xnu-4570.71.2.tar.gz

[apple/xnu.git] / bsd / net / pf_table.c

diff --git a/bsd/net/pf_table.c b/bsd/net/pf_table.c
index 8b4bf61c6abd5b223c6abe2693c553c324c64f14..5ccaf0426fe67ef08d619156ad17c2c99c9fb431 100644 (file)
--- a/bsd/net/pf_table.c
+++ b/bsd/net/pf_table.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 Apple Inc. All rights reserved.
+ * Copyright (c) 2007-2010 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
@@ -81,13 +81,13 @@
 
 #define COPYIN(from, to, size, flags)                          \
        ((flags & PFR_FLAG_USERIOCTL) ?                         \
-       copyin(CAST_USER_ADDR_T(from), (to), (size)) :          \
-       (bcopy((from), (to), (size)), 0))
+       copyin((from), (to), (size)) :                          \
+       (bcopy((void *)(uintptr_t)(from), (to), (size)), 0))
 
 #define COPYOUT(from, to, size, flags)                         \
        ((flags & PFR_FLAG_USERIOCTL) ?                         \
-       copyout((from), CAST_USER_ADDR_T(to), (size)) :         \
-       (bcopy((from), (to), (size)), 0))
+       copyout((from), (to), (size)) :                         \
+       (bcopy((from), (void *)(uintptr_t)(to), (size)), 0))
 
 #define        FILLIN_SIN(sin, addr)                   \
        do {                                    \
@@ -135,8 +135,8 @@ struct pfr_walktree {
                PFRW_DYNADDR_UPDATE
        }        pfrw_op;
        union {
-               struct pfr_addr         *pfrw1_addr;
-               struct pfr_astats       *pfrw1_astats;
+               user_addr_t              pfrw1_addr;
+               user_addr_t              pfrw1_astats;
                struct pfr_kentryworkq  *pfrw1_workq;
                struct pfr_kentry       *pfrw1_kentry;
                struct pfi_dynaddr      *pfrw1_dyn;
@@ -176,7 +176,7 @@ static void pfr_insert_kentries(struct pfr_ktable *,
     struct pfr_kentryworkq *, u_int64_t);
 static void pfr_remove_kentries(struct pfr_ktable *, struct pfr_kentryworkq *);
 static void pfr_clstats_kentries(struct pfr_kentryworkq *, u_int64_t, int);
-static void pfr_reset_feedback(struct pfr_addr *, int, int);
+static void pfr_reset_feedback(user_addr_t, int, int);
 static void pfr_prepare_network(union sockaddr_union *, int, int);
 static int pfr_route_kentry(struct pfr_ktable *, struct pfr_kentry *);
 static int pfr_unroute_kentry(struct pfr_ktable *, struct pfr_kentry *);
@@ -264,7 +264,7 @@ pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
 }
 
 int
-pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
+pfr_add_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
     int *nadd, int flags)
 {
        struct pfr_ktable       *kt, *tmpkt;
@@ -272,7 +272,8 @@ pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        struct pfr_kentry       *p, *q;
        struct pfr_addr          ad;
        int                      i, rv, xadd = 0;
-       u_int64_t                tzero = pf_time_second();
+       user_addr_t              addr = _addr;
+       u_int64_t                tzero = pf_calendar_time_second();
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
            PFR_FLAG_FEEDBACK);
@@ -287,8 +288,8 @@ pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        if (tmpkt == NULL)
                return (ENOMEM);
        SLIST_INIT(&workq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(addr+i, &ad, sizeof (ad), flags))
+       for (i = 0; i < size; i++, addr += sizeof (ad)) {
+               if (COPYIN(addr, &ad, sizeof (ad), flags))
                        senderr(EFAULT);
                if (pfr_validate_addr(&ad))
                        senderr(EINVAL);
@@ -318,7 +319,7 @@ pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
                        }
                }
                if (flags & PFR_FLAG_FEEDBACK)
-                       if (COPYOUT(&ad, addr+i, sizeof (ad), flags))
+                       if (COPYOUT(&ad, addr, sizeof (ad), flags))
                                senderr(EFAULT);
        }
        pfr_clean_node_mask(tmpkt, &workq);
@@ -334,19 +335,20 @@ _bad:
        pfr_clean_node_mask(tmpkt, &workq);
        pfr_destroy_kentries(&workq);
        if (flags & PFR_FLAG_FEEDBACK)
-               pfr_reset_feedback(addr, size, flags);
+               pfr_reset_feedback(_addr, size, flags);
        pfr_destroy_ktable(tmpkt, 0);
        return (rv);
 }
 
