_DBUS_LOG_LEVEL_DEBUG = 0x04,
 
     /* the difference between a warning and a critical is that it results in
-	 * g_warning() vs. g_critical() messages. Note that we want to use "warnings"
-	 * for unknown D-Bus API that could just result because we run against a
-	 * newer NetworkManager version (such warnings are more graceful, because
-	 * we want that libnm can be forward compatible against newer servers).
-	 * Critical warnings should be emitted when NetworkManager exposes something
-	 * on D-Bus that breaks the current expectations. Usually NetworkManager
-	 * should not break API, hence such issues are more severe. */
+     * g_warning() vs. g_critical() messages. Note that we want to use "warnings"
+     * for unknown D-Bus API that could just result because we run against a
+     * newer NetworkManager version (such warnings are more graceful, because
+     * we want that libnm can be forward compatible against newer servers).
+     * Critical warnings should be emitted when NetworkManager exposes something
+     * on D-Bus that breaks the current expectations. Usually NetworkManager
+     * should not break API, hence such issues are more severe. */
     _NML_DBUS_LOG_LEVEL_WARN  = 0x08,
     _NML_DBUS_LOG_LEVEL_ERROR = 0x10,
 
     /* ANY is only relevant for nml_dbus_log_enabled() to check whether any of the
-	 * options is on. */
+     * options is on. */
     NML_DBUS_LOG_LEVEL_ANY = _NML_DBUS_LOG_LEVEL_INITIALIZED,
 
     NML_DBUS_LOG_LEVEL_TRACE = _NML_DBUS_LOG_LEVEL_TRACE,
@@ -218,8 +218,8 @@ typedef struct _NMLDBusPropertyAO NMLDBusPropertyAO;
 
 typedef enum {
     /* See comments below for NMLDBusMetaIface.interface_prio.
-	 *
-	 * Higher numbers means more important to detect the GObject type. */
+     *
+     * Higher numbers means more important to detect the GObject type. */
     NML_DBUS_META_INTERFACE_PRIO_NONE             = 0,
     NML_DBUS_META_INTERFACE_PRIO_NMCLIENT         = 1,
     NML_DBUS_META_INTERFACE_PRIO_PARENT_TYPE      = 2,
@@ -235,8 +235,8 @@ typedef struct {
     GType (*get_o_type_fcn)(void);
 
     /* Ignore whether the referenced NMObject is ready or not. That means,
-	 * the property is always ready (and if the pointed object itself is
-	 * not yet ready, the property pretends to be %NULL for the moment. */
+     * the property is always ready (and if the pointed object itself is
+     * not yet ready, the property pretends to be %NULL for the moment. */
     bool is_always_ready : 1;
 
 } NMLDBusPropertVTableO;
@@ -277,8 +277,8 @@ typedef struct {
     gboolean (*check_nmobj_visible_fcn)(GObject *nmobj);
 
     /* Ignore whether the referenced NMObject is ready or not. That means,
-	 * the property is always ready (and if the pointed object itself is
-	 * not yet ready, the property pretends to be %NULL for the moment. */
+     * the property is always ready (and if the pointed object itself is
+     * not yet ready, the property pretends to be %NULL for the moment. */
     bool is_always_ready : 1;
 
 } NMLDBusPropertVTableAO;
@@ -463,16 +463,16 @@ struct _NMLDBusMetaIface {
     GType (*get_type_fcn)(void);
 
     /* Usually there is a one-to-one correspondence between the properties
-	 * on D-Bus (dbus_properties) and the GObject properties (obj_properties).
-	 *
-	 * With:
-	 *     meta_iface->obj_properties[o_idx]    (o_idx < n_obj_properties)
-	 *     &meta_iface->dbus_properties[d_idx]  (d_idx < n_dbus_properties)
-	 * it follows that
-	 *     assert (meta_iface->obj_properties_reverse_idx[o_idx] == d_idx)
-	 *     assert (meta_iface->dbus_properties[d_idx].obj_properties_idx == o_idx)
-	 * if (and only if) two properties correspond.
-	 */
+     * on D-Bus (dbus_properties) and the GObject properties (obj_properties).
+     *
+     * With:
+     *     meta_iface->obj_properties[o_idx]    (o_idx < n_obj_properties)
+     *     &meta_iface->dbus_properties[d_idx]  (d_idx < n_dbus_properties)
+     * it follows that
+     *     assert (meta_iface->obj_properties_reverse_idx[o_idx] == d_idx)
+     *     assert (meta_iface->dbus_properties[d_idx].obj_properties_idx == o_idx)
+     * if (and only if) two properties correspond.
+     */
     const GParamSpec *const *  obj_properties;
     const NMLDBusMetaProperty *dbus_properties;
     const guint8 *             obj_properties_reverse_idx;
@@ -481,51 +481,51 @@ struct _NMLDBusMetaIface {
     guint8 n_obj_properties;
 
     /* The offsets "prop_struct_offset" in NMLDBusMetaProperty are based on some base
-	 * struct. If "base_struct_offset" is 0, then the base struct is the GObject pointer
-	 * itself.
-	 * If this is non-null, then we expect at that location a pointer to the offset.
-	 * In this case we need to first find the base pointer via
-	 *   *((gpointer *) ((char *) nmobj + meta_iface->base_struct_offset)).
-	 *
-	 * This covers NMDeviceBridge._priv vs. NMDevice._priv. In the second case,
-	 * _priv is a pointer that we first need to follow.
-	 */
+     * struct. If "base_struct_offset" is 0, then the base struct is the GObject pointer
+     * itself.
+     * If this is non-null, then we expect at that location a pointer to the offset.
+     * In this case we need to first find the base pointer via
+     *   *((gpointer *) ((char *) nmobj + meta_iface->base_struct_offset)).
+     *
+     * This covers NMDeviceBridge._priv vs. NMDevice._priv. In the second case,
+     * _priv is a pointer that we first need to follow.
+     */
     guint8 base_struct_offset;
 
     /* We create the appropriate NMObject GType based on the D-Bus interfaces that
-	 * are present. For example, if we see a "org.freedesktop.NetworkManager.Device.Bridge"
-	 * interface, we create a NMDeviceBridge. Basically, if it looks like a certain
-	 * object (based on the D-Bus interface), we assume it is.
-	 *
-	 * Some interfaces are purely additional ("org.freedesktop.NetworkManager.Device.Statistics")
-	 * and don't determine the NMObject type (%NML_DBUS_META_INTERFACE_PRIO_NONE).
-	 *
-	 * Some interfaces are of a parent type ("org.freedesktop.NetworkManager.Device" for
-	 * NMDevice), and don't determine the type either (%NML_DBUS_META_INTERFACE_PRIO_PARENT_TYPE).
-	 *
-	 * Some interfaces ("org.freedesktop.NetworkManager.AgentManager") belong to NMClient
-	 * itself. Those have priority %NML_DBUS_META_INTERFACE_PRIO_NMCLIENT.
-	 *
-	 * In most cases, each D-Bus object is expected to have only one D-Bus interface
-	 * to determine the type. While theoretically an object
-	 * "/org/freedesktop/NetworkManager/Devices/3" could have interfaces "org.freedesktop.NetworkManager.Device.Bridge"
-	 * and "org.freedesktop.NetworkManager.Device.Bond" at the same time, in practice it doesn't.
-	 * Note that we also assume that once a D-Bus object gets a NMObject, it cannot change (*).
-	 * NetworkManager's API does not add/remove interfaces after exporting the object the
-	 * first time, so in practice each D-Bus object is expected to have a suitable D-Bus
-	 * interface (and only determining interface, which doesn't change). Those interfaces have
-	 * priority %NML_DBUS_META_INTERFACE_PRIO_INSTANTIATE_HIGH.
-	 *
-	 * (*) note that nothing bad would happen if a faulty NetworkManager would violate that.
-	 * Of course, something would not work correctly, but the D-Bus interface we find is unexpected
-	 * and wrong.
-	 *
-	 * One exception is "org.freedesktop.NetworkManager.Connection.Active". This can either
-	 * be a NMActiveConnection or a NMVpnConnection. Hence, this profile has priority
-	 * %NML_DBUS_META_INTERFACE_PRIO_INSTANTIATE_LOW, and depending on whether there is
-	 * a "org.freedesktop.NetworkManager.VPN.Connection" (with high priority), we create
-	 * one or the other type.
-	 */
+     * are present. For example, if we see a "org.freedesktop.NetworkManager.Device.Bridge"
+     * interface, we create a NMDeviceBridge. Basically, if it looks like a certain
+     * object (based on the D-Bus interface), we assume it is.
+     *
+     * Some interfaces are purely additional ("org.freedesktop.NetworkManager.Device.Statistics")
+     * and don't determine the NMObject type (%NML_DBUS_META_INTERFACE_PRIO_NONE).
+     *
+     * Some interfaces are of a parent type ("org.freedesktop.NetworkManager.Device" for
+     * NMDevice), and don't determine the type either (%NML_DBUS_META_INTERFACE_PRIO_PARENT_TYPE).
+     *
+     * Some interfaces ("org.freedesktop.NetworkManager.AgentManager") belong to NMClient
+     * itself. Those have priority %NML_DBUS_META_INTERFACE_PRIO_NMCLIENT.
+     *
+     * In most cases, each D-Bus object is expected to have only one D-Bus interface
+     * to determine the type. While theoretically an object
+     * "/org/freedesktop/NetworkManager/Devices/3" could have interfaces "org.freedesktop.NetworkManager.Device.Bridge"
+     * and "org.freedesktop.NetworkManager.Device.Bond" at the same time, in practice it doesn't.
+     * Note that we also assume that once a D-Bus object gets a NMObject, it cannot change (*).
+     * NetworkManager's API does not add/remove interfaces after exporting the object the
+     * first time, so in practice each D-Bus object is expected to have a suitable D-Bus
+     * interface (and only determining interface, which doesn't change). Those interfaces have
+     * priority %NML_DBUS_META_INTERFACE_PRIO_INSTANTIATE_HIGH.
+     *
+     * (*) note that nothing bad would happen if a faulty NetworkManager would violate that.
+     * Of course, something would not work correctly, but the D-Bus interface we find is unexpected
+     * and wrong.
+     *
+     * One exception is "org.freedesktop.NetworkManager.Connection.Active". This can either
+     * be a NMActiveConnection or a NMVpnConnection. Hence, this profile has priority
+     * %NML_DBUS_META_INTERFACE_PRIO_INSTANTIATE_LOW, and depending on whether there is
+     * a "org.freedesktop.NetworkManager.VPN.Connection" (with high priority), we create
+     * one or the other type.
+     */
     NMLDBusMetaInteracePrio interface_prio : 3;
 };
 
@@ -632,22 +632,22 @@ struct _NMLDBusObject {
     NMRefString *dbus_path;
 
     /* While the object is tracked by NMClient, it is linked with this list.
-	 * The lists are partitioned based on the NMLDBusObjState. */
+     * The lists are partitioned based on the NMLDBusObjState. */
     CList dbus_objects_lst;
 
     /* The list of D-Bus interface NMLDBusObjIfaceData.
-	 *
-	 * Some may be about to be removed (iface_removed) or
-	 * unknown (!dbus_iface_is_wellknown). */
+     *
+     * Some may be about to be removed (iface_removed) or
+     * unknown (!dbus_iface_is_wellknown). */
     CList iface_lst_head;
 
     /* The list of registered NMLDBusObjWatcher. */
     CList watcher_lst_head;
 
     /* When an object changes (e.g. because of new information on D-Bus), we often
-	 * don't process the changes right away, but enqueue the object in a changed
-	 * list. This list goes together with obj_changed_type property below, which
-	 * tracks what changed. */
+     * don't process the changes right away, but enqueue the object in a changed
+     * list. This list goes together with obj_changed_type property below, which
+     * tracks what changed. */
     CList obj_changed_lst;
 
     GObject *nmobj;
diff --git a/libnm/nm-object.c b/libnm/nm-object.c
index 356a2bde04..9de12e639b 100644
--- a/libnm/nm-object.c
+++ b/libnm/nm-object.c
@@ -287,10 +287,10 @@ nm_object_class_init(NMObjectClass *klass)
     klass->obj_changed_notify = obj_changed_notify;
 
     /**
-	 * NMObject:path:
-	 *
-	 * The D-Bus object path.
-	 **/
+     * NMObject:path:
+     *
+     * The D-Bus object path.
+     **/
     obj_properties[PROP_PATH] = g_param_spec_string(NM_OBJECT_PATH,
                                                     "",
                                                     "",
diff --git a/libnm/nm-remote-connection.c b/libnm/nm-remote-connection.c
index 2b442add99..3a5524fade 100644
--- a/libnm/nm-remote-connection.c
+++ b/libnm/nm-remote-connection.c
@@ -772,11 +772,11 @@ nm_remote_connection_class_init(NMRemoteConnectionClass *klass)
     nm_object_class->unregister_client = unregister_client;
 
     /**
-	 * NMRemoteConnection:unsaved:
-	 *
-	 * %TRUE if the remote connection contains changes that have not been saved
-	 * to disk, %FALSE if the connection is the same as its on-disk representation.
-	 **/
+     * NMRemoteConnection:unsaved:
+     *
+     * %TRUE if the remote connection contains changes that have not been saved
+     * to disk, %FALSE if the connection is the same as its on-disk representation.
+     **/
     obj_properties[PROP_UNSAVED] = g_param_spec_boolean(NM_REMOTE_CONNECTION_UNSAVED,
                                                         "",
                                                         "",
@@ -784,13 +784,13 @@ nm_remote_connection_class_init(NMRemoteConnectionClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMRemoteConnection:flags:
-	 *
-	 * The flags of the connection as unsigned integer. The values
-	 * correspond to the #NMSettingsConnectionFlags enum.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMRemoteConnection:flags:
+     *
+     * The flags of the connection as unsigned integer. The values
+     * correspond to the #NMSettingsConnectionFlags enum.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_FLAGS] = g_param_spec_uint(NM_REMOTE_CONNECTION_FLAGS,
                                                    "",
                                                    "",
@@ -800,13 +800,13 @@ nm_remote_connection_class_init(NMRemoteConnectionClass *klass)
                                                    G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMRemoteConnection:filename:
-	 *
-	 * File that stores the connection in case the connection is
-	 * file-backed.
-	 *
-	 * Since: 1.12
-	 **/
+     * NMRemoteConnection:filename:
+     *
+     * File that stores the connection in case the connection is
+     * file-backed.
+     *
+     * Since: 1.12
+     **/
     obj_properties[PROP_FILENAME] = g_param_spec_string(NM_REMOTE_CONNECTION_FILENAME,
                                                         "",
                                                         "",
@@ -814,16 +814,16 @@ nm_remote_connection_class_init(NMRemoteConnectionClass *klass)
                                                         G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMRemoteConnection:visible:
-	 *
-	 * %TRUE if the remote connection is visible to the current user, %FALSE if
-	 * not.  If the connection is not visible then it is essentially useless; it
-	 * will not contain any settings, and operations such as
-	 * nm_remote_connection_save() and nm_remote_connection_delete() will always
-	 * fail. (#NMRemoteSettings will not normally return non-visible connections
-	 * to callers, but it is possible for a connection's visibility to change
-	 * after you already have a reference to it.)
-	 **/
+     * NMRemoteConnection:visible:
+     *
+     * %TRUE if the remote connection is visible to the current user, %FALSE if
+     * not.  If the connection is not visible then it is essentially useless; it
+     * will not contain any settings, and operations such as
+     * nm_remote_connection_save() and nm_remote_connection_delete() will always
+     * fail. (#NMRemoteSettings will not normally return non-visible connections
+     * to callers, but it is possible for a connection's visibility to change
+     * after you already have a reference to it.)
+     **/
     obj_properties[PROP_VISIBLE] = g_param_spec_boolean(NM_REMOTE_CONNECTION_VISIBLE,
                                                         "",
                                                         "",
diff --git a/libnm/nm-secret-agent-old.c b/libnm/nm-secret-agent-old.c
index 57d0628139..4cc47bb133 100644
--- a/libnm/nm-secret-agent-old.c
+++ b/libnm/nm-secret-agent-old.c
@@ -80,11 +80,11 @@ typedef struct {
     bool registration_force_unregister : 1;
 
     /* This is true, if we either are in the process of RegisterWithCapabilities() or
-	 * are already successfully registered.
-	 *
-	 * This is only TRUE, if the name owner was authenticated to run as root user.
-	 *
-	 * It also means, we should follow up with an Unregister() call during shutdown. */
+     * are already successfully registered.
+     *
+     * This is only TRUE, if the name owner was authenticated to run as root user.
+     *
+     * It also means, we should follow up with an Unregister() call during shutdown. */
     bool registered_against_server : 1;
 
     bool is_initialized : 1;
@@ -723,16 +723,16 @@ nm_secret_agent_old_register(NMSecretAgentOld *self, GCancellable *cancellable,
         return FALSE;
 
     /* This is a synchronous function, meaning: we are not allowed to iterate
-	 * the caller's GMainContext. This is a catch 22, because we don't want
-	 * to perform synchronous calls that bypasses the ordering of our otherwise
-	 * asynchronous mode of operation. Hence, we always signal success.
-	 * That's why this function is deprecated.
-	 *
-	 * So despite claiming success, we might still be in the process of registering
-	 * or NetworkManager might not be available.
-	 *
-	 * This is a change in behavior with respect to libnm before 1.24.
-	 */
+     * the caller's GMainContext. This is a catch 22, because we don't want
+     * to perform synchronous calls that bypasses the ordering of our otherwise
+     * asynchronous mode of operation. Hence, we always signal success.
+     * That's why this function is deprecated.
+     *
+     * So despite claiming success, we might still be in the process of registering
+     * or NetworkManager might not be available.
+     *
+     * This is a change in behavior with respect to libnm before 1.24.
+     */
     return TRUE;
 }
 
@@ -1145,14 +1145,14 @@ _register_call_cb(GObject *source, GAsyncResult *result, gpointer user_data)
 
     if (error) {
         /* registration apparently failed. However we still keep priv->registered_against_server TRUE, because
-		 *
-		 * - eventually we want to still make an Unregister() call. Even if it probably has no effect,
-		 *   better be sure.
-		 *
-		 * - we actually accept secret request (from the right name owner). We register so that
-		 *   NetworkManager knows that we are here. We don't require the registration to succeed
-		 *   for our purpose. If NetworkManager makes requests for us, despite the registration
-		 *   failing, that is fine. */
+         *
+         * - eventually we want to still make an Unregister() call. Even if it probably has no effect,
+         *   better be sure.
+         *
+         * - we actually accept secret request (from the right name owner). We register so that
+         *   NetworkManager knows that we are here. We don't require the registration to succeed
+         *   for our purpose. If NetworkManager makes requests for us, despite the registration
+         *   failing, that is fine. */
         _LOGT("register: registration failed with error \"%s\"", error->message);
         goto out;
     }
@@ -1227,9 +1227,9 @@ _get_connection_unix_user_cb(GObject *source, GAsyncResult *result, gpointer use
                   error->message);
 
         /* we actually don't do anything and keep the agent unregistered.
-		 *
-		 * We keep priv->registering_cancellable set to not retry this again, until we loose the
-		 * name owner. But the state of the agent is lingering and won't accept any requests. */
+         *
+         * We keep priv->registering_cancellable set to not retry this again, until we loose the
+         * name owner. But the state of the agent is lingering and won't accept any requests. */
         return;
     }
 
@@ -1322,8 +1322,8 @@ _method_call(GDBusConnection *      connection,
 
     if (!priv->name_owner_curr || !priv->registered_against_server) {
         /* priv->registered_against_server means that we started to register, but not necessarily
-		 * that the registration fully succeeded. However, we already authenticated the request
-		 * and so we accept it, even if the registration is not yet complete. */
+         * that the registration fully succeeded. However, we already authenticated the request
+         * and so we accept it, even if the registration is not yet complete. */
         g_dbus_method_invocation_return_error_literal(context,
                                                       NM_SECRET_AGENT_ERROR,
                                                       NM_SECRET_AGENT_ERROR_PERMISSION_DENIED,
@@ -1354,8 +1354,8 @@ _register_state_complete(NMSecretAgentOld *self)
 
     if (!c_list_is_empty(&priv->pending_tasks_register_lst_head)) {
         /* add a dummy sentinel. We want to complete all the task we started
-		 * so far, but as we invoke user callbacks, the user might register
-		 * new tasks. Those we don't complete in this run. */
+         * so far, but as we invoke user callbacks, the user might register
+         * new tasks. Those we don't complete in this run. */
         g_object_ref(self);
         any_tasks_to_complete = TRUE;
         c_list_link_tail(&priv->pending_tasks_register_lst_head,
@@ -1535,7 +1535,7 @@ _register_state_change(NMSecretAgentOld *self)
 
     if (priv->register_state_change_reenter != 1) {
         /* Recursive calls are prevented. Do nothing for now, but repeat
-		 * the state change afterwards. */
+         * the state change afterwards. */
         priv->register_state_change_reenter = 3;
         return;
     }
@@ -1727,7 +1727,7 @@ init_sync(GInitable *initable, GCancellable *cancellable, GError **error)
     _LOGT("init-sync");
 
     /* See NMClient's sync-init method for explanation about why we create
-	 * an internal GMainContext priv->dbus_context. */
+     * an internal GMainContext priv->dbus_context. */
 
     priv->dbus_context = g_main_context_new();
 
@@ -1889,14 +1889,14 @@ nm_secret_agent_old_class_init(NMSecretAgentOldClass *class)
     object_class->finalize     = finalize;
 
     /**
-	 * NMSecretAgentOld:dbus-connection:
-	 *
-	 * The #GDBusConnection used by the instance. You may either set this
-	 * as construct-only property, or otherwise #NMSecretAgentOld will choose
-	 * a connection via g_bus_get() during initialization.
-	 *
-	 * Since: 1.24
-	 **/
+     * NMSecretAgentOld:dbus-connection:
+     *
+     * The #GDBusConnection used by the instance. You may either set this
+     * as construct-only property, or otherwise #NMSecretAgentOld will choose
+     * a connection via g_bus_get() during initialization.
+     *
+     * Since: 1.24
+     **/
     obj_properties[PROP_DBUS_CONNECTION] =
         g_param_spec_object(NM_SECRET_AGENT_OLD_DBUS_CONNECTION,
                             "",
@@ -1905,16 +1905,16 @@ nm_secret_agent_old_class_init(NMSecretAgentOldClass *class)
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSecretAgentOld:identifier:
-	 *
-	 * Identifies this agent; only one agent in each user session may use the
-	 * same identifier.  Identifier formatting follows the same rules as
-	 * D-Bus bus names with the exception that the ':' character is not
-	 * allowed.  The valid set of characters is "[A-Z][a-z][0-9]_-." and the
-	 * identifier is limited in length to 255 characters with a minimum
-	 * of 3 characters.  An example valid identifier is 'org.gnome.nm-applet'
-	 * (without quotes).
-	 **/
+     * NMSecretAgentOld:identifier:
+     *
+     * Identifies this agent; only one agent in each user session may use the
+     * same identifier.  Identifier formatting follows the same rules as
+     * D-Bus bus names with the exception that the ':' character is not
+     * allowed.  The valid set of characters is "[A-Z][a-z][0-9]_-." and the
+     * identifier is limited in length to 255 characters with a minimum
+     * of 3 characters.  An example valid identifier is 'org.gnome.nm-applet'
+     * (without quotes).
+     **/
     obj_properties[PROP_IDENTIFIER] =
         g_param_spec_string(NM_SECRET_AGENT_OLD_IDENTIFIER,
                             "",
@@ -1923,26 +1923,26 @@ nm_secret_agent_old_class_init(NMSecretAgentOldClass *class)
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSecretAgentOld:auto-register:
-	 *
-	 * If %TRUE (the default), the agent will always be registered when
-	 * NetworkManager is running; if NetworkManager exits and restarts, the
-	 * agent will re-register itself automatically.
-	 *
-	 * In particular, if this property is %TRUE at construct time, then the
-	 * agent will register itself with NetworkManager during
-	 * construction/initialization and initialization will only complete
-	 * after registration is completed (either successfully or unsuccessfully).
-	 * Since 1.24, a failure to register will no longer cause initialization
-	 * of #NMSecretAgentOld to fail.
-	 *
-	 * If the property is %FALSE, the agent will not automatically register with
-	 * NetworkManager, and nm_secret_agent_old_enable() or
-	 * nm_secret_agent_old_register_async() must be called to register it.
-	 *
-	 * Calling nm_secret_agent_old_enable() has the same effect as setting this
-	 * property.
-	 **/
+     * NMSecretAgentOld:auto-register:
+     *
+     * If %TRUE (the default), the agent will always be registered when
+     * NetworkManager is running; if NetworkManager exits and restarts, the
+     * agent will re-register itself automatically.
+     *
+     * In particular, if this property is %TRUE at construct time, then the
+     * agent will register itself with NetworkManager during
+     * construction/initialization and initialization will only complete
+     * after registration is completed (either successfully or unsuccessfully).
+     * Since 1.24, a failure to register will no longer cause initialization
+     * of #NMSecretAgentOld to fail.
+     *
+     * If the property is %FALSE, the agent will not automatically register with
+     * NetworkManager, and nm_secret_agent_old_enable() or
+     * nm_secret_agent_old_register_async() must be called to register it.
+     *
+     * Calling nm_secret_agent_old_enable() has the same effect as setting this
+     * property.
+     **/
     obj_properties[PROP_AUTO_REGISTER] =
         g_param_spec_boolean(NM_SECRET_AGENT_OLD_AUTO_REGISTER,
                              "",
@@ -1951,10 +1951,10 @@ nm_secret_agent_old_class_init(NMSecretAgentOldClass *class)
                              G_PARAM_READWRITE | G_PARAM_CONSTRUCT | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSecretAgentOld:registered:
-	 *
-	 * %TRUE if the agent is registered with NetworkManager, %FALSE if not.
-	 **/
+     * NMSecretAgentOld:registered:
+     *
+     * %TRUE if the agent is registered with NetworkManager, %FALSE if not.
+     **/
     obj_properties[PROP_REGISTERED] =
         g_param_spec_boolean(NM_SECRET_AGENT_OLD_REGISTERED,
                              "",
@@ -1963,13 +1963,13 @@ nm_secret_agent_old_class_init(NMSecretAgentOldClass *class)
                              G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMSecretAgentOld:capabilities:
-	 *
-	 * A bitfield of %NMSecretAgentCapabilities.
-	 *
-	 * Changing this property is possible at any time. In case the secret
-	 * agent is currently registered, this will cause a re-registration.
-	 **/
+     * NMSecretAgentOld:capabilities:
+     *
+     * A bitfield of %NMSecretAgentCapabilities.
+     *
+     * Changing this property is possible at any time. In case the secret
+     * agent is currently registered, this will cause a re-registration.
+     **/
     obj_properties[PROP_CAPABILITIES] =
         g_param_spec_flags(NM_SECRET_AGENT_OLD_CAPABILITIES,
                            "",
diff --git a/libnm/nm-secret-agent-old.h b/libnm/nm-secret-agent-old.h
index bd5c21be1c..9fdcce7853 100644
--- a/libnm/nm-secret-agent-old.h
+++ b/libnm/nm-secret-agent-old.h
@@ -129,15 +129,15 @@ typedef struct {
     /* Virtual methods for subclasses */
 
     /* Called when the subclass should retrieve and return secrets.  Subclass
-	 * must copy or reference any arguments it may require after returning from
-	 * this method, as the arguments will freed (except for 'self', 'callback',
-	 * and 'user_data' of course).
-	 *
-	 * Before version 1.24, if the request is canceled, the callback
-	 * should still be called, but with the NM_SECRET_AGENT_ERROR_AGENT_CANCELED
-	 * error. Since 1.24, invoking the callback has no effect during cancellation
-	 * and may be omitted.
-	 */
+     * must copy or reference any arguments it may require after returning from
+     * this method, as the arguments will freed (except for 'self', 'callback',
+     * and 'user_data' of course).
+     *
+     * Before version 1.24, if the request is canceled, the callback
+     * should still be called, but with the NM_SECRET_AGENT_ERROR_AGENT_CANCELED
+     * error. Since 1.24, invoking the callback has no effect during cancellation
+     * and may be omitted.
+     */
     void (*get_secrets)(NMSecretAgentOld *             self,
                         NMConnection *                 connection,
                         const char *                   connection_path,
@@ -148,23 +148,23 @@ typedef struct {
                         gpointer                       user_data);
 
     /* Called when the subclass should cancel an outstanding request to
-	 * get secrets for a given connection.
-	 *
-	 * Before version 1.24, canceling the request MUST call the callback that was
-	 * passed along with the initial get_secrets call, sending the NM_SECRET_AGENT_ERROR/
-	 * NM_SECRET_AGENT_ERROR_AGENT_CANCELED error to that callback. Since 1.24,
-	 * the get_secrets callback will be ignored during cancellation and may be omitted.
-	 */
+     * get secrets for a given connection.
+     *
+     * Before version 1.24, canceling the request MUST call the callback that was
+     * passed along with the initial get_secrets call, sending the NM_SECRET_AGENT_ERROR/
+     * NM_SECRET_AGENT_ERROR_AGENT_CANCELED error to that callback. Since 1.24,
+     * the get_secrets callback will be ignored during cancellation and may be omitted.
+     */
     void (*cancel_get_secrets)(NMSecretAgentOld *self,
                                const char *      connection_path,
                                const char *      setting_name);
 
     /* Called when the subclass should save the secrets contained in the
-	 * connection to backing storage.  Subclass must copy or reference any
-	 * arguments it may require after returning from this method, as the
-	 * arguments will freed (except for 'self', 'callback', and 'user_data'
-	 * of course).
-	 */
+     * connection to backing storage.  Subclass must copy or reference any
+     * arguments it may require after returning from this method, as the
+     * arguments will freed (except for 'self', 'callback', and 'user_data'
+     * of course).
+     */
     void (*save_secrets)(NMSecretAgentOld *              self,
                          NMConnection *                  connection,
                          const char *                    connection_path,
@@ -172,11 +172,11 @@ typedef struct {
                          gpointer                        user_data);
 
     /* Called when the subclass should delete the secrets contained in the
-	 * connection from backing storage.  Subclass must copy or reference any
-	 * arguments it may require after returning from this method, as the
-	 * arguments will freed (except for 'self', 'callback', and 'user_data'
-	 * of course).
-	 */
+     * connection from backing storage.  Subclass must copy or reference any
+     * arguments it may require after returning from this method, as the
+     * arguments will freed (except for 'self', 'callback', and 'user_data'
+     * of course).
+     */
     void (*delete_secrets)(NMSecretAgentOld *                self,
                            NMConnection *                    connection,
                            const char *                      connection_path,
diff --git a/libnm/nm-vpn-connection.c b/libnm/nm-vpn-connection.c
index 290fcb0f88..cfa53a9406 100644
--- a/libnm/nm-vpn-connection.c
+++ b/libnm/nm-vpn-connection.c
@@ -92,8 +92,8 @@ _notify_event_state_changed(NMClient *client, NMClientNotifyEventWithPtr *notify
     NMVpnConnectionPrivate *         priv = NM_VPN_CONNECTION_GET_PRIVATE(self);
 
     /* we expose here the value cache in @priv. In practice, this is the same
-	 * value as we received from the signal. In the unexpected case where they
-	 * differ, the cached value of the current instance would still be more correct. */
+     * value as we received from the signal. In the unexpected case where they
+     * differ, the cached value of the current instance would still be more correct. */
     g_signal_emit(self,
                   signals[VPN_STATE_CHANGED],
                   0,
@@ -176,10 +176,10 @@ nm_vpn_connection_class_init(NMVpnConnectionClass *connection_class)
     object_class->finalize     = finalize;
 
     /**
-	 * NMVpnConnection:vpn-state:
-	 *
-	 * The VPN state of the active VPN connection.
-	 **/
+     * NMVpnConnection:vpn-state:
+     *
+     * The VPN state of the active VPN connection.
+     **/
     obj_properties[PROP_VPN_STATE] = g_param_spec_enum(NM_VPN_CONNECTION_VPN_STATE,
                                                        "",
                                                        "",
@@ -188,10 +188,10 @@ nm_vpn_connection_class_init(NMVpnConnectionClass *connection_class)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMVpnConnection:banner:
-	 *
-	 * The VPN login banner of the active VPN connection.
-	 **/
+     * NMVpnConnection:banner:
+     *
+     * The VPN login banner of the active VPN connection.
+     **/
     obj_properties[PROP_BANNER] = g_param_spec_string(NM_VPN_CONNECTION_BANNER,
                                                       "",
                                                       "",
@@ -202,10 +202,10 @@ nm_vpn_connection_class_init(NMVpnConnectionClass *connection_class)
                                               &_nml_dbus_meta_iface_nm_vpn_connection);
 
     /* TODO: the state reason should also be exposed as a property in libnm's NMVpnConnection,
-	 * like done for NMDevice's state reason. */
+     * like done for NMDevice's state reason. */
 
     /* TODO: the D-Bus API should also expose the state-reason as a property instead of
-	 * a "VpnStateChanged" signal. Like done for Device's "StateReason".  */
+     * a "VpnStateChanged" signal. Like done for Device's "StateReason".  */
 
     G_GNUC_BEGIN_IGNORE_DEPRECATIONS
     signals[VPN_STATE_CHANGED] = g_signal_new("vpn-state-changed",
diff --git a/libnm/nm-vpn-plugin-old.c b/libnm/nm-vpn-plugin-old.c
index dde5897f04..3b28b0c6af 100644
--- a/libnm/nm-vpn-plugin-old.c
+++ b/libnm/nm-vpn-plugin-old.c
@@ -302,8 +302,8 @@ nm_vpn_plugin_old_set_config(NMVpnPluginOld *plugin, GVariant *config)
     g_warn_if_fail(priv->has_ip4 || priv->has_ip6);
 
     /* Record the items that need to also be inserted into the
-	 * ip4config, for compatibility with older daemons.
-	 */
+     * ip4config, for compatibility with older daemons.
+     */
     if (priv->banner)
         g_variant_unref(priv->banner);
     priv->banner = g_variant_lookup_value(config, NM_VPN_PLUGIN_CONFIG_BANNER, G_VARIANT_TYPE("s"));
@@ -342,18 +342,18 @@ nm_vpn_plugin_old_set_ip4_config(NMVpnPluginOld *plugin, GVariant *ip4_config)
     priv->got_ip4 = TRUE;
 
     /* Old plugins won't send the "config" signal and thus can't send
-	 * NM_VPN_PLUGIN_OLD_CONFIG_HAS_IP4 either.  But since they don't support IPv6,
-	 * we can safely assume that, if we don't receive a "config" signal but do
-	 * receive an "ip4-config" signal, the old plugin supports IPv4.
-	 */
+     * NM_VPN_PLUGIN_OLD_CONFIG_HAS_IP4 either.  But since they don't support IPv6,
+     * we can safely assume that, if we don't receive a "config" signal but do
+     * receive an "ip4-config" signal, the old plugin supports IPv4.
+     */
     if (!priv->got_config)
         priv->has_ip4 = TRUE;
 
     /* Older NetworkManager daemons expect all config info to be in
-	 * the ip4 config, so they won't even notice the "config" signal
-	 * being emitted. So just copy all of that data into the ip4
-	 * config too.
-	 */
+     * the ip4 config, so they won't even notice the "config" signal
+     * being emitted. So just copy all of that data into the ip4
+     * config too.
+     */
     g_variant_builder_init(&builder, G_VARIANT_TYPE("a{sv}"));
     g_variant_iter_init(&iter, ip4_config);
     while (g_variant_iter_next(&iter, "{&sv}", &key, &value)) {
@@ -481,8 +481,8 @@ _connect_generic(NMVpnPluginOld *       plugin,
         g_dbus_method_invocation_take_error(context, error);
 
         /* Stop the plugin from an idle handler so that the Connect
-		 * method return gets sent before the STOP StateChanged signal.
-		 */
+         * method return gets sent before the STOP StateChanged signal.
+         */
         schedule_fail_stop(plugin, fail_stop_timeout);
     }
 
@@ -549,8 +549,8 @@ impl_vpn_plugin_old_need_secrets(NMVpnPluginOld *       plugin,
 
     if (needed) {
         /* Push back the quit timer so the VPN plugin doesn't quit in the
-		 * middle of asking the user for secrets.
-		 */
+         * middle of asking the user for secrets.
+         */
         schedule_quit_timer(plugin);
 
         g_assert(setting_name);
@@ -613,8 +613,8 @@ impl_vpn_plugin_old_new_secrets(NMVpnPluginOld *       plugin,
         g_dbus_method_invocation_take_error(context, error);
 
         /* Stop the plugin from and idle handler so that the NewSecrets
-		 * method return gets sent before the STOP StateChanged signal.
-		 */
+         * method return gets sent before the STOP StateChanged signal.
+         */
         schedule_fail_stop(plugin, 0);
     }
 
@@ -644,13 +644,13 @@ nm_vpn_plugin_old_secrets_required(NMVpnPluginOld *plugin, const char *message,
     g_return_if_fail(NM_VPN_PLUGIN_OLD_GET_CLASS(plugin)->new_secrets);
 
     /* Plugin cannot call this method if NetworkManager didn't originally call
-	 * ConnectInteractive().
-	 */
+     * ConnectInteractive().
+     */
     g_return_if_fail(priv->interactive == TRUE);
 
     /* Cancel the connect timer since secrets might take a while.  It'll
-	 * get restarted when the secrets come back via NewSecrets().
-	 */
+     * get restarted when the secrets come back via NewSecrets().
+     */
     nm_clear_g_source(&priv->connect_timer);
 
     g_signal_emit(plugin, signals[SECRETS_REQUIRED], 0, message, hints);
@@ -1009,12 +1009,12 @@ nm_vpn_plugin_old_class_init(NMVpnPluginOldClass *plugin_class)
     plugin_class->state_changed = state_changed;
 
     /**
-	 * NMVpnPluginOld:service-name:
-	 *
-	 * The D-Bus service name of this plugin.
-	 *
-	 * Deprecated: 1.2: Replaced by NMVpnServicePlugin.
-	 */
+     * NMVpnPluginOld:service-name:
+     *
+     * The D-Bus service name of this plugin.
+     *
+     * Deprecated: 1.2: Replaced by NMVpnServicePlugin.
+     */
     obj_properties[PROP_DBUS_SERVICE_NAME] =
         g_param_spec_string(NM_VPN_PLUGIN_OLD_DBUS_SERVICE_NAME,
                             "",
@@ -1023,12 +1023,12 @@ nm_vpn_plugin_old_class_init(NMVpnPluginOldClass *plugin_class)
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMVpnPluginOld:state:
-	 *
-	 * The state of the plugin.
-	 *
-	 * Deprecated: 1.2: Replaced by NMVpnServicePlugin.
-	 */
+     * NMVpnPluginOld:state:
+     *
+     * The state of the plugin.
+     *
+     * Deprecated: 1.2: Replaced by NMVpnServicePlugin.
+     */
     obj_properties[PROP_STATE] = g_param_spec_enum(NM_VPN_PLUGIN_OLD_STATE,
                                                    "",
                                                    "",
diff --git a/libnm/nm-vpn-service-plugin.c b/libnm/nm-vpn-service-plugin.c
index 19f6ccc250..f4fbd99b2f 100644
--- a/libnm/nm-vpn-service-plugin.c
+++ b/libnm/nm-vpn-service-plugin.c
@@ -339,8 +339,8 @@ nm_vpn_service_plugin_set_config(NMVpnServicePlugin *plugin, GVariant *config)
     (void) g_variant_lookup(config, NM_VPN_PLUGIN_CONFIG_HAS_IP6, "b", &priv->has_ip6);
 
     /* Record the items that need to also be inserted into the
-	 * ip4config, for compatibility with older daemons.
-	 */
+     * ip4config, for compatibility with older daemons.
+     */
     if (priv->banner)
         g_variant_unref(priv->banner);
     priv->banner = g_variant_lookup_value(config, NM_VPN_PLUGIN_CONFIG_BANNER, G_VARIANT_TYPE("s"));
@@ -379,18 +379,18 @@ nm_vpn_service_plugin_set_ip4_config(NMVpnServicePlugin *plugin, GVariant *ip4_c
     priv->got_ip4 = TRUE;
 
     /* Old plugins won't send the "config" signal and thus can't send
-	 * NM_VPN_SERVICE_PLUGIN_CONFIG_HAS_IP4 either.  But since they don't support IPv6,
-	 * we can safely assume that, if we don't receive a "config" signal but do
-	 * receive an "ip4-config" signal, the old plugin supports IPv4.
-	 */
+     * NM_VPN_SERVICE_PLUGIN_CONFIG_HAS_IP4 either.  But since they don't support IPv6,
+     * we can safely assume that, if we don't receive a "config" signal but do
+     * receive an "ip4-config" signal, the old plugin supports IPv4.
+     */
     if (!priv->got_config)
         priv->has_ip4 = TRUE;
 
     /* Older NetworkManager daemons expect all config info to be in
-	 * the ip4 config, so they won't even notice the "config" signal
-	 * being emitted. So just copy all of that data into the ip4
-	 * config too.
-	 */
+     * the ip4 config, so they won't even notice the "config" signal
+     * being emitted. So just copy all of that data into the ip4
+     * config too.
+     */
     g_variant_builder_init(&builder, G_VARIANT_TYPE("a{sv}"));
     g_variant_iter_init(&iter, ip4_config);
     while (g_variant_iter_next(&iter, "{&sv}", &key, &value)) {
@@ -547,8 +547,8 @@ _connect_generic(NMVpnServicePlugin *   plugin,
         g_dbus_method_invocation_take_error(context, error);
 
         /* Stop the plugin from an idle handler so that the Connect
-		 * method return gets sent before the STOP StateChanged signal.
-		 */
+         * method return gets sent before the STOP StateChanged signal.
+         */
         schedule_fail_stop(plugin, fail_stop_timeout);
     }
 
@@ -615,8 +615,8 @@ impl_vpn_service_plugin_need_secrets(NMVpnServicePlugin *   plugin,
 
     if (needed) {
         /* Push back the quit timer so the VPN plugin doesn't quit in the
-		 * middle of asking the user for secrets.
-		 */
+         * middle of asking the user for secrets.
+         */
         schedule_quit_timer(plugin);
 
         g_assert(setting_name);
@@ -679,8 +679,8 @@ impl_vpn_service_plugin_new_secrets(NMVpnServicePlugin *   plugin,
         g_dbus_method_invocation_take_error(context, error);
 
         /* Stop the plugin from and idle handler so that the NewSecrets
-		 * method return gets sent before the STOP StateChanged signal.
-		 */
+         * method return gets sent before the STOP StateChanged signal.
+         */
         schedule_fail_stop(plugin, 0);
     }
 
@@ -712,13 +712,13 @@ nm_vpn_service_plugin_secrets_required(NMVpnServicePlugin *plugin,
     g_return_if_fail(NM_VPN_SERVICE_PLUGIN_GET_CLASS(plugin)->new_secrets);
 
     /* Plugin cannot call this method if NetworkManager didn't originally call
-	 * ConnectInteractive().
-	 */
+     * ConnectInteractive().
+     */
     g_return_if_fail(priv->interactive == TRUE);
 
     /* Cancel the connect timer since secrets might take a while.  It'll
-	 * get restarted when the secrets come back via NewSecrets().
-	 */
+     * get restarted when the secrets come back via NewSecrets().
+     */
     nm_clear_g_source(&priv->connect_timer);
 
     g_signal_emit(plugin, signals[SECRETS_REQUIRED], 0, message, hints);
@@ -1193,12 +1193,12 @@ nm_vpn_service_plugin_class_init(NMVpnServicePluginClass *plugin_class)
     plugin_class->state_changed = state_changed;
 
     /**
-	 * NMVpnServicePlugin:service-name:
-	 *
-	 * The D-Bus service name of this plugin.
-	 *
-	 * Since: 1.2
-	 */
+     * NMVpnServicePlugin:service-name:
+     *
+     * The D-Bus service name of this plugin.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_DBUS_SERVICE_NAME] =
         g_param_spec_string(NM_VPN_SERVICE_PLUGIN_DBUS_SERVICE_NAME,
                             "",
@@ -1207,12 +1207,12 @@ nm_vpn_service_plugin_class_init(NMVpnServicePluginClass *plugin_class)
                             G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMVpnServicePlugin:watch-peer:
-	 *
-	 * Whether to watch for D-Bus peer's changes.
-	 *
-	 * Since: 1.2
-	 */
+     * NMVpnServicePlugin:watch-peer:
+     *
+     * Whether to watch for D-Bus peer's changes.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_DBUS_WATCH_PEER] =
         g_param_spec_boolean(NM_VPN_SERVICE_PLUGIN_DBUS_WATCH_PEER,
                              "",
@@ -1221,12 +1221,12 @@ nm_vpn_service_plugin_class_init(NMVpnServicePluginClass *plugin_class)
                              G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMVpnServicePlugin:state:
-	 *
-	 * The state of the plugin.
-	 *
-	 * Since: 1.2
-	 */
+     * NMVpnServicePlugin:state:
+     *
+     * The state of the plugin.
+     *
+     * Since: 1.2
+     */
     obj_properties[PROP_STATE] = g_param_spec_enum(NM_VPN_SERVICE_PLUGIN_STATE,
                                                    "",
                                                    "",
diff --git a/libnm/nm-wifi-p2p-peer.c b/libnm/nm-wifi-p2p-peer.c
index d02aaa0ffc..b136af7c52 100644
--- a/libnm/nm-wifi-p2p-peer.c
+++ b/libnm/nm-wifi-p2p-peer.c
@@ -434,12 +434,12 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
     object_class->finalize     = finalize;
 
     /**
-	 * NMWifiP2PPeer:flags:
-	 *
-	 * The flags of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:flags:
+     *
+     * The flags of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_FLAGS] = g_param_spec_flags(NM_WIFI_P2P_PEER_FLAGS,
                                                     "",
                                                     "",
@@ -448,12 +448,12 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWifiP2PPeer:name:
-	 *
-	 * The name of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:name:
+     *
+     * The name of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_NAME] = g_param_spec_string(NM_WIFI_P2P_PEER_NAME,
                                                     "",
                                                     "",
@@ -461,12 +461,12 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWifiP2PPeer:manufacturer:
-	 *
-	 * The manufacturer of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:manufacturer:
+     *
+     * The manufacturer of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_MANUFACTURER] =
         g_param_spec_string(NM_WIFI_P2P_PEER_MANUFACTURER,
                             "",
@@ -475,12 +475,12 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWifiP2PPeer:model:
-	 *
-	 * The model of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:model:
+     *
+     * The model of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_MODEL] = g_param_spec_string(NM_WIFI_P2P_PEER_MODEL,
                                                      "",
                                                      "",
@@ -488,12 +488,12 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWifiP2PPeer:model-number:
-	 *
-	 * The hardware address of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:model-number:
+     *
+     * The hardware address of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_MODEL_NUMBER] =
         g_param_spec_string(NM_WIFI_P2P_PEER_MODEL_NUMBER,
                             "",
@@ -502,12 +502,12 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWifiP2PPeer:serial:
-	 *
-	 * The serial number of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:serial:
+     *
+     * The serial number of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_SERIAL] = g_param_spec_string(NM_WIFI_P2P_PEER_SERIAL,
                                                       "",
                                                       "",
@@ -515,24 +515,24 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWifiP2PPeer:wfd-ies:
-	 *
-	 * The WFD information elements of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:wfd-ies:
+     *
+     * The WFD information elements of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_WFD_IES] = g_param_spec_boxed(NM_WIFI_P2P_PEER_WFD_IES,
                                                       "",
                                                       "",
                                                       G_TYPE_BYTES,
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
     /**
-	 * NMWifiP2PPeer:hw-address:
-	 *
-	 * The hardware address of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:hw-address:
+     *
+     * The hardware address of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_HW_ADDRESS] =
         g_param_spec_string(NM_WIFI_P2P_PEER_HW_ADDRESS,
                             "",
@@ -541,12 +541,12 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
                             G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWifiP2PPeer:strength:
-	 *
-	 * The current signal strength of the P2P peer.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:strength:
+     *
+     * The current signal strength of the P2P peer.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_STRENGTH] = g_param_spec_uchar(NM_WIFI_P2P_PEER_STRENGTH,
                                                        "",
                                                        "",
@@ -556,13 +556,13 @@ nm_wifi_p2p_peer_class_init(NMWifiP2PPeerClass *klass)
                                                        G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWifiP2PPeer:last-seen:
-	 *
-	 * The timestamp (in CLOCK_BOOTTIME seconds) for the last time the
-	 * P2P peer was found.  A value of -1 means the peer has never been seen.
-	 *
-	 * Since: 1.16
-	 **/
+     * NMWifiP2PPeer:last-seen:
+     *
+     * The timestamp (in CLOCK_BOOTTIME seconds) for the last time the
+     * P2P peer was found.  A value of -1 means the peer has never been seen.
+     *
+     * Since: 1.16
+     **/
     obj_properties[PROP_LAST_SEEN] = g_param_spec_int(NM_WIFI_P2P_PEER_LAST_SEEN,
                                                       "",
                                                       "",
diff --git a/libnm/nm-wimax-nsp.c b/libnm/nm-wimax-nsp.c
index 2c2c00cf98..f1e8d85cba 100644
--- a/libnm/nm-wimax-nsp.c
+++ b/libnm/nm-wimax-nsp.c
@@ -137,12 +137,12 @@ nm_wimax_nsp_class_init(NMWimaxNspClass *nsp_class)
     object_class->get_property = get_property;
 
     /**
-	 * NMWimaxNsp:name:
-	 *
-	 * The name of the WiMAX NSP.
-	 *
-	 * Deprecated: 1.22: WiMAX is no longer supported by NetworkManager since 1.2.0.
-	 **/
+     * NMWimaxNsp:name:
+     *
+     * The name of the WiMAX NSP.
+     *
+     * Deprecated: 1.22: WiMAX is no longer supported by NetworkManager since 1.2.0.
+     **/
     obj_properties[PROP_NAME] = g_param_spec_string(NM_WIMAX_NSP_NAME,
                                                     "",
                                                     "",
@@ -150,12 +150,12 @@ nm_wimax_nsp_class_init(NMWimaxNspClass *nsp_class)
                                                     G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWimaxNsp:signal-quality:
-	 *
-	 * The signal quality of the WiMAX NSP.
-	 *
-	 * Deprecated: 1.22: WiMAX is no longer supported by NetworkManager since 1.2.0.
-	 **/
+     * NMWimaxNsp:signal-quality:
+     *
+     * The signal quality of the WiMAX NSP.
+     *
+     * Deprecated: 1.22: WiMAX is no longer supported by NetworkManager since 1.2.0.
+     **/
     obj_properties[PROP_SIGNAL_QUALITY] =
         g_param_spec_uint(NM_WIMAX_NSP_SIGNAL_QUALITY,
                           "",
@@ -166,12 +166,12 @@ nm_wimax_nsp_class_init(NMWimaxNspClass *nsp_class)
                           G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMWimaxNsp:network-type:
-	 *
-	 * The network type of the WiMAX NSP.
-	 *
-	 * Deprecated: 1.22: WiMAX is no longer supported by NetworkManager since 1.2.0.
-	 **/
+     * NMWimaxNsp:network-type:
+     *
+     * The network type of the WiMAX NSP.
+     *
+     * Deprecated: 1.22: WiMAX is no longer supported by NetworkManager since 1.2.0.
+     **/
     obj_properties[PROP_NETWORK_TYPE] =
         g_param_spec_enum(NM_WIMAX_NSP_NETWORK_TYPE,
                           "",
diff --git a/libnm/tests/test-libnm.c b/libnm/tests/test-libnm.c
index fa614e2391..cbbb4a9a8f 100644
--- a/libnm/tests/test-libnm.c
+++ b/libnm/tests/test-libnm.c
@@ -2743,8 +2743,8 @@ test_types(void)
             continue;
 
         /* We only test parts of the types, and avoid initializing all the types.
-		 * That is so that other unit tests in this process randomly run with either
-		 * the class instance already initialized or not. */
+         * That is so that other unit tests in this process randomly run with either
+         * the class instance already initialized or not. */
         if ((nmtst_get_rand_uint() % 5) == 0) {
             klass = (klass_unref = g_type_class_ref(gtype));
             g_assert(klass);
@@ -2837,8 +2837,8 @@ test_nml_dbus_meta(void)
             g_assert(g_type_is_a(gtype, NM_TYPE_OBJECT));
 
         /* We only test parts of the types, and avoid initializing all the types.
-		 * That is so that other unit tests in this process randomly run with either
-		 * the class instance already initialized or not. */
+         * That is so that other unit tests in this process randomly run with either
+         * the class instance already initialized or not. */
         if ((nmtst_get_rand_uint() % 5) == 0) {
             klass = (klass_unref = g_type_class_ref(gtype));
             g_assert(klass);
@@ -3062,7 +3062,7 @@ check_dbus_properties:
 
                 if (!nm_utils_g_param_spec_is_default(pspec)) {
                     /* We expect our properties to have a default value of zero/NULL.
-					 * Except those whitelisted here: */
+                     * Except those whitelisted here: */
                     if ((mif == &_nml_dbus_meta_iface_nm_accesspoint
                          && nm_streq(pspec->name, NM_ACCESS_POINT_LAST_SEEN))
                         || (mif == &_nml_dbus_meta_iface_nm_device_vxlan
@@ -3319,7 +3319,7 @@ test_dbus_meta_types(void)
     guint i;
 
     /* These iface<->gtype associations are copied from "nm-client.c"'s obj_nm_for_gdbus_object().
-	 * This is redundant to the meta-data, still check that the meta data matches. */
+     * This is redundant to the meta-data, still check that the meta data matches. */
     for (i = 0; i < G_N_ELEMENTS(list); i++) {
         const struct list_data *d = &list[i];
         const NMLDBusMetaIface *meta_iface;
diff --git a/libnm/tests/test-nm-client.c b/libnm/tests/test-nm-client.c
index 4b9919f067..d821978023 100644
--- a/libnm/tests/test-nm-client.c
+++ b/libnm/tests/test-nm-client.c
@@ -160,7 +160,7 @@ test_device_added_signal_after_init(void)
     nmtstc_service_add_device(sinfo, client, "AddWiredDevice", "eth0");
 
     /* Ensure the 'device-added' signal doesn't show up before
-	 * the 'Devices' property change notification */
+     * the 'Devices' property change notification */
     /* coverity[loop_condition] */
     while (!(result & SIGNAL_MASK) && !(result & NOTIFY_MASK))
         g_main_context_iteration(NULL, TRUE);
@@ -532,8 +532,8 @@ test_client_nm_running(void)
     client2 = nmtstc_client_new(FALSE);
 
     /* client2 should know that NM is running, but the previously-created
-	 * client1 hasn't gotten the news yet.
-	 */
+     * client1 hasn't gotten the news yet.
+     */
     g_assert(!nm_client_get_nm_running(client1));
     g_assert(nm_client_get_nm_running(client2));
 
@@ -602,7 +602,7 @@ assert_ac_and_device(NMClient *client)
     device_ac = nm_device_get_active_connection(device);
     if (!device_ac) {
         /* the stub NetworkManager service starts activating in an idle handler (delayed). That means, the
-		 * device may not yet refer to the active connection at this point. */
+         * device may not yet refer to the active connection at this point. */
     } else {
         g_assert_cmpstr(nm_object_get_path(NM_OBJECT(ac)),
                         ==,
@@ -705,8 +705,8 @@ test_active_connections(void)
     g_clear_object(&client);
 
     /* Ensure that we can correctly resolve the recursive property link between the
-	 * AC and the Device in a newly-created client.
-	 */
+     * AC and the Device in a newly-created client.
+     */
     client = nmtstc_client_new(TRUE);
     assert_ac_and_device(client);
     g_clear_object(&client);
@@ -830,10 +830,10 @@ test_activate_virtual(void)
                      &info);
 
     /* We're expecting a client::devices change, client::activate callback,
-	 * and a device::active-connection change.
-	 * The client::devices callback can hook a client::active-connections
-	 * change and bump this if the property is not yet loaded.
-	 */
+     * and a device::active-connection change.
+     * The client::devices callback can hook a client::active-connections
+     * change and bump this if the property is not yet loaded.
+     */
     info.remaining = 3;
 
     g_main_loop_run(gl.loop);
@@ -966,8 +966,8 @@ test_connection_invalid(void)
              == (g_main_context_get_thread_default() ?: g_main_context_default()));
 
     /**************************************************************************
-	 * Add three connections before starting libnm. One valid, two invalid.
-	 *************************************************************************/
+     * Add three connections before starting libnm. One valid, two invalid.
+     *************************************************************************/
 
     connection = nmtst_create_minimal_connection("test-connection-invalid-0",
                                                  NULL,
@@ -1029,8 +1029,8 @@ test_connection_invalid(void)
     nmtst_assert_connection_unnormalizable(connections->pdata[idx[2]], 0, 0);
 
     /**************************************************************************
-	 * After having the client up and running, add another invalid connection
-	 *************************************************************************/
+     * After having the client up and running, add another invalid connection
+     *************************************************************************/
 
     g_object_set(s_con,
                  NM_SETTING_CONNECTION_ID,
@@ -1066,8 +1066,8 @@ test_connection_invalid(void)
     nmtst_assert_connection_unnormalizable(connections->pdata[idx[3]], 0, 0);
 
     /**************************************************************************
-	 * Modify the invalid connection (still invalid)
-	 *************************************************************************/
+     * Modify the invalid connection (still invalid)
+     *************************************************************************/
 
     NMTST_VARIANT_EDITOR(variant,
                          NMTST_VARIANT_CHANGE_PROPERTY("invalid-type-2", "some-key2", "u", 4721));
@@ -1098,8 +1098,8 @@ test_connection_invalid(void)
     nmtst_assert_connection_unnormalizable(connections->pdata[idx[3]], 0, 0);
 
     /**************************************************************************
-	 * Modify the invalid connection (becomes valid)
-	 *************************************************************************/
+     * Modify the invalid connection (becomes valid)
+     *************************************************************************/
 
     NMTST_VARIANT_EDITOR(variant, NMTST_VARIANT_DROP_SETTING("invalid-type-2"));
     NMTST_VARIANT_EDITOR(variant,
@@ -1134,8 +1134,8 @@ test_connection_invalid(void)
     nmtst_assert_connection_unnormalizable(connections->pdata[idx[3]], 0, 0);
 
     /**************************************************************************
-	 * Modify the invalid connection (still invalid)
-	 *************************************************************************/
+     * Modify the invalid connection (still invalid)
+     *************************************************************************/
 
     g_object_set(s_con, NM_SETTING_CONNECTION_ID, "test-connection-invalid-2x", NULL);
     nmtstc_service_update_connection(my_sinfo, path3, connection, FALSE);
@@ -1167,8 +1167,8 @@ test_connection_invalid(void)
                     nm_connection_get_id(connections->pdata[idx[3]]));
 
     /**************************************************************************
-	 * Modify the invalid connection (now becomes valid)
-	 *************************************************************************/
+     * Modify the invalid connection (now becomes valid)
+     *************************************************************************/
 
     g_clear_object(&connection);
     connection = nmtst_create_minimal_connection("test-connection-invalid-2",
@@ -1214,8 +1214,8 @@ test_connection_invalid(void)
                     nm_connection_get_id(connections->pdata[idx[3]]));
 
     /**************************************************************************
-	 * Modify the invalid connection and make it valid
-	 *************************************************************************/
+     * Modify the invalid connection and make it valid
+     *************************************************************************/
 
     g_clear_object(&connection);
     connection = nmtst_create_minimal_connection("test-connection-invalid-1",
diff --git a/libnm/tests/test-remote-settings-client.c b/libnm/tests/test-remote-settings-client.c
index 81c37cdc12..35ef80aa83 100644
--- a/libnm/tests/test-remote-settings-client.c
+++ b/libnm/tests/test-remote-settings-client.c
@@ -34,9 +34,9 @@ add_cb(GObject *s, GAsyncResult *result, gpointer user_data)
     g_object_add_weak_pointer(G_OBJECT(gl.remote), (void **) &gl.remote);
 
     /* nm_client_add_connection_finish() adds a ref to @remote, but we
-	 * want the weak pointer to be cleared as soon as @client drops its own ref.
-	 * So drop ours.
-	 */
+     * want the weak pointer to be cleared as soon as @client drops its own ref.
+     * So drop ours.
+     */
     g_object_unref(gl.remote);
 }
 
@@ -357,8 +357,8 @@ test_add_remove_connection(void)
         return;
 
     /* This will cause the test server to immediately delete the connection
-	 * after creating it.
-	 */
+     * after creating it.
+     */
     ret = g_dbus_proxy_call_sync(gl.sinfo->proxy,
                                  "AutoRemoveNextConnection",
                                  NULL,
@@ -478,8 +478,8 @@ main(int argc, char **argv)
     gl.client = nmtstc_client_new(TRUE);
 
     /* FIXME: these tests assume that they get run in order, but g_test_run()
-	 * does not actually guarantee that!
-	 */
+     * does not actually guarantee that!
+     */
     g_test_add_func("/client/add_connection", test_add_connection);
     g_test_add_func("/client/make_invisible", test_make_invisible);
     g_test_add_func("/client/make_visible", test_make_visible);
diff --git a/shared/nm-glib-aux/nm-dbus-aux.h b/shared/nm-glib-aux/nm-dbus-aux.h
index b6436855cc..65d497579a 100644
--- a/shared/nm-glib-aux/nm-dbus-aux.h
+++ b/shared/nm-glib-aux/nm-dbus-aux.h
@@ -97,10 +97,10 @@ nm_dbus_connection_signal_subscribe_properties_changed(GDBusConnection *   dbus_
     nm_assert(bus_name);
 
     /* it seems that using a non-unique name causes problems that we get signals
-	 * also from unrelated senders. Usually, you are anyway monitoring the name-owner,
-	 * so you should have the unique name at hand.
-	 *
-	 * If not, investigate this, ensure that it works, and lift this restriction. */
+     * also from unrelated senders. Usually, you are anyway monitoring the name-owner,
+     * so you should have the unique name at hand.
+     *
+     * If not, investigate this, ensure that it works, and lift this restriction. */
     nm_assert(g_dbus_is_unique_name(bus_name));
 
     return g_dbus_connection_signal_subscribe(dbus_connection,
diff --git a/shared/nm-glib-aux/nm-dedup-multi.c b/shared/nm-glib-aux/nm-dedup-multi.c
index 774213f499..b750417921 100644
--- a/shared/nm-glib-aux/nm-dedup-multi.c
+++ b/shared/nm-glib-aux/nm-dedup-multi.c
@@ -14,12 +14,12 @@
 
 typedef struct {
     /* the stack-allocated lookup entry. It has a compatible
-	 * memory layout with NMDedupMultiEntry and NMDedupMultiHeadEntry.
-	 *
-	 * It is recognizable by having lst_entries_sentinel.next set to NULL.
-	 * Contrary to the other entries, which have lst_entries.next
-	 * always non-NULL.
-	 * */
+     * memory layout with NMDedupMultiEntry and NMDedupMultiHeadEntry.
+     *
+     * It is recognizable by having lst_entries_sentinel.next set to NULL.
+     * Contrary to the other entries, which have lst_entries.next
+     * always non-NULL.
+     * */
     CList                      lst_entries_sentinel;
     const NMDedupMultiObj *    obj;
     const NMDedupMultiIdxType *idx_type;
@@ -150,8 +150,8 @@ _entry_unpack(const NMDedupMultiEntry *   entry,
     ASSERT_idx_type(*out_idx_type);
 
     /* for lookup of the head, we allow to omit object, but only
-	 * if the idx_type does not partition the objects. Otherwise, we
-	 * require a obj to compare. */
+     * if the idx_type does not partition the objects. Otherwise, we
+     * require a obj to compare. */
     nm_assert(!*out_lookup_head || (*out_obj || !(*out_idx_type)->klass->idx_obj_partition_equal));
 
     /* lookup of the object requires always an object. */
@@ -602,8 +602,8 @@ nm_dedup_multi_index_remove_obj(NMDedupMultiIndex *                          sel
     }
 
     /* since we are about to remove the object, we obviously pass
-	 * a reference to @out_obj, the caller MUST unref the object,
-	 * if he chooses to provide @out_obj. */
+     * a reference to @out_obj, the caller MUST unref the object,
+     * if he chooses to provide @out_obj. */
     NM_SET_OUT(out_obj, nm_dedup_multi_obj_ref(entry->obj));
 
     _remove_entry(self, (NMDedupMultiEntry *) entry, NULL);
@@ -844,7 +844,7 @@ again:
         if (--(((NMDedupMultiObj *) obj)->_ref_count) <= 0) {
             if (obj->_multi_idx) {
                 /* restore the ref-count to 1 and release the object first
-				 * from the index. Then, retry again to unref. */
+                 * from the index. Then, retry again to unref. */
                 ((NMDedupMultiObj *) obj)->_ref_count++;
                 nm_dedup_multi_index_obj_release(obj->_multi_idx, obj);
                 nm_assert(obj->_ref_count == 1);
diff --git a/shared/nm-glib-aux/nm-dedup-multi.h b/shared/nm-glib-aux/nm-dedup-multi.h
index bb2101d32e..fea5049195 100644
--- a/shared/nm-glib-aux/nm-dedup-multi.h
+++ b/shared/nm-glib-aux/nm-dedup-multi.h
@@ -27,11 +27,11 @@ typedef enum _NMDedupMultiIdxMode {
     NM_DEDUP_MULTI_IDX_MODE_PREPEND_FORCE,
 
     /* append new objects to the end of the list.
-	 * If the object is already in the cache, don't move it. */
+     * If the object is already in the cache, don't move it. */
     NM_DEDUP_MULTI_IDX_MODE_APPEND,
 
     /* like NM_DEDUP_MULTI_IDX_MODE_APPEND, but if the object
-	 * is already in the cache, move it to the end. */
+     * is already in the cache, move it to the end. */
     NM_DEDUP_MULTI_IDX_MODE_APPEND_FORCE,
 } NMDedupMultiIdxMode;
 
@@ -56,7 +56,7 @@ struct _NMDedupMultiObjClass {
     void (*obj_destroy)(NMDedupMultiObj *obj);
 
     /* the NMDedupMultiObj can be deduplicated. For that the obj_full_hash_update()
-	 * and obj_full_equal() compare *all* fields of the object, even minor ones. */
+     * and obj_full_equal() compare *all* fields of the object, even minor ones. */
     void (*obj_full_hash_update)(const NMDedupMultiObj *obj, struct _NMHashState *h);
     gboolean (*obj_full_equal)(const NMDedupMultiObj *obj_a, const NMDedupMultiObj *obj_b);
 };
@@ -67,9 +67,9 @@ static inline const NMDedupMultiObj *
 nm_dedup_multi_obj_ref(const NMDedupMultiObj *obj)
 {
     /* ref and unref accept const pointers. Objects is supposed to be shared
-	 * and kept immutable. Disallowing to take/return a reference to a const
-	 * NMPObject is cumbersome, because callers are precisely expected to
-	 * keep a ref on the otherwise immutable object. */
+     * and kept immutable. Disallowing to take/return a reference to a const
+     * NMPObject is cumbersome, because callers are precisely expected to
+     * keep a ref on the otherwise immutable object. */
 
     nm_assert(obj);
     nm_assert(obj->_ref_count != NM_OBJ_REF_COUNT_STACKINIT);
@@ -146,12 +146,12 @@ struct _NMDedupMultiIdxTypeClass {
                                  const NMDedupMultiObj *    obj_b);
 
     /* an NMDedupMultiIdxTypeClass which implements partitioning of the
-	 * tracked objects, must implement the idx_obj_partition*() functions.
-	 *
-	 * idx_obj_partitionable() may return NULL if the object cannot be tracked.
-	 * For example, a index for routes by ifindex, may not want to track any
-	 * routes that don't have a valid ifindex. If the idx-type says that the
-	 * object is not partitionable, it is never added to the NMDedupMultiIndex. */
+     * tracked objects, must implement the idx_obj_partition*() functions.
+     *
+     * idx_obj_partitionable() may return NULL if the object cannot be tracked.
+     * For example, a index for routes by ifindex, may not want to track any
+     * routes that don't have a valid ifindex. If the idx-type says that the
+     * object is not partitionable, it is never added to the NMDedupMultiIndex. */
     gboolean (*idx_obj_partitionable)(const NMDedupMultiIdxType *idx_type,
                                       const NMDedupMultiObj *    obj);
     void (*idx_obj_partition_hash_update)(const NMDedupMultiIdxType *idx_type,
@@ -189,7 +189,7 @@ nm_dedup_multi_idx_type_partition_equal(const NMDedupMultiIdxType *
 
 struct _NMDedupMultiEntry {
     /* this is the list of all entries that share the same head entry.
-	 * All entries compare equal according to idx_obj_partition_equal(). */
+     * All entries compare equal according to idx_obj_partition_equal(). */
     CList lst_entries;
 
     /* const NMDedupMultiObj * */ gconstpointer obj;
@@ -202,7 +202,7 @@ struct _NMDedupMultiEntry {
 
 struct _NMDedupMultiHeadEntry {
     /* this is the list of all entries that share the same head entry.
-	 * All entries compare equal according to idx_obj_partition_equal(). */
+     * All entries compare equal according to idx_obj_partition_equal(). */
     CList lst_entries_head;
 
     const NMDedupMultiIdxType *idx_type;
@@ -220,7 +220,7 @@ static inline gconstpointer
 nm_dedup_multi_entry_get_obj(const NMDedupMultiEntry *entry)
 {
     /* convenience method that allows to skip the %NULL check on
-	 * @entry. Think of the NULL-conditional operator ?. of C# */
+     * @entry. Think of the NULL-conditional operator ?. of C# */
     return entry ? entry->obj : NULL;
 }
 
@@ -230,10 +230,10 @@ static inline void
 nm_dedup_multi_entry_set_dirty(const NMDedupMultiEntry *entry, gboolean dirty)
 {
     /* NMDedupMultiEntry is always exposed as a const object, because it is not
-	 * supposed to be modified outside NMDedupMultiIndex API. Except the "dirty"
-	 * flag. In C++ speak, it is a mutable field.
-	 *
-	 * Add this inline function, to cast-away constness and set the dirty flag. */
+     * supposed to be modified outside NMDedupMultiIndex API. Except the "dirty"
+     * flag. In C++ speak, it is a mutable field.
+     *
+     * Add this inline function, to cast-away constness and set the dirty flag. */
     nm_assert(entry);
     ((NMDedupMultiEntry *) entry)->dirty = dirty;
 }
@@ -338,7 +338,7 @@ nm_dedup_multi_iter_next(NMDedupMultiIter *iter)
         return FALSE;
 
     /* we always look ahead for the next. This way, the user
-	 * may delete the current entry (but no other entries). */
+     * may delete the current entry (but no other entries). */
     iter->current = c_list_entry(iter->_next, NMDedupMultiEntry, lst_entries);
     if (iter->_next->next == iter->_head)
         iter->_next = NULL;
@@ -392,8 +392,8 @@ nm_dedup_multi_head_entry_sort(const NMDedupMultiHeadEntry *head_entry,
 {
     if (head_entry) {
         /* the head entry can be sorted directly without messing up the
-		 * index to which it belongs. Of course, this does mess up any
-		 * NMDedupMultiIter instances. */
+         * index to which it belongs. Of course, this does mess up any
+         * NMDedupMultiIter instances. */
         c_list_sort((CList *) &head_entry->lst_entries_head, cmp, user_data);
     }
 }
diff --git a/shared/nm-glib-aux/nm-enum-utils.c b/shared/nm-glib-aux/nm-enum-utils.c
index 95596af06a..34430ae688 100644
--- a/shared/nm-glib-aux/nm-enum-utils.c
+++ b/shared/nm-glib-aux/nm-enum-utils.c
@@ -41,25 +41,25 @@ _ASSERT_enum_values_info(GType type, const NMUtilsEnumValueInfo *value_infos)
             enum_value = g_enum_get_value_by_nick(G_ENUM_CLASS(klass), value_infos->nick);
             if (enum_value) {
                 /* we do allow specifying the same name via @value_infos and @type.
-				 * That might make sense, if @type comes from a library where older versions
-				 * of the library don't yet support the value. In this case, the caller can
-				 * provide the nick via @value_infos, to support the older library version.
-				 * And then, when actually running against a newer library version where
-				 * @type knows the nick, we have this situation.
-				 *
-				 * Another reason for specifying a nick both in @value_infos and @type,
-				 * is to specify an alias which is not used with highest preference. For
-				 * example, if you add an alias "disabled" for "none" (both numerically
-				 * equal), then the first alias in @value_infos will be preferred over
-				 * the name from @type. So, to still use "none" as preferred name, you may
-				 * explicitly specify the "none" alias in @value_infos before "disabled".
-				 *
-				 * However, what never is allowed, is to use a name (nick) to re-number
-				 * the value. That is, if both @value_infos and @type contain a particular
-				 * nick, their numeric values must agree as well.
-				 * Allowing this, would be very confusing, because the name would have a different
-				 * value from the regular GLib GEnum API.
-				 */
+                 * That might make sense, if @type comes from a library where older versions
+                 * of the library don't yet support the value. In this case, the caller can
+                 * provide the nick via @value_infos, to support the older library version.
+                 * And then, when actually running against a newer library version where
+                 * @type knows the nick, we have this situation.
+                 *
+                 * Another reason for specifying a nick both in @value_infos and @type,
+                 * is to specify an alias which is not used with highest preference. For
+                 * example, if you add an alias "disabled" for "none" (both numerically
+                 * equal), then the first alias in @value_infos will be preferred over
+                 * the name from @type. So, to still use "none" as preferred name, you may
+                 * explicitly specify the "none" alias in @value_infos before "disabled".
+                 *
+                 * However, what never is allowed, is to use a name (nick) to re-number
+                 * the value. That is, if both @value_infos and @type contain a particular
+                 * nick, their numeric values must agree as well.
+                 * Allowing this, would be very confusing, because the name would have a different
+                 * value from the regular GLib GEnum API.
+                 */
                 g_assert(enum_value->value == value_infos->value);
             }
         } else {
diff --git a/shared/nm-glib-aux/nm-enum-utils.h b/shared/nm-glib-aux/nm-enum-utils.h
index 403c01fb0e..82e3e48367 100644
--- a/shared/nm-glib-aux/nm-enum-utils.h
+++ b/shared/nm-glib-aux/nm-enum-utils.h
@@ -10,7 +10,7 @@
 
 typedef struct _NMUtilsEnumValueInfo {
     /* currently, this is only used for _nm_utils_enum_from_str_full() to
-	 * declare additional aliases for values. */
+     * declare additional aliases for values. */
     const char *nick;
     int         value;
 } NMUtilsEnumValueInfo;
diff --git a/shared/nm-glib-aux/nm-errno.c b/shared/nm-glib-aux/nm-errno.c
index d4ebb866f1..fa9c50db77 100644
--- a/shared/nm-glib-aux/nm-errno.c
+++ b/shared/nm-glib-aux/nm-errno.c
@@ -170,8 +170,8 @@ nm_strerror_native(int errsv)
 
         if (pthread_key_create(&key, g_free) != 0 || pthread_setspecific(key, buf) != 0) {
             /* Failure. We will leak the buffer when the thread exits.
-			 *
-			 * Nothing we can do about it really. For Debug builds we fail with an assertion. */
+             *
+             * Nothing we can do about it really. For Debug builds we fail with an assertion. */
             nm_assert_not_reached();
         }
         errno = errno_saved;
diff --git a/shared/nm-glib-aux/nm-errno.h b/shared/nm-glib-aux/nm-errno.h
index a8a6385077..ca791c5e93 100644
--- a/shared/nm-glib-aux/nm-errno.h
+++ b/shared/nm-glib-aux/nm-errno.h
@@ -16,25 +16,25 @@ enum _NMErrno {
     _NM_ERRNO_RESERVED_FIRST = 100000,
 
     /* when we cannot represent a number as positive number, we resort to this
-	 * number. Basically, the values G_MININT, -NME_ERRNO_SUCCESS, NME_ERRNO_SUCCESS
-	 * and G_MAXINT all map to the same value. */
+     * number. Basically, the values G_MININT, -NME_ERRNO_SUCCESS, NME_ERRNO_SUCCESS
+     * and G_MAXINT all map to the same value. */
     NME_ERRNO_OUT_OF_RANGE = G_MAXINT,
 
     /* Indicate that the original errno was zero. Zero denotes *no error*, but we know something
-	 * went wrong and we want to report some error. This is a placeholder to mean, something
-	 * was wrong, but errno was zero. */
+     * went wrong and we want to report some error. This is a placeholder to mean, something
+     * was wrong, but errno was zero. */
     NME_ERRNO_SUCCESS = G_MAXINT - 1,
 
     /* an unspecified error. */
     NME_UNSPEC = _NM_ERRNO_RESERVED_FIRST,
 
     /* A bug, for example when an assertion failed.
-	 * Should never happen. */
+     * Should never happen. */
     NME_BUG,
 
     /* a native error number (from <errno.h>) cannot be mapped as
-	 * an nm-error, because it is in the range [_NM_ERRNO_RESERVED_FIRST,
-	 * _NM_ERRNO_RESERVED_LAST]. */
+     * an nm-error, because it is in the range [_NM_ERRNO_RESERVED_FIRST,
+     * _NM_ERRNO_RESERVED_LAST]. */
     NME_NATIVE_ERRNO,
 
     /* netlink errors. */
diff --git a/shared/nm-glib-aux/nm-glib.h b/shared/nm-glib-aux/nm-glib.h
index 70c3d77af7..5290bf93bc 100644
--- a/shared/nm-glib-aux/nm-glib.h
+++ b/shared/nm-glib-aux/nm-glib.h
@@ -225,7 +225,7 @@ static inline gboolean
 nm_g_hash_table_replace(GHashTable *hash, gpointer key, gpointer value)
 {
     /* glib 2.40 added a return value indicating whether the key already existed
-	 * (910191597a6c2e5d5d460e9ce9efb4f47d9cc63c). */
+     * (910191597a6c2e5d5d460e9ce9efb4f47d9cc63c). */
 #if GLIB_CHECK_VERSION(2, 40, 0)
     return g_hash_table_replace(hash, key, value);
 #else
@@ -240,7 +240,7 @@ static inline gboolean
 nm_g_hash_table_insert(GHashTable *hash, gpointer key, gpointer value)
 {
     /* glib 2.40 added a return value indicating whether the key already existed
-	 * (910191597a6c2e5d5d460e9ce9efb4f47d9cc63c). */
+     * (910191597a6c2e5d5d460e9ce9efb4f47d9cc63c). */
 #if GLIB_CHECK_VERSION(2, 40, 0)
     return g_hash_table_insert(hash, key, value);
 #else
@@ -255,7 +255,7 @@ static inline gboolean
 nm_g_hash_table_add(GHashTable *hash, gpointer key)
 {
     /* glib 2.40 added a return value indicating whether the key already existed
-	 * (910191597a6c2e5d5d460e9ce9efb4f47d9cc63c). */
+     * (910191597a6c2e5d5d460e9ce9efb4f47d9cc63c). */
 #if GLIB_CHECK_VERSION(2, 40, 0)
     return g_hash_table_add(hash, key);
 #else
@@ -639,7 +639,7 @@ g_hash_table_steal_extended(GHashTable *  hash_table,
             gpointer *_stolen_value = (stolen_value);                                        \
                                                                                              \
             /* we cannot allow NULL arguments, because then we would leak the values in
-		 * the compat implementation. */      \
+         * the compat implementation. */      \
             g_assert(_stolen_key);                                                           \
             g_assert(_stolen_value);                                                         \
                                                                                              \
diff --git a/shared/nm-glib-aux/nm-hash-utils.c b/shared/nm-glib-aux/nm-hash-utils.c
index 87ec164d2b..c2df5a88a5 100644
--- a/shared/nm-glib-aux/nm-hash-utils.c
+++ b/shared/nm-glib-aux/nm-hash-utils.c
@@ -25,7 +25,7 @@ static const guint8 *
 _get_hash_key_init(void)
 {
     /* the returned hash is aligned to guin64, hence, it is safe
-	 * to use it as guint* or guint64* pointer. */
+     * to use it as guint* or guint64* pointer. */
     static union {
         guint8  v8[HASH_KEY_SIZE];
         guint   _align_as_uint;
@@ -48,14 +48,14 @@ again:
         nm_utils_random_bytes(&t_arr, sizeof(t_arr));
 
         /* We only initialize one random hash key. So we can spend some effort
-		 * of getting this right. For one, we collect more random bytes than
-		 * necessary.
-		 *
-		 * Then, the first guint of the seed should have all the entropy that we could
-		 * obtain in sizeof(t_arr). For that, siphash(t_arr) and xor the first guint
-		 * with hash.
-		 * The first guint is especially interesting for nm_hash_static() below that
-		 * doesn't use siphash itself. */
+         * of getting this right. For one, we collect more random bytes than
+         * necessary.
+         *
+         * Then, the first guint of the seed should have all the entropy that we could
+         * obtain in sizeof(t_arr). For that, siphash(t_arr) and xor the first guint
+         * with hash.
+         * The first guint is especially interesting for nm_hash_static() below that
+         * doesn't use siphash itself. */
         h = c_siphash_hash(t_arr.v8, (const guint8 *) &t_arr, sizeof(t_arr));
         if (sizeof(h) > sizeof(guint))
             t_arr.vuint = t_arr.vuint ^ ((guint)(h & G_MAXUINT)) ^ ((guint)(h >> 32));
@@ -91,21 +91,21 @@ guint
 nm_hash_static(guint static_seed)
 {
     /* Note that we only xor the static_seed with the first guint of the key.
-	 *
-	 * We don't use siphash, which would mix the bits better with _get_hash_key().
-	 * Note that nm_hash_static() isn't used to hash the static_seed. Instead, it
-	 * is used to get a unique hash value in a static context. That means, every
-	 * caller is responsible to choose a static_seed that is sufficiently
-	 * distinct from all other callers. In other words, static_seed should be a
-	 * unique constant with good entropy.
-	 *
-	 * Note that _get_hash_key_init() already xored the first guint of the
-	 * key with the siphash of the entire static key. That means, even if
-	 * we got bad randomness for the first guint, the first guint is also
-	 * mixed with the randomness of the entire random key.
-	 *
-	 * Also, ensure that we don't return zero (like for nm_hash_complete()).
-	 */
+     *
+     * We don't use siphash, which would mix the bits better with _get_hash_key().
+     * Note that nm_hash_static() isn't used to hash the static_seed. Instead, it
+     * is used to get a unique hash value in a static context. That means, every
+     * caller is responsible to choose a static_seed that is sufficiently
+     * distinct from all other callers. In other words, static_seed should be a
+     * unique constant with good entropy.
+     *
+     * Note that _get_hash_key_init() already xored the first guint of the
+     * key with the siphash of the entire static key. That means, even if
+     * we got bad randomness for the first guint, the first guint is also
+     * mixed with the randomness of the entire random key.
+     *
+     * Also, ensure that we don't return zero (like for nm_hash_complete()).
+     */
     return ((*((const guint *) _get_hash_key())) ^ static_seed) ?: 3679500967u;
 }
 
diff --git a/shared/nm-glib-aux/nm-hash-utils.h b/shared/nm-glib-aux/nm-hash-utils.h
index ff529d224c..543389975a 100644
--- a/shared/nm-glib-aux/nm-hash-utils.h
+++ b/shared/nm-glib-aux/nm-hash-utils.h
@@ -67,14 +67,14 @@ nm_hash_complete_u64(NMHashState *state)
     nm_assert(state);
 
     /* this returns the native u64 hash value. Note that this differs
-	 * from nm_hash_complete() in two ways:
-	 *
-	 * - the type, guint64 vs. guint.
-	 * - nm_hash_complete() never returns zero.
-	 *
-	 * In practice, nm_hash*() API is implemented via siphash24, so this returns
-	 * the siphash24 value. But that is not guaranteed by the API, and if you need
-	 * siphash24 directly, use c_siphash_*() and nm_hash_siphash42*() API. */
+     * from nm_hash_complete() in two ways:
+     *
+     * - the type, guint64 vs. guint.
+     * - nm_hash_complete() never returns zero.
+     *
+     * In practice, nm_hash*() API is implemented via siphash24, so this returns
+     * the siphash24 value. But that is not guaranteed by the API, and if you need
+     * siphash24 directly, use c_siphash_*() and nm_hash_siphash42*() API. */
     return c_siphash_finalize(&state->_state);
 }
 
@@ -86,8 +86,8 @@ nm_hash_complete(NMHashState *state)
     h = nm_hash_complete_u64(state);
 
     /* we don't ever want to return a zero hash.
-	 *
-	 * NMPObject requires that in _idx_obj_part(), and it's just a good idea. */
+     *
+     * NMPObject requires that in _idx_obj_part(), and it's just a good idea. */
     return (((guint)(h >> 32)) ^ ((guint) h)) ?: 1396707757u;
 }
 
@@ -98,10 +98,10 @@ nm_hash_update(NMHashState *state, const void *ptr, gsize n)
     nm_assert(n == 0 || ptr);
 
     /* Note: the data passed in here might be sensitive data (secrets),
-	 * that we should nm_explicit_bzero() afterwards. However, since
-	 * we are using siphash24 with a random key, that is not really
-	 * necessary. Something to keep in mind, if we ever move away from
-	 * this hash implementation. */
+     * that we should nm_explicit_bzero() afterwards. However, since
+     * we are using siphash24 with a random key, that is not really
+     * necessary. Something to keep in mind, if we ever move away from
+     * this hash implementation. */
     c_siphash_append(&state->_state, ptr, n);
 }
 
@@ -270,12 +270,12 @@ static inline void
 nm_hash_update_mem(NMHashState *state, const void *ptr, gsize n)
 {
     /* This also hashes the length of the data. That means,
-	 * hashing two consecutive binary fields (of arbitrary
-	 * length), will hash differently. That is,
-	 * [[1,1], []] differs from [[1],[1]].
-	 *
-	 * If you have a constant length (sizeof), use nm_hash_update()
-	 * instead. */
+     * hashing two consecutive binary fields (of arbitrary
+     * length), will hash differently. That is,
+     * [[1,1], []] differs from [[1],[1]].
+     *
+     * If you have a constant length (sizeof), use nm_hash_update()
+     * instead. */
     nm_hash_update(state, &n, sizeof(n));
     if (n > 0)
         nm_hash_update(state, ptr, n);
diff --git a/shared/nm-glib-aux/nm-io-utils.c b/shared/nm-glib-aux/nm-io-utils.c
index db7ed0d000..784ab5f771 100644
--- a/shared/nm-glib-aux/nm-io-utils.c
+++ b/shared/nm-glib-aux/nm-io-utils.c
@@ -385,11 +385,11 @@ nm_utils_file_set_contents(const char *filename,
     }
 
     /* If the final destination exists and is > 0 bytes, we want to sync the
-	 * newly written file to ensure the data is on disk when we rename over
-	 * the destination. Otherwise, if we get a system crash we can lose both
-	 * the new and the old file on some filesystems. (I.E. those that don't
-	 * guarantee the data is written to the disk before the metadata.)
-	 */
+     * newly written file to ensure the data is on disk when we rename over
+     * the destination. Otherwise, if we get a system crash we can lose both
+     * the new and the old file on some filesystems. (I.E. those that don't
+     * guarantee the data is written to the disk before the metadata.)
+     */
     if (lstat(filename, &statbuf) == 0 && statbuf.st_size > 0) {
         if (fsync(fd) != 0) {
             errsv = NM_ERRNO_NATIVE(errno);
@@ -457,10 +457,10 @@ nm_utils_fd_read(int fd, NMStrBuf *out_string)
     g_return_val_if_fail(out_string, -1);
 
     /* If the buffer size is 0, we allocate NM_UTILS_GET_NEXT_REALLOC_SIZE_1000 (1000 bytes)
-	 * the first time. Afterwards, the buffer grows exponentially.
-	 *
-	 * Note that with @buf_available, we always would read as much buffer as we actually
-	 * have reserved. */
+     * the first time. Afterwards, the buffer grows exponentially.
+     *
+     * Note that with @buf_available, we always would read as much buffer as we actually
+     * have reserved. */
     nm_str_buf_maybe_expand(out_string, NM_UTILS_GET_NEXT_REALLOC_SIZE_1000, FALSE);
 
     buf_available = out_string->allocated - out_string->len;
diff --git a/shared/nm-glib-aux/nm-json-aux.c b/shared/nm-glib-aux/nm-json-aux.c
index 1d1e456cba..e344b3d4bd 100644
--- a/shared/nm-glib-aux/nm-json-aux.c
+++ b/shared/nm-glib-aux/nm-json-aux.c
@@ -82,18 +82,18 @@ _gstr_append_string_len(GString *gstr, const char *str, gsize len)
 
         if (end[0] == '\0') {
             /* there is a NUL byte in the string. Technically this is valid UTF-8, so we
-			 * encode it there. However, this will likely result in a truncated string when
-			 * parsing. */
+             * encode it there. However, this will likely result in a truncated string when
+             * parsing. */
             g_string_append(gstr, "\\u0000");
         } else {
             /* the character is not valid UTF-8. There is nothing we can do about it, because
-			 * JSON can only contain UTF-8 and even the escape sequences can only escape Unicode
-			 * codepoints (but not binary).
-			 *
-			 * The argument is not a string (in any known encoding), hence we cannot represent
-			 * it as a JSON string (which are unicode strings).
-			 *
-			 * Print an underscore instead of the invalid char :) */
+             * JSON can only contain UTF-8 and even the escape sequences can only escape Unicode
+             * codepoints (but not binary).
+             *
+             * The argument is not a string (in any known encoding), hence we cannot represent
+             * it as a JSON string (which are unicode strings).
+             *
+             * Print an underscore instead of the invalid char :) */
             g_string_append_c(gstr, '_');
         }
 
diff --git a/shared/nm-glib-aux/nm-json-aux.h b/shared/nm-glib-aux/nm-json-aux.h
index 5f8a69c22d..4e349e647d 100644
--- a/shared/nm-glib-aux/nm-json-aux.h
+++ b/shared/nm-glib-aux/nm-json-aux.h
@@ -141,8 +141,8 @@ static inline void
 nm_json_decref(const NMJsonVt *vt, nm_json_t *json)
 {
     /* Our ref-counting is not threadsafe, unlike libjansson's. But we never
-	 * share one json_t instance between threads, and if we would, we would very likely
-	 * wrap a mutex around it. */
+     * share one json_t instance between threads, and if we would, we would very likely
+     * wrap a mutex around it. */
     if (json && json->refcount != (size_t) -1 && --json->refcount == 0)
         vt->nm_json_delete(json);
 }
@@ -296,7 +296,7 @@ nm_value_type_from_json(const NMJsonVt * vt,
         return (nm_jansson_json_as_int(vt, elem, out_val) > 0);
 
     /* warning: this overwrites/leaks the previous value. You better have *out_val
-	 * point to uninitialized memory or NULL. */
+     * point to uninitialized memory or NULL. */
     case NM_VALUE_TYPE_STRING:
         return (nm_jansson_json_as_string(vt, elem, out_val) > 0);
 
diff --git a/shared/nm-glib-aux/nm-logging-base.h b/shared/nm-glib-aux/nm-logging-base.h
index e838d08f95..63e7ddddd5 100644
--- a/shared/nm-glib-aux/nm-logging-base.h
+++ b/shared/nm-glib-aux/nm-logging-base.h
@@ -10,12 +10,12 @@ typedef struct {
     const char *level_str;
 
     /* nm-logging uses syslog internally. Note that the three most-verbose syslog levels
-	 * are LOG_DEBUG, LOG_INFO and LOG_NOTICE. Journal already highlights LOG_NOTICE
-	 * as special.
-	 *
-	 * On the other hand, we have three levels LOGL_TRACE, LOGL_DEBUG and LOGL_INFO,
-	 * which are regular messages not to be highlighted. For that reason, we must map
-	 * LOGL_TRACE and LOGL_DEBUG both to syslog level LOG_DEBUG. */
+     * are LOG_DEBUG, LOG_INFO and LOG_NOTICE. Journal already highlights LOG_NOTICE
+     * as special.
+     *
+     * On the other hand, we have three levels LOGL_TRACE, LOGL_DEBUG and LOGL_INFO,
+     * which are regular messages not to be highlighted. For that reason, we must map
+     * LOGL_TRACE and LOGL_DEBUG both to syslog level LOG_DEBUG. */
     int syslog_level;
 
     GLogLevelFlags g_log_level;
diff --git a/shared/nm-glib-aux/nm-macros-internal.h b/shared/nm-glib-aux/nm-macros-internal.h
index 47e544f512..4ba280dbe3 100644
--- a/shared/nm-glib-aux/nm-macros-internal.h
+++ b/shared/nm-glib-aux/nm-macros-internal.h
@@ -811,15 +811,15 @@ nm_str_realloc(char *str)
     gs_free char *s = str;
 
     /* Returns a new clone of @str and frees @str. The point is that @str
-	 * possibly points to a larger chunck of memory. We want to freshly allocate
-	 * a buffer.
-	 *
-	 * We could use realloc(), but that might not do anything or leave
-	 * @str in its memory pool for chunks of a different size (bad for
-	 * fragmentation).
-	 *
-	 * This is only useful when we want to keep the buffer around for a long
-	 * time and want to re-allocate a more optimal buffer. */
+     * possibly points to a larger chunck of memory. We want to freshly allocate
+     * a buffer.
+     *
+     * We could use realloc(), but that might not do anything or leave
+     * @str in its memory pool for chunks of a different size (bad for
+     * fragmentation).
+     *
+     * This is only useful when we want to keep the buffer around for a long
+     * time and want to re-allocate a more optimal buffer. */
 
     return g_strdup(s);
 }
@@ -970,9 +970,9 @@ static inline void
 nm_g_object_unref(gpointer obj)
 {
     /* g_object_unref() doesn't accept NULL. Usually, we workaround that
-	 * by using g_clear_object(), but sometimes that is not convenient
-	 * (for example as destroy function for a hash table that can contain
-	 * NULL values). */
+     * by using g_clear_object(), but sometimes that is not convenient
+     * (for example as destroy function for a hash table that can contain
+     * NULL values). */
     if (obj)
         g_object_unref(obj);
 }
@@ -1697,7 +1697,7 @@ nm_decode_version(guint version, guint *major, guint *minor, guint *micro)
         int   _buf_len;                                                                     \
                                                                                             \
         /* some static assert trying to ensure that the buffer is statically allocated.
-		 * It disallows a buffer size of sizeof(gpointer) to catch that. */     \
+         * It disallows a buffer size of sizeof(gpointer) to catch that. */     \
         G_STATIC_ASSERT(G_N_ELEMENTS(buf) == sizeof(buf) && sizeof(buf) != sizeof(char *)); \
         _buf_len = g_snprintf(_buf, sizeof(buf), "" format "", ##__VA_ARGS__);              \
         nm_assert(_buf_len < sizeof(buf));                                                  \
diff --git a/shared/nm-glib-aux/nm-obj.h b/shared/nm-glib-aux/nm-obj.h
index f1addf8a0b..bc2f6da93c 100644
--- a/shared/nm-glib-aux/nm-obj.h
+++ b/shared/nm-glib-aux/nm-obj.h
@@ -15,20 +15,20 @@ typedef struct _NMObjBaseClass NMObjBaseClass;
 
 struct _NMObjBaseInst {
     /* The first field of NMObjBaseInst is compatible with GObject.
-	 * Basically, NMObjBaseInst is an abstract base type of GTypeInstance.
-	 *
-	 * If you do it right, you may derive a type of NMObjBaseInst as a proper GTypeInstance.
-	 * That involves allocating a GType for it, which can be inconvenient because
-	 * a GType is dynamically created (and the class can no longer be immutable
-	 * memory).
-	 *
-	 * Even if your implementation of NMObjBaseInst is not a full fledged GType(Instance),
-	 * you still can use GTypeInstances in the same context as you can decide based on the
-	 * NMObjBaseClass with what kind of object you are dealing with.
-	 *
-	 * Basically, the only thing NMObjBaseInst gives you is access to an
-	 * NMObjBaseClass instance.
-	 */
+     * Basically, NMObjBaseInst is an abstract base type of GTypeInstance.
+     *
+     * If you do it right, you may derive a type of NMObjBaseInst as a proper GTypeInstance.
+     * That involves allocating a GType for it, which can be inconvenient because
+     * a GType is dynamically created (and the class can no longer be immutable
+     * memory).
+     *
+     * Even if your implementation of NMObjBaseInst is not a full fledged GType(Instance),
+     * you still can use GTypeInstances in the same context as you can decide based on the
+     * NMObjBaseClass with what kind of object you are dealing with.
+     *
+     * Basically, the only thing NMObjBaseInst gives you is access to an
+     * NMObjBaseClass instance.
+     */
     union {
         const NMObjBaseClass *klass;
         GTypeInstance         g_type_instance;
@@ -37,24 +37,24 @@ struct _NMObjBaseInst {
 
 struct _NMObjBaseClass {
     /* NMObjBaseClass is the base class of all NMObjBaseInst implementations.
-	 * Note that it is also an abstract super class of GTypeInstance, that means
-	 * you may implement a NMObjBaseClass as a subtype of GTypeClass.
-	 *
-	 * For that to work, you must properly set the GTypeClass instance (and its
-	 * GType).
-	 *
-	 * Note that to implement a NMObjBaseClass that is *not* a GTypeClass, you wouldn't
-	 * set the GType. Hence, this field is only useful for type implementations that actually
-	 * extend GTypeClass.
-	 *
-	 * In a way it is wrong that NMObjBaseClass has the GType member, because it is
-	 * a base class of GTypeClass and doesn't necessarily use the GType. However,
-	 * it is here so that G_TYPE_CHECK_INSTANCE_TYPE() and friends work correctly
-	 * on any NMObjectClass. That means, while not necessary, it is convenient that
-	 * a NMObjBaseClass has all members of GTypeClass.
-	 * Also note that usually you have only one instance of a certain type, so this
-	 * wastes just a few bytes for the unneeded GType.
-	 */
+     * Note that it is also an abstract super class of GTypeInstance, that means
+     * you may implement a NMObjBaseClass as a subtype of GTypeClass.
+     *
+     * For that to work, you must properly set the GTypeClass instance (and its
+     * GType).
+     *
+     * Note that to implement a NMObjBaseClass that is *not* a GTypeClass, you wouldn't
+     * set the GType. Hence, this field is only useful for type implementations that actually
+     * extend GTypeClass.
+     *
+     * In a way it is wrong that NMObjBaseClass has the GType member, because it is
+     * a base class of GTypeClass and doesn't necessarily use the GType. However,
+     * it is here so that G_TYPE_CHECK_INSTANCE_TYPE() and friends work correctly
+     * on any NMObjectClass. That means, while not necessary, it is convenient that
+     * a NMObjBaseClass has all members of GTypeClass.
+     * Also note that usually you have only one instance of a certain type, so this
+     * wastes just a few bytes for the unneeded GType.
+     */
     union {
         GType      g_type;
         GTypeClass g_type_class;
diff --git a/shared/nm-glib-aux/nm-random-utils.c b/shared/nm-glib-aux/nm-random-utils.c
index 93c943ab66..83d620dcaa 100644
--- a/shared/nm-glib-aux/nm-random-utils.c
+++ b/shared/nm-glib-aux/nm-random-utils.c
@@ -64,29 +64,29 @@ nm_utils_random_bytes(void *p, size_t n)
                     return TRUE;
 
                 /* no or partial read. There is not enough entropy.
-				 * Fill the rest reading from urandom, and remember that
-				 * some bits are not high quality. */
+                 * Fill the rest reading from urandom, and remember that
+                 * some bits are not high quality. */
                 nm_assert(r < n);
                 buf += r;
                 n -= r;
                 has_high_quality = FALSE;
 
                 /* At this point, we don't want to read /dev/urandom, because
-				 * the entropy pool is low (early boot?), and asking for more
-				 * entropy causes kernel messages to be logged.
-				 *
-				 * We use our fallback via GRand. Note that g_rand_new() also
-				 * tries to seed itself with data from /dev/urandom, but since
-				 * we reuse the instance, it shouldn't matter. */
+                 * the entropy pool is low (early boot?), and asking for more
+                 * entropy causes kernel messages to be logged.
+                 *
+                 * We use our fallback via GRand. Note that g_rand_new() also
+                 * tries to seed itself with data from /dev/urandom, but since
+                 * we reuse the instance, it shouldn't matter. */
                 avoid_urandom = TRUE;
             } else {
                 if (errno == ENOSYS) {
                     /* no support for getrandom(). We don't know whether
-					 * we urandom will give us good quality. Assume yes. */
+                     * we urandom will give us good quality. Assume yes. */
                     have_syscall = FALSE;
                 } else {
                     /* unknown error. We'll read urandom below, but we don't have
-					 * high-quality randomness. */
+                     * high-quality randomness. */
                     has_high_quality = FALSE;
                 }
             }
@@ -116,10 +116,10 @@ fd_open:
         int                            j;
 
         /* we failed to fill the bytes reading from urandom.
-		 * Fill the bits using GRand pseudo random numbers.
-		 *
-		 * We don't have good quality.
-		 */
+         * Fill the bits using GRand pseudo random numbers.
+         *
+         * We don't have good quality.
+         */
         has_high_quality = FALSE;
 
         if (G_UNLIKELY(!rand))
diff --git a/shared/nm-glib-aux/nm-ref-string.c b/shared/nm-glib-aux/nm-ref-string.c
index bc40c63d44..fcd8d6441d 100644
--- a/shared/nm-glib-aux/nm-ref-string.c
+++ b/shared/nm-glib-aux/nm-ref-string.c
@@ -177,7 +177,7 @@ _nm_ref_string_unref_non_null(NMRefString *rstr)
     G_LOCK(gl_lock);
 
     /* in the fast-path above, we already decremented the ref-count to zero.
-	 * We need recheck that the ref-count is still zero. */
+     * We need recheck that the ref-count is still zero. */
 
     if (g_atomic_int_get(&rstr0->ref_count) == 0) {
         if (!g_hash_table_remove(gl_hash, rstr0))
diff --git a/shared/nm-glib-aux/nm-ref-string.h b/shared/nm-glib-aux/nm-ref-string.h
index 11733589ac..b70f7728a4 100644
--- a/shared/nm-glib-aux/nm-ref-string.h
+++ b/shared/nm-glib-aux/nm-ref-string.h
@@ -51,8 +51,8 @@ static inline gboolean
 nm_ref_string_equals_str(NMRefString *rstr, const char *s)
 {
     /* Note that rstr->len might be greater than strlen(rstr->str). This function does
-	 * not cover that and would ignore everything after the first NUL byte. If you need
-	 * that distinction, this function is not for you. */
+     * not cover that and would ignore everything after the first NUL byte. If you need
+     * that distinction, this function is not for you. */
 
     return rstr ? (s && nm_streq(rstr->str, s)) : (s == NULL);
 }
@@ -70,9 +70,9 @@ NM_IS_REF_STRING(const NMRefString *rstr)
 #endif
 
     /* Technically, %NULL is also a valid NMRefString (according to nm_ref_string_new(),
-	 * nm_ref_string_get_str() and nm_ref_string_unref()). However, NM_IS_REF_STRING()
-	 * does not think so. If callers want to allow %NULL, they need to check
-	 * separately. */
+     * nm_ref_string_get_str() and nm_ref_string_unref()). However, NM_IS_REF_STRING()
+     * does not think so. If callers want to allow %NULL, they need to check
+     * separately. */
     return !!rstr;
 }
 
diff --git a/shared/nm-glib-aux/nm-secret-utils.c b/shared/nm-glib-aux/nm-secret-utils.c
index b51082b8b6..9c2c3cca8e 100644
--- a/shared/nm-glib-aux/nm-secret-utils.c
+++ b/shared/nm-glib-aux/nm-secret-utils.c
@@ -44,11 +44,11 @@ nm_free_secret(char *secret)
 
 #if GLIB_CHECK_VERSION(2, 44, 0)
     /* Here we mix malloc() and g_malloc() API. Usually we avoid this,
-	 * however since glib 2.44.0 we are in fact guaranteed that g_malloc()/g_free()
-	 * just wraps malloc()/free(), so this is actually fine.
-	 *
-	 * See https://gitlab.gnome.org/GNOME/glib/commit/3be6ed60aa58095691bd697344765e715a327fc1
-	 */
+     * however since glib 2.44.0 we are in fact guaranteed that g_malloc()/g_free()
+     * just wraps malloc()/free(), so this is actually fine.
+     *
+     * See https://gitlab.gnome.org/GNOME/glib/commit/3be6ed60aa58095691bd697344765e715a327fc1
+     */
     len = malloc_usable_size(secret);
 #else
     len = strlen(secret);
@@ -68,9 +68,9 @@ nm_secret_strchomp(char *secret)
     g_return_val_if_fail(secret, NULL);
 
     /* it's actually identical to g_strchomp(). However,
-	 * the glib function does not document, that it clears the
-	 * memory. For @secret, we don't only want to truncate trailing
-	 * spaces, we want to overwrite them with NUL. */
+     * the glib function does not document, that it clears the
+     * memory. For @secret, we don't only want to truncate trailing
+     * spaces, we want to overwrite them with NUL. */
 
     len = strlen(secret);
     while (len--) {
@@ -96,16 +96,16 @@ nm_secret_copy_to_gbytes(gconstpointer mem, gsize mem_len)
     nm_assert(mem);
 
     /* NUL terminate the buffer.
-	 *
-	 * The entire buffer is already malloc'ed and likely has some room for padding.
-	 * Thus, in many situations, this additional byte will cause no overhead in
-	 * practice.
-	 *
-	 * Even if it causes an overhead, do it just for safety. Yes, the returned
-	 * bytes is not a NUL terminated string and no user must rely on this. Do
-	 * not treat binary data as NUL terminated strings, unless you know what
-	 * you are doing. Anyway, defensive FTW.
-	 */
+     *
+     * The entire buffer is already malloc'ed and likely has some room for padding.
+     * Thus, in many situations, this additional byte will cause no overhead in
+     * practice.
+     *
+     * Even if it causes an overhead, do it just for safety. Yes, the returned
+     * bytes is not a NUL terminated string and no user must rely on this. Do
+     * not treat binary data as NUL terminated strings, unless you know what
+     * you are doing. Anyway, defensive FTW.
+     */
 
     b = nm_secret_buf_new(mem_len + 1);
     memcpy(b->bin, mem, mem_len);
diff --git a/shared/nm-glib-aux/nm-secret-utils.h b/shared/nm-glib-aux/nm-secret-utils.h
index 67a5f10d49..a8f33ce812 100644
--- a/shared/nm-glib-aux/nm-secret-utils.h
+++ b/shared/nm-glib-aux/nm-secret-utils.h
@@ -44,7 +44,7 @@ typedef struct {
     gsize len;
 
     /* the data pointer. This pointer must be allocated with malloc (at least
-	 * when used with nm_secret_ptr_clear()). */
+     * when used with nm_secret_ptr_clear()). */
     union {
         char *  str;
         void *  ptr;
diff --git a/shared/nm-glib-aux/nm-shared-utils.c b/shared/nm-glib-aux/nm-shared-utils.c
index f8bddff548..d2ad22f8a3 100644
--- a/shared/nm-glib-aux/nm-shared-utils.c
+++ b/shared/nm-glib-aux/nm-shared-utils.c
@@ -58,7 +58,7 @@ nm_ip_addr_set_from_untrusted(int           addr_family,
     case AF_UNSPEC:
         if (!out_addr_family) {
             /* when the callers allow undefined @addr_family, they must provide
-			 * an @out_addr_family argument. */
+             * an @out_addr_family argument. */
             nm_assert_not_reached();
             return FALSE;
         }
@@ -83,7 +83,7 @@ nm_ip_addr_set_from_untrusted(int           addr_family,
         break;
     default:
         /* when the callers allow undefined @addr_family, they must provide
-		 * an @out_addr_family argument. */
+         * an @out_addr_family argument. */
         nm_assert(out_addr_family);
         return FALSE;
     }
@@ -130,7 +130,7 @@ _nm_assert_on_main_thread(void)
 
     if (G_LIKELY(tid == seen_tid)) {
         /* we don't care about false positives (when the process forked, and the thread-id
-		 * is accidentally re-used) . It's for assertions only. */
+         * is accidentally re-used) . It's for assertions only. */
         success = TRUE;
     } else {
         pid = getpid();
@@ -138,7 +138,7 @@ _nm_assert_on_main_thread(void)
 
         if (seen_tid == 0 || seen_pid != pid) {
             /* either this is the first time we call the function, or the process
-			 * forked. In both cases, remember the thread-id. */
+             * forked. In both cases, remember the thread-id. */
             seen_tid = tid;
             seen_pid = pid;
             success  = TRUE;
@@ -333,8 +333,8 @@ nm_utils_strbuf_seek_end(char **buf, gsize *len)
 
 truncate:
     /* hm, no NUL character within len bytes.
-	 * Just NUL terminate the array and consume them
-	 * all. */
+     * Just NUL terminate the array and consume them
+     * all. */
     *buf += *len;
     (*buf)[-1] = '\0';
     *len       = 0;
@@ -379,7 +379,7 @@ nm_utils_gbytes_equal_mem(GBytes *bytes, gconstpointer mem_data, gsize mem_len)
 
     if (!bytes) {
         /* as a special case, let %NULL GBytes compare identical
-		 * to an empty array. */
+         * to an empty array. */
         return (mem_len == 0);
     }
 
@@ -531,7 +531,7 @@ nm_strquote(char *buf, gsize buf_len, const char *str)
     nm_utils_strbuf_append_str(&buf, &buf_len, str);
 
     /* if the string was too long we indicate truncation with a
-	 * '^' instead of a closing quote. */
+     * '^' instead of a closing quote. */
     if (G_UNLIKELY(buf_len <= 1)) {
         switch (buf_len) {
         case 1:
@@ -781,7 +781,7 @@ nm_utils_ip_is_site_local(int addr_family, const void *address)
     switch (addr_family) {
     case AF_INET:
         /* RFC1918 private addresses
-		 * 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 */
+         * 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 */
         addr4 = ntohl(*((const in_addr_t *) address));
         return (addr4 & 0xff000000) == 0x0a000000 || (addr4 & 0xfff00000) == 0xac100000
                || (addr4 & 0xffff0000) == 0xc0a80000;
@@ -812,16 +812,16 @@ _parse_legacy_addr4(const char *text, in_addr_t *out_addr, GError **error)
     }
 
     /* OK, inet_aton() accepted the format. That's good, because we want
-	 * to accept IPv4 addresses in octal format, like 255.255.000.000.
-	 * That's what "legacy" means here. inet_pton() doesn't accept those.
-	 *
-	 * But inet_aton() also ignores trailing garbage and formats with fewer than
-	 * 4 digits. That is just too crazy and we don't do that. Perform additional checks
-	 * and reject some forms that inet_aton() accepted.
-	 *
-	 * Note that we still should (of course) accept everything that inet_pton()
-	 * accepts. However this code never gets called if inet_pton() succeeds
-	 * (see below, aside the assertion code). */
+     * to accept IPv4 addresses in octal format, like 255.255.000.000.
+     * That's what "legacy" means here. inet_pton() doesn't accept those.
+     *
+     * But inet_aton() also ignores trailing garbage and formats with fewer than
+     * 4 digits. That is just too crazy and we don't do that. Perform additional checks
+     * and reject some forms that inet_aton() accepted.
+     *
+     * Note that we still should (of course) accept everything that inet_pton()
+     * accepts. However this code never gets called if inet_pton() succeeds
+     * (see below, aside the assertion code). */
 
     if (NM_STRCHAR_ANY(text, ch, (!(ch >= '0' && ch <= '9') && !NM_IN_SET(ch, '.', 'x')))) {
         /* We only accepts '.', digits, and 'x' for "0x". */
@@ -846,7 +846,7 @@ _parse_legacy_addr4(const char *text, in_addr_t *out_addr, GError **error)
 
         if ((i == G_N_ELEMENTS(bin) - 1) != (s == NULL)) {
             /* Exactly for the last digit, we expect to have no more following token.
-			 * But this isn't the case. Abort. */
+             * But this isn't the case. Abort. */
             g_set_error(error,
                         NM_UTILS_ERROR,
                         NM_UTILS_ERROR_INVALID_ARGUMENT,
@@ -861,7 +861,7 @@ _parse_legacy_addr4(const char *text, in_addr_t *out_addr, GError **error)
             int errsv = errno;
 
             /* we do accept octal and hex (even with leading "0x"). But something
-			 * about this token is wrong. */
+             * about this token is wrong. */
             g_set_error(error,
                         NM_UTILS_ERROR,
                         NM_UTILS_ERROR_INVALID_ARGUMENT,
@@ -877,7 +877,7 @@ _parse_legacy_addr4(const char *text, in_addr_t *out_addr, GError **error)
 
     if (memcmp(bin, &a1, sizeof(bin)) != 0) {
         /* our parsing did not agree with what inet_aton() gave. Something
-		 * is wrong. Abort. */
+         * is wrong. Abort. */
         g_set_error(
             error,
             NM_UTILS_ERROR,
@@ -916,7 +916,7 @@ nm_utils_parse_inaddr_bin_full(int         addr_family,
         if (accept_legacy && addr_family == AF_INET
             && _parse_legacy_addr4(text, &addrbin.addr4, NULL)) {
             /* The address is in some legacy format which inet_aton() accepts, but not inet_pton().
-			 * Most likely octal digits (leading zeros). We accept the address. */
+             * Most likely octal digits (leading zeros). We accept the address. */
         } else
             return FALSE;
     }
@@ -927,7 +927,7 @@ nm_utils_parse_inaddr_bin_full(int         addr_family,
         in_addr_t             a;
 
         /* The legacy parser should accept everything that inet_pton() accepts too. Meaning,
-		 * it should strictly parse *more* formats. And of course, parse it the same way. */
+         * it should strictly parse *more* formats. And of course, parse it the same way. */
         if (!_parse_legacy_addr4(text, &a, &error)) {
             char buf[INET_ADDRSTRLEN];
 
@@ -1000,7 +1000,7 @@ nm_utils_parse_inaddr_prefix_bin(int         addr_family,
 
     if (slash) {
         /* For IPv4, `ip addr add` supports the prefix-length as a netmask. We don't
-		 * do that. */
+         * do that. */
         prefix =
             _nm_utils_ascii_str_to_int64(&slash[1], 10, 0, addr_family == AF_INET ? 32 : 128, -1);
         if (prefix == -1)
@@ -1052,7 +1052,7 @@ nm_utils_parse_next_line(const char **inout_ptr,
     for (line_len = 0;; line_len++) {
         if (line_len >= *inout_len) {
             /* if we consumed the entire line, we place the pointer at
-			 * one character after the end. */
+             * one character after the end. */
             *inout_ptr = &line_start[line_len];
             *inout_len = 0;
             goto done;
@@ -1245,7 +1245,7 @@ again:
 #endif
 
     /* Not really much else to do. Return the parsed value and leave errno set
-	 * to the unexpected value. */
+     * to the unexpected value. */
     return v;
 }
 
@@ -1335,7 +1335,7 @@ _nm_utils_ascii_str_to_uint64(const char *str,
 
     if (v != 0 && str[0] == '-') {
         /* As documented, g_ascii_strtoull() accepts negative values, and returns their
-		 * absolute value. We don't. */
+         * absolute value. We don't. */
         errno = ERANGE;
         return fallback;
     }
@@ -1405,11 +1405,11 @@ int
 nm_cmp_int2ptr_p_with_data(gconstpointer p_a, gconstpointer p_b, gpointer user_data)
 {
     /* p_a and p_b are two pointers to a pointer, where the pointer is
-	 * interpreted as a integer using GPOINTER_TO_INT().
-	 *
-	 * That is the case of a hash-table that uses GINT_TO_POINTER() to
-	 * convert integers as pointers, and the resulting keys-as-array
-	 * array. */
+     * interpreted as a integer using GPOINTER_TO_INT().
+     *
+     * That is the case of a hash-table that uses GINT_TO_POINTER() to
+     * convert integers as pointers, and the resulting keys-as-array
+     * array. */
     const int a = GPOINTER_TO_INT(*((gconstpointer *) p_a));
     const int b = GPOINTER_TO_INT(*((gconstpointer *) p_b));
 
@@ -1439,10 +1439,10 @@ _dbus_path_component_as_num(const char *p)
     gint64 n;
 
     /* no odd stuff. No leading zeros, only a non-negative, decimal integer.
-	 *
-	 * Otherwise, there would be multiple ways to encode the same number "10"
-	 * and "010". That is just confusing. A number has no leading zeros,
-	 * if it has, it's not a number (as far as we are concerned here). */
+     *
+     * Otherwise, there would be multiple ways to encode the same number "10"
+     * and "010". That is just confusing. A number has no leading zeros,
+     * if it has, it's not a number (as far as we are concerned here). */
     if (p[0] == '0') {
         if (p[1] != '\0')
             return -1;
@@ -1466,14 +1466,14 @@ nm_utils_dbus_path_cmp(const char *dbus_path_a, const char *dbus_path_b)
     gint64      n_a, n_b;
 
     /* compare function for two D-Bus paths. It behaves like
-	 * strcmp(), except, if both paths have the same prefix,
-	 * and both end in a (positive) number, then the paths
-	 * will be sorted by number. */
+     * strcmp(), except, if both paths have the same prefix,
+     * and both end in a (positive) number, then the paths
+     * will be sorted by number. */
 
     NM_CMP_SELF(dbus_path_a, dbus_path_b);
 
     /* if one or both paths have no slash (and no last component)
-	 * compare the full paths directly. */
+     * compare the full paths directly. */
     if (!(l_a = nm_utils_dbus_path_get_last_component(dbus_path_a))
         || !(l_b = nm_utils_dbus_path_get_last_component(dbus_path_b)))
         goto comp_full;
@@ -1490,20 +1490,20 @@ nm_utils_dbus_path_cmp(const char *dbus_path_a, const char *dbus_path_b)
         goto comp_l;
 
     /* both components must be convertible to a number. If they are not,
-	 * (and only one of them is), then we must always strictly sort numeric parts
-	 * after non-numeric components. If we wouldn't, we wouldn't have
-	 * a total order.
-	 *
-	 * An example of a not total ordering would be:
-	 *   "8"   < "010"  (numeric)
-	 *   "0x"  < "8"    (lexical)
-	 *   "0x"  > "010"  (lexical)
-	 * We avoid this, by forcing that a non-numeric entry "0x" always sorts
-	 * before numeric entries.
-	 *
-	 * Additionally, _dbus_path_component_as_num() would also reject "010" as
-	 * not a valid number.
-	 */
+     * (and only one of them is), then we must always strictly sort numeric parts
+     * after non-numeric components. If we wouldn't, we wouldn't have
+     * a total order.
+     *
+     * An example of a not total ordering would be:
+     *   "8"   < "010"  (numeric)
+     *   "0x"  < "8"    (lexical)
+     *   "0x"  > "010"  (lexical)
+     * We avoid this, by forcing that a non-numeric entry "0x" always sorts
+     * before numeric entries.
+     *
+     * Additionally, _dbus_path_component_as_num() would also reject "010" as
+     * not a valid number.
+     */
     if (n_a == -1)
         return -1;
     if (n_b == -1)
@@ -1558,8 +1558,8 @@ static gboolean
 _char_lookup_has(const CharLookupTable *lookup, char ch)
 {
     /* with some optimization levels, the compiler thinks this code
-	 * might access uninitialized @lookup. It is not -- when you look at the
-	 * callers of this function. */
+     * might access uninitialized @lookup. It is not -- when you look at the
+     * callers of this function. */
     NM_PRAGMA_WARNING_DISABLE("-Wmaybe-uninitialized")
     nm_assert(lookup->table[(guint8) '\0'] == 0);
     return lookup->table[(guint8) ch] != 0;
@@ -1638,9 +1638,9 @@ nm_utils_strsplit_set_full(const char *str, const char *delimiters, NMUtilsStrsp
 
     if (!str[0]) {
         /* We return %NULL here, also with NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY.
-		 * That makes nm_utils_strsplit_set_full() with NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY
-		 * different from g_strsplit_set(), which would in this case return an empty array.
-		 * If you need to handle %NULL, and "" specially, then check the input string first. */
+         * That makes nm_utils_strsplit_set_full() with NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY
+         * different from g_strsplit_set(), which would in this case return an empty array.
+         * If you need to handle %NULL, and "" specially, then check the input string first. */
         return NULL;
     }
 
@@ -1665,8 +1665,8 @@ nm_utils_strsplit_set_full(const char *str, const char *delimiters, NMUtilsStrsp
         }
 
         /* we assume escapings are not frequent. After we found
-		 * this delimiter, check whether it was escaped by counting
-		 * the backslashed before. */
+         * this delimiter, check whether it was escaped by counting
+         * the backslashed before. */
         if (f_allow_escaping && _char_is_escaped(str, c_str)) {
             /* the delimiter is escaped. This was not an accepted delimiter. */
             c_str++;
@@ -1770,7 +1770,7 @@ done2:
         gsize i, j;
 
         /* We no longer need ch_lookup for its original purpose. Modify it, so it
-		 * can detect the delimiters, '\\', and (optionally) whitespaces. */
+         * can detect the delimiters, '\\', and (optionally) whitespaces. */
         _char_lookup_table_set_one(&ch_lookup, '\\');
         if (f_strstrip)
             _char_lookup_table_set_all(&ch_lookup, NM_ASCII_SPACES);
@@ -1846,7 +1846,7 @@ nm_utils_escaped_tokens_escape_full(const char *                    str,
                                  | NM_UTILS_ESCAPED_TOKENS_ESCAPE_FLAGS_ESCAPE_TRAILING_SPACE)
                 && !_char_lookup_has_all(&ch_lookup, NM_ASCII_SPACES)) {
                 /* ESCAPE_LEADING_SPACE and ESCAPE_TRAILING_SPACE implies that we escape backslash
-				 * before whitespaces. */
+                 * before whitespaces. */
                 if (!has_ch_lookup_as_needed) {
                     has_ch_lookup_as_needed = TRUE;
                     _char_lookup_table_init(&ch_lookup_as_needed, NULL);
@@ -1981,8 +1981,8 @@ nm_utils_escaped_tokens_options_split(char *str, const char **out_key, const cha
                     i++;
             } else if (str[i] == '=') {
                 /* Encounter an unescaped '=' character. When we still parse the key, this
-				 * is the separator we were waiting for. If we are parsing the value,
-				 * we take the character verbatim. */
+                 * is the separator we were waiting for. If we are parsing the value,
+                 * we take the character verbatim. */
                 if (!val) {
                     if (last_space_has) {
                         str[last_space_idx] = '\0';
@@ -2101,7 +2101,7 @@ nm_utils_strsplit_quoted(const char *str)
     g_ptr_array_add(arr, NULL);
 
     /* We want to return an optimally sized strv array, with no excess
-	 * memory allocated. Hence, clone once more. */
+     * memory allocated. Hence, clone once more. */
     return nm_memdup(arr->pdata, sizeof(char *) * arr->len);
 }
 
@@ -2166,7 +2166,7 @@ _nm_utils_strv_cleanup(char **  strv,
 
     if (strip_whitespace) {
         /* we only modify the strings pointed to by @strv if @strip_whitespace is
-		 * requested. Otherwise, the strings themselves are untouched. */
+         * requested. Otherwise, the strings themselves are untouched. */
         for (i = 0; strv[i]; i++)
             g_strstrip(strv[i]);
     }
@@ -2304,7 +2304,7 @@ nm_g_object_set_property(GObject *     object,
     g_return_val_if_fail(!error || !*error, FALSE);
 
     /* g_object_class_find_property() does g_param_spec_get_redirect_target(),
-	 * where we differ from a plain g_object_set_property(). */
+     * where we differ from a plain g_object_set_property(). */
     pspec = g_object_class_find_property(G_OBJECT_GET_CLASS(object), property_name);
 
     if (!pspec) {
@@ -2432,10 +2432,10 @@ nm_g_object_set_property_char(GObject *   object,
                               GError **   error)
 {
     /* glib says about G_TYPE_CHAR:
-	 *
-	 * The type designated by G_TYPE_CHAR is unconditionally an 8-bit signed integer.
-	 *
-	 * This is always a (signed!) char. */
+     *
+     * The type designated by G_TYPE_CHAR is unconditionally an 8-bit signed integer.
+     *
+     * This is always a (signed!) char. */
     _set_property(object, property_name, G_TYPE_CHAR, g_value_set_schar, value, error);
 }
 
@@ -2678,8 +2678,8 @@ nm_utils_buf_utf8safe_unescape(const char *            str,
                 ch = (++str)[0];
                 if (ch >= '0' && ch <= '7') {
                     /* technically, escape sequences larger than \3FF are out of range
-					 * and invalid. We don't check for that, and do the same as
-					 * g_strcompress(): silently clip the value with & 0xFF. */
+                     * and invalid. We don't check for that, and do the same as
+                     * g_strcompress(): silently clip the value with & 0xFF. */
                     v = v * 8 + (ch - '0');
                     ++str;
                 }
@@ -2707,7 +2707,7 @@ nm_utils_buf_utf8safe_unescape(const char *            str,
                 break;
             default:
                 /* Here we handle "\\\\", but all other unexpected escape sequences are really a bug.
-				 * Take them literally, after removing the escape character */
+                 * Take them literally, after removing the escape character */
                 break;
             }
             str++;
@@ -2732,8 +2732,8 @@ nm_utils_buf_utf8safe_unescape(const char *            str,
     }
 
     /* assert that no reallocation was necessary. For one, unescaping should
-	 * never result in a longer string than the input. Also, when unescaping
-	 * secrets, we want to ensure that we don't leak secrets in memory. */
+     * never result in a longer string than the input. Also, when unescaping
+     * secrets, we want to ensure that we don't leak secrets in memory. */
     nm_assert(strbuf.allocated == len + 1u);
 
     return (*to_free = nm_str_buf_finalize(&strbuf, out_len));
@@ -2800,7 +2800,7 @@ nm_utils_buf_utf8safe_escape(gconstpointer           buf,
 
     if (g_utf8_validate(str, buflen, &p) && nul_terminated) {
         /* note that g_utf8_validate() does not allow NUL character inside @str. Good.
-		 * We can treat @str like a NUL terminated string. */
+         * We can treat @str like a NUL terminated string. */
         if (!NM_STRCHAR_ANY(
                 str,
                 ch,
@@ -3009,7 +3009,7 @@ nm_utils_fd_read_loop(int fd, void *buf, size_t nbytes, bool do_poll)
     g_return_val_if_fail(buf, -EINVAL);
 
     /* If called with nbytes == 0, let's call read() at least
-	 * once, to validate the operation */
+     * once, to validate the operation */
 
     if (nbytes > (size_t) SSIZE_MAX)
         return -EINVAL;
@@ -3026,8 +3026,8 @@ nm_utils_fd_read_loop(int fd, void *buf, size_t nbytes, bool do_poll)
 
             if (errsv == EAGAIN && do_poll) {
                 /* We knowingly ignore any return value here,
-				 * and expect that any error/EOF is reported
-				 * via read() */
+                 * and expect that any error/EOF is reported
+                 * via read() */
 
                 (void) nm_utils_fd_wait_for_event(fd, POLLIN, -1);
                 continue;
@@ -3215,7 +3215,7 @@ nm_utils_hash_keys_to_array(GHashTable *     hash,
     gpointer *keys;
 
     /* by convention, we never return an empty array. In that
-	 * case, always %NULL. */
+     * case, always %NULL. */
     if (!hash || g_hash_table_size(hash) == 0) {
         NM_SET_OUT(out_len, 0);
         return NULL;
@@ -3279,9 +3279,9 @@ _utils_hashtable_equal(GHashTable *     hash_a,
     nm_assert(g_hash_table_size(hash_a) == g_hash_table_size(hash_b));
 
     /* We rely on both hashes to have the same hash/equal function. Otherwise, we would have to iterate
-	 * both hashes and check whether all keys/values are present in the respective other hash (which
-	 * would be O(n^2), since we couldn't use the plain lookup function. That is not a useful thing
-	 * for this function. */
+     * both hashes and check whether all keys/values are present in the respective other hash (which
+     * would be O(n^2), since we couldn't use the plain lookup function. That is not a useful thing
+     * for this function. */
 
     g_hash_table_iter_init(&h, hash_a);
     while (g_hash_table_iter_next(&h, &a_key, &a_val)) {
@@ -3426,12 +3426,12 @@ nm_utils_hashtable_cmp(const GHashTable *a,
         gboolean same;
 
         /* we expect that the hashes are equal and the caller ensures us that they
-		 * use the same hash/equal functions. Do a fast path check first...
-		 *
-		 * It's unclear whether this is worth it. The full comparison is O(n*ln(n)),
-		 * while the fast check (using the hash lookup) is O(n). But then, the pre-check
-		 * makes additional requirements on the hash's hash/equal functions -- the
-		 * full comparison does not make such requirements. */
+         * use the same hash/equal functions. Do a fast path check first...
+         *
+         * It's unclear whether this is worth it. The full comparison is O(n*ln(n)),
+         * while the fast check (using the hash lookup) is O(n). But then, the pre-check
+         * makes additional requirements on the hash's hash/equal functions -- the
+         * full comparison does not make such requirements. */
         same = _utils_hashtable_equal(hash_a, hash_b, cmp_values, user_data);
 #if NM_MORE_ASSERTS > 5
         nm_assert(same == _utils_hashtable_equal(hash_b, hash_a, cmp_values, user_data));
@@ -3510,8 +3510,8 @@ nm_utils_strv_make_deep_copied(const char **strv)
     gsize i;
 
     /* it takes a strv list, and copies each
-	 * strings. Note that this updates @strv *in-place*
-	 * and returns it. */
+     * strings. Note that this updates @strv *in-place*
+     * and returns it. */
 
     if (!strv)
         return NULL;
@@ -3527,8 +3527,8 @@ nm_utils_strv_make_deep_copied_n(const char **strv, gsize len)
     gsize i;
 
     /* it takes a strv array with len elements, and copies each
-	 * strings. Note that this updates @strv *in-place*
-	 * and returns it. */
+     * strings. Note that this updates @strv *in-place*
+     * and returns it. */
 
     if (!strv)
         return NULL;
@@ -3576,7 +3576,7 @@ _nm_utils_strv_dup(const char *const *strv, gssize len, gboolean deep_copied)
         l = len;
     if (l == 0) {
         /* this function never returns an empty strv array. If you
-		 * need that, handle it yourself. */
+         * need that, handle it yourself. */
         return NULL;
     }
 
@@ -3584,7 +3584,7 @@ _nm_utils_strv_dup(const char *const *strv, gssize len, gboolean deep_copied)
     for (i = 0; i < l; i++) {
         if (G_UNLIKELY(!strv[i])) {
             /* NULL strings are not allowed. Clear the remainder of the array
-			 * and return it (with assertion failure). */
+             * and return it (with assertion failure). */
             l++;
             for (; i < l; i++)
                 v[i] = NULL;
@@ -3618,7 +3618,7 @@ _nm_utils_strv_dup_packed(const char *const *strv, gssize len)
     if (G_LIKELY(len < 0)) {
         if (!strv || !strv[0]) {
             /* This function never returns an empty strv array. If you need that, handle it
-			 * yourself. */
+             * yourself. */
             return NULL;
         }
         len2 = NM_PTRARRAY_LEN(strv);
@@ -3655,10 +3655,10 @@ _nm_utils_strv_dup_packed(const char *const *strv, gssize len)
 
         if (G_UNLIKELY(!strv[i])) {
             /* Technically there is no problem with accepting NULL strings. But that
-			 * does not really result in a strv array, and likely this only happens due
-			 * to a bug. We want to catch such bugs by asserting.
-			 *
-			 * We clear the remainder of the buffer and fail with an assertion. */
+             * does not really result in a strv array, and likely this only happens due
+             * to a bug. We want to catch such bugs by asserting.
+             *
+             * We clear the remainder of the buffer and fail with an assertion. */
             len2++;
             for (; i < len2; i++)
                 result[i] = NULL;
@@ -3705,9 +3705,9 @@ nm_utils_ptrarray_find_binary_search(gconstpointer *  list,
             cmp = cmpfcn(list[imid], needle, user_data);
             if (cmp == 0) {
                 /* we found a matching entry at index imid.
-				 *
-				 * Does the caller request the first/last index as well (in case that
-				 * there are multiple entries which compare equal). */
+                 *
+                 * Does the caller request the first/last index as well (in case that
+                 * there are multiple entries which compare equal). */
 
                 if (out_idx_first) {
                     i2min = imin;
@@ -3752,7 +3752,7 @@ nm_utils_ptrarray_find_binary_search(gconstpointer *  list,
     }
 
     /* return the inverse of @imin. This is a negative number, but
-	 * also is ~imin the position where the value should be inserted. */
+     * also is ~imin the position where the value should be inserted. */
     imin = ~imin;
     NM_SET_OUT(out_idx_first, imin);
     NM_SET_OUT(out_idx_last, imin);
@@ -3820,7 +3820,7 @@ nm_utils_array_find_binary_search(gconstpointer    list,
     }
 
     /* return the inverse of @imin. This is a negative number, but
-	 * also is ~imin the position where the value should be inserted. */
+     * also is ~imin the position where the value should be inserted. */
     return ~imin;
 }
 
@@ -3921,9 +3921,9 @@ nm_utils_get_start_time_for_pid(pid_t pid, char *out_state, pid_t *out_ppid)
         goto fail;
 
     /* start time is the token at index 19 after the '(process name)' entry - since only this
-	 * field can contain the ')' character, search backwards for this to avoid malicious
-	 * processes trying to fool us
-	 */
+     * field can contain the ')' character, search backwards for this to avoid malicious
+     * processes trying to fool us
+     */
     p = strrchr(contents, ')');
     if (!p)
         goto fail;
@@ -4213,16 +4213,16 @@ _nm_utils_invoke_on_idle_start(gboolean                    use_timeout,
     if (cancellable) {
         if (g_cancellable_is_cancelled(cancellable)) {
             /* the cancellable is already cancelled. We ignore the timeout
-			 * and always schedule an idle action. */
+             * and always schedule an idle action. */
             use_timeout = FALSE;
         } else {
             /* if we are passed a non-cancelled cancellable, we register to the "cancelled"
-			 * signal an invoke the callback synchronously (from the signal handler).
-			 *
-			 * We don't do that,
-			 *  - if the cancellable is already cancelled (because we don't want to invoke
-			 *    the callback synchronously from the caller).
-			 *  - if we have no cancellable at hand. */
+             * signal an invoke the callback synchronously (from the signal handler).
+             *
+             * We don't do that,
+             *  - if the cancellable is already cancelled (because we don't want to invoke
+             *    the callback synchronously from the caller).
+             *  - if we have no cancellable at hand. */
             data->cancelled_id = g_signal_connect(cancellable,
                                                   "cancelled",
                                                   G_CALLBACK(_nm_utils_invoke_on_idle_cb_cancelled),
@@ -4303,7 +4303,7 @@ nm_utils_memeqzero(gconstpointer data, gsize length)
     int                  len;
 
     /* Taken from https://github.com/rustyrussell/ccan/blob/9d2d2c49f053018724bcc6e37029da10b7c3d60d/ccan/mem/mem.c#L92,
-	 * CC-0 licensed. */
+     * CC-0 licensed. */
 
     /* Check first 16 bytes manually */
     for (len = 0; len < 16; len++) {
@@ -4361,7 +4361,7 @@ nm_utils_bin2hexstr_full(gconstpointer addr,
     }
 
     /* @out must contain at least @length*3 bytes if @delimiter is set,
-	 * otherwise, @length*2+1. */
+     * otherwise, @length*2+1. */
 
     if (length > 0) {
         nm_assert(in);
@@ -4771,14 +4771,14 @@ _ctx_integ_source_reacquire(CtxIntegSource *ctx_src)
         return;
 
     /* the parent context now iterates on a different thread.
-	 * We need to release and reacquire the inner context. */
+     * We need to release and reacquire the inner context. */
 
     if (ctx_src->acquired)
         g_main_context_release(ctx_src->context);
 
     if (G_UNLIKELY(!g_main_context_acquire(ctx_src->context))) {
         /* Nobody is supposed to reacquire the context while we use it. This is a bug
-		 * of the user. */
+         * of the user. */
         ctx_src->acquired = FALSE;
         g_return_if_reached();
     }
@@ -4874,8 +4874,8 @@ _ctx_integ_source_prepare(GSource *source, int *out_timeout)
             }
 
             /* How odd. We have duplicate FDs. In fact, currently g_main_context_query() always
-			 * coalesces the FDs and this cannot happen. However, that is not documented behavior,
-			 * so we should not rely on that. So we need to keep a list of indexes... */
+             * coalesces the FDs and this cannot happen. However, that is not documented behavior,
+             * so we should not rely on that. So we need to keep a list of indexes... */
             poll_data->events |= fd->events;
             if (!poll_data->has_many_idx) {
                 int idx0;
@@ -5065,10 +5065,10 @@ nm_utils_g_main_context_create_integrate_source(GMainContext *inner_context)
 
     if (!g_main_context_acquire(inner_context)) {
         /* We require to acquire the context while it's integrated. We need to keep it acquired
-		 * for the entire duration.
-		 *
-		 * This is also necessary because g_source_attach() only wakes up the context, if
-		 * the context is currently acquired. */
+         * for the entire duration.
+         *
+         * This is also necessary because g_source_attach() only wakes up the context, if
+         * the context is currently acquired. */
         g_return_val_if_reached(NULL);
     }
 
@@ -5094,8 +5094,8 @@ nm_utils_ifname_valid_kernel(const char *name, GError **error)
     int i;
 
     /* This function follows kernel's interface validation
-	 * function dev_valid_name() in net/core/dev.c.
-	 */
+     * function dev_valid_name() in net/core/dev.c.
+     */
 
     if (!name) {
         g_set_error_literal(error,
@@ -5152,14 +5152,14 @@ _nm_utils_ifname_valid_kernel(const char *name, GError **error)
 
     if (strchr(name, '%')) {
         /* Kernel's dev_valid_name() accepts (almost) any binary up to 15 chars.
-		 * However, '%' is treated special as a format specifier. Try
-		 *
-		 *   ip link add 'dummy%dx' type dummy
-		 *
-		 * Don't allow that for "connection.interface-name", which either
-		 * matches an existing netdev name (thus, it cannot have a '%') or
-		 * is used to configure a name (in which case we don't want kernel
-		 * to replace the format specifier). */
+         * However, '%' is treated special as a format specifier. Try
+         *
+         *   ip link add 'dummy%dx' type dummy
+         *
+         * Don't allow that for "connection.interface-name", which either
+         * matches an existing netdev name (thus, it cannot have a '%') or
+         * is used to configure a name (in which case we don't want kernel
+         * to replace the format specifier). */
         g_set_error_literal(error,
                             NM_UTILS_ERROR,
                             NM_UTILS_ERROR_UNKNOWN,
@@ -5169,10 +5169,10 @@ _nm_utils_ifname_valid_kernel(const char *name, GError **error)
 
     if (NM_IN_STRSET(name, "all", "default", "bonding_masters")) {
         /* Certain names are not allowed. The "all" and "default" names are reserved
-		 * due to their directories in "/proc/sys/net/ipv4/conf/" and "/proc/sys/net/ipv6/conf/".
-		 *
-		 * Also, there is "/sys/class/net/bonding_masters" file.
-		 */
+         * due to their directories in "/proc/sys/net/ipv4/conf/" and "/proc/sys/net/ipv6/conf/".
+         *
+         * Also, there is "/sys/class/net/bonding_masters" file.
+         */
         nm_utils_error_set(error,
                            NM_UTILS_ERROR_UNKNOWN,
                            _("'%s' is not allowed as interface name"),
@@ -5191,7 +5191,7 @@ _nm_utils_ifname_valid_ovs(const char *name, GError **error)
     /* OVS actually accepts a wider range of chars (all printable UTF-8 chars),
 	 NetworkManager restricts this to ASCII char as it's a safer option for
 	 now since OVS is not well documented on this matter.
-	 */
+     */
     for (ch = name; *ch; ++ch) {
         if (*ch == '\\' || *ch == '/' || !g_ascii_isgraph(*ch)) {
             g_set_error_literal(error,
@@ -5398,7 +5398,7 @@ _nm_utils_format_variant_attributes_full(GString *                            st
             value = g_variant_get_string(variant, NULL);
         else if (g_variant_is_of_type(variant, G_VARIANT_TYPE_BYTESTRING)) {
             /* FIXME: there is no guarantee that the byte array
-			 * is valid UTF-8.*/
+             * is valid UTF-8.*/
             value = g_variant_get_bytestring(variant);
         } else
             continue;
@@ -5474,9 +5474,9 @@ nm_utils_is_localhost(const char *name)
         return FALSE;
 
     /* This tries to identify local host and domain names
-	 * described in RFC6761 plus the redhatism of localdomain.
-	 *
-	 * Similar to systemd's is_localhost(). */
+     * described in RFC6761 plus the redhatism of localdomain.
+     *
+     * Similar to systemd's is_localhost(). */
 
     name_len = strlen(name);
 
@@ -5502,7 +5502,7 @@ nm_utils_is_localhost(const char *name)
             continue;
 
         /* we accept the name if it is equal to one of the well-known names,
-		 * or if it is some prefix, a '.' and the well-known name. */
+         * or if it is some prefix, a '.' and the well-known name. */
         if (s == 0)
             return TRUE;
         if (name[s - 1] == '.')
@@ -5520,7 +5520,7 @@ nm_utils_is_specific_hostname(const char *name)
 
     if (nm_streq(name, "(none)")) {
         /* This is not a special hostname. Probably an artefact by somebody wrongly
-		 * printing NULL. */
+         * printing NULL. */
         return FALSE;
     }
 
diff --git a/shared/nm-glib-aux/nm-shared-utils.h b/shared/nm-glib-aux/nm-shared-utils.h
index 00338e1960..85c18a9e6d 100644
--- a/shared/nm-glib-aux/nm-shared-utils.h
+++ b/shared/nm-glib-aux/nm-shared-utils.h
@@ -42,16 +42,16 @@ static inline gboolean
 _NM_INT_NOT_NEGATIVE(gssize val)
 {
     /* whether an enum (without negative values) is a signed int, depends on compiler options
-	 * and compiler implementation.
-	 *
-	 * When using such an enum for accessing an array, one naturally wants to check
-	 * that the enum is not negative. However, the compiler doesn't like a plain
-	 * comparison "enum_val >= 0", because (if the enum is unsigned), it will warn
-	 * that the expression is always true *duh*. Not even a cast to a signed
-	 * type helps to avoid the compiler warning in any case.
-	 *
-	 * The sole purpose of this function is to avoid a compiler warning, when checking
-	 * that an enum is not negative. */
+     * and compiler implementation.
+     *
+     * When using such an enum for accessing an array, one naturally wants to check
+     * that the enum is not negative. However, the compiler doesn't like a plain
+     * comparison "enum_val >= 0", because (if the enum is unsigned), it will warn
+     * that the expression is always true *duh*. Not even a cast to a signed
+     * type helps to avoid the compiler warning in any case.
+     *
+     * The sole purpose of this function is to avoid a compiler warning, when checking
+     * that an enum is not negative. */
     return val >= 0;
 }
 
@@ -104,8 +104,8 @@ typedef struct {
         struct in6_addr addr6;
 
         /* NMIPAddr is really a union for IP addresses.
-		 * However, as ethernet addresses fit in here nicely, use
-		 * it also for an ethernet MAC address. */
+         * However, as ethernet addresses fit in here nicely, use
+         * it also for an ethernet MAC address. */
         guint8 addr_eth[6 /*ETH_ALEN*/];
 
         guint8 array[sizeof(struct in6_addr)];
@@ -467,61 +467,61 @@ typedef enum {
     NM_UTILS_STRSPLIT_SET_FLAGS_NONE = 0,
 
     /* by default, strsplit will coalesce consecutive delimiters and remove
-	 * them from the result. If this flag is present, empty values are preserved
-	 * and returned.
-	 *
-	 * When combined with %NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP, if a value gets
-	 * empty after strstrip(), it also gets removed. */
+     * them from the result. If this flag is present, empty values are preserved
+     * and returned.
+     *
+     * When combined with %NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP, if a value gets
+     * empty after strstrip(), it also gets removed. */
     NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY = (1u << 0),
 
     /* %NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING means that delimiters prefixed
-	 * by a backslash are not treated as a separator. Such delimiters and their escape
-	 * character are copied to the current word without unescaping them. In general,
-	 * nm_utils_strsplit_set_full() does not remove any backslash escape characters
-	 * and does no unescaping. It only considers them for skipping to split at
-	 * an escaped delimiter.
-	 *
-	 * If this is combined with (or implied by %NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED), then
-	 * the backslash escapes are removed from the result.
-	 */
+     * by a backslash are not treated as a separator. Such delimiters and their escape
+     * character are copied to the current word without unescaping them. In general,
+     * nm_utils_strsplit_set_full() does not remove any backslash escape characters
+     * and does no unescaping. It only considers them for skipping to split at
+     * an escaped delimiter.
+     *
+     * If this is combined with (or implied by %NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED), then
+     * the backslash escapes are removed from the result.
+     */
     NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING = (1u << 1),
 
     /* If flag is set, does the same as g_strstrip() on the returned tokens.
-	 * This will remove leading and trailing ascii whitespaces (g_ascii_isspace()
-	 * and NM_ASCII_SPACES).
-	 *
-	 * - when combined with !%NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
-	 *   empty tokens will be removed (and %NULL will be returned if that
-	 *   results in an empty string array).
-	 * - when combined with %NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING,
-	 *   trailing whitespace escaped by backslash are not stripped. */
+     * This will remove leading and trailing ascii whitespaces (g_ascii_isspace()
+     * and NM_ASCII_SPACES).
+     *
+     * - when combined with !%NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY,
+     *   empty tokens will be removed (and %NULL will be returned if that
+     *   results in an empty string array).
+     * - when combined with %NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING,
+     *   trailing whitespace escaped by backslash are not stripped. */
     NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP = (1u << 2),
 
     /* This implies %NM_UTILS_STRSPLIT_SET_FLAGS_ALLOW_ESCAPING.
-	 *
-	 * This will do a final run over all tokens and remove all backslash
-	 * escape characters that
-	 *   - precede a delimiter.
-	 *   - precede a backslash.
-	 *   - preceed a whitespace (with %NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP).
-	 *
-	 *  Note that with %NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP, it is only
-	 *  necessary to escape the very last whitespace (if the delimiters
-	 *  are not whitespace themself). So, technically, it would be sufficient
-	 *  to only unescape a backslash before the last whitespace and the user
-	 *  still could express everything. However, such a rule would be complicated
-	 *  to understand, so when using backslash escaping with nm_utils_strsplit_set_full(),
-	 *  then all characters (including backslash) are treated verbatim, except:
-	 *
-	 *    - "\\$DELIMITER" (escaped delimiter)
-	 *    - "\\\\" (escaped backslash)
-	 *    - "\\$SPACE" (escaped space) (with %NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP).
-	 *
-	 * Note that all other escapes like "\\n" or "\\001" are left alone.
-	 * That makes the escaping/unescaping rules simple. Also, for the most part
-	 * a text is just taken as-is, with little additional rules. Only backslashes
-	 * need extra care, and then only if they proceed one of the relevant characters.
-	 */
+     *
+     * This will do a final run over all tokens and remove all backslash
+     * escape characters that
+     *   - precede a delimiter.
+     *   - precede a backslash.
+     *   - preceed a whitespace (with %NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP).
+     *
+     *  Note that with %NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP, it is only
+     *  necessary to escape the very last whitespace (if the delimiters
+     *  are not whitespace themself). So, technically, it would be sufficient
+     *  to only unescape a backslash before the last whitespace and the user
+     *  still could express everything. However, such a rule would be complicated
+     *  to understand, so when using backslash escaping with nm_utils_strsplit_set_full(),
+     *  then all characters (including backslash) are treated verbatim, except:
+     *
+     *    - "\\$DELIMITER" (escaped delimiter)
+     *    - "\\\\" (escaped backslash)
+     *    - "\\$SPACE" (escaped space) (with %NM_UTILS_STRSPLIT_SET_FLAGS_STRSTRIP).
+     *
+     * Note that all other escapes like "\\n" or "\\001" are left alone.
+     * That makes the escaping/unescaping rules simple. Also, for the most part
+     * a text is just taken as-is, with little additional rules. Only backslashes
+     * need extra care, and then only if they proceed one of the relevant characters.
+     */
     NM_UTILS_STRSPLIT_SET_FLAGS_ESCAPED = (1u << 3),
 
 } NMUtilsStrsplitSetFlags;
@@ -533,9 +533,9 @@ static inline const char **
 nm_utils_strsplit_set_with_empty(const char *str, const char *delimiters)
 {
     /* this returns the same result as g_strsplit_set(str, delimiters, -1), except
-	 * it does not deep-clone the strv array.
-	 * Also, for @str == "", this returns %NULL while g_strsplit_set() would return
-	 * an empty strv array. */
+     * it does not deep-clone the strv array.
+     * Also, for @str == "", this returns %NULL while g_strsplit_set() would return
+     * an empty strv array. */
     return nm_utils_strsplit_set_full(str, delimiters, NM_UTILS_STRSPLIT_SET_FLAGS_PRESERVE_EMPTY);
 }
 
@@ -578,35 +578,35 @@ typedef enum {
     NM_UTILS_ESCAPED_TOKENS_ESCAPE_FLAGS_ESCAPE_TRAILING_SPACE = (1ull << 2),
 
     /* Backslash characters will be escaped as "\\\\" if they precede another
-	 * character that makes it necessary. Such characters are:
-	 *
-	 *  1) before another '\\' backslash.
-	 *  2) before any delimiter in @delimiters.
-	 *  3) before any delimiter in @delimiters_as_needed.
-	 *  4) before a white space, if ESCAPE_LEADING_SPACE or ESCAPE_TRAILING_SPACE is set.
-	 *  5) before the end of the word
-	 *
-	 * Rule 4) is an extension. It's not immediately clear why with ESCAPE_LEADING_SPACE
-	 * and ESCAPE_TRAILING_SPACE we want *all* backslashes before a white space escaped.
-	 * The reason is, that we obviously want to use ESCAPE_LEADING_SPACE and ESCAPE_TRAILING_SPACE
-	 * in cases, where we later parse the backslash escaped strings back, but allowing to strip
-	 * unescaped white spaces. That means, we want that " a " gets escaped as "\\ a\\ ".
-	 * On the other hand, we also want that " a\\ b " gets escaped as "\\ a\\\\ b\\ ",
-	 * and not "\\ a\\ b\\ ". Because otherwise, the parser would need to treat "\\ "
-	 * differently depending on whether the sequence is at the beginning, end or middle
-	 * of the word.
-	 *
-	 * Rule 5) is also not immediately obvious. When used with ESCAPE_TRAILING_SPACE,
-	 * we clearly want to allow that an escaped word can have arbitrary
-	 * whitespace suffixes. That's why this mode exists. So we must escape "a\\" as
-	 * "a\\\\", so that appending " " does not change the meaning.
-	 * Also without ESCAPE_TRAILING_SPACE, we want in general that we can concatenate
-	 * two escaped words without changing their meaning. If the words would be "a\\"
-	 * and "," (with ',' being a delimiter), then the result must be "a\\\\" and "\\,"
-	 * so that the concatenated word ("a\\\\\\,") is still the same. If we would escape
-	 * them instead as "a\\" + "\\,", then the concatenated word would be "a\\\\," and
-	 * different.
-	 * */
+     * character that makes it necessary. Such characters are:
+     *
+     *  1) before another '\\' backslash.
+     *  2) before any delimiter in @delimiters.
+     *  3) before any delimiter in @delimiters_as_needed.
+     *  4) before a white space, if ESCAPE_LEADING_SPACE or ESCAPE_TRAILING_SPACE is set.
+     *  5) before the end of the word
+     *
+     * Rule 4) is an extension. It's not immediately clear why with ESCAPE_LEADING_SPACE
+     * and ESCAPE_TRAILING_SPACE we want *all* backslashes before a white space escaped.
+     * The reason is, that we obviously want to use ESCAPE_LEADING_SPACE and ESCAPE_TRAILING_SPACE
+     * in cases, where we later parse the backslash escaped strings back, but allowing to strip
+     * unescaped white spaces. That means, we want that " a " gets escaped as "\\ a\\ ".
+     * On the other hand, we also want that " a\\ b " gets escaped as "\\ a\\\\ b\\ ",
+     * and not "\\ a\\ b\\ ". Because otherwise, the parser would need to treat "\\ "
+     * differently depending on whether the sequence is at the beginning, end or middle
+     * of the word.
+     *
+     * Rule 5) is also not immediately obvious. When used with ESCAPE_TRAILING_SPACE,
+     * we clearly want to allow that an escaped word can have arbitrary
+     * whitespace suffixes. That's why this mode exists. So we must escape "a\\" as
+     * "a\\\\", so that appending " " does not change the meaning.
+     * Also without ESCAPE_TRAILING_SPACE, we want in general that we can concatenate
+     * two escaped words without changing their meaning. If the words would be "a\\"
+     * and "," (with ',' being a delimiter), then the result must be "a\\\\" and "\\,"
+     * so that the concatenated word ("a\\\\\\,") is still the same. If we would escape
+     * them instead as "a\\" + "\\,", then the concatenated word would be "a\\\\," and
+     * different.
+     * */
     NM_UTILS_ESCAPED_TOKENS_ESCAPE_FLAGS_ESCAPE_BACKSLASH_AS_NEEDED = (1ull << 3),
 
     NM_UTILS_ESCAPED_TOKENS_ESCAPE_FLAGS_ESCAPE_BACKSLASH_ALWAYS = (1ull << 4),
@@ -919,8 +919,8 @@ _nm_g_slice_free_fcn_define(1) _nm_g_slice_free_fcn_define(2) _nm_g_slice_free_f
         void (*_fcn)(gpointer);                                                               \
                                                                                               \
         /* If mem_size is a compile time constant, the compiler
-		 * will be able to optimize this. Hence, you don't want
-		 * to call this with a non-constant size argument. */                               \
+         * will be able to optimize this. Hence, you don't want
+         * to call this with a non-constant size argument. */                               \
         G_STATIC_ASSERT_EXPR(((mem_size) == 1) || ((mem_size) == 2) || ((mem_size) == 4)      \
                              || ((mem_size) == 8) || ((mem_size) == 10) || ((mem_size) == 12) \
                              || ((mem_size) == 16) || ((mem_size) == 32));                    \
@@ -1041,16 +1041,16 @@ typedef enum {
     NM_UTILS_ERROR_INVALID_ARGUMENT,    /*< nick=InvalidArgument >*/
 
     /* the following codes have a special meaning and are exactly used for
-	 * nm_device_check_connection_compatible() and nm_device_check_connection_available().
-	 *
-	 * Actually, their meaning is not very important (so, don't think too
-	 * hard about the name of these error codes). What is important, is their
-	 * relative order (i.e. the integer value of the codes). When manager
-	 * searches for a suitable device, it will check all devices whether
-	 * a profile can be activated. If they all fail, it will pick the error
-	 * message from the device that returned the *highest* error code,
-	 * in the hope that this message makes the most sense for the caller.
-	 * */
+     * nm_device_check_connection_compatible() and nm_device_check_connection_available().
+     *
+     * Actually, their meaning is not very important (so, don't think too
+     * hard about the name of these error codes). What is important, is their
+     * relative order (i.e. the integer value of the codes). When manager
+     * searches for a suitable device, it will check all devices whether
+     * a profile can be activated. If they all fail, it will pick the error
+     * message from the device that returned the *highest* error code,
+     * in the hope that this message makes the most sense for the caller.
+     * */
     NM_UTILS_ERROR_CONNECTION_AVAILABLE_INCOMPATIBLE,
     NM_UTILS_ERROR_CONNECTION_AVAILABLE_UNMANAGED_DEVICE,
     NM_UTILS_ERROR_CONNECTION_AVAILABLE_TEMPORARY,
@@ -1239,18 +1239,18 @@ typedef enum {
     NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII = 0x0002,
 
     /* This flag only has an effect during escaping to ensure we
-	 * don't leak secrets in memory. Note that during unescape we
-	 * know the maximum result size from the beginning, and no
-	 * reallocation happens. Thus, unescape always avoids leaking
-	 * secrets already. */
+     * don't leak secrets in memory. Note that during unescape we
+     * know the maximum result size from the beginning, and no
+     * reallocation happens. Thus, unescape always avoids leaking
+     * secrets already. */
     NM_UTILS_STR_UTF8_SAFE_FLAG_SECRET = 0x0004,
 
     /* This flag only has an effect during unescaping. It means
-	 * that non-escaped whitespaces (g_ascii_isspace()) will be
-	 * stripped from the front and end of the string. Note that
-	 * this flag is only useful for gracefully accepting user input
-	 * with spaces. With this flag, escape and unescape may no longer
-	 * yield the original input. */
+     * that non-escaped whitespaces (g_ascii_isspace()) will be
+     * stripped from the front and end of the string. Note that
+     * this flag is only useful for gracefully accepting user input
+     * with spaces. With this flag, escape and unescape may no longer
+     * yield the original input. */
     NM_UTILS_STR_UTF8_SAFE_UNESCAPE_STRIP_SPACES = 0x0008,
 } NMUtilsStrUtf8SafeFlags;
 
@@ -1283,15 +1283,15 @@ static inline void
 nm_g_variant_unref_floating(GVariant *var)
 {
     /* often a function wants to keep a reference to an input variant.
-	 * It uses g_variant_ref_sink() to either increase the ref-count,
-	 * or take ownership of a possibly floating reference.
-	 *
-	 * If the function doesn't actually want to do anything with the
-	 * input variant, it still must make sure that a passed in floating
-	 * reference is consumed. Hence, this helper which:
-	 *
-	 *   - does nothing if @var is not floating
-	 *   - unrefs (consumes) @var if it is floating. */
+     * It uses g_variant_ref_sink() to either increase the ref-count,
+     * or take ownership of a possibly floating reference.
+     *
+     * If the function doesn't actually want to do anything with the
+     * input variant, it still must make sure that a passed in floating
+     * reference is consumed. Hence, this helper which:
+     *
+     *   - does nothing if @var is not floating
+     *   - unrefs (consumes) @var if it is floating. */
     if (g_variant_is_floating(var))
         g_variant_unref(var);
 }
@@ -1831,8 +1831,8 @@ static inline gboolean
 nm_utils_process_state_is_dead(char pstate)
 {
     /* "/proc/[pid]/stat" returns a state as the 3rd fields (see `man 5 proc`).
-	 * Some of these states indicate the process is effectively dead (or a zombie).
-	 */
+     * Some of these states indicate the process is effectively dead (or a zombie).
+     */
     return NM_IN_SET(pstate, 'Z', 'x', 'X');
 }
 
@@ -1882,9 +1882,9 @@ static inline const char *const *
 nm_strv_ptrarray_get_unsafe(GPtrArray *arr, guint *out_len)
 {
     /* warning: the GPtrArray is not NULL terminated. So, it
-	 * isn't really a strv array (sorry the misnomer). That's why
-	 * the function is potentially "unsafe" and you must provide a
-	 * out_len parameter. */
+     * isn't really a strv array (sorry the misnomer). That's why
+     * the function is potentially "unsafe" and you must provide a
+     * out_len parameter. */
     if (!arr || arr->len == 0) {
         *out_len = 0;
         return NULL;
@@ -1951,9 +1951,9 @@ static inline int
 nm_strv_ptrarray_cmp(const GPtrArray *a, const GPtrArray *b)
 {
     /* _nm_utils_strv_cmp_n() will treat NULL and empty arrays the same.
-	 * That means, an empty strv array can both be represented by NULL
-	 * and an array of length zero.
-	 * If you need to distinguish between these case, do that yourself. */
+     * That means, an empty strv array can both be represented by NULL
+     * and an array of length zero.
+     * If you need to distinguish between these case, do that yourself. */
     return _nm_utils_strv_cmp_n((const char *const *) nm_g_ptr_array_pdata(a),
                                 nm_g_ptr_array_len(a),
                                 (const char *const *) nm_g_ptr_array_pdata(b),
diff --git a/shared/nm-glib-aux/nm-str-buf.h b/shared/nm-glib-aux/nm-str-buf.h
index 274bb09d66..898a0c3764 100644
--- a/shared/nm-glib-aux/nm-str-buf.h
+++ b/shared/nm-glib-aux/nm-str-buf.h
@@ -14,8 +14,8 @@ typedef struct _NMStrBuf {
     char *_priv_str;
 
     /* The unions only exist because we allow/encourage read-only access
-	 * to the "len" and "allocated" fields, but modifying the fields is
-	 * only allowed to the NMStrBuf implementation itself. */
+     * to the "len" and "allocated" fields, but modifying the fields is
+     * only allowed to the NMStrBuf implementation itself. */
     union {
         /*const*/ gsize len;
         gsize           _priv_len;
@@ -217,7 +217,7 @@ nm_str_buf_append_len0(NMStrBuf *strbuf, const char *str, gsize len)
     _nm_str_buf_assert(strbuf);
 
     /* this is basically like nm_str_buf_append_len() and
-	 * nm_str_buf_get_str() in one. */
+     * nm_str_buf_get_str() in one. */
 
     nm_str_buf_maybe_expand(strbuf, len + 1u, FALSE);
     if (len > 0) {
@@ -261,7 +261,7 @@ nm_str_buf_append_required_delimiter(NMStrBuf *strbuf, char delimiter)
     _nm_str_buf_assert(strbuf);
 
     /* appends the @delimiter if it is required (that is, if the
-	 * string is not empty). */
+     * string is not empty). */
     if (strbuf->len > 0)
         nm_str_buf_append_c(strbuf, delimiter);
     return strbuf;
@@ -387,7 +387,7 @@ nm_str_buf_finalize(NMStrBuf *strbuf, gsize *out_len)
     strbuf->_priv_str[strbuf->_priv_len] = '\0';
 
     /* the buffer is in invalid state afterwards, however, we clear it
-	 * so far, that nm_auto_str_buf and nm_str_buf_destroy() is happy.  */
+     * so far, that nm_auto_str_buf and nm_str_buf_destroy() is happy.  */
     return g_steal_pointer(&strbuf->_priv_str);
 }
 
@@ -398,12 +398,12 @@ nm_str_buf_finalize_to_gbytes(NMStrBuf *strbuf)
     gsize l;
 
     /* this always returns a non-NULL, newly allocated GBytes instance.
-	 * The data buffer always has an additional NUL character after
-	 * the data, and the data is allocated with malloc.
-	 *
-	 * That means, the caller who takes ownership of the GBytes can
-	 * safely modify the content of the buffer (including the additional
-	 * NUL sentinel). */
+     * The data buffer always has an additional NUL character after
+     * the data, and the data is allocated with malloc.
+     *
+     * That means, the caller who takes ownership of the GBytes can
+     * safely modify the content of the buffer (including the additional
+     * NUL sentinel). */
     s = nm_str_buf_finalize(strbuf, &l);
     return g_bytes_new_take(s ?: g_new0(char, 1), l);
 }
@@ -427,8 +427,8 @@ nm_str_buf_destroy(NMStrBuf *strbuf)
     g_free(strbuf->_priv_str);
 
     /* the buffer is in invalid state afterwards, however, we clear it
-	 * so far, that nm_auto_str_buf is happy when calling
-	 * nm_str_buf_destroy() again.  */
+     * so far, that nm_auto_str_buf is happy when calling
+     * nm_str_buf_destroy() again.  */
     strbuf->_priv_str = NULL;
 }
 
diff --git a/shared/nm-glib-aux/nm-time-utils.c b/shared/nm-glib-aux/nm-time-utils.c
index 3f2961318a..6112d73cc8 100644
--- a/shared/nm-glib-aux/nm-time-utils.c
+++ b/shared/nm-glib-aux/nm-time-utils.c
@@ -38,23 +38,23 @@ _t_init_global_state(void)
     }
 
     /* The only failure we tolerate is that CLOCK_BOOTTIME is not supported.
-	 * Other than that, we rely on kernel to not fail on this. */
+     * Other than that, we rely on kernel to not fail on this. */
     g_assert(r == 0);
     g_assert(tp.tv_nsec >= 0 && tp.tv_nsec < NM_UTILS_NSEC_PER_SEC);
 
     /* Calculate an offset for the time stamp.
-	 *
-	 * We always want positive values, because then we can initialize
-	 * a timestamp with 0 and be sure, that it will be less then any
-	 * value nm_utils_get_monotonic_timestamp_*() might return.
-	 * For this to be true also for nm_utils_get_monotonic_timestamp_sec() at
-	 * early boot, we have to shift the timestamp to start counting at
-	 * least from 1 second onward.
-	 *
-	 * Another advantage of shifting is, that this way we make use of the whole 31 bit
-	 * range of signed int, before the time stamp for nm_utils_get_monotonic_timestamp_sec()
-	 * wraps (~68 years).
-	 **/
+     *
+     * We always want positive values, because then we can initialize
+     * a timestamp with 0 and be sure, that it will be less then any
+     * value nm_utils_get_monotonic_timestamp_*() might return.
+     * For this to be true also for nm_utils_get_monotonic_timestamp_sec() at
+     * early boot, we have to shift the timestamp to start counting at
+     * least from 1 second onward.
+     *
+     * Another advantage of shifting is, that this way we make use of the whole 31 bit
+     * range of signed int, before the time stamp for nm_utils_get_monotonic_timestamp_sec()
+     * wraps (~68 years).
+     **/
     offset_sec = (-((gint64) tp.tv_sec)) + 1;
 
     if (!g_once_init_enter(&init_once)) {
@@ -124,9 +124,9 @@ nm_utils_get_monotonic_timestamp_nsec(void)
     p = _t_clock_gettime(&tp);
 
     /* Although the result will always be positive, we return a signed
-	 * integer, which makes it easier to calculate time differences (when
-	 * you want to subtract signed values).
-	 **/
+     * integer, which makes it easier to calculate time differences (when
+     * you want to subtract signed values).
+     **/
     return (((gint64) tp.tv_sec) + p->offset_sec) * NM_UTILS_NSEC_PER_SEC + tp.tv_nsec;
 }
 
@@ -151,9 +151,9 @@ nm_utils_get_monotonic_timestamp_usec(void)
     p = _t_clock_gettime(&tp);
 
     /* Although the result will always be positive, we return a signed
-	 * integer, which makes it easier to calculate time differences (when
-	 * you want to subtract signed values).
-	 **/
+     * integer, which makes it easier to calculate time differences (when
+     * you want to subtract signed values).
+     **/
     return (((gint64) tp.tv_sec) + p->offset_sec) * ((gint64) G_USEC_PER_SEC)
            + (tp.tv_nsec / (NM_UTILS_NSEC_PER_SEC / G_USEC_PER_SEC));
 }
@@ -179,9 +179,9 @@ nm_utils_get_monotonic_timestamp_msec(void)
     p = _t_clock_gettime(&tp);
 
     /* Although the result will always be positive, we return a signed
-	 * integer, which makes it easier to calculate time differences (when
-	 * you want to subtract signed values).
-	 **/
+     * integer, which makes it easier to calculate time differences (when
+     * you want to subtract signed values).
+     **/
     return (((gint64) tp.tv_sec) + p->offset_sec) * ((gint64) 1000)
            + (tp.tv_nsec / (NM_UTILS_NSEC_PER_SEC / 1000));
 }
@@ -243,7 +243,7 @@ nm_utils_monotonic_timestamp_as_boottime(gint64 timestamp, gint64 timestamp_nsec
                          -1);
 
     /* if the caller didn't yet ever fetch a monotonic-timestamp, he cannot pass any meaningful
-	 * value (because he has no idea what these timestamps would be). That would be a bug. */
+     * value (because he has no idea what these timestamps would be). That would be a bug. */
     nm_assert(g_atomic_pointer_get(&p_global_state));
 
     p = _t_get_global_state();
diff --git a/shared/nm-glib-aux/nm-value-type.h b/shared/nm-glib-aux/nm-value-type.h
index 943daf5ab2..fbe6ba1991 100644
--- a/shared/nm-glib-aux/nm-value-type.h
+++ b/shared/nm-glib-aux/nm-value-type.h
@@ -25,7 +25,7 @@ typedef union {
     const char *v_string;
 
     /* for convenience, also let the union contain other pointer types. These are
-	 * for NM_VALUE_TYPE_UNSPEC. */
+     * for NM_VALUE_TYPE_UNSPEC. */
     gconstpointer *  v_ptr;
     const GPtrArray *v_ptrarray;
 
@@ -144,7 +144,7 @@ nm_value_type_get_from_variant(NMValueType value_type,
 
     case NM_VALUE_TYPE_INT:
         /* "int" also does not have a define variant type, because it's not
-		 * clear how many bits we would need. */
+         * clear how many bits we would need. */
 
         /* fall-through */
     case NM_VALUE_TYPE_UNSPEC:
@@ -169,7 +169,7 @@ nm_value_type_to_variant(NMValueType value_type, gconstpointer src)
 
     case NM_VALUE_TYPE_INT:
         /* "int" also does not have a define variant type, because it's not
-		 * clear how many bits we would need. */
+         * clear how many bits we would need. */
 
         /* fall-through */
     case NM_VALUE_TYPE_UNSPEC:
@@ -192,7 +192,7 @@ nm_value_type_get_variant_type(NMValueType value_type)
 
     case NM_VALUE_TYPE_INT:
         /* "int" also does not have a define variant type, because it's not
-		 * clear how many bits we would need. */
+         * clear how many bits we would need. */
 
         /* fall-through */
     case NM_VALUE_TYPE_UNSPEC:
diff --git a/shared/nm-glib-aux/tests/test-shared-general.c b/shared/nm-glib-aux/tests/test-shared-general.c
index a70d107a08..d03ab5353b 100644
--- a/shared/nm-glib-aux/tests/test-shared-general.c
+++ b/shared/nm-glib-aux/tests/test-shared-general.c
@@ -39,18 +39,18 @@ test_gpid(void)
     GPid       pid = 42;
 
     /* We redefine G_PID_FORMAT, because it's only available since glib 2.53.5.
-	 *
-	 * Also, this is the format for GPid, which for glib is always a typedef
-	 * for "int". Add a check for that here.
-	 *
-	 * G_PID_FORMAT is not about pid_t, which might be a smaller int, and which we would
-	 * check with SIZEOF_PID_T. */
+     *
+     * Also, this is the format for GPid, which for glib is always a typedef
+     * for "int". Add a check for that here.
+     *
+     * G_PID_FORMAT is not about pid_t, which might be a smaller int, and which we would
+     * check with SIZEOF_PID_T. */
     G_STATIC_ASSERT(sizeof(GPid) == sizeof(int));
 
     g_assert_cmpstr("" G_PID_FORMAT, ==, "i");
 
     /* check that it's really "int". We will get a compiler warning, if that's not
-	 * the case. */
+     * the case. */
     int_ptr = &pid;
     g_assert_cmpint(*int_ptr, ==, 42);
 }
@@ -281,7 +281,7 @@ _strv_cmp_fuzz_input(const char *const * in,
     gsize        i;
 
     /* Fuzz the input argument. It will return two output arrays that are semantically
-	 * equal the input. */
+     * equal the input. */
 
     if (nmtst_get_rand_bool()) {
         char **ss;
@@ -312,12 +312,12 @@ _strv_cmp_fuzz_input(const char *const * in,
 
     if (nmtst_get_rand_bool()) {
         /* randomly swap the original and the clone. That means, out_s1 is either
-		 * the input argument (as-is) or the sementically equal clone. */
+         * the input argument (as-is) or the sementically equal clone. */
         NM_SWAP(out_s1, out_s2);
     }
     if (nmtst_get_rand_bool()) {
         /* randomly make s1 and s2 the same. This is for testing that
-		 * comparing two identical pointers yields the same result. */
+         * comparing two identical pointers yields the same result. */
         *out_s2 = *out_s1;
     }
 }
@@ -375,7 +375,7 @@ test_strv_cmp(void)
         }                                                                                           \
                                                                                                     \
         /* Compare with self. _strv_cmp_fuzz_input() randomly swapped the arguments (_a1 and _a1x).
-		 * Either way, the arrays must compare equal to their semantically equal alternative. */ \
+         * Either way, the arrays must compare equal to their semantically equal alternative. */ \
         g_assert_cmpint(_nm_utils_strv_cmp_n(_a1, _l1, _a1x, _l1), ==, 0);                          \
         g_assert_cmpint(_nm_utils_strv_cmp_n(_a2, _l2, _a2x, _l2), ==, 0);                          \
                                                                                                     \
@@ -512,7 +512,7 @@ test_nm_utils_bin2hexstr(void)
         hexdigit_pairs_mangled = FALSE;
         if (delimiter && len > 1 && nmtst_get_rand_bool()) {
             /* randomly convert "0?" sequences to single digits, so we can get hexdigit_pairs_required
-			 * parameter. */
+             * parameter. */
             g_assert(strlen(str_hex) >= 5);
             g_assert(str_hex[2] == delimiter);
             i = 0;
@@ -570,7 +570,7 @@ test_nm_utils_bin2hexstr(void)
 
         if (hexdigit_pairs_mangled) {
             /* we mangled the hexstr to contain single digits. Trying to parse with
-			 * hexdigit_pairs_required must now fail. */
+             * hexdigit_pairs_required must now fail. */
             bin2 = nm_utils_hexstr2bin_full(
                 str_hex,
                 nmtst_get_rand_bool(),
@@ -888,7 +888,7 @@ test_nm_utils_parse_next_line(void)
         }
 
         /* join the list of random words with (random) line delimiters
-		 * ("\0", "\n", "\r" or EOF). */
+         * ("\0", "\n", "\r" or EOF). */
         for (j = 0; j < strv_len; j++) {
             nm_str_buf_append(&strbuf, strv->pdata[j]);
 again:
@@ -900,7 +900,7 @@ again:
                 if (strbuf.len > 0
                     && (nm_str_buf_get_str_unsafe(&strbuf))[strbuf.len - 1] == '\r') {
                     /* the previous line was empty and terminated by "\r". We
-					 * must not join with "\n". Retry. */
+                     * must not join with "\n". Retry. */
                     goto again;
                 }
                 nm_str_buf_append_c(&strbuf, '\n');
@@ -913,7 +913,7 @@ again:
                 break;
             case 4:
                 /* the last word randomly is delimited or not, but not if the last
-				 * word is "". */
+                 * word is "". */
                 if (j + 1 < strv_len) {
                     /* it's not the last word. Retry. */
                     goto again;
@@ -921,7 +921,7 @@ again:
                 g_assert(j == strv_len - 1);
                 if (((const char *) strv->pdata[j])[0] == '\0') {
                     /* if the last word was "", we need a delimiter (to parse it back).
-					 * Retry. */
+                     * Retry. */
                     goto again;
                 }
                 /* The final delimiter gets omitted. It's EOF. */
diff --git a/shared/nm-meta-setting.c b/shared/nm-meta-setting.c
index 2c44f15467..3326a5393f 100644
--- a/shared/nm-meta-setting.c
+++ b/shared/nm-meta-setting.c
@@ -568,11 +568,11 @@ out_none:
     int i;
 
     /* this might hint to a bug, but it would be expected for NM_TYPE_SETTING
-		 * and NM_TYPE_SETTING_IP_CONFIG.
-		 *
-		 * Assert that we didn't lookup for a gtype, which we would expect to find.
-		 * An assertion failure here, hints to a bug in nm_setting_*_class_init().
-		 */
+         * and NM_TYPE_SETTING_IP_CONFIG.
+         *
+         * Assert that we didn't lookup for a gtype, which we would expect to find.
+         * An assertion failure here, hints to a bug in nm_setting_*_class_init().
+         */
     for (i = 0; i < _NM_META_SETTING_TYPE_NUM; i++)
         nm_assert(nm_meta_setting_infos[i].get_setting_gtype() != gtype);
 }
diff --git a/shared/nm-meta-setting.h b/shared/nm-meta-setting.h
index 6473b06699..138cc85076 100644
--- a/shared/nm-meta-setting.h
+++ b/shared/nm-meta-setting.h
@@ -96,10 +96,10 @@ extern const NMSetting8021xSchemeVtable
 
 typedef enum {
     /* the enum (and their numeric values) are internal API. Do not assign
-	 * any meaning the numeric values, because they already have one:
-	 *
-	 * they are sorted in a way, that corresponds to the asciibetical sort
-	 * order of the corresponding setting-name. */
+     * any meaning the numeric values, because they already have one:
+     *
+     * they are sorted in a way, that corresponds to the asciibetical sort
+     * order of the corresponding setting-name. */
 
     NM_META_SETTING_TYPE_6LOWPAN,
     NM_META_SETTING_TYPE_OLPC_MESH,
diff --git a/shared/nm-std-aux/c-list-util.c b/shared/nm-std-aux/c-list-util.c
index f298857154..f56347ccc3 100644
--- a/shared/nm-std-aux/c-list-util.c
+++ b/shared/nm-std-aux/c-list-util.c
@@ -71,8 +71,8 @@ _c_list_srt_merge(CList *ls1, CList *ls2, CListSortCmp cmp, const void *user_dat
     ls = &head;
     for (;;) {
         /* while invoking the @cmp function, the list
-		 * elements are not properly linked. Don't try to access
-		 * their next/prev pointers. */
+         * elements are not properly linked. Don't try to access
+         * their next/prev pointers. */
         if (cmp(ls1, ls2, user_data) <= 0) {
             ls->next = ls1;
             ls       = ls1;
@@ -102,16 +102,16 @@ static CList *
 _c_list_sort(CList *ls, CListSortCmp cmp, const void *user_data)
 {
     /* reserve a huge stack-size. We need roughly log2(n) entries, hence this
-	 * is much more we will ever need. We don't guard for stack-overflow either. */
+     * is much more we will ever need. We don't guard for stack-overflow either. */
     SortStack  stack_arr[70];
     SortStack *stack_head = stack_arr;
 
     stack_arr[0].ls1 = ls;
 
     /* A simple top-down, non-recursive, stable merge-sort.
-	 *
-	 * Maybe natural merge-sort would be better, to do better for
-	 * partially sorted lists. */
+     *
+     * Maybe natural merge-sort would be better, to do better for
+     * partially sorted lists. */
 _split:
     stack_head[0].ls2 = _c_list_srt_split(stack_head[0].ls1);
     if (stack_head[0].ls2) {
diff --git a/shared/nm-std-aux/nm-std-aux.h b/shared/nm-std-aux/nm-std-aux.h
index e85b8e89e1..4ccb2720b1 100644
--- a/shared/nm-std-aux/nm-std-aux.h
+++ b/shared/nm-std-aux/nm-std-aux.h
@@ -282,8 +282,8 @@ nm_strcmp0(const char *s1, const char *s2)
     int c;
 
     /* like g_strcmp0(), but this is inlinable.
-	 *
-	 * Also, it is guaranteed to return either -1, 0, or 1. */
+     *
+     * Also, it is guaranteed to return either -1, 0, or 1. */
     if (s1 == s2)
         return 0;
     if (!s1)
@@ -686,13 +686,13 @@ _nm_auto_fclose(FILE **pfd)
             *_pp = NULL;                                                             \
                                                                                      \
             /* g_clear_pointer() assigns @destroy first to a local variable, so that
-			 * you can call "g_clear_pointer (pp, (GDestroyNotify) destroy);" without
-			 * gcc emitting a warning. We don't do that, hence, you cannot cast
-			 * "destroy" first.
-			 *
-			 * On the upside: you are not supposed to cast fcn, because the pointer
-			 * types are preserved. If you really need a cast, you should cast @pp.
-			 * But that is hardly ever necessary. */ \
+             * you can call "g_clear_pointer (pp, (GDestroyNotify) destroy);" without
+             * gcc emitting a warning. We don't do that, hence, you cannot cast
+             * "destroy" first.
+             *
+             * On the upside: you are not supposed to cast fcn, because the pointer
+             * types are preserved. If you really need a cast, you should cast @pp.
+             * But that is hardly ever necessary. */ \
             (destroy)(_p);                                                           \
                                                                                      \
             _changed = true;                                                         \
diff --git a/shared/nm-std-aux/nm-std-utils.c b/shared/nm-std-aux/nm-std-utils.c
index 606692a7b8..b2060e135b 100644
--- a/shared/nm-std-aux/nm-std-utils.c
+++ b/shared/nm-std-aux/nm-std-utils.c
@@ -17,8 +17,8 @@ nm_utils_get_next_realloc_size(bool true_realloc, size_t requested)
 
     if (requested <= 40) {
         /* small allocations. Increase in small steps of 8 bytes.
-		 *
-		 * We get thus sizes of 8, 16, 32, 40. */
+         *
+         * We get thus sizes of 8, 16, 32, 40. */
         if (requested <= 8)
             return 8;
         if (requested <= 16)
@@ -27,27 +27,27 @@ nm_utils_get_next_realloc_size(bool true_realloc, size_t requested)
             return 32;
 
         /* The return values for < 104 are essentially hard-coded, and the choice here is
-		 * made without very strong reasons.
-		 *
-		 * We want to stay 24 bytes below the power-of-two border 64. Hence, return 40 here.
-		 * However, the next step then is already 104 (128 - 24). It's a larger gap than in
-		 * the steps before.
-		 *
-		 * It's not clear whether some of the steps should be adjusted (or how exactly). */
+         * made without very strong reasons.
+         *
+         * We want to stay 24 bytes below the power-of-two border 64. Hence, return 40 here.
+         * However, the next step then is already 104 (128 - 24). It's a larger gap than in
+         * the steps before.
+         *
+         * It's not clear whether some of the steps should be adjusted (or how exactly). */
         return 40;
     }
 
     if (requested <= 0x2000u - 24u || NM_UNLIKELY(!true_realloc)) {
         /* mid sized allocations. Return next power of two, minus 24 bytes extra space
-		 * at the beginning.
-		 * That means, we double the size as we grow.
-		 *
-		 * With !true_realloc, it means that the caller does not intend to call
-		 * realloc() but instead clone the buffer. This is for example the case, when we
-		 * want to nm_explicit_bzero() the old buffer. In that case we really want to grow
-		 * the buffer exponentially every time and not increment in page sizes of 4K (below).
-		 *
-		 * We get thus sizes of 104, 232, 488, 1000, 2024, 4072, 8168... */
+         * at the beginning.
+         * That means, we double the size as we grow.
+         *
+         * With !true_realloc, it means that the caller does not intend to call
+         * realloc() but instead clone the buffer. This is for example the case, when we
+         * want to nm_explicit_bzero() the old buffer. In that case we really want to grow
+         * the buffer exponentially every time and not increment in page sizes of 4K (below).
+         *
+         * We get thus sizes of 104, 232, 488, 1000, 2024, 4072, 8168... */
 
         if (NM_UNLIKELY(requested > SIZE_MAX / 2u - 24u))
             return SIZE_MAX;
@@ -67,8 +67,8 @@ nm_utils_get_next_realloc_size(bool true_realloc, size_t requested)
         return SIZE_MAX;
 
