[Pkg-swan-devel] Bug#1141732: libstrongswan-aesni.so SIGILL crash in both charon and swanctl

[Tobias Brunner]

Hi,

>>> on systems lacking AES-NI support critical strongswan processes (charon,
>>> swanctl) get terminated by SIGILL in libstrongswan-aesni.so.
>>
>> The plugin definitely checks for AES-NI and PCLMULQDQ at runtime.  But
>> what it did not do so far is check for SSSE3 (the next release will do
>> so).  So are you running on a CPU that has AES-NI and PCLMULQDQ
>> instructions but lacks support for SSSE3?  Maybe virtualized?
>  
> No, it is a real i686 CPU. No SSE and definitely no AES-NI.

What CPU is that (/proc/cpuinfo could be helpful)?

>> It's loaded but it doesn't register any plugin features if the required
>> CPU features are not found.  So it shouldn't cause any SIGILL when
>> running on unsuitable hardware (except in the combination mentioned above).
> 
> Then it must be something else, even before it tries to encrypt anything.
> Yes, even swanctl --help crashes with SIGILL when swanctl.load="aesni".

So maybe it's the feature detection that runs when the plugin is loaded.
 But that's some simple push/pop/mov and cpuid assembler code [1].  Does
your CPU lack support for cpuid?

Regards,
Tobias

[1]
https://github.com/strongswan/strongswan/blob/master/src/libstrongswan/utils/cpu_feature.c#L57-L61