 int
-pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
+pfr_del_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
     int *ndel, int flags)
 {
        struct pfr_ktable       *kt;
        struct pfr_kentryworkq   workq;
        struct pfr_kentry       *p;
        struct pfr_addr          ad;
+       user_addr_t              addr = _addr;
        int                      i, rv, xdel = 0, log = 1;
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
@@ -376,8 +378,8 @@ pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
                pfr_mark_addrs(kt);
        } else {
                /* iterate over addresses to delete */
-               for (i = 0; i < size; i++) {
-                       if (COPYIN(addr+i, &ad, sizeof (ad), flags))
+               for (i = 0; i < size; i++, addr += sizeof (ad)) {
+                       if (COPYIN(addr, &ad, sizeof (ad), flags))
                                return (EFAULT);
                        if (pfr_validate_addr(&ad))
                                return (EINVAL);
@@ -387,8 +389,8 @@ pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
                }
        }
        SLIST_INIT(&workq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(addr+i, &ad, sizeof (ad), flags))
+       for (addr = _addr, i = 0; i < size; i++, addr += sizeof (ad)) {
+               if (COPYIN(addr, &ad, sizeof (ad), flags))
                        senderr(EFAULT);
                if (pfr_validate_addr(&ad))
                        senderr(EINVAL);
@@ -410,7 +412,7 @@ pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
                        xdel++;
                }
                if (flags & PFR_FLAG_FEEDBACK)
-                       if (COPYOUT(&ad, addr+i, sizeof (ad), flags))
+                       if (COPYOUT(&ad, addr, sizeof (ad), flags))
                                senderr(EFAULT);
        }
        if (!(flags & PFR_FLAG_DUMMY)) {
@@ -421,12 +423,12 @@ pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        return (0);
 _bad:
        if (flags & PFR_FLAG_FEEDBACK)
-               pfr_reset_feedback(addr, size, flags);
+               pfr_reset_feedback(_addr, size, flags);
        return (rv);
 }
 
 int
-pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
+pfr_set_addrs(struct pfr_table *tbl, user_addr_t _addr, int size,
     int *size2, int *nadd, int *ndel, int *nchange, int flags,
     u_int32_t ignore_pfrt_flags)
 {
@@ -434,8 +436,9 @@ pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        struct pfr_kentryworkq   addq, delq, changeq;
        struct pfr_kentry       *p, *q;
        struct pfr_addr          ad;
+       user_addr_t              addr = _addr;
        int                      i, rv, xadd = 0, xdel = 0, xchange = 0;
-       u_int64_t                tzero = pf_time_second();
+       u_int64_t                tzero = pf_calendar_time_second();
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
            PFR_FLAG_FEEDBACK);
@@ -454,8 +457,8 @@ pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        SLIST_INIT(&addq);
        SLIST_INIT(&delq);
        SLIST_INIT(&changeq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(addr+i, &ad, sizeof (ad), flags))
+       for (i = 0; i < size; i++, addr += sizeof (ad)) {
+               if (COPYIN(addr, &ad, sizeof (ad), flags))
                        senderr(EFAULT);
                if (pfr_validate_addr(&ad))
                        senderr(EINVAL);
@@ -493,7 +496,7 @@ pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
                }
 _skip:
                if (flags & PFR_FLAG_FEEDBACK)
-                       if (COPYOUT(&ad, addr+i, sizeof (ad), flags))
+                       if (COPYOUT(&ad, addr, sizeof (ad), flags))
                                senderr(EFAULT);
        }
        pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
@@ -503,11 +506,13 @@ _skip:
                        senderr(0);
                }
                i = 0;
+               addr = _addr + size;
                SLIST_FOREACH(p, &delq, pfrke_workq) {
                        pfr_copyout_addr(&ad, p);
                        ad.pfra_fback = PFR_FB_DELETED;
-                       if (COPYOUT(&ad, addr+size+i, sizeof (ad), flags))
+                       if (COPYOUT(&ad, addr, sizeof (ad), flags))
                                senderr(EFAULT);
+                       addr += sizeof (ad);
                        i++;
                }
        }
@@ -532,13 +537,13 @@ _bad:
        pfr_clean_node_mask(tmpkt, &addq);
        pfr_destroy_kentries(&addq);
        if (flags & PFR_FLAG_FEEDBACK)
-               pfr_reset_feedback(addr, size, flags);
+               pfr_reset_feedback(_addr, size, flags);
        pfr_destroy_ktable(tmpkt, 0);
        return (rv);
 }
 