     /* For large allocations (with !true_realloc) we allocate memory in chunks of
-	 * 4K (- 24 bytes extra), assuming that the memory gets mmapped and thus
-	 * realloc() is efficient by just reordering pages. */
+     * 4K (- 24 bytes extra), assuming that the memory gets mmapped and thus
+     * realloc() is efficient by just reordering pages. */
     n = ((requested + (0x0FFFu + 24u)) & ~((size_t) 0x0FFFu)) - 24u;
     nm_assert(n >= requested);
     return n;
diff --git a/shared/nm-test-utils-impl.c b/shared/nm-test-utils-impl.c
index 99cd3effa8..e48841b41b 100644
--- a/shared/nm-test-utils-impl.c
+++ b/shared/nm-test-utils-impl.c
@@ -81,7 +81,7 @@ nmtstc_service_available(NMTstcServiceInfo *info)
         return info;
 
     /* This happens, when test-networkmanager-service.py exits with 77 status
-	 * code. */
+     * code. */
     m = g_strdup_printf("missing dependency for running NetworkManager stub service %s",
                         NMTSTC_NM_SERVICE);
     g_test_skip(m);
@@ -101,9 +101,9 @@ nmtstc_service_init(void)
     g_assert_no_error(error);
 
     /* Spawn the test service. info->keepalive_fd will be a pipe to the service's
-	 * stdin; if it closes, the service will exit immediately. We use this to
-	 * make sure the service exits if the test program crashes.
-	 */
+     * stdin; if it closes, the service will exit immediately. We use this to
+     * make sure the service exits if the test program crashes.
+     */
     g_spawn_async_with_pipes(NULL,
                              (char **) args,
                              NULL,
@@ -154,9 +154,9 @@ nmtstc_service_init(void)
 
             if (WIFEXITED(data.exit_code) && WEXITSTATUS(data.exit_code) == 77) {
                 /* If the stub service exited with status 77 it means that it decided
-				 * that it cannot conduct the tests and the test should be (gracefully)
-				 * skip. The likely reason for that, is that libnm is not available
-				 * via pygobject. */
+                 * that it cannot conduct the tests and the test should be (gracefully)
+                 * skip. The likely reason for that, is that libnm is not available
+                 * via pygobject. */
                 return NULL;
             }
             g_error("test service %s exited with error code %d", NMTSTC_NM_SERVICE, data.exit_code);
@@ -471,12 +471,12 @@ _context_object_new_do(GType       gtype,
     GObject *             obj;
 
     /* Create a GObject instance synchronously, and arbitrarily use either
-	 * the sync or async constructor.
-	 *
-	 * Note that the sync and async construct differ in one important aspect:
-	 * the async constructor iterates the current g_main_context_get_thread_default(),
-	 * while the sync constructor does not! Aside from that, both should behave
-	 * pretty much the same way. */
+     * the sync or async constructor.
+     *
+     * Note that the sync and async construct differ in one important aspect:
+     * the async constructor iterates the current g_main_context_get_thread_default(),
+     * while the sync constructor does not! Aside from that, both should behave
+     * pretty much the same way. */
 
     if (sync) {
         nm_auto_destroy_and_unref_gsource GSource *source = NULL;
@@ -605,16 +605,16 @@ nmtstc_context_object_new_valist(GType       gtype,
         inside_loop = FALSE;
     } else {
         /* The caller allows to iterate the main context. On that point,
-		 * we can both use the synchronous and the asynchronous initialization,
-		 * both should yield the same result. Choose one randomly. */
+         * we can both use the synchronous and the asynchronous initialization,
+         * both should yield the same result. Choose one randomly. */
         sync        = nmtst_get_rand_bool();
         inside_loop = ((nmtst_get_rand_uint32() % 3) == 0);
     }
 
     if (inside_loop) {
         /* Create the obj on an idle handler of the current context.
-		 * In practice, it should make no difference, which this check
-		 * tries to prove. */
+         * In practice, it should make no difference, which this check
+         * tries to prove. */
         return _context_object_new_inside_loop(gtype, sync, first_property_name, var_args);
     }
 
diff --git a/shared/nm-utils/nm-test-utils.h b/shared/nm-utils/nm-test-utils.h
index e90f16cb9c..559630cbca 100644
--- a/shared/nm-utils/nm-test-utils.h
+++ b/shared/nm-utils/nm-test-utils.h
@@ -381,7 +381,7 @@ __nmtst_init(int *       argc,
         char **d_argv, **i_argv, *nmtst_debug_copy;
 
         /* By setting then NMTST_DEBUG variable, @is_debug is set automatically.
-		 * This can be reverted with no-debug (on command line or environment variable). */
+         * This can be reverted with no-debug (on command line or environment variable). */
         is_debug = TRUE;
 
         nmtst_debug_copy = g_strdup(nmtst_debug);
@@ -394,7 +394,7 @@ __nmtst_init(int *       argc,
                 is_debug = TRUE;
             else if (!g_ascii_strcasecmp(debug, "no-debug")) {
                 /* when specifying the NMTST_DEBUG variable, we set is_debug to true. Use this flag to disable this
-				 * (e.g. for only setting the log-level, but not is_debug). */
+                 * (e.g. for only setting the log-level, but not is_debug). */
                 is_debug = FALSE;
             } else if (!g_ascii_strncasecmp(debug, "log-level=", strlen("log-level="))) {
                 g_free(c_log_level);
@@ -470,17 +470,17 @@ __nmtst_init(int *       argc,
         }
     } else {
         /* We're intentionally assigning a value to static variables
-		 * s_tests_x and p_tests_x without using it afterwards, just
-		 * so that valgrind doesn't complain about the leak. */
+         * s_tests_x and p_tests_x without using it afterwards, just
+         * so that valgrind doesn't complain about the leak. */
         NM_PRAGMA_WARNING_DISABLE("-Wunused-but-set-variable")
 
         /* g_test_init() is a variadic function, so we cannot pass it
-		 * (variadic) arguments. If you need to pass additional parameters,
-		 * call nmtst_init() with argc==NULL and call g_test_init() yourself. */
+         * (variadic) arguments. If you need to pass additional parameters,
+         * call nmtst_init() with argc==NULL and call g_test_init() yourself. */
 
         /* g_test_init() sets g_log_set_always_fatal() for G_LOG_LEVEL_WARNING
-		 * and G_LOG_LEVEL_CRITICAL. So, beware that the test will fail if you
-		 * have any WARN or ERR log messages -- unless you g_test_expect_message(). */
+         * and G_LOG_LEVEL_CRITICAL. So, beware that the test will fail if you
+         * have any WARN or ERR log messages -- unless you g_test_expect_message(). */
         GPtrArray *    arg_array   = g_ptr_array_new();
         gs_free char **arg_array_c = NULL;
         int            arg_array_n, j;
@@ -519,7 +519,7 @@ __nmtst_init(int *       argc,
 
         if (*argc > 1) {
             /* collaps argc/argv by removing the arguments detected
-			 * by g_test_init(). */
+             * by g_test_init(). */
             for (i = 1, j = 1; i < *argc; i++) {
                 if ((*argv)[i] == arg_array_c[j])
                     j++;
@@ -570,7 +570,7 @@ __nmtst_init(int *       argc,
 
     if (!log_level && log_domains) {
         /* if the log level is not specified (but the domain is), we assume
-		 * the caller wants to set it depending on is_debug */
+         * the caller wants to set it depending on is_debug */
         log_level = is_debug ? "DEBUG" : "WARN";
     }
 
@@ -590,15 +590,15 @@ __nmtst_init(int *       argc,
 #endif
     } else if (__nmtst_internal.no_expect_message) {
         /* We have a test that would be assert_logging, but the user specified no_expect_message.
-		 * This transforms g_test_expect_message() into a NOP, but we also have to relax
-		 * g_log_set_always_fatal(), which was set by g_test_init(). */
+         * This transforms g_test_expect_message() into a NOP, but we also have to relax
+         * g_log_set_always_fatal(), which was set by g_test_init(). */
         g_log_set_always_fatal(G_LOG_FATAL_MASK);
 #ifdef _NMTST_INSIDE_CORE
         if (c_log_domains || c_log_level) {
             /* Normally, tests with assert_logging do not overwrite the logging level/domains because
-			 * the logging statements are part of the assertions. But if the test is run with
-			 * no-expect-message *and* the logging is set explicitly via environment variables,
-			 * we still reset the logging. */
+             * the logging statements are part of the assertions. But if the test is run with
+             * no-expect-message *and* the logging is set explicitly via environment variables,
+             * we still reset the logging. */
             gboolean success;
 
             success          = nm_logging_setup(log_level, log_domains, NULL, NULL);
@@ -609,8 +609,8 @@ __nmtst_init(int *       argc,
     } else {
 #if GLIB_CHECK_VERSION(2, 34, 0)
         /* We were called not to set logging levels. This means, that the user
-		 * expects to assert against (all) messages.
-		 * Any uncaught message on >debug level is fatal. */
+         * expects to assert against (all) messages.
+         * Any uncaught message on >debug level is fatal. */
         g_log_set_always_fatal(G_LOG_LEVEL_MASK & ~G_LOG_LEVEL_DEBUG);
 #else
         /* g_test_expect_message() is a NOP, so allow any messages */
@@ -626,11 +626,11 @@ __nmtst_init(int *       argc,
                     || !g_ascii_strcasecmp(c_log_level, "TRACE"))))
         && !g_getenv("G_MESSAGES_DEBUG")) {
         /* if we are @is_debug or @log_level=="DEBUG" and
-		 * G_MESSAGES_DEBUG is unset, we set G_MESSAGES_DEBUG=all.
-		 * To disable this default behaviour, set G_MESSAGES_DEBUG='' */
+         * G_MESSAGES_DEBUG is unset, we set G_MESSAGES_DEBUG=all.
+         * To disable this default behaviour, set G_MESSAGES_DEBUG='' */
 
         /* Note that g_setenv is not thread safe, but you should anyway call
-		 * nmtst_init() at the very start. */
+         * nmtst_init() at the very start. */
         g_setenv("G_MESSAGES_DEBUG", "all", TRUE);
     }
 
@@ -1035,15 +1035,15 @@ nmtst_stable_rand(guint64 seed, gpointer buf, gsize len)
     } n;
 
     /* We want a stable random generator that is in our control and does not
-	 * depend on glibc/glib versions.
-	 * Use a linear congruential generator (x[n+1] = (A * x[n] + C) % M)
-	 * https://en.wikipedia.org/wiki/Linear_congruential_generator
-	 *
-	 * We choose (Knuth’s LCG MMIX)
-	 *   A = 6364136223846793005llu
-	 *   C = 1442695040888963407llu
-	 *   M = 2^64
-	 */
+     * depend on glibc/glib versions.
+     * Use a linear congruential generator (x[n+1] = (A * x[n] + C) % M)
+     * https://en.wikipedia.org/wiki/Linear_congruential_generator
+     *
+     * We choose (Knuth’s LCG MMIX)
+     *   A = 6364136223846793005llu
+     *   C = 1442695040888963407llu
+     *   M = 2^64
+     */
 
     g_assert(len == 0 || buf);
 
@@ -1053,7 +1053,7 @@ nmtst_stable_rand(guint64 seed, gpointer buf, gsize len)
         n.n = (A * n.n + C);
 
         /* let's combine the 64 bits randomness in one byte. By xor-ing, it's
-		 * also independent of endianness. */
+         * also independent of endianness. */
         b[0] = n.a[0] ^ n.a[1] ^ n.a[2] ^ n.a[3] ^ n.a[4] ^ n.a[5] ^ n.a[6] ^ n.a[7];
     }
 }
@@ -1082,38 +1082,38 @@ nmtst_get_rand_word_length(GRand *rand)
         guint   probability;
 
         /* The following python code implements a random sample with this
-		 * distribution:
-		 *
-		 *    def random_histogram(n_tries, scale = None):
-		 *        def probability(n_tok):
-		 *            import math
-		 *            return max(2, math.floor(100 / (2*(n_tok+1))))
-		 *        def n_tokens():
-		 *            import random
-		 *            n_tok = 0
-		 *            while True:
-		 *                if random.randint(0, 0xFFFFFFFF) % probability(n_tok) == 0:
-		 *                   return n_tok
-		 *                n_tok += 1
-		 *        hist = []
-		 *        i = 0;
-		 *        while i < n_tries:
-		 *            n_tok = n_tokens()
-		 *            while n_tok >= len(hist):
-		 *                hist.append(0)
-		 *            hist[n_tok] = hist[n_tok] + 1
-		 *            i += 1
-		 *        if scale is not None:
-		 *            hist = list([round(x / n_tries * scale) for x in hist])
-		 *        return hist
-		 *
-		 * For example, random_histogram(n_tries = 1000000, scale = 1000) may give
-		 *
-		 *   IDX:  [ 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29]
-		 *   SEEN: [20, 39, 59, 73, 80, 91, 92, 90, 91, 73, 73, 54, 55, 36, 24, 16, 16,  8,  4,  2,  1,  1,  0,  0,  0,  0,  0,  0,  0,  0]
-		 *
-		 * which give a sense of the probability with this individual results are returned.
-		 */
+         * distribution:
+         *
+         *    def random_histogram(n_tries, scale = None):
+         *        def probability(n_tok):
+         *            import math
+         *            return max(2, math.floor(100 / (2*(n_tok+1))))
+         *        def n_tokens():
+         *            import random
+         *            n_tok = 0
+         *            while True:
+         *                if random.randint(0, 0xFFFFFFFF) % probability(n_tok) == 0:
+         *                   return n_tok
+         *                n_tok += 1
+         *        hist = []
+         *        i = 0;
+         *        while i < n_tries:
+         *            n_tok = n_tokens()
+         *            while n_tok >= len(hist):
+         *                hist.append(0)
+         *            hist[n_tok] = hist[n_tok] + 1
+         *            i += 1
+         *        if scale is not None:
+         *            hist = list([round(x / n_tries * scale) for x in hist])
+         *        return hist
+         *
+         * For example, random_histogram(n_tries = 1000000, scale = 1000) may give
+         *
+         *   IDX:  [ 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29]
+         *   SEEN: [20, 39, 59, 73, 80, 91, 92, 90, 91, 73, 73, 54, 55, 36, 24, 16, 16,  8,  4,  2,  1,  1,  0,  0,  0,  0,  0,  0,  0,  0]
+         *
+         * which give a sense of the probability with this individual results are returned.
+         */
         probability = NM_MAX(2u, (100u / (2u * (n + 1u))));
         if ((rnd % probability) == 0)
             return n;
@@ -1602,7 +1602,7 @@ __nmtst_spawn_sync(const char *working_directory,
 
     if (assert_exit_status != -1) {
         /* exit status is a guint8 on success. Set @assert_exit_status to -1
-		 * not to check for the exit status. */
+         * not to check for the exit status. */
         g_assert(WIFEXITED(exit_status));
         g_assert_cmpint(WEXITSTATUS(exit_status), ==, assert_exit_status);
     }
@@ -1722,7 +1722,7 @@ _nmtst_assert_resolve_relative_path_equals(const char *f1,
     g_assert(p1 && *p1);
 
     /* Fixme: later we might need to coalesce repeated '/', "./", and "../".
-	 * For now, it's good enough. */
+     * For now, it's good enough. */
     if (g_strcmp0(p1, p2) != 0)
         g_error("%s:%d : filenames don't match \"%s\" vs. \"%s\" // \"%s\" - \"%s\"",
                 file,
@@ -1746,12 +1746,12 @@ nmtst_logging_disable(gboolean always)
     g_assert(nmtst_initialized());
     if (!always && __nmtst_internal.no_expect_message) {
         /* The caller does not want to @always suppress logging. Instead,
-		 * the caller wants to suppress unexpected log messages that would
-		 * fail assertions (since we possibly assert against all unexpected
-		 * log messages).
-		 *
-		 * If the test is run with no-expect-message, then don't suppress
-		 * the loggings, because they also wouldn't fail assertions. */
+         * the caller wants to suppress unexpected log messages that would
+         * fail assertions (since we possibly assert against all unexpected
+         * log messages).
+         *
+         * If the test is run with no-expect-message, then don't suppress
+         * the loggings, because they also wouldn't fail assertions. */
         return NULL;
     }
 
@@ -2355,9 +2355,9 @@ nmtst_assert_hwaddr_equals(gconstpointer hwaddr1,
     g_assert(nm_utils_hwaddr_aton(expected, buf2, hwaddr2_len));
 
     /* Manually check the entire hardware address instead of using
-	 * nm_utils_hwaddr_matches() because that function doesn't compare
-	 * entire InfiniBand addresses for various (legitimate) reasons.
-	 */
+     * nm_utils_hwaddr_matches() because that function doesn't compare
+     * entire InfiniBand addresses for various (legitimate) reasons.
+     */
     success = (hwaddr1_len == hwaddr2_len);
     if (success)
         success = !memcmp(hwaddr1, buf2, hwaddr1_len);
diff --git a/shared/nm-utils/nm-vpn-plugin-macros.h b/shared/nm-utils/nm-vpn-plugin-macros.h
index 32f01bf237..f9dd45a402 100644
--- a/shared/nm-utils/nm-vpn-plugin-macros.h
+++ b/shared/nm-utils/nm-vpn-plugin-macros.h
@@ -12,24 +12,24 @@ static inline int
 nm_utils_syslog_coerce_from_nm(int syslog_level)
 {
     /* NetworkManager uses internally NMLogLevel levels. When spawning
-	 * the VPN plugin, it maps those levels to syslog levels as follows:
-	 *
-	 *  LOGL_INFO = LOG_NOTICE,
-	 *  LOGL_DEBUG = LOG_INFO,
-	 *  LOGL_TRACE = LOG_DEBUG,
-	 *
-	 * However, when actually printing to syslog, we don't want to print messages
-	 * with LOGL_INFO level as LOG_NOTICE, because they are *not* to be highlighted.
-	 *
-	 * In other words: NetworkManager has 3 levels that should not require highlighting:
-	 * LOGL_INFO, LOGL_DEBUG, LOGL_TRACE. syslog on the other hand has only LOG_INFO and LOG_DEBUG.
-	 *
-	 * So, coerce those values before printing to syslog. When you receive the syslog_level
-	 * from NetworkManager, instead of calling
-	 *   syslog(syslog_level, ...)
-	 * you should call
-	 *   syslog(nm_utils_syslog_coerce_from_nm(syslog_level), ...)
-	 */
+     * the VPN plugin, it maps those levels to syslog levels as follows:
+     *
+     *  LOGL_INFO = LOG_NOTICE,
+     *  LOGL_DEBUG = LOG_INFO,
+     *  LOGL_TRACE = LOG_DEBUG,
+     *
+     * However, when actually printing to syslog, we don't want to print messages
+     * with LOGL_INFO level as LOG_NOTICE, because they are *not* to be highlighted.
+     *
+     * In other words: NetworkManager has 3 levels that should not require highlighting:
+     * LOGL_INFO, LOGL_DEBUG, LOGL_TRACE. syslog on the other hand has only LOG_INFO and LOG_DEBUG.
+     *
+     * So, coerce those values before printing to syslog. When you receive the syslog_level
+     * from NetworkManager, instead of calling
+     *   syslog(syslog_level, ...)
+     * you should call
+     *   syslog(nm_utils_syslog_coerce_from_nm(syslog_level), ...)
+     */
     switch (syslog_level) {
     case LOG_INFO:
         return LOG_DEBUG;
diff --git a/shared/nm-utils/nm-vpn-plugin-utils.c b/shared/nm-utils/nm-vpn-plugin-utils.c
index 99ae5d013b..9627158db7 100644
--- a/shared/nm-utils/nm-vpn-plugin-utils.c
+++ b/shared/nm-utils/nm-vpn-plugin-utils.c
@@ -41,10 +41,10 @@ nm_vpn_plugin_utils_load_editor(const char *                  module_name,
 
     if (!g_path_is_absolute(module_name)) {
         /*
-		 * Load an editor from the same directory this plugin is in.
-		 * Ideally, we'd get our .so name from the NMVpnEditorPlugin if it
-		 * would just have a property with it...
-		 */
+         * Load an editor from the same directory this plugin is in.
+         * Ideally, we'd get our .so name from the NMVpnEditorPlugin if it
+         * would just have a property with it...
+         */
         if (!dladdr(nm_vpn_plugin_utils_load_editor, &plugin_info)) {
             /* Really a "can not happen" scenario. */
             g_set_error(error,
@@ -61,16 +61,16 @@ nm_vpn_plugin_utils_load_editor(const char *                  module_name,
     }
 
     /* we really expect this function to be called with unchanging @module_name
-	 * and @factory_name. And we only want to load the module once, hence it would
-	 * be more complicated to accept changing @module_name/@factory_name arguments.
-	 *
-	 * The reason for only loading once is that due to glib types, we cannot create a
-	 * certain type-name more then once, so loading the same module or another version
-	 * of the same module will fail horribly as both try to create a GType with the same
-	 * name.
-	 *
-	 * Only support loading once, any future calls will reuse the handle. To simplify
-	 * that, we enforce that the @factory_name and @module_name is the same. */
+     * and @factory_name. And we only want to load the module once, hence it would
+     * be more complicated to accept changing @module_name/@factory_name arguments.
+     *
+     * The reason for only loading once is that due to glib types, we cannot create a
+     * certain type-name more then once, so loading the same module or another version
+     * of the same module will fail horribly as both try to create a GType with the same
+     * name.
+     *
+     * Only support loading once, any future calls will reuse the handle. To simplify
+     * that, we enforce that the @factory_name and @module_name is the same. */
     if (cached.factory) {
         g_return_val_if_fail(cached.dl_module, NULL);
         g_return_val_if_fail(cached.factory_name && nm_streq0(cached.factory_name, factory_name),
@@ -112,9 +112,9 @@ nm_vpn_plugin_utils_load_editor(const char *                  module_name,
         }
 
         /* we cannot ever unload the module because it creates glib types, which
-		 * cannot be unregistered.
-		 *
-		 * Thus we just leak the dl_module handle indefinitely. */
+         * cannot be unregistered.
+         *
+         * Thus we just leak the dl_module handle indefinitely. */
         cached.factory      = factory;
         cached.dl_module    = dl_module;
         cached.module_name  = g_strdup(module_name);
diff --git a/shared/systemd/nm-sd-utils-shared.c b/shared/systemd/nm-sd-utils-shared.c
index 2c72ba4d20..04b9c8c367 100644
--- a/shared/systemd/nm-sd-utils-shared.c
+++ b/shared/systemd/nm-sd-utils-shared.c
@@ -123,17 +123,17 @@ gboolean
 nm_sd_http_url_is_valid_https (const char *url)
 {
 	/* We use this function to verify connection:mud-url property, it must thus
-	 * not change behavior.
-	 *
-	 * Note that sd_dhcp_client_set_mud_url() and sd_dhcp6_client_set_request_mud_url()
-	 * assert with http_url_is_valid() that the argument is valid. We thus must make
-	 * sure to only pass URLs that are valid according to http_url_is_valid().
-	 *
-	 * This is given, because our nm_sd_http_url_is_valid_https() is more strict
-	 * than http_url_is_valid().
-	 *
-	 * We only must make sure that this is also correct in the future, when we
-	 * re-import systemd code. */
+     * not change behavior.
+     *
+     * Note that sd_dhcp_client_set_mud_url() and sd_dhcp6_client_set_request_mud_url()
+     * assert with http_url_is_valid() that the argument is valid. We thus must make
+     * sure to only pass URLs that are valid according to http_url_is_valid().
+     *
+     * This is given, because our nm_sd_http_url_is_valid_https() is more strict
+     * than http_url_is_valid().
+     *
+     * We only must make sure that this is also correct in the future, when we
+     * re-import systemd code. */
 	nm_assert (_http_url_is_valid (url, FALSE) == http_url_is_valid (url));
 	return _http_url_is_valid (url, TRUE);
 }
@@ -146,11 +146,11 @@ nmtst_systemd_extract_first_word_all (const char *str, char ***out_strv)
 	gs_unref_ptrarray GPtrArray *arr = NULL;
 
 	/* we implement a str split function to parse `/proc/cmdline`. This
-	 * code should behave like systemd, which uses extract_first_word()
-	 * for that.
-	 *
-	 * As we want to unit-test our implementation to match systemd,
-	 * expose this function for testing. */
+     * code should behave like systemd, which uses extract_first_word()
+     * for that.
+     *
+     * As we want to unit-test our implementation to match systemd,
+     * expose this function for testing. */
 
 	g_assert (out_strv);
 	g_assert (!*out_strv);
diff --git a/src/NetworkManagerUtils.c b/src/NetworkManagerUtils.c
index 1346d60f52..0fe55ec946 100644
--- a/src/NetworkManagerUtils.c
+++ b/src/NetworkManagerUtils.c
@@ -96,15 +96,15 @@ get_new_connection_name(NMConnection *const *existing_connections,
         return g_strdup(preferred);
 
     /* Otherwise, find the next available unique connection name using the given
-	 * connection name template.
-	 */
+     * connection name template.
+     */
     for (i = 1; TRUE; i++) {
         char *temp;
 
         /* TRANSLATORS: the first %s is a prefix for the connection id, such
-		 * as "Wired Connection" or "VPN Connection". The %d is a number
-		 * that is combined with the first argument to create a unique
-		 * connection id. */
+         * as "Wired Connection" or "VPN Connection". The %d is a number
+         * that is combined with the first argument to create a unique
+         * connection id. */
         temp = g_strdup_printf(C_("connection id fallback", "%s %u"), fallback_prefix, i);
 
         if (nm_utils_strv_find_first((char **) existing_names, existing_len, temp) < 0)
@@ -332,11 +332,11 @@ check_ip6_method(NMConnection *orig, NMConnection *candidate, GHashTable *settin
         && nm_streq(candidate_ip6_method, NM_SETTING_IP6_CONFIG_METHOD_AUTO)
         && (!candidate_ip6 || nm_setting_ip_config_get_may_fail(candidate_ip6))) {
         /* If the generated connection is 'link-local' and the candidate is both 'auto'
-		 * and may-fail=TRUE, then the candidate is OK to use.  may-fail is included
-		 * in the decision because if the candidate is 'auto' but may-fail=FALSE, then
-		 * the connection could not possibly have been previously activated on the
-		 * device if the device has no non-link-local IPv6 address.
-		 */
+         * and may-fail=TRUE, then the candidate is OK to use.  may-fail is included
+         * in the decision because if the candidate is 'auto' but may-fail=FALSE, then
+         * the connection could not possibly have been previously activated on the
+         * device if the device has no non-link-local IPv6 address.
+         */
         allow = TRUE;
     } else if (NM_IN_STRSET(orig_ip6_method,
                             NM_SETTING_IP6_CONFIG_METHOD_LINK_LOCAL,
@@ -344,9 +344,9 @@ check_ip6_method(NMConnection *orig, NMConnection *candidate, GHashTable *settin
                             NM_SETTING_IP6_CONFIG_METHOD_AUTO)
                && nm_streq0(candidate_ip6_method, NM_SETTING_IP6_CONFIG_METHOD_IGNORE)) {
         /* If the generated connection method is 'link-local', disabled' or 'auto' and
-		 * the candidate method is 'ignore' we can take the connection, because NM didn't
-		 * simply take care of IPv6.
-		 */
+         * the candidate method is 'ignore' we can take the connection, because NM didn't
+         * simply take care of IPv6.
+         */
         allow = TRUE;
     }
 
@@ -456,13 +456,13 @@ check_ip_routes(NMConnection *orig,
         }
 
         /* if @orig (@routes1) contains /32 routes that are missing in @candidate,
-		 * we accept that.
-		 *
-		 * A /32 may have been added automatically, as a direct-route to the gateway.
-		 * The generated connection (@orig) would contain that route, so we shall ignore
-		 * it.
-		 *
-		 * Likeweise for /128 for IPv6. */
+         * we accept that.
+         *
+         * A /32 may have been added automatically, as a direct-route to the gateway.
+         * The generated connection (@orig) would contain that route, so we shall ignore
+         * it.
+         *
+         * Likeweise for /128 for IPv6. */
         if (nm_ip_route_get_prefix(routes1[i1]) == PLEN)
             continue;
 
@@ -504,10 +504,10 @@ check_ip4_method(NMConnection *orig,
         && (!candidate_ip4 || nm_setting_ip_config_get_may_fail(candidate_ip4))
         && !device_has_carrier) {
         /* If the generated connection is 'disabled' (device had no IP addresses)
-		 * but it has no carrier, that most likely means that IP addressing could
-		 * not complete and thus no IP addresses were assigned.  In that case, allow
-		 * matching to the "auto" method.
-		 */
+         * but it has no carrier, that most likely means that IP addressing could
+         * not complete and thus no IP addresses were assigned.  In that case, allow
+         * matching to the "auto" method.
+         */
         remove_from_hash(settings,
                          props,
                          NM_SETTING_IP4_CONFIG_SETTING_NAME,
@@ -671,8 +671,8 @@ check_connection_s390_props(NMConnection *orig, NMConnection *candidate, GHashTa
         return TRUE;
 
     /* If the generated connection did not contain wired setting,
-	 * allow it to match to a connection with a wired setting,
-	 * but default (empty) s390-* properties */
+     * allow it to match to a connection with a wired setting,
+     * but default (empty) s390-* properties */
     s_wired_orig = nm_connection_get_setting_wired(orig);
     s_wired_cand = nm_connection_get_setting_wired(candidate);
     if (!s_wired_orig && s_wired_cand) {
@@ -800,8 +800,8 @@ nm_utils_match_connection(NMConnection *const *  connections,
             s_cand = nm_connection_get_setting_connection(candidate);
 
             /* It is indicated that this connection matches. Assume we have
-			 * a match, but check for particular differences that let us
-			 * reject the candidate. */
+             * a match, but check for particular differences that let us
+             * reject the candidate. */
             if (!nm_streq0(nm_setting_connection_get_connection_type(s_orig),
                            nm_setting_connection_get_connection_type(s_cand)))
                 continue;
@@ -875,10 +875,10 @@ nm_match_spec_device_by_pllink(const NMPlatformLink *pllink,
     NMMatchSpecMatchType m;
 
     /* we can only match by certain properties that are available on the
-	 * platform link (and even @pllink might be missing.
-	 *
-	 * It's still useful because of specs like "*" and "except:interface-name:eth0",
-	 * which match even in that case. */
+     * platform link (and even @pllink might be missing.
+     *
+     * It's still useful because of specs like "*" and "except:interface-name:eth0",
+     * which match even in that case. */
     m = nm_match_spec_device(specs,
                              pllink ? pllink->name : NULL,
                              match_device_type,
@@ -964,7 +964,7 @@ _shutdown_waitobj_unregister(NMShutdownWaitObjHandle *handle)
     g_slice_free(NMShutdownWaitObjHandle, handle);
 
     /* FIXME(shutdown): check whether the object list is empty, and
-	 * signal shutdown-complete */
+     * signal shutdown-complete */
 }
 
 static void
@@ -1041,8 +1041,8 @@ nm_shutdown_wait_obj_register_full(gpointer           watched_obj,
     handle  = g_slice_new(NMShutdownWaitObjHandle);
     *handle = (NMShutdownWaitObjHandle){
         /* depending on @free_msg_reason, we take ownership of @msg_reason.
-		 * In either case, we just reference the string without cloning
-		 * it. */
+         * In either case, we just reference the string without cloning
+         * it. */
         .watched_obj     = watched_obj,
         .msg_reason      = msg_reason,
         .free_msg_reason = free_msg_reason,
@@ -1114,12 +1114,12 @@ nm_utils_file_is_in_path(const char *abs_filename, const char *abs_path)
     nm_assert(path <= &abs_filename[strlen(abs_filename)]);
 
     /* we require a non-empty remainder with no slashes. That is, only a filename.
-	 *
-	 * Note this will reject "/var/run/" as not being in "/var",
-	 * while "/var/run" would pass. The function searches for files
-	 * only, so a trailing slash (indicating a directory) is not allowed).
-	 * This is despite that the function cannot determine whether "/var/run"
-	 * is itself a file or a directory. "*/
+     *
+     * Note this will reject "/var/run/" as not being in "/var",
+     * while "/var/run" would pass. The function searches for files
+     * only, so a trailing slash (indicating a directory) is not allowed).
+     * This is despite that the function cannot determine whether "/var/run"
+     * is itself a file or a directory. "*/
     return path[0] && !strchr(path, '/') ? path : NULL;
 }
 
@@ -1602,7 +1602,7 @@ nm_utils_ip_routes_to_dbus(int                          addr_family,
 
         if (out_routes) {
             /* legacy versions of nm_ip[46]_route_set_prefix() in libnm-util assert that the
-			 * plen is positive. Skip the default routes not to break older clients. */
+             * plen is positive. Skip the default routes not to break older clients. */
             if (!nm_platform_route_table_is_main(r->rx.table_coerced)
                 || NM_PLATFORM_IP_ROUTE_IS_DEFAULT(r))
                 continue;
diff --git a/src/NetworkManagerUtils.h b/src/NetworkManagerUtils.h
index b21e42d410..699c78dade 100644
--- a/src/NetworkManagerUtils.h
+++ b/src/NetworkManagerUtils.h
@@ -74,16 +74,16 @@ NMPlatformRoutingRule *nm_ip_routing_rule_to_platform(const NMIPRoutingRule *rul
 
 typedef enum {
     /* There is no watched_obj argument, and the shutdown is delayed until the user
-	 * explicitly calls unregister on the returned handle. */
+     * explicitly calls unregister on the returned handle. */
     NM_SHUTDOWN_WAIT_TYPE_HANDLE,
 
     /* The watched_obj argument is a GObject, and shutdown is delayed until the object
-	 * gets destroyed (or unregistered). */
+     * gets destroyed (or unregistered). */
     NM_SHUTDOWN_WAIT_TYPE_OBJECT,
 
     /* The watched_obj argument is a GCancellable, and shutdown is delayed until the object
-	 * gets destroyed (or unregistered). Note that after NM_SHUTDOWN_TIMEOUT_MS, the
-	 * cancellable will be cancelled to notify listeners about the shutdown. */
+     * gets destroyed (or unregistered). Note that after NM_SHUTDOWN_TIMEOUT_MS, the
+     * cancellable will be cancelled to notify listeners about the shutdown. */
     NM_SHUTDOWN_WAIT_TYPE_CANCELLABLE,
 } NMShutdownWaitType;
 
@@ -184,10 +184,10 @@ static inline NMDhcpLease *
 nm_dhcp_lease_new_from_options(GHashTable *options_take)
 {
     /* a NMDhcpLease is really just a GHashTable. But it's also supposed to be *immutable*.
-	 *
-	 * Hence, the API here takes over ownership of the reference to @options_take, that
-	 * is to emphasize that we acquire ownership of the hash, and it should not be modified
-	 * anymore. */
+     *
+     * Hence, the API here takes over ownership of the reference to @options_take, that
+     * is to emphasize that we acquire ownership of the hash, and it should not be modified
+     * anymore. */
     return (NMDhcpLease *) options_take;
 }
 
diff --git a/src/devices/adsl/nm-atm-manager.c b/src/devices/adsl/nm-atm-manager.c
index 308844940a..186164bbf3 100644
--- a/src/devices/adsl/nm-atm-manager.c
+++ b/src/devices/adsl/nm-atm-manager.c
@@ -162,8 +162,8 @@ adsl_remove(NMAtmManager *self, struct udev_device *udev_device)
         NMDevice *device = iter->data;
 
         /* Match 'iface' not 'ip_iface' to the ATM device instead of the
-		 * NAS bridge interface or PPPoE interface.
-		 */
+         * NAS bridge interface or PPPoE interface.
+         */
         if (g_strcmp0(nm_device_get_iface(device), iface) != 0)
             continue;
 
diff --git a/src/devices/adsl/nm-device-adsl.c b/src/devices/adsl/nm-device-adsl.c
index d2990a53e1..c39306297a 100644
--- a/src/devices/adsl/nm-device-adsl.c
+++ b/src/devices/adsl/nm-device-adsl.c
@@ -102,9 +102,9 @@ complete_connection(NMDevice *           device,
     NMSettingAdsl *s_adsl;
 
     /*
-	 * We can't telepathically figure out the username, so if
-	 * it wasn't given, we can't complete the connection.
-	 */
+     * We can't telepathically figure out the username, so if
+     * it wasn't given, we can't complete the connection.
+     */
     s_adsl = nm_connection_get_setting_adsl(connection);
     if (s_adsl && !nm_setting_verify(NM_SETTING(s_adsl), NULL, error))
         return FALSE;
@@ -338,10 +338,10 @@ br2684_create_iface(NMDeviceAdsl *self)
     ni.mtu         = 1500;
 
     /* Loop attempting to create an interface that doesn't exist yet.  The
-	 * kernel can create one for us automatically, but due to API issues it
-	 * cannot return that name to us.  Since we want to know the name right
-	 * away, just brute-force it.
-	 */
+     * kernel can create one for us automatically, but due to API issues it
+     * cannot return that name to us.  Since we want to know the name right
+     * away, just brute-force it.
+     */
     while (TRUE) {
         memset(&ni.ifname, 0, sizeof(ni.ifname));
         g_snprintf(ni.ifname, sizeof(ni.ifname), "nas%u", num++);
@@ -552,9 +552,9 @@ adsl_cleanup(NMDeviceAdsl *self)
     nm_clear_g_source(&priv->nas_update_id);
 
     /* FIXME: kernel has no way of explicitly deleting the 'nasX' interface yet,
-	 * so it gets leaked.  It does get destroyed when it's no longer in use,
-	 * but we have no control over that.
-	 */
+     * so it gets leaked.  It does get destroyed when it's no longer in use,
+     * but we have no control over that.
+     */
     priv->nas_ifindex = 0;
     nm_clear_g_free(&priv->nas_ifname);
 }
diff --git a/src/devices/bluetooth/nm-bluez-manager.c b/src/devices/bluetooth/nm-bluez-manager.c
index d79c457e8d..ccfee7438c 100644
--- a/src/devices/bluetooth/nm-bluez-manager.c
+++ b/src/devices/bluetooth/nm-bluez-manager.c
@@ -73,9 +73,9 @@ typedef struct {
     NMBluezManager *self;
 
     /* Fields name with "d_" prefix are purely cached values from BlueZ's
-	 * ObjectManager D-Bus interface. There is no logic whatsoever about
-	 * them.
-	 */
+     * ObjectManager D-Bus interface. There is no logic whatsoever about
+     * them.
+     */
 
     CList process_change_lst;
 
@@ -133,7 +133,7 @@ typedef struct {
     bool x_device_panu_connection_allow_create : 1;
 
     /* flag to remember last time when we checked wether the object
-	 * was  a suitable adapter that is usable to a device. */
+     * was  a suitable adapter that is usable to a device. */
     bool was_usable_adapter_for_device_before : 1;
 
     char _object_path_intern[];
@@ -259,12 +259,12 @@ static void
 _dbus_call_complete_cb_nop(GObject *source_object, GAsyncResult *res, gpointer user_data)
 {
     /* we don't do anything at all. The only reason to register this
-	 * callback is so that GDBusConnection keeps the cancellable alive
-	 * long enough until the call completes.
-	 *
-	 * Note that this cancellable in turn is registered via
-	 * nm_shutdown_wait_obj_register_*(), to block shutdown until
-	 * we are done. */
+     * callback is so that GDBusConnection keeps the cancellable alive
+     * long enough until the call completes.
+     *
+     * Note that this cancellable in turn is registered via
+     * nm_shutdown_wait_obj_register_*(), to block shutdown until
+     * we are done. */
 }
 
 /*****************************************************************************/
@@ -693,7 +693,7 @@ _bzobjs_device_is_usable(const BzDBusObj *bzobj,
             usable_nap = TRUE;
         else if (bzobj->x_device_panu_connection_allow_create) {
             /* We didn't yet try to create a connection. Presume we are going to create
-			 * it when the time comes... */
+             * it when the time comes... */
             usable_nap             = TRUE;
             create_panu_connection = TRUE;
         }
@@ -704,8 +704,8 @@ _bzobjs_device_is_usable(const BzDBusObj *bzobj,
             && nm_device_get_state(NM_DEVICE(bzobj->x_device.device_bt))
                    > NM_DEVICE_STATE_DISCONNECTED) {
             /* The device is still activated... the absence of a profile does not
-			 * render it unusable (yet). But since there is no more profile, the
-			 * device is probably about to disconnect. */
+             * render it unusable (yet). But since there is no more profile, the
+             * device is probably about to disconnect. */
         } else
             goto out_unusable;
     }
@@ -732,9 +732,9 @@ _bzobjs_device_is_connected(const BzDBusObj *bzobj)
         return TRUE;
     if (bzobj->x_device.connect_dun_context) {
         /* As long as we have a dun-context, we consider it connected.
-		 *
-		 * We require NMDeviceBt to try to connect to the modem, and if that fails,
-		 * it will disconnect. */
+         *
+         * We require NMDeviceBt to try to connect to the modem, and if that fails,
+         * it will disconnect. */
         return TRUE;
     }
     return FALSE;
@@ -1128,8 +1128,8 @@ _network_server_vt_register_bridge(const NMBtVTableNetworkServer *vtable,
     bzobj = _network_server_find_available(priv, addr, NULL);
     if (!bzobj) {
         /* The device checked that a network server is available, before
-		 * starting the activation, but for some reason it no longer is.
-		 * Indicate that the activation should not proceed. */
+         * starting the activation, but for some reason it no longer is.
+         * Indicate that the activation should not proceed. */
         if (addr) {
             nm_utils_error_set(error,
                                NM_UTILS_ERROR_UNKNOWN,
@@ -1424,14 +1424,14 @@ _device_process_change(BzDBusObj *bzobj)
             && NM_FLAGS_HAS(bzobj->d_device_capabilities, NM_BT_CAPABILITY_NAP)
             && _conn_track_find_head(self, NM_BT_CAPABILITY_NAP, bzobj->d_device.address)) {
             /* We have a useable device and also a panu-connection. We block future attemps
-			 * to generate a connection. */
+             * to generate a connection. */
             bzobj->x_device_panu_connection_allow_create = FALSE;
         }
         if (bzobj->x_device.panu_connection) {
             if (!NM_FLAGS_HAS(nm_settings_connection_get_flags(bzobj->x_device.panu_connection),
                               NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED)) {
                 /* the connection that we generated earlier still exists, but it's not longer the same
-				 * as it was when we created it. Forget about it, so that we don't delete the profile later... */
+                 * as it was when we created it. Forget about it, so that we don't delete the profile later... */
                 bzobj->x_device.panu_connection = NULL;
             } else {
                 if (!device_is_usable
@@ -1604,11 +1604,11 @@ _dbus_process_changes(NMBluezManager *self, BzDBusObj *bzobj, const char *log_re
     adapter_is_usable_for_device = _bzobjs_adapter_is_usable_for_device(bzobj);
     if (adapter_is_usable_for_device != bzobj->was_usable_adapter_for_device_before) {
         /* this function does not modify bzobj in any other cases except here.
-		 * Usually changes are processed delayed, in the idle handler.
-		 *
-		 * But the bzobj->was_usable_adapter_for_device_before only exists to know whether
-		 * we need to re-check device availability. It is correct to set the flag
-		 * here, right before we checked. */
+         * Usually changes are processed delayed, in the idle handler.
+         *
+         * But the bzobj->was_usable_adapter_for_device_before only exists to know whether
+         * we need to re-check device availability. It is correct to set the flag
+         * here, right before we checked. */
         bzobj->was_usable_adapter_for_device_before = adapter_is_usable_for_device;
         recheck_devices_for_adapter                 = TRUE;
         changes                                     = TRUE;
@@ -1634,7 +1634,7 @@ _dbus_process_changes(NMBluezManager *self, BzDBusObj *bzobj, const char *log_re
         BzDBusObj *    bzobj2;
 
         /* we got a change to the availability of an adapter. We might need to recheck
-		 * all devices that use this adapter... */
+         * all devices that use this adapter... */
         g_hash_table_iter_init(&iter, priv->bzobjs);
         while (g_hash_table_iter_next(&iter, (gpointer *) &bzobj2, NULL)) {
             if (bzobj2 == bzobj)
@@ -2432,11 +2432,11 @@ _connect_returned(NMBluezManager *        self,
           device_name);
 
     /* we already have another over-all timer running. But after we connected the device,
-	 * we still need to wait for bluez to acknowledge the connected state (via D-Bus, for NAP).
-	 * For DUN profiles we likely are already fully connected by now.
-	 *
-	 * Anyway, schedule another timeout that is possibly shorter than the overall, original
-	 * timeout. Now this should go down fast. */
+     * we still need to wait for bluez to acknowledge the connected state (via D-Bus, for NAP).
+     * For DUN profiles we likely are already fully connected by now.
+     *
+     * Anyway, schedule another timeout that is possibly shorter than the overall, original
+     * timeout. Now this should go down fast. */
     bzobj->x_device.c_req_data->timeout_wait_connect_id =
         g_timeout_add(5000, _connect_timeout_wait_connected_cb, bzobj),
     bzobj->x_device.c_req_data->device_name = g_strdup(device_name);
@@ -2471,11 +2471,11 @@ _connect_dun_step2_cb(NMBluez5DunContext *context,
 
     if (rfcomm_dev) {
         /* We want to early notify about the rfcomm path. That is because we might still delay
-		 * to signal full activation longer (asynchronously). But the earliest time the callback
-		 * is invoked with the rfcomm path, we just created the device synchronously.
-		 *
-		 * By already notifying the caller about the path early, it avoids a race where ModemManager
-		 * would find the modem before the bluetooth code considers the profile fully activated. */
+         * to signal full activation longer (asynchronously). But the earliest time the callback
+         * is invoked with the rfcomm path, we just created the device synchronously.
+         *
+         * By already notifying the caller about the path early, it avoids a race where ModemManager
+         * would find the modem before the bluetooth code considers the profile fully activated. */
 
         nm_assert(!error);
         nm_assert(bzobj->x_device.c_req_data);
@@ -2489,7 +2489,7 @@ _connect_dun_step2_cb(NMBluez5DunContext *context,
 
         if (!context) {
             /* No context set. This means, we just got notified about the rfcomm path and need to wait
-			 * longer, for the next callback. */
+             * longer, for the next callback. */
             return;
         }
     }
@@ -2618,12 +2618,12 @@ _connect_disconnect(NMBluezManager *self, BzDBusObj *bzobj, const char *reason)
 
     if (bt_type == NM_BT_CAPABILITY_DUN) {
         /* For DUN devices, we also called org.bluez.Device1.Connect() (because in order
-		 * for nm_bluez5_dun_connect() to succeed, we need to be already connected *why??).
-		 *
-		 * But upon disconnect we don't call Disconnect() because we don't know whether somebody
-		 * else also uses the bluetooth device for other purposes. During disconnect we only
-		 * terminate the DUN connection, but don't disconnect entirely. I think that's the
-		 * best we can do. */
+         * for nm_bluez5_dun_connect() to succeed, we need to be already connected *why??).
+         *
+         * But upon disconnect we don't call Disconnect() because we don't know whether somebody
+         * else also uses the bluetooth device for other purposes. During disconnect we only
+         * terminate the DUN connection, but don't disconnect entirely. I think that's the
+         * best we can do. */
 #if WITH_BLUEZ5_DUN
         nm_clear_pointer(&bzobj->x_device.connect_dun_context, nm_bluez5_dun_disconnect);
 #else
@@ -2858,8 +2858,8 @@ dispose(GObject *object)
     NMBluezManagerPrivate *priv = NM_BLUEZ_MANAGER_GET_PRIVATE(self);
 
     /* FIXME(shutdown): we need a nm_device_factory_stop() hook to first unregister all
-	 *   BzDBusObj instances and do necessary cleanup actions (like disconnecting devices
-	 *   or deleting panu_connection). */
+     *   BzDBusObj instances and do necessary cleanup actions (like disconnecting devices
+     *   or deleting panu_connection). */
 
     nm_assert(c_list_is_empty(&priv->network_server_lst_head));
     nm_assert(c_list_is_empty(&priv->process_change_lst_head));
diff --git a/src/devices/bluetooth/nm-bluez5-dun.c b/src/devices/bluetooth/nm-bluez5-dun.c
index 4b90f9cd82..caa4f73616 100644
--- a/src/devices/bluetooth/nm-bluez5-dun.c
+++ b/src/devices/bluetooth/nm-bluez5-dun.c
@@ -229,11 +229,11 @@ _connect_create_rfcomm(NMBluez5DunContext *context)
         errsv = NM_ERRNO_NATIVE(errno);
         if (errsv == EBADFD) {
             /* hm. We use a non-blocking socket to connect. Above getsockopt(SOL_SOCKET,SO_ERROR) indicated
-			 * success, but still now we fail with EBADFD. I think that is a bug and we should get the
-			 * failure during connect().
-			 *
-			 * Anyway, craft a less confusing error message than
-			 * "failed to create rfcomm device: File descriptor in bad state (77)". */
+             * success, but still now we fail with EBADFD. I think that is a bug and we should get the
+             * failure during connect().
+             *
+             * Anyway, craft a less confusing error message than
+             * "failed to create rfcomm device: File descriptor in bad state (77)". */
             g_set_error(&error,
                         NM_BT_ERROR,
                         NM_BT_ERROR_DUN_CONNECT_FAILED,
@@ -256,12 +256,12 @@ _connect_create_rfcomm(NMBluez5DunContext *context)
     r = _connect_open_tty(context);
     if (r < 0) {
         /* we created the rfcomm device, but cannot yet open it. That means, we are
-		 * not yet fully connected. However, we notify the caller about "what we learned
-		 * so far". Note that this happens synchronously.
-		 *
-		 * The purpose is that once we proceed synchronously, modem-manager races with
-		 * the detection of the modem. We want to notify the caller first about the
-		 * device name. */
+         * not yet fully connected. However, we notify the caller about "what we learned
+         * so far". Note that this happens synchronously.
+         *
+         * The purpose is that once we proceed synchronously, modem-manager races with
+         * the detection of the modem. We want to notify the caller first about the
+         * device name. */
         context->cdat->callback(NULL,
                                 context->rfcomm_tty_path,
                                 NULL,
diff --git a/src/devices/bluetooth/nm-device-bt.c b/src/devices/bluetooth/nm-device-bt.c
index fac18d4c7b..e5949d5671 100644
--- a/src/devices/bluetooth/nm-device-bt.c
+++ b/src/devices/bluetooth/nm-device-bt.c
@@ -472,8 +472,8 @@ modem_auth_requested(NMModem *modem, gpointer user_data)
     NMDevice *device = NM_DEVICE(user_data);
 
     /* Auth requests (PIN, PAP/CHAP passwords, etc) only get handled
-	 * during activation.
-	 */
+     * during activation.
+     */
     if (!nm_device_is_activating(device))
         return;
 
@@ -514,9 +514,9 @@ modem_prepare_result(NMModem *modem, gboolean success, guint i_reason, gpointer
     if (!success) {
         if (nm_device_state_reason_check(reason) == NM_DEVICE_STATE_REASON_SIM_PIN_INCORRECT) {
             /* If the connect failed because the SIM PIN was wrong don't allow
-			 * the device to be auto-activated anymore, which would risk locking
-			 * the SIM if the incorrect PIN continues to be used.
-			 */
+             * the device to be auto-activated anymore, which would risk locking
+             * the SIM if the incorrect PIN continues to be used.
+             */
             nm_device_autoconnect_blocked_set(NM_DEVICE(self),
                                               NM_DEVICE_AUTOCONNECT_BLOCKED_WRONG_PIN);
         }
@@ -541,9 +541,9 @@ device_state_changed(NMDevice *          device,
         nm_modem_device_state_changed(priv->modem, new_state, old_state);
 
     /* Need to recheck available connections whenever MM appears or disappears,
-	 * since the device could be both DUN and NAP capable and thus may not
-	 * change state (which rechecks available connections) when MM comes and goes.
-	 */
+     * since the device could be both DUN and NAP capable and thus may not
+     * change state (which rechecks available connections) when MM comes and goes.
+     */
     if (priv->mm_running && NM_FLAGS_HAS(priv->capabilities, NM_BT_CAPABILITY_DUN))
         nm_device_recheck_available_connections(device);
 }
@@ -611,8 +611,8 @@ modem_state_cb(NMModem *modem, int new_state_i, int old_state_i, gpointer user_d
 
     if (new_state <= NM_MODEM_STATE_DISABLING && old_state > NM_MODEM_STATE_DISABLING) {
         /* Will be called whenever something external to NM disables the
-		 * modem directly through ModemManager.
-		 */
+         * modem directly through ModemManager.
+         */
         if (nm_device_is_activating(device) || dev_state == NM_DEVICE_STATE_ACTIVATED) {
             nm_device_state_changed(device,
                                     NM_DEVICE_STATE_DISCONNECTED,
@@ -624,7 +624,7 @@ modem_state_cb(NMModem *modem, int new_state_i, int old_state_i, gpointer user_d
     if (new_state < NM_MODEM_STATE_CONNECTING && old_state >= NM_MODEM_STATE_CONNECTING
         && dev_state >= NM_DEVICE_STATE_NEED_AUTH && dev_state <= NM_DEVICE_STATE_ACTIVATED) {
         /* Fail the device if the modem disconnects unexpectedly while the
-		 * device is activating/activated. */
+         * device is activating/activated. */
         nm_device_state_changed(device,
                                 NM_DEVICE_STATE_FAILED,
                                 NM_DEVICE_STATE_REASON_MODEM_NO_CARRIER);
@@ -673,8 +673,8 @@ modem_try_claim(NMDeviceBt *self, NMModem *modem)
         return FALSE;
 
     /* Can only accept the modem in stage1, but since the interface matched
-	 * what we were expecting, don't let anything else claim the modem either.
-	 */
+     * what we were expecting, don't let anything else claim the modem either.
+     */
     state = nm_device_get_state(NM_DEVICE(self));
     if (state != NM_DEVICE_STATE_PREPARE) {
         _LOGD(LOGD_BT | LOGD_MB,
@@ -779,8 +779,8 @@ connect_watch_link_cb(NMPlatform *    platform,
     NMDeviceBtPrivate *              priv;
 
     /* bluez doesn't notify us when the connection disconnects.
-	 * Neither does NMManager (or NMDevice) tell us when the ip-ifindex goes away.
-	 * This is horrible, and should be improved. For now, watch the link ourself... */
+     * Neither does NMManager (or NMDevice) tell us when the ip-ifindex goes away.
+     * This is horrible, and should be improved. For now, watch the link ourself... */
 
     if (NM_IN_SET(change_type, NM_PLATFORM_SIGNAL_CHANGED, NM_PLATFORM_SIGNAL_REMOVED)) {
         priv = NM_DEVICE_BT_GET_PRIVATE(self);
@@ -796,7 +796,7 @@ connect_wait_modem_timeout(gpointer user_data)
     NMDeviceBtPrivate *priv = NM_DEVICE_BT_GET_PRIVATE(self);
 
     /* since this timeout is longer than the connect timeout, we must have already
-	 * hit the connect-timeout first or being connected. */
+     * hit the connect-timeout first or being connected. */
     nm_assert(priv->stage1_bt_state == NM_DEVICE_STAGE_STATE_COMPLETED);
 
     priv->connect_wait_modem_id = 0;
@@ -892,7 +892,7 @@ connect_bz_cb(NMBluezManager *bz_mgr,
 
     if (!priv->is_connected) {
         /* we got the callback from NMBluezManager with success. We actually should be
-		 * connected and this line shouldn't be reached. */
+         * connected and this line shouldn't be reached. */
         nm_assert_not_reached();
         _LOGE(LOGD_BT, "bluetooth is unexpectedly not in connected state");
         nm_device_state_changed(NM_DEVICE(self),
@@ -1043,8 +1043,8 @@ deactivate(NMDevice *device)
             nm_modem_deactivate(priv->modem, device);
 
             /* Since we're killing the Modem object before it'll get the
-			 * state change signal, simulate the state change here.
-			 */
+             * state change signal, simulate the state change here.
+             */
             nm_modem_device_state_changed(priv->modem,
                                           NM_DEVICE_STATE_DISCONNECTED,
                                           NM_DEVICE_STATE_ACTIVATED);
diff --git a/src/devices/nm-acd-manager.c b/src/devices/nm-acd-manager.c
index 59042ad7f3..c4389131e1 100644
--- a/src/devices/nm-acd-manager.c
+++ b/src/devices/nm-acd-manager.c
@@ -132,8 +132,8 @@ acd_error_to_nmerr(int error, gboolean always_fail)
     }
 
     /* so, @error is either zero (indicating success) or one
-	 * of the special status codes like N_ACD_E_*. In both cases,
-	 * return the positive value here. */
+     * of the special status codes like N_ACD_E_*. In both cases,
+     * return the positive value here. */
     if (NM_IN_SET(error, _N_ACD_E_SUCCESS, N_ACD_E_PREEMPTED, N_ACD_E_INVALID_ARGUMENT))
         return error;
 
@@ -404,8 +404,8 @@ nm_acd_manager_announce_addresses(NMAcdManager *self)
 
     if (self->state == STATE_INIT) {
         /* n-acd can't announce without probing, therefore let's
-		 * start a fake probe with zero timeout and then perform
-		 * the announcement. */
+         * start a fake probe with zero timeout and then perform
+         * the announcement. */
         g_hash_table_iter_init(&iter, self->addresses);
         while (g_hash_table_iter_next(&iter, NULL, (gpointer *) &info)) {
             if (!acd_probe_add(self, info, 0))
diff --git a/src/devices/nm-device-6lowpan.c b/src/devices/nm-device-6lowpan.c
index db2c24a0cb..a71a2c9b0c 100644
--- a/src/devices/nm-device-6lowpan.c
+++ b/src/devices/nm-device-6lowpan.c
@@ -68,8 +68,8 @@ parent_changed_notify(NMDevice *device,
         ->parent_changed_notify(device, old_ifindex, old_parent, new_ifindex, new_parent);
 
     /*  note that @self doesn't have to clear @parent_state_id on dispose,
-	 *  because NMDevice's dispose() will unset the parent, which in turn calls
-	 *  parent_changed_notify(). */
+     *  because NMDevice's dispose() will unset the parent, which in turn calls
+     *  parent_changed_notify(). */
     nm_clear_g_signal_handler(old_parent, &priv->parent_state_id);
 
     if (new_parent) {
@@ -202,8 +202,8 @@ complete_connection(NMDevice *           device,
     }
 
     /* If there's no 6LoWPAN interface, no parent, and no hardware address in the
-	 * settings, then there's not enough information to complete the setting.
-	 */
+     * settings, then there's not enough information to complete the setting.
+     */
     if (!nm_setting_6lowpan_get_parent(s_6lowpan)
         && !nm_device_match_parent_hwaddr(device, connection, TRUE)) {
         g_set_error_literal(
diff --git a/src/devices/nm-device-bond.c b/src/devices/nm-device-bond.c
index b73a8f6fe9..7d95fbb939 100644
--- a/src/devices/nm-device-bond.c
+++ b/src/devices/nm-device-bond.c
@@ -135,10 +135,10 @@ ignore_option(NMSettingBond *s_bond, const char *option, const char *value)
 
     if (nm_streq0(option, NM_SETTING_BOND_OPTION_MIIMON)) {
         /* The default value for miimon, when missing in the setting, is
-		 * 0 if arp_interval is != 0, and 100 otherwise. So, let's ignore
-		 * miimon=0 (which means that miimon is disabled) and accept any
-		 * other value. Adding miimon=100 does not cause any harm.
-		 */
+         * 0 if arp_interval is != 0, and 100 otherwise. So, let's ignore
+         * miimon=0 (which means that miimon is disabled) and accept any
+         * other value. Adding miimon=100 does not cause any harm.
+         */
         defvalue = "0";
     } else
         defvalue = nm_setting_bond_get_option_default(s_bond, option);
@@ -336,8 +336,8 @@ apply_bonding_config(NMDeviceBond *self)
     g_return_val_if_fail(mode != NM_BOND_MODE_UNKNOWN, FALSE);
 
     /* Set mode first, as some other options (e.g. arp_interval) are valid
-	 * only for certain modes.
-	 */
+     * only for certain modes.
+     */
     set_bond_attr_or_default(device, s_bond, NM_SETTING_BOND_OPTION_MODE);
 
     set_bond_arp_ip_targets(device, s_bond);
@@ -415,8 +415,8 @@ release_slave(NMDevice *device, NMDevice *slave, gboolean configure)
 
     if (configure) {
         /* When the last slave is released the bond MAC will be set to a random
-		 * value by kernel; remember the current one and restore it afterwards.
-		 */
+         * value by kernel; remember the current one and restore it afterwards.
+         */
         address = g_strdup(nm_device_get_hw_address(device));
 
         if (ifindex_slave > 0) {
@@ -436,9 +436,9 @@ release_slave(NMDevice *device, NMDevice *slave, gboolean configure)
             nm_device_hw_addr_set(device, address, "restore", FALSE);
 
         /* Kernel bonding code "closes" the slave when releasing it, (which clears
-		 * IFF_UP), so we must bring it back up here to ensure carrier changes and
-		 * other state is noticed by the now-released slave.
-		 */
+         * IFF_UP), so we must bring it back up here to ensure carrier changes and
+         * other state is noticed by the now-released slave.
+         */
         if (ifindex_slave > 0) {
             if (!nm_device_bring_up(slave, TRUE, NULL))
                 _LOGW(LOGD_BOND, "released bond slave could not be brought up.");
@@ -545,7 +545,7 @@ reapply_connection(NMDevice *device, NMConnection *con_old, NMConnection *con_ne
     g_return_if_fail(mode != NM_BOND_MODE_UNKNOWN);
 
     /* Below we set only the bond options that kernel allows to modify
-	 * while keeping the bond interface up */
+     * while keeping the bond interface up */
 
     set_bond_arp_ip_targets(device, s_bond);
 
diff --git a/src/devices/nm-device-bridge.c b/src/devices/nm-device-bridge.c
index 6ee0cfd6c9..a00c009d38 100644
--- a/src/devices/nm-device-bridge.c
+++ b/src/devices/nm-device-bridge.c
@@ -112,8 +112,8 @@ check_connection_compatible(NMDevice *device, NMConnection *connection, GError *
         }
 
         /* a bluetooth NAP connection is handled by the bridge.
-		 *
-		 * Proceed... */
+         *
+         * Proceed... */
     } else {
         s_bridge =
             _nm_connection_check_main_setting(connection, NM_SETTING_BRIDGE_SETTING_NAME, error);
@@ -472,8 +472,8 @@ commit_option(NMDevice *device, NMSetting *setting, const Option *option, gboole
             uval = (guint) g_value_get_uint(&val);
 
         /* zero means "unspecified" for some NM properties but isn't in the
-			 * allowed kernel range, so reset the property to the default value.
-			 */
+             * allowed kernel range, so reset the property to the default value.
+             */
         if (option->default_if_zero && uval == 0) {
             if (pspec->value_type == G_TYPE_UINT64)
                 uval = NM_G_PARAM_SPEC_GET_DEFAULT_UINT64(pspec);
@@ -482,10 +482,10 @@ commit_option(NMDevice *device, NMSetting *setting, const Option *option, gboole
         }
 
         /* Linux kernel bridge interfaces use 'centiseconds' for time-based values.
-			 * In reality it's not centiseconds, but depends on HZ and USER_HZ, which
-			 * is almost always works out to be a multiplier of 100, so we can assume
-			 * centiseconds.  See clock_t_to_jiffies().
-			 */
+             * In reality it's not centiseconds, but depends on HZ and USER_HZ, which
+             * is almost always works out to be a multiplier of 100, so we can assume
+             * centiseconds.  See clock_t_to_jiffies().
+             */
         if (option->user_hz_compensate)
             uval *= 100;
 
@@ -762,7 +762,7 @@ bridge_set_vlan_options(NMDevice *device, NMSettingBridge *s_bridge)
     g_return_val_if_fail(length == ETH_ALEN, FALSE);
     if (nm_utils_hwaddr_matches(hwaddr, ETH_ALEN, nm_ip_addr_zero.addr_eth, ETH_ALEN)) {
         /* We need a non-zero MAC address to set the default pvid.
-		 * Retry later. */
+         * Retry later. */
         return TRUE;
     }
 
@@ -773,7 +773,7 @@ bridge_set_vlan_options(NMDevice *device, NMSettingBridge *s_bridge)
         return FALSE;
 
     /* Clear the default PVID so that we later can force the re-creation of
-	 * default PVID VLANs by writing the option again. */
+     * default PVID VLANs by writing the option again. */
     if (!nm_platform_sysctl_master_set_option(plat, ifindex, "default_pvid", "0"))
         return FALSE;
 
@@ -782,7 +782,7 @@ bridge_set_vlan_options(NMDevice *device, NMSettingBridge *s_bridge)
         return FALSE;
 
     /* Now set the default PVID. After this point the kernel creates
-	 * a PVID VLAN on each port, including the bridge itself. */
+     * a PVID VLAN on each port, including the bridge itself. */
     pvid = nm_setting_bridge_get_vlan_default_pvid(s_bridge);
     if (pvid) {
         char value[32];
@@ -793,7 +793,7 @@ bridge_set_vlan_options(NMDevice *device, NMSettingBridge *s_bridge)
     }
 
     /* Create VLANs only after setting the default PVID, so that
-	 * any PVID VLAN overrides the bridge's default PVID. */
+     * any PVID VLAN overrides the bridge's default PVID. */
     g_object_get(s_bridge, NM_SETTING_BRIDGE_VLANS, &vlans, NULL);
     plat_vlans = setting_vlans_to_platform(vlans);
     if (plat_vlans && !nm_platform_link_set_bridge_vlans(plat, ifindex, FALSE, plat_vlans))
@@ -964,7 +964,7 @@ enslave_slave(NMDevice *device, NMDevice *slave, NMConnection *connection, gbool
             plat_vlans = setting_vlans_to_platform(vlans);
 
             /* Since the link was just enslaved, there are no existing VLANs
-			 * (except for the default one) and so there's no need to flush. */
+             * (except for the default one) and so there's no need to flush. */
 
             if (plat_vlans
                 && !nm_platform_link_set_bridge_vlans(nm_device_get_platform(slave),
@@ -1044,10 +1044,10 @@ create_and_realize(NMDevice *             device,
     if (!hwaddr
         && nm_device_hw_addr_get_cloned(device, connection, FALSE, &hwaddr_cloned, NULL, NULL)) {
         /* FIXME: we set the MAC address when creating the interface, while the
-		 * NMDevice is still unrealized. As we afterwards realize the device, it
-		 * forgets the parameters for the cloned MAC address, and in stage 1
-		 * it might create a different MAC address. That should be fixed by
-		 * better handling device realization. */
+         * NMDevice is still unrealized. As we afterwards realize the device, it
+         * forgets the parameters for the cloned MAC address, and in stage 1
+         * it might create a different MAC address. That should be fixed by
+         * better handling device realization. */
         hwaddr = hwaddr_cloned;
     }
 
@@ -1212,8 +1212,8 @@ match_connection(NMDeviceFactory *factory, NMConnection *connection)
 
     if (!g_type_from_name("NMBluezManager")) {
         /* bluetooth NAP connections are handled by bridge factory. However,
-		 * it needs help from the bluetooth plugin, so if the plugin is not loaded,
-		 * we claim not to support it. */
+         * it needs help from the bluetooth plugin, so if the plugin is not loaded,
+         * we claim not to support it. */
         return FALSE;
     }
 
diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c
index bd7c020743..ce593f620f 100644
--- a/src/devices/nm-device-ethernet.c
+++ b/src/devices/nm-device-ethernet.c
@@ -155,10 +155,10 @@ _update_s390_subchannels(NMDeviceEthernet *self)
 
     if (priv->subchannels) {
         /* only read the subchannels once. For one, we don't expect them to change
-		 * on multiple invocations. Second, we didn't implement proper reloading.
-		 * Proper reloading might also be complicated, because the subchannels are
-		 * used to match on devices based on a device-spec. Thus, it's not clear
-		 * what it means to change afterwards. */
+         * on multiple invocations. Second, we didn't implement proper reloading.
+         * Proper reloading might also be complicated, because the subchannels are
+         * used to match on devices based on a device-spec. Thus, it's not clear
+         * what it means to change afterwards. */
         return;
     }
 
@@ -570,9 +570,9 @@ supplicant_lnk_timeout_cb(gpointer user_data)
     }
 
     /* Disconnect event during initial authentication and credentials
-	 * ARE checked - we are likely to have wrong key.  Ask the user for
-	 * another one.
-	 */
+     * ARE checked - we are likely to have wrong key.  Ask the user for
+     * another one.
+     */
     if (nm_device_get_state(device) != NM_DEVICE_STATE_CONFIG)
         goto time_out;
 
@@ -640,8 +640,8 @@ supplicant_iface_state_is_completed(NMDeviceEthernet *self, NMSupplicantInterfac
         nm_clear_g_source(&priv->supplicant.con_timeout_id);
 
         /* If this is the initial association during device activation,
-		 * schedule the next activation stage.
-		 */
+         * schedule the next activation stage.
+         */
         if (nm_device_get_state(NM_DEVICE(self)) == NM_DEVICE_STATE_CONFIG) {
             _LOGI(LOGD_DEVICE | LOGD_ETHER,
                   "Activation: (ethernet) Stage 2 of 5 (Device Configure) successful.");
@@ -764,9 +764,9 @@ handle_auth_or_fail(NMDeviceEthernet *self, NMActRequest *req, gboolean new_secr
     _LOGI(LOGD_DEVICE | LOGD_ETHER, "Activation: (ethernet) asking for new secrets");
 
     /* Don't tear down supplicant if the authentication is optional
-	 * because in case of a failure in getting new secrets we want to
-	 * keep the supplicant alive.
-	 */
+     * because in case of a failure in getting new secrets we want to
+     * keep the supplicant alive.
+     */
     if (!wired_auth_is_optional(self))
         supplicant_interface_release(self);
 
@@ -792,17 +792,17 @@ supplicant_connection_timeout_cb(gpointer user_data)
     priv->supplicant.con_timeout_id = 0;
 
     /* Authentication failed; either driver problems, the encryption key is
-	 * wrong, the passwords or certificates were wrong or the Ethernet switch's
-	 * port is not configured for 802.1x. */
+     * wrong, the passwords or certificates were wrong or the Ethernet switch's
+     * port is not configured for 802.1x. */
     _LOGW(LOGD_DEVICE | LOGD_ETHER, "Activation: (ethernet) association took too long.");
 
     req        = nm_device_get_act_request(device);
     connection = nm_act_request_get_settings_connection(req);
 
     /* Ask for new secrets only if we've never activated this connection
-	 * before.  If we've connected before, don't bother the user with dialogs,
-	 * just retry or fail, and if we never connect the user can fix the
-	 * password somewhere else. */
+     * before.  If we've connected before, don't bother the user with dialogs,
+     * just retry or fail, and if we never connect the user can fix the
+     * password somewhere else. */
     if (nm_settings_connection_get_timestamp(connection, &timestamp))
         new_secrets = !timestamp;
 
@@ -977,8 +977,8 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
             NMSettingWired *s_wired;
 
             /* During restart of NetworkManager service we forget the original auto
-			 * negotiation settings. When taking over a device, remember to reset
-			 * the "default" during deactivate. */
+             * negotiation settings. When taking over a device, remember to reset
+             * the "default" during deactivate. */
             s_wired = nm_device_get_applied_setting(device, NM_TYPE_SETTING_WIRED);
             if (s_wired
                 && (nm_setting_wired_get_auto_negotiate(s_wired)
@@ -996,14 +996,14 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
     link_negotiation_set(device);
 
     /* If we're re-activating a PPPoE connection a short while after
-	 * a previous PPPoE connection was torn down, wait a bit to allow the
-	 * remote side to handle the disconnection.  Otherwise, the peer may
-	 * get confused and fail to negotiate the new connection. (rh #1023503)
-	 *
-	 * FIXME(shutdown): when exiting, we also need to wait before quitting,
-	 * at least for additional NM_SHUTDOWN_TIMEOUT_MS seconds because
-	 * otherwise after restart the device won't work for the first seconds.
-	 */
+     * a previous PPPoE connection was torn down, wait a bit to allow the
+     * remote side to handle the disconnection.  Otherwise, the peer may
+     * get confused and fail to negotiate the new connection. (rh #1023503)
+     *
+     * FIXME(shutdown): when exiting, we also need to wait before quitting,
+     * at least for additional NM_SHUTDOWN_TIMEOUT_MS seconds because
+     * otherwise after restart the device won't work for the first seconds.
+     */
     if (priv->last_pppoe_time != 0) {
         gint32 delay = nm_utils_get_monotonic_timestamp_sec() - priv->last_pppoe_time;
 
@@ -1238,8 +1238,8 @@ dcb_configure(NMDevice *device)
     }
 
     /* Pause again just in case the device takes the carrier down when
-	 * setting specific DCB attributes.
-	 */
+     * setting specific DCB attributes.
+     */
     _LOGD(LOGD_DCB, "waiting for carrier (postconfig down)");
     priv->dcb_wait       = DCB_WAIT_CARRIER_POSTCONFIG_DOWN;
     priv->dcb_timeout_id = g_timeout_add_seconds(3, dcb_carrier_timeout, device);
@@ -1261,12 +1261,12 @@ dcb_enable(NMDevice *device)
     }
 
     /* Pause for 3 seconds after enabling DCB to let the card reconfigure
-	 * itself.  Drivers will often re-initialize internal settings which
-	 * takes the carrier down for 2 or more seconds.  During this time,
-	 * lldpad will refuse to do anything else with the card since the carrier
-	 * is down.  But NM might get the carrier-down signal long after calling
-	 * "dcbtool dcb on", so we have to first wait for the carrier to go down.
-	 */
+     * itself.  Drivers will often re-initialize internal settings which
+     * takes the carrier down for 2 or more seconds.  During this time,
+     * lldpad will refuse to do anything else with the card since the carrier
+     * is down.  But NM might get the carrier-down signal long after calling
+     * "dcbtool dcb on", so we have to first wait for the carrier to go down.
+     */
     _LOGD(LOGD_DCB, "waiting for carrier (preconfig down)");
     priv->dcb_wait       = DCB_WAIT_CARRIER_PRECONFIG_DOWN;
     priv->dcb_timeout_id = g_timeout_add_seconds(3, dcb_carrier_timeout, device);
@@ -1409,8 +1409,8 @@ act_stage2_config(NMDevice *device, NMDeviceStateReason *out_failure_reason)
     priv->dcb_handle_carrier_changes = FALSE;
 
     /* 802.1x has to run before any IP configuration since the 802.1x auth
-	 * process opens the port up for normal traffic.
-	 */
+     * process opens the port up for normal traffic.
+     */
     connection_type = nm_setting_connection_get_connection_type(s_con);
     if (nm_streq(connection_type, NM_SETTING_WIRED_SETTING_NAME)) {
         NMSetting8021x *security;
@@ -1585,8 +1585,8 @@ complete_connection(NMDevice *           device,
     s_pppoe = nm_connection_get_setting_pppoe(connection);
 
     /* We can't telepathically figure out the service name or username, so if
-	 * those weren't given, we can't complete the connection.
-	 */
+     * those weren't given, we can't complete the connection.
+     */
     if (s_pppoe && !nm_setting_verify(NM_SETTING(s_pppoe), NULL, error))
         return FALSE;
 
@@ -1597,8 +1597,8 @@ complete_connection(NMDevice *           device,
     }
 
     /* Default to an ethernet-only connection, but if a PPPoE setting was given
-	 * then PPPoE should be our connection type.
-	 */
+     * then PPPoE should be our connection type.
+     */
     nm_utils_complete_generic(
         nm_device_get_platform(device),
         connection,
@@ -1646,7 +1646,7 @@ new_default_connection(NMDevice *self)
         return NULL;
 
     /* Create a stable UUID. The UUID is also the Network_ID for stable-privacy addr-gen-mode,
-	 * thus when it changes we will also generate different IPv6 addresses. */
+     * thus when it changes we will also generate different IPv6 addresses. */
     uuid = _nm_utils_uuid_generate_from_strings("default-wired",
                                                 nm_utils_machine_id_str(),
                                                 defname,
@@ -1729,8 +1729,8 @@ update_connection(NMDevice *device, NMConnection *connection)
                  NULL);
 
     /* If the device reports a permanent address, use that for the MAC address
-	 * and the current MAC, if different, is the cloned MAC.
-	 */
+     * and the current MAC, if different, is the cloned MAC.
+     */
     perm_hw_addr = nm_device_get_permanent_hw_address_full(device, TRUE, &perm_hw_addr_is_fake);
     if (perm_hw_addr && !perm_hw_addr_is_fake) {
         g_object_set(s_wired, NM_SETTING_WIRED_MAC_ADDRESS, perm_hw_addr, NULL);
diff --git a/src/devices/nm-device-factory.c b/src/devices/nm-device-factory.c
index 2a2da7a506..7649bc0355 100644
--- a/src/devices/nm-device-factory.c
+++ b/src/devices/nm-device-factory.c
@@ -349,7 +349,7 @@ load_factories_from_dir(const char *                      dirname,
         }
 
         /* after loading glib types from the plugin, we cannot unload the library anymore.
-		 * Make it resident. */
+         * Make it resident. */
         g_module_make_resident(plugin);
 
         factory = create_func(&error);
diff --git a/src/devices/nm-device-factory.h b/src/devices/nm-device-factory.h
index 6780ec9fec..4125d3f4cc 100644
--- a/src/devices/nm-device-factory.h
+++ b/src/devices/nm-device-factory.h
@@ -35,83 +35,83 @@ typedef struct {
     GObjectClass parent;
 
     /**
-	 * get_supported_types:
-	 * @factory: the #NMDeviceFactory
-	 * @out_link_types: on return, a %NM_LINK_TYPE_NONE terminated
-	 *  list of #NMLinkType that the plugin supports
-	 * @out_setting_types: on return, a %NULL terminated list of
-	 *  base-type #NMSetting names that the plugin can create devices for
-	 *
-	 * Returns the #NMLinkType and #NMSetting names that this plugin
-	 * supports.  This function MUST be implemented.
-	 */
+     * get_supported_types:
+     * @factory: the #NMDeviceFactory
+     * @out_link_types: on return, a %NM_LINK_TYPE_NONE terminated
+     *  list of #NMLinkType that the plugin supports
+     * @out_setting_types: on return, a %NULL terminated list of
+     *  base-type #NMSetting names that the plugin can create devices for
+     *
+     * Returns the #NMLinkType and #NMSetting names that this plugin
+     * supports.  This function MUST be implemented.
+     */
     void (*get_supported_types)(NMDeviceFactory *   factory,
                                 const NMLinkType ** out_link_types,
                                 const char *const **out_setting_types);
 
     /**
-	 * start:
-	 * @factory: the #NMDeviceFactory
-	 *
-	 * Start the factory and discover any existing devices that the factory
-	 * can manage.
-	 */
+     * start:
+     * @factory: the #NMDeviceFactory
+     *
+     * Start the factory and discover any existing devices that the factory
+     * can manage.
+     */
     void (*start)(NMDeviceFactory *factory);
 
     /**
-	 * match_connection:
-	 * @connection: the #NMConnection
-	 *
-	 * Check if the factory supports the given connection.
-	 */
+     * match_connection:
+     * @connection: the #NMConnection
+     *
+     * Check if the factory supports the given connection.
+     */
     gboolean (*match_connection)(NMDeviceFactory *factory, NMConnection *connection);
 
     /**
-	 * get_connection_parent:
-	 * @factory: the #NMDeviceFactory
-	 * @connection: the #NMConnection to return the parent name for, if supported
-	 *
-	 * Given a connection, returns the parent interface name, parent connection
-	 * UUID, or parent device permanent hardware address for @connection.
-	 *
-	 * Returns: the parent interface name, parent connection UUID, parent
-	 *   device permanent hardware address, or %NULL
-	 */
+     * get_connection_parent:
+     * @factory: the #NMDeviceFactory
+     * @connection: the #NMConnection to return the parent name for, if supported
+     *
+     * Given a connection, returns the parent interface name, parent connection
+     * UUID, or parent device permanent hardware address for @connection.
+     *
+     * Returns: the parent interface name, parent connection UUID, parent
+     *   device permanent hardware address, or %NULL
+     */
     const char *(*get_connection_parent)(NMDeviceFactory *factory, NMConnection *connection);
 
     /**
-	 * get_connection_iface:
-	 * @factory: the #NMDeviceFactory
-	 * @connection: the #NMConnection to return the interface name for
-	 * @parent_iface: optional parent interface name for virtual devices
-	 *
-	 * Given a connection, returns the interface name that a device activating
-	 * that connection would have.
-	 *
-	 * Returns: the interface name, or %NULL
-	 */
+     * get_connection_iface:
+     * @factory: the #NMDeviceFactory
+     * @connection: the #NMConnection to return the interface name for
+     * @parent_iface: optional parent interface name for virtual devices
+     *
+     * Given a connection, returns the interface name that a device activating
+     * that connection would have.
+     *
+     * Returns: the interface name, or %NULL
+     */
     char *(*get_connection_iface)(NMDeviceFactory *factory,
                                   NMConnection *   connection,
                                   const char *     parent_iface);
 
     /**
-	 * create_device:
-	 * @factory: the #NMDeviceFactory
-	 * @iface: the interface name of the device
-	 * @plink: the #NMPlatformLink if backed by a kernel device
-	 * @connection: the #NMConnection if not backed by a kernel device
-	 * @out_ignore: on return, %TRUE if the link should be ignored
-	 *
-	 * The plugin should create a new unrealized device using the details given
-	 * by @iface and @plink or @connection.  If both @iface and @plink are given,
-	 * they are guaranteed to match.  If both @iface and @connection are given,
-	 * @iface is guaranteed to be the interface name that @connection specifies.
-	 *
-	 * If the plugin cannot create a #NMDevice for the link and wants the
-	 * core to ignore it, set @out_ignore to %TRUE and return %NULL.
-	 *
-	 * Returns: the new unrealized #NMDevice, or %NULL
-	 */
+     * create_device:
+     * @factory: the #NMDeviceFactory
+     * @iface: the interface name of the device
+     * @plink: the #NMPlatformLink if backed by a kernel device
+     * @connection: the #NMConnection if not backed by a kernel device
+     * @out_ignore: on return, %TRUE if the link should be ignored
+     *
+     * The plugin should create a new unrealized device using the details given
+     * by @iface and @plink or @connection.  If both @iface and @plink are given,
+     * they are guaranteed to match.  If both @iface and @connection are given,
+     * @iface is guaranteed to be the interface name that @connection specifies.
+     *
+     * If the plugin cannot create a #NMDevice for the link and wants the
+     * core to ignore it, set @out_ignore to %TRUE and return %NULL.
+     *
+     * Returns: the new unrealized #NMDevice, or %NULL
+     */
     NMDevice *(*create_device)(NMDeviceFactory *     factory,
                                const char *          iface,
                                const NMPlatformLink *plink,
diff --git a/src/devices/nm-device-ip-tunnel.c b/src/devices/nm-device-ip-tunnel.c
index 629c6fba49..071375a347 100644
--- a/src/devices/nm-device-ip-tunnel.c
+++ b/src/devices/nm-device-ip-tunnel.c
@@ -82,8 +82,8 @@ ip6tnl_flags_setting_to_plat(NMIPTunnelFlags flags)
     G_STATIC_ASSERT(NM_IP_TUNNEL_FLAG_IP6_USE_ORIG_FWMARK == IP6_TNL_F_USE_ORIG_FWMARK);
 
     /* NOTE: "accidentally", the numeric values correspond.
-	 *       For flags added in the future, that might no longer
-	 *       be the case. */
+     *       For flags added in the future, that might no longer
+     *       be the case. */
     return flags & _NM_IP_TUNNEL_FLAG_ALL_IP6TNL;
 }
 
@@ -673,10 +673,10 @@ create_and_realize(NMDevice *             device,
     if (_nm_ip_tunnel_mode_is_layer2(mode)
         && nm_device_hw_addr_get_cloned(device, connection, FALSE, &hwaddr, NULL, NULL) && hwaddr) {
         /* FIXME: we set the MAC address when creating the interface, while the
-		 * NMDevice is still unrealized. As we afterwards realize the device, it
-		 * forgets the parameters for the cloned MAC address, and in stage 1
-		 * it might create a different MAC address. That should be fixed by
-		 * better handling device realization. */
+         * NMDevice is still unrealized. As we afterwards realize the device, it
+         * forgets the parameters for the cloned MAC address, and in stage 1
+         * it might create a different MAC address. That should be fixed by
+         * better handling device realization. */
         if (!nm_utils_hwaddr_aton(hwaddr, mac_address, ETH_ALEN)) {
             g_set_error(error,
                         NM_DEVICE_ERROR,
diff --git a/src/devices/nm-device-macsec.c b/src/devices/nm-device-macsec.c
index cb09c8219d..05fc599099 100644
--- a/src/devices/nm-device-macsec.c
+++ b/src/devices/nm-device-macsec.c
@@ -112,8 +112,8 @@ static void
 parent_mtu_maybe_changed(NMDevice *parent, GParamSpec *pspec, gpointer user_data)
 {
     /* the MTU of a MACsec device is limited by the parent's MTU.
-	 *
-	 * When the parent's MTU changes, try to re-set the MTU. */
+     *
+     * When the parent's MTU changes, try to re-set the MTU. */
     nm_device_commit_mtu(user_data);
 }
 
@@ -131,8 +131,8 @@ parent_changed_notify(NMDevice *device,
         ->parent_changed_notify(device, old_ifindex, old_parent, new_ifindex, new_parent);
 
     /*  note that @self doesn't have to clear @parent_state_id on dispose,
-	 *  because NMDevice's dispose() will unset the parent, which in turn calls
-	 *  parent_changed_notify(). */
+     *  because NMDevice's dispose() will unset the parent, which in turn calls
+     *  parent_changed_notify(). */
     nm_clear_g_signal_handler(old_parent, &priv->parent_state_id);
     nm_clear_g_signal_handler(old_parent, &priv->parent_mtu_id);
 
@@ -358,9 +358,9 @@ supplicant_lnk_timeout_cb(gpointer user_data)
     }
 
     /* Disconnect event during initial authentication and credentials
-	 * ARE checked - we are likely to have wrong key.  Ask the user for
-	 * another one.
-	 */
+     * ARE checked - we are likely to have wrong key.  Ask the user for
+     * another one.
+     */
     if (nm_device_get_state(dev) != NM_DEVICE_STATE_CONFIG)
         goto time_out;
 
@@ -403,8 +403,8 @@ supplicant_iface_state_is_completed(NMDeviceMacsec *self, NMSupplicantInterfaceS
         nm_device_bring_up(NM_DEVICE(self), TRUE, NULL);
 
         /* If this is the initial association during device activation,
-		 * schedule the next activation stage.
-		 */
+         * schedule the next activation stage.
+         */
         if (nm_device_get_state(NM_DEVICE(self)) == NM_DEVICE_STATE_CONFIG) {
             _LOGI(LOGD_DEVICE, "Activation: Stage 2 of 5 (Device Configure) successful.");
             nm_device_activate_schedule_stage3_ip_config_start(NM_DEVICE(self));
@@ -545,8 +545,8 @@ supplicant_connection_timeout_cb(gpointer user_data)
     priv->supplicant.con_timeout_id = 0;
 
     /* Authentication failed; either driver problems, the encryption key is
-	 * wrong, the passwords or certificates were wrong or the Ethernet switch's
-	 * port is not configured for 802.1x. */
+     * wrong, the passwords or certificates were wrong or the Ethernet switch's
+     * port is not configured for 802.1x. */
     _LOGW(LOGD_DEVICE, "Activation: (macsec) association took too long.");
 
     supplicant_interface_release(self);
@@ -556,9 +556,9 @@ supplicant_connection_timeout_cb(gpointer user_data)
     g_return_val_if_fail(connection, G_SOURCE_REMOVE);
 
     /* Ask for new secrets only if we've never activated this connection
-	 * before.  If we've connected before, don't bother the user with dialogs,
-	 * just retry or fail, and if we never connect the user can fix the
-	 * password somewhere else. */
+     * before.  If we've connected before, don't bother the user with dialogs,
+     * just retry or fail, and if we never connect the user can fix the
+     * password somewhere else. */
     if (nm_settings_connection_get_timestamp(connection, &timestamp))
         new_secrets = !timestamp;
 
diff --git a/src/devices/nm-device-macvlan.c b/src/devices/nm-device-macvlan.c
index 2bbbc28376..834278fbfc 100644
--- a/src/devices/nm-device-macvlan.c
+++ b/src/devices/nm-device-macvlan.c
@@ -125,8 +125,8 @@ static void
 parent_mtu_maybe_changed(NMDevice *parent, GParamSpec *pspec, gpointer user_data)
 {
     /* the MTU of a macvlan/macvtap device is limited by the parent's MTU.
-	 *
-	 * When the parent's MTU changes, try to re-set the MTU. */
+     *
+     * When the parent's MTU changes, try to re-set the MTU. */
     nm_device_commit_mtu(user_data);
 }
 
@@ -144,8 +144,8 @@ parent_changed_notify(NMDevice *device,
         ->parent_changed_notify(device, old_ifindex, old_parent, new_ifindex, new_parent);
 
     /*  note that @self doesn't have to clear @parent_state_id on dispose,
-	 *  because NMDevice's dispose() will unset the parent, which in turn calls
-	 *  parent_changed_notify(). */
+     *  because NMDevice's dispose() will unset the parent, which in turn calls
+     *  parent_changed_notify(). */
     nm_clear_g_signal_handler(old_parent, &priv->parent_state_id);
     nm_clear_g_signal_handler(old_parent, &priv->parent_mtu_id);
 
@@ -401,8 +401,8 @@ complete_connection(NMDevice *           device,
     }
 
     /* If there's no MACVLAN interface, no parent, and no hardware address in the
-	 * settings, then there's not enough information to complete the setting.
-	 */
+     * settings, then there's not enough information to complete the setting.
+     */
     if (!nm_setting_macvlan_get_parent(s_macvlan)
         && !nm_device_match_parent_hwaddr(device, connection, TRUE)) {
         g_set_error_literal(
diff --git a/src/devices/nm-device-tun.c b/src/devices/nm-device-tun.c
index 25b013db34..70f8cbfec1 100644
--- a/src/devices/nm-device-tun.c
+++ b/src/devices/nm-device-tun.c
@@ -169,9 +169,9 @@ update_connection(NMDevice *device, NMConnection *connection)
     const char *        str;
 
     /* Note: since we read tun properties from sysctl for older kernels,
-	 *       we don't get proper change notifications. Make sure that all our
-	 *       tun properties are up to date at this point. We should not do this,
-	 *       if we would entirely rely on netlink events. */
+     *       we don't get proper change notifications. Make sure that all our
+     *       tun properties are up to date at this point. We should not do this,
+     *       if we would entirely rely on netlink events. */
     update_properties(NM_DEVICE_TUN(device));
 
     switch (priv->props.type) {
diff --git a/src/devices/nm-device-veth.c b/src/devices/nm-device-veth.c
index 1af3f0062e..de0668646a 100644
--- a/src/devices/nm-device-veth.c
+++ b/src/devices/nm-device-veth.c
@@ -58,9 +58,9 @@ static gboolean
 can_unmanaged_external_down(NMDevice *self)
 {
     /* Unless running in a container, an udev rule causes these to be
-	 * unmanaged. If there's no udev then we're probably in a container
-	 * and should IFF_UP and configure the veth ourselves even if we
-	 * didn't create it. */
+     * unmanaged. If there's no udev then we're probably in a container
+     * and should IFF_UP and configure the veth ourselves even if we
+     * didn't create it. */
     return FALSE;
 }
 
diff --git a/src/devices/nm-device-vlan.c b/src/devices/nm-device-vlan.c
index c04826472b..a17e706ed9 100644
--- a/src/devices/nm-device-vlan.c
+++ b/src/devices/nm-device-vlan.c
@@ -75,8 +75,8 @@ static void
 parent_mtu_maybe_changed(NMDevice *parent, GParamSpec *pspec, gpointer user_data)
 {
     /* the MTU of a VLAN device is limited by the parent's MTU.
-	 *
-	 * When the parent's MTU changes, try to re-set the MTU. */
+     *
+     * When the parent's MTU changes, try to re-set the MTU. */
     nm_device_commit_mtu(user_data);
 }
 
@@ -113,8 +113,8 @@ parent_hwaddr_maybe_changed(NMDevice *parent, GParamSpec *pspec, gpointer user_d
         nm_device_hw_addr_set(device, new_mac, "vlan-parent", TRUE);
         nm_device_arp_announce(device);
         /* When changing the hw address the interface is taken down,
-		 * removing the IPv6 configuration; reapply it.
-		 */
+         * removing the IPv6 configuration; reapply it.
+         */
         s_ip6 = nm_connection_get_setting_ip6_config(connection);
         if (s_ip6)
             nm_device_reactivate_ip6_config(device, s_ip6, s_ip6);
@@ -135,8 +135,8 @@ parent_changed_notify(NMDevice *device,
         ->parent_changed_notify(device, old_ifindex, old_parent, new_ifindex, new_parent);
 
     /*  note that @self doesn't have to clear @parent_state_id on dispose,
-	 *  because NMDevice's dispose() will unset the parent, which in turn calls
-	 *  parent_changed_notify(). */
+     *  because NMDevice's dispose() will unset the parent, which in turn calls
+     *  parent_changed_notify(). */
     nm_clear_g_signal_handler(old_parent, &priv->parent_state_id);
     nm_clear_g_signal_handler(old_parent, &priv->parent_hwaddr_id);
     nm_clear_g_signal_handler(old_parent, &priv->parent_mtu_id);
@@ -412,8 +412,8 @@ complete_connection(NMDevice *           device,
     }
 
     /* If there's no VLAN interface, no parent, and no hardware address in the
-	 * settings, then there's not enough information to complete the setting.
-	 */
+     * settings, then there's not enough information to complete the setting.
+     */
     if (!nm_setting_vlan_get_parent(s_vlan)
         && !nm_device_match_parent_hwaddr(device, connection, TRUE)) {
         g_set_error_literal(
@@ -671,9 +671,9 @@ get_connection_iface(NMDeviceFactory *factory, NMConnection *connection, const c
         return g_strdup(ifname);
 
     /* If the connection doesn't specify the interface name for the VLAN
-	 * device, we create one for it using the VLAN ID and the parent
-	 * interface's name.
-	 */
+     * device, we create one for it using the VLAN ID and the parent
+     * interface's name.
+     */
     return nm_utils_new_vlan_name(parent_iface, nm_setting_vlan_get_id(s_vlan));
 }
 
diff --git a/src/devices/nm-device-wireguard.c b/src/devices/nm-device-wireguard.c
index 1da6a6f2e8..31016ac762 100644
--- a/src/devices/nm-device-wireguard.c
+++ b/src/devices/nm-device-wireguard.c
@@ -81,14 +81,14 @@ typedef struct {
     NMSockAddrUnion sockaddr;
 
     /* the timestamp (in nm_utils_get_monotonic_timestamp_nsec() scale) when we want
-	 * to retry resolving the endpoint (again).
-	 *
-	 * It may be set to %NEXT_TRY_AT_NSEC_ASAP to indicate to re-resolve as soon as possible.
-	 *
-	 * A @sockaddr is either fixed or it has
-	 *   - @cancellable set to indicate an ongoing request
-	 *   - @next_try_at_nsec set to a positive value, indicating when
-	 *     we ought to retry. */
+     * to retry resolving the endpoint (again).
+     *
+     * It may be set to %NEXT_TRY_AT_NSEC_ASAP to indicate to re-resolve as soon as possible.
+     *
+     * A @sockaddr is either fixed or it has
+     *   - @cancellable set to indicate an ongoing request
+     *   - @next_try_at_nsec set to a positive value, indicating when
+     *     we ought to retry. */
     gint64 next_try_at_nsec;
 
     guint resolv_fail_count;
@@ -249,14 +249,14 @@ _auto_default_route_get_auto_fwmark(const char *uuid)
     guint64 rnd_seed;
 
     /* we use the generated number as fwmark but also as routing table for
-	 * the default-route.
-	 *
-	 * We pick a number
-	 *
-	 * - based on the connection's UUID (as stable seed).
-	 * - larger than 51820u (arbitrarily)
-	 * - one out of AUTO_RANDOM_RANGE
-	 */
+     * the default-route.
+     *
+     * We pick a number
+     *
+     * - based on the connection's UUID (as stable seed).
+     * - larger than 51820u (arbitrarily)
+     * - one out of AUTO_RANDOM_RANGE
+     */
 
     rnd_seed = c_siphash_hash(NM_HASH_SEED_16(0xb9,
                                               0x39,
@@ -289,12 +289,12 @@ _auto_default_route_get_auto_priority(const char *uuid)
     guint64       rnd_seed;
 
     /* we pick a priority for the routing rules as follows:
-	 *
-	 * - use the connection's UUID as stable seed for the "random" number.
-	 * - have it smaller than RANGE_TOP (32766u - 1000u), where 32766u is the priority of the default
-	 *   rules
-	 * - we add 2 rules (PRIO_WIDTH). Hence only pick even priorities.
-	 * - pick one out of AUTO_RANDOM_RANGE. */
+     *
+     * - use the connection's UUID as stable seed for the "random" number.
+     * - have it smaller than RANGE_TOP (32766u - 1000u), where 32766u is the priority of the default
+     *   rules
+     * - we add 2 rules (PRIO_WIDTH). Hence only pick even priorities.
+     * - pick one out of AUTO_RANDOM_RANGE. */
 
     rnd_seed = c_siphash_hash(NM_HASH_SEED_16(0x99,
                                               0x22,
@@ -573,9 +573,9 @@ _peers_resolve_retry_timeout(gpointer user_data)
 
         if (peer_data->ep_resolv.cancellable) {
             /* we are currently resolving a name. We don't need the global
-			 * watchdog to guard this peer. No need to adjust @next for
-			 * this one, when the currently ongoing resolving completes, we
-			 * may reschedule. Skip. */
+             * watchdog to guard this peer. No need to adjust @next for
+             * this one, when the currently ongoing resolving completes, we
+             * may reschedule. Skip. */
             continue;
         }
 
@@ -583,7 +583,7 @@ _peers_resolve_retry_timeout(gpointer user_data)
             || now >= peer_data->ep_resolv.next_try_at_nsec) {
             _peers_resolve_start(self, peer_data);
             /* same here. Now we are resolving. We don't need the global
-			 * watchdog. Skip w.r.t. finding @next. */
+             * watchdog. Skip w.r.t. finding @next. */
             continue;
         }
 
@@ -608,16 +608,16 @@ _peers_resolve_retry_reschedule(NMDeviceWireGuard *self, gint64 new_next_try_at_
 
     if (priv->resolve_next_try_id && priv->resolve_next_try_at <= new_next_try_at_nsec) {
         /* we already have an earlier timeout scheduled (possibly for
-		 * another peer that expires sooner). Don't reschedule now.
-		 * Even if the scheduled timeout expires too early, we will
-		 * compute the right next-timeout and reschedule then. */
+         * another peer that expires sooner). Don't reschedule now.
+         * Even if the scheduled timeout expires too early, we will
+         * compute the right next-timeout and reschedule then. */
         return;
     }
 
     now = nm_utils_get_monotonic_timestamp_nsec();
 
     /* schedule at most one day ahead. No problem if we expire earlier
-	 * than expected. Also, rate-limit to 500 msec. */
+     * than expected. Also, rate-limit to 500 msec. */
     interval_ms = NM_CLAMP((new_next_try_at_nsec - now) / NM_UTILS_NSEC_PER_MSEC,
                            (gint64) 500,
                            (gint64)(24 * 60 * 60 * 1000));
@@ -761,11 +761,11 @@ _peers_resolve_cb(GObject *source_object, GAsyncResult *res, gpointer user_data)
 
     if (sockaddr.sa.sa_family == AF_UNSPEC) {
         /* we failed to resolve the name. There is no need to reset the previous
-		 * sockaddr. Either it was already AF_UNSPEC, or we had a good name
-		 * from resolving before. In that case, we don't want to throw away
-		 * a possibly good IP address, since WireGuard supports automatic roaming
-		 * anyway. Either the IP address is still good (and we would wrongly
-		 * reject it), or it isn't -- in which case it does not hurt much. */
+         * sockaddr. Either it was already AF_UNSPEC, or we had a good name
+         * from resolving before. In that case, we don't want to throw away
+         * a possibly good IP address, since WireGuard supports automatic roaming
+         * anyway. Either the IP address is still good (and we would wrongly
+         * reject it), or it isn't -- in which case it does not hurt much. */
     } else {
         if (nm_sock_addr_union_cmp(&peer_data->ep_resolv.sockaddr, &sockaddr) != 0)
             changed = TRUE;
@@ -774,7 +774,7 @@ _peers_resolve_cb(GObject *source_object, GAsyncResult *res, gpointer user_data)
 
     if (resolv_error || peer_data->ep_resolv.sockaddr.sa.sa_family == AF_UNSPEC) {
         /* while it technically did not fail, something is probably odd. Retry frequently to
-		 * resolve the name, like we would do for normal failures. */
+         * resolve the name, like we would do for normal failures. */
         retry_in_msec = _peers_retry_in_msec(peer_data, TRUE);
         _LOGT(LOGD_DEVICE,
               "wireguard-peer[%s]: no %sresults for endpoint \"%s\" (retry %s)",
@@ -800,7 +800,7 @@ _peers_resolve_cb(GObject *source_object, GAsyncResult *res, gpointer user_data)
         NMDeviceWireGuardPrivate *priv = NM_DEVICE_WIREGUARD_GET_PRIVATE(self);
 
         /* schedule the job in the background, to give multiple resolve events time
-		 * to complete. */
+         * to complete. */
         nm_clear_g_source(&priv->link_config_delayed_id);
         priv->link_config_delayed_id = g_idle_add_full(G_PRIORITY_DEFAULT_IDLE + 1,
                                                        link_config_delayed_resolver_cb,
@@ -822,10 +822,10 @@ _peers_resolve_start(NMDeviceWireGuard *self, PeerData *peer_data)
     peer_data->ep_resolv.cancellable = g_cancellable_new();
 
     /* set a special next-try timestamp. It is positive, and indicates
-	 * that we are in the process of trying.
-	 * This timestamp however already lies in the past, but that is correct,
-	 * because we are currently in the process of trying. We will determine
-	 * a next-try timestamp once the try completes. */
+     * that we are in the process of trying.
+     * This timestamp however already lies in the past, but that is correct,
+     * because we are currently in the process of trying. We will determine
+     * a next-try timestamp once the try completes. */
     peer_data->ep_resolv.next_try_at_nsec = NEXT_TRY_AT_NSEC_PAST;
 
     host = nm_sock_addr_endpoint_get_host(_nm_wireguard_peer_get_endpoint(peer_data->peer));
@@ -907,7 +907,7 @@ _peers_update(NMDeviceWireGuard *self,
     if (endpoint && nm_sock_addr_endpoint_get_host(endpoint)) {
         if (!nm_sock_addr_endpoint_get_fixed_sockaddr(endpoint, &sockaddr)) {
             /* we have an endpoint, but it's not a static IP address. We need to resolve
-			 * the names. */
+             * the names. */
             sockaddr_fixed = FALSE;
         }
     }
@@ -1044,8 +1044,8 @@ _peers_get_platform_list(NMDeviceWireGuardPrivate *           priv,
             *plf |= NM_PLATFORM_WIREGUARD_CHANGE_PEER_FLAG_HAS_KEEPALIVE_INTERVAL;
 
         /* if the peer has an endpoint but it is not yet resolved (not ready),
-		 * we still configure it and leave the endpoint unspecified. Later,
-		 * when we can resolve the endpoint, we will update. */
+         * we still configure it and leave the endpoint unspecified. Later,
+         * when we can resolve the endpoint, we will update. */
         plp->endpoint = peer_data->ep_resolv.sockaddr;
         if (plp->endpoint.sa.sa_family == AF_UNSPEC) {
             /* we don't actually ever clear endpoints, if we don't have better information. */
@@ -1089,7 +1089,7 @@ _peers_get_platform_list(NMDeviceWireGuardPrivate *           priv,
                                                          &addrbin,
                                                          &prefix)) {
                     /* the address is really not expected to be invalid, because then
-					 * the connection would not verify. Anyway, silently skip it. */
+                     * the connection would not verify. Anyway, silently skip it. */
                     continue;
                 }
 
@@ -1338,9 +1338,9 @@ static void
 _dns_config_changed(NMDnsManager *dns_manager, NMDeviceWireGuard *self)
 {
     /* when the DNS configuration changes, we re-resolve the peer addresses.
-	 *
-	 * Possibly, we should also do that when the default-route changes, but it's
-	 * hard to figure out when that happens. */
+     *
+     * Possibly, we should also do that when the default-route changes, but it's
+     * hard to figure out when that happens. */
     _peers_resolve_reresolve_all(self);
 }
 
@@ -1483,7 +1483,7 @@ link_config_delayed(NMDeviceWireGuard *self, const char *reason)
         now = nm_utils_get_monotonic_timestamp_nsec();
         if (now < priv->link_config_last_at + LINK_CONFIG_RATE_LIMIT_NSEC) {
             /* we ratelimit calls to link_config(), because we call this whenever a resolver
-			 * completes. */
+             * completes. */
             _LOGT(LOGD_DEVICE, "wireguard link config (%s) (postponed)", reason);
             priv->link_config_delayed_id =
                 g_timeout_add(NM_MAX((priv->link_config_last_at + LINK_CONFIG_RATE_LIMIT_NSEC - now)
@@ -1568,27 +1568,27 @@ _get_dev2_ip_config(NMDeviceWireGuard *self, int addr_family)
     s_wg = NM_SETTING_WIREGUARD(nm_connection_get_setting(connection, NM_TYPE_SETTING_WIREGUARD));
 
     /* Differences to `wg-quick`.
-	 *
-	 * `wg-quick` supports the "Table" setting with 3 modes:
-	 *
-	 * a1) "off": this is what we do with "peer-routes" disabled.
-	 *
-	 * a2) an explicit routing table. This is our behavior with "peer-routes" on. In this case
-	 *   we honor the "ipv4.route-table" and "ipv6.route-table" settings. One difference is that
-	 *   `wg-quick` would resolve table names from /etc/iproute2/rt_tables. Our connection profiles
-	 *   only contain table numbers, so that conversion from name to table must have happened
-	 *   before already.
-	 *
-	 * a3) "auto" (the default). In this case, `wg-quick` would only add the route to the
-	 *   main table, if the AllowedIP range is not yet reachable on the link. With "peer-routes"
-	 *   enabled, we don't check for that and always add the routes to the main-table
-	 *   (with 'ipv4.route-table' and 'ipv6.route-table' set to zero or RT_TABLE_MAIN (254)).
-	 *
-	 *   Also, in "auto" mode, `wg-quick` would add special handling for /0 routes and pick
-	 *   an empty table to configure policy routing to avoid routing loops. This handling
-	 *   of routing-loops via policy routing is not yet done, and requires a separate solution
-	 *   from constructing the peer-routes here.
-	 */
+     *
+     * `wg-quick` supports the "Table" setting with 3 modes:
+     *
+     * a1) "off": this is what we do with "peer-routes" disabled.
+     *
+     * a2) an explicit routing table. This is our behavior with "peer-routes" on. In this case
+     *   we honor the "ipv4.route-table" and "ipv6.route-table" settings. One difference is that
+     *   `wg-quick` would resolve table names from /etc/iproute2/rt_tables. Our connection profiles
+     *   only contain table numbers, so that conversion from name to table must have happened
+     *   before already.
+     *
+     * a3) "auto" (the default). In this case, `wg-quick` would only add the route to the
+     *   main table, if the AllowedIP range is not yet reachable on the link. With "peer-routes"
+     *   enabled, we don't check for that and always add the routes to the main-table
+     *   (with 'ipv4.route-table' and 'ipv6.route-table' set to zero or RT_TABLE_MAIN (254)).
+     *
+     *   Also, in "auto" mode, `wg-quick` would add special handling for /0 routes and pick
+     *   an empty table to configure policy routing to avoid routing loops. This handling
+     *   of routing-loops via policy routing is not yet done, and requires a separate solution
+     *   from constructing the peer-routes here.
+     */
     if (!nm_setting_wireguard_get_peer_routes(s_wg))
         return NULL;
 
@@ -1650,9 +1650,9 @@ _get_dev2_ip_config(NMDeviceWireGuard *self, int addr_family)
 
             if (prefix == 0 && auto_default_route_enabled) {
                 /* In auto-default-route mode, we place the default route in a table that
-				 * has the same number as the fwmark. wg-quick does that too. If you don't
-				 * like that, configure the rules and the default-route explicitly in the
-				 * connection profile. */
+                 * has the same number as the fwmark. wg-quick does that too. If you don't
+                 * like that, configure the rules and the default-route explicitly in the
+                 * connection profile. */
                 rtable_coerced = nm_platform_route_table_coerce(priv->auto_default_route_fwmark);
             }
 
@@ -1703,25 +1703,25 @@ static guint32
 get_configured_mtu(NMDevice *device, NMDeviceMtuSource *out_source, gboolean *out_force)
 {
     /* When "MTU" for `wg-quick up` is unset, it calls `ip route get` for
-	 * each configured endpoint, to determine the suitable MTU how to reach
-	 * each endpoint.
-	 * For `wg-quick` this works very well, because whenever the script runs it
-	 * determines the best setting at that point in time. It's simply not concerned
-	 * with what happens later (and it's not around anyway).
-	 *
-	 * NetworkManager sticks around, so the right MTU would need to be re-determined
-	 * whenever anything relevant changes. Which basically means, to re-evaluate whenever
-	 * something related to addresses or routing changes (which happens all the time).
-	 *
-	 * The correct MTU indeed depends on the MTU setting of other interfaces (or routes).
-	 * But it's still odd, that activating/deactivating a seemingly unrelated interface
-	 * would trigger an MTU change. It's odd to explain/document and odd to implemented
-	 * -- despite this being the reality.
-	 *
-	 * For now, only support configuring an explicit MTU, or leave the setting untouched.
-	 * The same limitation also applies to other "ip-tunnel" types, where we could use
-	 * similar smarts for autodetecting the MTU.
-	 */
+     * each configured endpoint, to determine the suitable MTU how to reach
+     * each endpoint.
+     * For `wg-quick` this works very well, because whenever the script runs it
+     * determines the best setting at that point in time. It's simply not concerned
+     * with what happens later (and it's not around anyway).
+     *
+     * NetworkManager sticks around, so the right MTU would need to be re-determined
+     * whenever anything relevant changes. Which basically means, to re-evaluate whenever
+     * something related to addresses or routing changes (which happens all the time).
+     *
+     * The correct MTU indeed depends on the MTU setting of other interfaces (or routes).
+     * But it's still odd, that activating/deactivating a seemingly unrelated interface
+     * would trigger an MTU change. It's odd to explain/document and odd to implemented
+     * -- despite this being the reality.
+     *
+     * For now, only support configuring an explicit MTU, or leave the setting untouched.
+     * The same limitation also applies to other "ip-tunnel" types, where we could use
+     * similar smarts for autodetecting the MTU.
+     */
     return nm_device_get_configured_mtu_from_connection(device,
                                                         NM_TYPE_SETTING_WIREGUARD,
                                                         out_source);
@@ -1764,8 +1764,8 @@ can_reapply_change(NMDevice *  device,
 {
     if (nm_streq(setting_name, NM_SETTING_WIREGUARD_SETTING_NAME)) {
         /* Most, but not all WireGuard settings can be reapplied. Whitelist.
-		 *
-		 * MTU cannot be reapplied. */
+         *
+         * MTU cannot be reapplied. */
         return nm_device_hash_check_invalid_keys(diffs,
                                                  NM_SETTING_WIREGUARD_SETTING_NAME,
                                                  error,
diff --git a/src/devices/nm-device-wpan.c b/src/devices/nm-device-wpan.c
index 7076405ee5..bb7f82b9d3 100644
--- a/src/devices/nm-device-wpan.c
+++ b/src/devices/nm-device-wpan.c
@@ -141,8 +141,8 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
     }
 
     /* As of kernel 4.16, the 6LoWPAN devices layered on top of WPANs
-	 * need to be DOWN as well as the WPAN device itself in order to
-	 * modify the WPAN properties. */
+     * need to be DOWN as well as the WPAN device itself in order to
+     * modify the WPAN properties. */
     lowpan_plink =
         nm_platform_link_get_by_address(platform, NM_LINK_TYPE_6LOWPAN, hwaddr, hwaddr_len);
     if (lowpan_plink && NM_FLAGS_HAS(lowpan_plink->n_ifi_flags, IFF_UP)) {
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index ca294a3da0..1dd5953c67 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -138,8 +138,8 @@ typedef void (*AcdCallback)(NMDevice *, NMIP4Config **, gboolean);
 
 typedef enum {
     /* The various NML3ConfigData types that we track explicitly. Note that
-	 * their relative order matters: higher numbers in this enum means more
-	 * important (and during merge overwrites other settings). */
+     * their relative order matters: higher numbers in this enum means more
+     * important (and during merge overwrites other settings). */
     L3_CONFIG_DATA_TYPE_LL_4,
     L3_CONFIG_DATA_TYPE_AC_6,
     L3_CONFIG_DATA_TYPE_DHCP_4,
@@ -421,11 +421,11 @@ typedef struct _NMDevicePrivate {
     guint32 v6_route_table;
 
     /* when carrier goes away, we give a grace period of _get_carrier_wait_ms()
-	 * until taking action.
-	 *
-	 * When changing MTU, the device might take longer then that. So, whenever
-	 * NM changes the MTU it sets @carrier_wait_until_ms to CARRIER_WAIT_TIME_AFTER_MTU_MS
-	 * in the future. This is used to extend the grace period in this particular case. */
+     * until taking action.
+     *
+     * When changing MTU, the device might take longer then that. So, whenever
+     * NM changes the MTU it sets @carrier_wait_until_ms to CARRIER_WAIT_TIME_AFTER_MTU_MS
+     * in the future. This is used to extend the grace period in this particular case. */
     gint64 carrier_wait_until_ms;
 
     union {
@@ -514,7 +514,7 @@ typedef struct _NMDevicePrivate {
     };
 
     /* Extra device configuration, injected by the subclass of NMDevice.
-	 * This is used for example by NMDeviceModem for WWAN configuration. */
+     * This is used for example by NMDeviceModem for WWAN configuration. */
     union {
         struct {
             AppliedConfig dev2_ip_config_6;
@@ -634,11 +634,11 @@ typedef struct _NMDevicePrivate {
         guint p_max_interval;
 
         /* the current interval. If we are probing, the interval might be lower
-		 * then the configured max interval. */
+         * then the configured max interval. */
         guint p_cur_interval;
 
         /* the timestamp, when we last scheduled the timer p_cur_id with current interval
-		 * p_cur_interval. */
+         * p_cur_interval. */
         gint64 p_cur_basetime_ns;
 
         NMConnectivityState state;
@@ -906,12 +906,12 @@ _prop_get_connection_stable_id(NMDevice *         self,
     priv = NM_DEVICE_GET_PRIVATE(self);
 
     /* we cache the generated stable ID for the time of an activation.
-	 *
-	 * The reason is, that we don't want the stable-id to change as long
-	 * as the device is active.
-	 *
-	 * Especially with ${RANDOM} stable-id we want to generate *one* configuration
-	 * for each activation. */
+     *
+     * The reason is, that we don't want the stable-id to change as long
+     * as the device is active.
+     *
+     * Especially with ${RANDOM} stable-id we want to generate *one* configuration
+     * for each activation. */
     if (G_UNLIKELY(!priv->current_stable_id)) {
         gs_free char *       default_id = NULL;
         gs_free char *       generated  = NULL;
@@ -937,8 +937,8 @@ _prop_get_connection_stable_id(NMDevice *         self,
         uuid = nm_connection_get_uuid(connection);
 
         /* the cloned-mac-address may be generated based on the stable-id.
-		 * Thus, at this point, we can only use the permanent MAC address
-		 * as seed. */
+         * Thus, at this point, we can only use the permanent MAC address
+         * as seed. */
         hwaddr = nm_device_get_permanent_hw_address_full(self, TRUE, &hwaddr_is_fake);
 
         stable_type = nm_utils_stable_id_parse(stable_id,
@@ -1053,10 +1053,10 @@ _prop_get_ipv6_dhcp_duid(NMDevice *    self,
 
     if (NM_IN_STRSET(duid, "stable-ll", "stable-llt", "stable-uuid")) {
         /* preferably, we would salt the checksum differently for each @duid type. We missed
-		 * to do that initially, so most types use the DEFAULT_SALT.
-		 *
-		 * Implementations that are added later, should use a distinct salt instead,
-		 * like "stable-ll"/"stable-llt" with ARPHRD_INFINIBAND below. */
+         * to do that initially, so most types use the DEFAULT_SALT.
+         *
+         * Implementations that are added later, should use a distinct salt instead,
+         * like "stable-ll"/"stable-llt" with ARPHRD_INFINIBAND below. */
         const guint32         DEFAULT_SALT   = 670531087u;
         nm_auto_free_checksum GChecksum *sum = NULL;
         NMUtilsStableType                stable_type;
@@ -1083,10 +1083,10 @@ _prop_get_ipv6_dhcp_duid(NMDevice *    self,
 
         if (NM_IN_STRSET(duid, "stable-ll", "stable-llt")) {
             /* for stable LL/LLT DUIDs, we still need a hardware address to detect
-			 * the arp-type. Alternatively, we would be able to detect it based on
-			 * other means (e.g. NMDevice type), but instead require the hardware
-			 * address to be present. This is at least consistent with the "ll"/"llt"
-			 * modes above. */
+             * the arp-type. Alternatively, we would be able to detect it based on
+             * other means (e.g. NMDevice type), but instead require the hardware
+             * address to be present. This is at least consistent with the "ll"/"llt"
+             * modes above. */
             if (!hwaddr) {
                 duid_error = "missing link-layer address";
                 goto out_fail;
@@ -1142,13 +1142,13 @@ _prop_get_ipv6_dhcp_duid(NMDevice *    self,
 #define EPOCH_DATETIME_THREE_YEARS (356 * 24 * 3600 * 3)
 
             /* We want a variable time between the host_id timestamp and three years
-			 * before. Let's compute the time (in seconds) from 0 to 3 years; then we'll
-			 * subtract it from the host_id timestamp.
-			 */
+             * before. Let's compute the time (in seconds) from 0 to 3 years; then we'll
+             * subtract it from the host_id timestamp.
+             */
             time = nm_utils_host_id_get_timestamp_ns() / NM_UTILS_NSEC_PER_SEC;
 
             /* don't use too old timestamps. They cannot be expressed in DUID-LLT and
-			 * would all be truncated to zero. */
+             * would all be truncated to zero. */
             time = NM_MAX(time, NM_UTILS_EPOCH_DATETIME_200001010000 + EPOCH_DATETIME_THREE_YEARS);
 
             switch (arp_type) {
@@ -1291,7 +1291,7 @@ _prop_get_ipvx_route_table(NMDevice *self, int addr_family)
     nm_assert_addr_family(addr_family);
 
     /* the route table setting affects how we sync routes. We shall
-	 * not change it while the device is active, hence, cache it. */
+     * not change it while the device is active, hence, cache it. */
     if (addr_family == AF_INET) {
         if (priv->v4_route_table_initialized)
             return priv->v4_route_table;
@@ -1518,8 +1518,8 @@ _prop_get_ipvx_dhcp_iaid(NMDevice *    self,
         }
 
         /* @iaid is in native endianness. Use unaligned_read_be32()
-		 * so that the IAID for a given MAC address is the same on
-		 * BE and LE machines. */
+         * so that the IAID for a given MAC address is the same on
+         * BE and LE machines. */
         iaid = unaligned_read_be32(&pllink->l_address.data[pllink->l_address.len - 4]);
         goto out_good;
     } else if (nm_streq0(iaid_str, NM_IAID_PERM_MAC)) {
@@ -1850,7 +1850,7 @@ _prop_get_ipv6_ip6_privacy(NMDevice *self)
     g_return_val_if_fail(self, NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN);
 
     /* 1.) First look at the per-connection setting. If it is not -1 (unknown),
-	 * use it. */
+     * use it. */
     connection = nm_device_get_applied_connection(self);
     if (connection) {
         NMSettingIPConfig *s_ip6 = nm_connection_get_setting_ip6_config(connection);
@@ -1878,10 +1878,10 @@ _prop_get_ipv6_ip6_privacy(NMDevice *self)
         return NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN;
 
     /* 3.) No valid default-value configured. Fallback to reading sysctl.
-	 *
-	 * Instead of reading static config files in /etc, just read the current sysctl value.
-	 * This works as NM only writes to "/proc/sys/net/ipv6/conf/IFNAME/use_tempaddr", but leaves
-	 * the "default" entry untouched. */
+     *
+     * Instead of reading static config files in /etc, just read the current sysctl value.
+     * This works as NM only writes to "/proc/sys/net/ipv6/conf/IFNAME/use_tempaddr", but leaves
+     * the "default" entry untouched. */
     ip6_privacy = nm_platform_sysctl_get_int32(
         nm_device_get_platform(self),
         NMP_SYSCTL_PATHID_ABSOLUTE("/proc/sys/net/ipv6/conf/default/use_tempaddr"),
@@ -2269,12 +2269,12 @@ nm_device_is_vpn(NMDevice *self)
     g_return_val_if_fail(NM_IS_DEVICE(self), FALSE);
 
     /* NetworkManager currently treats VPN connections (loaded from NetworkManager VPN plugins)
-	 * differently. Those are considered VPNs.
-	 * However, some native device types may also be considered VPNs...
-	 *
-	 * We should avoid distinguishing between is-vpn and "regular" devices. Is an (unencrypted)
-	 * IP tunnel a VPN? Is MACSec on top of an IP tunnel a VPN?
-	 * Sometimes we differentiate, but avoid unless reasonable. */
+     * differently. Those are considered VPNs.
+     * However, some native device types may also be considered VPNs...
+     *
+     * We should avoid distinguishing between is-vpn and "regular" devices. Is an (unencrypted)
+     * IP tunnel a VPN? Is MACSec on top of an IP tunnel a VPN?
+     * Sometimes we differentiate, but avoid unless reasonable. */
 
     return NM_IS_DEVICE_WIREGUARD(self);
 }
@@ -2503,8 +2503,8 @@ nm_device_sys_iface_state_set(NMDevice *self, NMDeviceSysIfaceState sys_iface_st
     }
 
     /* this function only sets a flag, no immediate actions are initiated.
-	 *
-	 * If you change this, make sure that all callers are fine with such actions. */
+     *
+     * If you change this, make sure that all callers are fine with such actions. */
 
     nm_assert(priv->sys_iface_state == sys_iface_state);
 }
@@ -2657,9 +2657,9 @@ set_ipv6_token(NMDevice *self, NMUtilsIPv6IfaceId iid, const char *token_str)
     gint64                val;
 
     /* Setting the kernel token is not strictly necessary as the
-	 * IPv6 address is generated in userspace. However it is
-	 * convenient so that users can see the token with iproute
-	 * ('ip token'). */
+     * IPv6 address is generated in userspace. However it is
+     * convenient so that users can see the token with iproute
+     * ('ip token'). */
     platform = nm_device_get_platform(self);
     ifindex  = nm_device_get_ip_ifindex(self);
     link     = nm_platform_link_get(platform, ifindex);
@@ -2670,9 +2670,9 @@ set_ipv6_token(NMDevice *self, NMUtilsIPv6IfaceId iid, const char *token_str)
     }
 
     /* The kernel allows setting a token only when 'accept_ra'
-	 * is 1: temporarily flip it if necessary; unfortunately
-	 * this will also generate an additional Router Solicitation
-	 * from kernel. */
+     * is 1: temporarily flip it if necessary; unfortunately
+     * this will also generate an additional Router Solicitation
+     * from kernel. */
     val = nm_device_sysctl_ip_conf_get_int_checked(self,
                                                    AF_INET6,
                                                    "accept_ra",
@@ -2769,9 +2769,9 @@ _set_ip_state(NMDevice *self, int addr_family, NMDeviceIPState new_state)
 
     if (new_state == NM_DEVICE_IP_STATE_DONE) {
         /* we only set the IPx_READY flag once we reach NM_DEVICE_IP_STATE_DONE state. We don't
-		 * ever clear it, even if we later enter NM_DEVICE_IP_STATE_FAIL state.
-		 *
-		 * This is not documented/guaranteed behavior, but seems to make sense for now. */
+         * ever clear it, even if we later enter NM_DEVICE_IP_STATE_FAIL state.
+         *
+         * This is not documented/guaranteed behavior, but seems to make sense for now. */
         _active_connection_set_state_flags(self,
                                            addr_family == AF_INET
                                                ? NM_ACTIVATION_STATE_FLAG_IP4_READY
@@ -3268,7 +3268,7 @@ _stats_refresh_rate_real(guint refresh_rate_ms)
 
     if (refresh_rate_ms < STATS_REFRESH_RATE_MS_MIN) {
         /* you cannot set the refresh-rate arbitrarily small. E.g.
-		 * setting to 1ms is just killing. Have a lowest number. */
+         * setting to 1ms is just killing. Have a lowest number. */
         return STATS_REFRESH_RATE_MS_MIN;
     }
 
@@ -3306,8 +3306,8 @@ _stats_set_refresh_rate(NMDevice *self, guint refresh_rate_ms)
         return;
 
     /* trigger an initial refresh of the data whenever the refresh-rate changes.
-	 * As we process the result in an idle handler with device_link_changed(),
-	 * we don't get the result right away. */
+     * As we process the result in an idle handler with device_link_changed(),
+     * we don't get the result right away. */
     ifindex = nm_device_get_ip_ifindex(self);
     if (ifindex > 0)
         nm_platform_link_refresh(nm_device_get_platform(self), ifindex);
@@ -3343,9 +3343,9 @@ get_ip_iface_identifier(NMDevice *self, NMUtilsIPv6IfaceId *out_iid)
 
     if (pllink->type == NM_LINK_TYPE_6LOWPAN) {
         /* If the underlying IEEE 802.15.4 device has a short address we generate
-		 * a "pseudo 48-bit address" that's to be used in the same fashion as a
-		 * wired Ethernet address. The mechanism is specified in Section 6. of
-		 * RFC 4944 */
+         * a "pseudo 48-bit address" that's to be used in the same fashion as a
+         * wired Ethernet address. The mechanism is specified in Section 6. of
+         * RFC 4944 */
         guint16 pan_id;
         guint16 short_addr;
 
@@ -3467,27 +3467,27 @@ guint32
 nm_device_get_route_metric_default(NMDeviceType device_type)
 {
     /* Device 'priority' is used for the default route-metric and is based on
-	 * the device type. The settings ipv4.route-metric and ipv6.route-metric
-	 * can overwrite this default.
-	 *
-	 * For both IPv4 and IPv6 we use the same default values.
-	 *
-	 * The route-metric is used for the metric of the routes of device.
-	 * This also applies to the default route. Therefore it affects also
-	 * which device is the "best".
-	 *
-	 * For comparison, note that iproute2 by default adds IPv4 routes with
-	 * metric 0, and IPv6 routes with metric 1024. The latter is the IPv6
-	 * "user default" in the kernel (NM_PLATFORM_ROUTE_METRIC_DEFAULT_IP6).
-	 * In kernel, the full uint32_t range is available for route
-	 * metrics (except for IPv6, where 0 means 1024).
-	 */
+     * the device type. The settings ipv4.route-metric and ipv6.route-metric
+     * can overwrite this default.
+     *
+     * For both IPv4 and IPv6 we use the same default values.
+     *
+     * The route-metric is used for the metric of the routes of device.
+     * This also applies to the default route. Therefore it affects also
+     * which device is the "best".
+     *
+     * For comparison, note that iproute2 by default adds IPv4 routes with
+     * metric 0, and IPv6 routes with metric 1024. The latter is the IPv6
+     * "user default" in the kernel (NM_PLATFORM_ROUTE_METRIC_DEFAULT_IP6).
+     * In kernel, the full uint32_t range is available for route
+     * metrics (except for IPv6, where 0 means 1024).
+     */
 
     switch (device_type) {
     /* 50 is also used for VPN plugins (NM_VPN_ROUTE_METRIC_DEFAULT).
-	 *
-	 * Note that returning 50 from this function means that this device-type is
-	 * in some aspects a VPN. */
+     *
+     * Note that returning 50 from this function means that this device-type is
+     * in some aspects a VPN. */
     case NM_DEVICE_TYPE_WIREGUARD:
         return NM_VPN_ROUTE_METRIC_DEFAULT;
 
@@ -3560,7 +3560,7 @@ default_route_metric_penalty_detect(NMDevice *self, int addr_family)
     const gboolean   IS_IPv4 = (addr_family == AF_INET);
 
     /* currently we don't differentiate between IPv4 and IPv6 when detecting
-	 * connectivity. */
+     * connectivity. */
     if (priv->concheck_x[IS_IPv4].state != NM_CONNECTIVITY_FULL
         && nm_connectivity_check_enabled(concheck_get_mgr(self)))
         return TRUE;
@@ -3597,9 +3597,9 @@ nm_device_get_route_metric(NMDevice *self, int addr_family)
         s_ip = nm_connection_get_setting_ip_config(connection, addr_family);
 
         /* Slave interfaces don't have IP settings, but we may get here when
-		 * external changes are made or when noticing IP changes when starting
-		 * the slave connection.
-		 */
+         * external changes are made or when noticing IP changes when starting
+         * the slave connection.
+         */
         if (s_ip) {
             route_metric = nm_setting_ip_config_get_route_metric(s_ip);
             if (route_metric >= 0)
@@ -3608,8 +3608,8 @@ nm_device_get_route_metric(NMDevice *self, int addr_family)
     }
 
     /* use the current NMConfigData, which makes this configuration reloadable.
-	 * Note that that means that the route-metric might change between SIGHUP.
-	 * You must cache the returned value if that is a problem. */
+     * Note that that means that the route-metric might change between SIGHUP.
+     * You must cache the returned value if that is a problem. */
     property     = addr_family == AF_INET ? NM_CON_DEFAULT("ipv4.route-metric")
                                           : NM_CON_DEFAULT("ipv6.route-metric");
     route_metric = nm_config_data_get_connection_default_int64(NM_CONFIG_GET_DATA,
@@ -3651,7 +3651,7 @@ _get_route_table_sync_mode_stateful(NMDevice *self, int addr_family)
 
     if (!all_sync_now) {
         /* If there's a local route switch to all-sync in order
-		 * to properly manage the local table */
+         * to properly manage the local table */
         if (addr_family == AF_INET) {
             const NMPlatformIP4Route *route;
 
@@ -3677,12 +3677,12 @@ _get_route_table_sync_mode_stateful(NMDevice *self, int addr_family)
         all_sync_eff = TRUE;
     else {
         /* When we change from all-sync to no all-sync, we do a last all-sync one
-		 * more time. For that, we determine the effective all-state based on the
-		 * cached/previous all-sync flag.
-		 *
-		 * The purpose of this is to support reapply of route-table (and thus the
-		 * all-sync mode). If reapply toggles from all-sync to no-all-sync, we must
-		 * sync one last time. */
+         * more time. For that, we determine the effective all-state based on the
+         * cached/previous all-sync flag.
+         *
+         * The purpose of this is to support reapply of route-table (and thus the
+         * all-sync mode). If reapply toggles from all-sync to no-all-sync, we must
+         * sync one last time. */
         if (addr_family == AF_INET)
             all_sync_eff = priv->v4_route_table_all_sync_before;
         else
@@ -3730,7 +3730,7 @@ nm_device_get_type_description(NMDevice *self)
     g_return_val_if_fail(self != NULL, NULL);
 
     /* Beware: this function should return the same
-	 * value as nm_device_get_type_description() in libnm. */
+     * value as nm_device_get_type_description() in libnm. */
 
     return NM_DEVICE_GET_CLASS(self)->get_type_description(self);
 }
@@ -3743,17 +3743,17 @@ get_type_description(NMDevice *self)
     nm_assert(NM_IS_DEVICE(self));
 
     /* the default implementation for the description just returns the (modified)
-	 * class name and depends entirely on the type of self. Note that we cache the
-	 * description in the klass itself.
-	 *
-	 * Also note, that as the GObject class gets inited, it inherrits the fields
-	 * of the parent class. That means, if NMDeviceVethClass was initialized after
-	 * NMDeviceEthernetClass already has the description cached in the class
-	 * (because we already fetched the description for an ethernet device),
-	 * then default_type_description will wrongly contain "ethernet".
-	 * To avoid that, and catch the situation, also cache the klass for
-	 * which the description was cached. If that doesn't match, it was
-	 * inherited and we need to reset it. */
+     * class name and depends entirely on the type of self. Note that we cache the
+     * description in the klass itself.
+     *
+     * Also note, that as the GObject class gets inited, it inherrits the fields
+     * of the parent class. That means, if NMDeviceVethClass was initialized after
+     * NMDeviceEthernetClass already has the description cached in the class
+     * (because we already fetched the description for an ethernet device),
+     * then default_type_description will wrongly contain "ethernet".
+     * To avoid that, and catch the situation, also cache the klass for
+     * which the description was cached. If that doesn't match, it was
+     * inherited and we need to reset it. */
     klass = NM_DEVICE_GET_CLASS(self);
     if (G_UNLIKELY(klass->default_type_description_klass != klass)) {
         const char *typename;
@@ -3928,7 +3928,7 @@ concheck_is_possible(NMDevice *self)
         return FALSE;
 
     /* we enable periodic checks for every device state (except UNKNOWN). Especially with
-	 * unmanaged devices, it is interesting to know whether we have connectivity on that device. */
+     * unmanaged devices, it is interesting to know whether we have connectivity on that device. */
     if (priv->state == NM_DEVICE_STATE_UNKNOWN)
         return FALSE;
 
@@ -3959,8 +3959,8 @@ concheck_periodic_schedule_do(NMDevice *self, int addr_family, gint64 now_ns)
     nm_assert(priv->concheck_x[IS_IPv4].p_cur_interval > 0);
 
     /* we schedule the timeout based on our current settings cur-interval and cur-basetime.
-	 * Before calling concheck_periodic_schedule_do(), make sure that these properties are
-	 * correct. */
+     * Before calling concheck_periodic_schedule_do(), make sure that these properties are
+     * correct. */
 
     expiry = priv->concheck_x[IS_IPv4].p_cur_basetime_ns
              + (priv->concheck_x[IS_IPv4].p_cur_interval * NM_UTILS_NSEC_PER_SEC);
@@ -4005,12 +4005,12 @@ concheck_periodic_schedule_set(NMDevice *self, int addr_family, ConcheckSchedule
 
     if (!priv->concheck_x[IS_IPv4].p_cur_id) {
         /* we currently don't have a timeout scheduled. No need to reschedule
-		 * another one... */
+         * another one... */
         if (NM_IN_SET(mode,
                       CONCHECK_SCHEDULE_UPDATE_INTERVAL,
                       CONCHECK_SCHEDULE_UPDATE_INTERVAL_RESTART)) {
             /* ... unless, we are about to start periodic checks after update-interval.
-			 * In this case, fall through and restart the periodic checks below. */
+             * In this case, fall through and restart the periodic checks below. */
             mode = CONCHECK_SCHEDULE_UPDATE_INTERVAL_RESTART;
         } else
             return;
@@ -4034,10 +4034,10 @@ concheck_periodic_schedule_set(NMDevice *self, int addr_family, ConcheckSchedule
 
         if (priv->concheck_x[IS_IPv4].p_cur_interval <= priv->concheck_x[IS_IPv4].p_max_interval) {
             /* we currently have a shorter interval set, than what we now have. Either,
-			 * because we are probing, or because the previous max interval was shorter.
-			 *
-			 * Either way, the current timer is set just fine. Nothing to do, we will
-			 * probe our way up. */
+             * because we are probing, or because the previous max interval was shorter.
+             *
+             * Either way, the current timer is set just fine. Nothing to do, we will
+             * probe our way up. */
             return;
         }
 
@@ -4048,18 +4048,18 @@ concheck_periodic_schedule_set(NMDevice *self, int addr_family, ConcheckSchedule
         priv->concheck_x[IS_IPv4].p_cur_interval = priv->concheck_x[IS_IPv4].p_max_interval;
         if (cur_expiry <= now_ns) {
             /* Since the last time we scheduled a periodic check, already more than the
-			 * new max_interval passed. We need to start a check right away (and
-			 * schedule a timeout in cur-interval in the future). */
+             * new max_interval passed. We need to start a check right away (and
+             * schedule a timeout in cur-interval in the future). */
             priv->concheck_x[IS_IPv4].p_cur_basetime_ns = now_ns;
             if (concheck_periodic_schedule_do(self, addr_family, now_ns))
                 concheck_start(self, addr_family, NULL, NULL, TRUE);
         } else {
             /* we are reducing the max-interval to a shorter interval that we have currently
-			 * scheduled (with cur_interval).
-			 *
-			 * However, since the last time we scheduled the check, not even the new max-interval
-			 * expired. All we need to do, is reschedule the timer to expire sooner. The cur_basetime
-			 * is unchanged. */
+             * scheduled (with cur_interval).
+             *
+             * However, since the last time we scheduled the check, not even the new max-interval
+             * expired. All we need to do, is reschedule the timer to expire sooner. The cur_basetime
+             * is unchanged. */
             concheck_periodic_schedule_do(self, addr_family, now_ns);
         }
         return;
@@ -4089,16 +4089,16 @@ concheck_periodic_schedule_set(NMDevice *self, int addr_family, ConcheckSchedule
         }
         if (any_periodic_pending) {
             /* we reached a timeout to schedule a new periodic request, however we still
-			 * have period requests pending that didn't complete yet. We need to bump the
-			 * interval already. */
+             * have period requests pending that didn't complete yet. We need to bump the
+             * interval already. */
             priv->concheck_x[IS_IPv4].p_cur_interval =
                 NM_MIN(old_interval * 2, priv->concheck_x[IS_IPv4].p_max_interval);
         }
 
         /* we just reached a timeout. The expected expiry (exp_expiry) should be
-		 * pretty close to now_ns.
-		 *
-		 * We want to reschedule the timeout at exp_expiry (aka now) + cur_interval. */
+         * pretty close to now_ns.
+         *
+         * We want to reschedule the timeout at exp_expiry (aka now) + cur_interval. */
         nm_utils_get_monotonic_timestamp_nsec_cached(&now_ns);
         exp_expiry =
             priv->concheck_x[IS_IPv4].p_cur_basetime_ns + (old_interval * NM_UTILS_NSEC_PER_SEC);
@@ -4111,10 +4111,10 @@ concheck_periodic_schedule_set(NMDevice *self, int addr_family, ConcheckSchedule
             handle = concheck_start(self, addr_family, NULL, NULL, TRUE);
             if (old_interval != priv->concheck_x[IS_IPv4].p_cur_interval) {
                 /* we just bumped the interval already when scheduling this check.
-				 * When the handle returns, don't bump a second time.
-				 *
-				 * But if we reach the timeout again before the handle returns (this
-				 * code here) we will still bump the interval. */
+                 * When the handle returns, don't bump a second time.
+                 *
+                 * But if we reach the timeout again before the handle returns (this
+                 * code here) we will still bump the interval. */
                 handle->is_periodic_bump_on_complete = FALSE;
             }
         }
@@ -4122,7 +4122,7 @@ concheck_periodic_schedule_set(NMDevice *self, int addr_family, ConcheckSchedule
     }
 
     /* we just got an event that we lost connectivity (that is, concheck returned). We reset
-	 * the interval to min/max or increase the probe interval (bump). */
+     * the interval to min/max or increase the probe interval (bump). */
     case CONCHECK_SCHEDULE_RETURNED_MIN:
         priv->concheck_x[IS_IPv4].p_cur_interval =
             NM_MIN(priv->concheck_x[IS_IPv4].p_max_interval, CONCHECK_P_PROBE_INTERVAL);
@@ -4138,11 +4138,11 @@ concheck_periodic_schedule_set(NMDevice *self, int addr_family, ConcheckSchedule
     }
 
     /* we are here, because we returned from a connectivity check and adjust the current interval.
-	 *
-	 * But note that we calculate the new timeout based on the time when we scheduled the
-	 * last check, instead of counting from now. The reason is that we want that the times
-	 * when we schedule checks be at precise intervals, without including the time it took for
-	 * the connectivity check. */
+     *
+     * But note that we calculate the new timeout based on the time when we scheduled the
+     * last check, instead of counting from now. The reason is that we want that the times
+     * when we schedule checks be at precise intervals, without including the time it took for
+     * the connectivity check. */
     new_expiry = priv->concheck_x[IS_IPv4].p_cur_basetime_ns
                  + (priv->concheck_x[IS_IPv4].p_cur_interval * NM_UTILS_NSEC_PER_SEC);
     tdiff = NM_MAX(new_expiry - nm_utils_get_monotonic_timestamp_nsec_cached(&now_ns), 0);
@@ -4172,7 +4172,7 @@ concheck_update_interval(NMDevice *self, int addr_family, gboolean check_now)
 
     if (!new_interval) {
         /* this will cancel any potentially pending timeout because max-interval is zero.
-		 * But it logs a nice message... */
+         * But it logs a nice message... */
         concheck_periodic_schedule_do(self, addr_family, 0);
 
         /* also update the fake connectivity state. */
@@ -4203,7 +4203,7 @@ concheck_update_state(NMDevice *          self,
     const gboolean   IS_IPv4 = (addr_family == AF_INET);
 
     /* @state is a result of the connectivity check. We only expect a precise
-	 * number of possible values. */
+     * number of possible values. */
     nm_assert(NM_IN_SET(state,
                         NM_CONNECTIVITY_LIMITED,
                         NM_CONNECTIVITY_PORTAL,
@@ -4214,18 +4214,18 @@ concheck_update_state(NMDevice *          self,
 
     if (state == NM_CONNECTIVITY_ERROR) {
         /* on error, we don't change the current connectivity state,
-		 * except making UNKNOWN to NONE. */
+         * except making UNKNOWN to NONE. */
         state = priv->concheck_x[IS_IPv4].state;
         if (state == NM_CONNECTIVITY_UNKNOWN)
             state = NM_CONNECTIVITY_NONE;
     } else if (state == NM_CONNECTIVITY_FAKE) {
         /* If the connectivity check is disabled and we obtain a fake
-		 * result, make an optimistic guess. */
+         * result, make an optimistic guess. */
         if (priv->state == NM_DEVICE_STATE_ACTIVATED) {
             /* FIXME: the fake connectivity state depends on the availability of
-			 * a default route. However, we have no mechanism that rechecks the
-			 * value if a device route appears/disappears after the device
-			 * was activated. */
+             * a default route. However, we have no mechanism that rechecks the
+             * value if a device route appears/disappears after the device
+             * was activated. */
             if (nm_device_get_best_default_route(self, AF_UNSPEC))
                 state = NM_CONNECTIVITY_FULL;
             else
@@ -4236,21 +4236,21 @@ concheck_update_state(NMDevice *          self,
 
     if (priv->concheck_x[IS_IPv4].state == state) {
         /* we got a connectivity update, but the state didn't change. If we were probing,
-		 * we bump the probe frequency. */
+         * we bump the probe frequency. */
         if (allow_periodic_bump)
             concheck_periodic_schedule_set(self, addr_family, CONCHECK_SCHEDULE_RETURNED_BUMP);
         return;
     }
     /* we need to update the probe interval before emitting signals. Emitting
-	 * a signal might call back into NMDevice and change the probe settings.
-	 * So, do that first. */
+     * a signal might call back into NMDevice and change the probe settings.
+     * So, do that first. */
     if (state == NM_CONNECTIVITY_FULL) {
         /* we reached full connectivity state. Stop probing by setting the
-		 * interval to the max. */
+         * interval to the max. */
         concheck_periodic_schedule_set(self, addr_family, CONCHECK_SCHEDULE_RETURNED_MAX);
     } else if (priv->concheck_x[IS_IPv4].state == NM_CONNECTIVITY_FULL) {
         /* we are about to loose connectivity. (re)start probing by setting
-		 * the timeout interval to the min. */
+         * the timeout interval to the min. */
         concheck_periodic_schedule_set(self, addr_family, CONCHECK_SCHEDULE_RETURNED_MIN);
     } else {
         if (allow_periodic_bump)
@@ -4308,8 +4308,8 @@ concheck_handle_complete(NMDeviceConnectivityHandle *handle, GError *error)
     const gboolean IS_IPv4 = (handle->addr_family == AF_INET);
 
     /* The moment we invoke the callback, we unlink it. It signals
-	 * that @handle is handled -- as far as the callee of callback
-	 * is concerned. */
+     * that @handle is handled -- as far as the callee of callback
+     * is concerned. */
     c_list_unlink(&handle->concheck_lst);
 
     if (handle->c_handle)
@@ -4352,8 +4352,8 @@ concheck_cb(NMConnectivity *           connectivity,
 
     if (state == NM_CONNECTIVITY_CANCELLED) {
         /* the only place where we nm_connectivity_check_cancel(@c_handle), is
-		 * from inside concheck_handle_complete(). This is a recursive call,
-		 * nothing to do. */
+         * from inside concheck_handle_complete(). This is a recursive call,
+         * nothing to do. */
         _LOGT(LOGD_CONCHECK,
               "connectivity: [IPv%c] complete check (seq:%llu, cancelled)",
               nm_utils_addr_family_to_char(handle->addr_family),
@@ -4380,7 +4380,7 @@ concheck_cb(NMConnectivity *           connectivity,
           nm_connectivity_state_to_string(state));
 
     /* find out, if there are any periodic checks pending (either whether they
-	 * were scheduled before or after @handle. */
+     * were scheduled before or after @handle. */
     any_periodic_before = FALSE;
     any_periodic_after  = FALSE;
     c_list_for_each_entry (other_handle, &priv->concheck_lst_head, concheck_lst) {
@@ -4395,17 +4395,17 @@ concheck_cb(NMConnectivity *           connectivity,
     }
     if (NM_IN_SET(state, NM_CONNECTIVITY_ERROR)) {
         /* the request failed. We consider this periodic check only as completed if
-		 * this was a periodic check, and there are not checks pending (either
-		 * before or after this one).
-		 *
-		 * We allow_periodic_bump, if the request failed and there are
-		 * still other requests periodic pending. */
+         * this was a periodic check, and there are not checks pending (either
+         * before or after this one).
+         *
+         * We allow_periodic_bump, if the request failed and there are
+         * still other requests periodic pending. */
         allow_periodic_bump =
             handle->is_periodic_bump_on_complete && !any_periodic_before && !any_periodic_after;
     } else {
         /* the request succeeded. This marks the completion of a periodic check,
-		 * if this handle was periodic, or any previously scheduled one (that
-		 * we are going to complete below). */
+         * if this handle was periodic, or any previously scheduled one (that
+         * we are going to complete below). */
         allow_periodic_bump = handle->is_periodic_bump_on_complete || any_periodic_before;
     }
 
@@ -4415,22 +4415,22 @@ concheck_cb(NMConnectivity *           connectivity,
     handle_is_alive = FALSE;
 
     /* we might have invoked callbacks during concheck_update_state(). The caller might have
-	 * cancelled and thus destroyed @handle. We have to check whether handle is still alive,
-	 * by searching it in the list of alive handles.
-	 *
-	 * Also, we might want to complete all pending callbacks that were started before
-	 * @handle, as they are automatically obsoleted. */
+     * cancelled and thus destroyed @handle. We have to check whether handle is still alive,
+     * by searching it in the list of alive handles.
+     *
+     * Also, we might want to complete all pending callbacks that were started before
+     * @handle, as they are automatically obsoleted. */
 check_handles:
     c_list_for_each_entry (other_handle, &priv->concheck_lst_head, concheck_lst) {
         if (other_handle->addr_family != handle->addr_family)
             continue;
         if (other_handle->seq >= seq) {
             /* it's not guaranteed that @handle is still in the list. It might already
-			 * be canceled while invoking callbacks for a previous other_handle.
-			 * If it is already cancelled, @handle is a dangling pointer.
-			 *
-			 * Since @seq is assigned uniquely and increasing, either @other_handle is
-			 * @handle (and thus, handle is alive), or it isn't. */
+             * be canceled while invoking callbacks for a previous other_handle.
+             * If it is already cancelled, @handle is a dangling pointer.
+             *
+             * Since @seq is assigned uniquely and increasing, either @other_handle is
+             * @handle (and thus, handle is alive), or it isn't. */
             if (other_handle == handle)
                 handle_is_alive = TRUE;
             break;
@@ -4440,19 +4440,19 @@ check_handles:
 
         if (!NM_IN_SET(state, NM_CONNECTIVITY_ERROR)) {
             /* we also want to complete handles that were started before the current
-			 * @handle. Their response is out-dated. */
+             * @handle. Their response is out-dated. */
             concheck_handle_complete(other_handle, NULL);
 
             /* we invoked callbacks, other handles might be cancelled and removed from the list.
-			 * Need to iterate the list from the start. */
+             * Need to iterate the list from the start. */
             goto check_handles;
         }
     }
 
     if (!handle_is_alive) {
         /* We didn't find @handle in the list of alive handles. Thus, the handles
-		 * was cancelled while we were invoking events. Nothing to do, and don't
-		 * touch the dangling pointer. */
+         * was cancelled while we were invoking events. Nothing to do, and don't
+         * touch the dangling pointer. */
         return;
     }
 
@@ -4547,7 +4547,7 @@ nm_device_check_connectivity_cancel(NMDeviceConnectivityHandle *handle)
     g_return_if_fail(!c_list_is_empty(&handle->concheck_lst));
 
     /* nobody has access to periodic handles, and cannot cancel
-	 * them externally. */
+     * them externally. */
     nm_assert(!handle->is_periodic);
 
     nm_utils_error_set_cancelled(&cancelled_error, FALSE, "NMDevice");
@@ -4637,8 +4637,8 @@ nm_device_master_enslave_slave(NMDevice *self, NMDevice *slave, NMConnection *co
     nm_device_slave_notify_enslave(info->slave, success);
 
     /* Ensure the device's hardware address is up-to-date; it often changes
-	 * when slaves change.
-	 */
+     * when slaves change.
+     */
     nm_device_update_hw_address(self);
 
     /* Send ARP announcements if did not yet and have addresses. */
@@ -4646,9 +4646,9 @@ nm_device_master_enslave_slave(NMDevice *self, NMDevice *slave, NMConnection *co
         nm_device_arp_announce(self);
 
     /* Restart IP configuration if we're waiting for slaves.  Do this
-	 * after updating the hardware address as IP config may need the
-	 * new address.
-	 */
+     * after updating the hardware address as IP config may need the
+     * new address.
+     */
     if (success) {
         if (priv->ip_state_4 == NM_DEVICE_IP_STATE_WAIT)
             nm_device_activate_stage3_ip4_start(self);
@@ -4658,8 +4658,8 @@ nm_device_master_enslave_slave(NMDevice *self, NMDevice *slave, NMConnection *co
     }
 
     /* Since slave devices don't have their own IP configuration,
-	 * set the MTU here.
-	 */
+     * set the MTU here.
+     */
     _commit_mtu(slave, NM_DEVICE_GET_PRIVATE(slave)->ip_config_4);
 
     return success;
@@ -4721,7 +4721,7 @@ nm_device_master_release_one_slave(NMDevice *          self,
     nm_device_slave_notify_release(slave, reason);
 
     /* keep both alive until the end of the function.
-	 * Transfers ownership from slave_priv->master.  */
+     * Transfers ownership from slave_priv->master.  */
     self_free = self;
 
     c_list_unlink(&info->lst_slave);
@@ -4738,8 +4738,8 @@ nm_device_master_release_one_slave(NMDevice *          self,
     }
 
     /* Ensure the device's hardware address is up-to-date; it often changes
-	 * when slaves change.
-	 */
+     * when slaves change.
+     */
     nm_device_update_hw_address(self);
     nm_device_set_unmanaged_by_flags(slave,
                                      NM_UNMANAGED_IS_SLAVE,
@@ -4793,8 +4793,8 @@ set_unmanaged_external_down(NMDevice *self, gboolean only_if_unmanaged)
     ext_flags = is_unmanaged_external_down(self, FALSE);
     if (ext_flags != NM_UNMAN_FLAG_OP_SET_UNMANAGED) {
         /* Ensure the assume check is queued before any queued state changes
-		 * from the transition to UNAVAILABLE.
-		 */
+         * from the transition to UNAVAILABLE.
+         */
         nm_device_queue_recheck_assume(self);
     }
 
@@ -4883,7 +4883,7 @@ carrier_changed(NMDevice *self, gboolean carrier)
             if (priv->state == NM_DEVICE_STATE_ACTIVATED)
                 nm_device_update_dynamic_ip_setup(self);
             /* If needed, also resume IP configuration that is
-			 * waiting for carrier. */
+             * waiting for carrier. */
             if (nm_device_activate_ip4_state_in_wait(self))
                 nm_device_activate_stage3_ip4_start(self);
             if (nm_device_activate_ip6_state_in_wait(self))
@@ -4893,9 +4893,9 @@ carrier_changed(NMDevice *self, gboolean carrier)
         /* fall-through and change state of device */
     } else if (priv->is_enslaved && !carrier) {
         /* Slaves don't deactivate when they lose carrier; for
-		 * bonds/teams in particular that would be actively
-		 * counterproductive.
-		 */
+         * bonds/teams in particular that would be actively
+         * counterproductive.
+         */
         return;
     }
 
@@ -4906,16 +4906,16 @@ carrier_changed(NMDevice *self, gboolean carrier)
                                   NM_DEVICE_STATE_REASON_CARRIER);
         } else if (priv->state == NM_DEVICE_STATE_DISCONNECTED) {
             /* If the device is already in DISCONNECTED state without a carrier
-			 * (probably because it is tagged for carrier ignore) ensure that
-			 * when the carrier appears, auto connections are rechecked for
-			 * the device.
-			 */
+             * (probably because it is tagged for carrier ignore) ensure that
+             * when the carrier appears, auto connections are rechecked for
+             * the device.
+             */
             nm_device_emit_recheck_auto_activate(self);
         } else if (priv->state == NM_DEVICE_STATE_ACTIVATED) {
             /* If the device is active without a carrier (probably because it is
-			 * tagged for carrier ignore) ensure that when the carrier appears we
-			 * renew DHCP leases and such.
-			 */
+             * tagged for carrier ignore) ensure that when the carrier appears we
+             * renew DHCP leases and such.
+             */
             nm_device_update_dynamic_ip_setup(self);
         }
     } else {
@@ -5064,7 +5064,7 @@ device_recheck_slave_status(NMDevice *self, const NMPlatformLink *plink)
     if (priv->master) {
         if (plink->master > 0 && plink->master == nm_device_get_ifindex(priv->master)) {
             /* call add-slave again. We expect @self already to be added to
-			 * the master, but this also triggers a recheck-assume. */
+             * the master, but this also triggers a recheck-assume. */
             nm_device_master_add_slave(priv->master, self, FALSE);
             return;
         }
@@ -5124,10 +5124,10 @@ ndisc_set_router_config(NMNDisc *ndisc, NMDevice *self)
             continue;
 
         /* resolve the timestamps relative to a new base.
-		 *
-		 * Note that for convenience, platform @addr might have timestamp and/or
-		 * lifetime unset. We don't allow that flexibility for ndisc and require
-		 * well defined timestamps. */
+         *
+         * Note that for convenience, platform @addr might have timestamp and/or
+         * lifetime unset. We don't allow that flexibility for ndisc and require
+         * well defined timestamps. */
         if (addr->timestamp) {
             nm_assert(addr->timestamp < G_MAXINT32);
             base = addr->timestamp;
@@ -5290,8 +5290,8 @@ device_link_changed(NMDevice *self)
         nm_device_recheck_available_connections(self);
 
         /* Let any connections that use the new interface name have a chance
-		 * to auto-activate on the device.
-		 */
+         * to auto-activate on the device.
+         */
         nm_device_emit_recheck_auto_activate(self);
     }
 
@@ -5325,16 +5325,16 @@ device_link_changed(NMDevice *self)
         reason = NM_DEVICE_STATE_REASON_NOW_MANAGED;
 
         /* If the device is a external-down candidated but no longer has external
-		 * down set, we must clear the platform-unmanaged flag with reason
-		 * "assumed". */
+         * down set, we must clear the platform-unmanaged flag with reason
+         * "assumed". */
         if (nm_device_get_unmanaged_mask(self, NM_UNMANAGED_EXTERNAL_DOWN)
             && !nm_device_get_unmanaged_flags(self, NM_UNMANAGED_EXTERNAL_DOWN)) {
             /* actually, user-udev overwrites external-down. So we only assume the device,
-			 * when it is a external-down candidate, which is not managed via udev. */
+             * when it is a external-down candidate, which is not managed via udev. */
             if (!nm_device_get_unmanaged_mask(self, NM_UNMANAGED_USER_UDEV)) {
                 /* Ensure the assume check is queued before any queued state changes
-				 * from the transition to UNAVAILABLE.
-				 */
+                 * from the transition to UNAVAILABLE.
+                 */
                 nm_device_queue_recheck_assume(self);
                 reason = NM_DEVICE_STATE_REASON_CONNECTION_ASSUMED;
             }
@@ -5349,7 +5349,7 @@ device_link_changed(NMDevice *self)
 
     if (priv->up && (!was_up || seen_down)) {
         /* the link was down and just came up. That happens for example, while changing MTU.
-		 * We must restore IP configuration. */
+         * We must restore IP configuration. */
         if (NM_IN_SET(priv->ip_state_4, NM_DEVICE_IP_STATE_CONF, NM_DEVICE_IP_STATE_DONE)) {
             if (!ip_config_merge_and_apply(self, AF_INET, TRUE))
                 _LOGW(LOGD_IP4, "failed applying IP4 config after link comes up again");
@@ -5367,10 +5367,10 @@ device_link_changed(NMDevice *self)
 
     if (got_hw_addr && !priv->up && nm_device_get_state(self) == NM_DEVICE_STATE_UNAVAILABLE) {
         /*
-		 * If the device is UNAVAILABLE, any previous try to
-		 * bring it up probably has failed because of the
-		 * invalid hardware address; try again.
-		 */
+         * If the device is UNAVAILABLE, any previous try to
+         * bring it up probably has failed because of the
+         * invalid hardware address; try again.
+         */
         nm_device_bring_up(self, TRUE, NULL);
         nm_device_queue_recheck_available(self,
                                           NM_DEVICE_STATE_REASON_NONE,
@@ -5781,23 +5781,23 @@ sriov_op_queue(NMDevice *              self,
     SriovOp *op;
 
     /* We usually never want to cancel an async write operation, unless it's superseded
-	 * by a newer operation (that resets the state). That is, because we need to ensure
-	 * that we never end up doing two concurrent writes (since we write on a background
-	 * thread, that would be unordered/racy).
-	 * Of course, since we queue requests only per-device, when devices get renamed we
-	 * might end up writing the same sysctl concurrently still. But that's really
-	 * unlikely, and don't rename after udev completes!
-	 *
-	 * The "next" operation is not yet even started. It can be replaced/canceled right away
-	 * when a newer request comes.
-	 * The "pending" operation is currently ongoing, and we may cancel it if
-	 * we have a follow-up operation (queued in "next"). Unless we have a such
-	 * a newer request, we cannot cancel it!
-	 *
-	 * FIXME(shutdown): However, during shutdown we don't have a follow-up write request to cancel
-	 * this operation and we have to give it at least some time to complete. The solution is that
-	 * we register a way to abort the last call during shutdown, and after NM_SHUTDOWN_TIMEOUT_MS
-	 * grace period we pull the plug and cancel it. */
+     * by a newer operation (that resets the state). That is, because we need to ensure
+     * that we never end up doing two concurrent writes (since we write on a background
+     * thread, that would be unordered/racy).
+     * Of course, since we queue requests only per-device, when devices get renamed we
+     * might end up writing the same sysctl concurrently still. But that's really
+     * unlikely, and don't rename after udev completes!
+     *
+     * The "next" operation is not yet even started. It can be replaced/canceled right away
+     * when a newer request comes.
+     * The "pending" operation is currently ongoing, and we may cancel it if
+     * we have a follow-up operation (queued in "next"). Unless we have a such
+     * a newer request, we cannot cancel it!
+     *
+     * FIXME(shutdown): However, during shutdown we don't have a follow-up write request to cancel
+     * this operation and we have to give it at least some time to complete. The solution is that
+     * we register a way to abort the last call during shutdown, and after NM_SHUTDOWN_TIMEOUT_MS
+     * grace period we pull the plug and cancel it. */
 
     op  = g_slice_new(SriovOp);
     *op = (SriovOp){
@@ -5847,7 +5847,7 @@ static void
 realize_start_notify(NMDevice *self, const NMPlatformLink *pllink)
 {
     /* the default implementation of realize_start_notify() just calls
-	 * link_changed() -- which by default does nothing. */
+     * link_changed() -- which by default does nothing. */
     NM_DEVICE_GET_CLASS(self)->link_changed(self, pllink);
 }
 
@@ -5888,7 +5888,7 @@ realize_start_setup(NMDevice *            self,
     gboolean             unmanaged;
 
     /* plink is a NMPlatformLink type, however, we require it to come from the platform
-	 * cache (where else would it come from?). */
+     * cache (where else would it come from?). */
     nm_assert(!plink || NMP_OBJECT_GET_TYPE(NMP_OBJECT_UP_CAST(plink)) == NMP_OBJECT_TYPE_LINK);
 
     g_return_if_fail(NM_IS_DEVICE(self));
@@ -5998,14 +5998,14 @@ realize_start_setup(NMDevice *            self,
     nm_device_set_unmanaged_flags(self, NM_UNMANAGED_USER_EXPLICIT, unmanaged_user_explicit);
 
     /* Do not manage externally created software devices until they are IFF_UP
-	 * or have IP addressing */
+     * or have IP addressing */
     nm_device_set_unmanaged_flags(self,
                                   NM_UNMANAGED_EXTERNAL_DOWN,
                                   is_unmanaged_external_down(self, TRUE));
 
     /* Unmanaged the loopback device with an explicit NM_UNMANAGED_BY_TYPE flag.
-	 * Later we might want to manage 'lo' too. Currently, that doesn't work because
-	 * NetworkManager might down the interface or remove the 127.0.0.1 address. */
+     * Later we might want to manage 'lo' too. Currently, that doesn't work because
+     * NetworkManager might down the interface or remove the 127.0.0.1 address. */
     nm_device_set_unmanaged_flags(self, NM_UNMANAGED_BY_TYPE, is_loopback(self));
 
     nm_device_set_unmanaged_by_user_udev(self);
@@ -6056,8 +6056,8 @@ static void
 unrealize_notify(NMDevice *self)
 {
     /* Stub implementation for unrealize_notify(). It does nothing,
-	 * but allows derived classes to uniformly invoke the parent
-	 * implementation. */
+     * but allows derived classes to uniformly invoke the parent
+     * implementation. */
 }
 
 static gboolean
@@ -6229,8 +6229,8 @@ nm_device_notify_availability_maybe_changed(NMDevice *self)
         return;
 
     /* A device could have stayed disconnected because it would
-	 * want to register with a network server that now become
-	 * available. */
+     * want to register with a network server that now become
+     * available. */
     nm_device_recheck_available_connections(self);
     if (g_hash_table_size(priv->available_connections) > 0)
         nm_device_emit_recheck_auto_activate(self);
@@ -6378,11 +6378,11 @@ nm_device_master_add_slave(NMDevice *self, NMDevice *slave, gboolean configure)
         _active_connection_set_state_flags(self, NM_ACTIVATION_STATE_FLAG_MASTER_HAS_SLAVES);
 
         /* no need to emit
-		 *
-		 *   _notify (slave, PROP_MASTER);
-		 *
-		 * because slave_priv->is_enslaved is not true, thus the value
-		 * didn't change yet. */
+         *
+         *   _notify (slave, PROP_MASTER);
+         *
+         * because slave_priv->is_enslaved is not true, thus the value
+         * didn't change yet. */
 
         g_warn_if_fail(!NM_FLAGS_HAS(slave_priv->unmanaged_mask, NM_UNMANAGED_IS_SLAVE));
         nm_device_set_unmanaged_by_flags(slave,
@@ -6432,10 +6432,10 @@ nm_device_master_check_slave_physical_port(NMDevice *self, NMDevice *slave, NMLo
                   nm_device_get_ip_iface(slave),
                   nm_device_get_ip_iface(info->slave));
             /* Since this function will get called for every slave, we only have
-			 * to warn about the first match we find; if there are other matches
-			 * later in the list, we will have already warned about them matching
-			 * @existing earlier.
-			 */
+             * to warn about the first match we find; if there are other matches
+             * later in the list, we will have already warned about them matching
+             * @existing earlier.
+             */
             return;
         }
     }
@@ -6537,7 +6537,7 @@ check_ip_state(NMDevice *self, gboolean may_fail, gboolean full_state_update)
         return;
 
     /* Don't progress into IP_CHECK or SECONDARIES if we're waiting for the
-	 * master to enslave us. */
+     * master to enslave us. */
     if (nm_active_connection_get_master(NM_ACTIVE_CONNECTION(priv->act_request.obj))
         && !priv->is_enslaved)
         return;
@@ -6566,17 +6566,17 @@ check_ip_state(NMDevice *self, gboolean may_fail, gboolean full_state_update)
         && (priv->ip_state_6 == NM_DEVICE_IP_STATE_FAIL
             || (ip6_disabled && priv->ip_state_6 == NM_DEVICE_IP_STATE_DONE))) {
         /* Either both methods failed, or only one failed and the other is
-		 * disabled */
+         * disabled */
         if (nm_device_sys_iface_state_is_external_or_assume(self)) {
             /* We have assumed configuration, but couldn't redo it. No problem,
-			 * move to check state. */
+             * move to check state. */
             _set_ip_state(self, AF_INET, NM_DEVICE_IP_STATE_DONE);
             _set_ip_state(self, AF_INET6, NM_DEVICE_IP_STATE_DONE);
             state = NM_DEVICE_STATE_IP_CHECK;
         } else if (may_fail && get_ip_config_may_fail(self, AF_INET)
                    && get_ip_config_may_fail(self, AF_INET6)) {
             /* Couldn't start either IPv6 and IPv4 autoconfiguration,
-			 * but both are allowed to fail. */
+             * but both are allowed to fail. */
             state = NM_DEVICE_STATE_SECONDARIES;
         } else {
             /* Autoconfiguration attempted without success. */
@@ -6721,7 +6721,7 @@ nm_device_removed(NMDevice *self, gboolean unconfigure_ip_config)
     priv = NM_DEVICE_GET_PRIVATE(self);
     if (priv->master) {
         /* this is called when something externally messes with the slave or during shut-down.
-		 * Release the slave from master, but don't touch the device. */
+         * Release the slave from master, but don't touch the device. */
         nm_device_master_release_one_slave(priv->master,
                                            self,
                                            FALSE,
@@ -6919,11 +6919,11 @@ nm_device_autoconnect_allowed(NMDevice *self)
         return FALSE;
 
     /* The 'autoconnect-allowed' signal is emitted on a device to allow
-	 * other listeners to block autoconnect on the device if they wish.
-	 * This is mainly used by the OLPC Mesh devices to block autoconnect
-	 * on their companion Wi-Fi device as they share radio resources and
-	 * cannot be connected at the same time.
-	 */
+     * other listeners to block autoconnect on the device if they wish.
+     * This is mainly used by the OLPC Mesh devices to block autoconnect
+     * on their companion Wi-Fi device as they share radio resources and
+     * cannot be connected at the same time.
+     */
 
     g_value_init(&instance, G_TYPE_OBJECT);
     g_value_set_object(&instance, self);
@@ -6932,7 +6932,7 @@ nm_device_autoconnect_allowed(NMDevice *self)
     g_value_set_boolean(&retval, TRUE);
 
     /* Use g_signal_emitv() rather than g_signal_emit() to avoid the return
-	 * value being changed if no handlers are connected */
+     * value being changed if no handlers are connected */
     g_signal_emitv(&instance, signals[AUTOCONNECT_ALLOWED], 0, &retval);
     g_value_unset(&instance);
 
@@ -6971,12 +6971,12 @@ nm_device_can_auto_connect(NMDevice *self, NMSettingsConnection *sett_conn, char
     g_return_val_if_fail(!specific_object || !*specific_object, FALSE);
 
     /* the caller must ensure that nm_device_autoconnect_allowed() returns
-	 * TRUE as well. This is done, because nm_device_can_auto_connect()
-	 * has only one caller, and it iterates over a list of available
-	 * connections.
-	 *
-	 * Hence, we don't need to re-check nm_device_autoconnect_allowed()
-	 * over and over again. The caller is supposed to do that. */
+     * TRUE as well. This is done, because nm_device_can_auto_connect()
+     * has only one caller, and it iterates over a list of available
+     * connections.
+     *
+     * Hence, we don't need to re-check nm_device_autoconnect_allowed()
+     * over and over again. The caller is supposed to do that. */
     nm_assert(nm_device_autoconnect_allowed(self));
 
     if (!nm_device_check_connection_available(self,
@@ -7192,8 +7192,8 @@ nm_device_generate_connection(NMDevice *self,
     }
 
     /* Ignore the connection if it has no IP configuration,
-	 * no slave configuration, and is not a master interface.
-	 */
+     * no slave configuration, and is not a master interface.
+     */
     ip4_method = nm_utils_get_ip_config_method(connection, AF_INET);
     ip6_method = nm_utils_get_ip_config_method(connection, AF_INET6);
     if (nm_streq0(ip4_method, NM_SETTING_IP4_CONFIG_METHOD_DISABLED)
@@ -7212,8 +7212,8 @@ nm_device_generate_connection(NMDevice *self,
     }
 
     /* Ignore any IPv6LL-only, not master connections without slaves,
-	 * unless they are in the assume-ipv6ll-only list.
-	 */
+     * unless they are in the assume-ipv6ll-only list.
+     */
     if (nm_streq0(ip4_method, NM_SETTING_IP4_CONFIG_METHOD_DISABLED)
         && nm_streq0(ip6_method, NM_SETTING_IP6_CONFIG_METHOD_LINK_LOCAL)
         && !nm_setting_connection_get_master(NM_SETTING_CONNECTION(s_con))
@@ -7290,9 +7290,9 @@ nm_device_match_parent(NMDevice *self, const char *parent)
         NMConnection *connection;
 
         /* If the parent is a UUID, the connection matches when there is
-		 * no connection active on the device or when a connection with
-		 * that UUID is active.
-		 */
+         * no connection active on the device or when a connection with
+         * that UUID is active.
+         */
         connection = nm_device_get_applied_connection(parent_device);
         if (connection && !nm_streq0(parent, nm_connection_get_uuid(connection)))
             return FALSE;
@@ -7349,8 +7349,8 @@ check_connection_compatible(NMDevice *self, NMConnection *connection, GError **e
             return FALSE;
     } else if (klass->check_connection_compatible == check_connection_compatible) {
         /* the device class does not implement check_connection_compatible nor set
-		 * connection_type_check_compatible. That means, it is by default not compatible
-		 * with any connection type. */
+         * connection_type_check_compatible. That means, it is by default not compatible
+         * with any connection type. */
         nm_utils_error_set_literal(error,
                                    NM_UTILS_ERROR_CONNECTION_AVAILABLE_INCOMPATIBLE,
                                    "device does not support any connections");
@@ -7360,8 +7360,8 @@ check_connection_compatible(NMDevice *self, NMConnection *connection, GError **e
     conn_iface = nm_manager_get_connection_iface(NM_MANAGER_GET, connection, NULL, NULL, &local);
 
     /* We always need a interface name for virtual devices, but for
-	 * physical ones a connection without interface name is fine for
-	 * any device. */
+     * physical ones a connection without interface name is fine for
+     * any device. */
     if (!conn_iface) {
         if (nm_connection_is_virtual(connection)) {
             nm_utils_error_set(error,
@@ -7495,15 +7495,15 @@ unmanaged_on_quit(NMDevice *self)
     NMConnection *connection;
 
     /* NMDeviceWifi overwrites this function to always unmanage wifi devices.
-	 *
-	 * For all other types, if the device type can assume connections, we leave
-	 * it up on quit.
-	 *
-	 * Originally, we would only keep devices up that can be assumed afterwards.
-	 * However, that meant we unmanged layer-2 only devices. So, this was step
-	 * by step refined to unmanage less (commit 25aaaab3, rh#1311988, rh#1333983).
-	 * But there are more scenarios where we also want to keep the device up
-	 * (rh#1378418, rh#1371126). */
+     *
+     * For all other types, if the device type can assume connections, we leave
+     * it up on quit.
+     *
+     * Originally, we would only keep devices up that can be assumed afterwards.
+     * However, that meant we unmanged layer-2 only devices. So, this was step
+     * by step refined to unmanage less (commit 25aaaab3, rh#1311988, rh#1333983).
+     * But there are more scenarios where we also want to keep the device up
+     * (rh#1378418, rh#1371126). */
     if (!nm_device_can_assume_connections(self))
         return TRUE;
 
@@ -8027,10 +8027,10 @@ activate_stage1_device_prepare(NMDevice *self)
             }
 
             /* When changing the number of VFs the kernel can block
-			 * for very long time in the write to sysfs, especially
-			 * if autoprobe-drivers is enabled. Do it asynchronously
-			 * to avoid blocking the entire NM process.
-			 */
+             * for very long time in the write to sysfs, especially
+             * if autoprobe-drivers is enabled. Do it asynchronously
+             * to avoid blocking the entire NM process.
+             */
             sriov_op_queue(self,
                            nm_setting_sriov_get_total_vfs(s_sriov),
                            autoprobe,
@@ -8221,8 +8221,8 @@ _routing_rules_sync(NMDevice *self, NMTernary set_mode)
                 nm_ip_routing_rule_to_platform(rule, &plrule);
 
                 /* We track this rule, but we also make it explicitly not weakly-tracked
-				 * (meaning to untrack NMP_RULES_MANAGER_EXTERN_WEAKLY_TRACKED_USER_TAG at
-				 * the same time). */
+                 * (meaning to untrack NMP_RULES_MANAGER_EXTERN_WEAKLY_TRACKED_USER_TAG at
+                 * the same time). */
                 nmp_rules_manager_track(rules_manager,
                                         &plrule,
                                         10,
@@ -8254,18 +8254,18 @@ _routing_rules_sync(NMDevice *self, NMTernary set_mode)
     keep_deleted_rules = FALSE;
     if (set_mode == NM_TERNARY_DEFAULT) {
         /* when exiting NM, we leave the device up and the rules configured.
-		 * We just all nmp_rules_manager_sync() to forget about the synced rules,
-		 * but we don't actually delete them.
-		 *
-		 * FIXME: that is a problem after restart of NetworkManager, because these
-		 * rules will look like externally added, and NM will no longer remove
-		 * them.
-		 * To fix that, we could during "assume" mark the rules of the profile
-		 * as owned (and "added" by the device). The problem with that is that it
-		 * wouldn't cover rules that devices add by internal decision (not because
-		 * of a setting in the profile, e.g. WireGuard could setup policy routing).
-		 * Maybe it would be better to remember these orphaned rules at exit in a
-		 * file and track them after restart again. */
+         * We just all nmp_rules_manager_sync() to forget about the synced rules,
+         * but we don't actually delete them.
+         *
+         * FIXME: that is a problem after restart of NetworkManager, because these
+         * rules will look like externally added, and NM will no longer remove
+         * them.
+         * To fix that, we could during "assume" mark the rules of the profile
+         * as owned (and "added" by the device). The problem with that is that it
+         * wouldn't cover rules that devices add by internal decision (not because
+         * of a setting in the profile, e.g. WireGuard could setup policy routing).
+         * Maybe it would be better to remember these orphaned rules at exit in a
+         * file and track them after restart again. */
         keep_deleted_rules = TRUE;
     }
     nmp_rules_manager_sync(rules_manager, keep_deleted_rules);
@@ -8850,7 +8850,7 @@ ip_config_merge_and_apply(NMDevice *self, int addr_family, gboolean commit)
             ignore_auto_dns    = nm_setting_ip_config_get_ignore_auto_dns(s_ip);
 
             /* if the connection has an explicit gateway, we also ignore
-			 * the default routes from other sources. */
+             * the default routes from other sources. */
             ignore_default_routes = nm_setting_ip_config_get_never_default(s_ip)
                                     || nm_setting_ip_config_get_gateway(s_ip);
 
@@ -8962,8 +8962,8 @@ ip_config_merge_and_apply(NMDevice *self, int addr_family, gboolean commit)
                            0);
 
     /* Merge WWAN config *last* to ensure modem-given settings overwrite
-	 * any external stuff set by pppd or other scripts.
-	 */
+     * any external stuff set by pppd or other scripts.
+     */
     config = applied_config_get_current(&priv->dev2_ip_config_x[IS_IPv4]);
     if (config) {
         nm_ip_config_merge(composite,
@@ -8989,7 +8989,7 @@ ip_config_merge_and_apply(NMDevice *self, int addr_family, gboolean commit)
     }
 
     /* Merge user overrides into the composite config. For assumed connections,
-	 * con_ip_config_x is empty. */
+     * con_ip_config_x is empty. */
     if (priv->con_ip_config_x[IS_IPv4]) {
         nm_ip_config_merge(composite,
                            priv->con_ip_config_x[IS_IPv4],
@@ -9060,9 +9060,9 @@ dhcp4_lease_change(NMDevice *self, NMIP4Config *config, gboolean bound)
     }
 
     /* TODO: we should perform DAD again whenever we obtain a
-	 * new lease after an expiry. But what should we do if
-	 * a duplicate address is detected? Fail the connection;
-	 * restart DHCP; continue without an address? */
+     * new lease after an expiry. But what should we do if
+     * a duplicate address is detected? Fail the connection;
+     * restart DHCP; continue without an address? */
     if (bound && !nm_dhcp_client_accept(priv->dhcp_data_4.client, &error)) {
         _LOGW(LOGD_DHCP4, "error accepting lease: %s", error->message);
         return FALSE;
@@ -9112,15 +9112,15 @@ dhcp_grace_period_start(NMDevice *self, int addr_family)
     guint32          timeout;
 
     /* In any other case (expired lease, assumed connection, etc.),
-	 * wait for some time before failing the IP method.
-	 */
+     * wait for some time before failing the IP method.
+     */
     if (priv->dhcp_data_x[IS_IPv4].grace_pending) {
         /* already pending. */
         return FALSE;
     }
 
     /* Start a grace period equal to the DHCP timeout multiplied
-	 * by a constant factor. */
+     * by a constant factor. */
     timeout = _prop_get_ipvx_dhcp_timeout(self, addr_family);
     if (timeout == NM_DHCP_TIMEOUT_INFINITY)
         _LOGI(LOGD_DHCP_from_addr_family(addr_family),
@@ -9160,18 +9160,18 @@ dhcp4_fail(NMDevice *self, NMDhcpState dhcp_state)
         goto clear_config;
 
     /* ... and also if there are static addresses configured
-	 * on the interface.
-	 */
+     * on the interface.
+     */
     if (priv->ip_state_4 == NM_DEVICE_IP_STATE_DONE && priv->con_ip_config_4
         && nm_ip4_config_get_num_addresses(priv->con_ip_config_4) > 0)
         goto clear_config;
 
     /* Fail the method when one of the following is true:
-	 * 1) the DHCP client terminated: it does not make sense to start a grace
-	 *    period without a client running;
-	 * 2) we failed to get an initial lease AND the client was
-	 *    not active before.
-	 */
+     * 1) the DHCP client terminated: it does not make sense to start a grace
+     *    period without a client running;
+     * 2) we failed to get an initial lease AND the client was
+     *    not active before.
+     */
     if (dhcp_state == NM_DHCP_STATE_TERMINATED
         || (!priv->dhcp_data_4.was_active && priv->ip_state_4 == NM_DEVICE_IP_STATE_CONF)) {
         nm_device_activate_schedule_ip_config_timeout(self, AF_INET);
@@ -9235,8 +9235,8 @@ dhcp4_state_changed(NMDhcpClient *client,
         priv->dhcp_data_4.grace_pending = FALSE;
 
         /* After some failures, we have been able to renew the lease:
-		 * update the ip state
-		 */
+         * update the ip state
+         */
         if (priv->ip_state_4 == NM_DEVICE_IP_STATE_FAIL)
             _set_ip_state(self, AF_INET, NM_DEVICE_IP_STATE_CONF);
 
@@ -9459,7 +9459,7 @@ connection_requires_carrier(NMConnection *connection)
     gboolean             ip4_used = FALSE, ip6_used = FALSE;
 
     /* We can progress to IP_CONFIG now, so that we're enslaved.
-	 * That may actually cause carrier to go up and thus continue activation. */
+     * That may actually cause carrier to go up and thus continue activation. */
     s_con = nm_connection_get_setting_connection(connection);
     if (nm_setting_connection_get_master(s_con))
         return FALSE;
@@ -9467,8 +9467,8 @@ connection_requires_carrier(NMConnection *connection)
     ip4_carrier_wanted = connection_ip_method_requires_carrier(connection, AF_INET, &ip4_used);
     if (ip4_carrier_wanted) {
         /* If IPv4 wants a carrier and cannot fail, the whole connection
-		 * requires a carrier regardless of the IPv6 method.
-		 */
+         * requires a carrier regardless of the IPv6 method.
+         */
         s_ip4 = nm_connection_get_setting_ip4_config(connection);
         if (s_ip4 && !nm_setting_ip_config_get_may_fail(s_ip4))
             return TRUE;
@@ -9477,16 +9477,16 @@ connection_requires_carrier(NMConnection *connection)
     ip6_carrier_wanted = connection_ip_method_requires_carrier(connection, AF_INET6, &ip6_used);
     if (ip6_carrier_wanted) {
         /* If IPv6 wants a carrier and cannot fail, the whole connection
-		 * requires a carrier regardless of the IPv4 method.
-		 */
+         * requires a carrier regardless of the IPv4 method.
+         */
         s_ip6 = nm_connection_get_setting_ip6_config(connection);
         if (s_ip6 && !nm_setting_ip_config_get_may_fail(s_ip6))
             return TRUE;
     }
 
