Add noexcept move constructors/operators

15 files changed, 150 insertions, 79 deletions

diff --git a/vespalib/src/vespa/vespalib/crypto/openssl_crypto_impl.cpp b/vespalib/src/vespa/vespalib/crypto/openssl_crypto_impl.cpp
index 2783fd01905..51a3f224b4a 100644
--- a/vespalib/src/vespa/vespalib/crypto/openssl_crypto_impl.cpp
+++ b/vespalib/src/vespa/vespalib/crypto/openssl_crypto_impl.cpp
@@ -62,7 +62,8 @@ BioPtr new_memory_bio() {
 
 } // anonymous namespace
 
-vespalib::string PrivateKeyImpl::private_to_pem() const {
+vespalib::string
+PrivateKeyImpl::private_to_pem() const {
     BioPtr bio = new_memory_bio();
     // TODO this API is const-broken even on 1.1.1, revisit in the future...
     auto* mutable_pkey = const_cast<::EVP_PKEY*>(_pkey.get());
@@ -73,7 +74,8 @@ vespalib::string PrivateKeyImpl::private_to_pem() const {
     return bio_to_string(*bio);
 }
 
-std::shared_ptr<PrivateKeyImpl> PrivateKeyImpl::generate_openssl_p256_ec_key() {
+std::shared_ptr<PrivateKeyImpl>
+PrivateKeyImpl::generate_openssl_p256_ec_key() {
     // We first have to generate an EVP context for the keygen _parameters_...
     EvpPkeyCtxPtr params_ctx(::EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr));
     if (!params_ctx) {
@@ -174,7 +176,8 @@ void set_certificate_expires_from_now(::X509& cert, std::chrono::seconds valid_f
     }
 }
 
-void set_name_entry_if_non_empty(::X509_NAME& name, const char* field, vespalib::stringref entry) {
+void
+set_name_entry_if_non_empty(::X509_NAME& name, const char* field, vespalib::stringref entry) {
     if (entry.empty()) {
         return;
     }
@@ -186,7 +189,8 @@ void set_name_entry_if_non_empty(::X509_NAME& name, const char* field, vespalib:
     }
 }
 
-void assign_subject_distinguished_name(::X509_NAME& name, const X509Certificate::DistinguishedName& dn) {
+void
+assign_subject_distinguished_name(::X509_NAME& name, const X509Certificate::DistinguishedName& dn) {
     set_name_entry_if_non_empty(name, "C",  dn._country);
     set_name_entry_if_non_empty(name, "ST", dn._state);
     set_name_entry_if_non_empty(name, "L",  dn._locality);
@@ -200,7 +204,8 @@ void assign_subject_distinguished_name(::X509_NAME& name, const X509Certificate:
 // `value` string is taken by value since X509V3_EXT_conf_nid takes in a mutable char*
 // and who knows what terrible things it might do to it (we must also ensure null
 // termination of the string).
-void add_v3_ext(::X509& subject, ::X509& issuer, int nid, vespalib::string value) {
+void
+add_v3_ext(::X509& subject, ::X509& issuer, int nid, vespalib::string value) {
     // We are now reaching a point where the API we need to use is not properly documented.
     // This functionality is inferred from https://opensource.apple.com/source/OpenSSL/OpenSSL-22/openssl/demos/x509/mkcert.c
     ::X509V3_CTX ctx;
@@ -219,7 +224,8 @@ void add_v3_ext(::X509& subject, ::X509& issuer, int nid, vespalib::string value
     }
 }
 
-void add_any_subject_alternate_names(::X509& subject, ::X509& issuer,
+void
+add_any_subject_alternate_names(::X509& subject, ::X509& issuer,
                                      const std::vector<vespalib::string>& sans) {
     // There can only be 1 SAN entry in a valid cert, but it can have multiple
     // logical entries separated by commas in a single string.
@@ -237,10 +243,13 @@ void add_any_subject_alternate_names(::X509& subject, ::X509& issuer,
 
 } // anonymous namespace
 
+X509CertificateImpl::~X509CertificateImpl() = default;
+
 // Some references:
 // https://stackoverflow.com/questions/256405/programmatically-create-x509-certificate-using-openssl
 // https://opensource.apple.com/source/OpenSSL/OpenSSL-22/openssl/demos/x509/mkcert.c
-std::shared_ptr<X509CertificateImpl> X509CertificateImpl::generate_openssl_x509_from(Params params) {
+std::shared_ptr<X509CertificateImpl>
+X509CertificateImpl::generate_openssl_x509_from(Params params) {
     X509Ptr cert(::X509_new());
     if (!cert) {
         throw CryptoException("X509_new");
@@ -291,7 +300,8 @@ std::shared_ptr<X509CertificateImpl> X509CertificateImpl::generate_openssl_x509_
     return std::make_shared<X509CertificateImpl>(std::move(cert));
 }
 
