diff --git a/ecryptfs-utils-75-werror.patch b/ecryptfs-utils-75-werror.patch
index b55dbff..c089d7f 100644
--- a/ecryptfs-utils-75-werror.patch
+++ b/ecryptfs-utils-75-werror.patch
@@ -24,17 +24,18 @@ diff -up ecryptfs-utils-109/src/key_mod/ecryptfs_key_mod_pkcs11_helper.c.werror 
  	return rc;
  }
  
-@@ -358,14 +357,14 @@ static int ecryptfs_pkcs11h_get_key_sig(
- 	data[i++] = '\02';
+@@ -379,15 +379,15 @@ static int ecryptfs_pkcs11h_get_key_sig(
  	data[i++] = (char)(nbits >> 8);
  	data[i++] = (char)nbits;
--	BN_bn2bin(rsa->n, &(data[i]));
-+	BN_bn2bin(rsa->n, (unsigned char *)&(data[i]));
+ 	RSA_get0_key(rsa, &rsa_n, NULL, NULL);
+-	BN_bn2bin(rsa_n, &(data[i]));
++	BN_bn2bin(rsa_n, (unsigned char *)&(data[i]));
  	i += nbytes;
  	data[i++] = (char)(ebits >> 8);
  	data[i++] = (char)ebits;
--	BN_bn2bin(rsa->e, &(data[i]));
-+	BN_bn2bin(rsa->e, (unsigned char *)&(data[i]));
+ 	RSA_get0_key(rsa, NULL, &rsa_e, NULL);
+-	BN_bn2bin(rsa_e, &(data[i]));
++	BN_bn2bin(rsa_e, (unsigned char *)&(data[i]));
  	i += ebytes;
 -	SHA1(data, len + 3, hash);
 -	to_hex(sig, hash, ECRYPTFS_SIG_SIZE);
diff --git a/ecryptfs-utils-87-syslog.patch b/ecryptfs-utils-87-syslog.patch
index be563bc..0ead855 100644
--- a/ecryptfs-utils-87-syslog.patch
+++ b/ecryptfs-utils-87-syslog.patch
@@ -10,359 +10,3 @@ diff -up ecryptfs-utils-108/src/include/ecryptfs.h.syslog ecryptfs-utils-108/src
  
  #define ECRYPTFS_MAX_NUM_CIPHERS 64
  #define ECRYPTFS_ECHO_ON 1
-diff -up ecryptfs-utils-108/src/pam_ecryptfs/pam_ecryptfs.c.syslog ecryptfs-utils-108/src/pam_ecryptfs/pam_ecryptfs.c
---- ecryptfs-utils-108/src/pam_ecryptfs/pam_ecryptfs.c.syslog	2015-08-11 14:44:02.640814023 +0200
-+++ ecryptfs-utils-108/src/pam_ecryptfs/pam_ecryptfs.c	2015-08-11 14:44:02.643814015 +0200
-@@ -93,7 +93,7 @@ static int wrap_passphrase_if_necessary(
- 
- 	rc = asprintf(&unwrapped_pw_filename, "/dev/shm/.ecryptfs-%s", username);
- 	if (rc == -1) {
--		syslog(LOG_ERR, "pam_ecryptfs: Unable to allocate memory\n");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Unable to allocate memory\n");
- 		return -ENOMEM;
- 	}
- 	/* If /dev/shm/.ecryptfs-$USER exists and owned by the user
-@@ -105,7 +105,7 @@ static int wrap_passphrase_if_necessary(
- 	    passphrase != NULL && *passphrase != '\0' &&
- 	    username != NULL && *username != '\0') {
- 		if ((rc = setuid(uid))<0 || ((rc = ecryptfs_wrap_passphrase_file(wrapped_pw_filename, passphrase, salt, unwrapped_pw_filename)) != 0)) {
--			syslog(LOG_ERR, "pam_ecryptfs: Error wrapping cleartext password; " "rc = [%d]\n", rc);
-+			ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error wrapping cleartext password; " "rc = [%d]\n", rc);
- 		}
- 		return rc;
- 	}
-@@ -149,7 +149,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h
- 	struct ecryptfs_pam_data *epd;
- 
- 	if ((epd = calloc(1, sizeof(struct ecryptfs_pam_data))) == NULL) {
--		syslog(LOG_ERR,"Memory allocation failed");
-+		ecryptfs_syslog(LOG_ERR,"Memory allocation failed");
- 		rc = -ENOMEM;
- 		goto out;
- 	}
-@@ -168,7 +168,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h
- 		} else rc = errno;
- 	}
- 	if (!epd->homedir) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user; rc = [%ld]\n", rc);
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user; rc = [%ld]\n", rc);
- 		goto out;
- 	}
- 
-@@ -176,7 +176,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h
- 		goto out;
- 	private_mnt = ecryptfs_fetch_private_mnt(epd->homedir);
- 	if (ecryptfs_private_is_mounted(NULL, private_mnt, NULL, 1)) {
--		syslog(LOG_DEBUG, "pam_ecryptfs: %s: %s is already mounted\n", __FUNCTION__, epd->homedir);
-+		ecryptfs_syslog(LOG_DEBUG, "pam_ecryptfs: %s: %s is already mounted\n", __FUNCTION__, epd->homedir);
- 		/* If private/home is already mounted, then we can skip
- 		   costly loading of keys */
- 		goto out;