     /* If an IP version wants a carrier and the other IP version isn't
-	 * used, the connection requires carrier since it will just fail without one.
-	 */
+     * used, the connection requires carrier since it will just fail without one.
+     */
     if (ip4_carrier_wanted && !ip6_used)
         return TRUE;
     if (ip6_carrier_wanted && !ip4_used)
@@ -9504,9 +9504,9 @@ have_any_ready_slaves(NMDevice *self)
     CList *          iter;
 
     /* Any enslaved slave is "ready" in the generic case as it's
-	 * at least >= NM_DEVCIE_STATE_IP_CONFIG and has had Layer 2
-	 * properties set up.
-	 */
+     * at least >= NM_DEVCIE_STATE_IP_CONFIG and has had Layer 2
+     * properties set up.
+     */
     c_list_for_each (iter, &priv->slaves) {
         info = c_list_entry(iter, SlaveInfo, lst_slave);
         if (NM_DEVICE_GET_PRIVATE(info->slave)->is_enslaved)
@@ -9594,18 +9594,18 @@ dhcp6_fail(NMDevice *self, NMDhcpState dhcp_state)
 
     if (is_dhcp_managed) {
         /* ... and also if there are static addresses configured
-		 * on the interface.
-		 */
+         * on the interface.
+         */
         if (priv->ip_state_6 == NM_DEVICE_IP_STATE_DONE && priv->con_ip_config_6
             && nm_ip6_config_get_num_addresses(priv->con_ip_config_6))
             goto clear_config;
 
         /* Fail the method when one of the following is true:
-		 * 1) the DHCP client terminated: it does not make sense to start a grace
-		 *    period without a client running;
-		 * 2) we failed to get an initial lease AND the client was
-		 *    not active before.
-		 */
+         * 1) the DHCP client terminated: it does not make sense to start a grace
+         *    period without a client running;
+         * 2) we failed to get an initial lease AND the client was
+         *    not active before.
+         */
         if (dhcp_state == NM_DHCP_STATE_TERMINATED
             || (!priv->dhcp_data_6.was_active && priv->ip_state_6 == NM_DEVICE_IP_STATE_CONF)) {
             nm_device_activate_schedule_ip_config_timeout(self, AF_INET6);
@@ -9653,9 +9653,9 @@ dhcp6_state_changed(NMDhcpClient *client,
         nm_clear_g_source(&priv->dhcp_data_6.grace_id);
         priv->dhcp_data_6.grace_pending = FALSE;
         /* If the server sends multiple IPv6 addresses, we receive a state
-		 * changed event for each of them. Use the event ID to merge IPv6
-		 * addresses from the same transaction into a single configuration.
-		 */
+         * changed event for each of them. Use the event ID to merge IPv6
+         * addresses from the same transaction into a single configuration.
+         */
 
         event_id = nm_dhcp_utils_get_dhcp6_event_id(options);
 
@@ -9678,8 +9678,8 @@ dhcp6_state_changed(NMDhcpClient *client,
         }
 
         /* After long time we have been able to renew the lease:
-		 * update the ip state
-		 */
+         * update the ip state
+         */
         if (priv->ip_state_6 == NM_DEVICE_IP_STATE_FAIL)
             _set_ip_state(self, AF_INET6, NM_DEVICE_IP_STATE_CONF);
 
@@ -9710,9 +9710,9 @@ dhcp6_state_changed(NMDhcpClient *client,
         break;
     case NM_DHCP_STATE_TERMINATED:
         /* In IPv6 info-only mode, the client doesn't handle leases so it
-		 * may exit right after getting a response from the server.  That's
-		 * normal.  In that case we just ignore the exit.
-		 */
+         * may exit right after getting a response from the server.  That's
+         * normal.  In that case we just ignore the exit.
+         */
         if (priv->dhcp6.mode == NM_NDISC_DHCP_LEVEL_OTHERCONF)
             break;
         /* fall-through */
@@ -9731,8 +9731,8 @@ dhcp6_prefix_delegated(NMDhcpClient *client, NMPlatformIP6Address *prefix, gpoin
     NMDevice *self = NM_DEVICE(user_data);
 
     /* Just re-emit. The device just contributes the prefix to the
-	 * pool in NMPolicy, which decides about subnet allocation
-	 * on the shared devices. */
+     * pool in NMPolicy, which decides about subnet allocation
+     * on the shared devices. */
     g_signal_emit(self, signals[IP6_PREFIX_DELEGATED], 0, prefix);
 }
 
@@ -10089,7 +10089,7 @@ check_and_add_ipv6ll_addr(NMDevice *self)
 
         if (priv->linklocal6_timeout_id) {
             /* We already started and attempt to add a LL address. For the EUI-64
-			 * mode we can't pick a new one, we'll just fail. */
+             * mode we can't pick a new one, we'll just fail. */
             _LOGW(LOGD_IP6, "linklocal6: DAD failed for an EUI-64 address");
             linklocal6_failed(self);
             return;
@@ -10133,10 +10133,10 @@ linklocal6_start(NMDevice *self)
     check_and_add_ipv6ll_addr(self);
 
     /* Depending on the network and what the 'dad_transmits' and 'retrans_time_ms'
-	 * sysctl values are, DAD for the IPv6LL address may take quite a while.
-	 * FIXME: use dad/retrans sysctl values if they are higher than a minimum time.
-	 * (rh #1101809)
-	 */
+     * sysctl values are, DAD for the IPv6LL address may take quite a while.
+     * FIXME: use dad/retrans sysctl values if they are higher than a minimum time.
+     * (rh #1101809)
+     */
     priv->linklocal6_timeout_id = g_timeout_add_seconds(15, linklocal6_timeout_cb, self);
     return FALSE;
 }
@@ -10247,9 +10247,9 @@ nm_device_get_configured_mtu_wired_parent(NMDevice *         self,
 
     if (parent_mtu && mtu > parent_mtu) {
         /* Trying to set a MTU that is out of range from configuration:
-		 * fall back to the parent MTU and set force flag so that it
-		 * overrides an MTU with higher priority already configured.
-		 */
+         * fall back to the parent MTU and set force flag so that it
+         * overrides an MTU with higher priority already configured.
+         */
         *out_source = NM_DEVICE_MTU_SOURCE_PARENT;
         *out_force  = TRUE;
         return parent_mtu;
@@ -10284,9 +10284,9 @@ _set_mtu(NMDevice *self, guint32 mtu)
 
     if (priv->master) {
         /* changing the MTU of a slave, might require the master to reset
-		 * its MTU. Note that the master usually cannot set a MTU larger
-		 * then the slave's. Hence, when the slave increases the MTU,
-		 * master might want to retry setting the MTU. */
+         * its MTU. Note that the master usually cannot set a MTU larger
+         * then the slave's. Hence, when the slave increases the MTU,
+         * master might want to retry setting the MTU. */
         nm_device_commit_mtu(priv->master);
     }
 }
@@ -10325,7 +10325,7 @@ _commit_mtu(NMDevice *self, const NMIP4Config *config)
     if (!nm_device_get_applied_connection(self)
         || nm_device_sys_iface_state_is_external_or_assume(self)) {
         /* we don't tamper with the MTU of disconnected and
-		 * external/assumed devices. */
+         * external/assumed devices. */
         return;
     }
 
@@ -10334,25 +10334,25 @@ _commit_mtu(NMDevice *self, const NMIP4Config *config)
         gboolean force = FALSE;
 
         /* We take the MTU from various sources: (in order of increasing
-		 * priority) parent link, IP configuration (which contains the
-		 * MTU from DHCP/PPP), connection profile.
-		 *
-		 * We could just compare it with the platform MTU and apply it
-		 * when different, but this would revert at random times manual
-		 * changes done by the user with the MTU from the connection.
-		 *
-		 * Instead, we remember the source of the currently configured
-		 * MTU and apply the new one only when the new source has a
-		 * higher priority, so that we don't set a MTU from same source
-		 * multiple times. An exception to this is for the PARENT
-		 * source, since we need to keep tracking the parent MTU when it
-		 * changes.
-		 *
-		 * The subclass can set the @force argument to TRUE to signal that the
-		 * returned MTU should be applied even if it has a lower priority. This
-		 * is useful when the value from a lower source should
-		 * preempt the one from higher ones.
-		 */
+         * priority) parent link, IP configuration (which contains the
+         * MTU from DHCP/PPP), connection profile.
+         *
+         * We could just compare it with the platform MTU and apply it
+         * when different, but this would revert at random times manual
+         * changes done by the user with the MTU from the connection.
+         *
+         * Instead, we remember the source of the currently configured
+         * MTU and apply the new one only when the new source has a
+         * higher priority, so that we don't set a MTU from same source
+         * multiple times. An exception to this is for the PARENT
+         * source, since we need to keep tracking the parent MTU when it
+         * changes.
+         *
+         * The subclass can set the @force argument to TRUE to signal that the
+         * returned MTU should be applied even if it has a lower priority. This
+         * is useful when the value from a lower source should
+         * preempt the one from higher ones.
+         */
 
         if (NM_DEVICE_GET_CLASS(self)->get_configured_mtu)
             mtu = NM_DEVICE_GET_CLASS(self)->get_configured_mtu(self, &source, &force);
@@ -10393,11 +10393,11 @@ _commit_mtu(NMDevice *self, const NMIP4Config *config)
                              NM_SETTING_IP6_CONFIG_METHOD_IGNORE,
                              NM_SETTING_IP6_CONFIG_METHOD_DISABLED)) {
             /* the interface has IPv6 enabled. The MTU with IPv6 cannot be smaller
-			 * then 1280.
-			 *
-			 * For slave-devices (that don't have @s_ip6 we) don't do this fixup because
-			 * it's anyway an unsolved problem when the slave configures a conflicting
-			 * MTU. */
+             * then 1280.
+             *
+             * For slave-devices (that don't have @s_ip6 we) don't do this fixup because
+             * it's anyway an unsolved problem when the slave configures a conflicting
+             * MTU. */
             mtu_desired = 1280;
         }
     }
@@ -10405,8 +10405,8 @@ _commit_mtu(NMDevice *self, const NMIP4Config *config)
     ip6_mtu = priv->ip6_mtu;
     if (!ip6_mtu && priv->mtu_source == NM_DEVICE_MTU_SOURCE_NONE) {
         /* initially, if the IPv6 MTU is not specified, grow it as large as the
-		 * link MTU @mtu_desired. Only exception is, if @mtu_desired is so small
-		 * to disable IPv6. */
+         * link MTU @mtu_desired. Only exception is, if @mtu_desired is so small
+         * to disable IPv6. */
         if (mtu_desired >= 1280)
             ip6_mtu = mtu_desired;
     }
@@ -10462,7 +10462,7 @@ _commit_mtu(NMDevice *self, const NMIP4Config *config)
 
         if (!priv->mtu_initial && !priv->ip6_mtu_initial) {
             /* before touching any of the MTU parameters, record the
-			 * original setting to restore on deactivation. */
+             * original setting to restore on deactivation. */
             priv->mtu_initial     = mtu_plat;
             priv->ip6_mtu_initial = _IP6_MTU_SYS();
         }
@@ -10554,9 +10554,9 @@ ndisc_config_changed(NMNDisc *ndisc, const NMNDiscData *rdata, guint changed_int
         guint32 ifa_flags;
 
         /* Check, whether kernel is recent enough to help user space handling RA.
-		 * If it's not supported, we have no ipv6-privacy and must add autoconf
-		 * addresses as /128. The reason for the /128 is to prevent the kernel
-		 * from adding a prefix route for this address. */
+         * If it's not supported, we have no ipv6-privacy and must add autoconf
+         * addresses as /128. The reason for the /128 is to prevent the kernel
+         * from adding a prefix route for this address. */
         ifa_flags = 0;
         if (nm_platform_kernel_support_get(NM_PLATFORM_KERNEL_SUPPORT_TYPE_EXTENDED_IFA_FLAGS)) {
             ifa_flags |= IFA_F_NOPREFIXROUTE;
@@ -10674,20 +10674,20 @@ ndisc_ra_timeout(NMNDisc *ndisc, NMDevice *self)
     NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self);
 
     /* We don't want to stop listening for router advertisements completely,
-	 * but instead let device activation continue activating.  If an RA
-	 * shows up later, we'll use it as long as the device is not disconnected.
-	 */
+     * but instead let device activation continue activating.  If an RA
+     * shows up later, we'll use it as long as the device is not disconnected.
+     */
 
     _LOGD(LOGD_IP6, "timed out waiting for IPv6 router advertisement");
     if (priv->ip_state_6 == NM_DEVICE_IP_STATE_CONF) {
         /* If RA is our only source of addressing information and we don't
-		 * ever receive one, then time out IPv6.  But if there is other
-		 * IPv6 configuration, like manual IPv6 addresses or external IPv6
-		 * config, consider that sufficient for IPv6 success.
-		 *
-		 * FIXME: it doesn't seem correct to determine this based on which
-		 *        addresses we find inside priv->ip_config_6.
-		 */
+         * ever receive one, then time out IPv6.  But if there is other
+         * IPv6 configuration, like manual IPv6 addresses or external IPv6
+         * config, consider that sufficient for IPv6 success.
+         *
+         * FIXME: it doesn't seem correct to determine this based on which
+         *        addresses we find inside priv->ip_config_6.
+         */
         if (priv->ip_config_6
             && nm_ip6_config_find_first_address(priv->ip_config_6,
                                                 NM_PLATFORM_MATCH_WITH_ADDRTYPE_NORMAL
@@ -10711,7 +10711,7 @@ addrconf6_start_with_link_ready(NMDevice *self)
         nm_ndisc_set_iid(priv->ndisc, iid);
     } else {
         /* Don't abort the addrconf at this point -- if ndisc needs the iid
-		 * it will notice this itself. */
+         * it will notice this itself. */
         _LOGI(LOGD_IP6, "addrconf6: no interface identifier; IPv6 address creation may fail");
     }
 
@@ -10959,8 +10959,8 @@ ip_requires_slaves(NMDevice *self, int addr_family)
         return nm_streq(method, NM_SETTING_IP4_CONFIG_METHOD_AUTO);
 
     /* SLAAC, DHCP, and Link-Local depend on connectivity (and thus slaves)
-	 * to complete addressing.  SLAAC and DHCP need a peer to provide a prefix.
-	 */
+     * to complete addressing.  SLAAC and DHCP need a peer to provide a prefix.
+     */
     return NM_IN_STRSET(method,
                         NM_SETTING_IP6_CONFIG_METHOD_AUTO,
                         NM_SETTING_IP6_CONFIG_METHOD_DHCP);
@@ -10994,8 +10994,8 @@ act_stage3_ip_config_start(NMDevice *           self,
 
     if (nm_device_is_master(self) && ip_requires_slaves(self, addr_family)) {
         /* If the master has no ready slaves, and depends on slaves for
-		 * a successful IP configuration attempt, then postpone IP addressing.
-		 */
+         * a successful IP configuration attempt, then postpone IP addressing.
+         */
         if (!have_any_ready_slaves(self)) {
             _LOGI(LOGD_DEVICE | LOGD_IP,
                   "IPv%c config waiting until slaves are ready",
@@ -11086,13 +11086,13 @@ act_stage3_ip_config_start(NMDevice *           self,
             if (!nm_device_sys_iface_state_is_external(self)) {
                 if (priv->master) {
                     /* If a device only has an IPv6 link-local address,
-					 * we don't generate an assumed connection. Therefore,
-					 * when a new slave connection (without IP configuration)
-					 * is activated on the device, the link-local address
-					 * remains configured. The IP configuration of an activated
-					 * slave should not depend on the previous state. Flush
-					 * addresses and routes on activation.
-					 */
+                     * we don't generate an assumed connection. Therefore,
+                     * when a new slave connection (without IP configuration)
+                     * is activated on the device, the link-local address
+                     * remains configured. The IP configuration of an activated
+                     * slave should not depend on the previous state. Flush
+                     * addresses and routes on activation.
+                     */
                     ifindex  = nm_device_get_ip_ifindex(self);
                     platform = nm_device_get_platform(self);
 
@@ -11107,9 +11107,9 @@ act_stage3_ip_config_start(NMDevice *           self,
                     gboolean ipv6ll_handle_old = priv->ipv6ll_handle;
 
                     /* When activating an IPv6 'ignore' connection we need to revert back
-					 * to kernel IPv6LL, but the kernel won't actually assign an address
-					 * to the interface until disable_ipv6 is bounced.
-					 */
+                     * to kernel IPv6LL, but the kernel won't actually assign an address
+                     * to the interface until disable_ipv6 is bounced.
+                     */
                     set_nm_ipv6ll(self, FALSE);
                     if (ipv6ll_handle_old)
                         nm_device_sysctl_ip_conf_set(self, AF_INET6, "disable_ipv6", "1");
@@ -11120,15 +11120,15 @@ act_stage3_ip_config_start(NMDevice *           self,
         }
 
         /* Ensure the MTU makes sense. If it was below 1280 the kernel would not
-		 * expose any ipv6 sysctls or allow presence of any addresses on the interface,
-		 * including LL, which * would make it impossible to autoconfigure MTU to a
-		 * correct value. */
+         * expose any ipv6 sysctls or allow presence of any addresses on the interface,
+         * including LL, which * would make it impossible to autoconfigure MTU to a
+         * correct value. */
         _commit_mtu(self, priv->ip_config_4);
 
         /* Any method past this point requires an IPv6LL address. Use NM-controlled
-		 * IPv6LL if this is not an assumed connection, since assumed connections
-		 * will already have IPv6 set up.
-		 */
+         * IPv6LL if this is not an assumed connection, since assumed connections
+         * will already have IPv6 set up.
+         */
         if (!nm_device_sys_iface_state_is_external_or_assume(self))
             set_nm_ipv6ll(self, TRUE);
 
@@ -11137,9 +11137,9 @@ act_stage3_ip_config_start(NMDevice *           self,
         set_disable_ipv6(self, "0");
 
         /* Synchronize external IPv6 configuration with kernel, since
-		 * linklocal6_start() uses the information there to determine if we can
-		 * proceed with the selected method (SLAAC, DHCP, link-local).
-		 */
+         * linklocal6_start() uses the information there to determine if we can
+         * proceed with the selected method (SLAAC, DHCP, link-local).
+         */
         nm_platform_process_events(nm_device_get_platform(self));
         g_clear_object(&priv->ext_ip6_config_captured);
         priv->ext_ip6_config_captured =
@@ -11272,8 +11272,8 @@ nm_device_activate_stage3_ip6_start(NMDevice *self)
         if (!ip6_config)
             ip6_config = nm_device_ip6_config_new(self);
         /* Here we get a static IPv6 config, like for Shared where it's
-		 * autogenerated or from modems where it comes from ModemManager.
-		 */
+         * autogenerated or from modems where it comes from ModemManager.
+         */
         nm_assert(!applied_config_get_current(&priv->ac_ip6_config));
         applied_config_init(&priv->ac_ip6_config, ip6_config);
         nm_device_activate_schedule_ip_config_result(self, AF_INET6, NULL);
@@ -11689,15 +11689,15 @@ start_sharing(NMDevice *self, NMIP4Config *config, GError **error)
     switch (nm_setting_connection_get_metered(s_con)) {
     case NM_METERED_YES:
         /* honor the metered flag. Note that reapply on the device does not affect
-		 * the metered setting. This is different from other profiles, where the
-		 * metered flag of an activated profile can be changed (reapplied). */
+         * the metered setting. This is different from other profiles, where the
+         * metered flag of an activated profile can be changed (reapplied). */
         announce_android_metered = TRUE;
         break;
     case NM_METERED_UNKNOWN:
         /* we pick up the current value and announce it. But again, we cannot update
-		 * the announced setting without restarting dnsmasq. That means, if the default
-		 * route changes w.r.t. being metered, then the shared connection does not get
-		 * updated before reactivating. */
+         * the announced setting without restarting dnsmasq. That means, if the default
+         * route changes w.r.t. being metered, then the shared connection does not get
+         * updated before reactivating. */
         announce_android_metered =
             NM_IN_SET(nm_manager_get_metered(NM_MANAGER_GET), NM_METERED_YES, NM_METERED_GUESS_YES);
         break;
@@ -11755,8 +11755,8 @@ nm_device_arp_announce(NMDevice *self)
         return;
 
     /* We only care about manually-configured addresses; DHCP- and autoip-configured
-	 * ones should already have been seen on the network at this point.
-	 */
+     * ones should already have been seen on the network at this point.
+     */
     connection = nm_device_get_applied_connection(self);
     if (!connection)
         return;
@@ -11839,8 +11839,8 @@ activate_stage5_ip_config_result_4(NMDevice *self)
     }
 
     /* If IPv4 wasn't the first to complete, and DHCP was used, then ensure
-	 * dispatcher scripts get the DHCP lease information.
-	 */
+     * dispatcher scripts get the DHCP lease information.
+     */
     if (priv->dhcp_data_4.client && nm_device_activate_ip4_state_in_conf(self)
         && (nm_device_get_state(self) > NM_DEVICE_STATE_IP_CONFIG)) {
         nm_dispatcher_call_device(NM_DISPATCHER_ACTION_DHCP4_CHANGE, self, NULL, NULL, NULL, NULL);
@@ -11853,9 +11853,9 @@ activate_stage5_ip_config_result_4(NMDevice *self)
         SlaveInfo *info;
 
         /* Skip announcement if there are no device enslaved, for two reasons:
-		 * 1) the master has a temporary MAC address until the first slave comes
-		 * 2) announcements are going to be dropped anyway without slaves
-		 */
+         * 1) the master has a temporary MAC address until the first slave comes
+         * 2) announcements are going to be dropped anyway without slaves
+         */
         do_announce = FALSE;
 
         c_list_for_each (iter, &priv->slaves) {
@@ -11893,8 +11893,8 @@ nm_device_activate_schedule_ip_config_result(NMDevice *self, int addr_family, NM
         applied_config_init(&priv->dev_ip_config_4, config);
     } else {
         /* If IP had previously failed, move it back to NM_DEVICE_IP_STATE_CONF since we
-		 * clearly now have configuration.
-		 */
+         * clearly now have configuration.
+         */
         if (priv->ip_state_6 == NM_DEVICE_IP_STATE_FAIL)
             _set_ip_state(self, AF_INET6, NM_DEVICE_IP_STATE_CONF);
     }
@@ -11966,8 +11966,8 @@ dad6_get_pending_addresses(NMDevice *self)
     }
 
     /* We are interested only in addresses that we have explicitly configured,
-	 * not in externally added ones.
-	 */
+     * not in externally added ones.
+     */
     for (i = 0; i < G_N_ELEMENTS(confs); i++) {
         if (!confs[i])
             continue;
@@ -12010,8 +12010,8 @@ activate_stage5_ip_config_result_6(NMDevice *self)
             && priv->ip_state_6 == NM_DEVICE_IP_STATE_CONF) {
             if (applied_config_get_current(&priv->dhcp6.ip6_config)) {
                 /* If IPv6 wasn't the first IP to complete, and DHCP was used,
-				 * then ensure dispatcher scripts get the DHCP lease information.
-				 */
+                 * then ensure dispatcher scripts get the DHCP lease information.
+                 */
                 nm_dispatcher_call_device(NM_DISPATCHER_ACTION_DHCP6_CHANGE,
                                           self,
                                           NULL,
@@ -12079,7 +12079,7 @@ act_request_set(NMDevice *self, NMActRequest *act_request)
         return;
 
     /* always clear the public flag. The few callers that set a new @act_request
-	 * don't want that the property is public yet.  */
+     * don't want that the property is public yet.  */
     nm_dbus_track_obj_path_set(&priv->act_request, act_request, FALSE);
 
     if (act_request) {
@@ -12352,11 +12352,11 @@ nm_device_reactivate_ip4_config(NMDevice *         self,
             gint64 metric_old, metric_new;
 
             /* For dynamic IP methods (DHCP, IPv4LL, WWAN) the route metric is
-			 * set at activation/renewal time using the value from static
-			 * configuration. To support runtime change we need to update the
-			 * dynamic configuration in place and tell the DHCP client the new
-			 * value to use for future renewals.
-			 */
+             * set at activation/renewal time using the value from static
+             * configuration. To support runtime change we need to update the
+             * dynamic configuration in place and tell the DHCP client the new
+             * value to use for future renewals.
+             */
             metric_old = nm_setting_ip_config_get_route_metric(s_ip4_old);
             metric_new = nm_setting_ip_config_get_route_metric(s_ip4_new);
 
@@ -12486,12 +12486,12 @@ can_reapply_change(NMDevice *  self,
 {
     if (nm_streq(setting_name, NM_SETTING_CONNECTION_SETTING_NAME)) {
         /* Whitelist allowed properties from "connection" setting which are
-		 * allowed to differ.
-		 *
-		 * This includes UUID, there is no principal problem with reapplying a
-		 * connection and changing its UUID. In fact, disallowing it makes it
-		 * cumbersome for the user to reapply any connection but the original
-		 * settings-connection. */
+         * allowed to differ.
+         *
+         * This includes UUID, there is no principal problem with reapplying a
+         * connection and changing its UUID. In fact, disallowing it makes it
+         * cumbersome for the user to reapply any connection but the original
+         * settings-connection. */
         return nm_device_hash_check_invalid_keys(diffs,
                                                  NM_SETTING_CONNECTION_SETTING_NAME,
                                                  error,
@@ -12584,8 +12584,8 @@ check_and_reapply_connection(NMDevice *    self,
     }
 
     /**************************************************************************
-	 * check for unsupported changes and reject to reapply
-	 *************************************************************************/
+     * check for unsupported changes and reject to reapply
+     *************************************************************************/
     if (diffs) {
         char *      setting_name;
         GHashTable *setting_diff;
@@ -12617,8 +12617,8 @@ check_and_reapply_connection(NMDevice *    self,
     }
 
     /**************************************************************************
-	 * Update applied connection
-	 *************************************************************************/
+     * Update applied connection
+     *************************************************************************/
 
     if (diffs)
         nm_active_connection_version_id_bump((NMActiveConnection *) priv->act_request.obj);
@@ -12637,8 +12637,8 @@ check_and_reapply_connection(NMDevice *    self,
             NMSettingConnection *s_con_a, *s_con_n;
 
             /* we allow re-applying a connection with differing ID, UUID, STABLE_ID and AUTOCONNECT.
-			 * This is for convenience but these values are not actually changeable. So, check
-			 * if they changed, and if the did revert to the original values. */
+             * This is for convenience but these values are not actually changeable. So, check
+             * if they changed, and if the did revert to the original values. */
             s_con_a = nm_connection_get_setting_connection(applied);
             s_con_n = nm_connection_get_setting_connection(connection);
 
@@ -12680,14 +12680,14 @@ check_and_reapply_connection(NMDevice *    self,
     priv->v6_route_table_initialized = FALSE;
 
     /**************************************************************************
-	 * Reapply changes
-	 *
-	 * Note that reapply_connection() is called as very first. This is for example
-	 * important for NMDeviceWireGuard, which implements coerce_route_table()
-	 * and get_extra_rules().
-	 * That is because NMDeviceWireGuard caches settings, so during reapply that
-	 * cache must be updated *first*.
-	 *************************************************************************/
+     * Reapply changes
+     *
+     * Note that reapply_connection() is called as very first. This is for example
+     * important for NMDeviceWireGuard, which implements coerce_route_table()
+     * and get_extra_rules().
+     * That is because NMDeviceWireGuard caches settings, so during reapply that
+     * cache must be updated *first*.
+     *************************************************************************/
     klass->reapply_connection(self, con_old, con_new);
 
     if (priv->state >= NM_DEVICE_STATE_CONFIG)
@@ -13225,15 +13225,15 @@ _device_activate(NMDevice *self, NMActRequest *req)
     nm_assert(nm_device_is_real(self));
 
     /* Ensure the activation request is still valid; the master may have
-	 * already failed in which case activation of this device should not proceed.
-	 */
+     * already failed in which case activation of this device should not proceed.
+     */
     if (nm_active_connection_get_state(NM_ACTIVE_CONNECTION(req))
         >= NM_ACTIVE_CONNECTION_STATE_DEACTIVATING)
         return;
 
     if (!nm_device_get_managed(self, FALSE)) {
         /* It's unclear why the device would be unmanaged at this point.
-		 * Just to be sure, handle it and error out. */
+         * Just to be sure, handle it and error out. */
         _LOGE(LOGD_DEVICE,
               "Activation: failed activating connection '%s' because device is still unmanaged",
               nm_active_connection_get_settings_connection_id((NMActiveConnection *) req));
@@ -13286,7 +13286,7 @@ _carrier_wait_check_act_request_must_queue(NMDevice *self, NMActRequest *req)
     NMConnection *   connection;
 
     /* If we have carrier or if we are not waiting for it, the activation
-	 * request is not blocked waiting for carrier. */
+     * request is not blocked waiting for carrier. */
     if (priv->carrier)
         return FALSE;
     if (priv->carrier_wait_id == 0)
@@ -13302,12 +13302,12 @@ _carrier_wait_check_act_request_must_queue(NMDevice *self, NMActRequest *req)
                                               NULL,
                                               NULL)) {
         /* We passed all @flags we have, and no @specific_object.
-		 * This equals maximal availability, if a connection is not available
-		 * in this case, it is not waiting for carrier.
-		 *
-		 * Actually, why are we even trying to activate it? Strange, but whatever
-		 * the reason, don't wait for carrier.
-		 */
+         * This equals maximal availability, if a connection is not available
+         * in this case, it is not waiting for carrier.
+         *
+         * Actually, why are we even trying to activate it? Strange, but whatever
+         * the reason, don't wait for carrier.
+         */
         return FALSE;
     }
 
@@ -13319,11 +13319,11 @@ _carrier_wait_check_act_request_must_queue(NMDevice *self, NMActRequest *req)
             NULL,
             NULL)) {
         /* The connection was available with flags ALL, and it is still available
-		 * if we pretend not to wait for carrier. That means that the
-		 * connection is available now, and does not wait for carrier.
-		 *
-		 * Since the flags increase the availability of a connection, when checking
-		 * ALL&~WAITING_CARRIER, it means that we certainly would wait for carrier. */
+         * if we pretend not to wait for carrier. That means that the
+         * connection is available now, and does not wait for carrier.
+         *
+         * Since the flags increase the availability of a connection, when checking
+         * ALL&~WAITING_CARRIER, it means that we certainly would wait for carrier. */
         return FALSE;
     }
 
@@ -13359,13 +13359,13 @@ nm_device_disconnect_active_connection(NMActiveConnection *          active,
             nm_device_state_changed(self, NM_DEVICE_STATE_DEACTIVATING, device_reason);
         } else {
             /* @active is the current ac of @self, but it's going down already.
-			 * Nothing to do. */
+             * Nothing to do. */
         }
         return;
     }
 
     /* the active connection references this device, but it's neither the
-	 * queued_act_request nor the current act_request. Just set it to fail... */
+     * queued_act_request nor the current act_request. Just set it to fail... */
 do_fail:
     nm_active_connection_set_state_fail(active, active_reason, NULL);
 }
@@ -13437,10 +13437,10 @@ nm_device_is_activating(NMDevice *self)
         return TRUE;
 
     /* There's a small race between the time when stage 1 is scheduled
-	 * and when the device actually sets STATE_PREPARE when the activation
-	 * handler is actually run.  If there's an activation handler scheduled
-	 * we're activating anyway.
-	 */
+     * and when the device actually sets STATE_PREPARE when the activation
+     * handler is actually run.  If there's an activation handler scheduled
+     * we're activating anyway.
+     */
     return priv->activation_source_id_4 != 0;
 }
 
@@ -13560,7 +13560,7 @@ nm_device_set_ip_config(NMDevice *  self,
 
     if (new_config && old_config) {
         /* has_changes is set only on relevant changes, because when the configuration changes,
-		 * this causes a re-read and reset. This should only happen for relevant changes */
+         * this causes a re-read and reset. This should only happen for relevant changes */
         nm_ip_config_replace(old_config, new_config, &has_changes);
         if (has_changes) {
             _LOGD(LOGD_IP_from_af(addr_family),
@@ -13651,9 +13651,9 @@ _replace_vpn_config_in_list(GSList **plist, GObject *old, GObject *new)
     GSList *old_link;
 
     /* Below, assert that @new is not yet tracked, but still behave
-	 * correctly in any case. Don't complain for missing @old since
-	 * it could have been removed when the parent device became
-	 * unmanaged. */
+     * correctly in any case. Don't complain for missing @old since
+     * it could have been removed when the parent device became
+     * unmanaged. */
 
     if (old && (old_link = g_slist_find(*plist, old))) {
         if (old != new) {
@@ -13905,7 +13905,7 @@ ip_check_ping_watch_cb(GPid pid, int status, gpointer user_data)
         ip_check_pre_up(self);
     } else {
         /* If ping exited with an error it may have returned early,
-		 * wait 1 second and restart it */
+         * wait 1 second and restart it */
         priv->gw_ping.watch = g_timeout_add_seconds(1, respawn_ping_cb, self);
     }
 }
@@ -13964,9 +13964,9 @@ nm_device_start_ip_check(NMDevice *self)
     NMLogDomain          log_domain = LOGD_IP4;
 
     /* Shouldn't be any active ping here, since IP_CHECK happens after the
-	 * first IP method completes.  Any subsequently completing IP method doesn't
-	 * get checked.
-	 */
+     * first IP method completes.  Any subsequently completing IP method doesn't
+     * get checked.
+     */
     g_return_if_fail(!priv->gw_ping.watch);
     g_return_if_fail(!priv->gw_ping.timeout);
     g_return_if_fail(!priv->gw_ping.pid);
@@ -14097,25 +14097,25 @@ nm_device_bring_up(NMDevice *self, gboolean block, gboolean *no_firmware)
     }
 
     /* some ethernet devices fail to report capabilities unless the device
-	 * is up. Re-read the capabilities. */
+     * is up. Re-read the capabilities. */
     capabilities = 0;
     if (NM_DEVICE_GET_CLASS(self)->get_generic_capabilities)
         capabilities |= NM_DEVICE_GET_CLASS(self)->get_generic_capabilities(self);
     _add_capabilities(self, capabilities);
 
     /* Devices that support carrier detect must be IFF_UP to report carrier
-	 * changes; so after setting the device IFF_UP we must suppress startup
-	 * complete (via a pending action) until either the carrier turns on, or
-	 * a timeout is reached.
-	 */
+     * changes; so after setting the device IFF_UP we must suppress startup
+     * complete (via a pending action) until either the carrier turns on, or
+     * a timeout is reached.
+     */
     if (nm_device_has_capability(self, NM_DEVICE_CAP_CARRIER_DETECT)) {
         gint64 now_ms, until_ms;
 
         /* we start a grace period of 5 seconds during which we will schedule
-		 * a pending action whenever we have no carrier.
-		 *
-		 * If during that time carrier goes away, we declare the interface
-		 * as not ready. */
+         * a pending action whenever we have no carrier.
+         *
+         * If during that time carrier goes away, we declare the interface
+         * as not ready. */
         nm_clear_g_source(&priv->carrier_wait_id);
         if (!priv->carrier)
             nm_device_add_pending_action(self, NM_PENDING_ACTION_CARRIER_WAIT, FALSE);
@@ -14257,9 +14257,9 @@ update_ext_ip_config(NMDevice *self, int addr_family, gboolean intersect_configs
         if (priv->ext_ip_config_4) {
             if (intersect_configs) {
                 /* This function was called upon external changes. Remove the configuration
-				 * (addresses,routes) that is no longer present externally from the internal
-				 * config. This way, we don't re-add addresses that were manually removed
-				 * by the user. */
+                 * (addresses,routes) that is no longer present externally from the internal
+                 * config. This way, we don't re-add addresses that were manually removed
+                 * by the user. */
                 if (priv->con_ip_config_4) {
                     nm_ip4_config_intersect(priv->con_ip_config_4,
                                             priv->ext_ip_config_4,
@@ -14276,8 +14276,8 @@ update_ext_ip_config(NMDevice *self, int addr_family, gboolean intersect_configs
             }
 
             /* Remove parts from ext_ip_config_4 to only contain the information that
-			 * was configured externally -- we already have the same configuration from
-			 * internal origins. */
+             * was configured externally -- we already have the same configuration from
+             * internal origins. */
             if (priv->con_ip_config_4) {
                 nm_ip4_config_subtract(priv->ext_ip_config_4,
                                        priv->con_ip_config_4,
@@ -14312,9 +14312,9 @@ update_ext_ip_config(NMDevice *self, int addr_family, gboolean intersect_configs
 
             if (intersect_configs) {
                 /* This function was called upon external changes. Remove the configuration
-				 * (addresses,routes) that is no longer present externally from the internal
-				 * config. This way, we don't re-add addresses that were manually removed
-				 * by the user. */
+                 * (addresses,routes) that is no longer present externally from the internal
+                 * config. This way, we don't re-add addresses that were manually removed
+                 * by the user. */
                 if (priv->con_ip_config_6) {
                     nm_ip6_config_intersect(priv->con_ip_config_6,
                                             priv->ext_ip_config_6,
@@ -14336,8 +14336,8 @@ update_ext_ip_config(NMDevice *self, int addr_family, gboolean intersect_configs
             }
 
             /* Remove parts from ext_ip_config_6 to only contain the information that
-			 * was configured externally -- we already have the same configuration from
-			 * internal origins. */
+             * was configured externally -- we already have the same configuration from
+             * internal origins. */
             if (priv->con_ip_config_6) {
                 nm_ip6_config_subtract(priv->ext_ip_config_6,
                                        priv->con_ip_config_6,
@@ -14415,9 +14415,9 @@ queued_ip_config_change(NMDevice *self, int addr_family)
         return G_SOURCE_CONTINUE;
 
     /* If a commit is scheduled, this function would potentially interfere with
-	 * it changing IP configurations before they are applied. Postpone the
-	 * update in such case.
-	 */
+     * it changing IP configurations before they are applied. Postpone the
+     * update in such case.
+     */
     if (priv->activation_source_id_x[IS_IPv4] != 0
         && priv->activation_source_func_x[IS_IPv4] == activate_stage5_ip_config_result_x[IS_IPv4])
         return G_SOURCE_CONTINUE;
@@ -14428,8 +14428,8 @@ queued_ip_config_change(NMDevice *self, int addr_family)
 
     if (!IS_IPv4) {
         /* Check whether we need to complete waiting for link-local.
-		 * We are also called from an idle handler, so no problem doing state transitions
-		 * now. */
+         * We are also called from an idle handler, so no problem doing state transitions
+         * now. */
         linklocal6_check_complete(self);
     }
 
@@ -14472,10 +14472,10 @@ queued_ip_config_change(NMDevice *self, int addr_family)
                 nm_ndisc_emit_config_change(priv->ndisc, ndisc_config_changed);
 
             /* If no IPv6 link-local address exists but other addresses do then we
-			 * must add the LL address to remain conformant with RFC 3513 chapter 2.1
-			 * ("Addressing Model"): "All interfaces are required to have at least
-			 * one link-local unicast address".
-			 */
+             * must add the LL address to remain conformant with RFC 3513 chapter 2.1
+             * ("Addressing Model"): "All interfaces are required to have at least
+             * one link-local unicast address".
+             */
             if (priv->ip_config_6 && nm_ip6_config_get_num_addresses(priv->ip_config_6))
                 need_ipv6ll = TRUE;
             if (need_ipv6ll)
@@ -14641,27 +14641,27 @@ static gboolean
 _get_managed_by_flags(NMUnmanagedFlags flags, NMUnmanagedFlags mask, gboolean for_user_request)
 {
     /* Evaluate the managed state based on the unmanaged flags.
-	 *
-	 * Some flags are authoritative, meaning they always cause
-	 * the device to be unmanaged (e.g. @NM_UNMANAGED_PLATFORM_INIT).
-	 *
-	 * OTOH, some flags can be overwritten. For example NM_UNMANAGED_USER_UDEV
-	 * is ignored once NM_UNMANAGED_USER_EXPLICIT is set. The idea is that
-	 * the flag from the configuration has no effect once the user explicitly
-	 * touches the unmanaged flags. */
+     *
+     * Some flags are authoritative, meaning they always cause
+     * the device to be unmanaged (e.g. @NM_UNMANAGED_PLATFORM_INIT).
+     *
+     * OTOH, some flags can be overwritten. For example NM_UNMANAGED_USER_UDEV
+     * is ignored once NM_UNMANAGED_USER_EXPLICIT is set. The idea is that
+     * the flag from the configuration has no effect once the user explicitly
+     * touches the unmanaged flags. */
 
     if (for_user_request) {
         /* @for_user_request can make the result only ~more~ managed.
-		 * If the flags already indicate a managed state for a non-user-request,
-		 * then it is also managed for an explicit user-request.
-		 *
-		 * Effectively, this check is redundant, as the code below already
-		 * already ensures that. Still, express this invariant explicitly here. */
+         * If the flags already indicate a managed state for a non-user-request,
+         * then it is also managed for an explicit user-request.
+         *
+         * Effectively, this check is redundant, as the code below already
+         * already ensures that. Still, express this invariant explicitly here. */
         if (_get_managed_by_flags(flags, mask, FALSE))
             return TRUE;
 
         /* A for-user-request, is effectively the same as pretending
-		 * that user-explicit flag is cleared. */
+         * that user-explicit flag is cleared. */
         mask |= NM_UNMANAGED_USER_EXPLICIT;
         flags &= ~NM_UNMANAGED_USER_EXPLICIT;
     }
@@ -14669,22 +14669,22 @@ _get_managed_by_flags(NMUnmanagedFlags flags, NMUnmanagedFlags mask, gboolean fo
     if (NM_FLAGS_ANY(mask, NM_UNMANAGED_USER_SETTINGS)
         && !NM_FLAGS_ANY(flags, NM_UNMANAGED_USER_SETTINGS)) {
         /* NM_UNMANAGED_USER_SETTINGS can only explicitly unmanage a device. It cannot
-		 * *manage* it. Having NM_UNMANAGED_USER_SETTINGS explicitly not set, is the
-		 * same as having it not set at all. */
+         * *manage* it. Having NM_UNMANAGED_USER_SETTINGS explicitly not set, is the
+         * same as having it not set at all. */
         mask &= ~NM_UNMANAGED_USER_SETTINGS;
     }
 
     if (NM_FLAGS_ANY(mask, NM_UNMANAGED_USER_UDEV)) {
         /* configuration from udev or nm-config overwrites the by-default flag
-		 * which is based on the device type.
-		 * configuration from udev overwrites external-down */
+         * which is based on the device type.
+         * configuration from udev overwrites external-down */
         flags &= ~(NM_UNMANAGED_BY_DEFAULT | NM_UNMANAGED_EXTERNAL_DOWN);
     }
 
     if (NM_FLAGS_ANY(mask, NM_UNMANAGED_USER_CONF)) {
         /* configuration from NetworkManager.conf overwrites the by-default flag
-		 * which is based on the device type.
-		 * It also overwrites the udev configuration and external-down */
+         * which is based on the device type.
+         * It also overwrites the udev configuration and external-down */
         flags &= ~(NM_UNMANAGED_BY_DEFAULT | NM_UNMANAGED_USER_UDEV | NM_UNMANAGED_EXTERNAL_DOWN);
     }
 
@@ -14695,7 +14695,7 @@ _get_managed_by_flags(NMUnmanagedFlags flags, NMUnmanagedFlags mask, gboolean fo
 
     if (NM_FLAGS_HAS(mask, NM_UNMANAGED_USER_EXPLICIT)) {
         /* if the device is managed by user-decision, certain other flags
-		 * are ignored. */
+         * are ignored. */
         flags &= ~(NM_UNMANAGED_BY_DEFAULT | NM_UNMANAGED_USER_UDEV | NM_UNMANAGED_USER_CONF
                    | NM_UNMANAGED_EXTERNAL_DOWN);
     }
@@ -14981,13 +14981,13 @@ nm_device_set_unmanaged_by_user_settings(NMDevice *self)
 
     if (nm_device_get_unmanaged_flags(self, NM_UNMANAGED_PLATFORM_INIT)) {
         /* the device is already unmanaged due to platform-init.
-		 *
-		 * We want to delay evaluating the device spec, because it will freeze
-		 * the permanent MAC address. That should not be done, before the platform
-		 * link is fully initialized (via UDEV).
-		 *
-		 * Note that when clearing NM_UNMANAGED_PLATFORM_INIT, we will re-evaluate
-		 * whether the device is unmanaged by user-settings. */
+         *
+         * We want to delay evaluating the device spec, because it will freeze
+         * the permanent MAC address. That should not be done, before the platform
+         * link is fully initialized (via UDEV).
+         *
+         * Note that when clearing NM_UNMANAGED_PLATFORM_INIT, we will re-evaluate
+         * whether the device is unmanaged by user-settings. */
         return;
     }
 
@@ -15202,10 +15202,10 @@ nm_device_update_metered(NMDevice *self)
     }
 
     /* Otherwise, look at connection type. For Bluetooth, we look at the type of
-	 * Bluetooth sharing: for PANU/DUN (where we are receiving internet from
-	 * another device) we set GUESS_YES; for NAP (where we are sharing internet
-	 * to another device) we set GUESS_NO. We ignore WiMAX here as it’s no
-	 * longer supported by NetworkManager. */
+     * Bluetooth sharing: for PANU/DUN (where we are receiving internet from
+     * another device) we set GUESS_YES; for NAP (where we are sharing internet
+     * to another device) we set GUESS_NO. We ignore WiMAX here as it’s no
+     * longer supported by NetworkManager. */
     if (value == NM_METERED_INVALID
         && nm_connection_is_type(connection, NM_SETTING_BLUETOOTH_SETTING_NAME)) {
         if (_nm_connection_get_setting_bluetooth_for_nap(connection)) {
@@ -15369,7 +15369,7 @@ nm_device_check_connection_available(NMDevice *                     self,
 #if NM_MORE_ASSERTS >= 2
     {
         /* The meaning of the flags is so that *adding* a flag relaxes a condition, thus making
-		 * the device *more* available. Assert against that requirement by testing all the flags. */
+         * the device *more* available. Assert against that requirement by testing all the flags. */
         NMDeviceCheckConAvailableFlags i, j, k;
         gboolean available_all[NM_DEVICE_CHECK_CON_AVAILABLE_ALL + 1] = {FALSE};
 
@@ -15422,23 +15422,23 @@ check_connection_available(NMDevice *                     self,
     NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE(self);
 
     /* Connections which require a network connection are not available when
-	 * the device has no carrier, even with ignore-carrer=TRUE.
-	 */
+     * the device has no carrier, even with ignore-carrer=TRUE.
+     */
     if (priv->carrier || !connection_requires_carrier(connection))
         return TRUE;
 
     if (NM_FLAGS_HAS(flags, _NM_DEVICE_CHECK_CON_AVAILABLE_FOR_USER_REQUEST_WAITING_CARRIER)
         && priv->carrier_wait_id != 0) {
         /* The device has no carrier though the connection requires it.
-		 *
-		 * If we are still waiting for carrier, the connection is available
-		 * for an explicit user-request. */
+         *
+         * If we are still waiting for carrier, the connection is available
+         * for an explicit user-request. */
         return TRUE;
     }
 
     /* master types are always available even without carrier.
-	 * Making connection non-available would un-enslave slaves which
-	 * is not desired. */
+     * Making connection non-available would un-enslave slaves which
+     * is not desired. */
     if (nm_device_is_master(self))
         return TRUE;
 
@@ -15524,8 +15524,8 @@ nm_device_get_best_connection(NMDevice *self, const char *specific_object, GErro
         guint64 candidate_timestamp = 0;
 
         /* If a specific object is given, only include connections that are
-		 * compatible with it.
-		 */
+         * compatible with it.
+         */
         if (specific_object /* << Optimization: we know that the connection is available without @specific_object.  */
             && !nm_device_check_connection_available(
                 self,
@@ -15726,7 +15726,7 @@ nm_device_has_pending_action_reason(NMDevice *self)
         if (!priv->pending_actions->next && nm_device_get_state(self) == NM_DEVICE_STATE_ACTIVATED
             && nm_streq(priv->pending_actions->data, NM_PENDING_ACTION_CARRIER_WAIT)) {
             /* if the device is already in activated state, and the only reason
-			 * why it appears still busy is "carrier-wait", then we are already complete. */
+             * why it appears still busy is "carrier-wait", then we are already complete. */
             return NULL;
         }
 
@@ -15736,7 +15736,7 @@ nm_device_has_pending_action_reason(NMDevice *self)
     if (nm_device_is_real(self)
         && nm_device_get_unmanaged_flags(self, NM_UNMANAGED_PLATFORM_INIT)) {
         /* as long as the platform link is not yet initialized, we have a pending
-		 * action. */
+         * action. */
         return NM_PENDING_ACTION_LINK_INIT;
     }
 
@@ -15816,8 +15816,8 @@ _cleanup_generic_post(NMDevice *self, CleanupType cleanup_type)
     priv->linklocal6_dad_counter = 0;
 
     /* Clean up IP configs; this does not actually deconfigure the
-	 * interface; the caller must flush routes and addresses explicitly.
-	 */
+     * interface; the caller must flush routes and addresses explicitly.
+     */
     nm_device_set_ip_config(self, AF_INET, NULL, TRUE, NULL);
     nm_device_set_ip_config(self, AF_INET6, NULL, TRUE, NULL);
     g_clear_object(&priv->proxy_config);
@@ -15845,7 +15845,7 @@ _cleanup_generic_post(NMDevice *self, CleanupType cleanup_type)
     priv->vpn_configs_6 = NULL;
 
     /* We no longer accept the delegations. nm_device_set_ip_config(NULL)
-	 * above disables them. */
+     * above disables them. */
     nm_assert(priv->needs_ip6_subnet == FALSE);
 
     if (priv->act_request.obj) {
@@ -15858,15 +15858,15 @@ _cleanup_generic_post(NMDevice *self, CleanupType cleanup_type)
 
     if (cleanup_type == CLEANUP_TYPE_DECONFIGURE) {
         /* Check if the device was deactivated, and if so, delete_link.
-		 * Don't call delete_link synchronously because we are currently
-		 * handling a state change -- which is not reentrant. */
+         * Don't call delete_link synchronously because we are currently
+         * handling a state change -- which is not reentrant. */
         delete_on_deactivate_check_and_schedule(self, nm_device_get_ip_ifindex(self));
     }
 
     /* ip_iface should be cleared after flushing all routes and addresses, since
-	 * those are identified by ip_iface, not by iface (which might be a tty
-	 * or ATM device).
-	 */
+     * those are identified by ip_iface, not by iface (which might be a tty
+     * or ATM device).
+     */
     _set_ip_ifindex(self, 0, NULL);
 }
 
@@ -15948,15 +15948,15 @@ nm_device_cleanup(NMDevice *self, NMDeviceStateReason reason, CleanupType cleanu
 
     if (ifindex > 0) {
         /* during device cleanup, we want to reset the MAC address of the device
-		 * to the initial state.
-		 *
-		 * We certainly want to do that when reaching the UNMANAGED state... */
+         * to the initial state.
+         *
+         * We certainly want to do that when reaching the UNMANAGED state... */
         if (nm_device_get_state(self) <= NM_DEVICE_STATE_UNMANAGED)
             nm_device_hw_addr_reset(self, "unmanage");
         else {
             /* for other device states (UNAVAILABLE, DISCONNECTED), allow the
-			 * device to overwrite the reset behavior, so that Wi-Fi can set
-			 * a randomized MAC address used during scanning. */
+             * device to overwrite the reset behavior, so that Wi-Fi can set
+             * a randomized MAC address used during scanning. */
             NM_DEVICE_GET_CLASS(self)->deactivate_reset_hw_addr(self);
         }
     }
@@ -16305,30 +16305,30 @@ deactivate_dispatcher_complete(NMDispatcherCallId *call_id, gpointer user_data)
 
     if (NM_DEVICE_GET_CLASS(self)->deactivate_async) {
         /* FIXME: the virtual function deactivate_async() has only this caller here.
-		 * And the NMDevice subtypes are well aware of the circumstances when they
-		 * are called. We shall make the function less generic and thus (as the scope
-		 * is narrower) more convenient.
-		 *
-		 * - Drop the callback argument. Instead, when deactivate_async() completes, the
-		 *   subtype shall call a method _nm_device_deactivate_async_done(). Because as
-		 *   it is currently, subtypes need to pretend this callback and the user-data
-		 *   would be opaque, and carry it around. When it's in fact very clear what this
-		 *   is.
-		 *
-		 * - Also drop the GCancellable argument. Upon cancellation, NMDevice shall
-		 *   call another virtual function deactivate_async_abort(). As it is currently,
-		 *   callers need to register to the cancelled signal of the cancellable. It
-		 *   seems simpler to just implement the deactivate_async_abort() function.
-		 *   On the other hand, some implementations actually use the GCancellable.
-		 *   So, NMDevice shall do both: it shall both pass a cancellable, but also
-		 *   invoke deactivate_async_abort(). It allow the implementation to honor
-		 *   whatever is simpler for their purpose.
-		 *
-		 * - sometimes, the subclass can complete right away. Scheduling the completion
-		 *   in an idle handler is cumbersome. Allow the function to return FALSE to
-		 *   indicate that the device is already deactivated and the callback (or
-		 *   _nm_device_deactivate_async_done()) won't be invoked.
-		 */
+         * And the NMDevice subtypes are well aware of the circumstances when they
+         * are called. We shall make the function less generic and thus (as the scope
+         * is narrower) more convenient.
+         *
+         * - Drop the callback argument. Instead, when deactivate_async() completes, the
+         *   subtype shall call a method _nm_device_deactivate_async_done(). Because as
+         *   it is currently, subtypes need to pretend this callback and the user-data
+         *   would be opaque, and carry it around. When it's in fact very clear what this
+         *   is.
+         *
+         * - Also drop the GCancellable argument. Upon cancellation, NMDevice shall
+         *   call another virtual function deactivate_async_abort(). As it is currently,
+         *   callers need to register to the cancelled signal of the cancellable. It
+         *   seems simpler to just implement the deactivate_async_abort() function.
+         *   On the other hand, some implementations actually use the GCancellable.
+         *   So, NMDevice shall do both: it shall both pass a cancellable, but also
+         *   invoke deactivate_async_abort(). It allow the implementation to honor
+         *   whatever is simpler for their purpose.
+         *
+         * - sometimes, the subclass can complete right away. Scheduling the completion
+         *   in an idle handler is cumbersome. Allow the function to return FALSE to
+         *   indicate that the device is already deactivated and the callback (or
+         *   _nm_device_deactivate_async_done()) won't be invoked.
+         */
         priv->deactivating_cancellable = g_cancellable_new();
         NM_DEVICE_GET_CLASS(self)->deactivate_async(self,
                                                     priv->deactivating_cancellable,
@@ -16365,9 +16365,9 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
     }
 
     /* Do nothing if state isn't changing, but as a special case allow
-	 * re-setting UNAVAILABLE if the device is missing firmware so that we
-	 * can retry device initialization.
-	 */
+     * re-setting UNAVAILABLE if the device is missing firmware so that we
+     * can retry device initialization.
+     */
     if ((priv->state == state)
         && (state != NM_DEVICE_STATE_UNAVAILABLE || !priv->firmware_missing)) {
         _LOGD(LOGD_DEVICE,
@@ -16388,8 +16388,8 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
           _sys_iface_state_to_str(priv->sys_iface_state));
 
     /* in order to prevent triggering any callback caused
-	 * by the device not having any pending action anymore
-	 * we add one here that gets removed at the end of the function */
+     * by the device not having any pending action anymore
+     * we add one here that gets removed at the end of the function */
     nm_device_add_pending_action(self, NM_PENDING_ACTION_IN_STATE_CHANGE, TRUE);
     priv->in_state_changed = TRUE;
 
@@ -16437,8 +16437,8 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
     }
 
     /* Handle the new state here; but anything that could trigger
-	 * another state change should be done below.
-	 */
+     * another state change should be done below.
+     */
     switch (state) {
     case NM_DEVICE_STATE_UNMANAGED:
         nm_device_set_firmware_missing(self, FALSE);
@@ -16477,29 +16477,29 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
             }
 
             /* Ensure the device gets deactivated in response to stuff like
-			 * carrier changes or rfkill.  But don't deactivate devices that are
-			 * about to assume a connection since that defeats the purpose of
-			 * assuming the device's existing connection.
-			 *
-			 * Note that we "deactivate" the device even when coming from
-			 * UNMANAGED, to ensure that it's in a clean state.
-			 */
+             * carrier changes or rfkill.  But don't deactivate devices that are
+             * about to assume a connection since that defeats the purpose of
+             * assuming the device's existing connection.
+             *
+             * Note that we "deactivate" the device even when coming from
+             * UNMANAGED, to ensure that it's in a clean state.
+             */
             nm_device_cleanup(self, reason, CLEANUP_TYPE_DECONFIGURE);
         }
         break;
     case NM_DEVICE_STATE_DISCONNECTED:
         if (old_state > NM_DEVICE_STATE_DISCONNECTED) {
             /* Ensure devices that previously assumed a connection now have
-			 * userspace IPv6LL enabled.
-			 */
+             * userspace IPv6LL enabled.
+             */
             set_nm_ipv6ll(self, TRUE);
 
             nm_device_cleanup(self, reason, CLEANUP_TYPE_DECONFIGURE);
         } else if (old_state < NM_DEVICE_STATE_DISCONNECTED) {
             if (priv->sys_iface_state == NM_DEVICE_SYS_IFACE_STATE_MANAGED) {
                 /* Ensure IPv6 is set up as it may not have been done when
-				 * entering the UNAVAILABLE state depending on the reason.
-				 */
+                 * entering the UNAVAILABLE state depending on the reason.
+                 */
                 ip6_managed_setup(self);
             }
         }
@@ -16510,8 +16510,8 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
     case NM_DEVICE_STATE_NEED_AUTH:
         if (old_state > NM_DEVICE_STATE_NEED_AUTH) {
             /* Clean up any half-done IP operations if the device's layer2
-			 * finds out it needs authentication during IP config.
-			 */
+             * finds out it needs authentication during IP config.
+             */
             _cleanup_ip_pre(self, AF_INET, CLEANUP_TYPE_DECONFIGURE);
             _cleanup_ip_pre(self, AF_INET6, CLEANUP_TYPE_DECONFIGURE);
         }
@@ -16545,11 +16545,11 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
     switch (state) {
     case NM_DEVICE_STATE_UNAVAILABLE:
         /* If the device can activate now (ie, it's got a carrier, the supplicant
-		 * is active, or whatever) schedule a delayed transition to DISCONNECTED
-		 * to get things rolling.  The device can't transition immediately because
-		 * we can't change states again from the state handler for a variety of
-		 * reasons.
-		 */
+         * is active, or whatever) schedule a delayed transition to DISCONNECTED
+         * to get things rolling.  The device can't transition immediately because
+         * we can't change states again from the state handler for a variety of
+         * reasons.
+         */
         if (nm_device_is_available(self, NM_DEVICE_CHECK_DEV_AVAILABLE_NONE)) {
             nm_device_queue_recheck_available(self,
                                               NM_DEVICE_STATE_REASON_NONE,
@@ -16562,7 +16562,7 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
         _cancel_activation(self);
 
         /* We cache the ignore_carrier state to not react on config-reloads while the connection
-		 * is active. But on deactivating, reset the ignore-carrier flag to the current state. */
+         * is active. But on deactivating, reset the ignore-carrier flag to the current state. */
         priv->ignore_carrier = nm_config_data_get_ignore_carrier(NM_CONFIG_GET_DATA, self);
 
         if (quitting) {
@@ -16611,11 +16611,11 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
         break;
     case NM_DEVICE_STATE_FAILED:
         /* Usually upon failure the activation chain is interrupted in
-		 * one of the stages; but in some cases the device fails for
-		 * external events (as a failure of master connection) while
-		 * the activation sequence is running and so we need to ensure
-		 * that the chain is terminated here.
-		 */
+         * one of the stages; but in some cases the device fails for
+         * external events (as a failure of master connection) while
+         * the activation sequence is running and so we need to ensure
+         * that the chain is terminated here.
+         */
         _cancel_activation(self);
 
         sett_conn = nm_device_get_settings_connection(self);
@@ -16627,10 +16627,10 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
         nm_device_master_release_slaves(self);
 
         /* If the connection doesn't yet have a timestamp, set it to zero so that
-		 * we can distinguish between connections we've tried to activate and have
-		 * failed (zero timestamp), connections that succeeded (non-zero timestamp),
-		 * and those we haven't tried yet (no timestamp).
-		 */
+         * we can distinguish between connections we've tried to activate and have
+         * failed (zero timestamp), connections that succeeded (non-zero timestamp),
+         * and those we haven't tried yet (no timestamp).
+         */
         if (sett_conn && !nm_settings_connection_get_timestamp(sett_conn, NULL))
             nm_settings_connection_update_timestamp(sett_conn, (guint64) 0);
 
@@ -16641,9 +16641,9 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
             break;
         }
         /* Schedule the transition to DISCONNECTED.  The device can't transition
-		 * immediately because we can't change states again from the state
-		 * handler for a variety of reasons.
-		 */
+         * immediately because we can't change states again from the state
+         * handler for a variety of reasons.
+         */
         nm_device_queue_state(self, NM_DEVICE_STATE_DISCONNECTED, NM_DEVICE_STATE_REASON_NONE);
         break;
     case NM_DEVICE_STATE_IP_CHECK:
@@ -16655,8 +16655,8 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
             nm_device_start_ip_check(self);
 
         /* IP-related properties are only valid when the device has IP configuration;
-		 * now that it does, ensure their change notifications are emitted.
-		 */
+         * now that it does, ensure their change notifications are emitted.
+         */
         notify_ip_properties(self);
         break;
     case NM_DEVICE_STATE_SECONDARIES:
@@ -16680,8 +16680,8 @@ _set_state_full(NMDevice *self, NMDeviceState state, NMDeviceStateReason reason,
     }
 
     /* IP-related properties are only valid when the device has IP configuration.
-	 * If it no longer does, ensure their change notifications are emitted.
-	 */
+     * If it no longer does, ensure their change notifications are emitted.
+     */
     if (ip_config_valid(old_state) && !ip_config_valid(state))
         notify_ip_properties(self);
 
@@ -16721,8 +16721,8 @@ queued_state_set(gpointer user_data)
           "change state");
 
     /* Clear queued state struct before triggering state change, since
-	 * the state change may queue another state.
-	 */
+     * the state change may queue another state.
+     */
     priv->queued_state.id = 0;
     new_state             = priv->queued_state.state;
     new_reason            = priv->queued_state.reason;
@@ -16758,7 +16758,7 @@ nm_device_queue_state(NMDevice *self, NMDeviceState state, NMDeviceStateReason r
     }
 
     /* Add pending action for the new state before clearing the queued states, so
-	 * that we don't accidentally pop all pending states and reach 'startup complete'  */
+     * that we don't accidentally pop all pending states and reach 'startup complete'  */
     nm_device_add_pending_action(self, queued_state_to_string(state), TRUE);
 
     /* We should only ever have one delayed state transition at a time */
@@ -16861,10 +16861,10 @@ nm_device_update_hw_address(NMDevice *self)
         char s_buf[NM_UTILS_HWADDR_LEN_MAX_STR];
 
         /* we cannot change the address length of a device once it is set (except
-		 * unrealizing the device).
-		 *
-		 * The reason is that the permanent and initial MAC addresses also must have the
-		 * same address length, so it's unclear what it would mean that the length changes. */
+         * unrealizing the device).
+         *
+         * The reason is that the permanent and initial MAC addresses also must have the
+         * same address length, so it's unclear what it would mean that the length changes. */
         _LOGD(LOGD_PLATFORM | LOGD_DEVICE,
               "hw-addr: read a MAC address with differing length (%s vs. %s)",
               priv->hw_addr,
@@ -16886,8 +16886,8 @@ nm_device_update_hw_address(NMDevice *self)
         || (priv->hw_addr_type == HW_ADDR_TYPE_UNSET && priv->state < NM_DEVICE_STATE_PREPARE
             && !nm_device_is_activating(self))) {
         /* when we get a hw_addr the first time or while the device
-		 * is not activated (with no explicit hw address set), always
-		 * update our initial hw-address as well. */
+         * is not activated (with no explicit hw address set), always
+         * update our initial hw-address as well. */
         nm_device_update_initial_hw_address(self);
     }
     return TRUE;
@@ -16901,7 +16901,7 @@ nm_device_update_initial_hw_address(NMDevice *self)
     if (priv->hw_addr && !nm_streq0(priv->hw_addr_initial, priv->hw_addr)) {
         if (priv->hw_addr_initial && priv->hw_addr_type != HW_ADDR_TYPE_UNSET) {
             /* once we have the initial hw address set, we only allow
-			 * update if the currently type is "unset". */
+             * update if the currently type is "unset". */
             return;
         }
         g_free(priv->hw_addr_initial);
@@ -16923,10 +16923,10 @@ nm_device_update_permanent_hw_address(NMDevice *self, gboolean force_freeze)
 
     if (priv->hw_addr_perm) {
         /* the permanent hardware address is only read once and not
-		 * re-read later.
-		 *
-		 * Except during unrealize/realize cycles, where we clear the permanent
-		 * hardware address during unrealization. */
+         * re-read later.
+         *
+         * Except during unrealize/realize cycles, where we clear the permanent
+         * hardware address during unrealization. */
         return;
     }
 
@@ -16935,12 +16935,12 @@ nm_device_update_permanent_hw_address(NMDevice *self, gboolean force_freeze)
         return;
 
     /* the user is advised to configure stable MAC addresses for software devices via
-	 * UDEV. Thus, check whether the link is fully initialized. */
+     * UDEV. Thus, check whether the link is fully initialized. */
     pllink = nm_platform_link_get(nm_device_get_platform(self), ifindex);
     if (!pllink || !pllink->initialized) {
         if (!force_freeze) {
             /* we can afford to wait. Back off and leave the permanent MAC address
-			 * undecided for now. */
+             * undecided for now. */
             return;
         }
         /* try to refresh the link just to give UDEV a bit more time... */
@@ -16952,9 +16952,9 @@ nm_device_update_permanent_hw_address(NMDevice *self, gboolean force_freeze)
 
     if (!priv->hw_addr_len) {
         /* we need the current MAC address because we require the permanent MAC address
-		 * to have the same length as the current address.
-		 *
-		 * Abort if there is no current MAC address. */
+         * to have the same length as the current address.
+         *
+         * Abort if there is no current MAC address. */
         return;
     }
 
@@ -16968,16 +16968,16 @@ nm_device_update_permanent_hw_address(NMDevice *self, gboolean force_freeze)
     }
 
     /* we failed to read a permanent MAC address, thus we use a fake address,
-	 * that is the current MAC address of the device.
-	 *
-	 * Note that the permanet MAC address of a NMDevice instance does not change
-	 * after being set once. Thus, we use now a fake address and stick to that
-	 * (until we unrealize the device). */
+     * that is the current MAC address of the device.
+     *
+     * Note that the permanet MAC address of a NMDevice instance does not change
+     * after being set once. Thus, we use now a fake address and stick to that
+     * (until we unrealize the device). */
     priv->hw_addr_perm_fake = TRUE;
 
     /* We also persist our choice of the fake address to the device state
-	 * file to use the same address on restart of NetworkManager.
-	 * First, try to reload the address from the state file. */
+     * file to use the same address on restart of NetworkManager.
+     * First, try to reload the address from the state file. */
     dev_state = nm_config_device_state_get(nm_config_get(), ifindex);
     if (dev_state && dev_state->perm_hw_addr_fake
         && nm_utils_hwaddr_aton(dev_state->perm_hw_addr_fake, buf, priv->hw_addr_len)
@@ -17071,8 +17071,8 @@ _hw_addr_set(NMDevice *        self,
 
     if (nm_device_get_device_type(self) == NM_DEVICE_TYPE_WIFI) {
         /* Always take the device down for Wi-Fi because
-		 * wpa_supplicant needs it to properly detect the MAC
-		 * change. */
+         * wpa_supplicant needs it to properly detect the MAC
+         * change. */
         retry_down     = FALSE;
         was_taken_down = TRUE;
         nm_device_take_down(self, FALSE);
@@ -17110,18 +17110,18 @@ again:
                   detail);
 
             /* The platform call indicated success, however the address is not
-			 * as expected. That is either due to a driver issue (brcmfmac, bgo#770456,
-			 * rh#1374023) or a race where externally the MAC address was reset.
-			 * The race is rather unlikely.
-			 *
-			 * The alternative would be to postpone the activation in case the
-			 * MAC address is not yet ready and poll without blocking. However,
-			 * that is rather complicated and it is not expected that this case
-			 * happens for regular drivers.
-			 * Note that brcmfmac can block NetworkManager for 500 msec while
-			 * taking down the device. Let's add another 100 msec to that.
-			 *
-			 * wait/poll up to 100 msec until it changes. */
+             * as expected. That is either due to a driver issue (brcmfmac, bgo#770456,
+             * rh#1374023) or a race where externally the MAC address was reset.
+             * The race is rather unlikely.
+             *
+             * The alternative would be to postpone the activation in case the
+             * MAC address is not yet ready and poll without blocking. However,
+             * that is rather complicated and it is not expected that this case
+             * happens for regular drivers.
+             * Note that brcmfmac can block NetworkManager for 500 msec while
+             * taking down the device. Let's add another 100 msec to that.
+             *
+             * wait/poll up to 100 msec until it changes. */
 
             poll_end = nm_utils_get_monotonic_timestamp_usec() + (100 * 1000);
             for (;;) {
@@ -17166,8 +17166,8 @@ handle_fail:
 
     if (retry_down) {
         /* changing the MAC address failed, but also the device was up (and we did not yet try to take
-		 * it down). Optimally, we change the MAC address without taking the device down, but some
-		 * devices don't like that. So, retry with taking the device down. */
+         * it down). Optimally, we change the MAC address without taking the device down, but some
+         * devices don't like that. So, retry with taking the device down. */
         retry_down     = FALSE;
         was_taken_down = TRUE;
         nm_device_take_down(self, FALSE);
@@ -17196,9 +17196,9 @@ nm_device_hw_addr_set(NMDevice *self, const char *addr, const char *detail, gboo
 
     if (set_permanent) {
         /* The type is set to PERMANENT by NMDeviceVlan when taking the MAC
-		 * address from the parent and by NMDeviceWifi when setting a random MAC
-		 * address during scanning.
-		 */
+         * address from the parent and by NMDeviceWifi when setting a random MAC
+         * address during scanning.
+         */
         priv->hw_addr_type = HW_ADDR_TYPE_PERMANENT;
     }
 
@@ -17289,8 +17289,8 @@ _hw_addr_get_cloned(NMDevice *    self,
     } else if (NM_IN_STRSET(addr, NM_CLONED_MAC_RANDOM)) {
         if (priv->hw_addr_type == HW_ADDR_TYPE_GENERATED) {
             /* hm, we already use a generate MAC address. Most certainly, that is from the same
-			 * activation request, so we should not create a new random address, instead keep
-			 * the current. */
+             * activation request, so we should not create a new random address, instead keep
+             * the current. */
             goto out_no_action;
         }
         hw_addr_generated = nm_utils_hw_addr_gen_random_eth(
@@ -17316,7 +17316,7 @@ _hw_addr_get_cloned(NMDevice *    self,
 
         if (priv->hw_addr_type == HW_ADDR_TYPE_GENERATED) {
             /* hm, we already use a generate MAC address. Most certainly, that is from the same
-			 * activation request, so let's skip creating the stable address anew. */
+             * activation request, so let's skip creating the stable address anew. */
             goto out_no_action;
         }
 
@@ -17430,7 +17430,7 @@ nm_device_hw_addr_reset(NMDevice *self, const char *detail)
     addr               = nm_device_get_initial_hw_address(self);
     if (!addr) {
         /* as hw_addr_type is not UNSET, we expect that we can get an
-		 * initial address to which to reset. */
+         * initial address to which to reset. */
         g_return_val_if_reached(FALSE);
     }
 
@@ -17450,8 +17450,8 @@ nm_device_get_permanent_hw_address_full(NMDevice *self,
 
     if (!priv->hw_addr_perm && force_freeze) {
         /* somebody requests a permanent MAC address, but we don't have it set
-		 * yet. We cannot delay it any longer and try to get it without waiting
-		 * for UDEV. */
+         * yet. We cannot delay it any longer and try to get it without waiting
+         * for UDEV. */
         nm_device_update_permanent_hw_address(self, TRUE);
     }
 
@@ -17649,8 +17649,8 @@ get_property(GObject *object, guint prop_id, GValue *value, GParamSpec *pspec)
     switch (prop_id) {
     case PROP_UDI:
         /* UDI is (depending on the device type) a path to sysfs and can contain
-		 * non-UTF-8.
-		 *   ip link add name $'d\xccf\\c' type dummy  */
+         * non-UTF-8.
+         *   ip link add name $'d\xccf\\c' type dummy  */
         g_value_take_string(
             value,
             nm_utils_str_utf8safe_escape_cp(priv->udi, NM_UTILS_STR_UTF8_SAFE_FLAG_NONE));
@@ -18177,8 +18177,8 @@ dispose(GObject *object)
 
     if (nm_clear_g_source(&priv->queued_state.id)) {
         /* FIXME: we'd expect the queud_state to be already cleared and this statement
-		 * not being necessary. Add this check here to hopefully investigate crash
-		 * rh#1270247. */
+         * not being necessary. Add this check here to hopefully investigate crash
+         * rh#1270247. */
         g_return_if_reached();
     }
 }
@@ -18217,7 +18217,7 @@ finalize(GObject *object)
     G_OBJECT_CLASS(nm_device_parent_class)->finalize(object);
 
     /* for testing, NMDeviceTest does not invoke NMDevice::constructed,
-	 * and thus @settings might be unset. */
+     * and thus @settings might be unset. */
     nm_g_object_unref(priv->settings);
     nm_g_object_unref(priv->manager);
 
diff --git a/src/devices/nm-device.h b/src/devices/nm-device.h
index 39567ef3a3..cc3f281070 100644
--- a/src/devices/nm-device.h
+++ b/src/devices/nm-device.h
@@ -22,10 +22,10 @@ typedef enum _nm_packed {
     NM_DEVICE_SYS_IFACE_STATE_MANAGED,
 
     /* the REMOVED state applies when the device is manually set to unmanaged
-	 * or the link was externally removed. In both cases, we move the device
-	 * to UNMANAGED state, without touching the link -- be it, because the link
-	 * is already gone or because we want to release it (give it up).
-	 */
+     * or the link was externally removed. In both cases, we move the device
+     * to UNMANAGED state, without touching the link -- be it, because the link
+     * is already gone or because we want to release it (give it up).
+     */
     NM_DEVICE_SYS_IFACE_STATE_REMOVED,
 } NMDeviceSysIfaceState;
 
@@ -40,15 +40,15 @@ static inline NMDeviceStateReason
 nm_device_state_reason_check(NMDeviceStateReason reason)
 {
     /* the device-state-reason serves mostly informational purpose during a state
-	 * change. In some cases however, decisions are made based on the reason.
-	 * I tend to think that interpreting the state reason to derive some behaviors
-	 * is confusing, because the cause and effect are so far apart.
-	 *
-	 * This function is here to mark source that inspects the reason to make
-	 * a decision -- contrary to places that set the reason. Thus, by grepping
-	 * for nm_device_state_reason_check() you can find the "effect" to a certain
-	 * reason.
-	 */
+     * change. In some cases however, decisions are made based on the reason.
+     * I tend to think that interpreting the state reason to derive some behaviors
+     * is confusing, because the cause and effect are so far apart.
+     *
+     * This function is here to mark source that inspects the reason to make
+     * a decision -- contrary to places that set the reason. Thus, by grepping
+     * for nm_device_state_reason_check() you can find the "effect" to a certain
+     * reason.
+     */
     return reason;
 }
 
@@ -153,24 +153,24 @@ typedef enum { /*< skip >*/
                NM_DEVICE_CHECK_CON_AVAILABLE_NONE = 0,
 
                /* since NM_DEVICE_CHECK_CON_AVAILABLE_FOR_USER_REQUEST is a collection of flags with more fine grained
-	 * parts, this flag in general indicates that this is a user-request. */
+     * parts, this flag in general indicates that this is a user-request. */
                _NM_DEVICE_CHECK_CON_AVAILABLE_FOR_USER_REQUEST = (1L << 0),
 
                /* we also consider devices which have no carrier but are still waiting for the driver
-	 * to detect carrier. Usually, such devices are not yet available, however for a user-request
-	 * they are. They might fail later if carrier doesn't come. */
+     * to detect carrier. Usually, such devices are not yet available, however for a user-request
+     * they are. They might fail later if carrier doesn't come. */
                _NM_DEVICE_CHECK_CON_AVAILABLE_FOR_USER_REQUEST_WAITING_CARRIER = (1L << 1),
 
                /* usually, a profile is only available if the Wi-Fi AP is in range. For an
-	 * explicit user request, we also consider profiles for APs that are not (yet)
-	 * visible. */
+     * explicit user request, we also consider profiles for APs that are not (yet)
+     * visible. */
                _NM_DEVICE_CHECK_CON_AVAILABLE_FOR_USER_REQUEST_IGNORE_AP = (1L << 2),
 
                /* a device can be marked as unmanaged for various reasons. Some of these reasons
-	 * are authoritative, others not. Non-authoritative reasons can be overruled by
-	 * `nmcli device set $DEVICE managed yes`. Also, for an explicit user activation
-	 * request we may want to consider the device as managed. This flag makes devices
-	 * that are unmanaged appear available. */
+     * are authoritative, others not. Non-authoritative reasons can be overruled by
+     * `nmcli device set $DEVICE managed yes`. Also, for an explicit user activation
+     * request we may want to consider the device as managed. This flag makes devices
+     * that are unmanaged appear available. */
                _NM_DEVICE_CHECK_CON_AVAILABLE_FOR_USER_REQUEST_OVERRULE_UNMANAGED = (1L << 3),
 
                /* a collection of flags, that are commonly set for an explicit user-request. */
@@ -197,9 +197,9 @@ typedef enum { /*< skip >*/
                NM_DEVICE_CHECK_DEV_AVAILABLE_NONE = 0,
 
                /* the device is considered available, even if it has no carrier.
-	 *
-	 * For various device types (software devices) we ignore carrier based
-	 * on the type. So, for them, this flag has no effect anyway. */
+     *
+     * For various device types (software devices) we ignore carrier based
+     * on the type. So, for them, this flag has no effect anyway. */
                _NM_DEVICE_CHECK_DEV_AVAILABLE_IGNORE_CARRIER = (1L << 0),
 
                NM_DEVICE_CHECK_DEV_AVAILABLE_FOR_USER_REQUEST =
@@ -219,17 +219,17 @@ typedef struct _NMDeviceClass {
     const char *connection_type_supported;
 
     /* most device types, can only handle profiles of a particular type. This
-	 * is the connection.type setting, as checked by nm_device_check_connection_compatible() */
+     * is the connection.type setting, as checked by nm_device_check_connection_compatible() */
     const char *connection_type_check_compatible;
 
     const NMLinkType *link_types;
 
     /* if the device MTU is set based on parent's one, this specifies
-	 * a delta in the MTU allowed value due the encapsulation overhead */
+     * a delta in the MTU allowed value due the encapsulation overhead */
     guint16 mtu_parent_delta;
 
     /* Whether the device type is a master-type. This depends purely on the
-	 * type (NMDeviceClass), not the actual device instance. */
+     * type (NMDeviceClass), not the actual device instance. */
     bool is_master : 1;
 
     void (*state_changed)(NMDevice *          device,
@@ -240,22 +240,22 @@ typedef struct _NMDeviceClass {
     void (*link_changed)(NMDevice *self, const NMPlatformLink *pllink);
 
     /**
-	 * create_and_realize():
-	 * @self: the #NMDevice
-	 * @connection: the #NMConnection being activated
-	 * @parent: the parent #NMDevice, if any
-	 * @out_plink: on success, a backing kernel network device if one exists.
-	 *   The returned pointer is owned by platform and only valid until the
-	 *   next platform operation.
-	 * @error: location to store error, or %NULL
-	 *
-	 * Create any backing resources (kernel devices, etc) required for this
-	 * device to activate @connection.  If the device is backed by a kernel
-	 * network device, that device should be returned in @out_plink after
-	 * being created.
-	 *
-	 * Returns: %TRUE on success, %FALSE on error
-	 */
+     * create_and_realize():
+     * @self: the #NMDevice
+     * @connection: the #NMConnection being activated
+     * @parent: the parent #NMDevice, if any
+     * @out_plink: on success, a backing kernel network device if one exists.
+     *   The returned pointer is owned by platform and only valid until the
+     *   next platform operation.
+     * @error: location to store error, or %NULL
+     *
+     * Create any backing resources (kernel devices, etc) required for this
+     * device to activate @connection.  If the device is backed by a kernel
+     * network device, that device should be returned in @out_plink after
+     * being created.
+     *
+     * Returns: %TRUE on success, %FALSE on error
+     */
     gboolean (*create_and_realize)(NMDevice *             self,
                                    NMConnection *         connection,
                                    NMDevice *             parent,
@@ -263,32 +263,32 @@ typedef struct _NMDeviceClass {
                                    GError **              error);
 
     /**
-	 * realize_start_notify():
-	 * @self: the #NMDevice
-	 * @pllink: the #NMPlatformLink if backed by a kernel netdevice
-	 *
-	 * Hook for derived classes to be notfied during realize_start_setup()
-	 * and perform additional setup.
-	 *
-	 * The default implementation of NMDevice calls link_changed().
-	 */
+     * realize_start_notify():
+     * @self: the #NMDevice
+     * @pllink: the #NMPlatformLink if backed by a kernel netdevice
+     *
+     * Hook for derived classes to be notfied during realize_start_setup()
+     * and perform additional setup.
+     *
+     * The default implementation of NMDevice calls link_changed().
+     */
     void (*realize_start_notify)(NMDevice *self, const NMPlatformLink *pllink);
 
     /**
-	 * unrealize():
-	 * @self: the #NMDevice
-	 *
-	 * Remove the device backing resources.
-	 */
+     * unrealize():
+     * @self: the #NMDevice
+     *
+     * Remove the device backing resources.
+     */
     gboolean (*unrealize)(NMDevice *self, GError **error);
 
     /**
-	 * unrealize_notify():
-	 * @self: the #NMDevice
-	 *
-	 * Hook for derived classes to clear any properties that depend on backing resources
-	 * (kernel devices, etc). This is called by nm_device_unrealize() during unrealization.
-	 */
+     * unrealize_notify():
+     * @self: the #NMDevice
+     *
+     * Hook for derived classes to clear any properties that depend on backing resources
+     * (kernel devices, etc). This is called by nm_device_unrealize() during unrealization.
+     */
     void (*unrealize_notify)(NMDevice *self);
 
     /* Hardware state (IFF_UP) */
@@ -308,14 +308,14 @@ typedef struct _NMDeviceClass {
     void (*set_enabled)(NMDevice *self, gboolean enabled);
 
     /* let the subclass return additional NMPlatformRoutingRule (in form of NMPObject
-	 * pointers) that shall be added to the rules provided by this device.
-	 * The returned GPtrArray will be g_ptr_array_unref()'ed. The subclass may or
-	 * may not keep an additional reference and return this array again and again. */
+     * pointers) that shall be added to the rules provided by this device.
+     * The returned GPtrArray will be g_ptr_array_unref()'ed. The subclass may or
+     * may not keep an additional reference and return this array again and again. */
     GPtrArray *(*get_extra_rules)(NMDevice *self);
 
     /* allow derived classes to override the result of nm_device_autoconnect_allowed().
-	 * If the value changes, the class should call nm_device_emit_recheck_auto_activate(),
-	 * which emits NM_DEVICE_RECHECK_AUTO_ACTIVATE signal. */
+     * If the value changes, the class should call nm_device_emit_recheck_auto_activate(),
+     * which emits NM_DEVICE_RECHECK_AUTO_ACTIVATE signal. */
     gboolean (*get_autoconnect_allowed)(NMDevice *self);
 
     gboolean (*can_auto_connect)(NMDevice *            self,
@@ -327,7 +327,7 @@ typedef struct _NMDeviceClass {
                                   gboolean *         out_force);
 
     /* allow the subclass to overwrite the routing table. This is mainly useful
-	 * to change from partial mode (route-table=0) to full-sync mode (route-table=254). */
+     * to change from partial mode (route-table=0) to full-sync mode (route-table=254). */
     guint32 (*coerce_route_table)(NMDevice *self,
                                   int       addr_family,
                                   guint32   route_table,
@@ -336,24 +336,24 @@ typedef struct _NMDeviceClass {
     const char *(*get_auto_ip_config_method)(NMDevice *self, int addr_family);
 
     /* Checks whether the connection is compatible with the device using
-	 * only the devices type and characteristics.  Does not use any live
-	 * network information like Wi-Fi scan lists etc.
-	 */
+     * only the devices type and characteristics.  Does not use any live
+     * network information like Wi-Fi scan lists etc.
+     */
     gboolean (*check_connection_compatible)(NMDevice *    self,
                                             NMConnection *connection,
                                             GError **     error);
 
     /* Checks whether the connection is likely available to be activated,
-	 * including any live network information like scan lists.  The connection
-	 * is checked against the object defined by @specific_object, if given.
-	 * Returns TRUE if the connection is available; FALSE if not.
-	 *
-	 * The passed @flags affect whether a connection is considered
-	 * available or not. Adding more flags, means the connection is
-	 * *more* available.
-	 *
-	 * Specifying @specific_object can only reduce the availability of a connection.
-	 */
+     * including any live network information like scan lists.  The connection
+     * is checked against the object defined by @specific_object, if given.
+     * Returns TRUE if the connection is available; FALSE if not.
+     *
+     * The passed @flags affect whether a connection is considered
+     * available or not. Adding more flags, means the connection is
+     * *more* available.
+     *
+     * Specifying @specific_object can only reduce the availability of a connection.
+     */
     gboolean (*check_connection_available)(NMDevice *                     self,
                                            NMConnection *                 connection,
                                            NMDeviceCheckConAvailableFlags flags,
@@ -438,8 +438,8 @@ typedef struct _NMDeviceClass {
     gboolean (*set_platform_mtu)(NMDevice *self, guint32 mtu);
 
     /* Control whether to call stage1 and stage2 callbacks also for assuming
-	 * a device or for external activations. In this case, the callback must
-	 * take care not to touch the device's configuration. */
+     * a device or for external activations. In this case, the callback must
+     * take care not to touch the device's configuration. */
     bool act_stage1_prepare_also_for_external_or_assume : 1;
     bool act_stage2_config_also_for_external_or_assume : 1;
 
@@ -460,7 +460,7 @@ static inline const char *
 _nm_device_get_iface(NMDevice *device)
 {
     /* like nm_device_get_iface(), but gracefully accept NULL without
-	 * asserting. */
+     * asserting. */
     return device ? nm_device_get_iface(device) : NULL;
 }
 
@@ -617,7 +617,7 @@ typedef enum { /*< skip >*/
                NM_UNMANAGED_NONE = 0,
 
                /* these flags are authoritative. If one of them is set,
-	 * the device cannot be managed. */
+     * the device cannot be managed. */
                NM_UNMANAGED_SLEEPING      = (1LL << 0),
                NM_UNMANAGED_QUITTING      = (1LL << 1),
                NM_UNMANAGED_PARENT        = (1LL << 2),
@@ -627,7 +627,7 @@ typedef enum { /*< skip >*/
                NM_UNMANAGED_USER_SETTINGS = (1LL << 6),
 
                /* These flags can be non-effective and be overwritten
-	 * by other flags. */
+     * by other flags. */
                NM_UNMANAGED_BY_DEFAULT    = (1LL << 8),
                NM_UNMANAGED_USER_CONF     = (1LL << 9),
                NM_UNMANAGED_USER_UDEV     = (1LL << 10),
diff --git a/src/devices/nm-lldp-listener.c b/src/devices/nm-lldp-listener.c
index 20fbd195e6..0b70ce1cc7 100644
--- a/src/devices/nm-lldp-listener.c
+++ b/src/devices/nm-lldp-listener.c
@@ -288,16 +288,16 @@ parse_management_address_tlv(const uint8_t *data, gsize len)
     guint32         v_address_subtype;
 
     /* 802.1AB-2009 - Figure 8-11
-	 *
-	 * - TLV type / length        (2 bytes)
-	 * - address string length    (1 byte)
-	 * - address subtype          (1 byte)
-	 * - address                  (1 to 31 bytes)
-	 * - interface number subtype (1 byte)
-	 * - interface number         (4 bytes)
-	 * - OID string length        (1 byte)
-	 * - OID                      (0 to 128 bytes)
-	 */
+     *
+     * - TLV type / length        (2 bytes)
+     * - address string length    (1 byte)
+     * - address subtype          (1 byte)
+     * - address                  (1 to 31 bytes)
+     * - interface number subtype (1 byte)
+     * - interface number         (4 bytes)
+     * - OID string length        (1 byte)
+     * - OID                      (0 to 128 bytes)
+     */
 
     if (len < 11)
         return NULL;
@@ -449,8 +449,8 @@ lldp_neighbor_new(sd_lldp_neighbor *neighbor_sd)
     }
     if (!s_chassis_id) {
         /* Invalid/unsupported chassis_id? Expose as hex string. This format is not stable, and
-		 * in the future we may add a better string representation for these case (thus
-		 * changing the API). */
+         * in the future we may add a better string representation for these case (thus
+         * changing the API). */
         s_chassis_id = nm_utils_bin2hexstr_full(chassis_id, chassis_id_len, '\0', FALSE, NULL);
     }
 
@@ -470,8 +470,8 @@ lldp_neighbor_new(sd_lldp_neighbor *neighbor_sd)
     }
     if (!s_port_id) {
         /* Invalid/unsupported port_id? Expose as hex string. This format is not stable, and
-		 * in the future we may add a better string representation for these case (thus
-		 * changing the API). */
+         * in the future we may add a better string representation for these case (thus
+         * changing the API). */
         s_port_id = nm_utils_bin2hexstr_full(port_id, port_id_len, '\0', FALSE, NULL);
     }
 
@@ -594,7 +594,7 @@ lldp_neighbor_to_variant(LldpNeighbor *neigh)
                     continue;
 
                 /* in other cases, something is seriously wrong. Abort, but
-				 * keep what we parsed so far. */
+                 * keep what we parsed so far. */
                 break;
             }
 
diff --git a/src/devices/ovs/nm-device-ovs-bridge.c b/src/devices/ovs/nm-device-ovs-bridge.c
index 2c2c559977..b5477cee1a 100644
--- a/src/devices/ovs/nm-device-ovs-bridge.c
+++ b/src/devices/ovs/nm-device-ovs-bridge.c
@@ -45,7 +45,7 @@ create_and_realize(NMDevice *             device,
                    GError **              error)
 {
     /* The actual backing resources will be created on enslavement by the port
-	 * when it can identify the port and the bridge. */
+     * when it can identify the port and the bridge. */
 
     return TRUE;
 }
diff --git a/src/devices/ovs/nm-device-ovs-interface.c b/src/devices/ovs/nm-device-ovs-interface.c
index fa97dfb6e2..b976d3d509 100644
--- a/src/devices/ovs/nm-device-ovs-interface.c
+++ b/src/devices/ovs/nm-device-ovs-interface.c
@@ -53,8 +53,8 @@ create_and_realize(NMDevice *             device,
                    GError **              error)
 {
     /* The actual backing resources will be created once an interface is
-	 * added to a port of ours, since there can be neither an empty port nor
-	 * an empty bridge. */
+     * added to a port of ours, since there can be neither an empty port nor
+     * an empty bridge. */
 
     return TRUE;
 }
@@ -151,14 +151,14 @@ static gboolean
 set_platform_mtu(NMDevice *device, guint32 mtu)
 {
     /*
-	 * If the MTU is not set in ovsdb, Open vSwitch will change
-	 * the MTU of an internal interface to match the minimum of
-	 * the other interfaces in the bridge.
-	 */
+     * If the MTU is not set in ovsdb, Open vSwitch will change
+     * the MTU of an internal interface to match the minimum of
+     * the other interfaces in the bridge.
+     */
     /* FIXME(shutdown): the function should become cancellable so
-	 * that it doesn't need to hold a reference to the device, and
-	 * it can be stopped during shutdown.
-	 */
+     * that it doesn't need to hold a reference to the device, and
+     * it can be stopped during shutdown.
+     */
     if (_is_internal_interface(device)) {
         nm_ovsdb_set_interface_mtu(nm_ovsdb_get(),
                                    nm_device_get_ip_iface(device),
@@ -302,11 +302,11 @@ deactivate_async(NMDevice *                 device,
     _LOGT(LOGD_CORE, "deactivate: start async");
 
     /* We want to ensure that the kernel link for this device is
-	 * removed upon disconnection so that it will not interfere with
-	 * later activations of the same device. Unfortunately there is
-	 * no synchronization mechanism with vswitchd, we only update
-	 * ovsdb and wait that changes are picked up.
-	 */
+     * removed upon disconnection so that it will not interfere with
+     * later activations of the same device. Unfortunately there is
+     * no synchronization mechanism with vswitchd, we only update
+     * ovsdb and wait that changes are picked up.
+     */
 
     data  = g_slice_new(DeactivateData);
     *data = (DeactivateData){
@@ -327,11 +327,11 @@ deactivate_async(NMDevice *                 device,
 
     if (priv->waiting_for_interface) {
         /* At this point we have issued an INSERT and a DELETE
-		 * command for the interface to ovsdb. We don't know if
-		 * vswitchd will see the two updates or only one. We
-		 * must add a timeout to avoid waiting forever in case
-		 * the link doesn't appear.
-		 */
+         * command for the interface to ovsdb. We don't know if
+         * vswitchd will see the two updates or only one. We
+         * must add a timeout to avoid waiting forever in case
+         * the link doesn't appear.
+         */
         data->link_timeout_id = g_timeout_add(6000, deactivate_link_timeout, data);
         _LOGT(LOGD_DEVICE, "deactivate: waiting for link to disappear in 6 seconds");
     } else
@@ -349,10 +349,10 @@ static gboolean
 can_update_from_platform_link(NMDevice *device, const NMPlatformLink *plink)
 {
     /* If the device is deactivating, we already sent the
-	 * deletion command to ovsdb and we don't want to deal
-	 * with any new link appearing from the previous
-	 * activation.
-	 */
+     * deletion command to ovsdb and we don't want to deal
+     * with any new link appearing from the previous
+     * activation.
+     */
     return !plink || nm_device_get_state(device) != NM_DEVICE_STATE_DEACTIVATING;
 }
 
diff --git a/src/devices/ovs/nm-device-ovs-port.c b/src/devices/ovs/nm-device-ovs-port.c
index 4717be172a..59ca5ddafc 100644
--- a/src/devices/ovs/nm-device-ovs-port.c
+++ b/src/devices/ovs/nm-device-ovs-port.c
@@ -46,7 +46,7 @@ create_and_realize(NMDevice *             device,
                    GError **              error)
 {
     /* The port will be added to ovsdb when an interface is enslaved,
-	 * because there's no such thing like an empty port. */
+     * because there's no such thing like an empty port. */
 
     return TRUE;
 }
@@ -148,7 +148,7 @@ release_slave(NMDevice *device, NMDevice *slave, gboolean configure)
                                del_iface_cb,
                                g_object_ref(slave));
         /* Open VSwitch is going to delete this one. We must ignore what happens
-		 * next with the interface. */
+         * next with the interface. */
         if (NM_IS_DEVICE_OVS_INTERFACE(slave))
             nm_device_update_from_platform_link(slave, NULL);
     } else
diff --git a/src/devices/ovs/nm-ovs-factory.c b/src/devices/ovs/nm-ovs-factory.c
index 0513784f7d..db2165836c 100644
--- a/src/devices/ovs/nm-ovs-factory.c
+++ b/src/devices/ovs/nm-ovs-factory.c
@@ -167,8 +167,8 @@ ovsdb_interface_failed(NMOvsdb *        ovsdb,
     }
 
     /* The patch interface which gets created first is expected to
-	 * fail because the second patch doesn't exist yet. Ignore all
-	 * failures of patch interfaces. */
+     * fail because the second patch doesn't exist yet. Ignore all
+     * failures of patch interfaces. */
     if (connection && (c = nm_settings_connection_get_connection(connection))
         && (type = nm_connection_get_connection_type(c))
         && nm_streq0(type, NM_SETTING_OVS_INTERFACE_SETTING_NAME)
diff --git a/src/devices/ovs/nm-ovsdb.c b/src/devices/ovs/nm-ovsdb.c
index aa3977ec7c..3cbc6d2272 100644
--- a/src/devices/ovs/nm-ovsdb.c
+++ b/src/devices/ovs/nm-ovsdb.c
@@ -1170,7 +1170,7 @@ ovsdb_got_update(NMOvsdb *self, json_t *msg)
                        &interface)
         == -1) {
         /* This doesn't really have to be an error; the key might
-		 * be missing if there really are no bridges present. */
+         * be missing if there really are no bridges present. */
         _LOGD("Bad update: %s", json_error.text);
     }
 
@@ -1216,7 +1216,7 @@ ovsdb_got_update(NMOvsdb *self, json_t *msg)
                       ovs_interface->connection_uuid ?: "");
                 if (g_strcmp0(ovs_interface->type, "internal") == 0) {
                     /* Currently, the factory only creates NMDevices for
-					 * internal interfaces. Ignore the rest. */
+                     * internal interfaces. Ignore the rest. */
                     g_signal_emit(self,
                                   signals[DEVICE_REMOVED],
                                   0,
@@ -1247,7 +1247,7 @@ ovsdb_got_update(NMOvsdb *self, json_t *msg)
                       ovs_interface->connection_uuid ?: "");
                 if (g_strcmp0(ovs_interface->type, "internal") == 0) {
                     /* Currently, the factory only creates NMDevices for
-					 * internal interfaces. Ignore the rest. */
+                     * internal interfaces. Ignore the rest. */
                     g_signal_emit(self,
                                   signals[DEVICE_ADDED],
                                   0,
@@ -1256,7 +1256,7 @@ ovsdb_got_update(NMOvsdb *self, json_t *msg)
                 }
             }
             /* The error is a string. No error is indicated by an empty set,
-			 * because why the fuck not: [ "set": [] ] */
+             * because why the fuck not: [ "set": [] ] */
             if (error && json_is_string(error)) {
                 g_signal_emit(self,
                               signals[INTERFACE_FAILED],
@@ -1524,7 +1524,7 @@ ovsdb_got_msg(NMOvsdb *self, json_t *msg)
         priv->num_failures = 0;
 
         /* Don't progress further commands in case the callback hit an error
-		 * and disconnected us. */
+         * and disconnected us. */
         if (!priv->conn)
             return;
 
@@ -1594,8 +1594,8 @@ ovsdb_read_cb(GObject *source_object, GAsyncResult *res, gpointer user_data)
     do {
         priv->bufp = 0;
         /* The callback always eats up only up to a single byte. This makes
-		 * it possible for us to identify complete JSON objects in spite of
-		 * us not knowing the length in advance. */
+         * it possible for us to identify complete JSON objects in spite of
+         * us not knowing the length in advance. */
         msg = json_load_callback(_json_callback, self, JSON_DISABLE_EOF_CHECK, &json_error);
         if (msg) {
             ovsdb_got_msg(self, msg);
@@ -1741,7 +1741,7 @@ _monitor_bridges_cb(NMOvsdb *self, json_t *result, GError *error, gpointer user_
     }
 
     /* Treat the first response the same as the subsequent "update"
-	 * messages we eventually get. */
+     * messages we eventually get. */
     ovsdb_got_update(self, result);
 }
 
@@ -1801,7 +1801,7 @@ ovsdb_try_connect(NMOvsdb *self)
     g_object_unref(addr);
 
     /* Queue a monitor call before any other command, ensuring that we have an up
-	 * to date view of existing bridged that we need for add and remove ops. */
+     * to date view of existing bridged that we need for add and remove ops. */
     ovsdb_call_method(self,
                       OVSDB_MONITOR,
                       NULL,
diff --git a/src/devices/team/nm-device-team.c b/src/devices/team/nm-device-team.c
index c7b5b88b1b..110b22082f 100644
--- a/src/devices/team/nm-device-team.c
+++ b/src/devices/team/nm-device-team.c
@@ -340,8 +340,8 @@ teamd_timeout_cb(gpointer user_data)
                                 NM_DEVICE_STATE_REASON_TEAMD_CONTROL_FAILED);
     } else {
         /* Read again the configuration after the timeout since it might
-		 * have changed.
-		 */
+         * have changed.
+         */
         if (!teamd_read_config(self)) {
             _LOGW(LOGD_TEAM, "failed to read teamd configuration");
             nm_device_state_changed(device,
@@ -362,16 +362,16 @@ teamd_ready(NMDeviceTeam *self)
 
     if (priv->kill_in_progress) {
         /* If we are currently killing teamd, we are not
-		 * interested in knowing when it becomes ready. */
+         * interested in knowing when it becomes ready. */
         return;
     }
 
     nm_device_queue_recheck_assume(device);
 
     /* Grab a teamd control handle even if we aren't going to use it
-	 * immediately.  But if we are, and grabbing it failed, fail the
-	 * device activation.
-	 */
+     * immediately.  But if we are, and grabbing it failed, fail the
+     * device activation.
+     */
     success = ensure_teamd_connection(device);
 
     if (nm_device_get_state(device) != NM_DEVICE_STATE_PREPARE
@@ -426,8 +426,8 @@ teamd_dbus_appeared(GDBusConnection *connection,
     _LOGI(LOGD_TEAM, "teamd appeared on D-Bus");
 
     /* If another teamd grabbed the bus name while our teamd was starting,
-	 * just ignore the death of our teamd and run with the existing one.
-	 */
+     * just ignore the death of our teamd and run with the existing one.
+     */
     if (priv->teamd_process_watch) {
         gs_unref_variant GVariant *ret = NULL;
         guint32                    pid;
@@ -450,11 +450,11 @@ teamd_dbus_appeared(GDBusConnection *connection,
                 teamd_cleanup(self, FALSE);
         } else {
             /* The process that registered on the bus died. If it's
-			 * the teamd instance we just started, ignore the event
-			 * as we already detect the failure through the process
-			 * watch. If it's a previous instance that got killed,
-			 * also ignore that as our new instance will register
-			 * again. */
+             * the teamd instance we just started, ignore the event
+             * as we already detect the failure through the process
+             * watch. If it's a previous instance that got killed,
+             * also ignore that as our new instance will register
+             * again. */
             _LOGD(LOGD_TEAM, "failed to determine D-Bus name owner, ignoring");
             return;
         }
@@ -473,9 +473,9 @@ teamd_dbus_vanished(GDBusConnection *dbus_connection, const char *name, gpointer
 
     if (!priv->tdc) {
         /* g_bus_watch_name will always raise an initial signal, to indicate whether the
-		 * name exists/not exists initially. Do not take this as a failure if it hadn't
-		 * previously appeared.
-		 */
+         * name exists/not exists initially. Do not take this as a failure if it hadn't
+         * previously appeared.
+         */
         _LOGD(LOGD_TEAM, "teamd not on D-Bus (ignored)");
         return;
     }
@@ -522,8 +522,8 @@ teamd_process_watch_cb(GPid pid, int status, gpointer user_data)
     priv->teamd_process_watch = 0;
 
     /* If teamd quit within 5 seconds of starting, it's probably hosed
-	 * and will just die again, so fail the activation.
-	 */
+     * and will just die again, so fail the activation.
+     */
     if (priv->teamd_timeout && (state >= NM_DEVICE_STATE_PREPARE)
         && (state <= NM_DEVICE_STATE_ACTIVATED)) {
         _LOGW(LOGD_TEAM,
@@ -658,7 +658,7 @@ teamd_start(NMDeviceTeam *self)
         json_error_t jerror;
 
         /* Inject the hwaddr property into the JSON configuration.
-		 * While doing so, detect potential conflicts */
+         * While doing so, detect potential conflicts */
 
         json = json_loads(config ?: "{}", JSON_REJECT_DUPLICATES, &jerror);
         g_return_val_if_fail(json, FALSE);
@@ -749,10 +749,10 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
 
     if (priv->tdc) {
         /* If the existing teamd config is the same as we're about to use,
-		 * then we can proceed.  If it's not the same, and we have a PID,
-		 * kill it so we can respawn it with the right config.  If we don't
-		 * have a PID, then we must fail.
-		 */
+         * then we can proceed.  If it's not the same, and we have a PID,
+         * kill it so we can respawn it with the right config.  If we don't
+         * have a PID, then we must fail.
+         */
         cfg = teamdctl_config_get_raw(priv->tdc);
         if (cfg && nm_streq0(cfg, nm_setting_team_get_config(s_team))) {
             _LOGD(LOGD_TEAM, "using existing matching teamd config");
@@ -894,9 +894,9 @@ release_slave(NMDevice *device, NMDevice *slave, gboolean configure)
             _LOGW(LOGD_TEAM, "failed to release team port %s", nm_device_get_ip_iface(slave));
 
         /* Kernel team code "closes" the port when releasing it, (which clears
-		 * IFF_UP), so we must bring it back up here to ensure carrier changes and
-		 * other state is noticed by the now-released port.
-		 */
+         * IFF_UP), so we must bring it back up here to ensure carrier changes and
+         * other state is noticed by the now-released port.
+         */
         if (!nm_device_bring_up(slave, TRUE, NULL)) {
             _LOGW(LOGD_TEAM,
                   "released team port %s could not be brought up",
diff --git a/src/devices/tests/test-acd.c b/src/devices/tests/test-acd.c
index f11188202e..e7dd1f4413 100644
--- a/src/devices/tests/test-acd.c
+++ b/src/devices/tests/test-acd.c
@@ -115,9 +115,9 @@ test_acd_common(test_fixture *fixture, TestInfo *info)
         return;
 
     /* first, try with a short waittime. We hope that this is long enough
-	 * to successfully complete the test. Only if that's not the case, we
-	 * assume the computer is currently busy (high load) and we retry with
-	 * a longer timeout. */
+     * to successfully complete the test. Only if that's not the case, we
+     * assume the computer is currently busy (high load) and we retry with
+     * a longer timeout. */
     wait_time = WAIT_TIME_OPTIMISTIC;
 again:
 
@@ -163,7 +163,7 @@ again:
 
         if (wait_time == WAIT_TIME_OPTIMISTIC) {
             /* probably we just had a glitch and the system took longer than
-			 * expected. Re-verify with a large timeout this time. */
+             * expected. Re-verify with a large timeout this time. */
             wait_time = 1000;
             goto again;
         }
diff --git a/src/devices/tests/test-lldp.c b/src/devices/tests/test-lldp.c
index 9ac577331a..a9bedd8cc8 100644
--- a/src/devices/tests/test-lldp.c
+++ b/src/devices/tests/test-lldp.c
@@ -227,7 +227,7 @@ TEST_RECV_DATA_DEFINE(_test_recv_data0_twice,
 TEST_RECV_FRAME_DEFINE(
     _test_recv_data1_frame0,
     /* lldp.detailed.pcap from
-	 * https://wiki.wireshark.org/SampleCaptures#Link_Layer_Discovery_Protocol_.28LLDP.29 */
+     * https://wiki.wireshark.org/SampleCaptures#Link_Layer_Discovery_Protocol_.28LLDP.29 */
     "{'raw': <[byte 0x01, 0x80, 0xc2, 0x00, 0x00, 0x0e, 0x00, 0x01, 0x30, 0xf9, 0xad, 0xa0, 0x88, "
     "0xcc, 0x02, 0x07, 0x04, 0x00, 0x01, 0x30, 0xf9, 0xad, 0xa0, 0x04, 0x04, 0x05, 0x31, 0x2f, "
     "0x31, 0x06, 0x02, 0x00, 0x78, 0x08, 0x17, 0x53, 0x75, 0x6d, 0x6d, 0x69, 0x74, 0x33, 0x30, "
diff --git a/src/devices/wifi/nm-device-iwd.c b/src/devices/wifi/nm-device-iwd.c
index a56a491fac..8e22fcc230 100644
--- a/src/devices/wifi/nm-device-iwd.c
+++ b/src/devices/wifi/nm-device-iwd.c
@@ -244,13 +244,13 @@ insert_ap_from_network(NMDeviceIwd *self,
     }
 
     /* What we get from IWD are networks, or ESSs, that may contain
-	 * multiple APs, or BSSs, each.  We don't get information about any
-	 * specific BSSs within an ESS but we can safely present each ESS
-	 * as an individual BSS to NM, which will be seen as ESSs comprising
-	 * a single BSS each.  NM won't be able to handle roaming but IWD
-	 * already does that.  We fake the BSSIDs as they don't play any
-	 * role either.
-	 */
+     * multiple APs, or BSSs, each.  We don't get information about any
+     * specific BSSs within an ESS but we can safely present each ESS
+     * as an individual BSS to NM, which will be seen as ESSs comprising
+     * a single BSS each.  NM won't be able to handle roaming but IWD
+     * already does that.  We fake the BSSIDs as they don't play any
+     * role either.
+     */
     bssid[0] = 0x00;
     bssid[1] = 0x01;
     bssid[2] = 0x02;
@@ -308,9 +308,9 @@ get_ordered_networks_cb(GObject *source, GAsyncResult *res, gpointer user_data)
     priv = NM_DEVICE_IWD_GET_PRIVATE(self);
 
     /* Depending on whether we're using the Station interface or the Device
-	 * interface for compatibility with IWD <= 0.7, the return signature of
-	 * GetOrderedNetworks will be different.
-	 */
+     * interface for compatibility with IWD <= 0.7, the return signature of
+     * GetOrderedNetworks will be different.
+     */
     compat     = priv->dbus_station_proxy == priv->dbus_device_proxy;
     return_sig = compat ? "(a(osns))" : "(a(on))";
 
@@ -350,9 +350,9 @@ get_ordered_networks_cb(GObject *source, GAsyncResult *res, gpointer user_data)
 
         if (ap == priv->current_ap) {
             /* Normally IWD will prevent the current AP from being
-			 * removed from the list and set a low signal strength,
-			 * but just making sure.
-			 */
+             * removed from the list and set a low signal strength,
+             * but just making sure.
+             */
             continue;
         }
 
@@ -643,8 +643,8 @@ check_connection_compatible(NMDevice *device, NMConnection *connection, GError *
 
     if (NM_IN_STRSET(mode, NULL, NM_SETTING_WIRELESS_MODE_INFRA)) {
         /* 8021x networks can only be used if they've been provisioned on the IWD side and
-		 * thus are Known Networks.
-		 */
+         * thus are Known Networks.
+         */
         if (security == NM_IWD_NETWORK_SECURITY_8021X) {
             if (!is_connection_known_network(connection)) {
                 nm_utils_error_set_literal(error,
@@ -717,7 +717,7 @@ check_connection_available(NMDevice *                     device,
     g_return_val_if_fail(s_wifi, FALSE);
 
     /* a connection that is available for a certain @specific_object, MUST
-	 * also be available in general (without @specific_object). */
+     * also be available in general (without @specific_object). */
 
     if (specific_object) {
         ap = nm_wifi_ap_lookup_for_device(NM_DEVICE(self), specific_object);
@@ -754,8 +754,8 @@ check_connection_available(NMDevice *                     device,
     }
 
     /* 8021x networks can only be used if they've been provisioned on the IWD side and
-	 * thus are Known Networks.
-	 */
+     * thus are Known Networks.
+     */
     if (nm_wifi_connection_get_iwd_security(connection, NULL) == NM_IWD_NETWORK_SECURITY_8021X) {
         if (!is_ap_known_network(ap)) {
             nm_utils_error_set_literal(
@@ -818,9 +818,9 @@ complete_connection(NMDevice *           device,
         ap = nm_wifi_aps_find_first_compatible(&priv->aps_lst_head, connection);
         if (!ap) {
             /* If we still don't have an AP, then the WiFI settings needs to be
-			 * fully specified by the client.  Might not be able to find an AP
-			 * if the network isn't broadcasting the SSID for example.
-			 */
+             * fully specified by the client.  Might not be able to find an AP
+             * if the network isn't broadcasting the SSID for example.
+             */
             if (!nm_setting_verify(NM_SETTING(s_wifi), connection, error))
                 return FALSE;
 
@@ -916,14 +916,14 @@ is_available(NMDevice *device, NMDeviceCheckDevAvailableFlags flags)
     NMDeviceState       state = nm_device_get_state(device);
 
     /* Available if either the device is UP and in station mode
-	 * or in AP/Ad-Hoc modes while activating or activated.  Device
-	 * may be temporarily DOWN while activating or deactivating and
-	 * we don't want it to be marked unavailable because of this.
-	 *
-	 * For reference:
-	 * We call nm_device_queue_recheck_available whenever
-	 * priv->enabled changes or priv->dbus_station_proxy changes.
-	 */
+     * or in AP/Ad-Hoc modes while activating or activated.  Device
+     * may be temporarily DOWN while activating or deactivating and
+     * we don't want it to be marked unavailable because of this.
+     *
+     * For reference:
+     * We call nm_device_queue_recheck_available whenever
+     * priv->enabled changes or priv->dbus_station_proxy changes.
+     */
     return priv->dbus_obj && priv->enabled
            && (priv->dbus_station_proxy
                || (state >= NM_DEVICE_STATE_CONFIG && state <= NM_DEVICE_STATE_DEACTIVATING));
@@ -959,16 +959,16 @@ can_auto_connect(NMDevice *device, NMSettingsConnection *sett_conn, char **speci
     g_return_val_if_fail(s_wifi, FALSE);
 
     /* Don't auto-activate AP or Ad-Hoc connections.
-	 * Note the wpa_supplicant backend has the opposite policy.
-	 */
+     * Note the wpa_supplicant backend has the opposite policy.
+     */
     mode = nm_setting_wireless_get_mode(s_wifi);
     if (mode && g_strcmp0(mode, NM_SETTING_WIRELESS_MODE_INFRA) != 0)
         return FALSE;
 
     /* Don't autoconnect to networks that have been tried at least once
-	 * but haven't been successful, since these are often accidental choices
-	 * from the menu and the user may not know the password.
-	 */
+     * but haven't been successful, since these are often accidental choices
+     * from the menu and the user may not know the password.
+     */
     if (nm_settings_connection_get_timestamp(sett_conn, &timestamp)) {
         if (timestamp == 0)
             return FALSE;
@@ -1008,10 +1008,10 @@ scan_cb(GObject *source, GAsyncResult *res, gpointer user_data)
     _notify(self, PROP_LAST_SCAN);
 
     /* On success, priv->scanning becomes true right before or right
-	 * after this callback, so the next automatic scan will be
-	 * scheduled when priv->scanning goes back to false.  On error,
-	 * schedule a retry now.
-	 */
+     * after this callback, so the next automatic scan will be
+     * scheduled when priv->scanning goes back to false.  On error,
+     * schedule a retry now.
+     */
     if (error && !priv->scanning)
         schedule_periodic_scan(self, FALSE);
 }
@@ -1364,8 +1364,8 @@ network_connect_cb(GObject *source, GAsyncResult *res, gpointer user_data)
         gs_free char *dbus_error = NULL;
 
         /* Connection failed; radio problems or if the network wasn't
-		 * open, the passwords or certificates may be wrong.
-		 */
+         * open, the passwords or certificates may be wrong.
+         */
 
         _LOGE(LOGD_DEVICE | LOGD_WIFI,
               "Activation: (wifi) Network.Connect failed: %s",
@@ -1449,9 +1449,9 @@ act_failed_cb(GObject *source, GAsyncResult *res, gpointer user_data)
         return;
 
     /* Change state to FAILED unless already done by state_changed
-	 * which may have been triggered by the station interface
-	 * appearing on DBus.
-	 */
+     * which may have been triggered by the station interface
+     * appearing on DBus.
+     */
     if (nm_device_get_state(device) == NM_DEVICE_STATE_CONFIG)
         nm_device_queue_state(device,
                               NM_DEVICE_STATE_FAILED,
@@ -1636,10 +1636,10 @@ act_set_mode(NMDeviceIwd *self)
     mode = nm_setting_wireless_get_mode(s_wireless);
 
     /* We need to first set interface mode (Device.Mode) to ap or ad-hoc.
-	 * We can't directly queue a call to the Start/StartOpen method on
-	 * the DBus interface that's going to be created after the property
-	 * set call returns.
-	 */
+     * We can't directly queue a call to the Start/StartOpen method on
+     * the DBus interface that's going to be created after the property
+     * set call returns.
+     */
     iwd_mode = nm_streq(mode, NM_SETTING_WIRELESS_MODE_AP) ? "ap" : "ad-hoc";
 
     if (!priv->cancellable)
@@ -1767,11 +1767,11 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
 
 add_new:
     /* If the user is trying to connect to an AP that NM doesn't yet know about
-	 * (hidden network or something) or starting a Hotspot, create an fake AP
-	 * from the security settings in the connection.  This "fake" AP gets used
-	 * until the real one is found in the scan list (Ad-Hoc or Hidden), or until
-	 * the device is deactivated (Ad-Hoc or Hotspot).
-	 */
+     * (hidden network or something) or starting a Hotspot, create an fake AP
+     * from the security settings in the connection.  This "fake" AP gets used
+     * until the real one is found in the scan list (Ad-Hoc or Hidden), or until
+     * the device is deactivated (Ad-Hoc or Hotspot).
+     */
     ap_fake = nm_wifi_ap_new_fake_from_connection(connection);
     if (!ap_fake)
         g_return_val_if_reached(NM_ACT_STAGE_RETURN_FAILURE);
@@ -1815,9 +1815,9 @@ act_stage2_config(NMDevice *device, NMDeviceStateReason *out_failure_reason)
         }
 
         /* 802.1x networks that are not IWD Known Networks will definitely
-		 * fail, for other combinations we will let the Connect call fail
-		 * or ask us for any missing secrets through the Agent.
-		 */
+         * fail, for other combinations we will let the Connect call fail
+         * or ask us for any missing secrets through the Agent.
+         */
         if (nm_connection_get_setting_802_1x(connection) && !is_ap_known_network(ap)) {
             _LOGI(LOGD_DEVICE | LOGD_WIFI,
                   "Activation: (wifi) access point '%s' has 802.1x security but is not configured "
@@ -1869,8 +1869,8 @@ act_stage2_config(NMDevice *device, NMDeviceStateReason *out_failure_reason)
             priv->cancellable = g_cancellable_new();
 
         /* Call Network.Connect.  No timeout because IWD already handles
-		 * timeouts.
-		 */
+         * timeouts.
+         */
         g_dbus_proxy_call(network_proxy,
                           "Connect",
                           NULL,
@@ -1963,16 +1963,16 @@ schedule_periodic_scan(NMDeviceIwd *self, gboolean initial_scan)
     g_variant_unref(value);
 
     /* Start scan immediately after a disconnect, mode change or
-	 * device UP, otherwise wait a period dependent on the current
-	 * state.
-	 *
-	 * (initial_scan && disconnected) override priv->scanning below
-	 * because of an IWD quirk where a device will often be in the
-	 * autoconnect state and scanning at the time of our initial_scan,
-	 * but our logic will the send it a Disconnect() causing IWD to
-	 * exit autoconnect and interrupt the ongoing scan, meaning that
-	 * we still want a new scan ASAP.
-	 */
+     * device UP, otherwise wait a period dependent on the current
+     * state.
+     *
+     * (initial_scan && disconnected) override priv->scanning below
+     * because of an IWD quirk where a device will often be in the
+     * autoconnect state and scanning at the time of our initial_scan,
+     * but our logic will the send it a Disconnect() causing IWD to
+     * exit autoconnect and interrupt the ongoing scan, meaning that
+     * we still want a new scan ASAP.
+     */
     if (initial_scan && disconnected)
         interval = 0;
     else if (!priv->periodic_scan_id && !priv->scanning)
@@ -2011,10 +2011,10 @@ device_state_changed(NMDevice *          device,
         break;
     case NM_DEVICE_STATE_UNAVAILABLE:
         /*
-		 * If the device is enabled and the IWD manager is ready,
-		 * transition to DISCONNECTED because the device is now
-		 * ready to use.
-		 */
+         * If the device is enabled and the IWD manager is ready,
+         * transition to DISCONNECTED because the device is now
+         * ready to use.
+         */
         if (priv->enabled && priv->dbus_station_proxy) {
             nm_device_queue_recheck_available(device,
                                               NM_DEVICE_STATE_REASON_SUPPLICANT_AVAILABLE,
@@ -2176,11 +2176,11 @@ state_changed(NMDeviceIwd *self, const char *new_state)
 
     if (NM_IN_STRSET(new_state, "connecting", "connected", "roaming")) {
         /* If we were connecting, do nothing, the confirmation of
-		 * a connection success is handled in the Device.Connect
-		 * method return callback.  Otherwise, IWD must have connected
-		 * without Network Manager's will so for simplicity force a
-		 * disconnect.
-		 */
+         * a connection success is handled in the Device.Connect
+         * method return callback.  Otherwise, IWD must have connected
+         * without Network Manager's will so for simplicity force a
+         * disconnect.
+         */
         if (iwd_connection)
             return;
 
@@ -2188,17 +2188,17 @@ state_changed(NMDeviceIwd *self, const char *new_state)
         send_disconnect(self);
     } else if (NM_IN_STRSET(new_state, "disconnecting", "disconnected")) {
         /* Call Disconnect on the IWD device object to make sure it
-		 * disables its own autoconnect.
-		 */
+         * disables its own autoconnect.
+         */
         send_disconnect(self);
 
         /*
-		 * If IWD is still handling the Connect call, let our Connect
-		 * callback for the dbus method handle the failure.  The main
-		 * reason we can't handle the failure here is because the method
-		 * callback will have more information on the specific failure
-		 * reason.
-		 */
+         * If IWD is still handling the Connect call, let our Connect
+         * callback for the dbus method handle the failure.  The main
+         * reason we can't handle the failure here is because the method
+         * callback will have more information on the specific failure
+         * reason.
+         */
         if (NM_IN_SET(dev_state, NM_DEVICE_STATE_CONFIG, NM_DEVICE_STATE_NEED_AUTH))
             return;
 
@@ -2212,8 +2212,8 @@ state_changed(NMDeviceIwd *self, const char *new_state)
     }
 
     /* Don't allow new connection until iwd exits disconnecting and no
-	 * Connect callback is pending.
-	 */
+     * Connect callback is pending.
+     */
     if (NM_IN_STRSET(new_state, "disconnected")) {
         priv->can_connect = TRUE;
         if (!can_connect)
@@ -2331,19 +2331,19 @@ powered_changed(NMDeviceIwd *self, gboolean new_powered)
     }
 
     /* We expect one of the three interfaces to always be present when
-	 * device is Powered so if AP and AdHoc are not present we should
-	 * be in station mode.
-	 */
+     * device is Powered so if AP and AdHoc are not present we should
+     * be in station mode.
+     */
     if (new_powered && !priv->dbus_ap_proxy && !priv->dbus_adhoc_proxy) {
         interface = g_dbus_object_get_interface(priv->dbus_obj, NM_IWD_STATION_INTERFACE);
         if (!interface) {
             /* No Station interface on the device object.  Check if the
-			 * "State" property is present on the Device interface, that
-			 * would mean we're dealing with an IWD version from before the
-			 * Device/Station split (0.7 or earlier) and we can easily
-			 * handle that by making priv->dbus_device_proxy and
-			 * priv->dbus_station_proxy both point at the Device interface.
-			 */
+             * "State" property is present on the Device interface, that
+             * would mean we're dealing with an IWD version from before the
+             * Device/Station split (0.7 or earlier) and we can easily
+             * handle that by making priv->dbus_device_proxy and
+             * priv->dbus_station_proxy both point at the Device interface.
+             */
             value = g_dbus_proxy_get_cached_property(priv->dbus_device_proxy, "State");
             if (value) {
                 g_variant_unref(value);
@@ -2534,13 +2534,13 @@ nm_device_iwd_agent_query(NMDeviceIwd *self, GDBusMethodInvocation *invocation)
         return TRUE;
 
     /* Normally require new secrets every time IWD asks for them.
-	 * IWD only queries us if it has not saved the secrets (e.g. by policy)
-	 * or a previous attempt has failed with current secrets so it wants
-	 * a fresh set.  However if this is a new connection it may include
-	 * all of the needed settings already so allow using these, too.
-	 * Connection timestamp is set after activation or after first
-	 * activation failure (to 0).
-	 */
+     * IWD only queries us if it has not saved the secrets (e.g. by policy)
+     * or a previous attempt has failed with current secrets so it wants
+     * a fresh set.  However if this is a new connection it may include
+     * all of the needed settings already so allow using these, too.
+     * Connection timestamp is set after activation or after first
+     * activation failure (to 0).
+     */
     if (nm_settings_connection_get_timestamp(nm_act_request_get_settings_connection(req), NULL))
         get_secret_flags |= NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW;
 
diff --git a/src/devices/wifi/nm-device-olpc-mesh.c b/src/devices/wifi/nm-device-olpc-mesh.c
index 7cbfadf27a..6aa2586899 100644
--- a/src/devices/wifi/nm-device-olpc-mesh.c
+++ b/src/devices/wifi/nm-device-olpc-mesh.c
@@ -70,7 +70,7 @@ get_autoconnect_allowed(NMDevice *device)
         return FALSE;
 
     /* We must not attempt to autoconnect when the companion is connected or
-	 * connecting, * because we'd tear down its connection. */
+     * connecting, * because we'd tear down its connection. */
     if (nm_device_get_state(priv->companion) > NM_DEVICE_STATE_DISCONNECTED)
         return FALSE;
 
@@ -162,7 +162,7 @@ _mesh_set_channel(NMDeviceOlpcMesh *self, guint32 channel)
         channel = old_channel;
 
     /* We want to call this even if the channel number is the same,
-	 * because that actually starts the mesh with the configured mesh ID. */
+     * because that actually starts the mesh with the configured mesh ID. */
     if (!nm_platform_mesh_set_channel(platform, ifindex, channel))
         return FALSE;
 
@@ -287,7 +287,7 @@ companion_autoconnect_allowed_cb(NMDeviceWifi *companion, gpointer user_data)
     NMDeviceState     state = nm_device_get_state(NM_DEVICE(self));
 
     /* Don't allow the companion to autoconnect while a mesh connection is
-	 * active */
+     * active */
     return (state < NM_DEVICE_STATE_PREPARE) || (state > NM_DEVICE_STATE_ACTIVATED);
 }
 
diff --git a/src/devices/wifi/nm-device-wifi-p2p.c b/src/devices/wifi/nm-device-wifi-p2p.c
index f9ddee4e63..81ff675f5c 100644
--- a/src/devices/wifi/nm-device-wifi-p2p.c
+++ b/src/devices/wifi/nm-device-wifi-p2p.c
@@ -38,10 +38,10 @@ typedef struct {
     NMSupplicantManager *sup_mgr;
 
     /* NOTE: In theory management and group ifaces could be identical. However,
-	 * in practice, this cannot happen currently as NMDeviceWifiP2P is only
-	 * created for existing non-P2P interfaces.
-	 * (i.e. a single standalone P2P interface is not supported at this point)
-	 */
+     * in practice, this cannot happen currently as NMDeviceWifiP2P is only
+     * created for existing non-P2P interfaces.
+     * (i.e. a single standalone P2P interface is not supported at this point)
+     */
     NMSupplicantInterface *mgmt_iface;
     NMSupplicantInterface *group_iface;
 
@@ -161,7 +161,7 @@ check_connection_peer_joined(NMDeviceWifiP2P *device)
         return FALSE;
 
     /* Comparing the object path found on the group_iface with the peers
-	 * found on the mgmt_iface is legal. */
+     * found on the mgmt_iface is legal. */
     group = nm_supplicant_interface_get_p2p_group_path(priv->group_iface);
     if (!group)
         return FALSE;
@@ -242,9 +242,9 @@ check_connection_compatible(NMDevice *device, NMConnection *connection, GError *
     /* TODO: Allow limitting the interface using the HW-address? */
 
     /* We don't need to check anything else here. The P2P device will only
-	 * exists if we are able to establish a P2P connection, and there should
-	 * be no further restrictions necessary.
-	 */
+     * exists if we are able to establish a P2P connection, and there should
+     * be no further restrictions necessary.
+     */
 
     return TRUE;
 }
@@ -514,7 +514,7 @@ peer_add_remove(NMDeviceWifiP2P *self,
 
     if (is_adding) {
         /* If we are in prepare state, then we are currently runnign a find
-		 * to search for the requested peer. */
+         * to search for the requested peer. */
         if (priv->find_peer_timeout_id != 0) {
             NMConnection *connection;
 
@@ -830,7 +830,7 @@ supplicant_iface_group_started_cb(NMSupplicantInterface *iface,
     priv->group_iface = g_object_ref(group_iface);
 
     /* We need to wait for the interface to be ready and the group
-	 * information to be resolved. */
+     * information to be resolved. */
     g_signal_connect(priv->group_iface,
                      "notify::" NM_SUPPLICANT_INTERFACE_P2P_GROUP_JOINED,
                      G_CALLBACK(supplicant_iface_group_joined_updated_cb),
@@ -907,10 +907,10 @@ device_state_changed(NMDevice *          device,
 
     if (new_state <= NM_DEVICE_STATE_UNAVAILABLE) {
         /* Clean up the supplicant interface because in these states the
-		 * device cannot be used.
-		 * Do not clean up for the UNMANAGED to UNAVAILABLE transition which
-		 * will happen during initialization.
-		 */
+         * device cannot be used.
+         * Do not clean up for the UNMANAGED to UNAVAILABLE transition which
+         * will happen during initialization.
+         */
         if (priv->mgmt_iface && old_state > new_state)
             supplicant_interfaces_release(self, TRUE);
 
@@ -940,7 +940,7 @@ device_state_changed(NMDevice *          device,
         break;
     case NM_DEVICE_STATE_FAILED:
         /* Clear any critical protocol notification in the wifi stack.
-		 * At this point the IP device may have been removed already. */
+         * At this point the IP device may have been removed already. */
         nm_supplicant_manager_set_wfd_ies(priv->sup_mgr, NULL);
         if (nm_device_get_ip_ifindex(device) > 0)
             nm_platform_wifi_indicate_addressing_running(nm_device_get_platform(device),
diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
index 459b713359..33bd3a2b9d 100644
--- a/src/devices/wifi/nm-device-wifi.c
+++ b/src/devices/wifi/nm-device-wifi.c
@@ -323,8 +323,8 @@ _scan_request_ssids_track(NMDeviceWifiPrivate *priv, const GPtrArray *ssids)
         priv->scan_request_ssids_hash = g_hash_table_new(nm_pgbytes_hash, nm_pgbytes_equal);
 
     /* Do a little dance. New elements shall keep their order as in @ssids, but all
-	 * new elements should be sorted in the list preexisting elements of the list.
-	 * First move the old elements away, and splice them back afterwards. */
+     * new elements should be sorted in the list preexisting elements of the list.
+     * First move the old elements away, and splice them back afterwards. */
     c_list_init(&old_lst_head);
     c_list_splice(&old_lst_head, &priv->scan_request_ssids_lst_head);
 
@@ -350,7 +350,7 @@ _scan_request_ssids_track(NMDeviceWifiPrivate *priv, const GPtrArray *ssids)
     c_list_splice(&priv->scan_request_ssids_lst_head, &old_lst_head);
 
     /* Trim the excess. After our splice with old_lst_head, the list contains the new
-	 * elements (from @ssids) at the front (in there original order), followed by older elements. */
+     * elements (from @ssids) at the front (in there original order), followed by older elements. */
     _scan_request_ssids_remove_all(priv, now_msec, SCAN_REQUEST_SSIDS_MAX_NUM);
 }
 
@@ -370,9 +370,9 @@ nm_device_wifi_scanning_prohibited_track(NMDeviceWifi *self,
     priv = NM_DEVICE_WIFI_GET_PRIVATE(self);
 
     /* We track these with a simple CList. This would be not efficient, if
-	 * there would be many users that need to be tracked at the same time (there
-	 * aren't). In fact, most of the time there is no NMDeviceOlpcMesh and
-	 * nobody tracks itself here. Optimize for that and simplicity. */
+     * there would be many users that need to be tracked at the same time (there
+     * aren't). In fact, most of the time there is no NMDeviceOlpcMesh and
+     * nobody tracks itself here. Optimize for that and simplicity. */
 
     elem = nm_c_list_elem_find_first(&priv->scanning_prohibited_lst_head, iter, iter == tag);
 
@@ -451,8 +451,8 @@ _scan_notify_is_scanning(NMDeviceWifi *self)
 
     if (scanning) {
         /* while the device is activating/activated, we don't need the pending
-		 * action. The pending action exists to delay startup complete, while
-		 * activating that is already achieved via other means. */
+         * action. The pending action exists to delay startup complete, while
+         * activating that is already achieved via other means. */
         if (state <= NM_DEVICE_STATE_DISCONNECTED || state > NM_DEVICE_STATE_ACTIVATED)
             nm_device_add_pending_action(NM_DEVICE(self), NM_PENDING_ACTION_WIFI_SCAN, FALSE);
     }
@@ -488,15 +488,15 @@ _scan_notify_allowed(NMDeviceWifi *self, NMTernary do_kickoff)
         /* something prohibits scanning. */
     } else if (NM_IN_SET(priv->mode, NM_802_11_MODE_ADHOC, NM_802_11_MODE_AP)) {
         /* Don't scan when a an AP or Ad-Hoc connection is active as it will
-		 * disrupt connected clients or peers. */
+         * disrupt connected clients or peers. */
     } else if (NM_IN_SET(state, NM_DEVICE_STATE_DISCONNECTED, NM_DEVICE_STATE_FAILED)) {
         /* Can always scan when disconnected */
         explicit_allowed = TRUE;
         periodic_allowed = TRUE;
     } else if (NM_IN_SET(state, NM_DEVICE_STATE_ACTIVATED)) {
         /* Prohibit periodic scans when connected; we ask the supplicant to
-		 * background scan for us, unless the connection is locked to a specific
-		 * BSSID (in which case scanning is effectively disabled). */
+         * background scan for us, unless the connection is locked to a specific
+         * BSSID (in which case scanning is effectively disabled). */
         periodic_allowed = FALSE;
 
         /* Prohibit scans if the supplicant is busy */
@@ -538,11 +538,11 @@ static gboolean
 unmanaged_on_quit(NMDevice *self)
 {
     /* Wi-Fi devices cannot be assumed and are always taken down.
-	 * However, also when being disconnected, we scan and thus
-	 * set the MAC address to a random value.
-	 *
-	 * We must restore the original MAC address when quitting, thus
-	 * signal to unmanage the device. */
+     * However, also when being disconnected, we scan and thus
+     * set the MAC address to a random value.
+     *
+     * We must restore the original MAC address when quitting, thus
+     * signal to unmanage the device. */
     return TRUE;
 }
 
@@ -731,8 +731,8 @@ periodic_update(NMDeviceWifi *self)
 
     if (nm_device_get_state(NM_DEVICE(self)) != NM_DEVICE_STATE_ACTIVATED) {
         /* BSSID and signal strength have meaningful values only if the device
-		 * is activated and not scanning.
-		 */
+         * is activated and not scanning.
+         */
         return;
     }
 
@@ -742,9 +742,9 @@ periodic_update(NMDeviceWifi *self)
             nm_supplicant_interface_get_state(priv->sup_iface))
         || nm_supplicant_interface_get_scanning(priv->sup_iface)) {
         /* Only update current AP if we're actually talking to something, otherwise
-		 * assume the old one (if any) is still valid until we're told otherwise or
-		 * the connection fails.
-		 */
+         * assume the old one (if any) is still valid until we're told otherwise or
+         * the connection fails.
+         */
         return;
     }
 
@@ -933,8 +933,8 @@ deactivate(NMDevice *device)
     nm_platform_wifi_indicate_addressing_running(nm_device_get_platform(device), ifindex, FALSE);
 
     /* Ensure we're in infrastructure mode after deactivation; some devices
-	 * (usually older ones) don't scan well in adhoc mode.
-	 */
+     * (usually older ones) don't scan well in adhoc mode.
+     */
     if (nm_platform_wifi_get_mode(nm_device_get_platform(device), ifindex)
         != NM_802_11_MODE_INFRA) {
         nm_device_take_down(NM_DEVICE(self), TRUE);
@@ -1074,7 +1074,7 @@ check_connection_available(NMDevice *                     device,
     g_return_val_if_fail(s_wifi, FALSE);
 
     /* a connection that is available for a certain @specific_object, MUST
-	 * also be available in general (without @specific_object). */
+     * also be available in general (without @specific_object). */
 
     if (specific_object) {
         NMWifiAP *ap;
@@ -1096,8 +1096,8 @@ check_connection_available(NMDevice *                     device,
     }
 
     /* Ad-Hoc, AP and Mesh connections are always available because they may be
-	 * started at any time.
-	 */
+     * started at any time.
+     */
     mode = nm_setting_wireless_get_mode(s_wifi);
     if (g_strcmp0(mode, NM_SETTING_WIRELESS_MODE_ADHOC) == 0
         || g_strcmp0(mode, NM_SETTING_WIRELESS_MODE_AP) == 0
@@ -1105,13 +1105,13 @@ check_connection_available(NMDevice *                     device,
         return TRUE;
 
     /* Hidden SSIDs obviously don't always appear in the scan list either.
-	 *
-	 * For an explicit user-activation-request, a connection is considered
-	 * available because for hidden Wi-Fi, clients didn't consistently
-	 * set the 'hidden' property to indicate hidden SSID networks.  If
-	 * activating but the network isn't available let the device recheck
-	 * availability.
-	 */
+     *
+     * For an explicit user-activation-request, a connection is considered
+     * available because for hidden Wi-Fi, clients didn't consistently
+     * set the 'hidden' property to indicate hidden SSID networks.  If
+     * activating but the network isn't available let the device recheck
+     * availability.
+     */
     if (nm_setting_wireless_get_hidden(s_wifi)
         || NM_FLAGS_HAS(flags, _NM_DEVICE_CHECK_CON_AVAILABLE_FOR_USER_REQUEST_IGNORE_AP))
         return TRUE;
@@ -1172,9 +1172,9 @@ complete_connection(NMDevice *           device,
             ap = nm_wifi_aps_find_first_compatible(&priv->aps_lst_head, connection);
 
             /* If we still don't have an AP, then the WiFI settings needs to be
-			 * fully specified by the client.  Might not be able to find an AP
-			 * if the network isn't broadcasting the SSID for example.
-			 */
+             * fully specified by the client.  Might not be able to find an AP
+             * if the network isn't broadcasting the SSID for example.
+             */
             if (!ap) {
                 if (!nm_setting_verify(NM_SETTING(s_wifi), connection, error))
                     return FALSE;
@@ -1213,17 +1213,17 @@ complete_connection(NMDevice *           device,
 
     if (ssid == NULL) {
         /* The AP must be hidden.  Connecting to a Wi-Fi AP requires the SSID
-		 * as part of the initial handshake, so check the connection details
-		 * for the SSID.  The AP object will still be used for encryption
-		 * settings and such.
-		 */
+         * as part of the initial handshake, so check the connection details
+         * for the SSID.  The AP object will still be used for encryption
+         * settings and such.
+         */
         ssid = nm_setting_wireless_get_ssid(s_wifi);
     }
 
     if (ssid == NULL) {
         /* If there's no SSID on the AP itself, and no SSID in the
-		 * connection data, then we cannot connect at all.  Return an error.
-		 */
+         * connection data, then we cannot connect at all.  Return an error.
+         */
         g_set_error_literal(
             error,
             NM_DEVICE_ERROR,
@@ -1235,8 +1235,8 @@ complete_connection(NMDevice *           device,
 
     if (ap) {
         /* If the SSID is a well-known SSID, lock the connection to the AP's
-		 * specific BSSID so NM doesn't autoconnect to some random wifi net.
-		 */
+         * specific BSSID so NM doesn't autoconnect to some random wifi net.
+         */
         if (!nm_wifi_ap_complete_connection(ap,
                                             connection,
                                             nm_wifi_utils_is_manf_default_ssid(ssid),
@@ -1384,10 +1384,10 @@ _hw_addr_set_scanning(NMDeviceWifi *self, gboolean do_reset)
         gs_free char *hw_addr_scan              = NULL;
 
         /* the random MAC address for scanning expires after a while.
-		 *
-		 * We don't bother with to update the MAC address exactly when
-		 * it expires, instead on the next scan request, we will generate
-		 * a new one.*/
+         *
+         * We don't bother with to update the MAC address exactly when
+         * it expires, instead on the next scan request, we will generate
+         * a new one.*/
         priv->hw_addr_scan_expire = now + SCAN_RAND_MAC_ADDRESS_EXPIRE_SEC;
 
         generate_mac_address_mask =
@@ -1615,7 +1615,7 @@ _scan_request_ssids_build_hidden(NMDeviceWifi *self,
 
         if (n_hidden > 4) {
             /* we allow at most 4 hidden profiles to be actively scanned. The
-			 * reason is speed and to not disclose too many SSIDs. */
+             * reason is speed and to not disclose too many SSIDs. */
             break;
         }
 
@@ -1665,10 +1665,10 @@ _scan_supplicant_request_scan_cb(NMSupplicantInterface *supp_iface,
     _LOGT_scan("scan request completed (D-Bus request)");
 
     /* we just completed a scan request, but possibly the supplicant's state is not yet toggled
-	 * to "scanning". That means, our internal scanning state "priv->scan_is_scanning" would already
-	 * flip to idle, while in a moment the supplicant would toggle the state again.
-	 *
-	 * Artificially keep the scanning state on, for another SCAN_EXTRA_DELAY_MSEC msec. */
+     * to "scanning". That means, our internal scanning state "priv->scan_is_scanning" would already
+     * flip to idle, while in a moment the supplicant would toggle the state again.
+     *
+     * Artificially keep the scanning state on, for another SCAN_EXTRA_DELAY_MSEC msec. */
     nm_clear_g_source_inst(&priv->scan_request_delay_source);
     priv->scan_request_delay_source =
         nm_g_source_attach(nm_g_timeout_source_new(SCAN_EXTRA_DELAY_MSEC,
@@ -1841,8 +1841,8 @@ _scan_kickoff(NMDeviceWifi *self)
                                          self);
 
     /* It's OK to call _scan_notify_is_scanning() again. They mutually call each other,
-	 * but _scan_kickoff() sets "priv->scan_request_cancellable" which will stop
-	 * them from recursing indefinitely. */
+     * but _scan_kickoff() sets "priv->scan_request_cancellable" which will stop
+     * them from recursing indefinitely. */
     _scan_notify_is_scanning(self);
 }
 
@@ -1902,7 +1902,7 @@ try_fill_ssid_for_hidden_ap(NMDeviceWifi *self, NMWifiAP *ap)
     g_return_if_fail(bssid);
 
     /* Look for this AP's BSSID in the seen-bssids list of a connection,
-	 * and if a match is found, copy over the SSID */
+     * and if a match is found, copy over the SSID */
     connections = nm_settings_get_connections(nm_device_get_settings((NMDevice *) self), NULL);
     for (i = 0; connections[i]; i++) {
         NMSettingsConnection *sett_conn = connections[i];
@@ -1937,10 +1937,10 @@ supplicant_iface_bss_changed_cb(NMSupplicantInterface *iface,
             return;
         if (found_ap == priv->current_ap) {
             /* The current AP cannot be removed (to prevent NM indicating that
-			 * it is connected, but to nothing), but it must be removed later
-			 * when the current AP is changed or cleared.  Set 'fake' to
-			 * indicate that this AP is now unknown to the supplicant.
-			 */
+             * it is connected, but to nothing), but it must be removed later
+             * when the current AP is changed or cleared.  Set 'fake' to
+             * indicate that this AP is now unknown to the supplicant.
+             */
             if (nm_wifi_ap_set_fake(found_ap, TRUE))
                 _ap_dump(self, LOGL_DEBUG, found_ap, "updated", 0);
         } else {
@@ -1959,8 +1959,8 @@ supplicant_iface_bss_changed_cb(NMSupplicantInterface *iface,
 
         if (!bss_info->bssid_valid) {
             /* We failed to initialize the info about the AP. This can
-			 * happen due to an error in the D-Bus communication. In this case
-			 * we ignore the info. */
+             * happen due to an error in the D-Bus communication. In this case
+             * we ignore the info. */
             return;
         }
 
@@ -1991,8 +1991,8 @@ supplicant_iface_bss_changed_cb(NMSupplicantInterface *iface,
     }
 
     /* Update the current AP if the supplicant notified a current BSS change
-	 * before it sent the current BSS's scan result.
-	 */
+     * before it sent the current BSS's scan result.
+     */
     if (nm_supplicant_interface_get_current_bss(iface) == bss_info->bss_path)
         supplicant_iface_notify_current_bss(priv->sup_iface, NULL, self);
 
@@ -2051,30 +2051,30 @@ wifi_secrets_cb(NMActRequest *                req,
         _LOGW(LOGD_WIFI, "no secrets: %s", error->message);
 
         /* Even if WPS is still pending, let's abort the activation when the secret
-		 * request returns.
-		 *
-		 * This means, a user can only effectively use WPS when also running a secret
-		 * agent, and pressing the push button while being prompted for the password.
-		 * Note, that in the secret prompt the user can see that WPS is in progress
-		 * (via the NM_SECRET_AGENT_GET_SECRETS_FLAG_WPS_PBC_ACTIVE flag).
-		 *
-		 * Previously, WPS was not cancelled when the secret request returns.
-		 * Note that in common use-cases WPS is enabled in the connection profile
-		 * but it won't succeed (because it's disabled in the AP or because the
-		 * user is not prepared to press the push button).
-		 * That means for example, during boot we would try to autoconnect with WPS.
-		 * At that point, there is no secret-agent running, and WPS is pending for
-		 * full 30 seconds. If in the meantime a secret agent registers (because
-		 * of logging into the DE), the profile is still busy waiting for WPS to time
-		 * out. Only after that delay, autoconnect starts again (note that autoconnect gets
-		 * not blocked in this case, because a secret agent registered in the meantime).
-		 *
-		 * It seems wrong to continue doing WPS if the user is not aware
-		 * that WPS is ongoing. The user is required to perform an action (push button),
-		 * and must be told via the secret prompt.
-		 * If no secret-agent is running, if the user cancels the secret-request, or any
-		 * other error to obtain secrets, the user apparently does not want WPS either.
-		 */
+         * request returns.
+         *
+         * This means, a user can only effectively use WPS when also running a secret
+         * agent, and pressing the push button while being prompted for the password.
+         * Note, that in the secret prompt the user can see that WPS is in progress
+         * (via the NM_SECRET_AGENT_GET_SECRETS_FLAG_WPS_PBC_ACTIVE flag).
+         *
+         * Previously, WPS was not cancelled when the secret request returns.
+         * Note that in common use-cases WPS is enabled in the connection profile
+         * but it won't succeed (because it's disabled in the AP or because the
+         * user is not prepared to press the push button).
+         * That means for example, during boot we would try to autoconnect with WPS.
+         * At that point, there is no secret-agent running, and WPS is pending for
+         * full 30 seconds. If in the meantime a secret agent registers (because
+         * of logging into the DE), the profile is still busy waiting for WPS to time
+         * out. Only after that delay, autoconnect starts again (note that autoconnect gets
+         * not blocked in this case, because a secret agent registered in the meantime).
+         *
+         * It seems wrong to continue doing WPS if the user is not aware
+         * that WPS is ongoing. The user is required to perform an action (push button),
+         * and must be told via the secret prompt.
+         * If no secret-agent is running, if the user cancels the secret-request, or any
+         * other error to obtain secrets, the user apparently does not want WPS either.
+         */
         nm_clear_g_source(&priv->wps_timeout_id);
         nm_device_state_changed(device, NM_DEVICE_STATE_FAILED, NM_DEVICE_STATE_REASON_NO_SECRETS);
         return;
@@ -2206,9 +2206,9 @@ link_timeout_cb(gpointer user_data)
     priv->link_timeout_id = 0;
 
     /* Disconnect event while activated; the supplicant hasn't been able
-	 * to reassociate within the timeout period, so the connection must
-	 * fail.
-	 */
+     * to reassociate within the timeout period, so the connection must
+     * fail.
+     */
     if (nm_device_get_state(device) != NM_DEVICE_STATE_ACTIVATED)
         return FALSE;
 
@@ -2238,15 +2238,15 @@ need_new_8021x_secrets(NMDeviceWifi *             self,
     g_return_val_if_fail(connection != NULL, FALSE);
 
     /* 802.1x stuff only happens in the supplicant's ASSOCIATED state when it's
-	 * attempting to authenticate with the AP.
-	 */
+     * attempting to authenticate with the AP.
+     */
     if (old_state != NM_SUPPLICANT_INTERFACE_STATE_ASSOCIATED)
         return FALSE;
 
     /* If it's an 802.1x or LEAP connection with "always ask"/unsaved secrets
-	 * then we need to ask again because it might be an OTP token and the PIN
-	 * may have changed.
-	 */
+     * then we need to ask again because it might be an OTP token and the PIN
+     * may have changed.
+     */
 
     s_8021x = nm_connection_get_setting_802_1x(connection);
     if (s_8021x) {
@@ -2302,10 +2302,10 @@ need_new_wpa_psk(NMDeviceWifi *             self,
 
     if (g_strcmp0(key_mgmt, "wpa-psk") == 0) {
 /* -4 (locally-generated WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY) usually
-		 * means the driver missed beacons from the AP.  This usually happens
-		 * due to driver bugs or faulty power-save management.  It doesn't
-		 * indicate that the PSK is wrong.
-		 */
+         * means the driver missed beacons from the AP.  This usually happens
+         * due to driver bugs or faulty power-save management.  It doesn't
+         * indicate that the PSK is wrong.
+         */
 #define LOCAL_WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY -4
         if (disconnect_reason == LOCAL_WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY)
             return FALSE;
@@ -2385,10 +2385,10 @@ supplicant_iface_state_down(NMDeviceWifi *self)
     cleanup_association_attempt(self, FALSE);
 
     /* If the device is already in UNAVAILABLE state then the state change
-	 * is a NOP and the interface won't be re-acquired in the device state
-	 * change handler.  So ensure we have a new one here so that we're
-	 * ready if the supplicant comes back.
-	 */
+     * is a NOP and the interface won't be re-acquired in the device state
+     * change handler.  So ensure we have a new one here so that we're
+     * ready if the supplicant comes back.
+     */
     supplicant_interface_release(self);
     if (priv->failed_iface_count < 5)
         priv->reacquire_iface_id = g_timeout_add_seconds(10, reacquire_interface_cb, self);
@@ -2447,8 +2447,8 @@ supplicant_iface_state(NMDeviceWifi *             self,
         nm_clear_g_source(&priv->wps_timeout_id);
 
         /* If this is the initial association during device activation,
-		 * schedule the next activation stage.
-		 */
+         * schedule the next activation stage.
+         */
         if (devstate == NM_DEVICE_STATE_CONFIG) {
             NMSettingWireless *s_wifi;
             GBytes *           ssid;
@@ -2473,20 +2473,20 @@ supplicant_iface_state(NMDeviceWifi *             self,
     case NM_SUPPLICANT_INTERFACE_STATE_DISCONNECTED:
         if ((devstate == NM_DEVICE_STATE_ACTIVATED) || nm_device_is_activating(device)) {
             /* Disconnect of an 802.1x/LEAP connection during authentication,
-			 * or disconnect of a WPA-PSK connection during the 4-way handshake,
-			 * often means secrets are wrong. Not always the case, but until we
-			 * have more information from wpa_supplicant about why the
-			 * disconnect happened this is the best we can do.
-			 */
+             * or disconnect of a WPA-PSK connection during the 4-way handshake,
+             * often means secrets are wrong. Not always the case, but until we
+             * have more information from wpa_supplicant about why the
+             * disconnect happened this is the best we can do.
+             */
             if (handle_8021x_or_psk_auth_fail(self, new_state, old_state, disconnect_reason))
                 break;
         }
 
         /* Otherwise, it might be a stupid driver or some transient error, so
-		 * let the supplicant try to reconnect a few more times.  Give it more
-		 * time if a scan is in progress since the link might be dropped during
-		 * the scan but will be re-established when the scan is done.
-		 */
+         * let the supplicant try to reconnect a few more times.  Give it more
+         * time if a scan is in progress since the link might be dropped during
+         * the scan but will be re-established when the scan is done.
+         */
         if (devstate == NM_DEVICE_STATE_ACTIVATED) {
             if (priv->link_timeout_id == 0) {
                 priv->link_timeout_id =
@@ -2497,8 +2497,8 @@ supplicant_iface_state(NMDeviceWifi *             self,
         break;
     case NM_SUPPLICANT_INTERFACE_STATE_INACTIVE:
         /* we would clear _scan_has_pending_action_set() and trigger a new scan.
-		 * However, we don't want to cancel the current pending action, so force
-		 * a new scan request. */
+         * However, we don't want to cancel the current pending action, so force
+         * a new scan request. */
         break;
     default:
         break;
@@ -2561,9 +2561,9 @@ supplicant_iface_notify_current_bss(NMSupplicantInterface *iface,
         gs_free char *old_ssid_s = NULL;
 
         /* Don't ever replace a "fake" current AP if we don't know about the
-		 * supplicant's current BSS yet.  It'll get replaced when we receive
-		 * the current BSS's scan result.
-		 */
+         * supplicant's current BSS yet.  It'll get replaced when we receive
+         * the current BSS's scan result.
+         */
         if (new_ap == NULL && nm_wifi_ap_get_fake(priv->current_ap))
             return;
 
@@ -2586,10 +2586,10 @@ supplicant_iface_notify_current_bss(NMSupplicantInterface *iface,
 
         if (new_bssid) {
             /* The new AP could be in a different layer 3 network
-			 * and so the old DHCP lease could be no longer valid.
-			 * Also, some APs (e.g. Cisco) can be configured to drop
-			 * all traffic until DHCP completes. To support such
-			 * cases, renew the lease when roaming to a new AP. */
+             * and so the old DHCP lease could be no longer valid.
+             * Also, some APs (e.g. Cisco) can be configured to drop
+             * all traffic until DHCP completes. To support such
+             * cases, renew the lease when roaming to a new AP. */
             nm_device_update_dynamic_ip_setup(NM_DEVICE(self));
         }
 
@@ -2617,8 +2617,8 @@ recheck_p2p_availability(NMDeviceWifi *self)
         gs_free char *iface_name = NULL;
 
         /* Create a P2P device. "p2p-dev-" is the same prefix as chosen by
-		 * wpa_supplicant internally.
-		 */
+         * wpa_supplicant internally.
+         */
         iface_name = g_strconcat("p2p-dev-", nm_device_get_iface(NM_DEVICE(self)), NULL);
 
         priv->p2p_device = nm_device_wifi_p2p_new(iface_name);
@@ -2753,10 +2753,10 @@ supplicant_connection_timeout_cb(gpointer user_data)
         return FALSE;
 
     /* Timed out waiting for a successful connection to the AP; if the AP's
-	 * security requires network-side authentication (like WPA or 802.1x)
-	 * and the connection attempt timed out then it's likely the authentication
-	 * information (passwords, pin codes, etc) are wrong.
-	 */
+     * security requires network-side authentication (like WPA or 802.1x)
+     * and the connection attempt timed out then it's likely the authentication
+     * information (passwords, pin codes, etc) are wrong.
+     */
 
     req = nm_device_get_act_request(device);
     g_assert(req);
@@ -2766,9 +2766,9 @@ supplicant_connection_timeout_cb(gpointer user_data)
 
     if (NM_IN_SET(priv->mode, NM_802_11_MODE_ADHOC, NM_802_11_MODE_MESH, NM_802_11_MODE_AP)) {
         /* In Ad-Hoc and AP modes there's nothing to check the encryption key
-		 * (if any), so supplicant timeouts here are almost certainly the wifi
-		 * driver being really stupid.
-		 */
+         * (if any), so supplicant timeouts here are almost certainly the wifi
+         * driver being really stupid.
+         */
         _LOGW(LOGD_DEVICE | LOGD_WIFI,
               "Activation: (wifi) %s network creation took too long, failing activation",
               priv->mode == NM_802_11_MODE_ADHOC ? "Ad-Hoc" : "Hotspot");
@@ -2785,15 +2785,15 @@ supplicant_connection_timeout_cb(gpointer user_data)
         gboolean new_secrets = TRUE;
 
         /* Connection failed; either driver problems, the encryption key is
-		 * wrong, or the passwords or certificates were wrong.
-		 */
+         * wrong, or the passwords or certificates were wrong.
+         */
         _LOGW(LOGD_DEVICE | LOGD_WIFI, "Activation: (wifi) association took too long");
 
         /* Ask for new secrets only if we've never activated this connection
-		 * before.  If we've connected before, don't bother the user with
-		 * dialogs, just retry or fail, and if we never connect the user can
-		 * fix the password somewhere else.
-		 */
+         * before.  If we've connected before, don't bother the user with
+         * dialogs, just retry or fail, and if we never connect the user can
+         * fix the password somewhere else.
+         */
         if (nm_settings_connection_get_timestamp(nm_act_request_get_settings_connection(req),
                                                  &timestamp))
             new_secrets = !timestamp;
@@ -3035,11 +3035,11 @@ act_stage1_prepare(NMDevice *device, NMDeviceStateReason *out_failure_reason)
 
     if (!ap) {
         /* If the user is trying to connect to an AP that NM doesn't yet know about
-		 * (hidden network or something), starting a Hotspot or joining a Mesh,
-		 * create a fake APfrom the security settings in the connection.  This "fake"
-		 * AP gets used until the real one is found in the scan list (Ad-Hoc or Hidden),
-		 * or until the device is deactivated (Hotspot).
-		 */
+         * (hidden network or something), starting a Hotspot or joining a Mesh,
+         * create a fake APfrom the security settings in the connection.  This "fake"
+         * AP gets used until the real one is found in the scan list (Ad-Hoc or Hidden),
+         * or until the device is deactivated (Hotspot).
+         */
         ap_fake = nm_wifi_ap_new_fake_from_connection(connection);
         if (!ap_fake)
             g_return_val_if_reached(NM_ACT_STAGE_RETURN_FAILURE);
@@ -3189,9 +3189,9 @@ act_stage2_config(NMDevice *device, NMDeviceStateReason *out_failure_reason)
     priv->ssid_found = FALSE;
 
     /* Supplicant requires an initial frequency for Ad-Hoc, Hotspot and Mesh;
-	 * if the user didn't specify one and we didn't find an AP that matched
-	 * the connection, just pick a frequency the device supports.
-	 */
+     * if the user didn't specify one and we didn't find an AP that matched
+     * the connection, just pick a frequency the device supports.
+     */
     if (NM_IN_SET(ap_mode, NM_802_11_MODE_ADHOC, NM_802_11_MODE_MESH) || nm_wifi_ap_is_hotspot(ap))
         ensure_hotspot_frequency(self, s_wireless, ap);
 
@@ -3312,13 +3312,13 @@ act_stage4_ip_config_timeout(NMDevice *           device,
     }
 
     /* If IP configuration times out and it's a static WEP connection, that
-	 * usually means the WEP key is wrong.  WEP's Open System auth mode has
-	 * no provision for figuring out if the WEP key is wrong, so you just have
-	 * to wait for DHCP to fail to figure it out.  For all other Wi-Fi security
-	 * types (open, WPA, 802.1x, etc) if the secrets/certs were wrong the
-	 * connection would have failed before IP configuration.
-	 *
-	 * Activation failed, we must have bad encryption key */
+     * usually means the WEP key is wrong.  WEP's Open System auth mode has
+     * no provision for figuring out if the WEP key is wrong, so you just have
+     * to wait for DHCP to fail to figure it out.  For all other Wi-Fi security
+     * types (open, WPA, 802.1x, etc) if the secrets/certs were wrong the
+     * connection would have failed before IP configuration.
+     *
+     * Activation failed, we must have bad encryption key */
     _LOGW(LOGD_DEVICE | LOGD_WIFI,
           "Activation: (wifi) could not get IP configuration for connection '%s'.",
           nm_connection_get_id(connection));
@@ -3351,19 +3351,19 @@ activation_success_handler(NMDevice *device)
     nm_platform_wifi_indicate_addressing_running(nm_device_get_platform(device), ifindex, FALSE);
 
     /* There should always be a current AP, either a fake one because we haven't
-	 * seen a scan result for the activated AP yet, or a real one from the
-	 * supplicant's scan list.
-	 */
+     * seen a scan result for the activated AP yet, or a real one from the
+     * supplicant's scan list.
+     */
     g_warn_if_fail(priv->current_ap);
     if (priv->current_ap) {
         if (nm_wifi_ap_get_fake(priv->current_ap)) {
             gboolean ap_changed = FALSE;
 
             /* If the activation AP hasn't been seen by the supplicant in a scan
-			 * yet, it will be "fake".  This usually happens for Ad-Hoc and
-			 * AP-mode connections.  Fill in the details from the device itself
-			 * until the supplicant sends the scan result.
-			 */
+             * yet, it will be "fake".  This usually happens for Ad-Hoc and
+             * AP-mode connections.  Fill in the details from the device itself
+             * until the supplicant sends the scan result.
+             */
             if (!nm_wifi_ap_get_address(priv->current_ap)) {
                 guint8        bssid[ETH_ALEN] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
                 gs_free char *bssid_str       = NULL;
@@ -3415,8 +3415,8 @@ device_state_changed(NMDevice *          device,
 
     if (new_state <= NM_DEVICE_STATE_UNAVAILABLE) {
         /* Clean up the supplicant interface because in these states the
-		 * device cannot be used.
-		 */
+         * device cannot be used.
+         */
         supplicant_interface_release(self);
 
         nm_clear_g_source(&priv->periodic_update_id);
@@ -3432,9 +3432,9 @@ device_state_changed(NMDevice *          device,
         break;
     case NM_DEVICE_STATE_UNAVAILABLE:
         /* If the device is enabled and the supplicant manager is ready,
-		 * acquire a supplicant interface and transition to DISCONNECTED because
-		 * the device is now ready to use.
-		 */
+         * acquire a supplicant interface and transition to DISCONNECTED because
+         * the device is now ready to use.
+         */
         if (priv->enabled && (nm_device_get_firmware_missing(device) == FALSE)) {
             if (!priv->sup_iface)
                 supplicant_interface_acquire(self);
diff --git a/src/devices/wifi/nm-iwd-manager.c b/src/devices/wifi/nm-iwd-manager.c
index 61ad41aa93..9bc2a49809 100644
--- a/src/devices/wifi/nm-iwd-manager.c
+++ b/src/devices/wifi/nm-iwd-manager.c
@@ -264,7 +264,7 @@ register_agent(NMIwdManager *self)
 
     if (!agent_manager) {
         /* IWD prior to 1.0 dated 30 October, 2019 has the agent manager on a
-		 * different path. */
+         * different path. */
         agent_manager = g_dbus_object_manager_get_interface(priv->object_manager,
                                                             "/",
                                                             NM_IWD_AGENT_MANAGER_INTERFACE);
@@ -424,10 +424,10 @@ mirror_8021x_connection(NMIwdManager *self, const char *name, gboolean create_ne
     }
 
     /* If we already have an NMSettingsConnection matching this
-	 * KnownNetwork, whether it's saved or an in-memory connection
-	 * potentially created by ourselves then we have nothing left to
-	 * do here.
-	 */
+     * KnownNetwork, whether it's saved or an in-memory connection
+     * potentially created by ourselves then we have nothing left to
+     * do here.
+     */
     if (settings_connection || !create_new)
         return settings_connection;
 
@@ -461,11 +461,11 @@ mirror_8021x_connection(NMIwdManager *self, const char *name, gboolean create_ne
     nm_connection_add_setting(connection, setting);
 
     /* "password" and "private-key-password" may be requested by the IWD agent
-	 * from NM and IWD will implement a specific secret cache policy so by
-	 * default respect that policy and don't save copies of those secrets in
-	 * NM settings.  The saved values can not be used anyway because of our
-	 * use of NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW.
-	 */
+     * from NM and IWD will implement a specific secret cache policy so by
+     * default respect that policy and don't save copies of those secrets in
+     * NM settings.  The saved values can not be used anyway because of our
+     * use of NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW.
+     */
     setting = NM_SETTING(g_object_new(NM_TYPE_SETTING_802_1X,
                                       NM_SETTING_802_1X_PASSWORD_FLAGS,
                                       NM_SETTING_SECRET_FLAG_NOT_SAVED,
@@ -506,7 +506,7 @@ mirror_8021x_connection_take_and_delete(NMSettingsConnection *sett_conn)
     flags = nm_settings_connection_get_flags(sett_conn);
 
     /* If connection has not been saved since we created it
-	 * in interface_added it too can be removed now. */
+     * in interface_added it too can be removed now. */
     if (NM_FLAGS_HAS(flags, NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED))
         nm_settings_connection_delete(sett_conn, FALSE);
 
@@ -662,8 +662,8 @@ connection_removed(NMSettings *settings, NMSettingsConnection *sett_conn, gpoint
         g_clear_object(&data->mirror_connection);
 
         /* Don't call Forget for an 8021x network until there's no
-		 * longer *any* matching NMSettingsConnection (debatable)
-		 */
+         * longer *any* matching NMSettingsConnection (debatable)
+         */
         new_mirror_conn = mirror_8021x_connection(self, id.name, FALSE);
         if (new_mirror_conn) {
             data->mirror_connection = g_object_ref(new_mirror_conn);
@@ -729,9 +729,9 @@ release_object_manager(NMIwdManager *self)
         agent_connection = g_dbus_object_manager_client_get_connection(omc);
 
         /* We're is called when we're shutting down (i.e. our DBus connection
-		 * is being closed, and IWD will detect this) or IWD was stopped so
-		 * in either case calling UnregisterAgent will not do anything.
-		 */
+         * is being closed, and IWD will detect this) or IWD was stopped so
+         * in either case calling UnregisterAgent will not do anything.
+         */
         g_dbus_connection_unregister_object(agent_connection, priv->agent_id);
         priv->agent_id = 0;
         nm_clear_g_free(&priv->agent_path);
@@ -950,8 +950,8 @@ dispose(GObject *object)
     }
 
     /* This may trigger mirror connection removals so it happens
-	 * after the g_signal_handlers_disconnect_by_data above.
-	 */
+     * after the g_signal_handlers_disconnect_by_data above.
+     */
     nm_clear_pointer(&priv->known_networks, g_hash_table_destroy);
 
     if (priv->manager) {
diff --git a/src/devices/wifi/nm-wifi-ap.c b/src/devices/wifi/nm-wifi-ap.c
index 01320d975e..518c568762 100644
--- a/src/devices/wifi/nm-wifi-ap.c
+++ b/src/devices/wifi/nm-wifi-ap.c
@@ -817,8 +817,8 @@ nm_wifi_ap_new_fake_from_connection(NMConnection *connection)
         add_group_ciphers(ap, s_wireless_sec);
     } else if (adhoc && psk) {
         /* Ad-Hoc has special requirements: proto=RSN, pairwise=CCMP and
-		 * group=CCMP.
-		 */
+         * group=CCMP.
+         */
         flags = priv->wpa_flags | NM_802_11_AP_SEC_KEY_MGMT_PSK;
 
         /* Clear ciphers; only CCMP is supported */
diff --git a/src/devices/wifi/nm-wifi-factory.c b/src/devices/wifi/nm-wifi-factory.c
index 113b7f6a5d..f8284fcf0c 100644
--- a/src/devices/wifi/nm-wifi-factory.c
+++ b/src/devices/wifi/nm-wifi-factory.c
@@ -110,9 +110,9 @@ create_device(NMDeviceFactory *     factory,
         }
 
         /* Ignore monitor-mode and other unhandled interface types.
-		 * FIXME: keep TYPE_MONITOR devices in UNAVAILABLE state and manage
-		 * them if/when they change to a handled type.
-		 */
+         * FIXME: keep TYPE_MONITOR devices in UNAVAILABLE state and manage
+         * them if/when they change to a handled type.
+         */
         mode = nm_platform_wifi_get_mode(NM_PLATFORM_GET, plink->ifindex);
         if (mode == NM_802_11_MODE_UNKNOWN) {
             *out_ignore = TRUE;
diff --git a/src/devices/wifi/nm-wifi-utils.c b/src/devices/wifi/nm-wifi-utils.c
index 9712942257..7c79bd0e6d 100644
--- a/src/devices/wifi/nm-wifi-utils.c
+++ b/src/devices/wifi/nm-wifi-utils.c
@@ -47,11 +47,11 @@ verify_leap(NMSettingWirelessSecurity *s_wsec,
     leap_username = nm_setting_wireless_security_get_leap_username(s_wsec);
 
     /* One (or both) of two things indicates we want LEAP:
-	 * 1) auth_alg == 'leap'
-	 * 2) valid leap_username
+     * 1) auth_alg == 'leap'
+     * 2) valid leap_username
      *
      * LEAP always requires a LEAP username.
-	 */
+     */
 
     if (auth_alg) {
         if (!strcmp(auth_alg, "leap")) {
@@ -97,8 +97,8 @@ verify_leap(NMSettingWirelessSecurity *s_wsec,
     }
 
     /* At this point if auth_alg is set it must be 'leap', and if key_mgmt
-	 * is set it must be 'ieee8021x'.
-	 */
+     * is set it must be 'ieee8021x'.
+     */
     if (leap_username) {
         if (auth_alg)
             g_assert(strcmp(auth_alg, "leap") == 0);
@@ -610,8 +610,8 @@ nm_wifi_utils_complete_connection(GBytes *      ap_ssid,
     }
 
     /* For now mesh requires channel and band, fill them only if both not present.
-	 * Do not check existing values against an existing ap/mesh point,
-	 * mesh join will start a new network if required */
+     * Do not check existing values against an existing ap/mesh point,
+     * mesh join will start a new network if required */
     if (mesh) {
         const char *band;
         guint32     channel;
@@ -732,8 +732,8 @@ nm_wifi_utils_complete_connection(GBytes *      ap_ssid,
 
             if (s_8021x) {
                 /* Dynamic WEP requires a valid 802.1x setting since we can't
-				 * autocomplete 802.1x.
-				 */
+                 * autocomplete 802.1x.
+                 */
                 if (!nm_setting_verify(NM_SETTING(s_8021x), NULL, error))
                     return FALSE;
             }
@@ -802,13 +802,13 @@ nm_wifi_utils_complete_connection(GBytes *      ap_ssid,
                      "open",
                      NULL);
         /* Leave proto/pairwise/group as client set them; if they are unset the
-		 * supplicant will figure out the best combination at connect time.
-		 */
+         * supplicant will figure out the best combination at connect time.
+         */
 
         /* 802.1x also requires the client to completely fill in the 8021x
-		 * setting.  Since there's so much configuration required for it, there's
-		 * no way it can be automatically completed.
-		 */
+         * setting.  Since there's so much configuration required for it, there's
+         * no way it can be automatically completed.
+         */
     } else if ((key_mgmt && !strcmp(key_mgmt, "sae"))
                || (ap_rsn_flags & NM_802_11_AP_SEC_KEY_MGMT_SAE)) {
         g_object_set(s_wsec,
@@ -836,8 +836,8 @@ nm_wifi_utils_complete_connection(GBytes *      ap_ssid,
                      "open",
                      NULL);
         /* Leave proto/pairwise/group as client set them; if they are unset the
-		 * supplicant will figure out the best combination at connect time.
-		 */
+         * supplicant will figure out the best combination at connect time.
+         */
     } else {
         g_set_error_literal(error,
                             NM_CONNECTION_ERROR,
@@ -856,11 +856,11 @@ nm_wifi_utils_is_manf_default_ssid(GBytes *ssid)
     gsize         ssid_l;
     int           i;
     /*
-	 * List of manufacturer default SSIDs that are often unchanged by users.
-	 *
-	 * NOTE: this list should *not* contain networks that you would like to
-	 * automatically roam to like "Starbucks" or "AT&T" or "T-Mobile HotSpot".
-	 */
+     * List of manufacturer default SSIDs that are often unchanged by users.
+     *
+     * NOTE: this list should *not* contain networks that you would like to
+     * automatically roam to like "Starbucks" or "AT&T" or "T-Mobile HotSpot".
+     */
     static const char *manf_defaults[] = {
         "linksys",
         "linksys-a",
diff --git a/src/devices/wifi/tests/test-devices-wifi.c b/src/devices/wifi/tests/test-devices-wifi.c
index a94bad7e26..9c2839fa0c 100644
--- a/src/devices/wifi/tests/test-devices-wifi.c
+++ b/src/devices/wifi/tests/test-devices-wifi.c
@@ -267,8 +267,8 @@ test_open_ap_empty_connection(void)
     GError *      error = NULL;
 
     /* Test that an empty source connection is correctly filled with the
-	 * SSID and Infra modes of the given AP details.
-	 */
+     * SSID and Infra modes of the given AP details.
+     */
 
     src      = nm_simple_connection_new();
     success  = complete_connection(ssid,
@@ -300,9 +300,9 @@ test_open_ap_leap_connection_1(gconstpointer add_wifi)
     GError *      error = NULL;
 
     /* Test that a basic connection filled with a LEAP username is
-	 * rejected when completion is attempted with an open AP.  LEAP requires
-	 * the AP to have the Privacy bit set.
-	 */
+     * rejected when completion is attempted with an open AP.  LEAP requires
+     * the AP to have the Privacy bit set.
+     */
 
     src = nm_simple_connection_new();
     if (add_wifi)
@@ -336,8 +336,8 @@ test_open_ap_leap_connection_2(void)
     GError *      error = NULL;
 
     /* Test that a basic connection specifying IEEE8021x security (ie, Dynamic
-	 * WEP or LEAP) is rejected when completion is attempted with an open AP.
-	 */
+     * WEP or LEAP) is rejected when completion is attempted with an open AP.
+     */
 
     src = nm_simple_connection_new();
     fill_wifi_empty(src);
@@ -374,8 +374,8 @@ test_open_ap_wep_connection(gconstpointer add_wifi)
     GError * error = NULL;
 
     /* Test that a static WEP connection is rejected when completion is
-	 * attempted with an open AP.
-	 */
+     * attempted with an open AP.
+     */
 
     src = nm_simple_connection_new();
     if (add_wifi)
@@ -447,9 +447,9 @@ static void
 test_open_ap_wpa_psk_connection_1(void)
 {
     /* Test that a WPA-PSK connection filling only the PSK itself and *not*
-	 * filling the wifi setting is rejected when completion is attempted with
-	 * an open AP.
-	 */
+     * filling the wifi setting is rejected when completion is attempted with
+     * an open AP.
+     */
     test_ap_wpa_psk_connection_base(NULL,
                                     NULL,
                                     NM_802_11_AP_FLAGS_NONE,
@@ -464,9 +464,9 @@ static void
 test_open_ap_wpa_psk_connection_2(void)
 {
     /* Test that a WPA-PSK connection filling only the PSK itself and also
-	 * filling the wifi setting is rejected when completion is attempted with
-	 * an open AP.
-	 */
+     * filling the wifi setting is rejected when completion is attempted with
+     * an open AP.
+     */
     test_ap_wpa_psk_connection_base(NULL,
                                     NULL,
                                     NM_802_11_AP_FLAGS_NONE,
@@ -481,8 +481,8 @@ static void
 test_open_ap_wpa_psk_connection_3(void)
 {
     /* Test that a WPA-PSK connection filling the PSK and setting the auth alg
-	 * to 'open' is rejected when completion is attempted with an open AP.
-	 */
+     * to 'open' is rejected when completion is attempted with an open AP.
+     */
     test_ap_wpa_psk_connection_base(NULL,
                                     "open",
                                     NM_802_11_AP_FLAGS_NONE,
@@ -497,9 +497,9 @@ static void
 test_open_ap_wpa_psk_connection_4(void)
 {
     /* Test that a WPA-PSK connection filling the PSK and setting the auth alg
-	 * to 'shared' is rejected when completion is attempted with an open AP.
-	 * Shared auth cannot be used with WPA.
-	 */
+     * to 'shared' is rejected when completion is attempted with an open AP.
+     * Shared auth cannot be used with WPA.
+     */
     test_ap_wpa_psk_connection_base(NULL,
                                     "shared",
                                     NM_802_11_AP_FLAGS_NONE,
@@ -514,8 +514,8 @@ static void
 test_open_ap_wpa_psk_connection_5(void)
 {
     /* Test that a WPA-PSK connection filling the PSK, the auth algorithm, and
-	 * key management is rejected when completion is attempted with an open AP.
-	 */
+     * key management is rejected when completion is attempted with an open AP.
+     */
     test_ap_wpa_psk_connection_base("wpa-psk",
                                     "open",
                                     NM_802_11_AP_FLAGS_NONE,
@@ -745,8 +745,8 @@ test_priv_ap_empty_connection(void)
     GError *      error = NULL;
 
     /* Test that an empty connection is completed to a valid Static WEP
-	 * connection when completed with an AP with the Privacy bit set.
-	 */
+     * connection when completed with an AP with the Privacy bit set.
+     */
 
     src     = nm_simple_connection_new();
     success = complete_connection(ssid,
@@ -788,9 +788,9 @@ test_priv_ap_leap_connection_1(gconstpointer add_wifi)
     GError *      error = NULL;
 
     /* Test that an minimal LEAP connection specifying only key management and
-	 * the LEAP username is completed to a full LEAP connection when completed
-	 * with an AP with the Privacy bit set.
-	 */
+     * the LEAP username is completed to a full LEAP connection when completed
+     * with an AP with the Privacy bit set.
+     */
 
     src = nm_simple_connection_new();
     if (add_wifi)
@@ -806,9 +806,9 @@ test_priv_ap_leap_connection_1(gconstpointer add_wifi)
                                   src,
                                   &error);
     /* We expect success here; since LEAP APs just set the 'privacy' flag
-	 * there's no way to determine from the AP's beacon whether it's static WEP,
-	 * dynamic WEP, or LEAP.
-	 */
+     * there's no way to determine from the AP's beacon whether it's static WEP,
+     * dynamic WEP, or LEAP.
+     */
     expected = create_basic(ssid, NULL, NM_802_11_MODE_INFRA);
     fill_wsec(expected, exp_wsec);
     COMPARE(src, expected, success, error, 0, 0);
@@ -831,9 +831,9 @@ test_priv_ap_leap_connection_2(void)
     GError *      error = NULL;
 
     /* Test that an minimal LEAP connection specifying only key management and
-	 * the LEAP auth alg is completed to a full LEAP connection when completed
-	 * with an AP with the Privacy bit set.
-	 */
+     * the LEAP auth alg is completed to a full LEAP connection when completed
+     * with an AP with the Privacy bit set.
+     */
 
     src = nm_simple_connection_new();
     fill_wifi_empty(src);
@@ -875,9 +875,9 @@ test_priv_ap_dynamic_wep_1(void)
     GError *      error = NULL;
 
     /* Test that an minimal Dynamic WEP connection specifying key management,
-	 * the auth algorithm, and valid 802.1x setting is completed to a valid
-	 * Dynamic WEP connection when completed with an AP with the Privacy bit set.
-	 */
+     * the auth algorithm, and valid 802.1x setting is completed to a valid
+     * Dynamic WEP connection when completed with an AP with the Privacy bit set.
+     */
 
     src = nm_simple_connection_new();
     fill_wifi_empty(src);
@@ -923,9 +923,9 @@ test_priv_ap_dynamic_wep_2(void)
     GError *      error = NULL;
 
     /* Test that an minimal Dynamic WEP connection specifying only the auth
-	 * algorithm and a valid 802.1x setting is completed to a valid Dynamic
-	 * WEP connection when completed with an AP with the Privacy bit set.
-	 */
+     * algorithm and a valid 802.1x setting is completed to a valid Dynamic
+     * WEP connection when completed with an AP with the Privacy bit set.
+     */
 
     src = nm_simple_connection_new();
     fill_wifi_empty(src);
@@ -967,8 +967,8 @@ test_priv_ap_dynamic_wep_3(void)
     GError *      error = NULL;
 