 int
-pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
+pfr_tst_addrs(struct pfr_table *tbl, user_addr_t addr, int size,
        int *nmatch, int flags)
 {
        struct pfr_ktable       *kt;
@@ -553,8 +558,8 @@ pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
                return (ESRCH);
 
-       for (i = 0; i < size; i++) {
-               if (COPYIN(addr+i, &ad, sizeof (ad), flags))
+       for (i = 0; i < size; i++, addr += sizeof (ad)) {
+               if (COPYIN(addr, &ad, sizeof (ad), flags))
                        return (EFAULT);
                if (pfr_validate_addr(&ad))
                        return (EINVAL);
@@ -567,7 +572,7 @@ pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
                    (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
                if (p != NULL && !p->pfrke_not)
                        xmatch++;
-               if (COPYOUT(&ad, addr+i, sizeof (ad), flags))
+               if (COPYOUT(&ad, addr, sizeof (ad), flags))
                        return (EFAULT);
        }
        if (nmatch != NULL)
@@ -576,7 +581,7 @@ pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 }
 
 int
-pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
+pfr_get_addrs(struct pfr_table *tbl, user_addr_t addr, int *size,
        int flags)
 {
        struct pfr_ktable       *kt;
@@ -616,14 +621,14 @@ pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
 }
 
 int
-pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
+pfr_get_astats(struct pfr_table *tbl, user_addr_t addr, int *size,
        int flags)
 {
        struct pfr_ktable       *kt;
        struct pfr_walktree      w;
        struct pfr_kentryworkq   workq;
        int                      rv;
-       u_int64_t                tzero = pf_time_second();
+       u_int64_t                tzero = pf_calendar_time_second();
 
        /* XXX PFR_FLAG_CLSTATS disabled */
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC);
@@ -663,13 +668,14 @@ pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
 }
 
 int
-pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
+pfr_clr_astats(struct pfr_table *tbl, user_addr_t _addr, int size,
     int *nzero, int flags)
 {
        struct pfr_ktable       *kt;
        struct pfr_kentryworkq   workq;
        struct pfr_kentry       *p;
        struct pfr_addr          ad;
+       user_addr_t              addr = _addr;
        int                      i, rv, xzero = 0;
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
@@ -680,8 +686,8 @@ pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
                return (ESRCH);
        SLIST_INIT(&workq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(addr+i, &ad, sizeof (ad), flags))
+       for (i = 0; i < size; i++, addr += sizeof (ad)) {
+               if (COPYIN(addr, &ad, sizeof (ad), flags))
                        senderr(EFAULT);
                if (pfr_validate_addr(&ad))
                        senderr(EINVAL);
@@ -689,7 +695,7 @@ pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
                if (flags & PFR_FLAG_FEEDBACK) {
                        ad.pfra_fback = (p != NULL) ?
                            PFR_FB_CLEARED : PFR_FB_NONE;
-                       if (COPYOUT(&ad, addr+i, sizeof (ad), flags))
+                       if (COPYOUT(&ad, addr, sizeof (ad), flags))
                                senderr(EFAULT);
                }
                if (p != NULL) {
@@ -706,11 +712,11 @@ pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        return (0);
 _bad:
        if (flags & PFR_FLAG_FEEDBACK)
-               pfr_reset_feedback(addr, size, flags);
+               pfr_reset_feedback(_addr, size, flags);
        return (rv);
 }
 
-int
+static int
 pfr_validate_addr(struct pfr_addr *ad)
 {
        int i;
@@ -744,7 +750,7 @@ pfr_validate_addr(struct pfr_addr *ad)
        return (0);
 }
 
-void
+static void
 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
        int *naddr, int sweep)
 {
@@ -766,7 +772,7 @@ pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
                *naddr = w.pfrw_cnt;
 }
 
