tcp md5: fix accounting for SYN segments with unexpected signature

[tuexen]

Summary

When receiving a SYN segment with an MD5 option on a listening socket, which has not enabled TCP MD5 support, increment the counter for unexpected signatures (tcps_sig_err_sigopt).

Test Plan

Run the following packetdrill script

--ip_version=ipv4
--tcp_md5_secret=secret

// Ensure that all relevant sysctl variables have their default variables.
+0.000 `sysctl -w net.inet.tcp.sack.enable=1`
+0.000 `sysctl -w net.inet.tcp.syncookies_only=0`
+0.000 `sysctl -w net.inet.tcp.syncookies=1`
// Flush host cache.
+0.000 `sysctl -w net.inet.tcp.hostcache.purgenow=1`
// Create a TCP endpoint in the ESTABLISHED state.
+0.000 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0.000 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0.000 bind(3, ..., ...) = 0
+0.000 listen(3, 1) = 0
+0.000 < S    0:0(0)             win 65535 <mss 1460,sackOK,md5 valid>
+1.000 < S    0:0(0)             win 65535 <mss 1460,sackOK,eol,eol>
+0.000 > S.   0:0(0)     ack   1 win 65535 <mss 1460,sackOK,eol,eol>
+0.050 <  .   1:1(0)     ack   1 win 65535
+0.000 accept(3, ..., ...) = 4
+0.000 close(3) = 0
+0.100 < P.   1:101(100) ack   1 win 65535
+0.000 recv(4, ..., 1000, 0) = 100
+0.040 >  .   1:1(0)     ack 101 win 65535
+0.100 < F. 101:101(0)   ack   1 win 65535
+0.000 >  .   1:1(0)     ack 102 win 65535
+0.000 recv(4, ..., 1000, 0) = 0
+0.000 close(4) = 0
+0.000 > F.   1:1(0)     ack 102 win 65535
+0.050 <  . 102:102(0)   ack   2 win 65535

and verify using netstat -sptcp that the tcps_sig_err_sigopt counter is incremented by one.