     /* Ensure that a basic connection specifying 'shared' auth and an 802.1x
-	 * setting is rejected, as 802.1x is incompatible with 'shared' auth.
-	 */
+     * setting is rejected, as 802.1x is incompatible with 'shared' auth.
+     */
 
     src = nm_simple_connection_new();
     fill_wifi_empty(src);
@@ -995,9 +995,9 @@ static void
 test_priv_ap_wpa_psk_connection_1(void)
 {
     /* Test that a basic WPA-PSK connection is rejected when completion is
-	 * attempted with an AP with just the Privacy bit set.  Lack of WPA/RSN
-	 * flags means the AP provides Static/Dynamic WEP or LEAP, not WPA.
-	 */
+     * attempted with an AP with just the Privacy bit set.  Lack of WPA/RSN
+     * flags means the AP provides Static/Dynamic WEP or LEAP, not WPA.
+     */
     test_ap_wpa_psk_connection_base(NULL,
                                     NULL,
                                     NM_802_11_AP_FLAGS_PRIVACY,
@@ -1012,9 +1012,9 @@ static void
 test_priv_ap_wpa_psk_connection_2(void)
 {
     /* Test that a basic WPA-PSK connection is rejected when completion is
-	 * attempted with an AP with just the Privacy bit set.  Lack of WPA/RSN
-	 * flags means the AP provides Static/Dynamic WEP or LEAP, not WPA.
-	 */
+     * attempted with an AP with just the Privacy bit set.  Lack of WPA/RSN
+     * flags means the AP provides Static/Dynamic WEP or LEAP, not WPA.
+     */
     test_ap_wpa_psk_connection_base(NULL,
                                     NULL,
                                     NM_802_11_AP_FLAGS_PRIVACY,
@@ -1029,10 +1029,10 @@ static void
 test_priv_ap_wpa_psk_connection_3(void)
 {
     /* Test that a basic WPA-PSK connection specifying only the auth algorithm
-	 * is rejected when completion is attempted with an AP with just the Privacy
-	 * bit set.  Lack of WPA/RSN flags means the AP provides Static/Dynamic WEP
-	 * or LEAP, not WPA.
-	 */
+     * is rejected when completion is attempted with an AP with just the Privacy
+     * bit set.  Lack of WPA/RSN flags means the AP provides Static/Dynamic WEP
+     * or LEAP, not WPA.
+     */
     test_ap_wpa_psk_connection_base(NULL,
                                     "open",
                                     NM_802_11_AP_FLAGS_PRIVACY,
@@ -1047,10 +1047,10 @@ static void
 test_priv_ap_wpa_psk_connection_4(void)
 {
     /* Test that a basic WPA-PSK connection specifying only the auth algorithm
-	 * is rejected when completion is attempted with an AP with just the Privacy
-	 * bit set.  Lack of WPA/RSN flags means the AP provides Static/Dynamic WEP
-	 * or LEAP, not WPA.  Second, 'shared' auth is incompatible with WPA.
-	 */
+     * is rejected when completion is attempted with an AP with just the Privacy
+     * bit set.  Lack of WPA/RSN flags means the AP provides Static/Dynamic WEP
+     * or LEAP, not WPA.  Second, 'shared' auth is incompatible with WPA.
+     */
     test_ap_wpa_psk_connection_base(NULL,
                                     "shared",
                                     NM_802_11_AP_FLAGS_PRIVACY,
@@ -1065,10 +1065,10 @@ static void
 test_priv_ap_wpa_psk_connection_5(void)
 {
     /* Test that a WPA-PSK connection specifying both the key management and
-	 * auth algorithm is rejected when completion is attempted with an AP with
-	 * just the Privacy bit set.  Lack of WPA/RSN flags means the AP provides
-	 * Static/Dynamic WEP or LEAP, not WPA.
-	 */
+     * auth algorithm is rejected when completion is attempted with an AP with
+     * just the Privacy bit set.  Lack of WPA/RSN flags means the AP provides
+     * Static/Dynamic WEP or LEAP, not WPA.
+     */
     test_ap_wpa_psk_connection_base("wpa-psk",
                                     "open",
                                     NM_802_11_AP_FLAGS_PRIVACY,
@@ -1095,9 +1095,9 @@ test_wpa_ap_empty_connection(gconstpointer data)
     GError *      error = NULL;
 
     /* Test that a basic WPA-PSK connection specifying just key management and
-	 * the auth algorithm is completed successfully when given an AP with WPA
-	 * or RSN flags.
-	 */
+     * the auth algorithm is completed successfully when given an AP with WPA
+     * or RSN flags.
+     */
 
     src     = nm_simple_connection_new();
     success = complete_connection(ssid,
@@ -1136,8 +1136,8 @@ test_wpa_ap_leap_connection_1(gconstpointer data)
     GError *      error = NULL;
 
     /* Test that completion of a LEAP connection with a WPA-enabled AP is
-	 * rejected since WPA APs (usually) do not support LEAP.
-	 */
+     * rejected since WPA APs (usually) do not support LEAP.
+     */
 
     src = nm_simple_connection_new();
     fill_wifi_empty(src);
@@ -1172,8 +1172,8 @@ test_wpa_ap_leap_connection_2(gconstpointer data)
     GError *      error = NULL;
 
     /* Test that completion of a LEAP connection with a WPA-enabled AP is
-	 * rejected since WPA APs (usually) do not support LEAP.
-	 */
+     * rejected since WPA APs (usually) do not support LEAP.
+     */
 
     src = nm_simple_connection_new();
     fill_wifi_empty(src);
@@ -1206,8 +1206,8 @@ test_wpa_ap_dynamic_wep_connection(gconstpointer data)
     GError *      error = NULL;
 
     /* Test that completion of a Dynamic WEP connection with a WPA-enabled AP is
-	 * rejected since WPA APs (usually) do not support Dynamic WEP.
-	 */
+     * rejected since WPA APs (usually) do not support Dynamic WEP.
+     */
 
     src = nm_simple_connection_new();
     fill_wifi_empty(src);
@@ -1471,9 +1471,9 @@ main(int argc, char **argv)
     g_test_add_func("/wifi/lock_bssid", test_lock_bssid);
 
     /* Open AP tests; make sure that connections to be completed that have
-	 * various security-related settings already set cause the completion
-	 * to fail.
-	 */
+     * various security-related settings already set cause the completion
+     * to fail.
+     */
     g_test_add_func("/wifi/open_ap/empty_connection", test_open_ap_empty_connection);
     g_test_add_data_func("/wifi/open_ap/leap_connection/1",
                          (gconstpointer) TRUE,
diff --git a/src/devices/wwan/nm-device-modem.c b/src/devices/wwan/nm-device-modem.c
index 50a0b66842..0165526385 100644
--- a/src/devices/wwan/nm-device-modem.c
+++ b/src/devices/wwan/nm-device-modem.c
@@ -115,23 +115,23 @@ modem_prepare_result(NMModem *modem, gboolean success, guint i_reason, gpointer
 
     if (!success) {
         /* There are several reasons to block autoconnection at device level:
-		 *
-		 *  - Wrong SIM-PIN: The device won't autoconnect because it doesn't make sense
-		 *    to retry the connection with the same PIN. This error also makes autoconnection
-		 *    blocked at settings level, so not even a modem unplug and replug will allow
-		 *    autoconnection again. It is somewhat redundant to block autoconnection at
-		 *    both device and setting level really.
-		 *
-		 *  - SIM wrong or not inserted: If the modem is reporting a SIM not inserted error,
-		 *    we can block autoconnection at device level, so that if the same device is
-		 *    unplugged and replugged with a SIM (or if a SIM hotplug event happens in MM,
-		 *    recreating the device completely), we can try the autoconnection again.
-		 *
-		 *  - Modem initialization failed: For some reason unknown to NM, the modem wasn't
-		 *    initialized correctly, which leads to an unusable device. A device unplug and
-		 *    replug may solve the issue, so make it a device-level autoconnection blocking
-		 *    reason.
-		 */
+         *
+         *  - Wrong SIM-PIN: The device won't autoconnect because it doesn't make sense
+         *    to retry the connection with the same PIN. This error also makes autoconnection
+         *    blocked at settings level, so not even a modem unplug and replug will allow
+         *    autoconnection again. It is somewhat redundant to block autoconnection at
+         *    both device and setting level really.
+         *
+         *  - SIM wrong or not inserted: If the modem is reporting a SIM not inserted error,
+         *    we can block autoconnection at device level, so that if the same device is
+         *    unplugged and replugged with a SIM (or if a SIM hotplug event happens in MM,
+         *    recreating the device completely), we can try the autoconnection again.
+         *
+         *  - Modem initialization failed: For some reason unknown to NM, the modem wasn't
+         *    initialized correctly, which leads to an unusable device. A device unplug and
+         *    replug may solve the issue, so make it a device-level autoconnection blocking
+         *    reason.
+         */
         switch (nm_device_state_reason_check(reason)) {
         case NM_DEVICE_STATE_REASON_GSM_SIM_PIN_REQUIRED:
         case NM_DEVICE_STATE_REASON_GSM_SIM_PUK_REQUIRED:
@@ -162,8 +162,8 @@ modem_auth_requested(NMModem *modem, gpointer user_data)
     NMDevice *device = NM_DEVICE(user_data);
 
     /* Auth requests (PIN, PAP/CHAP passwords, etc) only get handled
-	 * during activation.
-	 */
+     * during activation.
+     */
     if (!nm_device_is_activating(device))
         return;
 
@@ -265,8 +265,8 @@ modem_ip6_config_result(NMModem *    modem,
         break;
     default:
         /* Should never get here since we've assured that the IPv6 method
-		 * will either be "auto" or "ignored" when starting IPv6 configuration.
-		 */
+         * will either be "auto" or "ignored" when starting IPv6 configuration.
+         */
         nm_assert_not_reached();
     }
 }
@@ -287,9 +287,9 @@ ip_ifindex_changed_cb(NMModem *modem, GParamSpec *pspec, gpointer user_data)
     }
 
     /* Disable IPv6 immediately on the interface since NM handles IPv6
-	 * internally, and leaving it enabled could allow the kernel's IPv6
-	 * RA handling code to run before NM is ready.
-	 */
+     * internally, and leaving it enabled could allow the kernel's IPv6
+     * RA handling code to run before NM is ready.
+     */
     nm_device_sysctl_ip_conf_set(device, AF_INET6, "disable_ipv6", "1");
 }
 
@@ -339,8 +339,8 @@ modem_state_cb(NMModem *modem, int new_state_i, int old_state_i, gpointer user_d
     if (new_state <= NM_MODEM_STATE_DISABLING && old_state > NM_MODEM_STATE_DISABLING
         && priv->rf_enabled) {
         /* Called when the ModemManager modem enabled state is changed externally
-		 * to NetworkManager (eg something using MM's D-Bus API directly).
-		 */
+         * to NetworkManager (eg something using MM's D-Bus API directly).
+         */
         if (nm_device_is_activating(device) || dev_state == NM_DEVICE_STATE_ACTIVATED) {
             /* user-initiated action, hence DISCONNECTED not FAILED */
             nm_device_state_changed(device,
@@ -353,7 +353,7 @@ modem_state_cb(NMModem *modem, int new_state_i, int old_state_i, gpointer user_d
     if (new_state < NM_MODEM_STATE_CONNECTING && old_state >= NM_MODEM_STATE_CONNECTING
         && dev_state >= NM_DEVICE_STATE_NEED_AUTH && dev_state <= NM_DEVICE_STATE_ACTIVATED) {
         /* Fail the device if the modem disconnects unexpectedly while the
-		 * device is activating/activated. */
+         * device is activating/activated. */
         nm_device_state_changed(device,
                                 NM_DEVICE_STATE_FAILED,
                                 NM_DEVICE_STATE_REASON_MODEM_NO_CARRIER);
@@ -362,8 +362,8 @@ modem_state_cb(NMModem *modem, int new_state_i, int old_state_i, gpointer user_d
 
     if (new_state > NM_MODEM_STATE_LOCKED && old_state == NM_MODEM_STATE_LOCKED) {
         /* If the modem is now unlocked, enable/disable it according to the
-		 * device's enabled/disabled state.
-		 */
+         * device's enabled/disabled state.
+         */
         nm_modem_set_mm_enabled(priv->modem, priv->rf_enabled);
 
         if (dev_state == NM_DEVICE_STATE_NEED_AUTH) {
@@ -661,8 +661,8 @@ set_enabled(NMDevice *device, gboolean enabled)
     NMDeviceModemPrivate *priv = NM_DEVICE_MODEM_GET_PRIVATE(self);
 
     /* Called only by the Manager in response to rfkill switch changes or
-	 * global user WWAN enable/disable preference changes.
-	 */
+     * global user WWAN enable/disable preference changes.
+     */
     priv->rf_enabled = enabled;
 
     if (priv->modem) {
@@ -731,9 +731,9 @@ static guint32
 get_dhcp_timeout_for_device(NMDevice *device, int addr_family)
 {
     /* DHCP is always done by the modem firmware, not by the network, and
-	 * by the time we get around to DHCP the firmware should already know
-	 * the IP addressing details.  So the DHCP timeout can be much shorter.
-	 */
+     * by the time we get around to DHCP the firmware should already know
+     * the IP addressing details.  So the DHCP timeout can be much shorter.
+     */
     return 15;
 }
 
diff --git a/src/devices/wwan/nm-modem-broadband.c b/src/devices/wwan/nm-modem-broadband.c
index 987fd68a78..5ac5f4a1cd 100644
--- a/src/devices/wwan/nm-modem-broadband.c
+++ b/src/devices/wwan/nm-modem-broadband.c
@@ -25,12 +25,12 @@ MODEM_CAPS_3GPP(MMModemCapability caps)
 {
     G_GNUC_BEGIN_IGNORE_DEPRECATIONS
     /* MM_MODEM_CAPABILITY_LTE_ADVANCED is marked as deprecated since ModemManager 1.14.0.
-	 *
-	 * The flag probably was never used, it certainly isn't used since 1.14.0.
-	 *
-	 * Still, just to be sure, there is no harm in checking it here. Suppress the
-	 * warning, it should have no bad effect.
-	 */
+     *
+     * The flag probably was never used, it certainly isn't used since 1.14.0.
+     *
+     * Still, just to be sure, there is no harm in checking it here. Suppress the
+     * warning, it should have no bad effect.
+     */
     return NM_FLAGS_ANY(caps,
                         (MM_MODEM_CAPABILITY_GSM_UMTS | MM_MODEM_CAPABILITY_LTE
                          | MM_MODEM_CAPABILITY_LTE_ADVANCED));
@@ -205,7 +205,7 @@ get_capabilities(NMModem *                  _self,
     guint              n_supported;
 
     /* For now, we don't care about the capability combinations, just merge all
-	 * combinations in a single mask */
+     * combinations in a single mask */
     if (mm_modem_get_supported_capabilities(self->_priv.modem_iface, &supported, &n_supported)) {
         guint i;
 
@@ -412,8 +412,8 @@ connect_ready(MMModemSimple *simple_iface, GAsyncResult *res, NMModemBroadband *
             ctx->ip_type_tries++;
         } else {
             /* If the modem/provider lies and the IP type we tried isn't supported,
-			 * retry with the next one, if any.
-			 */
+             * retry with the next one, if any.
+             */
             ctx->ip_types_i++;
             ctx->ip_type_tries = 0;
         }
@@ -1067,7 +1067,7 @@ static_stage3_ip4_config_start(NMModem *            modem,
     NMModemBroadbandPrivate *priv = NM_MODEM_BROADBAND_GET_PRIVATE(self);
 
     /* We schedule it in an idle just to follow the same logic as in the
-	 * generic modem implementation. */
+     * generic modem implementation. */
     nm_clear_g_source(&priv->idle_id_ip4);
     priv->idle_id_ip4 = g_idle_add((GSourceFunc) static_stage3_ip4_done, self);
 
@@ -1196,7 +1196,7 @@ stage3_ip6_config_request(NMModem *modem, NMDeviceStateReason *out_failure_reaso
     NMModemBroadbandPrivate *priv = NM_MODEM_BROADBAND_GET_PRIVATE(self);
 
     /* We schedule it in an idle just to follow the same logic as in the
-	 * generic modem implementation. */
+     * generic modem implementation. */
     nm_clear_g_source(&priv->idle_id_ip6);
     priv->idle_id_ip6 = g_idle_add((GSourceFunc) stage3_ip6_done, self);
 
@@ -1343,9 +1343,9 @@ modem_state_changed(MMModem *                modem,
                     NMModemBroadband *       self)
 {
     /* After the SIM is unlocked MM1 will move the device to INITIALIZING which
-	 * is an unavailable state.  That makes state handling confusing here, so
-	 * suppress this state change and let the modem move from LOCKED to DISABLED.
-	 */
+     * is an unavailable state.  That makes state handling confusing here, so
+     * suppress this state change and let the modem move from LOCKED to DISABLED.
+     */
     if (new_state == MM_MODEM_STATE_INITIALIZING && old_state == MM_MODEM_STATE_LOCKED)
         return;
 
@@ -1495,7 +1495,7 @@ set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *ps
         }
 
         /* Note: don't grab the Simple iface here; the Modem interface is the
-		 * only one assumed to be always valid and available */
+         * only one assumed to be always valid and available */
         break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
diff --git a/src/devices/wwan/nm-modem-manager.c b/src/devices/wwan/nm-modem-manager.c
index ed701dae75..090cdb212e 100644
--- a/src/devices/wwan/nm-modem-manager.c
+++ b/src/devices/wwan/nm-modem-manager.c
@@ -53,8 +53,8 @@ typedef struct {
         guint         relaunch_id;
 
         /* this only has one use: that the <info> logging line about
-		 * ModemManager available distinguishes between first-time
-		 * and later name-owner-changed. */
+         * ModemManager available distinguishes between first-time
+         * and later name-owner-changed. */
         enum {
             LOG_AVAILABLE_NOT_INITIALIZED = 0,
             LOG_AVAILABLE_YES,
@@ -259,15 +259,15 @@ modm_handle_name_owner_changed(MMManager *modem_manager, GParamSpec *pspec, NMMo
     g_free(name_owner);
 
     /* Hack alert: GDBusObjectManagerClient won't signal neither 'object-added'
-	 * nor 'object-removed' if it was created while there was no ModemManager in
-	 * the bus. This hack avoids this issue until we get a GIO with the fix
-	 * included... */
+     * nor 'object-removed' if it was created while there was no ModemManager in
+     * the bus. This hack avoids this issue until we get a GIO with the fix
+     * included... */
     modm_clear_manager(self);
     modm_ensure_manager(self);
 
     /* Whenever GDBusObjectManagerClient is fixed, we can just do the following:
-	 * modm_manager_available (self);
-	 */
+     * modm_manager_available (self);
+     */
 }
 
 static void
@@ -362,8 +362,8 @@ modm_manager_new_cb(GObject *source, GAsyncResult *res, gpointer user_data)
 
     if (!modem_manager) {
         /* We're not really supposed to get any error here. If we do get one,
-		 * though, just re-schedule the MMManager creation after some time.
-		 * During this period, name-owner changes won't be followed. */
+         * though, just re-schedule the MMManager creation after some time.
+         * During this period, name-owner changes won't be followed. */
         _LOGW("error creating ModemManager client: %s", error->message);
         /* Setup timeout to relaunch */
         modm_schedule_manager_relaunch(self, MODEM_POKE_INTERVAL);
@@ -398,8 +398,8 @@ modm_ensure_manager(NMModemManager *self)
     g_assert(priv->dbus_connection);
 
     /* Create the GDBusObjectManagerClient. We do not request to autostart, as
-	 * we don't really want the MMManager creation to fail. We can always poke
-	 * later on if we want to request the autostart */
+     * we don't really want the MMManager creation to fail. We can always poke
+     * later on if we want to request the autostart */
     if (!priv->modm.manager) {
         if (!priv->main_cancellable)
             priv->main_cancellable = g_cancellable_new();
@@ -431,7 +431,7 @@ modm_schedule_manager_relaunch(NMModemManager *self, guint n_seconds)
     NMModemManagerPrivate *priv = NM_MODEM_MANAGER_GET_PRIVATE(self);
 
     /* No need to pass an extra reference to self; timeout/idle will be
-	 * cancelled if the object gets disposed. */
+     * cancelled if the object gets disposed. */
     if (n_seconds)
         priv->modm.relaunch_id =
             g_timeout_add_seconds(n_seconds, (GSourceFunc) modm_schedule_manager_relaunch_cb, self);
@@ -508,8 +508,8 @@ nm_modem_manager_name_owner_ref(NMModemManager *self)
 
     if (priv->modm.proxy_ref_count++ > 0) {
         /* only try once to create the proxy. If proxy creation
-		 * for the first "ref" failed, it's unclear what to do.
-		 * The proxy is hosed. */
+         * for the first "ref" failed, it's unclear what to do.
+         * The proxy is hosed. */
         return;
     }
 
@@ -570,10 +570,10 @@ ofono_create_modem(NMModemManager *self, const char *path)
     NMModem *              modem = NULL;
 
     /* Ensure duplicate modems aren't created.  Because we're not using the
-	 * ObjectManager interface there's a race during oFono startup where we
-	 * receive ModemAdded signals before GetModems() returns, so some of the
-	 * modems returned from GetModems() may already have been created.
-	 */
+     * ObjectManager interface there's a race during oFono startup where we
+     * receive ModemAdded signals before GetModems() returns, so some of the
+     * modems returned from GetModems() may already have been created.
+     */
     if (!g_hash_table_lookup(priv->modems, path)) {
         modem = nm_modem_ofono_new(path);
         if (modem)
diff --git a/src/devices/wwan/nm-modem-ofono.c b/src/devices/wwan/nm-modem-ofono.c
index 0439c36283..42149a1bd0 100644
--- a/src/devices/wwan/nm-modem-ofono.c
+++ b/src/devices/wwan/nm-modem-ofono.c
@@ -361,13 +361,13 @@ sim_get_properties_done(GObject *source, GAsyncResult *result, gpointer user_dat
     _LOGD("sim v_dict is type: %s", g_variant_get_type_string(v_dict));
 
     /*
-	 * TODO:
-	 * 1) optimize by looking up properties ( Online, Interfaces ), instead
-	 *    of iterating
-	 *
-	 * 2) reduce code duplication between all of the get_properties_done
-	 *    functions in this class.
-	 */
+     * TODO:
+     * 1) optimize by looking up properties ( Online, Interfaces ), instead
+     *    of iterating
+     *
+     * 2) reduce code duplication between all of the get_properties_done
+     *    functions in this class.
+     */
 
     g_variant_iter_init(&i, v_dict);
     while (g_variant_iter_next(&i, "{&sv}", &property, &v)) {
@@ -514,13 +514,13 @@ connman_get_properties_done(GObject *source, GAsyncResult *result, gpointer user
     v_dict = g_variant_get_child_value(v_properties, 0);
 
     /*
-	 * TODO:
-	 * 1) optimize by looking up properties ( Online, Interfaces ), instead
-	 *    of iterating
-	 *
-	 * 2) reduce code duplication between all of the get_properties_done
-	 *    functions in this class.
-	 */
+     * TODO:
+     * 1) optimize by looking up properties ( Online, Interfaces ), instead
+     *    of iterating
+     *
+     * 2) reduce code duplication between all of the get_properties_done
+     *    functions in this class.
+     */
 
     g_variant_iter_init(&i, v_dict);
     while (g_variant_iter_next(&i, "{&sv}", &property, &v)) {
@@ -584,8 +584,8 @@ handle_connman_iface(NMModemOfono *self, gboolean found)
         }
 
         /* The connection manager proxy disappeared, we should
-		 * consider the modem disabled.
-		 */
+         * consider the modem disabled.
+         */
         priv->gprs_attached = FALSE;
 
         update_modem_state(self);
@@ -691,13 +691,13 @@ modem_get_properties_done(GObject *source, GAsyncResult *result, gpointer user_d
     }
 
     /*
-	 * TODO:
-	 * 1) optimize by looking up properties ( Online, Interfaces ), instead
-	 *    of iterating
-	 *
-	 * 2) reduce code duplication between all of the get_properties_done
-	 *    functions in this class.
-	 */
+     * TODO:
+     * 1) optimize by looking up properties ( Online, Interfaces ), instead
+     *    of iterating
+     *
+     * 2) reduce code duplication between all of the get_properties_done
+     *    functions in this class.
+     */
 
     g_variant_iter_init(&i, v_dict);
     while (g_variant_iter_next(&i, "{&sv}", &property, &v)) {
@@ -730,11 +730,11 @@ stage1_prepare_done(GObject *source, GAsyncResult *result, gpointer user_data)
 
         nm_modem_emit_prepare_result(NM_MODEM(self), FALSE, NM_DEVICE_STATE_REASON_MODEM_BUSY);
         /*
-		 * FIXME: add code to check for InProgress so that the
-		 * connection doesn't continue to try and activate,
-		 * leading to the connection being disabled, and a 5m
-		 * timeout...
-		 */
+         * FIXME: add code to check for InProgress so that the
+         * connection doesn't continue to try and activate,
+         * leading to the connection being disabled, and a 5m
+         * timeout...
+         */
     }
 }
 
@@ -757,10 +757,10 @@ context_property_changed(GDBusProxy *proxy, const char *property, GVariant *v, g
     _LOGD("PropertyChanged: %s", property);
 
     /*
-	 * TODO: might be a good idea and re-factor this to mimic bluez-device,
-	 * ie. have this function just check the key, and call a sub-func to
-	 * handle the action.
-	 */
+     * TODO: might be a good idea and re-factor this to mimic bluez-device,
+     * ie. have this function just check the key, and call a sub-func to
+     * handle the action.
+     */
 
     if (g_strcmp0(property, "Settings") != 0)
         return;
@@ -968,9 +968,9 @@ context_proxy_new_cb(GObject *source, GAsyncResult *result, gpointer user_data)
     }
 
     /* We have an old copy of the settings from a previous activation,
-	 * clear it so that we can gate getting the IP config from oFono
-	 * on whether or not we have already received them
-	 */
+     * clear it so that we can gate getting the IP config from oFono
+     * on whether or not we have already received them
+     */
     g_clear_object(&priv->ip4_config);
 
     _nm_dbus_signal_connect(priv->context_proxy,
@@ -1156,8 +1156,8 @@ nm_modem_ofono_new(const char *path)
     nm_log_info(LOGD_MB, "ofono: creating new Ofono modem path %s", path);
 
     /* Use short modem name (not its object path) as the NM device name (which
-	 * comes from NM_MODEM_UID)and the device ID.
-	 */
+     * comes from NM_MODEM_UID)and the device ID.
+     */
     basename = g_path_get_basename(path);
 
     return (NMModem *) g_object_new(NM_TYPE_MODEM_OFONO,
diff --git a/src/devices/wwan/nm-modem.c b/src/devices/wwan/nm-modem.c
index 9e4126ab40..89b9cc1e8d 100644
--- a/src/devices/wwan/nm-modem.c
+++ b/src/devices/wwan/nm-modem.c
@@ -63,7 +63,7 @@ typedef struct _NMModemPrivate {
     char *data_port;
 
     /* TODO: ip_iface is solely used for nm_modem_owns_port().
-	 * We should rework the code that it's not necessary */
+     * We should rework the code that it's not necessary */
     char *ip_iface;
 
     int                ip_ifindex;
@@ -214,10 +214,10 @@ nm_modem_unclaim(NMModem *self)
     g_return_if_fail(priv->claimed);
 
     /* we don't actually unclaim the instance. This instance should not be re-used
-	 * by another owner, that is because we only claim modems as we receive them.
-	 * There is no mechanism that somebody else would later re-use them again.
-	 *
-	 * // priv->claimed = FALSE; */
+     * by another owner, that is because we only claim modems as we receive them.
+     * There is no mechanism that somebody else would later re-use them again.
+     *
+     * // priv->claimed = FALSE; */
 
     g_object_unref(self);
 }
@@ -513,9 +513,9 @@ ppp_ifindex_set(NMPPPManager *ppp_manager, int ifindex, const char *iface, gpoin
 
     if (ifindex <= 0 && iface) {
         /* this might happen, if the ifname was already deleted
-		 * and we failed to resolve ifindex.
-		 *
-		 * Forget about the name. */
+         * and we failed to resolve ifindex.
+         *
+         * Forget about the name. */
         iface = NULL;
     }
     _set_ip_ifindex(self, ifindex, iface);
@@ -533,13 +533,13 @@ ppp_ip4_config(NMPPPManager *ppp_manager, NMIP4Config *config, gpointer user_dat
     gboolean dns_workaround = FALSE;
 
     /* Work around a PPP bug (#1732) which causes many mobile broadband
-	 * providers to return 10.11.12.13 and 10.11.12.14 for the DNS servers.
-	 * Apparently fixed in ppp-2.4.5 but we've had some reports that this is
-	 * not the case.
-	 *
-	 * http://git.ozlabs.org/?p=ppp.git;a=commitdiff_plain;h=2e09ef6886bbf00bc5a9a641110f801e372ffde6
-	 * http://git.ozlabs.org/?p=ppp.git;a=commitdiff_plain;h=f8191bf07df374f119a07910a79217c7618f113e
-	 */
+     * providers to return 10.11.12.13 and 10.11.12.14 for the DNS servers.
+     * Apparently fixed in ppp-2.4.5 but we've had some reports that this is
+     * not the case.
+     *
+     * http://git.ozlabs.org/?p=ppp.git;a=commitdiff_plain;h=2e09ef6886bbf00bc5a9a641110f801e372ffde6
+     * http://git.ozlabs.org/?p=ppp.git;a=commitdiff_plain;h=f8191bf07df374f119a07910a79217c7618f113e
+     */
 
     num = nm_ip4_config_get_num_nameservers(config);
     if (num == 2) {
@@ -555,9 +555,9 @@ ppp_ip4_config(NMPPPManager *ppp_manager, NMIP4Config *config, gpointer user_dat
         }
 
         /* Be somewhat conservative about substitutions; the "bad" nameservers
-		 * could actually be valid in some cases, so only substitute if ppp
-		 * returns *only* the two bad nameservers.
-		 */
+         * could actually be valid in some cases, so only substitute if ppp
+         * returns *only* the two bad nameservers.
+         */
         dns_workaround = (found1 && found2);
     }
 
@@ -641,9 +641,9 @@ ppp_stage3_ip_config_start(NMModem *            self,
     g_return_val_if_fail(NM_IS_ACT_REQUEST(req), NM_ACT_STAGE_RETURN_FAILURE);
 
     /* If we're already running PPP don't restart it; for example, if both
-	 * IPv4 and IPv6 are requested, IPv4 gets started first, but we use the
-	 * same pppd for both v4 and v6.
-	 */
+     * IPv4 and IPv6 are requested, IPv4 gets started first, but we use the
+     * same pppd for both v4 and v6.
+     */
     if (priv->ppp_manager)
         return NM_ACT_STAGE_RETURN_POSTPONE;
 
@@ -662,17 +662,17 @@ ppp_stage3_ip_config_start(NMModem *            self,
     }
 
     /* Check if ModemManager requested a specific IP timeout to be used. If 0 reported,
-	 * use the default one (30s) */
+     * use the default one (30s) */
     if (priv->mm_ip_timeout > 0) {
         _LOGI("using modem-specified IP timeout: %u seconds", priv->mm_ip_timeout);
         ip_timeout = priv->mm_ip_timeout;
     }
 
     /* Some tty drivers and modems ignore port speed, but pppd requires the
-	 * port speed to be > 0 or it exits. If the port speed is 0 pass an
-	 * explicit speed to pppd to prevent the exit.
-	 * https://bugzilla.redhat.com/show_bug.cgi?id=1281731
-	 */
+     * port speed to be > 0 or it exits. If the port speed is 0 pass an
+     * explicit speed to pppd to prevent the exit.
+     * https://bugzilla.redhat.com/show_bug.cgi?id=1281731
+     */
     if (port_speed_is_zero(priv->data_port))
         baud_override = 57600;
 
@@ -790,9 +790,9 @@ nm_modem_ip4_pre_commit(NMModem *modem, NMDevice *device, NMIP4Config *config)
     NMModemPrivate *priv = NM_MODEM_GET_PRIVATE(modem);
 
     /* If the modem has an ethernet-type data interface (ie, not PPP and thus
-	 * not point-to-point) and IP config has a /32 prefix, then we assume that
-	 * ARP will be pointless and we turn it off.
-	 */
+     * not point-to-point) and IP config has a /32 prefix, then we assume that
+     * ARP will be pointless and we turn it off.
+     */
     if (priv->ip4_method == NM_MODEM_IP_METHOD_STATIC
         || priv->ip4_method == NM_MODEM_IP_METHOD_AUTO) {
         const NMPlatformIP4Address *address = nm_ip4_config_get_first_address(config);
@@ -821,8 +821,8 @@ nm_modem_emit_ip6_config_result(NMModem *self, NMIP6Config *config, GError *erro
 
     if (config) {
         /* If the IPv6 configuration only included a Link-Local address, then
-		 * we have to run SLAAC to get the full IPv6 configuration.
-		 */
+         * we have to run SLAAC to get the full IPv6 configuration.
+         */
         nm_ip_config_iter_ip6_address_for_each (&ipconf_iter, config, &addr) {
             if (IN6_IS_ADDR_LINKLOCAL(&addr->address)) {
                 if (!priv->iid.id)
@@ -886,9 +886,9 @@ nm_modem_stage3_ip6_config_start(NMModem *            self,
     case NM_MODEM_IP_METHOD_STATIC:
     case NM_MODEM_IP_METHOD_AUTO:
         /* Both static and DHCP/Auto retrieve a base IP config from the modem
-		 * which in the static case is the full config, and the DHCP/Auto case
-		 * is just the IPv6LL address to use for SLAAC.
-		 */
+         * which in the static case is the full config, and the DHCP/Auto case
+         * is just the IPv6LL address to use for SLAAC.
+         */
         ret = NM_MODEM_GET_CLASS(self)->stage3_ip6_config_request(self, out_failure_reason);
         break;
     default:
@@ -1068,8 +1068,8 @@ nm_modem_act_stage2_config(NMModem *self)
 
     priv = NM_MODEM_GET_PRIVATE(self);
     /* Clear secrets tries counter since secrets were successfully used
-	 * already if we get here.
-	 */
+     * already if we get here.
+     */
     priv->secrets_tries = 0;
 }
 
@@ -1105,9 +1105,9 @@ nm_modem_check_connection_compatible(NMModem *self, NMConnection *connection, GE
         }
 
         /* SIM properties may not be available before the SIM is unlocked, so
-		 * to ensure that autoconnect works, the connection's SIM properties
-		 * are only compared if present on the device.
-		 */
+         * to ensure that autoconnect works, the connection's SIM properties
+         * are only compared if present on the device.
+         */
 
         if (priv->sim_id && (str = nm_setting_gsm_get_sim_id(s_gsm))) {
             if (!nm_streq(str, priv->sim_id)) {
@@ -1304,8 +1304,8 @@ nm_modem_deactivate_async(NMModem *                 self,
 
     if (ppp_manager) {
         /* If we have a PPP manager, stop it.
-		 *
-		 * Pass on the reference in @ppp_manager. */
+         *
+         * Pass on the reference in @ppp_manager. */
         nm_ppp_manager_stop(ppp_manager, ctx->cancellable, _deactivate_ppp_manager_stop_cb, ctx);
         return;
     }
@@ -1409,8 +1409,8 @@ nm_modem_get_ip_ifindex(NMModem *self)
     priv = NM_MODEM_GET_PRIVATE(self);
 
     /* internally we track an unset ip_ifindex as -1.
-	 * For the caller of nm_modem_get_ip_ifindex(), this
-	 * shall be zero too. */
+     * For the caller of nm_modem_get_ip_ifindex(), this
+     * shall be zero too. */
     return priv->ip_ifindex != -1 ? priv->ip_ifindex : 0;
 }
 
@@ -1955,18 +1955,18 @@ nm_modem_class_init(NMModemClass *klass)
                                               G_TYPE_POINTER);
 
     /**
-	 * NMModem::ip6-config-result:
-	 * @modem: the #NMModem  on which the signal is emitted
-	 * @config: the #NMIP6Config to apply to the modem's data port
-	 * @do_slaac: %TRUE if IPv6 SLAAC should be started
-	 * @error: a #GError if any error occurred during IP configuration
-	 *
-	 * This signal is emitted when IPv6 configuration has completed or failed.
-	 * If @error is set the configuration failed.  If @config is set, then
-	 * the details should be applied to the data port before any further
-	 * configuration (like SLAAC) is done.  @do_slaac indicates whether SLAAC
-	 * should be started after applying @config to the data port.
-	 */
+     * NMModem::ip6-config-result:
+     * @modem: the #NMModem  on which the signal is emitted
+     * @config: the #NMIP6Config to apply to the modem's data port
+     * @do_slaac: %TRUE if IPv6 SLAAC should be started
+     * @error: a #GError if any error occurred during IP configuration
+     *
+     * This signal is emitted when IPv6 configuration has completed or failed.
+     * If @error is set the configuration failed.  If @config is set, then
+     * the details should be applied to the data port before any further
+     * configuration (like SLAAC) is done.  @do_slaac indicates whether SLAAC
+     * should be started after applying @config to the data port.
+     */
     signals[IP6_CONFIG_RESULT] = g_signal_new(NM_MODEM_IP6_CONFIG_RESULT,
                                               G_OBJECT_CLASS_TYPE(object_class),
                                               G_SIGNAL_RUN_FIRST,
diff --git a/src/devices/wwan/nm-modem.h b/src/devices/wwan/nm-modem.h
index 8d56df40f3..4e9bd7a0a2 100644
--- a/src/devices/wwan/nm-modem.h
+++ b/src/devices/wwan/nm-modem.h
@@ -129,8 +129,8 @@ typedef struct {
                                                        NMDeviceStateReason *out_failure_reason);
 
     /* Request the IP6 config; when the config returns the modem
-	 * subclass should emit the ip6_config_result signal.
-	 */
+     * subclass should emit the ip6_config_result signal.
+     */
     NMActStageReturn (*stage3_ip6_config_request)(NMModem *            self,
                                                   NMDeviceStateReason *out_failure_reason);
 
diff --git a/src/devices/wwan/nm-wwan-factory.c b/src/devices/wwan/nm-wwan-factory.c
index 602950268f..3d5f7f9577 100644
--- a/src/devices/wwan/nm-wwan-factory.c
+++ b/src/devices/wwan/nm-wwan-factory.c
@@ -72,9 +72,9 @@ modem_added_cb(NMModemManager *manager, NMModem *modem, gpointer user_data)
     driver = nm_modem_get_driver(modem);
 
     /* If it was a Bluetooth modem and no bluetooth device claimed it, ignore
-	 * it.  The rfcomm port (and thus the modem) gets created automatically
-	 * by the Bluetooth code during the connection process.
-	 */
+     * it.  The rfcomm port (and thus the modem) gets created automatically
+     * by the Bluetooth code during the connection process.
+     */
     if (driver && strstr(driver, "bluetooth")) {
         nm_log_dbg(
             LOGD_MB,
diff --git a/src/dhcp/nm-dhcp-client.c b/src/dhcp/nm-dhcp-client.c
index 7741de1231..1cc2b54285 100644
--- a/src/dhcp/nm-dhcp-client.c
+++ b/src/dhcp/nm-dhcp-client.c
@@ -451,10 +451,10 @@ nm_dhcp_client_set_state(NMDhcpClient *self,
         watch_cleanup(self);
 
     /* The client may send same-state transitions for RENEW/REBIND events and
-	 * the lease may have changed, so handle same-state transitions for the
-	 * EXTENDED and BOUND states.  Ignore same-state transitions for other
-	 * events since the lease won't have changed and the state was already handled.
-	 */
+     * the lease may have changed, so handle same-state transitions for the
+     * EXTENDED and BOUND states.  Ignore same-state transitions for other
+     * events since the lease won't have changed and the state was already handled.
+     */
     if ((priv->state == new_state)
         && !NM_IN_SET(new_state, NM_DHCP_STATE_BOUND, NM_DHCP_STATE_EXTENDED))
         return;
@@ -741,8 +741,8 @@ bytearray_variant_to_string(NMDhcpClient *self, GVariant *value, const char *key
     array = g_variant_get_fixed_array(value, &length, 1);
 
     /* Since the DHCP options come through environment variables, they should
-	 * already be UTF-8 safe, but just make sure.
-	 */
+     * already be UTF-8 safe, but just make sure.
+     */
     str = g_string_sized_new(length);
     for (i = 0; i < length; i++) {
         c = array[i];
@@ -806,20 +806,20 @@ maybe_add_option(NMDhcpClient *self, GHashTable *hash, const char *key, GVariant
         g_hash_table_insert(hash, g_strdup(key), str_value);
 
         /* dhclient has no special labels for private dhcp options: it uses "unknown_xyz"
-		 * labels for that. We need to identify those to alias them to our "private_xyz"
-		 * format unused in the internal dchp plugins.
-		 */
+         * labels for that. We need to identify those to alias them to our "private_xyz"
+         * format unused in the internal dchp plugins.
+         */
         if ((priv_opt_num = label_is_unknown_xyz(key)) > 0) {
             gs_free guint8 *check_val = NULL;
             char *          hex_str   = NULL;
             gsize           len;
 
             /* dhclient passes values from dhcp private options in its own "string" format:
-			 * if the raw values are printable as ascii strings, it will pass the string
-			 * representation; if the values are not printable as an ascii string, it will
-			 * pass a string displaying the hex values (hex string). Try to enforce passing
-			 * always an hex string, converting string representation if needed.
-			 */
+             * if the raw values are printable as ascii strings, it will pass the string
+             * representation; if the values are not printable as an ascii string, it will
+             * pass a string displaying the hex values (hex string). Try to enforce passing
+             * always an hex string, converting string representation if needed.
+             */
             check_val = nm_utils_hexstr2bin_alloc(str_value, FALSE, TRUE, ":", 0, &len);
             hex_str   = nm_utils_bin2hexstr_full(check_val ?: (guint8 *) str_value,
                                                check_val ? len : strlen(str_value),
@@ -912,8 +912,8 @@ nm_dhcp_client_handle_event(gpointer      unused,
 
     if (!IN6_IS_ADDR_UNSPECIFIED(&prefix.address)) {
         /* If we got an IPv6 prefix to delegate, we don't change the state
-		 * of the DHCP client instance. Instead, we just signal the prefix
-		 * to the device. */
+         * of the DHCP client instance. Instead, we just signal the prefix
+         * to the device. */
         nm_dhcp_client_emit_ipv6_prefix_delegated(self, &prefix);
     } else {
         /* Fail if no valid IP config was received */
@@ -1129,9 +1129,9 @@ dispose(GObject *object)
     NMDhcpClientPrivate *priv = NM_DHCP_CLIENT_GET_PRIVATE(self);
 
     /* Stopping the client is left up to the controlling device
-	 * explicitly since we may want to quit NetworkManager but not terminate
-	 * the DHCP client.
-	 */
+     * explicitly since we may want to quit NetworkManager but not terminate
+     * the DHCP client.
+     */
 
     nm_assert(c_list_is_empty(&self->dhcp_client_lst));
 
diff --git a/src/dhcp/nm-dhcp-client.h b/src/dhcp/nm-dhcp-client.h
index 066ed436d2..f33c4911be 100644
--- a/src/dhcp/nm-dhcp-client.h
+++ b/src/dhcp/nm-dhcp-client.h
@@ -94,14 +94,14 @@ typedef struct {
     void (*stop)(NMDhcpClient *self, gboolean release);
 
     /**
-	 * get_duid:
-	 * @self: the #NMDhcpClient
-	 *
-	 * Attempts to find an existing DHCPv6 DUID for this client in the DHCP
-	 * client's persistent configuration.  Returned DUID should be the binary
-	 * representation of the DUID.  If no DUID is found, %NULL should be
-	 * returned.
-	 */
+     * get_duid:
+     * @self: the #NMDhcpClient
+     *
+     * Attempts to find an existing DHCPv6 DUID for this client in the DHCP
+     * client's persistent configuration.  Returned DUID should be the binary
+     * representation of the DUID.  If no DUID is found, %NULL should be
+     * returned.
+     */
     GBytes *(*get_duid)(NMDhcpClient *self);
 } NMDhcpClientClass;
 
diff --git a/src/dhcp/nm-dhcp-dhclient-utils.c b/src/dhcp/nm-dhcp-dhclient-utils.c
index d09b162c41..9c1863974e 100644
--- a/src/dhcp/nm-dhcp-dhclient-utils.c
+++ b/src/dhcp/nm-dhcp-dhclient-utils.c
@@ -112,8 +112,8 @@ add_ip4_config(GString *           str,
         nm_assert(p);
 
         /* Allow type 0 (non-hardware address) to be represented as a string
-		 * as long as all the characters are printable.
-		 */
+         * as long as all the characters are printable.
+         */
         for (i = 1; (p[0] == 0) && i < l; i++) {
             if (!g_ascii_isprint(p[i]) || p[i] == '\\' || p[i] == '"')
                 break;
@@ -345,7 +345,7 @@ nm_dhcp_dhclient_create_config(const char *        interface,
                 if (NM_STR_HAS_PREFIX(p, "lease") || NM_STR_HAS_PREFIX(p, "alias")
                     || NM_STR_HAS_PREFIX(p, "interface") || NM_STR_HAS_PREFIX(p, "pseudo")) {
                     /* skip over these blocks, except 'interface' when it
-					 * matches the current interface */
+                     * matches the current interface */
                     blocks_skip++;
                     g_string_append_c(blocks_stack, 'b');
                     if (!intf[0] && NM_STR_HAS_PREFIX(p, "interface")) {
@@ -377,12 +377,12 @@ nm_dhcp_dhclient_create_config(const char *        interface,
                 continue;
 
             /* Some timing parameters in dhclient should not be imported (timeout, retry).
-			 * The retry parameter will be simply not used as we will exit on first failure.
-			 * The timeout one instead may affect NetworkManager behavior: if the timeout
-			 * elapses before dhcp-timeout dhclient will report failure and cause NM to
-			 * fail the dhcp process before dhcp-timeout. So, always skip importing timeout
-			 * as we will need to add one greater than dhcp-timeout.
-			 */
+             * The retry parameter will be simply not used as we will exit on first failure.
+             * The timeout one instead may affect NetworkManager behavior: if the timeout
+             * elapses before dhcp-timeout dhclient will report failure and cause NM to
+             * fail the dhcp process before dhcp-timeout. So, always skip importing timeout
+             * as we will need to add one greater than dhcp-timeout.
+             */
             if (!strncmp(p, TIMEOUT_TAG, strlen(TIMEOUT_TAG))
                 || !strncmp(p, RETRY_TAG, strlen(RETRY_TAG)))
                 continue;
@@ -407,8 +407,8 @@ nm_dhcp_dhclient_create_config(const char *        interface,
             }
 
             /* To let user's FQDN options (except "fqdn.fqdn") override the
-			 * default ones set by NM, add them later
-			 */
+             * default ones set by NM, add them later
+             */
             if (!strncmp(p, FQDN_TAG_PREFIX, NM_STRLEN(FQDN_TAG_PREFIX))) {
                 if (!fqdn_opts)
                     fqdn_opts = g_ptr_array_new_full(5, g_free);
@@ -453,8 +453,8 @@ nm_dhcp_dhclient_create_config(const char *        interface,
         g_string_append_c(new_contents, '\n');
 
     /* ensure dhclient timeout is greater than dhcp-timeout: as dhclient timeout default value is
-	 * 60 seconds, we need this only if dhcp-timeout is greater than 60.
-	 */
+     * 60 seconds, we need this only if dhcp-timeout is greater than 60.
+     */
     if (timeout >= 60) {
         timeout = timeout < G_MAXINT32 ? timeout + 1 : G_MAXINT32;
         g_string_append_printf(new_contents, "timeout %u;\n", timeout);
@@ -567,8 +567,8 @@ nm_dhcp_dhclient_unescape_duid(const char *duid)
     guint8        octal;
 
     /* FIXME: it's wrong to have an "unescape-duid" function. dhclient
-	 * defines a file format with escaping. So we need a general unescape
-	 * function that can handle dhclient syntax. */
+     * defines a file format with escaping. So we need a general unescape
+     * function that can handle dhclient syntax. */
 
     len       = strlen(duid);
     unescaped = g_byte_array_sized_new(len);
@@ -584,7 +584,7 @@ nm_dhcp_dhclient_unescape_duid(const char *duid)
                 i += 2;
             } else {
                 /* FIXME: don't warn on untrusted data. Either signal an error, or accept
-				 * it silently. */
+                 * it silently. */
 
                 /* One of ", ', $, `, \, |, or & */
                 g_warn_if_fail(p[i] == '"' || p[i] == '\'' || p[i] == '$' || p[i] == '`'
@@ -682,9 +682,9 @@ nm_dhcp_dhclient_save_duid(const char *leasefile, GBytes *duid, GError **error)
             const char *l;
 
             /* If we find an uncommented DUID in the file, check if
-			 * equal to the one we are going to write: if so, no need
-			 * to update the lease file, otherwise skip the old DUID.
-			 */
+             * equal to the one we are going to write: if so, no need
+             * to update the lease file, otherwise skip the old DUID.
+             */
             l = nm_str_skip_leading_spaces(str);
             if (g_str_has_prefix(l, DUID_PREFIX)) {
                 gs_strfreev char **split = NULL;
diff --git a/src/dhcp/nm-dhcp-dhclient.c b/src/dhcp/nm-dhcp-dhclient.c
index 6dddef75ba..9b72ce11f0 100644
--- a/src/dhcp/nm-dhcp-dhclient.c
+++ b/src/dhcp/nm-dhcp-dhclient.c
@@ -118,10 +118,10 @@ get_dhclient_leasefile(int         addr_family,
     NM_SET_OUT(out_preferred_path, g_steal_pointer(&path));
 
     /* If the leasefile we're looking for doesn't exist yet in the new location
-	 * (eg, /var/lib/NetworkManager) then look in old locations to maintain
-	 * backwards compatibility with external tools (like dracut) that put
-	 * leasefiles there.
-	 */
+     * (eg, /var/lib/NetworkManager) then look in old locations to maintain
+     * backwards compatibility with external tools (like dracut) that put
+     * leasefiles there.
+     */
 
     /* Old Debian, SUSE, and Mandriva location */
     g_free(path);
@@ -201,9 +201,9 @@ find_existing_config(NMDhcpDhclient *self, int addr_family, const char *iface, c
     char *path;
 
     /* NetworkManager-overridden configuration can be used to ship DHCP config
-	 * with NetworkManager itself. It can be uuid-specific, device-specific
-	 * or generic.
-	 */
+     * with NetworkManager itself. It can be uuid-specific, device-specific
+     * or generic.
+     */
     if (uuid) {
         path = g_strdup_printf(NMCONFDIR "/dhclient%s-%s.conf",
                                _addr_family_to_path_part(addr_family),
@@ -229,13 +229,13 @@ find_existing_config(NMDhcpDhclient *self, int addr_family, const char *iface, c
     g_free(path);
 
     /* Distribution's dhclient configuration is used so that we can use
-	 * configuration shipped with dhclient (if any).
-	 *
-	 * This replaces conditional compilation based on distribution name. Fedora
-	 * and Debian store the configs in /etc/dhcp while upstream defaults to /etc
-	 * which is then used by many other distributions. Some distributions
-	 * (including Fedora) don't even provide a default configuration file.
-	 */
+     * configuration shipped with dhclient (if any).
+     *
+     * This replaces conditional compilation based on distribution name. Fedora
+     * and Debian store the configs in /etc/dhcp while upstream defaults to /etc
+     * which is then used by many other distributions. Some distributions
+     * (including Fedora) don't even provide a default configuration file.
+     */
     path = g_strdup_printf(SYSCONFDIR "/dhcp/dhclient%s-%s.conf",
                            _addr_family_to_path_part(addr_family),
                            iface);
@@ -428,8 +428,8 @@ dhclient_start(NMDhcpClient *client,
     g_ptr_array_add(argv, (gpointer) "-d");
 
     /* Be quiet. dhclient logs to syslog anyway. And we duplicate the syslog
-	 * to stderr in case of NM running with --debug.
-	 */
+     * to stderr in case of NM running with --debug.
+     */
     g_ptr_array_add(argv, (gpointer) "-q");
 
     if (release)
@@ -459,9 +459,9 @@ dhclient_start(NMDhcpClient *client,
     }
 
     /* Usually the system bus address is well-known; but if it's supposed
-	 * to be something else, we need to push it to dhclient, since dhclient
-	 * sanitizes the environment it gives the action scripts.
-	 */
+     * to be something else, we need to push it to dhclient, since dhclient
+     * sanitizes the environment it gives the action scripts.
+     */
     system_bus_address = getenv("DBUS_SYSTEM_BUS_ADDRESS");
     if (system_bus_address) {
         system_bus_address_env = g_strdup_printf("DBUS_SYSTEM_BUS_ADDRESS=%s", system_bus_address);
diff --git a/src/dhcp/nm-dhcp-dhcpcanon.c b/src/dhcp/nm-dhcp-dhcpcanon.c
index 83d7bd25d8..2cf7b93795 100644
--- a/src/dhcp/nm-dhcp-dhcpcanon.c
+++ b/src/dhcp/nm-dhcp-dhcpcanon.c
@@ -124,9 +124,9 @@ dhcpcanon_start(NMDhcpClient *client,
     }
 
     /* Usually the system bus address is well-known; but if it's supposed
-	 * to be something else, we need to push it to dhcpcanon, since dhcpcanon
-	 * sanitizes the environment it gives the action scripts.
-	 */
+     * to be something else, we need to push it to dhcpcanon, since dhcpcanon
+     * sanitizes the environment it gives the action scripts.
+     */
     system_bus_address = getenv("DBUS_SYSTEM_BUS_ADDRESS");
     if (system_bus_address) {
         system_bus_address_env = g_strdup_printf("DBUS_SYSTEM_BUS_ADDRESS=%s", system_bus_address);
diff --git a/src/dhcp/nm-dhcp-dhcpcd.c b/src/dhcp/nm-dhcp-dhcpcd.c
index eea928aec6..449cd4d460 100644
--- a/src/dhcp/nm-dhcp-dhcpcd.c
+++ b/src/dhcp/nm-dhcp-dhcpcd.c
@@ -87,8 +87,8 @@ ip4_start(NMDhcpClient *client,
     iface = nm_dhcp_client_get_iface(client);
 
     /* dhcpcd does not allow custom pidfiles; the pidfile is always
-	 * RUNSTATEDIR "dhcpcd-<ifname>.pid".
-	 */
+     * RUNSTATEDIR "dhcpcd-<ifname>.pid".
+     */
     priv->pid_file = g_strdup_printf(RUNSTATEDIR "/dhcpcd-%s.pid", iface);
 
     dhcpcd_path = nm_dhcp_dhcpcd_get_path();
@@ -119,9 +119,9 @@ ip4_start(NMDhcpClient *client,
     g_ptr_array_add(argv, (gpointer) nm_dhcp_helper_path);
 
     /* IPv4-only for now.  NetworkManager knows better than dhcpcd when to
-	 * run IPv6, and dhcpcd's automatic Router Solicitations cause problems
-	 * with devices that don't expect them.
-	 */
+     * run IPv6, and dhcpcd's automatic Router Solicitations cause problems
+     * with devices that don't expect them.
+     */
     g_ptr_array_add(argv, (gpointer) "-4");
 
     hostname = nm_dhcp_client_get_hostname(client);
diff --git a/src/dhcp/nm-dhcp-helper.c b/src/dhcp/nm-dhcp-helper.c
index 818a6f3c68..325f1be54e 100644
--- a/src/dhcp/nm-dhcp-helper.c
+++ b/src/dhcp/nm-dhcp-helper.c
@@ -83,12 +83,12 @@ build_signal_parameters(void)
             continue;
 
         /* Value passed as a byte array rather than a string, because there are
-		 * no character encoding guarantees with DHCP, and D-Bus requires
-		 * strings to be UTF-8.
-		 *
-		 * Note that we can't use g_variant_new_bytestring() here, because that
-		 * includes the trailing '\0'. (??!?)
-		 */
+         * no character encoding guarantees with DHCP, and D-Bus requires
+         * strings to be UTF-8.
+         *
+         * Note that we can't use g_variant_new_bytestring() here, because that
+         * includes the trailing '\0'. (??!?)
+         */
         g_variant_builder_add(&builder,
                               "{sv}",
                               name,
@@ -128,10 +128,10 @@ main(int argc, char *argv[])
     gint64                     time_end;
 
     /* Connecting to the unix socket can fail with EAGAIN if there are too
-	 * many pending connections and the server can't accept them in time
-	 * before reaching backlog capacity. Ideally the server should increase
-	 * the backlog length, but GLib doesn't provide a way to change it for a
-	 * GDBus server. Retry for up to 5 seconds in case of failure. */
+     * many pending connections and the server can't accept them in time
+     * before reaching backlog capacity. Ideally the server should increase
+     * the backlog length, but GLib doesn't provide a way to change it for a
+     * GDBus server. Retry for up to 5 seconds in case of failure. */
     time_start = g_get_monotonic_time();
     time_end   = time_start + (5000 * 1000L);
     try_count  = 0;
@@ -193,10 +193,10 @@ do_notify:
             gint64 interval;
 
             /* I am not sure that a race can actually happen, as we register the object
-			 * on the server side during GDBusServer:new-connection signal.
-			 *
-			 * However, there was also a race for subscribing to an event, so let's just
-			 * do some retry. */
+             * on the server side during GDBusServer:new-connection signal.
+             *
+             * However, there was also a race for subscribing to an event, so let's just
+             * do some retry. */
             if (remaining_time > 0) {
                 _LOGi("failure to call notify: %s (retry %u)", error->message, try_count);
                 interval = NM_CLAMP((gint64)(100L * (1L << NM_MIN(try_count, 31))), 5000, 25000);
@@ -209,9 +209,9 @@ do_notify:
         g_clear_error(&error);
 
         /* for backward compatibility, try to emit the signal. There is no stable
-		 * API between the dhcp-helper and NetworkManager. However, while upgrading
-		 * the NetworkManager package, a newer helper might want to notify an
-		 * older server, which still uses the "Event". */
+         * API between the dhcp-helper and NetworkManager. However, while upgrading
+         * the NetworkManager package, a newer helper might want to notify an
+         * older server, which still uses the "Event". */
         if (!g_dbus_connection_emit_signal(connection,
                                            NULL,
                                            "/",
diff --git a/src/dhcp/nm-dhcp-listener.c b/src/dhcp/nm-dhcp-listener.c
index add389f62c..9fd5fca4eb 100644
--- a/src/dhcp/nm-dhcp-listener.c
+++ b/src/dhcp/nm-dhcp-listener.c
@@ -27,7 +27,7 @@
 
 const NMDhcpClientFactory *const _nm_dhcp_manager_factories[6] = {
 /* the order here matters, as we will try the plugins in this order to find
-	 * the first available plugin. */
+     * the first available plugin. */
 
 #if WITH_DHCPCANON
     &_nm_dhcp_client_factory_dhcpcanon,
@@ -108,8 +108,8 @@ get_option(GVariant *options, const char *key)
     bytes = g_variant_get_fixed_array(value, &len, 1);
 
     /* Since the DHCP options come through environment variables, they should
-	 * already be UTF-8 safe, but just make sure.
-	 */
+     * already be UTF-8 safe, but just make sure.
+     */
     converted = g_malloc(len + 1);
     for (s = bytes, d = converted; s < bytes + len; s++, d++) {
         /* Convert NULLs to spaces and non-ASCII characters to ? */
@@ -228,7 +228,7 @@ new_connection_cb(NMDBusManager *     mgr,
     GError *               error = NULL;
 
     /* it is important to register the object during the new-connection signal,
-	 * as this avoids races with the connecting object. */
+     * as this avoids races with the connecting object. */
     registration_id = _dbus_connection_register_object(self, connection, &error);
     if (!registration_id) {
         _LOGE("failure to register %s for connection %p: %s",
diff --git a/src/dhcp/nm-dhcp-manager.c b/src/dhcp/nm-dhcp-manager.c
index 7596901c64..f064760312 100644
--- a/src/dhcp/nm-dhcp-manager.c
+++ b/src/dhcp/nm-dhcp-manager.c
@@ -92,24 +92,24 @@ _client_factory_get_gtype(const NMDhcpClientFactory *client_factory, int addr_fa
     nm_assert_addr_family(addr_family);
 
     /* currently, the chosen DHCP plugin for IPv4 and IPv6 is configured in NetworkManager.conf
-	 * and cannot be reloaded. It would be nice to configure the plugin per address family
-	 * or to be able to reload it.
-	 *
-	 * Note that certain options in NetworkManager.conf depend on the chosen DHCP plugin.
-	 * See "dhcp-plugin:" in "Device List Format" (`man NetworkManager.conf`).
-	 * Supporting reloading the plugin would also require to re-evalate the decisions from
-	 * the "Device List Format". Likewise, having per-address family plugins would make the
-	 * "main.dhcp" setting and "dhcp-plugin:" match non-sensical because these configurations
-	 * currently are address family independent.
-	 *
-	 * So actually, we don't want that complexity. We want to phase out all plugins in favor
-	 * of the internal plugin.
-	 * However, certain existing plugins are well known to not support an address family.
-	 * In those cases, we should just silently fallback to the internal plugin.
-	 *
-	 * This could be a problem with forward compatibility if we ever intended to add IPv6 support
-	 * to those plugins. But we don't intend to do so. The internal plugin is the way forward and
-	 * not extending other plugins. */
+     * and cannot be reloaded. It would be nice to configure the plugin per address family
+     * or to be able to reload it.
+     *
+     * Note that certain options in NetworkManager.conf depend on the chosen DHCP plugin.
+     * See "dhcp-plugin:" in "Device List Format" (`man NetworkManager.conf`).
+     * Supporting reloading the plugin would also require to re-evalate the decisions from
+     * the "Device List Format". Likewise, having per-address family plugins would make the
+     * "main.dhcp" setting and "dhcp-plugin:" match non-sensical because these configurations
+     * currently are address family independent.
+     *
+     * So actually, we don't want that complexity. We want to phase out all plugins in favor
+     * of the internal plugin.
+     * However, certain existing plugins are well known to not support an address family.
+     * In those cases, we should just silently fallback to the internal plugin.
+     *
+     * This could be a problem with forward compatibility if we ever intended to add IPv6 support
+     * to those plugins. But we don't intend to do so. The internal plugin is the way forward and
+     * not extending other plugins. */
 
     if (client_factory->get_type_per_addr_family)
         gtype = client_factory->get_type_per_addr_family(addr_family);
@@ -173,9 +173,9 @@ remove_client(NMDhcpManager *self, NMDhcpClient *client)
     c_list_unlink(&client->dhcp_client_lst);
 
     /* Stopping the client is left up to the controlling device
-	 * explicitly since we may want to quit NetworkManager but not terminate
-	 * the DHCP client.
-	 */
+     * explicitly since we may want to quit NetworkManager but not terminate
+     * the DHCP client.
+     */
 }
 
 static void
@@ -280,11 +280,11 @@ client_start(NMDhcpManager *           self,
     client = get_client_for_ifindex(self, addr_family, ifindex);
     if (client) {
         /* FIXME: we cannot just call synchronously "stop()" and forget about the client.
-		 * We need to wait for the client to be fully stopped because most/all clients
-		 * cannot quit right away.
-		 *
-		 * FIXME(shutdown): also fix this during shutdown, to wait for all DHCP clients
-		 * to be fully stopped. */
+         * We need to wait for the client to be fully stopped because most/all clients
+         * cannot quit right away.
+         *
+         * FIXME(shutdown): also fix this during shutdown, to wait for all DHCP clients
+         * to be fully stopped. */
         remove_client(self, client);
         nm_dhcp_client_stop(client, FALSE);
         g_object_unref(client);
@@ -345,30 +345,30 @@ client_start(NMDhcpManager *           self,
                      self);
 
     /* unfortunately, our implementations work differently per address-family regarding client-id/DUID.
-	 *
-	 * - for IPv4, the calling code may determine a client-id (from NM's connection profile).
-	 *   If present, it is taken. If not present, the DHCP plugin uses a plugin specific default.
-	 *     - for "internal" plugin, the default is just "mac".
-	 *     - for "dhclient", we try to get the configuration from dhclient's /etc/dhcp or fallback
-	 *       to whatever dhclient uses by default.
-	 *   We do it this way, because for dhclient the user may configure a default
-	 *   outside of NM, and we want to honor that. Worse, dhclient could be a wapper
-	 *   script where the wrapper script overwrites the client-id. We need to distinguish
-	 *   between: force a particular client-id and leave it unspecified to whatever dhclient
-	 *   wants.
-	 *
-	 * - for IPv6, the calling code always determines a client-id. It also specifies @enforce_duid,
-	 *   to determine whether the given client-id must be used.
-	 *     - for "internal" plugin @enforce_duid doesn't matter and the given client-id is
-	 *       always used.
-	 *     - for "dhclient", @enforce_duid FALSE means to first try to load the DUID from the
-	 *       lease file, and only otherwise fallback to the given client-id.
-	 *     - other plugins don't support DHCPv6.
-	 *   It's done this way, so that existing dhclient setups don't change behavior on upgrade.
-	 *
-	 * This difference is cumbersome and only exists because of "dhclient" which supports hacking the
-	 * default outside of NetworkManager API.
-	 */
+     *
+     * - for IPv4, the calling code may determine a client-id (from NM's connection profile).
+     *   If present, it is taken. If not present, the DHCP plugin uses a plugin specific default.
+     *     - for "internal" plugin, the default is just "mac".
+     *     - for "dhclient", we try to get the configuration from dhclient's /etc/dhcp or fallback
+     *       to whatever dhclient uses by default.
+     *   We do it this way, because for dhclient the user may configure a default
+     *   outside of NM, and we want to honor that. Worse, dhclient could be a wapper
+     *   script where the wrapper script overwrites the client-id. We need to distinguish
+     *   between: force a particular client-id and leave it unspecified to whatever dhclient
+     *   wants.
+     *
+     * - for IPv6, the calling code always determines a client-id. It also specifies @enforce_duid,
+     *   to determine whether the given client-id must be used.
+     *     - for "internal" plugin @enforce_duid doesn't matter and the given client-id is
+     *       always used.
+     *     - for "dhclient", @enforce_duid FALSE means to first try to load the DUID from the
+     *       lease file, and only otherwise fallback to the given client-id.
+     *     - other plugins don't support DHCPv6.
+     *   It's done this way, so that existing dhclient setups don't change behavior on upgrade.
+     *
+     * This difference is cumbersome and only exists because of "dhclient" which supports hacking the
+     * default outside of NetworkManager API.
+     */
 
     if (addr_family == AF_INET) {
         success = nm_dhcp_client_start_ip4(client,
@@ -430,10 +430,10 @@ nm_dhcp_manager_start_ip4(NMDhcpManager *     self,
 
     if (send_hostname) {
         /* Use, in order of preference:
-		 *  1. FQDN from configuration
-		 *  2. hostname from configuration
-		 *  3. system hostname (only host part)
-		 */
+         *  1. FQDN from configuration
+         *  2. hostname from configuration
+         *  3. system hostname (only host part)
+         */
         if (dhcp_fqdn) {
             hostname = dhcp_fqdn;
             use_fqdn = TRUE;
@@ -652,9 +652,9 @@ nm_dhcp_manager_init(NMDhcpManager *self)
     nm_log_info(LOGD_DHCP, "dhcp-init: Using DHCP client '%s'", client_factory->name);
 
     /* NOTE: currently the DHCP plugin is chosen once at start. It's not
-	 * possible to reload that configuration. If that ever becomes possible,
-	 * beware that the "dhcp-plugin" device spec made decisions based on
-	 * the previous plugin and may need reevaluation. */
+     * possible to reload that configuration. If that ever becomes possible,
+     * beware that the "dhcp-plugin" device spec made decisions based on
+     * the previous plugin and may need reevaluation. */
     priv->client_factory = client_factory;
 }
 
diff --git a/src/dhcp/nm-dhcp-nettools.c b/src/dhcp/nm-dhcp-nettools.c
index 5b9300846f..183e26bb3f 100644
--- a/src/dhcp/nm-dhcp-nettools.c
+++ b/src/dhcp/nm-dhcp-nettools.c
@@ -75,8 +75,8 @@ static void
 set_error_nettools(GError **error, int r, const char *message)
 {
     /* the error code returned from n_dhcp4_* API is either a negative
-	 * errno, or a positive internal error code. Generate different messages
-	 * for these. */
+     * errno, or a positive internal error code. Generate different messages
+     * for these. */
     if (r < 0)
         nm_utils_error_set_errno(error, r, "%s: %s", message);
     else
@@ -228,21 +228,21 @@ lease_option_print_domain_name(GString * str,
     uint8_t   c;
 
     /*
-	 * We are given two adjacent memory regions. The @cache contains alreday parsed
-	 * domain names, and the @datap contains the remaining data to parse.
-	 *
-	 * A domain name is formed from a sequence of labels. Each label start with
-	 * a length byte, where the two most significant bits are unset. A zero-length
-	 * label indicates the end of the domain name.
-	 *
-	 * Alternatively, a label can be followed by an offset (indicated by the two
-	 * most significant bits being set in the next byte that is read). The offset
-	 * is an offset into the cache, where the next label of the domain name can
-	 * be found.
-	 *
-	 * Note, that each time a jump to an offset is performed, the size of the
-	 * cache shrinks, so this is guaranteed to terminate.
-	 */
+     * We are given two adjacent memory regions. The @cache contains alreday parsed
+     * domain names, and the @datap contains the remaining data to parse.
+     *
+     * A domain name is formed from a sequence of labels. Each label start with
+     * a length byte, where the two most significant bits are unset. A zero-length
+     * label indicates the end of the domain name.
+     *
+     * Alternatively, a label can be followed by an offset (indicated by the two
+     * most significant bits being set in the next byte that is read). The offset
+     * is an offset into the cache, where the next label of the domain name can
+     * be found.
+     *
+     * Note, that each time a jump to an offset is performed, the size of the
+     * cache shrinks, so this is guaranteed to terminate.
+     */
     if (cache + n_cache != *datap)
         return FALSE;
 
@@ -257,9 +257,9 @@ lease_option_print_domain_name(GString * str,
 
             if (n_label == 0) {
                 /*
-				 * We reached the final label of the domain name. Adjust
-				 * the cache to include the consumed data, and return.
-				 */
+                 * We reached the final label of the domain name. Adjust
+                 * the cache to include the consumed data, and return.
+                 */
                 *n_cachep = *datap - cache;
                 return TRUE;
             }
@@ -279,9 +279,9 @@ lease_option_print_domain_name(GString * str,
             size_t offset = (c & 0x3F) << 16;
 
             /*
-			 * The offset is given as two bytes (in big endian), where the
-			 * two high bits are masked out.
-			 */
+             * The offset is given as two bytes (in big endian), where the
+             * two high bits are masked out.
+             */
 
             if (!lease_option_consume(&c, sizeof(c), domainp, n_domainp))
                 return FALSE;
@@ -387,7 +387,7 @@ lease_parse_address(NDhcp4ClientLease *lease,
         n_dhcp4_client_lease_get_basetime(lease, &nettools_basetime);
 
         /* usually we shouldn't assert against external libraries like n-dhcp4.
-		 * Here we still do it... it seems safe enough. */
+         * Here we still do it... it seems safe enough. */
         nm_assert(nettools_basetime > 0);
         nm_assert(nettools_lifetime >= nettools_basetime);
         nm_assert(((nettools_lifetime - nettools_basetime) % NM_UTILS_NSEC_PER_SEC) == 0);
@@ -400,15 +400,15 @@ lease_parse_address(NDhcp4ClientLease *lease,
             lifetime = nettools_lifetime - nettools_basetime;
 
             /* we "ceil" the value to the next second. In practice, we don't expect any sub-second values
-			 * from n-dhcp4 anyway, so this should have no effect. */
+             * from n-dhcp4 anyway, so this should have no effect. */
             lifetime += NM_UTILS_NSEC_PER_SEC - 1;
         }
 
         ts = nm_utils_monotonic_timestamp_from_boottime(nettools_basetime, 1);
 
         /* the timestamp must be positive, because we only started nettools DHCP client
-		 * after obtaining the first monotonic timestamp. Hence, the lease must have been
-		 * received afterwards. */
+         * after obtaining the first monotonic timestamp. Hence, the lease must have been
+         * received afterwards. */
         nm_assert(ts >= NM_UTILS_NSEC_PER_SEC);
 
         a_timestamp = ts / NM_UTILS_NSEC_PER_SEC;
@@ -499,7 +499,7 @@ lease_parse_address_list(NDhcp4ClientLease *      lease,
         case NM_DHCP_OPTION_DHCP4_DOMAIN_NAME_SERVER:
             if (addr.s_addr == 0 || nm_ip4_addr_is_localhost(addr.s_addr)) {
                 /* Skip localhost addresses, like also networkd does.
-				 * See https://github.com/systemd/systemd/issues/4524. */
+                 * See https://github.com/systemd/systemd/issues/4524. */
                 continue;
             }
             nm_ip4_config_add_nameserver(ip4_config, addr.s_addr);
@@ -559,7 +559,7 @@ lease_parse_routes(NDhcp4ClientLease *lease,
 
             if (plen == 0) {
                 /* if there are multiple default routes, we add them with differing
-				 * metrics. */
+                 * metrics. */
                 m = default_route_metric;
                 if (default_route_metric < G_MAXUINT32)
                     default_route_metric++;
@@ -603,16 +603,16 @@ lease_parse_routes(NDhcp4ClientLease *lease,
 
             if (has_classless) {
                 /* RFC 3443: if the DHCP server returns both a Classless Static Routes
-				 * option and a Static Routes option, the DHCP client MUST ignore the
-				 * Static Routes option. */
+                 * option and a Static Routes option, the DHCP client MUST ignore the
+                 * Static Routes option. */
                 continue;
             }
 
             if (plen == 0) {
                 /* for option 33 (static route), RFC 2132 says:
-				 *
-				 * The default route (0.0.0.0) is an illegal destination for a static
-				 * route. */
+                 *
+                 * The default route (0.0.0.0) is an illegal destination for a static
+                 * route. */
                 continue;
             }
 
@@ -649,16 +649,16 @@ lease_parse_routes(NDhcp4ClientLease *lease,
 
             if (has_router_from_classless) {
                 /* If the DHCP server returns both a Classless Static Routes option and a
-				 * Router option, the DHCP client MUST ignore the Router option [RFC 3442].
-				 *
-				 * Be more lenient and ignore the Router option only if Classless Static
-				 * Routes contain a default gateway (as other DHCP backends do).
-				 */
+                 * Router option, the DHCP client MUST ignore the Router option [RFC 3442].
+                 *
+                 * Be more lenient and ignore the Router option only if Classless Static
+                 * Routes contain a default gateway (as other DHCP backends do).
+                 */
                 continue;
             }
 
             /* if there are multiple default routes, we add them with differing
-			 * metrics. */
+             * metrics. */
             m = default_route_metric;
             if (default_route_metric < G_MAXUINT32)
                 default_route_metric++;
@@ -937,7 +937,7 @@ lease_parse_private_options(NDhcp4ClientLease *lease, GHashTable *options)
         int           r;
 
         /* We manage private options 249 (private classless static route) and 252 (wpad) in a special
-		 * way, so skip them as we here just manage all (the other) private options as raw data */
+         * way, so skip them as we here just manage all (the other) private options as raw data */
         if (NM_IN_SET(i,
                       NM_DHCP_OPTION_DHCP4_PRIVATE_CLASSLESS_STATIC_ROUTE,
                       NM_DHCP_OPTION_DHCP4_PRIVATE_PROXY_AUTODISCOVERY))
@@ -1137,12 +1137,12 @@ dhcp4_event_cb(int fd, GIOCondition condition, gpointer data)
     r = n_dhcp4_client_dispatch(priv->client);
     if (r < 0) {
         /* FIXME: if any operation (e.g. send()) fails during the
-		 * dispatch, n-dhcp4 returns an error without arming timers
-		 * or progressing state, so the only reasonable thing to do
-		 * is to move to failed state so that the client will be
-		 * restarted. Ideally n-dhcp4 should retry failed operations
-		 * a predefined number of times (possibly infinite).
-		 */
+         * dispatch, n-dhcp4 returns an error without arming timers
+         * or progressing state, so the only reasonable thing to do
+         * is to move to failed state so that the client will be
+         * restarted. Ideally n-dhcp4 should retry failed operations
+         * a predefined number of times (possibly infinite).
+         */
         _LOGE("error %d dispatching events", r);
         nm_clear_g_source_inst(&priv->event_source);
         nm_dhcp_client_set_state(NM_DHCP_CLIENT(self), NM_DHCP_STATE_FAIL, NULL, NULL);
@@ -1199,7 +1199,7 @@ nettools_create(NMDhcpNettools *self, const char *dhcp_anycast_addr, GError **er
     }
 
     /* Note that we always set a client-id. In particular for infiniband that is necessary,
-	 * see https://tools.ietf.org/html/rfc4390#section-2.1 . */
+     * see https://tools.ietf.org/html/rfc4390#section-2.1 . */
     client_id = nm_dhcp_client_get_client_id(NM_DHCP_CLIENT(self));
     if (!client_id) {
         client_id_new = nm_utils_dhcp_client_id_mac(arp_type, hwaddr_arr, hwaddr_len);
@@ -1341,9 +1341,9 @@ ip4_start(NMDhcpClient *client,
     }
 
     /*
-	 * FIXME:
-	 * Select, or configure, a reasonable start delay, to protect poor servers being flooded.
-	 */
+     * FIXME:
+     * Select, or configure, a reasonable start delay, to protect poor servers being flooded.
+     */
     n_dhcp4_client_probe_config_set_start_delay(config, 1);
 
     nm_dhcp_utils_get_leasefile_path(AF_INET,
@@ -1356,12 +1356,12 @@ ip4_start(NMDhcpClient *client,
         inet_pton(AF_INET, last_ip4_address, &last_addr);
     else {
         /*
-		 * TODO: we stick to the systemd-networkd lease file format. Quite easy for now to
-		 * just use the functions in systemd code. Anyway, as in the end we just use the
-		 * ip address from all the options found in the lease, write a function that parses
-		 * the lease file just for the assigned address and returns it in &last_address.
-		 * Then drop reference to systemd-networkd structures and functions.
-		 */
+         * TODO: we stick to the systemd-networkd lease file format. Quite easy for now to
+         * just use the functions in systemd code. Anyway, as in the end we just use the
+         * ip address from all the options found in the lease, write a function that parses
+         * the lease file just for the assigned address and returns it in &last_address.
+         * Then drop reference to systemd-networkd structures and functions.
+         */
         nm_auto(sd_dhcp_lease_unrefp) sd_dhcp_lease *lease = NULL;
 
         dhcp_lease_load(&lease, lease_file);
diff --git a/src/dhcp/nm-dhcp-options.c b/src/dhcp/nm-dhcp-options.c
index abf533cdb6..03d783e7b1 100644
--- a/src/dhcp/nm-dhcp-options.c
+++ b/src/dhcp/nm-dhcp-options.c
@@ -23,8 +23,8 @@ const NMDhcpOption _nm_dhcp_option_dhcp4_options[] = {
     REQ(NM_DHCP_OPTION_DHCP4_INTERFACE_MTU, "interface_mtu", TRUE),
     REQ(NM_DHCP_OPTION_DHCP4_BROADCAST, "broadcast_address", TRUE),
     /* RFC 3442: The Classless Static Routes option code MUST appear in the parameter
-	 *   request list prior to both the Router option code and the Static
-	 *   Routes option code, if present. */
+     *   request list prior to both the Router option code and the Static
+     *   Routes option code, if present. */
     REQ(NM_DHCP_OPTION_DHCP4_CLASSLESS_STATIC_ROUTE, "rfc3442_classless_static_routes", TRUE),
     REQ(NM_DHCP_OPTION_DHCP4_ROUTER, "routers", TRUE),
     REQ(NM_DHCP_OPTION_DHCP4_STATIC_ROUTE, "static_routes", TRUE),
@@ -174,8 +174,8 @@ const NMDhcpOption _nm_dhcp_option_dhcp6_options[] = {
     REQ(NM_DHCP_OPTION_DHCP6_CLIENTID, "dhcp6_client_id", FALSE),
 
     /* Don't request server ID by default; some servers don't reply to
-	 * Information Requests that request the Server ID.
-	 */
+     * Information Requests that request the Server ID.
+     */
     REQ(NM_DHCP_OPTION_DHCP6_SERVERID, "dhcp6_server_id", FALSE),
 
     REQ(NM_DHCP_OPTION_DHCP6_DNS_SERVERS, "dhcp6_name_servers", TRUE),
diff --git a/src/dhcp/nm-dhcp-systemd.c b/src/dhcp/nm-dhcp-systemd.c
index 2d25735d7d..0e76512275 100644
--- a/src/dhcp/nm-dhcp-systemd.c
+++ b/src/dhcp/nm-dhcp-systemd.c
@@ -202,7 +202,7 @@ lease_to_ip4_config(NMDedupMultiIndex *multi_idx,
 
             if (addr_list[i].s_addr == 0 || nm_ip4_addr_is_localhost(addr_list[i].s_addr)) {
                 /* Skip localhost addresses, like also networkd does.
-				 * See https://github.com/systemd/systemd/issues/4524. */
+                 * See https://github.com/systemd/systemd/issues/4524. */
                 continue;
             }
             nm_ip4_config_add_nameserver(ip4_config, addr_list[i].s_addr);
@@ -236,7 +236,7 @@ lease_to_ip4_config(NMDedupMultiIndex *multi_idx,
                                   s);
 
         /* Multiple domains sometimes stuffed into option 15 "Domain Name".
-		 * As systemd escapes such characters, split them at \\032. */
+         * As systemd escapes such characters, split them at \\032. */
         domains = g_strsplit(s, "\\032", 0);
         for (d = domains; *d; d++)
             nm_ip4_config_add_domain(ip4_config, *d);
@@ -309,22 +309,22 @@ lease_to_ip4_config(NMDedupMultiIndex *multi_idx,
 
             if (option == NM_DHCP_OPTION_DHCP4_STATIC_ROUTE && has_classless_route) {
                 /* RFC 3443: if the DHCP server returns both a Classless Static Routes
-				 * option and a Static Routes option, the DHCP client MUST ignore the
-				 * Static Routes option. */
+                 * option and a Static Routes option, the DHCP client MUST ignore the
+                 * Static Routes option. */
                 continue;
             }
 
             if (r_plen == 0 && option == NM_DHCP_OPTION_DHCP4_STATIC_ROUTE) {
                 /* for option 33 (static route), RFC 2132 says:
-				 *
-				 * The default route (0.0.0.0) is an illegal destination for a static
-				 * route. */
+                 *
+                 * The default route (0.0.0.0) is an illegal destination for a static
+                 * route. */
                 continue;
             }
 
             if (r_plen == 0) {
                 /* if there are multiple default routes, we add them with differing
-				 * metrics. */
+                 * metrics. */
                 m = default_route_metric;
                 if (default_route_metric < G_MAXUINT32)
                     default_route_metric++;
@@ -376,16 +376,16 @@ lease_to_ip4_config(NMDedupMultiIndex *multi_idx,
 
             if (has_router_from_classless) {
                 /* If the DHCP server returns both a Classless Static Routes option and a
-				 * Router option, the DHCP client MUST ignore the Router option [RFC 3442].
-				 *
-				 * Be more lenient and ignore the Router option only if Classless Static
-				 * Routes contain a default gateway (as other DHCP backends do).
-				 */
+                 * Router option, the DHCP client MUST ignore the Router option [RFC 3442].
+                 *
+                 * Be more lenient and ignore the Router option only if Classless Static
+                 * Routes contain a default gateway (as other DHCP backends do).
+                 */
                 continue;
             }
 
             /* if there are multiple default routes, we add them with differing
-			 * metrics. */
+             * metrics. */
             m = default_route_metric;
             if (default_route_metric < G_MAXUINT32)
                 default_route_metric++;
@@ -674,7 +674,7 @@ ip4_start(NMDhcpClient *client,
     }
 
     /* Note that we always set a client-id. In particular for infiniband that is necessary,
-	 * see https://tools.ietf.org/html/rfc4390#section-2.1 . */
+     * see https://tools.ietf.org/html/rfc4390#section-2.1 . */
     r = sd_dhcp_client_set_client_id(sd_client,
                                      client_id_arr[0],
                                      client_id_arr + 1,
@@ -697,9 +697,9 @@ ip4_start(NMDhcpClient *client,
     hostname = nm_dhcp_client_get_hostname(client);
     if (hostname) {
         /* FIXME: sd-dhcp decides which hostname/FQDN option to send (12 or 81)
-		 * only based on whether the hostname has a domain part or not. At the
-		 * moment there is no way to force one or another.
-		 */
+         * only based on whether the hostname has a domain part or not. At the
+         * moment there is no way to force one or another.
+         */
         r = sd_dhcp_client_set_hostname(sd_client, hostname);
         if (r < 0) {
             nm_utils_error_set_errno(error, r, "failed to set DHCP hostname: %s");
@@ -1021,7 +1021,7 @@ ip6_start(NMDhcpClient *            client,
         if (needed_prefixes > 1)
             _LOGW("dhcp-client6: only one prefix request is supported");
         /* FIXME: systemd-networkd API only allows to request a
-		 * single prefix */
+         * single prefix */
         r = sd_dhcp6_client_set_prefix_delegation(sd_client, TRUE);
         if (r < 0) {
             nm_utils_error_set_errno(error, r, "failed to enable prefix delegation: %s");
diff --git a/src/dhcp/nm-dhcp-utils.c b/src/dhcp/nm-dhcp-utils.c
index da505d94a9..ae73303845 100644
--- a/src/dhcp/nm-dhcp-utils.c
+++ b/src/dhcp/nm-dhcp-utils.c
@@ -218,29 +218,29 @@ ip4_process_classless_routes(const char * iface,
     *gwaddr = 0;
 
     /* dhcpd/dhclient in Fedora has support for rfc3442 implemented using a
-	 * slightly different format:
-	 *
-	 * option classless-static-routes = array of (destination-descriptor ip-address);
-	 *
-	 * which results in:
-	 *
-	 * 0 192.168.0.113 25.129.210.177.132 192.168.0.113 7.2 10.34.255.6
-	 *
-	 * dhcpcd supports classless static routes natively and uses this same
-	 * option identifier with the following format:
-	 *
-	 * 192.168.10.0/24 192.168.1.1 10.0.0.0/8 10.17.66.41
-	 */
+     * slightly different format:
+     *
+     * option classless-static-routes = array of (destination-descriptor ip-address);
+     *
+     * which results in:
+     *
+     * 0 192.168.0.113 25.129.210.177.132 192.168.0.113 7.2 10.34.255.6
+     *
+     * dhcpcd supports classless static routes natively and uses this same
+     * option identifier with the following format:
+     *
+     * 192.168.10.0/24 192.168.1.1 10.0.0.0/8 10.17.66.41
+     */
     str = g_hash_table_lookup(options, "classless_static_routes");
 
     /* dhclient doesn't have actual support for rfc3442 classless static routes
-	 * upstream.  Thus, people resort to defining the option in dhclient.conf
-	 * and using arbitrary formats like so:
-	 *
-	 * option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
-	 *
-	 * See https://lists.isc.org/pipermail/dhcp-users/2008-December/007629.html
-	 */
+     * upstream.  Thus, people resort to defining the option in dhclient.conf
+     * and using arbitrary formats like so:
+     *
+     * option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
+     *
+     * See https://lists.isc.org/pipermail/dhcp-users/2008-December/007629.html
+     */
     if (!str)
         str = g_hash_table_lookup(options, "rfc3442_classless_static_routes");
 
@@ -428,8 +428,8 @@ nm_dhcp_utils_ip4_config_from_options(NMDedupMultiIndex *multi_idx,
     nm_platform_ip4_address_set_addr(&address, addr, plen);
 
     /* Routes: if the server returns classless static routes, we MUST ignore
-	 * the 'static_routes' option.
-	 */
+     * the 'static_routes' option.
+     */
     if (!ip4_process_classless_routes(iface,
                                       options,
                                       route_table,
@@ -443,8 +443,8 @@ nm_dhcp_utils_ip4_config_from_options(NMDedupMultiIndex *multi_idx,
         gateway_has = TRUE;
     } else {
         /* If the gateway wasn't provided as a classless static route with a
-		 * subnet length of 0, try to find it using the old-style 'routers' option.
-		 */
+         * subnet length of 0, try to find it using the old-style 'routers' option.
+         */
         str = g_hash_table_lookup(options, "routers");
         if (str) {
             gs_free const char **routers = nm_utils_strsplit_set(str, " ");
@@ -745,9 +745,9 @@ nm_dhcp_utils_client_id_string_to_bytes(const char *client_id)
         bytes = nm_utils_hexstr2bin(client_id);
 
         /* the result must be at least two bytes long,
-		 * because @client_id contains a delimiter
-		 * but nm_utils_hexstr2bin() does not allow
-		 * leading nor trailing delimiters. */
+         * because @client_id contains a delimiter
+         * but nm_utils_hexstr2bin() does not allow
+         * leading nor trailing delimiters. */
         nm_assert(!bytes || g_bytes_get_size(bytes) >= 2);
     }
     if (!bytes) {
diff --git a/src/dhcp/tests/test-dhcp-utils.c b/src/dhcp/tests/test-dhcp-utils.c
index 738c6bb82d..8626b66fad 100644
--- a/src/dhcp/tests/test-dhcp-utils.c
+++ b/src/dhcp/tests/test-dhcp-utils.c
@@ -414,8 +414,8 @@ test_dhcpcd_invalid_classless_routes_1(void)
     g_test_assert_expected_messages();
 
     /* Test falling back to old-style static routes if the classless static
-	 * routes are invalid.
-	 */
+     * routes are invalid.
+     */
     g_assert_cmpint(nm_ip4_config_get_num_routes(ip4_config), ==, 3);
     ip4_test_route(ip4_config, 0, expected_route1_dest, expected_route1_gw, 32);
     ip4_test_route(ip4_config, 1, expected_route2_dest, expected_route2_gw, 32);
@@ -445,8 +445,8 @@ test_dhclient_invalid_classless_routes_2(void)
     g_test_assert_expected_messages();
 
     /* Test falling back to old-style static routes if the classless static
-	 * routes are invalid.
-	 */
+     * routes are invalid.
+     */
     g_assert_cmpint(nm_ip4_config_get_num_routes(ip4_config), ==, 3);
     ip4_test_route(ip4_config, 0, expected_route1_dest, expected_route1_gw, 32);
     ip4_test_route(ip4_config, 1, expected_route2_dest, expected_route2_gw, 32);
@@ -476,8 +476,8 @@ test_dhcpcd_invalid_classless_routes_2(void)
     g_test_assert_expected_messages();
 
     /* Test falling back to old-style static routes if the classless static
-	 * routes are invalid.
-	 */
+     * routes are invalid.
+     */
 
     /* Routes */
     g_assert_cmpint(nm_ip4_config_get_num_routes(ip4_config), ==, 3);
@@ -684,9 +684,9 @@ test_ip4_prefix_classless(void)
     const NMPlatformIP4Address * address;
 
     /* Ensure that the missing-subnet-mask handler doesn't mangle classless
-	 * subnet masks at all.  The handler should trigger only if the server
-	 * doesn't send the subnet mask.
-	 */
+     * subnet masks at all.  The handler should trigger only if the server
+     * doesn't send the subnet mask.
+     */
 
     options = fill_table(generic_options, NULL);
     g_hash_table_insert(options, "ip_address", "172.16.54.22");
diff --git a/src/dns/nm-dns-dnsmasq.c b/src/dns/nm-dns-dnsmasq.c
index 3c5bf2fa15..10fb6732fa 100644
--- a/src/dns/nm-dns-dnsmasq.c
+++ b/src/dns/nm-dns-dnsmasq.c
@@ -80,9 +80,9 @@ static struct {
     guint watch_id;
 
     /* whether the external process (with the pid from PIDFILE) was already killed.
-	 * This only happens once, once we do that, we remember to not do it again.
-	 * The reason is that later one, when we want to kill the process it's a
-	 * child process. So, we wait for the exit code. */
+     * This only happens once, once we do that, we remember to not do it again.
+     * The reason is that later one, when we want to kill the process it's a
+     * child process. So, we wait for the exit code. */
     bool kill_external_done : 1;
 
     bool terminate_sigkill : 1;
@@ -295,7 +295,7 @@ _gl_pid_spawn_register_for_termination(void)
 {
     if (gl_pid.pid > 0 && !gl_pid.terminate_handle) {
         /* Create a shutdown handle as a reminder that the currently running process must be terminated
-		 * first. This also happens to block shutdown... */
+         * first. This also happens to block shutdown... */
         gl_pid.terminate_handle = nm_shutdown_wait_obj_register_handle_full(
             g_strdup_printf("kill-dnsmasq-process-%" G_PID_FORMAT, gl_pid.pid),
             TRUE);
@@ -362,8 +362,8 @@ _gl_pid_spawn_cancelled_cb(GCancellable *cancellable, GlPidSpawnAsyncData *sdata
         gl_pid.spawn_data = NULL;
 
         /* When the cancellable gets cancelled, we terminate the current dnsmasq instance
-		 * in the background. The only way for keeping dnsmasq running while unregistering
-		 * the callback is by calling _gl_pid_spawn() without a new callback. */
+         * in the background. The only way for keeping dnsmasq running while unregistering
+         * the callback is by calling _gl_pid_spawn() without a new callback. */
         _gl_pid_spawn_register_for_termination();
     } else
         nm_assert_not_reached();
@@ -441,7 +441,7 @@ _gl_pid_spawn_watch_cb(GPid pid, int status, gpointer user_data)
 
     if (gl_pid.pid != pid) {
         /* this can only happen, if we timed out and no longer care about this PID.
-		 * We still kept the watch-id active, to reap the process. Nothing to do. */
+         * We still kept the watch-id active, to reap the process. Nothing to do. */
         return;
     }
 
@@ -456,8 +456,8 @@ _gl_pid_spawn_watch_cb(GPid pid, int status, gpointer user_data)
     if (gl_pid.spawn_data) {
         if (was_stopping) {
             /* The current process was scheduled to be terminated. That means the pending
-			 * spawn_data is not for that former instance, but for starting a new one.
-			 * This spawn-request is not yet complete, instead it's just about to start. */
+             * spawn_data is not for that former instance, but for starting a new one.
+             * This spawn-request is not yet complete, instead it's just about to start. */
         } else
             _gl_pid_spawn_notify(g_steal_pointer(&gl_pid.spawn_data), pid, &status, NULL);
     }
@@ -636,15 +636,15 @@ _gl_pid_spawn(const char *          dm_binary,
                          gl_pid.spawn_data);
 
         /* If dnsmasq is running, we terminate it and start a new instance.
-		 *
-		 * If the user would not provide a new callback, this would mean to fail/abort
-		 * the currently subscribed notification (below). But it would leave the dnsmasq
-		 * instance running in the background.
-		 * This allows the user to say to not care about the current instance
-		 * anymore, but still leave it running.
-		 *
-		 * To kill the dnsmasq process without scheduling a new one, cancel the cancellable
-		 * instead. */
+         *
+         * If the user would not provide a new callback, this would mean to fail/abort
+         * the currently subscribed notification (below). But it would leave the dnsmasq
+         * instance running in the background.
+         * This allows the user to say to not care about the current instance
+         * anymore, but still leave it running.
+         *
+         * To kill the dnsmasq process without scheduling a new one, cancel the cancellable
+         * instead. */
         _gl_pid_spawn_register_for_termination();
     } else {
         nm_assert(!notify);
@@ -656,9 +656,9 @@ _gl_pid_spawn(const char *          dm_binary,
         gs_free_error GError *error = NULL;
 
         /* we don't mark the error as G_IO_ERROR/G_IO_ERROR_CANCELLED. That
-		 * is reserved for cancelling the cancellable. However, the current
-		 * request was obsoleted/replaced by a new one, so we fail it with
-		 * NM_UTILS_ERROR/NM_UTILS_ERROR_CANCELLED_DISPOSING. */
+         * is reserved for cancelling the cancellable. However, the current
+         * request was obsoleted/replaced by a new one, so we fail it with
+         * NM_UTILS_ERROR/NM_UTILS_ERROR_CANCELLED_DISPOSING. */
         nm_utils_error_set_cancelled(&error, TRUE, NULL);
         _gl_pid_spawn_notify(sdata_replace, 0, NULL, error);
     }
@@ -761,10 +761,10 @@ ip_addr_to_string(int addr_family, gconstpointer addr, const char *iface, char *
         else
             _nm_utils_inet6_ntop(addr, buf2);
         /* Need to scope link-local addresses with %<zone-id>. Before dnsmasq 2.58,
-		 * only '@' was supported as delimiter. Since 2.58, '@' and '%' are
-		 * supported. Due to a bug, since 2.73 only '%' works properly as "server"
-		 * address.
-		 */
+         * only '@' was supported as delimiter. Since 2.58, '@' and '%' are
+         * supported. Due to a bug, since 2.73 only '%' works properly as "server"
+         * address.
+         */
         separator = IN6_IS_ADDR_LINKLOCAL(addr) ? "%" : "@";
     }
 
@@ -924,7 +924,7 @@ _main_cleanup(NMDnsDnsmasq *self, gboolean emit_failed)
     nm_clear_g_cancellable(&priv->update_cancellable);
 
     /* cancelling the main_cancellable will also cause _gl_pid_spawn*() to terminate the
-	 * process in the background. */
+     * process in the background. */
     nm_clear_g_cancellable(&priv->main_cancellable);
 
     if (!priv->is_stopped && priv->burst_retry_timeout_id == 0) {
@@ -1061,8 +1061,8 @@ start_dnsmasq(NMDnsDnsmasq *self, gboolean force_start, GError **error)
     dm_binary = nm_utils_find_helper("dnsmasq", DNSMASQ_PATH, NULL);
     if (!dm_binary) {
         /* We resolve the binary name before trying to start it asynchronously.
-		 * The reason is, that if dnsmasq is not installed, we want to fail early,
-		 * so that NMDnsManager can fallback to a non-caching implementation. */
+         * The reason is, that if dnsmasq is not installed, we want to fail early,
+         * so that NMDnsManager can fallback to a non-caching implementation. */
         nm_utils_error_set(error, NM_UTILS_ERROR_UNKNOWN, "could not find dnsmasq binary");
         return FALSE;
     }
@@ -1146,7 +1146,7 @@ stop(NMDnsPlugin *plugin)
     nm_clear_g_source(&priv->burst_retry_timeout_id);
 
     /* Cancelling the cancellable will also terminate the
-	 * process (in the background). */
+     * process (in the background). */
     _main_cleanup(self, FALSE);
 }
 
diff --git a/src/dns/nm-dns-manager.c b/src/dns/nm-dns-manager.c
index ef86782f57..c1f3cc960a 100644
--- a/src/dns/nm-dns-manager.c
+++ b/src/dns/nm-dns-manager.c
@@ -462,10 +462,10 @@ merge_one_ip_config(NMResolvConfData *rc, int ifindex, const NMIPConfig *ip_conf
     }
     if (num_nameservers == 0) {
         /* If the @ip_config contributes no DNS servers, ignore whether trust-ad is set or unset
-		 * for this @ip_config. */
+         * for this @ip_config. */
     } else if (has_trust_ad) {
         /* We only set has_trust_ad to TRUE, if all IP configs agree (or don't contribute).
-		 * Once set to FALSE, it doesn't get reset. */
+         * Once set to FALSE, it doesn't get reset. */
         if (rc->has_trust_ad == NM_TERNARY_DEFAULT)
             rc->has_trust_ad = NM_TERNARY_TRUE;
     } else
@@ -566,8 +566,8 @@ dispatch_netconfig(NMDnsManager *     self,
     str = g_string_new("");
 
     /* NM is writing already-merged DNS information to netconfig, so it
-	 * does not apply to a specific network interface.
-	 */
+     * does not apply to a specific network interface.
+     */
     netconfig_construct_str(self, str, "INTERFACE", "NetworkManager");
     netconfig_construct_strv(self, str, "DNSSEARCH", searches);
     netconfig_construct_strv(self, str, "DNSSERVERS", nameservers);
@@ -634,19 +634,19 @@ create_resolv_conf(const char *const *searches,
 
             if (l == 0 || NM_STRCHAR_ANY(s, ch, NM_IN_SET(ch, ' ', '\t', '\n'))) {
                 /* there should be no such characters in the search entry. Also,
-				 * because glibc parser would treat them as line/word separator.
-				 *
-				 * Skip the value silently. */
+                 * because glibc parser would treat them as line/word separator.
+                 *
+                 * Skip the value silently. */
                 continue;
             }
 
             if (search_base_idx > 0) {
                 if (str->len - search_base_idx + 1 + l > 254) {
                     /* this entry crosses the 256 character boundary. Older glibc versions
-					 * would truncate the entry at this point.
-					 *
-					 * Fill the line with spaces to cross the 256 char boundary and continue
-					 * afterwards. This way, the truncation happens between two search entries. */
+                     * would truncate the entry at this point.
+                     *
+                     * Fill the line with spaces to cross the 256 char boundary and continue
+                     * afterwards. This way, the truncation happens between two search entries. */
                     while (str->len - search_base_idx < 257)
                         g_string_append_c(str, ' ');
                     search_base_idx = 0;
@@ -879,12 +879,12 @@ update_resolv_conf(NMDnsManager *                self,
                 rc_path = rc_path_real;
             else {
                 /* realpath did not resolve a path-name. That either means,
-				 * _PATH_RESCONF:
-				 *   - does not exist
-				 *   - is a plain file
-				 *   - is a dangling symlink
-				 *
-				 * Handle the case, where it is a dangling symlink... */
+                 * _PATH_RESCONF:
+                 *   - does not exist
+                 *   - is a plain file
+                 *   - is a dangling symlink
+                 *
+                 * Handle the case, where it is a dangling symlink... */
                 rc_path_syml = nm_utils_read_link_absolute(_PATH_RESCONF, NULL);
                 if (rc_path_syml)
                     rc_path = rc_path_syml;
@@ -892,8 +892,8 @@ update_resolv_conf(NMDnsManager *                self,
         }
 
         /* we first write to /etc/resolv.conf directly. If that fails,
-		 * we still continue to write to runstatedir but remember the
-		 * error. */
+         * we still continue to write to runstatedir but remember the
+         * error. */
         if (!g_file_set_contents(rc_path, content, -1, &local)) {
             _LOGT("update-resolv-conf: write to %s failed (rc-manager=%s, %s)",
                   rc_path,
@@ -901,7 +901,7 @@ update_resolv_conf(NMDnsManager *                self,
                   local->message);
             g_propagate_error(error, local);
             /* clear @error, so that we don't try reset it. This is the error
-			 * we want to propagate to the caller. */
+             * we want to propagate to the caller. */
             error             = NULL;
             write_file_result = SR_ERROR;
         } else {
@@ -937,8 +937,8 @@ update_resolv_conf(NMDnsManager *                self,
         if (success) {
             errsv = errno;
             /* only set an error here if write_resolv_conf() was successful,
-			 * since its error is more important.
-			 */
+             * since its error is more important.
+             */
             g_set_error(error,
                         NM_MANAGER_ERROR,
                         NM_MANAGER_ERROR_FAILED,
@@ -992,9 +992,9 @@ update_resolv_conf(NMDnsManager *                self,
     }
 
     /* By this point, /etc/resolv.conf exists and is a symlink to our internal
-	 * resolv.conf. We update the symlink so that applications get an inotify
-	 * notification.
-	 */
+     * resolv.conf. We update the symlink so that applications get an inotify
+     * notification.
+     */
     if (unlink(RESOLV_CONF_TMP) != 0 && ((errsv = errno) != ENOENT)) {
         g_set_error(error,
                     NM_MANAGER_ERROR,
@@ -1066,7 +1066,7 @@ compute_hash(NMDnsManager *self, const NMGlobalDnsConfig *global, guint8 buffer[
         const CList *head;
 
         /* FIXME(ip-config-checksum): this relies on the fact that an IP
-		 * configuration without DNS parameters gives a zero checksum. */
+         * configuration without DNS parameters gives a zero checksum. */
         head = _ip_config_lst_head(self);
         c_list_for_each_entry (ip_data, head, ip_config_lst)
             nm_ip_config_hash(ip_data->ip_config, sum, TRUE);
@@ -1209,12 +1209,12 @@ _collect_resolv_conf_data(NMDnsManager *     self,
     }
 
     /* If the hostname is a FQDN ("dcbw.example.com"), then add the domain part of it
-	 * ("example.com") to the searches list, to ensure that we can still resolve its
-	 * non-FQ form ("dcbw") too. (Also, if there are no other search domains specified,
-	 * this makes a good default.) However, if the hostname is the top level of a domain
-	 * (eg, "example.com"), then use the hostname itself as the search (since the user is
-	 * unlikely to want "com" as a search domain).
-	 */
+     * ("example.com") to the searches list, to ensure that we can still resolve its
+     * non-FQ form ("dcbw") too. (Also, if there are no other search domains specified,
+     * this makes a good default.) However, if the hostname is the top level of a domain
+     * (eg, "example.com"), then use the hostname itself as the search (since the user is
+     * unlikely to want "com" as a search domain).
+     */
     if (priv->hostname) {
         const char *hostdomain = strchr(priv->hostname, '.');
 
@@ -1371,14 +1371,14 @@ rebuild_domain_lists(NMDnsManager *self)
         num_dom1 = 0;
 
         /* Add wildcard lookup domain to connections with the default route.
-		 * If there is no default route, add the wildcard domain to all non-VPN
-		 * connections */
+         * If there is no default route, add the wildcard domain to all non-VPN
+         * connections */
         if (default_route_found) {
             /* FIXME: this heuristic of which device has a default route does
-			 * not work with policy routing (as used by default with WireGuard).
-			 * We should have a more stable mechanism where an NMIPConfig indicates
-			 * whether it is suitable for certain operations (like having an automatically
-			 * added "~" domain). */
+             * not work with policy routing (as used by default with WireGuard).
+             * We should have a more stable mechanism where an NMIPConfig indicates
+             * whether it is suitable for certain operations (like having an automatically
+             * added "~" domain). */
             if (nm_ip_config_best_default_route_get(ip_config))
                 domains[num_dom1++] = "~";
         } else {
@@ -1543,8 +1543,8 @@ update_dns(NMDnsManager *self, gboolean no_caching, GError **error)
             _LOGW("update-dns: plugin %s update failed: %s", plugin_name, plugin_error->message);
 
             /* If the plugin failed to update, we shouldn't write out a local
-			 * caching DNS configuration to resolv.conf.
-			 */
+             * caching DNS configuration to resolv.conf.
+             */
             caching = FALSE;
         }
 
@@ -1552,8 +1552,8 @@ plugin_skip:;
     }
 
     /* Clear the generated search list as it points to
-	 * strings owned by IP configurations and we can't
-	 * guarantee they stay alive. */
+     * strings owned by IP configurations and we can't
+     * guarantee they stay alive. */
     clear_domain_lists(self);
 
     update_resolv_conf_no_stub(self,
@@ -1562,9 +1562,9 @@ plugin_skip:;
                                NM_CAST_STRV_CC(options));
 
     /* If caching was successful, we only send 127.0.0.1 to /etc/resolv.conf
-	 * to ensure that the glibc resolver doesn't try to round-robin nameservers,
-	 * but only uses the local caching nameserver.
-	 */
+     * to ensure that the glibc resolver doesn't try to round-robin nameservers,
+     * but only uses the local caching nameserver.
+     */
     if (caching) {
         const char *lladdr = "127.0.0.1";
 
@@ -1590,7 +1590,7 @@ plugin_skip:;
                                         priv->rc_manager);
             resolv_conf_updated = TRUE;
             /* If we have ended with no nameservers avoid updating again resolv.conf
-			 * on stop, as some external changes may be applied to it in the meanwhile */
+             * on stop, as some external changes may be applied to it in the meanwhile */
             if (!nameservers && !options)
                 priv->dns_touched = FALSE;
             break;
@@ -1845,10 +1845,10 @@ nm_dns_manager_stop(NMDnsManager *self)
     _LOGT("stopping...");
 
     /* If we're quitting, leave a valid resolv.conf in place, not one
-	 * pointing to 127.0.0.1 if dnsmasq was active.  But if we haven't
-	 * done any DNS updates yet, there's no reason to touch resolv.conf
-	 * on shutdown.
-	 */
+     * pointing to 127.0.0.1 if dnsmasq was active.  But if we haven't
+     * done any DNS updates yet, there's no reason to touch resolv.conf
+     * on shutdown.
+     */
     if (priv->dns_touched && priv->plugin && NM_IS_DNS_DNSMASQ(priv->plugin)) {
         gs_free_error GError *error = NULL;
 
@@ -1903,8 +1903,8 @@ _check_resconf_immutable(NMDnsManagerResolvConfManager rc_manager)
             switch (rc_manager) {
             case NM_DNS_MANAGER_RESOLV_CONF_MAN_SYMLINK:
                 /* we don't care whether the link-target is immutable.
-				 * If the symlink points to another file, rc-manager=symlink anyway backs off.
-				 * Otherwise, we would only check whether our internal resolv.conf is immutable. */
+                 * If the symlink points to another file, rc-manager=symlink anyway backs off.
+                 * Otherwise, we would only check whether our internal resolv.conf is immutable. */
                 return NM_DNS_MANAGER_RESOLV_CONF_MAN_SYMLINK;
             case NM_DNS_MANAGER_RESOLV_CONF_MAN_UNKNOWN:
             case NM_DNS_MANAGER_RESOLV_CONF_MAN_UNMANAGED:
@@ -1953,13 +1953,13 @@ _resolvconf_resolved_managed(void)
         nm_auto_free char *real_path = NULL;
 
         /* see if resolv.conf is a symlink with a target that is
-		 * exactly like one of the candidates.
-		 *
-		 * This check will work for symlinks, even if the target
-		 * does not exist and realpath() cannot resolve anything.
-		 *
-		 * We want to handle that, because systemd-resolved might not
-		 * have started yet. */
+         * exactly like one of the candidates.
+         *
+         * This check will work for symlinks, even if the target
+         * does not exist and realpath() cannot resolve anything.
+         *
+         * We want to handle that, because systemd-resolved might not
+         * have started yet. */
         full_path = g_file_read_link(_PATH_RESCONF, NULL);
         if (nm_utils_strv_find_first((char **) RESOLVED_PATHS,
                                      G_N_ELEMENTS(RESOLVED_PATHS),
@@ -1968,13 +1968,13 @@ _resolvconf_resolved_managed(void)
             return TRUE;
 
         /* see if resolv.conf is a symlink that resolves exactly one
-		 * of the candidate paths.
-		 *
-		 * This check will work for symlinks that can be resolved
-		 * to a realpath, but the actual file might not exist.
-		 *
-		 * We want to handle that, because systemd-resolved might not
-		 * have started yet. */
+         * of the candidate paths.
+         *
+         * This check will work for symlinks that can be resolved
+         * to a realpath, but the actual file might not exist.
+         *
+         * We want to handle that, because systemd-resolved might not
+         * have started yet. */
         real_path = realpath(_PATH_RESCONF, NULL);
         if (nm_utils_strv_find_first((char **) RESOLVED_PATHS,
                                      G_N_ELEMENTS(RESOLVED_PATHS),
@@ -1983,16 +1983,16 @@ _resolvconf_resolved_managed(void)
             return TRUE;
 
         /* fall-through and resolve the symlink, to check the file
-		 * it points to (below).
-		 *
-		 * This check is the most reliable, but it only works if
-		 * systemd-resolved already started and created the file. */
+         * it points to (below).
+         *
+         * This check is the most reliable, but it only works if
+         * systemd-resolved already started and created the file. */
         if (stat(_PATH_RESCONF, &st) != 0)
             return FALSE;
     }
 
     /* see if resolv.conf resolves to one of the candidate
-	 * paths (or whether it is hard-linked). */
+     * paths (or whether it is hard-linked). */
     for (i = 0; i < G_N_ELEMENTS(RESOLVED_PATHS); i++) {
         const char *p = RESOLVED_PATHS[i];
 
@@ -2093,25 +2093,25 @@ again:
             rc_manager = NM_DNS_MANAGER_RESOLV_CONF_MAN_UNMANAGED;
         else if (HAS_RESOLVCONF && g_file_test(RESOLVCONF_PATH, G_FILE_TEST_IS_EXECUTABLE)) {
             /* We detect /sbin/resolvconf only at this stage. That means, if you install
-			 * or uninstall openresolv afterwards, you need to reload the DNS settings
-			 * (with SIGHUP or `systemctl reload NetworkManager.service`).
-			 *
-			 * We only accept resolvconf if NetworkManager was built with --with-resolvconf.
-			 * For example, on Fedora the systemd package provides a compat resolvconf
-			 * implementation for systemd-resolved. But using that never makes sense, because
-			 * there we either use full systemd-resolved mode or not. In no case does it
-			 * make sense to call that resolvconf implementation. */
+             * or uninstall openresolv afterwards, you need to reload the DNS settings
+             * (with SIGHUP or `systemctl reload NetworkManager.service`).
+             *
+             * We only accept resolvconf if NetworkManager was built with --with-resolvconf.
+             * For example, on Fedora the systemd package provides a compat resolvconf
+             * implementation for systemd-resolved. But using that never makes sense, because
+             * there we either use full systemd-resolved mode or not. In no case does it
+             * make sense to call that resolvconf implementation. */
             rc_manager = NM_DNS_MANAGER_RESOLV_CONF_MAN_RESOLVCONF;
         } else if (HAS_NETCONFIG && g_file_test(NETCONFIG_PATH, G_FILE_TEST_IS_EXECUTABLE)) {
             /* Like for resolvconf, we detect only once. We only autoenable this
-			 * option, if NetworkManager was built with netconfig explicitly enabled. */
+             * option, if NetworkManager was built with netconfig explicitly enabled. */
             rc_manager = NM_DNS_MANAGER_RESOLV_CONF_MAN_NETCONFIG;
         } else
             rc_manager = NM_DNS_MANAGER_RESOLV_CONF_MAN_SYMLINK;
     }
 
     /* The systemd-resolved plugin is special. We typically always want to keep
-	 * systemd-resolved up to date even if the configured plugin is different. */
+     * systemd-resolved up to date even if the configured plugin is different. */
     if (systemd_resolved) {
         if (!priv->sd_resolve_plugin) {
             priv->sd_resolve_plugin  = nm_dns_systemd_resolved_new();
@@ -2162,9 +2162,9 @@ config_changed_cb(NMConfig *          config,
                      NM_CONFIG_CHANGE_DNS_MODE | NM_CONFIG_CHANGE_RC_MANAGER
                          | NM_CONFIG_CHANGE_CAUSE_SIGHUP | NM_CONFIG_CHANGE_CAUSE_DNS_FULL)) {
         /* reload the resolv-conf mode also on SIGHUP (when DNS_MODE didn't change).
-		 * The reason is, that the configuration also depends on whether resolv.conf
-		 * is immutable, thus, without the configuration changing, we always want to
-		 * re-configure the mode. */
+         * The reason is, that the configuration also depends on whether resolv.conf
+         * is immutable, thus, without the configuration changing, we always want to
+         * re-configure the mode. */
         init_resolv_conf_mode(
             self,
             NM_FLAGS_ANY(changes, NM_CONFIG_CHANGE_CAUSE_SIGHUP | NM_CONFIG_CHANGE_CAUSE_DNS_FULL));
diff --git a/src/dns/nm-dns-plugin.h b/src/dns/nm-dns-plugin.h
index 1ddd8a31e1..4abb4eea27 100644
--- a/src/dns/nm-dns-plugin.h
+++ b/src/dns/nm-dns-plugin.h
@@ -26,10 +26,10 @@ typedef struct {
     GObjectClass parent;
 
     /* Called when DNS information is changed.  'configs' is an array
-	 * of pointers to NMDnsIPConfigData sorted by priority.
-	 * 'global_config' is the optional global DNS
-	 * configuration.
-	 */
+     * of pointers to NMDnsIPConfigData sorted by priority.
+     * 'global_config' is the optional global DNS
+     * configuration.
+     */
     gboolean (*update)(NMDnsPlugin *            self,
                        const NMGlobalDnsConfig *global_config,
                        const CList *            ip_config_lst_head,
@@ -41,9 +41,9 @@ typedef struct {
     const char *plugin_name;
 
     /* Types should set to TRUE if they start a local caching nameserver
-	 * that listens on localhost and would block any other local caching
-	 * nameserver from operating.
-	 */
+     * that listens on localhost and would block any other local caching
+     * nameserver from operating.
+     */
     bool is_caching : 1;
 
 } NMDnsPluginClass;
diff --git a/src/dns/nm-dns-systemd-resolved.c b/src/dns/nm-dns-systemd-resolved.c
index 9c42c37195..64118d2792 100644
--- a/src/dns/nm-dns-systemd-resolved.c
+++ b/src/dns/nm-dns-systemd-resolved.c
@@ -279,7 +279,7 @@ send_updates(NMDnsSystemdResolved *self)
     if (!priv->dbus_has_owner) {
         if (priv->try_start_blocked) {
             /* we have no name owner and we already tried poking the service to
-			 * autostart. */
+             * autostart. */
             _LOGT("send-updates: no name owner");
             return;
         }
@@ -306,13 +306,13 @@ send_updates(NMDnsSystemdResolved *self)
         (request_item =
              c_list_first_entry(&priv->request_queue_lst_head, RequestItem, request_queue_lst))) {
         /* Above we explicitly call "StartServiceByName" trying to avoid D-Bus activating systmd-resolved
-		 * multiple times. There is still a race, were we might hit this line although actually
-		 * the service just quit this very moment. In that case, we would try to D-Bus activate the
-		 * service multiple times during each call (something we wanted to avoid).
-		 *
-		 * But this is hard to avoid, because we'd have to check the error failure to detect the reason
-		 * and retry. The race is not critical, because at worst it results in logging a warning
-		 * about failure to start systemd.resolved. */
+         * multiple times. There is still a race, were we might hit this line although actually
+         * the service just quit this very moment. In that case, we would try to D-Bus activate the
+         * service multiple times during each call (something we wanted to avoid).
+         *
+         * But this is hard to avoid, because we'd have to check the error failure to detect the reason
+         * and retry. The race is not critical, because at worst it results in logging a warning
+         * about failure to start systemd.resolved. */
         g_dbus_connection_call(priv->dbus_connection,
                                SYSTEMD_RESOLVED_DBUS_SERVICE,
                                SYSTEMD_RESOLVED_DBUS_PATH,
@@ -420,7 +420,7 @@ name_owner_changed_cb(GDBusConnection *connection,
 
     if (!priv->dbus_initied) {
         /* There was a race and we got a NameOwnerChanged signal before GetNameOwner
-		 * returns. */
+         * returns. */
         priv->dbus_initied = TRUE;
         nm_clear_g_cancellable(&priv->cancellable);
     }
diff --git a/src/dns/nm-dns-unbound.c b/src/dns/nm-dns-unbound.c
index b90cae4c2c..30637f8d71 100644
--- a/src/dns/nm-dns-unbound.c
+++ b/src/dns/nm-dns-unbound.c
@@ -36,14 +36,14 @@ update(NMDnsPlugin *            plugin,
     int                   status;
 
     /* TODO: We currently call a script installed with the dnssec-trigger
-	 * package that queries all information itself. Later, the dependency
-	 * on that package will be optional and the only hard dependency will
-	 * be unbound.
-	 *
-	 * Unbound configuration should be later handled by this plugin directly,
-	 * without calling custom scripts. The dnssec-trigger functionality
-	 * may be eventually merged into NetworkManager.
-	 */
+     * package that queries all information itself. Later, the dependency
+     * on that package will be optional and the only hard dependency will
+     * be unbound.
+     *
+     * Unbound configuration should be later handled by this plugin directly,
+     * without calling custom scripts. The dnssec-trigger functionality
+     * may be eventually merged into NetworkManager.
+     */
     if (!g_spawn_sync("/", argv, NULL, 0, NULL, NULL, NULL, NULL, &status, &local)) {
         nm_utils_error_set(error,
                            NM_UTILS_ERROR_UNKNOWN,
diff --git a/src/dnsmasq/nm-dnsmasq-manager.c b/src/dnsmasq/nm-dnsmasq-manager.c
index 7edc784239..a234213a12 100644
--- a/src/dnsmasq/nm-dnsmasq-manager.c
+++ b/src/dnsmasq/nm-dnsmasq-manager.c
@@ -120,11 +120,11 @@ create_dm_cmd_line(const char *       iface,
     }
 
     /* dnsmasq may read from its default config file location, which if that
-	 * location is a valid config file, it will combine with the options here
-	 * and cause undesirable side-effects.  Like sending bogus IP addresses
-	 * as the gateway or whatever.  So tell dnsmasq not to use any config file
-	 * at all.
-	 */
+     * location is a valid config file, it will combine with the options here
+     * and cause undesirable side-effects.  Like sending bogus IP addresses
+     * as the gateway or whatever.  So tell dnsmasq not to use any config file
+     * at all.
+     */
     nm_strv_ptrarray_add_string_dup(cmd, "--conf-file=/dev/null");
 
     nm_strv_ptrarray_add_string_dup(cmd, "--no-hosts");
@@ -134,9 +134,9 @@ create_dm_cmd_line(const char *       iface,
     nm_strv_ptrarray_add_string_dup(cmd, "--clear-on-reload");
 
     /* Use strict order since in the case of VPN connections, the VPN's
-	 * nameservers will be first in resolv.conf, and those need to be tried
-	 * first by dnsmasq to successfully resolve names from the VPN.
-	 */
+     * nameservers will be first in resolv.conf, and those need to be tried
+     * first by dnsmasq to successfully resolve names from the VPN.
+     */
     nm_strv_ptrarray_add_string_dup(cmd, "--strict-order");
 
     _nm_utils_inet4_ntop(listen_address->address, listen_address_s);
@@ -179,7 +179,7 @@ create_dm_cmd_line(const char *       iface,
 
     if (announce_android_metered) {
         /* force option 43 to announce ANDROID_METERED. Do this, even if the client
-		 * did not ask for this option. See https://www.lorier.net/docs/android-metered.html */
+         * did not ask for this option. See https://www.lorier.net/docs/android-metered.html */
         nm_strv_ptrarray_add_string_dup(cmd, "--dhcp-option-force=43,ANDROID_METERED");
     }
 
diff --git a/src/dnsmasq/nm-dnsmasq-utils.c b/src/dnsmasq/nm-dnsmasq-utils.c
index ffd6469ae5..db97ed31b0 100644
--- a/src/dnsmasq/nm-dnsmasq-utils.c
+++ b/src/dnsmasq/nm-dnsmasq-utils.c
@@ -34,18 +34,18 @@ nm_dnsmasq_utils_get_range(const NMPlatformIP4Address *addr,
 
     if (prefix < 24) {
         /* if the subnet is larger then /24, we partition it and treat it
-		 * like it would be a /24.
-		 *
-		 * Hence, the resulting range will always be between x.x.x.1/24
-		 * and x.x.x.254/24, with x.x.x.0 being the network address of the
-		 * host.
-		 *
-		 * In this case, only a /24 portion of the subnet is used.
-		 * No particular reason for that, but it's unlikely that a user
-		 * would use NetworkManager's shared method when having hundred
-		 * of DHCP clients. So, restrict the range to the same /24 in
-		 * which the host address lies.
-		 */
+         * like it would be a /24.
+         *
+         * Hence, the resulting range will always be between x.x.x.1/24
+         * and x.x.x.254/24, with x.x.x.0 being the network address of the
+         * host.
+         *
+         * In this case, only a /24 portion of the subnet is used.
+         * No particular reason for that, but it's unlikely that a user
+         * would use NetworkManager's shared method when having hundred
+         * of DHCP clients. So, restrict the range to the same /24 in
+         * which the host address lies.
+         */
         prefix = 24;
     }
 
@@ -56,8 +56,8 @@ nm_dnsmasq_utils_get_range(const NMPlatformIP4Address *addr,
     host    = ntohl(host);
 
     /* if host is the network or broadcast address, coerce it to
-	 * one above or below. Usually, we wouldn't expect the user
-	 * to pick such an address. */
+     * one above or below. Usually, we wouldn't expect the user
+     * to pick such an address. */
     if (host == (host & netmask))
         host++;
     else if (host == (host | ~netmask))
@@ -68,17 +68,17 @@ nm_dnsmasq_utils_get_range(const NMPlatformIP4Address *addr,
     last  = (host | ~netmask) - 1;
 
     /* Depending on whether host is above or below the middle of
-	 * the subnet, the larger part if handed out.
-	 *
-	 * If the host is in the lower half, the range starts
-	 * at the lower end with the host (plus reserved), until the
-	 * broadcast address
-	 *
-	 * If the host is in the upper half, the range starts above
-	 * the network-address and goes up until the host (except reserved).
-	 *
-	 * reserved is up to 8 addresses, 10% of the determined range.
-	 */
+     * the subnet, the larger part if handed out.
+     *
+     * If the host is in the lower half, the range starts
+     * at the lower end with the host (plus reserved), until the
+     * broadcast address
+     *
+     * If the host is in the upper half, the range starts above
+     * the network-address and goes up until the host (except reserved).
+     *
+     * reserved is up to 8 addresses, 10% of the determined range.
+     */
     mid = (host & netmask) | (((first + last) / 2) & ~netmask);
     if (host > mid) {
         /* use lower range */
diff --git a/src/initrd/nmi-cmdline-reader.c b/src/initrd/nmi-cmdline-reader.c
index 28eab122e5..a37018a996 100644
--- a/src/initrd/nmi-cmdline-reader.c
+++ b/src/initrd/nmi-cmdline-reader.c
@@ -192,11 +192,11 @@ reader_get_connection(Reader *    reader,
         guint                i;
 
         /*
-		 * If ifname was not given, we'll match the connection by type.
-		 * If the type was not given either, then we're happy with any connection but slaves.
-		 * This is so that things like "bond=bond0:eth1,eth2 nameserver=1.3.3.7 end up
-		 * slapping the nameserver to the most reasonable connection (bond0).
-		 */
+         * If ifname was not given, we'll match the connection by type.
+         * If the type was not given either, then we're happy with any connection but slaves.
+         * This is so that things like "bond=bond0:eth1,eth2 nameserver=1.3.3.7 end up
+         * slapping the nameserver to the most reasonable connection (bond0).
+         */
         for (i = 0; i < reader->array->len; i++) {
             candidate = g_hash_table_lookup(reader->hash, reader->array->pdata[i]);
             s_con     = nm_connection_get_setting_connection(candidate);
@@ -1079,9 +1079,9 @@ nmi_cmdline_reader_parse(const char *sysfs_dir, const char *const *argv, char **
         if (!nm_utils_hwaddr_valid(bootif, ETH_ALEN) && g_str_has_prefix(bootif, "01-")
             && nm_utils_hwaddr_valid(&bootif[3], ETH_ALEN)) {
             /*
-			 * BOOTIF MAC address can be prefixed with a hardware type identifier.
-			 * "01" stays for "wired", no other are known.
-			 */
+             * BOOTIF MAC address can be prefixed with a hardware type identifier.
+             * "01" stays for "wired", no other are known.
+             */
             bootif += 3;
         }
 
diff --git a/src/initrd/nmi-dt-reader.c b/src/initrd/nmi-dt-reader.c
index 212b114bb3..c7a8e0868b 100644
--- a/src/initrd/nmi-dt-reader.c
+++ b/src/initrd/nmi-dt-reader.c
@@ -153,10 +153,10 @@ nmi_dt_reader_parse(const char *sysfs_dir)
     tokens = g_strsplit(path, ",", 0);
 
     /*
-	 * Ethernet device settings. Defined by "Open Firmware,
-	 * Recommended Practice: Device Support Extensions, Version 1.0 [1]
-	 * [1] https://www.devicetree.org/open-firmware/practice/devicex/dse1_0a.ps
-	 */
+     * Ethernet device settings. Defined by "Open Firmware,
+     * Recommended Practice: Device Support Extensions, Version 1.0 [1]
+     * [1] https://www.devicetree.org/open-firmware/practice/devicex/dse1_0a.ps
+     */
 
     for (i = 0; tokens[i]; i++) {
         /* Skip these. They have magical meaning for OpenFirmware. */
@@ -184,10 +184,10 @@ nmi_dt_reader_parse(const char *sysfs_dir)
     }
 
     /*
-	 * Network boot configuration. Defined by "Open Firmware,
-	 * Recommended Practice: TFTP Booting Extension, Version 1.0 [1]
-	 * [1] https://www.devicetree.org/open-firmware/practice/obp-tftp/tftp1_0.pdf
-	 */
+     * Network boot configuration. Defined by "Open Firmware,
+     * Recommended Practice: TFTP Booting Extension, Version 1.0 [1]
+     * [1] https://www.devicetree.org/open-firmware/practice/obp-tftp/tftp1_0.pdf
+     */
 
     for (; tokens[i]; i++) {
         if (NM_IN_STRSET(tokens[i], "bootp", "dhcp", "rarp")) {
@@ -219,7 +219,7 @@ nmi_dt_reader_parse(const char *sysfs_dir)
 
     if (tokens[i] && (strchr(tokens[i], '.') || strchr(tokens[i], ':'))) {
         /* yaboot claims the mask can be specified here,
-		 * though it doesn't support it. */
+         * though it doesn't support it. */
         s_netmask = tokens[i];
         i++;
     }
diff --git a/src/initrd/nmi-ibft-reader.c b/src/initrd/nmi-ibft-reader.c
index 9c3b10d434..3d309d7d9f 100644
--- a/src/initrd/nmi-ibft-reader.c
+++ b/src/initrd/nmi-ibft-reader.c
@@ -344,8 +344,8 @@ is_ibft_vlan_device(GHashTable *nic)
 
     if (s_vlan_id) {
         /* VLAN 0 is normally a valid VLAN ID, but in the iBFT case it
-		 * means "no VLAN".
-		 */
+         * means "no VLAN".
+         */
         if (_nm_utils_ascii_str_to_int64(s_vlan_id, 10, 1, 4095, -1) != -1)
             return TRUE;
     }
@@ -364,8 +364,8 @@ vlan_setting_add_from_block(GHashTable *nic, NMConnection *connection, GError **
     g_assert(connection);
 
     /* This won't fail since this function shouldn't be called unless the
-	 * iBFT VLAN ID exists and is > 0.
-	 */
+     * iBFT VLAN ID exists and is > 0.
+     */
     vlan_id_str = (const char *) g_hash_table_lookup(nic, "vlan");
     g_assert(vlan_id_str);
 
diff --git a/src/initrd/tests/test-ibft-reader.c b/src/initrd/tests/test-ibft-reader.c
index 2511aebac3..6745d8df30 100644
--- a/src/initrd/tests/test-ibft-reader.c
+++ b/src/initrd/tests/test-ibft-reader.c
@@ -235,9 +235,9 @@ test_read_ibft(void)
     GError *           error = NULL;
 
     /* This test doesn't actually test too much (apart from the presence of
-	 * IPv6 that is not covered by other tests), but the test fixture is a good
-	 * example of about everything that can be included in iBFT table (as of
-	 * ACPI 3.0b). */
+     * IPv6 that is not covered by other tests), but the test fixture is a good
+     * example of about everything that can be included in iBFT table (as of
+     * ACPI 3.0b). */
 
     connection = read_connection(TEST_INITRD_DIR "/sysfs", "00:53:00:AB:00:01", &error);
     g_assert(connection);
diff --git a/src/main-utils.c b/src/main-utils.c
index c6f95a11f2..c425195756 100644
--- a/src/main-utils.c
+++ b/src/main-utils.c
@@ -142,8 +142,8 @@ nm_main_utils_ensure_rundir()
     }
 
     /* NM_CONFIG_DEVICE_STATE_DIR is used to determine whether NM is restarted or not.
-	 * It is important to set NMConfigCmdLineOptions.first_start before creating
-	 * the directory. */
+     * It is important to set NMConfigCmdLineOptions.first_start before creating
+     * the directory. */
     nm_assert(g_str_has_prefix(NM_CONFIG_DEVICE_STATE_DIR, NMRUNDIR "/"));
     if (g_mkdir(NM_CONFIG_DEVICE_STATE_DIR, 0755) != 0) {
         errsv = errno;
@@ -236,16 +236,16 @@ nm_main_utils_early_setup(const char *  progname,
     const char **   opt_loc_log_level = NULL, **opt_loc_log_domains = NULL;
 
     /* Make GIO ignore the remote VFS service; otherwise it tries to use the
-	 * session bus to contact the remote service, and NM shouldn't ever be
-	 * talking on the session bus.  See rh #588745
-	 */
+     * session bus to contact the remote service, and NM shouldn't ever be
+     * talking on the session bus.  See rh #588745
+     */
     setenv("GIO_USE_VFS", "local", 1);
 
     /*
-	 * Set the umask to 0022, which results in 0666 & ~0022 = 0644.
-	 * Otherwise, if root (or an su'ing user) has a wacky umask, we could
-	 * write out an unreadable resolv.conf.
-	 */
+     * Set the umask to 0022, which results in 0666 & ~0022 = 0644.
+     * Otherwise, if root (or an su'ing user) has a wacky umask, we could
+     * write out an unreadable resolv.conf.
+     */
     umask(022);
 
     /* Ensure gettext() gets the right environment (bgo #666516) */
diff --git a/src/main.c b/src/main.c
index 0983c283ba..854cfc0ee2 100644
--- a/src/main.c
+++ b/src/main.c
@@ -96,7 +96,7 @@ _init_nm_debug(NMConfig *config)
 #if !defined(__SANITIZE_ADDRESS__)
     if (NM_FLAGS_HAS(flags, D_RLIMIT_CORE)) {
         /* only enable this, if explicitly requested, because it might
-		 * expose sensitive data. */
+         * expose sensitive data. */
 
         struct rlimit limit = {
             .rlim_cur = RLIM_INFINITY,
@@ -132,11 +132,11 @@ nm_main_config_reload(int signal)
     nm_log_info(LOGD_CORE, "reload configuration (signal %s)...", strsignal(signal));
 
     /* The signal handler thread is only installed after
-	 * creating NMConfig instance, and on shut down we
-	 * no longer run the mainloop (to reach this point).
-	 *
-	 * Hence, a NMConfig singleton instance must always be
-	 * available. */
+     * creating NMConfig instance, and on shut down we
+     * no longer run the mainloop (to reach this point).
+     *
+     * Hence, a NMConfig singleton instance must always be
+     * available. */
     nm_config_reload(nm_config_get(), reload_flags, TRUE);
 }
 
@@ -270,17 +270,17 @@ _dbus_manager_init(NMConfig *config)
 
     if (c_a_q_type == NM_CONFIG_CONFIGURE_AND_QUIT_ENABLED) {
         /* D-Bus is useless in configure and quit mode -- we're eventually dropping
-		 * off and potential clients would have no way of knowing whether we're
-		 * finished already or didn't start yet.
-		 *
-		 * But we still create a nm_dbus_manager_get_dbus_connection() D-Bus connection
-		 * so that we can talk to other services like firewalld. */
+         * off and potential clients would have no way of knowing whether we're
+         * finished already or didn't start yet.
+         *
+         * But we still create a nm_dbus_manager_get_dbus_connection() D-Bus connection
+         * so that we can talk to other services like firewalld. */
         return nm_dbus_manager_acquire_bus(busmgr, FALSE);
     }
 
     nm_assert(c_a_q_type == NM_CONFIG_CONFIGURE_AND_QUIT_INITRD);
     /* in initrd we don't have D-Bus at all. Don't even try to get the G_BUS_TYPE_SYSTEM
-	 * connection. And of course don't claim the D-Bus name. */
+     * connection. And of course don't claim the D-Bus name. */
     return TRUE;
 }
 
@@ -304,7 +304,7 @@ main(int argc, char *argv[])
     int                     errsv;
 
     /* Known to cause a possible deadlock upon GDBus initialization:
-	 * https://bugzilla.gnome.org/show_bug.cgi?id=674885 */
+     * https://bugzilla.gnome.org/show_bug.cgi?id=674885 */
     g_type_ensure(G_TYPE_SOCKET);
     g_type_ensure(G_TYPE_DBUS_CONNECTION);
     g_type_ensure(NM_TYPE_DBUS_MANAGER);
@@ -314,7 +314,7 @@ main(int argc, char *argv[])
     main_loop = g_main_loop_new(NULL, FALSE);
 
     /* we determine a first-start (contrary to a restart during the same boot)
-	 * based on the existence of NM_CONFIG_DEVICE_STATE_DIR directory. */
+     * based on the existence of NM_CONFIG_DEVICE_STATE_DIR directory. */
     config_cli = nm_config_cmd_line_options_new(
         !g_file_test(NM_CONFIG_DEVICE_STATE_DIR, G_FILE_TEST_IS_DIR));
 
@@ -344,13 +344,13 @@ main(int argc, char *argv[])
     nm_main_utils_ensure_rundir();
 
     /* When running from the build directory, determine our build directory
-	 * base and set helper paths in the build tree */
+     * base and set helper paths in the build tree */
     if (global_opt.run_from_build_dir) {
         char *path, *slash;
         int   g;
 
         /* exe is <basedir>/src/.libs/lt-NetworkManager, so chop off
-		 * the last three components */
+         * the last three components */
         path = realpath("/proc/self/exe", NULL);
         g_assert(path != NULL);
         for (g = 0; g < 3; ++g) {
@@ -360,7 +360,7 @@ main(int argc, char *argv[])
         }
 
         /* don't free these strings, we need them for the entire
-		 * process lifetime */
+         * process lifetime */
         nm_dhcp_helper_path = g_strdup_printf("%s/src/dhcp/nm-dhcp-helper", path);
 
         g_free(path);
@@ -388,15 +388,15 @@ main(int argc, char *argv[])
     _init_nm_debug(config);
 
     /* Initialize logging from config file *only* if not explicitly
-	 * specified by commandline.
-	 */
+     * specified by commandline.
+     */
     if (global_opt.opt_log_level == NULL && global_opt.opt_log_domains == NULL) {
         if (!nm_logging_setup(nm_config_get_log_level(config),
                               nm_config_get_log_domains(config),
                               &bad_domains,
                               &error_invalid_logging_config)) {
             /* ignore error, and print the failure reason below.
-			 * Likewise, print about bad_domains below. */
+             * Likewise, print about bad_domains below. */
         }
     }
 
@@ -497,15 +497,15 @@ main(int argc, char *argv[])
     nm_platform_process_events(NM_PLATFORM_GET);
 
     /* Make sure the loopback interface is up. If interface is down, we bring
-	 * it up and kernel will assign it link-local IPv4 and IPv6 addresses. If
-	 * it was already up, we assume is in clean state.
-	 *
-	 * TODO: it might be desirable to check the list of addresses and compare
-	 * it with a list of expected addresses (one of the protocol families
-	 * could be disabled). The 'lo' interface is sometimes used for assigning
-	 * global addresses so their availability doesn't depend on the state of
-	 * physical interfaces.
-	 */
+     * it up and kernel will assign it link-local IPv4 and IPv6 addresses. If
+     * it was already up, we assume is in clean state.
+     *
+     * TODO: it might be desirable to check the list of addresses and compare
+     * it with a list of expected addresses (one of the protocol families
+     * could be disabled). The 'lo' interface is sometimes used for assigning
+     * global addresses so their availability doesn't depend on the state of
+     * physical interfaces.
+     */
     nm_log_dbg(LOGD_CORE, "setting up local loopback");
     nm_platform_link_set_up(NM_PLATFORM_GET, 1, NULL);
 
@@ -520,9 +520,9 @@ main(int argc, char *argv[])
 done:
 
     /* write the device-state to file. Note that we only persist the
-	 * state here. We don't bother updating the state as devices
-	 * change during regular operation. If NM is killed with SIGKILL,
-	 * it misses to update the state. */
+     * state here. We don't bother updating the state as devices
+     * change during regular operation. If NM is killed with SIGKILL,
+     * it misses to update the state. */
     nm_manager_write_device_state_all(manager);
 
     nm_manager_stop(manager);
diff --git a/src/ndisc/nm-lndp-ndisc.c b/src/ndisc/nm-lndp-ndisc.c
index a9bd72f3c0..19e4dd7a8a 100644
--- a/src/ndisc/nm-lndp-ndisc.c
+++ b/src/ndisc/nm-lndp-ndisc.c
@@ -109,16 +109,16 @@ receive_ra(struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
     guint32              val;
 
     /* Router discovery is subject to the following RFC documents:
-	 *
-	 * http://tools.ietf.org/html/rfc4861
-	 * http://tools.ietf.org/html/rfc4862
-	 *
-	 * The biggest difference from good old DHCP is that all configuration
-	 * items have their own lifetimes and they are merged from various
-	 * sources. Router discovery is *not* contract-based, so there is *no*
-	 * single time when the configuration is finished and updates can
-	 * come at any time.
-	 */
+     *
+     * http://tools.ietf.org/html/rfc4861
+     * http://tools.ietf.org/html/rfc4862
+     *
+     * The biggest difference from good old DHCP is that all configuration
+     * items have their own lifetimes and they are merged from various
+     * sources. Router discovery is *not* contract-based, so there is *no*
+     * single time when the configuration is finished and updates can
+     * come at any time.
+     */
     _LOGD("received router advertisement at %d", (int) now);
 
     gateway_addr = *ndp_msg_addrto(msg);
@@ -126,11 +126,11 @@ receive_ra(struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
         g_return_val_if_reached(0);
 
     /* DHCP level:
-	 *
-	 * The problem with DHCP level is what to do if subsequent
-	 * router advertisements carry different flags. Currently, we just
-	 * rewrite the flag with every inbound RA.
-	 */
+     *
+     * The problem with DHCP level is what to do if subsequent
+     * router advertisements carry different flags. Currently, we just
+     * rewrite the flag with every inbound RA.
+     */
     {
         NMNDiscDHCPLevel dhcp_level;
 
@@ -142,7 +142,7 @@ receive_ra(struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
             dhcp_level = NM_NDISC_DHCP_LEVEL_NONE;
 
         /* when receiving multiple RA (possibly from different routers),
-		 * let's keep the "most managed" level. */
+         * let's keep the "most managed" level. */
         G_STATIC_ASSERT_EXPR(NM_NDISC_DHCP_LEVEL_MANAGED > NM_NDISC_DHCP_LEVEL_OTHERCONF);
         G_STATIC_ASSERT_EXPR(NM_NDISC_DHCP_LEVEL_OTHERCONF > NM_NDISC_DHCP_LEVEL_NONE);
         dhcp_level = MAX(dhcp_level, rdata->public.dhcp_level);
@@ -154,11 +154,11 @@ receive_ra(struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
     }
 
     /* Default gateway:
-	 *
-	 * Subsequent router advertisements can represent new default gateways
-	 * on the network. We should present all of them in router preference
-	 * order.
-	 */
+     *
+     * Subsequent router advertisements can represent new default gateways
+     * on the network. We should present all of them in router preference
+     * order.
+     */
     {
         const NMNDiscGateway gateway = {
             .address    = gateway_addr,
@@ -248,10 +248,10 @@ receive_ra(struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
             };
 
             /* Pad the lifetime somewhat to give a bit of slack in cases
-			 * where one RA gets lost or something (which can happen on unreliable
-			 * links like Wi-Fi where certain types of frames are not retransmitted).
-			 * Note that 0 has special meaning and is therefore not adjusted.
-			 */
+             * where one RA gets lost or something (which can happen on unreliable
+             * links like Wi-Fi where certain types of frames are not retransmitted).
+             * Note that 0 has special meaning and is therefore not adjusted.
+             */
             if (dns_server.lifetime && dns_server.lifetime < 7200)
                 dns_server.lifetime = 7200;
             if (nm_ndisc_add_dns_server(ndisc, &dns_server))
@@ -270,10 +270,10 @@ receive_ra(struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
             };
 
             /* Pad the lifetime somewhat to give a bit of slack in cases
-			 * where one RA gets lost or something (which can happen on unreliable
-			 * links like Wi-Fi where certain types of frames are not retransmitted).
-			 * Note that 0 has special meaning and is therefore not adjusted.
-			 */
+             * where one RA gets lost or something (which can happen on unreliable
+             * links like Wi-Fi where certain types of frames are not retransmitted).
+             * Note that 0 has special meaning and is therefore not adjusted.
+             */
             if (dns_domain.lifetime && dns_domain.lifetime < 7200)
                 dns_domain.lifetime = 7200;
             if (nm_ndisc_add_dns_domain(ndisc, &dns_domain))
@@ -309,9 +309,9 @@ receive_ra(struct ndp *ndp, struct ndp_msg *msg, gpointer user_data)
             }
         } else {
             /* All sorts of bad things would happen if we accepted this.
-			 * Kernel would set it, but would flush out all IPv6 addresses away
-			 * from the link, even the link-local, and we wouldn't be able to
-			 * listen for further RAs that could fix the MTU. */
+             * Kernel would set it, but would flush out all IPv6 addresses away
+             * from the link, even the link-local, and we wouldn't be able to
+             * listen for further RAs that could fix the MTU. */
             _LOGW("MTU too small for IPv6 ignored: %d", mtu);
         }
     }
@@ -382,7 +382,7 @@ send_ra(NMNDisc *ndisc, GError **error)
     ndp_msgra_router_lifetime_set(ndp_msgra(msg), NM_NDISC_ROUTER_LIFETIME);
 
     /* The device let us know about all addresses that the device got
-	 * whose prefixes are suitable for delegating. Let's announce them. */
+     * whose prefixes are suitable for delegating. Let's announce them. */
     for (i = 0; i < rdata->addresses->len; i++) {
         NMNDiscAddress *address = &g_array_index(rdata->addresses, NMNDiscAddress, i);
         guint32 age      = NM_CLAMP((gint64) now - (gint64) address->timestamp, 0, G_MAXUINT32 - 1);
diff --git a/src/ndisc/nm-ndisc.c b/src/ndisc/nm-ndisc.c
index 2d7030a06f..bcfc26557c 100644
--- a/src/ndisc/nm-ndisc.c
+++ b/src/ndisc/nm-ndisc.c
@@ -110,9 +110,9 @@ nm_ndisc_data_to_l3cd(NMDedupMultiIndex *       multi_idx,
     nm_l3_config_data_set_ip6_privacy(l3cd, ip6_privacy);
 
     /* Check, whether kernel is recent enough to help user space handling RA.
-	 * If it's not supported, we have no ipv6-privacy and must add autoconf
-	 * addresses as /128. The reason for the /128 is to prevent the kernel
-	 * from adding a prefix route for this address. */
+     * If it's not supported, we have no ipv6-privacy and must add autoconf
+     * addresses as /128. The reason for the /128 is to prevent the kernel
+     * from adding a prefix route for this address. */
     ifa_flags = 0;
     if (kernel_support_extended_ifa_flags) {
         ifa_flags |= IFA_F_NOPREFIXROUTE;
@@ -178,8 +178,8 @@ nm_ndisc_data_to_l3cd(NMDedupMultiIndex *       multi_idx,
 
             if (first_pref != rdata->gateways[i].preference && !kernel_support_rta_pref) {
                 /* We are unable to configure a router preference. Hence, we skip all gateways
-				 * with a different preference from the first gateway. Note, that the gateways
-				 * are sorted in order of highest to lowest preference. */
+                 * with a different preference from the first gateway. Note, that the gateways
+                 * are sorted in order of highest to lowest preference. */
                 break;
             }
         }
@@ -538,7 +538,7 @@ nm_ndisc_add_address(NMNDisc *ndisc, const NMNDiscAddress *new, gint32 now_s, gb
 
         if (from_ra) {
             /* RFC4862 5.5.3.d, we find an existing address with the same prefix.
-			 * (note that all prefixes at this point have implicitly length /64). */
+             * (note that all prefixes at this point have implicitly length /64). */
             if (memcmp(&item->address, &new->address, 8) == 0) {
                 existing = item;
                 break;
@@ -617,9 +617,9 @@ nm_ndisc_add_address(NMNDisc *ndisc, const NMNDiscAddress *new, gint32 now_s, gb
     }
 
     /* we create at most max_addresses autoconf addresses. This is different from
-	 * what the kernel does, because it considers *all* addresses (including
-	 * static and other temporary addresses).
-	 **/
+     * what the kernel does, because it considers *all* addresses (including
+     * static and other temporary addresses).
+     **/
     if (priv->max_addresses && rdata->addresses->len >= priv->max_addresses)
         return FALSE;
 
@@ -654,12 +654,12 @@ nm_ndisc_add_route(NMNDisc *ndisc, const NMNDiscRoute *new)
 
     if (new->plen == 0 || new->plen > 128) {
         /* Only expect non-default routes.  The router has no idea what the
-		 * local configuration or user preferences are, so sending routes
-		 * with a prefix length of 0 must be ignored by NMNDisc.
-		 *
-		 * Also, upper layers also don't expect that NMNDisc exposes routes
-		 * with a plen or zero or larger then 128.
-		 */
+         * local configuration or user preferences are, so sending routes
+         * with a prefix length of 0 must be ignored by NMNDisc.
+         *
+         * Also, upper layers also don't expect that NMNDisc exposes routes
+         * with a plen or zero or larger then 128.
+         */
         g_return_val_if_reached(FALSE);
     }
 
@@ -902,7 +902,7 @@ announce_router_initial(NMNDisc *ndisc)
         nm_clear_g_source(&priv->send_ra_id);
 
     /* Schedule the initial send rather early. Clamp the delay by minimal
-	 * delay and not the initial advert internal so that we start fast. */
+     * delay and not the initial advert internal so that we start fast. */
     if (G_LIKELY(!priv->send_ra_id)) {
         priv->send_ra_id =
             g_timeout_add_seconds(g_random_int_range(0, NM_NDISC_ROUTER_ADVERT_DELAY),
@@ -1100,8 +1100,8 @@ nm_ndisc_stop(NMNDisc *ndisc)
     priv->rdata.public.hop_limit = 64;
 
     /* Start at very low number so that last_rs - router_solicitation_interval
-	 * is much lower than nm_utils_get_monotonic_timestamp_sec() at startup.
-	 */
+     * is much lower than nm_utils_get_monotonic_timestamp_sec() at startup.
+     */
     priv->last_rs = G_MININT32;
     nm_clear_g_source_inst(&priv->ra_timeout_source);
     nm_clear_g_source(&priv->send_rs_id);
@@ -1534,8 +1534,8 @@ nm_ndisc_init(NMNDisc *ndisc)
     priv->rdata.public.hop_limit = 64;
 
     /* Start at very low number so that last_rs - router_solicitation_interval
-	 * is much lower than nm_utils_get_monotonic_timestamp_sec() at startup.
-	 */
+     * is much lower than nm_utils_get_monotonic_timestamp_sec() at startup.
+     */
     priv->last_rs = G_MININT32;
 }
 
diff --git a/src/ndisc/tests/test-ndisc-fake.c b/src/ndisc/tests/test-ndisc-fake.c
index a0ee50242c..729478292f 100644
--- a/src/ndisc/tests/test-ndisc-fake.c
+++ b/src/ndisc/tests/test-ndisc-fake.c
@@ -396,9 +396,9 @@ test_preference_changed(void)
     guint        id;
 
     /* Test that when a low-preference and medium gateway send advertisements,
-	 * that if the low-preference gateway switches to high-preference, we do
-	 * not get duplicates in the gateway list.
-	 */
+     * that if the low-preference gateway switches to high-preference, we do
+     * not get duplicates in the gateway list.
+     */
 
     id = nm_fake_ndisc_add_ra(ndisc, 1, NM_NDISC_DHCP_LEVEL_NONE, 4, 1500);
     g_assert(id);
@@ -459,9 +459,9 @@ test_dns_solicit_loop_rs_sent(NMFakeNDisc *ndisc, TestData *data)
         }
 
         /* On all but the first solicitation, which should be triggered by the
-		 * DNS servers reaching 1/2 lifetime, emit a new RA without the DNS
-		 * servers again.
-		 */
+         * DNS servers reaching 1/2 lifetime, emit a new RA without the DNS
+         * servers again.
+         */
         id = nm_fake_ndisc_add_ra(ndisc, 0, NM_NDISC_DHCP_LEVEL_NONE, 4, 1500);
         g_assert(id);
         nm_fake_ndisc_add_gateway(ndisc, id, "fe80::1", now, 10, NM_ICMPV6_ROUTER_PREF_MEDIUM);
@@ -485,11 +485,11 @@ test_dns_solicit_loop(void)
     guint        id;
 
     /* Ensure that no solicitation loop happens when DNS servers or domains
-	 * stop being sent in advertisements.  This can happen if two routers
-	 * send RAs, but the one sending DNS info stops responding, or if one
-	 * router removes the DNS info from the RA without zero-lifetiming them
-	 * first.
-	 */
+     * stop being sent in advertisements.  This can happen if two routers
+     * send RAs, but the one sending DNS info stops responding, or if one
+     * router removes the DNS info from the RA without zero-lifetiming them
+     * first.
+     */
 
     id = nm_fake_ndisc_add_ra(ndisc, 1, NM_NDISC_DHCP_LEVEL_NONE, 4, 1500);
     g_assert(id);
diff --git a/src/nm-act-request.c b/src/nm-act-request.c
index 0e428b9b36..6afae138e1 100644
--- a/src/nm-act-request.c
+++ b/src/nm-act-request.c
@@ -378,19 +378,19 @@ device_state_changed(NMActiveConnection *active,
     NMActiveConnectionStateReason ac_state_reason = NM_ACTIVE_CONNECTION_STATE_REASON_UNKNOWN;
 
     /* Decide which device state changes to handle when this active connection
-	 * is not the device's current request.  Two cases here: (a) the AC is
-	 * pending and not yet active, and (b) the AC was active but the device is
-	 * entering DISCONNECTED state (which clears the device's current AC before
-	 * emitting the state change signal).
-	 */
+     * is not the device's current request.  Two cases here: (a) the AC is
+     * pending and not yet active, and (b) the AC was active but the device is
+     * entering DISCONNECTED state (which clears the device's current AC before
+     * emitting the state change signal).
+     */
     if (NM_ACTIVE_CONNECTION(nm_device_get_act_request(device)) != active) {
         /* Some other request is activating; this one must be pending */
         if (new_state >= NM_DEVICE_STATE_PREPARE)
             return;
         else if (new_state == NM_DEVICE_STATE_DISCONNECTED) {
             /* This request hasn't started activating yet; the device is
-			 * disconnecting and cleaning up a previous activation request.
-			 */
+             * disconnecting and cleaning up a previous activation request.
+             */
             if (cur_ac_state < NM_ACTIVE_CONNECTION_STATE_ACTIVATING)
                 return;
 
diff --git a/src/nm-active-connection.c b/src/nm-active-connection.c
index 903ce035a4..f7ce0ef32d 100644
--- a/src/nm-active-connection.c
+++ b/src/nm-active-connection.c
@@ -43,9 +43,9 @@ typedef struct _NMActiveConnectionPrivate {
     NMActivationType activation_type : 3;
 
     /* capture the original reason why the connection was activated.
-	 * For example with NM_ACTIVATION_REASON_ASSUME, the connection
-	 * will later change to become fully managed. But the original
-	 * reason never changes. */
+     * For example with NM_ACTIVATION_REASON_ASSUME, the connection
+     * will later change to become fully managed. But the original
+     * reason never changes. */
     NMActivationReason activation_reason : 4;
 
     NMAuthSubject *     subject;
@@ -175,18 +175,18 @@ _settings_connection_updated(NMSettingsConnection *sett_conn,
     NMActiveConnection *self = user_data;
 
     /* we don't know which properties actually changed. Just to be sure,
-	 * notify about all possible properties. After all, an update of a
-	 * connection is a rare event. */
+     * notify about all possible properties. After all, an update of a
+     * connection is a rare event. */
 
     _notify(self, PROP_ID);
 
     /* it's a bit odd to update the TYPE of an active connection. But the alternative
-	 * is unexpected too. */
+     * is unexpected too. */
     _notify(self, PROP_TYPE);
 
     /* currently, the UUID and the exported CONNECTION path cannot change. Later, we might
-	 * want to support a re-link operation, which associates an active-connection with a different
-	 * settings-connection. */
+     * want to support a re-link operation, which associates an active-connection with a different
+     * settings-connection. */
 }
 
 static void
@@ -257,15 +257,15 @@ nm_active_connection_set_state(NMActiveConnection *          self,
 
     if (new_state > NM_ACTIVE_CONNECTION_STATE_ACTIVATED) {
         /* once we are about to deactivate, we don't need the keep-alive instance
-		 * anymore. Freeze/disarm it. */
+         * anymore. Freeze/disarm it. */
         nm_keep_alive_disarm(priv->keep_alive);
     }
 
     if (new_state == NM_ACTIVE_CONNECTION_STATE_ACTIVATED
         && priv->activation_type == NM_ACTIVATION_TYPE_ASSUME) {
         /* assuming connections mean to gracefully take over an externally
-		 * configured device. Once activation is complete, an assumed
-		 * activation *is* the same as a full activation. */
+         * configured device. Once activation is complete, an assumed
+         * activation *is* the same as a full activation. */
         _set_activation_type_managed(self);
     }
 
@@ -305,9 +305,9 @@ nm_active_connection_set_state(NMActiveConnection *          self,
         auth_complete(self, FALSE, "Authorization request cancelled");
 
         /* Device is no longer relevant when deactivated. So remove it and
-		 * emit property change notification so clients re-read the value,
-		 * which will be NULL due to conditions in get_property().
-		 */
+         * emit property change notification so clients re-read the value,
+         * which will be NULL due to conditions in get_property().
+         */
         _device_cleanup(self);
         _notify(self, PROP_DEVICES);
     }
@@ -406,8 +406,8 @@ nm_active_connection_get_settings_connection(NMActiveConnection *self)
     sett_conn = _nm_active_connection_get_settings_connection(self);
 
     /* Only call this function on an active-connection that is already
-	 * fully set-up (i.e. that has a settings-connection). Other uses
-	 * indicate a bug. */
+     * fully set-up (i.e. that has a settings-connection). Other uses
+     * indicate a bug. */
     g_return_val_if_fail(sett_conn, NULL);
     return sett_conn;
 }
@@ -422,8 +422,8 @@ nm_active_connection_get_applied_connection(NMActiveConnection *self)
     connection = NM_ACTIVE_CONNECTION_GET_PRIVATE(self)->applied_connection;
 
     /* Only call this function on an active-connection that is already
-	 * fully set-up (i.e. that has a settings-connection). Other uses
-	 * indicate a bug. */
+     * fully set-up (i.e. that has a settings-connection). Other uses
+     * indicate a bug. */
     g_return_val_if_fail(connection, NULL);
     return connection;
 }
@@ -443,7 +443,7 @@ _set_applied_connection_take(NMActiveConnection *self, NMConnection *applied_con
     nm_connection_clear_secrets(priv->applied_connection);
 
     /* we determine whether the connection is a master/slave, based solely
-	 * on the connection properties itself. */
+     * on the connection properties itself. */
     s_con = nm_connection_get_setting_connection(priv->applied_connection);
     if (nm_setting_connection_get_master(s_con))
         flags_val |= NM_ACTIVATION_STATE_FLAG_IS_SLAVE;
@@ -472,12 +472,12 @@ nm_active_connection_set_settings_connection(NMActiveConnection *  self,
     g_return_if_fail(!priv->applied_connection);
 
     /* Can't change connection after the ActiveConnection is exported over D-Bus.
-	 *
-	 * Later, we want to change the settings-connection of an activated connection.
-	 * When doing that, this changes the assumption that the settings-connection
-	 * never changes (once it's set). That has effects for NMVpnConnection and
-	 * NMActivationRequest.
-	 * For example, we'd have to cancel all pending seret requests. */
+     *
+     * Later, we want to change the settings-connection of an activated connection.
+     * When doing that, this changes the assumption that the settings-connection
+     * never changes (once it's set). That has effects for NMVpnConnection and
+     * NMActivationRequest.
+     * For example, we'd have to cancel all pending seret requests. */
     g_return_if_fail(!nm_dbus_object_is_exported(NM_DBUS_OBJECT(self)));
 
     _set_settings_connection(self, sett_conn);
@@ -538,8 +538,8 @@ nm_active_connection_set_specific_object(NMActiveConnection *self, const char *s
     NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE(self);
 
     /* Nothing that calls this function should be using paths from D-Bus,
-	 * where NM uses "/" to mean NULL.
-	 */
+     * where NM uses "/" to mean NULL.
+     */
     nm_assert(!nm_streq0(specific_object, "/"));
 
     if (nm_streq0(priv->specific_object, specific_object))
@@ -728,8 +728,8 @@ nm_active_connection_set_device(NMActiveConnection *self, NMDevice *device)
         }
     } else {
         /* The ActiveConnection's device can only be cleared after the
-		 * connection is activated.
-		 */
+         * connection is activated.
+         */
         g_warn_if_fail(priv->state > NM_ACTIVE_CONNECTION_STATE_UNKNOWN);
         priv->device = NULL;
     }
@@ -772,10 +772,10 @@ check_master_ready(NMActiveConnection *self)
     gboolean                   signalling = FALSE;
 
     /* ActiveConnetions don't enter the ACTIVATING state until they have a
-	 * NMDevice in PREPARE or higher states, so the master active connection's
-	 * device will be ready to accept slaves when the master is in ACTIVATING
-	 * or higher states.
-	 */
+     * NMDevice in PREPARE or higher states, so the master active connection's
+     * device will be ready to accept slaves when the master is in ACTIVATING
+     * or higher states.
+     */
     if (!priv->master_ready && priv->master && priv->state == NM_ACTIVE_CONNECTION_STATE_ACTIVATING
         && NM_IN_SET(nm_active_connection_get_state(priv->master),
                      NM_ACTIVE_CONNECTION_STATE_ACTIVATING,
@@ -798,9 +798,9 @@ check_master_ready(NMActiveConnection *self)
         _notify(self, PROP_INT_MASTER_READY);
 
         /* Also notify clients to recheck the exported 'master' property to
-		 * ensure that if the master connection was created without a device
-		 * that we notify clients when the master device is known.
-		 */
+         * ensure that if the master connection was created without a device
+         * that we notify clients when the master device is known.
+         */
         _notify(self, PROP_MASTER);
     }
 }
@@ -1127,9 +1127,9 @@ auth_done(NMAuthManager *      auth_mgr,
         nm_assert(auth_call_id == priv->auth.call_id_wifi_shared_permission);
         if (result != NM_AUTH_CALL_RESULT_YES) {
             /* we don't fail right away. Instead, we mark that wifi-shared-permissions
-			 * are missing. We prefer to report the failure about network-control.
-			 * Below, we will wait longer for call_id_network_control (if it's still
-			 * pending). */
+             * are missing. We prefer to report the failure about network-control.
+             * Below, we will wait longer for call_id_network_control (if it's still
+             * pending). */
             priv->auth.call_id_wifi_shared_permission = AUTH_CALL_ID_SHARED_WIFI_PERMISSION_FAILED;
         } else
             priv->auth.call_id_wifi_shared_permission = NULL;
@@ -1275,13 +1275,13 @@ get_property(GObject *object, guint prop_id, GValue *value, GParamSpec *pspec)
 
     switch (prop_id) {
     /* note that while priv->settings_connection.obj might not be set initially,
-	 * it will be set before the object is exported on D-Bus. Hence,
-	 * nobody is calling these property getters before the object is
-	 * exported, at which point we will have a valid settings-connection.
-	 *
-	 * Therefore, intentionally not check whether priv->settings_connection.obj
-	 * is set, to get an assertion failure if somebody tries to access the
-	 * getters at the wrong time. */
+     * it will be set before the object is exported on D-Bus. Hence,
+     * nobody is calling these property getters before the object is
+     * exported, at which point we will have a valid settings-connection.
+     *
+     * Therefore, intentionally not check whether priv->settings_connection.obj
+     * is set, to get an assertion failure if somebody tries to access the
+     * getters at the wrong time. */
     case PROP_CONNECTION:
         g_value_set_string(value, nm_dbus_track_obj_path_get(&priv->settings_connection));
         break;
@@ -1311,8 +1311,8 @@ get_property(GObject *object, guint prop_id, GValue *value, GParamSpec *pspec)
             g_value_set_uint(value, priv->state);
         else {
             /* When the AC has just been created, its externally-visible state should
-			 * be "ACTIVATING", even though internally it is "UNKNOWN".
-			 */
+             * be "ACTIVATING", even though internally it is "UNKNOWN".
+             */
             g_value_set_uint(value, NM_ACTIVE_CONNECTION_STATE_ACTIVATING);
         }
         break;
@@ -1380,11 +1380,11 @@ set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *ps
         acon = g_value_get_object(value);
         if (acon) {
             /* we don't call _set_applied_connection_take() yet, because the instance
-			 * is not yet fully initialized. We are currently in the process of setting
-			 * the constructor properties.
-			 *
-			 * For now, just piggyback the connection, but call _set_applied_connection_take()
-			 * in constructed(). */
+             * is not yet fully initialized. We are currently in the process of setting
+             * the constructor properties.
+             *
+             * For now, just piggyback the connection, but call _set_applied_connection_take()
+             * in constructed(). */
             priv->applied_connection = g_object_ref(acon);
         }
         break;
@@ -1491,10 +1491,10 @@ constructed(GObject *object)
 
     if (priv->applied_connection) {
         /* priv->applied_connection was set during the construction of the object.
-		 * It's not yet fully initialized, so do that now.
-		 *
-		 * We delayed that, because we may log in _set_applied_connection_take(), and the
-		 * first logging line should be "constructed" above). */
+         * It's not yet fully initialized, so do that now.
+         *
+         * We delayed that, because we may log in _set_applied_connection_take(), and the
+         * first logging line should be "constructed" above). */
         _set_applied_connection_take(self, g_steal_pointer(&priv->applied_connection));
     }
 
diff --git a/src/nm-active-connection.h b/src/nm-active-connection.h
index ed87df4f45..f85545c6f8 100644
--- a/src/nm-active-connection.h
+++ b/src/nm-active-connection.h
@@ -64,7 +64,7 @@ struct _NMActiveConnection {
     struct _NMActiveConnectionPrivate *_priv;
 
     /* active connection can be tracked in a list by NMManager. This is
-	 * the list node. */
+     * the list node. */
     CList active_connections_lst;
 };
 
@@ -72,8 +72,8 @@ typedef struct {
     NMDBusObjectClass parent;
 
     /* re-emits device state changes as a convenience for subclasses for
-	 * device states >= DISCONNECTED.
-	 */
+     * device states >= DISCONNECTED.
+     */
     void (*device_state_changed)(NMActiveConnection *connection,
                                  NMDevice *          device,
                                  NMDeviceState       new_state,
diff --git a/src/nm-auth-manager.c b/src/nm-auth-manager.c
index 4ed83b6dc5..20992a3269 100644
--- a/src/nm-auth-manager.c
+++ b/src/nm-auth-manager.c
@@ -160,7 +160,7 @@ _call_id_free(NMAuthManagerCallId *call_id)
 
     if (call_id->dbus_cancellable) {
         /* we have a pending D-Bus call. We keep the call-id instance alive
-		 * for _call_check_authorize_cb() */
+         * for _call_check_authorize_cb() */
         g_cancellable_cancel(call_id->dbus_cancellable);
         return;
     }
@@ -212,10 +212,10 @@ _call_check_authorize_cb(GObject *proxy, GAsyncResult *res, gpointer user_data)
     gboolean              is_challenge  = FALSE;
 
     /* we need to clear the cancelable, to signal for _call_id_free() that we
-	 * are not in a pending call.
-	 *
-	 * Note how _call_id_free() kept call-id alive, even if the request was
-	 * already cancelled. */
+     * are not in a pending call.
+     *
+     * Note how _call_id_free() kept call-id alive, even if the request was
+     * already cancelled. */
     g_clear_object(&call_id->dbus_cancellable);
 
     self = call_id->self;
@@ -225,20 +225,20 @@ _call_check_authorize_cb(GObject *proxy, GAsyncResult *res, gpointer user_data)
 
     if (nm_utils_error_is_cancelled(error)) {
         /* call_id was cancelled externally, but _call_id_free() kept call_id
-		 * alive (and it has still the reference on @self. */
+         * alive (and it has still the reference on @self. */
 
         if (!priv->main_cancellable) {
             /* we do a forced shutdown. There is no more time for cancelling... */
             _call_id_free(call_id);
 
             /* this shouldn't really happen, because:
-			 * nm_auth_manager_check_authorization() only scheduled the D-Bus request at a time when
-			 * main_cancellable was still set. It means, somebody called force-shutdown
-			 * after call-id was schedule.
-			 * force-shutdown should only be called after:
-			 *   - cancel all pending requests
-			 *   - give enough time to cancel the request and schedule a D-Bus call
-			 *     to CancelCheckAuthorization (below), before issuing force-shutdown. */
+             * nm_auth_manager_check_authorization() only scheduled the D-Bus request at a time when
+             * main_cancellable was still set. It means, somebody called force-shutdown
+             * after call-id was schedule.
+             * force-shutdown should only be called after:
+             *   - cancel all pending requests
+             *   - give enough time to cancel the request and schedule a D-Bus call
+             *     to CancelCheckAuthorization (below), before issuing force-shutdown. */
             g_return_if_reached();
         }
 
@@ -541,28 +541,28 @@ nm_auth_manager_force_shutdown(NMAuthManager *self)
     priv = NM_AUTH_MANAGER_GET_PRIVATE(self);
 
     /* FIXME(shutdown): ensure we properly call this API during shutdown as
-	 * described next. */
+     * described next. */
 
     /* while we have pending requests (NMAuthManagerCallId), the instance
-	 * is kept alive.
-	 *
-	 * Even if the caller cancels all pending call-ids, we still need to keep
-	 * a reference to self, in order to handle pending CancelCheckAuthorization
-	 * requests.
-	 *
-	 * To do a coordinated shutdown, do the following:
-	 * - cancel all pending NMAuthManagerCallId requests.
-	 * - ensure everybody unrefs the NMAuthManager instance. If by that, the instance
-	 *   gets destroyed, the shutdown already completed successfully.
-	 * - Otherwise, the object is kept alive by pending CancelCheckAuthorization requests.
-	 *   wait a certain timeout (1 second) for all requests to complete (by watching
-	 *   for destruction of NMAuthManager).
-	 * - if that doesn't happen within timeout, issue nm_auth_manager_force_shutdown() and
-	 *   wait longer. After that, soon the instance should be destroyed and you
-	 *   did a successful shutdown.
-	 * - if the instance was still not destroyed within a short timeout, you leaked
-	 *   resources. You cannot properly shutdown.
-	 */
+     * is kept alive.
+     *
+     * Even if the caller cancels all pending call-ids, we still need to keep
+     * a reference to self, in order to handle pending CancelCheckAuthorization
+     * requests.
+     *
+     * To do a coordinated shutdown, do the following:
+     * - cancel all pending NMAuthManagerCallId requests.
+     * - ensure everybody unrefs the NMAuthManager instance. If by that, the instance
+     *   gets destroyed, the shutdown already completed successfully.
+     * - Otherwise, the object is kept alive by pending CancelCheckAuthorization requests.
+     *   wait a certain timeout (1 second) for all requests to complete (by watching
+     *   for destruction of NMAuthManager).
+     * - if that doesn't happen within timeout, issue nm_auth_manager_force_shutdown() and
+     *   wait longer. After that, soon the instance should be destroyed and you
+     *   did a successful shutdown.
+     * - if the instance was still not destroyed within a short timeout, you leaked
+     *   resources. You cannot properly shutdown.
+     */
 
     priv->shutting_down = TRUE;
     nm_clear_g_cancellable(&priv->main_cancellable);
diff --git a/src/nm-auth-utils.c b/src/nm-auth-utils.c
index 476b4c3aba..9d10d56510 100644
--- a/src/nm-auth-utils.c
+++ b/src/nm-auth-utils.c
@@ -150,8 +150,8 @@ nm_auth_chain_set_cancellable(NMAuthChain *self, GCancellable *cancellable)
     g_return_if_fail(G_IS_CANCELLABLE(cancellable));
 
     /* after the chain is started, the cancellable can no longer be changed.
-	 * No need to handle the complexity of swapping the cancellable *after*
-	 * requests are already started. */
+     * No need to handle the complexity of swapping the cancellable *after*
+     * requests are already started. */
     g_return_if_fail(!self->is_started);
     nm_assert(c_list_is_empty(&self->auth_call_lst_head));
 
@@ -240,9 +240,9 @@ nm_auth_chain_steal_data(NMAuthChain *self, const char *tag)
         return NULL;
 
     /* Make sure the destroy handler isn't called when freeing.
-	 *
-	 * We don't bother to really remove the element from the array.
-	 * Just mark the entry as unused by clearing the tag. */
+     *
+     * We don't bother to really remove the element from the array.
+     * Just mark the entry as unused by clearing the tag. */
     chain_data->destroy = NULL;
     chain_data->tag     = NULL;
     return chain_data->data;
@@ -274,15 +274,15 @@ nm_auth_chain_set_data_unsafe(NMAuthChain *  self,
     g_return_if_fail(tag);
 
     /* The tag must not yet exist. Otherwise, we'd have to first search the
-	 * list for an existing entry. That usage pattern is not supported. */
+     * list for an existing entry. That usage pattern is not supported. */
     nm_assert(!_get_data(self, tag));
 
     if (!data) {
         /* we don't track user data of %NULL.
-		 *
-		 * In the past this had also the meaning of removing a user-data. But since
-		 * nm_auth_chain_set_data() does not allow being called more than once
-		 * for the same tag, we don't need to remove anything. */
+         *
+         * In the past this had also the meaning of removing a user-data. But since
+         * nm_auth_chain_set_data() does not allow being called more than once
+         * for the same tag, we don't need to remove anything. */
         return;
     }
 
@@ -313,14 +313,14 @@ nm_auth_chain_get_result(NMAuthChain *self, const char *permission)
     g_return_val_if_fail(permission, NM_AUTH_CALL_RESULT_UNKNOWN);
 
     /* it is a bug to request the result other than from the done_func()
-	 * callback. You are not supposed to poll for the result but request
-	 * it upon notification. */
+     * callback. You are not supposed to poll for the result but request
+     * it upon notification. */
     nm_assert(self->is_finishing);
 
     auth_call = _find_auth_call(self, permission);
 
     /* it is a bug to request a permission result that was not
-	 * previously requested or which did not complete yet. */
+     * previously requested or which did not complete yet. */
     if (!auth_call)
         g_return_val_if_reached(NM_AUTH_CALL_RESULT_UNKNOWN);
 
@@ -328,7 +328,7 @@ nm_auth_chain_get_result(NMAuthChain *self, const char *permission)
 
     if (self->cancellable_idle_source) {
         /* already cancelled. We always return unknown (even if we happen to
-		 * have already received the response. */
+         * have already received the response. */
         return NM_AUTH_CALL_RESULT_UNKNOWN;
     }
 
@@ -390,7 +390,7 @@ pk_call_cb(NMAuthManager *      auth_manager,
 
     if (call->chain->num_pending_auth_calls == 0) {
         /* we are on an idle-handler or a clean call-stack (non-reentrant) so it's safe
-		 * to invoke the callback right away. */
+         * to invoke the callback right away. */
         _done_and_destroy(self);
     }
 }
@@ -427,7 +427,7 @@ nm_auth_chain_add_call_unsafe(NMAuthChain *self, const char *permission, gboolea
                         NM_AUTH_SUBJECT_TYPE_INTERNAL));
 
     /* duplicate permissions are not supported, also because nm_auth_chain_get_result()
-	 * can only return one-permission. */
+     * can only return one-permission. */
     nm_assert(!_find_auth_call(self, permission));
 
     if (!self->is_started) {
@@ -457,8 +457,8 @@ nm_auth_chain_add_call_unsafe(NMAuthChain *self, const char *permission, gboolea
     };
 
     /* above we assert that no duplicate permissions are added. Still, track the
-	 * new request to the front of the list so that it would shadow an earlier
-	 * call. */
+     * new request to the front of the list so that it would shadow an earlier
+     * call. */
     c_list_link_front(&self->auth_call_lst_head, &call->auth_call_lst);
 
     if (self->cancellable_idle_source) {
@@ -478,8 +478,8 @@ nm_auth_chain_add_call_unsafe(NMAuthChain *self, const char *permission, gboolea
     _ASSERT_call(call);
 
     /* we track auth-calls in a linked list. If we end up requesting too many permissions this
-	 * becomes inefficient. If that ever happens, consider a more efficient data structure for
-	 * a large number of requests. */
+     * becomes inefficient. If that ever happens, consider a more efficient data structure for
+     * a large number of requests. */
     nm_assert(c_list_length(&self->auth_call_lst_head) < 25);
     G_STATIC_ASSERT_EXPR(NM_CLIENT_PERMISSION_LAST < 25);
 }
@@ -579,9 +579,9 @@ _auth_chain_destroy(NMAuthChain *self)
     nm_clear_g_source_inst(&self->cancellable_idle_source);
 
     /* we must first destroy all AuthCall instances before ChainData. The reason is
-	 * that AuthData.permission is not cloned and the lifetime of the string must
-	 * be ensured by the caller. A sensible thing to do for the caller is attach the
-	 * permission string via nm_auth_chain_set_data(). Hence, first free the AuthCall. */
+     * that AuthData.permission is not cloned and the lifetime of the string must
+     * be ensured by the caller. A sensible thing to do for the caller is attach the
+     * permission string via nm_auth_chain_set_data(). Hence, first free the AuthCall. */
     while ((call = c_list_first_entry(&self->auth_call_lst_head, AuthCall, auth_call_lst)))
         auth_call_free(call);
 
@@ -634,8 +634,8 @@ nm_auth_is_subject_in_acl(NMConnection *connection, NMAuthSubject *subject, char
     s_con = nm_connection_get_setting_connection(connection);
     if (!s_con) {
         /* This can only happen when called from AddAndActivate, so we know
-		 * the user will be authorized when the connection is completed.
-		 */
+         * the user will be authorized when the connection is completed.
+         */
         return TRUE;
     }
 
diff --git a/src/nm-checkpoint-manager.c b/src/nm-checkpoint-manager.c
index fbd9e7cd07..23aa39491d 100644
--- a/src/nm-checkpoint-manager.c
+++ b/src/nm-checkpoint-manager.c
@@ -82,7 +82,7 @@ rollback_checkpoint(NMCheckpointManager *self, NMCheckpoint *checkpoint)
         iter = iter->next;
         if (nm_checkpoint_includes_devices_of(cp, checkpoint)) {
             /* the younger checkpoint has overlapping devices and gets obsoleted.
-			 * Destroy it. */
+             * Destroy it. */
             destroy_checkpoint(self, cp, TRUE);
         }
     }
@@ -124,7 +124,7 @@ nm_checkpoint_manager_create(NMCheckpointManager *   self,
 
         nm_manager_for_each_device (manager, device, tmp_lst) {
             /* FIXME: there is no strong reason to skip over unrealized devices.
-			 *        Also, NMCheckpoint anticipates to handle them (in parts). */
+             *        Also, NMCheckpoint anticipates to handle them (in parts). */
             if (!nm_device_is_real(device))
                 continue;
             nm_assert(nm_dbus_object_get_path(NM_DBUS_OBJECT(device)));
@@ -327,11 +327,11 @@ nm_checkpoint_manager_new(NMManager *manager, GParamSpec *spec)
     self = g_slice_new0(NMCheckpointManager);
 
     /* the NMCheckpointManager instance is actually owned by NMManager.
-	 * Thus, we cannot take a reference to it, and we also don't bother
-	 * taking a weak-reference. Instead let GET_MANAGER() assert that
-	 * self->_manager is alive -- which we always expect as the lifetime
-	 * of NMManager shall surpass the lifetime of the NMCheckpointManager
-	 * instance. */
+     * Thus, we cannot take a reference to it, and we also don't bother
+     * taking a weak-reference. Instead let GET_MANAGER() assert that
+     * self->_manager is alive -- which we always expect as the lifetime
+     * of NMManager shall surpass the lifetime of the NMCheckpointManager
+     * instance. */
     self->_manager      = manager;
     self->property_spec = spec;
     c_list_init(&self->checkpoints_lst_head);
diff --git a/src/nm-checkpoint.c b/src/nm-checkpoint.c
index 7706dddf9b..d8bc5d9d80 100644
--- a/src/nm-checkpoint.c
+++ b/src/nm-checkpoint.c
@@ -112,8 +112,8 @@ nm_checkpoint_set_timeout_callback(NMCheckpoint *              self,
     NMCheckpointPrivate *priv = NM_CHECKPOINT_GET_PRIVATE(self);
 
     /* in glib world, we would have a GSignal for this. But as there
-	 * is only one subscriber, it's simpler to just set and unset(!)
-	 * the callback this way. */
+     * is only one subscriber, it's simpler to just set and unset(!)
+     * the callback this way. */
     priv->timeout_cb   = callback;
     priv->timeout_data = user_data;
 }
@@ -217,11 +217,11 @@ restore_and_activate_connection(NMCheckpoint *self, DeviceCheckpoint *dev_checkp
     connection = find_settings_connection(self, dev_checkpoint, &need_update, &need_activation);
 
     /* FIXME: we need to ensure to re-create/update the profile for the
-	 *   same settings plugin. E.g. if it was a keyfile in /run or /etc,
-	 *   it must be again. If it was previously handled by a certain settings plugin,
-	 *   so it must again.
-	 *
-	 * FIXME: preserve and restore the right settings flags (volatile, nm-generated). */
+     *   same settings plugin. E.g. if it was a keyfile in /run or /etc,
+     *   it must be again. If it was previously handled by a certain settings plugin,
+     *   so it must again.
+     *
+     * FIXME: preserve and restore the right settings flags (volatile, nm-generated). */
     sett_flags = NM_SETTINGS_CONNECTION_INT_FLAGS_NONE;
     sett_mask  = NM_SETTINGS_CONNECTION_INT_FLAGS_NONE;
 
@@ -276,8 +276,8 @@ restore_and_activate_connection(NMCheckpoint *self, DeviceCheckpoint *dev_checkp
         subject = nm_auth_subject_new_internal();
 
         /* Disconnect the device if needed. This necessary because now
-		 * the manager prevents the reactivation of the same connection by
-		 * an internal subject. */
+         * the manager prevents the reactivation of the same connection by
+         * an internal subject. */
         if (nm_device_get_state(dev_checkpoint->device) > NM_DEVICE_STATE_DISCONNECTED
             && nm_device_get_state(dev_checkpoint->device) < NM_DEVICE_STATE_DEACTIVATING) {
             nm_device_state_changed(dev_checkpoint->device,
@@ -595,11 +595,11 @@ nm_checkpoint_adjust_rollback_timeout(NMCheckpoint *self, guint32 add_timeout)
         rollback_timeout_ms = (now_ms - priv->created_at_ms) + add_timeout_ms;
 
         /* round to nearest integer second. Since NM_CHECKPOINT_ROLLBACK_TIMEOUT is
-		 * in units seconds, it will be able to exactly express the timeout. */
+         * in units seconds, it will be able to exactly express the timeout. */
         rollback_timeout_s = NM_MIN((rollback_timeout_ms + 500) / 1000, (gint64) G_MAXUINT32);
 
         /* we expect the timeout to be positive, because add_timeout_ms is positive.
-		 * We cannot accept a zero, because it means "infinity". */
+         * We cannot accept a zero, because it means "infinity". */
         nm_assert(rollback_timeout_s > 0);
 
         priv->timeout_id =
@@ -702,8 +702,8 @@ nm_checkpoint_new(NMManager *             manager,
         NMDevice *device = devices->pdata[i];
 