-vespalib::string X509CertificateImpl::to_pem() const {
+vespalib::string
+X509CertificateImpl::to_pem() const {
     BioPtr bio = new_memory_bio();
     // TODO this API is const-broken, revisit in the future...
     auto* mutable_cert = const_cast<::X509*>(_cert.get());
diff --git a/vespalib/src/vespa/vespalib/crypto/openssl_crypto_impl.h b/vespalib/src/vespa/vespalib/crypto/openssl_crypto_impl.h
index 7996c83d37b..539960cc000 100644
--- a/vespalib/src/vespa/vespalib/crypto/openssl_crypto_impl.h
+++ b/vespalib/src/vespa/vespalib/crypto/openssl_crypto_impl.h
@@ -30,7 +30,7 @@ class X509CertificateImpl : public X509Certificate {
     X509Ptr _cert;
 public:
     explicit X509CertificateImpl(X509Ptr cert) noexcept : _cert(std::move(cert)) {}
-    ~X509CertificateImpl() = default;
+    ~X509CertificateImpl() override;
 
     ::X509* native_cert() noexcept { return _cert.get(); }
     const ::X509* native_cert() const noexcept { return _cert.get(); }
diff --git a/vespalib/src/vespa/vespalib/crypto/x509_certificate.cpp b/vespalib/src/vespa/vespalib/crypto/x509_certificate.cpp
index afc240ba53e..e74d5204c76 100644
--- a/vespalib/src/vespa/vespalib/crypto/x509_certificate.cpp
+++ b/vespalib/src/vespa/vespalib/crypto/x509_certificate.cpp
@@ -5,18 +5,16 @@
 
 namespace vespalib::crypto {
 
-X509Certificate::DistinguishedName::DistinguishedName() = default;
+X509Certificate::DistinguishedName::DistinguishedName() noexcept= default;
 X509Certificate::DistinguishedName::DistinguishedName(const DistinguishedName&) = default;
-X509Certificate::DistinguishedName& X509Certificate::DistinguishedName::operator=(const DistinguishedName&) = default;
 X509Certificate::DistinguishedName::DistinguishedName(DistinguishedName&&) noexcept = default;
 X509Certificate::DistinguishedName& X509Certificate::DistinguishedName::operator=(DistinguishedName&&) noexcept = default;
 X509Certificate::DistinguishedName::~DistinguishedName() = default;
 
-X509Certificate::Params::Params() = default;
+X509Certificate::Params::Params() noexcept= default;
 X509Certificate::Params::~Params() = default;
 
 X509Certificate::Params::Params(const Params&) = default;
-X509Certificate::Params& X509Certificate::Params::operator=(const Params&) = default;
 X509Certificate::Params::Params(Params&&) noexcept = default;
 X509Certificate::Params& X509Certificate::Params::operator=(Params&&) noexcept = default;
 
@@ -47,16 +45,28 @@ X509Certificate::Params::issued_by(SubjectInfo subject,
     return params;
 }
 
+X509Certificate::SubjectInfo::SubjectInfo(DistinguishedName dn_) noexcept
+    : dn(std::move(dn_)),
+      subject_alt_names()
+{}
+X509Certificate::SubjectInfo::SubjectInfo() noexcept = default;
+X509Certificate::SubjectInfo::SubjectInfo(const SubjectInfo &) = default;
+X509Certificate::SubjectInfo::SubjectInfo(SubjectInfo &&) noexcept = default;
+X509Certificate::SubjectInfo & X509Certificate::SubjectInfo::operator=(SubjectInfo &&) noexcept = default;
+X509Certificate::SubjectInfo::~SubjectInfo() = default;
+
 std::shared_ptr<X509Certificate> X509Certificate::generate_from(Params params) {
     return openssl_impl::X509CertificateImpl::generate_openssl_x509_from(std::move(params));
 }
 
 CertKeyWrapper::CertKeyWrapper(std::shared_ptr<X509Certificate> cert_,
                                std::shared_ptr<PrivateKey> key_)
-        : cert(std::move(cert_)),
-          key(std::move(key_))
+    : cert(std::move(cert_)),
+      key(std::move(key_))
 {}
 
+CertKeyWrapper::CertKeyWrapper(CertKeyWrapper &&) noexcept = default;
+CertKeyWrapper & CertKeyWrapper::operator=(CertKeyWrapper &&) noexcept = default;
 CertKeyWrapper::~CertKeyWrapper() = default;
 