-void
+static void
 pfr_mark_addrs(struct pfr_ktable *kt)
 {
        struct pfr_walktree     w;
@@ -780,14 +786,14 @@ pfr_mark_addrs(struct pfr_ktable *kt)
 }
 
 
-struct pfr_kentry *
+static struct pfr_kentry *
 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
 {
        union sockaddr_union     sa, mask;
        struct radix_node_head  *head;
        struct pfr_kentry       *ke;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        bzero(&sa, sizeof (sa));
        if (ad->pfra_af == AF_INET) {
@@ -814,7 +820,7 @@ pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
        return (ke);
 }
 
-struct pfr_kentry *
+static struct pfr_kentry *
 pfr_create_kentry(struct pfr_addr *ad, int intr)
 {
        struct pfr_kentry       *ke;
@@ -838,7 +844,7 @@ pfr_create_kentry(struct pfr_addr *ad, int intr)
        return (ke);
 }
 
-void
+static void
 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
 {
        struct pfr_kentry       *p, *q;
@@ -849,7 +855,7 @@ pfr_destroy_kentries(struct pfr_kentryworkq *workq)
        }
 }
 
-void
+static void
 pfr_destroy_kentry(struct pfr_kentry *ke)
 {
        if (ke->pfrke_intrpool)
@@ -858,7 +864,7 @@ pfr_destroy_kentry(struct pfr_kentry *ke)
                pool_put(&pfr_kentry_pl, ke);
 }
 
-void
+static void
 pfr_insert_kentries(struct pfr_ktable *kt,
     struct pfr_kentryworkq *workq, u_int64_t tzero)
 {
@@ -901,7 +907,7 @@ pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, u_int64_t tzero)
        return (0);
 }
 
-void
+static void
 pfr_remove_kentries(struct pfr_ktable *kt,
     struct pfr_kentryworkq *workq)
 {
@@ -916,7 +922,7 @@ pfr_remove_kentries(struct pfr_ktable *kt,
        pfr_destroy_kentries(workq);
 }
 
-void
+static void
 pfr_clean_node_mask(struct pfr_ktable *kt,
     struct pfr_kentryworkq *workq)
 {
@@ -926,13 +932,13 @@ pfr_clean_node_mask(struct pfr_ktable *kt,
                pfr_unroute_kentry(kt, p);
 }
 
-void
+static void
 pfr_clstats_kentries(struct pfr_kentryworkq *workq, u_int64_t tzero,
     int negchange)
 {
        struct pfr_kentry       *p;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        SLIST_FOREACH(p, workq, pfrke_workq) {
                if (negchange)
@@ -943,22 +949,22 @@ pfr_clstats_kentries(struct pfr_kentryworkq *workq, u_int64_t tzero,
        }
 }
 
-void
-pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
+static void
+pfr_reset_feedback(user_addr_t addr, int size, int flags)
 {
        struct pfr_addr ad;
        int             i;
 
-       for (i = 0; i < size; i++) {
-               if (COPYIN(addr+i, &ad, sizeof (ad), flags))
+       for (i = 0; i < size; i++, addr += sizeof (ad)) {
+               if (COPYIN(addr, &ad, sizeof (ad), flags))
                        break;
                ad.pfra_fback = PFR_FB_NONE;
-               if (COPYOUT(&ad, addr+i, sizeof (ad), flags))
+               if (COPYOUT(&ad, addr, sizeof (ad), flags))
                        break;
        }
 }
 
-void
+static void
 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
 {
        int     i;
@@ -983,14 +989,14 @@ pfr_prepare_network(union sockaddr_union *sa, int af, int net)
        }
 }
 
-int
+static int
 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 {
        union sockaddr_union     mask;
        struct radix_node       *rn;
        struct radix_node_head  *head;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        bzero(ke->pfrke_node, sizeof (ke->pfrke_node));
        if (ke->pfrke_af == AF_INET)
@@ -1009,14 +1015,14 @@ pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
        return (rn == NULL ? -1 : 0);
 }
 
-int
+static int
 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
 {
        union sockaddr_union     mask;
        struct radix_node       *rn;
        struct radix_node_head  *head;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (ke->pfrke_af == AF_INET)
                head = kt->pfrkt_ip4;
@@ -1038,7 +1044,7 @@ pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
        return (0);
 }
 