         /* As long as the check point instance exists, it will keep a reference
-		 * to the device also if the device gets removed (by rmmod or by deleting
-		 * a connection profile for a software device). */
+         * to the device also if the device gets removed (by rmmod or by deleting
+         * a connection profile for a software device). */
         g_hash_table_insert(priv->devices, device, device_checkpoint_create(self, device));
     }
 
diff --git a/src/nm-config-data.c b/src/nm-config-data.c
index d8ccafd532..f4c6ba3b37 100644
--- a/src/nm-config-data.c
+++ b/src/nm-config-data.c
@@ -21,8 +21,8 @@ typedef struct {
     gboolean stop_match;
     struct {
         /* have a separate boolean field @has, because a @spec with
-		 * value %NULL does not necessarily mean, that the property
-		 * "match-device" was unspecified. */
+         * value %NULL does not necessarily mean, that the property
+         * "match-device" was unspecified. */
         gboolean has;
         GSList * spec;
     } match_device;
@@ -63,11 +63,11 @@ typedef struct {
     GKeyFile *keyfile_intern;
 
     /* A zero-terminated list of pre-processed information from the
-	 * [connection] sections. This is to speed up lookup. */
+     * [connection] sections. This is to speed up lookup. */
     MatchSectionInfo *connection_infos;
 
     /* A zero-terminated list of pre-processed information from the
-	 * [device] sections. This is to speed up lookup. */
+     * [device] sections. This is to speed up lookup. */
     MatchSectionInfo *device_infos;
 
     struct {
@@ -523,9 +523,9 @@ nm_config_data_is_intern_atomic_group(const NMConfigData *self, const char *grou
         return FALSE;
 
     /* we have a .was entry for the section. That means that the section would be overwritten
-	 * from user configuration. But it doesn't mean that the merged configuration contains this
-	 * groups, because the internal setting could hide the user section.
-	 * Only return TRUE, if we actually have such a group in the merged configuration.*/
+     * from user configuration. But it doesn't mean that the merged configuration contains this
+     * groups, because the internal setting could hide the user section.
+     * Only return TRUE, if we actually have such a group in the merged configuration.*/
     return g_key_file_has_group(priv->keyfile, group);
 }
 
@@ -550,7 +550,7 @@ _merge_keyfiles(GKeyFile *keyfile_user, GKeyFile *keyfile_intern)
         return keyfile;
 
     /* we must reverse the order of the connection settings so that we
-	 * have lowest priority last. */
+     * have lowest priority last. */
     _nm_config_sort_groups(groups, ngroups);
     for (g = 0; groups[g]; g++) {
         const char *       group = groups[g];
@@ -1395,12 +1395,12 @@ _match_section_infos_lookup(const MatchSectionInfo *match_section_infos,
         gboolean match;
 
         /* FIXME: Here we use g_key_file_get_string(). This should be in sync with what keyfile-reader
-		 * does.
-		 *
-		 * Unfortunately that is currently not possible because keyfile-reader does the two steps
-		 * string_to_value(keyfile_to_string(keyfile)) in one. Optimally, keyfile library would
-		 * expose both functions, and we would return here keyfile_to_string(keyfile).
-		 * The caller then could convert the string to the proper value via string_to_value(value). */
+         * does.
+         *
+         * Unfortunately that is currently not possible because keyfile-reader does the two steps
+         * string_to_value(keyfile_to_string(keyfile)) in one. Optimally, keyfile library would
+         * expose both functions, and we would return here keyfile_to_string(keyfile).
+         * The caller then could convert the string to the proper value via string_to_value(value). */
         value = g_key_file_get_string(keyfile, match_section_infos->group_name, property, NULL);
         if (!value && !match_section_infos->stop_match)
             continue;
@@ -1588,10 +1588,10 @@ _match_section_infos_construct(GKeyFile *keyfile, const char *prefix)
     MatchSectionInfo *match_section_infos = NULL;
 
     /* get the list of existing [connection.\+]/[device.\+] sections.
-	 *
-	 * We expect the sections in their right order, with lowest priority
-	 * first. Only exception is the (literal) [connection] section, which
-	 * we will always reorder to the end. */
+     *
+     * We expect the sections in their right order, with lowest priority
+     * first. Only exception is the (literal) [connection] section, which
+     * we will always reorder to the end. */
     groups = g_key_file_get_groups(keyfile, &ngroups);
     if (!groups)
         return NULL;
@@ -1865,7 +1865,7 @@ constructed(GObject *object)
     g_free(str);
 
     /* On missing config value, fallback to 300. On invalid value, disable connectivity checking by setting
-	 * the interval to zero. */
+     * the interval to zero. */
     str = g_key_file_get_string(priv->keyfile,
                                 NM_CONFIG_KEYFILE_GROUP_CONNECTIVITY,
                                 NM_CONFIG_KEYFILE_KEY_CONNECTIVITY_INTERVAL,
diff --git a/src/nm-config-data.h b/src/nm-config-data.h
index 489c9211f5..404e9c2a17 100644
--- a/src/nm-config-data.h
+++ b/src/nm-config-data.h
@@ -20,8 +20,8 @@ typedef enum {
     NM_AUTH_POLKIT_MODE_ALLOW_ALL,
 
     /* use PolicyKit to authorize requests. Root user (uid 0) always
-	 * gets a free pass, without consulting PolicyKit. If PolicyKit is not
-	 * running, authorization will fail for non root users. */
+     * gets a free pass, without consulting PolicyKit. If PolicyKit is not
+     * running, authorization will fail for non root users. */
     NM_AUTH_POLKIT_MODE_USE_POLKIT,
 
 } NMAuthPolkitMode;
@@ -61,7 +61,7 @@ typedef enum { /*< flags >*/
                NM_CONFIG_GET_VALUE_NO_EMPTY = (1LL << 2),
 
                /* special flag to read device spec. You want to use this before passing the
-	 * value to nm_match_spec_split(). */
+     * value to nm_match_spec_split(). */
                NM_CONFIG_GET_VALUE_TYPE_SPEC = NM_CONFIG_GET_VALUE_RAW,
 } NMConfigGetValueFlags;
 
@@ -69,8 +69,8 @@ typedef enum { /*< flags >*/
                NM_CONFIG_CHANGE_NONE = 0,
 
                /**************************************************************************
-	 * The external cause which triggered the reload/configuration-change
-	 *************************************************************************/
+     * The external cause which triggered the reload/configuration-change
+     *************************************************************************/
 
                NM_CONFIG_CHANGE_CAUSE_SIGHUP          = (1L << 0),
                NM_CONFIG_CHANGE_CAUSE_SIGUSR1         = (1L << 1),
@@ -84,8 +84,8 @@ typedef enum { /*< flags >*/
                NM_CONFIG_CHANGE_CAUSES = ((1L << 8) - 1),
 
                /**************************************************************************
-	 * Following flags describe which property of the configuration changed:
-	 *************************************************************************/
+     * Following flags describe which property of the configuration changed:
+     *************************************************************************/
 
                /* main-file or config-description changed */
                NM_CONFIG_CHANGE_CONFIG_FILES = (1L << 10),
diff --git a/src/nm-config.c b/src/nm-config.c
index 95b8b280fa..4f2a0f72e9 100644
--- a/src/nm-config.c
+++ b/src/nm-config.c
@@ -42,18 +42,18 @@ struct NMConfigCmdLineOptions {
     char *   connectivity_uri;
 
     /* We store interval as signed internally to track whether it's
-	 * set or not via GOptionEntry
-	 */
+     * set or not via GOptionEntry
+     */
     int   connectivity_interval;
     char *connectivity_response;
 
     /* @first_start is not provided by command line. It is a convenient hack
-	 * to pass in an argument to NMConfig. This makes NMConfigCmdLineOptions a
-	 * misnomer.
-	 *
-	 * It is true, if NM is started the first time -- contrary to a restart
-	 * during the same boot up. That is determined by the content of the
-	 * /run/NetworManager state directory. */
+     * to pass in an argument to NMConfig. This makes NMConfigCmdLineOptions a
+     * misnomer.
+     *
+     * It is true, if NM is started the first time -- contrary to a restart
+     * during the same boot up. That is determined by the content of the
+     * /run/NetworManager state directory. */
     bool first_start;
 };
 
@@ -91,24 +91,24 @@ typedef struct {
     char **atomic_section_prefixes;
 
     /* The state. This is actually a mutable data member and it makes sense:
-	 * The regular config is immutable (NMConfigData) and can old be swapped
-	 * as a whole (via nm_config_set_values() or during reload). Thus, it can
-	 * be changed, but it is still immutable and is swapped atomically as a
-	 * whole. Also, we emit a config-changed signal on that occasion.
-	 *
-	 * For state, there are no events. You can query it and set it.
-	 * It only gets read *once* at startup, and later is cached and only
-	 * written out to disk. Hence, no need for the immutable dance here
-	 * because the state changes only on explicit actions from the daemon
-	 * itself. */
+     * The regular config is immutable (NMConfigData) and can old be swapped
+     * as a whole (via nm_config_set_values() or during reload). Thus, it can
+     * be changed, but it is still immutable and is swapped atomically as a
+     * whole. Also, we emit a config-changed signal on that occasion.
+     *
+     * For state, there are no events. You can query it and set it.
+     * It only gets read *once* at startup, and later is cached and only
+     * written out to disk. Hence, no need for the immutable dance here
+     * because the state changes only on explicit actions from the daemon
+     * itself. */
     State *state;
 
     /* the hash table of device states. It is only loaded from disk
-	 * once and kept immutable afterwards.
-	 *
-	 * We also read all state file at once. We don't want to support
-	 * that they are changed outside of NM (at least not while NM is running).
-	 * Hence, we read them once, that's it. */
+     * once and kept immutable afterwards.
+     *
+     * We also read all state file at once. We don't want to support
+     * that they are changed outside of NM (at least not while NM is running).
+     * Hence, we read them once, that's it. */
     GHashTable *device_states;
 
     char **warnings;
@@ -236,7 +236,7 @@ nm_config_keyfile_set_string_list(GKeyFile *         keyfile,
     g_key_file_set_string_list(keyfile, group, key, strv, len);
 
     /* g_key_file_set_string_list() appends a trailing separator to the value.
-	 * We don't like that, get rid of it. */
+     * We don't like that, get rid of it. */
 
     new_value = g_key_file_get_value(keyfile, group, key, NULL);
     if (!new_value)
@@ -245,8 +245,8 @@ nm_config_keyfile_set_string_list(GKeyFile *         keyfile,
     l = strlen(new_value);
     if (l > 0 && new_value[l - 1] == NM_CONFIG_KEYFILE_LIST_SEPARATOR) {
         /* Maybe we should check that value doesn't end with "\\,", i.e.
-		 * with an escaped separator. But the way g_key_file_set_string_list()
-		 * is implemented (currently), it always adds a trailing separator. */
+         * with an escaped separator. But the way g_key_file_set_string_list()
+         * is implemented (currently), it always adds a trailing separator. */
         new_value[l - 1] = '\0';
         g_key_file_set_value(keyfile, group, key, new_value);
     }
@@ -344,8 +344,8 @@ no_auto_default_from_file(const char *no_auto_default_file)
     }
 
     /* The returned buffer here is not at all compact. That means, it has additional
-	 * memory allocations and is larger than needed. That means, you should not keep
-	 * this result around, only process it further and free it. */
+     * memory allocations and is larger than needed. That means, you should not keep
+     * this result around, only process it further and free it. */
     return (char **) list;
 }
 
@@ -417,9 +417,9 @@ nm_config_set_no_auto_default_for_device(NMConfig *self, NMDevice *device)
 
     if (is_fake) {
         /* A fake MAC address, no point in storing it to the file.
-		 * Also, nm_match_spec_device() would ignore fake MAC addresses.
-		 *
-		 * Instead, try the interface-name...  */
+         * Also, nm_match_spec_device() would ignore fake MAC addresses.
+         *
+         * Instead, try the interface-name...  */
         ifname = nm_device_get_ip_iface(device);
         if (!nm_utils_ifname_valid_kernel(ifname, NULL))
             return;
@@ -442,7 +442,7 @@ nm_config_set_no_auto_default_for_device(NMConfig *self, NMDevice *device)
                                                NULL);
     if (idx >= 0) {
         /* @spec is already blocked. We don't have to update our in-memory representation.
-		 * Maybe we should write to no_auto_default_file anew, but let's save that too. */
+         * Maybe we should write to no_auto_default_file anew, but let's save that too. */
         return;
     }
 
@@ -712,7 +712,7 @@ ignore_config_snippet(GKeyFile *keyfile, gboolean is_base_config)
         return FALSE;
 
     /* first, let's try to parse the value as plain boolean. If that is possible, we don't treat
-	 * the value as match-spec. */
+     * the value as match-spec. */
     as_bool = nm_config_keyfile_get_boolean(keyfile,
                                             NM_CONFIG_KEYFILE_GROUP_CONFIG,
                                             NM_CONFIG_KEYFILE_KEY_CONFIG_ENABLE,
@@ -751,16 +751,16 @@ _sort_groups_cmp(const char **pa, const char **pb, gpointer dummy)
 
     if (a_is_connection != b_is_connection) {
         /* one is a [connection*] entry, the other not. We sort [connection*] entries
-		 * after.  */
+         * after.  */
         if (a_is_connection)
             return 1;
         return -1;
     }
     if (a_is_connection) {
         /* both are [connection.\+] entries. Reverse their order.
-		 * One of the sections might be literally [connection]. That section
-		 * is special and its order will be fixed later. It doesn't actually
-		 * matter here how it compares with [connection.\+] sections. */
+         * One of the sections might be literally [connection]. That section
+         * is special and its order will be fixed later. It doesn't actually
+         * matter here how it compares with [connection.\+] sections. */
         return pa > pb ? -1 : 1;
     }
 
@@ -769,16 +769,16 @@ _sort_groups_cmp(const char **pa, const char **pb, gpointer dummy)
 
     if (a_is_device != b_is_device) {
         /* one is a [device*] entry, the other not. We sort [device*] entries
-		 * after.  */
+         * after.  */
         if (a_is_device)
             return 1;
         return -1;
     }
     if (a_is_device) {
         /* both are [device.\+] entries. Reverse their order.
-		 * One of the sections might be literally [device]. That section
-		 * is special and its order will be fixed later. It doesn't actually
-		 * matter here how it compares with [device.\+] sections. */
+         * One of the sections might be literally [device]. That section
+         * is special and its order will be fixed later. It doesn't actually
+         * matter here how it compares with [device.\+] sections. */
         return pa > pb ? -1 : 1;
     }
 
@@ -1002,8 +1002,8 @@ read_config(GKeyFile *  keyfile,
         return TRUE;
 
     /* the config-group is internal to every configuration snippets. It doesn't make sense
-	 * to merge it into the global configuration, and it doesn't make sense to preserve the
-	 * group beyond this point. */
+     * to merge it into the global configuration, and it doesn't make sense to preserve the
+     * group beyond this point. */
     g_key_file_remove_group(kf, NM_CONFIG_KEYFILE_GROUP_CONFIG, NULL);
 
     /* Override the current settings with the new ones */
@@ -1012,13 +1012,13 @@ read_config(GKeyFile *  keyfile,
         ngroups = 0;
 
     /* Within one file we reverse the order of the '[connection.\+] sections.
-	 * Here we merge the current file (@kf) into @keyfile. As we merge multiple
-	 * files, earlier sections (with lower priority) will be added first.
-	 * But within one file, we want a top-to-bottom order. This means we
-	 * must reverse the order within each file.
-	 * At the very end, we will revert the order of all sections again and
-	 * get thus the right behavior. This final reversing is done in
-	 * NMConfigData:_get_connection_infos().  */
+     * Here we merge the current file (@kf) into @keyfile. As we merge multiple
+     * files, earlier sections (with lower priority) will be added first.
+     * But within one file, we want a top-to-bottom order. This means we
+     * must reverse the order within each file.
+     * At the very end, we will revert the order of all sections again and
+     * get thus the right behavior. This final reversing is done in
+     * NMConfigData:_get_connection_infos().  */
     _nm_config_sort_groups(groups, ngroups);
 
     for (g = 0; groups && groups[g]; g++) {
@@ -1105,7 +1105,7 @@ read_config(GKeyFile *  keyfile,
                         nm_auto_free_slist GSList *new_specs = nm_match_spec_split(new_sval);
 
                         /* the key is a device spec. This is a special kind of string-list, that
-						 * we must split differently. */
+                         * we must split differently. */
                         old_val = _nm_utils_slist_to_strv(old_specs, FALSE);
                         new_val = _nm_utils_slist_to_strv(new_specs, FALSE);
                     }
@@ -1152,7 +1152,7 @@ read_config(GKeyFile *  keyfile,
                     }
                 } else {
                     /* For any other settings we don't support extending the option with +/-.
-					 * Just drop the key. */
+                     * Just drop the key. */
                 }
                 continue;
             }
@@ -1197,11 +1197,11 @@ read_base_config(GKeyFile *  keyfile,
     }
 
     /* Even though we prefer NetworkManager.conf, we need to check the
-	 * old nm-system-settings.conf first to preserve compat with older
-	 * setups.  In package managed systems dropping a NetworkManager.conf
-	 * onto the system would make NM use it instead of nm-system-settings.conf,
-	 * changing behavior during an upgrade.  We don't want that.
-	 */
+     * old nm-system-settings.conf first to preserve compat with older
+     * setups.  In package managed systems dropping a NetworkManager.conf
+     * onto the system would make NM use it instead of nm-system-settings.conf,
+     * changing behavior during an upgrade.  We don't want that.
+     */
 
     /* Try deprecated nm-system-settings.conf first */
     if (read_config(keyfile, TRUE, NULL, DEFAULT_CONFIG_MAIN_FILE_OLD, warnings, &my_error)) {
@@ -1228,8 +1228,8 @@ read_base_config(GKeyFile *  keyfile,
     g_clear_error(&my_error);
 
     /* If for some reason no config file exists, use the default
-	 * config file path.
-	 */
+     * config file path.
+     */
     *out_config_main_file = g_strdup(DEFAULT_CONFIG_MAIN_FILE);
     _LOGI("No config file found or given; using %s", DEFAULT_CONFIG_MAIN_FILE);
     return TRUE;
@@ -1366,12 +1366,12 @@ read_entire_config(const NMConfigCmdLineOptions *cli,
     }
 
     /* Merge settings from command line. They overwrite everything read from
-	 * config files. */
+     * config files. */
 
     if (cli) {
         if (cli->plugins) {
             /* plugins is a string list. Set the value directly, so the user has to do proper escaping
-			 * on the command line. */
+             * on the command line. */
             g_key_file_set_value(keyfile, NM_CONFIG_KEYFILE_GROUP_MAIN, "plugins", cli->plugins);
         }
 
@@ -1597,8 +1597,8 @@ intern_config_read(const char *       filename,
                 continue;
             }
             /* we must set the "was" marker in our keyfile, so that we know that the section
-			 * from user config is overwritten. The value doesn't matter, it's just a marker
-			 * that this section is present. */
+             * from user config is overwritten. The value doesn't matter, it's just a marker
+             * that this section is present. */
             g_key_file_set_value(keyfile_intern,
                                  group,
                                  NM_CONFIG_KEYFILE_KEY_ATOMIC_SECTION_WAS,
@@ -1631,9 +1631,9 @@ intern_config_read(const char *       filename,
 
                 if (!nm_streq0(value_conf, value_was)) {
                     /* if value_was is no longer the same as @value_conf, it means the user
-					 * changed the configuration since the last write. In this case, we
-					 * drop the value. It also means our file is out-of-date, and we should
-					 * rewrite it. */
+                     * changed the configuration since the last write. In this case, we
+                     * drop the value. It also means our file is out-of-date, and we should
+                     * rewrite it. */
                     needs_rewrite = TRUE;
                     continue;
                 }
@@ -1657,16 +1657,16 @@ intern_config_read(const char *       filename,
 
                 if (!nm_streq0(value_conf, value_was)) {
                     /* if value_was is no longer the same as @value_conf, it means the user
-					 * changed the configuration since the last write. In this case, we
-					 * don't overwrite the user-provided value. It also means our file is
-					 * out-of-date, and we should rewrite it. */
+                     * changed the configuration since the last write. In this case, we
+                     * don't overwrite the user-provided value. It also means our file is
+                     * out-of-date, and we should rewrite it. */
                     needs_rewrite = TRUE;
                     continue;
                 }
                 has_intern = TRUE;
                 /* signal the absence of the value. That means, we must propagate the
-				 * "was" key to NMConfigData, so that it knows to hide the corresponding
-				 * user key. */
+                 * "was" key to NMConfigData, so that it knows to hide the corresponding
+                 * user key. */
                 g_key_file_set_value(keyfile_intern, group, key, "");
             } else
                 needs_rewrite = TRUE;
@@ -1675,11 +1675,11 @@ intern_config_read(const char *       filename,
 
 out:
     /*
-	 * If user configuration specifies global DNS options, the DNS
-	 * options in internal configuration must be deleted. Otherwise, a
-	 * deletion of options from user configuration may cause the
-	 * internal options to appear again.
-	 */
+     * If user configuration specifies global DNS options, the DNS
+     * options in internal configuration must be deleted. Otherwise, a
+     * deletion of options from user configuration may cause the
+     * internal options to appear again.
+     */
     if (nm_config_keyfile_has_global_dns_config(keyfile_conf, FALSE)) {
         if (g_key_file_remove_group(keyfile_intern,
                                     NM_CONFIG_KEYFILE_GROUP_INTERN_GLOBAL_DNS,
@@ -1790,8 +1790,8 @@ intern_config_write(const char *       filename,
                  || (!keys[1] && strcmp(keys[0], NM_CONFIG_KEYFILE_KEY_ATOMIC_SECTION_WAS) == 0))
                 && !g_key_file_has_group(keyfile_conf, group)) {
                 /* we are about to save an atomic section. However, we don't have any additional
-				 * keys on our own and there is no user-provided (overlapping) section either.
-				 * We don't have to write an empty section (i.e. skip the useless ".was=0#"). */
+                 * keys on our own and there is no user-provided (overlapping) section either.
+                 * We don't have to write an empty section (i.e. skip the useless ".was=0#"). */
                 continue;
             } else {
                 gs_free char *conf_section_is = NULL;
@@ -1828,8 +1828,8 @@ intern_config_write(const char *       filename,
 
                 if (NM_STR_HAS_PREFIX_WITH_MORE(key, NM_CONFIG_KEYFILE_KEYPREFIX_SET)) {
                     /* Setting a key with .set prefix has no meaning, as these keys
-					 * are protected. Just set the value you want to set instead.
-					 * Why did this happen?? */
+                     * are protected. Just set the value you want to set instead.
+                     * Why did this happen?? */
                     g_warn_if_reached();
                 } else if (NM_STR_HAS_PREFIX_WITH_MORE(key, NM_CONFIG_KEYFILE_KEYPREFIX_WAS)) {
                     const char *key_base = &key[NM_STRLEN(NM_CONFIG_KEYFILE_KEYPREFIX_WAS)];
@@ -1842,7 +1842,7 @@ intern_config_write(const char *       filename,
 
                     if (g_key_file_has_key(keyfile_intern, group, key_base, NULL)) {
                         /* There is also a matching key_base entry. Skip processing
-						 * the .was. key ad handle the key_base in the other else branch. */
+                         * the .was. key ad handle the key_base in the other else branch. */
                         continue;
                     }
 
@@ -1856,7 +1856,7 @@ intern_config_write(const char *       filename,
                         value_was = g_key_file_get_value(keyfile_conf, group, key, NULL);
                         if (nm_streq0(value_set, value_was)) {
                             /* there is no point in storing the identical value as we have via
-							 * user configuration. Skip it. */
+                             * user configuration. Skip it. */
                             continue;
                         }
                         if (value_was) {
@@ -1933,8 +1933,8 @@ nm_config_get_match_spec(const GKeyFile *keyfile,
     gs_free char *value = NULL;
 
     /* nm_match_spec_split() already supports full escaping and is basically
-	 * a modified version of g_key_file_parse_value_as_string(). So we first read
-	 * the raw value (g_key_file_get_value()), and do the parsing ourselves. */
+     * a modified version of g_key_file_parse_value_as_string(). So we first read
+     * the raw value (g_key_file_get_value()), and do the parsing ourselves. */
     value = g_key_file_get_value((GKeyFile *) keyfile, group, key, NULL);
     if (out_has_key)
         *out_has_key = !!value;
@@ -2120,12 +2120,12 @@ nm_config_set_values(NMConfig *self,
 
     if (allow_write && (new_data || force_rewrite)) {
         /* We write the internal config file based on the user configuration from
-		 * the last load/reload. That is correct, because the intern properties might
-		 * be in accordance to what NM thinks is currently configured. Even if the files
-		 * on disk changed in the meantime.
-		 * But if they changed, on the next reload with might throw away our just
-		 * written data. That is correct, because from NM's point of view, those
-		 * changes on disk happened in any case *after* now. */
+         * the last load/reload. That is correct, because the intern properties might
+         * be in accordance to what NM thinks is currently configured. Even if the files
+         * on disk changed in the meantime.
+         * But if they changed, on the next reload with might throw away our just
+         * written data. That is correct, because from NM's point of view, those
+         * changes on disk happened in any case *after* now. */
         if (*priv->intern_config_file) {
             keyfile_user = _nm_config_data_get_keyfile_user(priv->config_data);
             if (!intern_config_write(priv->intern_config_file,
@@ -2155,7 +2155,7 @@ static const char *
 state_get_filename(const NMConfigCmdLineOptions *cli)
 {
     /* For an empty filename, we assume the user wants to disable
-	 * state. NMConfig will not try to read it nor write it out. */
+     * state. NMConfig will not try to read it nor write it out. */
     if (!cli->state_file)
         return DEFAULT_STATE_FILE;
     return cli->state_file[0] ? cli->state_file : NULL;
@@ -2229,11 +2229,11 @@ nm_config_state_get(NMConfig *self)
 
     if (G_UNLIKELY(!priv->state)) {
         /* read the state from file lazy on first access. The reason is that
-		 * we want to log a failure to read the file via nm-logging.
-		 *
-		 * So we cannot read the state during construction of NMConfig,
-		 * because at that time nm-logging is not yet configured.
-		 */
+         * we want to log a failure to read the file via nm-logging.
+         *
+         * So we cannot read the state during construction of NMConfig,
+         * because at that time nm-logging is not yet configured.
+         */
         priv->state = state_new_from_file(state_get_filename(&priv->cli));
     }
 
@@ -2275,7 +2275,7 @@ state_write(NMConfig *self)
         _LOGD("state: error writing state file \"%s\": %s", filename, error->message);
         g_clear_error(&error);
         /* we leave the state dirty. That potentially means, that we try to
-		 * write the file over and over again, although it isn't possible. */
+         * write the file over and over again, although it isn't possible. */
         priv->state->p.dirty = TRUE;
     } else
         priv->state->p.dirty = FALSE;
@@ -2299,8 +2299,8 @@ _nm_config_state_set(NMConfig *self, gboolean allow_persist, gboolean force_pers
     va_start(ap, force_persist);
 
     /* We expect that the NMConfigRunStatePropertyType is an integer type <= sizeof (int).
-	 * Smaller would be fine, since the variadic arguments get promoted to int.
-	 * Larger would be a problem, also, because we want that "0" is a valid sentinel. */
+     * Smaller would be fine, since the variadic arguments get promoted to int.
+     * Larger would be a problem, also, because we want that "0" is a valid sentinel. */
     G_STATIC_ASSERT_EXPR(sizeof(NMConfigRunStatePropertyType) <= sizeof(int));
 
     while ((property_type = va_arg(ap, int)) != NM_CONFIG_STATE_PROPERTY_NONE) {
@@ -2412,7 +2412,7 @@ _config_device_state_data_new(int ifindex, GKeyFile *kf)
                                              NM_TERNARY_DEFAULT);
 
     /* metric zero is not a valid metric. While zero valid for IPv4, for IPv6 it is an alias
-	 * for 1024. Since we handle here IPv4 and IPv6 the same, we cannot allow zero. */
+     * for 1024. Since we handle here IPv4 and IPv6 the same, we cannot allow zero. */
     route_metric_default_effective = nm_config_keyfile_get_int64(
         kf,
         DEVICE_RUN_STATE_KEYFILE_GROUP_DEVICE,
@@ -2770,9 +2770,9 @@ nm_config_reload(NMConfig *self, NMConfigChangeFlags reload_flags, gboolean emit
     warnings = g_ptr_array_new_with_free_func(g_free);
 
     /* pass on the original command line options. This means, that
-	 * options specified at command line cannot ever be reloaded from
-	 * file. That seems desirable.
-	 */
+     * options specified at command line cannot ever be reloaded from
+     * file. That seems desirable.
+     */
     keyfile = read_entire_config(&priv->cli,
                                  priv->config_dir,
                                  priv->system_config_dir,
@@ -2917,7 +2917,7 @@ nm_config_setup(const NMConfigCmdLineOptions *cli, char **atomic_section_prefixe
         nm_singleton_instance_register();
 
         /* usually, you would not see this logging line because when creating the
-		 * NMConfig instance, the logging is not yet set up to print debug message. */
+         * NMConfig instance, the logging is not yet set up to print debug message. */
         nm_log_dbg(LOGD_CORE,
                    "setup %s singleton (" NM_HASH_OBFUSCATE_PTR_FMT ")",
                    "NMConfig",
diff --git a/src/nm-config.h b/src/nm-config.h
index aa9a6eaec0..bd38d3d082 100644
--- a/src/nm-config.h
+++ b/src/nm-config.h
@@ -238,13 +238,13 @@ struct _NMConfigDeviceStateData {
     guint32 route_metric_default_effective;
 
     /* the UUID of the last settings-connection active
-	 * on the device. */
+     * on the device. */
     const char *connection_uuid;
 
     const char *perm_hw_addr_fake;
 
     /* whether the device was nm-owned (0/1) or -1 for
-	 * non-software devices. */
+     * non-software devices. */
     NMTernary nm_owned : 3;
 };
 
diff --git a/src/nm-connectivity.c b/src/nm-connectivity.c
index 60c5f3c21f..bedcb508ab 100644
--- a/src/nm-connectivity.c
+++ b/src/nm-connectivity.c
@@ -213,7 +213,7 @@ cb_data_complete(NMConnectivityCheckHandle *cb_data,
     self = cb_data->self;
 
     /* mark the handle as completing. After this point, nm_connectivity_check_cancel()
-	 * is no longer possible. */
+     * is no longer possible. */
     cb_data->self = NULL;
 
     c_list_unlink_stale(&cb_data->handles_lst);
@@ -221,12 +221,12 @@ cb_data_complete(NMConnectivityCheckHandle *cb_data,
 #if WITH_CONCHECK
     if (cb_data->concheck.curl_ehandle) {
         /* Contrary to what cURL manual claim it is *not* safe to remove
-		 * the easy handle "at any moment"; specifically it's not safe to
-		 * remove *any* handle from within a libcurl callback. That is
-		 * why we queue completed handles in this case.
-		 *
-		 * cb_data_complete() is however only called *not* from within a
-		 * libcurl callback. So, this is fine. */
+         * the easy handle "at any moment"; specifically it's not safe to
+         * remove *any* handle from within a libcurl callback. That is
+         * why we queue completed handles in this case.
+         *
+         * cb_data_complete() is however only called *not* from within a
+         * libcurl callback. So, this is fine. */
         curl_easy_setopt(cb_data->concheck.curl_ehandle, CURLOPT_WRITEFUNCTION, NULL);
         curl_easy_setopt(cb_data->concheck.curl_ehandle, CURLOPT_WRITEDATA, NULL);
         curl_easy_setopt(cb_data->concheck.curl_ehandle, CURLOPT_HEADERFUNCTION, NULL);
@@ -252,8 +252,8 @@ cb_data_complete(NMConnectivityCheckHandle *cb_data,
     cb_data->callback(self, cb_data, state, cb_data->user_data);
 
     /* Note: self might be a danling pointer at this point. It must not be used
-	 * after this point, and all callers must either take a reference first, or
-	 * not use the self pointer too. */
+     * after this point, and all callers must either take a reference first, or
+     * not use the self pointer too. */
 
 #if WITH_CONCHECK
     _con_config_unref(cb_data->concheck.con_config);
@@ -368,8 +368,8 @@ _con_curl_check_connectivity(CURLM *mhandle, int sockfd, int ev_bitmask)
                 == CURLE_OK)) {
             if (response_code == 204) {
                 /* We expected an empty response, and we got a 204 response code (no content).
-				 * We may or may not have received any content (we would ignore it).
-				 * Anyway, the response_code 204 means we are good. */
+                 * We may or may not have received any content (we would ignore it).
+                 * Anyway, the response_code 204 means we are good. */
                 cb_data_queue_completed(cb_data,
                                         NM_CONNECTIVITY_FULL,
                                         "no content, as expected",
@@ -388,16 +388,16 @@ _con_curl_check_connectivity(CURLM *mhandle, int sockfd, int ev_bitmask)
         }
 
         /* If we get here, it means that easy_write_cb() didn't read enough
-		 * bytes to be able to do a match, or that we were asking for no content
-		 * (204 response code) and we actually got some. Either way, that is
-		 * an indication of a captive portal */
+         * bytes to be able to do a match, or that we were asking for no content
+         * (204 response code) and we actually got some. Either way, that is
+         * an indication of a captive portal */
         cb_data_queue_completed(cb_data, NM_CONNECTIVITY_PORTAL, "unexpected short response", NULL);
     }
 
     /* if we return a failure, we don't know what went wrong. It's likely serious, because
-	 * a failure here is not expected. Return FALSE, so that we stop polling the file descriptor.
-	 * Worst case, this leaves the pending connectivity check unhandled, until our regular
-	 * time-out kicks in. */
+     * a failure here is not expected. Return FALSE, so that we stop polling the file descriptor.
+     * Worst case, this leaves the pending connectivity check unhandled, until our regular
+     * time-out kicks in. */
     return success;
 }
 
@@ -428,10 +428,10 @@ typedef struct {
     GSource *source;
 
     /* this is a very simplistic weak-pointer. If ConCurlSockData gets
-	 * destroyed, it will set *destroy_notify to TRUE.
-	 *
-	 * _con_curl_socketevent_cb() uses this to detect whether it can
-	 * safely access @fdp after _con_curl_check_connectivity(). */
+     * destroyed, it will set *destroy_notify to TRUE.
+     *
+     * _con_curl_socketevent_cb() uses this to detect whether it can
+     * safely access @fdp after _con_curl_check_connectivity(). */
     gboolean *destroy_notify;
 
 } ConCurlSockData;
@@ -459,7 +459,7 @@ _con_curl_socketevent_cb(int fd, GIOCondition condition, gpointer user_data)
 
     if (fdp_destroyed) {
         /* hups. fdp got invalidated during _con_curl_check_connectivity(). That's fine,
-		 * just don't touch it. */
+         * just don't touch it. */
     } else {
         nm_assert(fdp->destroy_notify == &fdp_destroyed);
         fdp->destroy_notify = NULL;
@@ -566,24 +566,24 @@ easy_write_cb(void *buffer, size_t size, size_t nmemb, void *userdata)
 
     if (response[0] == '\0') {
         /* no response expected. We are however graceful and accept any
-		 * extra response that we might receive. We determine the empty
-		 * response based on the status code 204.
-		 *
-		 * Continue receiving... */
+         * extra response that we might receive. We determine the empty
+         * response based on the status code 204.
+         *
+         * Continue receiving... */
         cb_data->concheck.response_good_cnt += len;
 
         if (cb_data->concheck.response_good_cnt > (gsize)(100 * 1024)) {
             /* we expect an empty response. We accept either
-			 * 1) status code 204 and any response
-			 * 2) status code 200 and an empty response.
-			 *
-			 * Here, we want to continue receiving data, to see whether we have
-			 * case 1). Arguably, the server shouldn't send us 204 with a non-empty
-			 * response, but we accept that also with a non-empty response, so
-			 * keep receiving.
-			 *
-			 * However, if we get an excessive amount of data, we put a stop on it
-			 * and fail. */
+             * 1) status code 204 and any response
+             * 2) status code 200 and an empty response.
+             *
+             * Here, we want to continue receiving data, to see whether we have
+             * case 1). Arguably, the server shouldn't send us 204 with a non-empty
+             * response, but we accept that also with a non-empty response, so
+             * keep receiving.
+             *
+             * However, if we get an excessive amount of data, we put a stop on it
+             * and fail. */
             cb_data_queue_completed(cb_data,
                                     NM_CONNECTIVITY_PORTAL,
                                     "unexpected non-empty response",
@@ -887,23 +887,23 @@ nm_connectivity_check_start(NMConnectivity *            self,
         }
 
         /* note that we pick up support for systemd-resolved right away when we need it.
-		 * We don't need to remember the setting, because we can (cheaply) check anew
-		 * on each request.
-		 *
-		 * Yes, this makes NMConnectivity singleton dependent on NMDnsManager singleton.
-		 * Well, not really: it makes connectivity-check-start dependent on NMDnsManager
-		 * which merely means, not to start a connectivity check, late during shutdown.
-		 *
-		 * NMDnsSystemdResolved tries to D-Bus activate systemd-resolved only once,
-		 * to not spam syslog with failures messages from dbus-daemon.
-		 * Note that unless NMDnsSystemdResolved tried and failed to start systemd-resolved,
-		 * it guesses that systemd-resolved is activatable and returns %TRUE here. That
-		 * means, while NMDnsSystemdResolved would not try to D-Bus activate systemd-resolved
-		 * more than once, NMConnectivity might -- until NMDnsSystemdResolved tried itself
-		 * and noticed that systemd-resolved is not available.
-		 * This is relatively cumbersome to avoid, because we would have to go through
-		 * NMDnsSystemdResolved trying to asynchronously start the service, to ensure there
-		 * is only one attempt to start the service. */
+         * We don't need to remember the setting, because we can (cheaply) check anew
+         * on each request.
+         *
+         * Yes, this makes NMConnectivity singleton dependent on NMDnsManager singleton.
+         * Well, not really: it makes connectivity-check-start dependent on NMDnsManager
+         * which merely means, not to start a connectivity check, late during shutdown.
+         *
+         * NMDnsSystemdResolved tries to D-Bus activate systemd-resolved only once,
+         * to not spam syslog with failures messages from dbus-daemon.
+         * Note that unless NMDnsSystemdResolved tried and failed to start systemd-resolved,
+         * it guesses that systemd-resolved is activatable and returns %TRUE here. That
+         * means, while NMDnsSystemdResolved would not try to D-Bus activate systemd-resolved
+         * more than once, NMConnectivity might -- until NMDnsSystemdResolved tried itself
+         * and noticed that systemd-resolved is not available.
+         * This is relatively cumbersome to avoid, because we would have to go through
+         * NMDnsSystemdResolved trying to asynchronously start the service, to ensure there
+         * is only one attempt to start the service. */
         has_systemd_resolved = nm_dns_manager_has_systemd_resolved(nm_dns_manager_get());
 
         if (has_systemd_resolved) {
@@ -912,8 +912,8 @@ nm_connectivity_check_start(NMConnectivity *            self,
             dbus_connection = NM_MAIN_DBUS_CONNECTION_GET;
             if (!dbus_connection) {
                 /* we have no D-Bus connection? That might happen in configure and quit mode.
-				 *
-				 * Anyway, something is very odd, just fail connectivity check. */
+                 *
+                 * Anyway, something is very odd, just fail connectivity check. */
                 _LOG2D("start fake request (fail due to no D-Bus connection)");
                 cb_data->completed_state  = NM_CONNECTIVITY_ERROR;
                 cb_data->completed_reason = "no D-Bus connection";
diff --git a/src/nm-core-utils.c b/src/nm-core-utils.c
index 123545df0c..3e3b3db213 100644
--- a/src/nm-core-utils.c
+++ b/src/nm-core-utils.c
@@ -78,7 +78,7 @@ again:
     }
 
     /* Accessing nm_utils_get_testing() causes us to set the flags to initialized.
-	 * Detecting running tests also based on g_test_initialized(). */
+     * Detecting running tests also based on g_test_initialized(). */
     flags = _NM_UTILS_TEST_INITIALIZED;
     if (g_test_initialized())
         flags |= _NM_UTILS_TEST_GENERAL;
@@ -86,7 +86,7 @@ again:
     g_atomic_int_compare_and_exchange(&_nm_utils_testing, 0, (int) flags);
 
     /* regardless of whether we won the race of initializing _nm_utils_testing,
-	 * go back and read the value again. It must be non-zero by now. */
+     * go back and read the value again. It must be non-zero by now. */
     goto again;
 }
 
@@ -100,7 +100,7 @@ _nm_utils_set_testing(NMUtilsTestFlags flags)
 
     if (!g_atomic_int_compare_and_exchange(&_nm_utils_testing, 0, (int) flags)) {
         /* We only allow setting _nm_utils_set_testing() once, before fetching the
-		 * value with nm_utils_get_testing(). */
+         * value with nm_utils_get_testing(). */
         g_return_if_reached();
     }
 }
@@ -146,7 +146,7 @@ _nm_singleton_instance_register_destruction(GObject *instance)
     g_return_if_fail(G_IS_OBJECT(instance));
 
     /* Don't allow registration after shutdown. We only destroy the singletons
-	 * once. */
+     * once. */
     g_return_if_fail(!_singletons_shutdown);
 
     g_object_weak_ref(instance, _nm_singleton_instance_weak_cb, NULL);
@@ -267,7 +267,7 @@ nm_utils_array_remove_at_indexes(GArray *array, const guint *indexes_to_delete,
             mm_len++;
         else {
             /* we require indexes_to_delete to contain non-repeated, ascending
-			 * indexes. Otherwise, we would need to presort the indexes. */
+             * indexes. Otherwise, we would need to presort the indexes. */
             while (TRUE) {
                 guint dd;
 
@@ -866,7 +866,7 @@ nm_utils_kill_child_sync(pid_t       pid,
             sleep_time = MIN(wait_until - now, sleep_duration_usec);
             if (loop_count < 20) {
                 /* At the beginning we expect the process to die fast.
-				 * Limit the sleep time, the limit doubles with every iteration. */
+                 * Limit the sleep time, the limit doubles with every iteration. */
                 sleep_time = MIN(sleep_time, (((guint64) 1) << loop_count) * G_USEC_PER_SEC / 2000);
                 loop_count++;
             }
@@ -1104,8 +1104,8 @@ nm_utils_kill_process_sync(pid_t       pid,
         if (max_wait_until != 0 && now >= max_wait_until) {
             if (wait_until_sigkill != 0) {
                 /* wait_before_kill_msec is not larger then max_wait_until but we did not yet send
-				 * SIGKILL. Although we already reached our timeout, we don't want to skip sending
-				 * the signal. Even if we don't wait for the process to disappear. */
+                 * SIGKILL. Although we already reached our timeout, we don't want to skip sending
+                 * the signal. Even if we don't wait for the process to disappear. */
                 nm_log_dbg(log_domain, LOG_NAME_PROCESS_FMT ": sending SIGKILL", LOG_NAME_ARGS);
                 kill(pid, SIGKILL);
             }
@@ -1180,7 +1180,7 @@ nm_utils_kill_process_sync(pid_t       pid,
 
         if (loop_count < 20) {
             /* At the beginning we expect the process to die fast.
-			 * Limit the sleep time, the limit doubles with every iteration. */
+             * Limit the sleep time, the limit doubles with every iteration. */
             sleep_time = MIN(sleep_time, (((guint64) 1) << loop_count) * G_USEC_PER_SEC / 2000);
             loop_count++;
         }
@@ -1241,10 +1241,10 @@ nm_utils_read_link_absolute(const char *link_file, GError **error)
         gs_free char *current_dir = g_get_current_dir();
 
         /* @link_file argument was not an absolute path in the first place.
-		 * That actually may be a bug, because the CWD is not well defined
-		 * in most cases. Anyway, apparently we were able to load the file
-		 * even from a relative path. So, when making the link absolute, we
-		 * also need to prepend the CWD. */
+         * That actually may be a bug, because the CWD is not well defined
+         * in most cases. Anyway, apparently we were able to load the file
+         * even from a relative path. So, when making the link absolute, we
+         * also need to prepend the CWD. */
         ln_abs = g_build_filename(current_dir, dirname, ln, NULL);
     } else
         ln_abs = g_build_filename(dirname, ln, NULL);
@@ -1312,8 +1312,8 @@ match_device_s390_subchannels_parse(const char *s390_subchannels,
         if (!g_ascii_isxdigit(ch) && ch != '.') {
             if (ch == ',') {
                 /* FIXME: currently we consider the first channel and ignore
-				 * everything after the first ',' separator. Maybe we should
-				 * validate all present channels? */
+                 * everything after the first ',' separator. Maybe we should
+                 * validate all present channels? */
                 break;
             }
             return FALSE; /* Invalid chars */
@@ -1420,11 +1420,11 @@ _match_result(gboolean has_except,
         nm_assert(!has_match);
         if (has_match_except) {
             /* one of the "except:" matches matched. The result is an explicit
-			 * negative match. */
+             * negative match. */
             return NM_MATCH_SPEC_NEG_MATCH;
         } else {
             /* none of the "except:" matches matched. The result is a positive match,
-			 * despite there being no positive match. */
+             * despite there being no positive match. */
             return NM_MATCH_SPEC_MATCH;
         }
     }
@@ -1486,20 +1486,20 @@ match_device_eval(const char *spec_str, gboolean allow_fuzzy, MatchDeviceData *m
             return FALSE;
 
         /* support:
-		 * 1) "${DRIVER}"
-		 *   In this case, DRIVER may not contain a '/' character.
-		 *   It matches any driver version.
-		 * 2) "${DRIVER}/${DRIVER_VERSION}"
-		 *   In this case, DRIVER may contains '/' but DRIVER_VERSION
-		 *   may not. A '/' in DRIVER_VERSION may be replaced by '?'.
-		 *
-		 * It follows, that "${DRIVER}/""*" is like 1), but allows
-		 * '/' inside DRIVER.
-		 *
-		 * The fields match to what `nmcli -f GENERAL.DRIVER,GENERAL.DRIVER-VERSION device show`
-		 * gives. However, DRIVER matches literally, while DRIVER_VERSION is a glob
-		 * supporting ? and *.
-		 */
+         * 1) "${DRIVER}"
+         *   In this case, DRIVER may not contain a '/' character.
+         *   It matches any driver version.
+         * 2) "${DRIVER}/${DRIVER_VERSION}"
+         *   In this case, DRIVER may contains '/' but DRIVER_VERSION
+         *   may not. A '/' in DRIVER_VERSION may be replaced by '?'.
+         *
+         * It follows, that "${DRIVER}/""*" is like 1), but allows
+         * '/' inside DRIVER.
+         *
+         * The fields match to what `nmcli -f GENERAL.DRIVER,GENERAL.DRIVER-VERSION device show`
+         * gives. However, DRIVER matches literally, while DRIVER_VERSION is a glob
+         * supporting ? and *.
+         */
 
         t = strrchr(spec_str, '/');
 
@@ -1748,7 +1748,7 @@ nm_match_spec_split(const char *value)
         return NULL;
 
     /* Copied from glibs g_key_file_parse_value_as_string() function
-	 * and adjusted. */
+     * and adjusted. */
 
     string_value = g_new(char, strlen(value) + 1);
 
@@ -2103,12 +2103,12 @@ nm_utils_new_infiniband_name(char *name, const char *parent_name, int p_key)
     g_return_val_if_fail(strlen(parent_name) < IFNAMSIZ, NULL);
 
     /* technically, p_key of 0x0000 and 0x8000 is not allowed either. But we don't
-	 * want to assert against that in nm_utils_new_infiniband_name(). So be more
-	 * resilient here, and accept those. */
+     * want to assert against that in nm_utils_new_infiniband_name(). So be more
+     * resilient here, and accept those. */
     g_return_val_if_fail(p_key >= 0 && p_key <= 0xffff, NULL);
 
     /* If parent+suffix is too long, kernel would just truncate
-	 * the name. We do the same. See ipoib_vlan_add().  */
+     * the name. We do the same. See ipoib_vlan_add().  */
     g_snprintf(name, IFNAMSIZ, "%s.%04x", parent_name, p_key);
     return name;
 }
@@ -2240,7 +2240,7 @@ _log_connection_sort_names_fcn(gconstpointer a, gconstpointer b)
     const LogConnectionSettingItem *v2 = b;
 
     /* we want to first show the items, that disappeared, then the one that changed and
-	 * then the ones that were added. */
+     * then the ones that were added. */
 
     if ((v1->diff_result & NM_SETTING_DIFF_RESULT_IN_A)
         != (v2->diff_result & NM_SETTING_DIFF_RESULT_IN_A))
@@ -2383,7 +2383,7 @@ nm_utils_log_connection_diff(NMConnection *connection,
     }
 
     /* FIXME: it doesn't nicely show the content of NMSettingVpn, because nm_connection_diff() does not
-	 * expand the hash values. */
+     * expand the hash values. */
 
     sorted_hashes = _log_connection_sort_hashes(connection, diff_base, connection_diff);
     if (sorted_hashes->len <= 0)
@@ -2679,11 +2679,11 @@ typedef struct {
         _nul_sentinel; /* just for safety, if somebody accidentally uses the binary in a string context. */
 
     /* depending on whether the string is packed or not (with/without hyphens),
-	 * it's 32 or 36 characters long (plus the trailing NUL).
-	 *
-	 * The difference is that boot-id is a valid RFC 4211 UUID and represented
-	 * as a 36 ascii string (with hyphens). The machine-id technically is not
-	 * a UUID, but just a 32 byte sequence of hexchars. */
+     * it's 32 or 36 characters long (plus the trailing NUL).
+     *
+     * The difference is that boot-id is a valid RFC 4211 UUID and represented
+     * as a 36 ascii string (with hyphens). The machine-id technically is not
+     * a UUID, but just a 32 byte sequence of hexchars. */
     char str[37];
     bool is_fake;
 } UuidData;
@@ -2726,9 +2726,9 @@ again:
         NMUuid          uuid;
 
         /* Get the machine ID from /etc/machine-id; it's always in /etc no matter
-		 * where our configured SYSCONFDIR is.  Alternatively, it might be in
-		 * LOCALSTATEDIR /lib/dbus/machine-id.
-		 */
+         * where our configured SYSCONFDIR is.  Alternatively, it might be in
+         * LOCALSTATEDIR /lib/dbus/machine-id.
+         */
         if (nm_utils_file_get_contents(-1,
                                        "/etc/machine-id",
                                        100 * 1024,
@@ -2769,29 +2769,29 @@ again:
 
             if (!allow_fake) {
                 /* we don't allow generating (and memorizing) a fake key.
-				 * Signal that no valid machine-id exists. */
+                 * Signal that no valid machine-id exists. */
                 return NULL;
             }
 
             if (nm_utils_host_id_get(&seed_bin, &seed_len)) {
                 /* We have no valid machine-id but we have a valid secrey_key.
-				 * Generate a fake machine ID by hashing the secret-key. The secret_key
-				 * is commonly persisted, so it should be stable across reboots (despite
-				 * having a broken system without proper machine-id).
-				 *
-				 * Note that we access the host-id here, which is based on secret_key.
-				 * Also not that the secret_key may be generated based on the machine-id,
-				 * so we have to be careful that they don't depend on each other (and
-				 * no infinite recursion happens. This is done correctly, because the secret-key
-				 * will call _machine_id_get(FALSE), so it won't allow accessing a fake
-				 * machine-id, thus avoiding the problem. */
+                 * Generate a fake machine ID by hashing the secret-key. The secret_key
+                 * is commonly persisted, so it should be stable across reboots (despite
+                 * having a broken system without proper machine-id).
+                 *
+                 * Note that we access the host-id here, which is based on secret_key.
+                 * Also not that the secret_key may be generated based on the machine-id,
+                 * so we have to be careful that they don't depend on each other (and
+                 * no infinite recursion happens. This is done correctly, because the secret-key
+                 * will call _machine_id_get(FALSE), so it won't allow accessing a fake
+                 * machine-id, thus avoiding the problem. */
                 fake_type = "secret-key";
                 hash_seed = "ab085f06-b629-46d1-a553-84eeba5683b6";
             } else {
                 /* the secret-key is not valid/persistent either. That happens when we fail
-				 * to read/write the secret-key to disk. Fallback to boot-id. The boot-id
-				 * itself may be fake and randomly generated ad-hoc, but that is as best
-				 * as it gets.  */
+                 * to read/write the secret-key to disk. Fallback to boot-id. The boot-id
+                 * itself may be fake and randomly generated ad-hoc, but that is as best
+                 * as it gets.  */
                 seed_bin  = (const guint8 *) nm_utils_boot_id_bin();
                 seed_len  = sizeof(NMUuid);
                 fake_type = "boot-id";
@@ -2799,7 +2799,7 @@ again:
             }
 
             /* the fake machine-id is based on secret-key/boot-id, but we hash it
-			 * again, so that they are not literally the same. */
+             * again, so that they are not literally the same. */
             nm_utils_uuid_generate_from_string_bin(&uuid,
                                                    (const char *) seed_bin,
                                                    seed_len,
@@ -2862,25 +2862,25 @@ _host_id_read_timestamp(gboolean      use_secret_key_file,
 
     if (use_secret_key_file && stat(SECRET_KEY_FILE, &st) == 0) {
         /* don't check for overflow or timestamps in the future. We get whatever
-		 * (bogus) date is on the file. */
+         * (bogus) date is on the file. */
         *out_timestamp_ns = nm_utils_timespec_to_nsec(&st.st_mtim);
         return TRUE;
     }
 
     /* generate a fake timestamp based on the host-id.
-	 *
-	 * This really should never happen under normal circumstances. We already
-	 * are in a code path, where the system has a problem (unable to get good randomness
-	 * and/or can't access the secret_key). In such a scenario, a fake timestamp is the
-	 * least of our problems.
-	 *
-	 * At least, generate something sensible so we don't have to worry about the
-	 * timestamp. It is wrong to worry about using a fake timestamp (which is tied to
-	 * the secret_key) if we are unable to access the secret_key file in the first place.
-	 *
-	 * Pick a random timestamp from the past two years. Yes, this timestamp
-	 * is not stable across restarts, but apparently neither is the host-id
-	 * nor the secret_key itself. */
+     *
+     * This really should never happen under normal circumstances. We already
+     * are in a code path, where the system has a problem (unable to get good randomness
+     * and/or can't access the secret_key). In such a scenario, a fake timestamp is the
+     * least of our problems.
+     *
+     * At least, generate something sensible so we don't have to worry about the
+     * timestamp. It is wrong to worry about using a fake timestamp (which is tied to
+     * the secret_key) if we are unable to access the secret_key file in the first place.
+     *
+     * Pick a random timestamp from the past two years. Yes, this timestamp
+     * is not stable across restarts, but apparently neither is the host-id
+     * nor the secret_key itself. */
 
 #define EPOCH_TWO_YEARS (G_GINT64_CONSTANT(2 * 365 * 24 * 3600) * NM_UTILS_NSEC_PER_SEC)
 
@@ -2952,18 +2952,18 @@ _host_id_read(guint8 **out_host_id, gsize *out_host_id_len)
                && memcmp(file_content.bin, SECRET_KEY_V2_PREFIX, NM_STRLEN(SECRET_KEY_V2_PREFIX))
                       == 0) {
         /* for this type of secret key, we require a prefix followed at least SECRET_KEY_LEN (32) bytes. We
-		 * (also) do that, because older versions of NetworkManager wrote exactly 32 bytes without
-		 * prefix, so we won't wrongly interpret such legacy keys as v2 (if they accidentally have
-		 * a SECRET_KEY_V2_PREFIX prefix, they'll still have the wrong size).
-		 *
-		 * Note that below we generate the random seed in base64 encoding. But that is only done
-		 * to write an ASCII file. There is no base64 decoding and the ASCII is hashed as-is.
-		 * We would accept any binary data just as well (provided a suitable prefix and at least
-		 * 32 bytes).
-		 *
-		 * Note that when hashing the v2 content, we also hash the prefix. There is no strong reason,
-		 * except that it seems simpler not to distinguish between the v2 prefix and the content.
-		 * It's all just part of the seed. */
+         * (also) do that, because older versions of NetworkManager wrote exactly 32 bytes without
+         * prefix, so we won't wrongly interpret such legacy keys as v2 (if they accidentally have
+         * a SECRET_KEY_V2_PREFIX prefix, they'll still have the wrong size).
+         *
+         * Note that below we generate the random seed in base64 encoding. But that is only done
+         * to write an ASCII file. There is no base64 decoding and the ASCII is hashed as-is.
+         * We would accept any binary data just as well (provided a suitable prefix and at least
+         * 32 bytes).
+         *
+         * Note that when hashing the v2 content, we also hash the prefix. There is no strong reason,
+         * except that it seems simpler not to distinguish between the v2 prefix and the content.
+         * It's all just part of the seed. */
 
         secret_arr = _host_id_hash_v2(file_content.bin, file_content.len, sha256_digest);
         secret_len = NM_UTILS_CHECKSUM_LENGTH_SHA256;
@@ -2984,7 +2984,7 @@ _host_id_read(guint8 **out_host_id, gsize *out_host_id_len)
         goto out;
     } else {
         /* the secret key is borked. Log a warning, but proceed below to generate
-		 * a new one. */
+         * a new one. */
         nm_log_warn(LOGD_CORE,
                     "secret-key: too short secret key in \"%s\" (generate new key)",
                     SECRET_KEY_FILE);
@@ -3002,10 +3002,10 @@ _host_id_read(guint8 **out_host_id, gsize *out_host_id_len)
         success = nm_utils_random_bytes(rnd_buf, sizeof(rnd_buf));
 
         /* Our key is really binary data. But since we anyway generate a random seed
-		 * (with 32 random bytes), don't write it in binary, but instead create
-		 * an pure ASCII (base64) representation. Note that the ASCII will still be taken
-		 * as-is (no base64 decoding is done). The sole purpose is to write a ASCII file
-		 * instead of a binary. The content is gibberish either way. */
+         * (with 32 random bytes), don't write it in binary, but instead create
+         * an pure ASCII (base64) representation. Note that the ASCII will still be taken
+         * as-is (no base64 decoding is done). The sole purpose is to write a ASCII file
+         * instead of a binary. The content is gibberish either way. */
         memcpy(new_content, SECRET_KEY_V2_PREFIX, NM_STRLEN(SECRET_KEY_V2_PREFIX));
         len = NM_STRLEN(SECRET_KEY_V2_PREFIX);
         len += g_base64_encode_step(rnd_buf,
@@ -3252,8 +3252,8 @@ nm_utils_arp_type_detect_from_hwaddrlen(gsize hwaddr_len)
         return ARPHRD_INFINIBAND;
     default:
         /* Note: if you ever support anything but ethernet and infiniband,
-		 * make sure to look at all callers. They assert that it's one of
-		 * these two. */
+         * make sure to look at all callers. They assert that it's one of
+         * these two. */
         return -EINVAL;
     }
 }
@@ -3361,9 +3361,9 @@ nm_utils_get_ipv6_interface_identifier(NMLinkType          link_type,
     switch (link_type) {
     case NM_LINK_TYPE_INFINIBAND:
         /* Use the port GUID per http://tools.ietf.org/html/rfc4391#section-8,
-		 * making sure to set the 'u' bit to 1.  The GUID is the lower 64 bits
-		 * of the IPoIB interface's hardware address.
-		 */
+         * making sure to set the 'u' bit to 1.  The GUID is the lower 64 bits
+         * of the IPoIB interface's hardware address.
+         */
         g_return_val_if_fail(hwaddr_len == INFINIBAND_ALEN, FALSE);
         memcpy(out_iid->id_u8, hwaddr + INFINIBAND_ALEN - 8, 8);
         out_iid->id_u8[0] |= 0x02;
@@ -3386,9 +3386,9 @@ nm_utils_get_ipv6_interface_identifier(NMLinkType          link_type,
     default:
         if (hwaddr_len == ETH_ALEN) {
             /* Translate 48-bit MAC address to a 64-bit Modified EUI-64.  See
-			 * http://tools.ietf.org/html/rfc4291#appendix-A and the Linux
-			 * kernel's net/ipv6/addrconf.c::ipv6_generate_eui64() function.
-			 */
+             * http://tools.ietf.org/html/rfc4291#appendix-A and the Linux
+             * kernel's net/ipv6/addrconf.c::ipv6_generate_eui64() function.
+             */
             out_iid->id_u8[0] = hwaddr[0];
             out_iid->id_u8[1] = hwaddr[1];
             out_iid->id_u8[2] = hwaddr[2];
@@ -3512,9 +3512,9 @@ nm_utils_stable_id_generated_complete(const char *stable_id_generated)
     char *                           base64;
 
     /* for NM_UTILS_STABLE_TYPE_GENERATED we generate a possibly long string
-	 * by doing text-substitutions in nm_utils_stable_id_parse().
-	 *
-	 * Let's shorten the (possibly) long stable_id to something more compact. */
+     * by doing text-substitutions in nm_utils_stable_id_parse().
+     *
+     * Let's shorten the (possibly) long stable_id to something more compact. */
 
     g_return_val_if_fail(stable_id_generated, NULL);
 
@@ -3523,8 +3523,8 @@ nm_utils_stable_id_generated_complete(const char *stable_id_generated)
     nm_utils_checksum_get_digest(sum, buf);
 
     /* we don't care to use the sha1 sum in common hex representation.
-	 * Use instead base64, it's 27 chars (stripping the padding) vs.
-	 * 40. */
+     * Use instead base64, it's 27 chars (stripping the padding) vs.
+     * 40. */
 
     base64 = g_base64_encode((guchar *) buf, sizeof(buf));
     nm_assert(strlen(base64) == 28);
@@ -3561,41 +3561,41 @@ nm_utils_stable_id_parse(const char *stable_id,
     }
 
     /* the stable-id allows for some dynamic by performing text-substitutions
-	 * of ${...} patterns.
-	 *
-	 * At first, it looks a bit like bash parameter substitution.
-	 * In contrast however, the process is unambiguous so that the resulting
-	 * effective id differs if:
-	 *  - the original, untranslated stable-id differs
-	 *  - or any of the subsitutions differs.
-	 *
-	 * The reason for that is, for example if you specify "${CONNECTION}" in the
-	 * stable-id, then the resulting ID should be always(!) unique for this connection.
-	 * There should be no way another connection could specify any stable-id that results
-	 * in the same addresses to be generated (aside hash collisions).
-	 *
-	 *
-	 * For example: say you have a connection with UUID
-	 * "123e4567-e89b-12d3-a456-426655440000" which happens also to be
-	 * the current boot-id.
-	 * Then:
-	 *   (1) connection.stable-id = <NULL>
-	 *   (2) connection.stable-id = "123e4567-e89b-12d3-a456-426655440000"
-	 *   (3) connection.stable-id = "${CONNECTION}"
-	 *   (3) connection.stable-id = "${BOOT}"
-	 * will all generate different addresses, although in one way or the
-	 * other, they all mangle the uuid "123e4567-e89b-12d3-a456-426655440000".
-	 *
-	 * For example, with stable-id="${FOO}${BAR}" the substitutions
-	 *   - FOO="ab", BAR="c"
-	 *   - FOO="a",  BAR="bc"
-	 * should give a different effective id.
-	 *
-	 * For example, with FOO="x" and BAR="x", the stable-ids
-	 *   - "${FOO}${BAR}"
-	 *   - "${BAR}${FOO}"
-	 * should give a different effective id.
-	 */
+     * of ${...} patterns.
+     *
+     * At first, it looks a bit like bash parameter substitution.
+     * In contrast however, the process is unambiguous so that the resulting
+     * effective id differs if:
+     *  - the original, untranslated stable-id differs
+     *  - or any of the subsitutions differs.
+     *
+     * The reason for that is, for example if you specify "${CONNECTION}" in the
+     * stable-id, then the resulting ID should be always(!) unique for this connection.
+     * There should be no way another connection could specify any stable-id that results
+     * in the same addresses to be generated (aside hash collisions).
+     *
+     *
+     * For example: say you have a connection with UUID
+     * "123e4567-e89b-12d3-a456-426655440000" which happens also to be
+     * the current boot-id.
+     * Then:
+     *   (1) connection.stable-id = <NULL>
+     *   (2) connection.stable-id = "123e4567-e89b-12d3-a456-426655440000"
+     *   (3) connection.stable-id = "${CONNECTION}"
+     *   (3) connection.stable-id = "${BOOT}"
+     * will all generate different addresses, although in one way or the
+     * other, they all mangle the uuid "123e4567-e89b-12d3-a456-426655440000".
+     *
+     * For example, with stable-id="${FOO}${BAR}" the substitutions
+     *   - FOO="ab", BAR="c"
+     *   - FOO="a",  BAR="bc"
+     * should give a different effective id.
+     *
+     * For example, with FOO="x" and BAR="x", the stable-ids
+     *   - "${FOO}${BAR}"
+     *   - "${BAR}${FOO}"
+     * should give a different effective id.
+     */
 
     idx_start = 0;
     for (i = 0; stable_id[i];) {
@@ -3628,30 +3628,30 @@ nm_utils_stable_id_parse(const char *stable_id,
             _stable_id_append(str, hwaddr);
         else if (g_str_has_prefix(&stable_id[i], "${RANDOM}")) {
             /* RANDOM makes not so much sense for cloned-mac-address
-			 * as the result is similar to specifying "cloned-mac-address=random".
-			 * It makes however sense for RFC 7217 Stable Privacy IPv6 addresses
-			 * where this is effectively the only way to generate a different
-			 * (random) host identifier for each connect.
-			 *
-			 * With RANDOM, the user can switch the lifetime of the
-			 * generated cloned-mac-address and IPv6 host identifier
-			 * by toggling only the stable-id property of the connection.
-			 * With RANDOM being the most short-lived, ~non-stable~ variant.
-			 */
+             * as the result is similar to specifying "cloned-mac-address=random".
+             * It makes however sense for RFC 7217 Stable Privacy IPv6 addresses
+             * where this is effectively the only way to generate a different
+             * (random) host identifier for each connect.
+             *
+             * With RANDOM, the user can switch the lifetime of the
+             * generated cloned-mac-address and IPv6 host identifier
+             * by toggling only the stable-id property of the connection.
+             * With RANDOM being the most short-lived, ~non-stable~ variant.
+             */
             if (str)
                 g_string_free(str, TRUE);
             *out_generated = NULL;
             return NM_UTILS_STABLE_TYPE_RANDOM;
         } else {
             /* The text following the '$' is not recognized as valid
-			 * substitution pattern. Treat it verbatim. */
+             * substitution pattern. Treat it verbatim. */
             i++;
 
             /* Note that using unrecognized substitution patterns might
-			 * yield different results with future versions. Avoid that,
-			 * by not using '$' (except for actual substitutions) or escape
-			 * it as "$$" (which is guaranteed to be treated verbatim
-			 * in future). */
+             * yield different results with future versions. Avoid that,
+             * by not using '$' (except for actual substitutions) or escape
+             * it as "$$" (which is guaranteed to be treated verbatim
+             * in future). */
             if (stable_id[i] == '$')
                 i++;
         }
@@ -3682,8 +3682,8 @@ _is_reserved_ipv6_iid(const guint8 *iid)
         return TRUE;
 
     /* 0200:5EFF:FE00:0000 - 0200:5EFF:FE00:5212 (Reserved IPv6 Interface Identifiers corresponding to the IANA Ethernet Block [RFC4291])
-	 * 0200:5EFF:FE00:5213                       (Proxy Mobile IPv6 [RFC6543])
-	 * 0200:5EFF:FE00:5214 - 0200:5EFF:FEFF:FFFF (Reserved IPv6 Interface Identifiers corresponding to the IANA Ethernet Block [RFC4291]) */
+     * 0200:5EFF:FE00:5213                       (Proxy Mobile IPv6 [RFC6543])
+     * 0200:5EFF:FE00:5214 - 0200:5EFF:FEFF:FFFF (Reserved IPv6 Interface Identifiers corresponding to the IANA Ethernet Block [RFC4291]) */
     if (memcmp(iid, (const guint8[]){0x02, 0x00, 0x5E, 0xFF, 0xFE}, 5) == 0)
         return TRUE;
 
@@ -3724,14 +3724,14 @@ _set_stable_privacy(NMUtilsStableType stable_type,
         stable_type_uint8 = (guint8) stable_type;
 
         /* Preferably, we would always like to include the stable-type,
-		 * but for backward compatibility reasons, we cannot for UUID.
-		 *
-		 * That is no real problem and it is still impossible to
-		 * force a collision here, because of how the remaining
-		 * fields are hashed. That is, as we also hash @host_id_len
-		 * and the terminating '\0' of @network_id, it is unambiguously
-		 * possible to revert the process and deduce the @stable_type.
-		 */
+         * but for backward compatibility reasons, we cannot for UUID.
+         *
+         * That is no real problem and it is still impossible to
+         * force a collision here, because of how the remaining
+         * fields are hashed. That is, as we also hash @host_id_len
+         * and the terminating '\0' of @network_id, it is unambiguously
+         * possible to revert the process and deduce the @stable_type.
+         */
         g_checksum_update(sum, &stable_type_uint8, sizeof(stable_type_uint8));
     }
 
@@ -3832,11 +3832,11 @@ _hw_addr_eth_complete(struct ether_addr *addr,
     guint              i;
 
     /* the second LSB of the first octet means
-	 * "globally unique, OUI enforced, BIA (burned-in-address)"
-	 * vs. "locally-administered". By default, set it to
-	 * generate locally-administered addresses.
-	 *
-	 * Maybe be overwritten by a mask below. */
+     * "globally unique, OUI enforced, BIA (burned-in-address)"
+     * vs. "locally-administered". By default, set it to
+     * generate locally-administered addresses.
+     *
+     * Maybe be overwritten by a mask below. */
     addr->ether_addr_octet[0] |= 2;
 
     if (!generate_mac_address_mask || !*generate_mac_address_mask)
@@ -3851,7 +3851,7 @@ _hw_addr_eth_complete(struct ether_addr *addr,
     nm_assert((ouis == NULL) ^ (ouis_len != 0));
     if (ouis) {
         /* g_random_int() is good enough here. It uses a static GRand instance
-		 * that is seeded from /dev/urandom. */
+         * that is seeded from /dev/urandom. */
         oui = ouis[g_random_int() % ouis_len];
         g_free(ouis);
     } else {
@@ -3869,7 +3869,7 @@ _hw_addr_eth_complete(struct ether_addr *addr,
 
 out:
     /* The LSB of the first octet must always be cleared,
-	 * it means Unicast vs. Multicast */
+     * it means Unicast vs. Multicast */
     addr->ether_addr_octet[0] &= ~1;
 }
 
@@ -4025,14 +4025,14 @@ nm_utils_create_dhcp_iaid(gboolean      legacy_unstable_byteorder,
     u32 = (u64 & 0xffffffffu) ^ (u64 >> 32);
     if (legacy_unstable_byteorder) {
         /* legacy systemd code dhcp_identifier_set_iaid() generates the iaid
-		 * dependent on the host endianness. Since this function returns the IAID
-		 * in native-byte order, we need to account for that.
-		 *
-		 * On little endian systems, we want the legacy-behavior is identical to
-		 * the endianness-agnostic behavior. So, we need to swap the bytes on
-		 * big-endian systems.
-		 *
-		 * (https://github.com/systemd/systemd/pull/10614). */
+         * dependent on the host endianness. Since this function returns the IAID
+         * in native-byte order, we need to account for that.
+         *
+         * On little endian systems, we want the legacy-behavior is identical to
+         * the endianness-agnostic behavior. So, we need to swap the bytes on
+         * big-endian systems.
+         *
+         * (https://github.com/systemd/systemd/pull/10614). */
         return htole32(u32);
     } else {
         /* we return the value as-is, in native byte order. */
@@ -4153,11 +4153,11 @@ nm_utils_generate_duid_uuid(const NMUuid *uuid)
     nm_assert(uuid);
 
     /* Generate a DHCP Unique Identifier for DHCPv6 using the
-	 * DUID-UUID method (see RFC 6355 section 4).  Format is:
-	 *
-	 * u16: type (DUID-UUID = 4)
-	 * u8[16]: UUID bytes
-	 */
+     * DUID-UUID method (see RFC 6355 section 4).  Format is:
+     *
+     * u16: type (DUID-UUID = 4)
+     * u8[16]: UUID bytes
+     */
     G_STATIC_ASSERT_EXPR(sizeof(duid_type) == 2);
     G_STATIC_ASSERT_EXPR(sizeof(*uuid) == 16);
     duid_buffer = g_malloc(18);
@@ -4185,9 +4185,9 @@ again:
         machine_id = nm_utils_machine_id_bin();
 
         /* Hash the machine ID so it's not leaked to the network.
-		 *
-		 * Optimally, we would choose an use case specific seed, but for historic
-		 * reasons we didn't. */
+         *
+         * Optimally, we would choose an use case specific seed, but for historic
+         * reasons we didn't. */
         sum = g_checksum_new(G_CHECKSUM_SHA256);
         g_checksum_update(sum, (const guchar *) machine_id, sizeof(*machine_id));
         nm_utils_checksum_get_digest(sum, digest.sha256);
@@ -4289,12 +4289,12 @@ nm_utils_lifetime_rebase_relative_time_on_now(guint32 timestamp, guint32 duratio
 
     if (timestamp == 0) {
         /* if the @timestamp is zero, assume it was just left unset and that the relative
-		 * @duration starts counting from @now. This is convenient to construct an address
-		 * and print it in nm_platform_ip4_address_to_string().
-		 *
-		 * In general it does not make sense to set the @duration without anchoring at
-		 * @timestamp because you don't know the absolute expiration time when looking
-		 * at the address at a later moment. */
+         * @duration starts counting from @now. This is convenient to construct an address
+         * and print it in nm_platform_ip4_address_to_string().
+         *
+         * In general it does not make sense to set the @duration without anchoring at
+         * @timestamp because you don't know the absolute expiration time when looking
+         * at the address at a later moment. */
         timestamp = now;
     }
 
@@ -4321,10 +4321,10 @@ nm_utils_lifetime_get(guint32  timestamp,
 
     if (timestamp == 0 && lifetime == 0) {
         /* We treat lifetime==0 && timestamp==0 addresses as permanent addresses to allow easy
-		 * creation of such addresses (without requiring to set the lifetime fields to
-		 * NM_PLATFORM_LIFETIME_PERMANENT). The real lifetime==0 addresses (E.g. DHCP6 telling us
-		 * to drop an address will have timestamp set.
-		 */
+         * creation of such addresses (without requiring to set the lifetime fields to
+         * NM_PLATFORM_LIFETIME_PERMANENT). The real lifetime==0 addresses (E.g. DHCP6 telling us
+         * to drop an address will have timestamp set.
+         */
         NM_SET_OUT(out_preferred, NM_PLATFORM_LIFETIME_PERMANENT);
         g_return_val_if_fail(preferred == 0, NM_PLATFORM_LIFETIME_PERMANENT);
         return NM_PLATFORM_LIFETIME_PERMANENT;
@@ -4344,9 +4344,9 @@ nm_utils_lifetime_get(guint32  timestamp,
     NM_SET_OUT(out_preferred, MIN(t_preferred, t_lifetime));
 
     /* Assert that non-permanent addresses have a (positive) @timestamp. nm_utils_lifetime_rebase_relative_time_on_now()
-	 * treats addresses with timestamp 0 as *now*. Addresses passed to _address_get_lifetime() always
-	 * should have a valid @timestamp, otherwise on every re-sync, their lifetime will be extended anew.
-	 */
+     * treats addresses with timestamp 0 as *now*. Addresses passed to _address_get_lifetime() always
+     * should have a valid @timestamp, otherwise on every re-sync, their lifetime will be extended anew.
+     */
     g_return_val_if_fail(timestamp != 0
                              || (lifetime == NM_PLATFORM_LIFETIME_PERMANENT
                                  && preferred == NM_PLATFORM_LIFETIME_PERMANENT),
@@ -4948,8 +4948,8 @@ get_max_rate_ht(const guint8 *bytes, guint len, guint32 *out_maxrate)
     guint32       rate;
 
     /* http://standards.ieee.org/getieee802/download/802.11-2012.pdf
-	 * https://mrncciew.com/2014/10/19/cwap-ht-capabilities-ie/
-	 */
+     * https://mrncciew.com/2014/10/19/cwap-ht-capabilities-ie/
+     */
 
     if (len != 26)
         return FALSE;
@@ -4985,7 +4985,7 @@ get_max_rate_vht(const guint8 *bytes, guint len, guint32 *out_maxrate)
     guint8  vht_cap, tx_map;
 
     /* https://tda802dot11.blogspot.it/2014/10/vht-capabilities-element-vht.html
-	 * http://chimera.labs.oreilly.com/books/1234000001739/ch03.html#management_frames */
+     * http://chimera.labs.oreilly.com/books/1234000001739/ch03.html#management_frames */
 
     if (len != 12)
         return FALSE;
@@ -5002,7 +5002,7 @@ get_max_rate_vht(const guint8 *bytes, guint len, guint32 *out_maxrate)
         mcs = 7;
 
     /* Check for 160Mhz wide channel support and
-	 * spatial stream support */
+     * spatial stream support */
     if (vht_cap & (1 << 2)) {
         if (tx_map & 0x30)
             m = get_max_rate_vht_160_ss3(mcs);
diff --git a/src/nm-core-utils.h b/src/nm-core-utils.h
index f12b2cacab..ca1c483b89 100644
--- a/src/nm-core-utils.h
+++ b/src/nm-core-utils.h
@@ -67,15 +67,15 @@ void _nm_singleton_instance_register_destruction(GObject *instance);
     _nm_unused static void _nmtst_##GETTER##_reset(TYPE *instance)                          \
     {                                                                                       \
         /* usually, the singleton can only be created once (and further instantiations
-	 * are guarded by an assert). For testing, we need to reset the singleton to
-	 * allow multiple instantiations. */      \
+     * are guarded by an assert). For testing, we need to reset the singleton to
+     * allow multiple instantiations. */      \
         g_assert(G_IS_OBJECT(instance));                                                    \
         g_assert(instance == singleton_instance);                                           \
         g_assert(_already_created_##GETTER);                                                \
         g_object_unref(instance);                                                           \
                                                                                             \
         /* require that the last unref also destroyed the singleton. If this fails,
-	 * somebody still keeps a reference. Fix your test! */         \
+     * somebody still keeps a reference. Fix your test! */         \
         g_assert(!singleton_instance);                                                      \
         _already_created_##GETTER = FALSE;                                                  \
     }
@@ -388,11 +388,11 @@ gboolean nm_utils_get_ipv6_interface_identifier(NMLinkType          link_type,
 
 typedef enum {
     /* The stable type. Note that this value is encoded in the
-	 * generated addresses, thus the numbers MUST not change.
-	 *
-	 * Also note, if we ever allocate ID 255, we must take care
-	 * that nm_utils_ipv6_addr_set_stable_privacy() extends the
-	 * uint8 encoding of this value. */
+     * generated addresses, thus the numbers MUST not change.
+     *
+     * Also note, if we ever allocate ID 255, we must take care
+     * that nm_utils_ipv6_addr_set_stable_privacy() extends the
+     * uint8 encoding of this value. */
     NM_UTILS_STABLE_TYPE_UUID      = 0,
     NM_UTILS_STABLE_TYPE_STABLE_ID = 1,
     NM_UTILS_STABLE_TYPE_GENERATED = 2,
diff --git a/src/nm-dbus-manager.c b/src/nm-dbus-manager.c
index f54090723b..5fa565346f 100644
--- a/src/nm-dbus-manager.c
+++ b/src/nm-dbus-manager.c
@@ -153,13 +153,13 @@ typedef struct {
     GDBusServer *server;
 
     /* With peer bus connections, we'll get a new connection for each
-	 * client.  For each connection we create an ObjectManager for
-	 * that connection to handle exporting our objects.
-	 *
-	 * Note that even for connections that don't export any objects
-	 * we'll still create GDBusObjectManager since that's where we store
-	 * the pointer to the GDBusConnection.
-	 */
+     * client.  For each connection we create an ObjectManager for
+     * that connection to handle exporting our objects.
+     *
+     * Note that even for connections that don't export any objects
+     * we'll still create GDBusObjectManager since that's where we store
+     * the pointer to the GDBusConnection.
+     */
     CList object_mgr_lst_head;
 
     NMDBusManager *manager;
@@ -214,9 +214,9 @@ close_connection_in_idle(gpointer user_data)
                   info->connection);
 
     /* FIXME: there's a bug (754730) in GLib for which the connection
-	 * is marked as closed when the remote peer vanishes but its
-	 * resources are not cleaned up.  Work around it by explicitly
-	 * closing the connection in that case. */
+     * is marked as closed when the remote peer vanishes but its
+     * resources are not cleaned up.  Work around it by explicitly
+     * closing the connection in that case. */
     if (info->remote_peer_vanished)
         g_dbus_connection_close(info->connection, NULL, NULL, NULL);
 
@@ -261,7 +261,7 @@ private_server_closed_connection(GDBusConnection *conn,
     g_object_ref(s->manager);
 
     /* Delay the close of connection to ensure that D-Bus signals
-	 * are handled */
+     * are handled */
     g_idle_add(close_connection_in_idle, info);
 }
 
@@ -292,10 +292,10 @@ private_server_new_connection(GDBusServer *server, GDBusConnection *conn, gpoint
           NM_HASH_OBFUSCATE_PTR(conn));
 
     /* Emit this for the manager.
-	 *
-	 * It is essential to do this from the "new-connection" signal handler, as
-	 * at that point no messages from the connection are yet processed
-	 * (which avoids races with registering objects). */
+     *
+     * It is essential to do this from the "new-connection" signal handler, as
+     * at that point no messages from the connection are yet processed
+     * (which avoids races with registering objects). */
     g_signal_emit(s->manager, signals[PRIVATE_CONNECTION_NEW], s->detail, conn, manager);
     return TRUE;
 }
@@ -527,12 +527,12 @@ _get_caller_info_ensure(NMDBusManager *self,
 #define CALLER_INFO_MAX_AGE (NM_UTILS_NSEC_PER_SEC * 1)
 
     /* Linear search the cache for the sender.
-	 *
-	 * The number of cached caller-infos is limited. Hence, it's O(1) and
-	 * the list is reasonably short.
-	 * Also, the entire caching assumes that we repeatedly ask for the
-	 * same sender. That means, we expect to find the right caller info
-	 * at the front of the list. */
+     *
+     * The number of cached caller-infos is limited. Hence, it's O(1) and
+     * the list is reasonably short.
+     * Also, the entire caching assumes that we repeatedly ask for the
+     * same sender. That means, we expect to find the right caller info
+     * at the front of the list. */
     num         = 1;
     caller_info = NULL;
     c_list_for_each_entry (ci, &priv->caller_info_lst_head, caller_info_lst) {
@@ -911,7 +911,7 @@ static const GDBusInterfaceVTable dbus_vtable = {
     .get_property = dbus_vtable_get_property,
 
     /* set_property is handled via method_call as well. We need to authenticate
-	 * which requires an asynchronous handler. */
+     * which requires an asynchronous handler. */
     .set_property = NULL,
 };
 
@@ -947,11 +947,11 @@ _obj_register(NMDBusManager *self, NMDBusObject *obj)
 
         if (prev_interface_infos == klass->interface_infos) {
             /* derived classes inherrit the interface-infos from the parent class.
-			 * For convenience, we allow the subclass to leave interface-infos untouched,
-			 * but it means we must ignore the parent's interface, because we already
-			 * handled it.
-			 *
-			 * Note that the loop goes from the parent classes to child classes */
+             * For convenience, we allow the subclass to leave interface-infos untouched,
+             * but it means we must ignore the parent's interface, because we already
+             * handled it.
+             *
+             * Note that the loop goes from the parent classes to child classes */
             continue;
         }
         prev_interface_infos = klass->interface_infos;
@@ -993,18 +993,18 @@ _obj_register(NMDBusManager *self, NMDBusObject *obj)
     nm_assert(!c_list_is_empty(&obj->internal.registration_lst_head));
 
     /* Currently, the interfaces of an object do not changed and strictly depend on the object glib type.
-	 * We don't need more flexibility, and it simplifies the code. Hence, now emit interface-added
-	 * signal for the new object.
-	 *
-	 * Warning: note that if @obj's notify signal is currently blocked via g_object_freeze_notify(),
-	 * we might emit properties with an inconsistent (internal) state. There is no easy solution,
-	 * because we have to emit the signal now, and we don't know what the correct desired state
-	 * of the properties is.
-	 * Another problem is, upon unfreezing the signals, we immediately send PropertiesChanged
-	 * notifications out. Which is a bit odd, as we just export the object.
-	 *
-	 * In general, it's ok to export an object with frozen signals. But you better make sure
-	 * that all properties are in a self-consistent state when exporting the object. */
+     * We don't need more flexibility, and it simplifies the code. Hence, now emit interface-added
+     * signal for the new object.
+     *
+     * Warning: note that if @obj's notify signal is currently blocked via g_object_freeze_notify(),
+     * we might emit properties with an inconsistent (internal) state. There is no easy solution,
+     * because we have to emit the signal now, and we don't know what the correct desired state
+     * of the properties is.
+     * Another problem is, upon unfreezing the signals, we immediately send PropertiesChanged
+     * notifications out. Which is a bit odd, as we just export the object.
+     *
+     * In general, it's ok to export an object with frozen signals. But you better make sure
+     * that all properties are in a self-consistent state when exporting the object. */
     g_dbus_connection_emit_signal(priv->main_dbus_connection,
                                   NULL,
                                   OBJECT_MANAGER_SERVER_BASE_PATH,
@@ -1167,12 +1167,12 @@ _nm_dbus_manager_obj_notify(NMDBusObject *obj, guint n_pspecs, const GParamSpec
     }
 
     /* do a naive search for the matching NMDBusPropertyInfoExtended infos. Since the number of
-	 * (interfaces x properties) is static and possibly small, this naive search is effectively
-	 * O(1). We might wanna introduce some index to lookup the properties in question faster.
-	 *
-	 * The nice part of this implementation is however, that the order in which properties
-	 * are added to the GVariant is strictly defined to be the order in which the D-Bus property-info
-	 * is declared. Getting a defined ordering with some smart lookup would be hard. */
+     * (interfaces x properties) is static and possibly small, this naive search is effectively
+     * O(1). We might wanna introduce some index to lookup the properties in question faster.
+     *
+     * The nice part of this implementation is however, that the order in which properties
+     * are added to the GVariant is strictly defined to be the order in which the D-Bus property-info
+     * is declared. Getting a defined ordering with some smart lookup would be hard. */
     c_list_for_each_entry (reg_data, &obj->internal.registration_lst_head, registration_lst) {
         const NMDBusInterfaceInfoExtended *interface_info = _reg_data_get_interface_info(reg_data);
         gboolean                           has_properties = FALSE;
@@ -1223,7 +1223,7 @@ _nm_dbus_manager_obj_notify(NMDBusObject *obj, guint n_pspecs, const GParamSpec
 
         if (G_UNLIKELY(interface_info == &nm_interface_info_device_statistics)) {
             /* we treat the Device.Statistics signal special, because we need to
-			 * emit a signal also for it (below). */
+             * emit a signal also for it (below). */
             nm_assert(!device_statistics_args);
             device_statistics_args = g_variant_ref_sink(args);
         }
@@ -1241,8 +1241,8 @@ _nm_dbus_manager_obj_notify(NMDBusObject *obj, guint n_pspecs, const GParamSpec
 
     if (G_UNLIKELY(device_statistics_args)) {
         /* this is a special interface: it has a legacy PropertiesChanged signal,
-		 * however, contrary to other interfaces with ~regular~ legacy signals,
-		 * we only notify about properties that actually belong to this interface. */
+         * however, contrary to other interfaces with ~regular~ legacy signals,
+         * we only notify about properties that actually belong to this interface. */
         g_dbus_connection_emit_signal(priv->main_dbus_connection,
                                       NULL,
                                       obj->internal.path,
@@ -1257,22 +1257,22 @@ _nm_dbus_manager_obj_notify(NMDBusObject *obj, guint n_pspecs, const GParamSpec
         gs_unref_variant GVariant *args = NULL;
 
         /* The legacy PropertyChanged signal on the NetworkManager D-Bus interface is
-		 * deprecated for the standard signal on org.freedesktop.DBus.Properties. However,
-		 * for backward compatibility, we still need to emit it.
-		 *
-		 * Due to a bug in dbus-glib in NetworkManager <= 1.0, the signal would
-		 * not only notify about properties that were actually on the corresponding
-		 * D-Bus interface. Instead, it would notify about all relevant properties
-		 * on all interfaces that had such a signal.
-		 *
-		 * For example, "HwAddress" gets emitted both on "fdo.NM.Device.Ethernet"
-		 * and "fdo.NM.Device.Veth" for veth interfaces, although only the former
-		 * actually has such a property.
-		 * Also note that "fdo.NM.Device" interface has no legacy signal. All notifications
-		 * about its properties are instead emitted on the interfaces of the subtypes.
-		 *
-		 * See bgo#770629 and commit bef26a2e69f51259095fa080221db73de09fd38d.
-		 */
+         * deprecated for the standard signal on org.freedesktop.DBus.Properties. However,
+         * for backward compatibility, we still need to emit it.
+         *
+         * Due to a bug in dbus-glib in NetworkManager <= 1.0, the signal would
+         * not only notify about properties that were actually on the corresponding
+         * D-Bus interface. Instead, it would notify about all relevant properties
+         * on all interfaces that had such a signal.
+         *
+         * For example, "HwAddress" gets emitted both on "fdo.NM.Device.Ethernet"
+         * and "fdo.NM.Device.Veth" for veth interfaces, although only the former
+         * actually has such a property.
+         * Also note that "fdo.NM.Device" interface has no legacy signal. All notifications
+         * about its properties are instead emitted on the interfaces of the subtypes.
+         *
+         * See bgo#770629 and commit bef26a2e69f51259095fa080221db73de09fd38d.
+         */
         args = g_variant_ref_sink(g_variant_new("(a{sv})", &legacy_builder));
         c_list_for_each_entry (reg_data, &obj->internal.registration_lst_head, registration_lst) {
             const NMDBusInterfaceInfoExtended *interface_info =
@@ -1399,10 +1399,10 @@ dbus_vtable_objmgr_method_call(GDBusConnection *      connection,
         GVariantBuilder interfaces_builder;
 
         /* note that we are called on an idle handler. Hence, all properties are
-		 * supposed to be in a consistent state. That is true, if you always
-		 * g_object_thaw_notify() before returning to the mainloop. Keeping
-		 * signals frozen between while returning from the current call stack
-		 * is anyway a very fragile thing, easy to get wrong. Don't do that. */
+         * supposed to be in a consistent state. That is true, if you always
+         * g_object_thaw_notify() before returning to the mainloop. Keeping
+         * signals frozen between while returning from the current call stack
+         * is anyway a very fragile thing, easy to get wrong. Don't do that. */
         g_variant_builder_add(&array_builder,
                               "{oa{sa{sv}}}",
                               obj->internal.path,
@@ -1489,10 +1489,10 @@ nm_dbus_manager_acquire_bus(NMDBusManager *self, gboolean request_name)
     priv = NM_DBUS_MANAGER_GET_PRIVATE(self);
 
     /* Create the D-Bus connection and registering the name synchronously.
-	 * That is necessary because we need to exit right away if we can't
-	 * acquire the name despite connecting to the bus successfully.
-	 * It means that something is gravely broken -- such as another NetworkManager
-	 * instance running. */
+     * That is necessary because we need to exit right away if we can't
+     * acquire the name despite connecting to the bus successfully.
+     * It means that something is gravely broken -- such as another NetworkManager
+     * instance running. */
     priv->main_dbus_connection = g_bus_get_sync(G_BUS_TYPE_SYSTEM, NULL, &error);
     if (!priv->main_dbus_connection) {
         _LOGE("cannot connect to D-Bus: %s", error->message);
@@ -1564,9 +1564,9 @@ nm_dbus_manager_stop(NMDBusManager *self)
     priv->shutting_down = TRUE;
 
     /* during shutdown we also clear the set-property-handler. It's no longer
-	 * possible to set a property, because doing so would require authorization,
-	 * which is async, which is just complicated to get right. No more property
-	 * setting from now on. */
+     * possible to set a property, because doing so would require authorization,
+     * which is async, which is just complicated to get right. No more property
+     * setting from now on. */
     priv->set_property_handler      = NULL;
     priv->set_property_handler_data = NULL;
 }
@@ -1602,7 +1602,7 @@ dispose(GObject *object)
     CallerInfo *          caller_info;
 
     /* All exported NMDBusObject instances keep the manager alive, so we don't
-	 * expect any remaining objects. */
+     * expect any remaining objects. */
     nm_assert(!priv->objects_by_path || g_hash_table_size(priv->objects_by_path) == 0);
     nm_assert(c_list_is_empty(&priv->objects_lst_head));
 
@@ -1691,8 +1691,8 @@ _new_unix_process(GDBusMethodInvocation *context,
 
     g_return_val_if_fail(dbus_sender && *dbus_sender, NULL);
     /* polkit glib library stores uid and pid as int. There might be some
-	 * pitfalls if the id ever happens to be larger then that. Just assert against
-	 * it here. */
+     * pitfalls if the id ever happens to be larger then that. Just assert against
+     * it here. */
     g_return_val_if_fail(uid <= MIN(G_MAXINT, G_MAXINT32), NULL);
     g_return_val_if_fail(pid > 0 && pid <= MIN(G_MAXINT, G_MAXINT32), NULL);
 
@@ -1700,8 +1700,8 @@ _new_unix_process(GDBusMethodInvocation *context,
 
     if (nm_auth_subject_get_subject_type(self) != NM_AUTH_SUBJECT_TYPE_UNIX_PROCESS) {
         /* this most likely happened because the process is gone (start_time==0).
-		 * Either that is not assert-worthy, or constructed() already asserted.
-		 * Just return NULL. */
+         * Either that is not assert-worthy, or constructed() already asserted.
+         * Just return NULL. */
         g_clear_object(&self);
     }
     return self;
diff --git a/src/nm-dbus-object.c b/src/nm-dbus-object.c
index a763ebf4c9..b71111cfd7 100644
--- a/src/nm-dbus-object.c
+++ b/src/nm-dbus-object.c
@@ -127,16 +127,16 @@ nm_dbus_object_unexport(gpointer /* (NMDBusObject *) */ self)
     _LOGT("unexport: \"%s\"", self1->internal.path);
 
     /* note that we emit the signal *before* actually unexporting the object.
-	 * The reason is, that listeners want to use this signal to know that
-	 * the object goes away, and clear their D-Bus path to this object.
-	 *
-	 * But this must happen before we actually unregister the object, so
-	 * that we first emit a D-Bus signal that other objects no longer
-	 * reference this object, before finally unregistering the object itself.
-	 *
-	 * The inconvenient part is, that at this point nm_dbus_object_get_path()
-	 * still returns the path. So, the callee needs to handle that. Possibly
-	 * by using "nm_dbus_object_get_path_still_exported()". */
+     * The reason is, that listeners want to use this signal to know that
+     * the object goes away, and clear their D-Bus path to this object.
+     *
+     * But this must happen before we actually unregister the object, so
+     * that we first emit a D-Bus signal that other objects no longer
+     * reference this object, before finally unregistering the object itself.
+     *
+     * The inconvenient part is, that at this point nm_dbus_object_get_path()
+     * still returns the path. So, the callee needs to handle that. Possibly
+     * by using "nm_dbus_object_get_path_still_exported()". */
     self1->internal.is_unexporting = TRUE;
 
     _emit_exported_changed(self1);
@@ -171,9 +171,9 @@ nm_dbus_object_unexport_on_idle(gpointer /* (NMDBusObject *) */ self_take)
     g_return_if_fail(self->internal.path);
 
     /* There is no mechanism to cancel or abort the unexport. It will always
-	 * gonna happen.
-	 *
-	 * However, we register it to block shutdown, so that we ensure that it will happen. */
+     * gonna happen.
+     *
+     * However, we register it to block shutdown, so that we ensure that it will happen. */
 
     nm_shutdown_wait_obj_register_object(self, "unexport-dbus-obj-on-idle");
 
@@ -277,18 +277,18 @@ constructed(GObject *object)
         nm_dbus_object_export((NMDBusObject *) object);
 
     /* NMDBusObject types should be very careful when overwriting notify().
-	 * It is possible to do, but this is a reminder that it's probably not
-	 * a good idea.
-	 *
-	 * It's not a good idea, because NMDBusObject uses dispatch_properties_changed()
-	 * to emit signals about a bunch of property changes. So, we want to make
-	 * use of g_object_freeze_notify() / g_object_thaw_notify() to combine multiple
-	 * property changes in one signal on D-Bus. Note that notify() is not invoked
-	 * while the signal is frozen, that means, whatever you do inside notify()
-	 * will not make it into the same batch of PropertiesChanged signal. That is
-	 * confusing, and probably not what you want.
-	 *
-	 * Simple solution: don't overwrite notify(). */
+     * It is possible to do, but this is a reminder that it's probably not
+     * a good idea.
+     *
+     * It's not a good idea, because NMDBusObject uses dispatch_properties_changed()
+     * to emit signals about a bunch of property changes. So, we want to make
+     * use of g_object_freeze_notify() / g_object_thaw_notify() to combine multiple
+     * property changes in one signal on D-Bus. Note that notify() is not invoked
+     * while the signal is frozen, that means, whatever you do inside notify()
+     * will not make it into the same batch of PropertiesChanged signal. That is
+     * confusing, and probably not what you want.
+     *
+     * Simple solution: don't overwrite notify(). */
     nm_assert(!G_OBJECT_CLASS(klass)->notify);
 }
 
@@ -298,8 +298,8 @@ dispose(GObject *object)
     NMDBusObject *self = NM_DBUS_OBJECT(object);
 
     /* Objects should have already been unexported by their owner, unless
-	 * we are quitting, where many objects stick around until exit.
-	 */
+     * we are quitting, where many objects stick around until exit.
+     */
     if (self->internal.path) {
         if (!nm_dbus_manager_is_stopping(nm_dbus_object_get_manager(self)))
             g_warn_if_reached();
diff --git a/src/nm-dbus-object.h b/src/nm-dbus-object.h
index a3afeff863..5cccc6ca41 100644
--- a/src/nm-dbus-object.h
+++ b/src/nm-dbus-object.h
@@ -17,13 +17,13 @@ typedef struct {
     const char *path;
 
     /* if path is of type NM_DBUS_EXPORT_PATH_NUMBERED(), we need a
-	 * per-class counter when generating a new numbered path.
-	 *
-	 * Each NMDBusObjectClass instance has a shallow clone of the NMDBusObjectClass parent
-	 * instance in every derived type. Hence we cannot embed the counter there directly,
-	 * because it must be shared, e.g. between NMDeviceBond and NMDeviceEthernet.
-	 * Make int_counter a pointer to the actual counter that is used by ever sibling
-	 * class. */
+     * per-class counter when generating a new numbered path.
+     *
+     * Each NMDBusObjectClass instance has a shallow clone of the NMDBusObjectClass parent
+     * instance in every derived type. Hence we cannot embed the counter there directly,
+     * because it must be shared, e.g. between NMDeviceBond and NMDeviceEthernet.
+     * Make int_counter a pointer to the actual counter that is used by ever sibling
+     * class. */
     long long unsigned *int_counter;
 } NMDBusExportPath;
 
@@ -76,11 +76,11 @@ struct _NMDBusObjectInternal {
     CList          registration_lst_head;
 
     /* we perform asynchronous operation on exported objects. For example, we receive
-	 * a Set property call, and asynchronously validate the operation. We must make
-	 * sure that when the authentication is complete, that we are still looking at
-	 * the same (exported) object. In the meantime, the object could have been
-	 * unexported, or even re-exported afterwards. If that happens, we want
-	 * to fail the request. For that, we keep track of a version id.  */
+     * a Set property call, and asynchronously validate the operation. We must make
+     * sure that when the authentication is complete, that we are still looking at
+     * the same (exported) object. In the meantime, the object could have been
+     * unexported, or even re-exported afterwards. If that happens, we want
+     * to fail the request. For that, we keep track of a version id.  */
     guint64 export_version_id;
     bool    is_unexporting : 1;
 };
@@ -157,7 +157,7 @@ nm_dbus_object_get_path_still_exported(NMDBusObject *self)
     g_return_val_if_fail(NM_IS_DBUS_OBJECT(self), NULL);
 
     /* like nm_dbus_object_get_path(), however, while unexporting
-	 * (exported-changed signal), returns %NULL instead of the path. */
+     * (exported-changed signal), returns %NULL instead of the path. */
     return self->internal.is_unexporting ? NULL : self->internal.path;
 }
 
diff --git a/src/nm-dbus-utils.c b/src/nm-dbus-utils.c
index 5afbe33479..2be198599d 100644
--- a/src/nm-dbus-utils.c
+++ b/src/nm-dbus-utils.c
@@ -26,7 +26,7 @@ nm_dbus_utils_interface_info_lookup_property(const GDBusInterfaceInfo *interface
     nm_assert(property_name);
 
     /* there is also g_dbus_interface_info_lookup_property(), however that makes use
-	 * of a global cache. */
+     * of a global cache. */
     if (interface_info->properties) {
         for (i = 0; interface_info->properties[i]; i++) {
             GDBusPropertyInfo *info = interface_info->properties[i];
@@ -51,7 +51,7 @@ nm_dbus_utils_interface_info_lookup_method(const GDBusInterfaceInfo *interface_i
     nm_assert(method_name);
 
     /* there is also g_dbus_interface_info_lookup_property(), however that makes use
-	 * of a global cache. */
+     * of a global cache. */
     if (interface_info->methods) {
         for (i = 0; interface_info->methods[i]; i++) {
             GDBusMethodInfo *info = interface_info->methods[i];
@@ -221,7 +221,7 @@ void
 nm_dbus_track_obj_path_deinit(NMDBusTrackObjPath *track)
 {
     /* we allow deinit() to be called multiple times (e.g. from
-	 * dispose(), which must be re-entrant). */
+     * dispose(), which must be re-entrant). */
     nm_assert(track);
     nm_assert(!track->_notify_target || G_IS_OBJECT(track->_notify_target));
 
diff --git a/src/nm-dbus-utils.h b/src/nm-dbus-utils.h
index e3f8fa7745..ad953c6bc6 100644
--- a/src/nm-dbus-utils.h
+++ b/src/nm-dbus-utils.h
@@ -16,8 +16,8 @@ struct _NMDBusPropertyInfoExtendedBase {
     const char *      property_name;
 
     /* Whether the properties needs to be notified on the legacy
-	 * PropertyChanged signal. This is only to preserve API, new
-	 * properties should not use this. */
+     * PropertyChanged signal. This is only to preserve API, new
+     * properties should not use this. */
     bool include_in_legacy_property_changed;
 };
 
@@ -25,7 +25,7 @@ struct _NMDBusPropertyInfoExtendedReadWritable {
     struct _NMDBusPropertyInfoExtendedBase _base;
 
     /* this is the polkit permission type for authenticating setting
-	 * the property. */
+     * the property. */
     const char *permission;
 
     /* this is the audit operation type for writing the property. */
@@ -39,14 +39,14 @@ typedef struct {
         struct _NMDBusPropertyInfoExtendedReadWritable writable;
 
         /* duplicate the base structure in the union, so that the common fields
-		 * are accessible directly in the parent struct. */
+         * are accessible directly in the parent struct. */
         struct {
             GDBusPropertyInfo parent;
             const char *      property_name;
 
             /* Whether the properties needs to be notified on the legacy
-			 * PropertyChanged signal. This is only to preserve API, new
-			 * properties should not use this. */
+             * PropertyChanged signal. This is only to preserve API, new
+             * properties should not use this. */
             bool include_in_legacy_property_changed;
         };
     };
@@ -150,7 +150,7 @@ typedef struct _NMDBusInterfaceInfoExtended {
     GDBusInterfaceInfo parent;
 
     /* Whether the interface has a legacy property changed signal (@nm_signal_info_property_changed_legacy).
-	 * New interfaces should not use this. */
+     * New interfaces should not use this. */
     bool legacy_property_changed : 1;
 } NMDBusInterfaceInfoExtended;
 
diff --git a/src/nm-dcb.c b/src/nm-dcb.c
index e42320047a..268bbc4297 100644
--- a/src/nm-dcb.c
+++ b/src/nm-dcb.c
@@ -216,8 +216,8 @@ _dcb_setup(const char *  iface,
             return FALSE;
     } else {
         /* Ignore disable failure since lldpad <= 0.9.46 does not support disabling
-		 * priority groups without specifying an entire PG config.
-		 */
+         * priority groups without specifying an entire PG config.
+         */
         (void) do_helper(iface, DCBTOOL, run_func, user_data, error, "pg e:0");
     }
 
@@ -359,11 +359,11 @@ carrier_wait(const char *iface, guint secs, gboolean up)
     ifindex = nm_platform_link_get_ifindex(NM_PLATFORM_GET, iface);
     if (ifindex > 0) {
         /* To work around driver quirks and lldpad handling of carrier status,
-		 * we must wait a short period of time to see if the carrier goes
-		 * down, and then wait for the carrier to come back up again.  Otherwise
-		 * subsequent lldpad calls may fail with "Device not found, link down
-		 * or DCB not enabled" errors.
-		 */
+         * we must wait a short period of time to see if the carrier goes
+         * down, and then wait for the carrier to come back up again.  Otherwise
+         * subsequent lldpad calls may fail with "Device not found, link down
+         * or DCB not enabled" errors.
+         */
         nm_log_dbg(LOGD_DCB, "(%s): cleanup waiting for carrier %s", iface, up ? "up" : "down");
         g_usleep(G_USEC_PER_SEC / 4);
         while (nm_platform_link_is_connected(NM_PLATFORM_GET, ifindex) != up && count-- > 0) {
@@ -380,8 +380,8 @@ nm_dcb_cleanup(const char *iface, GError **error)
     _fcoe_cleanup(iface, run_helper, GUINT_TO_POINTER(FCOEADM), NULL);
 
     /* Must pause a bit to wait for carrier-up since disabling FCoE may
-	 * cause the device to take the link down, making lldpad return errors.
-	 */
+     * cause the device to take the link down, making lldpad return errors.
+     */
     carrier_wait(iface, 2, FALSE);
     carrier_wait(iface, 4, TRUE);
 
diff --git a/src/nm-dispatcher.c b/src/nm-dispatcher.c
index 8b12b8bd65..fc88ec6cc9 100644
--- a/src/nm-dispatcher.c
+++ b/src/nm-dispatcher.c
@@ -942,8 +942,8 @@ nm_dispatcher_call_cancel(NMDispatcherCallId *call_id)
         g_return_if_reached();
 
     /* Canceling just means the callback doesn't get called, so set the
-	 * DispatcherInfo's callback to NULL.
-	 */
+     * DispatcherInfo's callback to NULL.
+     */
     _LOG3D(call_id, "cancelling dispatcher callback action");
     call_id->callback = NULL;
 }
diff --git a/src/nm-firewall-manager.c b/src/nm-firewall-manager.c
index a4debff015..f203f25c71 100644
--- a/src/nm-firewall-manager.c
+++ b/src/nm-firewall-manager.c
@@ -150,10 +150,10 @@ static gboolean
 _get_running(NMFirewallManagerPrivate *priv)
 {
     /* when starting, we need to asynchronously check whether there is
-	 * a name owner. During that time we optimistically assume that the
-	 * service is indeed running. That is the time when we queue the
-	 * requests, and they will be started once the get-name-owner call
-	 * returns. */
+     * a name owner. During that time we optimistically assume that the
+     * service is indeed running. That is the time when we queue the
+     * requests, and they will be started once the get-name-owner call
+     * returns. */
     return priv->running || (priv->dbus_connection && !priv->dbus_inited);
 }
 
@@ -243,8 +243,8 @@ _handle_idle_start(NMFirewallManager *self, NMFirewallManagerCallId *call_id)
 {
     if (!call_id->callback) {
         /* if the user did not provide a callback and firewalld is not running,
-		 * there is no point in scheduling an idle-request to fake success. Just
-		 * return right away. */
+         * there is no point in scheduling an idle-request to fake success. Just
+         * return right away. */
         _LOGD(call_id, "complete: drop request simulating success");
         _cb_info_complete(call_id, NULL);
         return FALSE;
@@ -295,7 +295,7 @@ _handle_dbus_cb(GObject *source, GAsyncResult *result, gpointer user_data)
             _LOGD(call_id, "complete: request failed with a non-error (%s)", error->message);
 
             /* The operation failed with an error reason that we don't want
-			 * to propagate. Instead, signal success. */
+             * to propagate. Instead, signal success. */
             g_clear_error(&error);
         } else
             _LOGW(call_id, "complete: request failed (%s)", error->message);
@@ -385,18 +385,18 @@ _start_request(NMFirewallManager *                self,
             _handle_dbus_start(self, call_id);
         if (!call_id->callback) {
             /* if the user did not provide a callback, the call_id is useless.
-			 * Especially, the user cannot use the call-id to cancel the request,
-			 * because he cannot know whether the request is still pending.
-			 *
-			 * Hence, returning %NULL doesn't mean that the request could not be started
-			 * (this function never fails and always starts a request). */
+             * Especially, the user cannot use the call-id to cancel the request,
+             * because he cannot know whether the request is still pending.
+             *
+             * Hence, returning %NULL doesn't mean that the request could not be started
+             * (this function never fails and always starts a request). */
             return NULL;
         }
     } else {
         if (!_handle_idle_start(self, call_id)) {
             /* if the user did not provide a callback and firewalld is not running,
-			 * there is no point in scheduling an idle-request to fake success. Just
-			 * return right away. */
+             * there is no point in scheduling an idle-request to fake success. Just
+             * return right away. */
             return NULL;
         }
     }
@@ -484,13 +484,13 @@ name_owner_changed(NMFirewallManager *self, const char *owner)
         NMFirewallManagerCallId *call_id;
 
         /* We kick of the requests that we have pending. Note that this is
-		 * entirely asynchronous and also we don't invoke any callbacks for
-		 * the user.
-		 * Even _handle_idle_start() just schedules an idle handler. That is,
-		 * because we don't want to callback to the user before emitting the
-		 * DISCONNECTED signal below. Also, emitting callbacks means the user
-		 * can call back to modify the list of pending-calls and we'd have
-		 * to handle reentrancy. */
+         * entirely asynchronous and also we don't invoke any callbacks for
+         * the user.
+         * Even _handle_idle_start() just schedules an idle handler. That is,
+         * because we don't want to callback to the user before emitting the
+         * DISCONNECTED signal below. Also, emitting callbacks means the user
+         * can call back to modify the list of pending-calls and we'd have
+         * to handle reentrancy. */
         c_list_for_each_entry_safe (call_id, call_id_safe, &priv->pending_calls, lst) {
             nm_assert(!call_id->is_idle);
             nm_assert(call_id->dbus.arg);
@@ -500,9 +500,9 @@ name_owner_changed(NMFirewallManager *self, const char *owner)
                 _handle_dbus_start(self, call_id);
             } else {
                 /* we don't want to invoke callbacks to the user right away. That is because
-				 * the user might schedule/cancel more calls, which messes up the order.
-				 *
-				 * Instead, convert the pending calls to idle requests... */
+                 * the user might schedule/cancel more calls, which messes up the order.
+                 *
+                 * Instead, convert the pending calls to idle requests... */
                 nm_clear_pointer(&call_id->dbus.arg, g_variant_unref);
                 call_id->is_idle = TRUE;
                 _LOGD(call_id, "initializing: fake success on idle");
@@ -591,7 +591,7 @@ dispose(GObject *object)
     NMFirewallManagerPrivate *priv = NM_FIREWALL_MANAGER_GET_PRIVATE(self);
 
     /* as every pending operation takes a reference to the manager,
-	 * we don't expect pending operations at this point. */
+     * we don't expect pending operations at this point. */
     nm_assert(c_list_is_empty(&priv->pending_calls));
 
     nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->name_owner_changed_id);
diff --git a/src/nm-hostname-manager.c b/src/nm-hostname-manager.c
index 0a75dd7957..2680f70e70 100644
--- a/src/nm-hostname-manager.c
+++ b/src/nm-hostname-manager.c
@@ -368,9 +368,9 @@ nm_hostname_manager_write_hostname(NMHostnameManager *self, const char *hostname
     }
 
     /* If the hostname file is a symbolic link, follow it to find where the
-	 * real file is located, otherwise g_file_set_contents will attempt to
-	 * replace the link with a plain file.
-	 */
+     * real file is located, otherwise g_file_set_contents will attempt to
+     * replace the link with a plain file.
+     */
     if (lstat(file, &file_stat) == 0 && S_ISLNK(file_stat.st_mode)
         && (link_path = nm_utils_read_link_absolute(file, NULL)))
         file = link_path;
diff --git a/src/nm-iface-helper.c b/src/nm-iface-helper.c
index 6d4f41df3b..cb11b1cc98 100644
--- a/src/nm-iface-helper.c
+++ b/src/nm-iface-helper.c
@@ -181,9 +181,9 @@ ndisc_config_changed(NMNDisc *          ndisc,
         guint32 ifa_flags;
 
         /* Check, whether kernel is recent enough to help user space handling RA.
-		 * If it's not supported, we have no ipv6-privacy and must add autoconf
-		 * addresses as /128. The reason for the /128 is to prevent the kernel
-		 * from adding a prefix route for this address. */
+         * If it's not supported, we have no ipv6-privacy and must add autoconf
+         * addresses as /128. The reason for the /128 is to prevent the kernel
+         * from adding a prefix route for this address. */
         ifa_flags = 0;
         if (nm_platform_kernel_support_get(NM_PLATFORM_KERNEL_SUPPORT_TYPE_EXTENDED_IFA_FLAGS)) {
             ifa_flags |= IFA_F_NOPREFIXROUTE;
@@ -641,7 +641,7 @@ main(int argc, char *argv[])
 
     if (global_opt.dhcp4_clientid) {
         /* this string is just a plain hex-string. Unlike ipv4.dhcp-client-id, which
-		 * is parsed via nm_dhcp_utils_client_id_string_to_bytes(). */
+         * is parsed via nm_dhcp_utils_client_id_string_to_bytes(). */
         client_id = nm_utils_hexstr2bin(global_opt.dhcp4_clientid);
         if (!client_id || g_bytes_get_size(client_id) < 2) {
             fprintf(stderr,
@@ -703,8 +703,8 @@ main(int argc, char *argv[])
             && (global_opt.stable_id[0] >= '0' && global_opt.stable_id[0] <= '9')
             && global_opt.stable_id[1] == ' ') {
             /* strict parsing of --stable-id, which is the numeric stable-type
-			 * and the ID, joined with one space. For now, only support stable-types
-			 * from 0 to 9. */
+             * and the ID, joined with one space. For now, only support stable-types
+             * from 0 to 9. */
             stable_type = (global_opt.stable_id[0] - '0');
             stable_id   = &global_opt.stable_id[2];
         }
@@ -769,7 +769,7 @@ main(int argc, char *argv[])
 
 const NMDhcpClientFactory *const _nm_dhcp_manager_factories[6] = {
     /* For nm-iface-helper there is no option to choose a DHCP plugin.
-	 * It just uses the "internal" one. */
+     * It just uses the "internal" one. */
     &_nm_dhcp_client_factory_internal,
 };
 
diff --git a/src/nm-ip4-config.c b/src/nm-ip4-config.c
index f7338eea66..33bbc61139 100644
--- a/src/nm-ip4-config.c
+++ b/src/nm-ip4-config.c
@@ -95,7 +95,7 @@ _nm_ip_config_add_obj(NMDedupMultiIndex *          multi_idx,
     nm_assert(ifindex > 0);
 
     /* we go through extra lengths to accept a full obj_new object. That one,
-	 * can be reused by increasing the ref-count. */
+     * can be reused by increasing the ref-count. */
     if (!obj_new) {
         nm_assert(pl_new);
         obj_new = nmp_object_stackinit(&obj_new_stackinit, idx_type->obj_type, pl_new);
@@ -123,16 +123,16 @@ _nm_ip_config_add_obj(NMDedupMultiIndex *          multi_idx,
         }
 
         /* if @merge, we merge the new object with the existing one.
-		 * Otherwise, we replace it entirely. */
+         * Otherwise, we replace it entirely. */
         if (merge) {
             switch (idx_type->obj_type) {
             case NMP_OBJECT_TYPE_IP4_ADDRESS:
             case NMP_OBJECT_TYPE_IP6_ADDRESS:
                 /* for addresses that we read from the kernel, we keep the timestamps as defined
-				 * by the previous source (item_old). The reason is, that the other source configured the lifetimes
-				 * with "what should be" and the kernel values are "what turned out after configuring it".
-				 *
-				 * For other sources, the longer lifetime wins. */
+                 * by the previous source (item_old). The reason is, that the other source configured the lifetimes
+                 * with "what should be" and the kernel values are "what turned out after configuring it".
+                 *
+                 * For other sources, the longer lifetime wins. */
                 if ((obj_new->ip_address.addr_source == NM_IP_CONFIG_SOURCE_KERNEL
                      && obj_old->ip_address.addr_source != NM_IP_CONFIG_SOURCE_KERNEL)
                     || nm_platform_ip_address_cmp_expiry(NMP_OBJECT_CAST_IP_ADDRESS(obj_old),
@@ -403,7 +403,7 @@ _nm_ip_config_best_default_route_find_better(const NMPObject *obj_cur, const NMP
     nm_assert(!obj_cur || nmp_object_ip_route_is_best_defaut_route(obj_cur));
 
     /* assumes that @obj_cur is already the best default route (or NULL). It checks whether
-	 * @obj_cmp is also a default route and returns the best of both. */
+     * @obj_cmp is also a default route and returns the best of both. */
     if (obj_cmp && nmp_object_ip_route_is_best_defaut_route(obj_cmp)) {
         guint32 metric_cur, metric_cmp;
 
@@ -420,9 +420,9 @@ _nm_ip_config_best_default_route_find_better(const NMPObject *obj_cur, const NMP
             int c;
 
             /* Routes have the same metric. We still want to deterministically
-			 * prefer one or the other. It's important to consistently choose one
-			 * or the other, so that the order doesn't matter how routes are added
-			 * (and merged). */
+             * prefer one or the other. It's important to consistently choose one
+             * or the other, so that the order doesn't matter how routes are added
+             * (and merged). */
             c = nmp_object_cmp(obj_cur, obj_cmp);
             if (c != 0)
                 return c < 0 ? obj_cur : obj_cmp;
@@ -628,7 +628,7 @@ nm_ip4_config_add_dependent_routes(NMIP4Config *self,
     g_return_if_fail(ifindex > 0);
 
     /* For IPv6 slaac, we explicitly add the device-routes (onlink) to NMIP6Config.
-	 * As we don't do that for IPv4 (and manual IPv6 addresses), add them explicitly. */
+     * As we don't do that for IPv4 (and manual IPv6 addresses), add them explicitly. */
 
     nm_ip_config_iter_ip4_address_for_each (&iter, self, &my_addr) {
         nm_auto_nmpobj NMPObject *r = NULL;
@@ -663,13 +663,13 @@ nm_ip4_config_add_dependent_routes(NMIP4Config *self,
 
         if (nm_utils_ip4_address_is_zeronet(network)) {
             /* Kernel doesn't add device-routes for destinations that
-			 * start with 0.x.y.z. Skip them. */
+             * start with 0.x.y.z. Skip them. */
             continue;
         }
 
         if (my_addr->plen == 32 && my_addr->address == my_addr->peer_address) {
             /* Kernel doesn't add device-routes for /32 addresses unless
-			 * they have a peer. */
+             * they have a peer. */
             continue;
         }
 
@@ -1293,8 +1293,8 @@ nm_ip4_config_subtract(NMIP4Config *      dst,
             NMPlatformIP4Route *rr;
 
             /* the default route was penalized when merging it to the combined ip-config.
-			 * When subtracting the routes, we must re-do that process when comparing
-			 * the routes. */
+             * When subtracting the routes, we must re-do that process when comparing
+             * the routes. */
             o_lookup = nmp_object_stackinit_obj(&o_lookup_copy, o_src);
             rr       = NMP_OBJECT_CAST_IP4_ROUTE(&o_lookup_copy);
             rr->metric =
@@ -1443,8 +1443,8 @@ _nm_ip4_config_intersect_helper(NMIP4Config *      dst,
             NMPlatformIP4Route *rr;
 
             /* the default route was penalized when merging it to the combined ip-config.
-			 * When intersecting the routes, we must re-do that process when comparing
-			 * the routes. */
+             * When intersecting the routes, we must re-do that process when comparing
+             * the routes. */
             o_lookup = nmp_object_stackinit_obj(&o_lookup_copy, o_dst);
             rr       = NMP_OBJECT_CAST_IP4_ROUTE(&o_lookup_copy);
             rr->metric =
@@ -1858,7 +1858,7 @@ nm_ip4_config_replace(NMIP4Config *dst, const NMIP4Config *src, gboolean *releva
 
 #if NM_MORE_ASSERTS
     /* config_equal does not compare *all* the fields, therefore, we might have has_minor_changes
-	 * regardless of config_equal. But config_equal must correspond to has_relevant_changes. */
+     * regardless of config_equal. But config_equal must correspond to has_relevant_changes. */
     nm_assert(config_equal == !has_relevant_changes);
 #endif
 
@@ -2877,15 +2877,15 @@ nm_ip4_config_hash(const NMIP4Config *self, GChecksum *sum, gboolean dns_only)
         g_checksum_update(sum, (const guint8 *) &val, sizeof(val));
 
     /* FIXME(ip-config-checksum): the DNS priority should be considered relevant
-	 * and added into the checksum as well, but this can't be done right now
-	 * because in the DNS manager we rely on the fact that an empty
-	 * configuration (i.e. just created) has a zero checksum. This is needed to
-	 * avoid rewriting resolv.conf when there is no change.
-	 *
-	 * The DNS priority initial value depends on the connection type (VPN or
-	 * not), so it's a bit difficult to add it to checksum maintaining the
-	 * assumption of checksum(empty)=0
-	 */
+     * and added into the checksum as well, but this can't be done right now
+     * because in the DNS manager we rely on the fact that an empty
+     * configuration (i.e. just created) has a zero checksum. This is needed to
+     * avoid rewriting resolv.conf when there is no change.
+     *
+     * The DNS priority initial value depends on the connection type (VPN or
+     * not), so it's a bit difficult to add it to checksum maintaining the
+     * assumption of checksum(empty)=0
+     */
 }
 
 /**
diff --git a/src/nm-ip4-config.h b/src/nm-ip4-config.h
index b5eed5fd7d..bfdb681c93 100644
--- a/src/nm-ip4-config.h
+++ b/src/nm-ip4-config.h
@@ -20,7 +20,7 @@ typedef enum _NMIPConfigFlags {
     NM_IP_CONFIG_FLAG_NONE = 0,
 
     /* if set, then the merge flag NM_IP_CONFIG_MERGE_NO_DEFAULT_ROUTES gets
-	 * ignored during merge. */
+     * ignored during merge. */
     NM_IP_CONFIG_FLAGS_IGNORE_MERGE_NO_DEFAULT_ROUTES = (1ull << 0),
 } NMIPConfigFlags;
 
diff --git a/src/nm-ip6-config.c b/src/nm-ip6-config.c
index e5a1925709..5ebb46a84f 100644
--- a/src/nm-ip6-config.c
+++ b/src/nm-ip6-config.c
@@ -371,9 +371,9 @@ nm_ip6_config_add_dependent_routes(NMIP6Config *self,
     g_return_if_fail(ifindex > 0);
 
     /* For IPv6 addresses received via SLAAC/autoconf, we explicitly add the
-	 * device-routes (onlink) to NMIP6Config.
-	 *
-	 * For manually added IPv6 routes, add the device routes explicitly. */
+     * device-routes (onlink) to NMIP6Config.
+     *
+     * For manually added IPv6 routes, add the device routes explicitly. */
 
     /* Pre-generate multicast route */
     {
@@ -424,7 +424,7 @@ nm_ip6_config_add_dependent_routes(NMIP6Config *self,
         has_peer = !IN6_IS_ADDR_UNSPECIFIED(&my_addr->peer_address);
 
         /* If we have an IPv6 peer, we add two /128 routes
-		 * (unless, both addresses are identical). */
+         * (unless, both addresses are identical). */
         routes_n =
             (has_peer && !IN6_ARE_ADDR_EQUAL(&my_addr->address, &my_addr->peer_address)) ? 2 : 1;
 
@@ -973,8 +973,8 @@ nm_ip6_config_subtract(NMIP6Config *      dst,
             NMPlatformIP6Route *rr;
 
             /* the default route was penalized when merging it to the combined ip-config.
-			 * When subtracting the routes, we must re-do that process when comparing
-			 * the routes. */
+             * When subtracting the routes, we must re-do that process when comparing
+             * the routes. */
             o_lookup = nmp_object_stackinit_obj(&o_lookup_copy, o_src);
             rr       = NMP_OBJECT_CAST_IP6_ROUTE(&o_lookup_copy);
             rr->metric =
@@ -1093,8 +1093,8 @@ _nm_ip6_config_intersect_helper(NMIP6Config *      dst,
             NMPlatformIP6Route *rr;
 
             /* the default route was penalized when merging it to the combined ip-config.
-			 * When intersecting the routes, we must re-do that process when comparing
-			 * the routes. */
+             * When intersecting the routes, we must re-do that process when comparing
+             * the routes. */
             o_lookup = nmp_object_stackinit_obj(&o_lookup_copy, o_dst);
             rr       = NMP_OBJECT_CAST_IP6_ROUTE(&o_lookup_copy);
             rr->metric =
@@ -1450,7 +1450,7 @@ nm_ip6_config_replace(NMIP6Config *dst, const NMIP6Config *src, gboolean *releva
 
 #if NM_MORE_ASSERTS
     /* config_equal does not compare *all* the fields, therefore, we might have has_minor_changes
-	 * regardless of config_equal. But config_equal must correspond to has_relevant_changes. */
+     * regardless of config_equal. But config_equal must correspond to has_relevant_changes. */
     nm_assert(config_equal == !has_relevant_changes);
 #endif
 
@@ -1778,8 +1778,8 @@ nm_ip6_config_reset_routes_ndisc(NMIP6Config *         self,
 
             if (first_pref != gateways[i].preference && !kernel_support_rta_pref) {
                 /* We are unable to configure a router preference. Hence, we skip all gateways
-				 * with a different preference from the first gateway. Note, that the gateways
-				 * are sorted in order of highest to lowest preference. */
+                 * with a different preference from the first gateway. Note, that the gateways
+                 * are sorted in order of highest to lowest preference. */
                 break;
             }
         }
diff --git a/src/nm-keep-alive.c b/src/nm-keep-alive.c
index 7dc52f9db2..b24fac3e8e 100644
--- a/src/nm-keep-alive.c
+++ b/src/nm-keep-alive.c
@@ -73,14 +73,14 @@ _is_alive(NMKeepAlive *self)
     if (priv->dbus_client_watching) {
         if (_is_alive_dbus_client(self)) {
             /* no matter what, the keep-alive is alive, because there is a D-Bus client
-			 * still around keeping it alive. */
+             * still around keeping it alive. */
             return TRUE;
         }
         /* the D-Bus client is gone. The only other binding (below) for the connection's
-		 * visibility cannot keep the instance alive.
-		 *
-		 * As such, a D-Bus client watch is authoritative and overrules other conditions (that
-		 * we have so far). */
+         * visibility cannot keep the instance alive.
+         *
+         * As such, a D-Bus client watch is authoritative and overrules other conditions (that
+         * we have so far). */
         return FALSE;
     }
 
@@ -88,11 +88,11 @@ _is_alive(NMKeepAlive *self)
         && !NM_FLAGS_HAS(nm_settings_connection_get_flags(priv->connection),
                          NM_SETTINGS_CONNECTION_INT_FLAGS_VISIBLE)) {
         /* note that we only declare the keep-alive as dead due to invisible
-		 * connection, if
-		 *    (1) we monitor a connection, obviously
-		 *    (2) the connection was visible earlier and is no longer. It was
-		 *        was invisible all the time, it does not suffice.
-		 */
+         * connection, if
+         *    (1) we monitor a connection, obviously
+         *    (2) the connection was visible earlier and is no longer. It was
+         *        was invisible all the time, it does not suffice.
+         */
         return FALSE;
     }
 
@@ -134,16 +134,16 @@ connection_flags_changed(NMSettingsConnection *connection, NMKeepAlive *self)
         && NM_FLAGS_HAS(nm_settings_connection_get_flags(priv->connection),
                         NM_SETTINGS_CONNECTION_INT_FLAGS_VISIBLE)) {
         /* the profile was never visible but now it becomes visible.
-		 * Remember that.
-		 *
-		 * Before this happens (that is, if the device was invisible all along),
-		 * the keep alive instance is considered alive (w.r.t. watching the connection).
-		 *
-		 * The reason is to allow a user to manually activate an invisible profile and keep
-		 * it alive. At least, as long until the user logs out the first time (which is the
-		 * first time, the profiles changes from visible to invisible).
-		 *
-		 * Yes, that is odd. How to improve? */
+         * Remember that.
+         *
+         * Before this happens (that is, if the device was invisible all along),
+         * the keep alive instance is considered alive (w.r.t. watching the connection).
+         *
+         * The reason is to allow a user to manually activate an invisible profile and keep
+         * it alive. At least, as long until the user logs out the first time (which is the
+         * first time, the profiles changes from visible to invisible).
+         *
+         * Yes, that is odd. How to improve? */
         priv->connection_was_visible = TRUE;
     }
     _notify_alive(self);
@@ -223,8 +223,8 @@ _is_alive_dbus_client(NMKeepAlive *self)
 
     if (!priv->dbus_client_confirmed) {
         /* it's unconfirmed that the D-Bus client is really alive.
-		 * It looks like it is, but as we are claiming that to be
-		 * the case, issue an async GetNameOwner call to make sure. */
+         * It looks like it is, but as we are claiming that to be
+         * the case, issue an async GetNameOwner call to make sure. */
         priv->dbus_client_confirmed           = TRUE;
         priv->dbus_client_confirm_cancellable = g_cancellable_new();
 
@@ -439,18 +439,18 @@ _nm_keep_alive_set_owner(NMKeepAlive *self, GObject *owner)
     nm_assert(!owner || G_IS_OBJECT(owner));
 
     /* it's bad style to reset the owner object. You are supposed to
-	 * set it once, and clear it once. That's it. */
+     * set it once, and clear it once. That's it. */
     nm_assert(!owner || !priv->owner);
 
     /* optimally, we would take a reference to @owner. But the
-	 * owner already owns a reference to the keep-alive, so we cannot
-	 * just own a reference back.
-	 *
-	 * We could register a weak-pointer here. But instead, declare that
-	 * owner is required to set itself as owner when creating the
-	 * keep-alive instance, and unset itself when it lets go of the
-	 * keep-alive instance (at latest, when the owner itself gets destroyed).
-	 */
+     * owner already owns a reference to the keep-alive, so we cannot
+     * just own a reference back.
+     *
+     * We could register a weak-pointer here. But instead, declare that
+     * owner is required to set itself as owner when creating the
+     * keep-alive instance, and unset itself when it lets go of the
+     * keep-alive instance (at latest, when the owner itself gets destroyed).
+     */
     priv->owner = owner;
 }
 
diff --git a/src/nm-l3-config-data.c b/src/nm-l3-config-data.c
index 323e6236b3..81565136b6 100644
--- a/src/nm-l3-config-data.c
+++ b/src/nm-l3-config-data.c
@@ -705,10 +705,10 @@ nm_l3_config_data_unref(const NML3ConfigData *self)
     nm_assert(_NM_IS_L3_CONFIG_DATA(self, TRUE));
 
     /* NML3ConfigData aims to be an immutable, ref-counted type. The mode of operation
-	 * is to create/initialize the instance once, then seal it and pass around the reference.
-	 *
-	 * That means, also ref/unref operate on const pointers (otherwise, you'd have to cast all
-	 * the time). Hence, we cast away the constness during ref/unref/seal operations. */
+     * is to create/initialize the instance once, then seal it and pass around the reference.
+     *
+     * That means, also ref/unref operate on const pointers (otherwise, you'd have to cast all
+     * the time). Hence, we cast away the constness during ref/unref/seal operations. */
 
     mutable = (NML3ConfigData *) self;
 
@@ -860,7 +860,7 @@ nm_l3_config_data_lookup_address_6(const NML3ConfigData *self, const struct in6_
     nm_assert(_NM_IS_L3_CONFIG_DATA(self, TRUE));
 
     /* this works only, because the primary key for a Ipv6 address is the
-	 * ifindex and the "struct in6_addr". */
+     * ifindex and the "struct in6_addr". */
     nmp_object_stackinit_id_ip6_address(&obj_stack, self->ifindex, addr);
 
     head = nm_l3_config_data_lookup_obj(self, &obj_stack);
@@ -924,7 +924,7 @@ nm_l3_config_data_has_routes_with_type_local(const NML3ConfigData *self, int add
     }
 
     /* the value gets accumulated and cached. Doing that is also permissible to a
-	 * const/sealed instance. Hence, we cast the const-ness away. */
+     * const/sealed instance. Hence, we cast the const-ness away. */
     self_mutable = (NML3ConfigData *) self;
     if (IS_IPv4) {
         self_mutable->has_routes_with_type_local_4_set = TRUE;
@@ -1024,7 +1024,7 @@ _l3_config_data_add_obj(NMDedupMultiIndex *     multi_idx,
                         NMP_OBJECT_TYPE_IP6_ADDRESS,
                         NMP_OBJECT_TYPE_IP6_ROUTE));
     /* we go through extra lengths to accept a full obj_new object. That one,
-	 * can be reused by increasing the ref-count. */
+     * can be reused by increasing the ref-count. */
     if (!obj_new) {
         nm_assert(pl_new);
         obj_new = nmp_object_stackinit(&obj_new_stackinit, idx_type->obj_type, pl_new);
@@ -1061,10 +1061,10 @@ _l3_config_data_add_obj(NMDedupMultiIndex *     multi_idx,
             case NMP_OBJECT_TYPE_IP4_ADDRESS:
             case NMP_OBJECT_TYPE_IP6_ADDRESS:
                 /* for addresses that we read from the kernel, we keep the timestamps as defined
-				 * by the previous source (item_old). The reason is, that the other source configured the lifetimes
-				 * with "what should be" and the kernel values are "what turned out after configuring it".
-				 *
-				 * For other sources, the longer lifetime wins. */
+                 * by the previous source (item_old). The reason is, that the other source configured the lifetimes
+                 * with "what should be" and the kernel values are "what turned out after configuring it".
+                 *
+                 * For other sources, the longer lifetime wins. */
                 if ((obj_new->ip_address.addr_source == NM_IP_CONFIG_SOURCE_KERNEL
                      && obj_old->ip_address.addr_source != NM_IP_CONFIG_SOURCE_KERNEL)
                     || nm_platform_ip_address_cmp_expiry(NMP_OBJECT_CAST_IP_ADDRESS(obj_old),
@@ -1153,7 +1153,7 @@ _l3_config_best_default_route_find_better(const NMPObject *obj_cur, const NMPObj
     nm_assert(!obj_cur || nmp_object_ip_route_is_best_defaut_route(obj_cur));
 
     /* assumes that @obj_cur is already the best default route (or NULL). It checks whether
-	 * @obj_cmp is also a default route and returns the best of both. */
+     * @obj_cmp is also a default route and returns the best of both. */
     if (obj_cmp && nmp_object_ip_route_is_best_defaut_route(obj_cmp)) {
         guint32 metric_cur, metric_cmp;
 
@@ -1173,9 +1173,9 @@ _l3_config_best_default_route_find_better(const NMPObject *obj_cur, const NMPObj
             int c;
 
             /* Routes have the same metric. We still want to deterministically
-			 * prefer one or the other. It's important to consistently choose one
-			 * or the other, so that the order doesn't matter how routes are added
-			 * (and merged). */
+             * prefer one or the other. It's important to consistently choose one
+             * or the other, so that the order doesn't matter how routes are added
+             * (and merged). */
             c = nmp_object_cmp(obj_cur, obj_cmp);
             if (c != 0)
                 return c < 0 ? obj_cur : obj_cmp;
@@ -1850,11 +1850,11 @@ nm_l3_config_data_cmp(const NML3ConfigData *a, const NML3ConfigData *b)
     NM_CMP_FIELD(a, b, source);
 
     /* these fields are not considered by cmp():
-	 *
-	 * - multi_idx
-	 * - ref_count
-	 * - is_sealed
-	 */
+     *
+     * - multi_idx
+     * - ref_count
+     * - is_sealed
+     */
 
     return 0;
 }
@@ -1938,8 +1938,8 @@ nm_l3_config_data_get_blacklisted_ip4_routes(const NML3ConfigData *self, gboolea
     nm_assert(_NM_IS_L3_CONFIG_DATA(self, FALSE));
 
     /* For IPv6 slaac, we explicitly add the device-routes (onlink).
-	 * As we don't do that for IPv4 and manual IPv6 addresses. Add them here
-	 * as dependent routes. */
+     * As we don't do that for IPv4 and manual IPv6 addresses. Add them here
+     * as dependent routes. */
 
     nm_l3_config_data_iter_obj_for_each(&iter, self, &my_addr_obj, NMP_OBJECT_TYPE_IP4_ADDRESS)
     {
@@ -1958,13 +1958,13 @@ nm_l3_config_data_get_blacklisted_ip4_routes(const NML3ConfigData *self, gboolea
 
         if (nm_utils_ip4_address_is_zeronet(network_4)) {
             /* Kernel doesn't add device-routes for destinations that
-			 * start with 0.x.y.z. Skip them. */
+             * start with 0.x.y.z. Skip them. */
             continue;
         }
 
         if (my_addr->plen == 32 && my_addr->address == my_addr->peer_address) {
             /* Kernel doesn't add device-routes for /32 addresses unless
-			 * they have a peer. */
+             * they have a peer. */
             continue;
         }
 
@@ -2017,8 +2017,8 @@ nm_l3_config_data_add_dependent_routes(NML3ConfigData *self,
     nm_assert_addr_family(addr_family);
 
     /* For IPv6 slaac, we explicitly add the device-routes (onlink).
-	 * As we don't do that for IPv4 and manual IPv6 addresses. Add them here
-	 * as dependent routes. */
+     * As we don't do that for IPv4 and manual IPv6 addresses. Add them here
+     * as dependent routes. */
 
     if (!IS_IPv4) {
         /* Pre-generate multicast route */
@@ -2083,13 +2083,13 @@ nm_l3_config_data_add_dependent_routes(NML3ConfigData *self,
 
             if (nm_utils_ip4_address_is_zeronet(network_4)) {
                 /* Kernel doesn't add device-routes for destinations that
-				 * start with 0.x.y.z. Skip them. */
+                 * start with 0.x.y.z. Skip them. */
                 continue;
             }
 
             if (my_addr->a4.plen == 32 && my_addr->a4.address == my_addr->a4.peer_address) {
                 /* Kernel doesn't add device-routes for /32 addresses unless
-				 * they have a peer. */
+                 * they have a peer. */
                 continue;
             }
         } else {
@@ -2115,7 +2115,7 @@ nm_l3_config_data_add_dependent_routes(NML3ConfigData *self,
             int            routes_i;
 
             /* If we have an IPv6 peer, we add two /128 routes
-			 * (unless, both addresses are identical). */
+             * (unless, both addresses are identical). */
             for (routes_i = 0; routes_i < 2; routes_i++) {
                 struct in6_addr        a6_stack;
                 const struct in6_addr *a6;
@@ -2660,7 +2660,7 @@ nm_l3_config_data_new_clone(const NML3ConfigData *src, int ifindex)
     nm_assert(_NM_IS_L3_CONFIG_DATA(src, TRUE));
 
     /* pass 0, to use the original ifindex. You can also use this function to
-	 * copy the configuration for a different ifindex. */
+     * copy the configuration for a different ifindex. */
     nm_assert(ifindex >= 0);
     if (ifindex <= 0)
         ifindex = src->ifindex;
diff --git a/src/nm-l3-config-data.h b/src/nm-l3-config-data.h
index a0cd76dba4..f32b1ceb69 100644
--- a/src/nm-l3-config-data.h
+++ b/src/nm-l3-config-data.h
@@ -13,7 +13,7 @@ typedef enum {
     NM_L3_CONFIG_DAT_FLAGS_NONE = 0,
 
     /* if set, then the merge flag NM_L3_CONFIG_MERGE_FLAGS_NO_DEFAULT_ROUTES gets
-	 * ignored during merge. */
+     * ignored during merge. */
     NM_L3_CONFIG_DAT_FLAGS_IGNORE_MERGE_NO_DEFAULT_ROUTES = (1ull << 0),
 
     NM_L3_CONFIG_DAT_FLAGS_HAS_DNS_PRIORITY_4 = (1ull << 1),
@@ -28,18 +28,18 @@ typedef enum {
     NM_L3_CONFIG_ADD_FLAGS_NONE = 0,
 
     /* If the object does not yet exist, it will be added. If it already exists,
-	 * by default the object will be replaced. With this flag, the new object will
-	 * be merged with the existing one. */
+     * by default the object will be replaced. With this flag, the new object will
+     * be merged with the existing one. */
     NM_L3_CONFIG_ADD_FLAGS_MERGE = (1ull << 0),
 
     /* If the object does not yet exist, it will be added. If it already exists,
-	 * by default the object will be replaced. With this flag, the add will have
-	 * no effect and the existing object will be kept. */
+     * by default the object will be replaced. With this flag, the add will have
+     * no effect and the existing object will be kept. */
     NM_L3_CONFIG_ADD_FLAGS_EXCLUSIVE = (1ull << 1),
 
     /* A new object gets appended by default. If the object already exists,
-	 * by default it will not be moved. With APPEND-FORCE, we will always move
-	 * an existing object to the end of the list. */
+     * by default it will not be moved. With APPEND-FORCE, we will always move
+     * an existing object to the end of the list. */
     NM_L3_CONFIG_ADD_FLAGS_APPEND_FORCE = (1ull << 2),
 } NML3ConfigAddFlags;
 
@@ -165,11 +165,11 @@ static inline gboolean
 NM_IS_L3_CONFIG_DATA(const NML3ConfigData *self)
 {
     /* NML3ConfigData is not an NMObject/GObject, so we cannot ask which type it has.
-	 * This check here is really only useful for assertions, and there it is
-	 * enough to check whether the pointer is not NULL.
-	 *
-	 * Additionally, also call nm_l3_config_data_get_ifindex(), which does more
-	 * checks during nm_assert(). */
+     * This check here is really only useful for assertions, and there it is
+     * enough to check whether the pointer is not NULL.
+     *
+     * Additionally, also call nm_l3_config_data_get_ifindex(), which does more
+     * checks during nm_assert(). */
     nm_assert(nm_l3_config_data_get_ifindex(self) > 0);
     return !!self;
 }
diff --git a/src/nm-l3cfg.c b/src/nm-l3cfg.c
index 31a320328b..b76c30e4b8 100644
--- a/src/nm-l3cfg.c
+++ b/src/nm-l3cfg.c
@@ -73,8 +73,8 @@ typedef struct {
     in_addr_t addr;
 
     /* This is only relevant while in state ACD_STATE_PROBING. It's the
-	 * duration for how long we probe, and @probing_timestamp_msec is the
-	 * timestamp when we start probing. */
+     * duration for how long we probe, and @probing_timestamp_msec is the
+     * timestamp when we start probing. */
     guint32 probing_timeout_msec;
 
     CList acd_lst;
@@ -95,7 +95,7 @@ typedef struct {
     AcdState acd_state;
 
     /* The probe result. This is only relevant if @acd_state is ACD_STATE_PROBE_DONE.
-	 * In state ACD_STATE_ANNOUNCING the @probe_result must be TRUE. */
+     * In state ACD_STATE_ANNOUNCING the @probe_result must be TRUE. */
     bool probe_result : 1;
 
     bool announcing_failed_is_retrying : 1;
@@ -362,9 +362,9 @@ _l3_acd_ipv4_addresses_on_link_update(NML3Cfg * self,
     }
 
     /* when we remove an IPv4 address from kernel, we cannot know whether the same address is still
-	 * present (with a different prefix length or peer). So we cannot be sure whether we removed
-	 * the only address, or whether more are still present. All we can do is forget about the
-	 * cached addresses, and fetch them new the next time we need the information. */
+     * present (with a different prefix length or peer). So we cannot be sure whether we removed
+     * the only address, or whether more are still present. All we can do is forget about the
+     * cached addresses, and fetch them new the next time we need the information. */
     nm_clear_pointer(&self->priv.p->acd_ipv4_addresses_on_link, g_hash_table_unref);
     self->priv.p->acd_ipv4_addresses_on_link_has = FALSE;
     if (acd_data)
@@ -472,9 +472,9 @@ _l3cfg_externally_removed_objs_drop_unused(NML3Cfg *self)
     while (g_hash_table_iter_next(&h_iter, (gpointer *) &obj, NULL)) {
         if (!nm_l3_config_data_lookup_route_obj(self->priv.p->combined_l3cd_commited, obj)) {
             /* The object is no longer tracked in the configuration.
-			 * The externally_removed_objs_hash is to prevent adding entires that were
-			 * removed externally, so if we don't plan to add the entry, we no longer need to track
-			 * it. */
+             * The externally_removed_objs_hash is to prevent adding entires that were
+             * removed externally, so if we don't plan to add the entry, we no longer need to track
+             * it. */
             (*(_l3cfg_externally_removed_objs_counter(self, NMP_OBJECT_GET_TYPE(obj))))--;
             g_hash_table_iter_remove(&h_iter);
             _LOGD("externally-removed: untrack %s",
@@ -818,7 +818,7 @@ nm_l3cfg_property_emit_unregister(NML3Cfg *         self,
 
         if (target_property) {
             /* if a target-property is given, we don't have another entry in
-			 * the list. */
+             * the list. */
             return;
         }
     }
@@ -924,10 +924,10 @@ static void
 _l3_acd_platform_commit_acd_update(NML3Cfg *self)
 {
     /* The idea with NML3Cfg is that multiple users (NMDevice/NMVpnConnection) share one layer 3 configuration
-	 * and push their (portion of) IP configuration to it. That implies, that any user may issue nm_l3cfg_platform_commit()
-	 * at any time, in order to say that a new configuration is ready.
-	 *
-	 * This makes the mechanism also suitable for internally triggering a commit when ACD completes. */
+     * and push their (portion of) IP configuration to it. That implies, that any user may issue nm_l3cfg_platform_commit()
+     * at any time, in order to say that a new configuration is ready.
+     *
+     * This makes the mechanism also suitable for internally triggering a commit when ACD completes. */
     _LOGT("acd: acd update now");
     nm_l3cfg_platform_commit(self, NM_L3_CFG_COMMIT_TYPE_AUTO);
 }
@@ -1017,8 +1017,8 @@ _l3_acd_nacd_event(int fd, GIOCondition condition, gpointer user_data)
             char          sbuf_addr[NM_UTILS_INET_ADDRSTRLEN];
 
             /* since we announce with N_ACD_DEFEND_ALWAYS, we don't actually expect any
-			 * conflict reported and don't handle it. It would be complicated to de-configure
-			 * the address. */
+             * conflict reported and don't handle it. It would be complicated to de-configure
+             * the address. */
             nm_assert(event->event == N_ACD_EVENT_DEFENDED);
 
             n_acd_probe_get_userdata(event->_acd_event_payload.probe, (void **) &acd_data);
@@ -1067,7 +1067,7 @@ _l3_acd_nacd_event(int fd, GIOCondition condition, gpointer user_data)
 out:
     if (!success) {
         /* Something is seriously wrong with our nacd instance. We handle that by resetting the
-		 * ACD instance. */
+         * ACD instance. */
         _l3_acd_nacd_instance_reset(self, NM_TERNARY_TRUE, TRUE);
     }
 
@@ -1156,7 +1156,7 @@ again:
 
     if (self->priv.p->nacd_instance_ensure_retry) {
         /* we just tried to create an instance and failed. We are rate-limited,
-		 * don't yet try again. */
+         * don't yet try again. */
         NM_SET_OUT(out_acd_not_supported, self->priv.p->nacd_acd_not_supported);
         return NULL;
     }
@@ -1192,11 +1192,11 @@ again:
 
 failed_create_acd:
     /* is-internal-error means that we failed to create the NAcd instance. Most likely due
-	 * to being unable to create a file descriptor. Anyway, something is seriously wrong here.
-	 *
-	 * Otherwise, the MAC address might just not be suitable (ETH_ALEN) or we might have
-	 * not NMPlatformLink. In that case, it means the interface is currently not ready to
-	 * do acd. */
+     * to being unable to create a file descriptor. Anyway, something is seriously wrong here.
+     *
+     * Otherwise, the MAC address might just not be suitable (ETH_ALEN) or we might have
+     * not NMPlatformLink. In that case, it means the interface is currently not ready to
+     * do acd. */
     self->priv.p->nacd_acd_not_supported = acd_not_supported;
     _l3_acd_nacd_instance_reset(self, NM_TERNARY_TRUE, FALSE);
     goto again;
@@ -1246,7 +1246,7 @@ _l3_acd_data_free_trackers(NML3Cfg *self, AcdData *acd_data, gboolean all /* or
                                 &acd_data->acd_track_lst_head,
                                 acd_track_lst) {
         /* If not "all" is requested, we only delete the dirty ones
-		 * (and mark the survivors as dirty right away). */
+         * (and mark the survivors as dirty right away). */
         if (!all && !acd_track->acd_dirty) {
             acd_track->acd_dirty = TRUE;
             continue;
@@ -1300,7 +1300,7 @@ _l3_acd_data_add(NML3Cfg *             self,
 
     if (acd_timeout_msec > ACD_MAX_TIMEOUT_MSEC) {
         /* we limit the maximum timeout. Otherwise we have to handle integer overflow
-		 * when adding timeouts. */
+         * when adding timeouts. */
         acd_timeout_msec = ACD_MAX_TIMEOUT_MSEC;
     }
 
@@ -1376,9 +1376,9 @@ _l3_acd_data_add_all(NML3Cfg *self, const L3ConfigData *const *infos, guint info
     }
 
     /* Then we do a pre-flight check, whether some of the acd_data entries can already
-	 * move forward to automatically pass ACD. That is the case if acd_timeout_msec
-	 * is zero (to disable ACD) or if the address is already configured on the
-	 * interface. */
+     * move forward to automatically pass ACD. That is the case if acd_timeout_msec
+     * is zero (to disable ACD) or if the address is already configured on the
+     * interface. */
     c_list_for_each_entry (acd_data, &self->priv.p->acd_lst_head, acd_lst)
         _l3_acd_data_state_change(self, acd_data, ACD_STATE_CHANGE_MODE_INIT, NULL);
 }
@@ -1605,20 +1605,20 @@ _l3_acd_data_state_change(NML3Cfg *          self,
     gboolean    was_probing;
 
     /* Keeping track of ACD inevitably requires keeping (and mutating) state. Then a multitude of
-	 * things can happen, and depending on the state, we need to do something.
-	 *
-	 * Here, all the state for one address that we probe/announce is tracked in AcdData/acd_data.
-	 *
-	 * The acd_data has a list of AcdTrackData/acd_track_lst_head, which are configuration items
-	 * that are interested in configuring this address. The "owners" of the ACD check for a certain
-	 * address.
-	 *
-	 * We try to do all the state changes in this _l3_acd_data_state_change() function, where --
-	 * depending on the @state_change_mode -- we progress the state.
-	 *
-	 * It is complicated, but I think this is not really avoidable if you want to handle all
-	 * the special things (state-changes) that can happen.
-	 */
+     * things can happen, and depending on the state, we need to do something.
+     *
+     * Here, all the state for one address that we probe/announce is tracked in AcdData/acd_data.
+     *
+     * The acd_data has a list of AcdTrackData/acd_track_lst_head, which are configuration items
+     * that are interested in configuring this address. The "owners" of the ACD check for a certain
+     * address.
+     *
+     * We try to do all the state changes in this _l3_acd_data_state_change() function, where --
+     * depending on the @state_change_mode -- we progress the state.
+     *
+     * It is complicated, but I think this is not really avoidable if you want to handle all
+     * the special things (state-changes) that can happen.
+     */
 
     nm_assert(NM_IS_L3CFG(self));
     nm_assert(acd_data);
@@ -1633,15 +1633,15 @@ _l3_acd_data_state_change(NML3Cfg *          self,
         gboolean      any_no_timeout;
 
         /* we are called from _l3_acd_data_add_all(), and we do a fast check whether
-		 * newly tracked entries already passed ACD so that we can use the address
-		 * right away. */
+         * newly tracked entries already passed ACD so that we can use the address
+         * right away. */
 
         if (_l3_acd_ipv4_addresses_on_link_contains(self, acd_data->addr)) {
             /* the address is already configured on the link. It is an automatic pass. */
             if (_acd_data_collect_tracks_data(acd_data, FALSE, NM_TERNARY_DEFAULT, NULL) <= 0) {
                 /* The entry has no non-dirty trackers, that means, it's no longer referenced
-				 * and will be removed during the next _l3_acd_data_prune(). We can ignore
-				 * this entry. */
+                 * and will be removed during the next _l3_acd_data_prune(). We can ignore
+                 * this entry. */
                 return;
             }
             log_reason = "address initially already configured";
@@ -1649,10 +1649,10 @@ _l3_acd_data_state_change(NML3Cfg *          self,
         }
 
         /* we are called at the end of _l3_acd_data_add_all(). We updated the list of a
-		 * all tracked IP addresses before we actually collect the addresses that are
-		 * ready. We don't do regular handling of ACD states at this point, however,
-		 * we check whether ACD for new elements is disabled entirely, so we can signal
-		 * the address are ready right away (without going through another hop). */
+         * all tracked IP addresses before we actually collect the addresses that are
+         * ready. We don't do regular handling of ACD states at this point, however,
+         * we check whether ACD for new elements is disabled entirely, so we can signal
+         * the address are ready right away (without going through another hop). */
 
         if (acd_data->acd_state != ACD_STATE_INIT) {
             /* this element is not new and we don't perform the quick-check. */
@@ -1671,14 +1671,14 @@ _l3_acd_data_state_change(NML3Cfg *          self,
         }
         if (!any_no_timeout) {
             /* there are elements that request the address, but they all specify
-			 * an ACD timeout. We cannot progress the state. */
+             * an ACD timeout. We cannot progress the state. */
             return;
         }
 
         /* ACD is disabled, we can artificially moving the state further to
-		 * ACD_STATE_PROBE_DONE and configure the address right away. This avoids
-		 * that we go through another hop.
-		 */
+         * ACD_STATE_PROBE_DONE and configure the address right away. This avoids
+         * that we go through another hop.
+         */
         log_reason = "ACD disabled by configuration from the start";
         goto handle_probing_acd_good;
     }
@@ -1732,10 +1732,10 @@ _l3_acd_data_state_change(NML3Cfg *          self,
             }
 
             /* probing started (with the original timeout. Note that acd_data->probing_time*_msec
-			 * no longer corresponds to the actual timeout of the nacd_probe. This is not a problem
-			 * because at this point we only trust the internal timer from nacd_probe to get
-			 * it right. Instead, we keep acd_data->probing_time*_msec unchanged, to remember when
-			 * we originally wanted to start. */
+             * no longer corresponds to the actual timeout of the nacd_probe. This is not a problem
+             * because at this point we only trust the internal timer from nacd_probe to get
+             * it right. Instead, we keep acd_data->probing_time*_msec unchanged, to remember when
+             * we originally wanted to start. */
             _LOGT_acd(acd_data,
                       "state: probing started (after retry, timeout %u msec)",
                       acd_data->probing_timeout_msec);
@@ -1744,7 +1744,7 @@ _l3_acd_data_state_change(NML3Cfg *          self,
 
         if (acd_data->acd_state == ACD_STATE_PROBE_DONE && !acd_data->probe_result) {
             /* Probing is done, but previously we detected a conflict. After a restart, we retry to
-			 * probe. */
+             * probe. */
             nm_assert(!acd_data->nacd_probe);
             nm_assert(!acd_data->announcing_failed_is_retrying);
 
@@ -1806,26 +1806,26 @@ _l3_acd_data_state_change(NML3Cfg *          self,
 
     case ACD_STATE_CHANGE_MODE_EXTERNAL_REMOVED:
         /* The address got removed. Either we ourself removed it or it was removed externally.
-		 * In either case, it's not clear what we should do about that, regardless in which
-		 * ACD state we are, so ignore it. */
+         * In either case, it's not clear what we should do about that, regardless in which
+         * ACD state we are, so ignore it. */
         _LOGT_acd(acd_data, "state: address was externally removed. Ignore");
         return;
 
     case ACD_STATE_CHANGE_MODE_NACD_DOWN:
         if (acd_data->acd_state < ACD_STATE_PROBE_DONE) {
             /* we are probing, but the probe has a problem that the link went down. Maybe
-			 * we need to restart. */
+             * we need to restart. */
 
             nm_assert(acd_data->acd_state == ACD_STATE_PROBING);
 
             if (!acd_data->nacd_probe) {
                 /* we are in probing state, but currently not really probing. A timer is
-				 * running, and we will handle this situation that way. */
+                 * running, and we will handle this situation that way. */
                 return;
             }
 
             /* We abort the probing, but we also schedule a timer to restart it. Let
-			 * the regular re-start handling handle this. */
+             * the regular re-start handling handle this. */
             _LOGT_acd(acd_data,
                       "state: interface-down. Probing aborted but we keep waiting to retry");
             acd_data->nacd_probe = n_acd_probe_free(acd_data->nacd_probe);
@@ -1834,9 +1834,9 @@ _l3_acd_data_state_change(NML3Cfg *          self,
         }
 
         /* We already completed a probe and acted accordingly (by either configuring the address
-		 * already or by rejecting it). We cannot (easily) re-evaluate what to do now. Should
-		 * we later restart probing? But what about the decisions we already made??
-		 * Ignore the situation. */
+         * already or by rejecting it). We cannot (easily) re-evaluate what to do now. Should
+         * we later restart probing? But what about the decisions we already made??
+         * Ignore the situation. */
         return;
 
     case ACD_STATE_CHANGE_MODE_LINK_NOW_UP:
@@ -1855,7 +1855,7 @@ _l3_acd_data_state_change(NML3Cfg *          self,
 
             if (!acd_data->nacd_probe) {
                 /* We currently are waiting to restart probing. We don't handle the link-up
-				 * event here, we only trigger a timeout right away. */
+                 * event here, we only trigger a timeout right away. */
                 _LOGT_acd(acd_data,
                           "state: ignore link up event while we are waiting to start probing");
                 _l3_acd_data_timeout_schedule(acd_data, now_msec, now_msec, TRUE);
@@ -1864,7 +1864,7 @@ _l3_acd_data_state_change(NML3Cfg *          self,
 
             if (acd_data->probing_timestamp_msec + ACD_WAIT_PROBING_RESTART_TIME_MSEC >= now_msec) {
                 /* This probe was already started quite a while ago. We ignore the link-up event
-				 * and let it complete regularly. This is to avoid restarting to probing indefinitely. */
+                 * and let it complete regularly. This is to avoid restarting to probing indefinitely. */
                 _LOGT_acd(acd_data, "state: ignore link up event for a probe started long ago");
                 return;
             }
@@ -1886,13 +1886,13 @@ _l3_acd_data_state_change(NML3Cfg *          self,
             NM_SWAP(&probe, &acd_data->nacd_probe);
 
             /* We just restarted probing. Note that we don't touch the original acd_data->probing_time*_msec
-			 * times, otherwise a repeated link up/down cycle could extend the probing indefinitely.
-			 *
-			 * This is despite the new probe just started counting now. So, at this point, the
-			 * timestamp/timeout of acd_data no longer corresponds to the internal timestamp of
-			 * acd_data->nacd_probe. But since we don't run our own timer against the internal timer of
-			 * acd_data->nacd_probe, that is not a problem.
-			 */
+             * times, otherwise a repeated link up/down cycle could extend the probing indefinitely.
+             *
+             * This is despite the new probe just started counting now. So, at this point, the
+             * timestamp/timeout of acd_data no longer corresponds to the internal timestamp of
+             * acd_data->nacd_probe. But since we don't run our own timer against the internal timer of
+             * acd_data->nacd_probe, that is not a problem.
+             */
             _LOGT_acd(acd_data,
                       "state: probing restarted (after link up, new timeout %u msec)",
                       acd_data->probing_timeout_msec);
@@ -1900,7 +1900,7 @@ _l3_acd_data_state_change(NML3Cfg *          self,
         }
 
         /* we are already done with the ACD state. Bringing up an interface has
-		 * no further consequence w.r.t. the ACD state. */
+         * no further consequence w.r.t. the ACD state. */
         return;
 
     case ACD_STATE_CHANGE_MODE_INSTANCE_RESET:
@@ -1935,7 +1935,7 @@ _l3_acd_data_state_change(NML3Cfg *          self,
 
 handle_post_commit:
     /* we just did a commit of the IP configuration and now visit all ACD states
-	 * and kick off the necessary actions... */
+     * and kick off the necessary actions... */
     if (_l3_acd_ipv4_addresses_on_link_contains(self, acd_data->addr)) {
         log_reason = "address already configured";
         goto handle_probing_acd_good;
@@ -2006,15 +2006,15 @@ handle_post_commit:
 
         if (!acd_data->nacd_probe) {
             /* we are currently waiting for restarting a probe. At this point, at most we have
-			 * to adjust the timeout/timestamp and let the regular timeouts handle this. */
+             * to adjust the timeout/timestamp and let the regular timeouts handle this. */
 
             if (new_expiry_msec >= old_expiry_msec) {
                 /* the running timeout expires before the new timeout. We don't update the timestamp/timerout,
-				 * because we don't want to prolong the overall probing time. */
+                 * because we don't want to prolong the overall probing time. */
                 return;
             }
             /* update the timers after out timeout got reduced. Also, reschedule the timeout
-			 * so that it expires immediately. */
+             * so that it expires immediately. */
             acd_data->probing_timestamp_msec = now_msec;
             acd_data->probing_timeout_msec   = acd_timeout_msec;
             _l3_acd_data_timeout_schedule(acd_data, now_msec, now_msec, TRUE);
@@ -2023,7 +2023,7 @@ handle_post_commit:
 
         if (new_expiry_msec >= old_expiry_msec) {
             /* we already have ACD running with a timeout that expires before the requested one. There
-			 * is nothing to do at this time. */
+             * is nothing to do at this time. */
             return;
         }
 
@@ -2057,8 +2057,8 @@ handle_post_commit:
         }
 
         /* We update the timestamps (after also restarting the probe).
-		 *
-		 * Note that we only reduced the overall expiry. */
+         *
+         * Note that we only reduced the overall expiry. */
         acd_data->probing_timestamp_msec = now_msec;
         acd_data->probing_timeout_msec   = acd_timeout_msec;
         _LOGT_acd(acd_data, "state: restart probing (timeout %u msec)", acd_timeout_msec);
@@ -2116,7 +2116,7 @@ handle_probe_done:
         nm_assert(acd_data->acd_state == ACD_STATE_PROBE_DONE);
         nm_assert(!acd_data->nacd_probe);
         /* we just completed probing with negative result.
-		 * Emit a signal, but also reschedule a timer to restart. */
+         * Emit a signal, but also reschedule a timer to restart. */
         if (was_probing) {
             _LOGT_acd(acd_data, "state: acd probe failed; signal failure");
             acd_data->probing_timestamp_msec =
@@ -2146,7 +2146,7 @@ handle_probe_done:
 
         if (acd_data->announcing_failed_is_retrying) {
             /* we already failed to create a probe. We are ratelimited to retry, but
-			 * we have a timer pending... */
+             * we have a timer pending... */
             return;
         }
 
@@ -2158,7 +2158,7 @@ handle_probe_done:
                                                    &failure_reason);
         if (!probe) {
             /* we failed to create a probe for announcing the address. We log a (rate limited)
-			 * warning and start a timer to retry. */
+             * warning and start a timer to retry. */
             _LOGT_acd(acd_data,
                       "state: start announcing failed to create probe (%s)",
                       failure_reason);
@@ -2248,11 +2248,11 @@ _l3_config_datas_get_sorted_cmp(gconstpointer p_a, gconstpointer p_b, gpointer u
     nm_assert(nm_l3_config_data_get_ifindex(a->l3cd) == nm_l3_config_data_get_ifindex(b->l3cd));
 
     /* we sort the entries with higher priority (more important, lower numerical value)
-	 * first. */
+     * first. */
     NM_CMP_FIELD(a, b, priority);
 
     /* if the priority is not unique, we sort them in the order they were added,
-	 * with the oldest first (lower numerical value). */
+     * with the oldest first (lower numerical value). */
     NM_CMP_FIELD(a, b, pseudo_timestamp);
 
     return nm_assert_unreachable_val(0);
@@ -2646,8 +2646,8 @@ _routes_temporary_not_available_timeout(gpointer user_data)
         return G_SOURCE_REMOVE;
 
     /* we check the timeouts again. That is, because we allow to remove
-	 * entries from routes_temporary_not_available_hash, without rescheduling
-	 * out timeouts. */
+     * entries from routes_temporary_not_available_hash, without rescheduling
+     * out timeouts. */
 
     now_msec = nm_utils_get_monotonic_timestamp_msec();
 
@@ -2666,7 +2666,7 @@ _routes_temporary_not_available_timeout(gpointer user_data)
 
     if (any_expired) {
         /* a route expired. We emit a signal, but we don't schedule it again. That will
-		 * only happen if the user calls nm_l3cfg_platform_commit() again. */
+         * only happen if the user calls nm_l3cfg_platform_commit() again. */
         _nm_l3cfg_emit_signal_notify(
             self,
             NM_L3_CONFIG_NOTIFY_TYPE_ROUTES_TEMPORARY_NOT_AVAILABLE_EXPIRED,
@@ -2827,7 +2827,7 @@ _platform_commit(NML3Cfg *         self,
 
     if (changed_combined_l3cd) {
         /* our combined configuration changed. We may track entries in externally_removed_objs_hash,
-		 * which are not longer to be considered by our configuration. We need to forget about them. */
+         * which are not longer to be considered by our configuration. We need to forget about them. */
         _l3cfg_externally_removed_objs_drop_unused(self);
     }
 
@@ -2880,9 +2880,9 @@ _platform_commit(NML3Cfg *         self,
                                                            route_table_sync);
     } else if (commit_type == NM_L3_CFG_COMMIT_TYPE_UPDATE) {
         /* during update, we do a cross with the previous configuration.
-		 *
-		 * Of course, if an entry is both to be pruned and to be added, then
-		 * the latter wins. So, this works just nicely. */
+         *
+         * Of course, if an entry is both to be pruned and to be added, then
+         * the latter wins. So, this works just nicely. */
         if (l3cd_old) {
             const NMDedupMultiHeadEntry *head_entry;
 
@@ -2943,8 +2943,8 @@ nm_l3cfg_platform_commit(NML3Cfg *self, NML3CfgCommitType commit_type)
     switch (commit_type) {
     case NM_L3_CFG_COMMIT_TYPE_AUTO:
         /* if in "AUTO" mode we currently have commit-type "UPDATE", that
-		 * causes also the following update to still be "UPDATE". Either
-		 * the same commit */
+         * causes also the following update to still be "UPDATE". Either
+         * the same commit */
         commit_type_detected = TRUE;
         commit_type          = nm_l3cfg_commit_type_get(self);
         if (commit_type == NM_L3_CFG_COMMIT_TYPE_UPDATE)
@@ -3129,12 +3129,12 @@ nm_l3cfg_has_commited_ip6_addresses_pending_dad(NML3Cfg *self)
         return FALSE;
 
     /* we iterate over all addresses in platform, and check whether the tentative
-	 * addresses are tracked by our l3cd. Not the other way around, because we assume
-	 * that there are few addresses in platform that are still tentative, so
-	 * we only need to lookup few platform addresses in l3cd.
-	 *
-	 * Of course, all lookups are O(1) anyway, so in any case the operation is
-	 * O(n) (once "n" being the addresses in platform, and once in l3cd). */
+     * addresses are tracked by our l3cd. Not the other way around, because we assume
+     * that there are few addresses in platform that are still tentative, so
+     * we only need to lookup few platform addresses in l3cd.
+     *
+     * Of course, all lookups are O(1) anyway, so in any case the operation is
+     * O(n) (once "n" being the addresses in platform, and once in l3cd). */
 
     nmp_lookup_init_object(&plat_lookup, NMP_OBJECT_TYPE_IP6_ADDRESS, self->priv.ifindex);
 
diff --git a/src/nm-l3cfg.h b/src/nm-l3cfg.h
index 3b76d43607..0129554fee 100644
--- a/src/nm-l3cfg.h
+++ b/src/nm-l3cfg.h
@@ -27,9 +27,9 @@ typedef enum {
     NM_L3_CONFIG_NOTIFY_TYPE_POST_COMMIT,
 
     /* NML3Cfg hooks to the NMPlatform signals for link, addresses and routes.
-	 * It re-emits the signal on an idle handler. The purpose is for something
-	 * like NMDevice which is already subscribed to these signals, it can get the
-	 * notifications without also subscribing directly to the platform. */
+     * It re-emits the signal on an idle handler. The purpose is for something
+     * like NMDevice which is already subscribed to these signals, it can get the
+     * notifications without also subscribing directly to the platform. */
     NM_L3_CONFIG_NOTIFY_TYPE_PLATFORM_CHANGE_ON_IDLE,
 
     _NM_L3_CONFIG_NOTIFY_TYPE_NUM,
@@ -191,26 +191,26 @@ gboolean nm_l3cfg_remove_config_all(NML3Cfg *self, gconstpointer tag, gboolean o
 typedef enum _nm_packed {
 
     /* the NML3Cfg instance tracks with nm_l3cfg_commit_setup_register() the requested commit type.
-	 * Use _NM_L3_CFG_COMMIT_TYPE_AUTO to automatically choose the level as requested. */
+     * Use _NM_L3_CFG_COMMIT_TYPE_AUTO to automatically choose the level as requested. */
     NM_L3_CFG_COMMIT_TYPE_AUTO,
 
     /* Don't touch the interface. */
     NM_L3_CFG_COMMIT_TYPE_NONE,
 
     /* ASSUME means to keep any pre-existing extra routes/addresses, while
-	 * also not adding routes/addresses that are not present yet. This is to
-	 * gracefully take over after restart, where the existing IP configuration
-	 * should not change. */
+     * also not adding routes/addresses that are not present yet. This is to
+     * gracefully take over after restart, where the existing IP configuration
+     * should not change. */
     NM_L3_CFG_COMMIT_TYPE_ASSUME,
 
     /* UPDATE means to add new addresses/routes, while also removing addresses/routes
-	 * that are no longer present (but were previously configured by NetworkManager).
-	 * Routes/addresses that were removed externally won't be re-added, and routes/addresses
-	 * that are added externally won't be removed. */
+     * that are no longer present (but were previously configured by NetworkManager).
+     * Routes/addresses that were removed externally won't be re-added, and routes/addresses
+     * that are added externally won't be removed. */
     NM_L3_CFG_COMMIT_TYPE_UPDATE,
 
     /* This is a full sync. It configures the IP addresses/routes that are indicated,
-	 * while removing the existing ones from the interface. */
+     * while removing the existing ones from the interface. */
     NM_L3_CFG_COMMIT_TYPE_REAPPLY,
 
 } NML3CfgCommitType;
diff --git a/src/nm-logging.c b/src/nm-logging.c
index 35229221e8..f261e7c9e8 100644
--- a/src/nm-logging.c
+++ b/src/nm-logging.c
@@ -99,11 +99,11 @@ typedef struct {
     const char *syslog_identifier;
 
     /* before we setup syslog (during start), the backend defaults to GLIB, meaning:
-	 * we use g_log() for all logging. At that point, the application is not yet supposed
-	 * to do any logging and doing so indicates a bug.
-	 *
-	 * Afterwards, the backend is either SYSLOG or JOURNAL. From that point, also
-	 * g_log() is redirected to this backend via a logging handler. */
+     * we use g_log() for all logging. At that point, the application is not yet supposed
+     * to do any logging and doing so indicates a bug.
+     *
+     * Afterwards, the backend is either SYSLOG or JOURNAL. From that point, also
+     * g_log() is redirected to this backend via a logging handler. */
     LogBackend log_backend;
 } Global;
 
@@ -117,8 +117,8 @@ static GlobalMain gl_main = {};
 
 static union {
     /* a union with an immutable and a mutable alias for the Global.
-	 * Since nm-logging must be thread-safe, we must take care at which
-	 * places we only read value ("imm") and where we modify them ("mut"). */
+     * Since nm-logging must be thread-safe, we must take care at which
+     * places we only read value ("imm") and where we modify them ("mut"). */
     Global       mut;
     const Global imm;
 } gl = {
@@ -134,9 +134,9 @@ static union {
 
 NMLogDomain _nm_logging_enabled_state[_LOGL_N_REAL] = {
     /* nm_logging_setup ("INFO", LOGD_DEFAULT_STRING, NULL, NULL);
-	 *
-	 * Note: LOGD_VPN_PLUGIN is special and must be disabled for
-	 * DEBUG and TRACE levels. */
+     *
+     * Note: LOGD_VPN_PLUGIN is special and must be disabled for
+     * DEBUG and TRACE levels. */
     [LOGL_INFO] = LOGD_DEFAULT,
     [LOGL_WARN] = LOGD_DEFAULT,
     [LOGL_ERR]  = LOGD_DEFAULT,
@@ -305,8 +305,8 @@ nm_logging_setup(const char *level, const char *domains, char **bad_domains, GEr
         NMLogDomain    bits;
 
         /* LOGD_VPN_PLUGIN is protected, that is, when setting ALL or DEFAULT,
-		 * it does not enable the verbose levels DEBUG and TRACE, because that
-		 * may expose sensitive data. */
+         * it does not enable the verbose levels DEBUG and TRACE, because that
+         * may expose sensitive data. */
         NMLogDomain protect = LOGD_NONE;
 
         p = strchr(s, ':');
@@ -321,8 +321,8 @@ nm_logging_setup(const char *level, const char *domains, char **bad_domains, GEr
 
         if (domains_free) {
             /* The caller didn't provide any domains to set (`nmcli general logging level DEBUG`).
-			 * We reset all domains that were previously set, but we still want to protect
-			 * VPN_PLUGIN domain. */
+             * We reset all domains that were previously set, but we still want to protect
+             * VPN_PLUGIN domain. */
             protect = LOGD_VPN_PLUGIN;
         }
 
@@ -401,8 +401,8 @@ nm_logging_setup(const char *level, const char *domains, char **bad_domains, GEr
 
     if (had_platform_debug && !_nm_logging_enabled_lockfree(LOGL_DEBUG, LOGD_PLATFORM)) {
         /* when debug logging is enabled, platform will cache all access to
-		 * sysctl. When the user disables debug-logging, we want to clear that
-		 * cache right away. */
+         * sysctl. When the user disables debug-logging, we want to clear that
+         * cache right away. */
         _nm_logging_clear_platform_logging_cache();
     }
 
@@ -462,8 +462,8 @@ _domains_to_string(gboolean          include_level_override,
     int            i;
 
     /* We don't just return g_strdup() the logging domains that were set during
-	 * nm_logging_setup(), because we want to expand "DEFAULT" and "ALL".
-	 */
+     * nm_logging_setup(), because we want to expand "DEFAULT" and "ALL".
+     */
 
     str = g_string_sized_new(75);
     for (diter = &domain_desc[0]; diter->name; diter++) {
@@ -532,7 +532,7 @@ again:
         nm_utils_strbuf_append_str(&buf_p, &buf_l, LOGD_ALL_STRING);
 
         /* Did you modify the logging domains (or their names)? Adjust the size of
-		 * _all_logging_domains_to_str buffer above to have the exact size. */
+         * _all_logging_domains_to_str buffer above to have the exact size. */
         nm_assert(strlen(_all_logging_domains_to_str) == sizeof(_all_logging_domains_to_str) - 1);
         nm_assert(buf_l == 1);
 
@@ -669,8 +669,8 @@ _nm_log_impl(const char *file,
     if (G_UNLIKELY(mt_require_locking)) {
         G_LOCK(log);
         /* we evaluate logging-enabled under lock. There is still a race that
-		 * we might log the message below *after* logging was disabled. That means,
-		 * when disabling logging, we might still log messages. */
+         * we might log the message below *after* logging was disabled. That means,
+         * when disabling logging, we might still log messages. */
         if (!_nm_logging_enabled_lockfree(level, domain)) {
             G_UNLOCK(log);
             return;
@@ -858,7 +858,7 @@ nm_log_handler(const char *log_domain, GLogLevelFlags level, const char *message
     }
 
     /* we don't need any locking here. The glib log handler gets only registered
-	 * once during nm_logging_init() and the global data is not modified afterwards. */
+     * once during nm_logging_init() and the global data is not modified afterwards. */
     nm_assert(gl.imm.init_done);
 
     if (gl.imm.debug_stderr)
@@ -913,8 +913,8 @@ void
 nm_logging_init_pre(const char *syslog_identifier, char *prefix_take)
 {
     /* this function may be called zero or one times, and only
-	 * - on the main thread
-	 * - not after nm_logging_init(). */
+     * - on the main thread
+     * - not after nm_logging_init(). */
 
     NM_ASSERT_ON_MAIN_THREAD();
 
@@ -951,7 +951,7 @@ nm_logging_init(const char *logging_backend, gboolean debug)
     LogBackend x_log_backend;
 
     /* this function may be called zero or one times, and only on the
-	 * main thread. */
+     * main thread. */
 
     NM_ASSERT_ON_MAIN_THREAD();
 
@@ -967,11 +967,11 @@ nm_logging_init(const char *logging_backend, gboolean debug)
 
     if (nm_streq(logging_backend, NM_LOG_CONFIG_BACKEND_DEBUG)) {
         /* "debug" was wrongly documented as a valid logging backend. It makes no sense however,
-		 * because printing to stderr only makes sense when not demonizing. Whether to daemonize
-		 * is only controlled via command line arguments (--no-daemon, --debug) and not via the
-		 * logging backend from configuration.
-		 *
-		 * Fall back to the default. */
+         * because printing to stderr only makes sense when not demonizing. Whether to daemonize
+         * is only controlled via command line arguments (--no-daemon, --debug) and not via the
+         * logging backend from configuration.
+         *
+         * Fall back to the default. */
         logging_backend        = "" NM_CONFIG_DEFAULT_LOGGING_BACKEND;
         obsolete_debug_backend = TRUE;
     }
@@ -983,7 +983,7 @@ nm_logging_init(const char *logging_backend, gboolean debug)
         x_log_backend = LOG_BACKEND_JOURNAL;
 
         /* We only log the monotonic-timestamp with structured logging (journal).
-		 * Only in this case, fetch the timestamp. */
+         * Only in this case, fetch the timestamp. */
         fetch_monotonic_timestamp = TRUE;
     } else
 #endif
@@ -1006,7 +1006,7 @@ nm_logging_init(const char *logging_backend, gboolean debug)
 
     if (fetch_monotonic_timestamp) {
         /* ensure we read a monotonic timestamp. Reading the timestamp the first
-		 * time causes a logging message. We don't want to do that during _nm_log_impl. */
+         * time causes a logging message. We don't want to do that during _nm_log_impl. */
         nm_utils_get_monotonic_timestamp_nsec();
     }
 
diff --git a/src/nm-manager.c b/src/nm-manager.c
index a31ce013f7..e86d16c22d 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -401,8 +401,8 @@ _connection_is_vpn(NMConnection *connection)
         return nm_streq(type, NM_SETTING_VPN_SETTING_NAME);
 
     /* we have an incomplete (invalid) connection at hand. That can only
-	 * happen during AddAndActivate. Determine whether it's VPN type based
-	 * on the existence of a [vpn] section. */
+     * happen during AddAndActivate. Determine whether it's VPN type based
+     * on the existence of a [vpn] section. */
     return !!nm_connection_get_setting_vpn(connection);
 }
 
@@ -587,9 +587,9 @@ _device_route_metric_data_new(int ifindex, guint32 aspired_metric, guint32 effec
     nm_assert(ifindex > 0);
 
     /* For IPv4, metrics can use the entire uint32 bit range. For IPv6,
-	 * zero is treated like 1024. Since we handle IPv4 and IPv6 identically,
-	 * we cannot allow a zero metric here.
-	 */
+     * zero is treated like 1024. Since we handle IPv4 and IPv6 identically,
+     * we cannot allow a zero metric here.
+     */
     nm_assert(aspired_metric > 0);
     nm_assert(effective_metric == 0 || aspired_metric <= effective_metric);
 
@@ -677,8 +677,8 @@ _device_route_metric_get(NMManager *  self,
                 continue;
             if (!nm_platform_link_get(priv->platform, device_state->ifindex)) {
                 /* we have the entry in the state file, but (currently) no such
-				 * ifindex exists in platform. Most likely the entry is obsolete,
-				 * hence we skip it. */
+                 * ifindex exists in platform. Most likely the entry is obsolete,
+                 * hence we skip it. */
                 continue;
             }
             if (!g_hash_table_add(
@@ -707,13 +707,13 @@ initited:
         n_links        = all_links_head ? all_links_head->len : 0;
 
         /* on systems where a lot of devices are created and go away, the index contains
-		 * a lot of stale entries. We must from time to time clean them up.
-		 *
-		 * Do do this cleanup, whenever we have more entries then 2 times the number of links. */
+         * a lot of stale entries. We must from time to time clean them up.
+         *
+         * Do do this cleanup, whenever we have more entries then 2 times the number of links. */
         if (G_UNLIKELY(g_hash_table_size(priv->device_route_metrics) > NM_MAX(20, n_links * 2))) {
             /* from time to time, we need to do some house-keeping and prune stale entries.
-			 * Otherwise, on a system where interfaces frequently come and go (docker), we
-			 * keep growing this cache for ifindexes that no longer exist. */
+             * Otherwise, on a system where interfaces frequently come and go (docker), we
+             * keep growing this cache for ifindexes that no longer exist. */
             g_hash_table_iter_init(&h_iter, priv->device_route_metrics);
             while (g_hash_table_iter_next(&h_iter, NULL, (gpointer *) &d2)) {
                 if (!nm_platform_link_get(priv->platform, d2->ifindex))
@@ -727,13 +727,13 @@ initited:
         _device_route_metric_data_new(ifindex, nm_device_get_route_metric_default(device_type), 0);
 