 }
diff --git a/vespalib/src/vespa/vespalib/crypto/x509_certificate.h b/vespalib/src/vespa/vespalib/crypto/x509_certificate.h
index 3dd7c9c6abe..50c6b25c2d4 100644
--- a/vespalib/src/vespa/vespalib/crypto/x509_certificate.h
+++ b/vespalib/src/vespa/vespalib/crypto/x509_certificate.h
@@ -38,9 +38,9 @@ public:
         // we want to be able to test this edge case.
         std::vector<vespalib::string> _common_names; // "CN"
 
-        DistinguishedName();
+        DistinguishedName() noexcept;
         DistinguishedName(const DistinguishedName&);
-        DistinguishedName& operator=(const DistinguishedName&);
+        DistinguishedName& operator=(const DistinguishedName&) = delete;
         DistinguishedName(DistinguishedName&&) noexcept;
         DistinguishedName& operator=(DistinguishedName&&) noexcept;
         ~DistinguishedName();
@@ -64,11 +64,13 @@ public:
         DistinguishedName dn;
         std::vector<vespalib::string> subject_alt_names;
 
-        SubjectInfo() = default;
-        explicit SubjectInfo(DistinguishedName dn_)
-                : dn(std::move(dn_)),
-                  subject_alt_names()
-        {}
+        SubjectInfo() noexcept;
+        explicit SubjectInfo(DistinguishedName dn_) noexcept;
+        SubjectInfo(const SubjectInfo &);
+        SubjectInfo & operator=(const SubjectInfo &) = delete;
+        SubjectInfo(SubjectInfo &&) noexcept;
+        SubjectInfo & operator=(SubjectInfo &&) noexcept;
+        ~SubjectInfo();
 
         SubjectInfo& add_subject_alt_name(vespalib::string san) {
             subject_alt_names.emplace_back(std::move(san));
@@ -77,11 +79,11 @@ public:
     };
 
     struct Params {
-        Params();
+        Params() noexcept;
         ~Params();
 
         Params(const Params&);
-        Params& operator=(const Params&);
+        Params& operator=(const Params&) = delete;
         Params(Params&&) noexcept;
         Params& operator=(Params&&) noexcept;
 
@@ -117,6 +119,8 @@ struct CertKeyWrapper {
 
     CertKeyWrapper(std::shared_ptr<X509Certificate> cert_,
                    std::shared_ptr<PrivateKey> key_);
+    CertKeyWrapper(CertKeyWrapper &&) noexcept;
+    CertKeyWrapper & operator=(CertKeyWrapper &&) noexcept;
     ~CertKeyWrapper();
 };
 
diff --git a/vespalib/src/vespa/vespalib/net/crypto_engine.cpp b/vespalib/src/vespa/vespalib/net/crypto_engine.cpp
index f826e74e450..cffcdcd1a08 100644
--- a/vespalib/src/vespa/vespalib/net/crypto_engine.cpp
+++ b/vespalib/src/vespa/vespalib/net/crypto_engine.cpp
@@ -6,9 +6,6 @@
 #include <vespa/vespalib/net/tls/auto_reloading_tls_crypto_engine.h>
 #include <vespa/vespalib/net/tls/maybe_tls_crypto_engine.h>
 #include <vespa/vespalib/net/tls/statistics.h>
-#include <vespa/vespalib/net/tls/tls_crypto_engine.h>
-#include <vespa/vespalib/net/tls/transport_security_options.h>
-#include <vespa/vespalib/net/tls/transport_security_options_reading.h>
 #include <vespa/vespalib/stllike/string.h>
 #include <vespa/vespalib/util/size_literals.h>
 
@@ -24,11 +21,12 @@ class NullCryptoSocket : public CryptoSocket
 private:
     SocketHandle _socket;
 public:
-    NullCryptoSocket(SocketHandle socket) : _socket(std::move(socket)) {}
-    int get_fd() const override { return _socket.get(); }
+    explicit NullCryptoSocket(SocketHandle socket) : _socket(std::move(socket)) {}
+    ~NullCryptoSocket() override;
+    [[nodiscard]] int get_fd() const override { return _socket.get(); }
     HandshakeResult handshake() override { return HandshakeResult::DONE; }
     void do_handshake_work() override {}
-    size_t min_read_buffer_size() const override { return 1; }
+    [[nodiscard]] size_t min_read_buffer_size() const override { return 1; }
     ssize_t read(char *buf, size_t len) override { return _socket.read(buf, len); }
     ssize_t drain(char *, size_t) override { return 0; }
     ssize_t write(const char *buf, size_t len) override { return _socket.write(buf, len); }
@@ -37,9 +35,11 @@ public:
     void drop_empty_buffers() override {}
 };
 
