Index: sys/netinet/tcp_timewait.c
===================================================================
--- sys/netinet/tcp_timewait.c
+++ sys/netinet/tcp_timewait.c
@@ -36,6 +36,7 @@
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
+#include "opt_ipsec.h"
 #include "opt_tcpdebug.h"
 
 #include <sys/param.h>
@@ -96,10 +97,14 @@
 
 #include <netinet/udp.h>
 #include <netinet/udp_var.h>
+
+#include <netipsec/ipsec_support.h>
+
 #include <machine/in_cksum.h>
 
 #include <security/mac/mac_framework.h>
 
+
 VNET_DEFINE_STATIC(uma_zone_t, tcptw_zone);
 #define	V_tcptw_zone		VNET(tcptw_zone)
 static int	maxtcptw;
@@ -328,6 +333,7 @@
 	tw->irs     = tp->irs;
 	tw->t_starttime = tp->t_starttime;
 	tw->tw_time = 0;
+	tw->tw_flags = tp->t_flags;
 
 /* XXX
  * If this code will
@@ -669,6 +675,10 @@
 		to.to_tsval = tcp_ts_getticks() + tw->ts_offset;
 		to.to_tsecr = tw->t_recent;
 	}
+#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
+	if (tw->tw_flags & TF_SIGNATURE)
+		to.to_flags |= TOF_SIGNATURE;
+#endif
 	optlen = tcp_addoptions(&to, (u_char *)(th + 1));
 
 	if (udp) {
@@ -686,6 +696,13 @@
 	th->th_flags = flags;
 	th->th_win = htons(tw->last_win);
 
+#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
+	if (tw->tw_flags & TF_SIGNATURE) {
+		if (!TCPMD5_ENABLED() ||
+		    TCPMD5_OUTPUT(m, th, to.to_signature) != 0)
+			return (-1);
+	}
+#endif
 #ifdef INET6
 	if (isipv6) {
 		if (tw->t_port) {
Index: sys/netinet/tcp_var.h
===================================================================
--- sys/netinet/tcp_var.h
+++ sys/netinet/tcp_var.h
@@ -539,7 +539,7 @@
 	int		tw_time;
 	TAILQ_ENTRY(tcptw) tw_2msl;
 	void		*tw_pspare;	/* TCP_SIGNATURE */
-	u_int		*tw_spare;	/* TCP_SIGNATURE */
+	u_int		tw_flags;	/* tcpcb t_flags */
 };
 
 #define	intotcpcb(ip)	((struct tcpcb *)(ip)->inp_ppcb)