     /* unfortunately, there is no stright forward way to lookup all reserved metrics.
-	 * Note, that we don't only have to know which metrics are currently reserved,
-	 * but also, which metrics are now seemingly un-used but caused another reserved
-	 * metric to be bumped. Hence, the naive O(n^2) search :(
-	 *
-	 * Well, technically, since we limit bumping the metric to 50, this entire
-	 * loop runs at most 50 times, so it's still O(n). Let's just say, it's not
-	 * very efficient. */
+     * Note, that we don't only have to know which metrics are currently reserved,
+     * but also, which metrics are now seemingly un-used but caused another reserved
+     * metric to be bumped. Hence, the naive O(n^2) search :(
+     *
+     * Well, technically, since we limit bumping the metric to 50, this entire
+     * loop runs at most 50 times, so it's still O(n). Let's just say, it's not
+     * very efficient. */
 again:
     g_hash_table_iter_init(&h_iter, priv->device_route_metrics);
     while (g_hash_table_iter_next(&h_iter, NULL, (gpointer *) &d2)) {
@@ -744,28 +744,28 @@ again:
         }
         if (!cleaned && !nm_platform_link_get(priv->platform, d2->ifindex)) {
             /* the metric seems taken, but there is no such interface. This entry
-			 * is stale, forget about it. */
+             * is stale, forget about it. */
             g_hash_table_iter_remove(&h_iter);
             continue;
         }
 
         if (d2->effective_metric == G_MAXUINT32) {
             /* we cannot bump the metric any further. Done.
-			 *
-			 * Actually, this can currently not happen because the aspired_metric
-			 * are small numbers and we limit the bumping to 50. Still, for
-			 * completeness... */
+             *
+             * Actually, this can currently not happen because the aspired_metric
+             * are small numbers and we limit the bumping to 50. Still, for
+             * completeness... */
             data->effective_metric = G_MAXUINT32;
             break;
         }
 
         if (d2->effective_metric - data->aspired_metric >= 50) {
             /* as one active interface reserves an entire range of metrics
-			 * (from aspired_metric to effective_metric), that means if you
-			 * alternatingly activate two interfaces, their metric will
-			 * bump each other.
-			 *
-			 * Limit this, bump the metric at most 50 points. */
+             * (from aspired_metric to effective_metric), that means if you
+             * alternatingly activate two interfaces, their metric will
+             * bump each other.
+             *
+             * Limit this, bump the metric at most 50 points. */
             data->effective_metric = data->aspired_metric + 50;
             break;
         }
@@ -905,10 +905,10 @@ active_connection_state_changed(NMActiveConnection *active, GParamSpec *pspec, N
     state = nm_active_connection_get_state(active);
     if (state == NM_ACTIVE_CONNECTION_STATE_DEACTIVATED) {
         /* Destroy active connections from an idle handler to ensure that
-		 * their last property change notifications go out, which wouldn't
-		 * happen if we destroyed them immediately when their state was set
-		 * to DEACTIVATED.
-		 */
+         * their last property change notifications go out, which wouldn't
+         * happen if we destroyed them immediately when their state was set
+         * to DEACTIVATED.
+         */
         if (!priv->ac_cleanup_id)
             priv->ac_cleanup_id = g_idle_add(_active_connection_cleanup, self);
 
@@ -1017,11 +1017,11 @@ active_connection_find(
         return NULL;
 
     /* as an optimization, we only allocate out_all_matching, if there are more
-	 * than one result. If there is only one result, we only return the single
-	 * element and don't bother allocating an array. That's the common case.
-	 *
-	 * Also, in case we have multiple results, we return the *first* one
-	 * as @best_ac. */
+     * than one result. If there is only one result, we only return the single
+     * element and don't bother allocating an array. That's the common case.
+     *
+     * Also, in case we have multiple results, we return the *first* one
+     * as @best_ac. */
     nm_assert(!all || (all->len >= 2 && all->pdata[0] == best_ac));
 
     *out_all_matching = all;
@@ -1043,7 +1043,7 @@ active_connection_find_by_connection(NMManager *             self,
               || connection == nm_settings_connection_get_connection(sett_conn));
 
     /* Depending on whether connection is a settings connection,
-	 * either lookup by object-identity of @connection, or compare the UUID */
+     * either lookup by object-identity of @connection, or compare the UUID */
     return active_connection_find(self,
                                   sett_conn,
                                   sett_conn ? NULL : nm_connection_get_uuid(connection),
@@ -1077,7 +1077,7 @@ _get_activatable_connections_filter(NMSettings *          settings,
         return TRUE;
 
     /* the connection is activatable, if it has no active-connections that are in state
-	 * activated, activating, or waiting to be activated. */
+     * activated, activating, or waiting to be activated. */
     return !active_connection_find(d->self,
                                    sett_conn,
                                    NULL,
@@ -1528,12 +1528,12 @@ manager_device_state_changed(NMDevice *          device,
         G_STATIC_ASSERT_EXPR(DEVICE_STATE_PRUNE_RATELIMIT_MAX < G_MAXUINT8);
         if (priv->device_state_prune_ratelimit_count++ > DEVICE_STATE_PRUNE_RATELIMIT_MAX) {
             /* We write the device state to /run. The state files are named after the
-			 * ifindex (which is assumed to be unique and not repeat -- in practice
-			 * it may repeat). So from time to time, we prune device state files
-			 * for interfaces that no longer exist.
-			 *
-			 * Otherwise, the files might pile up if you create (and destroy) a large
-			 * number of software devices. */
+             * ifindex (which is assumed to be unique and not repeat -- in practice
+             * it may repeat). So from time to time, we prune device state files
+             * for interfaces that no longer exist.
+             *
+             * Otherwise, the files might pile up if you create (and destroy) a large
+             * number of software devices. */
             priv->device_state_prune_ratelimit_count = 0;
             nm_config_device_state_prune_stale(NULL, priv->platform);
         }
@@ -1570,20 +1570,20 @@ check_if_startup_complete(NMManager *self)
     }
 
     /* All NMDevice must be ready. But also NMSettings tracks profiles that wait for
-	 * ready devices via "connection.wait-device-timeout".
-	 *
-	 * Note that we only re-check nm_settings_get_startup_complete_blocked_reason() when
-	 * all of the devices become ready (again).
-	 *
-	 * For example, assume we have device "eth1" and "profile-eth2" which waits for "eth2".
-	 * If "eth1" is ready (no pending action), we only need to re-evaluate "profile-eth2"
-	 * if we have another device ("eth2"), that becomes non-ready (had pending actions)
-	 * and again become ready. We don't need to check "profile-eth2" until "eth2" becomes
-	 * non-ready.
-	 * That is why nm_settings_get_startup_complete_blocked_reason() only has any significance
-	 * if all devices are ready too. It allows us to cut down the number of checks whether
-	 * NMSettings is ready. That's because we don't need to re-evaluate on minor changes of
-	 * a device, only when all devices become managed and ready. */
+     * ready devices via "connection.wait-device-timeout".
+     *
+     * Note that we only re-check nm_settings_get_startup_complete_blocked_reason() when
+     * all of the devices become ready (again).
+     *
+     * For example, assume we have device "eth1" and "profile-eth2" which waits for "eth2".
+     * If "eth1" is ready (no pending action), we only need to re-evaluate "profile-eth2"
+     * if we have another device ("eth2"), that becomes non-ready (had pending actions)
+     * and again become ready. We don't need to check "profile-eth2" until "eth2" becomes
+     * non-ready.
+     * That is why nm_settings_get_startup_complete_blocked_reason() only has any significance
+     * if all devices are ready too. It allows us to cut down the number of checks whether
+     * NMSettings is ready. That's because we don't need to re-evaluate on minor changes of
+     * a device, only when all devices become managed and ready. */
 
     g_signal_handlers_block_by_func(priv->settings, settings_startup_complete_changed, self);
     reason = nm_settings_get_startup_complete_blocked_reason(priv->settings, TRUE);
@@ -1598,7 +1598,7 @@ check_if_startup_complete(NMManager *self)
     priv->startup = FALSE;
 
     /* we no longer care about these signals. Startup-complete only
-	 * happens once. */
+     * happens once. */
     g_signal_handlers_disconnect_by_func(priv->settings,
                                          G_CALLBACK(settings_startup_complete_changed),
                                          self);
@@ -1638,7 +1638,7 @@ again:
     c_list_for_each_entry (candidate, &priv->devices_lst_head, devices_lst) {
         if (nm_device_parent_notify_changed(candidate, device, device_removed)) {
             /* in the unlikely event that this changes anything, we start iterating
-			 * again, to be sure that the device list is up-to-date. */
+             * again, to be sure that the device list is up-to-date. */
             goto again;
         }
     }
@@ -1708,20 +1708,20 @@ remove_device(NMManager *self, NMDevice *device, gboolean quitting)
         gboolean unconfigure_ip_config = !quitting || unmanage;
 
         /* When we don't unmanage the device on shutdown, we want to preserve the DNS
-		 * configuration in resolv.conf. For that, we must leak the configuration
-		 * in NMPolicy/NMDnsManager. We do that, by emitting the device-removed signal
-		 * with device's ip-config object still uncleared. In that case, NMPolicy
-		 * never learns to unconfigure the ip-config objects and does not remove them
-		 * from DNS on shutdown (which is ugly, because we don't cleanup the memory
-		 * properly).
-		 *
-		 * Control that by passing @unconfigure_ip_config.  */
+         * configuration in resolv.conf. For that, we must leak the configuration
+         * in NMPolicy/NMDnsManager. We do that, by emitting the device-removed signal
+         * with device's ip-config object still uncleared. In that case, NMPolicy
+         * never learns to unconfigure the ip-config objects and does not remove them
+         * from DNS on shutdown (which is ugly, because we don't cleanup the memory
+         * properly).
+         *
+         * Control that by passing @unconfigure_ip_config.  */
         nm_device_removed(device, unconfigure_ip_config);
 
         _emit_device_added_removed(self, device, FALSE);
     } else {
         /* unrealize() does not release a slave device from master and
-		 * clear IP configurations, do it here */
+         * clear IP configurations, do it here */
         nm_device_removed(device, TRUE);
     }
 
@@ -1796,8 +1796,8 @@ find_parent_device_for_connection(NMManager *      self,
         return NULL;
 
     /* Check if the parent connection is currently activated or is compatible
-	 * with some known device.
-	 */
+     * with some known device.
+     */
     c_list_for_each_entry (candidate, &priv->devices_lst_head, devices_lst) {
         /* Unmanaged devices are not compatible with any connection */
         if (!nm_device_get_managed(candidate, FALSE))
@@ -2033,8 +2033,8 @@ system_create_virtual_device(NMManager *self, NMConnection *connection)
         }
 
         /* Add device takes a reference that NMManager still owns, so it's
-		 * safe to unref here and still return @device.
-		 */
+         * safe to unref here and still return @device.
+         */
         g_object_unref(device);
     }
 
@@ -2151,8 +2151,8 @@ connection_changed(NMManager *self, NMSettingsConnection *sett_conn)
         return;
 
     /* Maybe the device that was created was needed by some other
-	 * connection's device (parent of a VLAN). Let the connections
-	 * can use the newly created device as a parent know. */
+     * connection's device (parent of a VLAN). Let the connections
+     * can use the newly created device as a parent know. */
     retry_connections_for_parent_device(self, device);
 }
 
@@ -2217,7 +2217,7 @@ connection_flags_changed(NMSettings *settings, NMSettingsConnection *connection,
                                NM_ACTIVE_CONNECTION_STATE_DEACTIVATED,
                                NULL)) {
         /* the connection still has an active-connection. It will be purged
-		 * when the active connection(s) get(s) removed. */
+         * when the active connection(s) get(s) removed. */
         return;
     }
 
@@ -2363,10 +2363,10 @@ manager_rfkill_update_one_type(NMManager *self, RadioState *rstate, RfKillType r
     }
 
     /* And finally update the actual device radio state itself; respect the
-	 * daemon state here because this is never called from user-triggered
-	 * radio changes and we only want to ignore the daemon enabled state when
-	 * handling user radio change requests.
-	 */
+     * daemon state here because this is never called from user-triggered
+     * radio changes and we only want to ignore the daemon enabled state when
+     * handling user radio change requests.
+     */
     new_enabled = radio_enabled_for_rstate(rstate, TRUE);
     if (new_enabled != old_enabled)
         manager_update_radio_enabled(self, rstate, new_enabled);
@@ -2579,9 +2579,9 @@ get_existing_connection(NMManager *self, NMDevice *device, gboolean *out_generat
         int master_ifindex = nm_platform_link_get_master(priv->platform, ifindex);
 
         /* Check that the master is activating before assuming a
-		 * slave connection. However, ignore ovs-system master as
-		 * we never manage it.
-		 */
+         * slave connection. However, ignore ovs-system master as
+         * we never manage it.
+         */
         if (master_ifindex
             && nm_platform_link_get_type(priv->platform, master_ifindex)
                    != NM_LINK_TYPE_OPENVSWITCH) {
@@ -2607,16 +2607,16 @@ get_existing_connection(NMManager *self, NMDevice *device, gboolean *out_generat
     }
 
     /* The core of the API is nm_device_generate_connection() function and
-	 * update_connection() virtual method and the convenient connection_type
-	 * class attribute. Subclasses supporting the new API must have
-	 * update_connection() implemented, otherwise nm_device_generate_connection()
-	 * returns NULL.
-	 */
+     * update_connection() virtual method and the convenient connection_type
+     * class attribute. Subclasses supporting the new API must have
+     * update_connection() implemented, otherwise nm_device_generate_connection()
+     * returns NULL.
+     */
     connection = nm_device_generate_connection(device, master, &maybe_later, &gen_error);
     if (!connection) {
         if (maybe_later) {
             /* The device can generate a connection, but it failed for now.
-			 * Give it a chance to match a connection from the state file. */
+             * Give it a chance to match a connection from the state file. */
             only_by_uuid = TRUE;
         } else {
             nm_device_assume_state_reset(device);
@@ -2631,14 +2631,14 @@ get_existing_connection(NMManager *self, NMDevice *device, gboolean *out_generat
     nm_device_assume_state_get(device, &assume_state_guess_assume, &assume_state_connection_uuid);
 
     /* Now we need to compare the generated connection to each configured
-	 * connection. The comparison function is the heart of the connection
-	 * assumption implementation and it must compare the connections very
-	 * carefully to sort out various corner cases. Also, the comparison is
-	 * not entirely symmetric.
-	 *
-	 * When no configured connection matches the generated connection, we keep
-	 * the generated connection instead.
-	 */
+     * connection. The comparison function is the heart of the connection
+     * assumption implementation and it must compare the connections very
+     * carefully to sort out various corner cases. Also, the comparison is
+     * not entirely symmetric.
+     *
+     * When no configured connection matches the generated connection, we keep
+     * the generated connection instead.
+     */
     if (assume_state_connection_uuid
         && (connection_checked =
                 nm_settings_get_connection_by_uuid(priv->settings, assume_state_connection_uuid))
@@ -2673,7 +2673,7 @@ get_existing_connection(NMManager *self, NMDevice *device, gboolean *out_generat
         guint                          len, i, j;
 
         /* the state file doesn't indicate a connection UUID to assume. Search the
-		 * persistent connections for a matching candidate. */
+         * persistent connections for a matching candidate. */
         sett_conns = nm_manager_get_activatable_connections(self, FALSE, FALSE, &len);
         if (len > 0) {
             for (i = 0, j = 0; i < len; i++) {
@@ -2849,11 +2849,11 @@ recheck_assume_connection(NMManager *self, NMDevice *device)
         if (copy_lease(initramfs_lease, connection_lease)) {
             unlink(initramfs_lease);
             /*
-			 * We've managed to steal the lease used by initramfs before it
-			 * killed off the dhclient. We need to take ownership of the configured
-			 * connection and act like the device was configured by us.
-			 * Otherwise, the address would just expire.
-			 */
+             * We've managed to steal the lease used by initramfs before it
+             * killed off the dhclient. We need to take ownership of the configured
+             * connection and act like the device was configured by us.
+             * Otherwise, the address would just expire.
+             */
             _LOG2I(LOGD_DEVICE, device, "assume: taking over an initramfs-configured connection");
             activation_type_assume = TRUE;
 
@@ -2906,16 +2906,16 @@ recheck_assume_connection(NMManager *self, NMDevice *device)
         subject = nm_auth_subject_new_internal();
 
         /* Note: the lifetime of the activation connection is always bound to the profiles visibility
-		 * via NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY.
-		 *
-		 * This only makes a difference, if the profile actually has "connection.permissions"
-		 * set to limit visibility (which is not the case for externally managed, generated profiles).
-		 *
-		 * If we assume a previously active connection whose lifetime was unbound, we now bind it
-		 * after restart. That is not correct, and can mean that the profile becomes subject to
-		 * deactivation after restart (if the user logs out).
-		 *
-		 * This should be improved, but it's unclear how. */
+         * via NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY.
+         *
+         * This only makes a difference, if the profile actually has "connection.permissions"
+         * set to limit visibility (which is not the case for externally managed, generated profiles).
+         *
+         * If we assume a previously active connection whose lifetime was unbound, we now bind it
+         * after restart. That is not correct, and can mean that the profile becomes subject to
+         * deactivation after restart (if the user logs out).
+         *
+         * This should be improved, but it's unclear how. */
         active = _new_active_connection(
             self,
             FALSE,
@@ -2995,10 +2995,10 @@ device_ip_iface_changed(NMDevice *device, GParamSpec *pspec, NMManager *self)
     NMDevice *        candidate;
 
     /* Remove NMDevice objects that are actually child devices of others,
-	 * when the other device finally knows its IP interface name.  For example,
-	 * remove the PPP interface that's a child of a WWAN device, since it's
-	 * not really a standalone NMDevice.
-	 */
+     * when the other device finally knows its IP interface name.  For example,
+     * remove the PPP interface that's a child of a WWAN device, since it's
+     * not really a standalone NMDevice.
+     */
     c_list_for_each_entry (candidate, &priv->devices_lst_head, devices_lst) {
         if (candidate != device && nm_streq0(nm_device_get_iface(candidate), ip_iface)
             && nm_device_get_device_type(candidate) == device_type
@@ -3013,8 +3013,8 @@ static void
 device_iface_changed(NMDevice *device, GParamSpec *pspec, NMManager *self)
 {
     /* Virtual connections may refer to the new device name as
-	 * parent device, retry to activate them.
-	 */
+     * parent device, retry to activate them.
+     */
     retry_connections_for_parent_device(self, device);
 }
 
@@ -3048,7 +3048,7 @@ _get_best_connectivity(NMManager *self, int addr_family)
         best_state = _get_best_connectivity(self, AF_INET);
         if (nm_connectivity_state_cmp(best_state, NM_CONNECTIVITY_FULL) >= 0) {
             /* already FULL IPv4 connectivity. No need to check IPv6, it doesn't get
-			 * better. */
+             * better. */
             return best_state;
         }
         return NM_MAX_WITH_CMP(nm_connectivity_state_cmp,
@@ -3070,13 +3070,13 @@ _get_best_connectivity(NMManager *self, int addr_family)
             metric = NMP_OBJECT_CAST_IP_ROUTE(r)->metric;
         else {
             /* if all devices have no default-route, we still include the best
-			 * of all connectivity state of all the devices. */
+             * of all connectivity state of all the devices. */
             metric = G_MAXINT64;
         }
 
         if (metric > best_metric) {
             /* we already have a default route with better metric. The connectivity state
-			 * of this device is irreleavnt. */
+             * of this device is irreleavnt. */
             continue;
         }
 
@@ -3142,7 +3142,7 @@ _device_realize_finish(NMManager *self, NMDevice *device, const NMPlatformLink *
         return;
 
     /* if we failed to assume a connection for the managed device, but the device
-	 * is still unavailable. Set UNAVAILABLE state again, this time with NOW_MANAGED. */
+     * is still unavailable. Set UNAVAILABLE state again, this time with NOW_MANAGED. */
     nm_device_state_changed(device,
                             NM_DEVICE_STATE_UNAVAILABLE,
                             NM_DEVICE_STATE_REASON_NOW_MANAGED);
@@ -3181,12 +3181,12 @@ add_device(NMManager *self, NMDevice *device, GError **error)
     }
 
     /* Remove existing devices owned by the new device; eg remove ethernet
-	 * ports that are owned by a WWAN modem, since udev may announce them
-	 * before the modem is fully discovered.
-	 *
-	 * FIXME: use parent/child device relationships instead of removing
-	 * the child NMDevice entirely
-	 */
+     * ports that are owned by a WWAN modem, since udev may announce them
+     * before the modem is fully discovered.
+     *
+     * FIXME: use parent/child device relationships instead of removing
+     * the child NMDevice entirely
+     */
     c_list_for_each_entry (candidate, &priv->devices_lst_head, devices_lst) {
         if (nm_device_is_real(candidate) && (iface = nm_device_get_ip_iface(candidate))
             && nm_device_owns_iface(device, iface))
@@ -3246,9 +3246,9 @@ add_device(NMManager *self, NMDevice *device, GError **error)
     }
 
     /* Update global rfkill state for this device type with the device's
-	 * rfkill state, and then set this device's rfkill state based on the
-	 * global state.
-	 */
+     * rfkill state, and then set this device's rfkill state based on the
+     * global state.
+     */
     rtype = nm_device_get_rfkill_type(device);
     if (rtype != RFKILL_TYPE_UNKNOWN) {
         nm_manager_rfkill_update(self, rtype);
@@ -3358,15 +3358,15 @@ platform_link_added(NMManager *                    self,
 
         if (nm_device_is_real(candidate)) {
             /* There's already a realized device with the link's name
-			 * and a different ifindex.
-			 */
+             * and a different ifindex.
+             */
             if (nm_device_get_ifindex(candidate) <= 0)
                 nm_device_update_from_platform_link(candidate, plink);
             else {
                 /* The ifindex of a device can't be changed after
-				 * initialization because it is used as a key by
-				 * the dns-manager.
-				 */
+                 * initialization because it is used as a key by
+                 * the dns-manager.
+                 */
                 _LOGD(LOGD_DEVICE,
                       "(%s): removing old device %p after ifindex change from %d to %d",
                       plink->name,
@@ -3685,31 +3685,31 @@ nm_manager_get_best_device_for_connection(NMManager *           self,
         flags = NM_DEVICE_CHECK_CON_AVAILABLE_NONE;
     else {
         /* if the profile is multi-connect=single, we also consider devices which
-		 * are marked as unmanaged. And explicit user-request shows sufficient user
-		 * intent to make the device managed.
-		 * That is also, because we expect that such profile is suitably tied
-		 * to the intended device. So when an unmanaged device matches, the user's
-		 * intent is clear.
-		 *
-		 * For multi-connect != single devices that is different. The profile
-		 * is not restricted to a particular device.
-		 * For that reason, plain `nmcli connection up "$MULIT_PROFILE"` seems
-		 * less suitable for multi-connect profiles, because the target device is
-		 * left unspecified. Anyway, if a user issues
-		 *
-		 *   $ nmcli device set "$DEVICE" managed no
-		 *   $ nmcli connection up "$MULIT_PROFILE"
-		 *
-		 * then it is reasonable for multi-connect profiles to not consider
-		 * the device a suitable candidate.
-		 *
-		 * This may be seen inconsistent, but I think that it makes a lot of
-		 * sense. Also note that "connection.multi-connect" work quite differently
-		 * in aspects like activation. E.g. `nmcli connection up` of multi-connect
-		 * "single" profile, will deactivate the profile if it is active already.
-		 * That is different from multi-connect profiles, where it will aim to
-		 * activate the profile one more time on an hitherto disconnected device.
-		 */
+         * are marked as unmanaged. And explicit user-request shows sufficient user
+         * intent to make the device managed.
+         * That is also, because we expect that such profile is suitably tied
+         * to the intended device. So when an unmanaged device matches, the user's
+         * intent is clear.
+         *
+         * For multi-connect != single devices that is different. The profile
+         * is not restricted to a particular device.
+         * For that reason, plain `nmcli connection up "$MULIT_PROFILE"` seems
+         * less suitable for multi-connect profiles, because the target device is
+         * left unspecified. Anyway, if a user issues
+         *
+         *   $ nmcli device set "$DEVICE" managed no
+         *   $ nmcli connection up "$MULIT_PROFILE"
+         *
+         * then it is reasonable for multi-connect profiles to not consider
+         * the device a suitable candidate.
+         *
+         * This may be seen inconsistent, but I think that it makes a lot of
+         * sense. Also note that "connection.multi-connect" work quite differently
+         * in aspects like activation. E.g. `nmcli connection up` of multi-connect
+         * "single" profile, will deactivate the profile if it is active already.
+         * That is different from multi-connect profiles, where it will aim to
+         * activate the profile one more time on an hitherto disconnected device.
+         */
         if (multi_connect == NM_CONNECTION_MULTI_CONNECT_SINGLE)
             flags = NM_DEVICE_CHECK_CON_AVAILABLE_FOR_USER_REQUEST;
         else
@@ -3724,12 +3724,12 @@ nm_manager_get_best_device_for_connection(NMManager *           self,
                                                       NM_ACTIVE_CONNECTION_STATE_DEACTIVATING,
                                                       &all_ac_arr))) {
         /* if we have a profile which may activate on only one device (multi-connect single), then
-		 * we prefer the device on which the profile is already active. It means to reactivate
-		 * the profile on the same device.
-		 *
-		 * If the profile can be activated on multiple devices, we don't do this. In fact, the
-		 * check below for the DeviceActivationPrio will prefer devices which are not already
-		 * activated (with this or another) profile. */
+         * we prefer the device on which the profile is already active. It means to reactivate
+         * the profile on the same device.
+         *
+         * If the profile can be activated on multiple devices, we don't do this. In fact, the
+         * check below for the DeviceActivationPrio will prefer devices which are not already
+         * activated (with this or another) profile. */
 
         ac_device = nm_active_connection_get_device(ac);
         if (ac_device
@@ -3766,7 +3766,7 @@ nm_manager_get_best_device_for_connection(NMManager *           self,
 
                 if (ac_state == ac_state2) {
                     /* active-connections are in their list in the order in which they are connected.
-					 * If we have two with same state, the later (newer) one is preferred. */
+                     * If we have two with same state, the later (newer) one is preferred. */
                     goto found_better;
                 }
 
@@ -3816,23 +3816,23 @@ found_better:
             continue;
 
         /* determine the priority of this device. Currently, this priority is independent
-		 * of the profile (connection) and the device's details (aside the state).
-		 *
-		 * Maybe nm_device_check_connection_available() should instead return a priority,
-		 * as it has more information available.
-		 *
-		 * For example, if you have multiple Wi-Fi devices, currently a user-request would
-		 * also select the device if the AP is not visible. Optimally, if one of the two
-		 * devices sees the AP and the other one doesn't, the former would be preferred.
-		 * For that, the priority would need to be determined by nm_device_check_connection_available(). */
+         * of the profile (connection) and the device's details (aside the state).
+         *
+         * Maybe nm_device_check_connection_available() should instead return a priority,
+         * as it has more information available.
+         *
+         * For example, if you have multiple Wi-Fi devices, currently a user-request would
+         * also select the device if the AP is not visible. Optimally, if one of the two
+         * devices sees the AP and the other one doesn't, the former would be preferred.
+         * For that, the priority would need to be determined by nm_device_check_connection_available(). */
         prio = _device_get_activation_prio(device);
         if (prio <= best.prio && best.device) {
             /* we already have a matching device with a better priority. This candidate
-			 * cannot be better. Skip the check.
-			 *
-			 * Also note, that below we collect the best error message @local_best.
-			 * Since we already have best.device, the error message does not matter
-			 * either, and we can skip nm_device_check_connection_available() altogether. */
+             * cannot be better. Skip the check.
+             *
+             * Also note, that below we collect the best error message @local_best.
+             * Since we already have best.device, the error message does not matter
+             * either, and we can skip nm_device_check_connection_available() altogether. */
             continue;
         }
 
@@ -3843,7 +3843,7 @@ found_better:
                                                  error ? &local : NULL)) {
             if (prio == _DEVICE_ACTIVATION_PRIO_BEST) {
                 /* this device already has the best priority. It cannot get better
-				 * and finish the search. */
+                 * and finish the search. */
                 return device;
             }
             best.prio   = prio;
@@ -4174,14 +4174,14 @@ ensure_master_active_connection(NMManager *           self,
                      NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY);
 
     /* If the master device isn't activated then we need to activate it using
-	 * compatible connection.  If it's already activating we can just proceed.
-	 */
+     * compatible connection.  If it's already activating we can just proceed.
+     */
     if (master_device) {
         NMSettingsConnection *device_connection = nm_device_get_settings_connection(master_device);
 
         /* If we're passed a connection and a device, we require that connection
-		 * be already activated on the device, eg returned from find_master().
-		 */
+         * be already activated on the device, eg returned from find_master().
+         */
         g_assert(!master_connection || master_connection == device_connection);
         if (device_connection
             && !is_compatible_with_slave(nm_settings_connection_get_connection(device_connection),
@@ -4211,8 +4211,8 @@ ensure_master_active_connection(NMManager *           self,
         }
 
         /* If the device is disconnected, find a compatible connection and
-		 * activate it on the device.
-		 */
+         * activate it on the device.
+         */
         if (master_state == NM_DEVICE_STATE_DISCONNECTED || !nm_device_is_real(master_device)) {
             gs_free NMSettingsConnection **connections = NULL;
             guint                          i;
@@ -4226,8 +4226,8 @@ ensure_master_active_connection(NMManager *           self,
                 NMConnection *        cand_conn = nm_settings_connection_get_connection(candidate);
 
                 /* Ensure eg bond/team slave and the candidate master is a
-				 * bond/team master
-				 */
+                 * bond/team master
+                 */
                 if (!is_compatible_with_slave(cand_conn, connection))
                     continue;
 
@@ -4357,9 +4357,9 @@ find_slaves(NMManager *           manager,
     devices = g_hash_table_new(nm_direct_hash, NULL);
 
     /* Search through all connections, not only inactive ones, because
-	 * even if a slave was already active, it might be deactivated during
-	 * master reactivation.
-	 */
+     * even if a slave was already active, it might be deactivated during
+     * master reactivation.
+     */
     all_connections = nm_settings_get_connections_clone(
         priv->settings,
         &n_all_connections,
@@ -4390,7 +4390,7 @@ find_slaves(NMManager *           manager,
 
             if (!slaves) {
                 /* what we allocate is quite likely much too large. Don't bother, it is only
-				 * a temporary buffer. */
+                 * a temporary buffer. */
                 slaves = g_new(SlaveConnectionInfo, n_all_connections);
             }
 
@@ -4497,9 +4497,9 @@ autoconnect_slaves(NMManager *           self,
             const char *         uuid;
 
             /* To avoid loops when autoconnecting slaves, we propagate
-			 * the UUID of the initial connection down to slaves until
-			 * the same connection is found.
-			 */
+             * the UUID of the initial connection down to slaves until
+             * the same connection is found.
+             */
             uuid = g_object_get_qdata(G_OBJECT(master_connection), autoconnect_root_quark());
             if (nm_streq0(nm_settings_connection_get_uuid(slave->connection), uuid)) {
                 _LOGI(LOGD_CORE,
@@ -4586,9 +4586,9 @@ static void
 unmanaged_to_disconnected(NMDevice *device)
 {
     /* when creating the software device, it can happen that the device is
-	 * still unmanaged by NM_UNMANAGED_PLATFORM_INIT because we didn't yet
-	 * get the udev event. At this point, we can no longer delay the activation
-	 * and force the device to be managed. */
+     * still unmanaged by NM_UNMANAGED_PLATFORM_INIT because we didn't yet
+     * get the udev event. At this point, we can no longer delay the activation
+     * and force the device to be managed. */
     nm_device_set_unmanaged_by_flags(device,
                                      NM_UNMANAGED_PLATFORM_INIT,
                                      FALSE,
@@ -4628,27 +4628,27 @@ _activation_bind_lifetime_to_profile_visibility(NMAuthSubject *subject)
     }
 
     /* if the activation was not done by internal decision nor root, there
-	 * are the following cases:
-	 *
-	 * - the connection has "connection.permissions" unset and the profile
-	 *   is not restricted to a user and commonly always visible. It does
-	 *   not hurt to bind the lifetime, because we expect the profile to be
-	 *   visible at the moment. If the profile changes (while still being active),
-	 *   we want to pick-up changes to the visibility and possibly disconnect.
-	 *
-	 * - the connection has "connection.permissions" set, and the current user
-	 *   is the owner:
-	 *
-	 *      - Usually, we would expect that the profile is visible at the moment,
-	 *        and of course we want to bind the lifetime. The moment the user
-	 *        logs out, the connection becomes invisible and disconnects.
-	 *
-	 *      - the profile at this time could already be invisible (e.g. if the
-	 *        user didn't create a proper session (sudo) and manually activates
-	 *        an invisible profile. In this case, we still want to bind the
-	 *        lifetime, and it will disconnect after the user logs in and logs
-	 *        out again. NMKeepAlive takes care of that.
-	 */
+     * are the following cases:
+     *
+     * - the connection has "connection.permissions" unset and the profile
+     *   is not restricted to a user and commonly always visible. It does
+     *   not hurt to bind the lifetime, because we expect the profile to be
+     *   visible at the moment. If the profile changes (while still being active),
+     *   we want to pick-up changes to the visibility and possibly disconnect.
+     *
+     * - the connection has "connection.permissions" set, and the current user
+     *   is the owner:
+     *
+     *      - Usually, we would expect that the profile is visible at the moment,
+     *        and of course we want to bind the lifetime. The moment the user
+     *        logs out, the connection becomes invisible and disconnects.
+     *
+     *      - the profile at this time could already be invisible (e.g. if the
+     *        user didn't create a proper session (sudo) and manually activates
+     *        an invisible profile. In this case, we still want to bind the
+     *        lifetime, and it will disconnect after the user logs in and logs
+     *        out again. NMKeepAlive takes care of that.
+     */
     return NM_ACTIVATION_STATE_FLAG_LIFETIME_BOUND_TO_PROFILE_VISIBILITY;
 }
 
@@ -4727,10 +4727,10 @@ _internal_activate_device(NMManager *self, NMActiveConnection *active, GError **
     applied = nm_active_connection_get_applied_connection(active);
 
     /* If the device is active and its connection is not visible to the
-	 * user that's requesting this new activation, fail, since other users
-	 * should not be allowed to implicitly deactivate private connections
-	 * by activating a connection of their own.
-	 */
+     * user that's requesting this new activation, fail, since other users
+     * should not be allowed to implicitly deactivate private connections
+     * by activating a connection of their own.
+     */
     existing_connection = nm_device_get_applied_connection(device);
     subject             = nm_active_connection_get_subject(active);
     if (existing_connection
@@ -4858,8 +4858,8 @@ _internal_activate_device(NMManager *self, NMActiveConnection *active, GError **
     }
 
     /* Ensure there's a master active connection the new connection we're
-	 * activating can depend on.
-	 */
+     * activating can depend on.
+     */
     if (master_connection || master_device) {
         if (master_connection) {
             _LOGD(LOGD_CORE,
@@ -4912,9 +4912,9 @@ _internal_activate_device(NMManager *self, NMActiveConnection *active, GError **
         }
 
         /* Now that we're activating a slave for that master, make sure the master just
-		 * decides to go unmanaged while we're activating (perhaps because other slaves
-		 * go away leaving him with no kids).
-		 */
+         * decides to go unmanaged while we're activating (perhaps because other slaves
+         * go away leaving him with no kids).
+         */
         if (master_device) {
             nm_device_set_unmanaged_by_flags(master_device,
                                              NM_UNMANAGED_EXTERNAL_DOWN,
@@ -4953,7 +4953,7 @@ _internal_activate_device(NMManager *self, NMActiveConnection *active, GError **
         guint                        i, n_all;
 
         /* Disconnect the connection if already connected or queued for activation.
-		 * The connection cannot be active multiple times (at the same time).  */
+         * The connection cannot be active multiple times (at the same time).  */
         ac = active_connection_find(self,
                                     sett_conn,
                                     NULL,
@@ -4975,7 +4975,7 @@ _internal_activate_device(NMManager *self, NMActiveConnection *active, GError **
 
         if (!nm_device_get_managed(device, FALSE)) {
             /* Unexpectedly, the device is still unmanaged. That can happen for example,
-			 * if the device is forcibly unmanaged due to NM_UNMANAGED_USER_SETTINGS. */
+             * if the device is forcibly unmanaged due to NM_UNMANAGED_USER_SETTINGS. */
             g_set_error_literal(error,
                                 NM_MANAGER_ERROR,
                                 NM_MANAGER_ERROR_DEPENDENCY_FAILED,
@@ -4997,8 +4997,8 @@ _internal_activate_generic(NMManager *self, NMActiveConnection *active, GError *
     gboolean          success = FALSE;
 
     /* Ensure activation request is still valid, eg that its device hasn't gone
-	 * away or that some other dependency has not failed.
-	 */
+     * away or that some other dependency has not failed.
+     */
     if (nm_active_connection_get_state(active) >= NM_ACTIVE_CONNECTION_STATE_DEACTIVATING) {
         g_set_error_literal(error,
                             NM_MANAGER_ERROR,
@@ -5014,12 +5014,12 @@ _internal_activate_generic(NMManager *self, NMActiveConnection *active, GError *
 
     if (success) {
         /* Force an update of the Manager's activating-connection property.
-		 * The device changes state before the AC gets exported, which causes
-		 * the manager's 'activating-connection' property to be NULL since the
-		 * AC only gets a D-Bus path when it's exported.  So now that the AC
-		 * is exported, make sure the manager's activating-connection property
-		 * is up-to-date.
-		 */
+         * The device changes state before the AC gets exported, which causes
+         * the manager's 'activating-connection' property to be NULL since the
+         * AC only gets a D-Bus path when it's exported.  So now that the AC
+         * is exported, make sure the manager's activating-connection property
+         * is up-to-date.
+         */
         policy_activating_ac_changed(G_OBJECT(priv->policy), NULL, self);
     }
 
@@ -5059,8 +5059,8 @@ _new_active_connection(NMManager *            self,
         NMActiveConnection *parent;
 
         /* FIXME: for VPN connections, we don't allow re-activating an
-		 * already active connection. It's a bug, and should be fixed together
-		 * when reworking VPN handling. */
+         * already active connection. It's a bug, and should be fixed together
+         * when reworking VPN handling. */
         if (active_connection_find_by_connection(self,
                                                  sett_conn,
                                                  incompl_conn,
@@ -5151,10 +5151,10 @@ _internal_activation_auth_done(NMManager *         self,
         goto fail;
 
     /* Don't continue with an autoconnect-activation if a more important activation
-	 * already exists.
-	 * We also check this earlier, but there we may fail to detect a duplicate
-	 * if the existing active connection was undergoing authorization.
-	 */
+     * already exists.
+     * We also check this earlier, but there we may fail to detect a duplicate
+     * if the existing active connection was undergoing authorization.
+     */
     if (NM_IN_SET(nm_active_connection_get_activation_reason(active),
                   NM_ACTIVATION_REASON_EXTERNAL,
                   NM_ACTIVATION_REASON_ASSUME,
@@ -5242,10 +5242,10 @@ nm_manager_activate_connection(NMManager *            self,
         return NULL;
 
     /* Look for a active connection that's equivalent and is already pending authorization
-	 * and eventual activation. This is used to de-duplicate concurrent activations which would
-	 * otherwise race and cause the device to disconnect and reconnect repeatedly.
-	 * In particular, this allows the master and multiple slaves to concurrently auto-activate
-	 * while all the slaves would use the same active-connection. */
+     * and eventual activation. This is used to de-duplicate concurrent activations which would
+     * otherwise race and cause the device to disconnect and reconnect repeatedly.
+     * In particular, this allows the master and multiple slaves to concurrently auto-activate
+     * while all the slaves would use the same active-connection. */
     c_list_for_each_entry (async_op_data, &priv->async_op_lst_head, async_op_lst) {
         if (async_op_data->async_op_type != ASYNC_OP_TYPE_AC_AUTH_ACTIVATE_INTERNAL)
             continue;
@@ -5377,7 +5377,7 @@ validate_activation_request(NMManager *            self,
             gs_free char *iface = NULL;
 
             /* VPN and software-device connections don't need a device yet,
-			 * but non-virtual connections do ... */
+             * but non-virtual connections do ... */
             if (!nm_connection_is_virtual(connection)) {
                 g_set_error(error,
                             NM_MANAGER_ERROR,
@@ -5487,10 +5487,10 @@ impl_manager_activate_connection(NMDBusObject *                     obj,
     device_path          = nm_dbus_path_not_empty(device_path);
 
     /* If the connection path is given and valid, that connection is activated.
-	 * Otherwise, the "best" connection for the device is chosen and activated,
-	 * regardless of whether that connection is autoconnect-enabled or not
-	 * (since this is an explicit request, not an auto-activation request).
-	 */
+     * Otherwise, the "best" connection for the device is chosen and activated,
+     * regardless of whether that connection is autoconnect-enabled or not
+     * (since this is an explicit request, not an auto-activation request).
+     */
     if (connection_path) {
         sett_conn = nm_settings_get_connection_by_path(priv->settings, connection_path);
         if (!sett_conn) {
@@ -5670,8 +5670,8 @@ _add_and_activate_auth_done(NMManager *                     self,
     priv = NM_MANAGER_GET_PRIVATE(self);
 
     /* FIXME(shutdown): nm_settings_add_connection_dbus() cannot be cancelled. It should be made
-	 * cancellable and tracked via AsyncOpData to be able to do a clean
-	 * shutdown. */
+     * cancellable and tracked via AsyncOpData to be able to do a clean
+     * shutdown. */
     nm_settings_add_connection_dbus(
         priv->settings,
         connection,
@@ -5791,12 +5791,12 @@ impl_manager_add_and_activate_connection(NMDBusObject *                     obj,
     device_path          = nm_dbus_path_not_empty(device_path);
 
     /* Try to create a new connection with the given settings.
-	 * We allow empty settings for AddAndActivateConnection(). In that case,
-	 * the connection will be completed in nm_utils_complete_generic() or
-	 * nm_device_complete_connection() below. Just make sure we don't expect
-	 * specific data being in the connection till then (especially in
-	 * validate_activation_request()).
-	 */
+     * We allow empty settings for AddAndActivateConnection(). In that case,
+     * the connection will be completed in nm_utils_complete_generic() or
+     * nm_device_complete_connection() below. Just make sure we don't expect
+     * specific data being in the connection till then (especially in
+     * validate_activation_request()).
+     */
     incompl_conn = nm_simple_connection_new();
     if (settings && g_variant_n_children(settings))
         _nm_connection_replace_settings(incompl_conn,
@@ -6069,7 +6069,7 @@ sleep_devices_add(NMManager *self, NMDevice *device, gboolean suspending)
     if (g_hash_table_lookup_extended(priv->sleep_devices, device, NULL, (gpointer *) &handle)) {
         if (suspending) {
             /* if we are suspending, always insert a new handle in sleep_devices.
-			 * Even if we had an old handle, it might be stale by now. */
+             * Even if we had an old handle, it might be stale by now. */
             g_hash_table_insert(priv->sleep_devices,
                                 device,
                                 nm_sleep_monitor_inhibit_take(priv->sleep_monitor));
@@ -6163,15 +6163,15 @@ do_sleep_wake(NMManager *self, gboolean sleeping_changed)
         _LOGD(LOGD_SUSPEND, "sleep: %s...", suspending ? "sleeping" : "disabling");
 
         /* FIXME: are there still hardware devices that need to be disabled around
-		 * suspend/resume?
-		 */
+         * suspend/resume?
+         */
         c_list_for_each_entry (device, &priv->devices_lst_head, devices_lst) {
             if (nm_device_is_software(device)) {
                 /* If a user disables networking we consider that as an
-				 * indication that also software devices must be disconnected.
-				 * But we don't want to destroy them for external events as
-				 * a system suspend.
-				 */
+                 * indication that also software devices must be disconnected.
+                 * But we don't want to destroy them for external events as
+                 * a system suspend.
+                 */
                 if (suspending)
                     continue;
             }
@@ -6211,8 +6211,8 @@ do_sleep_wake(NMManager *self, gboolean sleeping_changed)
                     continue;
 
                 /* Belatedly take down Wake-on-LAN devices; ideally we wouldn't have to do this
-				 * but for now it's the only way to make sure we re-check their connectivity.
-				 */
+                 * but for now it's the only way to make sure we re-check their connectivity.
+                 */
                 if (device_is_wake_on_lan(priv->platform, device))
                     nm_device_set_unmanaged_by_flags(device,
                                                      NM_UNMANAGED_SLEEPING,
@@ -6220,9 +6220,9 @@ do_sleep_wake(NMManager *self, gboolean sleeping_changed)
                                                      NM_DEVICE_STATE_REASON_SLEEPING);
 
                 /* Check if the device is unmanaged but the state transition is still pending.
-				 * If so, change state now so that later we re-manage the device forcing a
-				 * re-check of available connections.
-				 */
+                 * If so, change state now so that later we re-manage the device forcing a
+                 * re-check of available connections.
+                 */
                 if (!nm_device_get_managed(device, FALSE)
                     && nm_device_get_state(device) != NM_DEVICE_STATE_UNMANAGED) {
                     nm_device_state_changed(device,
@@ -6233,8 +6233,8 @@ do_sleep_wake(NMManager *self, gboolean sleeping_changed)
         }
 
         /* Ensure rfkill state is up-to-date since we don't respond to state
-		 * changes during sleep.
-		 */
+         * changes during sleep.
+         */
         nm_manager_rfkill_update(self, RFKILL_TYPE_UNKNOWN);
 
         /* Re-manage managed devices */
@@ -6244,14 +6244,14 @@ do_sleep_wake(NMManager *self, gboolean sleeping_changed)
             if (nm_device_is_software(device)
                 && !nm_device_get_unmanaged_flags(device, NM_UNMANAGED_SLEEPING)) {
                 /* DHCP leases of software devices could have gone stale
-				 * so we need to renew them. */
+                 * so we need to renew them. */
                 nm_device_update_dynamic_ip_setup(device);
                 continue;
             }
 
             /* enable/disable wireless devices since that we don't respond
-			 * to killswitch changes during sleep.
-			 */
+             * to killswitch changes during sleep.
+             */
             for (i = 0; i < RFKILL_TYPE_MAX; i++) {
                 RadioState *rstate  = &priv->radio_states[i];
                 gboolean    enabled = radio_enabled_for_rstate(rstate, TRUE);
@@ -6338,13 +6338,13 @@ impl_manager_sleep(NMDBusObject *                     obj,
     }
 
     /* Unconditionally allow the request.  Previously it was polkit protected
-	 * but unfortunately that doesn't work for short-lived processes like
-	 * pm-utils.  It uses dbus-send without --print-reply, which quits
-	 * immediately after sending the request, and NM is unable to obtain the
-	 * sender's UID as dbus-send has already dropped off the bus.  Thus NM
-	 * fails the request.  Instead, don't validate the request, but rely on
-	 * D-Bus permissions to restrict the call to root.
-	 */
+     * but unfortunately that doesn't work for short-lived processes like
+     * pm-utils.  It uses dbus-send without --print-reply, which quits
+     * immediately after sending the request, and NM is unable to obtain the
+     * sender's UID as dbus-send has already dropped off the bus.  Thus NM
+     * fails the request.  Instead, don't validate the request, but rely on
+     * D-Bus permissions to restrict the call to root.
+     */
     _internal_sleep(self, do_sleep);
     nm_audit_log_control_op(NM_AUDIT_OP_SLEEP_CONTROL,
                             do_sleep ? "on" : "off",
@@ -6556,9 +6556,9 @@ impl_manager_set_logging(NMDBusObject *                     obj,
     const char *domains;
 
     /* The permission is already enforced by the D-Bus daemon, but we ensure
-	 * that the caller is still alive so that clients are forced to wait and
-	 * we'll be able to switch to polkit without breaking behavior.
-	 */
+     * that the caller is still alive so that clients are forced to wait and
+     * we'll be able to switch to polkit without breaking behavior.
+     */
     if (!nm_dbus_manager_ensure_uid(nm_dbus_object_get_manager(NM_DBUS_OBJECT(self)),
                                     invocation,
                                     G_MAXULONG,
@@ -6626,15 +6626,15 @@ device_connectivity_done(NMDevice *                  device,
             || (state == NM_CONNECTIVITY_FULL
                 && priv->connectivity_state == NM_CONNECTIVITY_FULL))) {
         /* despite having a @handle and @state returned by the requests, we always
-		 * return the current connectivity_state. That is, because the connectivity_state
-		 * and the answer to the connectivity check shall agree.
-		 *
-		 * However, if one of the requests (early) returns full connectivity and agrees with
-		 * the accumulated connectivity state, we no longer have to wait. The result is set.
-		 *
-		 * This also works well, because NMDevice first emits change signals to its own
-		 * connectivity state, which is then taken into account for the accumulated global
-		 * state. All this happens, before the callback is invoked. */
+         * return the current connectivity_state. That is, because the connectivity_state
+         * and the answer to the connectivity check shall agree.
+         *
+         * However, if one of the requests (early) returns full connectivity and agrees with
+         * the accumulated connectivity state, we no longer have to wait. The result is set.
+         *
+         * This also works well, because NMDevice first emits change signals to its own
+         * connectivity state, which is then taken into account for the accumulated global
+         * state. All this happens, before the callback is invoked. */
         g_dbus_method_invocation_return_value(
             g_steal_pointer(&data->context),
             g_variant_new("(u)", (guint) priv->connectivity_state));
@@ -6920,17 +6920,17 @@ nm_manager_stop(NMManager *self)
     NMDevice *        device;
 
     /* FIXME(shutdown): we don't do a proper shutdown yet:
-	 *  - need to ensure that all pending async operations are cancelled
-	 *    - e.g. operations in priv->async_op_lst_head
-	 *  - need to ensure that no more asynchronous requests are started,
-	 *    or that they complete quickly, or that they fail quickly.
-	 *  - note that cancelling some operations is not possible synchronously.
-	 *    Hence, stop() only prepares shutdown and tells everybody to not
-	 *    accept new work, and to complete in a timely manner.
-	 *    We need to still iterate the mainloop for a bit, to give everybody
-	 *    the chance to complete.
-	 *    - e.g. see comment at nm_auth_manager_force_shutdown()
-	 */
+     *  - need to ensure that all pending async operations are cancelled
+     *    - e.g. operations in priv->async_op_lst_head
+     *  - need to ensure that no more asynchronous requests are started,
+     *    or that they complete quickly, or that they fail quickly.
+     *  - note that cancelling some operations is not possible synchronously.
+     *    Hence, stop() only prepares shutdown and tells everybody to not
+     *    accept new work, and to complete in a timely manner.
+     *    We need to still iterate the mainloop for a bit, to give everybody
+     *    the chance to complete.
+     *    - e.g. see comment at nm_auth_manager_force_shutdown()
+     */
 
     nm_dbus_manager_stop(nm_dbus_object_get_manager(NM_DBUS_OBJECT(self)));
 
@@ -7008,9 +7008,9 @@ policy_default_ac_changed(GObject *object, GParamSpec *pspec, gpointer user_data
     NMActiveConnection *ac;
 
     /* Note: this assumes that it's not possible for the IP4 default
-	 * route to be going over the default-ip6-device. If that changes,
-	 * we need something more complicated here.
-	 */
+     * route to be going over the default-ip6-device. If that changes,
+     * we need something more complicated here.
+     */
     ac = nm_policy_get_default_ip4_ac(priv->policy);
     if (!ac)
         ac = nm_policy_get_default_ip6_ac(priv->policy);
@@ -7048,12 +7048,12 @@ policy_activating_ac_changed(GObject *object, GParamSpec *pspec, gpointer user_d
     NMActiveConnection *activating, *best;
 
     /* We only look at activating-ip6-ac if activating-ip4-ac
-	 * AND default-ip4-ac are NULL; if default-ip4-ac is
-	 * non-NULL, then activating-ip6-ac is irrelevant, since while
-	 * that AC might become the new default-ip6-ac, it can't
-	 * become primary-connection while default-ip4-ac is set to
-	 * something else.
-	 */
+     * AND default-ip4-ac are NULL; if default-ip4-ac is
+     * non-NULL, then activating-ip6-ac is irrelevant, since while
+     * that AC might become the new default-ip6-ac, it can't
+     * become primary-connection while default-ip4-ac is set to
+     * something else.
+     */
     activating = nm_policy_get_activating_ip4_ac(priv->policy);
     best       = nm_policy_get_default_ip4_ac(priv->policy);
     if (!activating && !best)
@@ -7517,14 +7517,14 @@ manager_radio_user_toggled(NMManager *self, RadioState *rstate, gboolean enabled
     nm_config_state_set(priv->config, TRUE, FALSE, rstate->key, enabled);
 
     /* When the user toggles the radio, their request should override any
-	 * daemon (like ModemManager) enabled state that can be changed.  For WWAN
-	 * for example, we want the WwanEnabled property to reflect the daemon state
-	 * too so that users can toggle the modem powered, but we don't want that
-	 * daemon state to affect whether or not the user *can* turn it on, which is
-	 * what the kernel rfkill state does.  So we ignore daemon enabled state
-	 * when determining what the new state should be since it shouldn't block
-	 * the user's request.
-	 */
+     * daemon (like ModemManager) enabled state that can be changed.  For WWAN
+     * for example, we want the WwanEnabled property to reflect the daemon state
+     * too so that users can toggle the modem powered, but we don't want that
+     * daemon state to affect whether or not the user *can* turn it on, which is
+     * what the kernel rfkill state does.  So we ignore daemon enabled state
+     * when determining what the new state should be since it shouldn't block
+     * the user's request.
+     */
     old_enabled          = radio_enabled_for_rstate(rstate, TRUE);
     rstate->user_enabled = enabled;
     new_enabled          = radio_enabled_for_rstate(rstate, FALSE);
@@ -7665,10 +7665,10 @@ constructed(GObject *object)
                      self);
 
     /*
-	 * Do not delete existing virtual devices to keep connectivity up.
-	 * Virtual devices are reused when NetworkManager is restarted.
-	 * Hence, don't react on NM_SETTINGS_SIGNAL_CONNECTION_REMOVED.
-	 */
+     * Do not delete existing virtual devices to keep connectivity up.
+     * Virtual devices are reused when NetworkManager is restarted.
+     * Hence, don't react on NM_SETTINGS_SIGNAL_CONNECTION_REMOVED.
+     */
 
     priv->policy = nm_policy_new(self, priv->settings);
     g_signal_connect(priv->policy,
@@ -7708,10 +7708,10 @@ constructed(GObject *object)
                      self);
 
     /* Force kernel Wi-Fi/WWAN rfkill state to follow NM saved Wi-Fi/WWAN state
-	 * in case the BIOS doesn't save rfkill state, and to be consistent with user
-	 * changes to the WirelessEnabled/WWANEnabled properties which toggle kernel
-	 * rfkill.
-	 */
+     * in case the BIOS doesn't save rfkill state, and to be consistent with user
+     * changes to the WirelessEnabled/WWANEnabled properties which toggle kernel
+     * rfkill.
+     */
     rfkill_change(self,
                   priv->radio_states[RFKILL_TYPE_WLAN].desc,
                   RFKILL_TYPE_WLAN,
@@ -8509,12 +8509,12 @@ nm_manager_class_init(NMManagerClass *manager_class)
                                                       G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMManager:metered:
-	 *
-	 * Whether the connectivity is metered.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMManager:metered:
+     *
+     * Whether the connectivity is metered.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_METERED] = g_param_spec_uint(NM_MANAGER_METERED,
                                                      "",
                                                      "",
@@ -8524,12 +8524,12 @@ nm_manager_class_init(NMManagerClass *manager_class)
                                                      G_PARAM_READABLE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMManager:global-dns-configuration:
-	 *
-	 * The global DNS configuration.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMManager:global-dns-configuration:
+     *
+     * The global DNS configuration.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_GLOBAL_DNS_CONFIGURATION] =
         g_param_spec_variant(NM_MANAGER_GLOBAL_DNS_CONFIGURATION,
                              "",
@@ -8539,12 +8539,12 @@ nm_manager_class_init(NMManagerClass *manager_class)
                              G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
 
     /**
-	 * NMManager:all-devices:
-	 *
-	 * All devices, including those that are not realized.
-	 *
-	 * Since: 1.2
-	 **/
+     * NMManager:all-devices:
+     *
+     * All devices, including those that are not realized.
+     *
+     * Since: 1.2
+     **/
     obj_properties[PROP_ALL_DEVICES] =
         g_param_spec_boxed(NM_MANAGER_ALL_DEVICES,
                            "",
@@ -8588,7 +8588,7 @@ nm_manager_class_init(NMManagerClass *manager_class)
                                                   G_TYPE_OBJECT);
 
     /* emitted only for realized devices when a device
-	 * becomes unrealized or removed */
+     * becomes unrealized or removed */
     signals[DEVICE_REMOVED] = g_signal_new(NM_MANAGER_DEVICE_REMOVED,
                                            G_OBJECT_CLASS_TYPE(object_class),
                                            G_SIGNAL_RUN_FIRST,
diff --git a/src/nm-netns.c b/src/nm-netns.c
index f07bb1c498..b4e28fa3ab 100644
--- a/src/nm-netns.c
+++ b/src/nm-netns.c
@@ -179,12 +179,12 @@ _platform_signal_on_idle_cb(gpointer user_data)
     priv->signal_pending_idle_id = 0;
 
     /* we emit all queued signals together. However, we don't want to hook the
-	 * main loop for longer than the currently queued elements.
-	 *
-	 * If we catch more change events, they will be queued and processed by a future
-	 * idle handler.
-	 *
-	 * Hence, move the list to a temporary list. Isn't CList great? */
+     * main loop for longer than the currently queued elements.
+     *
+     * If we catch more change events, they will be queued and processed by a future
+     * idle handler.
+     *
+     * Hence, move the list to a temporary list. Isn't CList great? */
 
     c_list_init(&work_list);
     c_list_splice(&work_list, &priv->l3cfg_signal_pending_lst_head);
@@ -385,21 +385,21 @@ constructed(GObject *object)
     priv->rules_manager = nmp_rules_manager_new(priv->platform);
 
     /* Weakly track the default rules with a dummy user-tag. These
-	 * rules are always weekly tracked... */
+     * rules are always weekly tracked... */
     nmp_rules_manager_track_default(priv->rules_manager,
                                     AF_UNSPEC,
                                     0,
                                     nm_netns_parent_class /* static dummy user-tag */);
 
     /* Also weakly track all existing rules. These were added before NetworkManager
-	 * starts, so they are probably none of NetworkManager's business.
-	 *
-	 * However note that during service restart, devices may stay up and rules kept.
-	 * That means, after restart such rules may have been added by a previous run
-	 * of NetworkManager, we just don't know.
-	 *
-	 * For that reason, whenever we will touch such rules later one, we make them
-	 * fully owned and no longer weekly tracked. See %NMP_RULES_MANAGER_EXTERN_WEAKLY_TRACKED_USER_TAG. */
+     * starts, so they are probably none of NetworkManager's business.
+     *
+     * However note that during service restart, devices may stay up and rules kept.
+     * That means, after restart such rules may have been added by a previous run
+     * of NetworkManager, we just don't know.
+     *
+     * For that reason, whenever we will touch such rules later one, we make them
+     * fully owned and no longer weekly tracked. See %NMP_RULES_MANAGER_EXTERN_WEAKLY_TRACKED_USER_TAG. */
     nmp_rules_manager_track_from_platform(priv->rules_manager,
                                           NULL,
                                           AF_UNSPEC,
diff --git a/src/nm-pacrunner-manager.c b/src/nm-pacrunner-manager.c
index 8a7de486f4..ac403f2d79 100644
--- a/src/nm-pacrunner-manager.c
+++ b/src/nm-pacrunner-manager.c
@@ -460,17 +460,17 @@ nm_pacrunner_manager_remove(NMPacrunnerConfId *conf_id)
 
     if (!conf_id->path) {
         /* There is no ID to destroy the configuration.
-		 *
-		 * That can happen because:
-		 *
-		 *  - pacrunner D-Bus service is not running (no name owner) and we didn't call CreateProxyConfiguration.
-		 *  - CreateProxyConfiguration failed.
-		 *  - CreateProxyConfiguration is in progress.
-		 *
-		 * In all cases there is nothing to do. Note that if CreateProxyConfiguration is in progress
-		 * it has a reference on the conf-id and it will automatically destroy the configuration
-		 * when it completes.
-		 */
+         *
+         * That can happen because:
+         *
+         *  - pacrunner D-Bus service is not running (no name owner) and we didn't call CreateProxyConfiguration.
+         *  - CreateProxyConfiguration failed.
+         *  - CreateProxyConfiguration is in progress.
+         *
+         * In all cases there is nothing to do. Note that if CreateProxyConfiguration is in progress
+         * it has a reference on the conf-id and it will automatically destroy the configuration
+         * when it completes.
+         */
         return;
     }
 
@@ -596,9 +596,9 @@ dispose(GObject *object)
     nm_assert(c_list_is_empty(&priv->conf_id_lst_head));
 
     /* we cancel all pending operations. Note that pacrunner automatically
-	 * removes all configuration once NetworkManager disconnects from
-	 * the bus -- which happens soon after we destroy the pacrunner manager.
-	 */
+     * removes all configuration once NetworkManager disconnects from
+     * the bus -- which happens soon after we destroy the pacrunner manager.
+     */
     nm_clear_g_cancellable(&priv->cancellable);
 
     nm_clear_g_dbus_connection_signal(priv->dbus_connection, &priv->name_owner_changed_id);
diff --git a/src/nm-policy.c b/src/nm-policy.c
index d610354e2a..202cbf47e2 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -172,7 +172,7 @@ _clear_ip6_subnet(gpointer key, gpointer value, gpointer user_data)
 
     if (device) {
         /* We can not remove a subnet we already started announcing.
-		 * Just un-prefer it. */
+         * Just un-prefer it. */
         subnet->preferred = 0;
         nm_device_use_ip6_subnet(device, subnet);
     }
@@ -244,10 +244,10 @@ ip6_subnet_from_delegation(IP6PrefixDelegation *delegation, NMDevice *device)
             delegation->prefix.address.s6_addr32[1] | htonl(delegation->next_subnet);
 
         /* Out subnet pool management is pretty unsophisticated. We only add
-		 * the subnets and index them by ifindex. That keeps the implementation
-		 * simple and the dead entries make it easy to reuse the same subnet on
-		 * subsequent activations. On the other hand they may waste the subnet
-		 * space. */
+         * the subnets and index them by ifindex. That keeps the implementation
+         * simple and the dead entries make it easy to reuse the same subnet on
+         * subsequent activations. On the other hand they may waste the subnet
+         * space. */
         delegation->next_subnet++;
     }
 
@@ -355,9 +355,9 @@ device_ip6_prefix_delegated(NMDevice *device, NMPlatformIP6Address *prefix, gpoi
     delegation->prefix = *prefix;
 
     /* The newly activated connections are added to the list beginning,
-	 * so traversing it from the beginning makes it likely for newly
-	 * activated connections that have no subnet assigned to be served
-	 * first. That is a simple yet fair policy, which is good. */
+     * so traversing it from the beginning makes it likely for newly
+     * activated connections that have no subnet assigned to be served
+     * first. That is a simple yet fair policy, which is good. */
     nm_manager_for_each_active_connection (priv->manager, ac, tmp_list) {
         NMDevice *to_device;
 
@@ -414,7 +414,7 @@ get_best_active_connection(NMPolicy *self, int addr_family, gboolean fully_activ
     nm_assert(NM_IN_SET(addr_family, AF_INET, AF_INET6));
 
     /* we prefer the current AC in case of identical metric.
-	 * Hence, try that one first. */
+     * Hence, try that one first. */
     prev_ac = addr_family == AF_INET ? (fully_activated ? priv->default_ac4 : priv->activating_ac4)
                                      : (fully_activated ? priv->default_ac6 : priv->activating_ac6);
     best_ac = NULL;
@@ -437,10 +437,10 @@ get_best_active_connection(NMPolicy *self, int addr_family, gboolean fully_activ
         r = nm_device_get_best_default_route(device, addr_family);
         if (r) {
             /* NOTE: the best route might have rt_source NM_IP_CONFIG_SOURCE_VPN,
-			 * which means it was injected by a VPN, not added by device.
-			 *
-			 * In this case, is it really the best device? Why do we even need the best
-			 * device?? */
+             * which means it was injected by a VPN, not added by device.
+             *
+             * In this case, is it really the best device? Why do we even need the best
+             * device?? */
             metric             = NMP_OBJECT_CAST_IP_ROUTE(r)->metric;
             is_fully_activated = TRUE;
         } else if (!fully_activated && (connection = nm_device_get_applied_connection(device))
@@ -463,8 +463,8 @@ get_best_active_connection(NMPolicy *self, int addr_family, gboolean fully_activ
 
     if (!fully_activated && best_ac && best_is_fully_activated) {
         /* There's a best activating AC only if the best device
-		 * among all activating and already-activated devices is a
-		 * still-activating one. */
+         * among all activating and already-activated devices is a
+         * still-activating one. */
         return NULL;
     }
 
@@ -533,8 +533,8 @@ _get_hostname(NMPolicy *self)
     int              errsv;
 
     /* If there is an in-progress hostname change, return
-	 * the last hostname set as would be set soon...
-	 */
+     * the last hostname set as would be set soon...
+     */
     if (priv->changing_hostname) {
         _LOGT(LOGD_DNS, "get-hostname: \"%s\" (last on set)", priv->last_hostname);
         return g_strdup(priv->last_hostname);
@@ -578,27 +578,27 @@ _set_hostname(NMPolicy *self, const char *new_hostname, const char *msg)
     const char *     name;
 
     /* The incoming hostname *can* be NULL, which will get translated to
-	 * 'localhost.localdomain' or such in the hostname policy code, but we
-	 * keep cur_hostname = NULL in the case because we need to know that
-	 * there was no valid hostname to start with.
-	 */
+     * 'localhost.localdomain' or such in the hostname policy code, but we
+     * keep cur_hostname = NULL in the case because we need to know that
+     * there was no valid hostname to start with.
+     */
 
     /* Clear lookup addresses if we have a hostname, so that we don't
-	 * restart the reverse lookup thread later.
-	 */
+     * restart the reverse lookup thread later.
+     */
     if (new_hostname)
         g_clear_object(&priv->lookup.addr);
 
     /* Update the DNS only if the hostname is actually
-	 * going to change.
-	 */
+     * going to change.
+     */
     if (!nm_streq0(priv->cur_hostname, new_hostname)) {
         g_free(priv->cur_hostname);
         priv->cur_hostname = g_strdup(new_hostname);
 
         /* Notify the DNS manager of the hostname change so that the domain part, if
-		 * present, can be added to the search list.
-		 */
+         * present, can be added to the search list.
+         */
         nm_dns_manager_set_hostname(priv->dns_manager,
                                     priv->cur_hostname,
                                     all_devices_not_active(self));
@@ -627,7 +627,7 @@ _set_hostname(NMPolicy *self, const char *new_hostname, const char *msg)
     _LOGI(LOGD_DNS, "set-hostname: set hostname to '%s' (%s)", name, msg);
 
     /* Ask NMSettings to update the transient hostname using its
-	 * systemd-hostnamed proxy */
+     * systemd-hostnamed proxy */
     nm_hostname_manager_set_transient_hostname(priv->hostname_manager,
                                                name,
                                                settings_set_hostname_cb,
@@ -698,8 +698,8 @@ update_system_hostname(NMPolicy *self, const char *msg)
     nm_clear_g_cancellable(&priv->lookup.cancellable);
 
     /* Check if the hostname was set externally to NM, so that in that case
-	 * we can avoid to fallback to the one we got when we started.
-	 * Consider "not specific" hostnames as equal. */
+     * we can avoid to fallback to the one we got when we started.
+     * Consider "not specific" hostnames as equal. */
     if ((temp_hostname = _get_hostname(self)) && !nm_streq0(temp_hostname, priv->last_hostname)
         && (nm_utils_is_specific_hostname(temp_hostname)
             || nm_utils_is_specific_hostname(priv->last_hostname))) {
@@ -722,13 +722,13 @@ update_system_hostname(NMPolicy *self, const char *msg)
     }
 
     /* Hostname precedence order:
-	 *
-	 * 1) a configured hostname (from settings)
-	 * 2) automatic hostname from the default device's config (DHCP, VPN, etc)
-	 * 3) the last hostname set outside NM
-	 * 4) reverse-DNS of the best device's IPv4 address
-	 *
-	 */
+     *
+     * 1) a configured hostname (from settings)
+     * 2) automatic hostname from the default device's config (DHCP, VPN, etc)
+     * 3) the last hostname set outside NM
+     * 4) reverse-DNS of the best device's IPv4 address
+     *
+     */
 
     /* Try a persistent hostname first */
     configured_hostname = nm_hostname_manager_get_hostname(priv->hostname_manager);
@@ -782,10 +782,10 @@ update_system_hostname(NMPolicy *self, const char *msg)
 
     if (priv->hostname_mode == NM_POLICY_HOSTNAME_MODE_DHCP) {
         /* In dhcp hostname-mode, the hostname is updated only if it comes from
-		 * a DHCP host-name option: if last set was from a host-name option and
-		 * we are here than that connection is gone (with its host-name option),
-		 * so reset the hostname to the previous value
-		 */
+         * a DHCP host-name option: if last set was from a host-name option and
+         * we are here than that connection is gone (with its host-name option),
+         * so reset the hostname to the previous value
+         */
         if (priv->dhcp_hostname) {
             _set_hostname(self, priv->orig_hostname, "reset dhcp hostname");
             priv->dhcp_hostname = FALSE;
@@ -797,23 +797,23 @@ update_system_hostname(NMPolicy *self, const char *msg)
 
     if (!priv->default_ac4 && !priv->default_ac6) {
         /* No best device; fall back to the last hostname set externally
-		 * to NM or if there wasn't one, 'localhost.localdomain'
-		 */
+         * to NM or if there wasn't one, 'localhost.localdomain'
+         */
         _set_hostname(self, priv->orig_hostname, "no default device");
         return;
     }
 
     /* If no automatically-configured hostname, try using the last hostname
-	 * set externally to NM
-	 */
+     * set externally to NM
+     */
     if (priv->orig_hostname) {
         _set_hostname(self, priv->orig_hostname, "from system startup");
         return;
     }
 
     /* No configured hostname, no automatically determined hostname, and no
-	 * bootup hostname. Start reverse DNS of the current IPv4 or IPv6 address.
-	 */
+     * bootup hostname. Start reverse DNS of the current IPv4 or IPv6 address.
+     */
     device     = get_default_device(self, AF_INET);
     ip4_config = device ? nm_device_get_ip4_config(device) : NULL;
 
@@ -845,9 +845,9 @@ update_default_ac(NMPolicy *self, int addr_family, NMActiveConnection *best)
     NMActiveConnection *ac;
 
     /* Clear the 'default[6]' flag on all active connections that aren't the new
-	 * default active connection.  We'll set the new default after; this ensures
-	 * we don't ever have two marked 'default[6]' simultaneously.
-	 */
+     * default active connection.  We'll set the new default after; this ensures
+     * we don't ever have two marked 'default[6]' simultaneously.
+     */
     nm_manager_for_each_active_connection (priv->manager, ac, tmp_list) {
         if (ac != best)
             nm_active_connection_set_default(ac, addr_family, FALSE);
@@ -957,8 +957,8 @@ update_ip4_routing(NMPolicy *self, gboolean force_update)
     NMActiveConnection *ac;
 
     /* Note that we might have an IPv4 VPN tunneled over an IPv6-only device,
-	 * so we can get (vpn != NULL && best == NULL).
-	 */
+     * so we can get (vpn != NULL && best == NULL).
+     */
     if (!get_best_ip_config(self, AF_INET, &ip_iface, &best_ac, &best, &vpn)) {
         if (nm_clear_g_object(&priv->default_ac4)) {
             _LOGt(LOGD_DNS, "set-default-ac-4: %p", NULL);
@@ -1020,8 +1020,8 @@ update_ip6_routing(NMPolicy *self, gboolean force_update)
     const CList *       tmp_list;
 
     /* Note that we might have an IPv6 VPN tunneled over an IPv4-only device,
-	 * so we can get (vpn != NULL && best == NULL).
-	 */
+     * so we can get (vpn != NULL && best == NULL).
+     */
     if (!get_best_ip_config(self, AF_INET6, &ip_iface, &best_ac, &best, &vpn)) {
         if (nm_clear_g_object(&priv->default_ac6)) {
             _LOGt(LOGD_DNS, "set-default-ac-6: %p", NULL);
@@ -1071,8 +1071,8 @@ update_ip_dns(NMPolicy *self, int addr_family, NMDevice *changed_device)
     ip_config = get_best_ip_config(self, addr_family, &ip_iface, NULL, &device, &vpn);
     if (ip_config) {
         /* Tell the DNS manager this config is preferred by re-adding it with
-		 * a different IP config type.
-		 */
+         * a different IP config type.
+         */
         _dns_manager_set_ip_config(NM_POLICY_GET_PRIVATE(self)->dns_manager,
                                    ip_config,
                                    (vpn || (device && nm_device_is_vpn(device)))
@@ -1160,7 +1160,7 @@ pending_ac_gone(gpointer data, GObject *where_the_object_was)
     NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE(self);
 
     /* Active connections should reach the DEACTIVATED state
-	 * before disappearing. */
+     * before disappearing. */
     nm_assert_not_reached();
 
     if (g_hash_table_remove(priv->pending_active_connections, where_the_object_was))
@@ -1175,10 +1175,10 @@ pending_ac_state_changed(NMActiveConnection *ac, guint state, guint reason, NMPo
 
     if (state >= NM_ACTIVE_CONNECTION_STATE_DEACTIVATING) {
         /* The AC is being deactivated before the device had a chance
-		 * to move to PREPARE. Schedule a new auto-activation on the
-		 * device, but block the current connection to avoid an activation
-		 * loop.
-		 */
+         * to move to PREPARE. Schedule a new auto-activation on the
+         * device, but block the current connection to avoid an activation
+         * loop.
+         */
         if (reason != NM_ACTIVE_CONNECTION_STATE_REASON_DEVICE_DISCONNECTED) {
             con = nm_active_connection_get_settings_connection(ac);
             nm_settings_connection_autoconnect_blocked_reason_set(
@@ -1289,9 +1289,9 @@ auto_activate_device(NMPolicy *self, NMDevice *device)
     }
 
     /* Subscribe to AC state-changed signal to detect when the
-	 * activation fails in early stages without changing device
-	 * state.
-	 */
+     * activation fails in early stages without changing device
+     * state.
+     */
     if (g_hash_table_add(priv->pending_active_connections, ac)) {
         g_signal_connect(ac,
                          NM_ACTIVE_CONNECTION_STATE_CHANGED,
@@ -1463,8 +1463,8 @@ reset_autoconnect_all(
                     NM_SETTINGS_AUTO_CONNECT_BLOCKED_REASON_NO_SECRETS,
                     FALSE)) {
                 /* maybe the connection is still blocked afterwards for other reasons
-				 * and in the larger picture nothing changed. But it's too complicated
-				 * to find out exactly. Just assume, something changed to be sure. */
+                 * and in the larger picture nothing changed. But it's too complicated
+                 * to find out exactly. Just assume, something changed to be sure. */
                 if (!nm_settings_connection_autoconnect_is_blocked(sett_conn))
                     changed = TRUE;
             }
@@ -1779,10 +1779,10 @@ device_state_changed(NMDevice *          device,
     case NM_DEVICE_STATE_REASON_SIM_PIN_INCORRECT:
     case NM_DEVICE_STATE_REASON_GSM_APN_FAILED:
         /* Block autoconnection at settings level if there is any settings-specific
-		 * error reported by the modem (e.g. wrong SIM-PIN or wrong APN). Do not block
-		 * autoconnection at settings level for errors in the device domain (e.g.
-		 * a missing SIM or wrong modem initialization).
-		 */
+         * error reported by the modem (e.g. wrong SIM-PIN or wrong APN). Do not block
+         * autoconnection at settings level for errors in the device domain (e.g.
+         * a missing SIM or wrong modem initialization).
+         */
         if (sett_conn) {
             nm_settings_connection_autoconnect_blocked_reason_set(
                 sett_conn,
@@ -1797,8 +1797,8 @@ device_state_changed(NMDevice *          device,
     switch (new_state) {
     case NM_DEVICE_STATE_FAILED:
         /* Mark the connection invalid if it failed during activation so that
-		 * it doesn't get automatically chosen over and over and over again.
-		 */
+         * it doesn't get automatically chosen over and over and over again.
+         */
         if (sett_conn && old_state >= NM_DEVICE_STATE_PREPARE
             && old_state <= NM_DEVICE_STATE_ACTIVATED) {
             gboolean blocked = FALSE;
@@ -1807,18 +1807,18 @@ device_state_changed(NMDevice *          device,
 
             if (nm_device_state_reason_check(reason) == NM_DEVICE_STATE_REASON_NO_SECRETS) {
                 /* we want to block the connection from auto-connect if it failed due to no-secrets.
-				 * However, if a secret-agent registered, since the connection made the last
-				 * secret-request, we do not block it. The new secret-agent might not yet
-				 * been consulted, and it may be able to provide the secrets.
-				 *
-				 * We detect this by using a version-id of the agent-manager, which increments
-				 * whenever new agents register. Note that the agent-manager's version-id is
-				 * never zero and strictly increasing.
-				 *
-				 * A connection's version-id of zero means that the connection never tried to request secrets.
-				 * That can happen when nm_settings_connection_get_secrets() fails early without actually
-				 * consulting any agents.
-				 */
+                 * However, if a secret-agent registered, since the connection made the last
+                 * secret-request, we do not block it. The new secret-agent might not yet
+                 * been consulted, and it may be able to provide the secrets.
+                 *
+                 * We detect this by using a version-id of the agent-manager, which increments
+                 * whenever new agents register. Note that the agent-manager's version-id is
+                 * never zero and strictly increasing.
+                 *
+                 * A connection's version-id of zero means that the connection never tried to request secrets.
+                 * That can happen when nm_settings_connection_get_secrets() fails early without actually
+                 * consulting any agents.
+                 */
                 con_v = nm_settings_connection_get_last_secret_agent_version_id(sett_conn);
                 if (con_v == 0 || con_v == nm_agent_manager_get_agent_version_id(priv->agent_mgr)) {
                     _LOGD(LOGD_DEVICE,
@@ -1833,13 +1833,13 @@ device_state_changed(NMDevice *          device,
             } else if (nm_device_state_reason_check(reason)
                        == NM_DEVICE_STATE_REASON_DEPENDENCY_FAILED) {
                 /* A connection that fails due to dependency-failed is not
-				 * able to reconnect until the master connection activates
-				 * again; when this happens, the master clears the blocked
-				 * reason for all its slaves in activate_slave_connections()
-				 * and tries to reconnect them. For this to work, the slave
-				 * should be marked as blocked when it fails with
-				 * dependency-failed.
-				 */
+                 * able to reconnect until the master connection activates
+                 * again; when this happens, the master clears the blocked
+                 * reason for all its slaves in activate_slave_connections()
+                 * and tries to reconnect them. For this to work, the slave
+                 * should be marked as blocked when it fails with
+                 * dependency-failed.
+                 */
                 _LOGD(LOGD_DEVICE,
                       "connection '%s' now blocked from autoconnect due to failed dependency",
                       nm_settings_connection_get_id(sett_conn));
@@ -1874,8 +1874,8 @@ device_state_changed(NMDevice *          device,
             nm_settings_connection_autoconnect_retries_reset(sett_conn);
 
             /* And clear secrets so they will always be requested from the
-			 * settings service when the next connection is made.
-			 */
+             * settings service when the next connection is made.
+             */
             nm_settings_connection_clear_secrets(sett_conn, FALSE, FALSE);
         }
 
@@ -1935,8 +1935,8 @@ device_state_changed(NMDevice *          device,
         break;
     case NM_DEVICE_STATE_DISCONNECTED:
         /* Reset retry counts for a device's connections when carrier on; if cable
-		 * was unplugged and plugged in again, we should try to reconnect.
-		 */
+         * was unplugged and plugged in again, we should try to reconnect.
+         */
         if (nm_device_state_reason_check(reason) == NM_DEVICE_STATE_REASON_CARRIER
             && old_state == NM_DEVICE_STATE_UNAVAILABLE)
             reset_autoconnect_all(self, device, FALSE);
@@ -1950,11 +1950,11 @@ device_state_changed(NMDevice *          device,
 
     case NM_DEVICE_STATE_PREPARE:
         /* Reset auto-connect retries of all slaves and schedule them for
-		 * activation. */
+         * activation. */
         activate_slave_connections(self, device);
 
         /* Now that the device state is progressing, we don't care
-		 * anymore for the AC state. */
+         * anymore for the AC state. */
         ac = (NMActiveConnection *) nm_device_get_act_request(device);
         if (ac && g_hash_table_remove(priv->pending_active_connections, ac)) {
             g_signal_handlers_disconnect_by_func(ac, pending_ac_state_changed, self);
@@ -2020,10 +2020,10 @@ device_ip_config_changed(NMDevice *  device,
     nm_dns_manager_begin_updates(priv->dns_manager, __func__);
 
     /* We catch already all the IP events registering on the device state changes but
-	 * the ones where the IP changes but the device state keep stable (i.e., activated):
-	 * ignore IP config changes but when the device is in activated state.
-	 * Prevents unnecessary changes to DNS information.
-	 */
+     * the ones where the IP changes but the device state keep stable (i.e., activated):
+     * ignore IP config changes but when the device is in activated state.
+     * Prevents unnecessary changes to DNS information.
+     */
     if (nm_device_get_state(device) == NM_DEVICE_STATE_ACTIVATED) {
         if (old_config != new_config) {
             if (new_config)
@@ -2138,7 +2138,7 @@ device_removed(NMManager *manager, NMDevice *device, gpointer user_data)
     ActivateData *   data;
 
     /* TODO: is this needed? The delegations are cleaned up
-	 * on transition to deactivated too. */
+     * on transition to deactivated too. */
     ip6_remove_device_prefix_delegations(self, device);
 
     /* Clear any idle callbacks for this device */
@@ -2150,8 +2150,8 @@ device_removed(NMManager *manager, NMDevice *device, gpointer user_data)
         devices_list_unregister(self, device);
 
     /* Don't update routing and DNS here as we've already handled that
-	 * for devices that need it when the device's state changed to UNMANAGED.
-	 */
+     * for devices that need it when the device's state changed to UNMANAGED.
+     */
 }
 
 /*****************************************************************************/
@@ -2369,7 +2369,7 @@ schedule_activate_all(NMPolicy *self)
     NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE(self);
 
     /* always restart the idle handler. That way, we settle
-	 * all other events before restarting to activate them. */
+     * all other events before restarting to activate them. */
     nm_clear_g_source(&priv->schedule_activate_all_id);
     priv->schedule_activate_all_id = g_idle_add(schedule_activate_all_cb, self);
 }
@@ -2393,8 +2393,8 @@ firewall_state_changed(NMFirewallManager *manager, gboolean initialized_now, gpo
 
     if (initialized_now) {
         /* the firewall manager was initializing, but all requests
-		 * so fare were queued and are already sent. No need to
-		 * re-update the firewall zone of the devices. */
+         * so fare were queued and are already sent. No need to
+         * re-update the firewall zone of the devices. */
         return;
     }
 
@@ -2413,9 +2413,9 @@ dns_config_changed(NMDnsManager *dns_manager, gpointer user_data)
     NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE(self);
 
     /* Restart a thread for reverse-DNS lookup after we are signalled that
-	 * DNS changed. Because the result from a previous run may not be right
-	 * (race in updating DNS and doing the reverse lookup).
-	 */
+     * DNS changed. Because the result from a previous run may not be right
+     * (race in updating DNS and doing the reverse lookup).
+     */
 
     nm_clear_g_cancellable(&priv->lookup.cancellable);
 
@@ -2520,9 +2520,9 @@ secret_agent_registered(NMSettings *settings, NMSecretAgent *agent, gpointer use
     NMPolicy *self = NM_POLICY(user_data);
 
     /* The registered secret agent may provide some missing secrets. Thus we
-	 * reset retries count here and schedule activation, so that the
-	 * connections failed due to missing secrets may re-try auto-connection.
-	 */
+     * reset retries count here and schedule activation, so that the
+     * connections failed due to missing secrets may re-try auto-connection.
+     */
     if (reset_autoconnect_all(self, NULL, TRUE))
         schedule_activate_all(self);
 }
@@ -2797,9 +2797,9 @@ dispose(GObject *object)
     }
 
     /* The manager should have disposed of ActiveConnections already, which
-	 * will have called active_connection_removed() and thus we don't need
-	 * to clean anything up.  Assert that this is TRUE.
-	 */
+     * will have called active_connection_removed() and thus we don't need
+     * to clean anything up.  Assert that this is TRUE.
+     */
     nm_assert(c_list_is_empty(nm_manager_get_active_connections(priv->manager)));
 
     nm_clear_g_source(&priv->reset_retries_id);
@@ -2819,10 +2819,10 @@ dispose(GObject *object)
         g_clear_object(&priv->settings);
 
         /* we don't clear priv->manager as we don't own a reference to it,
-		 * that is, NMManager must outlive NMPolicy anyway.
-		 *
-		 * Hence, we unsubscribe the signals here together with the signals
-		 * for settings. */
+         * that is, NMManager must outlive NMPolicy anyway.
+         *
+         * Hence, we unsubscribe the signals here together with the signals
+         * for settings. */
         g_signal_handlers_disconnect_by_data(priv->manager, priv);
     }
 
diff --git a/src/nm-proxy-config.c b/src/nm-proxy-config.c
index 9e26c39f54..6c114bd9c5 100644
--- a/src/nm-proxy-config.c
+++ b/src/nm-proxy-config.c
@@ -73,8 +73,8 @@ nm_proxy_config_merge_setting(NMProxyConfig *config, NMSettingProxy *setting)
         priv->method = NM_PROXY_CONFIG_METHOD_AUTO;
 
         /* Free DHCP Obtained PAC Url (i.e Option 252)
-		 * only when libnm overrides it.
-		 */
+         * only when libnm overrides it.
+         */
         tmp = nm_setting_proxy_get_pac_url(setting);
         if (tmp) {
             g_free(priv->pac_url);
diff --git a/src/nm-rfkill-manager.c b/src/nm-rfkill-manager.c
index 879f8fafd0..7c3d0c86f0 100644
--- a/src/nm-rfkill-manager.c
+++ b/src/nm-rfkill-manager.c
@@ -217,8 +217,8 @@ recheck_killswitches(NMRfkillManager *self)
     for (i = 0; i < RFKILL_TYPE_MAX; i++) {
         if (platform_checked[i] == TRUE) {
             /* blocked platform switch state overrides device state, otherwise
-			 * let the device state stand. (bgo #655773)
-			 */
+             * let the device state stand. (bgo #655773)
+             */
             if (platform_states[i] != RFKILL_UNBLOCKED)
                 poll_states[i] = platform_states[i];
         }
diff --git a/src/nm-rfkill-manager.h b/src/nm-rfkill-manager.h
index 24ebd5d877..8298591292 100644
--- a/src/nm-rfkill-manager.h
+++ b/src/nm-rfkill-manager.h
@@ -18,9 +18,9 @@ typedef enum { /*< skip >*/
                RFKILL_TYPE_WWAN = 1,
 
                /* UNKNOWN and MAX should always be 1 more than
-	 * the last rfkill type since RFKILL_TYPE_MAX is
-	 * used as an array size.
-	 */
+     * the last rfkill type since RFKILL_TYPE_MAX is
+     * used as an array size.
+     */
                RFKILL_TYPE_UNKNOWN, /* KEEP LAST */
                RFKILL_TYPE_MAX = RFKILL_TYPE_UNKNOWN
 } RfKillType;
diff --git a/src/nm-session-monitor.c b/src/nm-session-monitor.c
index 7d189b7c16..a9573c0b3c 100644
--- a/src/nm-session-monitor.c
+++ b/src/nm-session-monitor.c
@@ -345,11 +345,11 @@ nm_session_monitor_class_init(NMSessionMonitorClass *klass)
     gobject_class->finalize = finalize;
 
     /**
-	 * NMSessionMonitor::changed:
-	 * @monitor: A #NMSessionMonitor
-	 *
-	 * Emitted when something changes.
-	 */
+     * NMSessionMonitor::changed:
+     * @monitor: A #NMSessionMonitor
+     *
+     * Emitted when something changes.
+     */
     signals[CHANGED] = g_signal_new(NM_SESSION_MONITOR_CHANGED,
                                     NM_TYPE_SESSION_MONITOR,
                                     G_SIGNAL_RUN_LAST,
diff --git a/src/nm-types.h b/src/nm-types.h
index 92fab52ad5..f9cba476ec 100644
--- a/src/nm-types.h
+++ b/src/nm-types.h
@@ -59,12 +59,12 @@ typedef enum {
     NM_ACTIVATION_TYPE_MANAGED = 0,
 
     /* gracefully/seamlessly take over the device. This leaves additional
-	 * IP addresses and does not restore missing manual addresses. */
+     * IP addresses and does not restore missing manual addresses. */
     NM_ACTIVATION_TYPE_ASSUME = 1,
 
     /* external activation. This device is not managed by NM, instead
-	 * a in-memory connection is generated and NM pretends the device
-	 * to be active, but it doesn't do anything really. */
+     * a in-memory connection is generated and NM pretends the device
+     * to be active, but it doesn't do anything really. */
     NM_ACTIVATION_TYPE_EXTERNAL = 2,
 } NMActivationType;
 
@@ -83,7 +83,7 @@ typedef enum {
     NM_IP_CONFIG_SOURCE_UNKNOWN = 0,
 
     /* for routes, the source is mapped to the uint8 field rtm_protocol.
-	 * Reserve the range [1,0x100] for native RTPROT values. */
+     * Reserve the range [1,0x100] for native RTPROT values. */
 
     NM_IP_CONFIG_SOURCE_RTPROT_UNSPEC   = 1 + 0,
     NM_IP_CONFIG_SOURCE_RTPROT_REDIRECT = 1 + 1,
diff --git a/src/platform/nm-linux-platform.c b/src/platform/nm-linux-platform.c
index 7e7e3d404b..8724c59178 100644
--- a/src/platform/nm-linux-platform.c
+++ b/src/platform/nm-linux-platform.c
@@ -377,7 +377,7 @@ typedef enum {
 
 typedef enum {
     /* Negative values are errors from kernel. Add dummy member to
-	 * make enum signed. */
+     * make enum signed. */
     _WAIT_FOR_NL_RESPONSE_RESULT_SYSTEM_ERROR = G_MININT,
 
     WAIT_FOR_NL_RESPONSE_RESULT_UNKNOWN = 0,
@@ -434,11 +434,11 @@ typedef struct {
 
     struct {
         /* which delayed actions are scheduled, as marked in @flags.
-		 * Some types have additional arguments in the fields below. */
+         * Some types have additional arguments in the fields below. */
         DelayedActionType flags;
 
         /* counter that a refresh all action is in progress, separated
-		 * by type. */
+         * by type. */
         int refresh_all_in_progress[_REFRESH_ALL_TYPE_NUM];
 
         GPtrArray *list_master_connected;
@@ -623,19 +623,19 @@ typedef struct {
     const char *type_string;
 
     /* IFLA_INFO_KIND / rtnl_link_get_type() where applicable; the rtnl type
-	 * should only be specified if the device type can be created without
-	 * additional parameters, and if the device type can be determined from
-	 * the rtnl_type.  eg, tun/tap should not be specified since both
-	 * tun and tap devices use "tun", and InfiniBand should not be
-	 * specified because a PKey is required at creation. Drivers set this
-	 * value from their 'struct rtnl_link_ops' structure.
-	 */
+     * should only be specified if the device type can be created without
+     * additional parameters, and if the device type can be determined from
+     * the rtnl_type.  eg, tun/tap should not be specified since both
+     * tun and tap devices use "tun", and InfiniBand should not be
+     * specified because a PKey is required at creation. Drivers set this
+     * value from their 'struct rtnl_link_ops' structure.
+     */
     const char *rtnl_type;
 
     /* uevent DEVTYPE where applicable, from /sys/class/net/<ifname>/uevent;
-	 * drivers set this value from their SET_NETDEV_DEV() call and the
-	 * 'struct device_type' name member.
-	 */
+     * drivers set this value from their SET_NETDEV_DEV() call and the
+     * 'struct device_type' name member.
+     */
     const char *devtype;
 } LinkDesc;
 
@@ -900,13 +900,13 @@ _addrtime_timestamp_to_nm(guint32 timestamp, gint32 *out_now_nm)
     NM_SET_OUT(out_now_nm, now_nm / 1000);
 
     /* converting the timestamp into nm_utils_get_monotonic_timestamp_msec() scale is
-	 * a good guess but fails in the following situations:
-	 *
-	 * - If the address existed before start of the process, the timestamp in nm scale would
-	 *   be negative or zero. In this case we default to 1.
-	 * - during hibernation, the CLOCK_MONOTONIC/timestamp drifts from
-	 *   nm_utils_get_monotonic_timestamp_msec() scale.
-	 */
+     * a good guess but fails in the following situations:
+     *
+     * - If the address existed before start of the process, the timestamp in nm scale would
+     *   be negative or zero. In this case we default to 1.
+     * - during hibernation, the CLOCK_MONOTONIC/timestamp drifts from
+     *   nm_utils_get_monotonic_timestamp_msec() scale.
+     */
     if (result <= 1000)
         return 1;
 
@@ -1054,17 +1054,17 @@ _linktype_get_type(NMPlatform *      platform,
         obj = _lookup_cached_link(cache, ifindex, completed_from_cache, link_cached);
 
         /* If we detected the link type before, we stick to that
-		 * decision unless the "kind" or "name" changed. If "name" changed,
-		 * it means that their type may not have been determined correctly
-		 * due to race conditions while accessing sysfs.
-		 *
-		 * This way, we save additional ethtool/sysctl lookups, but moreover,
-		 * we keep the linktype stable and don't change it as long as the link
-		 * exists.
-		 *
-		 * Note that kernel *can* reuse the ifindex (on integer overflow, and
-		 * when moving interface to other netns). Thus here there is a tiny potential
-		 * of messing stuff up. */
+         * decision unless the "kind" or "name" changed. If "name" changed,
+         * it means that their type may not have been determined correctly
+         * due to race conditions while accessing sysfs.
+         *
+         * This way, we save additional ethtool/sysctl lookups, but moreover,
+         * we keep the linktype stable and don't change it as long as the link
+         * exists.
+         *
+         * Note that kernel *can* reuse the ifindex (on integer overflow, and
+         * when moving interface to other netns). Thus here there is a tiny potential
+         * of messing stuff up. */
         if (obj && obj->_link.netlink.is_in_netlink
             && !NM_IN_SET(obj->link.type, NM_LINK_TYPE_UNKNOWN, NM_LINK_TYPE_NONE)
             && nm_streq(ifname, obj->link.name) && (!kind || nm_streq0(kind, obj->link.kind))) {
@@ -1075,10 +1075,10 @@ _linktype_get_type(NMPlatform *      platform,
     }
 
     /* we intern kind to not require us to keep the pointer alive. Essentially
-	 * leaking it in a global cache. That should be safe enough, because the
-	 * kind comes only from kernel messages, which depend on the number of
-	 * available drivers. So, there is not the danger that we leak uncontrolled
-	 * many kinds. */
+     * leaking it in a global cache. That should be safe enough, because the
+     * kind comes only from kernel messages, which depend on the number of
+     * available drivers. So, there is not the danger that we leak uncontrolled
+     * many kinds. */
     *out_kind = g_intern_string(kind);
 
     if (kind) {
@@ -1112,8 +1112,8 @@ _linktype_get_type(NMPlatform *      platform,
 
             if (arptype == 256) {
                 /* Some s390 CTC-type devices report 256 for the encapsulation type
-				 * for some reason, but we need to call them Ethernet.
-				 */
+                 * for some reason, but we need to call them Ethernet.
+                 */
                 if (nm_streq(driver_info.driver, "ctcm"))
                     return NM_LINK_TYPE_ETHERNET;
             }
@@ -1136,8 +1136,8 @@ _linktype_get_type(NMPlatform *      platform,
                 if (link_type != NM_LINK_TYPE_NONE) {
                     if (link_type == NM_LINK_TYPE_BNEP && arptype != ARPHRD_ETHER) {
                         /* Both BNEP and 6lowpan use DEVTYPE=bluetooth, so we must
-						 * use arptype to distinguish between them.
-						 */
+                         * use arptype to distinguish between them.
+                         */
                     } else
                         return link_type;
                 }
@@ -1150,23 +1150,23 @@ _linktype_get_type(NMPlatform *      platform,
 
         if (arptype == ARPHRD_ETHER) {
             /* Misc non-upstream WWAN drivers.  rmnet is Qualcomm's proprietary
-			 * modem interface, ccmni is MediaTek's.  FIXME: these drivers should
-			 * really set devtype=WWAN.
-			 */
+             * modem interface, ccmni is MediaTek's.  FIXME: these drivers should
+             * really set devtype=WWAN.
+             */
             if (g_str_has_prefix(ifname, "rmnet") || g_str_has_prefix(ifname, "rev_rmnet")
                 || g_str_has_prefix(ifname, "ccmni"))
                 return NM_LINK_TYPE_WWAN_NET;
 
             /* Standard wired ethernet interfaces don't report an rtnl_link_type, so
-			 * only allow fallback to Ethernet if no type is given.  This should
-			 * prevent future virtual network drivers from being treated as Ethernet
-			 * when they should be Generic instead.
-			 */
+             * only allow fallback to Ethernet if no type is given.  This should
+             * prevent future virtual network drivers from being treated as Ethernet
+             * when they should be Generic instead.
+             */
             if (!kind && !devtype)
                 return NM_LINK_TYPE_ETHERNET;
 
             /* The USB gadget interfaces behave and look like ordinary ethernet devices
-			 * aside from the DEVTYPE. */
+             * aside from the DEVTYPE. */
             if (nm_streq0(devtype, "gadget"))
                 return NM_LINK_TYPE_ETHERNET;
 
@@ -1264,8 +1264,8 @@ _parse_af_inet6(NMPlatform *        platform,
     }
 
     /* Hack to detect support addrgenmode of the kernel. We only parse
-	 * netlink messages that we receive from kernel, hence this check
-	 * is valid. */
+     * netlink messages that we receive from kernel, hence this check
+     * is valid. */
     if (!_nm_platform_kernel_support_detected(NM_PLATFORM_KERNEL_SUPPORT_TYPE_USER_IPV6LL)) {
         /* IFLA_INET6_ADDR_GEN_MODE was added in kernel 3.17, dated 5 October, 2014. */
         _nm_platform_kernel_support_init(NM_PLATFORM_KERNEL_SUPPORT_TYPE_USER_IPV6LL,
@@ -1276,7 +1276,7 @@ _parse_af_inet6(NMPlatform *        platform,
         i6_addr_gen_mode_inv = _nm_platform_uint8_inv(nla_get_u8(tb[IFLA_INET6_ADDR_GEN_MODE]));
         if (i6_addr_gen_mode_inv == 0) {
             /* an inverse addrgenmode of zero is unexpected. We need to reserve zero
-			 * to signal "unset". */
+             * to signal "unset". */
             return FALSE;
         }
         addr_gen_mode_valid = TRUE;
@@ -1341,7 +1341,7 @@ _parse_lnk_bridge(const char *kind, struct nlattr *info_data)
     if (!_nm_platform_kernel_support_detected(
             NM_PLATFORM_KERNEL_SUPPORT_TYPE_IFLA_BR_VLAN_STATS_ENABLED)) {
         /* IFLA_BR_VLAN_STATS_ENABLED was added in kernel 4.10 on April 30, 2016.
-		 * See commit 6dada9b10a0818ba72c249526a742c8c41274a73. */
+         * See commit 6dada9b10a0818ba72c249526a742c8c41274a73. */
         _nm_platform_kernel_support_init(NM_PLATFORM_KERNEL_SUPPORT_TYPE_IFLA_BR_VLAN_STATS_ENABLED,
                                          tb[IFLA_BR_VLAN_STATS_ENABLED] ? 1 : -1);
     }
@@ -1906,7 +1906,7 @@ _vlan_qos_mapping_from_nla(struct nlattr *          nlattr,
         guint             i, j;
 
         /* The sorting is necessary, because for egress mapping, kernel
-		 * doesn't sent the items strictly sorted by the from field. */
+         * doesn't sent the items strictly sorted by the from field. */
         g_ptr_array_sort_with_data(array, _vlan_qos_mapping_cmp_from_ptr, NULL);
 
         list = g_new(NMVlanQosMapping, array->len);
@@ -1917,8 +1917,8 @@ _vlan_qos_mapping_from_nla(struct nlattr *          nlattr,
             map = array->pdata[i];
 
             /* kernel doesn't really send us duplicates. Just be extra cautious
-			 * because we want strong guarantees about the sort order and uniqueness
-			 * of our mapping list (for simpler equality comparison). */
+             * because we want strong guarantees about the sort order and uniqueness
+             * of our mapping list (for simpler equality comparison). */
             if (j > 0 && list[j - 1].from == map->from)
                 list[j - 1] = *map;
             else
@@ -2209,7 +2209,7 @@ _wireguard_update_from_peers_nla(CList *peers, GArray **p_allowed_ips, struct nl
                    NMP_WIREGUARD_PUBLIC_KEY_LEN)) {
         G_STATIC_ASSERT_EXPR(NMP_WIREGUARD_PUBLIC_KEY_LEN == sizeof(peer_c->data.public_key));
         /* this message is a continuation of the previous peer.
-		 * Only parse WGPEER_A_ALLOWEDIPS below. */
+         * Only parse WGPEER_A_ALLOWEDIPS below. */
     } else {
         /* otherwise, start a new peer */
         peer_c = g_slice_new0(WireGuardPeerConstruct);
@@ -2318,7 +2318,7 @@ _wireguard_get_device_cb(struct nl_msg *msg, void *arg)
 
     if (parse_data->obj) {
         /* we already have an object instance. This means the netlink message
-		 * is a continuation, only providing more WGDEVICE_A_PEERS data below. */
+         * is a continuation, only providing more WGDEVICE_A_PEERS data below. */
     } else {
         NMPObject *             obj;
         NMPlatformLnkWireGuard *props;
@@ -2329,8 +2329,8 @@ _wireguard_get_device_cb(struct nl_msg *msg, void *arg)
         if (tb[WGDEVICE_A_PRIVATE_KEY]) {
             nla_memcpy(props->private_key, tb[WGDEVICE_A_PRIVATE_KEY], sizeof(props->private_key));
             /* FIXME(netlink-bzero-secret): extend netlink library to wipe memory. For now,
-			 * just hack it here (yes, this does not cover all places where the
-			 * private key was copied). */
+             * just hack it here (yes, this does not cover all places where the
+             * private key was copied). */
             nm_explicit_bzero(nla_data(tb[WGDEVICE_A_PRIVATE_KEY]),
                               nla_len(tb[WGDEVICE_A_PRIVATE_KEY]));
         }
@@ -2353,8 +2353,8 @@ _wireguard_get_device_cb(struct nl_msg *msg, void *arg)
                                                   &parse_data->allowed_ips,
                                                   attr)) {
                 /* we ignore the error of parsing one peer.
-				 * _wireguard_update_from_peers_nla() leaves the @peers array in the
-				 * desired state. */
+                 * _wireguard_update_from_peers_nla() leaves the @peers array in the
+                 * desired state. */
             }
         }
     }
@@ -2406,7 +2406,7 @@ _wireguard_read_info(NMPlatform *    platform /* used only as logging context */
     c_list_init(&parse_data.peers);
 
     /* we ignore errors, and return whatever we could successfully
-	 * parse. */
+     * parse. */
     nl_recvmsgs(genl,
                 &((const struct nl_cb){
                     .valid_cb  = _wireguard_get_device_cb,
@@ -2427,32 +2427,32 @@ _wireguard_read_info(NMPlatform *    platform /* used only as logging context */
     }
 
     /* we receive peers/allowed-ips possibly in separate netlink messages. Hence, while
-	 * parsing the dump, we don't know upfront how many peers/allowed-ips we will receive.
-	 *
-	 * We solve that, by collecting all peers with a CList. It's done this way,
-	 * because a GArray would require growing the array, but we want to bzero()
-	 * the preshared-key of each peer while reallocating. The CList apprach avoids
-	 * that.
-	 *
-	 * For allowed-ips, we instead track one GArray, which are all appended
-	 * there. The realloc/resize of the GArray is fine there. However,
-	 * while we build the GArray, we don't yet have the final pointers.
-	 * Hence, while constructing, we track the indexes with peer->_construct_idx_*
-	 * fields. These indexes must be converted to actual pointers blow.
-	 *
-	 * This is all done during parsing. In the final NMPObjectLnkWireGuard we
-	 * don't want the CList anymore and repackage the NMPObject tightly. The
-	 * reason is, that NMPObject instances are immutable and long-living. Spend
-	 * a bit effort below during construction to obtain a most suitable representation
-	 * in this regard. */
+     * parsing the dump, we don't know upfront how many peers/allowed-ips we will receive.
+     *
+     * We solve that, by collecting all peers with a CList. It's done this way,
+     * because a GArray would require growing the array, but we want to bzero()
+     * the preshared-key of each peer while reallocating. The CList apprach avoids
+     * that.
+     *
+     * For allowed-ips, we instead track one GArray, which are all appended
+     * there. The realloc/resize of the GArray is fine there. However,
+     * while we build the GArray, we don't yet have the final pointers.
+     * Hence, while constructing, we track the indexes with peer->_construct_idx_*
+     * fields. These indexes must be converted to actual pointers blow.
+     *
+     * This is all done during parsing. In the final NMPObjectLnkWireGuard we
+     * don't want the CList anymore and repackage the NMPObject tightly. The
+     * reason is, that NMPObject instances are immutable and long-living. Spend
+     * a bit effort below during construction to obtain a most suitable representation
+     * in this regard. */
     obj->_lnk_wireguard.peers_len = c_list_length(&parse_data.peers);
     obj->_lnk_wireguard.peers     = obj->_lnk_wireguard.peers_len > 0
                                         ? g_new(NMPWireGuardPeer, obj->_lnk_wireguard.peers_len)
                                         : NULL;
 
     /* duplicate allowed_ips instead of using the pointer. The GArray possibly has more
-	 * space allocated then we need, and we want to get rid of this excess buffer.
-	 * Note that NMPObject instance is possibly put into the cache and long-living. */
+     * space allocated then we need, and we want to get rid of this excess buffer.
+     * Note that NMPObject instance is possibly put into the cache and long-living. */
     obj->_lnk_wireguard._allowed_ips_buf_len = allowed_ips ? allowed_ips->len : 0u;
     obj->_lnk_wireguard._allowed_ips_buf =
         obj->_lnk_wireguard._allowed_ips_buf_len > 0
@@ -2553,8 +2553,8 @@ _wireguard_refresh_link(NMPlatform *platform, int wireguard_family_id, int ifind
         return plink;
 
     /* we use nmp_cache_update_netlink() to re-inject the new object into the cache.
-	 * For that, we need to clone it, and tweak it so that it's suitable. It's a bit
-	 * of a hack, in particular that we need to clear driver and udev-device. */
+     * For that, we need to clone it, and tweak it so that it's suitable. It's a bit
+     * of a hack, in particular that we need to clear driver and udev-device. */
     obj                            = nmp_object_clone(plink, FALSE);
     obj->_link.wireguard_family_id = wireguard_family_id;
     nmp_object_unref(obj->_link.netlink.lnk);
@@ -2610,15 +2610,15 @@ _wireguard_create_change_nlmsgs(NMPlatform *                              platfo
     G_STMT_END
 
     /* Adapted from LGPL-2.1+ code [1].
-	 *
-	 * [1] https://git.zx2c4.com/WireGuard/tree/contrib/examples/embeddable-wg-library/wireguard.c?id=5e99a6d43fe2351adf36c786f5ea2086a8fe7ab8#n1073 */
+     *
+     * [1] https://git.zx2c4.com/WireGuard/tree/contrib/examples/embeddable-wg-library/wireguard.c?id=5e99a6d43fe2351adf36c786f5ea2086a8fe7ab8#n1073 */
 
     idx_peer_curr        = IDX_NIL;
     idx_allowed_ips_curr = IDX_NIL;
 
     /* TODO: for the moment, we always reset all peers and allowed-ips (WGDEVICE_F_REPLACE_PEERS, WGPEER_F_REPLACE_ALLOWEDIPS).
-	 * The platform API should be extended to also support partial updates. In particular, configuring the same configuration
-	 * multiple times, should not clear and re-add all settings, but rather sync the existing settings with the desired configuration. */
+     * The platform API should be extended to also support partial updates. In particular, configuring the same configuration
+     * multiple times, should not clear and re-add all settings, but rather sync the existing settings with the desired configuration. */
 
 again:
 
@@ -2680,7 +2680,7 @@ again:
                                   | NM_PLATFORM_WIREGUARD_CHANGE_PEER_FLAG_HAS_ALLOWEDIPS
                                   | NM_PLATFORM_WIREGUARD_CHANGE_PEER_FLAG_REPLACE_ALLOWEDIPS)) {
                 /* no flags set. We take that as indication to skip configuring the peer
-				 * entirely. */
+                 * entirely. */
                 nm_assert(p_flags == NM_PLATFORM_WIREGUARD_CHANGE_PEER_FLAG_NONE);
                 continue;
             }
@@ -2964,17 +2964,17 @@ _new_from_nl_link(NMPlatform *     platform,
 
     if (!tb[IFLA_MTU]) {
         /* Kernel has two places that send RTM_GETLINK messages:
-		 * net/core/rtnetlink.c and net/wireless/ext-core.c.
-		 * Unfortunately ext-core.c sets only IFLA_WIRELESS and
-		 * IFLA_IFNAME. This confuses code in this function, because
-		 * it cannot get complete set of data for the interface and
-		 * later incomplete object this function creates is used to
-		 * overwrite existing data in NM's cache.
-		 * Since ext-core.c doesn't set IFLA_MTU we can use it as a
-		 * signal to ignore incoming message.
-		 * To some extent this is a hack and correct approach is to
-		 * merge objects per-field.
-		 */
+         * net/core/rtnetlink.c and net/wireless/ext-core.c.
+         * Unfortunately ext-core.c sets only IFLA_WIRELESS and
+         * IFLA_IFNAME. This confuses code in this function, because
+         * it cannot get complete set of data for the interface and
+         * later incomplete object this function creates is used to
+         * overwrite existing data in NM's cache.
+         * Since ext-core.c doesn't set IFLA_MTU we can use it as a
+         * signal to ignore incoming message.
+         * To some extent this is a hack and correct approach is to
+         * merge objects per-field.
+         */
         return NULL;
     }
     obj->link.mtu = nla_get_u32(tb[IFLA_MTU]);
@@ -3129,11 +3129,11 @@ _new_from_nl_link(NMPlatform *     platform,
                 && link_cached->_link.netlink.lnk
                 && (!lnk_data || nmp_object_equal(lnk_data, link_cached->_link.netlink.lnk))) {
                 /* We always try to look into the cache and reuse the object there.
-				 * We do that, because we consider the lnk object as immutable and don't
-				 * modify it after creating. Hence we can share it and reuse.
-				 *
-				 * Also, sometimes the info-data is missing for updates. In this case
-				 * we want to keep the previously received lnk_data. */
+                 * We do that, because we consider the lnk object as immutable and don't
+                 * modify it after creating. Hence we can share it and reuse.
+                 *
+                 * Also, sometimes the info-data is missing for updates. In this case
+                 * we want to keep the previously received lnk_data. */
                 nmp_object_unref(lnk_data);
                 lnk_data = nmp_object_ref(link_cached->_link.netlink.lnk);
             }
@@ -3188,8 +3188,8 @@ _new_from_nl_link(NMPlatform *     platform,
         struct nl_sock * genl         = NM_LINUX_PLATFORM_GET_PRIVATE(platform)->genl;
 
         /* The WireGuard kernel module does not yet send link update
-		 * notifications, so we don't actually update the cache. For
-		 * now, always refetch link data here. */
+         * notifications, so we don't actually update the cache. For
+         * now, always refetch link data here. */
 
         _lookup_cached_link(cache, obj->link.ifindex, completed_from_cache, &link_cached);
         if (link_cached && link_cached->_link.netlink.is_in_netlink
@@ -3266,7 +3266,7 @@ _new_from_nl_addr(struct nlmsghdr *nlh, gboolean id_only)
     _check_addr_or_return_null(tb, IFA_LOCAL, addr_len);
     if (is_v4) {
         /* For IPv4, kernel omits IFA_LOCAL/IFA_ADDRESS if (and only if) they
-		 * are effectively 0.0.0.0 (all-zero). */
+         * are effectively 0.0.0.0 (all-zero). */
         if (tb[IFA_LOCAL])
             memcpy(&obj->ip4_address.address, nla_data(tb[IFA_LOCAL]), addr_len);
         if (tb[IFA_ADDRESS])
@@ -3278,12 +3278,12 @@ _new_from_nl_addr(struct nlmsghdr *nlh, gboolean id_only)
         obj->ip4_address.use_ip4_broadcast_address = TRUE;
     } else {
         /* For IPv6, IFA_ADDRESS is always present.
-		 *
-		 * If IFA_LOCAL is missing, IFA_ADDRESS is @address and @peer_address
-		 * is :: (all-zero).
-		 *
-		 * If unexpectedly IFA_ADDRESS is missing, make the best of it -- but it _should_
-		 * actually be there. */
+         *
+         * If IFA_LOCAL is missing, IFA_ADDRESS is @address and @peer_address
+         * is :: (all-zero).
+         *
+         * If unexpectedly IFA_ADDRESS is missing, make the best of it -- but it _should_
+         * actually be there. */
         if (tb[IFA_ADDRESS] || tb[IFA_LOCAL]) {
             if (tb[IFA_LOCAL]) {
                 memcpy(&obj->ip6_address.address, nla_data(tb[IFA_LOCAL]), addr_len);
@@ -3375,8 +3375,8 @@ _new_from_nl_route(struct nlmsghdr *nlh, gboolean id_only)
     rtm = nlmsg_data(nlh);
 
     /*****************************************************************
-	 * only handle ~supported~ routes.
-	 *****************************************************************/
+     * only handle ~supported~ routes.
+     *****************************************************************/
 
     if (!NM_IN_SET(rtm->rtm_family, AF_INET, AF_INET6))
         return NULL;
@@ -3396,8 +3396,8 @@ _new_from_nl_route(struct nlmsghdr *nlh, gboolean id_only)
         return NULL;
 
     /*****************************************************************
-	 * parse nexthops. Only handle routes with one nh.
-	 *****************************************************************/
+     * parse nexthops. Only handle routes with one nh.
+     *****************************************************************/
 
     if (tb[RTA_MULTIPATH]) {
         size_t            tlen = nla_len(tb[RTA_MULTIPATH]);
@@ -3454,13 +3454,13 @@ rta_multipath_done:;
 
         if (!nh.is_present) {
             /* If no nexthops have been provided via RTA_MULTIPATH
-			 * we add it as regular nexthop to maintain backwards
-			 * compatibility */
+             * we add it as regular nexthop to maintain backwards
+             * compatibility */
             nh.ifindex = ifindex;
             nh.gateway = gateway;
         } else {
             /* Kernel supports new style nexthop configuration,
-			 * verify that it is a duplicate and ignore old-style nexthop. */
+             * verify that it is a duplicate and ignore old-style nexthop. */
             if (nh.ifindex != ifindex || memcmp(&nh.gateway, &gateway, addr_len) != 0)
                 return NULL;
         }
@@ -3559,7 +3559,7 @@ rta_multipath_done:;
     if (!is_v4) {
         if (!_nm_platform_kernel_support_detected(NM_PLATFORM_KERNEL_SUPPORT_TYPE_RTA_PREF)) {
             /* Detect support for RTA_PREF by inspecting the netlink message.
-			 * RTA_PREF was added in kernel 4.1, dated 21 June, 2015. */
+             * RTA_PREF was added in kernel 4.1, dated 21 June, 2015. */
             _nm_platform_kernel_support_init(NM_PLATFORM_KERNEL_SUPPORT_TYPE_RTA_PREF,
                                              tb[RTA_PREF] ? 1 : -1);
         }
@@ -3753,17 +3753,17 @@ _new_from_nl_routing_rule(struct nlmsghdr *nlh, gboolean id_only)
     if (tb[FRA_L3MDEV]) {
         if (!_nm_platform_kernel_support_detected(NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_L3MDEV)) {
             /* support for FRA_L3MDEV was added in 96c63fa7393d0a346acfe5a91e0c7d4c7782641b,
-			 * kernel 4.8, 3 October 2017.
-			 *
-			 * We can only detect support if the attribute is present. A missing attribute
-			 * is not conclusive. */
+             * kernel 4.8, 3 October 2017.
+             *
+             * We can only detect support if the attribute is present. A missing attribute
+             * is not conclusive. */
             _nm_platform_kernel_support_init(NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_L3MDEV, 1);
         }
 
         /* actually, kernel only allows this attribute to be missing or
-		 * "1". Still, encode it as full uint8.
-		 *
-		 * Note that FRA_L3MDEV and FRA_TABLE are mutally exclusive. */
+         * "1". Still, encode it as full uint8.
+         *
+         * Note that FRA_L3MDEV and FRA_TABLE are mutally exclusive. */
         props->l3mdev = nla_get_u8(tb[FRA_L3MDEV]);
     }
 
@@ -3774,7 +3774,7 @@ _new_from_nl_routing_rule(struct nlmsghdr *nlh, gboolean id_only)
 
     if (!_nm_platform_kernel_support_detected(NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_PROTOCOL)) {
         /* FRA_PROTOCOL was added in kernel 4.17, dated 3 June, 2018.
-		 * See commit 1b71af6053af1bd2f849e9fda4f71c1e3f145dcf. */
+         * See commit 1b71af6053af1bd2f849e9fda4f71c1e3f145dcf. */
         _nm_platform_kernel_support_init(NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_PROTOCOL,
                                          tb[FRA_PROTOCOL] ? 1 : -1);
     }
@@ -3791,10 +3791,10 @@ _new_from_nl_routing_rule(struct nlmsghdr *nlh, gboolean id_only)
 
     if (!_nm_platform_kernel_support_detected(NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_IP_PROTO)) {
         /* support for FRA_IP_PROTO, FRA_SPORT_RANGE, and FRA_DPORT_RANGE was added together
-		 * by bfff4862653bb96001ab57c1edd6d03f48e5f035, kernel 4.17, 4 June 2018.
-		 *
-		 * Unfortunately, a missing attribute does not tell us anything about support.
-		 * We can only tell for sure when we have support, but not when we don't have.  */
+         * by bfff4862653bb96001ab57c1edd6d03f48e5f035, kernel 4.17, 4 June 2018.
+         *
+         * Unfortunately, a missing attribute does not tell us anything about support.
+         * We can only tell for sure when we have support, but not when we don't have.  */
         if (tb[FRA_IP_PROTO] || tb[FRA_SPORT_RANGE] || tb[FRA_DPORT_RANGE])
             _nm_platform_kernel_support_init(NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_IP_PROTO, 1);
     }
@@ -3806,10 +3806,10 @@ _new_from_nl_routing_rule(struct nlmsghdr *nlh, gboolean id_only)
     if (tb[FRA_UID_RANGE]) {
         if (!_nm_platform_kernel_support_detected(NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_UID_RANGE)) {
             /* support for FRA_UID_RANGE was added in 622ec2c9d52405973c9f1ca5116eb1c393adfc7d,
-			 * kernel 4.10, 19 February 2017.
-			 *
-			 * We can only detect support if the attribute is present. A missing attribute
-			 * is not conclusive. */
+             * kernel 4.10, 19 February 2017.
+             *
+             * We can only detect support if the attribute is present. A missing attribute
+             * is not conclusive. */
             _nm_platform_kernel_support_init(NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_UID_RANGE, 1);
         }
 
@@ -4439,7 +4439,7 @@ _nl_msg_new_link_set_linkinfo_vlan(struct nl_msg *         msg,
     nm_assert(msg);
 
     /* We must not create an empty IFLA_LINKINFO section. Otherwise, kernel
-	 * rejects the request as invalid. */
+     * rejects the request as invalid. */
     if (flags_mask != 0 || vlan_id >= 0)
         has_any_vlan_properties = TRUE;
     if (!has_any_vlan_properties && ingress_qos && ingress_qos_len > 0) {
@@ -4486,7 +4486,7 @@ _nl_msg_new_link_set_linkinfo_vlan(struct nl_msg *         msg,
 
         for (i = 0; i < ingress_qos_len; i++) {
             /* Silently ignore invalid mappings. Kernel would truncate
-			 * them and modify the wrong mapping. */
+             * them and modify the wrong mapping. */
             if (VLAN_XGRESS_PRIO_VALID(ingress_qos[i].from)) {
                 if (!qos) {
                     if (!(qos = nla_nest_start(msg, IFLA_VLAN_INGRESS_QOS)))
@@ -4633,11 +4633,11 @@ _nl_msg_new_address(int           nlmsg_type,
 
     if (flags & ~((guint32) 0xFF)) {
         /* only set the IFA_FLAGS attribute, if they actually contain additional
-		 * flags that are not already set to am.ifa_flags.
-		 *
-		 * Older kernels refuse RTM_NEWADDR and RTM_NEWROUTE messages with EINVAL
-		 * if they contain unknown netlink attributes. See net/core/rtnetlink.c, which
-		 * was fixed by kernel commit 661d2967b3f1b34eeaa7e212e7b9bbe8ee072b59. */
+         * flags that are not already set to am.ifa_flags.
+         *
+         * Older kernels refuse RTM_NEWADDR and RTM_NEWROUTE messages with EINVAL
+         * if they contain unknown netlink attributes. See net/core/rtnetlink.c, which
+         * was fixed by kernel commit 661d2967b3f1b34eeaa7e212e7b9bbe8ee072b59. */
         NLA_PUT_U32(msg, IFA_FLAGS, flags);
     }
 
@@ -4776,11 +4776,11 @@ _nl_msg_new_routing_rule(int nlmsg_type, int nlmsg_flags, const NMPlatformRoutin
         && routing_rule->action == FR_ACT_TO_TBL && routing_rule->l3mdev == 0
         && table == RT_TABLE_UNSPEC) {
         /* for IPv6, this setting is invalid and rejected by kernel. That's fine.
-		 *
-		 * for IPv4, kernel will automatically assign an unused table. That's not
-		 * fine, because we don't know what we will get.
-		 *
-		 * The caller must not allow that to happen. */
+         *
+         * for IPv4, kernel will automatically assign an unused table. That's not
+         * fine, because we don't know what we will get.
+         *
+         * The caller must not allow that to happen. */
         nm_assert_not_reached();
     }
 
@@ -5196,10 +5196,10 @@ sysctl_set_internal(NMPlatform *platform,
     _log_dbg_sysctl_set(platform, pathid, dirfd, path, value);
 
     /* Most sysfs and sysctl options don't care about a trailing LF, while some
-	 * (like infiniband) do.  So always add the LF.  Also, neither sysfs nor
-	 * sysctl support partial writes so the LF must be added to the string we're
-	 * about to write.
-	 */
+     * (like infiniband) do.  So always add the LF.  Also, neither sysfs nor
+     * sysctl support partial writes so the LF must be added to the string we're
+     * about to write.
+     */
     len = strlen(value) + 1;
     nm_assert(len > 0);
     if (len > 512)
@@ -5231,7 +5231,7 @@ sysctl_set_internal(NMPlatform *platform,
         } else if (errsv == EINVAL
                    && nm_utils_sysctl_ip_conf_is_path(AF_INET6, path, NULL, "mtu")) {
             /* setting the MTU can fail under regular conditions. Suppress
-			 * logging a warning. */
+             * logging a warning. */
             level = LOGL_DEBUG;
         }
 
@@ -5984,8 +5984,8 @@ delayed_action_handle_one(NMPlatform *platform)
         return FALSE;
 
     /* First process DELAYED_ACTION_TYPE_MASTER_CONNECTED actions.
-	 * This type of action is entirely cache-internal and is here to resolve a
-	 * cache inconsistency. It should be fixed right away. */
+     * This type of action is entirely cache-internal and is here to resolve a
+     * cache inconsistency. It should be fixed right away. */
     if (NM_FLAGS_HAS(priv->delayed_action.flags, DELAYED_ACTION_TYPE_MASTER_CONNECTED)) {
         nm_assert(priv->delayed_action.list_master_connected->len > 0);
 
@@ -6006,7 +6006,7 @@ delayed_action_handle_one(NMPlatform *platform)
     nm_assert(priv->delayed_action.list_master_connected->len == 0);
 
     /* Next we prefer read-netlink, because the buffer size is limited and we want to process events
-	 * from netlink early. */
+     * from netlink early. */
     if (NM_FLAGS_HAS(priv->delayed_action.flags, DELAYED_ACTION_TYPE_READ_NETLINK)) {
         _LOGt_delayed_action(DELAYED_ACTION_TYPE_READ_NETLINK, NULL, "handle");
         priv->delayed_action.flags &= ~DELAYED_ACTION_TYPE_READ_NETLINK;
@@ -6160,7 +6160,7 @@ cache_prune_one_type(NMPlatform *platform, const NMPLookup *lookup)
         const NMDedupMultiEntry *main_entry;
 
         /* we only track the dirty flag for the OBJECT-TYPE index. That means,
-		 * for other lookup types we need to check the dirty flag of the main-entry. */
+         * for other lookup types we need to check the dirty flag of the main-entry. */
         main_entry = nmp_cache_reresolve_main_entry(cache, iter.current, lookup);
         if (!main_entry->dirty)
             continue;
@@ -6291,9 +6291,9 @@ cache_on_change(NMPlatform *     platform,
             int ifindex = -1;
 
             /* removal of a link could be caused by moving the link to another netns.
-			 * In this case, we potentially have to update other links that have this link as parent.
-			 * Currently, kernel misses to sent us a notification in this case
-			 * (https://bugzilla.redhat.com/show_bug.cgi?id=1262908). */
+             * In this case, we potentially have to update other links that have this link as parent.
+             * Currently, kernel misses to sent us a notification in this case
+             * (https://bugzilla.redhat.com/show_bug.cgi?id=1262908). */
 
             if (cache_op == NMP_CACHE_OPS_REMOVED
                 && obj_old /* <-- nonsensical, make coverity happy */
@@ -6329,8 +6329,8 @@ cache_on_change(NMPlatform *     platform,
                     || (NM_FLAGS_HAS(obj_old->link.n_ifi_flags, IFF_LOWER_UP)
                         && !NM_FLAGS_HAS(obj_new->link.n_ifi_flags, IFF_LOWER_UP)))) {
                 /* FIXME: I suspect that IFF_LOWER_UP must not be considered, and I
-				 * think kernel does send RTM_DELROUTE events for IPv6 routes, so
-				 * we might not need to refresh IPv6 routes. */
+                 * think kernel does send RTM_DELROUTE events for IPv6 routes, so
+                 * we might not need to refresh IPv6 routes. */
                 delayed_action_schedule(platform,
                                         DELAYED_ACTION_TYPE_REFRESH_ALL_IP4_ROUTES
                                             | DELAYED_ACTION_TYPE_REFRESH_ALL_IP6_ROUTES,
@@ -6358,33 +6358,33 @@ cache_on_change(NMPlatform *     platform,
                              NM_LINK_TYPE_VLAN,
                              NM_LINK_TYPE_VXLAN)) {
                 /* certain link-types also come with a IFLA_INFO_DATA/lnk_data. It may happen that
-				 * kernel didn't send this notification, thus when we first learn about a link
-				 * that lacks an lnk_data we re-request it again.
-				 *
-				 * For example https://bugzilla.redhat.com/show_bug.cgi?id=1284001 */
+                 * kernel didn't send this notification, thus when we first learn about a link
+                 * that lacks an lnk_data we re-request it again.
+                 *
+                 * For example https://bugzilla.redhat.com/show_bug.cgi?id=1284001 */
                 re_request_link = TRUE;
             } else if (obj_new->link.type == NM_LINK_TYPE_TUN && obj_new->_link.netlink.lnk
                        && (lnk_tun = &(obj_new->_link.netlink.lnk)->lnk_tun) && !lnk_tun->persist
                        && lnk_tun->pi && !lnk_tun->vnet_hdr && !lnk_tun->multi_queue
                        && !lnk_tun->owner_valid && !lnk_tun->group_valid) {
                 /* kernel has/had a know issue that the first notification for TUN device would
-				 * be sent with invalid parameters. The message looks like that kind, so refetch
-				 * it. */
+                 * be sent with invalid parameters. The message looks like that kind, so refetch
+                 * it. */
                 re_request_link = TRUE;
             } else if (obj_new->link.type == NM_LINK_TYPE_VETH && obj_new->link.parent == 0) {
                 /* the initial notification when adding a veth pair can lack the parent/IFLA_LINK
-				 * (https://bugzilla.redhat.com/show_bug.cgi?id=1285827).
-				 * Request it again. */
+                 * (https://bugzilla.redhat.com/show_bug.cgi?id=1285827).
+                 * Request it again. */
                 re_request_link = TRUE;
             } else if (obj_new->link.type == NM_LINK_TYPE_ETHERNET
                        && obj_new->link.l_address.len == 0) {
                 /* Due to a kernel bug, we sometimes receive spurious NEWLINK
-				 * messages after a wifi interface has disappeared. Since the
-				 * link is not present anymore we can't determine its type and
-				 * thus it will show up as a Ethernet one, with no address
-				 * specified.  Request the link again to check if it really
-				 * exists.  https://bugzilla.redhat.com/show_bug.cgi?id=1302037
-				 */
+                 * messages after a wifi interface has disappeared. Since the
+                 * link is not present anymore we can't determine its type and
+                 * thus it will show up as a Ethernet one, with no address
+                 * specified.  Request the link again to check if it really
+                 * exists.  https://bugzilla.redhat.com/show_bug.cgi?id=1302037
+                 */
                 re_request_link = TRUE;
             }
             if (re_request_link) {
@@ -6437,7 +6437,7 @@ cache_on_change(NMPlatform *     platform,
     case NMP_OBJECT_TYPE_IP6_ADDRESS:
     {
         /* Address deletion is sometimes accompanied by route deletion. We need to
-			 * check all routes belonging to the same interface. */
+             * check all routes belonging to the same interface. */
         if (cache_op == NMP_CACHE_OPS_REMOVED) {
             delayed_action_schedule(platform,
                                     (klass->obj_type == NMP_OBJECT_TYPE_IP4_ADDRESS)
@@ -6457,8 +6457,8 @@ static guint32
 _nlh_seq_next_get(NMLinuxPlatformPrivate *priv)
 {
     /* generate a new sequence number, but never return zero.
-	 * Wrapping numbers are not a problem, because we don't rely
-	 * on strictly increasing sequence numbers. */
+     * Wrapping numbers are not a problem, because we don't rely
+     * on strictly increasing sequence numbers. */
     return (++priv->nlh_seq_next) ?: (++priv->nlh_seq_next);
 }
 
@@ -6682,9 +6682,9 @@ do_request_all_no_delayed_actions(NMPlatform *platform, DelayedActionType action
     action_type_prune = action_type;
 
     /* calling nmp_cache_dirty_set_all_main() with a non-main lookup-index requires an extra
-	 * cache lookup for every entry.
-	 *
-	 * Avoid that, by special casing routing-rules here. */
+     * cache lookup for every entry.
+     *
+     * Avoid that, by special casing routing-rules here. */
     if (NM_FLAGS_ALL(action_type_prune, DELAYED_ACTION_TYPE_REFRESH_ALL_ROUTING_RULES_ALL)) {
         NMPLookup lookup;
 
@@ -6819,10 +6819,10 @@ event_seq_check(NMPlatform *            platform,
 
             if (data->seq_number == seq_number) {
                 /* We potentially receive many parts partial responses for the same sequence number.
-				 * Thus, we only remember the result, and collect it later. */
+                 * Thus, we only remember the result, and collect it later. */
                 if (data->seq_result < 0) {
                     /* we already saw an error for this sequence number.
-					 * Preserve it. */
+                     * Preserve it. */
                 } else if (seq_result != WAIT_FOR_NL_RESPONSE_RESULT_RESPONSE_UNKNOWN
                            || data->seq_result == WAIT_FOR_NL_RESPONSE_RESULT_UNKNOWN)
                     data->seq_result = seq_result;
@@ -6857,18 +6857,18 @@ event_valid_msg(NMPlatform *platform, struct nl_msg *msg, gboolean handle_events
     if (!_nm_platform_kernel_support_detected(NM_PLATFORM_KERNEL_SUPPORT_TYPE_EXTENDED_IFA_FLAGS)
         && msghdr->nlmsg_type == RTM_NEWADDR) {
         /* IFA_FLAGS is set for IPv4 and IPv6 addresses. It was added first to IPv6,
-		 * but if we encounter an IPv4 address with IFA_FLAGS, we surely have support. */
+         * but if we encounter an IPv4 address with IFA_FLAGS, we surely have support. */
         if (nlmsg_valid_hdr(msghdr, sizeof(struct ifaddrmsg))
             && NM_IN_SET(((struct ifaddrmsg *) nlmsg_data(msghdr))->ifa_family,
                          AF_INET,
                          AF_INET6)) {
             /* see if the nl_msg contains the IFA_FLAGS attribute. If it does,
-			 * we assume, that the kernel supports extended flags, IFA_F_MANAGETEMPADDR
-			 * and IFA_F_NOPREFIXROUTE for IPv6. They were added together in kernel 3.14,
-			 * dated 30 March, 2014.
-			 *
-			 * For IPv4, IFA_F_NOPREFIXROUTE was added later, but there is no easy
-			 * way to detect kernel support. */
+             * we assume, that the kernel supports extended flags, IFA_F_MANAGETEMPADDR
+             * and IFA_F_NOPREFIXROUTE for IPv6. They were added together in kernel 3.14,
+             * dated 30 March, 2014.
+             *
+             * For IPv4, IFA_F_NOPREFIXROUTE was added later, but there is no easy
+             * way to detect kernel support. */
             _nm_platform_kernel_support_init(
                 NM_PLATFORM_KERNEL_SUPPORT_TYPE_EXTENDED_IFA_FLAGS,
                 !!nlmsg_find_attr(msghdr, sizeof(struct ifaddrmsg), IFA_FLAGS) ? 1 : -1);
@@ -6886,7 +6886,7 @@ event_valid_msg(NMPlatform *platform, struct nl_msg *msg, gboolean handle_events
                   RTM_DELQDISC,
                   RTM_DELTFILTER)) {
         /* The event notifies about a deleted object. We don't need to initialize all
-		 * fields of the object. */
+         * fields of the object. */
         is_del = TRUE;
     }
 
@@ -6944,7 +6944,7 @@ event_valid_msg(NMPlatform *platform, struct nl_msg *msg, gboolean handle_events
             gboolean                        is_ipv6;
 
             /* IPv4 routes that are a response to RTM_GETROUTE must have
-			 * the cloned flag while IPv6 routes don't have to. */
+             * the cloned flag while IPv6 routes don't have to. */
             is_ipv6 = NMP_OBJECT_GET_TYPE(obj) == NMP_OBJECT_TYPE_IP6_ROUTE;
             if (is_ipv6 || NM_FLAGS_HAS(obj->ip_route.r_rtm_flags, RTM_F_CLONED)) {
                 nm_assert(is_ipv6 || !nmp_object_is_alive(obj));
@@ -6986,16 +6986,16 @@ event_valid_msg(NMPlatform *platform, struct nl_msg *msg, gboolean handle_events
                     const NMDedupMultiEntry *entry_replace;
 
                     /* we found an object that is to be replaced by the RTM_NEWROUTE message.
-					 * While we invoke the signal, the platform cache might change and invalidate
-					 * the findings. Mitigate that (for the most part), by marking the entry as
-					 * dirty and only delete @obj_replace if it is still dirty afterwards.
-					 *
-					 * Yes, there is a tiny tiny chance for still getting it wrong. But in practice,
-					 * the signal handlers do not cause to call the platform again, so the cache
-					 * is not really changing. -- if they would, it would anyway be dangerous to overflow
-					 * the stack and it's not ensured that the processing of netlink messages is
-					 * reentrant (maybe it is).
-					 */
+                     * While we invoke the signal, the platform cache might change and invalidate
+                     * the findings. Mitigate that (for the most part), by marking the entry as
+                     * dirty and only delete @obj_replace if it is still dirty afterwards.
+                     *
+                     * Yes, there is a tiny tiny chance for still getting it wrong. But in practice,
+                     * the signal handlers do not cause to call the platform again, so the cache
+                     * is not really changing. -- if they would, it would anyway be dangerous to overflow
+                     * the stack and it's not ensured that the processing of netlink messages is
+                     * reentrant (maybe it is).
+                     */
                     entry_replace = nmp_cache_lookup_entry(cache, obj_replace);
                     nm_assert(entry_replace && entry_replace->obj == obj_replace);
                     nm_dedup_multi_entry_set_dirty(entry_replace, TRUE);
@@ -7007,7 +7007,7 @@ event_valid_msg(NMPlatform *platform, struct nl_msg *msg, gboolean handle_events
 
             if (obj_replace) {
                 /* the RTM_NEWROUTE message indicates that another route was replaced.
-				 * Remove it now. */
+                 * Remove it now. */
                 cache_op = nmp_cache_remove(cache, obj_replace, TRUE, only_dirty, NULL);
                 if (cache_op != NMP_CACHE_OPS_UNCHANGED) {
                     nm_assert(cache_op == NMP_CACHE_OPS_REMOVED);
@@ -7018,7 +7018,7 @@ event_valid_msg(NMPlatform *platform, struct nl_msg *msg, gboolean handle_events
 
             if (resync_required) {
                 /* we'd like to avoid such resyncs as they are expensive and we should only rely on the
-				 * netlink events. This needs investigation. */
+                 * netlink events. This needs investigation. */
                 _LOGT("schedule resync of routes after RTM_NEWROUTE");
                 delayed_action_schedule(platform,
                                         delayed_action_refresh_from_needle_object(obj),
@@ -7146,12 +7146,12 @@ do_add_addrroute(NMPlatform *     platform,
 
     if (NMP_OBJECT_GET_TYPE(obj_id) == NMP_OBJECT_TYPE_IP6_ADDRESS) {
         /* In rare cases, the object is not yet ready as we received the ACK from
-		 * kernel. Need to refetch.
-		 *
-		 * We want to safe the expensive refetch, thus we look first into the cache
-		 * whether the object exists.
-		 *
-		 * rh#1484434 */
+         * kernel. Need to refetch.
+         *
+         * We want to safe the expensive refetch, thus we look first into the cache
+         * whether the object exists.
+         *
+         * rh#1484434 */
         if (!nmp_cache_lookup_obj(nm_platform_get_cache(platform), obj_id))
             do_request_one_type_by_needle_object(platform, obj_id);
     }
@@ -7219,12 +7219,12 @@ do_delete_object(NMPlatform *platform, const NMPObject *obj_id, struct nl_msg *n
                   NMP_OBJECT_TYPE_QDISC,
                   NMP_OBJECT_TYPE_TFILTER)) {
         /* In rare cases, the object is still there after we receive the ACK from
-		 * kernel. Need to refetch.
-		 *
-		 * We want to safe the expensive refetch, thus we look first into the cache
-		 * whether the object exists.
-		 *
-		 * rh#1484434 */
+         * kernel. Need to refetch.
+         *
+         * We want to safe the expensive refetch, thus we look first into the cache
+         * whether the object exists.
+         *
+         * rh#1484434 */
         if (nmp_cache_lookup_obj(nm_platform_get_cache(platform), obj_id))
             do_request_one_type_by_needle_object(platform, obj_id);
     }
@@ -7273,7 +7273,7 @@ retry:
     }
 
     /* always refetch the link after changing it. There seems to be issues
-	 * and we sometimes lack events. Nuke it from the orbit... */
+     * and we sometimes lack events. Nuke it from the orbit... */
     delayed_action_schedule(platform, DELAYED_ACTION_TYPE_REFRESH_LINK, GINT_TO_POINTER(ifindex));
 
     delayed_action_handle_all(platform, FALSE);
@@ -7305,7 +7305,7 @@ retry:
                          data->set_address.length)
                       == 0) {
         /* workaround ENFILE which may be wrongly returned (bgo #770456).
-		 * If the MAC address is as expected, assume success? */
+         * If the MAC address is as expected, assume success? */
         log_result = "success";
         log_detail = " (assume success changing address)";
         result     = 0;
@@ -7344,12 +7344,12 @@ link_add(NMPlatform *           platform,
 
     if (type == NM_LINK_TYPE_BOND) {
         /* When the kernel loads the bond module, either via explicit modprobe
-		 * or automatically in response to creating a bond master, it will also
-		 * create a 'bond0' interface.  Since the bond we're about to create may
-		 * or may not be named 'bond0' prevent potential confusion about a bond
-		 * that the user didn't want by telling the bonding module not to create
-		 * bond0 automatically.
-		 */
+         * or automatically in response to creating a bond master, it will also
+         * create a 'bond0' interface.  Since the bond we're about to create may
+         * or may not be named 'bond0' prevent potential confusion about a bond
+         * that the user didn't want by telling the bonding module not to create
+         * bond0 automatically.
+         */
         if (!g_file_test("/sys/class/net/bonding_masters", G_FILE_TEST_EXISTS))
             (void) nm_utils_modprobe(NULL, TRUE, "bonding", "max_bonds=0", NULL);
     }
@@ -7507,9 +7507,9 @@ link_supports_carrier_detect(NMPlatform *platform, int ifindex)
         return FALSE;
 
     /* We use netlink for the actual carrier detection, but netlink can't tell
-	 * us whether the device actually supports carrier detection in the first
-	 * place. We assume any device that does implements one of these two APIs.
-	 */
+     * us whether the device actually supports carrier detection in the first
+     * place. We assume any device that does implements one of these two APIs.
+     */
     return nmp_utils_ethtool_supports_carrier_detect(ifindex)
            || nmp_utils_mii_supports_carrier_detect(ifindex);
 }
@@ -7688,11 +7688,11 @@ link_set_sriov_params_async(NMPlatform *            platform,
     }
 
     /*
-	 * Take special care when setting new values:
-	 *  - don't touch anything if the right values are already set
-	 *  - to change the number of VFs or autoprobe we need to destroy existing VFs
-	 *  - the autoprobe setting is irrelevant when numvfs is zero
-	 */
+     * Take special care when setting new values:
+     *  - don't touch anything if the right values are already set
+     *  - to change the number of VFs or autoprobe we need to destroy existing VFs
+     *  - the autoprobe setting is irrelevant when numvfs is zero
+     */
     current_num = nm_platform_sysctl_get_int_checked(
         platform,
         NMP_SYSCTL_PATHID_NETDIR(dirfd, ifname, "device/sriov_numvfs"),
@@ -7710,7 +7710,7 @@ link_set_sriov_params_async(NMPlatform *            platform,
 
     if (current_autoprobe == -1 && errno == ENOENT) {
         /* older kernel versions don't have this sysctl. Assume the value is
-		 * "1". */
+         * "1". */
         current_autoprobe = 1;
     }
 
@@ -7814,9 +7814,9 @@ link_set_sriov_vfs(NMPlatform *platform, int ifindex, const NMPlatformVF *const
         }
 
         /* Kernel only supports one VLAN per VF now. If this
-		 * changes in the future, we need to figure out how to
-		 * clear existing VLANs and set new ones in one message
-		 * with the new API.*/
+         * changes in the future, we need to figure out how to
+         * clear existing VLANs and set new ones in one message
+         * with the new API.*/
         if (vf->num_vlans > 1) {
             _LOGW("multiple VLANs per VF are not supported at the moment");
             return FALSE;
@@ -8031,14 +8031,14 @@ _vlan_change_vlan_qos_mapping_create(gboolean                is_ingress_map,
     if (current_n_map) {
         if (is_ingress_map) {
             /* For the ingress-map, there are only 8 entries (0 to 7).
-			 * When the user requests to reset all entries, we don't actually
-			 * need the cached entries, we can just explicitly clear all possible
-			 * ones.
-			 *
-			 * That makes only a real difference in case our cache is out-of-date.
-			 *
-			 * For the egress map we cannot do that, because there are far too
-			 * many. There we can only clear the entries that we know about. */
+             * When the user requests to reset all entries, we don't actually
+             * need the cached entries, we can just explicitly clear all possible
+             * ones.
+             *
+             * That makes only a real difference in case our cache is out-of-date.
+             *
+             * For the egress map we cannot do that, because there are far too
+             * many. There we can only clear the entries that we know about. */
             for (i = 0; i < INGRESS_RANGE_LEN; i++) {
                 map[i].from = i;
                 map[i].to   = 0;
@@ -8751,12 +8751,12 @@ ip_route_get(NMPlatform *  platform,
         delayed_action_handle_all(platform, FALSE);
 
         /* Retry, if we failed due to a cache resync. That can happen when the netlink
-		 * socket fills up and we lost the response. */
+         * socket fills up and we lost the response. */
     } while (seq_result == WAIT_FOR_NL_RESPONSE_RESULT_FAILED_RESYNC && ++try_count < 10);
 
     if (seq_result < 0) {
         /* negative seq_result is an errno from kernel. Map it to negative
-		 * int (which are also errno). */
+         * int (which are also errno). */
         return (int) seq_result;
     }
 
@@ -8824,7 +8824,7 @@ qdisc_add(NMPlatform *platform, NMPNlmFlags flags, const NMPlatformQdisc *qdisc)
     nm_auto_nlmsg struct nl_msg *msg = NULL;
 
     /* Note: @qdisc must not be copied or kept alive because the lifetime of qdisc.kind
-	 * is undefined. */
+     * is undefined. */
 
     msg = _nl_msg_new_qdisc(RTM_NEWQDISC, flags, qdisc);
 
@@ -8868,7 +8868,7 @@ tfilter_add(NMPlatform *platform, NMPNlmFlags flags, const NMPlatformTfilter *tf
     nm_auto_nlmsg struct nl_msg *msg = NULL;
 
     /* Note: @tfilter must not be copied or kept alive because the lifetime of tfilter.kind
-	 * and tfilter.action.kind is undefined. */
+     * and tfilter.action.kind is undefined. */
 
     msg = _nl_msg_new_tfilter(RTM_NEWTFILTER, flags, tfilter);
 
@@ -8936,7 +8936,7 @@ continue_reading:
             int buf_size;
 
             /* the message receive buffer was too small. We lost one message, which
-			 * is unfortunate. Try to double the buffer size for the next time. */
+             * is unfortunate. Try to double the buffer size for the next time. */
             buf_size = nl_socket_get_msg_buf_size(sk);
             if (buf_size < 512 * 1024) {
                 buf_size *= 2;
@@ -8985,10 +8985,10 @@ continue_reading:
 
         if (hdr->nlmsg_flags & NLM_F_DUMP_INTR) {
             /*
-			 * We have to continue reading to clear
-			 * all messages until a NLMSG_DONE is
-			 * received and report the inconsistency.
-			 */
+             * We have to continue reading to clear
+             * all messages until a NLMSG_DONE is
+             * received and report the inconsistency.
+             */
             interrupted = TRUE;
         }
 
@@ -9001,20 +9001,20 @@ continue_reading:
 
         if (hdr->nlmsg_type == NLMSG_DONE) {
             /* messages terminates a multipart message, this is
-			 * usually the end of a message and therefore we slip
-			 * out of the loop by default. the user may overrule
-			 * this action by skipping this packet. */
+             * usually the end of a message and therefore we slip
+             * out of the loop by default. the user may overrule
+             * this action by skipping this packet. */
             multipart  = FALSE;
             seq_result = WAIT_FOR_NL_RESPONSE_RESULT_RESPONSE_OK;
         } else if (hdr->nlmsg_type == NLMSG_NOOP) {
             /* Message to be ignored, the default action is to
-			 * skip this message if no callback is specified. The
-			 * user may overrule this action by returning
-			 * NL_PROCEED. */
+             * skip this message if no callback is specified. The
+             * user may overrule this action by returning
+             * NL_PROCEED. */
         } else if (hdr->nlmsg_type == NLMSG_OVERRUN) {
             /* Data got lost, report back to user. The default action is to
-			 * quit parsing. The user may overrule this action by returning
-			 * NL_SKIP or NL_PROCEED (dangerous) */
+             * quit parsing. The user may overrule this action by returning
+             * NL_SKIP or NL_PROCEED (dangerous) */
             err           = -NME_NL_MSG_OVERFLOW;
             abort_parsing = TRUE;
         } else if (hdr->nlmsg_type == NLMSG_ERROR) {
@@ -9023,9 +9023,9 @@ continue_reading:
 
             if (hdr->nlmsg_len < nlmsg_size(sizeof(*e))) {
                 /* Truncated error message, the default action
-				 * is to stop parsing. The user may overrule
-				 * this action by returning NL_SKIP or
-				 * NL_PROCEED (dangerous) */
+                 * is to stop parsing. The user may overrule
+                 * this action by returning NL_SKIP or
+                 * NL_PROCEED (dangerous) */
                 err           = -NME_NL_MSG_TRUNC;
                 abort_parsing = TRUE;
             } else if (e->error) {
@@ -9067,18 +9067,18 @@ continue_reading:
         seq_number = nlmsg_hdr(msg)->nlmsg_seq;
 
         /* check whether the seq number is different from before, and
-		 * whether the previous number (@nlh_seq_last_seen) is a pending
-		 * refresh-all request. In that case, the pending request is thereby
-		 * completed.
-		 *
-		 * We must do that before processing the message with event_valid_msg(),
-		 * because we must track the completion of the pending request before that. */
+         * whether the previous number (@nlh_seq_last_seen) is a pending
+         * refresh-all request. In that case, the pending request is thereby
+         * completed.
+         *
+         * We must do that before processing the message with event_valid_msg(),
+         * because we must track the completion of the pending request before that. */
         event_seq_check_refresh_all(platform, seq_number);
 
         if (process_valid_msg) {
             /* Valid message (not checking for MULTIPART bit to
-			 * get along with broken kernels. NL_SKIP has no
-			 * effect on this.  */
+             * get along with broken kernels. NL_SKIP has no
+             * effect on this.  */
 
             event_valid_msg(platform, msg, handle_events);
 
@@ -9101,8 +9101,8 @@ continue_reading:
 stop:
     if (!handle_events) {
         /* when we don't handle events, we want to drain all messages from the socket
-		 * without handling the messages (but still check for sequence numbers).
-		 * Repeat reading. */
+         * without handling the messages (but still check for sequence numbers).
+         * Repeat reading. */
         goto continue_reading;
     }
 
@@ -9443,7 +9443,7 @@ constructed(GObject *_object)
         _LOGD("could not enable extended acks on netlink socket");
 
     /* explicitly set the msg buffer size and disable MSG_PEEK.
-	 * If we later encounter NME_NL_MSG_TRUNC, we will adjust the buffer size. */
+     * If we later encounter NME_NL_MSG_TRUNC, we will adjust the buffer size. */
     nl_socket_disable_msg_peek(priv->nlh);
     nle = nl_socket_set_msg_buf_size(priv->nlh, 32 * 1024);
     g_assert(!nle);
diff --git a/src/platform/nm-netlink.c b/src/platform/nm-netlink.c
index 00c9a8402f..0246da5455 100644
--- a/src/platform/nm-netlink.c
+++ b/src/platform/nm-netlink.c
@@ -426,10 +426,10 @@ nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize)
     size_t      len;
 
     /* - Always writes @dstsize bytes to @dst
-	 * - Copies the first non-NUL characters to @dst.
-	 *   Any characters after the first NUL bytes in @nla are ignored.
-	 * - If the string @nla is longer than @dstsize, the string
-	 *   gets truncated. @dst will always be NUL terminated. */
+     * - Copies the first non-NUL characters to @dst.
+     *   Any characters after the first NUL bytes in @nla are ignored.
+     * - If the string @nla is longer than @dstsize, the string
+     *   gets truncated. @dst will always be NUL terminated. */
 
     if (G_UNLIKELY(dstsize <= 1)) {
         if (dstsize == 1)
@@ -478,8 +478,8 @@ nla_memcpy(void *dst, const struct nlattr *nla, size_t dstsize)
     len = NM_MIN((size_t) srclen, dstsize);
     if (len > 0) {
         /* there is a crucial difference between nla_strlcpy() and nla_memcpy().
-		 * The former always write @dstsize bytes (akin to strncpy()), here, we only
-		 * write the bytes that we actually have (leaving the remainder undefined). */
+         * The former always write @dstsize bytes (akin to strncpy()), here, we only
+         * write the bytes that we actually have (leaving the remainder undefined). */
         memcpy(dst, nla_data(nla), len);
     }
 
@@ -553,9 +553,9 @@ _nest_end(struct nl_msg *msg, struct nlattr *start, int keep_empty)
 
     if (len > USHRT_MAX || (!keep_empty && len == NLA_HDRLEN)) {
         /*
-		 * Max nlattr size exceeded or empty nested attribute, trim the
-		 * attribute header again
-		 */
+         * Max nlattr size exceeded or empty nested attribute, trim the
+         * attribute header again
+         */
         nla_nest_cancel(msg, start);
 
         /* Return error only if nlattr size was exceeded */
@@ -567,11 +567,11 @@ _nest_end(struct nl_msg *msg, struct nlattr *start, int keep_empty)
     pad = NLMSG_ALIGN(msg->nm_nlh->nlmsg_len) - msg->nm_nlh->nlmsg_len;
     if (pad > 0) {
         /*
-		 * Data inside attribute does not end at a alignment boundary.
-		 * Pad accordingly and account for the additional space in
-		 * the message. nlmsg_reserve() may never fail in this situation,
-		 * the allocate message buffer must be a multiple of NLMSG_ALIGNTO.
-		 */
+         * Data inside attribute does not end at a alignment boundary.
+         * Pad accordingly and account for the additional space in
+         * the message. nlmsg_reserve() may never fail in this situation,
+         * the allocate message buffer must be a multiple of NLMSG_ALIGNTO.
+         */
         if (!nlmsg_reserve(msg, pad, 0))
             g_return_val_if_reached(-NME_BUG);
     }
@@ -1140,7 +1140,7 @@ nl_wait_for_ack(struct nl_sock *sk, const struct nl_cb *cb)
                                                                  \
         if (_cb && _cb->type##_cb) {                             \
             /* the returned value here must be either a negative
-		 * netlink error number, or one of NL_SKIP, NL_STOP, NL_OK. */ \
+         * netlink error number, or one of NL_SKIP, NL_STOP, NL_OK. */ \
             nmerr = _cb->type##_cb((msg), _cb->type##_arg);      \
             switch (nmerr) {                                     \
             case NL_OK:                                          \
@@ -1198,7 +1198,7 @@ continue_reading:
         if (hdr->nlmsg_type == NLMSG_DONE || hdr->nlmsg_type == NLMSG_ERROR
             || hdr->nlmsg_type == NLMSG_NOOP || hdr->nlmsg_type == NLMSG_OVERRUN) {
             /* We can't check for !NLM_F_MULTI since some netlink
-			 * users in the kernel are broken. */
+             * users in the kernel are broken. */
             sk->s_seq_expect++;
         }
 
@@ -1207,32 +1207,32 @@ continue_reading:
 
         if (hdr->nlmsg_flags & NLM_F_DUMP_INTR) {
             /*
-			 * We have to continue reading to clear
-			 * all messages until a NLMSG_DONE is
-			 * received and report the inconsistency.
-			 */
+             * We have to continue reading to clear
+             * all messages until a NLMSG_DONE is
+             * received and report the inconsistency.
+             */
             interrupted = 1;
         }
 
         /* messages terminates a multipart message, this is
-		 * usually the end of a message and therefore we slip
-		 * out of the loop by default. the user may overrule
-		 * this action by skipping this packet. */
+         * usually the end of a message and therefore we slip
+         * out of the loop by default. the user may overrule
+         * this action by skipping this packet. */
         if (hdr->nlmsg_type == NLMSG_DONE) {
             multipart = 0;
             NL_CB_CALL(cb, finish, msg);
         }
 
         /* Message to be ignored, the default action is to
-		 * skip this message if no callback is specified. The
-		 * user may overrule this action by returning
-		 * NL_PROCEED. */
+         * skip this message if no callback is specified. The
+         * user may overrule this action by returning
+         * NL_PROCEED. */
         else if (hdr->nlmsg_type == NLMSG_NOOP)
             goto skip;
 
         /* Data got lost, report back to user. The default action is to
-		 * quit parsing. The user may overrule this action by returning
-		 * NL_SKIP or NL_PROCEED (dangerous) */
+         * quit parsing. The user may overrule this action by returning
+         * NL_SKIP or NL_PROCEED (dangerous) */
         else if (hdr->nlmsg_type == NLMSG_OVERRUN) {
             nmerr = -NME_NL_MSG_OVERFLOW;
             goto out;
@@ -1244,9 +1244,9 @@ continue_reading:
 
             if (hdr->nlmsg_len < nlmsg_size(sizeof(*e))) {
                 /* Truncated error message, the default action
-				 * is to stop parsing. The user may overrule
-				 * this action by returning NL_SKIP or
-				 * NL_PROCEED (dangerous) */
+                 * is to stop parsing. The user may overrule
+                 * this action by returning NL_SKIP or
+                 * NL_PROCEED (dangerous) */
                 nmerr = -NME_NL_MSG_TRUNC;
                 goto out;
             }
@@ -1254,7 +1254,7 @@ continue_reading:
                 /* Error message reported back from kernel. */
                 if (cb && cb->err_cb) {
                     /* the returned value here must be either a negative
-					 * netlink error number, or one of NL_SKIP, NL_STOP, NL_OK. */
+                     * netlink error number, or one of NL_SKIP, NL_STOP, NL_OK. */
                     nmerr = cb->err_cb(&nla, e, cb->err_arg);
                     if (nmerr < 0)
                         goto out;
@@ -1273,8 +1273,8 @@ continue_reading:
                 NL_CB_CALL(cb, ack, msg);
         } else {
             /* Valid message (not checking for MULTIPART bit to
-			 * get along with broken kernels. NL_SKIP has no
-			 * effect on this.  */
+             * get along with broken kernels. NL_SKIP has no
+             * effect on this.  */
             NL_CB_CALL(cb, valid, msg);
         }
 skip:
@@ -1332,8 +1332,8 @@ nl_send_iovec(struct nl_sock *sk, struct nl_msg *msg, struct iovec *iov, unsigne
     char buf[CMSG_SPACE(sizeof(struct ucred))];
 
     /* Overwrite destination if specified in the message itself, defaults
-	 * to the peer address of the socket.
-	 */
+     * to the peer address of the socket.
+     */
     dst = nlmsg_get_dst(msg);
     if (dst->nl_family == AF_NETLINK)
         hdr.msg_name = dst;
@@ -1467,8 +1467,8 @@ retry:
         }
 
         /* Provided buffer is not long enough, enlarge it
-		 * to size of n (which should be total length of the message)
-		 * and try again. */
+         * to size of n (which should be total length of the message)
+         * and try again. */
         iov.iov_base = g_realloc(iov.iov_base, n);
         iov.iov_len  = n;
         flags        = 0;
diff --git a/src/platform/nm-netlink.h b/src/platform/nm-netlink.h
index ec5a85824e..63f63c4899 100644
--- a/src/platform/nm-netlink.h
+++ b/src/platform/nm-netlink.h
@@ -81,8 +81,8 @@ struct nla_policy {
         G_STATIC_ASSERT_EXPR(G_N_ELEMENTS(tb) > 0);                                           \
                                                                                               \
         /* We allow @policy to be either a C array or NULL. The sizeof()
-		 * must either match the expected array size or the sizeof(NULL),
-		 * but not both. */                      \
+         * must either match the expected array size or the sizeof(NULL),
+         * but not both. */                      \
         G_STATIC_ASSERT_EXPR((sizeof(policy) == G_N_ELEMENTS(tb) * sizeof(struct nla_policy)) \
                              ^ (sizeof(policy) == sizeof(NULL)));                             \
     }                                                                                         \
@@ -144,8 +144,8 @@ nla_data(const struct nlattr *nla)
         nm_assert(nla_len(_nla) >= sizeof(type));                       \
                                                                         \
         /* note that casting the pointer is undefined behavior in C, if
-		 * the data has wrong alignment. Netlink data is aligned to 4 bytes,
-		 * that means, if the alignment is larger than 4, this is invalid. */ \
+         * the data has wrong alignment. Netlink data is aligned to 4 bytes,
+         * that means, if the alignment is larger than 4, this is invalid. */ \
         G_STATIC_ASSERT_EXPR(_nm_alignof(type) <= NLA_ALIGNTO);         \
                                                                         \
         (type *) nla_data(_nla);                                        \
@@ -237,8 +237,8 @@ size_t nla_memcpy(void *dst, const struct nlattr *nla, size_t dstsize);
         size_t                     _srcsize;                             \
                                                                          \
         /* assert that, if @nla is given, that it has the exact expected
-		 * size. This implies that the caller previously verified the length
-		 * of the attribute (via minlen/maxlen at nla_parse()). */ \
+         * size. This implies that the caller previously verified the length
+         * of the attribute (via minlen/maxlen at nla_parse()). */ \
                                                                          \
         if (_nla) {                                                      \
             _srcsize = nla_memcpy(_dst, _nla, _dstsize);                 \
diff --git a/src/platform/nm-platform-utils.c b/src/platform/nm-platform-utils.c
index 6b78fc8fae..08b6a39fa8 100644
--- a/src/platform/nm-platform-utils.c
+++ b/src/platform/nm-platform-utils.c
@@ -143,7 +143,7 @@ _ioctl_call(const char *      log_ioctl_type,
     }
 
     /* we might need to retry the request. Backup edata so that we can
-	 * restore it on retry. */
+     * restore it on retry. */
     if (edata_size > 0)
         edata_backup = nm_memdup_maybe_a(500, edata, edata_size, &edata_backup_free);
 
@@ -189,41 +189,41 @@ again:
     /* resolve the name again to see whether the ifindex still has the same name. */
     if (!nmp_utils_if_indextoname(ifindex, known_ifnames[try_count % 2])) {
         /* we could not find the ifindex again. Probably the device just got
-		 * removed.
-		 *
-		 * In both cases we return the error code we got from ioctl above.
-		 * Either it failed because the device was gone already or it still
-		 * managed to complete the call. In both cases, the error code is good. */
+         * removed.
+         *
+         * In both cases we return the error code we got from ioctl above.
+         * Either it failed because the device was gone already or it still
+         * managed to complete the call. In both cases, the error code is good. */
         failure_reason =
             "cannot resolve ifindex after ioctl call. Probably the device was just removed";
         goto out;
     }
 
     /* check whether the ifname changed in the meantime. If yes, would render the result
-	 * invalid. Note that this cannot detect every race regarding renames, for example:
-	 *
-	 *  - if_indextoname(#10) gives eth0
-	 *  - rename(#10) => eth0_tmp
-	 *  - rename(#11) => eth0
-	 *  - ioctl(eth0) (wrongly fetching #11, formerly eth1)
-	 *  - rename(#11) => eth_something
-	 *  - rename(#10) => eth0
-	 *  - if_indextoname(#10) gives eth0
-	 */
+     * invalid. Note that this cannot detect every race regarding renames, for example:
+     *
+     *  - if_indextoname(#10) gives eth0
+     *  - rename(#10) => eth0_tmp
+     *  - rename(#11) => eth0
+     *  - ioctl(eth0) (wrongly fetching #11, formerly eth1)
+     *  - rename(#11) => eth_something
+     *  - rename(#10) => eth0
+     *  - if_indextoname(#10) gives eth0
+     */
     if (!nm_streq(known_ifnames[0], known_ifnames[1])) {
         gboolean retry;
 
         /* we detected a possible(!) rename.
-		 *
-		 * For getters it's straight forward to just retry the call.
-		 *
-		 * For setters we also always retry. If our previous call operated on the right device,
-		 * calling it again should have no bad effect (just setting the same thing more than once).
-		 *
-		 * The only potential bad thing is if there was a race involving swapping names, and we just
-		 * set the ioctl option on the wrong device. But then the bad thing already happenned and
-		 * we cannot detect it (nor do anything about it). At least, we can retry and set the
-		 * option on the right interface. */
+         *
+         * For getters it's straight forward to just retry the call.
+         *
+         * For setters we also always retry. If our previous call operated on the right device,
+         * calling it again should have no bad effect (just setting the same thing more than once).
+         *
+         * The only potential bad thing is if there was a race involving swapping names, and we just
+         * set the ioctl option on the wrong device. But then the bad thing already happenned and
+         * we cannot detect it (nor do anything about it). At least, we can retry and set the
+         * option on the right interface. */
         retry = (try_count < 5);
 
         nm_log_trace(LOGD_PLATFORM,
@@ -388,7 +388,7 @@ ethtool_gstrings_find(const struct ethtool_gstrings *gstrings, const char *needl
     guint32 i;
 
     /* ethtool_get_stringset() always ensures NUL terminated strings at ETH_GSTRING_LEN.
-	 * that means, we cannot possibly request longer names. */
+     * that means, we cannot possibly request longer names. */
     nm_assert(needle && strlen(needle) < ETH_GSTRING_LEN);
 
     for (i = 0; i < gstrings->len; i++) {
@@ -404,7 +404,7 @@ ethtool_get_stringset_index(SocketHandle *shandle, int stringset_id, const char
     gs_free struct ethtool_gstrings *gstrings = NULL;
 
     /* ethtool_get_stringset() always ensures NUL terminated strings at ETH_GSTRING_LEN.
-	 * that means, we cannot possibly request longer names. */
+     * that means, we cannot possibly request longer names. */
     nm_assert(needle && strlen(needle) < ETH_GSTRING_LEN);
 
     gstrings = ethtool_get_stringset(shandle, stringset_id);
@@ -423,10 +423,10 @@ static const NMEthtoolFeatureInfo _ethtool_feature_infos[_NM_ETHTOOL_ID_FEATURE_
     }
 
     /* the order does only matter for one thing: if it happens that more than one NMEthtoolID
-	 * reference the same kernel-name, then the one that is mentioned *later* will win in
-	 * case these NMEthtoolIDs are set. That mostly only makes sense for ethtool-ids which
-	 * refer to multiple features ("feature-tso"), while also having more specific ids
-	 * ("feature-tx-tcp-segmentation"). */
+     * reference the same kernel-name, then the one that is mentioned *later* will win in
+     * case these NMEthtoolIDs are set. That mostly only makes sense for ethtool-ids which
+     * refer to multiple features ("feature-tso"), while also having more specific ids
+     * ("feature-tx-tcp-segmentation"). */
 
     /* names from ethtool utility, which are aliases for multiple features. */
     ETHT_FEAT(NM_ETHTOOL_ID_FEATURE_SG, "tx-scatter-gather", "tx-scatter-gather-fraglist"),
@@ -766,8 +766,8 @@ nmp_utils_ethtool_set_features(
             if (do_set && (!s->available || s->never_changed)
                 && (s->active != (requested[i] == NM_TERNARY_TRUE))) {
                 /* we request to change a flag which kernel reported as fixed.
-				 * While the ethtool operation will silently succeed, mark the request
-				 * as failure. */
+                 * While the ethtool operation will silently succeed, mark the request
+                 * as failure. */
                 success = FALSE;
             }
 
@@ -1139,9 +1139,9 @@ nmp_utils_ethtool_get_permanent_address(int ifindex, guint8 *buf, size_t *length
 
     if (NM_IN_SET(pdata[0], 0, 0xFF)) {
         /* Some drivers might return a permanent address of all zeros.
-		 * Reject that (rh#1264024)
-		 *
-		 * Some drivers return a permanent address of all ones. Reject that too */
+         * Reject that (rh#1264024)
+         *
+         * Some drivers return a permanent address of all ones. Reject that too */
         for (i = 1; i < edata.e.size; i++) {
             if (pdata[0] != pdata[i])
                 goto not_all_0or1;
@@ -1163,9 +1163,9 @@ nmp_utils_ethtool_supports_carrier_detect(int ifindex)
     g_return_val_if_fail(ifindex > 0, FALSE);
 
     /* We ignore the result. If the ETHTOOL_GLINK call succeeded, then we
-	 * assume the device supports carrier-detect, otherwise we assume it
-	 * doesn't.
-	 */
+     * assume the device supports carrier-detect, otherwise we assume it
+     * doesn't.
+     */
     return _ethtool_call_once(ifindex, &edata, sizeof(edata)) >= 0;
 }
 
@@ -1349,8 +1349,8 @@ nmp_utils_ethtool_set_link_settings(int                      ifindex,
         return FALSE;
 
     /* FIXME: try first new ETHTOOL_GLINKSETTINGS/SLINKSETTINGS API
-	 * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f1ac7a700d039c61d8d8b99f28d605d489a60cf
-	 */
+     * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f1ac7a700d039c61d8d8b99f28d605d489a60cf
+     */
 
     /* then change the needed ones */
     edata.cmd = ETHTOOL_SSET;
@@ -1525,9 +1525,9 @@ nmp_utils_udev_get_driver(struct udev_device *udevice)
         driver = udev_device_get_driver(parent);
         if (!driver) {
             /* Try the grandparent if it's an ibmebus device or if the
-			 * subsys is NULL which usually indicates some sort of
-			 * platform device like a 'gadget' net interface.
-			 */
+             * subsys is NULL which usually indicates some sort of
+             * platform device like a 'gadget' net interface.
+             */
             subsys = udev_device_get_subsystem(parent);
             if ((g_strcmp0(subsys, "ibmebus") == 0) || (subsys == NULL)) {
                 grandparent = udev_device_get_parent(parent);
@@ -1539,7 +1539,7 @@ nmp_utils_udev_get_driver(struct udev_device *udevice)
 
 out:
     /* Intern the string so we don't have to worry about memory
-	 * management in NMPlatformLink. */
+     * management in NMPlatformLink. */
     return g_intern_string(driver);
 }
 
@@ -1557,8 +1557,8 @@ NMIPConfigSource
 nmp_utils_ip_config_source_round_trip_rtprot(NMIPConfigSource source)
 {
     /* when adding a route to kernel for a give @source, the resulting route
-	 * will be put into the cache with a source of NM_IP_CONFIG_SOURCE_RTPROT_*.
-	 * This function returns that. */
+     * will be put into the cache with a source of NM_IP_CONFIG_SOURCE_RTPROT_*.
+     * This function returns that. */
     return nmp_utils_ip_config_source_from_rtprot(
         nmp_utils_ip_config_source_coerce_to_rtprot(source));
 }
@@ -1567,8 +1567,8 @@ guint8
 nmp_utils_ip_config_source_coerce_to_rtprot(NMIPConfigSource source)
 {
     /* when adding a route to kernel, we coerce the @source field
-	 * to rtm_protocol. This is not lossless as we map different
-	 * source values to the same RTPROT uint8 value. */
+     * to rtm_protocol. This is not lossless as we map different
+     * source values to the same RTPROT uint8 value. */
     if (source <= NM_IP_CONFIG_SOURCE_UNKNOWN)
         return RTPROT_UNSPEC;
 
@@ -1594,17 +1594,17 @@ NMIPConfigSource
 nmp_utils_ip_config_source_coerce_from_rtprot(NMIPConfigSource source)
 {
     /* When we receive a route from kernel and put it into the platform cache,
-	 * we preserve the protocol field by converting it to a NMIPConfigSource
-	 * via nmp_utils_ip_config_source_from_rtprot().
-	 *
-	 * However, that is not the inverse of nmp_utils_ip_config_source_coerce_to_rtprot().
-	 * Instead, to go back to the original value, you need another step:
-	 *   nmp_utils_ip_config_source_coerce_from_rtprot (nmp_utils_ip_config_source_from_rtprot (rtprot)).
-	 *
-	 * This might partly restore the original source value, but of course that
-	 * is not really possible because nmp_utils_ip_config_source_coerce_to_rtprot()
-	 * is not injective.
-	 * */
+     * we preserve the protocol field by converting it to a NMIPConfigSource
+     * via nmp_utils_ip_config_source_from_rtprot().
+     *
+     * However, that is not the inverse of nmp_utils_ip_config_source_coerce_to_rtprot().
+     * Instead, to go back to the original value, you need another step:
+     *   nmp_utils_ip_config_source_coerce_from_rtprot (nmp_utils_ip_config_source_from_rtprot (rtprot)).
+     *
+     * This might partly restore the original source value, but of course that
+     * is not really possible because nmp_utils_ip_config_source_coerce_to_rtprot()
+     * is not injective.
+     * */
     switch (source) {
     case NM_IP_CONFIG_SOURCE_RTPROT_UNSPEC:
         return NM_IP_CONFIG_SOURCE_UNKNOWN;
@@ -1753,8 +1753,8 @@ nmp_utils_sysctl_open_netdir(int ifindex, const char *ifname_guess, char *out_if
             g_return_val_if_reached(-1);
 
         /* we only retry, if the name changed since previous attempt.
-		 * Hence, it is extremely unlikely that this loop runes until the
-		 * end of the @try_count. */
+         * Hence, it is extremely unlikely that this loop runes until the
+         * end of the @try_count. */
         if (nm_streq(ifname, ifname_buf_last_try))
             return -1;
         strcpy(ifname_buf_last_try, ifname);
diff --git a/src/platform/nm-platform-utils.h b/src/platform/nm-platform-utils.h
index cae1e07dee..1d0f32295f 100644
--- a/src/platform/nm-platform-utils.h
+++ b/src/platform/nm-platform-utils.h
@@ -34,7 +34,7 @@ gboolean nmp_utils_ethtool_get_permanent_address(int ifindex, guint8 *buf, size_
 
 typedef struct {
     /* We don't want to include <linux/ethtool.h> in header files,
-	 * thus create a ABI compatible version of struct ethtool_drvinfo.*/
+     * thus create a ABI compatible version of struct ethtool_drvinfo.*/
     guint32 _private_cmd;
     char    driver[32];
     char    version[32];
@@ -57,8 +57,8 @@ typedef struct {
     guint8 n_kernel_names;
 
     /* one NMEthtoolID refers to one or more kernel_names. The reason for supporting this complexity
-	 * (where one NMSettingEthtool option refers to multiple kernel features)  is to follow what
-	 * ethtool does, where "tx" is an alias for multiple features. */
+     * (where one NMSettingEthtool option refers to multiple kernel features)  is to follow what
+     * ethtool does, where "tx" is an alias for multiple features. */
     const char *const *kernel_names;
 } NMEthtoolFeatureInfo;
 
@@ -68,7 +68,7 @@ typedef struct {
     guint idx_ss_features;
 
     /* one NMEthtoolFeatureInfo references one or more kernel_names. This is the index
-	 * of the matching info->kernel_names */
+     * of the matching info->kernel_names */
     guint8 idx_kernel_name;
 
     bool available : 1;
diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c
index bfef88ac52..60484c74d0 100644
--- a/src/platform/nm-platform.c
+++ b/src/platform/nm-platform.c
@@ -474,13 +474,13 @@ nm_platform_process_events_ensure_link(NMPlatform *self, int ifindex, const char
         return NULL;
 
     /* we look into the cache, whether a link for given ifindex/ifname
-	 * exits. If not, we poll the netlink socket, maybe the event
-	 * with the link is waiting.
-	 *
-	 * Then we try again to find the object.
-	 *
-	 * If the link is already cached the first time, we avoid polling
-	 * the netlink socket. */
+     * exits. If not, we poll the netlink socket, maybe the event
+     * with the link is waiting.
+     *
+     * Then we try again to find the object.
+     *
+     * If the link is already cached the first time, we avoid polling
+     * the netlink socket. */
 again:
     obj = nmp_cache_lookup_link_full(
         nm_platform_get_cache(self),
@@ -524,8 +524,8 @@ nm_platform_sysctl_open_netdir(NMPlatform *self, int ifindex, char *out_ifname)
     g_return_val_if_fail(ifindex > 0, -1);
 
     /* we don't have an @ifname_guess argument to make the API nicer.
-	 * But still do a cache-lookup first. Chances are good that we have
-	 * the right ifname cached and save if_indextoname() */
+     * But still do a cache-lookup first. Chances are good that we have
+     * the right ifname cached and save if_indextoname() */
     ifname_guess = nm_platform_link_get_name(self, ifindex);
 
     return nmp_utils_sysctl_open_netdir(ifindex, ifname_guess, out_ifname);
@@ -621,7 +621,7 @@ nm_platform_sysctl_ip_conf_set_ipv6_hop_limit_safe(NMPlatform *self, const char
                                              -1);
 
     /* only allow increasing the hop-limit to avoid DOS by an attacker
-	 * setting a low hop-limit (CVE-2015-2924, rh#1209902) */
+     * setting a low hop-limit (CVE-2015-2924, rh#1209902) */
 
     if (value < cur)
         return FALSE;
@@ -650,7 +650,7 @@ nm_platform_sysctl_ip_neigh_set_ipv6_reachable_time(NMPlatform *self,
         return TRUE;
 
     /* RFC 4861 says the value can't be greater than one hour.
-	 * Also use a reasonable lower threshold. */
+     * Also use a reasonable lower threshold. */
     clamped = NM_CLAMP(value_ms, 100, 3600000);
     nm_sprintf_buf(path, "/proc/sys/net/ipv6/neigh/%s/base_reachable_time_ms", iface);
     nm_sprintf_buf(str, "%u", clamped);
@@ -783,7 +783,7 @@ nm_platform_sysctl_get_int_checked(NMPlatform *self,
     value = nm_platform_sysctl_get(self, pathid, dirfd, path);
     if (!value) {
         /* nm_platform_sysctl_get() set errno to ENOENT if the file does not exist.
-		 * Propagate/preserve that. */
+         * Propagate/preserve that. */
         if (errno != ENOENT)
             errno = EINVAL;
         return fallback;
@@ -892,8 +892,8 @@ nm_platform_sysctl_ip_conf_get_rp_filter_ipv4(NMPlatform *self,
         return -1;
 
     /* the effectively used value is the rp_filter sysctl value of MAX(all,ifname).
-	 * Note that this is the numerical MAX(), despite rp_filter "1" being more strict
-	 * than "2". */
+     * Note that this is the numerical MAX(), despite rp_filter "1" being more strict
+     * than "2". */
     if (val < 2 && consider_all && !nm_streq(ifname, "all")) {
         val_all = nm_platform_sysctl_ip_conf_get_int_checked(self,
                                                              AF_INET,
@@ -974,7 +974,7 @@ nm_platform_link_get_all(NMPlatform *self, gboolean sort_by_name)
         return NULL;
 
     /* first sort the links by their ifindex or name. Below we will sort
-	 * further by moving children/slaves to the end. */
+     * further by moving children/slaves to the end. */
     g_ptr_array_sort_with_data(links, _link_get_all_presort, GINT_TO_POINTER(sort_by_name));
 
     unseen = g_hash_table_new(nm_direct_hash, NULL);
@@ -1045,7 +1045,7 @@ skip:
         } else {
             nm_assert(first_idx != G_MAXUINT);
             /* There is a loop, pop the first (remaining) element from the list.
-			 * This can happen for veth pairs where each peer is parent of the other end. */
+             * This can happen for veth pairs where each peer is parent of the other end. */
             item = NMP_OBJECT_CAST_LINK(links->pdata[first_idx]);
             nm_assert(item);
             g_hash_table_remove(unseen, GINT_TO_POINTER(item->ifindex));
@@ -1471,11 +1471,11 @@ nm_platform_link_get_type_name(NMPlatform *self, int ifindex)
 
     if (obj->link.type != NM_LINK_TYPE_UNKNOWN) {
         /* We could detect the @link_type. In this case the function returns
-		 * our internal module names, which differs from rtnl_link_get_type():
-		 *   - NM_LINK_TYPE_INFINIBAND (gives "infiniband", instead of "ipoib")
-		 *   - NM_LINK_TYPE_TAP (gives "tap", instead of "tun").
-		 * Note that this functions is only used by NMDeviceGeneric to
-		 * set type_description. */
+         * our internal module names, which differs from rtnl_link_get_type():
+         *   - NM_LINK_TYPE_INFINIBAND (gives "infiniband", instead of "ipoib")
+         *   - NM_LINK_TYPE_TAP (gives "tap", instead of "tun").
+         * Note that this functions is only used by NMDeviceGeneric to
+         * set type_description. */
         return nm_link_type_to_string(obj->link.type);
     }
     /* Link type not detected. Fallback to rtnl_link_get_type()/IFLA_INFO_KIND. */
@@ -1581,7 +1581,7 @@ nm_platform_link_get_ifi_flags(NMPlatform *self, int ifindex, guint requested_fl
         return -ENODEV;
 
     /* Errors are signaled as negative values. That means, you cannot request
-	 * the most significant bit (2^31) with this API. Assert against that. */
+     * the most significant bit (2^31) with this API. Assert against that. */
     nm_assert((int) requested_flags >= 0);
     nm_assert(requested_flags < (guint) G_MAXINT);
 
@@ -2497,7 +2497,7 @@ nm_platform_link_tun_add(NMPlatform *            self,
     g_return_val_if_fail(NM_IN_SET(props->type, IFF_TUN, IFF_TAP), -NME_BUG);
 
     /* creating a non-persistent device requires that the caller handles
-	 * the file descriptor. */
+     * the file descriptor. */
     g_return_val_if_fail(props->persist || out_fd, -NME_BUG);
 
     NM_SET_OUT(out_fd, -1);
@@ -2531,7 +2531,7 @@ nm_platform_link_6lowpan_get_properties(NMPlatform *self, int ifindex, int *out_
     }
 
     /* As of 4.16 kernel does not expose the peer_ifindex as IFA_LINK.
-	 * Find the WPAN device with the same MAC address. */
+     * Find the WPAN device with the same MAC address. */
     if (out_parent) {
         const NMPlatformLink *parent_plink;
 
@@ -2861,7 +2861,7 @@ nm_platform_link_infiniband_get_properties(NMPlatform * self,
     }
 
     /* Could not get the link information via netlink. To support older kernels,
-	 * fallback to reading sysfs. */
+     * fallback to reading sysfs. */
 
     dirfd = nm_platform_sysctl_open_netdir(self, ifindex, ifname_verified);
     if (dirfd < 0)
@@ -2974,7 +2974,7 @@ nm_platform_link_tun_get_properties(NMPlatform *self, int ifindex, NMPlatformLnk
         nm_assert(NMP_OBJECT_GET_CLASS(pllnk)->lnk_link_type == NM_LINK_TYPE_TUN);
 