+    NullCryptoSocket::~NullCryptoSocket() = default;
 using net::tls::AuthorizationMode;
 
-AuthorizationMode authorization_mode_from_env() {
+AuthorizationMode
+authorization_mode_from_env() {
     const char* env = getenv("VESPA_TLS_INSECURE_AUTHORIZATION_MODE");
     vespalib::string mode = env ? env : "";
     if (mode == "enforce") {
@@ -55,7 +55,8 @@ AuthorizationMode authorization_mode_from_env() {
     return AuthorizationMode::Enforce;
 }
 
-CryptoEngine::SP create_default_crypto_engine() {
+CryptoEngine::SP
+create_default_crypto_engine() {
     const char *env = getenv("VESPA_TLS_CONFIG_FILE");
     vespalib::string cfg_file = env ? env : "";
     if (cfg_file.empty()) {
@@ -79,7 +80,8 @@ CryptoEngine::SP create_default_crypto_engine() {
     return tls;
 }
 
-CryptoEngine::SP try_create_default_crypto_engine() {
+CryptoEngine::SP
+try_create_default_crypto_engine() {
     try {
         return create_default_crypto_engine();
     } catch (crypto::CryptoException &e) {
@@ -99,6 +101,8 @@ CryptoEngine::get_default()
     return shared_default;
 }
 
+NullCryptoEngine::~NullCryptoEngine() = default;
+
 CryptoSocket::UP
 NullCryptoEngine::create_client_crypto_socket(SocketHandle socket, const SocketSpec &)
 {
diff --git a/vespalib/src/vespa/vespalib/net/crypto_engine.h b/vespalib/src/vespa/vespalib/net/crypto_engine.h
index 7f4b5287415..d5cddb0c7a3 100644
--- a/vespalib/src/vespa/vespalib/net/crypto_engine.h
+++ b/vespalib/src/vespa/vespalib/net/crypto_engine.h
@@ -31,6 +31,7 @@ struct CryptoEngine {
  * Crypto engine without encryption.
  **/
 struct NullCryptoEngine : public CryptoEngine {
+    ~NullCryptoEngine() override;
     bool use_tls_when_client() const override { return false; }
     bool always_use_tls_when_server() const override { return false; }
     CryptoSocket::UP create_client_crypto_socket(SocketHandle socket, const SocketSpec &spec) override;
diff --git a/vespalib/src/vespa/vespalib/net/socket_handle.cpp b/vespalib/src/vespa/vespalib/net/socket_handle.cpp
index a2580f6fec8..72b78a1e466 100644
--- a/vespalib/src/vespa/vespalib/net/socket_handle.cpp
+++ b/vespalib/src/vespa/vespalib/net/socket_handle.cpp
@@ -7,6 +7,17 @@
 
 namespace vespalib {
 
+SocketHandle::SocketHandle(SocketHandle &&rhs) noexcept
+    : _fd(rhs.release())
+{}
+SocketHandle &
+SocketHandle::operator=(SocketHandle &&rhs) noexcept {
+    maybe_close(_fd);
+    _fd = rhs.release();
+    return *this;
+}
+SocketHandle::~SocketHandle() { maybe_close(_fd); }
+
 ssize_t
 SocketHandle::read(char *buf, size_t len)
 {
diff --git a/vespalib/src/vespa/vespalib/net/socket_handle.h b/vespalib/src/vespa/vespalib/net/socket_handle.h
index b4893191188..a8b84e3e2f7 100644
--- a/vespalib/src/vespa/vespalib/net/socket_handle.h
+++ b/vespalib/src/vespa/vespalib/net/socket_handle.h
@@ -28,16 +28,12 @@ public:
     explicit SocketHandle(int sockfd) : _fd(sockfd) {}
     SocketHandle(const SocketHandle &) = delete;
     SocketHandle &operator=(const SocketHandle &) = delete;
-    SocketHandle(SocketHandle &&rhs) : _fd(rhs.release()) {}
-    SocketHandle &operator=(SocketHandle &&rhs) {
-        maybe_close(_fd);
-        _fd = rhs.release();
-        return *this;
-    }
-    ~SocketHandle() { maybe_close(_fd); }
-    bool valid() const { return (_fd >= 0); }
-    operator bool() const { return valid(); }
-    int get() const { return _fd; }
+    SocketHandle(SocketHandle &&rhs) noexcept;
+    SocketHandle &operator=(SocketHandle &&rhs) noexcept;
+    ~SocketHandle();
+    [[nodiscard]] bool valid() const { return (_fd >= 0); }
+    explicit operator bool() const { return valid(); }
+    [[nodiscard]] int get() const { return _fd; }
     int release() {
         int old_fd = _fd;
         _fd = -1;
@@ -60,7 +56,7 @@ public:
     SocketHandle accept();
     void shutdown();
     int half_close();
-    int get_so_error() const;
+    [[nodiscard]] int get_so_error() const;
 };
 