-@@ -186,7 +186,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h
- 	else
- 		rc = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&epd->passphrase);
- 	if (rc != PAM_SUCCESS) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error retrieving passphrase; rc = [%ld]\n",
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error retrieving passphrase; rc = [%ld]\n",
- 		       rc);
- 		goto out;
- 	}
-@@ -198,7 +198,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h
- 		from_hex(epd->salt, salt_hex, ECRYPTFS_SALT_SIZE);
- 	epd->unwrap = ((argc == 1) && (memcmp(argv[0], "unwrap\0", 7) == 0));
- 	if ((rc=pam_set_data(pamh, ECRYPTFS_PAM_DATA, epd, pam_free_ecryptfsdata)) != PAM_SUCCESS) {
--		syslog(LOG_ERR, "Unable to store ecryptfs pam data : %s", pam_strerror(pamh, rc));
-+		ecryptfs_syslog(LOG_ERR, "Unable to store ecryptfs pam data : %s", pam_strerror(pamh, rc));
- 		goto out;
- 	}
- 
-@@ -222,12 +222,12 @@ static struct passwd *fetch_pwd(pam_hand
- 
- 	rc = pam_get_user(pamh, &username, NULL);
- 	if (rc != PAM_SUCCESS || username == NULL) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%ld]\n", username, rc);
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%ld]\n", username, rc);
- 		return NULL;
- 	}
- 	pwd = getpwnam(username);
- 	if (pwd == NULL) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%ld]\n", username, rc);
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%ld]\n", username, rc);
- 		return NULL;
- 	}
- 	return pwd;
-@@ -258,13 +258,13 @@ static int private_dir(pam_handle_t *pam
- 	if (
- 	    (asprintf(&autofile, "%s/.ecryptfs/%s", pwd->pw_dir, a) < 0)
- 	     || autofile == NULL) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error allocating memory for autofile name");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error allocating memory for autofile name");
- 		return 1;
-         }
-         if (
- 	    (asprintf(&sigfile, "%s/.ecryptfs/%s.sig", pwd->pw_dir,
- 	     PRIVATE_DIR) < 0) || sigfile == NULL) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error allocating memory for sigfile name");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error allocating memory for sigfile name");
- 		return 1;
-         }
- 	if (stat(sigfile, &s) != 0) {
-@@ -276,7 +276,7 @@ static int private_dir(pam_handle_t *pam
- 		goto out;
- 	}
- 	if ((pid = fork()) < 0) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error setting up private mount");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error setting up private mount");
- 		return 1;
- 	}
- 	if (pid == 0) {
-@@ -284,7 +284,7 @@ static int private_dir(pam_handle_t *pam
- 		        if ((asprintf(&recorded,
- 			    "%s/.ecryptfs/.wrapped-passphrase.recorded",
- 			    pwd->pw_dir) < 0) || recorded == NULL) {
--				syslog(LOG_ERR, "pam_ecryptfs: Error allocating memory for recorded name");
-+				ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error allocating memory for recorded name");
- 				_exit(255);
- 			}
- 			if (stat(recorded, &s) != 0 && stat("/usr/share/ecryptfs-utils/ecryptfs-record-passphrase", &s) == 0) {
-@@ -297,12 +297,12 @@ static int private_dir(pam_handle_t *pam
- 			}
- 			if (stat(autofile, &s) != 0) {
- 				/* User does not want to auto-mount */
--				syslog(LOG_DEBUG, "pam_ecryptfs: Skipping automatic eCryptfs mount");
-+				ecryptfs_syslog(LOG_DEBUG, "pam_ecryptfs: Skipping automatic eCryptfs mount");
- 				_exit(0);
- 			}
- 			clearenv();
- 			if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
--				syslog(LOG_ERR, "Unable to set user's groups : %m");
-+				ecryptfs_syslog(LOG_ERR, "Unable to set user's groups : %m");
- 				_exit(-1);
- 			}
- 			/* run mount.ecryptfs_private as the user */
-@@ -310,16 +310,16 @@ static int private_dir(pam_handle_t *pam
- 				_exit(-1);
- 			execl("/sbin/mount.ecryptfs_private",
- 			      "mount.ecryptfs_private", NULL);
