Building ruby with rbenv and ruby-build fails with undefined symbol: SSLv2_method

Question

I'm trying to install ruby 2.2.4 or 2.3.0 on my Synology DS215j which has an ARMv7 processor. I used optware-ng to install gcc, make, openssl, openssl-dev and zlib. I installed rbenv (version 1.0.0-19-g29b4da7) and the ruby-build plugin according to the instructions in the README.

These are the package and their versions installed with optware-ng

binutils - 2.25.1-1
gcc - 5.3.0-6
gconv-modules - 2.21-3
glibc-opt - 2.21-4
libc-dev - 2.21-1
libgmp - 6.0.0a-1
libmpc - 1.0.2-1
libmpfr - 3.1.3-1
libnsl - 2.21-3
libstdc++ - 6.0.21-6
make - 4.1-1
ncurses - 5.7-4
openssl - 1.0.2f-1
openssl-dev - 1.0.2f-1
readline - 6.1-2
ruby - 2.2.0-1
screen - 4.2.1-2
termcap - 1.3.1-3
zlib - 1.2.8-2

When I run rbenv install 2.2.4 or rbenv install 2.3.0 in both cases the build fails with the error message "undefined symbol: SSLv2_method". This is the error for the 2.2.4 build:

installing bundle gems:       /var/services/homes/florian/.rbenv/versions/2.2.4/lib/ruby/gems/2.2.0 (build_info, cache, doc, extensions, gems, specifications)
/tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require': /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/.ext/armv7l-linux-eabihf/openssl.so: undefined symbol: SSLv2_method - /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/.ext/armv7l-linux-eabihf/openssl.so (LoadError)
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/.ext/common/openssl.rb:17:in `<top (required)>'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/security.rb:11:in `<top (required)>'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/package.rb:43:in `<top (required)>'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/dependency_installer.rb:3:in `<top (required)>'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
    from /tmp/ruby-build.20160329115213.2672/ruby-2.2.4/lib/rubygems.rb:556:in `install'
    from ./tool/rbinstall.rb:722:in `block (2 levels) in <main>'
    from ./tool/rbinstall.rb:721:in `each'
    from ./tool/rbinstall.rb:721:in `block in <main>'
    from ./tool/rbinstall.rb:757:in `call'
    from ./tool/rbinstall.rb:757:in `block in <main>'
    from ./tool/rbinstall.rb:754:in `each'
    from ./tool/rbinstall.rb:754:in `<main>'
uncommon.mk:246: recipe for target 'do-install-all' failed
make: *** [do-install-all] Error 1

This seems to be related to something in rubygems.

Interestingly, the reason why I try to build ruby myself is, that the ruby version delivered with Synology 6 returns a similar error when I try to install gems:

florian@synology:~/.rbenv/plugins$ /usr/bin/gem install rails
ERROR:  Loading command: install (LoadError)
        /usr/lib/ruby/2.3.0/armle-linux-gnu/openssl.so: undefined symbol: SSLv2_method - /usr/lib/ruby/2.3.0/armle-linux-gnu/openssl.so
ERROR:  While executing gem ... (NoMethodError)
    undefined method `invoke_with_build_args' for nil:NilClass

What could cause these issues and how could I resolve them?

have you tried any of the suggestions on other posts that match yours like [This One](http://stackoverflow.com/questions/12759518/undefined-symbol-sslv2-method-when-running-bundle-install) or [This One](http://stackoverflow.com/questions/9732591/rails-loaderror-with-openssl-so-undefined-symbol-d2i-ecpkparameters) seems they all suggest explicitly setting the open-ssl-dir when installing with `rvm` like [SO](http://stackoverflow.com/questions/12759767/rails-bundle-install-returns-undefined-symbol-sslv2-method) — engineersmnky, Mar 29 '16 at 14:00
I'm not using RVM and the solutions you highlight seem to make use of some openssl library which gets delivered by RVM. Unfortunately RVM fails if I try to install it (due to missing getent and other errors). I now tried to run `RUBY_CONFIGURE_OPTS=--with-openssl-dir=/opt/local rbenv install 2.2.4` and will see if this changes anything. — Florian Feldhaus, Mar 29 '16 at 15:06
Using `RUBY_CONFIGURE_OPTS=--with-openssl-dir=/opt/local` did not help. I expect the problem to be somewhere else. — Florian Feldhaus, Mar 29 '16 at 15:46
This is an issue with trying to use `https` a simple work around would be to change your gem source to `http://rubygems.org` but this is just bypassing the issue not actually solving it. — engineersmnky, Mar 29 '16 at 15:48
as per https://github.com/rbenv/ruby-build/issues/1011 `brew unlink openssl` worked for me — Amol Pujari, Apr 25 '18 at 03:13

score 6 · Accepted Answer · answered Mar 31 '16 at 04:12

When I run rbenv install 2.2.4 or rbenv install 2.3.0 in both cases the build fails with the error message "undefined symbol: SSLv2_method"...