 } // namespace vespalib
diff --git a/vespalib/src/vespa/vespalib/net/tls/peer_policies.cpp b/vespalib/src/vespa/vespalib/net/tls/peer_policies.cpp
index b9d5135a96f..7a9c7720b43 100644
--- a/vespalib/src/vespa/vespalib/net/tls/peer_policies.cpp
+++ b/vespalib/src/vespa/vespalib/net/tls/peer_policies.cpp
@@ -8,7 +8,8 @@ namespace vespalib::net::tls {
 
 namespace {
 
-bool is_regex_special_char(char c) noexcept {
+bool
+is_regex_special_char(char c) noexcept {
     switch (c) {
     case '^':
     case '$':
@@ -32,7 +33,8 @@ bool is_regex_special_char(char c) noexcept {
 
 // Important: `delimiter` MUST NOT be a character that needs escaping within a regex [charset]
 template <bool SupportSingleCharMatch>
-std::string char_delimited_glob_to_regex(vespalib::stringref glob, char delimiter) {
+std::string
+char_delimited_glob_to_regex(vespalib::stringref glob, char delimiter) {
     std::string ret = "^";
     ret.reserve(glob.size() + 2);
     // Note: we explicitly stop matching at a delimiter boundary.
@@ -97,15 +99,18 @@ public:
 
 } // anon ns
 
-std::shared_ptr<const CredentialMatchPattern> CredentialMatchPattern::create_from_dns_glob(vespalib::stringref glob_pattern) {
+std::shared_ptr<const CredentialMatchPattern>
+CredentialMatchPattern::create_from_dns_glob(vespalib::stringref glob_pattern) {
     return std::make_shared<const RegexHostMatchPattern>(RegexHostMatchPattern::from_dns_glob_pattern(glob_pattern));
 }
 
-std::shared_ptr<const CredentialMatchPattern> CredentialMatchPattern::create_from_uri_glob(vespalib::stringref glob_pattern) {
+std::shared_ptr<const CredentialMatchPattern>
+    CredentialMatchPattern::create_from_uri_glob(vespalib::stringref glob_pattern) {
     return std::make_shared<const RegexHostMatchPattern>(RegexHostMatchPattern::from_uri_glob_pattern(glob_pattern));
 }
 
-std::shared_ptr<const CredentialMatchPattern> CredentialMatchPattern::create_exact_match(vespalib::stringref str) {
+std::shared_ptr<const CredentialMatchPattern>
+CredentialMatchPattern::create_exact_match(vespalib::stringref str) {
     return std::make_shared<const ExactMatchPattern>(str);
 }
 
@@ -117,6 +122,9 @@ RequiredPeerCredential::RequiredPeerCredential(Field field, vespalib::string mus
 {
 }
 
+RequiredPeerCredential::RequiredPeerCredential(const RequiredPeerCredential &) = default;
+RequiredPeerCredential::RequiredPeerCredential(RequiredPeerCredential &&) noexcept = default;
+RequiredPeerCredential & RequiredPeerCredential::operator=(RequiredPeerCredential &&) noexcept = default;
 RequiredPeerCredential::~RequiredPeerCredential() = default;
 
 PeerPolicy::PeerPolicy() = default;
@@ -135,9 +143,15 @@ PeerPolicy::PeerPolicy(std::vector<RequiredPeerCredential> required_peer_credent
 
 PeerPolicy::~PeerPolicy() = default;
 
+AuthorizedPeers::AuthorizedPeers(const AuthorizedPeers&) = default;
+AuthorizedPeers::AuthorizedPeers(AuthorizedPeers&&) noexcept = default;
+AuthorizedPeers& AuthorizedPeers::operator=(AuthorizedPeers&&) noexcept = default;
+AuthorizedPeers::~AuthorizedPeers() = default;
+
 namespace {
 template <typename Collection>
-void print_joined(std::ostream& os, const Collection& coll, const char* sep) {
+void
+print_joined(std::ostream& os, const Collection& coll, const char* sep) {
     bool first = true;
     for (const auto& e : coll) {
         if (!first) {
@@ -148,7 +162,8 @@ void print_joined(std::ostream& os, const Collection& coll, const char* sep) {
     }
 }
 