-void
+static void
 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
 {
        bzero(ad, sizeof (*ad));
@@ -1053,14 +1059,14 @@ pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
                ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
 }
 
-int
+static int
 pfr_walktree(struct radix_node *rn, void *arg)
 {
        struct pfr_kentry       *ke = (struct pfr_kentry *)rn;
        struct pfr_walktree     *w = arg;
        int                      flags = w->pfrw_flags;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        switch (w->pfrw_op) {
        case PFRW_MARK:
@@ -1079,11 +1085,9 @@ pfr_walktree(struct radix_node *rn, void *arg)
                        struct pfr_addr ad;
 
                        pfr_copyout_addr(&ad, ke);
-                       if (copyout(&ad,
-                           CAST_USER_ADDR_T(w->pfrw_addr),
-                           sizeof (ad)))
+                       if (copyout(&ad, w->pfrw_addr, sizeof (ad)))
                                return (EFAULT);
-                       w->pfrw_addr++;
+                       w->pfrw_addr += sizeof (ad);
                }
                break;
        case PFRW_GET_ASTATS:
@@ -1092,6 +1096,11 @@ pfr_walktree(struct radix_node *rn, void *arg)
 
                        pfr_copyout_addr(&as.pfras_a, ke);
 
+#if !defined(__LP64__)
+                       /* Initialized to avoid potential info leak to
+                        * userspace */
+                       as._pad = 0;
+#endif
                        bcopy(ke->pfrke_packets, as.pfras_packets,
                            sizeof (as.pfras_packets));
                        bcopy(ke->pfrke_bytes, as.pfras_bytes,
@@ -1100,7 +1109,7 @@ pfr_walktree(struct radix_node *rn, void *arg)
 
                        if (COPYOUT(&as, w->pfrw_astats, sizeof (as), flags))
                                return (EFAULT);
-                       w->pfrw_astats++;
+                       w->pfrw_astats += sizeof (as);
                }
                break;
        case PFRW_POOL_GET:
@@ -1141,7 +1150,7 @@ pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
        struct pfr_ktable       *p;
        int                      xdel = 0;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
            PFR_FLAG_ALLRSETS);
@@ -1171,21 +1180,22 @@ pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
 }
 
 int
-pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
+pfr_add_tables(user_addr_t tbl, int size, int *nadd, int flags)
 {
        struct pfr_ktableworkq   addq, changeq;
        struct pfr_ktable       *p, *q, *r, key;
        int                      i, rv, xadd = 0;
-       u_int64_t                tzero = pf_time_second();
+       u_int64_t                tzero = pf_calendar_time_second();
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
        SLIST_INIT(&addq);
        SLIST_INIT(&changeq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(tbl+i, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
+       for (i = 0; i < size; i++, tbl += sizeof (key.pfrkt_t)) {
+               if (COPYIN(tbl, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
                        senderr(EFAULT);
+               pfr_table_copyin_cleanup(&key.pfrkt_t);
                if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
                    flags & PFR_FLAG_USERIOCTL))
                        senderr(EINVAL);
@@ -1249,19 +1259,20 @@ _bad:
 }
 
 int
-pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
+pfr_del_tables(user_addr_t tbl, int size, int *ndel, int flags)
 {
        struct pfr_ktableworkq   workq;
        struct pfr_ktable       *p, *q, key;
        int                      i, xdel = 0;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
        SLIST_INIT(&workq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(tbl+i, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
+       for (i = 0; i < size; i++, tbl += sizeof (key.pfrkt_t)) {
+               if (COPYIN(tbl, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
                        return (EFAULT);
+               pfr_table_copyin_cleanup(&key.pfrkt_t);
                if (pfr_validate_table(&key.pfrkt_t, 0,
                    flags & PFR_FLAG_USERIOCTL))
                        return (EINVAL);
@@ -1287,7 +1298,7 @@ _skip:
 }
 
 int
-pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
+pfr_get_tables(struct pfr_table *filter, user_addr_t tbl, int *size,
        int flags)
 {
        struct pfr_ktable       *p;
@@ -1308,8 +1319,9 @@ pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
                        continue;
                if (n-- <= 0)
                        continue;
-               if (COPYOUT(&p->pfrkt_t, tbl++, sizeof (*tbl), flags))
+               if (COPYOUT(&p->pfrkt_t, tbl, sizeof (p->pfrkt_t), flags))
                        return (EFAULT);
+               tbl += sizeof (p->pfrkt_t);
        }
        if (n) {
                printf("pfr_get_tables: corruption detected (%d).\n", n);
@@ -1320,15 +1332,15 @@ pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
 }
 
