Commit 24c70db4b9 for strongswan.org

commit 24c70db4b912636d086a6aacf428edd77537e867
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Fri Jul 10 07:51:10 2026 +0200

    aesni: Split plugin to avoid potential SIGILL

    Because the CFLAGS applied to the whole plugin, the compiler could
    "optimize" the boilerplate plugin code, which could then cause a SIGILL
    on hardware that doesn't support such instructions.  This change makes
    sure only the actual AES implementation is compiled like that, which
    would then not get registered depending on the CPU feature detection.

diff --git a/src/libstrongswan/plugins/aesni/Makefile.am b/src/libstrongswan/plugins/aesni/Makefile.am
index 0faf90f62d..51450bebe8 100644
--- a/src/libstrongswan/plugins/aesni/Makefile.am
+++ b/src/libstrongswan/plugins/aesni/Makefile.am
@@ -2,18 +2,10 @@ AM_CPPFLAGS = \
 	-I$(top_srcdir)/src/libstrongswan

 AM_CFLAGS = \
-	-maes \
-	-mpclmul \
-	-mssse3 \
 	$(PLUGIN_CFLAGS)

-if MONOLITHIC
-noinst_LTLIBRARIES = libstrongswan-aesni.la
-else
-plugin_LTLIBRARIES = libstrongswan-aesni.la
-endif
-
-libstrongswan_aesni_la_SOURCES = \
+noinst_LTLIBRARIES = libaesni.la
+libaesni_la_SOURCES = \
 	aesni_key.h aesni_key.c \
 	aesni_cbc.h aesni_cbc.c \
 	aesni_ecb.h aesni_ecb.c \
@@ -21,7 +13,21 @@ libstrongswan_aesni_la_SOURCES = \
 	aesni_ccm.h aesni_ccm.c \
 	aesni_gcm.h aesni_gcm.c \
 	aesni_xcbc.h aesni_xcbc.c \
-	aesni_cmac.h aesni_cmac.c \
+	aesni_cmac.h aesni_cmac.c
+
+libaesni_la_CFLAGS = \
+	-maes \
+	-mpclmul \
+	-mssse3
+
+if MONOLITHIC
+noinst_LTLIBRARIES += libstrongswan-aesni.la
+else
+plugin_LTLIBRARIES = libstrongswan-aesni.la
+endif
+
+libstrongswan_aesni_la_SOURCES = \
 	aesni_plugin.h aesni_plugin.c

 libstrongswan_aesni_la_LDFLAGS = -module -avoid-version
+libstrongswan_aesni_la_LIBADD = libaesni.la