how not to implement tcp md5sig


FreeBSD
only attach md5 signatures on outgoing packets, do not bother checking those on packets you receive. what for?!?

Cisco
apparently, in IOS, md5 signatures are checked _before_ the regular tcp stuff (sequence number!) - yeah, the cheapest checks last...

Apparently only Juniper and OpenBSD got this right. astounding.