What could cause these issues ...

The SSLv2 gear was completely removed from OpenSSL in March due to CVE-2016-0800 (DROWN Attack).

I think the complete removal was a bit harsh because of the effects like you are experiencing. There should have been a warning and transition period. And it should have occurred 10 years ago or so.

Instead of complete removal due to DROWN, I think SSLv2_method, SSLv2_client_method and SSLv2_server_method should have set an appropriate error code like ERR_R_REMOVED_INSECURE and returned NULL. <openssl/opensslconf.h> should have unconditionally set OPENSSL_NO_SSL2 also.

OpenSSL realized they broke ABI compatibility and added the symbols back to 1.0.2 with Commit 133138569f37d149. The check-in provided the symbols SSLv2_method, SSLv2_client_method and SSLv2_server_method again, but they return NULL without setting an error code. They also do not define OPENSSL_NO_SSL2. Also see [openssl.org #4398] BUG / 1.0.2g breaks CURL extension.

SSLv2 has been insecure for 15 or 20 years. Packages like Ruby should not have been referencing the symbols. You should file a security bug report against Ruby for referencing the symbol.

... and how could I resolve them?

To fix the issue, I believe you need either (1) wait for OpenSSL 1.0.2h, (2), manually patch OpenSSL 1.0.2g, or (3) remove all Ruby references to SSLv2_method, SSLv2_client_method and SSLv2_server_method.

Here's the patch you need for (2), manually patch OpenSSL 1.0.2g:

diff --git a/ssl/s2_meth.c b/ssl/s2_meth.c
index b312f17..d46e2f5 100644
--- a/ssl/s2_meth.c
+++ b/ssl/s2_meth.c
@@ -74,8 +74,8 @@ IMPLEMENT_ssl2_meth_func(SSLv2_method,
                          ssl2_accept, ssl2_connect, ssl2_get_method)
 #else                           /* !OPENSSL_NO_SSL2 */

-# if PEDANTIC
-static void *dummy = &dummy;
-# endif
+SSL_METHOD *SSLv2_method(void) { return NULL; }
+SSL_METHOD *SSLv2_client_method(void) { return NULL; }
+SSL_METHOD *SSLv2_server_method(void) { return NULL; }

 #endif

You should also configure and compile OpenSSL with at least no-ssl2 no-ssl3 no-comp flags because they are known security problems. The configure options define OPENSSL_NO_SSL2, OPENSSL_NO_SSL3 and OPENSSL_NO_COMP in <openssl/opensslconf.h>.

Thanks for the very detailed answer! As it works right now, I'll leave it at this. I will retry again with openssl 1.0.2h and hope it gets released soon. — Florian Feldhaus, Apr 02 '16 at 12:37

score 4 · Answer 2 · answered Mar 30 '16 at 17:17

After several attempts and lots of searching I found this ruby-build issue and reread the instructions in the ruby-build wiki which are suggesting for other platforms to install autoconf. I installed automaker, autoconf and gdbm (which I found some warnings in the ruby-build logs) with ipkg which didn't directly help. Only after I prefixed rbenv with RUBY_CONFIGURE_OPTS=--with-openssl-dir=/opt it worked.

For reference, these are the packages I have installed with ipkg

autoconf - 2.69-1
automake - 1.15-3
binutils - 2.25.1-1
gcc - 5.3.0-6
gconv-modules - 2.21-3
gdbm - 1.8.3-4
glibc-opt - 2.21-4
libc-dev - 2.21-1
libgmp - 6.0.0a-1
libmpc - 1.0.2-1
libmpfr - 3.1.3-1
libnsl - 2.21-3
libstdc++ - 6.0.21-6
m4 - 1.4.17-1
make - 4.1-1
ncurses - 5.7-4
openssl - 1.0.2f-1
openssl-dev - 1.0.2f-1
readline - 6.1-2
ruby - 2.2.0-1
screen - 4.2.1-2
termcap - 1.3.1-3
zlib - 1.2.8-2

This is the rbenv command which worked for me in the end

RUBY_CONFIGURE_OPTS=--with-openssl-dir=/opt rbenv install 2.3.0 -v

Building ruby with rbenv and ruby-build fails with undefined symbol: SSLv2_method

2 Answers2

Linked