         /* recent kernels expose tun properties via netlink and thus we have them
-		 * in the platform cache. */
+         * in the platform cache. */
         NM_SET_OUT(out_properties, pllnk->lnk_tun);
         return TRUE;
     }
@@ -3741,9 +3741,9 @@ _addr_array_clean_expired(int          addr_family,
 
         if (addr_family == AF_INET6 && NM_FLAGS_HAS(a->n_ifa_flags, IFA_F_TEMPORARY)) {
             /* temporary addresses are never added explicitly by NetworkManager but
-			 * kernel adds them via mngtempaddr flag.
-			 *
-			 * We drop them from this list. */
+             * kernel adds them via mngtempaddr flag.
+             *
+             * We drop them from this list. */
             goto clear_and_next;
         }
 
@@ -3855,7 +3855,7 @@ ip4_addr_subnets_build_index(const GPtrArray *addresses,
             g_ptr_array_insert(addr_list, position, p_address);
         } else {
             /* we only care about the primary. No need to track the secondaries
-			 * as a GPtrArray. */
+             * as a GPtrArray. */
             nm_assert(ip4_addr_subnets_is_plain_address(addresses, p));
             if (consider_flags && !NM_FLAGS_HAS(address->n_ifa_flags, IFA_F_SECONDARY)) {
                 g_hash_table_insert(subnets, GUINT_TO_POINTER(net), p_address);
@@ -3993,9 +3993,9 @@ nm_platform_ip_address_sync(NMPlatform *self,
     _CHECK_SELF(self, klass, FALSE);
 
     /* The order we want to enforce is only among addresses with the same
-	 * scope, as the kernel keeps addresses sorted by scope. Therefore,
-	 * apply the same sorting to known addresses, so that we don't try to
-	 * unnecessary change the order of addresses with different scopes. */
+     * scope, as the kernel keeps addresses sorted by scope. Therefore,
+     * apply the same sorting to known addresses, so that we don't try to
+     * unnecessary change the order of addresses with different scopes. */
     if (!IS_IPv4) {
         if (known_addresses)
             g_ptr_array_sort_with_data(known_addresses,
@@ -4011,7 +4011,7 @@ nm_platform_ip_address_sync(NMPlatform *self,
         known_addresses = NULL;
 
     /* @plat_addresses must be sorted in decreasing priority order (highest priority addresses first), contrary to
-	 * @known_addresses which is in increasing priority order (lowest priority addresses first). */
+     * @known_addresses which is in increasing priority order (lowest priority addresses first). */
     plat_addresses = addresses_prune;
 
     if (nm_g_ptr_array_len(plat_addresses) > 0) {
@@ -4049,7 +4049,7 @@ nm_platform_ip_address_sync(NMPlatform *self,
                             ip4_addr_subnets_is_secondary(o, known_subnets, known_addresses, NULL);
                         if (secondary == NM_FLAGS_HAS(plat_address->n_ifa_flags, IFA_F_SECONDARY)) {
                             /* if we have an existing known-address, with matching secondary role,
-							 * do not delete the platform-address. */
+                             * do not delete the platform-address. */
                             continue;
                         }
                     }
@@ -4067,11 +4067,11 @@ nm_platform_ip_address_sync(NMPlatform *self,
                                                    &addr_list)
                     && addr_list) {
                     /* If we just deleted a primary addresses and there were
-					 * secondary ones the kernel can do two things, depending on
-					 * version and sysctl setting: delete also secondary addresses
-					 * or promote a secondary to primary. Ensure that secondary
-					 * addresses are deleted, so that we can start with a clean
-					 * slate and add addresses in the right order. */
+                     * secondary ones the kernel can do two things, depending on
+                     * version and sysctl setting: delete also secondary addresses
+                     * or promote a secondary to primary. Ensure that secondary
+                     * addresses are deleted, so that we can start with a clean
+                     * slate and add addresses in the right order. */
                     for (j = 1; j < addr_list->len; j++) {
                         const NMPObject **o;
 
@@ -4106,18 +4106,18 @@ nm_platform_ip_address_sync(NMPlatform *self,
             known_addresses_len = known_addresses ? known_addresses->len : 0;
 
             /* First, compare every address whether it is still a "known address", that is, whether
-			 * to keep it or to delete it.
-			 *
-			 * If we don't find a matching valid address in @known_addresses, we will delete
-			 * plat_addr.
-			 *
-			 * Certain addresses, like temporary addresses, are ignored by this function
-			 * if not run with full_sync. These addresses are usually not managed by NetworkManager
-			 * directly, or at least, they are not managed via nm_platform_ip6_address_sync().
-			 * Only in full_sync mode, we really want to get rid of them (usually, when we take
-			 * the interface down).
-			 *
-			 * Note that we mark handled addresses by setting it to %NULL in @plat_addresses array. */
+             * to keep it or to delete it.
+             *
+             * If we don't find a matching valid address in @known_addresses, we will delete
+             * plat_addr.
+             *
+             * Certain addresses, like temporary addresses, are ignored by this function
+             * if not run with full_sync. These addresses are usually not managed by NetworkManager
+             * directly, or at least, they are not managed via nm_platform_ip6_address_sync().
+             * Only in full_sync mode, we really want to get rid of them (usually, when we take
+             * the interface down).
+             *
+             * Note that we mark handled addresses by setting it to %NULL in @plat_addresses array. */
             for (i_plat = 0; i_plat < plat_addresses->len; i_plat++) {
                 const NMPObject *           plat_obj = plat_addresses->pdata[i_plat];
                 const NMPObject *           know_obj;
@@ -4128,13 +4128,13 @@ nm_platform_ip_address_sync(NMPlatform *self,
                     if (know_obj
                         && plat_addr->plen == NMP_OBJECT_CAST_IP6_ADDRESS(know_obj)->plen) {
                         /* technically, plen is not part of the ID for IPv6 addresses and thus
-						 * @plat_addr is essentially the same address as @know_addr (regrading
-						 * its identity, not its other attributes).
-						 * However, we cannot modify an existing addresses' plen without
-						 * removing and readding it. Thus, only keep plat_addr, if the plen
-						 * matches.
-						 *
-						 * keep this one, and continue */
+                         * @plat_addr is essentially the same address as @know_addr (regrading
+                         * its identity, not its other attributes).
+                         * However, we cannot modify an existing addresses' plen without
+                         * removing and readding it. Thus, only keep plat_addr, if the plen
+                         * matches.
+                         *
+                         * keep this one, and continue */
                         continue;
                     }
                 }
@@ -4144,15 +4144,15 @@ nm_platform_ip_address_sync(NMPlatform *self,
             }
 
             /* Next, we must preserve the priority of the routes. That is, source address
-			 * selection will choose addresses in the order as they are reported by kernel.
-			 * Note that the order in @plat_addresses of the remaining matches is highest
-			 * priority first.
-			 * We need to compare this to the order of addresses with same scope in
-			 * @known_addresses (which has lowest priority first).
-			 *
-			 * If we find a first discrepancy, we need to delete all remaining addresses
-			 * with same scope from that point on, because below we must re-add all the
-			 * addresses in the right order to get their priority right. */
+             * selection will choose addresses in the order as they are reported by kernel.
+             * Note that the order in @plat_addresses of the remaining matches is highest
+             * priority first.
+             * We need to compare this to the order of addresses with same scope in
+             * @known_addresses (which has lowest priority first).
+             *
+             * If we find a first discrepancy, we need to delete all remaining addresses
+             * with same scope from that point on, because below we must re-add all the
+             * addresses in the right order to get their priority right. */
             cur_scope              = IP6_ADDR_SCOPE_LOOPBACK;
             delete_remaining_addrs = FALSE;
             i_plat                 = plat_addresses->len;
@@ -4194,7 +4194,7 @@ nm_platform_ip_address_sync(NMPlatform *self,
                         }
 
                         /* plat_address has no match. Now delete_remaining_addrs is TRUE and we will
-						 * delete all the remaining addresses with cur_scope. */
+                         * delete all the remaining addresses with cur_scope. */
                         break;
                     }
                 }
@@ -4216,8 +4216,8 @@ next_plat:;
                     : 0;
 
     /* Add missing addresses. New addresses are added by kernel with top
-	 * priority.
-	 */
+     * priority.
+     */
     for (i_know = 0; i_know < known_addresses->len; i_know++) {
         const NMPlatformIPXAddress *known_address;
         const NMPObject *           o;
@@ -4297,9 +4297,9 @@ _err_inval_due_to_ipv6_tentative_pref_src(NMPlatform *self, const NMPObject *obj
     nm_assert(NMP_OBJECT_IS_VALID(obj));
 
     /* trying to add an IPv6 route with pref-src fails, if the address is
-	 * still tentative (rh#1452684). We need to hack around that.
-	 *
-	 * Detect it, by guessing whether that's the case. */
+     * still tentative (rh#1452684). We need to hack around that.
+     *
+     * Detect it, by guessing whether that's the case. */
 
     if (NMP_OBJECT_GET_TYPE(obj) != NMP_OBJECT_TYPE_IP6_ROUTE)
         return FALSE;
@@ -4470,8 +4470,8 @@ nm_platform_ip_route_sync(NMPlatform *self,
             if ((i_type == 0 && !VTABLE_IS_DEVICE_ROUTE(vt, conf_o))
                 || (i_type == 1 && VTABLE_IS_DEVICE_ROUTE(vt, conf_o))) {
                 /* we add routes in two runs over @i_type.
-				 *
-				 * First device routes, then gateway routes. */
+                 *
+                 * First device routes, then gateway routes. */
                 continue;
             }
 
@@ -4490,7 +4490,7 @@ nm_platform_ip_route_sync(NMPlatform *self,
 
             if (!IS_IPv4 && NMP_OBJECT_CAST_IP6_ROUTE(conf_o)->metric == 0) {
                 /* User space cannot add routes with metric 0. However, kernel can, and we might track such
-				 * routes in @route as they are present external. Skip them silently. */
+                 * routes in @route as they are present external. Skip them silently. */
                 continue;
             }
 
@@ -4507,7 +4507,7 @@ nm_platform_ip_route_sync(NMPlatform *self,
                     continue;
 
                 /* we need to replace the existing route with a (slightly) different
-				 * one. Delete it first. */
+                 * one. Delete it first. */
                 if (!nm_platform_object_delete(self, plat_o)) {
                     /* ignore error. */
                 }
@@ -4521,8 +4521,8 @@ sync_route_add:
             if (r < 0) {
                 if (r == -EEXIST) {
                     /* Don't fail for EEXIST. It's not clear that the existing route
-					 * is identical to the one that we were about to add. However,
-					 * above we should have deleted conflicting (non-identical) routes. */
+                     * is identical to the one that we were about to add. However,
+                     * above we should have deleted conflicting (non-identical) routes. */
                     if (_LOGD_ENABLED()) {
                         plat_entry =
                             nm_platform_lookup_entry(self, NMP_CACHE_ID_TYPE_OBJECT_TYPE, conf_o);
@@ -4713,15 +4713,15 @@ static guint8
 _ip_route_scope_inv_get_normalized(const NMPlatformIP4Route *route)
 {
     /* in kernel, you cannot set scope to RT_SCOPE_NOWHERE (255).
-	 * That means, in NM, we treat RT_SCOPE_NOWHERE as unset, and detect
-	 * it based on the presence of the gateway. In other words, when adding
-	 * a route with scope RT_SCOPE_NOWHERE (in NetworkManager) to kernel,
-	 * the resulting scope will be either "link" or "universe" (depending
-	 * on the gateway).
-	 *
-	 * Note that internally, we track @scope_inv is the inverse of scope,
-	 * so that the default equals zero (~(RT_SCOPE_NOWHERE)).
-	 **/
+     * That means, in NM, we treat RT_SCOPE_NOWHERE as unset, and detect
+     * it based on the presence of the gateway. In other words, when adding
+     * a route with scope RT_SCOPE_NOWHERE (in NetworkManager) to kernel,
+     * the resulting scope will be either "link" or "universe" (depending
+     * on the gateway).
+     *
+     * Note that internally, we track @scope_inv is the inverse of scope,
+     * so that the default equals zero (~(RT_SCOPE_NOWHERE)).
+     **/
     if (route->scope_inv == 0) {
         if (route->type_coerced == nm_platform_route_type_coerce(RTN_LOCAL))
             return nm_platform_route_scope_inv(RT_SCOPE_HOST);
@@ -5019,9 +5019,9 @@ _ip4_dev_route_blacklist_notify_route(NMPlatform *self, const NMPObject *obj)
     }
 
     /* We cannot delete it right away because we are in the process of receiving netlink messages.
-	 * It may be possible to do so, but complicated and error prone.
-	 *
-	 * Instead, we mark the entry and schedule an idle action (with high priority). */
+     * It may be possible to do so, but complicated and error prone.
+     *
+     * Instead, we mark the entry and schedule an idle action (with high priority). */
     *p_timeout_ms = (*p_timeout_ms) | ((gint64) 1);
     _ip4_dev_route_blacklist_check_schedule(self);
 }
@@ -5065,8 +5065,8 @@ _ip4_dev_route_blacklist_schedule(NMPlatform *self)
     } else {
         if (!priv->ip4_dev_route_blacklist_gc_timeout_id) {
             /* this timeout is only to garbage collect the expired entries from priv->ip4_dev_route_blacklist_hash.
-			 * It can run infrequently, and it doesn't hurt if expired entries linger around a bit
-			 * longer then necessary. */
+             * It can run infrequently, and it doesn't hurt if expired entries linger around a bit
+             * longer then necessary. */
             priv->ip4_dev_route_blacklist_gc_timeout_id =
                 g_timeout_add_seconds(IP4_DEV_ROUTE_BLACKLIST_GC_TIMEOUT_S,
                                       _ip4_dev_route_blacklist_gc_timeout_handle,
@@ -5126,11 +5126,11 @@ nm_platform_ip4_dev_route_blacklist_set(NMPlatform *self,
         while (g_hash_table_iter_next(&iter, (gpointer *) &p_obj, (gpointer *) &p_timeout_ms)) {
             if (NMP_OBJECT_CAST_IP4_ROUTE(p_obj)->ifindex == ifindex) {
                 /* we could g_hash_table_iter_remove(&iter) the current entry.
-				 * Instead, just expire it and let _ip4_dev_route_blacklist_gc_timeout_handle()
-				 * handle it.
-				 *
-				 * The assumption is, that ip4_dev_route_blacklist contains the very same entry
-				 * again, with a new timeout. So, we can un-expire it below. */
+                 * Instead, just expire it and let _ip4_dev_route_blacklist_gc_timeout_handle()
+                 * handle it.
+                 *
+                 * The assumption is, that ip4_dev_route_blacklist contains the very same entry
+                 * again, with a new timeout. So, we can un-expire it below. */
                 *p_timeout_ms = 0;
             }
         }
@@ -5206,7 +5206,7 @@ nm_platform_qdisc_add(NMPlatform *self, NMPNlmFlags flags, const NMPlatformQdisc
     _CHECK_SELF(self, klass, -NME_BUG);
 
     /* Note: @qdisc must not be copied or kept alive because the lifetime of qdisc.kind
-	 * is undefined. */
+     * is undefined. */
 
     _LOG3D("adding or updating a qdisc: %s", nm_platform_qdisc_to_string(qdisc, NULL, 0));
     return klass->qdisc_add(self, flags, qdisc);
@@ -5309,7 +5309,7 @@ nm_platform_tfilter_add(NMPlatform *self, NMPNlmFlags flags, const NMPlatformTfi
     _CHECK_SELF(self, klass, -NME_BUG);
 
     /* Note: @tfilter must not be copied or kept alive because the lifetime of tfilter.kind
-	 * and tfilter.action.kind is undefined. */
+     * and tfilter.action.kind is undefined. */
 
     _LOG3D("adding or updating a tfilter: %s", nm_platform_tfilter_to_string(tfilter, NULL, 0));
     return klass->tfilter_add(self, flags, tfilter);
@@ -6803,7 +6803,7 @@ nm_platform_routing_rule_to_string(const NMPlatformRoutingRule *routing_rule, ch
 
     if (routing_rule->ip_proto != 0) {
         /* we don't call getprotobynumber(), just print the numeric value.
-		 * This differs from what ip-rule prints. */
+         * This differs from what ip-rule prints. */
         nm_utils_strbuf_append(&buf, &len, " ipproto %u", routing_rule->ip_proto);
     }
 
@@ -6835,10 +6835,10 @@ nm_platform_routing_rule_to_string(const NMPlatformRoutingRule *routing_rule, ch
 
     if (routing_rule->flow) {
         /* FRA_FLOW is only for IPv4, but we want to print the value for all address-families,
-		 * to see when it is set. In practice, this should not be set except for IPv4.
-		 *
-		 * We don't follow the style how ip-rule prints flow/realms. It's confusing. Just
-		 * print the value hex. */
+         * to see when it is set. In practice, this should not be set except for IPv4.
+         *
+         * We don't follow the style how ip-rule prints flow/realms. It's confusing. Just
+         * print the value hex. */
         nm_utils_strbuf_append(&buf, &len, " realms 0x%08x", routing_rule->flow);
     }
 
@@ -6846,7 +6846,7 @@ nm_platform_routing_rule_to_string(const NMPlatformRoutingRule *routing_rule, ch
         G_STATIC_ASSERT_EXPR(RTN_NAT == 10);
 
         /* NAT is deprecated for many years. We don't support RTA_GATEWAY/FRA_UNUSED2
-		 * for the gateway, and so do recent kernels ignore that parameter. */
+         * for the gateway, and so do recent kernels ignore that parameter. */
         nm_utils_strbuf_append_str(&buf, &len, " masquerade");
     } else if (routing_rule->action == FR_ACT_GOTO) {
         if (routing_rule->goto_target != 0)
@@ -7715,7 +7715,7 @@ nm_platform_ip4_address_pretty_sort_cmp(const NMPlatformIP4Address *a1,
     nm_assert(a2);
 
     /* Sort by address type. For example link local will
-	 * be sorted *after* a global address. */
+     * be sorted *after* a global address. */
     NM_CMP_DIRECT(_address_pretty_sort_get_prio_4(a2->address),
                   _address_pretty_sort_get_prio_4(a1->address));
 
@@ -7725,10 +7725,10 @@ nm_platform_ip4_address_pretty_sort_cmp(const NMPlatformIP4Address *a1,
     NM_CMP_DIRECT((a2->label[0] == '\0'), (a1->label[0] == '\0'));
 
     /* Finally, sort addresses lexically. We compare only the
-	 * network part so that the order of addresses in the same
-	 * subnet (and thus also the primary/secondary role) is
-	 * preserved.
-	 */
+     * network part so that the order of addresses in the same
+     * subnet (and thus also the primary/secondary role) is
+     * preserved.
+     */
     n1 = a1->address & _nm_utils_ip4_prefix_to_netmask(a1->plen);
     n2 = a2->address & _nm_utils_ip4_prefix_to_netmask(a2->plen);
     NM_CMP_DIRECT_MEMCMP(&n1, &n2, sizeof(guint32));
@@ -7770,7 +7770,7 @@ nm_platform_ip6_address_pretty_sort_cmp(const NMPlatformIP6Address *a1,
                   NM_FLAGS_HAS(a2->n_ifa_flags, IFA_F_TENTATIVE));
 
     /* Sort by address type. For example link local will
-	 * be sorted *after* site local or global. */
+     * be sorted *after* site local or global. */
     NM_CMP_DIRECT(_address_pretty_sort_get_prio_6(&a2->address),
                   _address_pretty_sort_get_prio_6(&a1->address));
 
@@ -8249,7 +8249,7 @@ nm_platform_routing_rule_hash_update(const NMPlatformRoutingRule *obj,
 
     if (G_UNLIKELY(!NM_IN_SET(obj->addr_family, AF_INET, AF_INET6))) {
         /* the address family is not one of the supported ones. That means, the
-		 * instance will only compare equal to itself (pointer-equality). */
+         * instance will only compare equal to itself (pointer-equality). */
         nm_hash_update_val(h, (gconstpointer) obj);
         return;
     }
@@ -8338,7 +8338,7 @@ nm_platform_routing_rule_cmp(const NMPlatformRoutingRule *a,
 
     if (G_UNLIKELY(!valid)) {
         /* the address family is not one of the supported ones. That means, the
-		 * instance will only compare equal to itself. */
+         * instance will only compare equal to itself. */
         NM_CMP_DIRECT((uintptr_t) a, (uintptr_t) b);
         nm_assert_not_reached();
         return 0;
diff --git a/src/platform/nm-platform.h b/src/platform/nm-platform.h
index 441c4828e8..c01008018a 100644
--- a/src/platform/nm-platform.h
+++ b/src/platform/nm-platform.h
@@ -73,7 +73,7 @@ typedef enum {
     NMP_NLM_FLAG_F_ECHO = 0x08, /* NLM_F_ECHO, Echo this request */
 
     /* use our own platform enum for the nlmsg-flags. Otherwise, we'd have
-	 * to include <linux/netlink.h> */
+     * to include <linux/netlink.h> */
     NMP_NLM_FLAG_F_REPLACE = 0x100, /* NLM_F_REPLACE, Override existing */
     NMP_NLM_FLAG_F_EXCL    = 0x200, /* NLM_F_EXCL, Do not touch, if it exists */
     NMP_NLM_FLAG_F_CREATE  = 0x400, /* NLM_F_CREATE, Create, if it does not exist */
@@ -82,15 +82,15 @@ typedef enum {
     NMP_NLM_FLAG_FMASK = 0xFFFF, /* a mask for all NMP_NLM_FLAG_F_* flags */
 
     /* instructs NM to suppress logging an error message for any failures
-	 * received from kernel.
-	 *
-	 * It will still log with debug-level, and it will still log
-	 * other failures aside the kernel response. */
+     * received from kernel.
+     *
+     * It will still log with debug-level, and it will still log
+     * other failures aside the kernel response. */
     NMP_NLM_FLAG_SUPPRESS_NETLINK_FAILURE = 0x10000,
 
     /* the following aliases correspond to iproute2's `ip route CMD` for
-	 * RTM_NEWROUTE, with CMD being one of add, change, replace, prepend,
-	 * append and test. */
+     * RTM_NEWROUTE, with CMD being one of add, change, replace, prepend,
+     * append and test. */
     NMP_NLM_FLAG_ADD     = NMP_NLM_FLAG_F_CREATE | NMP_NLM_FLAG_F_EXCL,
     NMP_NLM_FLAG_CHANGE  = NMP_NLM_FLAG_F_REPLACE,
     NMP_NLM_FLAG_REPLACE = NMP_NLM_FLAG_F_CREATE | NMP_NLM_FLAG_F_REPLACE,
@@ -101,40 +101,40 @@ typedef enum {
 
 typedef enum {
     /* compare fields which kernel considers as similar routes.
-	 * It is a looser comparisong then NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID
-	 * and means that `ip route add` would fail to add two routes
-	 * that have the same NM_PLATFORM_IP_ROUTE_CMP_TYPE_WEAK_ID.
-	 * On the other hand, `ip route append` would allow that, as
-	 * long as NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID differs. */
+     * It is a looser comparisong then NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID
+     * and means that `ip route add` would fail to add two routes
+     * that have the same NM_PLATFORM_IP_ROUTE_CMP_TYPE_WEAK_ID.
+     * On the other hand, `ip route append` would allow that, as
+     * long as NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID differs. */
     NM_PLATFORM_IP_ROUTE_CMP_TYPE_WEAK_ID,
 
     /* compare two routes as kernel would allow to add them with
-	 * `ip route append`. In other words, kernel does not allow you to
-	 * add two routes (at the same time) which compare equal according
-	 * to NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID.
-	 *
-	 * For the ID we can only recognize route fields that we actually implement.
-	 * However, kernel supports more routing options, some of them also part of
-	 * the ID. NetworkManager is oblivious to these options and will wrongly think
-	 * that two routes are identical, while they are not. That can lead to an
-	 * inconsistent platform cache. Not much what we can do about that, except
-	 * implementing all options that kernel supports *sigh*. See rh#1337860.
-	 */
+     * `ip route append`. In other words, kernel does not allow you to
+     * add two routes (at the same time) which compare equal according
+     * to NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID.
+     *
+     * For the ID we can only recognize route fields that we actually implement.
+     * However, kernel supports more routing options, some of them also part of
+     * the ID. NetworkManager is oblivious to these options and will wrongly think
+     * that two routes are identical, while they are not. That can lead to an
+     * inconsistent platform cache. Not much what we can do about that, except
+     * implementing all options that kernel supports *sigh*. See rh#1337860.
+     */
     NM_PLATFORM_IP_ROUTE_CMP_TYPE_ID,
 
     /* compare all fields as they make sense for kernel. For example,
-	 * a route destination 192.168.1.5/24 is not accepted by kernel and
-	 * we treat it identical to 192.168.1.0/24. Semantically these
-	 * routes are identical, but NM_PLATFORM_IP_ROUTE_CMP_TYPE_FULL will
-	 * report them as different.
-	 *
-	 * The result shall be identical to call first nm_platform_ip_route_normalize()
-	 * on both routes and then doing a full comparison. */
+     * a route destination 192.168.1.5/24 is not accepted by kernel and
+     * we treat it identical to 192.168.1.0/24. Semantically these
+     * routes are identical, but NM_PLATFORM_IP_ROUTE_CMP_TYPE_FULL will
+     * report them as different.
+     *
+     * The result shall be identical to call first nm_platform_ip_route_normalize()
+     * on both routes and then doing a full comparison. */
     NM_PLATFORM_IP_ROUTE_CMP_TYPE_SEMANTICALLY,
 
     /* compare all fields. This should have the same effect as memcmp(),
-	 * except allowing for undefined data in holes between field alignment.
-	 */
+     * except allowing for undefined data in holes between field alignment.
+     */
     NM_PLATFORM_IP_ROUTE_CMP_TYPE_FULL,
 
 } NMPlatformIPRouteCmpType;
@@ -158,16 +158,16 @@ GBytes *      nmp_link_address_get_as_bytes(const NMPLinkAddress *addr);
 typedef enum {
 
     /* match-flags are strictly inclusive. That means,
-	 * by default nothing is matched, but if you enable a particular
-	 * flag, a candidate that matches passes the check.
-	 *
-	 * In other words: adding more flags can only extend the result
-	 * set of matching objects.
-	 *
-	 * Also, the flags form partitions. Like, an address can be either of
-	 * ADDRTYPE_NORMAL or ADDRTYPE_LINKLOCAL, but never both. Same for
-	 * the ADDRSTATE match types.
-	 */
+     * by default nothing is matched, but if you enable a particular
+     * flag, a candidate that matches passes the check.
+     *
+     * In other words: adding more flags can only extend the result
+     * set of matching objects.
+     *
+     * Also, the flags form partitions. Like, an address can be either of
+     * ADDRTYPE_NORMAL or ADDRTYPE_LINKLOCAL, but never both. Same for
+     * the ADDRSTATE match types.
+     */
     NM_PLATFORM_MATCH_WITH_NONE = 0,
 
     NM_PLATFORM_MATCH_WITH_ADDRTYPE_NORMAL    = (1LL << 0),
@@ -187,7 +187,7 @@ typedef enum {
 
 struct _NMPlatformObject {
     /* the object type has no fields of its own, it is only used to having
-	 * a special pointer type that can be used to indicate "any" type. */
+     * a special pointer type that can be used to indicate "any" type. */
     char _dummy_don_t_use_me;
 };
 
@@ -214,8 +214,8 @@ struct _NMPlatformLink {
     int master;
 
     /* rtnl_link_get_link(), IFLA_LINK.
-	 * If IFLA_LINK_NETNSID indicates that the parent is in another namespace,
-	 * this field be set to (negative) NM_PLATFORM_LINK_OTHER_NETNS. */
+     * If IFLA_LINK_NETNSID indicates that the parent is in another namespace,
+     * this field be set to (negative) NM_PLATFORM_LINK_OTHER_NETNS. */
     int parent;
 
     /* IFF_* flags. Note that the flags in 'struct ifinfomsg' are declared as 'unsigned'. */
@@ -236,8 +236,8 @@ struct _NMPlatformLink {
     NMUtilsIPv6IfaceId inet6_token;
 
     /* The bitwise inverse of rtnl_link_inet6_get_addr_gen_mode(). It is inverse
-	 * to have a default of 0 -- meaning: unspecified. That way, a struct
-	 * initialized with memset(0) has and unset value.*/
+     * to have a default of 0 -- meaning: unspecified. That way, a struct
+     * initialized with memset(0) has and unset value.*/
     guint8 inet6_addr_gen_mode_inv;
 
     /* Statistics */
@@ -247,7 +247,7 @@ struct _NMPlatformLink {
     guint64 tx_bytes;
 
     /* @connected is mostly identical to (@n_ifi_flags & IFF_UP). Except for bridge/bond masters,
-	 * where we coerce the link as disconnect if it has no slaves. */
+     * where we coerce the link as disconnect if it has no slaves. */
     bool connected : 1;
 
     bool initialized : 1;
@@ -287,35 +287,35 @@ typedef enum {
     NMIPConfigSource addr_source;                                                            \
                                                                                              \
     /* Timestamp in seconds in the reference system of nm_utils_get_monotonic_timestamp_*().
-	 *
-	 * The rules are:
-	 * 1 @lifetime==0: @timestamp and @preferred is irrelevant (but mostly set to 0 too). Such addresses
-	 *   are permanent. This rule is so that unset addresses (calloc) are permanent by default.
-	 * 2 @lifetime==@preferred==NM_PLATFORM_LIFETIME_PERMANENT: @timestamp is irrelevant (but mostly
-	 *   set to 0). Such addresses are permanent.
-	 * 3 Non permanent addresses should (almost) always have @timestamp > 0. 0 is not a valid timestamp
-	 *   and never returned by nm_utils_get_monotonic_timestamp_sec(). In this case @valid/@preferred
-	 *   is anchored at @timestamp.
-	 * 4 Non permanent addresses with @timestamp == 0 are implicitly anchored at *now*, thus the time
-	 *   moves as time goes by. This is usually not useful, except e.g. nm_platform_ip[46]_address_add().
-	 *
-	 * Non permanent addresses from DHCP/RA might have the @timestamp set to the moment of when the
-	 * lease was received. Addresses from kernel might have the @timestamp based on the last modification
-	 * time of the addresses. But don't rely on this behaviour, the @timestamp is only defined for anchoring
-	 * @lifetime and @preferred.
-	 */ \
+     *
+     * The rules are:
+     * 1 @lifetime==0: @timestamp and @preferred is irrelevant (but mostly set to 0 too). Such addresses
+     *   are permanent. This rule is so that unset addresses (calloc) are permanent by default.
+     * 2 @lifetime==@preferred==NM_PLATFORM_LIFETIME_PERMANENT: @timestamp is irrelevant (but mostly
+     *   set to 0). Such addresses are permanent.
+     * 3 Non permanent addresses should (almost) always have @timestamp > 0. 0 is not a valid timestamp
+     *   and never returned by nm_utils_get_monotonic_timestamp_sec(). In this case @valid/@preferred
+     *   is anchored at @timestamp.
+     * 4 Non permanent addresses with @timestamp == 0 are implicitly anchored at *now*, thus the time
+     *   moves as time goes by. This is usually not useful, except e.g. nm_platform_ip[46]_address_add().
+     *
+     * Non permanent addresses from DHCP/RA might have the @timestamp set to the moment of when the
+     * lease was received. Addresses from kernel might have the @timestamp based on the last modification
+     * time of the addresses. But don't rely on this behaviour, the @timestamp is only defined for anchoring
+     * @lifetime and @preferred.
+     */ \
     guint32 timestamp;                                                                       \
     guint32 lifetime;  /* seconds since timestamp */                                         \
     guint32 preferred; /* seconds since timestamp */                                         \
                                                                                              \
     /* ifa_flags in 'struct ifaddrmsg' from <linux/if_addr.h>, extended to 32 bit by
-	 * IFA_FLAGS attribute. */         \
+     * IFA_FLAGS attribute. */         \
     guint32 n_ifa_flags;                                                                     \
                                                                                              \
     guint8 plen;                                                                             \
                                                                                              \
     /* FIXME(l3cfg): the external marker won't be necessary anymore, because we only
-	 *   merge addresses we care about, and ignore (don't remove) external addresses. */         \
+     *   merge addresses we care about, and ignore (don't remove) external addresses. */         \
     bool external : 1;                                                                       \
                                                                                              \
     bool use_ip4_broadcast_address : 1;                                                      \
@@ -345,20 +345,20 @@ struct _NMPlatformIP4Address {
     in_addr_t address;
 
     /* The IFA_ADDRESS PTP peer address. This field is rather important, because
-	 * it constitutes the identifier for the IPv4 address (e.g. you can add two
-	 * addresses that only differ by their peer's network-part.
-	 *
-	 * Beware that for most cases, NetworkManager doesn't want to set an explicit
-	 * peer-address. However, that corresponds to setting the peer address to @address
-	 * itself. Leaving peer-address unset/zero, means explicitly setting the peer
-	 * address to 0.0.0.0, which you probably don't want.
-	 * */
+     * it constitutes the identifier for the IPv4 address (e.g. you can add two
+     * addresses that only differ by their peer's network-part.
+     *
+     * Beware that for most cases, NetworkManager doesn't want to set an explicit
+     * peer-address. However, that corresponds to setting the peer address to @address
+     * itself. Leaving peer-address unset/zero, means explicitly setting the peer
+     * address to 0.0.0.0, which you probably don't want.
+     * */
     in_addr_t peer_address; /* PTP peer address */
 
     /* IFA_BROADCAST.
-	 *
-	 * This parameter is ignored unless use_ip4_broadcast_address is TRUE.
-	 * See nm_platform_ip4_broadcast_address_from_addr(). */
+     *
+     * This parameter is ignored unless use_ip4_broadcast_address is TRUE.
+     * See nm_platform_ip4_broadcast_address_from_addr(). */
     in_addr_t broadcast_address;
 
     char label[NMP_IFNAMSIZ];
@@ -407,32 +407,32 @@ typedef union {
     __NMPlatformObjWithIfindex_COMMON;                                              \
                                                                                     \
     /* The NMIPConfigSource. For routes that we receive from cache this corresponds
-	 * to the rtm_protocol field (and is one of the NM_IP_CONFIG_SOURCE_RTPROT_* values).
-	 * When adding a route, the source will be coerced to the protocol using
-	 * nmp_utils_ip_config_source_coerce_to_rtprot().
-	 *
-	 * rtm_protocol is part of the primary key of an IPv4 route (meaning, you can add
-	 * two IPv4 routes that only differ in their rtm_protocol. For IPv6, that is not
-	 * the case.
-	 *
-	 * When deleting an IPv4/IPv6 route, the rtm_protocol field must match (even
-	 * if it is not part of the primary key for IPv6) -- unless rtm_protocol is set
-	 * to zero, in which case the first matching route (with proto ignored) is deleted. */ \
+     * to the rtm_protocol field (and is one of the NM_IP_CONFIG_SOURCE_RTPROT_* values).
+     * When adding a route, the source will be coerced to the protocol using
+     * nmp_utils_ip_config_source_coerce_to_rtprot().
+     *
+     * rtm_protocol is part of the primary key of an IPv4 route (meaning, you can add
+     * two IPv4 routes that only differ in their rtm_protocol. For IPv6, that is not
+     * the case.
+     *
+     * When deleting an IPv4/IPv6 route, the rtm_protocol field must match (even
+     * if it is not part of the primary key for IPv6) -- unless rtm_protocol is set
+     * to zero, in which case the first matching route (with proto ignored) is deleted. */ \
     NMIPConfigSource rt_source;                                                     \
                                                                                     \
     guint8 plen;                                                                    \
                                                                                     \
     /* RTA_METRICS:
-	 *
-	 * For IPv4 routes, these properties are part of their
-	 * ID (meaning: you can add otherwise identical IPv4 routes that
-	 * only differ by the metric property).
-	 * On the other hand, for IPv6 you cannot add two IPv6 routes that only differ
-	 * by an RTA_METRICS property.
-	 *
-	 * When deleting a route, kernel seems to ignore the RTA_METRICS properties.
-	 * That is a problem/bug for IPv4 because you cannot explicitly select which
-	 * route to delete. Kernel just picks the first. See rh#1475642. */                                                                 \
+     *
+     * For IPv4 routes, these properties are part of their
+     * ID (meaning: you can add otherwise identical IPv4 routes that
+     * only differ by the metric property).
+     * On the other hand, for IPv6 you cannot add two IPv6 routes that only differ
+     * by an RTA_METRICS property.
+     *
+     * When deleting a route, kernel seems to ignore the RTA_METRICS properties.
+     * That is a problem/bug for IPv4 because you cannot explicitly select which
+     * route to delete. Kernel just picks the first. See rh#1475642. */                                                                 \
                                                                                     \
     /* RTA_METRICS.RTAX_LOCK (iproute2: "lock" arguments) */                        \
     bool lock_window : 1;                                                           \
@@ -442,15 +442,15 @@ typedef union {
     bool lock_mtu : 1;                                                              \
                                                                                     \
     /* rtnh_flags
-	 *
-	 * Routes with rtm_flags RTM_F_CLONED are hidden by platform and
-	 * do not exist from the point-of-view of platform users.
-	 * Such a route is not alive, according to nmp_object_is_alive().
-	 *
-	 * NOTE: currently we ignore all flags except RTM_F_CLONED
-	 * and RTNH_F_ONLINK.
-	 * We also may not properly consider the flags as part of the ID
-	 * in route-cmp. */                                                                   \
+     *
+     * Routes with rtm_flags RTM_F_CLONED are hidden by platform and
+     * do not exist from the point-of-view of platform users.
+     * Such a route is not alive, according to nmp_object_is_alive().
+     *
+     * NOTE: currently we ignore all flags except RTM_F_CLONED
+     * and RTNH_F_ONLINK.
+     * We also may not properly consider the flags as part of the ID
+     * in route-cmp. */                                                                   \
     unsigned r_rtm_flags;                                                           \
                                                                                     \
     /* RTA_METRICS.RTAX_ADVMSS (iproute2: advmss) */                                \
@@ -475,17 +475,17 @@ typedef union {
     guint32 metric;                                                                 \
                                                                                     \
     /* rtm_table, RTA_TABLE.
-	 *
-	 * This is not the original table ID. Instead, 254 (RT_TABLE_MAIN) and
-	 * zero (RT_TABLE_UNSPEC) are swapped, so that the default is the main
-	 * table. Use nm_platform_route_table_coerce()/nm_platform_route_table_uncoerce(). */                                                        \
+     *
+     * This is not the original table ID. Instead, 254 (RT_TABLE_MAIN) and
+     * zero (RT_TABLE_UNSPEC) are swapped, so that the default is the main
+     * table. Use nm_platform_route_table_coerce()/nm_platform_route_table_uncoerce(). */                                                        \
     guint32 table_coerced;                                                          \
                                                                                     \
     /* rtm_type.
-	 *
-	 * This is not the original type, if type_coerced is 0 then
-	 * it means RTN_UNSPEC otherwise the type value is preserved.
-	 * */                                                                    \
+     *
+     * This is not the original type, if type_coerced is 0 then
+     * it means RTN_UNSPEC otherwise the type value is preserved.
+     * */                                                                    \
     guint8 type_coerced;                                                            \
                                                                                     \
     /*end*/
@@ -515,29 +515,29 @@ struct _NMPlatformIP4Route {
     in_addr_t gateway;
 
     /* RTA_PREFSRC (called "src" by iproute2).
-	 *
-	 * pref_src is part of the ID of an IPv4 route. When deleting a route,
-	 * pref_src must match, unless set to 0.0.0.0 to match any. */
+     *
+     * pref_src is part of the ID of an IPv4 route. When deleting a route,
+     * pref_src must match, unless set to 0.0.0.0 to match any. */
     in_addr_t pref_src;
 
     /* rtm_tos (iproute2: tos)
-	 *
-	 * For IPv4, tos is part of the weak-id (like metric).
-	 *
-	 * For IPv6, tos is ignored by kernel.  */
+     *
+     * For IPv4, tos is part of the weak-id (like metric).
+     *
+     * For IPv6, tos is ignored by kernel.  */
     guint8 tos;
 
     /* The bitwise inverse of the route scope rtm_scope. It is inverted so that the
-	 * default value (RT_SCOPE_NOWHERE) is zero. Use nm_platform_route_scope_inv()
-	 * to convert back and forth between the inverse representation and the
-	 * real value.
-	 *
-	 * rtm_scope is part of the primary key for IPv4 routes. When deleting a route,
-	 * the scope must match, unless it is left at RT_SCOPE_NOWHERE, in which case the first
-	 * matching route is deleted.
-	 *
-	 * For IPv6 routes, the scope is ignored and kernel always assumes global scope.
-	 * Hence, this field is only in NMPlatformIP4Route. */
+     * default value (RT_SCOPE_NOWHERE) is zero. Use nm_platform_route_scope_inv()
+     * to convert back and forth between the inverse representation and the
+     * real value.
+     *
+     * rtm_scope is part of the primary key for IPv4 routes. When deleting a route,
+     * the scope must match, unless it is left at RT_SCOPE_NOWHERE, in which case the first
+     * matching route is deleted.
+     *
+     * For IPv6 routes, the scope is ignored and kernel always assumes global scope.
+     * Hence, this field is only in NMPlatformIP4Route. */
     guint8 scope_inv;
 };
 
@@ -549,28 +549,28 @@ struct _NMPlatformIP6Route {
     struct in6_addr gateway;
 
     /* RTA_PREFSRC (called "src" by iproute2).
-	 *
-	 * pref_src is not part of the ID for an IPv6 route. You cannot add two
-	 * routes that only differ by pref_src.
-	 *
-	 * When deleting a route, pref_src is ignored by kernel. */
+     *
+     * pref_src is not part of the ID for an IPv6 route. You cannot add two
+     * routes that only differ by pref_src.
+     *
+     * When deleting a route, pref_src is ignored by kernel. */
     struct in6_addr pref_src;
 
     /* RTA_SRC and rtm_src_len (called "from" by iproute2).
-	 *
-	 * Kernel clears the host part of src/src_plen.
-	 *
-	 * src/src_plen is part of the ID of a route just like network/plen. That is,
-	 * Not only `ip route append`, but also `ip route add` allows to add routes that only
-	 * differ in their src/src_plen.
-	 */
+     *
+     * Kernel clears the host part of src/src_plen.
+     *
+     * src/src_plen is part of the ID of a route just like network/plen. That is,
+     * Not only `ip route append`, but also `ip route add` allows to add routes that only
+     * differ in their src/src_plen.
+     */
     struct in6_addr src;
     guint8          src_plen;
 
     /* RTA_PREF router preference.
-	 *
-	 * The type is guint8 to keep the struct size small. But the values are compatible with
-	 * the NMIcmpv6RouterPref enum. */
+     *
+     * The type is guint8 to keep the struct size small. But the values are compatible with
+     * the NMIcmpv6RouterPref enum. */
     guint8 rt_pref;
 };
 
@@ -674,7 +674,7 @@ typedef struct {
     __NMPlatformObjWithIfindex_COMMON;
 
     /* beware, kind is embedded in an NMPObject, hence you must
-	 * take care of the lifetime of the string. */
+     * take care of the lifetime of the string. */
     const char *kind;
 
     int     addr_family;
@@ -702,7 +702,7 @@ typedef struct {
 
 typedef struct {
     /* beware, kind is embedded in an NMPObject, hence you must
-	 * take care of the lifetime of the string. */
+     * take care of the lifetime of the string. */
     const char *kind;
 
     union {
@@ -718,7 +718,7 @@ typedef struct {
     __NMPlatformObjWithIfindex_COMMON;
 
     /* beware, kind is embedded in an NMPObject, hence you must
-	 * take care of the lifetime of the string. */
+     * take care of the lifetime of the string. */
     const char *kind;
 
     int              addr_family;
@@ -988,7 +988,7 @@ typedef enum {
     NM_PLATFORM_KERNEL_SUPPORT_TYPE_IFLA_BR_VLAN_STATS_ENABLED,
 
     /* this also includes FRA_SPORT_RANGE and FRA_DPORT_RANGE which
-	 * were added at the same time. */
+     * were added at the same time. */
     NM_PLATFORM_KERNEL_SUPPORT_TYPE_FRA_IP_PROTO,
 
     _NM_PLATFORM_KERNEL_SUPPORT_NUM,
@@ -1270,7 +1270,7 @@ nm_platform_ip4_broadcast_address_from_addr(const NMPlatformIP4Address *addr)
         return addr->broadcast_address;
 
     /* the set broadcast-address gets ignored, and we determine a default brd base
-	 * on the peer IFA_ADDRESS. */
+     * on the peer IFA_ADDRESS. */
     if (addr->peer_address != 0u && addr->plen < 31 /* RFC3021 */)
         return nm_platform_ip4_broadcast_address_create(addr->peer_address, addr->plen);
     return 0u;
@@ -1290,11 +1290,11 @@ static inline guint32
 nm_platform_route_table_coerce(guint32 table)
 {
     /* For kernel, the default table is RT_TABLE_MAIN (254).
-	 * We want that in NMPlatformIPRoute.table_coerced a numeric
-	 * zero is the default. Hence, @table_coerced swaps the
-	 * value 0 and 254. Use nm_platform_route_table_coerce()
-	 * and nm_platform_route_table_uncoerce() to convert between
-	 * the two domains. */
+     * We want that in NMPlatformIPRoute.table_coerced a numeric
+     * zero is the default. Hence, @table_coerced swaps the
+     * value 0 and 254. Use nm_platform_route_table_coerce()
+     * and nm_platform_route_table_uncoerce() to convert between
+     * the two domains. */
     switch (table) {
     case 0 /* RT_TABLE_UNSPEC */:
         return 254;
@@ -1334,13 +1334,13 @@ static inline gboolean
 nm_platform_route_table_is_main(guint32 table)
 {
     /* same as
-	 *   nm_platform_route_table_uncoerce (table, TRUE) == RT_TABLE_MAIN
-	 * and
-	 *   nm_platform_route_table_uncoerce (nm_platform_route_table_coerce (table), TRUE) == RT_TABLE_MAIN
-	 *
-	 * That is, the function operates the same on @table and its coerced
-	 * form.
-	 */
+     *   nm_platform_route_table_uncoerce (table, TRUE) == RT_TABLE_MAIN
+     * and
+     *   nm_platform_route_table_uncoerce (nm_platform_route_table_coerce (table), TRUE) == RT_TABLE_MAIN
+     *
+     * That is, the function operates the same on @table and its coerced
+     * form.
+     */
     return table == 0 || table == 254;
 }
 
diff --git a/src/platform/nmp-netns.c b/src/platform/nmp-netns.c
index 977211fd10..134be51502 100644
--- a/src/platform/nmp-netns.c
+++ b/src/platform/nmp-netns.c
@@ -157,7 +157,7 @@ _netns_stack_get_impl(void)
     _netns_stack = s;
 
     /* at the bottom of the stack we must try to create a netns instance
-	 * that we never pop. It's the base to which we need to return. */
+     * that we never pop. It's the base to which we need to return. */
     netns = _netns_new(&error);
     if (!netns) {
         _LOGE(NULL, "failed to create initial netns: %s", error->message);
@@ -168,8 +168,8 @@ _netns_stack_get_impl(void)
     _stack_push(s, netns, _CLONE_NS_ALL);
 
     /* finally, register a destructor function to cleanup the array. If we fail
-	 * to do so, we will leak NMPNetns instances (and their file descriptor) when the
-	 * thread exits. */
+     * to do so, we will leak NMPNetns instances (and their file descriptor) when the
+     * thread exits. */
     if (pthread_key_create(&key, (void (*)(void *)) g_array_unref) != 0)
         _LOGE(NULL, "failure to initialize thread-local storage");
     else if (pthread_setspecific(key, s) != 0)
@@ -197,7 +197,7 @@ _stack_current_netns(GArray *netns_stack, int ns_types)
     nm_assert(netns_stack && netns_stack->len > 0);
 
     /* we search the stack top-down to find the netns that has
-	 * all @ns_types set. */
+     * all @ns_types set. */
     for (j = netns_stack->len; ns_types && j >= 1;) {
         NetnsInfo *info;
 
@@ -221,7 +221,7 @@ _stack_current_ns_types(GArray *netns_stack, NMPNetns *netns, int ns_types)
     nm_assert(netns_stack && netns_stack->len > 0);
 
     /* we search the stack top-down to check which of @ns_types
-	 * are already set to @netns. */
+     * are already set to @netns. */
     for (j = netns_stack->len; ns_types && j >= 1;) {
         NetnsInfo *info;
 
@@ -508,7 +508,7 @@ nmp_netns_new(void)
 
     if (!_stack_peek(netns_stack)) {
         /* there are no netns instances. We cannot create a new one
-		 * (because after unshare we couldn't return to the original one). */
+         * (because after unshare we couldn't return to the original one). */
         errno = ENOTSUP;
         return NULL;
     }
diff --git a/src/platform/nmp-object.c b/src/platform/nmp-object.c
index b47bf86087..77e6808ea3 100644
--- a/src/platform/nmp-object.c
+++ b/src/platform/nmp-object.c
@@ -54,25 +54,25 @@ typedef struct {
 
 struct _NMPCache {
     /* the cache contains only one hash table for all object types, and similarly
-	 * it contains only one NMMultiIndex.
-	 * This works, because different object types don't ever compare equal and
-	 * because their index ids also don't overlap.
-	 *
-	 * For routes and addresses, the cache contains an address if (and only if) the
-	 * object was reported via netlink.
-	 * For links, the cache contain a link if it was reported by either netlink
-	 * or udev. That means, a link object can be alive, even if it was already
-	 * removed via netlink.
-	 *
-	 * This effectively merges the udev-device cache into the NMPCache.
-	 */
+     * it contains only one NMMultiIndex.
+     * This works, because different object types don't ever compare equal and
+     * because their index ids also don't overlap.
+     *
+     * For routes and addresses, the cache contains an address if (and only if) the
+     * object was reported via netlink.
+     * For links, the cache contain a link if it was reported by either netlink
+     * or udev. That means, a link object can be alive, even if it was already
+     * removed via netlink.
+     *
+     * This effectively merges the udev-device cache into the NMPCache.
+     */
 
     NMDedupMultiIndex *multi_idx;
 
     /* an idx_type entry for each NMP_CACHE_ID_TYPE. Note that NONE (zero)
-	 * is skipped, so the index is shifted by one: idx_type[cache_id_type - 1].
-	 *
-	 * Don't bother, use _idx_type_get() instead! */
+     * is skipped, so the index is shifted by one: idx_type[cache_id_type - 1].
+     *
+     * Don't bother, use _idx_type_get() instead! */
     DedupMultiIdxType idx_types[NMP_CACHE_ID_TYPE_MAX];
 
     gboolean use_udev;
@@ -226,9 +226,9 @@ nm_sock_addr_union_to_string(const NMSockAddrUnion *sa, char *buf, gsize len)
         return buf;
 
     /* maybe we should use getnameinfo(), but here implement it ourself.
-	 *
-	 * We want to see the actual bytes for debugging (as we understand them),
-	 * and now what getnameinfo() makes of it. Also, it's simpler this way. */
+     *
+     * We want to see the actual bytes for debugging (as we understand them),
+     * and now what getnameinfo() makes of it. Also, it's simpler this way. */
 
     switch (sa->sa.sa_family) {
     case AF_INET:
@@ -300,7 +300,7 @@ _idx_obj_part(const DedupMultiIdxType *idx_type,
     NMPObjectType obj_type;
 
     /* the hash/equals functions are strongly related. So, keep them
-	 * side-by-side and do it all in _idx_obj_part(). */
+     * side-by-side and do it all in _idx_obj_part(). */
 
     nm_assert(idx_type);
     nm_assert(idx_type->parent.klass == &_dedup_multi_idx_type_class);
@@ -321,8 +321,8 @@ _idx_obj_part(const DedupMultiIdxType *idx_type,
     case NMP_CACHE_ID_TYPE_LINK_BY_IFNAME:
         if (NMP_OBJECT_GET_TYPE(obj_a) != NMP_OBJECT_TYPE_LINK) {
             /* first check, whether obj_a is suitable for this idx_type.
-			 * If not, return 0 (which is correct for partitionable(), hash() and equal()
-			 * functions. */
+             * If not, return 0 (which is correct for partitionable(), hash() and equal()
+             * functions. */
             if (h)
                 nm_hash_update_val(h, obj_a);
             return 0;
@@ -652,7 +652,7 @@ _nmp_object_fixup_link_udev_fields(NMPObject **obj_new, NMPObject *obj_orig, gbo
     obj = *obj_new ?: obj_orig;
 
     /* The link contains internal fields that are combined by
-	 * properties from netlink and udev. Update those properties */
+     * properties from netlink and udev. Update those properties */
 
     /* When a link is not in netlink, its udev fields don't matter. */
     if (obj->_link.netlink.is_in_netlink) {
@@ -661,12 +661,12 @@ _nmp_object_fixup_link_udev_fields(NMPObject **obj_new, NMPObject *obj_orig, gbo
             initialized = TRUE;
         else if (!use_udev) {
             /* If we don't use udev, we immediately mark the link as initialized.
-			 *
-			 * For that, we consult @use_udev argument, that is cached via
-			 * nmp_cache_use_udev_get(). It is on purpose not to test
-			 * for a writable /sys on every call. A minor reason for that is
-			 * performance, but the real reason is reproducibility.
-			 * */
+             *
+             * For that, we consult @use_udev argument, that is cached via
+             * nmp_cache_use_udev_get(). It is on purpose not to test
+             * for a writable /sys on every call. A minor reason for that is
+             * performance, but the real reason is reproducibility.
+             * */
             initialized = TRUE;
         }
     }
@@ -1217,9 +1217,9 @@ _vt_cmd_obj_cmp_link(const NMPObject *obj1, const NMPObject *obj2)
             return 1;
 
         /* Only compare based on pointer values. That is ugly because it's not a
-		 * stable sort order.
-		 *
-		 * Have this check as very last. */
+         * stable sort order.
+         *
+         * Have this check as very last. */
         return (obj1->_link.udev.device < obj2->_link.udev.device) ? -1 : 1;
     }
 
@@ -1451,7 +1451,7 @@ nmp_object_id_cmp(const NMPObject *obj1, const NMPObject *obj2)
 
     if (!klass->cmd_plobj_id_cmp) {
         /* the klass doesn't implement ID cmp(). That means, different objects
-		 * never compare equal, but the cmp() according to their pointer value. */
+         * never compare equal, but the cmp() according to their pointer value. */
         NM_CMP_DIRECT_PTR(obj1, obj2);
         return 0;
     }
@@ -1525,7 +1525,7 @@ nmp_object_id_hash_update(const NMPObject *obj, NMHashState *h)
 
     if (!klass->cmd_plobj_id_hash_update) {
         /* The klass doesn't implement ID compare. It means, to use pointer
-		 * equality. */
+         * equality. */
         nm_hash_update_val(h, obj);
         return;
     }
@@ -1679,20 +1679,20 @@ static gboolean
 _vt_cmd_obj_is_alive_ipx_route(const NMPObject *obj)
 {
     /* We want to ignore routes that are RTM_F_CLONED but we still
-	 * let nmp_object_from_nl() create such route objects, instead of
-	 * returning NULL right away.
-	 *
-	 * The idea is, that if we have the same route (according to its id)
-	 * in the cache with !RTM_F_CLONED, an update that changes the route
-	 * to be RTM_F_CLONED must remove the instance.
-	 *
-	 * If nmp_object_from_nl() would just return NULL, we couldn't look
-	 * into the cache to see if it contains a route that now disappears
-	 * (because it changed to be cloned).
-	 *
-	 * Instead we create a dead object, and nmp_cache_update_netlink()
-	 * will remove the old version of the update.
-	 **/
+     * let nmp_object_from_nl() create such route objects, instead of
+     * returning NULL right away.
+     *
+     * The idea is, that if we have the same route (according to its id)
+     * in the cache with !RTM_F_CLONED, an update that changes the route
+     * to be RTM_F_CLONED must remove the instance.
+     *
+     * If nmp_object_from_nl() would just return NULL, we couldn't look
+     * into the cache to see if it contains a route that now disappears
+     * (because it changed to be cloned).
+     *
+     * Instead we create a dead object, and nmp_cache_update_netlink()
+     * will remove the old version of the update.
+     **/
     return NMP_OBJECT_CAST_IP_ROUTE(obj)->ifindex > 0
            && !NM_FLAGS_HAS(obj->ip_route.r_rtm_flags, RTM_F_CLONED);
 }
@@ -1873,7 +1873,7 @@ nmp_cache_link_connected_needs_toggle(const NMPCache * cache,
         return FALSE;
 
     /* if native IFF_LOWER_UP is down, link.connected must also be down
-	 * regardless of the slaves. */
+     * regardless of the slaves. */
     if (!NM_FLAGS_HAS(master->link.n_ifi_flags, IFF_LOWER_UP))
         return !!master->link.connected;
 
@@ -2305,13 +2305,13 @@ static NMDedupMultiIdxMode
 _obj_get_add_mode(const NMPObject *obj)
 {
     /* new objects are usually appended to the list. Except for
-	 * addresses, which are prepended during `ip address add`.
-	 *
-	 * Actually, for routes it is more complicated, because depending on
-	 * `ip route append`, `ip route replace`, `ip route prepend`, the object
-	 * will be added at the tail, at the front, or even replace an element
-	 * in the list. However, that is handled separately by nmp_cache_update_netlink_route()
-	 * and of no concern here. */
+     * addresses, which are prepended during `ip address add`.
+     *
+     * Actually, for routes it is more complicated, because depending on
+     * `ip route append`, `ip route replace`, `ip route prepend`, the object
+     * will be added at the tail, at the front, or even replace an element
+     * in the list. However, that is handled separately by nmp_cache_update_netlink_route()
+     * and of no concern here. */
     if (NM_IN_SET(NMP_OBJECT_GET_TYPE(obj),
                   NMP_OBJECT_TYPE_IP4_ADDRESS,
                   NMP_OBJECT_TYPE_IP6_ADDRESS))
@@ -2385,7 +2385,7 @@ _idxcache_update_other_cache_ids(NMPCache *       cache,
         if (obj_old && nm_dedup_multi_idx_type_id_equal(idx_type, obj_old, obj_new)
             && nm_dedup_multi_idx_type_partition_equal(idx_type, obj_old, obj_new)) {
             /* optimize. We just looked up the @obj_old entry and @obj_new compares equal
-			 * according to idx_obj_id_equal(). entry_new is the same as entry_old. */
+             * according to idx_obj_id_equal(). entry_new is the same as entry_old. */
             entry_new = entry_old;
         } else {
             entry_new = nm_dedup_multi_index_lookup_obj(cache->multi_idx, idx_type, obj_new);
@@ -2440,9 +2440,9 @@ _idxcache_update(NMPCache *                cache,
     nm_auto_nmpobj const NMPObject *obj_old = NULL;
 
     /* we update an object in the cache.
-	 *
-	 * Note that @entry_old MUST be what is currently tracked in multi_idx, and it must
-	 * have the same ID as @obj_new. */
+     *
+     * Note that @entry_old MUST be what is currently tracked in multi_idx, and it must
+     * have the same ID as @obj_new. */
 
     nm_assert(cache);
     nm_assert(entry_old || obj_new);
@@ -2469,11 +2469,11 @@ _idxcache_update(NMPCache *                cache,
         obj_old = nmp_object_ref(entry_old->obj);
 
     /* first update the main index NMP_CACHE_ID_TYPE_OBJECT_TYPE.
-	 * We already know the pre-existing @entry old, so all that
-	 * nm_dedup_multi_index_add_full() effectively does, is update the
-	 * obj reference.
-	 *
-	 * We also get the new boxed object, which we need below. */
+     * We already know the pre-existing @entry old, so all that
+     * nm_dedup_multi_index_add_full() effectively does, is update the
+     * obj reference.
+     *
+     * We also get the new boxed object, which we need below. */
     if (obj_new) {
         nm_auto_nmpobj NMPObject *obj_old2 = NULL;
 
@@ -2494,7 +2494,7 @@ _idxcache_update(NMPCache *                cache,
         nm_dedup_multi_index_remove_entry(cache->multi_idx, entry_old);
 
     /* now update all other indexes. We know the previously boxed entry, and the
-	 * newly boxed one. */
+     * newly boxed one. */
     klass = NMP_OBJECT_GET_CLASS(entry_new ? entry_new->obj : obj_old);
     for (i_idx_type = klass->supported_cache_ids; *i_idx_type; i_idx_type++) {
         NMPCacheIdType id_type = *i_idx_type;
@@ -2534,7 +2534,7 @@ nmp_cache_remove(NMPCache *        cache,
 
     if (equals_by_ptr && obj_old != obj_needle) {
         /* We found an identical object, but we only delete it if it's the same pointer as
-		 * @obj_needle. */
+         * @obj_needle. */
         return NMP_CACHE_OPS_UNCHANGED;
     }
     if (only_dirty && !entry_old->dirty) {
@@ -2568,9 +2568,9 @@ nmp_cache_remove_netlink(NMPCache *        cache,
 
     if (NMP_OBJECT_GET_TYPE(obj_needle) == NMP_OBJECT_TYPE_LINK) {
         /* For nmp_cache_remove_netlink() we have an incomplete @obj_needle instance to be
-		 * removed from netlink. Link objects are alive without being in netlink when they
-		 * have a udev-device. All we want to do in this case is clear the netlink.is_in_netlink
-		 * flag. */
+         * removed from netlink. Link objects are alive without being in netlink when they
+         * have a udev-device. All we want to do in this case is clear the netlink.is_in_netlink
+         * flag. */
 
         NM_SET_OUT(out_obj_old, nmp_object_ref(obj_old));
 
@@ -2647,8 +2647,8 @@ nmp_cache_update_netlink(NMPCache *        cache,
     nm_assert(NMP_OBJECT_IS_VALID(obj_hand_over));
     nm_assert(!NMP_OBJECT_IS_STACKINIT(obj_hand_over));
     /* A link object from netlink must have the udev related fields unset.
-	 * We could implement to handle that, but there is no need to support such
-	 * a use-case */
+     * We could implement to handle that, but there is no need to support such
+     * a use-case */
     nm_assert(NMP_OBJECT_GET_TYPE(obj_hand_over) != NMP_OBJECT_TYPE_LINK
               || (!obj_hand_over->_link.udev.device && !obj_hand_over->link.driver));
     nm_assert(nm_dedup_multi_index_obj_find(cache->multi_idx, obj_hand_over) != obj_hand_over);
@@ -2685,14 +2685,14 @@ nmp_cache_update_netlink(NMPCache *        cache,
             }
             if (obj_old->_link.udev.device) {
                 /* @obj_hand_over is not in netlink.
-				 *
-				 * This is similar to nmp_cache_remove_netlink(), but there we preserve the
-				 * preexisting netlink properties. The use case of that is when kernel_get_object()
-				 * cannot load an object (based on the id of a needle).
-				 *
-				 * Here we keep the data provided from @obj_hand_over. The usecase is when receiving
-				 * a valid @obj_hand_over instance from netlink with RTM_DELROUTE.
-				 */
+                 *
+                 * This is similar to nmp_cache_remove_netlink(), but there we preserve the
+                 * preexisting netlink properties. The use case of that is when kernel_get_object()
+                 * cannot load an object (based on the id of a needle).
+                 *
+                 * Here we keep the data provided from @obj_hand_over. The usecase is when receiving
+                 * a valid @obj_hand_over instance from netlink with RTM_DELROUTE.
+                 */
                 is_alive = TRUE;
             } else
                 is_alive = FALSE;
@@ -2765,8 +2765,8 @@ nmp_cache_update_netlink_route(NMPCache *        cache,
     nm_assert(NMP_OBJECT_IS_VALID(obj_hand_over));
     nm_assert(!NMP_OBJECT_IS_STACKINIT(obj_hand_over));
     /* A link object from netlink must have the udev related fields unset.
-	 * We could implement to handle that, but there is no need to support such
-	 * a use-case */
+     * We could implement to handle that, but there is no need to support such
+     * a use-case */
     nm_assert(NM_IN_SET(NMP_OBJECT_GET_TYPE(obj_hand_over),
                         NMP_OBJECT_TYPE_IP4_ROUTE,
                         NMP_OBJECT_TYPE_IP6_ROUTE));
@@ -2809,12 +2809,12 @@ update_done:
     NM_SET_OUT(out_obj_new, nmp_object_ref(nm_dedup_multi_entry_get_obj(entry_new)));
 
     /* a RTM_GETROUTE event may signal that another object was replaced.
-	 * Find out whether that is the case and return it as @obj_replaced.
-	 *
-	 * Also, fixup the order of @entry_new within NMP_CACHE_ID_TYPE_ROUTES_BY_WEAK_ID
-	 * index. For most parts, we don't care about the order of objects (including routes).
-	 * But NMP_CACHE_ID_TYPE_ROUTES_BY_WEAK_ID we must keep in the correct order, to
-	 * properly find @obj_replaced. */
+     * Find out whether that is the case and return it as @obj_replaced.
+     *
+     * Also, fixup the order of @entry_new within NMP_CACHE_ID_TYPE_ROUTES_BY_WEAK_ID
+     * index. For most parts, we don't care about the order of objects (including routes).
+     * But NMP_CACHE_ID_TYPE_ROUTES_BY_WEAK_ID we must keep in the correct order, to
+     * properly find @obj_replaced. */
     resync_required = FALSE;
     entry_replace   = NULL;
     if (is_dump)
@@ -2824,15 +2824,15 @@ update_done:
         if (NM_FLAGS_HAS(nlmsgflags, NLM_F_REPLACE)
             && nmp_cache_lookup_all(cache, NMP_CACHE_ID_TYPE_ROUTES_BY_WEAK_ID, obj_hand_over)) {
             /* hm. @obj_hand_over was not added, meaning it was not alive.
-			 * However, we track some other objects with the same weak-id.
-			 * It's unclear what that means. To be sure, resync. */
+             * However, we track some other objects with the same weak-id.
+             * It's unclear what that means. To be sure, resync. */
             resync_required = TRUE;
         }
         goto out;
     }
 
     /* FIXME: for routes, we only maintain the order correctly for the BY_WEAK_ID
-	 * index. For all other indexes their order becomes messed up. */
+     * index. For all other indexes their order becomes messed up. */
     entry_cur =
         _lookup_entry_with_idx_type(cache, NMP_CACHE_ID_TYPE_ROUTES_BY_WEAK_ID, entry_new->obj);
     if (!entry_cur) {
diff --git a/src/platform/nmp-object.h b/src/platform/nmp-object.h
index 660c0ad367..e6c664fb7c 100644
--- a/src/platform/nmp-object.h
+++ b/src/platform/nmp-object.h
@@ -120,44 +120,44 @@ typedef enum { /*< skip >*/
                NMP_CACHE_ID_TYPE_NONE,
 
                /* all the objects of a certain type.
-	 *
-	 * This index is special. It is the only one that contains *all* object.
-	 * Other indexes may consider some object as non "partitionable", hence
-	 * they don't track all objects.
-	 *
-	 * Hence, this index type is used when looking at all objects (still
-	 * partitioned by type).
-	 *
-	 * Also, note that links may be considered invisible. This index type
-	 * expose all links, even invisible ones. For addresses/routes, this
-	 * distinction doesn't exist, as all addresses/routes that are alive
-	 * are visible as well. */
+     *
+     * This index is special. It is the only one that contains *all* object.
+     * Other indexes may consider some object as non "partitionable", hence
+     * they don't track all objects.
+     *
+     * Hence, this index type is used when looking at all objects (still
+     * partitioned by type).
+     *
+     * Also, note that links may be considered invisible. This index type
+     * expose all links, even invisible ones. For addresses/routes, this
+     * distinction doesn't exist, as all addresses/routes that are alive
+     * are visible as well. */
                NMP_CACHE_ID_TYPE_OBJECT_TYPE,
 
                /* index for the link objects by ifname. */
                NMP_CACHE_ID_TYPE_LINK_BY_IFNAME,
 
                /* indices for the visible default-routes, ignoring ifindex.
-	 * This index only contains two partitions: all visible default-routes,
-	 * separate for IPv4 and IPv6. */
+     * This index only contains two partitions: all visible default-routes,
+     * separate for IPv4 and IPv6. */
                NMP_CACHE_ID_TYPE_DEFAULT_ROUTES,
 
                /* all the objects that have an ifindex (by object-type) for an ifindex. */
                NMP_CACHE_ID_TYPE_OBJECT_BY_IFINDEX,
 
                /* Consider all the destination fields of a route, that is, the ID without the ifindex
-	 * and gateway (meaning: network/plen,metric).
-	 * The reason for this is that `ip route change` can replace an existing route
-	 * and modify its ifindex/gateway. Effectively, that means it deletes an existing
-	 * route and adds a different one (as the ID of the route changes). However, it only
-	 * sends one RTM_NEWADDR notification without notifying about the deletion. We detect
-	 * that by having this index to contain overlapping routes which require special
-	 * cache-resync. */
+     * and gateway (meaning: network/plen,metric).
+     * The reason for this is that `ip route change` can replace an existing route
+     * and modify its ifindex/gateway. Effectively, that means it deletes an existing
+     * route and adds a different one (as the ID of the route changes). However, it only
+     * sends one RTM_NEWADDR notification without notifying about the deletion. We detect
+     * that by having this index to contain overlapping routes which require special
+     * cache-resync. */
                NMP_CACHE_ID_TYPE_ROUTES_BY_WEAK_ID,
 
                /* a filter for objects that track an explicit address family.
-	 *
-	 * Note that currently on NMPObjectRoutingRule is indexed by this filter. */
+     *
+     * Note that currently on NMPObjectRoutingRule is indexed by this filter. */
                NMP_CACHE_ID_TYPE_OBJECT_BY_ADDR_FAMILY,
 
                __NMP_CACHE_ID_TYPE_MAX,
@@ -215,21 +215,21 @@ typedef struct {
 
     struct {
         /* note that "struct udev_device" references the library context
-		 * "struct udev", but doesn't own it.
-		 *
-		 * Hence, the udev.device shall not be used after the library
-		 * context is destroyed.
-		 *
-		 * In case of NMPObjectLink instances that you obtained from the
-		 * platform cache, that means that you shall no keep references
-		 * to those instances that outlife the NMPlatform instance.
-		 *
-		 * In practice, the requirement is less strict and you'll be even
-		 * fine if the platform instance (and the "struct udev" instance)
-		 * are already destroyed while you still hold onto a reference to
-		 * the NMPObjectLink instance. Just don't make use of udev functions
-		 * that cause access to the udev library context.
-		 */
+         * "struct udev", but doesn't own it.
+         *
+         * Hence, the udev.device shall not be used after the library
+         * context is destroyed.
+         *
+         * In case of NMPObjectLink instances that you obtained from the
+         * platform cache, that means that you shall no keep references
+         * to those instances that outlife the NMPlatform instance.
+         *
+         * In practice, the requirement is less strict and you'll be even
+         * fine if the platform instance (and the "struct udev" instance)
+         * are already destroyed while you still hold onto a reference to
+         * the NMPObjectLink instance. Just don't make use of udev functions
+         * that cause access to the udev library context.
+         */
         struct udev_device *device;
     } udev;
 
@@ -237,8 +237,8 @@ typedef struct {
     GObject *ext_data;
 
     /* FIXME: not every NMPObjectLink should pay the price for tracking
-	 * the wireguard family id. This should be tracked via ext_data, which
-	 * would be exactly the right place. */
+     * the wireguard family id. This should be tracked via ext_data, which
+     * would be exactly the right place. */
     int wireguard_family_id;
 } NMPObjectLink;
 
@@ -447,7 +447,7 @@ NMP_OBJECT_IS_VALID(const NMPObject *obj)
     nm_assert(!obj || (obj && obj->parent._ref_count > 0 && NMP_CLASS_IS_VALID(obj->_class)));
 
     /* There isn't really much to check. Either @obj is NULL, or we must
-	 * assume that it points to valid memory. */
+     * assume that it points to valid memory. */
     return obj != NULL;
 }
 
@@ -589,9 +589,9 @@ nmp_object_ref(const NMPObject *obj)
     }
 
     /* ref and unref accept const pointers. NMPObject is supposed to be shared
-	 * and kept immutable. Disallowing to take/return a reference to a const
-	 * NMPObject is cumbersome, because callers are precisely expected to
-	 * keep a ref on the otherwise immutable object. */
+     * and kept immutable. Disallowing to take/return a reference to a const
+     * NMPObject is cumbersome, because callers are precisely expected to
+     * keep a ref on the otherwise immutable object. */
     g_return_val_if_fail(NMP_OBJECT_IS_VALID(obj), NULL);
     g_return_val_if_fail(obj->parent._ref_count != NM_OBJ_REF_COUNT_STACKINIT, NULL);
 
@@ -863,7 +863,7 @@ nmp_cache_reresolve_main_entry(NMPCache *               cache,
     }
 
     /* we only track the dirty flag for the OBJECT-TYPE index. That means,
-	 * for other lookup types we need to check the dirty flag of the main-entry. */
+     * for other lookup types we need to check the dirty flag of the main-entry. */
     main_entry = nmp_cache_lookup_entry(cache, entry->obj);
 
     nm_assert(main_entry);
@@ -1045,12 +1045,12 @@ nmp_object_ip_route_is_best_defaut_route(const NMPObject *obj)
     const NMPlatformIPRoute *r = NMP_OBJECT_CAST_IP_ROUTE(obj);
 
     /* return whether @obj is considered a default-route.
-	 *
-	 * NMIP4Config/NMIP6Config tracks the (best) default-route explicitly, because
-	 * at various places we act differently depending on whether there is a default-route
-	 * configured.
-	 *
-	 * Note that this only considers the main routing table. */
+     *
+     * NMIP4Config/NMIP6Config tracks the (best) default-route explicitly, because
+     * at various places we act differently depending on whether there is a default-route
+     * configured.
+     *
+     * Note that this only considers the main routing table. */
     return r && NM_PLATFORM_IP_ROUTE_IS_DEFAULT(r)
            && nm_platform_route_table_is_main(r->table_coerced)
            && r->type_coerced == nm_platform_route_type_coerce(1 /* RTN_UNICAST */);
diff --git a/src/platform/nmp-rules-manager.c b/src/platform/nmp-rules-manager.c
index 84f1a35d34..3bb14d380d 100644
--- a/src/platform/nmp-rules-manager.c
+++ b/src/platform/nmp-rules-manager.c
@@ -66,18 +66,18 @@ typedef struct {
     CList            user_tag_lst;
 
     /* track_priority_val zero is special: those are weakly tracked rules.
-	 * That means: NetworkManager will restore them only if it removed them earlier.
-	 * But it will not remove or add them otherwise.
-	 *
-	 * Otherwise, the track_priority_val goes together with track_priority_present.
-	 * In case of one rule being tracked multiple times (with different priorities),
-	 * the one with higher priority wins. See _rules_obj_get_best_data().
-	 * Then, the winning present state either enforces that the rule is present
-	 * or absent.
-	 *
-	 * If a rules is not tracked at all, it is ignored by NetworkManager. Assuming
-	 * that it was added externally by the user. But unlike weakly tracked rules,
-	 * NM will *not* restore such rules if NetworkManager themself removed them. */
+     * That means: NetworkManager will restore them only if it removed them earlier.
+     * But it will not remove or add them otherwise.
+     *
+     * Otherwise, the track_priority_val goes together with track_priority_present.
+     * In case of one rule being tracked multiple times (with different priorities),
+     * the one with higher priority wins. See _rules_obj_get_best_data().
+     * Then, the winning present state either enforces that the rule is present
+     * or absent.
+     *
+     * If a rules is not tracked at all, it is ignored by NetworkManager. Assuming
+     * that it was added externally by the user. But unlike weakly tracked rules,
+     * NM will *not* restore such rules if NetworkManager themself removed them. */
     guint32 track_priority_val;
     bool    track_priority_present : 1;
 
@@ -90,14 +90,14 @@ typedef enum {
     CONFIG_STATE_REMOVED_BY_US = 2,
 
     /* ConfigState encodes whether the rule was touched by us at all (CONFIG_STATE_NONE).
-	 *
-	 * Maybe we would only need to track whether we touched the rule at all. But we
-	 * track it more in detail what we did: did we add it (CONFIG_STATE_ADDED_BY_US)
-	 * or did we remove it (CONFIG_STATE_REMOVED_BY_US)?
-	 * Finally, we need CONFIG_STATE_OWNED_BY_US, which means that we didn't actively
-	 * add/remove it, but whenever we are about to undo the add/remove, we need to do it.
-	 * In that sense, CONFIG_STATE_OWNED_BY_US is really just a flag that we unconditionally
-	 * force the state next time when necessary. */
+     *
+     * Maybe we would only need to track whether we touched the rule at all. But we
+     * track it more in detail what we did: did we add it (CONFIG_STATE_ADDED_BY_US)
+     * or did we remove it (CONFIG_STATE_REMOVED_BY_US)?
+     * Finally, we need CONFIG_STATE_OWNED_BY_US, which means that we didn't actively
+     * add/remove it, but whenever we are about to undo the add/remove, we need to do it.
+     * In that sense, CONFIG_STATE_OWNED_BY_US is really just a flag that we unconditionally
+     * force the state next time when necessary. */
     CONFIG_STATE_OWNED_BY_US = 3,
 } ConfigState;
 
@@ -106,15 +106,15 @@ typedef struct {
     CList            obj_lst_head;
 
     /* indicates whether we configured/removed the rule (during sync()). We need that, so
-	 * if the rule gets untracked, that we know to remove/restore it.
-	 *
-	 * This makes NMPRulesManager stateful (beyond the configuration that indicates
-	 * which rules are tracked).
-	 * After a restart, NetworkManager would no longer remember which rules were added
-	 * by us.
-	 *
-	 * That is partially fixed by NetworkManager taking over the rules that it
-	 * actively configures (see %NMP_RULES_MANAGER_EXTERN_WEAKLY_TRACKED_USER_TAG). */
+     * if the rule gets untracked, that we know to remove/restore it.
+     *
+     * This makes NMPRulesManager stateful (beyond the configuration that indicates
+     * which rules are tracked).
+     * After a restart, NetworkManager would no longer remember which rules were added
+     * by us.
+     *
+     * That is partially fixed by NetworkManager taking over the rules that it
+     * actively configures (see %NMP_RULES_MANAGER_EXTERN_WEAKLY_TRACKED_USER_TAG). */
     ConfigState config_state;
 } RulesObjData;
 
@@ -203,7 +203,7 @@ _rules_obj_get_best_data(RulesObjData *obj_data)
             if (rd_best->track_priority_val == rules_data->track_priority_val) {
                 if (rd_best->track_priority_present || !rules_data->track_priority_present) {
                     /* if the priorities are identical, then "present" wins over
-					 * "!present" (absent). */
+                     * "!present" (absent). */
                     continue;
                 }
             }
@@ -449,14 +449,14 @@ _rules_data_untrack(NMPRulesManager *self,
     if (make_owned_by_us) {
         if (obj_data->config_state == CONFIG_STATE_NONE) {
             /* we need to mark this entry that it requires a touch on the next
-			 * sync. */
+             * sync. */
             obj_data->config_state = CONFIG_STATE_OWNED_BY_US;
         }
     } else if (remove_user_tag_data && c_list_length_is(&rules_data->user_tag_lst, 1))
         g_hash_table_remove(self->by_user_tag, &rules_data->user_tag);
 
     /* if obj_data is marked to be "added_by_us" or "removed_by_us", we need to keep this entry
-	 * around for the next sync -- so that we can undo what we did earlier. */
+     * around for the next sync -- so that we can undo what we did earlier. */
     if (obj_data->config_state == CONFIG_STATE_NONE && c_list_length_is(&rules_data->obj_lst, 1))
         g_hash_table_remove(self->by_obj, &rules_data->obj);
 
@@ -563,7 +563,7 @@ nmp_rules_manager_sync(NMPRulesManager *self, gboolean keep_deleted_rules)
 
             if (!obj_data) {
                 /* this rule is not tracked. It was externally added, hence we
-				 * ignore it. */
+                 * ignore it. */
                 continue;
             }
 
diff --git a/src/platform/tests/test-address.c b/src/platform/tests/test-address.c
index bd0964217d..311d61013d 100644
--- a/src/platform/tests/test-address.c
+++ b/src/platform/tests/test-address.c
@@ -233,8 +233,8 @@ test_ip4_address_general_2(void)
     g_assert(ifindex > 0);
 
     /* Looks like addresses are not announced by kernel when the interface
-	 * is down. Link-local IPv6 address is automatically added.
-	 */
+     * is down. Link-local IPv6 address is automatically added.
+     */
     g_assert(nm_platform_link_set_up(NM_PLATFORM_GET, DEVICE_IFINDEX, NULL));
 
     /* Add/delete notification */
diff --git a/src/platform/tests/test-common.c b/src/platform/tests/test-common.c
index 5363eaa252..97c4c4541b 100644
--- a/src/platform/tests/test-common.c
+++ b/src/platform/tests/test-common.c
@@ -790,14 +790,14 @@ nmtstp_wait_for_signal(NMPlatform *platform, gint64 timeout_msec)
                                   &data);
 
     /* if timeout_msec is negative, it means the wait-time already expired.
-	 * Maybe, we should do nothing and return right away, without even
-	 * processing events from platform. However, that inconsistency (of not
-	 * processing events from mainloop) is inconvenient.
-	 *
-	 * It's better that on the return of nmtstp_wait_for_signal(), we always
-	 * have no events pending. So, a negative timeout is treated the same as
-	 * a zero timeout: we check whether there are any events pending in platform,
-	 * and quite the mainloop immediately afterwards. But we always check. */
+     * Maybe, we should do nothing and return right away, without even
+     * processing events from platform. However, that inconsistency (of not
+     * processing events from mainloop) is inconvenient.
+     *
+     * It's better that on the return of nmtstp_wait_for_signal(), we always
+     * have no events pending. So, a negative timeout is treated the same as
+     * a zero timeout: we check whether there are any events pending in platform,
+     * and quite the mainloop immediately afterwards. But we always check. */
 
     data.id = g_timeout_add(CLAMP(timeout_msec, 0, G_MAXUINT32), _wait_for_signal_timeout, &data);
 
@@ -880,7 +880,7 @@ nmtstp_wait_for_link_until(NMPlatform *platform,
 
         waited_once = TRUE;
         /* regardless of whether timeout is already reached, we poll the netlink
-		 * socket a bit. */
+         * socket a bit. */
         nmtstp_wait_for_signal(platform, until_ms - now);
     }
 }
@@ -1951,8 +1951,8 @@ nmtstp_link_tun_add(NMPlatform *            platform,
 
     if (!lnk->persist) {
         /* ip tuntap does not support non-persistent devices.
-		 *
-		 * Add this device only via NMPlatform. */
+         *
+         * Add this device only via NMPlatform. */
         if (external_command == -1)
             external_command = FALSE;
     }
@@ -1981,7 +1981,7 @@ nmtstp_link_tun_add(NMPlatform *            platform,
             lnk->multi_queue ? " multi_queue" : "",
             name);
         /* Older versions of iproute2 don't support adding  devices.
-		 * On failure, fallback to using platform code. */
+         * On failure, fallback to using platform code. */
         if (err == 0)
             pllink = nmtstp_assert_wait_for_link(platform, name, NM_LINK_TYPE_TUN, 100);
         else
@@ -2088,7 +2088,7 @@ nmtstp_link_vxlan_add(NMPlatform *              platform,
                                  lnk->src_port_max,
                                  lnk->ageing);
         /* Older versions of iproute2 don't support adding vxlan devices.
-		 * On failure, fallback to using platform code. */
+         * On failure, fallback to using platform code. */
         if (err == 0)
             pllink = nmtstp_assert_wait_for_link(platform, name, NM_LINK_TYPE_VXLAN, 100);
         else
@@ -2491,7 +2491,7 @@ unshare_user(void)
         return FALSE;
 
     /* Since Linux 3.19 we have to disable setgroups() in order to map users.
-	 * Just proceed if the file is not there. */
+     * Just proceed if the file is not there. */
     f = fopen("/proc/self/setgroups", "we");
     if (f) {
         fprintf(f, "deny");
diff --git a/src/platform/tests/test-link.c b/src/platform/tests/test-link.c
index 7713f44802..f93250bff1 100644
--- a/src/platform/tests/test-link.c
+++ b/src/platform/tests/test-link.c
@@ -174,14 +174,14 @@ test_link_changed_signal_cb(NMPlatform *              platform,
     const NMPlatformSignalChangeType change_type = change_type_i;
 
     /* test invocation of platform signals with multiple listeners
-	 * connected to the signal. Platform signals have enum-typed
-	 * arguments and there seem to be an issue with invoking such
-	 * signals on s390x and ppc64 archs.
-	 * https://bugzilla.redhat.com/show_bug.cgi?id=1260577
-	 *
-	 * As the test shows, the failure is not reproducible for
-	 * platform signals.
-	 */
+     * connected to the signal. Platform signals have enum-typed
+     * arguments and there seem to be an issue with invoking such
+     * signals on s390x and ppc64 archs.
+     * https://bugzilla.redhat.com/show_bug.cgi?id=1260577
+     *
+     * As the test shows, the failure is not reproducible for
+     * platform signals.
+     */
     g_assert(NM_IS_PLATFORM(platform));
     g_assert(platform == NM_PLATFORM_GET);
 
@@ -226,9 +226,9 @@ test_slave(int master, int type, SignalData *master_changed)
     accept_signal(link_added);
 
     /* Set the slave up to see whether master's IFF_LOWER_UP is set correctly.
-	 *
-	 * See https://bugzilla.redhat.com/show_bug.cgi?id=910348
-	 */
+     *
+     * See https://bugzilla.redhat.com/show_bug.cgi?id=910348
+     */
     g_assert(!nm_platform_link_is_up(NM_PLATFORM_GET, ifindex));
     g_assert(nm_platform_link_set_down(NM_PLATFORM_GET, ifindex));
     g_assert(!nm_platform_link_is_up(NM_PLATFORM_GET, ifindex));
@@ -274,10 +274,10 @@ test_slave(int master, int type, SignalData *master_changed)
     g_assert(test_link_changed_signal_arg2);
 
     /* Master with a disconnected slave is disconnected
-	 *
-	 * For some reason, bonding and teaming slaves are automatically set up. We
-	 * need to set them back down for this test.
-	 */
+     *
+     * For some reason, bonding and teaming slaves are automatically set up. We
+     * need to set them back down for this test.
+     */
     switch (nm_platform_link_get_type(NM_PLATFORM_GET, master)) {
     case NM_LINK_TYPE_BOND:
     case NM_LINK_TYPE_TEAM:
@@ -293,8 +293,8 @@ test_slave(int master, int type, SignalData *master_changed)
     if (nmtstp_is_root_test() && nm_platform_link_is_connected(NM_PLATFORM_GET, master)) {
         if (nm_platform_link_get_type(NM_PLATFORM_GET, master) == NM_LINK_TYPE_TEAM) {
             /* Older team versions (e.g. Fedora 17) have a bug that team master stays
-			 * IFF_LOWER_UP even if its slave is down. Double check it with iproute2 and if
-			 * `ip link` also claims master to be up, accept it. */
+             * IFF_LOWER_UP even if its slave is down. Double check it with iproute2 and if
+             * `ip link` also claims master to be up, accept it. */
             char *stdout_str = NULL;
 
             nmtst_spawn_sync(NULL,
@@ -322,9 +322,9 @@ test_slave(int master, int type, SignalData *master_changed)
     accept_signals(master_changed, 0, 3);
 
     /* Enslave again
-	 *
-	 * Gracefully succeed if already enslaved.
-	 */
+     *
+     * Gracefully succeed if already enslaved.
+     */
     ensure_no_signal(link_changed);
     g_assert(nm_platform_link_enslave(NM_PLATFORM_GET, master, ifindex));
     accept_signals(link_changed, 0, 2);
@@ -357,7 +357,7 @@ test_slave(int master, int type, SignalData *master_changed)
         accept_signals(link_removed, 0, 1);
     } else {
         /* Due to https://bugzilla.redhat.com/show_bug.cgi?id=1285719 , kernel might send a
-		 * wrong RTM_DELLINK message so that we instead see an removed+added signal. */
+         * wrong RTM_DELLINK message so that we instead see an removed+added signal. */
         accept_signal(link_added);
         ensure_no_signal(link_changed);
         accept_signal(link_removed);
@@ -524,7 +524,7 @@ static int
 _system(const char *cmd)
 {
     /* some gcc version really want to warn on -Werror=unused-result. Add a bogus wrapper
-	 * function. */
+     * function. */
     return system(cmd);
 }
 
@@ -1475,11 +1475,11 @@ test_software_detect(gconstpointer user_data)
         lnk_macvlan.tap        = FALSE;
 
         /* Since in old kernel versions sysfs files for macvtaps are not
-		 * namespaced, the creation can fail if a macvtap in another namespace
-		 * has the same index. Try to detect this situation and skip already
-		 * used indexes.
-		 * The fix (17af2bce) is included kernel 4.7, dated 24 July, 2016.
-		 */
+         * namespaced, the creation can fail if a macvtap in another namespace
+         * has the same index. Try to detect this situation and skip already
+         * used indexes.
+         * The fix (17af2bce) is included kernel 4.7, dated 24 July, 2016.
+         */
         for (i = ifindex_parent + 1; i < ifindex_parent + 100; i++) {
             snprintf(buf, sizeof(buf), "/sys/class/macvtap/tap%d", i);
             if (!g_file_test(buf, G_FILE_TEST_IS_SYMLINK))
@@ -1605,7 +1605,7 @@ test_software_detect(gconstpointer user_data)
                 .multi_queue = nmtst_get_rand_bool(),
 
                 /* if we add the device via iproute2 (external), we can only
-				 * create persistent devices. */
+                 * create persistent devices. */
                 .persist = (ext == 1) ? TRUE : nmtst_get_rand_bool(),
             };
             break;
@@ -1654,8 +1654,8 @@ test_software_detect(gconstpointer user_data)
 
             if (test_data->link_type == NM_LINK_TYPE_VXLAN && set_up) {
                 /* On RHEL-7, we need to add a tiny sleep here, otherwise,
-				 * upping the vxlan device fails with EADDRINUSE.
-				 * https://bugzilla.redhat.com/show_bug.cgi?id=1277131 */
+                 * upping the vxlan device fails with EADDRINUSE.
+                 * https://bugzilla.redhat.com/show_bug.cgi?id=1277131 */
                 g_usleep(1);
             }
             nmtstp_link_set_updown(NULL, -1, ifindex, set_up);
@@ -1667,7 +1667,7 @@ test_software_detect(gconstpointer user_data)
 
         if (!lnk && test_data->link_type == NM_LINK_TYPE_TUN) {
             /* this is ok. Kernel apparently does not support tun properties via netlink. We
-			 * fetch them from sysfs below. */
+             * fetch them from sysfs below. */
         } else
             g_assert(lnk);
 
@@ -1833,8 +1833,8 @@ test_software_detect(gconstpointer user_data)
                      == nm_platform_link_get_lnk_tun(NM_PLATFORM_GET, ifindex, NULL));
 
             /* kernel might not expose tun options via netlink. Either way, try
-			 * to read them (either from platform cache, or fallback to sysfs).
-			 * See also: rh#1547213. */
+             * to read them (either from platform cache, or fallback to sysfs).
+             * See also: rh#1547213. */
             if (!nm_platform_link_tun_get_properties(NM_PLATFORM_GET, ifindex, &lnk_tun2))
                 g_assert_not_reached();
 
@@ -1844,9 +1844,9 @@ test_software_detect(gconstpointer user_data)
 
             if (i_step == 0) {
                 /* Before we upped the device for the first time the kernel didn't notify
-				 * us of the owner set after the link creation:
-				 * https://bugzilla.redhat.com/show_bug.cgi?id=1566062
-				 */
+                 * us of the owner set after the link creation:
+                 * https://bugzilla.redhat.com/show_bug.cgi?id=1566062
+                 */
                 break;
             }
 
@@ -1895,7 +1895,7 @@ test_software_detect(gconstpointer user_data)
                 g_assert_cmpint(plnk->dst_port, ==, 4789);
                 if (plnk->src_port_min != 0 || plnk->src_port_max != 0) {
                     /* on some kernels, omitting the port range results in setting
-					 * following default port range. */
+                     * following default port range. */
                     g_assert_cmpint(plnk->src_port_min, ==, 32768);
                     g_assert_cmpint(plnk->src_port_max, ==, 61000);
                 }
@@ -2426,8 +2426,8 @@ test_create_many_links_do(guint n_devices)
         nm_sprintf_buf(name, "t-%05u", i);
         if (EX == 2) {
             /* This mode is different from letting nmtstp_link_dummy_add()
-			 * because in this case we don't process any platform events
-			 * while adding all the links. */
+             * because in this case we don't process any platform events
+             * while adding all the links. */
             nmtstp_run_command_check("ip link add %s type dummy", name);
         } else
             nmtstp_link_dummy_add(NULL, EX, name);
@@ -2516,20 +2516,20 @@ test_nl_bugs_veth(void)
     g_assert(pllink_veth0);
     if (pllink_veth0->parent == 0) {
         /* Kernels prior to 4.1 dated 21 June, 2015 don't support exposing the veth peer
-		 * as IFA_LINK. skip the remainder of the test. */
+         * as IFA_LINK. skip the remainder of the test. */
         goto out;
     }
     g_assert_cmpint(pllink_veth0->parent, ==, ifindex_veth1);
 
     /* The following tests whether we have a workaround for kernel bug
-	 * https://bugzilla.redhat.com/show_bug.cgi?id=1285827 in place. */
+     * https://bugzilla.redhat.com/show_bug.cgi?id=1285827 in place. */
     pllink_veth1 = nm_platform_link_get(NM_PLATFORM_GET, ifindex_veth1);
     g_assert(pllink_veth1);
     g_assert_cmpint(pllink_veth1->parent, ==, ifindex_veth0);
 
     /* move one veth peer to another namespace and check that the
-	 * parent/IFLA_LINK of the remaining peer properly updates
-	 * (https://bugzilla.redhat.com/show_bug.cgi?id=1262908). */
+     * parent/IFLA_LINK of the remaining peer properly updates
+     * (https://bugzilla.redhat.com/show_bug.cgi?id=1262908). */
     ns_handle = nmtstp_namespace_create(CLONE_NEWNET, &error);
     g_assert_no_error(error);
     g_assert(ns_handle);
@@ -2673,7 +2673,7 @@ static void
 _test_netns_setup(gpointer fixture, gconstpointer test_data)
 {
     /* the singleton platform instance has netns support disabled.
-	 * Destroy the instance before the test and re-create it afterwards. */
+     * Destroy the instance before the test and re-create it afterwards. */
     g_object_unref(NM_PLATFORM_GET);
 }
 
@@ -2864,7 +2864,7 @@ test_netns_general(gpointer fixture, gconstpointer test_data)
     _sysctl_assert_eq(platform_2, "/proc/sys/net/ipv6/conf/dummy2a/disable_ipv6", NULL);
 
     /* Kernels prior to 3.19 dated 8 February, 2015 don't support ethtool -i for dummy devices.
-	 * Work around that and skip asserts that are known to fail. */
+     * Work around that and skip asserts that are known to fail. */
     ethtool_support = nmtstp_run_command("ethtool -i dummy1_ > /dev/null") == 0;
     if (ethtool_support) {
         g_assert(nmp_utils_ethtool_get_driver_info(
@@ -3340,7 +3340,7 @@ test_sysctl_netns_switch(void)
     nmtstp_netns_select_random(platforms, G_N_ELEMENTS(platforms), &netns_pop_3);
 
     /* even if we switch to other namespaces, we can still lookup the path correctly,
-	 * either using dirfd or via the platform instance (which switches namespace as needed). */
+     * either using dirfd or via the platform instance (which switches namespace as needed). */
     {
         gs_free char *c = NULL;
 
@@ -3417,7 +3417,7 @@ test_sysctl_netns_switch(void)
     }
 
     /* accessing the path directly, only succeeds iff the current namespace happens to be the namespace
-	 * in which we created the link. */
+     * in which we created the link. */
     {
         gs_free char *c = NULL;
 
@@ -3570,9 +3570,9 @@ _test_netns_mt_thread(gpointer data)
     g_assert(netns_bottom);
 
     /* I don't know why, but we need to create a new netns here at least once.
-	 * Otherwise, setns(, CLONE_NEWNS) below fails with EINVAL (???).
-	 *
-	 * Something is not right here, but what?  */
+     * Otherwise, setns(, CLONE_NEWNS) below fails with EINVAL (???).
+     *
+     * Something is not right here, but what?  */
     netns2 = nmp_netns_new();
     nmp_netns_pop(netns2);
     g_clear_object(&netns2);
diff --git a/src/platform/tests/test-nmp-object.c b/src/platform/tests/test-nmp-object.c
index 85042f7d16..0bdddb21da 100644
--- a/src/platform/tests/test-nmp-object.c
+++ b/src/platform/tests/test-nmp-object.c
@@ -577,8 +577,8 @@ main(int argc, char **argv)
         enumerator = nm_udev_client_enumerate_new(udev_client);
 
         /* Demand that the device is initialized (udev rules ran,
-		 * device has a stable name now) in case udev is running
-		 * (not in a container). */
+         * device has a stable name now) in case udev is running
+         * (not in a container). */
         if (access("/sys", W_OK) == 0)
             udev_enumerate_add_match_is_initialized(enumerator);
 
diff --git a/src/platform/tests/test-platform-general.c b/src/platform/tests/test-platform-general.c
index b10981d28b..ff02d8834e 100644
--- a/src/platform/tests/test-platform-general.c
+++ b/src/platform/tests/test-platform-general.c
@@ -556,13 +556,13 @@ test_platform_ip_address_pretty_sort_cmp(gconstpointer test_data)
     gsize            i, j;
 
     /*
-	 * First we create a list of addresses filled with (stable) random bytes.
-	 * We tweak some fields explicitly (stable randomly), so that we cover all
-	 * relevant cases.
-	 *
-	 * Then we sort the list of addresses, and compare that the result is
-	 * as our EXPECTED_BUFFER.
-	 */
+     * First we create a list of addresses filled with (stable) random bytes.
+     * We tweak some fields explicitly (stable randomly), so that we cover all
+     * relevant cases.
+     *
+     * Then we sort the list of addresses, and compare that the result is
+     * as our EXPECTED_BUFFER.
+     */
 
     addresses = g_malloc(ELM_SIZE * N_ADDRESSES);
     rand_map  = g_malloc(sizeof(rand_map[0]) * N_ADDRESSES);
@@ -640,7 +640,7 @@ test_platform_ip_address_pretty_sort_cmp(gconstpointer test_data)
 
         if (CONSUME_BITS(r, 5) != 0) {
             /* randomly make addr-source the same (so that several addresses compare
-			 * equal). */
+             * equal). */
             a->a4.addr_source = CONSUME_BITS(r, 2);
         }
 
diff --git a/src/platform/tests/test-route.c b/src/platform/tests/test-route.c
index c559539862..2891b5b976 100644
--- a/src/platform/tests/test-route.c
+++ b/src/platform/tests/test-route.c
@@ -25,7 +25,7 @@ _wait_for_ipv4_addr_device_route(NMPlatform *platform,
                                  guint8      plen)
 {
     /* Wait that the addresses gets a device-route. After adding a address,
-	 * the device route is not added immediately. It takes a moment... */
+     * the device route is not added immediately. It takes a moment... */
 
     addr = nm_utils_ip4_address_clear_host_address(addr, plen);
     NMTST_WAIT_ASSERT(400, {
@@ -60,9 +60,9 @@ _wait_for_ipv6_addr_non_tentative(NMPlatform *           platform,
     guint i;
 
     /* Wait that the addresses become non-tentative.  Dummy interfaces are NOARP
-	 * and thus don't do DAD, but the kernel sets the address as tentative for a
-	 * small amount of time, which prevents the immediate addition of the route
-	 * with RTA_PREFSRC */
+     * and thus don't do DAD, but the kernel sets the address as tentative for a
+     * small amount of time, which prevents the immediate addition of the route
+     * with RTA_PREFSRC */
 
     NMTST_WAIT_ASSERT(timeout_msec, {
         gboolean                    should_wait = FALSE;
@@ -1248,7 +1248,7 @@ static guint32
 _rr_rand_choose_u32(guint32 p)
 {
     /* mostly, we just return zero. We want that each rule only has few
-	 * fields set -- having most fields at zero. */
+     * fields set -- having most fields at zero. */
     if ((p % 10000u) < 7500u)
         return 0;
 
@@ -1317,9 +1317,9 @@ _rule_create_random(NMPlatform *platform)
         p = nmtst_get_rand_uint32();
         if ((p % 1000u) < 100) {
             /* if we set src_len/dst_len to zero, the src/dst is actually ignored.
-			 *
-			 * For fuzzying, still set the address. It shall have no further effect.
-			 * */
+             *
+             * For fuzzying, still set the address. It shall have no further effect.
+             * */
             *p_len = (~p) % (addr_size * 8 + 1);
             p      = nmtst_get_rand_uint32();
             if ((p % 3u) == 0) {
@@ -1456,10 +1456,10 @@ _rule_fuzzy_equal(const NMPObject *obj, const NMPObject *obj_comp, int op_type)
     switch (op_type) {
     case RTM_NEWRULE:
         /* when adding rules with RTM_NEWRULE, kernel checks whether an existing
-		 * rule already exists and may fail with EEXIST. This check has issues
-		 * and reject legitimate rules (rh#1686075).
-		 *
-		 * Work around that. */
+         * rule already exists and may fail with EEXIST. This check has issues
+         * and reject legitimate rules (rh#1686075).
+         *
+         * Work around that. */
         if (rr->src_len == 0)
             rr_co.src_len = 0;
         if (rr->dst_len == 0)
@@ -1477,7 +1477,7 @@ _rule_fuzzy_equal(const NMPObject *obj, const NMPObject *obj_comp, int op_type)
         break;
     case RTM_DELRULE:
         /* when deleting a rule with RTM_DELRULE, kernel tries to find the
-		 * candidate to delete. It might delete the wrong rule (rh#1685816). */
+         * candidate to delete. It might delete the wrong rule (rh#1685816). */
         if (rr->action == FR_ACT_UNSPEC)
             rr_co.action = FR_ACT_UNSPEC;
         if (rr->iifname[0] == '\0')
@@ -1646,8 +1646,8 @@ again:
         objs_sync = g_ptr_array_new_with_free_func((GDestroyNotify) nmp_object_unref);
 
         /* ensure that priorities are unique. Otherwise, it confuses the test, because
-		 * kernel may wrongly be unable to add/delete routes based on a wrong match
-		 * (rh#1685816, rh#1685816). */
+         * kernel may wrongly be unable to add/delete routes based on a wrong match
+         * (rh#1685816, rh#1685816). */
         for (i = 0; i < objs->len; i++) {
             const NMPObject *obj  = objs->pdata[i];
             guint32          prio = NMP_OBJECT_CAST_ROUTING_RULE(obj)->priority;
@@ -1667,7 +1667,7 @@ again:
                                     NULL);
             if (nmtst_get_rand_bool()) {
                 /* this has no effect, because a negative priority (of same absolute value)
-				 * has lower priority than the positive priority above. */
+                 * has lower priority than the positive priority above. */
                 nmp_rules_manager_track(rules_manager,
                                         NMP_OBJECT_CAST_ROUTING_RULE(objs_sync->pdata[i]),
                                         -1,
@@ -1748,7 +1748,7 @@ again:
                 }
                 if (r == 0) {
                     /* OK, the rule is shadowed by another rule, and kernel does not allow
-					 * us to add this one (rh#1686075). Drop this from the test. */
+                     * us to add this one (rh#1686075). Drop this from the test. */
                     g_ptr_array_remove_index(objs, i);
                     had_an_issue_exist = TRUE;
                     continue;
@@ -1820,11 +1820,11 @@ again:
                 guint k;
 
                 /* When deleting a rule, kernel does a fuzzy match, ignoring for example:
-				 *  - action, if it is FR_ACT_UNSPEC
-				 *  - iifname,oifname if it is unspecified
-				 * rh#1685816
-				 *
-				 * That means, we may have deleted the wrong rule. Which one? */
+                 *  - action, if it is FR_ACT_UNSPEC
+                 *  - iifname,oifname if it is unspecified
+                 * rh#1685816
+                 *
+                 * That means, we may have deleted the wrong rule. Which one? */
                 k = i;
                 for (j = i + 1; j < objs->len; j++) {
                     if (!_platform_has_routing_rule(platform, objs->pdata[j])) {
@@ -1877,7 +1877,7 @@ again:
                     objs_initial->len);
 
     /* the tests passed as good as we could (as good as we implemented workarounds for them).
-	 * Still, with this kernel, not all features were fully tested. Mark the test as skipped. */
+     * Still, with this kernel, not all features were fully tested. Mark the test as skipped. */
     if (had_an_issue_exist)
         g_test_skip("adding a rule failed with EEXIST although it should not (rh#1686075)");
     else if (!_rule_check_kernel_support(platform, -1))
diff --git a/src/platform/wifi/nm-wifi-utils-nl80211.c b/src/platform/wifi/nm-wifi-utils-nl80211.c
index d2c409057b..468b4d1706 100644
--- a/src/platform/wifi/nm-wifi-utils-nl80211.c
+++ b/src/platform/wifi/nm-wifi-utils-nl80211.c
@@ -129,16 +129,16 @@ nl80211_send_and_recv(NMWifiUtilsNl80211 *self,
         return err;
 
     /* Loop until one of our NL callbacks says we're done; on success
-	 * done will be 1, on error it will be < 0.
-	 */
+     * done will be 1, on error it will be < 0.
+     */
     while (!done) {
         err = nl_recvmsgs(self->nl_sock, &cb);
         if (err < 0 && err != -EAGAIN) {
             /* Kernel scan list can change while we are dumping it, as new scan
-			 * results from H/W can arrive. BSS info is assured to be consistent
-			 * and we don't need consistent view of whole scan list. Hence do
-			 * not warn on DUMP_INTR error for get scan command.
-			 */
+             * results from H/W can arrive. BSS info is assured to be consistent
+             * and we don't need consistent view of whole scan list. Hence do
+             * not warn on DUMP_INTR error for get scan command.
+             */
             if (err == -NME_NL_DUMP_INTR
                 && genlmsg_hdr(nlmsg_hdr(msg))->cmd == NL80211_CMD_GET_SCAN)
                 break;
@@ -652,8 +652,8 @@ wifi_nl80211_indicate_addressing_running(NMWifiUtils *data, gboolean running)
                                     : 99 /* NL80211_CMD_CRIT_PROTOCOL_STOP */,
                             0);
     /* Despite the DHCP name, we're using this for any type of IP addressing,
-	 * DHCPv4, DHCPv6, and IPv6 SLAAC.
-	 */
+     * DHCPv4, DHCPv6, and IPv6 SLAAC.
+     */
     NLA_PUT_U16(msg, 179 /* NL80211_ATTR_CRIT_PROT_ID */, 1 /* NL80211_CRIT_PROTO_DHCP */);
     if (running) {
         /* Give DHCP 5 seconds to complete */
@@ -756,11 +756,11 @@ nl80211_wiphy_info_handler(struct nl_msg *msg, void *arg)
             case NL80211_CMD_CONNECT:
             case NL80211_CMD_AUTHENTICATE:
                 /* Only devices that support CONNECT or AUTH actually support
-				 * 802.11, unlike say ipw2x00 (up to at least kernel 3.4) which
-				 * has minimal info support, but no actual command support.
-				 * This check mirrors what wpa_supplicant does to determine
-				 * whether or not to use the nl80211 driver.
-				 */
+                 * 802.11, unlike say ipw2x00 (up to at least kernel 3.4) which
+                 * has minimal info support, but no actual command support.
+                 * This check mirrors what wpa_supplicant does to determine
+                 * whether or not to use the nl80211 driver.
+                 */
                 info->supported = TRUE;
                 break;
             default:
diff --git a/src/platform/wifi/nm-wifi-utils-private.h b/src/platform/wifi/nm-wifi-utils-private.h
index bc5b265557..891ad41fa8 100644
--- a/src/platform/wifi/nm-wifi-utils-private.h
+++ b/src/platform/wifi/nm-wifi-utils-private.h
@@ -37,8 +37,8 @@ typedef struct {
     gboolean (*get_bssid)(NMWifiUtils *data, guint8 *out_bssid);
 
     /* Return a signal strength percentage 0 - 100% for the current BSSID;
-	 * return -1 on errors or if not associated.
-	 */
+     * return -1 on errors or if not associated.
+     */
     int (*get_qual)(NMWifiUtils *data);
 
     /* OLPC Mesh-only functions */
diff --git a/src/platform/wifi/nm-wifi-utils-wext.c b/src/platform/wifi/nm-wifi-utils-wext.c
index cf30e52228..98a03b4d78 100644
--- a/src/platform/wifi/nm-wifi-utils-wext.c
+++ b/src/platform/wifi/nm-wifi-utils-wext.c
@@ -76,8 +76,8 @@ iw_freq_to_uint32(const struct iw_freq *freq)
 {
     if (freq->e == 0) {
         /* Some drivers report channel not frequency.  Convert to a
-		 * frequency; but this assumes that the device is in b/g mode.
-		 */
+         * frequency; but this assumes that the device is in b/g mode.
+         */
         if ((freq->m >= 1) && (freq->m <= 13))
             return 2407 + (5 * freq->m);
         else if (freq->m == 14)
@@ -341,24 +341,24 @@ wext_qual_to_percent(const struct iw_quality *qual, const struct iw_quality *max
           max_qual->updated);
 
     /* Try using the card's idea of the signal quality first as long as it tells us what the max quality is.
-	 * Drivers that fill in quality values MUST treat them as percentages, ie the "Link Quality" MUST be
-	 * bounded by 0 and max_qual->qual, and MUST change in a linear fashion.  Within those bounds, drivers
-	 * are free to use whatever they want to calculate "Link Quality".
-	 */
+     * Drivers that fill in quality values MUST treat them as percentages, ie the "Link Quality" MUST be
+     * bounded by 0 and max_qual->qual, and MUST change in a linear fashion.  Within those bounds, drivers
+     * are free to use whatever they want to calculate "Link Quality".
+     */
     if ((max_qual->qual != 0) && !(max_qual->updated & IW_QUAL_QUAL_INVALID)
         && !(qual->updated & IW_QUAL_QUAL_INVALID))
         percent = (int) (100 * ((double) qual->qual / (double) max_qual->qual));
 
     /* If the driver doesn't specify a complete and valid quality, we have two options:
-	 *
-	 * 1) dBm: driver must specify max_qual->level = 0, and have valid values for
-	 *        qual->level and (qual->noise OR max_qual->noise)
-	 * 2) raw RSSI: driver must specify max_qual->level > 0, and have valid values for
-	 *        qual->level and max_qual->level
-	 *
-	 * This is the WEXT spec.  If this interpretation is wrong, I'll fix it.  Otherwise,
-	 * If drivers don't conform to it, they are wrong and need to be fixed.
-	 */
+     *
+     * 1) dBm: driver must specify max_qual->level = 0, and have valid values for
+     *        qual->level and (qual->noise OR max_qual->noise)
+     * 2) raw RSSI: driver must specify max_qual->level > 0, and have valid values for
+     *        qual->level and max_qual->level
+     *
+     * This is the WEXT spec.  If this interpretation is wrong, I'll fix it.  Otherwise,
+     * If drivers don't conform to it, they are wrong and need to be fixed.
+     */
 
     if ((max_qual->level == 0)
         && !(max_qual->updated & IW_QUAL_LEVEL_INVALID) /* Valid max_qual->level == 0 */
@@ -572,9 +572,9 @@ wext_get_range_ifname(NMWifiUtilsWext *wext,
     wrq.u.data.length  = sizeof(struct iw_range);
 
     /* Need to give some drivers time to recover after suspend/resume
-	 * (ex ipw3945 takes a few seconds to talk to its regulatory daemon;
-	 * see rh bz#362421)
-	 */
+     * (ex ipw3945 takes a few seconds to talk to its regulatory daemon;
+     * see rh bz#362421)
+     */
     while (i-- > 0) {
         if (ioctl(wext->fd, SIOCGIWRANGE, &wrq) == 0) {
             if (response_len)
@@ -650,9 +650,9 @@ wext_get_caps(NMWifiUtilsWext *wext, const char *ifname, struct iw_range *range)
     }
 
     /* There's no way to detect Ad-Hoc/AP mode support with WEXT
-	 * (other than actually trying to do it), so just assume that
-	 * Ad-Hoc is supported and AP isn't.
-	 */
+     * (other than actually trying to do it), so just assume that
+     * Ad-Hoc is supported and AP isn't.
+     */
     caps |= NM_WIFI_DEVICE_CAP_ADHOC;
 
     return caps;
@@ -744,9 +744,9 @@ nm_wifi_utils_wext_new(int ifindex, gboolean check_scan)
     }
 
     /* Check for the ability to scan specific SSIDs.  Until the scan_capa
-	 * field gets added to wireless-tools, need to work around that by casting
-	 * to the custom structure.
-	 */
+     * field gets added to wireless-tools, need to work around that by casting
+     * to the custom structure.
+     */
     scan_capa_range = (struct iw_range_with_scan_capa *) &range;
     if (scan_capa_range->scan_capa & NM_IW_SCAN_CAPA_ESSID) {
         _LOGI(LOGD_PLATFORM | LOGD_WIFI,
@@ -785,14 +785,14 @@ nm_wifi_utils_wext_is_wifi(const char *iface)
     gboolean     is_wifi = FALSE;
 
     /* performing an ioctl on a non-existing name may cause the automatic
-	 * loading of kernel modules, which should be avoided.
-	 *
-	 * Usually, we should thus make sure that an interface with this name
-	 * exists.
-	 *
-	 * Note that wifi_wext_is_wifi() has only one caller which just verified
-	 * that an interface with this name exists.
-	 */
+     * loading of kernel modules, which should be avoided.
+     *
+     * Usually, we should thus make sure that an interface with this name
+     * exists.
+     *
+     * Note that wifi_wext_is_wifi() has only one caller which just verified
+     * that an interface with this name exists.
+     */
 
     fd = socket(PF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
     if (fd >= 0) {
diff --git a/src/platform/wpan/nm-wpan-utils.c b/src/platform/wpan/nm-wpan-utils.c
index 4e767cfde2..86c6df7b5f 100644
--- a/src/platform/wpan/nm-wpan-utils.c
+++ b/src/platform/wpan/nm-wpan-utils.c
@@ -118,8 +118,8 @@ nl802154_send_and_recv(NMWpanUtils *  self,
         return err;
 
     /* Loop until one of our NL callbacks says we're done; on success
-	 * done will be 1, on error it will be < 0.
-	 */
+     * done will be 1, on error it will be < 0.
+     */
     while (!done) {
         err = nl_recvmsgs(self->nl_sock, &cb);
         if (err < 0 && err != -EAGAIN) {
diff --git a/src/ppp/nm-ppp-manager-call.c b/src/ppp/nm-ppp-manager-call.c
index 5d0cdba686..feff6830bf 100644
--- a/src/ppp/nm-ppp-manager-call.c
+++ b/src/ppp/nm-ppp-manager-call.c
@@ -68,7 +68,7 @@ nm_ppp_manager_create(const char *iface, GError **error)
         }
 
         /* after loading glib types from the plugin, we cannot unload the library anymore.
-		 * Make it resident. */
+         * Make it resident. */
         g_module_make_resident(plugin);
 
         nm_assert(ops);
diff --git a/src/ppp/nm-ppp-manager.c b/src/ppp/nm-ppp-manager.c
index 472989a326..324f3b3e1c 100644
--- a/src/ppp/nm-ppp-manager.c
+++ b/src/ppp/nm-ppp-manager.c
@@ -328,11 +328,11 @@ ppp_secrets_cb(NMActRequest *                req,
     }
 
     /* This is sort of a hack but...
-	 * pppd plugin only ever needs username and password. Passing the full
-	 * connection there would mean some bloat: the plugin would need to link
-	 * against libnm just to parse this. So instead, let's just send what
-	 * it needs.
-	 */
+     * pppd plugin only ever needs username and password. Passing the full
+     * connection there would mean some bloat: the plugin would need to link
+     * against libnm just to parse this. So instead, let's just send what
+     * it needs.
+     */
     g_dbus_method_invocation_return_value(priv->pending_secrets_context,
                                           g_variant_new("(ss)", username ?: "", password ?: ""));
 
@@ -384,9 +384,9 @@ impl_ppp_manager_need_secrets(NMDBusObject *                     obj,
     }
 
     /* Only ask for completely new secrets after retrying them once; some devices
-	 * appear to ask a few times when they actually don't even care what you
-	 * pass back.
-	 */
+     * appear to ask a few times when they actually don't even care what you
+     * pass back.
+     */
     tries = GPOINTER_TO_UINT(
         g_object_get_qdata(G_OBJECT(applied_connection), ppp_manager_secret_tries_quark()));
     if (tries > 1)
@@ -599,9 +599,9 @@ iid_value_to_ll6_addr(GVariant *          dict,
     g_return_val_if_fail(iid != 0, FALSE);
 
     /* Construct an IPv6 LL address from the interface identifier.  See
-	 * http://tools.ietf.org/html/rfc4291#section-2.5.1 (IPv6) and
-	 * http://tools.ietf.org/html/rfc5072#section-4.1 (IPv6 over PPP).
-	 */
+     * http://tools.ietf.org/html/rfc4291#section-2.5.1 (IPv6) and
+     * http://tools.ietf.org/html/rfc5072#section-4.1 (IPv6 over PPP).
+     */
     memset(out_addr->s6_addr, 0, sizeof(out_addr->s6_addr));
     out_addr->s6_addr16[0] = htons(0xfe80);
     memcpy(out_addr->s6_addr + 8, &iid, sizeof(iid));
@@ -857,9 +857,9 @@ create_pppd_cmd_line(NMPPPManager *  self,
         nm_strv_ptrarray_add_int(cmd, baud_override);
 
     /* noauth by default, because we certainly don't have any information
-	 * with which to verify anything the peer gives us if we ask it to
-	 * authenticate itself, which is what 'auth' really means.
-	 */
+     * with which to verify anything the peer gives us if we ask it to
+     * authenticate itself, which is what 'auth' really means.
+     */
     nm_strv_ptrarray_add_string_dup(cmd, "noauth");
 
     if (nm_setting_ppp_get_refuse_eap(setting))
@@ -888,8 +888,8 @@ create_pppd_cmd_line(NMPPPManager *  self,
         nm_strv_ptrarray_add_string_dup(cmd, "crtscts");
 
     /* Always ask for DNS, we don't have to use them if the connection
-	 * overrides the returned servers.
-	 */
+     * overrides the returned servers.
+     */
     nm_strv_ptrarray_add_string_dup(cmd, "usepeerdns");
 
     if (nm_setting_ppp_get_mru(setting)) {
@@ -922,8 +922,8 @@ create_pppd_cmd_line(NMPPPManager *  self,
         static int unit;
 
         /* The PPP interface is going to be renamed, so pass a
-		 * different unit each time so that activations don't
-		 * race with each others. */
+         * different unit each time so that activations don't
+         * race with each others. */
         nm_strv_ptrarray_add_string_dup(cmd, "unit");
         nm_strv_ptrarray_add_int(cmd, unit);
         unit = unit < G_MAXINT ? unit + 1 : 0;
@@ -1006,8 +1006,8 @@ _ppp_manager_start(NMPPPManager *self,
     s_ppp = nm_connection_get_setting_ppp(connection);
     if (!s_ppp) {
         /* If the PPP settings are all default we may not have a PPP setting yet,
-		 * so just make a default one here.
-		 */
+         * so just make a default one here.
+         */
         s_ppp = s_ppp_free = NM_SETTING_PPP(nm_setting_ppp_new());
     }
 
@@ -1100,7 +1100,7 @@ struct _NMPPPManagerStopHandle {
     gpointer                 user_data;
 
     /* this object delays shutdown, because we still need to wait until
-	 * pppd process terminated. */
+     * pppd process terminated. */
     GObject *shutdown_waitobj;
 
     GCancellable *cancellable;
@@ -1185,9 +1185,9 @@ _ppp_manager_stop(NMPPPManager *           self,
 
     if (!priv->pid && !callback) {
         /* nothing to do further...
-		 *
-		 * In this case, we return a %NULL handle. The caller cannot cancel this
-		 * event, but clearly he is not waiting for a callback anyway. */
+         *
+         * In this case, we return a %NULL handle. The caller cannot cancel this
+         * event, but clearly he is not waiting for a callback anyway. */
         return NULL;
     }
 
@@ -1203,19 +1203,19 @@ _ppp_manager_stop(NMPPPManager *           self,
 
     if (!priv->pid) {
         /* No PID. There is nothing to kill, however, invoke the callback in
-		 * an idle handler.
-		 *
-		 * Note that we don't register nm_shutdown_wait_obj_register_object().
-		 * In order for shutdown to work properly, the caller must always
-		 * explicitly cancel the action to go down. With the idle-handler,
-		 * cancelling the handle completes the request. */
+         * an idle handler.
+         *
+         * Note that we don't register nm_shutdown_wait_obj_register_object().
+         * In order for shutdown to work properly, the caller must always
+         * explicitly cancel the action to go down. With the idle-handler,
+         * cancelling the handle completes the request. */
         handle->idle_id = g_idle_add(_stop_idle_cb, handle);
         return handle;
     }
 
     /* we really want to kill the process and delay shutdown of NetworkManager
-	 * until the process terminated. We do that, by registering an object
-	 * that delays shutdown. */
+     * until the process terminated. We do that, by registering an object
+     * that delays shutdown. */
     handle->shutdown_waitobj = g_object_new(G_TYPE_OBJECT, NULL);
     nm_shutdown_wait_obj_register_object(handle->shutdown_waitobj, "ppp-manager-wait-kill-pppd");
     nm_utils_kill_child_async(nm_steal_int(&priv->pid),
@@ -1244,8 +1244,8 @@ _ppp_manager_stop_cancel(NMPPPManagerStopHandle *handle)
     }
 
     /* a real handle. Only invoke the callback (synchronously). This marks
-	 * the handle as handled, but it keeps shutdown_waitobj around, until
-	 * nm_utils_kill_child_async() returns. */
+     * the handle as handled, but it keeps shutdown_waitobj around, until
+     * nm_utils_kill_child_async() returns. */
     _stop_handle_complete(handle, TRUE);
 }
 
@@ -1313,7 +1313,7 @@ dispose(GObject *object)
     NMPPPManagerPrivate *priv = NM_PPP_MANAGER_GET_PRIVATE(self);
 
     /* we expect the user to first stop the manager. As fallback,
-	 * still stop. */
+     * still stop. */
     g_warn_if_fail(!priv->pid);
     g_warn_if_fail(!nm_dbus_object_is_exported(NM_DBUS_OBJECT(self)));
     _ppp_manager_stop(self, NULL, NULL, NULL);
diff --git a/src/ppp/nm-pppd-plugin.c b/src/ppp/nm-pppd-plugin.c
index 37dc971bdb..bed68e6b66 100644
--- a/src/ppp/nm-pppd-plugin.c
+++ b/src/ppp/nm-pppd-plugin.c
@@ -128,8 +128,8 @@ nm_phasechange(int arg)
         ifindex = if_nametoindex(ifname);
 
         /* Make a sync call to ensure that when the call
-		 * terminates the interface already has its final
-		 * name. */
+         * terminates the interface already has its final
+         * name. */
         ret = g_dbus_connection_call_sync(gl.dbus_connection,
                                           NM_DBUS_SERVICE,
                                           gl.ipparam,
@@ -181,8 +181,8 @@ nm_ip_up(void *data, int arg)
     g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);
 
     /* Keep sending the interface name to be backwards compatible
-	 * with older versions of NM during a package upgrade, where
-	 * NM is not restarted and the pppd plugin was not loaded. */
+     * with older versions of NM during a package upgrade, where
+     * NM is not restarted and the pppd plugin was not loaded. */
     g_variant_builder_add(&builder,
                           "{sv}",
                           NM_PPP_IP4_CONFIG_INTERFACE,
@@ -194,9 +194,9 @@ nm_ip_up(void *data, int arg)
                           g_variant_new_uint32(opts.ouraddr));
 
     /* Prefer the peer options remote address first, _unless_ pppd made the
-	 * address up, at which point prefer the local options remote address,
-	 * and if that's not right, use the made-up address as a last resort.
-	 */
+     * address up, at which point prefer the local options remote address,
+     * and if that's not right, use the made-up address as a last resort.
+     */
     if (peer_opts.hisaddr && (peer_opts.hisaddr != pppd_made_up_address)) {
         g_variant_builder_add(&builder,
                               "{sv}",
@@ -289,8 +289,8 @@ nm_ip6_up(void *data, int arg)
 
     g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);
     /* Keep sending the interface name to be backwards compatible
-	 * with older versions of NM during a package upgrade, where
-	 * NM is not restarted and the pppd plugin was not loaded. */
+     * with older versions of NM during a package upgrade, where
+     * NM is not restarted and the pppd plugin was not loaded. */
     g_variant_builder_add(&builder,
                           "{sv}",
                           NM_PPP_IP6_CONFIG_INTERFACE,
@@ -382,8 +382,8 @@ nm_exit_notify(void *data, int arg)
     g_return_if_fail(G_IS_DBUS_CONNECTION(gl.dbus_connection));
 
     /* We wait until this point to notify dead phase to make sure that
-	 * the serial port has recovered already its original settings.
-	 */
+     * the serial port has recovered already its original settings.
+     */
     nm_phasechange(PHASE_DEAD);
 
     g_message("nm-ppp-plugin: cleaning up");
diff --git a/src/settings/nm-agent-manager.c b/src/settings/nm-agent-manager.c
index df7c810a78..3814d64f42 100644
--- a/src/settings/nm-agent-manager.c
+++ b/src/settings/nm-agent-manager.c
@@ -202,8 +202,8 @@ struct _NMAgentManagerCallId {
             NMAuthChain *chain;
 
             /* Whether the agent currently being asked for secrets
-			 * has the system.modify privilege.
-			 */
+             * has the system.modify privilege.
+             */
             gboolean current_has_modify;
 
             union {
@@ -411,8 +411,8 @@ _agent_create_auth_chain(NMAgentManager *self, NMSecretAgent *agent, GDBusMethod
 
     if (agent->auth_chain && !context && !agent->fully_registered) {
         /* we restart the authorization check (without a @context), but the currently
-		 * pending auth-chain carries a context. We need to pass it on as we replace
-		 * the auth-chain. */
+         * pending auth-chain carries a context. We need to pass it on as we replace
+         * the auth-chain. */
         context = nm_auth_chain_get_context(agent->auth_chain);
         nm_assert(context);
     }
@@ -588,8 +588,8 @@ request_free(Request *req)
         g_source_remove(req->idle_id);
 
     /* cancel-secrets invokes the done-callback synchronously -- in which case
-	 * the handler just return.
-	 * Hence, we can proceed to free @req... */
+     * the handler just return.
+     * Hence, we can proceed to free @req... */
     nm_secret_agent_cancel_call(req->current, req->current_call_id);
 
     g_object_unref(req->subject);
@@ -735,8 +735,8 @@ request_add_agent(Request *req, NMSecretAgent *agent)
         NMAuthSubject *subject = nm_secret_agent_get_subject(agent);
 
         /* Ensure the caller's username exists in the connection's permissions,
-		 * or that the permissions is empty (ie, visible by everyone).
-		 */
+         * or that the permissions is empty (ie, visible by everyone).
+         */
         if (!nm_auth_is_subject_in_acl(req->con.connection, subject, NULL)) {
             _LOGD(agent,
                   "agent ignored for secrets request " LOG_REQ_FMT " (not in ACL)",
@@ -978,9 +978,9 @@ set_secrets_not_required(NMConnection *connection, GVariant *dict)
             g_variant_iter_init(&setting_iter, setting_dict);
             while (g_variant_iter_next(&setting_iter, "{&sv}", &key_name, &val)) {
                 /* For each secret, set the flag that it's not required; VPN
-				 * secrets need slightly different treatment here since the
-				 * "secrets" property is actually a dictionary of secrets.
-				 */
+                 * secrets need slightly different treatment here since the
+                 * "secrets" property is actually a dictionary of secrets.
+                 */
                 if (strcmp(setting_name, NM_SETTING_VPN_SETTING_NAME) == 0
                     && strcmp(key_name, NM_SETTING_VPN_SECRETS) == 0
                     && g_variant_is_of_type(val, G_VARIANT_TYPE("a{ss}"))) {
@@ -1022,9 +1022,9 @@ _con_get_request_start_proceed(Request *req, gboolean include_system_secrets)
                                                 NULL);
     } else {
         /* Update secret flags in the temporary connection to indicate that
-		 * the system secrets we're not sending to the agent aren't required,
-		 * so the agent can properly validate UI controls and such.
-		 */
+         * the system secrets we're not sending to the agent aren't required,
+         * so the agent can properly validate UI controls and such.
+         */
         if (req->con.get.existing_secrets)
             set_secrets_not_required(tmp, req->con.get.existing_secrets);
     }
@@ -1061,9 +1061,9 @@ _con_get_request_start_validated(NMAuthChain *          chain,
     req->con.chain = NULL;
 
     /* If the agent obtained the 'modify' permission, we send all system secrets
-	 * to it.  If it didn't, we still ask it for secrets, but we don't send
-	 * any system secrets.
-	 */
+     * to it.  If it didn't, we still ask it for secrets, but we don't send
+     * any system secrets.
+     */
     perm = nm_auth_chain_get_data(chain, "perm");
     g_assert(perm);
     if (nm_auth_chain_get_result(chain, perm) == NM_AUTH_CALL_RESULT_YES)
@@ -1091,11 +1091,11 @@ _con_get_request_start(Request *req)
     agent_dbus_owner = nm_secret_agent_get_dbus_owner(req->current);
 
     /* If the request flags allow user interaction, and there are existing
-	 * system secrets (or blank secrets that are supposed to be system-owned),
-	 * check whether the agent has the 'modify' permission before sending those
-	 * secrets to the agent.  We shouldn't leak system-owned secrets to
-	 * unprivileged users.
-	 */
+     * system secrets (or blank secrets that are supposed to be system-owned),
+     * check whether the agent has the 'modify' permission before sending those
+     * secrets to the agent.  We shouldn't leak system-owned secrets to
+     * unprivileged users.
+     */
     if ((req->con.get.flags != NM_SECRET_AGENT_GET_SECRETS_FLAG_NONE)
         && (req->con.get.existing_secrets
             || _nm_connection_aggregate(req->con.connection,
@@ -1113,9 +1113,9 @@ _con_get_request_start(Request *req)
         nm_assert(req->con.chain);
 
         /* If the caller is the only user in the connection's permissions, then
-		 * we use the 'modify.own' permission instead of 'modify.system'.  If the
-		 * request affects more than just the caller, require 'modify.system'.
-		 */
+         * we use the 'modify.own' permission instead of 'modify.system'.  If the
+         * request affects more than just the caller, require 'modify.system'.
+         */
         s_con = nm_connection_get_setting_connection(req->con.connection);
         g_assert(s_con);
         if (nm_setting_connection_get_num_permissions(s_con) == 1)
@@ -1155,10 +1155,10 @@ _con_get_try_complete_early(Request *req)
         return FALSE;
 
     /* The connection already had secrets; check if any more are required.
-	 * If no more are required, we're done.  If secrets are still needed,
-	 * ask a secret agent for more.  This allows admins to provide generic
-	 * secrets but allow additional user-specific ones as well.
-	 */
+     * If no more are required, we're done.  If secrets are still needed,
+     * ask a secret agent for more.  This allows admins to provide generic
+     * secrets but allow additional user-specific ones as well.
+     */
     tmp = nm_simple_connection_new_clone(req->con.connection);
     g_assert(tmp);
 
@@ -1188,15 +1188,15 @@ _con_get_try_complete_early(Request *req)
     /* We don't, so ask some agents for additional secrets */
     if (req->con.get.flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_NO_ERRORS && !req->pending) {
         /* The request initiated from GetSecrets() via DBus,
-		 * don't error out if any secrets are missing. */
+         * don't error out if any secrets are missing. */
         req_complete(req, req->con.get.existing_secrets, NULL, NULL, NULL);
         return TRUE;
     }
 
     /* Couldn't get secrets from system settings, so now we ask the
-	 * agents for secrets.  Let the Agent Manager handle which agents
-	 * we'll ask and in which order.
-	 */
+     * agents for secrets.  Let the Agent Manager handle which agents
+     * we'll ask and in which order.
+     */
     return FALSE;
 }
 
@@ -1248,10 +1248,10 @@ nm_agent_manager_get_secrets(NMAgentManager *             self,
                setting_name);
 
     /* NOTE: a few things in the Request handling depend on existing_secrets
-	 * being NULL if there aren't any system-owned secrets for this connection.
-	 * This in turn depends on nm_connection_to_dbus() and nm_setting_to_hash()
-	 * both returning NULL if they didn't hash anything.
-	 */
+     * being NULL if there aren't any system-owned secrets for this connection.
+     * This in turn depends on nm_connection_to_dbus() and nm_setting_to_hash()
+     * both returning NULL if they didn't hash anything.
+     */
     req = request_new(self, REQUEST_TYPE_CON_GET, nm_connection_get_id(connection), subject);
 
     req->con.path       = g_strdup(path);
diff --git a/src/settings/nm-secret-agent.c b/src/settings/nm-secret-agent.c
index 8852aa2201..d6f040f980 100644
--- a/src/settings/nm-secret-agent.c
+++ b/src/settings/nm-secret-agent.c
@@ -157,7 +157,7 @@ _call_id_new(NMSecretAgent *       self,
 
     if (!priv->shutdown_wait_obj_registered) {
         /* self has async requests (that keep self alive). As long as
-		 * we have pending requests, shutdown is blocked. */
+         * we have pending requests, shutdown is blocked. */
         priv->shutdown_wait_obj_registered = TRUE;
         nm_shutdown_wait_obj_register_object(G_OBJECT(self), "secret-agent");
     }
@@ -488,11 +488,11 @@ nm_secret_agent_cancel_call(NMSecretAgent *self, NMSecretAgentCallId *call_id)
     g_return_if_fail(!c_list_is_empty(&call_id->lst));
 
     /* Theoretically, call-id already has a self pointer. But nm_secret_agent_cancel_call() has only
-	 * one user: NMAgentManager. And that one has the self-pointer at hand, so the only purpose of
-	 * the @self argument is to assert that we are cancelling the expected call.
-	 *
-	 * We could drop the @self argument, but that just remove an additional assert-check from
-	 * our code, without making a simplification for the only caller of this function. */
+     * one user: NMAgentManager. And that one has the self-pointer at hand, so the only purpose of
+     * the @self argument is to assert that we are cancelling the expected call.
+     *
+     * We could drop the @self argument, but that just remove an additional assert-check from
+     * our code, without making a simplification for the only caller of this function. */
     g_return_if_fail(self == call_id->self);
 
     priv = NM_SECRET_AGENT_GET_PRIVATE(self);
@@ -516,7 +516,7 @@ nm_secret_agent_cancel_call(NMSecretAgent *self, NMSecretAgentCallId *call_id)
             _call_cancel_cb,
             call_id);
         /* we keep call-id alive, but it will be unlinked from priv->requests.
-		 * _call_cancel_cb() will finally free it later. */
+         * _call_cancel_cb() will finally free it later. */
         free_call_id = FALSE;
     }
 
diff --git a/src/settings/nm-settings-connection.c b/src/settings/nm-settings-connection.c
index d55f58f96d..6e93f177ca 100644
--- a/src/settings/nm-settings-connection.c
+++ b/src/settings/nm-settings-connection.c
@@ -86,18 +86,18 @@ typedef struct _NMSettingsConnectionPrivate {
     NMDevice *default_wired_device;
 
     /* Caches secrets from on-disk connections; were they not cached any
-	 * call to nm_connection_clear_secrets() wipes them out and we'd have
-	 * to re-read them from disk which defeats the purpose of having the
-	 * connection in-memory at all.
-	 */
+     * call to nm_connection_clear_secrets() wipes them out and we'd have
+     * to re-read them from disk which defeats the purpose of having the
+     * connection in-memory at all.
+     */
     GVariant *system_secrets;
 
     /* Caches secrets from agents during the activation process; if new system
-	 * secrets are returned from an agent, they get written out to disk,
-	 * triggering a re-read of the connection, which reads only system
-	 * secrets, and would wipe out any agent-owned or not-saved secrets the
-	 * agent also returned.
-	 */
+     * secrets are returned from an agent, they get written out to disk,
+     * triggering a re-read of the connection, which reads only system
+     * secrets, and would wipe out any agent-owned or not-saved secrets the
+     * agent also returned.
+     */
     GVariant *agent_secrets;
 
     GHashTable *seen_bssids; /* Up-to-date BSSIDs that's been seen for the connection */
@@ -288,13 +288,13 @@ _nm_settings_connection_set_connection(NMSettingsConnection *           self,
         nmtst_connection_assert_unchanging(priv->connection);
 
         /* note that we only return @connection_old if the new connection actually differs from
-		 * before.
-		 *
-		 * So, there are three cases:
-		 *
-		 *  - return %NULL when setting the connection the first time.
-		 *  - return %NULL if setting a profile with the same content that we already have.
-		 *  - return the previous pointer if the connection changed. */
+         * before.
+         *
+         * So, there are three cases:
+         *
+         *  - return %NULL when setting the connection the first time.
+         *  - return %NULL if setting a profile with the same content that we already have.
+         *  - return the previous pointer if the connection changed. */
         NM_SET_OUT(out_connection_old, g_steal_pointer(&connection_old));
     }
 
@@ -408,12 +408,12 @@ nm_settings_connection_check_permission(NMSettingsConnection *self, const char *
 
     for (i = 0; i < num; i++) {
         /* For each user get their secret agent and check if that agent has the
-		 * required permission.
-		 *
-		 * FIXME: what if the user isn't running an agent?  PolKit needs a bus
-		 * name or a PID but if the user isn't running an agent they won't have
-		 * either.
-		 */
+         * required permission.
+         *
+         * FIXME: what if the user isn't running an agent?  PolKit needs a bus
+         * name or a PID but if the user isn't running an agent they won't have
+         * either.
+         */
         if (nm_setting_connection_get_permission(s_con, i, NULL, &puser, NULL)) {
             if (nm_agent_manager_has_agent_with_permission(priv->agent_mgr, puser, permission))
                 return TRUE;
@@ -438,7 +438,7 @@ update_system_secrets_cache(NMSettingsConnection *self, NMConnection *new)
         goto out;
 
     /* FIXME: improve NMConnection API so we can avoid the overhead of cloning the connection,
-	 *   in particular if there are no secrets to begin with. */
+     *   in particular if there are no secrets to begin with. */
 
     connection_cloned = nm_simple_connection_new_clone(new);
 
@@ -470,7 +470,7 @@ update_agent_secrets_cache(NMSettingsConnection *self, NMConnection *new)
         goto out;
 
     /* FIXME: improve NMConnection API so we can avoid the overhead of cloning the connection,
-	 *   in particular if there are no secrets to begin with. */
+     *   in particular if there are no secrets to begin with. */
 
     connection_cloned = nm_simple_connection_new_clone(new);
 
@@ -556,15 +556,15 @@ _secrets_update(NMConnection * connection,
         secrets_setting = g_variant_lookup_value(secrets, setting_name, NM_VARIANT_TYPE_SETTING);
         if (!secrets_setting) {
             /* The connection dictionary didn't contain any secrets for
-			 * @setting_name; just return success.
-			 */
+             * @setting_name; just return success.
+             */
             return TRUE;
         }
         secrets = secrets_setting;
     }
 
     /* if @out_new_connection is provided, we don't modify @connection but clone
-	 * and return it. Otherwise, we update @connection inplace. */
+     * and return it. Otherwise, we update @connection inplace. */
     if (out_new_connection) {
         nm_assert(!*out_new_connection);
         connection          = nm_simple_connection_new_clone(connection);
@@ -733,18 +733,18 @@ get_cmp_flags(NMSettingsConnection *       self,    /* only needed for logging *
         }
 
         /* If the agent returned any system-owned secrets (initial connect and no
-		 * secrets given when the connection was created, or something like that)
-		 * make sure the agent's UID has the 'modify' permission before we use or
-		 * save those system-owned secrets.  If not, discard them and use the
-		 * existing secrets, or fail the connection.
-		 */
+         * secrets given when the connection was created, or something like that)
+         * make sure the agent's UID has the 'modify' permission before we use or
+         * save those system-owned secrets.  If not, discard them and use the
+         * existing secrets, or fail the connection.
+         */
         *agent_had_system =
             _nm_connection_find_secret(connection, secrets, secret_is_system_owned, NULL);
         if (*agent_had_system) {
             if (flags == NM_SECRET_AGENT_GET_SECRETS_FLAG_NONE) {
                 /* No user interaction was allowed when requesting secrets; the
-				 * agent is being bad.  Remove system-owned secrets.
-				 */
+                 * agent is being bad.  Remove system-owned secrets.
+                 */
                 if (is_self) {
                     _LOGD("(%s:%p) interaction forbidden but agent %s returned system secrets",
                           setting_name,
@@ -755,8 +755,8 @@ get_cmp_flags(NMSettingsConnection *       self,    /* only needed for logging *
                 cmp_flags->required |= NM_SETTING_SECRET_FLAG_AGENT_OWNED;
             } else if (agent_has_modify == FALSE) {
                 /* Agent didn't successfully authenticate; clear system-owned secrets
-				 * from the secrets the agent returned.
-				 */
+                 * from the secrets the agent returned.
+                 */
                 if (is_self) {
                     _LOGD("(%s:%p) agent failed to authenticate but provided system secrets",
                           setting_name,
@@ -773,8 +773,8 @@ get_cmp_flags(NMSettingsConnection *       self,    /* only needed for logging *
     }
 
     /* If no user interaction was allowed, make sure that no "unsaved" secrets
-	 * came back.  Unsaved secrets by definition require user interaction.
-	 */
+     * came back.  Unsaved secrets by definition require user interaction.
+     */
     if (flags == NM_SECRET_AGENT_GET_SECRETS_FLAG_NONE) {
         cmp_flags->forbidden |=
             (NM_SETTING_SECRET_FLAG_NOT_SAVED | NM_SETTING_SECRET_FLAG_NOT_REQUIRED);
@@ -923,10 +923,10 @@ get_secrets_done_cb(NMAgentManager *             manager,
     }
 
     /* Update the connection with the agent's secrets; by this point if any
-	 * system-owned secrets exist in 'secrets' the agent that provided them
-	 * will have been authenticated, so those secrets can replace the existing
-	 * system secrets.
-	 */
+     * system-owned secrets exist in 'secrets' the agent that provided them
+     * will have been authenticated, so those secrets can replace the existing
+     * system secrets.
+     */
     filtered_secrets = validate_secret_flags(new_connection, secrets, &cmp_flags);
 
     if (!_secrets_update(new_connection, setting_name, filtered_secrets, NULL, &local)) {
@@ -937,10 +937,10 @@ get_secrets_done_cb(NMAgentManager *             manager,
     }
 
     /* Only save secrets to backing storage if the agent returned any
-	 * new system secrets.  If it didn't, then the secrets are agent-
-	 * owned and there's no point to writing out the connection when
-	 * nothing has changed, since agent-owned secrets don't get saved here.
-	 */
+     * new system secrets.  If it didn't, then the secrets are agent-
+     * owned and there's no point to writing out the connection when
+     * nothing has changed, since agent-owned secrets don't get saved here.
+     */
     if (agent_had_system) {
         _LOGD("(%s:%p) saving new secrets to backing storage", setting_name, call_id);
     } else {
@@ -1097,15 +1097,15 @@ nm_settings_connection_get_secrets(NMSettingsConnection *          self,
     }
 
     /* we remember the current version-id of the secret-agents. The version-id is strictly increasing,
-	 * as new agents register the number. We know hence, that this request was made against a certain
-	 * set of secret-agents.
-	 * If after making this request a new secret-agent registers, the version-id increases.
-	 * Then we know that the this request probably did not yet include the latest secret-agent. */
+     * as new agents register the number. We know hence, that this request was made against a certain
+     * set of secret-agents.
+     * If after making this request a new secret-agent registers, the version-id increases.
+     * Then we know that the this request probably did not yet include the latest secret-agent. */
     priv->last_secret_agent_version_id = nm_agent_manager_get_agent_version_id(priv->agent_mgr);
 
     /* Use priv->system_secrets to work around the fact that nm_connection_clear_secrets()
-	 * will clear secrets on this object's settings.
-	 */
+     * will clear secrets on this object's settings.
+     */
     call_id_a = nm_agent_manager_get_secrets(priv->agent_mgr,
                                              nm_dbus_object_get_path(NM_DBUS_OBJECT(self)),
                                              nm_settings_connection_get_connection(self),
@@ -1327,25 +1327,25 @@ get_settings_auth_cb(NMSettingsConnection * self,
     }
 
     /* Timestamp is not updated in connection's 'timestamp' property,
-	 * because it would force updating the connection and in turn
-	 * writing to /etc periodically, which we want to avoid. Rather real
-	 * timestamps are kept track of in a private variable. So, substitute
-	 * timestamp property with the real one here before returning the settings.
-	 */
+     * because it would force updating the connection and in turn
+     * writing to /etc periodically, which we want to avoid. Rather real
+     * timestamps are kept track of in a private variable. So, substitute
+     * timestamp property with the real one here before returning the settings.
+     */
     options.timestamp.has = TRUE;
     nm_settings_connection_get_timestamp(self, &options.timestamp.val);
 
     /* Seen BSSIDs are not updated in 802-11-wireless 'seen-bssids' property
-	 * from the same reason as timestamp. Thus we put it here to GetSettings()
-	 * return settings too.
-	 */
+     * from the same reason as timestamp. Thus we put it here to GetSettings()
+     * return settings too.
+     */
     seen_bssids         = nm_settings_connection_get_seen_bssids(self);
     options.seen_bssids = seen_bssids;
 
     /* Secrets should *never* be returned by the GetSettings method, they
-	 * get returned by the GetSecrets method which can be better
-	 * protected against leakage of secrets to unprivileged callers.
-	 */
+     * get returned by the GetSecrets method which can be better
+     * protected against leakage of secrets to unprivileged callers.
+     */
     settings = nm_connection_to_dbus_full(nm_settings_connection_get_connection(self),
                                           NM_CONNECTION_SERIALIZE_NO_SECRETS,
                                           &options);
@@ -1449,9 +1449,9 @@ _autoconnect_retries_set(NMSettingsConnection *self, int retries, gboolean is_re
         priv->autoconnect_retries_blocked_until = 0;
     else {
         /* NOTE: the blocked time must be identical for all connections, otherwise
-		 * the tracking of resetting the retry count in NMPolicy needs adjustment
-		 * in _connection_autoconnect_retries_set() (as it would need to re-evaluate
-		 * the next-timeout every time a connection gets blocked). */
+         * the tracking of resetting the retry count in NMPolicy needs adjustment
+         * in _connection_autoconnect_retries_set() (as it would need to re-evaluate
+         * the next-timeout every time a connection gets blocked). */
         priv->autoconnect_retries_blocked_until =
             nm_utils_get_monotonic_timestamp_sec() + AUTOCONNECT_RESET_RETRIES_TIMER;
     }
@@ -1481,18 +1481,18 @@ update_auth_cb(NMSettingsConnection * self,
                                       NM_CONNECTION_AGGREGATE_ANY_SECRETS,
                                       NULL)) {
             /* If the new connection has no secrets, we do not want to remove all
-			 * secrets, rather we keep all the existing ones. Do that by merging
-			 * them in to the new connection.
-			 */
+             * secrets, rather we keep all the existing ones. Do that by merging
+             * them in to the new connection.
+             */
             if (priv->agent_secrets)
                 nm_connection_update_secrets(info->new_settings, NULL, priv->agent_secrets, NULL);
             if (priv->system_secrets)
                 nm_connection_update_secrets(info->new_settings, NULL, priv->system_secrets, NULL);
         } else {
             /* Cache the new secrets from the agent, as stuff like inotify-triggered
-			 * changes to connection's backing config files will blow them away if
-			 * they're in the main connection.
-			 */
+             * changes to connection's backing config files will blow them away if
+             * they're in the main connection.
+             */
             update_agent_secrets_cache(self, info->new_settings);
 
             /* New secrets, allow autoconnection again */
@@ -1560,9 +1560,9 @@ update_auth_cb(NMSettingsConnection * self,
         gs_unref_object NMConnection *for_agent = NULL;
 
         /* Dupe the connection so we can clear out non-agent-owned secrets,
-		 * as agent-owned secrets are the only ones we send back be saved.
-		 * Only send secrets to agents of the same UID that called update too.
-		 */
+         * as agent-owned secrets are the only ones we send back be saved.
+         * Only send secrets to agents of the same UID that called update too.
+         */
         for_agent = nm_simple_connection_new_clone(nm_settings_connection_get_connection(self));
         _nm_connection_clear_secrets_by_secret_flags(for_agent, NM_SETTING_SECRET_FLAG_AGENT_OWNED);
         nm_agent_manager_save_secrets(info->agent_mgr,
@@ -1590,14 +1590,14 @@ get_update_modify_permission(NMConnection *old, NMConnection *new)
     new_num = nm_setting_connection_get_num_permissions(s_con);
 
     /* If the caller is the only user in either connection's permissions, then
-	 * we use the 'modify.own' permission instead of 'modify.system'.
-	 */
+     * we use the 'modify.own' permission instead of 'modify.system'.
+     */
     if (orig_num == 1 && new_num == 1)
         return NM_AUTH_PERMISSION_SETTINGS_MODIFY_OWN;
 
     /* If the update request affects more than just the caller (ie if the old
-	 * settings were system-wide, or the new ones are), require 'modify.system'.
-	 */
+     * settings were system-wide, or the new ones are), require 'modify.system'.
+     */
     return NM_AUTH_PERMISSION_SETTINGS_MODIFY_SYSTEM;
 }
 
@@ -1643,9 +1643,9 @@ settings_connection_update(NMSettingsConnection * self,
         goto error;
 
     /* And that the new connection settings will be visible to the user
-	 * that's sending the update request.  You can't make a connection
-	 * invisible to yourself.
-	 */
+     * that's sending the update request.  You can't make a connection
+     * invisible to yourself.
+     */
     if (!nm_auth_is_subject_in_acl_set_error(tmp ?: nm_settings_connection_get_connection(self),
                                              subject,
                                              NM_SETTINGS_ERROR,
@@ -1822,9 +1822,9 @@ get_modify_permission_basic(NMSettingsConnection *self)
     NMSettingConnection *s_con;
 
     /* If the caller is the only user in the connection's permissions, then
-	 * we use the 'modify.own' permission instead of 'modify.system'.  If the
-	 * request affects more than just the caller, require 'modify.system'.
-	 */
+     * we use the 'modify.own' permission instead of 'modify.system'.  If the
+     * request affects more than just the caller, require 'modify.system'.
+     */
     s_con = nm_connection_get_setting_connection(nm_settings_connection_get_connection(self));
     if (nm_setting_connection_get_num_permissions(s_con) == 1)
         return NM_AUTH_PERMISSION_SETTINGS_MODIFY_OWN;
@@ -1875,10 +1875,10 @@ dbus_get_agent_secrets_cb(NMSettingsConnection *      self,
         g_dbus_method_invocation_return_gerror(context, error);
     else {
         /* Return secrets from agent and backing storage to the D-Bus caller;
-		 * nm_settings_connection_get_secrets() will have updated itself with
-		 * secrets from backing storage and those returned from the agent
-		 * by the time we get here.
-		 */
+         * nm_settings_connection_get_secrets() will have updated itself with
+         * secrets from backing storage and those returned from the agent
+         * by the time we get here.
+         */
         dict = nm_connection_to_dbus(nm_settings_connection_get_connection(self),
                                      NM_CONNECTION_SERIALIZE_ONLY_SECRETS);
         if (!dict)
@@ -2133,7 +2133,7 @@ _cmp_last_resort(NMSettingsConnection *a, NMSettingsConnection *b)
     NM_CMP_DIRECT_STRCMP0(nm_settings_connection_get_uuid(a), nm_settings_connection_get_uuid(b));
 
     /* hm, same UUID. Use their pointer value to give them a stable
-	 * order. */
+     * order. */
     return (a > b) ? -1 : 1;
 }
 
@@ -2309,10 +2309,10 @@ _nm_settings_connection_register_kf_dbs(NMSettingsConnection *self,
                   nm_key_file_db_get_filename(priv->kf_db_seen_bssids));
 
             /* If this connection didn't have an entry in the seen-bssids database,
-			 * maybe this is the first time we've read it in, so populate the
-			 * seen-bssids list from the deprecated seen-bssids property of the
-			 * wifi setting.
-			 */
+             * maybe this is the first time we've read it in, so populate the
+             * seen-bssids list from the deprecated seen-bssids property of the
+             * wifi setting.
+             */
             s_wifi =
                 nm_connection_get_setting_wireless(nm_settings_connection_get_connection(self));
             if (s_wifi) {
@@ -2778,7 +2778,7 @@ nm_settings_connection_class_init(NMSettingsConnectionClass *klass)
     g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties);
 
     /* internal signal, with an argument (NMSettingsConnectionUpdateReason update_reason) as
-	 * guint. */
+     * guint. */
     signals[UPDATED_INTERNAL] = g_signal_new(NM_SETTINGS_CONNECTION_UPDATED_INTERNAL,
                                              G_TYPE_FROM_CLASS(klass),
                                              G_SIGNAL_RUN_FIRST,
diff --git a/src/settings/nm-settings-connection.h b/src/settings/nm-settings-connection.h
index b65a8c8ff6..c294870ff4 100644
--- a/src/settings/nm-settings-connection.h
+++ b/src/settings/nm-settings-connection.h
@@ -27,27 +27,27 @@ typedef enum {
     NM_SETTINGS_CONNECTION_UPDATE_REASON_NONE = 0,
 
     /* with persist-mode != NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_ONLY, and
-	 * update tries to update the profile on disk (which can always fail).
-	 * In some cases we want to ignore such failure and proceed. For example,
-	 * when we receive secrets from a secret-agent, we want to update the connection
-	 * at all cost and ignore failures to write them to disk. */
+     * update tries to update the profile on disk (which can always fail).
+     * In some cases we want to ignore such failure and proceed. For example,
+     * when we receive secrets from a secret-agent, we want to update the connection
+     * at all cost and ignore failures to write them to disk. */
     NM_SETTINGS_CONNECTION_UPDATE_REASON_IGNORE_PERSIST_FAILURE = (1u << 0),
 
     /* When updating the profile, force renaming the file on disk. That matters
-	 * only for keyfile plugin. Keyfile prefers a filename based on connection.id.
-	 * When the connection.id changes we might want to rename the file on disk
-	 * (that is, don't overwrite the existing file, but delete it and write it
-	 * with the new name).
-	 * This flag forces such rename. */
+     * only for keyfile plugin. Keyfile prefers a filename based on connection.id.
+     * When the connection.id changes we might want to rename the file on disk
+     * (that is, don't overwrite the existing file, but delete it and write it
+     * with the new name).
+     * This flag forces such rename. */
     NM_SETTINGS_CONNECTION_UPDATE_REASON_FORCE_RENAME = (1u << 1),
 
     /* Usually, changing a profile that is currently active does not immediately
-	 * reapply the changes. The exception are connection.zone and connection.metered
-	 * properties. When this flag is set, then these two properties are reapplied
-	 * right away.
-	 *
-	 * See also %NM_SETTINGS_UPDATE2_FLAG_NO_REAPPLY flag, to prevent partial reapply
-	 * during Update2(). */
+     * reapply the changes. The exception are connection.zone and connection.metered
+     * properties. When this flag is set, then these two properties are reapplied
+     * right away.
+     *
+     * See also %NM_SETTINGS_UPDATE2_FLAG_NO_REAPPLY flag, to prevent partial reapply
+     * during Update2(). */
     NM_SETTINGS_CONNECTION_UPDATE_REASON_REAPPLY_PARTIAL = (1u << 2),
 
     NM_SETTINGS_CONNECTION_UPDATE_REASON_CLEAR_SYSTEM_SECRETS = (1u << 3),
@@ -57,8 +57,8 @@ typedef enum {
     NM_SETTINGS_CONNECTION_UPDATE_REASON_RESET_AGENT_SECRETS = (1u << 6),
 
     /* if a profile was greated as default-wired connection for a device, then
-	 * when the user modifies it via D-Bus, the profile should become persisted
-	 * to disk and it the purpose why the profile was created should be forgotten. */
+     * when the user modifies it via D-Bus, the profile should become persisted
+     * to disk and it the purpose why the profile was created should be forgotten. */
     NM_SETTINGS_CONNECTION_UPDATE_REASON_CLEAR_DEFAULT_WIRED = (1u << 7),
 
     NM_SETTINGS_CONNECTION_UPDATE_REASON_BLOCK_AUTOCONNECT = (1u << 8),
@@ -68,49 +68,49 @@ typedef enum {
 typedef enum {
 
     /* if the profile is in-memory, update it in-memory and keep it.
-	 * if the profile is on-disk, update it on-disk, and keep it. */
+     * if the profile is on-disk, update it on-disk, and keep it. */
     NM_SETTINGS_CONNECTION_PERSIST_MODE_KEEP,
 
     /* persist to disk. If the profile is currently in-memory, remove
-	 * it from /run. Depending on the shadowed-storage, the pre-existing
-	 * file is reused when moving the storage.
-	 *
-	 * Corresponds to %NM_SETTINGS_UPDATE2_FLAG_TO_DISK. */
+     * it from /run. Depending on the shadowed-storage, the pre-existing
+     * file is reused when moving the storage.
+     *
+     * Corresponds to %NM_SETTINGS_UPDATE2_FLAG_TO_DISK. */
     NM_SETTINGS_CONNECTION_PERSIST_MODE_TO_DISK,
 
     /* Update in-memory (i.e. persist to /run). If the profile is currently on disk,
-	 * then a reference to the profile is remembered as "shadowed-storage".
-	 * Later, when storing again to persistent storage, the shadowed-storage is
-	 * updated. When deleting the profile, the shadowed-storage is also deleted
-	 * from disk.
-	 *
-	 * Corresponds to %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY. */
+     * then a reference to the profile is remembered as "shadowed-storage".
+     * Later, when storing again to persistent storage, the shadowed-storage is
+     * updated. When deleting the profile, the shadowed-storage is also deleted
+     * from disk.
+     *
+     * Corresponds to %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY. */
     NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY,
 
     /* Update in-memory (i.e. persist to /run). This is almost like
-	 * %NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY, except the in-memory profile
-	 * remembers not to own the shadowed-storage ("shadowed-owned").
-	 * The difference is that when deleting the in-memory profile, the original
-	 * profile is not deleted but instead the nmmeta tombstone remembers the
-	 * shadowed-storage and re-used it when re-adding the profile.
-	 *
-	 * Corresponds to %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY_DETACHED. */
+     * %NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY, except the in-memory profile
+     * remembers not to own the shadowed-storage ("shadowed-owned").
+     * The difference is that when deleting the in-memory profile, the original
+     * profile is not deleted but instead the nmmeta tombstone remembers the
+     * shadowed-storage and re-used it when re-adding the profile.
+     *
+     * Corresponds to %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY_DETACHED. */
     NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_DETACHED,
 
     /* Update in-memory (i.e. persist to /run). If the profile is currently on disk,
-	 * delete it from disk.
-	 *
-	 * If the profile is in-memory and has a shadowed-storage, the original profile
-	 * will be deleted from disk.
-	 *
-	 * Corresponds to %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY_ONLY. */
+     * delete it from disk.
+     *
+     * If the profile is in-memory and has a shadowed-storage, the original profile
+     * will be deleted from disk.
+     *
+     * Corresponds to %NM_SETTINGS_UPDATE2_FLAG_IN_MEMORY_ONLY. */
     NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_ONLY,
 
     /* This only updates the connection in-memory. Note that "in-memory" above
-	 * means to write to keyfile in /run. This mode really means to not notify the
-	 * settings plugin about the change. This should be only used for updating
-	 * secrets.
-	 */
+     * means to write to keyfile in /run. This mode really means to not notify the
+     * settings plugin about the change. This should be only used for updating
+     * secrets.
+     */
     NM_SETTINGS_CONNECTION_PERSIST_MODE_NO_PERSIST,
 
 } NMSettingsConnectionPersistMode;
diff --git a/src/settings/nm-settings-plugin.c b/src/settings/nm-settings-plugin.c
index 2692912602..e80caa7b09 100644
--- a/src/settings/nm-settings-plugin.c
+++ b/src/settings/nm-settings-plugin.c
@@ -45,7 +45,7 @@ nm_settings_plugin_cmp_by_priority(const NMSettingsPlugin *a,
         nm_assert(idx_b >= 0);
 
         /* plugins that appear first in @plugin_list have higher priority.
-		 * That means: smaller index -> higher priority. Reverse sort. */
+         * That means: smaller index -> higher priority. Reverse sort. */
         NM_CMP_DIRECT(idx_b, idx_a);
     }
 
diff --git a/src/settings/nm-settings-plugin.h b/src/settings/nm-settings-plugin.h
index 1ac2ef743d..01f433a120 100644
--- a/src/settings/nm-settings-plugin.h
+++ b/src/settings/nm-settings-plugin.h
@@ -46,30 +46,30 @@ typedef struct {
     GObjectClass parent;
 
     /*
-	 * Return a string list of specifications of devices which NetworkManager
-	 * should not manage.  Returned list will be freed by the system settings
-	 * service, and each element must be allocated using g_malloc() or its
-	 * variants (g_strdup, g_strdup_printf, etc).
-	 *
-	 * Each string in the list must be in one of the formats recognized by
-	 * nm_device_spec_match_list().
-	 */
+     * Return a string list of specifications of devices which NetworkManager
+     * should not manage.  Returned list will be freed by the system settings
+     * service, and each element must be allocated using g_malloc() or its
+     * variants (g_strdup, g_strdup_printf, etc).
+     *
+     * Each string in the list must be in one of the formats recognized by
+     * nm_device_spec_match_list().
+     */
     GSList *(*get_unmanaged_specs)(NMSettingsPlugin *self);
 
     /*
-	 * Return a string list of specifications of devices for which at least
-	 * one non-NetworkManager-based configuration is defined. Returned list
-	 * will be freed by the system settings service, and each element must be
-	 * allocated using g_malloc() or its variants (g_strdup, g_strdup_printf,
-	 * etc).
-	 *
-	 * Each string in the list must be in one of the formats recognized by
-	 * nm_device_spec_match_list().
-	 */
+     * Return a string list of specifications of devices for which at least
+     * one non-NetworkManager-based configuration is defined. Returned list
+     * will be freed by the system settings service, and each element must be
+     * allocated using g_malloc() or its variants (g_strdup, g_strdup_printf,
+     * etc).
+     *
+     * Each string in the list must be in one of the formats recognized by
+     * nm_device_spec_match_list().
+     */
     GSList *(*get_unrecognized_specs)(NMSettingsPlugin *self);
 
     /* Requests that the plugin load/reload a set of filenames.
-	 */
+     */
     void (*load_connections)(NMSettingsPlugin *                     self,
                              NMSettingsPluginConnectionLoadEntry *  entries,
                              gsize                                  n_entries,
@@ -77,8 +77,8 @@ typedef struct {
                              gpointer                               user_data);
 
     /* Requests that the plugin reload all connection files from disk,
-	 * and emit signals reflecting new, changed, and removed connections.
-	 */
+     * and emit signals reflecting new, changed, and removed connections.
+     */
     void (*reload_connections)(NMSettingsPlugin *                     self,
                                NMSettingsPluginConnectionLoadCallback callback,
                                gpointer                               user_data);
diff --git a/src/settings/nm-settings-storage.c b/src/settings/nm-settings-storage.c
index e0304e0790..477c9933ff 100644
--- a/src/settings/nm-settings-storage.c
+++ b/src/settings/nm-settings-storage.c
@@ -20,9 +20,9 @@ nm_settings_storage_cmp(NMSettingsStorage *a, NMSettingsStorage *b, const GSList
     NMSettingsStorageClass *klass;
 
     /* Sort by priority.
-	 *
-	 * If a > b (by priority), we return a positive number (as one
-	 * would expect by a cmp() function). */
+     *
+     * If a > b (by priority), we return a positive number (as one
+     * would expect by a cmp() function). */
 
     nm_assert(NM_IS_SETTINGS_STORAGE(a));
     nm_assert(NM_IS_SETTINGS_STORAGE(b));
@@ -39,7 +39,7 @@ nm_settings_storage_cmp(NMSettingsStorage *a, NMSettingsStorage *b, const GSList
     klass = NM_SETTINGS_STORAGE_GET_CLASS(a);
     if (klass != NM_SETTINGS_STORAGE_GET_CLASS(b)) {
         /* one plugin must return storages of the same type. Otherwise, it's
-		 * unclear how cmp_fcn() should compare them. */
+         * unclear how cmp_fcn() should compare them. */
         nm_assert_not_reached();
         return 0;
     }
diff --git a/src/settings/nm-settings.c b/src/settings/nm-settings.c
index 7c007df7f5..5c5fbf0790 100644
--- a/src/settings/nm-settings.c
+++ b/src/settings/nm-settings.c
@@ -156,9 +156,9 @@ static gboolean
 _storage_data_is_alive(StorageData *sd)
 {
     /* If the storage tracks a connection, it is considered alive.
-	 *
-	 * Meta-data storages are special: they never track a connection.
-	 * We need to check them specially to know when to drop them. */
+     *
+     * Meta-data storages are special: they never track a connection.
+     * We need to check them specially to know when to drop them. */
     return sd->connection || nm_settings_storage_is_meta_data_alive(sd->storage);
 }
 
@@ -250,28 +250,28 @@ _sett_conn_entry_storage_find_conflicting_storage(SettConnEntry *    sett_conn_e
 
     if (storage_check_including && nm_settings_storage_is_keyfile_run(storage_check_including)) {
         /* the storage we check against is in-memory. It always has highest
-		 * priority, so there can be no other conflicting storages. */
+         * priority, so there can be no other conflicting storages. */
         return NULL;
     }
 
     /* Finds the first (highest priority) storage that has a connection.
-	 * Note that due to tombstones (that have a high priority), the connection
-	 * may not actually be exposed. This is to find hidden/shadowed storages
-	 * that provide a connection. */
+     * Note that due to tombstones (that have a high priority), the connection
+     * may not actually be exposed. This is to find hidden/shadowed storages
+     * that provide a connection. */
     c_list_for_each_entry (sd, &sett_conn_entry->sd_lst_head, sd_lst) {
         nm_assert(NM_IS_SETTINGS_STORAGE(sd->storage));
 
         if (!sd->connection) {
             /* We only consider storages with connection. In particular,
-			 * tombstones are not relevant, because we can delete them to
-			 * resolve the conflict. */
+             * tombstones are not relevant, because we can delete them to
+             * resolve the conflict. */
             continue;
         }
 
         if (sd->storage == storage_check_including) {
             /* ok, the storage is the one we are about to check. All other
-			 * storages are lower priority, so there is no storage that hides
-			 * our storage_check_including. */
+             * storages are lower priority, so there is no storage that hides
+             * our storage_check_including. */
             return NULL;
         }
 
@@ -280,12 +280,12 @@ _sett_conn_entry_storage_find_conflicting_storage(SettConnEntry *    sett_conn_e
                                                plugins)
             <= 0) {
             /* the plugin of the existing storage is less important than @target_plugin.
-			 * We have no conflicting/hiding storage. */
+             * We have no conflicting/hiding storage. */
             return NULL;
         }
 
         /* Found. If we would add the profile to @target_plugin, then it would be hidden
-		 * by existing_storage. */
+         * by existing_storage. */
         return sd->storage;
     }
 
@@ -493,7 +493,7 @@ _startup_complete_check_is_ready(NMSettings *          self,
         if (nm_device_get_state(device) < NM_DEVICE_STATE_UNAVAILABLE
             || (!ignore_pending_actions && nm_device_has_pending_action(device))) {
             /* while a device is not yet available and still has a pending
-			 * action itself, it's not a suitable candidate. */
+             * action itself, it's not a suitable candidate. */
             continue;
         }
 
@@ -534,7 +534,7 @@ _startup_complete_check(NMSettings *self, gint64 now_msec)
 
     if (!priv->started) {
         /* before we are started there is no need to evaluate our list because
-		 * we are anyway blocking startup-complete. */
+         * we are anyway blocking startup-complete. */
         return;
     }
 
@@ -546,14 +546,14 @@ _startup_complete_check(NMSettings *self, gint64 now_msec)
     elapsed_msec = now_msec - priv->startup_complete_start_timestamp_msec;
 
     /* We search the entire list whether they all timed-out or found a compatible device.
-	 * We do that by appending elements that are ready to the end of the list, so that
-	 * we hopefully keep testing the elements that are ready already (and can shortcut
-	 * the test in common cases).
-	 *
-	 * Note that all profiles that we wait for need to have their dependencies satisfied
-	 * at the same time. For example, consider connection A is waiting for device A' which is ready.
-	 * Connection B waits for device B', which isn't ready. Once B'/B becomes ready, A/A' must
-	 * still be ready. Otherwise, we would wait for A/A' to become ready again. */
+     * We do that by appending elements that are ready to the end of the list, so that
+     * we hopefully keep testing the elements that are ready already (and can shortcut
+     * the test in common cases).
+     *
+     * Note that all profiles that we wait for need to have their dependencies satisfied
+     * at the same time. For example, consider connection A is waiting for device A' which is ready.
+     * Connection B waits for device B', which isn't ready. Once B'/B becomes ready, A/A' must
+     * still be ready. Otherwise, we would wait for A/A' to become ready again. */
     scd_not_ready = NULL;
     c_list_init(&ready_lst);
     c_list_for_each_entry_safe (scd, scd_safe, &priv->startup_complete_scd_lst_head, scd_lst) {
@@ -568,7 +568,7 @@ _startup_complete_check(NMSettings *self, gint64 now_msec)
 
 next_with_ready:
         /* this element is ready. We move it to a temporary list, so that we
-		 * can reorder the list (to next time evaluate the non-ready element first). */
+         * can reorder the list (to next time evaluate the non-ready element first). */
         nm_c_list_move_tail(&ready_lst, &scd->scd_lst);
     }
     c_list_splice(&priv->startup_complete_scd_lst_head, &ready_lst);
@@ -830,49 +830,49 @@ _sett_conn_entry_sds_update_cmp_ascending(const StorageData *sd_a,
     bool                      is_keyfile_run_b;
 
     /* Sort storages by priority. More important storages are sorted
-	 * higher (ascending sort). For example, if "sd_a" is more important than
-	 * "sd_b" (sd_a>sd_b), a positive integer is returned. */
+     * higher (ascending sort). For example, if "sd_a" is more important than
+     * "sd_b" (sd_a>sd_b), a positive integer is returned. */
 
     meta_data_a = nm_settings_storage_is_meta_data(sd_a->storage);
     meta_data_b = nm_settings_storage_is_meta_data(sd_b->storage);
 
     /* runtime storages (both connections and meta-data) are always more
-	 * important. */
+     * important. */
     is_keyfile_run_a = nm_settings_storage_is_keyfile_run(sd_a->storage);
     is_keyfile_run_b = nm_settings_storage_is_keyfile_run(sd_b->storage);
     if (is_keyfile_run_a != is_keyfile_run_b) {
         if (!meta_data_a && !meta_data_b) {
             /* Ok, both are non-meta-data providing actual profiles. But one is in /run and one is in
-			 * another storage. In this case we first honor whether one of the storages is explicitly
-			 * prioritized. The prioritize flag is an in-memory hack to overwrite relative priorities
-			 * contrary to what exists on-disk.
-			 *
-			 * This is done because when we use explicit D-Bus API (like update-connection)
-			 * to update a profile, then we really want to prioritize the candidate
-			 * despite having multiple other profiles.
-			 *
-			 * The example is if you have the same UUID twice in /run (one of them shadowed).
-			 * If you move it to disk, then one of the profiles gets deleted and re-created
-			 * on disk, but that on-disk profile must win against the remainging profile in
-			 * /run. At least until the next reload/restart. */
+             * another storage. In this case we first honor whether one of the storages is explicitly
+             * prioritized. The prioritize flag is an in-memory hack to overwrite relative priorities
+             * contrary to what exists on-disk.
+             *
+             * This is done because when we use explicit D-Bus API (like update-connection)
+             * to update a profile, then we really want to prioritize the candidate
+             * despite having multiple other profiles.
+             *
+             * The example is if you have the same UUID twice in /run (one of them shadowed).
+             * If you move it to disk, then one of the profiles gets deleted and re-created
+             * on disk, but that on-disk profile must win against the remainging profile in
+             * /run. At least until the next reload/restart. */
             NM_CMP_FIELD_UNSAFE(sd_a, sd_b, prioritize);
         }
 
         /* in-memory has higher priority. That is regardless of whether any of
-		 * them is meta-data/tombstone or a profile.
-		 *
-		 * That works, because if any of them are tombstones/metadata, then we are in full
-		 * control. There can by only one meta-data file, which is fully owned (and accordingly
-		 * created/deleted) by NetworkManager.
-		 *
-		 * The only case where this might not be right is if we have profiles
-		 * in /run that are shadowed. When we move such a profile to disk, then
-		 * a conflict might arise. That is handled by "prioritize" above! */
+         * them is meta-data/tombstone or a profile.
+         *
+         * That works, because if any of them are tombstones/metadata, then we are in full
+         * control. There can by only one meta-data file, which is fully owned (and accordingly
+         * created/deleted) by NetworkManager.
+         *
+         * The only case where this might not be right is if we have profiles
+         * in /run that are shadowed. When we move such a profile to disk, then
+         * a conflict might arise. That is handled by "prioritize" above! */
         NM_CMP_DIRECT(is_keyfile_run_a, is_keyfile_run_b);
     }
 
     /* After we determined that both profiles are either in /run or not,
-	 * tombstones are always more important than non-tombstones. */
+     * tombstones are always more important than non-tombstones. */
     NM_CMP_DIRECT(meta_data_a && meta_data_a->is_tombstone,
                   meta_data_b && meta_data_b->is_tombstone);
 
@@ -880,8 +880,8 @@ _sett_conn_entry_sds_update_cmp_ascending(const StorageData *sd_a,
     NM_CMP_FIELD_UNSAFE(sd_a, sd_b, prioritize);
 
     /* finally, compare the storages. This basically honors the timestamp
-	 * of the profile and the relative order of the source plugin (via the
-	 * @plugins list). */
+     * of the profile and the relative order of the source plugin (via the
+     * @plugins list). */
     return nm_settings_storage_cmp(sd_a->storage, sd_b->storage, plugins);
 }
 
@@ -906,20 +906,20 @@ _sett_conn_entry_sds_update(NMSettings *self, SettConnEntry *sett_conn_entry)
     nm_assert_storage_data_lst(&sett_conn_entry->dirty_sd_lst_head);
 
     /* we merge the dirty list with the previous list.
-	 *
-	 * The idea is:
-	 *
-	 *  - _connection_changed_track() appends events for the same UUID. Meaning:
-	 *    if the storage is new, it get appended (having lower priority).
-	 *    If it already exist and is an update for an event that we already
-	 *    track it, it keeps the list position in @dirty_sd_lst_head unchanged.
-	 *
-	 *  - during merge, we want to preserve the previous order (with higher
-	 *    priority first in the list).
-	 */
+     *
+     * The idea is:
+     *
+     *  - _connection_changed_track() appends events for the same UUID. Meaning:
+     *    if the storage is new, it get appended (having lower priority).
+     *    If it already exist and is an update for an event that we already
+     *    track it, it keeps the list position in @dirty_sd_lst_head unchanged.
+     *
+     *  - during merge, we want to preserve the previous order (with higher
+     *    priority first in the list).
+     */
 
     /* first go through all storages that we track and check whether they
-	 * got an update...*/
+     * got an update...*/
 
     reprioritize = FALSE;
     c_list_for_each_entry (sd, &sett_conn_entry->dirty_sd_lst_head, sd_lst) {
@@ -949,14 +949,14 @@ _sett_conn_entry_sds_update(NMSettings *self, SettConnEntry *sett_conn_entry)
     nm_assert_storage_data_lst(&sett_conn_entry->sd_lst_head);
 
     /* all remaining (so far unseen) dirty entries are appended to the merged list.
-	 * (append means lower priority). */
+     * (append means lower priority). */
 
     c_list_splice(&sett_conn_entry->sd_lst_head, &sett_conn_entry->dirty_sd_lst_head);
 
     nm_assert_storage_data_lst(&sett_conn_entry->sd_lst_head);
 
     /* we drop the entries that are no longer "alive" (meaning, they no longer
-	 * indicate a connection and are not a tombstone). */
+     * indicate a connection and are not a tombstone). */
     c_list_for_each_entry_safe (sd, sd_safe, &sett_conn_entry->sd_lst_head, sd_lst) {
         if (!_storage_data_is_alive(sd))
             _storage_data_destroy(sd);
@@ -1009,8 +1009,8 @@ _connection_changed_normalize_connection(NMSettingsStorage *storage,
                                           connection_cloned ? NULL : &connection_cloned,
                                           &error)) {
         /* this is most likely a bug in the plugin. It provided a connection that no longer verifies.
-		 * Well, I guess it could also happen when we merge @secrets_to_merge above. In any case
-		 * somewhere is a bug. */
+         * Well, I guess it could also happen when we merge @secrets_to_merge above. In any case
+         * somewhere is a bug. */
         _LOGT("storage[%s," NM_SETTINGS_STORAGE_PRINT_FMT
               "]: plugin provided an invalid connection: %s",
               uuid,
@@ -1093,7 +1093,7 @@ _connection_changed_update(NMSettings *                     self,
         nm_assert(!NM_FLAGS_HAS(sett_flags, NM_SETTINGS_CONNECTION_INT_FLAGS_UNSAVED));
 
         /* Profiles that don't reside in /run, are never nm-generated,
-		 * volatile, and external. */
+         * volatile, and external. */
         sett_mask |= (NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
                       | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
                       | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL);
@@ -1106,9 +1106,9 @@ _connection_changed_update(NMSettings *                     self,
 
     if (is_new) {
         /* FIXME(shutdown): The NMSettings instance can't be disposed
-		 * while there is any exported connection. Ideally we should
-		 * unexport all connections on NMSettings' disposal, but for now
-		 * leak @self on termination when there are connections alive. */
+         * while there is any exported connection. Ideally we should
+         * unexport all connections on NMSettings' disposal, but for now
+         * leak @self on termination when there are connections alive. */
         path = nm_dbus_object_export(NM_DBUS_OBJECT(sett_conn));
     } else
         path = nm_dbus_object_get_path(NM_DBUS_OBJECT(sett_conn));
@@ -1165,10 +1165,10 @@ _connection_changed_delete(NMSettings *          self,
           NM_SETTINGS_STORAGE_PRINT_ARG(storage));
 
     /* When the default wired sett_conn is removed (either deleted or saved to
-	 * a new persistent sett_conn by a plugin), write the MAC address of the
-	 * wired device to the config file and don't create a new default wired
-	 * sett_conn for that device again.
-	 */
+     * a new persistent sett_conn by a plugin), write the MAC address of the
+     * wired device to the config file and don't create a new default wired
+     * sett_conn for that device again.
+     */
     device = nm_settings_connection_default_wired_get_device(sett_conn);
     if (device)
         default_wired_clear_tag(self, device, sett_conn, allow_add_to_no_auto_default);
@@ -1382,7 +1382,7 @@ _connection_changed_track(NMSettings *       self,
     }
 
     /* see _sett_conn_entry_sds_update() for why we append the new events
-	 * and leave existing ones at their position. */
+     * and leave existing ones at their position. */
     sd = _storage_data_find_in_lst(&sett_conn_entry->dirty_sd_lst_head, storage);
     if (sd)
         nm_g_object_ref_set(&sd->connection, connection);
@@ -1482,13 +1482,13 @@ _add_connection_to_first_plugin(NMSettings *                 self,
                                                                                     priv->plugins);
             if (conflicting_storage) {
                 /* we have a connection provided by a plugin with higher priority than the one
-				 * we would want to add the connection. We cannot do that, because doing so
-				 * would result in adding a connection that gets hidden by the existing profile.
-				 * Also, since we test the plugins in order of priority, all following plugins
-				 * are unsuitable.
-				 *
-				 * Multiple connection plugins are so cumbersome, especially if they are unable
-				 * to add the connection. I suggest to disable all plugins except keyfile. */
+                 * we would want to add the connection. We cannot do that, because doing so
+                 * would result in adding a connection that gets hidden by the existing profile.
+                 * Also, since we test the plugins in order of priority, all following plugins
+                 * are unsuitable.
+                 *
+                 * Multiple connection plugins are so cumbersome, especially if they are unable
+                 * to add the connection. I suggest to disable all plugins except keyfile. */
                 _LOGT("add-connection: failed to add %s/'%s': there is an existing "
                       "storage " NM_SETTINGS_STORAGE_PRINT_FMT " with higher priority",
                       nm_connection_get_uuid(new_connection),
@@ -1766,10 +1766,10 @@ nm_settings_add_connection(NMSettings *                    self,
                 NULL));
             if (shadowed_storage) {
                 /* We have a nmmeta tombstone that indicates that a storage is shadowed.
-				 *
-				 * This happens when deleting a in-memory profile that was decoupled from
-				 * the persistent storage with NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_DETACHED.
-				 * We need to take over this storage again... */
+                 *
+                 * This happens when deleting a in-memory profile that was decoupled from
+                 * the persistent storage with NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_DETACHED.
+                 * We need to take over this storage again... */
                 break;
             }
         }
@@ -1785,10 +1785,10 @@ nm_settings_add_connection(NMSettings *                    self,
             priv->plugins);
         if (conflicting_storage) {
             /* We cannot add the profile as @shadowed_storage, because there is another, existing storage
-			 * that would hide it. Just add it as new storage. In general, this leads to duplication of profiles,
-			 * but the circumstances where this happens are very exotic (you need at least one additional settings
-			 * plugin, then going through the paths of making shadowed_storage in-memory-detached and delete it,
-			 * and finally adding the conflicting storage outside of NM and restart/reload). */
+             * that would hide it. Just add it as new storage. In general, this leads to duplication of profiles,
+             * but the circumstances where this happens are very exotic (you need at least one additional settings
+             * plugin, then going through the paths of making shadowed_storage in-memory-detached and delete it,
+             * and finally adding the conflicting storage outside of NM and restart/reload). */
             _LOGT("ignore shadowed storage " NM_SETTINGS_STORAGE_PRINT_FMT
                   " due to conflicting storage " NM_SETTINGS_STORAGE_PRINT_FMT,
                   NM_SETTINGS_STORAGE_PRINT_ARG(shadowed_storage),
@@ -1829,8 +1829,8 @@ again_add_connection:
         if (!success) {
             if (!NMS_IS_KEYFILE_STORAGE(update_storage)) {
                 /* hm, the intended storage is not keyfile (it's ifcfg-rh). This settings
-				 * plugin may not support the new connection. So step back and retry adding
-				 * the profile anew. */
+                 * plugin may not support the new connection. So step back and retry adding
+                 * the profile anew. */
                 _LOGT("failure to add profile as existing storage \"%s\": %s",
                       nm_settings_storage_get_filename(update_storage),
                       local->message);
@@ -1894,8 +1894,8 @@ again_delete_tombstone:
                                                      &new_tombstone_storage,
                                                      NULL)) {
             /* Ups, something went wrong. We really need to get rid of the tombstone. At least
-			 * forget about it in-memory. Upong next restart/reload, this might be reverted
-			 * however :( .*/
+             * forget about it in-memory. Upong next restart/reload, this might be reverted
+             * however :( .*/
             if (!simulate) {
                 simulate = TRUE;
                 goto again_delete_tombstone;
@@ -2012,9 +2012,9 @@ nm_settings_update_connection(NMSettings *                     self,
         NMDevice *device;
 