-constexpr const char* to_string(RequiredPeerCredential::Field field) noexcept {
+constexpr const char*
+to_string(RequiredPeerCredential::Field field) noexcept {
     switch (field) {
     case RequiredPeerCredential::Field::CN:      return "CN";
     case RequiredPeerCredential::Field::SAN_DNS: return "SAN_DNS";
@@ -159,7 +174,8 @@ constexpr const char* to_string(RequiredPeerCredential::Field field) noexcept {
 
 }
 
-std::ostream& operator<<(std::ostream& os, const RequiredPeerCredential& cred) {
+std::ostream&
+operator<<(std::ostream& os, const RequiredPeerCredential& cred) {
     os << "RequiredPeerCredential("
        << to_string(cred.field())
        << " matches '"
@@ -168,14 +184,16 @@ std::ostream& operator<<(std::ostream& os, const RequiredPeerCredential& cred) {
     return os;
 }
 
-std::ostream& operator<<(std::ostream& os, const PeerPolicy& policy) {
+std::ostream&
+operator<<(std::ostream& os, const PeerPolicy& policy) {
     os << "PeerPolicy(";
     print_joined(os, policy.required_peer_credentials(), ", ");
     os << ", " << policy.granted_capabilities().to_string() << ")";
     return os;
 }
 
-std::ostream& operator<<(std::ostream& os, const AuthorizedPeers& authorized){
+std::ostream&
+operator<<(std::ostream& os, const AuthorizedPeers& authorized){
     os << "AuthorizedPeers(";
     print_joined(os, authorized.peer_policies(), ", ");
     os << ")";
diff --git a/vespalib/src/vespa/vespalib/net/tls/peer_policies.h b/vespalib/src/vespa/vespalib/net/tls/peer_policies.h
index 3314e5e4adf..56aa2986de3 100644
--- a/vespalib/src/vespa/vespalib/net/tls/peer_policies.h
+++ b/vespalib/src/vespa/vespalib/net/tls/peer_policies.h
@@ -30,6 +30,10 @@ private:
 public:
     RequiredPeerCredential() = default;
     RequiredPeerCredential(Field field, vespalib::string must_match_pattern);
+    RequiredPeerCredential(const RequiredPeerCredential &);
+    RequiredPeerCredential & operator=(const RequiredPeerCredential &) = delete;
+    RequiredPeerCredential(RequiredPeerCredential &&) noexcept;
+    RequiredPeerCredential & operator=(RequiredPeerCredential &&) noexcept;
     ~RequiredPeerCredential();
 
     bool operator==(const RequiredPeerCredential& rhs) const {
@@ -43,8 +47,8 @@ public:
         return (_match_pattern && _match_pattern->matches(str));
     }
 
-    Field field() const noexcept { return _field; }
-    const vespalib::string& original_pattern() const noexcept { return _original_pattern; }
+    [[nodiscard]] Field field() const noexcept { return _field; }
+    [[nodiscard]] const vespalib::string& original_pattern() const noexcept { return _original_pattern; }
 };
 
 class PeerPolicy {
@@ -89,10 +93,11 @@ public:
           _allow_all_if_empty(false)
     {}
 
-    AuthorizedPeers(const AuthorizedPeers&) = default;
-    AuthorizedPeers& operator=(const AuthorizedPeers&) = default;
-    AuthorizedPeers(AuthorizedPeers&&) noexcept = default;
-    AuthorizedPeers& operator=(AuthorizedPeers&&) noexcept = default;
+    AuthorizedPeers(const AuthorizedPeers&);
+    AuthorizedPeers& operator=(const AuthorizedPeers&) = delete;
+    AuthorizedPeers(AuthorizedPeers&&) noexcept;
+    AuthorizedPeers& operator=(AuthorizedPeers&&) noexcept;
+    ~AuthorizedPeers();
 
     static AuthorizedPeers allow_all_authenticated() {
         return AuthorizedPeers(true);
@@ -104,7 +109,7 @@ public:
     [[nodiscard]] bool allows_all_authenticated() const noexcept {
         return _allow_all_if_empty;
     }
-    const std::vector<PeerPolicy>& peer_policies() const noexcept { return _peer_policies; }
+    [[nodiscard]] const std::vector<PeerPolicy>& peer_policies() const noexcept { return _peer_policies; }
 };
 
 std::ostream& operator<<(std::ostream&, const RequiredPeerCredential&);
diff --git a/vespalib/src/vespa/vespalib/net/tls/transport_security_options.cpp b/vespalib/src/vespa/vespalib/net/tls/transport_security_options.cpp
index f3ae1a05919..52f822d7593 100644
--- a/vespalib/src/vespa/vespalib/net/tls/transport_security_options.cpp
+++ b/vespalib/src/vespa/vespalib/net/tls/transport_security_options.cpp
@@ -30,7 +30,6 @@ TransportSecurityOptions::TransportSecurityOptions(vespalib::string ca_certs_pem
 }
 
