Publish todays advisories.

Approved by:	so

share/security/patches/SA-16:05/tcp.patch

@@ -0,0 +1,37 @@
+--- sys/netinet/tcp_output.c.orig
++++ sys/netinet/tcp_output.c
+@@ -752,8 +752,8 @@
+ 	 * segments.  Options for SYN-ACK segments are handled in TCP
+ 	 * syncache.
+ 	 */
++	to.to_flags = 0;
+ 	if ((tp->t_flags & TF_NOOPT) == 0) {
+-		to.to_flags = 0;
+ 		/* Maximum segment size. */
+ 		if (flags & TH_SYN) {
+ 			tp->snd_nxt = tp->iss;
+@@ -1233,7 +1233,7 @@
+ 		tp->snd_up = tp->snd_una;		/* drag it along */
+ 
+ #ifdef TCP_SIGNATURE
+-	if (tp->t_flags & TF_SIGNATURE) {
++	if (to.to_flags & TOF_SIGNATURE) {
+ 		int sigoff = to.to_signature - opt;
+ 		tcp_signature_compute(m, 0, len, optlen,
+ 		    (u_char *)(th + 1) + sigoff, IPSEC_DIR_OUTBOUND);
+@@ -1713,6 +1713,7 @@
+ 			bcopy((u_char *)&to->to_tsecr, optp, sizeof(to->to_tsecr));
+ 			optp += sizeof(to->to_tsecr);
+ 			break;
++#ifdef TCP_SIGNATURE
+ 		case TOF_SIGNATURE:
+ 			{
+ 			int siglen = TCPOLEN_SIGNATURE - 2;
+@@ -1731,6 +1732,7 @@
+ 				 *optp++ = 0;
+ 			break;
+ 			}
++#endif
+ 		case TOF_SACK:
+ 			{
+ 			int sackblks = 0;