         /* The connection has been changed by the user, it should no longer be
-		 * considered a default wired connection, and should no longer affect
-		 * the no-auto-default configuration option.
-		 */
+         * considered a default wired connection, and should no longer affect
+         * the no-auto-default configuration option.
+         */
         device = nm_settings_connection_default_wired_get_device(sett_conn);
         if (device) {
             nm_assert(cur_in_memory);
@@ -2025,11 +2025,11 @@ nm_settings_update_connection(NMSettings *                     self,
 
             if (NM_IN_SET(persist_mode, NM_SETTINGS_CONNECTION_PERSIST_MODE_NO_PERSIST)) {
                 /* making a default-wired-connection a regular connection implies persisting
-				 * it to disk (unless specified differently).
-				 *
-				 * Actually, this line is probably unreached, because we should not use
-				 * NM_SETTINGS_CONNECTION_PERSIST_MODE_NO_PERSIST to toggle the nm-generated
-				 * flag. */
+                 * it to disk (unless specified differently).
+                 *
+                 * Actually, this line is probably unreached, because we should not use
+                 * NM_SETTINGS_CONNECTION_PERSIST_MODE_NO_PERSIST to toggle the nm-generated
+                 * flag. */
                 nm_assert_not_reached();
                 persist_mode = NM_SETTINGS_CONNECTION_PERSIST_MODE_TO_DISK;
             }
@@ -2046,8 +2046,8 @@ nm_settings_update_connection(NMSettings *                     self,
                             | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
                             | NM_SETTINGS_CONNECTION_INT_FLAGS_EXTERNAL)) {
         /* we update the nm-generated/volatile setting of a profile (which is inherently
-		 * in-memory. The caller did not request to persist this to disk, however we need
-		 * to store the flags in run. */
+         * in-memory. The caller did not request to persist this to disk, however we need
+         * to store the flags in run. */
         nm_assert(cur_in_memory);
         persist_mode = NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY;
     }
@@ -2066,13 +2066,13 @@ nm_settings_update_connection(NMSettings *                     self,
 
     if (!new_in_memory) {
         /* Persistent connections cannot be volatile nor nm-generated.
-		 *
-		 * That is obviously true for volatile, as it is enforced by Update2() API.
-		 *
-		 * For nm-generated profiles also, because the nm-generated flag is only stored
-		 * for in-memory profiles. If we would persist the profile to /etc it would loose
-		 * the nm-generated flag after restart/reload, and that cannot be right. If a profile
-		 * ends up on disk, the information who created it gets lost. */
+         *
+         * That is obviously true for volatile, as it is enforced by Update2() API.
+         *
+         * For nm-generated profiles also, because the nm-generated flag is only stored
+         * for in-memory profiles. If we would persist the profile to /etc it would loose
+         * the nm-generated flag after restart/reload, and that cannot be right. If a profile
+         * ends up on disk, the information who created it gets lost. */
         nm_assert(!NM_FLAGS_ANY(sett_flags,
                                 NM_SETTINGS_CONNECTION_INT_FLAGS_NM_GENERATED
                                     | NM_SETTINGS_CONNECTION_INT_FLAGS_VOLATILE
@@ -2134,7 +2134,7 @@ nm_settings_update_connection(NMSettings *                     self,
             }
         } else if (nm_settings_storage_is_keyfile_lib(cur_storage)) {
             /* the profile is a keyfile in /usr/lib. It cannot be overwritten, we must migrate it
-			 * from /usr/lib to /etc. */
+             * from /usr/lib to /etc. */
         } else
             update_storage = cur_storage;
 
@@ -2253,7 +2253,7 @@ nm_settings_update_connection(NMSettings *                     self,
                   NM_PRINT_FMT_QUOTED(filename, " (file \"", filename, "\")", ""),
                   local->message);
             /* there is no aborting back form this. We must get rid of the connection and
-			 * cannot do better than log a message. Proceed, but remember to write tombstones. */
+             * cannot do better than log a message. Proceed, but remember to write tombstones. */
             if (nm_settings_storage_is_keyfile_run(cur_storage))
                 tombstone_in_memory = TRUE;
             else
@@ -2344,7 +2344,7 @@ nm_settings_delete_connection(NMSettings *          self,
                   local->message);
             g_clear_error(&local);
             /* there is no aborting back form this. We must get rid of the connection and
-			 * cannot do better than log a message. Proceed, but remember to write tombstones. */
+             * cannot do better than log a message. Proceed, but remember to write tombstones. */
             if (nm_settings_storage_is_keyfile_run(cur_storage))
                 tombstone_in_memory = TRUE;
             else
@@ -2363,7 +2363,7 @@ nm_settings_delete_connection(NMSettings *          self,
 
             if (sd->storage == shadowed_storage_unowned) {
                 /* this only happens if we leak a profile on disk after NM_SETTINGS_CONNECTION_PERSIST_MODE_IN_MEMORY_DETACHED.
-				 * We need to write a tombstone and remember the shadowed-storage. */
+                 * We need to write a tombstone and remember the shadowed-storage. */
                 tombstone_in_memory = TRUE;
                 new_shadowed_storage_filename =
                     nm_settings_storage_get_filename(shadowed_storage_unowned);
@@ -2402,9 +2402,9 @@ send_agent_owned_secrets(NMSettings *self, NMSettingsConnection *sett_conn, NMAu
     gs_unref_object NMConnection *for_agent = NULL;
 
     /* Dupe the connection so we can clear out non-agent-owned secrets,
-	 * as agent-owned secrets are the only ones we send back to be saved.
-	 * Only send secrets to agents of the same UID that called update too.
-	 */
+     * as agent-owned secrets are the only ones we send back to be saved.
+     * Only send secrets to agents of the same UID that called update too.
+     */
     for_agent = nm_simple_connection_new_clone(nm_settings_connection_get_connection(sett_conn));
     _nm_connection_clear_secrets_by_secret_flags(for_agent, NM_SETTING_SECRET_FLAG_AGENT_OWNED);
     nm_agent_manager_save_secrets(priv->agent_mgr,
@@ -2453,9 +2453,9 @@ pk_add_cb(NMAuthChain *chain, GDBusMethodInvocation *context, gpointer user_data
                                    &error);
 
         /* The callback may remove the connection from the settings manager (e.g.
-		 * because it's found to be incompatible with the device on AddAndActivate).
-		 * But we need to keep it alive for a bit longer, precisely to check wehther
-		 * it's still known to the setting manager. */
+         * because it's found to be incompatible with the device on AddAndActivate).
+         * But we need to keep it alive for a bit longer, precisely to check wehther
+         * it's still known to the setting manager. */
         nm_g_object_ref(added);
     }
 
@@ -2511,9 +2511,9 @@ nm_settings_add_connection_dbus(NMSettings *                    self,
         goto done;
 
     /* If the caller is the only user in the connection's permissions, then
-	 * we use the 'modify.own' permission instead of 'modify.system'.  If the
-	 * request affects more than just the caller, require 'modify.system'.
-	 */
+     * we use the 'modify.own' permission instead of 'modify.system'.  If the
+     * request affects more than just the caller, require 'modify.system'.
+     */
     s_con = nm_connection_get_setting_connection(connection);
     nm_assert(s_con);
     if (nm_setting_connection_get_num_permissions(s_con) == 1)
@@ -2768,9 +2768,9 @@ impl_settings_load_connections(NMDBusObject *                     obj,
     g_variant_get(parameters, "(^a&s)", &filenames);
 
     /* The permission is already enforced by the D-Bus daemon, but we ensure
-	 * that the caller is still alive so that clients are forced to wait and
-	 * we'll be able to switch to polkit without breaking behavior.
-	 */
+     * that the caller is still alive so that clients are forced to wait and
+     * we'll be able to switch to polkit without breaking behavior.
+     */
     if (!nm_dbus_manager_ensure_uid(nm_dbus_object_get_manager(obj),
                                     invocation,
                                     G_MAXULONG,
@@ -2858,9 +2858,9 @@ impl_settings_reload_connections(NMDBusObject *                     obj,
     NMSettings *self = NM_SETTINGS(obj);
 
     /* The permission is already enforced by the D-Bus daemon, but we ensure
-	 * that the caller is still alive so that clients are forced to wait and
-	 * we'll be able to switch to polkit without breaking behavior.
-	 */
+     * that the caller is still alive so that clients are forced to wait and
+     * we'll be able to switch to polkit without breaking behavior.
+     */
     if (!nm_dbus_manager_ensure_uid(nm_dbus_object_get_manager(obj),
                                     invocation,
                                     G_MAXULONG,
@@ -2888,9 +2888,9 @@ _clear_connections_cached_list(NMSettingsPrivate *priv)
 
 #if NM_MORE_ASSERTS
     /* set the pointer to a bogus value. This makes it more apparent
-	 * if somebody has a reference to the cached list and still uses
-	 * it. That is a bug, this code just tries to make it blow up
-	 * more eagerly. */
+     * if somebody has a reference to the cached list and still uses
+     * it. That is a bug, this code just tries to make it blow up
+     * more eagerly. */
     memset(priv->connections_cached_list,
            0x43,
            sizeof(NMSettingsConnection *) * (priv->connections_len + 1));
@@ -3223,7 +3223,7 @@ add_plugin_load_file(NMSettings *self, const char *pname, GError **error)
     }
 
     /* after accessing the plugin we cannot unload it anymore, because the glib
-	 * types cannot be properly unregistered. */
+     * types cannot be properly unregistered. */
     g_module_make_resident(module);
 
     plugin = (*factory_func)();
@@ -3278,7 +3278,7 @@ load_plugins(NMSettings *self, const char *const *plugins, GError **error)
 
         if (nm_utils_strv_find_first((char **) plugins, iter - plugins, pname) >= 0) {
             /* the plugin is already mentioned in the list previously.
-			 * Don't load a duplicate. */
+             * Don't load a duplicate. */
             continue;
         }
 
@@ -3466,15 +3466,15 @@ device_realized(NMDevice *device, GParamSpec *pspec, NMSettings *self)
     priv = NM_SETTINGS_GET_PRIVATE(self);
 
     /* If the device isn't managed or it already has a default wired connection,
-	 * ignore it.
-	 */
+     * ignore it.
+     */
     if (!NM_DEVICE_GET_CLASS(device)->new_default_connection
         || !nm_device_get_managed(device, FALSE)
         || g_object_get_qdata(G_OBJECT(device), _default_wired_connection_blocked_quark()))
         return;
 
     /* we only check once whether to create the auto-default connection. If we reach this point,
-	 * we mark the creation of the default-wired-connection as blocked. */
+     * we mark the creation of the default-wired-connection as blocked. */
     g_object_set_qdata(G_OBJECT(device), _default_wired_connection_blocked_quark(), device);
 
     if (nm_config_get_no_auto_default_for_device(priv->config, device)) {
@@ -3536,7 +3536,7 @@ nm_settings_device_added(NMSettings *self, NMDevice *device)
         device_realized(device, NULL, self);
     else {
         /* FIXME(shutdown): we need to disconnect this signal handler during
-		 *   shutdown. */
+         *   shutdown. */
         g_signal_connect_after(device,
                                "notify::" NM_DEVICE_REAL,
                                G_CALLBACK(device_realized),
@@ -3556,8 +3556,8 @@ nm_settings_device_removed(NMSettings *self, NMDevice *device, gboolean quitting
         default_wired_clear_tag(self, device, connection, FALSE);
 
         /* Don't delete the default wired connection on shutdown, so that it
-		 * remains up and can be assumed if NM starts again.
-		 */
+         * remains up and can be assumed if NM starts again.
+         */
         if (quitting == FALSE)
             nm_settings_connection_delete(connection, TRUE);
     }
@@ -3585,13 +3585,13 @@ again:
                                          is_visible);
         if (generation != priv->connections_generation) {
             /* the cached list was invalidated. Start again.
-			 *
-			 * Note that nm_settings_connection_recheck_visibility() will do nothing
-			 * if the visibility didn't change (including emitting no signals,
-			 * and not invalidating the list).
-			 *
-			 * Hence, for this to be an endless loop, the settings would have
-			 * to constantly change the visibility flag and also invalidate the list. */
+             *
+             * Note that nm_settings_connection_recheck_visibility() will do nothing
+             * if the visibility didn't change (including emitting no signals,
+             * and not invalidating the list).
+             *
+             * Hence, for this to be an endless loop, the settings would have
+             * to constantly change the visibility flag and also invalidate the list. */
             goto again;
         }
     }
@@ -3776,9 +3776,9 @@ nm_settings_start(NMSettings *self, GError **error)
     _startup_complete_check(self, 0);
 
     /* FIXME(shutdown): we also need a nm_settings_stop() during shutdown.
-	 *
-	 * In particular, we need to remove all in-memory keyfiles from /run that are nm-generated.
-	 * alternatively, the nm-generated flag must also be persisted and loaded to /run. */
+     *
+     * In particular, we need to remove all in-memory keyfiles from /run that are nm-generated.
+     * alternatively, the nm-generated flag must also be persisted and loaded to /run. */
 
     return TRUE;
 }
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
index 50a33cbc52..48a798ee49 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-plugin.c
@@ -293,12 +293,12 @@ _storages_consolidate(NMSIfcfgRHPlugin *                     self,
     guint                        i;
 
     /* when we reload all files, we must signal add/update/modify of profiles one-by-one.
-	 * NMSettings then goes ahead and emits further signals and a lot of things happen.
-	 *
-	 * So, first, emit an update of the unmanaged/unrecognized specs that contains *all*
-	 * the unmanaged/unrecognized devices from before and after. Since both unmanaged/unrecognized
-	 * specs have the meaning of "not doing something", it makes sense that we temporarily
-	 * disable that action for the sum of before and after. */
+     * NMSettings then goes ahead and emits further signals and a lot of things happen.
+     *
+     * So, first, emit an update of the unmanaged/unrecognized specs that contains *all*
+     * the unmanaged/unrecognized devices from before and after. Since both unmanaged/unrecognized
+     * specs have the meaning of "not doing something", it makes sense that we temporarily
+     * disable that action for the sum of before and after. */
     _unhandled_specs_merge_storages(self, storages_new);
 
     storages_modified = g_ptr_array_new_with_free_func(g_object_unref);
@@ -366,7 +366,7 @@ _storages_consolidate(NMSIfcfgRHPlugin *                     self,
 
         if (!storage->dirty) {
             /* the entry is no longer dirty. In the meantime we already emitted
-			 * another signal for it. */
+             * another signal for it. */
             continue;
         }
         storage->dirty = FALSE;
@@ -375,8 +375,8 @@ _storages_consolidate(NMSIfcfgRHPlugin *                     self,
                 &priv->storages,
                 nms_ifcfg_rh_storage_get_filename(storage))) {
             /* hm? The profile was deleted in the meantime? That is only possible
-			 * if the signal handler called again into the plugin. In any case, the event
-			 * was already emitted. Skip. */
+             * if the signal handler called again into the plugin. In any case, the event
+             * was already emitted. Skip. */
             continue;
         }
 
@@ -479,7 +479,7 @@ load_connections(NMSettingsPlugin *                     plugin,
                 NMSIfcfgRHStorage *storage2;
 
                 /* the file does not exist. We take that as indication to unload the file
-				 * that was previously loaded... */
+                 * that was previously loaded... */
                 storage2 = nm_sett_util_storages_lookup_by_filename(&priv->storages, full_filename);
                 if (storage2)
                     g_hash_table_add(storages_replaced, g_object_ref(storage2));
@@ -519,15 +519,15 @@ load_connections(NMSettingsPlugin *                     plugin,
             }
 
             /* @storage has a UUID that was just loaded from disk, but we have an entry in cache.
-			 * Reload that file too despite not being told to do so. The reason is to get
-			 * the latest file timestamp so that we get the priorities right. */
+             * Reload that file too despite not being told to do so. The reason is to get
+             * the latest file timestamp so that we get the priorities right. */
 
             storage_new = _load_file(self, full_filename, &local);
             if (storage_new
                 && !nm_streq0(loaded_uuid, nms_ifcfg_rh_storage_get_uuid_opt(storage_new))) {
                 /* the file now references a different UUID. We are not told to reload
-				 * that file, so this means the existing storage (with the previous
-				 * filename and UUID tuple) is no longer valid. */
+                 * that file, so this means the existing storage (with the previous
+                 * filename and UUID tuple) is no longer valid. */
                 g_clear_object(&storage_new);
             }
 
@@ -567,12 +567,12 @@ load_connections_done(NMSettingsPlugin *plugin)
     NMSIfcfgRHPlugin *self = NMS_IFCFG_RH_PLUGIN(plugin);
 
     /* at the beginning of a load, we emit a change signal for unmanaged/unrecognized
-	 * specs that contain the sum of before and after (_unhandled_specs_merge_storages()).
-	 *
-	 * The idea is that while we emit signals about changes to connection, we have
-	 * the sum of all unmanaged/unrecognized devices from before and after.
-	 *
-	 * This if triggered at the end, to reset the specs. */
+     * specs that contain the sum of before and after (_unhandled_specs_merge_storages()).
+     *
+     * The idea is that while we emit signals about changes to connection, we have
+     * the sum of all unmanaged/unrecognized devices from before and after.
+     *
+     * This if triggered at the end, to reset the specs. */
     _unhandled_specs_reset(self);
 
     nm_assert_self(self, TRUE);
@@ -923,11 +923,11 @@ impl_ifcfgrh_get_ifcfg_details(NMSIfcfgRHPlugin *     self,
     }
 
     /* It is ugly that the ifcfg-rh plugin needs to call back into NMSettings this
-	 * way.
-	 * There are alternatives (like invoking a signal), but they are all significant
-	 * extra code (and performance overhead). So the quick and dirty solution here
-	 * is likely to be simpler than getting this right (also from point of readability!).
-	 */
+     * way.
+     * There are alternatives (like invoking a signal), but they are all significant
+     * extra code (and performance overhead). So the quick and dirty solution here
+     * is likely to be simpler than getting this right (also from point of readability!).
+     */
     path = nm_settings_get_dbus_path_for_uuid(nm_settings_get(), uuid);
 
     if (!path) {
@@ -1128,7 +1128,7 @@ _dbus_setup(NMSIfcfgRHPlugin *self)
     }
 
     /* We use a separate D-Bus connection so that org.freedesktop.NetworkManager and com.redhat.ifcfgrh1
-	 * are exported by different connections. */
+     * are exported by different connections. */
     address = g_dbus_address_get_for_bus_sync(G_BUS_TYPE_SYSTEM, NULL, &error);
     if (address == NULL) {
         _LOGW("dbus: failed getting address for system bus: %s", error->message);
@@ -1156,11 +1156,11 @@ config_changed_cb(NMConfig *          config,
     NMSIfcfgRHPluginPrivate *priv;
 
     /* If the dbus connection for some reason is borked the D-Bus service
-	 * won't be offered.
-	 *
-	 * On SIGHUP and SIGUSR1 try to re-connect to D-Bus. So in the unlikely
-	 * event that the D-Bus connection is broken, that allows for recovery
-	 * without need for restarting NetworkManager. */
+     * won't be offered.
+     *
+     * On SIGHUP and SIGUSR1 try to re-connect to D-Bus. So in the unlikely
+     * event that the D-Bus connection is broken, that allows for recovery
+     * without need for restarting NetworkManager. */
     if (!NM_FLAGS_ANY(changes, NM_CONFIG_CHANGE_CAUSE_SIGHUP | NM_CONFIG_CHANGE_CAUSE_SIGUSR1))
         return;
 
@@ -1211,7 +1211,7 @@ dispose(GObject *object)
         g_signal_handlers_disconnect_by_func(priv->config, config_changed_cb, self);
 
     /* FIXME(shutdown) we need a stop method so that we can unregistering the D-Bus service
-	 * when NMSettings is shutting down, and not when the instance gets destroyed. */
+     * when NMSettings is shutting down, and not when the instance gets destroyed. */
     _dbus_clear(self);
 
     nm_sett_util_storages_clear(&priv->storages);
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index fa1fd22daf..1d94d95ded 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -311,8 +311,8 @@ check_if_bond_slave(shvarFile *ifcfg, NMSettingConnection *s_con)
     }
 
     /* We should be checking for SLAVE=yes as well, but NM used to not set that,
-	 * so for backward-compatibility, we don't check.
-	 */
+     * so for backward-compatibility, we don't check.
+     */
 }
 
 static void
@@ -362,9 +362,9 @@ make_connection_name(shvarFile * ifcfg,
         prefix = "System";
 
     /* For cosmetic reasons, if the suggested name is the same as
-	 * the ifcfg files name, don't use it.  Mainly for wifi so that
-	 * the SSID is shown in the connection ID instead of just "wlan0".
-	 */
+     * the ifcfg files name, don't use it.  Mainly for wifi so that
+     * the SSID is shown in the connection ID instead of just "wlan0".
+     */
     if (suggested && strcmp(ifcfg_name, suggested))
         full_name = g_strdup_printf("%s %s (%s)", prefix, suggested, ifcfg_name);
     else
@@ -425,7 +425,7 @@ make_connection_setting(const char *file,
         GError *error = NULL;
 
         /* Only validate for NMU_IFACE_KERNEL, because ifcfg plugin anyway
-		 * doesn't support OVS types. */
+         * doesn't support OVS types. */
         if (nm_utils_ifname_valid(v, NMU_IFACE_KERNEL, &error)) {
             g_object_set(s_con, NM_SETTING_CONNECTION_INTERFACE_NAME, v, NULL);
         } else {
@@ -605,8 +605,8 @@ make_connection_setting(const char *file,
                 d *= 1000.0;
 
                 /* We round. Yes, this is not correct to round IEEE 754 floats in general,
-				 * but sufficient for our case where we know that NetworkManager wrote the
-				 * setting with up to 3 digits for the milliseconds. */
+                 * but sufficient for our case where we know that NetworkManager wrote the
+                 * setting with up to 3 digits for the milliseconds. */
                 d += 0.5;
                 if (d >= 0.0 && d <= (double) G_MAXINT32)
                     vint64 = (gint64) d;
@@ -790,10 +790,10 @@ static gboolean
 parse_route_line_is_comment(const char *line)
 {
     /* we obtained the line from a legacy route file. Here we skip
-	 * empty lines and comments.
-	 *
-	 * initscripts compares: "$line" =~ '^[[:space:]]*(\#.*)?$'
-	 */
+     * empty lines and comments.
+     *
+     * initscripts compares: "$line" =~ '^[[:space:]]*(\#.*)?$'
+     */
     while (nm_utils_is_separator(line[0]))
         line++;
     if (NM_IN_SET(line[0], '\0', '#'))
@@ -817,7 +817,7 @@ typedef struct {
     bool disabled_with_options_route : 1;
 
     /* whether the element is to be ignored. Ignord is different from
-	 * "disabled", because we still parse the option, but don't use it. */
+     * "disabled", because we still parse the option, but don't use it. */
     ParseLineAFFlag ignore : 3;
 
     bool int_base_16 : 1;
@@ -829,7 +829,7 @@ typedef struct {
 
 typedef struct {
     /* whether the command line option was found, and @v is
-	 * initialized. */
+     * initialized. */
     bool has : 1;
 
     union {
@@ -1022,20 +1022,20 @@ parse_route_line(const char *line,
     nm_assert(!options_route || nm_ip_route_get_family(options_route) == addr_family);
 
     /* initscripts read the legacy route file line-by-line and
-	 * use it as `ip route add $line`, thus doing split+glob.
-	 * Splitting on IFS (which we consider '<space><tab><newline>')
-	 * and globbing (which we obviously don't do).
-	 *
-	 * I think it's a mess, because it doesn't support escaping or
-	 * quoting. In fact, it can only encode benign values.
-	 *
-	 * We also use the same form for the numbered OPTIONS
-	 * variable. I think it's bad not to support any form of
-	 * escaping. But do that for now.
-	 *
-	 * Maybe later we want to support some form of quotation here.
-	 * Which of course, would be incompatible with initscripts.
-	 */
+     * use it as `ip route add $line`, thus doing split+glob.
+     * Splitting on IFS (which we consider '<space><tab><newline>')
+     * and globbing (which we obviously don't do).
+     *
+     * I think it's a mess, because it doesn't support escaping or
+     * quoting. In fact, it can only encode benign values.
+     *
+     * We also use the same form for the numbered OPTIONS
+     * variable. I think it's bad not to support any form of
+     * escaping. But do that for now.
+     *
+     * Maybe later we want to support some form of quotation here.
+     * Which of course, would be incompatible with initscripts.
+     */
     words_free = nm_utils_strsplit_set(line, " \t\n");
 
     words = words_free ?: NM_PTRARRAY_EMPTY(const char *);
@@ -1060,7 +1060,7 @@ parse_route_line(const char *line,
 
             if (p_data->has) {
                 /* iproute2 for most arguments allows specifying them multiple times.
-				 * Let's not do that. */
+                 * Let's not do that. */
                 g_set_error(error,
                             NM_SETTINGS_ERROR,
                             NM_SETTINGS_ERROR_INVALID_CONNECTION,
@@ -1228,7 +1228,7 @@ parse_line_type_addr_with_prefix:
                     if (p_info == &parse_infos[PARSE_LINE_ATTR_ROUTE_VIA]
                         && nm_streq(s, "(null)")) {
                         /* Due to a bug, would older versions of NM write "via (null)"
-						 * (rh#1452648). Workaround that, and accept it.*/
+                         * (rh#1452648). Workaround that, and accept it.*/
                         memset(&p_data->v.addr.addr, 0, sizeof(p_data->v.addr.addr));
                     } else {
                         if (unqualified_addr) {
@@ -1374,9 +1374,9 @@ next:;
             break;
         case PARSE_LINE_TYPE_FLAG:
             /* NOTE: the flag (for "onlink") only allows to explicitly set "TRUE".
-			 * There is no way to express an explicit "FALSE" setting
-			 * of this attribute, hence, the file format cannot encode
-			 * that configuration. */
+             * There is no way to express an explicit "FALSE" setting
+             * of this attribute, hence, the file format cannot encode
+             * that configuration. */
             nm_ip_route_set_attribute(route, p_info->key, g_variant_new_boolean(TRUE));
             break;
         case PARSE_LINE_TYPE_STRING:
@@ -1530,7 +1530,7 @@ read_route_file_parse(int                addr_family,
                 PARSE_WARNING("ignoring manual default route: '%s' (%s)", line, filename);
             else {
                 /* we accept all unrecognized lines, because otherwise we would reject the
-				 * entire connection. */
+                 * entire connection. */
                 PARSE_WARNING("ignoring invalid route at \"%s\" (%s:%lu): %s",
                               line,
                               filename,
@@ -1782,10 +1782,10 @@ make_ip4_setting(shvarFile *ifcfg,
     s_ip4 = (NMSettingIPConfig *) nm_setting_ip4_config_new();
 
     /* First check if DEFROUTE is set for this device; DEFROUTE has the
-	 * opposite meaning from never-default. The default if DEFROUTE is not
-	 * specified is DEFROUTE=yes which means that this connection can be used
-	 * as a default route
-	 */
+     * opposite meaning from never-default. The default if DEFROUTE is not
+     * specified is DEFROUTE=yes which means that this connection can be used
+     * as a default route
+     */
     i = svGetValueBoolean(ifcfg, "DEFROUTE", -1);
     if (i == -1)
         never_default = FALSE;
@@ -1805,8 +1805,8 @@ make_ip4_setting(shvarFile *ifcfg,
         dns_options = svGetValue(network_ifcfg, "RES_OPTIONS", &dns_options_free);
 
         /* If there was a global gateway device specified, then only connections
-		 * for that device can be the default connection.
-		 */
+         * for that device can be the default connection.
+         */
         if (gatewaydev && v)
             never_default = !!strcmp(v, gatewaydev);
 
@@ -1913,21 +1913,21 @@ make_ip4_setting(shvarFile *ifcfg,
         g_object_set(s_ip4, NM_SETTING_IP_CONFIG_DHCP_IAID, v, NULL);
 
     /* Read static IP addresses.
-	 * Read them even for AUTO method - in this case the addresses are
-	 * added to the automatic ones. Note that this is not currently supported by
-	 * the legacy 'network' service (ifup-eth).
-	 */
+     * Read them even for AUTO method - in this case the addresses are
+     * added to the automatic ones. Note that this is not currently supported by
+     * the legacy 'network' service (ifup-eth).
+     */
     for (i = -1;; i++) {
         NMIPAddress *addr = NULL;
 
         /* gateway will only be set if still unset. Hence, we don't leak gateway
-		 * here by calling read_full_ip4_address() repeatedly */
+         * here by calling read_full_ip4_address() repeatedly */
         if (!read_full_ip4_address(ifcfg, i, NULL, &addr, &gateway, error))
             return NULL;
 
         if (!addr) {
             /* The first mandatory variable is 2-indexed (IPADDR2)
-			 * Variables IPADDR, IPADDR0 and IPADDR1 are optional */
+             * Variables IPADDR, IPADDR0 and IPADDR1 are optional */
             if (i > 1)
                 break;
             continue;
@@ -1963,15 +1963,15 @@ make_ip4_setting(shvarFile *ifcfg,
         PARSE_WARNING("GATEWAY will be ignored when DEFROUTE is disabled");
 
     /* We used to skip saving a lot of unused properties for the ipv4 shared method.
-	 * We want now to persist them but... unfortunately loading DNS or DOMAIN options
-	 * would cause a fail in the ipv4 verify() function. As we don't want any regression
-	 * in the unlikely event that someone has a working ifcfg file for an IPv4 shared ip
-	 * connection with a crafted "DNS" entry... don't load it. So we will avoid failing
-	 * the connection) */
+     * We want now to persist them but... unfortunately loading DNS or DOMAIN options
+     * would cause a fail in the ipv4 verify() function. As we don't want any regression
+     * in the unlikely event that someone has a working ifcfg file for an IPv4 shared ip
+     * connection with a crafted "DNS" entry... don't load it. So we will avoid failing
+     * the connection) */
     if (!nm_streq(method, NM_SETTING_IP4_CONFIG_METHOD_SHARED)) {
         /* DNS servers
-		 * Pick up just IPv4 addresses (IPv6 addresses are taken by make_ip6_setting())
-		 */
+         * Pick up just IPv4 addresses (IPv6 addresses are taken by make_ip6_setting())
+         */
         for (i = 1; i <= 10; i++) {
             char tag[256];
 
@@ -2245,16 +2245,16 @@ make_ip6_setting(shvarFile *ifcfg, shvarFile *network_ifcfg, gboolean routes_rea
     s_ip6 = (NMSettingIPConfig *) nm_setting_ip6_config_new();
 
     /* First check if IPV6_DEFROUTE is set for this device; IPV6_DEFROUTE has the
-	 * opposite meaning from never-default. The default if IPV6_DEFROUTE is not
-	 * specified is IPV6_DEFROUTE=yes which means that this connection can be used
-	 * as a default route
-	 */
+     * opposite meaning from never-default. The default if IPV6_DEFROUTE is not
+     * specified is IPV6_DEFROUTE=yes which means that this connection can be used
+     * as a default route
+     */
     never_default = !svGetValueBoolean(ifcfg, "IPV6_DEFROUTE", TRUE);
 
     /* Then check if IPV6_DEFAULTGW or IPV6_DEFAULTDEV is specified;
-	 * they are global and override IPV6_DEFROUTE
-	 * When both are set, the device specified in IPV6_DEFAULTGW takes preference.
-	 */
+     * they are global and override IPV6_DEFROUTE
+     * When both are set, the device specified in IPV6_DEFAULTGW takes preference.
+     */
     if (network_ifcfg) {
         const char *  ipv6_defaultgw, *ipv6_defaultdev;
         gs_free char *ipv6_defaultgw_to_free  = NULL;
@@ -2276,8 +2276,8 @@ make_ip6_setting(shvarFile *ifcfg, shvarFile *network_ifcfg, gboolean routes_rea
             default_dev = ipv6_defaultdev;
 
         /* If there was a global default route device specified, then only connections
-		 * for that device can be the default connection.
-		 */
+         * for that device can be the default connection.
+         */
         if (default_dev && v)
             never_default = !!strcmp(v, default_dev);
     }
@@ -2385,8 +2385,8 @@ make_ip6_setting(shvarFile *ifcfg, shvarFile *network_ifcfg, gboolean routes_rea
     nm_clear_g_free(&value);
     v = svGetValueStr(ifcfg, "DHCPV6_HOSTNAME", &value);
     /* Use DHCP_HOSTNAME as fallback if it is in FQDN format and ipv6.method is
-	 * auto or dhcp: this is required to support old ifcfg files
-	 */
+     * auto or dhcp: this is required to support old ifcfg files
+     */
     if (!v
         && (!strcmp(method, NM_SETTING_IP6_CONFIG_METHOD_AUTO)
             || !strcmp(method, NM_SETTING_IP6_CONFIG_METHOD_DHCP))) {
@@ -2413,10 +2413,10 @@ make_ip6_setting(shvarFile *ifcfg, shvarFile *network_ifcfg, gboolean routes_rea
     }
 
     /* Read static IP addresses.
-	 * Read them even for AUTO and DHCP methods - in this case the addresses are
-	 * added to the automatic ones. Note that this is not currently supported by
-	 * the legacy 'network' service (ifup-eth).
-	 */
+     * Read them even for AUTO and DHCP methods - in this case the addresses are
+     * added to the automatic ones. Note that this is not currently supported by
+     * the legacy 'network' service (ifup-eth).
+     */
     ipv6addr = svGetValueStr(ifcfg, "IPV6ADDR", &ipv6addr_to_free);
     ipv6addr_secondaries =
         svGetValueStr(ifcfg, "IPV6ADDR_SECONDARIES", &ipv6addr_secondaries_to_free);
@@ -2485,8 +2485,8 @@ make_ip6_setting(shvarFile *ifcfg, shvarFile *network_ifcfg, gboolean routes_rea
         g_object_set(s_ip6, NM_SETTING_IP6_CONFIG_TOKEN, v, NULL);
 
     /* DNS servers
-	 * Pick up just IPv6 addresses (IPv4 addresses are taken by make_ip4_setting())
-	 */
+     * Pick up just IPv6 addresses (IPv4 addresses are taken by make_ip4_setting())
+     */
     for (i = 1; i <= 10; i++) {
         char tag[256];
 
@@ -3132,11 +3132,11 @@ add_one_wep_key(shvarFile *                ifcfg,
             }
 
             /* Remove 's:' prefix.
-			 * Don't convert to hex string. wpa_supplicant takes 'wep_key0' option over D-Bus as byte array
-			 * and converts it to hex string itself. Even though we convert hex string keys into a bin string
-			 * before passing to wpa_supplicant, this prevents two unnecessary conversions. And mainly,
-			 * ASCII WEP key doesn't change to HEX WEP key in UI, which could confuse users.
-			 */
+             * Don't convert to hex string. wpa_supplicant takes 'wep_key0' option over D-Bus as byte array
+             * and converts it to hex string itself. Even though we convert hex string keys into a bin string
+             * before passing to wpa_supplicant, this prevents two unnecessary conversions. And mainly,
+             * ASCII WEP key doesn't change to HEX WEP key in UI, which could confuse users.
+             */
             key = value + 2;
         }
     }
@@ -3285,8 +3285,8 @@ make_wep_setting(shvarFile *ifcfg, const char *file, GError **error)
     }
 
     /* If no WEP keys were given, and the keys are not agent-owned, and no
-	 * default WEP key index was given, then the connection is unencrypted.
-	 */
+     * default WEP key index was given, then the connection is unencrypted.
+     */
     if (!nm_setting_wireless_security_get_wep_key(s_wsec, 0)
         && !nm_setting_wireless_security_get_wep_key(s_wsec, 1)
         && !nm_setting_wireless_security_get_wep_key(s_wsec, 2)
@@ -3360,10 +3360,10 @@ parse_wpa_psk(shvarFile *ifcfg, const char *file, GBytes *ssid, GError **error)
     size_t        plen;
 
     /* Passphrase must be between 10 and 66 characters in length because WPA
-	 * hex keys are exactly 64 characters (no quoting), and WPA passphrases
-	 * are between 8 and 63 characters (inclusive), plus optional quoting if
-	 * the passphrase contains spaces.
-	 */
+     * hex keys are exactly 64 characters (no quoting), and WPA passphrases
+     * are between 8 and 63 characters (inclusive), plus optional quoting if
+     * the passphrase contains spaces.
+     */
 
     /* Try to get keys from the "shadow" key file */
     keys_ifcfg = utils_get_keys_ifcfg(file, FALSE);
@@ -3518,11 +3518,11 @@ eap_tls_reader(const char *    eap_method,
                                   : NM_SETTING_802_1X_CLIENT_CERT_PASSWORD);
 
     /* In the past when the private key and client certificate
-	 * were the same PKCS #12 file we used to write only the
-	 * private key variable. Still support that even if it means
-	 * that we have to look into the file content, which makes
-	 * the connection not self-contained.
-	 */
+     * were the same PKCS #12 file we used to write only the
+     * private key variable. Still support that even if it means
+     * that we have to look into the file content, which makes
+     * the connection not self-contained.
+     */
     if (!client_cert && privkey && !svGetValue(ifcfg, client_cert_var, &value_to_free)) {
         if (phase2)
             format = nm_setting_802_1x_get_phase2_private_key_format(s_8021x);
@@ -3859,9 +3859,9 @@ fill_8021x(shvarFile *ifcfg, const char *file, const char *key_mgmt, gboolean wi
                 goto next;
 
             /* Some EAP methods don't provide keying material, thus they
-			 * cannot be used with Wi-Fi unless they are an inner method
-			 * used with TTLS or PEAP or whatever.
-			 */
+             * cannot be used with Wi-Fi unless they are an inner method
+             * used with TTLS or PEAP or whatever.
+             */
             if (wifi && eap->wifi_phase2_only) {
                 PARSE_WARNING("ignored invalid IEEE_8021X_EAP_METHOD '%s'; not allowed for wifi",
                               lower);
@@ -4256,7 +4256,7 @@ make_wireless_setting(shvarFile *ifcfg, GError **error)
         if (value_len > 2 && (value_len % 2) == 0 && g_str_has_prefix(value, "0x")
             && NM_STRCHAR_ALL(&value[2], ch, g_ascii_isxdigit(ch))) {
             /* interpret the value as hex-digits iff value starts
-			 * with "0x" followed by pairs of hex digits */
+             * with "0x" followed by pairs of hex digits */
             bytes = nm_utils_hexstr2bin(&value[2]);
         } else
             bytes = g_bytes_new(value, value_len);
@@ -4923,7 +4923,7 @@ parse_ethtool_options(shvarFile *ifcfg, NMConnection *connection)
             opts = nm_utils_strsplit_set(ethtool_opts, ";");
             for (iter = opts; iter && iter[0]; iter++) {
                 /* in case of repeated wol_passwords, parse_ethtool_option()
-				 * will do the right thing and clear wol_password before resetting. */
+                 * will do the right thing and clear wol_password before resetting. */
                 parse_ethtool_option(iter[0],
                                      &wol_flags,
                                      &wol_password,
@@ -6012,8 +6012,8 @@ make_vlan_setting(shvarFile *ifcfg, const char *file, GError **error)
                 parent = g_strndup(iface_name, v - iface_name);
                 if (g_str_has_prefix(parent, "vlan")) {
                     /* Like initscripts, if no PHYSDEV and we get an obviously
-					 * invalid parent interface from DEVICE, fail.
-					 */
+                     * invalid parent interface from DEVICE, fail.
+                     */
                     nm_clear_g_free(&parent);
                 }
             }
@@ -6028,8 +6028,8 @@ make_vlan_setting(shvarFile *ifcfg, const char *file, GError **error)
             int device_vlan_id;
 
             /* Grab VLAN ID from interface name; this takes precedence over the
-			 * separate VLAN_ID property for backwards compat.
-			 */
+             * separate VLAN_ID property for backwards compat.
+             */
             device_vlan_id = _nm_utils_ascii_str_to_int64(v, 10, 0, 4095, -1);
             if (device_vlan_id != -1)
                 vlan_id = device_vlan_id;
@@ -6158,9 +6158,9 @@ create_unhandled_connection(const char *filename,
     connection = nm_simple_connection_new();
 
     /* Get NAME, UUID, etc. We need to set a connection type (generic) and add
-	 * an empty type-specific setting as well, to make sure it passes
-	 * nm_connection_verify() later.
-	 */
+     * an empty type-specific setting as well, to make sure it passes
+     * nm_connection_verify() later.
+     */
     s_con = make_connection_setting(filename, ifcfg, NM_SETTING_GENERIC_SETTING_NAME, NULL, NULL);
     nm_connection_add_setting(connection, s_con);
 
@@ -6200,8 +6200,8 @@ check_dns_search_domains(shvarFile *ifcfg, NMSetting *s_ip4, NMSetting *s_ip6)
         return;
 
     /* If there is no IPv4 config or it doesn't contain DNS searches,
-	 * read DOMAIN and put the domains into IPv6.
-	 */
+     * read DOMAIN and put the domains into IPv6.
+     */
     if (!s_ip4 || nm_setting_ip_config_get_num_dns_searches(NM_SETTING_IP_CONFIG(s_ip4)) == 0) {
         /* DNS searches */
         gs_free char *value = NULL;
@@ -6317,8 +6317,8 @@ connection_from_file_full(const char *filename,
         gs_free char *t = NULL;
 
         /* Team and TeamPort types are also accepted by the mere
-		 * presence of TEAM_CONFIG/TEAM_MASTER. They don't require
-		 * DEVICETYPE. */
+         * presence of TEAM_CONFIG/TEAM_MASTER. They don't require
+         * DEVICETYPE. */
         t = svGetValueStr_cp(main_ifcfg, "TEAM_CONFIG");
         if (t)
             type = g_strdup(TYPE_TEAM);
@@ -6373,11 +6373,11 @@ connection_from_file_full(const char *filename,
                 gsize         i;
 
                 /* network-functions detects DEVICETYPE based on the ifcfg-* name and the existence
-				 * of a ifup script:
-				 *    [ -z "$DEVICETYPE" ] && DEVICETYPE=$(echo ${DEVICE} | sed "s/[0-9]*$//")
-				 * later...
-				 *    OTHERSCRIPT="/etc/sysconfig/network-scripts/ifup-${DEVICETYPE}"
-				 * */
+                 * of a ifup script:
+                 *    [ -z "$DEVICETYPE" ] && DEVICETYPE=$(echo ${DEVICE} | sed "s/[0-9]*$//")
+                 * later...
+                 *    OTHERSCRIPT="/etc/sysconfig/network-scripts/ifup-${DEVICETYPE}"
+                 * */
 #define IFUP_PATH_PREFIX "/etc/sysconfig/network-scripts/ifup-"
                 i        = strlen(device);
                 p_path   = g_malloc(NM_STRLEN(IFUP_PATH_PREFIX) + i + 1);
@@ -6416,9 +6416,9 @@ connection_from_file_full(const char *filename,
             }
         } else {
             /* For the unit tests, there won't necessarily be any
-			 * adapters of the connection's type in the system so the
-			 * type can't be tested with ioctls.
-			 */
+             * adapters of the connection's type in the system so the
+             * type can't be tested with ioctls.
+             */
             type = g_strdup(test_type);
         }
 
@@ -6534,9 +6534,9 @@ connection_from_file_full(const char *filename,
         nm_connection_add_setting(connection, s_tc);
 
     /* For backwards compatibility, if IPv4 is disabled or the
-	 * config fails for some reason, we read DOMAIN and put the
-	 * values into IPv6 config instead of IPv4.
-	 */
+     * config fails for some reason, we read DOMAIN and put the
+     * values into IPv6 config instead of IPv4.
+     */
     check_dns_search_domains(main_ifcfg, s_ip4, s_ip6);
 
     s_proxy = make_proxy_setting(main_ifcfg);
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-storage.h b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-storage.h
index 89de695751..1684dea828 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-storage.h
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-storage.h
@@ -31,7 +31,7 @@ typedef struct {
     char *unrecognized_spec;
 
     /* The timestamp (stat's mtime) of the file. Newer files have
-	 * higher priority. */
+     * higher priority. */
     struct timespec stat_mtime;
 
     bool dirty : 1;
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
index d30b4586e8..bb1ea38051 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.c
@@ -150,11 +150,11 @@ utils_get_ifcfg_name(const char *file, gboolean only_ifcfg)
     G_STMT_END
 
     /* Do not detect alias files and return 'eth0:0' instead of 'eth0'.
-	 * Unfortunately, we cannot be sure that our files don't contain colons,
-	 * so we cannot reject files with colons.
-	 *
-	 * Instead, you must not call utils_get_ifcfg_name() with an alias file
-	 * or files that are ignored. */
+     * Unfortunately, we cannot be sure that our files don't contain colons,
+     * so we cannot reject files with colons.
+     *
+     * Instead, you must not call utils_get_ifcfg_name() with an alias file
+     * or files that are ignored. */
     MATCH_TAG_AND_RETURN(name, IFCFG_TAG);
     if (!only_ifcfg) {
         MATCH_TAG_AND_RETURN(name, KEYS_TAG);
@@ -300,7 +300,7 @@ utils_has_route_file_new_syntax_content(const char *contents, gsize len)
 
         if (eol) {
             /* restore the line ending. We don't want to mangle the content from
-			 * POV of the caller. */
+             * POV of the caller. */
             eol[0] = '\n';
         }
 
@@ -382,8 +382,8 @@ utils_detect_ifcfg_path(const char *path, gboolean only_ifcfg)
                 *ptr = '\0';
                 if (g_file_test(ifcfg, G_FILE_TEST_EXISTS)) {
                     /* the file has a colon, so it is probably an alias.
-					 * To be ~more~ certain that this is an alias file,
-					 * check whether a corresponding base file exists. */
+                     * To be ~more~ certain that this is an alias file,
+                     * check whether a corresponding base file exists. */
                     if (only_ifcfg)
                         return NULL;
                     return g_steal_pointer(&ifcfg);
@@ -410,8 +410,8 @@ nms_ifcfg_rh_utils_user_key_encode(const char *key, GString *str_buffer)
         char ch = key[i];
 
         /* we encode the key in only upper case letters, digits, and underscore.
-		 * As we expect lower-case letters to be more common, we encode lower-case
-		 * letters as upper case, and upper-case letters with a leading underscore. */
+         * As we expect lower-case letters to be more common, we encode lower-case
+         * letters as upper case, and upper-case letters with a leading underscore. */
 
         if (ch >= '0' && ch <= '9') {
             g_string_append_c(str_buffer, ch);
@@ -491,7 +491,7 @@ nms_ifcfg_rh_utils_user_key_decode(const char *name, GString *str_buffer)
                 if ((ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || (ch == '.')
                     || (ch >= 'a' && ch <= 'z')) {
                     /* such characters are not expected to be encoded via
-					 * octal representation. The encoding is invalid. */
+                     * octal representation. The encoding is invalid. */
                     return FALSE;
                 }
                 g_string_append_c(str_buffer, ch);
@@ -627,17 +627,17 @@ static NM_UTILS_STRING_TABLE_LOOKUP_DEFINE(
     { return NM_ETHTOOL_ID_UNKNOWN; },
 
     /* Map the names from kernel/ethtool/ifcfg to NMEthtoolID. Note that ethtool utility has built-in
-	 * features and NetworkManager's API follows the naming of these built-in features, whenever
-	 * they exist.
-	 * For example, NM's "ethtool.feature-ntuple" corresponds to ethtool utility's "ntuple"
-	 * feature. However the underlying kernel feature is called "rx-ntuple-filter" (as reported
-	 * for ETH_SS_FEATURES).
-	 *
-	 * With ethtool utility, whose command line we attempt to parse here, the user can also
-	 * specify the name of the underlying kernel feature directly. So, check whether that is
-	 * the case and if yes, map them to the corresponding NetworkManager's features.
-	 *
-	 * That is why there are duplicate IDs in this list. */
+     * features and NetworkManager's API follows the naming of these built-in features, whenever
+     * they exist.
+     * For example, NM's "ethtool.feature-ntuple" corresponds to ethtool utility's "ntuple"
+     * feature. However the underlying kernel feature is called "rx-ntuple-filter" (as reported
+     * for ETH_SS_FEATURES).
+     *
+     * With ethtool utility, whose command line we attempt to parse here, the user can also
+     * specify the name of the underlying kernel feature directly. So, check whether that is
+     * the case and if yes, map them to the corresponding NetworkManager's features.
+     *
+     * That is why there are duplicate IDs in this list. */
     {"esp-hw-offload", NM_ETHTOOL_ID_FEATURE_ESP_HW_OFFLOAD},
     {"esp-tx-csum-hw-offload", NM_ETHTOOL_ID_FEATURE_ESP_TX_CSUM_HW_OFFLOAD},
     {"fcoe-mtu", NM_ETHTOOL_ID_FEATURE_FCOE_MTU},
@@ -761,9 +761,9 @@ nms_ifcfg_rh_utils_is_numbered_tag_impl(const char *key,
 
     if (key[0] == '\0') {
         /* The key has no number suffix. We treat this also as a numbered
-		 * tag, and it is for certain tags like "IPADDR", but not so much
-		 * for others like "ROUTING_RULE_". The caller may want to handle
-		 * this case specially. */
+         * tag, and it is for certain tags like "IPADDR", but not so much
+         * for others like "ROUTING_RULE_". The caller may want to handle
+         * this case specially. */
         NM_SET_OUT(out_idx, -1);
         return TRUE;
     }
@@ -1065,9 +1065,9 @@ nms_ifcfg_rh_utils_is_well_known_key(const char *key)
         if (NM_FLAGS_ANY(ti->key_flags,
                          NMS_IFCFG_KEY_TYPE_IS_PLAIN | NMS_IFCFG_KEY_TYPE_IS_NUMBERED)) {
             /* These tags are valid on full match.
-			 *
-			 * Note that numbered tags we also treat as valid if they have no
-			 * suffix. That is correct for "IPADDR", but less so for "ROUTING_RULE_". */
+             *
+             * Note that numbered tags we also treat as valid if they have no
+             * suffix. That is correct for "IPADDR", but less so for "ROUTING_RULE_". */
             return ti;
         }
         nm_assert(NM_FLAGS_HAS(ti->key_flags, NMS_IFCFG_KEY_TYPE_IS_PREFIX));
@@ -1076,8 +1076,8 @@ nms_ifcfg_rh_utils_is_well_known_key(const char *key)
     }
 
     /* Not found. Maybe it's a numbered/prefixed key? With idx we got the index where
-	 * we should insert the key. Since the numbered/prefixed keys share a prefix, we can
-	 * find the possible prefix at the index before the insert position. */
+     * we should insert the key. Since the numbered/prefixed keys share a prefix, we can
+     * find the possible prefix at the index before the insert position. */
     idx = ~idx;
     if (idx == 0)
         return NULL;
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
index c4c0e41e32..7384fef0e1 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-utils.h
@@ -22,8 +22,8 @@ typedef enum {
     NMS_IFCFG_KEY_TYPE_IS_PREFIX   = (1u << 3),
 
     /* by default, well knowns keys that are not explicitly set
-	 * by the writer (the unvisited, dirty ones) are removed.
-	 * With this flag, such keys are kept if they are present. */
+     * by the writer (the unvisited, dirty ones) are removed.
+     * With this flag, such keys are kept if they are present. */
     NMS_IFCFG_KEY_TYPE_KEEP_WHEN_DIRTY = (1u << 4),
 
 } NMSIfcfgKeyTypeFlags;
@@ -118,7 +118,7 @@ _nms_ifcfg_rh_utils_numbered_tag(char *buf, gsize buf_len, const char *tag_name,
         _nm_unused char *const _buf = (buf);                                              \
                                                                                           \
         /* some static assert trying to ensure that the buffer is statically allocated.
-		 * It disallows a buffer size of sizeof(gpointer) to catch that. */   \
+         * It disallows a buffer size of sizeof(gpointer) to catch that. */   \
         G_STATIC_ASSERT(G_N_ELEMENTS(buf) == sizeof(buf) && sizeof(buf) != sizeof(char *) \
                         && sizeof(buf) < G_MAXINT);                                       \
         _nms_ifcfg_rh_utils_numbered_tag(buf, sizeof(buf), "" tag_name "", (which));      \
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
index cf4197c0ca..6d5ad3d5ff 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
@@ -240,8 +240,8 @@ write_object(NMSetting8021x *                s_8021x,
         extension = "pem";
 
     /* If the object path was specified, prefer that over any raw cert data that
-	 * may have been sent.
-	 */
+     * may have been sent.
+     */
     if (value) {
         svSetValueStr(ifcfg, objtype->ifcfg_rh_key, value);
         return TRUE;
@@ -258,14 +258,14 @@ write_object(NMSetting8021x *                s_8021x,
     }
 
     /* If certificate/private key wasn't sent, the connection may no longer be
-	 * 802.1x and thus we clear out the paths and certs.
-	 *
-	 * Since no cert/private key is now being used, delete any standard file
-	 * that was created for this connection, but leave other files alone.
-	 * Thus, for example,
-	 * /etc/sysconfig/network-scripts/ca-cert-Test_Write_Wifi_WPA_EAP-TLS.der
-	 * will be deleted, but /etc/pki/tls/cert.pem will not.
-	 */
+     * 802.1x and thus we clear out the paths and certs.
+     *
+     * Since no cert/private key is now being used, delete any standard file
+     * that was created for this connection, but leave other files alone.
+     * Thus, for example,
+     * /etc/sysconfig/network-scripts/ca-cert-Test_Write_Wifi_WPA_EAP-TLS.der
+     * will be deleted, but /etc/pki/tls/cert.pem will not.
+     */
     standard_file = utils_cert_path(svFileGetName(ifcfg), objtype->vtable->file_suffix, extension);
     g_hash_table_replace(blobs, standard_file, NULL);
     svSetValue(ifcfg, objtype->ifcfg_rh_key, force_write ? "" : NULL);
@@ -292,9 +292,9 @@ write_blobs(GHashTable *blobs, GError **error)
         }
 
         /* Write the raw certificate data out to the standard file so that we
-		 * can use paths from now on instead of pushing around the certificate
-		 * data itself.
-		 */
+         * can use paths from now on instead of pushing around the certificate
+         * data itself.
+         */
         if (!nm_utils_file_set_contents(filename,
                                         (const char *) g_bytes_get_data(blob, NULL),
                                         g_bytes_get_size(blob),
@@ -348,11 +348,11 @@ write_8021x_certs(NMSetting8021x *s_8021x,
         return FALSE;
 
     /* Save the client certificate.
-	 * If there is a private key, always write a property for the
-	 * client certificate even if it is empty, so that the reader
-	 * doesn't have to read the private key file to determine if it
-	 * is a PKCS #12 one which serves also as client certificate.
-	 */
+     * If there is a private key, always write a property for the
+     * client certificate even if it is empty, so that the reader
+     * doesn't have to read the private key file to determine if it
+     * is a PKCS #12 one which serves also as client certificate.
+     */
     if (!write_object(
             s_8021x,
             ifcfg,
@@ -690,9 +690,9 @@ write_wireless_security_setting(NMConnection *connection,
                 gboolean      key_valid = TRUE;
 
                 /* Passphrase needs a different ifcfg key since with WEP, there
-				 * are some passphrases that are indistinguishable from WEP hex
-				 * keys.
-				 */
+                 * are some passphrases that are indistinguishable from WEP hex
+                 * keys.
+                 */
                 if (key_type == NM_WEP_KEY_TYPE_UNKNOWN) {
                     if (nm_utils_wep_key_valid(key, NM_WEP_KEY_TYPE_KEY))
                         key_type = NM_WEP_KEY_TYPE_KEY;
@@ -746,8 +746,8 @@ write_wireless_security_setting(NMConnection *connection,
         cipher = nm_setting_wireless_security_get_pairwise(s_wsec, i);
 
         /* Don't write out WEP40 or WEP104 if for some reason they are set; they
-		 * are not valid pairwise ciphers.
-		 */
+         * are not valid pairwise ciphers.
+         */
         if (strcmp(cipher, "wep40") && strcmp(cipher, "wep104")) {
             tmp = g_ascii_strup(cipher, -1);
             g_string_append(str, tmp);
@@ -870,8 +870,8 @@ write_wireless_setting(NMConnection *connection,
     }
 
     /* If the SSID contains any non-printable characters, we need to use the
-	 * hex notation of the SSID instead.
-	 */
+     * hex notation of the SSID instead.
+     */
     if (ssid_len > 2 && ssid_data[0] == '0' && ssid_data[1] == 'x') {
         hex_ssid = TRUE;
         for (i = 2; i < ssid_len; i++) {
@@ -941,9 +941,9 @@ write_wireless_setting(NMConnection *connection,
     svSetValueStr(ifcfg, "BSSID", bssid);
 
     /* Ensure DEFAULTKEY and SECURITYMODE are cleared unless there's security;
-	 * otherwise there's no way to detect WEP vs. open when WEP keys aren't
-	 * saved.
-	 */
+     * otherwise there's no way to detect WEP vs. open when WEP keys aren't
+     * saved.
+     */
 
     if (nm_connection_get_setting_wireless_security(connection)) {
         if (!write_wireless_security_setting(connection, ifcfg, secrets, adhoc, no_8021x, error))
@@ -1127,7 +1127,7 @@ write_wired_setting(NMConnection *connection, shvarFile *ifcfg, GError **error)
 
             if (strchr(s390_key, '=')) {
                 /* this key cannot be expressed. But after all, it's not valid anyway
-				 * and the connection shouldn't even verify. */
+                 * and the connection shouldn't even verify. */
                 continue;
             }
 
@@ -1190,10 +1190,10 @@ write_ethtool_setting(NMConnection *connection, shvarFile *ifcfg, GError **error
         duplex         = nm_setting_wired_get_duplex(s_wired);
 
         /* autoneg off + speed 0 + duplex NULL, means we want NM
-		 * to skip link configuration which is default. So write
-		 * down link config only if we have auto-negotiate true or
-		 * a valid value for one among speed and duplex.
-		 */
+         * to skip link configuration which is default. So write
+         * down link config only if we have auto-negotiate true or
+         * a valid value for one among speed and duplex.
+         */
         if (auto_negotiate) {
             str = g_string_sized_new(64);
             g_string_printf(str, "autoneg on");
@@ -2089,8 +2089,8 @@ write_connection_setting(NMSettingConnection *s_con, shvarFile *ifcfg)
             const char *puser = NULL;
 
             /* Items separated by space for consistency with eg
-			 * IPV6ADDR_SECONDARIES and DOMAIN.
-			 */
+             * IPV6ADDR_SECONDARIES and DOMAIN.
+             */
             if (str->len)
                 g_string_append_c(str, ' ');
 
@@ -2117,7 +2117,7 @@ write_connection_setting(NMSettingConnection *s_con, shvarFile *ifcfg)
     master = nm_setting_connection_get_master(s_con);
     if (master) {
         /* The reader prefers the *_UUID variants, however we still try to resolve
-		 * it into an interface name, so that legacy tooling is not confused. */
+         * it into an interface name, so that legacy tooling is not confused. */
         if (!nm_utils_get_testing()) {
             /* This is conditional for easier testing. */
             master_iface = nm_manager_iface_for_uuid(NM_MANAGER_GET, master);
@@ -2166,8 +2166,8 @@ write_connection_setting(NMSettingConnection *s_con, shvarFile *ifcfg)
             const char *uuid;
 
             /* Items separated by space for consistency with eg
-			 * IPV6ADDR_SECONDARIES and DOMAIN.
-			 */
+             * IPV6ADDR_SECONDARIES and DOMAIN.
+             */
             if (str->len)
                 g_string_append_c(str, ' ');
 
@@ -2271,7 +2271,7 @@ get_route_attributes_string(NMIPRoute *route, int family)
                 g_string_append_printf(str, "%s lock 0", n);
             } else {
                 /* we also have a corresponding attribute with the numeric value. The
-				 * lock setting is handled above. */
+                 * lock setting is handled above. */
             }
         } else if (nm_streq(names[i], NM_IP_ROUTE_ATTRIBUTE_SCOPE)) {
             g_string_append_printf(str, "%s %u", names[i], (unsigned) g_variant_get_byte(attr));
@@ -2688,7 +2688,7 @@ write_ip4_setting(NMConnection *connection,
         svSetValueStr(ifcfg, "BOOTPROTO", "dhcp");
     else if (!strcmp(method, NM_SETTING_IP4_CONFIG_METHOD_MANUAL)) {
         /* Preserve the archaic form of "static" if there actually
-		 * is static configuration. */
+         * is static configuration. */
         if (g_strcmp0(svGetValue(ifcfg, "BOOTPROTO", &tmp), "static") || !num)
             svSetValueStr(ifcfg, "BOOTPROTO", "none");
         g_free(tmp);
@@ -2700,8 +2700,8 @@ write_ip4_setting(NMConnection *connection,
     has_netmask = !!svFindFirstNumberedKey(ifcfg, "NETMASK");
 
     /* Write out IPADDR<n>, PREFIX<n>, GATEWAY<n> for current IP addresses
-	 * without labels. Unset obsolete NETMASK<n>.
-	 */
+     * without labels. Unset obsolete NETMASK<n>.
+     */
     for (i = n = 0; i < num; i++) {
         NMIPAddress *addr;
         guint        prefix;
@@ -2718,10 +2718,10 @@ write_ip4_setting(NMConnection *connection,
 
         if (n == 0) {
             /* Instead of index 0 use un-numbered variables.
-			 * It's needed for compatibility with ifup that only recognizes 'GATEAWAY'
-			 * See https://bugzilla.redhat.com/show_bug.cgi?id=771673
-			 * and https://bugzilla.redhat.com/show_bug.cgi?id=1105770
-			 */
+             * It's needed for compatibility with ifup that only recognizes 'GATEAWAY'
+             * See https://bugzilla.redhat.com/show_bug.cgi?id=771673
+             * and https://bugzilla.redhat.com/show_bug.cgi?id=1105770
+             */
             j = -1;
         } else
             j = n;
@@ -2778,8 +2778,8 @@ write_ip4_setting(NMConnection *connection,
     svSetValueInt64_cond(ifcfg, "DHCP_HOSTNAME_FLAGS", flags != NM_DHCP_HOSTNAME_FLAG_NONE, flags);
 
     /* Missing DHCP_SEND_HOSTNAME means TRUE, and we prefer not write it explicitly
-	 * in that case, because it is NM-specific variable
-	 */
+     * in that case, because it is NM-specific variable
+     */
     svSetValueStr(ifcfg,
                   "DHCP_SEND_HOSTNAME",
                   nm_setting_ip_config_get_dhcp_send_hostname(s_ip4) ? NULL : "no");
@@ -2984,8 +2984,8 @@ write_ip6_setting(NMConnection *connection,
     svSetValueStr(ifcfg, "DHCPV6_HOSTNAME", hostname);
 
     /* Missing DHCPV6_SEND_HOSTNAME means TRUE, and we prefer not write it
-	 * explicitly in that case, because it is NM-specific variable
-	 */
+     * explicitly in that case, because it is NM-specific variable
+     */
     if (!nm_setting_ip_config_get_dhcp_send_hostname(s_ip6))
         svSetValueStr(ifcfg, "DHCPV6_SEND_HOSTNAME", "no");
 
@@ -3431,8 +3431,8 @@ do_write_to_disk(NMConnection *connection,
                  GError **     error)
 {
     /* From here on, we persist data to disk. Before, it was all in-memory
-	 * only. But we loaded the ifcfg files from disk, and managled our
-	 * new settings (in-memory). */
+     * only. But we loaded the ifcfg files from disk, and managled our
+     * new settings (in-memory). */
 
     if (!svWriteFileWithoutDirtyWellknown(ifcfg, 0644, error))
         return FALSE;
@@ -3544,13 +3544,13 @@ nms_ifcfg_rh_writer_write_connection(NMConnection *                  connection,
         return FALSE;
 
     /* Note that we just wrote the connection to disk, and re-read it from there.
-	 * That is racy if somebody else modifies the connection.
-	 * That race is why we must not tread a failure to re-read the profile
-	 * as an error.
-	 *
-	 * FIXME: a much better solution might be, to re-read the connection only based
-	 * on the in-memory representation of what we collected above. But the reader
-	 * does not yet allow to inject the configuration. */
+     * That is racy if somebody else modifies the connection.
+     * That race is why we must not tread a failure to re-read the profile
+     * as an error.
+     *
+     * FIXME: a much better solution might be, to re-read the connection only based
+     * on the in-memory representation of what we collected above. But the reader
+     * does not yet allow to inject the configuration. */
     if (out_reread || out_reread_same) {
         gs_unref_object NMConnection *reread      = NULL;
         gboolean                      reread_same = FALSE;
diff --git a/src/settings/plugins/ifcfg-rh/shvar.c b/src/settings/plugins/ifcfg-rh/shvar.c
index d31654eccf..2bab914f68 100644
--- a/src/settings/plugins/ifcfg-rh/shvar.c
+++ b/src/settings/plugins/ifcfg-rh/shvar.c
@@ -29,28 +29,28 @@ struct _shvarLine {
     CList lst;
 
     /* We index variables by their key in shvarFile.lst_idx. One shell variable might
-	 * occur multiple times in a file (in which case the last occurrence wins).
-	 * Hence, we need to keep a list of all the same keys.
-	 *
-	 * This is a pointer to the next shadowed line. */
+     * occur multiple times in a file (in which case the last occurrence wins).
+     * Hence, we need to keep a list of all the same keys.
+     *
+     * This is a pointer to the next shadowed line. */
     struct _shvarLine *prev_shadowed;
 
     /* There are three cases:
-	 *
-	 * 1) the line is not a valid variable assignment (that is, it doesn't
-	 *   start with a "FOO=" with possible whitespace prefix).
-	 *   In that case, @key and @key_with_prefix are %NULL, and the entire
-	 *   original line is in @line. Such entries are ignored for the most part.
-	 *
-	 * 2) if the line can be parsed with a "FOO=" assignment, then @line contains
-	 *   the part after '=', @key_with_prefix contains the key "FOO" with possible
-	 *   whitespace prefix, and @key points into @key_with_prefix skipping over the
-	 *   whitespace.
-	 *
-	 * 3) like 2, but if the value was deleted via svSetValue(), the entry is not removed,
-	 *   but only marked for deletion. That is done by clearing @line but preserving
-	 *   @key/@key_with_prefix.
-	 * */
+     *
+     * 1) the line is not a valid variable assignment (that is, it doesn't
+     *   start with a "FOO=" with possible whitespace prefix).
+     *   In that case, @key and @key_with_prefix are %NULL, and the entire
+     *   original line is in @line. Such entries are ignored for the most part.
+     *
+     * 2) if the line can be parsed with a "FOO=" assignment, then @line contains
+     *   the part after '=', @key_with_prefix contains the key "FOO" with possible
+     *   whitespace prefix, and @key points into @key_with_prefix skipping over the
+     *   whitespace.
+     *
+     * 3) like 2, but if the value was deleted via svSetValue(), the entry is not removed,
+     *   but only marked for deletion. That is done by clearing @line but preserving
+     *   @key/@key_with_prefix.
+     * */
     char *line;
     char *key_with_prefix;
 
@@ -236,9 +236,9 @@ svEscape(const char *s, char **to_free)
             requires_quotes = TRUE;
         else if (s[slen] < ' ') {
             /* if the string contains newline we can only express it using ANSI C quotation
-			 * (as we don't support line continuation).
-			 * Additionally, ANSI control characters look odd with regular quotation, so handle
-			 * them too. */
+             * (as we don't support line continuation).
+             * Additionally, ANSI control characters look odd with regular quotation, so handle
+             * them too. */
             return (*to_free = _escape_ansic(s));
         }
     }
@@ -325,18 +325,18 @@ _gstr_init(GString **str, const char *value, gsize i)
 
     if (!(*str)) {
         /* if @str is not yet initialized, it allocates
-		 * a new GString and copies @i characters from
-		 * @value over.
-		 *
-		 * Unescaping usually does not extend the length of a string,
-		 * so we might be tempted to allocate a fixed buffer of length
-		 * (strlen(value)+CONST).
-		 * However, due to $'\Ux' escapes, the maximum length is some
-		 * (FACTOR*strlen(value) + CONST), which is non trivial to get
-		 * right in all cases. Also, we would have to provision for the
-		 * very unlikely extreme case.
-		 * Instead, use a GString buffer which can grow as needed. But for an
-		 * initial guess, strlen(value) is a good start */
+         * a new GString and copies @i characters from
+         * @value over.
+         *
+         * Unescaping usually does not extend the length of a string,
+         * so we might be tempted to allocate a fixed buffer of length
+         * (strlen(value)+CONST).
+         * However, due to $'\Ux' escapes, the maximum length is some
+         * (FACTOR*strlen(value) + CONST), which is non trivial to get
+         * right in all cases. Also, we would have to provision for the
+         * very unlikely extreme case.
+         * Instead, use a GString buffer which can grow as needed. But for an
+         * initial guess, strlen(value) is a good start */
         *str = g_string_new_len(NULL, strlen(value) + 3);
         if (i)
             g_string_append_len(*str, value, i);
@@ -351,7 +351,7 @@ svUnescape(const char *value, char **to_free)
     int      looks_like_old_svescaped = -1;
 
     /* we handle bash syntax here (note that ifup has #!/bin/bash.
-	 * Thus, see https://www.gnu.org/software/bash/manual/html_node/Quoting.html#Quoting */
+     * Thus, see https://www.gnu.org/software/bash/manual/html_node/Quoting.html#Quoting */
 
     /* @value shall start with the first character after "FOO=" */
 
@@ -359,7 +359,7 @@ svUnescape(const char *value, char **to_free)
     nm_assert(to_free);
 
     /* we don't expect any newlines. They must be filtered out before-hand.
-	 * We also don't support line continuation. */
+     * We also don't support line continuation. */
     nm_assert(!NM_STRCHAR_ANY(value, ch, ch == '\n'));
 
     i = 0;
@@ -371,19 +371,19 @@ svUnescape(const char *value, char **to_free)
             gboolean has_semicolon = (value[i] == ';');
 
             /* starting with space is only allowed, if the entire
-			 * string consists of spaces (possibly terminated by a comment).
-			 * This disallows for example
-			 *   LANG=C ls -1
-			 *   LANG=  ls -1
-			 * but allows
-			 *   LANG= #comment
-			 *
-			 * As a special case, we also allow one trailing semicolon, as long
-			 * it is only followed by whitespace or a #-comment.
-			 *   FOO=;
-			 *   FOO=a;
-			 *   FOO=b ; #hallo
-			 */
+             * string consists of spaces (possibly terminated by a comment).
+             * This disallows for example
+             *   LANG=C ls -1
+             *   LANG=  ls -1
+             * but allows
+             *   LANG= #comment
+             *
+             * As a special case, we also allow one trailing semicolon, as long
+             * it is only followed by whitespace or a #-comment.
+             *   FOO=;
+             *   FOO=a;
+             *   FOO=b ; #hallo
+             */
             j = i + 1;
             while (g_ascii_isspace(value[j])
                    || (!has_semicolon && (has_semicolon = (value[j] == ';'))))
@@ -452,17 +452,17 @@ svUnescape(const char *value, char **to_free)
                         /* Drop the backslash. */
                     } else if (NM_IN_SET(value[i], '\'', '~')) {
                         /* '\'' and '~' in double quotes are not handled special by shell.
-						 * However, old versions of svEscape() would wrongly use double-quoting
-						 * with backslash escaping for these characters (expecting svUnescape()
-						 * to remove the backslash).
-						 *
-						 * In order to preserve previous behavior, we continue to read such
-						 * strings different then shell does. */
+                         * However, old versions of svEscape() would wrongly use double-quoting
+                         * with backslash escaping for these characters (expecting svUnescape()
+                         * to remove the backslash).
+                         *
+                         * In order to preserve previous behavior, we continue to read such
+                         * strings different then shell does. */
 
                         /* Actually, we can relax this. Old svEscape() escaped the entire value
-						 * in a particular way with double quotes.
-						 * If the value doesn't exactly look like something as created by svEscape(),
-						 * don't do the compat hack and preserve the backslash. */
+                         * in a particular way with double quotes.
+                         * If the value doesn't exactly look like something as created by svEscape(),
+                         * don't do the compat hack and preserve the backslash. */
                         if (looks_like_old_svescaped < 0)
                             looks_like_old_svescaped = _looks_like_old_svescaped(value);
                         if (!looks_like_old_svescaped)
@@ -598,7 +598,7 @@ loop_ansic_next:;
 
         if (NM_IN_SET(value[i], '|', '&', '(', ')', '<', '>')) {
             /* shell metacharacters are not supported without quoting.
-			 * Note that ';' is already handled above. */
+             * Note that ';' is already handled above. */
             goto out_error;
         }
 
@@ -687,8 +687,8 @@ void
 _nmtst_svFileSetName(shvarFile *s, const char *fileName)
 {
     /* changing the file name is not supported for regular
-	 * operation. Only allowed to use in tests, otherwise,
-	 * the filename is immutable. */
+     * operation. Only allowed to use in tests, otherwise,
+     * the filename is immutable. */
     g_free(s->fileName);
     s->fileName = g_strdup(fileName);
 }
@@ -842,9 +842,9 @@ _line_link_parse(shvarFile *s, const char *value, gsize len)
         shvarLine *existing_val;
 
         /* Slow-path: we have duplicate keys. Fix the mess we created.
-		 * Unfortunately, g_hash_table_insert() now had to allocate an extra
-		 * array to track the keys/values differently. I wish there was an
-		 * GHashTable API to add a key only if it does not exist yet. */
+         * Unfortunately, g_hash_table_insert() now had to allocate an extra
+         * array to track the keys/values differently. I wish there was an
+         * GHashTable API to add a key only if it does not exist yet. */
 
         if (!g_hash_table_lookup_extended(s->lst_idx,
                                           line,
@@ -922,7 +922,7 @@ svOpenFileInternal(const char *name, gboolean create, GError **error)
     }
 
     /* closefd is set if we opened the file read-only, so go ahead and
-	 * close it, because we can't write to it anyway */
+     * close it, because we can't write to it anyway */
     nm_assert(closefd || fd >= 0);
     return svFile_new(name, !closefd ? nm_steal_fd(&fd) : -1, content);
 }
@@ -1018,7 +1018,7 @@ svGetKeys(shvarFile *s, SvKeyType match_key_type)
         line = c_list_entry(current, shvarLine, lst);
         if (line->key && line->line && _svKeyMatchesType(line->key, match_key_type)) {
             /* we don't clone the keys. The keys are only valid
-			 * until @s gets modified. */
+             * until @s gets modified. */
             if (!keys)
                 keys = g_hash_table_new_full(nm_str_hash, g_str_equal, NULL, NULL);
             g_hash_table_add(keys, (gpointer) line->key);
@@ -1096,8 +1096,8 @@ _svGetValue(shvarFile *s, const char *key, char **to_free)
         v = svUnescape(line->line, to_free);
         if (!v) {
             /* a wrongly quoted value is treated like the empty string.
-			 * See also svWriteFile(), which handles unparsable values
-			 * that way. */
+             * See also svWriteFile(), which handles unparsable values
+             * that way. */
             nm_assert(!*to_free);
             return "";
         }
@@ -1248,7 +1248,7 @@ svGetValueInt64(shvarFile *s, const char *key, guint base, gint64 min, gint64 ma
     if (!value) {
         nm_assert(!to_free);
         /* indicate that the key does not exist (or has a syntax error
-		 * and svUnescape() failed). */
+         * and svUnescape() failed). */
         errno = ENOKEY;
         return fallback;
     }
@@ -1273,7 +1273,7 @@ svGetValueEnum(shvarFile *s, const char *key, GType gtype, int *out_value, GErro
     svalue = _svGetValue(s, key, &to_free);
     if (!svalue) {
         /* don't touch out_value. The caller is supposed
-		 * to initialize it with the default value. */
+         * to initialize it with the default value. */
         return TRUE;
     }
 
@@ -1367,7 +1367,7 @@ svSetValue(shvarFile *s, const char *key, const char *value)
     line = g_hash_table_lookup(s->lst_idx, &key);
     if (line && (l_shadowed = line->prev_shadowed)) {
         /* if we find multiple entries for the same key, we can
-		 * delete the shadowed ones. */
+         * delete the shadowed ones. */
         line->prev_shadowed = NULL;
         changed             = TRUE;
         do {
@@ -1381,7 +1381,7 @@ svSetValue(shvarFile *s, const char *key, const char *value)
     if (!value) {
         if (line) {
             /* We only clear the value, but leave the line entry. This way, if we
-			 * happen to re-add the value, we write it to the same line again. */
+             * happen to re-add the value, we write it to the same line again. */
             if (nm_clear_g_free(&line->line)) {
                 changed = TRUE;
             }
diff --git a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
index 1a924cbd57..7ed6dd11d1 100644
--- a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
+++ b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
@@ -97,9 +97,9 @@ _assert_reread_same_FIXME(NMConnection *connection, NMConnection *reread)
     gs_unref_hashtable GHashTable *settings             = NULL;
 
     /* FIXME: these assertion failures should not happen as we expect
-	 * that re-reading a connection after write yields the same result.
-	 *
-	 * Needs investigation and fixing. */
+     * that re-reading a connection after write yields the same result.
+     *
+     * Needs investigation and fixing. */
     nmtst_assert_connection_verifies_without_normalization(reread);
 
     connection_normalized = nmtst_connection_duplicate_and_normalize(connection);
@@ -170,7 +170,7 @@ _assert_expected_content(NMConnection *connection, const char *filename, const c
             }
 
             /* other '$' is not supported. If need be, support escaping of
-			 * '$' via '$$'. */
+             * '$' via '$$'. */
             g_assert_not_reached();
         }
     }
@@ -623,9 +623,9 @@ test_read_basic(void)
     g_assert_cmpint(nm_setting_connection_get_autoconnect_retries(s_con), ==, -1);
 
     /* UUID can't be tested if the ifcfg does not contain the UUID key, because
-	 * the UUID is generated on the full path of the ifcfg file, which can change
-	 * depending on where the tests are run.
-	 */
+     * the UUID is generated on the full path of the ifcfg file, which can change
+     * depending on where the tests are run.
+     */
 
     /* ===== WIRED SETTING ===== */
     s_wired = nm_connection_get_setting_wired(connection);
@@ -2145,8 +2145,8 @@ test_read_802_1x_ttls_eapgtc(void)
     NMSetting8021x *s_8021x;
 
     /* Test that EAP-* inner methods are correctly read into the
-	 * NMSetting8021x::autheap property.
-	 */
+     * NMSetting8021x::autheap property.
+     */
 
     connection = _connection_from_file(TEST_IFCFG_DIR "/ifcfg-test-wired-802-1x-ttls-eapgtc",
                                        NULL,
@@ -2601,9 +2601,9 @@ test_read_wifi_open(void)
     g_assert_cmpstr(nm_setting_connection_get_id(s_con), ==, "System blahblah (test-wifi-open)");
 
     /* UUID can't be tested if the ifcfg does not contain the UUID key, because
-	 * the UUID is generated on the full path of the ifcfg file, which can change
-	 * depending on where the tests are run.
-	 */
+     * the UUID is generated on the full path of the ifcfg file, which can change
+     * depending on where the tests are run.
+     */
 
     g_assert_cmpint(nm_setting_connection_get_timestamp(s_con), ==, 0);
     g_assert(nm_setting_connection_get_autoconnect(s_con));
@@ -2812,9 +2812,9 @@ test_read_wifi_wep(void)
     g_assert_cmpstr(nm_setting_connection_get_id(s_con), ==, "System blahblah (test-wifi-wep)");
 
     /* UUID can't be tested if the ifcfg does not contain the UUID key, because
-	 * the UUID is generated on the full path of the ifcfg file, which can change
-	 * depending on where the tests are run.
-	 */
+     * the UUID is generated on the full path of the ifcfg file, which can change
+     * depending on where the tests are run.
+     */
 
     g_assert_cmpint(nm_setting_connection_get_timestamp(s_con), ==, 0);
     g_assert(nm_setting_connection_get_autoconnect(s_con));
@@ -2895,9 +2895,9 @@ test_read_wifi_wep_adhoc(void)
                     "System blahblah (test-wifi-wep-adhoc)");
 
     /* UUID can't be tested if the ifcfg does not contain the UUID key, because
-	 * the UUID is generated on the full path of the ifcfg file, which can change
-	 * depending on where the tests are run.
-	 */
+     * the UUID is generated on the full path of the ifcfg file, which can change
+     * depending on where the tests are run.
+     */
 
     g_assert(!nm_setting_connection_get_autoconnect(s_con));
 
@@ -3181,9 +3181,9 @@ test_read_wifi_wpa_psk(void)
     g_assert_cmpstr(nm_setting_connection_get_id(s_con), ==, "System blahblah (test-wifi-wpa-psk)");
 
     /* UUID can't be tested if the ifcfg does not contain the UUID key, because
-	 * the UUID is generated on the full path of the ifcfg file, which can change
-	 * depending on where the tests are run.
-	 */
+     * the UUID is generated on the full path of the ifcfg file, which can change
+     * depending on where the tests are run.
+     */
 
     g_assert_cmpint(nm_setting_connection_get_timestamp(s_con), ==, 0);
     g_assert(nm_setting_connection_get_autoconnect(s_con));
@@ -3710,8 +3710,8 @@ test_read_wifi_dynamic_wep_leap(void)
     g_assert_cmpstr(nm_setting_wireless_security_get_key_mgmt(s_wsec), ==, "ieee8021x");
 
     /* Auth alg should be NULL (open) for dynamic WEP with LEAP as the EAP method;
-	 * only "old-school" LEAP uses 'leap' for the auth alg.
-	 */
+     * only "old-school" LEAP uses 'leap' for the auth alg.
+     */
     g_assert_cmpstr(nm_setting_wireless_security_get_auth_alg(s_wsec), ==, NULL);
 
     /* Expect no old-school LEAP username/password, that'll be in the 802.1x setting */
@@ -4508,9 +4508,9 @@ test_read_wifi_wep_no_keys(void)
                     "System foobar (test-wifi-wep-no-keys)");
 
     /* UUID can't be tested if the ifcfg does not contain the UUID key, because
-	 * the UUID is generated on the full path of the ifcfg file, which can change
-	 * depending on where the tests are run.
-	 */
+     * the UUID is generated on the full path of the ifcfg file, which can change
+     * depending on where the tests are run.
+     */
 
     /* ===== WIRELESS SETTING ===== */
 
@@ -4592,8 +4592,8 @@ test_read_wifi_wep_agent_keys(void)
                                        NULL);
 
     /* Ensure the connection is still marked for wifi security even though
-	 * we don't have any WEP keys because they are agent owned.
-	 */
+     * we don't have any WEP keys because they are agent owned.
+     */
 
     /* ===== WIRELESS SETTING ===== */
     s_wifi = nm_connection_get_setting_wireless(connection);
@@ -5513,9 +5513,9 @@ test_read_write_static_routes_legacy(void)
     g_assert(!nm_setting_ip_config_get_never_default(s_ip4));
 
     /* Save the ifcfg; use a special different scratch dir to ensure that
-	 * we can clean up after the written connection in both the original
-	 * source tree and for 'make distcheck'.
-	 */
+     * we can clean up after the written connection in both the original
+     * source tree and for 'make distcheck'.
+     */
     _writer_new_connec_exp(connection,
                            TEST_SCRATCH_DIR_TMP,
                            TEST_IFCFG_DIR "/ifcfg-test-static-routes-legacy.cexpected",
@@ -5637,8 +5637,8 @@ test_write_wired_static_routes(void)
                                   &reread,
                                   &reread_same);
     /* ifcfg does not support setting onlink=0. It gets lost during write+re-read.
-	 * Assert that it's missing, and patch it to check whether the rest of the
-	 * connection equals. */
+     * Assert that it's missing, and patch it to check whether the rest of the
+     * connection equals. */
     g_assert(!reread_same);
     nmtst_assert_connection_verifies_without_normalization(reread);
     s_ip4 = nm_connection_get_setting_ip4_config(reread);
@@ -5860,9 +5860,9 @@ test_write_wired_8021x_tls(gconstpointer test_data)
     nmtst_file_unlink_if_exists(keyfile);
 
     /* Ensure the reread connection's certificates and private key are paths; no
-	 * matter what scheme was used in the original connection they will be read
-	 * back in as paths.
-	 */
+     * matter what scheme was used in the original connection they will be read
+     * back in as paths.
+     */
     s_8021x = nm_connection_get_setting_802_1x(reread);
     g_assert(s_8021x);
     g_assert_cmpint(nm_setting_802_1x_get_ca_cert_scheme(s_8021x),
@@ -5888,16 +5888,16 @@ test_write_wired_8021x_tls(gconstpointer test_data)
 
     if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) {
         /* Do a direct compare if using the path scheme since then the
-		 * certificate and key properties should be the same.  If using blob
-		 * scheme the original connection cert/key properties will be blobs
-		 * but the re-read connection is always path scheme, so we wouldn't
-		 * expect it to compare successfully.
-		 */
+         * certificate and key properties should be the same.  If using blob
+         * scheme the original connection cert/key properties will be blobs
+         * but the re-read connection is always path scheme, so we wouldn't
+         * expect it to compare successfully.
+         */
         if (flags != NM_SETTING_SECRET_FLAG_NONE) {
             /* Clear original connection's private key password because flags
-			 * say it's not system-owned, and therefore it should not show up
-			 * in the re-read connection.
-			 */
+             * say it's not system-owned, and therefore it should not show up
+             * in the re-read connection.
+             */
             s_8021x = nm_connection_get_setting_802_1x(connection);
             g_object_set(s_8021x, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD, NULL, NULL);
         }
@@ -6013,9 +6013,9 @@ test_write_wired_aliases(void)
     nmtst_file_unlink(TEST_SCRATCH_ALIAS_BASE ":3");
 
     /* nm_connection_compare() is not guaranteed to succeed, because the
-	 * aliases get read back in essentially random order. So just
-	 * verify the aliases manually.
-	 */
+     * aliases get read back in essentially random order. So just
+     * verify the aliases manually.
+     */
     s_ip4 = nm_connection_get_setting_ip4_config(connection);
     g_assert(nm_setting_ip_config_get_num_addresses(s_ip4) == num_addresses);
 
@@ -6961,8 +6961,8 @@ test_write_wifi_leap_secret_flags(gconstpointer data)
     g_assert(g_file_test(keyfile, G_FILE_TEST_EXISTS) == FALSE);
 
     /* Remove the LEAP password from the original connection since it wont' be
-	 * in the reread connection, as the password is not system owned.
-	 */
+     * in the reread connection, as the password is not system owned.
+     */
     g_object_set(s_wsec, NM_SETTING_WIRELESS_SECURITY_LEAP_PASSWORD, NULL, NULL);
     nmtst_assert_connection_equals(connection, TRUE, reread, FALSE);
 }
@@ -7585,8 +7585,8 @@ test_write_wifi_wpa_then_open(void)
     const char *                  ssid_data = "blahblah";
 
     /* Test that writing out a WPA config then changing that to an open
-	 * config doesn't leave various WPA-related keys lying around in the ifcfg.
-	 */
+     * config doesn't leave various WPA-related keys lying around in the ifcfg.
+     */
 
     connection = nm_simple_connection_new();
 
@@ -7700,8 +7700,8 @@ test_write_wifi_wpa_then_wep_with_perms(void)
     const char *                  ssid_data = "SomeSSID";
 
     /* Test that writing out a WPA config then changing that to a WEP
-	 * config works and doesn't cause infinite loop or other issues.
-	 */
+     * config works and doesn't cause infinite loop or other issues.
+     */
 
     connection = nm_simple_connection_new();
     g_assert(connection);
@@ -7906,9 +7906,9 @@ test_write_wifi_dynamic_wep_leap(void)
     nmtst_assert_connection_equals(connection, TRUE, reread, FALSE);
 
     /* Check and make sure that an "old-school" LEAP (Network EAP) connection
-	 * did not get written.  Check first that the auth alg is not set to "LEAP"
-	 * and next that the only IEEE 802.1x EAP method is "LEAP".
-	 */
+     * did not get written.  Check first that the auth alg is not set to "LEAP"
+     * and next that the only IEEE 802.1x EAP method is "LEAP".
+     */
     ifcfg = _svOpenFile(testfile);
     _svGetValue_check(ifcfg, "SECURITYMODE", NULL);
     _svGetValue_check(ifcfg, "IEEE_8021X_EAP_METHODS", "LEAP");
@@ -8210,10 +8210,10 @@ test_write_wifi_wep_agent_keys(void)
     reread = _connection_from_file(testfile, NULL, TYPE_WIRELESS, NULL);
 
     /* Remove the WEP key from the original, because it should not have been
-	 * written out to disk as it was agent-owned.  The new connection should
-	 * not have any WEP keys set.
-	 * Also the new connection should not have WEP key type set.
-	 */
+     * written out to disk as it was agent-owned.  The new connection should
+     * not have any WEP keys set.
+     * Also the new connection should not have WEP key type set.
+     */
     nm_setting_wireless_security_set_wep_key(s_wsec, 0, NULL);
     g_object_set(s_wsec, NM_SETTING_WIRELESS_SECURITY_WEP_KEY_TYPE, NM_WEP_KEY_TYPE_UNKNOWN, NULL);
 
@@ -9041,9 +9041,9 @@ test_write_ethernet_missing_ipv6(void)
 
     /* IP6 setting */
     /*
-	 * We intentionally don't add IPv6 setting here. ifcfg-rh plugin should regard
-	 * missing IPv6 as IPv6 with NM_SETTING_IP6_CONFIG_METHOD_AUTO method.
-	 */
+     * We intentionally don't add IPv6 setting here. ifcfg-rh plugin should regard
+     * missing IPv6 as IPv6 with NM_SETTING_IP6_CONFIG_METHOD_AUTO method.
+     */
 
     nmtst_assert_connection_verifies(connection);
 
@@ -10379,9 +10379,9 @@ do_svUnescape_combine_ansi_append(GString *               str_val,
     g_string_append(str_exp, data->exp);
     if (honor_needs_ascii_separator && data->needs_ascii_separator) {
         /* the string has an open escape sequence. We must ensure that when
-		 * combining it with another sequence, that they don't merge into
-		 * something different. for example "\xa" + "a" must not result in
-		 * "\xaa". Instead, we add a space in between to get "\xa a". */
+         * combining it with another sequence, that they don't merge into
+         * something different. for example "\xa" + "a" must not result in
+         * "\xaa". Instead, we add a space in between to get "\xa a". */
         g_string_append(str_val, " ");
         g_string_append(str_exp, " ");
     }
@@ -10500,7 +10500,7 @@ test_svUnescape(void)
         V1("\"aa\\\"\"b", "aa\"b"),
 
         /* the following is not shell behavior, but kept for backward compatibility
-		 * with old svEscape(). */
+         * with old svEscape(). */
         V0("\"\\'\"", "'"),
         V0("\"\\~\"", "~"),
         V0("\"b\\~b\"", "b~b"),
@@ -10508,7 +10508,7 @@ test_svUnescape(void)
         V0("\"\\~\\'\"", "~'"),
 
         /* the following is shell-behavior, because it doesn't look like written
-		 * by old svEscape(). */
+         * by old svEscape(). */
         V1("\"\\~~\"", "\\~~"),
         V1("\"\\a\\'\"", "\\a\\'"),
         V1("x\"\\~\"", "x\\~"),
@@ -10518,7 +10518,7 @@ test_svUnescape(void)
     };
     const UnescapeTestData data_ansi[] = {
         /* strings inside $''. They cannot be compared directly, but must
-		 * be wrapped by do_svUnescape_combine_ansi(). */
+         * be wrapped by do_svUnescape_combine_ansi(). */
         V1("", ""),
         V1("a", "a"),
         V1("b", "b"),
@@ -10732,9 +10732,9 @@ test_read_vlan_trailing_spaces(void)
     char *         contents = NULL;
 
     /* Ensure there is whitespace at the end of the VLAN interface name,
-	 * to prevent the whitespace getting stripped off and committed mistakenly
-	 * by something in the future.
-	 */
+     * to prevent the whitespace getting stripped off and committed mistakenly
+     * by something in the future.
+     */
     success = g_file_get_contents(testfile, &contents, NULL, &error);
     g_assert_no_error(error);
     g_assert(success);
diff --git a/src/settings/plugins/ifupdown/nms-ifupdown-interface-parser.c b/src/settings/plugins/ifupdown/nms-ifupdown-interface-parser.c
index 071116596d..25090d1aee 100644
--- a/src/settings/plugins/ifupdown/nms-ifupdown-interface-parser.c
+++ b/src/settings/plugins/ifupdown/nms-ifupdown-interface-parser.c
@@ -74,7 +74,7 @@ add_data(if_parser *parser, const char *key, const char *data)
     memcpy((char *) ifd->data, data, l_data);
 
     /* Normalize keys. Convert '_' to '-', as ifupdown accepts both variants.
-	 * When querying keys via ifparser_getkey(), use '-'. */
+     * When querying keys via ifparser_getkey(), use '-'. */
     idx = (char *) ifd->key;
     while ((idx = strchr(idx, '_')))
         *(idx++) = '-';
@@ -184,8 +184,8 @@ _recursive_ifparser(if_parser *parser, const char *eni_file, int quiet)
         }
 
         /* There are six different stanzas:
-		 * iface, mapping, auto, allow-*, source, and source-directory.
-		 * Create a block for each of them except source and source-directory.  */
+         * iface, mapping, auto, allow-*, source, and source-directory.
+         * Create a block for each of them except source and source-directory.  */
 
         /* iface stanza takes at least 3 parameters */
         if (nm_streq(token[0], "iface")) {
@@ -200,7 +200,7 @@ _recursive_ifparser(if_parser *parser, const char *eni_file, int quiet)
             add_data(parser, token[2], join_values_with_spaces(value, token + 3));
         }
         /* auto and allow-auto stanzas are equivalent,
-		 * both can take multiple interfaces as parameters: add one block for each */
+         * both can take multiple interfaces as parameters: add one block for each */
         else if (NM_IN_STRSET(token[0], "auto", "allow-auto")) {
             int i;
 
diff --git a/src/settings/plugins/ifupdown/nms-ifupdown-plugin.c b/src/settings/plugins/ifupdown/nms-ifupdown-plugin.c
index f96aee3616..2379dd7381 100644
--- a/src/settings/plugins/ifupdown/nms-ifupdown-plugin.c
+++ b/src/settings/plugins/ifupdown/nms-ifupdown-plugin.c
@@ -31,8 +31,8 @@ typedef struct {
 
 typedef struct {
     /* Stores an entry for blocks/interfaces read from /e/n/i and (if exists)
-	 * the StorageData associated with the block.
-	 */
+     * the StorageData associated with the block.
+     */
     GHashTable *eni_ifaces;
 
     bool ifupdown_managed : 1;
@@ -123,11 +123,11 @@ reload_connections(NMSettingsPlugin *                     plugin,
         initialize(self);
     else if (!priv->already_reloaded) {
         /* This is the first call to reload, but we are already initialized.
-		 *
-		 * This happens because during start NMSettings first queries unmanaged-specs,
-		 * and then issues a reload call right away.
-		 *
-		 * On future reloads, we really want to load /e/n/i again. */
+         *
+         * This happens because during start NMSettings first queries unmanaged-specs,
+         * and then issues a reload call right away.
+         *
+         * On future reloads, we really want to load /e/n/i again. */
         priv->already_reloaded = TRUE;
     } else {
         eni_ifaces_old   = priv->eni_ifaces;
diff --git a/src/settings/plugins/keyfile/nms-keyfile-plugin.c b/src/settings/plugins/keyfile/nms-keyfile-plugin.c
index 7e2be5dee1..8704923c3f 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-plugin.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-plugin.c
@@ -42,18 +42,18 @@ typedef struct {
     NMConfig *config;
 
     /* there can/could be multiple read-only directories. For example, one
-	 * could set dirname_libs to
-	 *   - /usr/lib/NetworkManager/profiles/
-	 *   - /etc/NetworkManager/system-connections
-	 * and leave dirname_etc unset. In this case, there would be multiple
-	 * read-only directories.
-	 *
-	 * Directories that come later have higher priority and shadow profiles
-	 * from earlier directories.
-	 *
-	 * Currently, this is only an array with zero or one elements. It could be
-	 * easily extended to support multiple read-only directories.
-	 */
+     * could set dirname_libs to
+     *   - /usr/lib/NetworkManager/profiles/
+     *   - /etc/NetworkManager/system-connections
+     * and leave dirname_etc unset. In this case, there would be multiple
+     * read-only directories.
+     *
+     * Directories that come later have higher priority and shadow profiles
+     * from earlier directories.
+     *
+     * Currently, this is only an array with zero or one elements. It could be
+     * easily extended to support multiple read-only directories.
+     */
     char *dirname_libs[2];
     char *dirname_etc;
     char *dirname_run;
@@ -130,7 +130,7 @@ static gboolean
 _ignore_filename(NMSKeyfileStorageType storage_type, const char *filename)
 {
     /* for backward-compatibility, we don't require an extension for
-	 * files under "/etc/...". */
+     * files under "/etc/...". */
     return nm_keyfile_utils_ignore_filename(filename,
                                             (storage_type != NMS_KEYFILE_STORAGE_TYPE_ETC));
 }
@@ -139,9 +139,9 @@ static const char *
 _get_plugin_dir(NMSKeyfilePluginPrivate *priv)
 {
     /* the plugin dir is only needed to generate connection.uuid value via
-	 * nm_keyfile_read_ensure_uuid(). This is either the configured /etc
-	 * directory, of the compile-time default (in case the /etc directory
-	 * is disabled). */
+     * nm_keyfile_read_ensure_uuid(). This is either the configured /etc
+     * directory, of the compile-time default (in case the /etc directory
+     * is disabled). */
     return priv->dirname_etc ?: NM_KEYFILE_PATH_NAME_ETC_DEFAULT;
 }
 
@@ -543,15 +543,15 @@ _storages_consolidate(NMSKeyfilePlugin *                     self,
 
         if (!storage->is_dirty) {
             /* the entry is no longer is_dirty. In the meantime we already emitted
-			 * another signal for it. */
+             * another signal for it. */
             continue;
         }
         storage->is_dirty = FALSE;
 
         if (c_list_is_empty(&storage->parent._storage_lst)) {
             /* hm? The profile was deleted in the meantime? That is only possible
-			 * if the signal handler called again into the plugin. In any case, the event
-			 * was already emitted. Skip. */
+             * if the signal handler called again into the plugin. In any case, the event
+             * was already emitted. Skip. */
             continue;
         }
 
@@ -681,7 +681,7 @@ load_connections(NMSettingsPlugin *                     plugin,
                 NMSKeyfileStorage *storage2;
 
                 /* the file does not exist. We take that as indication to unload the file
-				 * that was previously loaded... */
+                 * that was previously loaded... */
                 storage2 = nm_sett_util_storages_lookup_by_filename(&priv->storages, full_filename);
                 if (storage2)
                     g_hash_table_add(storages_replaced, g_object_ref(storage2));
@@ -719,14 +719,14 @@ load_connections(NMSettingsPlugin *                     plugin,
             }
 
             /* @storage has a UUID that was just loaded from disk, but we have an entry in cache.
-			 * Reload that file too despite not being told to do so. The reason is to get
-			 * the latest file timestamp so that we get the priorities right. */
+             * Reload that file too despite not being told to do so. The reason is to get
+             * the latest file timestamp so that we get the priorities right. */
 
             storage_new = _load_file_from_path(self, full_filename, storage->storage_type, &local);
             if (storage_new && !nm_streq(loaded_uuid, nms_keyfile_storage_get_uuid(storage_new))) {
                 /* the file now references a different UUID. We are not told to reload
-				 * that file, so this means the existing storage (with the previous
-				 * filename and UUID tuple) is no longer valid. */
+                 * that file, so this means the existing storage (with the previous
+                 * filename and UUID tuple) is no longer valid. */
                 g_clear_object(&storage_new);
             }
 
@@ -777,7 +777,7 @@ nms_keyfile_plugin_add_connection(NMSKeyfilePlugin *  self,
     uuid = nm_connection_get_uuid(connection);
 
     /* Note that even if the caller requests persistent storage, we may switch to in-memory, if
-	 * no /etc directory is configured. */
+     * no /etc directory is configured. */
     storage_type = !in_memory && priv->dirname_etc ? NMS_KEYFILE_STORAGE_TYPE_ETC
                                                    : NMS_KEYFILE_STORAGE_TYPE_RUN;
 
@@ -1244,8 +1244,8 @@ nms_keyfile_plugin_init(NMSKeyfilePlugin *plugin)
                                                                      nms_keyfile_storage_destroy);
 
     /* dirname_libs are a set of read-only directories with lower priority than /etc or /run.
-	 * There is nothing complicated about having multiple of such directories, so dirname_libs
-	 * is a list (which currently only has at most one directory). */
+     * There is nothing complicated about having multiple of such directories, so dirname_libs
+     * is a list (which currently only has at most one directory). */
     priv->dirname_libs[0] = nm_sd_utils_path_simplify(g_strdup(NM_KEYFILE_PATH_NAME_LIB), FALSE);
     priv->dirname_libs[1] = NULL;
     priv->dirname_run     = nm_sd_utils_path_simplify(g_strdup(NM_KEYFILE_PATH_NAME_RUN), FALSE);
@@ -1255,8 +1255,8 @@ nms_keyfile_plugin_init(NMSKeyfilePlugin *plugin)
                                                  NM_CONFIG_GET_VALUE_STRIP);
     if (priv->dirname_etc && priv->dirname_etc[0] == '\0') {
         /* special case: configure an empty keyfile path so that NM has no writable keyfile
-		 * directory. In this case, NM will only honor dirname_libs and dirname_run, meaning
-		 * it cannot persist profile to non-volatile memory. */
+         * directory. In this case, NM will only honor dirname_libs and dirname_run, meaning
+         * it cannot persist profile to non-volatile memory. */
         nm_clear_g_free(&priv->dirname_etc);
     } else if (!priv->dirname_etc || priv->dirname_etc[0] != '/') {
         /* either invalid path or unspecified. Use the default. */
diff --git a/src/settings/plugins/keyfile/nms-keyfile-reader.c b/src/settings/plugins/keyfile/nms-keyfile-reader.c
index d423cdb27a..b0cedd4926 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-reader.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-reader.c
@@ -118,7 +118,7 @@ nms_keyfile_reader_from_keyfile(GKeyFile *  key_file,
         nm_assert(filename[0] == '/');
 
         /* @base_dir may be NULL, in which case @filename must be an absolute path,
-		 * and the directory is taken as the @base_dir. */
+         * and the directory is taken as the @base_dir. */
         s        = strrchr(filename, '/');
         base_dir = nm_strndup_a(255, filename, s - filename, &base_dir_free);
         if (!profile_dir || nm_streq(base_dir, profile_dir))
diff --git a/src/settings/plugins/keyfile/nms-keyfile-storage.c b/src/settings/plugins/keyfile/nms-keyfile-storage.c
index dfd40eec01..dcf120a955 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-storage.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-storage.c
@@ -69,7 +69,7 @@ cmp_fcn(const NMSKeyfileStorage *a, const NMSKeyfileStorage *b)
     nm_assert(a != b);
 
     /* sort by storage-type, which also has a numeric value according to their
-	 * (inverse) priority. */
+     * (inverse) priority. */
     NM_CMP_FIELD_UNSAFE(b, a, storage_type);
 
     /* meta-data is more important. */
diff --git a/src/settings/plugins/keyfile/nms-keyfile-storage.h b/src/settings/plugins/keyfile/nms-keyfile-storage.h
index 08702d7a5a..3686cb8be6 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-storage.h
+++ b/src/settings/plugins/keyfile/nms-keyfile-storage.h
@@ -33,65 +33,65 @@ typedef struct {
     NMSettingsStorage parent;
 
     /* The connection. Note that there are tombstones (loaded-uuid files to /dev/null)
-	 * that don't have a connection.
-	 *
-	 * Also, we don't actually remember the loaded connection after returning it
-	 * to NMSettings. So, also for regular storages (non-tombstones) this field
-	 * is often cleared. */
+     * that don't have a connection.
+     *
+     * Also, we don't actually remember the loaded connection after returning it
+     * to NMSettings. So, also for regular storages (non-tombstones) this field
+     * is often cleared. */
     union {
         struct {
             NMConnection *connection;
 
             /* when we move a profile from permanent storage to unsaved (/run), then
-			 * we may leave the profile on disk (depending on options for Update2()).
-			 *
-			 * Later, when we save the profile again to disk, we want to re-use that filename.
-			 * Likewise, we delete the (now in-memory) profile, we may want to also delete
-			 * the original filename.
-			 *
-			 * This is the original filename, and we store it inside [.nmmeta] in the
-			 * keyfile in /run. Note that we don't store this in the .nmmeta file, because
-			 * the information is tied to the particular keyfile in /run, not to all UUIDs
-			 * in general. */
+             * we may leave the profile on disk (depending on options for Update2()).
+             *
+             * Later, when we save the profile again to disk, we want to re-use that filename.
+             * Likewise, we delete the (now in-memory) profile, we may want to also delete
+             * the original filename.
+             *
+             * This is the original filename, and we store it inside [.nmmeta] in the
+             * keyfile in /run. Note that we don't store this in the .nmmeta file, because
+             * the information is tied to the particular keyfile in /run, not to all UUIDs
+             * in general. */
             char *shadowed_storage;
 
             /* the timestamp (stat's mtime) of the keyfile. For meta-data this
-			 * is irrelevant. The purpose is that if the same storage type (directory) has
-			 * multiple files with the same UUID, then the newer file gets preferred. */
+             * is irrelevant. The purpose is that if the same storage type (directory) has
+             * multiple files with the same UUID, then the newer file gets preferred. */
             struct timespec stat_mtime;
 
             /* these flags are only relevant for storages with %NMS_KEYFILE_STORAGE_TYPE_RUN
-			 * (and non-metadata). This is to persist and reload these settings flags to
-			 * /run.
-			 *
-			 * Note that these flags are not stored in as meta-data. The reason is that meta-data
-			 * is per UUID. But these flags are only relevant for a particular keyfile on disk.
-			 * That is, it must be tied to the actual keyfile, and not to the UUID. */
+             * (and non-metadata). This is to persist and reload these settings flags to
+             * /run.
+             *
+             * Note that these flags are not stored in as meta-data. The reason is that meta-data
+             * is per UUID. But these flags are only relevant for a particular keyfile on disk.
+             * That is, it must be tied to the actual keyfile, and not to the UUID. */
             bool is_nm_generated : 1;
             bool is_volatile : 1;
             bool is_external : 1;
 
             /* if shadowed_storage is set, then this flag indicates whether the file
-			 * is owned. The difference comes into play when deleting the in-memory,
-			 * shadowing profile: a owned profile will also be deleted. */
+             * is owned. The difference comes into play when deleting the in-memory,
+             * shadowing profile: a owned profile will also be deleted. */
             bool shadowed_owned : 1;
 
         } conn_data;
 
         /* the content from the .nmmeta file. Note that the nmmeta file has the UUID
-		 * in the filename, that means there can be only two variants of this file:
-		 * in /etc and in /run. As such, this is really meta-data about the entire profile
-		 * (the UUID), and not about the individual keyfile. */
+         * in the filename, that means there can be only two variants of this file:
+         * in /etc and in /run. As such, this is really meta-data about the entire profile
+         * (the UUID), and not about the individual keyfile. */
         NMSettingsMetaData meta_data;
 
     } u;
 
     /* The storage type. This is directly related to the filename. Since
-	 * the filename cannot change, this value is unchanging. */
+     * the filename cannot change, this value is unchanging. */
     const NMSKeyfileStorageType storage_type;
 
     /* whether union "u" has meta_data or conn_data. Since the type of the storage
-	 * depends on the (immutable) filename, this is also const. */
+     * depends on the (immutable) filename, this is also const. */
     const bool is_meta_data;
 
     /* this flag is only used during reload to mark and prune old entries. */
@@ -188,13 +188,13 @@ nm_settings_storage_is_meta_data_alive(const NMSettingsStorage *storage)
         return NULL;
 
     /* Regular (all other) storages are alive as long as they report a NMConnection, and
-	 * they will be dropped, once they have no more connection.
-	 *
-	 * Meta-data storages are special: they never report a NMConnection.
-	 * So, a meta-data storage is alive as long as it is tracked by the
-	 * settings plugin.
-	 *
-	 * This function is used to ckeck for that. */
+     * they will be dropped, once they have no more connection.
+     *
+     * Meta-data storages are special: they never report a NMConnection.
+     * So, a meta-data storage is alive as long as it is tracked by the
+     * settings plugin.
+     *
+     * This function is used to ckeck for that. */
 
     if (c_list_is_empty(&storage->_storage_lst))
         return NULL;
diff --git a/src/settings/plugins/keyfile/nms-keyfile-utils.c b/src/settings/plugins/keyfile/nms-keyfile-utils.c
index a5aab64ce8..42d4615873 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-utils.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-utils.c
@@ -52,7 +52,7 @@ nms_keyfile_nmmeta_check_filename(const char *filename, guint *out_uuid_len)
 
     if (!NM_IN_SET(len, 36, 40)) {
         /* the remaining part of the filename has not the right length to
-		 * contain a UUID (according to nm_utils_is_uuid()). */
+         * contain a UUID (according to nm_utils_is_uuid()). */
         return NULL;
     }
 
@@ -81,7 +81,7 @@ nms_keyfile_nmmeta_filename(const char *dirname, const char *uuid, gboolean temp
                    temporary ? "~" : "")
         >= sizeof(filename)) {
         /* valid uuids are limited in length (nm_utils_is_uuid). The buffer should always
-		 * be large enough. */
+         * be large enough. */
         nm_assert_not_reached();
     }
 
@@ -151,7 +151,7 @@ nms_keyfile_nmmeta_read(const char * dirname,
 
         if (!loaded_path && !shadowed_storage) {
             /* if there is no useful information in the file, it is the same as if
-			 * the file is not present. Signal failure. */
+             * the file is not present. Signal failure. */
             return FALSE;
         }
 
@@ -240,7 +240,7 @@ nms_keyfile_nmmeta_write(const char *dirname,
         f = nm_utils_file_is_in_path(loaded_path, dirname);
         if (f) {
             /* @loaded_path points to a file directly in @dirname.
-			 * Don't use absolute paths. */
+             * Don't use absolute paths. */
             loaded_path = f;
         }
     }
@@ -275,8 +275,8 @@ nms_keyfile_nmmeta_write(const char *dirname,
         }
     } else {
         /* we only have the "loaded_path" to store. That is commonly used for the tombstones to
-		 * link to /dev/null. A symlink is sufficient to store that amount of information.
-		 * No need to bother with a keyfile. */
+         * link to /dev/null. A symlink is sufficient to store that amount of information.
+         * No need to bother with a keyfile. */
         if (symlink(loaded_path, full_filename_tmp) != 0) {
             errsv                                            = -NM_ERRNO_NATIVE(errno);
             full_filename_tmp[strlen(full_filename_tmp) - 1] = '\0';
diff --git a/src/settings/plugins/keyfile/nms-keyfile-writer.c b/src/settings/plugins/keyfile/nms-keyfile-writer.c
index dc52f1a06d..1e3b0b7673 100644
--- a/src/settings/plugins/keyfile/nms-keyfile-writer.c
+++ b/src/settings/plugins/keyfile/nms-keyfile-writer.c
@@ -50,15 +50,15 @@ cert_writer(NMConnection *                    connection,
             const char *p = path + strlen(info->keyfile_dir);
 
             /* If the path is rooted in the keyfile directory, just use a
-			 * relative path instead of an absolute one.
-			 */
+             * relative path instead of an absolute one.
+             */
             if (*p == '/') {
                 while (*p == '/')
                     p++;
                 if (p[0]) {
                     /* If @p looks like an integer list, the following detection will fail too and
-					 * we will file:// qualify the path below. We thus avoid writing a path string
-					 * that would be interpreted as legacy binary format by reader. */
+                     * we will file:// qualify the path below. We thus avoid writing a path string
+                     * that would be interpreted as legacy binary format by reader. */
                     tmp = nm_keyfile_detect_unqualified_path_scheme(info->keyfile_dir,
                                                                     p,
                                                                     -1,
@@ -73,7 +73,7 @@ cert_writer(NMConnection *                    connection,
         }
         if (!accepted_path) {
             /* What we are about to write, must also be understood by the reader.
-			 * Otherwise, add a file:// prefix */
+             * Otherwise, add a file:// prefix */
             tmp =
                 nm_keyfile_detect_unqualified_path_scheme(info->keyfile_dir, path, -1, FALSE, NULL);
             if (tmp) {
@@ -115,8 +115,8 @@ cert_writer(NMConnection *                    connection,
         }
 
         /* Write the raw data out to the standard file so that we can use paths
-		 * from now on instead of pushing around the certificate data.
-		 */
+         * from now on instead of pushing around the certificate data.
+         */
         new_path = g_strdup_printf("%s/%s-%s.%s",
                                    info->keyfile_dir,
                                    nm_connection_get_uuid(connection),
@@ -124,9 +124,9 @@ cert_writer(NMConnection *                    connection,
                                    ext);
 
         /* FIXME(keyfile-parse-in-memory): writer must not access/write to the file system before
-		 * being sure that the entire profile can be written and all circumstances are good to
-		 * proceed. That means, while writing we must only collect the blogs in-memory, and write
-		 * them all in the end together (or not at all). */
+         * being sure that the entire profile can be written and all circumstances are good to
+         * proceed. That means, while writing we must only collect the blogs in-memory, and write
+         * them all in the end together (or not at all). */
         success = nm_utils_file_set_contents(new_path,
                                              (const char *) blob_data,
                                              blob_len,
@@ -135,7 +135,7 @@ cert_writer(NMConnection *                    connection,
                                              &local);
         if (success) {
             /* Write the path value to the keyfile.
-			 * We know, that basename(new_path) starts with a UUID, hence no conflict with "data:;base64,"  */
+             * We know, that basename(new_path) starts with a UUID, hence no conflict with "data:;base64,"  */
             nm_keyfile_plugin_kf_set_string(file,
                                             setting_name,
                                             vtable->setting_key,
@@ -152,11 +152,11 @@ cert_writer(NMConnection *                    connection,
         g_free(new_path);
     } else {
         /* scheme_func() returns UNKNOWN in all other cases. The only valid case
-		 * where a scheme is allowed to be UNKNOWN, is unsetting the value. In this
-		 * case, we don't expect the writer to be called, because the default value
-		 * will not be serialized.
-		 * The only other reason for the scheme to be UNKNOWN is an invalid cert.
-		 * But our connection verifies, so that cannot happen either. */
+         * where a scheme is allowed to be UNKNOWN, is unsetting the value. In this
+         * case, we don't expect the writer to be called, because the default value
+         * will not be serialized.
+         * The only other reason for the scheme to be UNKNOWN is an invalid cert.
+         * But our connection verifies, so that cannot happen either. */
         g_return_if_reached();
     }
 }
@@ -395,8 +395,8 @@ _internal_write_connection(NMConnection *                  connection,
     }
 
     /* In case of updating the connection and changing the file path,
-	 * we need to remove the old one, not to end up with two connections.
-	 */
+     * we need to remove the old one, not to end up with two connections.
+     */
     if (existing_path && !existing_path_read_only && !nm_streq(path, existing_path))
         unlink(existing_path);
 
diff --git a/src/settings/plugins/keyfile/tests/test-keyfile-settings.c b/src/settings/plugins/keyfile/tests/test-keyfile-settings.c
index e225c7ff20..011f166565 100644
--- a/src/settings/plugins/keyfile/tests/test-keyfile-settings.c
+++ b/src/settings/plugins/keyfile/tests/test-keyfile-settings.c
@@ -1656,9 +1656,9 @@ test_write_wired_8021x_tls_connection_path(void)
     keyfile = keyfile_load_from_file(testfile);
 
     /* Depending on whether this test is being run from 'make check' or
-	 * 'make distcheck' we might be using relative paths (check) or
-	 * absolute ones (distcheck).
-	 */
+     * 'make distcheck' we might be using relative paths (check) or
+     * absolute ones (distcheck).
+     */
     tmp2 = g_path_get_dirname(testfile);
     if (g_strcmp0(tmp2, TEST_KEYFILES_DIR) == 0)
         relative = TRUE;
diff --git a/src/supplicant/nm-supplicant-config.c b/src/supplicant/nm-supplicant-config.c
index 39c1130460..b17f0e7b83 100644
--- a/src/supplicant/nm-supplicant-config.c
+++ b/src/supplicant/nm-supplicant-config.c
@@ -533,8 +533,8 @@ nm_supplicant_config_add_setting_wireless(NMSupplicantConfig *self,
     }
 
     /* Except for Ad-Hoc, Hotspot and Mesh, request that the driver probe for the
-	 * specific SSID we want to associate with.
-	 */
+     * specific SSID we want to associate with.
+     */
     if (!(is_adhoc || is_ap || is_mesh)) {
         if (!nm_supplicant_config_add_option(self, "scan_ssid", "1", -1, NULL, error))
             return FALSE;
@@ -590,33 +590,33 @@ nm_supplicant_config_add_bgscan(NMSupplicantConfig *self, NMConnection *connecti
     g_assert(s_wifi);
 
     /* Don't scan when a shared connection (either AP or Ad-Hoc) is active;
-	 * it will disrupt connected clients.
-	 */
+     * it will disrupt connected clients.
+     */
     if (NM_IN_STRSET(nm_setting_wireless_get_mode(s_wifi),
                      NM_SETTING_WIRELESS_MODE_AP,
                      NM_SETTING_WIRELESS_MODE_ADHOC))
         return TRUE;
 
     /* Don't scan when the connection is locked to a specific AP, since
-	 * intra-ESS roaming (which requires periodic scanning) isn't being
-	 * used due to the specific AP lock. (bgo #513820)
-	 */
+     * intra-ESS roaming (which requires periodic scanning) isn't being
+     * used due to the specific AP lock. (bgo #513820)
+     */
     if (nm_setting_wireless_get_bssid(s_wifi))
         return TRUE;
 
     /* Default to a very long bgscan interval when signal is OK on the assumption
-	 * that either (a) there aren't multiple APs and we don't need roaming, or
-	 * (b) since EAP/802.1x isn't used and thus there are fewer steps to fail
-	 * during a roam, we can wait longer before scanning for roam candidates.
-	 */
+     * that either (a) there aren't multiple APs and we don't need roaming, or
+     * (b) since EAP/802.1x isn't used and thus there are fewer steps to fail
+     * during a roam, we can wait longer before scanning for roam candidates.
+     */
     bgscan = "simple:30:-70:86400";
 
     /* If using WPA Enterprise, Dynamic WEP or we have seen more than one AP use
-	 * a shorter bgscan interval on the assumption that this is a multi-AP ESS
-	 * in which we want more reliable roaming between APs. Thus trigger scans
-	 * when the signal is still somewhat OK so we have an up-to-date roam
-	 * candidate list when the signal gets bad.
-	 */
+     * a shorter bgscan interval on the assumption that this is a multi-AP ESS
+     * in which we want more reliable roaming between APs. Thus trigger scans
+     * when the signal is still somewhat OK so we have an up-to-date roam
+     * candidate list when the signal gets bad.
+     */
     if (nm_setting_wireless_get_num_seen_bssids(s_wifi) > 1
         || ((s_wsec = nm_connection_get_setting_wireless_security(connection))
             && NM_IN_STRSET(nm_setting_wireless_security_get_key_mgmt(s_wsec),
@@ -878,10 +878,10 @@ nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig *
 
         if (psk_len >= 8 && psk_len <= 63) {
             /* Use NM_SUPPL_OPT_TYPE_STRING here so that it gets pushed to the
-			 * supplicant as a string, and therefore gets quoted,
-			 * and therefore the supplicant will interpret it as a
-			 * passphrase and not a hex key.
-			 */
+             * supplicant as a string, and therefore gets quoted,
+             * and therefore the supplicant will interpret it as a
+             * passphrase and not a hex key.
+             */
             if (!nm_supplicant_config_add_option_with_type(self,
                                                            "psk",
                                                            psk,
@@ -892,8 +892,8 @@ nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig *
                 return FALSE;
         } else if (nm_streq(key_mgmt, "sae")) {
             /* If the SAE password doesn't comply with WPA-PSK limitation,
-			 * we need to call it "sae_password" instead of "psk".
-			 */
+             * we need to call it "sae_password" instead of "psk".
+             */
             if (!nm_supplicant_config_add_option_with_type(self,
                                                            "sae_password",
                                                            psk,
@@ -1070,9 +1070,9 @@ nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig *
 
         if (nm_streq(key_mgmt, "wpa-eap")) {
             /* When using WPA-Enterprise, we want to use Proactive Key Caching (also
-			 * called Opportunistic Key Caching) to avoid full EAP exchanges when
-			 * roaming between access points in the same mobility group.
-			 */
+             * called Opportunistic Key Caching) to avoid full EAP exchanges when
+             * roaming between access points in the same mobility group.
+             */
             if (!nm_supplicant_config_add_option(self,
                                                  "proactive_key_caching",
                                                  "1",
@@ -1104,8 +1104,8 @@ add_pkcs11_uri_with_pin(NMSupplicantConfig *       self,
         return TRUE;
 
     /* We ignore the attributes -- RFC 7512 suggests that some of them
-	 * might be unsafe and we want to be on the safe side. Also, we're
-	 * installing our attributes, so this makes things a bit easier for us. */
+     * might be unsafe and we want to be on the safe side. Also, we're
+     * installing our attributes, so this makes things a bit easier for us. */
     split = g_strsplit(uri, "&", 2);
     if (split[1])
         nm_log_info(LOGD_SUPPLICANT, "URI attributes ignored");
@@ -1117,8 +1117,8 @@ add_pkcs11_uri_with_pin(NMSupplicantConfig *       self,
         g_free(escaped);
     } else if (!(pin_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)) {
         /* Include an empty PIN to indicate the login is still needed.
-		 * Probably a token that has a PIN path and the actual PIN will
-		 * be entered using a protected path. */
+         * Probably a token that has a PIN path and the actual PIN will
+         * be entered using a protected path. */
         pin_qattr = g_strdup("pin-value=");
     }
 
@@ -1191,7 +1191,7 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
     }
 
     /* Build the "eap" option string while we check for EAP methods needing
-	 * special handling: PEAP + GTC, FAST, external */
+     * special handling: PEAP + GTC, FAST, external */
     eap_str = g_string_new(NULL);
     num_eap = nm_setting_802_1x_get_num_eap_methods(setting);
     for (i = 0; i < num_eap; i++) {
@@ -1225,7 +1225,7 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
         return FALSE;
 
     /* Adjust the fragment size according to MTU, but do not set it higher than 1280-14
-	 * for better compatibility */
+     * for better compatibility */
     hdrs = 14; /* EAPOL + EAP-TLS */
     frag = 1280 - hdrs;
     if (mtu > hdrs)
@@ -1308,8 +1308,8 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
             return FALSE;
     } else {
         /* PAC file is not specified.
-		 * If provisioning is allowed, use an blob format.
-		 */
+         * If provisioning is allowed, use an blob format.
+         */
         if (fast_provisoning_allowed) {
             gs_free char *blob_name = NULL;
 
@@ -1330,7 +1330,7 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
     }
 
     /* If user wants to use system CA certs, either populate ca_path (if the path
-	 * is a directory) or ca_cert (the path is a file name) */
+     * is a directory) or ca_cert (the path is a file name) */
     if (nm_setting_802_1x_get_system_ca_certs(setting)) {
         if (g_file_test(SYSTEM_CA_PATH, G_FILE_TEST_IS_DIR))
             ca_path_override = SYSTEM_CA_PATH;
@@ -1517,9 +1517,9 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
         if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH
             || format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
             /* Only add the private key password for PKCS#12 blobs and
-			 * all path schemes, since in both of these cases the private key
-			 * isn't decrypted at all.
-			 */
+             * all path schemes, since in both of these cases the private key
+             * isn't decrypted at all.
+             */
             value = nm_setting_802_1x_get_private_key_password(setting);
             if (!add_string_val(self, value, "private_key_passwd", FALSE, "<hidden>", error))
                 return FALSE;
@@ -1527,8 +1527,8 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
 
         if (format != NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
             /* Only add the client cert if the private key is not PKCS#12, as
-			 * wpa_supplicant configuration directs us to do.
-			 */
+             * wpa_supplicant configuration directs us to do.
+             */
             switch (nm_setting_802_1x_get_client_cert_scheme(setting)) {
             case NM_SETTING_802_1X_CK_SCHEME_BLOB:
                 bytes = nm_setting_802_1x_get_client_cert_blob(setting);
@@ -1606,9 +1606,9 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
         if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH
             || format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
             /* Only add the private key password for PKCS#12 blobs and
-			 * all path schemes, since in both of these cases the private key
-			 * isn't decrypted at all.
-			 */
+             * all path schemes, since in both of these cases the private key
+             * isn't decrypted at all.
+             */
             value = nm_setting_802_1x_get_phase2_private_key_password(setting);
             if (!add_string_val(self, value, "private_key2_passwd", FALSE, "<hidden>", error))
                 return FALSE;
@@ -1616,8 +1616,8 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
 
         if (format != NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
             /* Only add the client cert if the private key is not PKCS#12, as
-			 * wpa_supplicant configuration directs us to do.
-			 */
+             * wpa_supplicant configuration directs us to do.
+             */
             switch (nm_setting_802_1x_get_phase2_client_cert_scheme(setting)) {
             case NM_SETTING_802_1X_CK_SCHEME_BLOB:
                 bytes = nm_setting_802_1x_get_phase2_client_cert_blob(setting);
diff --git a/src/supplicant/nm-supplicant-interface.c b/src/supplicant/nm-supplicant-interface.c
index a6a19721fb..05826cb898 100644
--- a/src/supplicant/nm-supplicant-interface.c
+++ b/src/supplicant/nm-supplicant-interface.c
@@ -466,8 +466,8 @@ _notify_maybe_scanning(NMSupplicantInterface *self)
 
     if (!scanning && !c_list_is_empty(&priv->bss_initializing_lst_head)) {
         /* we would change state to indicate we no longer scan. However,
-		 * we still have BSS instances to be initialized. Delay the
-		 * state change further. */
+         * we still have BSS instances to be initialized. Delay the
+         * state change further. */
         return;
     }
 
@@ -1177,8 +1177,8 @@ parse_capabilities(NMSupplicantInterface *self, GVariant *capabilities)
 
     if (g_variant_lookup(capabilities, "Modes", "^a&s", &array)) {
         /* Setting p2p_capable might toggle _prop_p2p_available_get(). However,
-		 * we don't need to check for a property changed notification, because
-		 * the caller did g_object_freeze_notify() and will perform the check. */
+         * we don't need to check for a property changed notification, because
+         * the caller did g_object_freeze_notify() and will perform the check. */
         priv->p2p_capable_property = g_strv_contains(array, "p2p");
         g_free(array);
     }
@@ -1201,10 +1201,10 @@ parse_capabilities(NMSupplicantInterface *self, GVariant *capabilities)
         const gint32 WPAS_MAX_SCAN_SSIDS = 16;
 
         /* Even if supplicant claims that 20 SSIDs are supported, the Scan request
-		 * still only accepts WPAS_MAX_SCAN_SSIDS SSIDs. Otherwise, the D-Bus
-		 * request will be rejected with "fi.w1.wpa_supplicant1.InvalidArgs"
-		 * Body: ('Did not receive correct message arguments.', 'Too many ssids specified. Specify at most four')
-		 * */
+         * still only accepts WPAS_MAX_SCAN_SSIDS SSIDs. Otherwise, the D-Bus
+         * request will be rejected with "fi.w1.wpa_supplicant1.InvalidArgs"
+         * Body: ('Did not receive correct message arguments.', 'Too many ssids specified. Specify at most four')
+         * */
         priv->max_scan_ssids = CLAMP(max_scan_ssids, 0, WPAS_MAX_SCAN_SSIDS);
     }
 
@@ -1536,7 +1536,7 @@ _wps_handle_set_pc_cb(GVariant *res, GError *error, gpointer user_data)
         g_variant_builder_add(&start_args, "{sv}", "Pin", g_variant_new_string(wps_data->pin));
     if (wps_data->bssid) {
         /* The BSSID is in fact not mandatory. If it is not set the supplicant would
-		 * enroll with any BSS in range. */
+         * enroll with any BSS in range. */
         if (!nm_utils_hwaddr_aton(wps_data->bssid, bssid_buf, sizeof(bssid_buf)))
             nm_assert_not_reached();
         g_variant_builder_add(
@@ -1787,11 +1787,11 @@ _properties_changed_main(NMSupplicantInterface *self, GVariant *properties)
 
     if (nm_g_variant_lookup(properties, "DisconnectReason", "i", &v_i32)) {
         /* Disconnect reason is currently only given for deauthentication events,
-		 * not disassociation; currently they are IEEE 802.11 "reason codes",
-		 * defined by (IEEE 802.11-2007, 7.3.1.7, Table 7-22).  Any locally caused
-		 * deauthentication will be negative, while authentications caused by the
-		 * AP will be positive.
-		 */
+         * not disassociation; currently they are IEEE 802.11 "reason codes",
+         * defined by (IEEE 802.11-2007, 7.3.1.7, Table 7-22).  Any locally caused
+         * deauthentication will be negative, while authentications caused by the
+         * AP will be positive.
+         */
         priv->disconnect_reason = v_i32;
     }
 
@@ -1810,10 +1810,10 @@ _properties_changed_main(NMSupplicantInterface *self, GVariant *properties)
             priv->supp_state = state;
             if (priv->state > NM_SUPPLICANT_INTERFACE_STATE_STARTING) {
                 /* Only transition to actual wpa_supplicant interface states (ie,
-				 * anything > STARTING) after the NMSupplicantInterface has had a
-				 * chance to initialize, which is signalled by entering the STARTING
-				 * state.
-				 */
+                 * anything > STARTING) after the NMSupplicantInterface has had a
+                 * chance to initialize, which is signalled by entering the STARTING
+                 * state.
+                 */
                 do_set_state = TRUE;
             }
         }
@@ -2126,10 +2126,10 @@ assoc_add_network_cb(GObject *source, GAsyncResult *result, gpointer user_data)
             const char *net_path;
 
             /* the assoc-request was already cancelled, but the AddNetwork request succeeded.
-			 * Cleanup the created network.
-			 *
-			 * This cleanup action does not work when NetworkManager is about to exit
-			 * and leaves the mainloop. During program shutdown, we may orphan networks. */
+             * Cleanup the created network.
+             *
+             * This cleanup action does not work when NetworkManager is about to exit
+             * and leaves the mainloop. During program shutdown, we may orphan networks. */
             g_variant_get(res, "(&o)", &net_path);
             g_dbus_connection_call(G_DBUS_CONNECTION(source),
                                    name_owner->str,
@@ -2197,11 +2197,11 @@ add_network(NMSupplicantInterface *self)
     priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE(self);
 
     /* the association does not keep @self alive. We want to be able to remove
-	 * the network again, even if @self is already gone. Hence, track the data
-	 * separately.
-	 *
-	 * For that we also have a shutdown_wait_obj so that on exit we still wait
-	 * to handle the response. */
+     * the network again, even if @self is already gone. Hence, track the data
+     * separately.
+     *
+     * For that we also have a shutdown_wait_obj so that on exit we still wait
+     * to handle the response. */
     add_network_data  = g_slice_new(AddNetworkData);
     *add_network_data = (AddNetworkData){
         .assoc_data        = priv->assoc_data,
@@ -2345,8 +2345,8 @@ nm_supplicant_interface_assoc(NMSupplicantInterface *      self,
     if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FAST) == NM_TERNARY_FALSE
         && nm_supplicant_config_fast_required(cfg)) {
         /* Make sure the supplicant supports EAP-FAST before trying to send
-		 * it an EAP-FAST configuration.
-		 */
+         * it an EAP-FAST configuration.
+         */
         assoc_data->fail_on_idle_id = g_idle_add(assoc_fail_on_idle_cb, self);
         return;
     }
@@ -2375,10 +2375,10 @@ nm_supplicant_interface_assoc(NMSupplicantInterface *      self,
     } else {
         assoc_data->calls_left++;
         /* It would be smarter to change the property only when necessary.
-		 * However, wpa_supplicant doesn't send the PropertiesChanged
-		 * signal for ApIsolate, and so to know the current value we would
-		 * need first a Get call. It seems simpler to just set the value
-		 * we want. */
+         * However, wpa_supplicant doesn't send the PropertiesChanged
+         * signal for ApIsolate, and so to know the current value we would
+         * need first a Get call. It seems simpler to just set the value
+         * we want. */
         nm_dbus_connection_call_set(priv->dbus_connection,
                                     priv->name_owner->str,
                                     priv->object_path->str,
@@ -2429,8 +2429,8 @@ scan_request_cb(GObject *source, GAsyncResult *result, gpointer user_data)
     }
 
     /* we don't propagate the error/success. That is, because either answer is not
-	 * reliable. What is important to us is whether the request completed, and
-	 * the current nm_supplicant_interface_get_scanning() state. */
+     * reliable. What is important to us is whether the request completed, and
+     * the current nm_supplicant_interface_get_scanning() state. */
     if (cancelled)
         _LOGD("request-scan: request cancelled");
     else {
@@ -2497,8 +2497,8 @@ nm_supplicant_interface_request_scan(NMSupplicantInterface *                  se
 
     if (callback) {
         /* A callback was provided. This keeps @self alive. The caller
-		 * must provide a cancellable as the caller must never leave an asynchronous
-		 * operation pending indefinitely. */
+         * must provide a cancellable as the caller must never leave an asynchronous
+         * operation pending indefinitely. */
         nm_assert(G_IS_CANCELLABLE(cancellable));
         g_object_ref(self);
     } else {
@@ -2868,7 +2868,7 @@ _signal_handle(NMSupplicantInterface *self,
             }
 
             /* the state eventually reaches one of started, success or failure
-			 * so ignore any other intermediate (unknown) state change. */
+             * so ignore any other intermediate (unknown) state change. */
             if (auth_state != NM_SUPPLICANT_AUTH_STATE_UNKNOWN && auth_state != priv->auth_state) {
                 priv->auth_state = auth_state;
                 _notify(self, PROP_AUTH_STATE);
@@ -2943,9 +2943,9 @@ _signal_handle(NMSupplicantInterface *self,
                 g_variant_get(parameters, "(@a{sv})", &args);
 
                 /* TODO: Group finished is called on the management interface!
-				 *       This means the signal consumer will currently need to assume which
-				 *       interface is finishing or it needs to match the object paths.
-				 */
+                 *       This means the signal consumer will currently need to assume which
+                 *       interface is finishing or it needs to match the object paths.
+                 */
                 if (!g_variant_lookup(args, "interface_object", "&o", &iface_path))
                     return;
 
@@ -3201,10 +3201,10 @@ constructed(GObject *object)
 
     if (_get_capability(priv, NM_SUPPL_CAP_TYPE_AP) == NM_TERNARY_DEFAULT) {
         /* If the global supplicant capabilities property is not present, we can
-		 * fall back to checking whether the ProbeRequest method is supported.  If
-		 * neither of these works we have no way of determining if AP mode is
-		 * supported or not.  hostap 1.0 and earlier don't support either of these.
-		 */
+         * fall back to checking whether the ProbeRequest method is supported.  If
+         * neither of these works we have no way of determining if AP mode is
+         * supported or not.  hostap 1.0 and earlier don't support either of these.
+         */
         priv->starting_pending_count++;
         _dbus_connection_call(self,
                               DBUS_INTERFACE_INTROSPECTABLE,
@@ -3283,9 +3283,9 @@ dispose(GObject *object)
 
     if (priv->wps_data) {
         /* we shut down, but an asynchronous Cancel request is pending.
-		 * We don't want to cancel it, so mark wps-data that @self is gone.
-		 * This way, _wps_handle_cancel_cb() knows it must no longer touch
-		 * @self */
+         * We don't want to cancel it, so mark wps-data that @self is gone.
+         * This way, _wps_handle_cancel_cb() knows it must no longer touch
+         * @self */
         priv->wps_data->self = NULL;
         priv->wps_data       = NULL;
     }
diff --git a/src/supplicant/nm-supplicant-manager.c b/src/supplicant/nm-supplicant-manager.c
index 9f500f5f41..757c08f41f 100644
--- a/src/supplicant/nm-supplicant-manager.c
+++ b/src/supplicant/nm-supplicant-manager.c
@@ -295,8 +295,8 @@ _poke_name_owner_timeout_cb(gpointer user_data)
 
     if (priv->available == NM_TERNARY_DEFAULT) {
         /* the available flag usually only changes together with the name-owner.
-		 * However, if we tries to poke the service but failed to start it (with
-		 * timeout), was also set it as (hard) not available. */
+         * However, if we tries to poke the service but failed to start it (with
+         * timeout), was also set it as (hard) not available. */
         priv->available = NM_TERNARY_FALSE;
         nm_clear_g_source(&priv->available_reset_id);
         priv->available_reset_id = g_timeout_add_seconds(60, _available_reset_cb, self);
@@ -311,7 +311,7 @@ _poke_name_owner_timeout_cb(gpointer user_data)
 
     if (available_changed) {
         /* We delay the emitting of the notification after aborting all
-		 * create-iface handles. */
+         * create-iface handles. */
         g_signal_emit(self, signals[AVAILABLE_CHANGED], 0);
     }
 
@@ -334,7 +334,7 @@ _poke_name_owner_cb(GObject *source, GAsyncResult *result, gpointer user_data)
         _LOGT("poke service \"%s\" succeeded", NM_WPAS_DBUS_SERVICE);
 
     /* in both cases, we react the same: we wait for the name owner to appear
-	 * or hit the timeout. */
+     * or hit the timeout. */
 }
 
 static void
@@ -387,8 +387,8 @@ _create_iface_complete(NMSupplMgrCreateIfaceHandle *handle,
 
     if (handle->shutdown_handle) {
         /* we have a pending CreateInterface request. We keep the handle
-		 * instance alive. This is to remove the device again, once the
-		 * request completes. */
+         * instance alive. This is to remove the device again, once the
+         * request completes. */
         return;
     }
 
@@ -467,7 +467,7 @@ _create_iface_dbus_call_get_interface_cb(GObject *source, GAsyncResult *result,
             && _nm_dbus_error_has_name(error, NM_WPAS_ERROR_UNKNOWN_IFACE)
             && nm_platform_if_indextoname(NM_PLATFORM_GET, handle->ifindex, ifname)) {
             /* Before, supplicant told us the interface existed. Was there a race?
-			 * Try again. */
+             * Try again. */
             _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT
                   "]: D-Bus call failed to get interface. Try to create it again (ifname \"%s\")",
                   NM_HASH_OBFUSCATE_PTR(handle),
@@ -652,20 +652,20 @@ _create_iface_dbus_start(NMSupplicantManager *self, NMSupplMgrCreateIfaceHandle
     }
 
     /* Our handle keeps @self alive. That means, when NetworkManager shall shut
-	 * down, it's the responsibility of the callers to cancel the handles,
-	 * to initiate coordinated shutdown.
-	 *
-	 * However, we now issue a CreateInterface call. Even if the handle gets cancelled
-	 * (because of shutdown, or because the caller is no longer interested in the
-	 * result), we don't want to cancel this request. Instead, we want to get
-	 * the interface path and remove it right away.
-	 *
-	 * That means, the D-Bus call cannot be cancelled (because we always care about
-	 * the result). Only the @handle can be cancelled, but parts of the handle will
-	 * stick around to complete the task.
-	 *
-	 * See also handle->shutdown_handle.
-	 */
+     * down, it's the responsibility of the callers to cancel the handles,
+     * to initiate coordinated shutdown.
+     *
+     * However, we now issue a CreateInterface call. Even if the handle gets cancelled
+     * (because of shutdown, or because the caller is no longer interested in the
+     * result), we don't want to cancel this request. Instead, we want to get
+     * the interface path and remove it right away.
+     *
+     * That means, the D-Bus call cannot be cancelled (because we always care about
+     * the result). Only the @handle can be cancelled, but parts of the handle will
+     * stick around to complete the task.
+     *
+     * See also handle->shutdown_handle.
+     */
     handle->name_owner  = nm_ref_string_ref(priv->name_owner);
     handle->cancellable = g_cancellable_new();
     _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: creating interface (ifname \"%s\")...",
@@ -778,9 +778,9 @@ _create_iface_proceed_all(NMSupplicantManager *self, GError *error)
         CList alt_list;
 
         /* we move the handles we want to proceed to a alternative list.
-		 * That is, because we invoke callbacks to the caller, who might
-		 * create another request right away. We don't want to proceed
-		 * that one. */
+         * That is, because we invoke callbacks to the caller, who might
+         * create another request right away. We don't want to proceed
+         * that one. */
         c_list_init(&alt_list);
         c_list_splice(&alt_list, &priv->create_iface_lst_head);
 
@@ -796,7 +796,7 @@ _create_iface_proceed_all(NMSupplicantManager *self, GError *error)
     }
 
     /* start all the handles. This does not invoke callbacks, so the list of handles
-	 * cannot be modified while we iterate it. */
+     * cannot be modified while we iterate it. */
     c_list_for_each_entry (handle, &priv->create_iface_lst_head, create_iface_lst) {
         _LOGT("create-iface[" NM_HASH_OBFUSCATE_PTR_FMT "]: create interface on %s...",
               NM_HASH_OBFUSCATE_PTR(handle),
@@ -897,14 +897,14 @@ _dbus_get_capabilities_cb(GVariant *res, GError *error, gpointer user_data)
     g_clear_object(&priv->get_capabilities_cancellable);
 
     /* The supplicant only advertises global capabilities if the following
-	 * commit has been applied:
-	 *
-	 * commit 1634ac0654eba8d458640a115efc0a6cde3bac4d
-	 * Author: Dan Williams <dcbw@redhat.com>
-	 * Date:   Sat Sep 29 19:06:30 2012 +0300
-	 *
-	 * dbus: Add global capabilities property
-	 */
+     * commit has been applied:
+     *
+     * commit 1634ac0654eba8d458640a115efc0a6cde3bac4d
+     * Author: Dan Williams <dcbw@redhat.com>
+     * Date:   Sat Sep 29 19:06:30 2012 +0300
+     *
+     * dbus: Add global capabilities property
+     */
     _caps_set(priv, NM_SUPPL_CAP_TYPE_AP, NM_TERNARY_DEFAULT);
     _caps_set(priv, NM_SUPPL_CAP_TYPE_PMF, NM_TERNARY_DEFAULT);
     _caps_set(priv, NM_SUPPL_CAP_TYPE_FILS, NM_TERNARY_DEFAULT);
@@ -1159,16 +1159,16 @@ name_owner_changed(NMSupplicantManager *self, const char *name_owner, gboolean f
     }
 
     /* if supplicant is running (has a name owner), we may use it.
-	 * If this is the first time, and supplicant is not running, we
-	 * may also use it (and assume that we probably could D-Bus activate
-	 * it).
-	 *
-	 * Otherwise, somebody else stopped supplicant. It's no longer useable to
-	 * us and we block auto starting it. The user has to start the service...
-	 *
-	 * Actually, below we reset the hard block after a short timeout. This
-	 * causes the caller to notify that supplicant may now by around and
-	 * retry to D-Bus activate it. */
+     * If this is the first time, and supplicant is not running, we
+     * may also use it (and assume that we probably could D-Bus activate
+     * it).
+     *
+     * Otherwise, somebody else stopped supplicant. It's no longer useable to
+     * us and we block auto starting it. The user has to start the service...
+     *
+     * Actually, below we reset the hard block after a short timeout. This
+     * causes the caller to notify that supplicant may now by around and
+     * retry to D-Bus activate it. */
     if (priv->name_owner)
         available = NM_TERNARY_TRUE;
     else if (first_time)
@@ -1194,7 +1194,7 @@ name_owner_changed(NMSupplicantManager *self, const char *name_owner, gboolean f
     if (!priv->name_owner) {
         if (priv->poke_name_owner_timeout_id) {
             /* we are still poking for the service to start. Don't cancel
-			 * the pending create requests just yet. */
+             * the pending create requests just yet. */
         } else {
             gs_free_error GError *local_error = NULL;
 
@@ -1204,12 +1204,12 @@ name_owner_changed(NMSupplicantManager *self, const char *name_owner, gboolean f
         }
     } else {
         /* We got a name-owner, but we don't do anything. Instead let
-		 * _dbus_get_capabilities_cb() complete and kick of the create-iface
-		 * handles.
-		 *
-		 * Note that before the first name-owner change, all create-iface
-		 * requests fail right away. So we don't have to handle them here
-		 * (by starting to poke the service). */
+         * _dbus_get_capabilities_cb() complete and kick of the create-iface
+         * handles.
+         *
+         * Note that before the first name-owner change, all create-iface
+         * requests fail right away. So we don't have to handle them here
+         * (by starting to poke the service). */
     }
 
     if (available_changed)
@@ -1244,7 +1244,7 @@ name_owner_changed_cb(GDBusConnection *connection,
 
     if (name_owner && priv->name_owner) {
         /* odd, we directly switch from one name owner to the next. Can't allow that.
-		 * First clear the name owner before resetting. */
+         * First clear the name owner before resetting. */
         name_owner_changed(self, NULL, FALSE);
     }
     name_owner_changed(user_data, name_owner, FALSE);
diff --git a/src/tests/config/test-config.c b/src/tests/config/test-config.c
index b3cbffaa56..f63b286bb8 100644
--- a/src/tests/config/test-config.c
+++ b/src/tests/config/test-config.c
@@ -1218,9 +1218,9 @@ test_config_signal(void)
     nm_config_reload(config, expected, FALSE);
 
     /* test with subscribing two signals...
-	 *
-	 * This test exposes glib bug https://bugzilla.redhat.com/show_bug.cgi?id=1260577
-	 * for which we however have a workaround in 'nm-config.c' */
+     *
+     * This test exposes glib bug https://bugzilla.redhat.com/show_bug.cgi?id=1260577
+     * for which we however have a workaround in 'nm-config.c' */
     g_signal_connect(G_OBJECT(config),
                      NM_CONFIG_SIGNAL_CONFIG_CHANGED,
                      G_CALLBACK(_test_signal_config_changed_cb2),
@@ -1389,9 +1389,9 @@ main(int argc, char **argv)
     g_test_add_func("/config/state-file", test_config_state_file);
 
     /* This one has to come last, because it leaves its values in
-	 * nm-config.c's global variables, and there's no way to reset
-	 * those to NULL.
-	 */
+     * nm-config.c's global variables, and there's no way to reset
+     * those to NULL.
+     */
     g_test_add_func("/config/override", test_config_override);
 
     return g_test_run();
diff --git a/src/tests/test-core-with-expect.c b/src/tests/test-core-with-expect.c
index 390c38fff7..019e3207ee 100644
--- a/src/tests/test-core-with-expect.c
+++ b/src/tests/test-core-with-expect.c
@@ -332,7 +332,7 @@ do_test_nm_utils_kill_child(void)
     test_nm_utils_kill_child_sync_do("test-s-3-1", pid3s, SIGTERM, 3000, TRUE, &expected_exit_47);
 
     /* pid3s should not be a valid process, hence the call should fail. Note, that there
-	 * is a race here. */
+     * is a race here. */
     NMTST_EXPECT_NM_ERROR(
         "kill child process 'test-s-3-2' (*): failed due to unexpected return value -1 by waitpid "
         "(No child processes, 10) after sending no signal (0)");
@@ -395,7 +395,7 @@ do_test_nm_utils_kill_child(void)
     test_nm_utils_kill_child_async_do("test-a-3-1", pid3a, SIGTERM, 3000, TRUE, &expected_exit_47);
 
     /* pid3a should not be a valid process, hence the call should fail. Note, that there
-	 * is a race here. */
+     * is a race here. */
     NMTST_EXPECT_NM_ERROR(
         "kill child process 'test-a-3-2' (*): failed due to unexpected return value -1 by waitpid "
         "(No child processes, 10) after sending no signal (0)");
@@ -425,12 +425,12 @@ test_nm_utils_kill_child(void)
     pid_t child_pid;
 
     /* the tests spawns several processes, we want to clean them up
-	 * by sending a SIGKILL to the process group.
-	 *
-	 * The current process might be a session leader, which prevents it from
-	 * creating a new process group. Hence, first fork and let the child
-	 * create a new process group, run the tests, and kill all pending
-	 * processes. */
+     * by sending a SIGKILL to the process group.
+     *
+     * The current process might be a session leader, which prevents it from
+     * creating a new process group. Hence, first fork and let the child
+     * create a new process group, run the tests, and kill all pending
+     * processes. */
     child_pid = fork();
     g_assert(child_pid >= 0);
 
diff --git a/src/tests/test-core.c b/src/tests/test-core.c
index b75bc80d74..6446ac54d5 100644
--- a/src/tests/test-core.c
+++ b/src/tests/test-core.c
@@ -226,8 +226,8 @@ test_nm_utils_log_connection_diff(void)
     NMConnection *connection2;
 
     /* if logging is disabled (the default), nm_utils_log_connection_diff() returns
-	 * early without doing anything. Hence, in the normal testing, this test does nothing.
-	 * It only gets interesting, when run verbosely with NMTST_DEBUG=debug ... */
+     * early without doing anything. Hence, in the normal testing, this test does nothing.
+     * It only gets interesting, when run verbosely with NMTST_DEBUG=debug ... */
 
     nm_log(LOGL_DEBUG, LOGD_CORE, NULL, NULL, "START TEST test_nm_utils_log_connection_diff...");
 
@@ -458,9 +458,9 @@ test_connection_match_ip6_method(void)
     connections = g_slist_append(connections, copy);
 
     /* Check that if the generated connection is IPv6 method=link-local, and the
-	 * candidate is both method=auto and may-faily=true, that the candidate is
-	 * matched.
-	 */
+     * candidate is both method=auto and may-faily=true, that the candidate is
+     * matched.
+     */
     s_ip6 = nm_connection_get_setting_ip6_config(orig);
     g_assert(s_ip6);
     g_object_set(G_OBJECT(s_ip6),
@@ -497,8 +497,8 @@ test_connection_match_ip6_method_ignore(void)
     connections = g_slist_append(connections, copy);
 
     /* Check that if the generated connection is IPv6 method=link-local, and the
-	 * candidate is method=ignore, that the candidate is matched.
-	 */
+     * candidate is method=ignore, that the candidate is matched.
+     */
     s_ip6 = nm_connection_get_setting_ip6_config(orig);
     g_assert(s_ip6);
     g_object_set(G_OBJECT(s_ip6),
@@ -533,8 +533,8 @@ test_connection_match_ip6_method_ignore_auto(void)
     connections = g_slist_append(connections, copy);
 
     /* Check that if the generated connection is IPv6 method=auto, and the
-	 * candidate is method=ignore, that the candidate is matched.
-	 */
+     * candidate is method=ignore, that the candidate is matched.
+     */
     s_ip6 = nm_connection_get_setting_ip6_config(orig);
     g_assert(s_ip6);
     g_object_set(G_OBJECT(s_ip6),
@@ -569,9 +569,9 @@ test_connection_match_ip4_method(void)
     connections = g_slist_append(connections, copy);
 
     /* Check that if the generated connection is IPv4 method=disabled, and the
-	 * candidate is both method=auto and may-faily=true, and the device has no
-	 * carrier that the candidate is matched.
-	 */
+     * candidate is both method=auto and may-faily=true, and the device has no
+     * carrier that the candidate is matched.
+     */
     s_ip4 = nm_connection_get_setting_ip4_config(orig);
     g_assert(s_ip4);
     g_object_set(G_OBJECT(s_ip4),
@@ -612,8 +612,8 @@ test_connection_match_interface_name(void)
     connections = g_slist_append(connections, copy);
 
     /* Check that if the generated connection has an interface name and the
-	 * candidate's interface name is NULL, that the candidate is matched.
-	 */
+     * candidate's interface name is NULL, that the candidate is matched.
+     */
     s_con = nm_connection_get_setting_connection(orig);
     g_assert(s_con);
     g_object_set(G_OBJECT(s_con), NM_SETTING_CONNECTION_INTERFACE_NAME, "em1", NULL);
@@ -695,8 +695,8 @@ test_connection_match_wired2(void)
     connections = g_slist_append(connections, copy);
 
     /* Check that if the generated connection do not have wired setting
-	 * and s390 properties in the existing connection's setting are default,
-	 * the connections match. It can happen if assuming VLAN devices. */
+     * and s390 properties in the existing connection's setting are default,
+     * the connections match. It can happen if assuming VLAN devices. */
     nm_connection_remove_setting(orig, NM_TYPE_SETTING_WIRED);
 
     matched = _match_connection(connections, orig, TRUE, 0, 0);
@@ -759,8 +759,8 @@ test_connection_no_match_ip4_addr(void)
     connections = g_slist_append(connections, copy);
 
     /* Check that if we have two differences, ipv6.method (exception we allow) and
-	 * ipv4.addresses (which is fatal), we don't match the connections.
-	 */
+     * ipv4.addresses (which is fatal), we don't match the connections.
+     */
     s_ip6 = nm_connection_get_setting_ip6_config(orig);
     g_assert(s_ip6);
     g_object_set(G_OBJECT(s_ip6),
@@ -1253,7 +1253,7 @@ _do_test_match_spec_device(const char *       spec_str,
     g_slist_free_full(specs_resplit, g_free);
 
     /* also check the matches in the random order. They must yield the same result because
-	 * matches are inclusive -- except "except:" which always wins. */
+     * matches are inclusive -- except "except:" which always wins. */
     specs_randperm = nmtst_rand_perm_gslist(NULL, g_slist_copy(specs));
 
     for (i = 0; matches && matches[i]; i++) {
@@ -1799,9 +1799,9 @@ test_nm_utils_strbuf_append(void)
                 g_snprintf(t_buf, t_len, "%s", str);
                 if (t_len > 0 && strlen(str) >= buf_len && (nmtst_get_rand_uint32() % 2)) {
                     /* the string was truncated by g_snprintf(). That means, at the last position in the
-					 * buffer is now NUL.
-					 * Replace the NUL by the actual character, and check that nm_utils_strbuf_seek_end()
-					 * does the right thing: NUL terminate the buffer and seek past the end of the buffer. */
+                     * buffer is now NUL.
+                     * Replace the NUL by the actual character, and check that nm_utils_strbuf_seek_end()
+                     * does the right thing: NUL terminate the buffer and seek past the end of the buffer. */
                     g_assert_cmpmem(t_buf, t_len - 1, str, t_len - 1);
                     g_assert(t_buf[t_len - 1] == '\0');
                     g_assert(str[t_len - 1] != '\0');
@@ -1814,15 +1814,15 @@ test_nm_utils_strbuf_append(void)
                     nm_utils_strbuf_seek_end(&t_buf, &t_len);
                     if (buf_len > 0 && strlen(str) + 1 > buf_len) {
                         /* the buffer was truncated by g_snprintf() above.
-						 *
-						 * But nm_utils_strbuf_seek_end() does not recognize that and returns
-						 * a remaining length of 1.
-						 *
-						 * Note that other nm_utils_strbuf_append*() functions recognize
-						 * truncation, and properly set the remaining length to zero.
-						 * As the assertions below check for the behavior of nm_utils_strbuf_append*(),
-						 * we assert here that nm_utils_strbuf_seek_end() behaved as expected, and then
-						 * adjust t_buf/t_len according to the "is-truncated" case. */
+                         *
+                         * But nm_utils_strbuf_seek_end() does not recognize that and returns
+                         * a remaining length of 1.
+                         *
+                         * Note that other nm_utils_strbuf_append*() functions recognize
+                         * truncation, and properly set the remaining length to zero.
+                         * As the assertions below check for the behavior of nm_utils_strbuf_append*(),
+                         * we assert here that nm_utils_strbuf_seek_end() behaved as expected, and then
+                         * adjust t_buf/t_len according to the "is-truncated" case. */
                         g_assert(t_len == 1);
                         g_assert(t_buf == &buf[buf_len - 1]);
                         g_assert(t_buf[0] == '\0');
@@ -1897,8 +1897,8 @@ static void
 test_duplicate_decl_specifier(void)
 {
     /* We're intentionally assigning values to static arrays v_const
-	 * and v_result without using it afterwards just so that valgrind
-	 * doesn't complain about the leak. */
+     * and v_result without using it afterwards just so that valgrind
+     * doesn't complain about the leak. */
     NM_PRAGMA_WARNING_DISABLE("-Wunused-but-set-variable")
 
     /* have some static variables, so that the result is certainly not optimized out. */
@@ -1907,7 +1907,7 @@ test_duplicate_decl_specifier(void)
     const int        v2          = 3;
 
     /* Test that we don't get a compiler warning about duplicate const specifier.
-	 * C99 allows that and it can easily happen in macros. */
+     * C99 allows that and it can easily happen in macros. */
 
 #define TEST_MAX(a, b)            \
     ({                            \
@@ -2267,8 +2267,8 @@ test_machine_id_read(void)
 
     logstate = nmtst_logging_disable(FALSE);
     /* If you run this test as root, without a valid /etc/machine-id,
-	 * the code will try to get the secret-key. That is a bit ugly,
-	 * but no real problem. */
+     * the code will try to get the secret-key. That is a bit ugly,
+     * but no real problem. */
     machine_id = nm_utils_machine_id_bin();
     nmtst_logging_reenable(logstate);
 
@@ -2281,12 +2281,12 @@ test_machine_id_read(void)
     /* double check with systemd's implementation... */
     if (!nm_sd_utils_id128_get_machine(&machine_id_sd)) {
         /* if systemd failed to read /etc/machine-id, the file likely
-		 * is invalid. Our machine-id is fake, and we have nothing to
-		 * compare against. */
+         * is invalid. Our machine-id is fake, and we have nothing to
+         * compare against. */
 
         /* NOTE: this test will fail, if you don't have /etc/machine-id,
-		 * but a valid "LOCALSTATEDIR/lib/dbus/machine-id" file.
-		 * Just don't do that. */
+         * but a valid "LOCALSTATEDIR/lib/dbus/machine-id" file.
+         * Just don't do that. */
         g_assert(nm_utils_machine_id_is_fake());
     } else {
         g_assert(!nm_utils_machine_id_is_fake());
@@ -2378,8 +2378,8 @@ test_nm_utils_dhcp_client_id_systemd_node_specific(gconstpointer test_data)
     gint32              u32;
 
     /* the test already hard-codes the expected values iaid_ifname and duid_id
-	 * above. Still, redo the steps to derive them from the ifname/machine-id
-	 * and double check. */
+     * above. Still, redo the steps to derive them from the ifname/machine-id
+     * and double check. */
     u64 = c_siphash_hash(HASH_KEY, (const guint8 *) d->ifname, strlen(d->ifname));
     g_assert_cmpint(u64, ==, d->ifname_hash_1);
     u32 = be32toh((u64 & 0xffffffffu) ^ (u64 >> 32));
@@ -2410,7 +2410,7 @@ test_nm_utils_dhcp_client_id_systemd_node_specific(gconstpointer test_data)
 #if __BYTE_ORDER == __BIG_ENDIAN
         if (legacy_unstable_byteorder) {
             /* on non-little endian, the legacy behavior is to have the bytes
-			 * swapped. */
+             * swapped. */
             iaid = bswap_32(iaid);
         }
 #endif
diff --git a/src/tests/test-systemd.c b/src/tests/test-systemd.c
index 8949de637d..71d9ee1d1e 100644
--- a/src/tests/test-systemd.c
+++ b/src/tests/test-systemd.c
@@ -80,7 +80,7 @@ test_dhcp_create(void)
 
     if (/* never true */ client4 == (gpointer) &r) {
         /* we don't want to call this, but ensure that the linker
-		 * includes all these symbols. */
+         * includes all these symbols. */
         sd_dhcp_client_start(client4);
     }
 
diff --git a/src/vpn/nm-vpn-connection.c b/src/vpn/nm-vpn-connection.c
index c9ff044e40..b552584a50 100644
--- a/src/vpn/nm-vpn-connection.c
+++ b/src/vpn/nm-vpn-connection.c
@@ -115,8 +115,8 @@ typedef struct {
     NMIP6Config *      ip6_config;
 
     /* These config instances are passed on to NMDevice and modified by NMDevice.
-	 * This pointer is only useful for nm_device_replace_vpn4_config() to clear the
-	 * previous configuration. Consider these instances to be owned by NMDevice. */
+     * This pointer is only useful for nm_device_replace_vpn4_config() to clear the
+     * previous configuration. Consider these instances to be owned by NMDevice. */
     NMIP4Config *last_device_ip4_config;
     NMIP6Config *last_device_ip6_config;
 
@@ -258,11 +258,11 @@ _state_to_nm_vpn_state(VpnState state)
     case STATE_DEACTIVATING:
     {
         /* Map DEACTIVATING to ACTIVATED to preserve external API behavior,
-		 * since our API has no DEACTIVATING state of its own.  Since this can
-		 * take some time, and the VPN isn't actually disconnected until it
-		 * hits the DISCONNECTED state, to clients it should still appear
-		 * connected.
-		 */
+         * since our API has no DEACTIVATING state of its own.  Since this can
+         * take some time, and the VPN isn't actually disconnected until it
+         * hits the DISCONNECTED state, to clients it should still appear
+         * connected.
+         */
         return NM_VPN_CONNECTION_STATE_ACTIVATED;
     }
     case STATE_DISCONNECTED:
@@ -305,8 +305,8 @@ _get_settings_connection(NMVpnConnection *self, gboolean allow_missing)
     NMSettingsConnection *con;
 
     /* Currently, we operate on the assumption, that the settings-connection
-	 * never changes after it is set (though initially, it might be unset).
-	 * Later we might want to change that, but then we need fixes here too. */
+     * never changes after it is set (though initially, it might be unset).
+     * Later we might want to change that, but then we need fixes here too. */
 
     con = _nm_active_connection_get_settings_connection(NM_ACTIVE_CONNECTION(self));
     if (!con && !allow_missing)
@@ -400,8 +400,8 @@ vpn_cleanup(NMVpnConnection *self, NMDevice *parent_dev)
     priv->bus_name = NULL;
 
     /* Clear out connection secrets to ensure that the settings service
-	 * gets asked for them next time the connection is activated.
-	 */
+     * gets asked for them next time the connection is activated.
+     */
     nm_active_connection_clear_secrets(NM_ACTIVE_CONNECTION(self));
 }
 
@@ -466,8 +466,8 @@ _set_vpn_state(NMVpnConnection *             self,
     priv->vpn_state = vpn_state;
 
     /* The device gets destroyed by active connection when it enters
-	 * the deactivated state, so we need to ref it for usage below.
-	 */
+     * the deactivated state, so we need to ref it for usage below.
+     */
     if (parent_dev)
         g_object_ref(parent_dev);
 
@@ -482,9 +482,9 @@ _set_vpn_state(NMVpnConnection *             self,
     dispatcher_cleanup(self);
 
     /* The connection gets destroyed by the VPN manager when it enters the
-	 * disconnected/failed state, but we need to keep it around for a bit
-	 * to send out signals and handle the dispatcher.  So ref it.
-	 */
+     * disconnected/failed state, but we need to keep it around for a bit
+     * to send out signals and handle the dispatcher.  So ref it.
+     */
     g_object_ref(self);
 
     old_external_state = _state_to_nm_vpn_state(old_vpn_state);
@@ -508,9 +508,9 @@ _set_vpn_state(NMVpnConnection *             self,
     switch (vpn_state) {
     case STATE_NEED_AUTH:
         /* Do nothing; not part of 'default' because we don't want to touch
-		 * priv->secrets_req as NEED_AUTH is re-entered during interactive
-		 * secrets.
-		 */
+         * priv->secrets_req as NEED_AUTH is re-entered during interactive
+         * secrets.
+         */
         break;
     case STATE_PRE_UP:
         if (!nm_dispatcher_call_vpn(NM_DISPATCHER_ACTION_VPN_PRE_UP,
@@ -678,8 +678,8 @@ device_state_changed(NMActiveConnection *active,
     }
 
     /* FIXME: map device DEACTIVATING state to VPN DEACTIVATING state and
-	 * block device deactivation on VPN deactivation.
-	 */
+     * block device deactivation on VPN deactivation.
+     */
 }
 
 static void
@@ -705,7 +705,7 @@ add_ip4_vpn_gateway_route(NMIP4Config *config,
     nm_assert(ifindex == nm_device_get_ip_ifindex(parent_device));
 
     /* Ask kernel how to reach @vpn_gw. We can only inject the route in
-	 * @parent_device, so whatever we resolve, it can only be on @ifindex. */
+     * @parent_device, so whatever we resolve, it can only be on @ifindex. */
     if (nm_platform_ip_route_get(platform,
                                  AF_INET,
                                  &vpn_gw,
@@ -718,10 +718,10 @@ add_ip4_vpn_gateway_route(NMIP4Config *config,
             const NMPObject *obj;
 
             /* `ip route get` always resolves the route, even if the destination is unreachable.
-			 * In which case, it pretends the destination is directly reachable.
-			 *
-			 * So, only accept direct routes if @vpn_gw is a private network
-			 * or if the parent device also has a direct default route */
+             * In which case, it pretends the destination is directly reachable.
+             *
+             * So, only accept direct routes if @vpn_gw is a private network
+             * or if the parent device also has a direct default route */
             if (nm_platform_route_table_is_main(r->table_coerced)) {
                 if (r->gateway) {
                     parent_gw     = r->gateway;
@@ -752,10 +752,10 @@ add_ip4_vpn_gateway_route(NMIP4Config *config,
 
     if (parent_gw) {
         /* Ensure there's a route to the parent device's gateway through the
-		 * parent device, since if the VPN claims the default route and the VPN
-		 * routes include a subnet that matches the parent device's subnet,
-		 * the parent device's gateway would get routed through the VPN and fail.
-		 */
+         * parent device, since if the VPN claims the default route and the VPN
+         * routes include a subnet that matches the parent device's subnet,
+         * the parent device's gateway would get routed through the VPN and fail.
+         */
         memset(&route, 0, sizeof(route));
         route.network   = parent_gw;
         route.plen      = 32;
@@ -788,7 +788,7 @@ add_ip6_vpn_gateway_route(NMIP6Config *          config,
     nm_assert(ifindex == nm_device_get_ip_ifindex(parent_device));
 
     /* Ask kernel how to reach @vpn_gw. We can only inject the route in
-	 * @parent_device, so whatever we resolve, it can only be on @ifindex. */
+     * @parent_device, so whatever we resolve, it can only be on @ifindex. */
     if (nm_platform_ip_route_get(platform,
                                  AF_INET6,
                                  vpn_gw,
@@ -801,10 +801,10 @@ add_ip6_vpn_gateway_route(NMIP6Config *          config,
             const NMPObject *obj;
 
             /* `ip route get` always resolves the route, even if the destination is unreachable.
-			 * In which case, it pretends the destination is directly reachable.
-			 *
-			 * So, only accept direct routes if @vpn_gw is a private network
-			 * or if the parent device also has a direct default route */
+             * In which case, it pretends the destination is directly reachable.
+             *
+             * So, only accept direct routes if @vpn_gw is a private network
+             * or if the parent device also has a direct default route */
             if (nm_platform_route_table_is_main(r->table_coerced)) {
                 if (!IN6_IS_ADDR_UNSPECIFIED(&r->gateway)) {
                     parent_gw     = &r->gateway;
@@ -835,10 +835,10 @@ add_ip6_vpn_gateway_route(NMIP6Config *          config,
     nm_ip6_config_add_route(config, &route, NULL);
 
     /* Ensure there's a route to the parent device's gateway through the
-	 * parent device, since if the VPN claims the default route and the VPN
-	 * routes include a subnet that matches the parent device's subnet,
-	 * the parent device's gateway would get routed through the VPN and fail.
-	 */
+     * parent device, since if the VPN claims the default route and the VPN
+     * routes include a subnet that matches the parent device's subnet,
+     * the parent device's gateway would get routed through the VPN and fail.
+     */
     if (parent_gw && !IN6_IS_ADDR_UNSPECIFIED(parent_gw)) {
         memset(&route, 0, sizeof(route));
         route.network   = *parent_gw;
@@ -965,8 +965,8 @@ plugin_state_changed(NMVpnConnection *self, NMVpnServiceState new_service_state)
 
     if (new_service_state == NM_VPN_SERVICE_STATE_STOPPED) {
         /* Clear connection secrets to ensure secrets get requested each time the
-		 * connection is activated.
-		 */
+         * connection is activated.
+         */
         nm_active_connection_clear_secrets(NM_ACTIVE_CONNECTION(self));
 
         if ((priv->vpn_state >= STATE_WAITING) && (priv->vpn_state <= STATE_ACTIVATED)) {
@@ -978,8 +978,8 @@ plugin_state_changed(NMVpnConnection *self, NMVpnServiceState new_service_state)
             priv->failure_reason = NM_ACTIVE_CONNECTION_STATE_REASON_UNKNOWN;
 
             /* If the connection failed, the service cannot persist, but the
-			 * connection can persist, ask listeners to re-activate the connection.
-			 */
+             * connection can persist, ask listeners to re-activate the connection.
+             */
             if (old_state == STATE_ACTIVATED && priv->vpn_state == STATE_FAILED
                 && _connection_only_can_persist(self))
                 g_signal_emit(self, signals[INTERNAL_RETRY_AFTER_FAILURE], 0);
@@ -1105,9 +1105,9 @@ apply_parent_device_config(NMVpnConnection *self)
     ifindex = nm_device_get_ip_ifindex(parent_dev);
     if (ifindex > 0) {
         /* If the VPN didn't return a network interface, it is a route-based
-		 * VPN (like kernel IPSec) and all IP addressing and routing should
-		 * be done on the parent interface instead.
-		 */
+         * VPN (like kernel IPSec) and all IP addressing and routing should
+         * be done on the parent interface instead.
+         */
         if (priv->ip4_config) {
             vpn4_parent_config = nm_ip4_config_new(nm_netns_get_multi_idx(priv->netns), ifindex);
             if (priv->ip_ifindex <= 0)
@@ -1529,8 +1529,8 @@ nm_vpn_connection_ip4_config_get(NMVpnConnection *self, GVariant *dict)
         _LOGI("VPN connection: (IP4 Config Get) reply received from old-style plugin");
 
         /* In the old API, the generic and IPv4 configuration items
-		 * were mixed together.
-		 */
+         * were mixed together.
+         */
         if (!process_generic_config(self, dict))
             return;
 
@@ -1640,10 +1640,10 @@ nm_vpn_connection_ip4_config_get(NMVpnConnection *self, GVariant *dict)
                 if (priv->ip4_external_gw && route.network == priv->ip4_external_gw
                     && route.plen == 32) {
                     /* Ignore host routes to the VPN gateway since NM adds one itself
-					 * below.  Since NM knows more about the routing situation than
-					 * the VPN server, we want to use the NM created route instead of
-					 * whatever the server provides.
-					 */
+                     * below.  Since NM knows more about the routing situation than
+                     * the VPN server, we want to use the NM created route instead of
+                     * whatever the server provides.
+                     */
                     break;
                 }
 
@@ -1839,10 +1839,10 @@ nm_vpn_connection_ip6_config_get(NMVpnConnection *self, GVariant *dict)
             if (priv->ip6_external_gw && IN6_ARE_ADDR_EQUAL(&route.network, priv->ip6_external_gw)
                 && route.plen == 128) {
                 /* Ignore host routes to the VPN gateway since NM adds one itself.
-				 * Since NM knows more about the routing situation than the VPN
-				 * server, we want to use the NM created route instead of whatever
-				 * the server provides.
-				 */
+                 * Since NM knows more about the routing situation than the VPN
+                 * server, we want to use the NM created route instead of whatever
+                 * the server provides.
+                 */
                 goto next;
             }
 
@@ -1919,7 +1919,7 @@ connect_success(NMVpnConnection *self)
     g_assert(s_vpn);
 
     /* Timeout waiting for IP config signal from VPN service
-	 * It is a configured value or 60 seconds */
+     * It is a configured value or 60 seconds */
     timeout = nm_setting_vpn_get_timeout(s_vpn);
     if (timeout == 0) {
         timeout = nm_config_data_get_connection_default_int64(NM_CONFIG_GET_DATA,
@@ -2008,8 +2008,8 @@ _hash_with_username(NMConnection *connection, const char *username)
     NMSettingVpn *                s_vpn;
 
     /* Shortcut if we weren't given a username or if there already was one in
-	 * the VPN setting; don't bother duplicating the connection and everything.
-	 */
+     * the VPN setting; don't bother duplicating the connection and everything.
+     */
     s_vpn = nm_connection_get_setting_vpn(connection);
     g_assert(s_vpn);
     if (username == NULL || nm_setting_vpn_get_user_name(s_vpn))
@@ -2039,11 +2039,11 @@ really_activate(NMVpnConnection *self, const char *username)
     g_variant_ref_sink(priv->connect_hash);
 
     /* If at least one agent doesn't support VPN hints, then we can't use
-	 * ConnectInteractive(), because that agent won't be able to pass hints
-	 * from the VPN plugin's interactive secrets requests to the VPN authentication
-	 * dialog and we won't get the secrets we need.  In this case fall back to
-	 * the old Connect() call.
-	 */
+     * ConnectInteractive(), because that agent won't be able to pass hints
+     * from the VPN plugin's interactive secrets requests to the VPN authentication
+     * dialog and we won't get the secrets we need.  In this case fall back to
+     * the old Connect() call.
+     */
     if (nm_agent_manager_all_agents_have_capability(
             nm_agent_manager_get(),
             nm_active_connection_get_subject(NM_ACTIVE_CONNECTION(self)),
@@ -2186,10 +2186,10 @@ _name_owner_changed(GObject *object, GParamSpec *pspec, gpointer user_data)
         _set_vpn_state(self, STATE_NEED_AUTH, NM_ACTIVE_CONNECTION_STATE_REASON_NONE, FALSE);
 
         /* Kick off the secrets requests; first we get existing system secrets
-		 * and ask the plugin if these are sufficient, next we get all existing
-		 * secrets from system and from user agents and ask the plugin again,
-		 * and last we ask the user for new secrets if required.
-		 */
+         * and ask the plugin if these are sufficient, next we get all existing
+         * secrets from system and from user agents and ask the plugin again,
+         * and last we ask the user for new secrets if required.
+         */
         get_secrets(self, SECRETS_REQ_SYSTEM, NULL);
     } else if (!owner && priv->service_running) {
         /* service went away */
@@ -2223,17 +2223,17 @@ _get_log_level(void)
     NMLogLevel level;
 
     /* curiously enough, nm-logging also uses syslog. But it
-	 * maps NMLogLevel differently to the syslog levels then we
-	 * do here.
-	 *
-	 * The reason is, that LOG_NOTICE is already something worth
-	 * highlighting in the journal, but we have 3 levels that are
-	 * lower then LOG_NOTICE (LOGL_TRACE, LOGL_DEBUG, LOGL_INFO),
-	 * On the other hand, syslog only defines LOG_DEBUG and LOG_INFO.
-	 * Thus, we must map them differently.
-	 *
-	 * Inside the VPN plugin, you might want to treat LOG_NOTICE as
-	 * as low severity, not worthy to be highlighted (like NM does). */
+     * maps NMLogLevel differently to the syslog levels then we
+     * do here.
+     *
+     * The reason is, that LOG_NOTICE is already something worth
+     * highlighting in the journal, but we have 3 levels that are
+     * lower then LOG_NOTICE (LOGL_TRACE, LOGL_DEBUG, LOGL_INFO),
+     * On the other hand, syslog only defines LOG_DEBUG and LOG_INFO.
+     * Thus, we must map them differently.
+     *
+     * Inside the VPN plugin, you might want to treat LOG_NOTICE as
+     * as low severity, not worthy to be highlighted (like NM does). */
 
     level = nm_logging_get_level(LOGD_VPN_PLUGIN);
     if (level != _LOGL_OFF) {
@@ -2295,9 +2295,9 @@ nm_vpn_service_daemon_exec(NMVpnConnection *self, GError **error)
     envp[i++] = nm_sprintf_buf(env_log_level, "NM_VPN_LOG_LEVEL=%d", _get_log_level());
 
     /* NM_VPN_LOG_SYSLOG: whether to log to stdout or syslog. If NetworkManager itself runs in
-	 * foreground, we also want the plugin to log to stdout.
-	 * If the plugin runs in background, the plugin should prefer logging to syslog. Otherwise
-	 * logging messages will be lost (unless using journald, in which case it wouldn't matter). */
+     * foreground, we also want the plugin to log to stdout.
+     * If the plugin runs in background, the plugin should prefer logging to syslog. Otherwise
+     * logging messages will be lost (unless using journald, in which case it wouldn't matter). */
     envp[i++] = nm_sprintf_buf(env_log_syslog,
                                "NM_VPN_LOG_SYSLOG=%c",
                                nm_logging_syslog_enabled() ? '1' : '0');
@@ -2463,7 +2463,7 @@ _get_ip_iface_for_device(NMVpnConnection *self, const char **out_iface)
     nm_assert(NM_IS_VPN_CONNECTION(self));
 
     /* the ifindex and the ifname in this case should come together.
-	 * They either must be both set, or none. */
+     * They either must be both set, or none. */
 
     parent_dev = nm_active_connection_get_device(NM_ACTIVE_CONNECTION(self));
     if (!parent_dev)
@@ -2785,15 +2785,15 @@ device_changed(NMActiveConnection *active, NMDevice *new_device, NMDevice *old_d
         return;
 
     /* Route-based VPNs must update their routing and send a new IP config
-	 * since all their routes need to be adjusted for new_device.
-	 */
+     * since all their routes need to be adjusted for new_device.
+     */
     if (priv->ip_ifindex <= 0)
         return;
 
     /* Device changed underneath the VPN connection.  Let the plugin figure
-	 * out that connectivity is down and start its reconnect attempt if it
-	 * needs to.
-	 */
+     * out that connectivity is down and start its reconnect attempt if it
+     * needs to.
+     */
     if (old_device)
         remove_parent_device_config(NM_VPN_CONNECTION(active), old_device);
 
diff --git a/src/vpn/nm-vpn-manager.c b/src/vpn/nm-vpn-manager.c
index d518b08229..90632e3257 100644
--- a/src/vpn/nm-vpn-manager.c
+++ b/src/vpn/nm-vpn-manager.c
@@ -22,7 +22,7 @@ typedef struct {
     gulong        monitor_id_lib;
 
     /* This is only used for services that don't support multiple
-	 * connections, to guard access to them. */
+     * connections, to guard access to them. */
     GHashTable *active_services;
 } NMVpnManagerPrivate;
 
@@ -128,8 +128,8 @@ try_add_plugin(NMVpnManager *self, NMVpnPluginInfo *plugin_info)
         return;
 
     /* Make sure we don't add dupes.
-	 * We don't really allow reload of the same file. What we do allow is however to
-	 * delete a file and re-add it. */
+     * We don't really allow reload of the same file. What we do allow is however to
+     * delete a file and re-add it. */
     if (nm_vpn_plugin_info_list_find_by_filename(priv->plugins,
                                                  nm_vpn_plugin_info_get_filename(plugin_info)))
         return;
@@ -168,9 +168,9 @@ vpn_dir_changed(GFileMonitor *    monitor,
         plugin_info = nm_vpn_plugin_info_list_find_by_filename(priv->plugins, path);
         if (plugin_info) {
             /* we don't support reloading an existing plugin. You can only remove the file
-			 * and re-add it. By reloading we want to support the use case of installing
-			 * a VPN plugin after NM started. No need to burden ourself with a complete
-			 * reload. */
+             * and re-add it. By reloading we want to support the use case of installing
+             * a VPN plugin after NM started. No need to burden ourself with a complete
+             * reload. */
             break;
         }
 
@@ -230,9 +230,9 @@ nm_vpn_manager_init(NMVpnManager *self)
     }
 
     /* first read conf_dir_lib. The name files are not really user configuration, but
-	 * plugin configuration. Hence we expect ~newer~ plugins to install their files
-	 * in /usr/lib/NetworkManager. We want to prefer those files.
-	 * In case of no-conflict, the order doesn't matter. */
+     * plugin configuration. Hence we expect ~newer~ plugins to install their files
+     * in /usr/lib/NetworkManager. We want to prefer those files.
+     * In case of no-conflict, the order doesn't matter. */
     infos = _nm_vpn_plugin_info_list_load_dir(conf_dir_lib, TRUE, 0, NULL, NULL);
     for (info = infos; info; info = info->next)
         try_add_plugin(self, info->data);