 int
-pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
+pfr_get_tstats(struct pfr_table *filter, user_addr_t tbl, int *size,
        int flags)
 {
        struct pfr_ktable       *p;
        struct pfr_ktableworkq   workq;
        int                      n, nn;
-       u_int64_t                tzero = pf_time_second();
+       u_int64_t                tzero = pf_calendar_time_second();
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        /* XXX PFR_FLAG_CLSTATS disabled */
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_ALLRSETS);
@@ -1347,9 +1359,10 @@ pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
                        continue;
                if (n-- <= 0)
                        continue;
-               if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof (*tbl), flags)) {
+               if (COPYOUT(&p->pfrkt_ts, tbl, sizeof (p->pfrkt_ts), flags)) {
                        return (EFAULT);
                }
+               tbl += sizeof (p->pfrkt_ts);
                SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
        }
        if (flags & PFR_FLAG_CLSTATS)
@@ -1364,21 +1377,22 @@ pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
 }
 
 int
-pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
+pfr_clr_tstats(user_addr_t tbl, int size, int *nzero, int flags)
 {
        struct pfr_ktableworkq   workq;
        struct pfr_ktable       *p, key;
        int                      i, xzero = 0;
-       u_int64_t                tzero = pf_time_second();
+       u_int64_t                tzero = pf_calendar_time_second();
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
            PFR_FLAG_ADDRSTOO);
        SLIST_INIT(&workq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(tbl+i, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
+       for (i = 0; i < size; i++, tbl += sizeof (key.pfrkt_t)) {
+               if (COPYIN(tbl, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
                        return (EFAULT);
+               pfr_table_copyin_cleanup(&key.pfrkt_t);
                if (pfr_validate_table(&key.pfrkt_t, 0, 0))
                        return (EINVAL);
                p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
@@ -1396,14 +1410,14 @@ pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
 }
 
 int
-pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
+pfr_set_tflags(user_addr_t tbl, int size, int setflag, int clrflag,
        int *nchange, int *ndel, int flags)
 {
        struct pfr_ktableworkq   workq;
        struct pfr_ktable       *p, *q, key;
        int                      i, xchange = 0, xdel = 0;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
        if ((setflag & ~PFR_TFLAG_USRMASK) ||
@@ -1411,9 +1425,10 @@ pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
            (setflag & clrflag))
                return (EINVAL);
        SLIST_INIT(&workq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(tbl+i, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
+       for (i = 0; i < size; i++, tbl += sizeof (key.pfrkt_t)) {
+               if (COPYIN(tbl, &key.pfrkt_t, sizeof (key.pfrkt_t), flags))
                        return (EFAULT);
+               pfr_table_copyin_cleanup(&key.pfrkt_t);
                if (pfr_validate_table(&key.pfrkt_t, 0,
                    flags & PFR_FLAG_USERIOCTL))
                        return (EINVAL);
@@ -1455,7 +1470,7 @@ pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
        struct pf_ruleset       *rs;
        int                      xdel = 0;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
        rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
@@ -1483,7 +1498,7 @@ pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
 }
 
