tcp md5: fix accounting of ACK with bad signatures

[tuexen]

Summary

When processing the ACK of the initial TCP handshake using the SYN cookie, don't increment the counter for unexpected signatures(tcps_sig_err_sigopt). The correct counter (tcps_sig_rcvbadsig) for bad signatures is already incremented in TCPMD5_INPUT().

Reported by: Hannes Elfert

Test Plan

Run the following packetdrill-script

--ip_version=ipv4
--tcp_md5_secret=secret

// Enable TCP MD5
 0.000 `kldload -n tcpmd5`
+0.000 `setkey -F`
+0.000 `setkey -e 'add 192.168.0.1 192.0.2.1 tcp 0x1000 -A tcp-md5 "secret" ;'`
+0.000 `setkey -e 'add 192.0.2.1 192.168.0.1 tcp 0x1001 -A tcp-md5 "secret" ;'`
// Ensure that all relevant sysctl variables have their default variables.
+0.000 `sysctl -w net.inet.tcp.sack.enable=1`
+0.000 `sysctl -w net.inet.tcp.syncookies_only=1`
+0.000 `sysctl -w net.inet.tcp.syncookies=1`
// Flush host cache.
+0.000 `sysctl -w net.inet.tcp.hostcache.purgenow=1`
// Create a TCP endpoint in the ESTABLISHED state.
+0.000 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0.000 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
+0.000 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0.000 setsockopt(3, IPPROTO_TCP, TCP_MD5SIG, [1], 4) = 0
+0.000 bind(3, ..., ...) = 0
+0.000 listen(3, 1) = 0
+0.000 < S    0:0(0)             win 65535 <mss 1460,sackOK,md5 valid>
+0.000 > S.   0:0(0)     ack   1 win 65535 <mss 1460,sackOK,md5 valid>
+0.050 <  .   1:1(0)     ack   1 win 65535 <nop, nop, md5 0102030405060708090a0b0c0d0e0f10>
+0.000 accept(3, ..., ...) = -1 EWOULDBLOCK (Operation would block)
+0.000 close(3) = 0

and observe using netstat -sptcp that tcps_sig_rcvbadsig is incremented by one and tcps_sig_err_sigopt does not change.

[rscheff]

LGTM