 TransportSecurityOptions::TransportSecurityOptions(const TransportSecurityOptions&) = default;
-TransportSecurityOptions& TransportSecurityOptions::operator=(const TransportSecurityOptions&) = default;
 TransportSecurityOptions::TransportSecurityOptions(TransportSecurityOptions&&) noexcept = default;
 TransportSecurityOptions& TransportSecurityOptions::operator=(TransportSecurityOptions&&) noexcept = default;
 
@@ -63,9 +62,6 @@ TransportSecurityOptions::Params::~Params() {
 
 TransportSecurityOptions::Params::Params(const Params&) = default;
 
-TransportSecurityOptions::Params&
-TransportSecurityOptions::Params::operator=(const TransportSecurityOptions::Params&) = default;
-
 TransportSecurityOptions::Params::Params(Params&&) noexcept = default;
 
 TransportSecurityOptions::Params&
diff --git a/vespalib/src/vespa/vespalib/net/tls/transport_security_options.h b/vespalib/src/vespa/vespalib/net/tls/transport_security_options.h
index 4694373671b..438049b0e56 100644
--- a/vespalib/src/vespa/vespalib/net/tls/transport_security_options.h
+++ b/vespalib/src/vespa/vespalib/net/tls/transport_security_options.h
@@ -27,7 +27,7 @@ public:
         Params();
         ~Params();
         Params(const Params&);
-        Params& operator=(const Params&);
+        Params& operator=(const Params&) = delete;
         Params(Params&&) noexcept;
         Params& operator=(Params&&) noexcept;
 
@@ -47,7 +47,7 @@ public:
 
     explicit TransportSecurityOptions(Params params);
     TransportSecurityOptions(const TransportSecurityOptions&);
-    TransportSecurityOptions& operator=(const TransportSecurityOptions&);
+    TransportSecurityOptions& operator=(const TransportSecurityOptions&) = delete;
     TransportSecurityOptions(TransportSecurityOptions&&) noexcept;
     TransportSecurityOptions& operator=(TransportSecurityOptions&&) noexcept;
 
diff --git a/vespalib/src/vespa/vespalib/util/exception.h b/vespalib/src/vespa/vespalib/util/exception.h
index 0acaabdd92c..6334e58a2f4 100644
--- a/vespalib/src/vespa/vespalib/util/exception.h
+++ b/vespalib/src/vespa/vespalib/util/exception.h
@@ -61,7 +61,7 @@
 #define VESPA_DEFINE_EXCEPTION(MyClass, Parent)                            \
 class MyClass : public Parent {                                            \
 public:                                                                    \
-    MyClass(vespalib::stringref msg,                                       \
+    explicit MyClass(vespalib::stringref msg,                              \
             vespalib::stringref location = "", int skipStack = 0);         \
     MyClass(vespalib::stringref msg, const Exception &cause,               \
             vespalib::stringref location = "", int skipStack = 0);         \
diff --git a/vespalib/src/vespa/vespalib/util/exceptions.cpp b/vespalib/src/vespa/vespalib/util/exceptions.cpp
index 2c21ab8bcea..5bb85d1e275 100644
--- a/vespalib/src/vespa/vespalib/util/exceptions.cpp
+++ b/vespalib/src/vespa/vespalib/util/exceptions.cpp
@@ -51,7 +51,9 @@ ExceptionWithPayload::ExceptionWithPayload(vespalib::stringref msg, Anything::UP
       _msg(msg),
       _payload(std::move(payload))
 { }
-ExceptionWithPayload::~ExceptionWithPayload() {}
+ExceptionWithPayload::ExceptionWithPayload(ExceptionWithPayload &&) noexcept = default;
+ExceptionWithPayload & ExceptionWithPayload::operator = (ExceptionWithPayload &&) noexcept = default;
+ExceptionWithPayload::~ExceptionWithPayload() = default;
 
 SilenceUncaughtException::SilenceUncaughtException(const std::exception & e) :
     _oldTerminate(std::set_terminate(silent_terminate))
@@ -95,6 +97,8 @@ PortListenException::PortListenException(int port, vespalib::stringref protocol,
 {
 }
 
