Fix three bugs related to the sequence number wrap-around affecting

the processing of ECNE and ASCONF chunks.

Reviewed by: rrs
MFC after: 3 days.

3 files changed, 3 insertions, 3 deletions

diff --git a/sys/netinet/sctp_asconf.c b/sys/netinet/sctp_asconf.c
index 288381de4131..a9d0f37512b1 100644
--- a/sys/netinet/sctp_asconf.c
+++ b/sys/netinet/sctp_asconf.c
@@ -632,7 +632,7 @@ sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 	asoc = &stcb->asoc;
 	serial_num = ntohl(cp->serial_number);
 
-	if (compare_with_wrap(asoc->asconf_seq_in, serial_num, MAX_SEQ) ||
+	if (compare_with_wrap(asoc->asconf_seq_in, serial_num, MAX_TSN) ||
 	    serial_num == asoc->asconf_seq_in) {
 		/* got a duplicate ASCONF */
 		SCTPDBG(SCTP_DEBUG_ASCONF1,
diff --git a/sys/netinet/sctp_input.c b/sys/netinet/sctp_input.c
index 0d9d44fd4697..08b4b6585408 100644
--- a/sys/netinet/sctp_input.c
+++ b/sys/netinet/sctp_input.c
@@ -2944,7 +2944,7 @@ sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
 			net = lchk->whoTo;
 			break;
 		}
-		if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ))
+		if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_TSN))
 			break;
 		lchk = TAILQ_NEXT(lchk, sctp_next);
 	}
diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c
index 4ae66ad02d78..abe124eaffb7 100644
--- a/sys/netinet/sctp_output.c
+++ b/sys/netinet/sctp_output.c
@@ -6477,7 +6477,7 @@ sctp_toss_old_asconf(struct sctp_tcb *stcb)
 		if (chk->rec.chunk_id.id == SCTP_ASCONF) {
 			if (chk->data) {
 				acp = mtod(chk->data, struct sctp_asconf_chunk *);
-				if (compare_with_wrap(ntohl(acp->serial_number), stcb->asoc.asconf_seq_out_acked, MAX_SEQ)) {
+				if (compare_with_wrap(ntohl(acp->serial_number), stcb->asoc.asconf_seq_out_acked, MAX_TSN)) {
 					/* Not Acked yet */
 					break;
 				}