 int
-pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
+pfr_ina_define(struct pfr_table *tbl, user_addr_t addr, int size,
     int *nadd, int *naddr, u_int32_t ticket, int flags)
 {
        struct pfr_ktableworkq   tableq;
@@ -1494,7 +1509,7 @@ pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
        struct pf_ruleset       *rs;
        int                      i, rv, xadd = 0, xaddr = 0;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
        if (size && !(flags & PFR_FLAG_ADDRSTOO))
@@ -1507,7 +1522,7 @@ pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
                return (EBUSY);
        tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
        SLIST_INIT(&tableq);
-       kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
+       kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)(void *)tbl);
        if (kt == NULL) {
                kt = pfr_create_ktable(tbl, 0, 1);
                if (kt == NULL)
@@ -1542,8 +1557,8 @@ _skip:
                return (ENOMEM);
        }
        SLIST_INIT(&addrq);
-       for (i = 0; i < size; i++) {
-               if (COPYIN(addr+i, &ad, sizeof (ad), flags))
+       for (i = 0; i < size; i++, addr += sizeof (ad)) {
+               if (COPYIN(addr, &ad, sizeof (ad), flags))
                        senderr(EFAULT);
                if (pfr_validate_addr(&ad))
                        senderr(EINVAL);
@@ -1593,7 +1608,7 @@ pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
        struct pf_ruleset       *rs;
        int                      xdel = 0;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
        rs = pf_find_ruleset(trs->pfrt_anchor);
@@ -1626,9 +1641,9 @@ pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
        struct pfr_ktableworkq   workq;
        struct pf_ruleset       *rs;
        int                      xadd = 0, xchange = 0;
-       u_int64_t                tzero = pf_time_second();
+       u_int64_t                tzero = pf_calendar_time_second();
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
        rs = pf_find_ruleset(trs->pfrt_anchor);
@@ -1663,13 +1678,13 @@ pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
        return (0);
 }
 
-void
+static void
 pfr_commit_ktable(struct pfr_ktable *kt, u_int64_t tzero)
 {
        struct pfr_ktable       *shadow = kt->pfrkt_shadow;
        int                      nflags;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (shadow->pfrkt_cnt == NO_ADDRESSES) {
                if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
@@ -1724,7 +1739,14 @@ pfr_commit_ktable(struct pfr_ktable *kt, u_int64_t tzero)
        pfr_setflags_ktable(kt, nflags);
 }
 
-int
+void
+pfr_table_copyin_cleanup(struct pfr_table *tbl)
+{
+       tbl->pfrt_anchor[sizeof (tbl->pfrt_anchor) - 1] = '\0';
+       tbl->pfrt_name[sizeof (tbl->pfrt_name) - 1] = '\0';
+}
+
+static int
 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
 {
        int i;
@@ -1749,7 +1771,7 @@ pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
  * Rewrite anchors referenced by tables to remove slashes
  * and check for validity.
  */
-int
+static int
 pfr_fix_anchor(char *anchor)
 {
        size_t siz = MAXPATHLEN;
@@ -1774,7 +1796,7 @@ pfr_fix_anchor(char *anchor)
        return (0);
 }
 
-int
+static int
 pfr_table_count(struct pfr_table *filter, int flags)
 {
        struct pf_ruleset *rs;
@@ -1788,7 +1810,7 @@ pfr_table_count(struct pfr_table *filter, int flags)
        return (pf_main_ruleset.tables);
 }
 
-int
+static int
 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
 {
        if (flags & PFR_FLAG_ALLRSETS)
@@ -1798,21 +1820,21 @@ pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
        return (0);
 }
 
-void
+static void
 pfr_insert_ktables(struct pfr_ktableworkq *workq)
 {
        struct pfr_ktable       *p;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        SLIST_FOREACH(p, workq, pfrkt_workq)
                pfr_insert_ktable(p);
 }
 
-void
+static void
 pfr_insert_ktable(struct pfr_ktable *kt)
 {
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
        pfr_ktable_cnt++;
@@ -1822,12 +1844,12 @@ pfr_insert_ktable(struct pfr_ktable *kt)
                            kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
 }
 
-void
+static void
 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
 {
        struct pfr_ktable       *p, *q;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        for (p = SLIST_FIRST(workq); p; p = q) {
                q = SLIST_NEXT(p, pfrkt_workq);
@@ -1835,12 +1857,12 @@ pfr_setflags_ktables(struct pfr_ktableworkq *workq)
        }
 }
 
-void
+static void
 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
 {
        struct pfr_kentryworkq  addrq;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (!(newf & PFR_TFLAG_REFERENCED) &&
            !(newf & PFR_TFLAG_PERSIST))
@@ -1869,23 +1891,23 @@ pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
        kt->pfrkt_flags = newf;
 }
 
-void
+static void
 pfr_clstats_ktables(struct pfr_ktableworkq *workq, u_int64_t tzero, int recurse)
 {
        struct pfr_ktable       *p;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        SLIST_FOREACH(p, workq, pfrkt_workq)
                pfr_clstats_ktable(p, tzero, recurse);
 }
 