+PortListenException::PortListenException(PortListenException &&) noexcept = default;
+PortListenException & PortListenException::operator = (PortListenException &&) noexcept = default;
 PortListenException::PortListenException(const PortListenException &) = default;
 PortListenException & PortListenException::operator = (const PortListenException &) = default;
 
@@ -117,6 +121,11 @@ IoException::IoException(stringref msg, Type type,
 {
 }
 
+IoException::IoException(const IoException &) = default;
+IoException::IoException(IoException &&) noexcept = default;
+IoException & IoException::operator =(IoException &&) noexcept = default;
+IoException::~IoException() = default;
+
 string
 IoException::createMessage(stringref msg, Type type)
 {
diff --git a/vespalib/src/vespa/vespalib/util/exceptions.h b/vespalib/src/vespa/vespalib/util/exceptions.h
index 5d880ccf0ac..c5a3f354fe6 100644
--- a/vespalib/src/vespa/vespalib/util/exceptions.h
+++ b/vespalib/src/vespa/vespalib/util/exceptions.h
@@ -68,13 +68,13 @@ public:
     class Anything {
     public:
        using UP = std::unique_ptr<Anything>;
-       virtual ~Anything() { }
+       virtual ~Anything() = default;
     };
-    ExceptionWithPayload(vespalib::stringref msg);
+    explicit ExceptionWithPayload(vespalib::stringref msg);
     ExceptionWithPayload(vespalib::stringref msg, Anything::UP payload);
-    ExceptionWithPayload(ExceptionWithPayload &&) = default;
-    ExceptionWithPayload & operator = (ExceptionWithPayload &&) = default;
-    ~ExceptionWithPayload();
+    ExceptionWithPayload(ExceptionWithPayload &&) noexcept;
+    ExceptionWithPayload & operator = (ExceptionWithPayload &&) noexcept;
+    ~ExceptionWithPayload() override;
     void setPayload(Anything::UP payload) { _payload = std::move(payload); }
     const char * what() const noexcept override;
 private:
@@ -84,7 +84,7 @@ private:
 
 class OOMException : public ExceptionWithPayload {
 public:
-    OOMException(vespalib::stringref msg) : ExceptionWithPayload(msg) { }
+    explicit OOMException(vespalib::stringref msg) : ExceptionWithPayload(msg) { }
     OOMException(vespalib::stringref msg, Anything::UP payload) : ExceptionWithPayload(msg, std::move(payload)) { }
 };
 
@@ -105,11 +105,11 @@ public:
                         vespalib::stringref location = "", int skipStack = 0);
     PortListenException(int port, vespalib::stringref protocol, const Exception &cause, vespalib::stringref msg = "",
                         vespalib::stringref location = "", int skipStack = 0);
-    PortListenException(PortListenException &&) = default;
-    PortListenException & operator = (PortListenException &&) = default;
+    PortListenException(PortListenException &&) noexcept;
+    PortListenException & operator = (PortListenException &&) noexcept;
     PortListenException(const PortListenException &);
     PortListenException & operator = (const PortListenException &);
-    ~PortListenException();
+    ~PortListenException() override;
     VESPA_DEFINE_EXCEPTION_SPINE(PortListenException);
     int get_port() const { return _port; }
     const vespalib::string &get_protocol() const { return _protocol; }
@@ -130,6 +130,11 @@ public:
 
     IoException(stringref msg, Type type, stringref location, int skipStack = 0);
     IoException(stringref msg, Type type, const Exception& cause, stringref location, int skipStack = 0);
+    IoException(const IoException &);
+    IoException & operator =(const IoException &) = delete;
+    IoException(IoException &&) noexcept;
+    IoException & operator =(IoException &&) noexcept;
+    ~IoException() override;
 
     VESPA_DEFINE_EXCEPTION_SPINE(IoException);
 
@@ -148,8 +153,10 @@ class SilenceUncaughtException : public ExceptionWithPayload::Anything {
 public:
     SilenceUncaughtException(const SilenceUncaughtException &) = delete;
     SilenceUncaughtException & operator = (const SilenceUncaughtException &) = delete;
+    SilenceUncaughtException(SilenceUncaughtException &&) noexcept = delete;
+    SilenceUncaughtException & operator=(SilenceUncaughtException &&) noexcept = delete;
     SilenceUncaughtException(const std::exception & e);
-    ~SilenceUncaughtException();
+    ~SilenceUncaughtException() override;
 private:
     std::terminate_handler _oldTerminate;
 };