-void
+static void
 pfr_clstats_ktable(struct pfr_ktable *kt, u_int64_t tzero, int recurse)
 {
        struct pfr_kentryworkq   addrq;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (recurse) {
                pfr_enqueue_addrs(kt, &addrq, NULL, 0);
@@ -1897,13 +1919,13 @@ pfr_clstats_ktable(struct pfr_ktable *kt, u_int64_t tzero, int recurse)
        kt->pfrkt_tzero = tzero;
 }
 
-struct pfr_ktable *
+static struct pfr_ktable *
 pfr_create_ktable(struct pfr_table *tbl, u_int64_t tzero, int attachruleset)
 {
        struct pfr_ktable       *kt;
        struct pf_ruleset       *rs;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        kt = pool_get(&pfr_ktable_pl, PR_WAITOK);
        if (kt == NULL)
@@ -1933,12 +1955,12 @@ pfr_create_ktable(struct pfr_table *tbl, u_int64_t tzero, int attachruleset)
        return (kt);
 }
 
-void
+static void
 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
 {
        struct pfr_ktable       *p, *q;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        for (p = SLIST_FIRST(workq); p; p = q) {
                q = SLIST_NEXT(p, pfrkt_workq);
@@ -1946,12 +1968,12 @@ pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
        }
 }
 
-void
+static void
 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
 {
        struct pfr_kentryworkq   addrq;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (flushaddr) {
                pfr_enqueue_addrs(kt, &addrq, NULL, 0);
@@ -1971,7 +1993,7 @@ pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
        pool_put(&pfr_ktable_pl, kt);
 }
 
-int
+static int
 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
 {
        int d;
@@ -1981,14 +2003,14 @@ pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
        return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
 }
 
-struct pfr_ktable *
+static struct pfr_ktable *
 pfr_lookup_table(struct pfr_table *tbl)
 {
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        /* struct pfr_ktable start like a struct pfr_table */
        return (RB_FIND(pfr_ktablehead, &pfr_ktables,
-           (struct pfr_ktable *)tbl));
+           (struct pfr_ktable *)(void *)tbl));
 }
 
 int
@@ -1997,7 +2019,7 @@ pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
        struct pfr_kentry       *ke = NULL;
        int                      match;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
                kt = kt->pfrkt_root;
@@ -2036,7 +2058,7 @@ pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
 {
        struct pfr_kentry       *ke = NULL;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
                kt = kt->pfrkt_root;
@@ -2083,7 +2105,7 @@ pfr_attach_table(struct pf_ruleset *rs, char *name)
        struct pfr_table         tbl;
        struct pf_anchor        *ac = rs->anchor;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        bzero(&tbl, sizeof (tbl));
        strlcpy(tbl.pfrt_name, name, sizeof (tbl.pfrt_name));
@@ -2091,7 +2113,7 @@ pfr_attach_table(struct pf_ruleset *rs, char *name)
                strlcpy(tbl.pfrt_anchor, ac->path, sizeof (tbl.pfrt_anchor));
        kt = pfr_lookup_table(&tbl);
        if (kt == NULL) {
-               kt = pfr_create_ktable(&tbl, pf_time_second(), 1);
+               kt = pfr_create_ktable(&tbl, pf_calendar_time_second(), 1);
                if (kt == NULL)
                        return (NULL);
                if (ac != NULL) {
@@ -2117,7 +2139,7 @@ pfr_attach_table(struct pf_ruleset *rs, char *name)
 void
 pfr_detach_table(struct pfr_ktable *kt)
 {
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
                printf("pfr_detach_table: refcount = %d.\n",
@@ -2135,7 +2157,7 @@ pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
        union sockaddr_union     mask;
        int                      idx = -1, use_counter = 0;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        if (af == AF_INET)
                addr = (struct pf_addr *)&pfr_sin.sin_addr;
@@ -2220,12 +2242,12 @@ _next_block:
        }
 }
 
-struct pfr_kentry *
+static struct pfr_kentry *
 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
 {
        struct pfr_walktree     w;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        bzero(&w, sizeof (w));
        w.pfrw_op = PFRW_POOL_GET;
@@ -2254,7 +2276,7 @@ pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
 {
        struct pfr_walktree     w;
 
-       lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
+       LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
 
        bzero(&w, sizeof (w));
        w.pfrw_op = PFRW_DYNADDR_UPDATE;