--			syslog(LOG_ERR, "unable to execute mount.ecryptfs_private : %m");
-+			ecryptfs_syslog(LOG_ERR, "unable to execute mount.ecryptfs_private : %m");
- 		} else {
- 			if (stat(autofile, &s) != 0) {
- 				/* User does not want to auto-unmount */
--				syslog(LOG_DEBUG, "pam_ecryptfs: Skipping automatic eCryptfs unmount");
-+				ecryptfs_syslog(LOG_DEBUG, "pam_ecryptfs: Skipping automatic eCryptfs unmount");
- 				_exit(0);
- 			}
- 			clearenv();
- 			if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
--				syslog(LOG_ERR, "Unable to set user's groups : %m");
-+				ecryptfs_syslog(LOG_ERR, "Unable to set user's groups : %m");
- 				_exit(-1);
- 			}
- 			/* run umount.ecryptfs_private as the user */
-@@ -327,7 +327,7 @@ static int private_dir(pam_handle_t *pam
- 				_exit(-1);
- 			execl("/sbin/umount.ecryptfs_private",
- 			      "umount.ecryptfs_private", "-d", NULL);
--			syslog(LOG_ERR, "unable to execute umount.ecryptfs_private : %m");
-+			ecryptfs_syslog(LOG_ERR, "unable to execute umount.ecryptfs_private : %m");
- 			_exit(1);
- 		}
- 		_exit(1);
-@@ -362,24 +362,24 @@ static int fill_keyring(pam_handle_t *pa
- 	
- 	if ((rc=pam_get_data(pamh, ECRYPTFS_PAM_DATA, (const void **)&epd)) != PAM_SUCCESS)
- 	{
--		syslog(LOG_ERR,"Unable to get ecryptfs pam data : %s", pam_strerror(pamh, rc));
-+		ecryptfs_syslog(LOG_ERR,"Unable to get ecryptfs pam data : %s", pam_strerror(pamh, rc));
- 		return -EINVAL;
- 	}
-   
- 	oeuid = geteuid();
- 	oegid = getegid();
- 	if ((ngids = getgroups(sizeof(groups)/sizeof(gid_t), groups)) < 0) {
--		syslog(LOG_ERR, "pam_ecryptfs: geteuid error");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: geteuid error");
- 		goto outnouid;
- 	}
- 
- 	if (setegid(epd->gid) < 0 || setgroups(1, &epd->gid) < 0 || seteuid(epd->uid) < 0) {
--		syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
- 		goto out;
- 	}
- 
- 	if (!auth_tok_sig) {
--		syslog(LOG_ERR, "Out of memory\n");
-+		ecryptfs_syslog(LOG_ERR, "Out of memory\n");
- 		return -ENOMEM;
- 	}
-   
-@@ -387,7 +387,7 @@ static int fill_keyring(pam_handle_t *pa
- 		/* temp regain uid 0 to drop privs */
- 		if (seteuid(oeuid) < 0)
- 		{
--			syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
-+			ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
- 			goto out_child;
- 		}
- 		/* setgroups() already called */
-@@ -395,12 +395,12 @@ static int fill_keyring(pam_handle_t *pa
- 			goto out_child;
- 	  
- 		if (epd->passphrase == NULL) {
--			syslog(LOG_ERR, "NULL passphrase; aborting\n");
-+			ecryptfs_syslog(LOG_ERR, "NULL passphrase; aborting\n");
- 			rc = -EINVAL;
- 			goto out_child;
- 		}
- 		if ((rc = ecryptfs_validate_keyring())) {
--			syslog(LOG_WARNING,
-+			ecryptfs_syslog(LOG_WARNING,
- 			       "Cannot validate keyring integrity\n");
- 		}
- 		rc = 0;
-@@ -412,18 +412,18 @@ static int fill_keyring(pam_handle_t *pa
- 				epd->homedir,
- 				ECRYPTFS_DEFAULT_WRAPPED_PASSPHRASE_FILENAME);
- 			if (rc == -1) {
--				syslog(LOG_ERR, "Unable to allocate memory\n");
-+				ecryptfs_syslog(LOG_ERR, "Unable to allocate memory\n");
- 				rc = -ENOMEM;
- 				goto out_child;
- 			}
- 			if (wrap_passphrase_if_necessary(epd->username, epd->uid, wrapped_pw_filename, epd->passphrase, epd->salt) == 0) {
--				syslog(LOG_INFO, "Passphrase file wrapped");
-+				ecryptfs_syslog(LOG_INFO, "Passphrase file wrapped");
- 			} else {
- 				goto out_child;
- 			}
- 			if (rewrap_passphrase_if_necessary(wrapped_pw_filename, epd->passphrase, epd->salt)) {
- 				/* Non fatal condition. Log a warning. */
--				syslog(LOG_WARNING, "pam_ecryptfs: Unable to rewrap passphrase file\n");
-+				ecryptfs_syslog(LOG_WARNING, "pam_ecryptfs: Unable to rewrap passphrase file\n");
- 			}
- 			rc = ecryptfs_insert_wrapped_passphrase_into_keyring(
- 				auth_tok_sig, wrapped_pw_filename, epd->passphrase,
-@@ -437,7 +437,7 @@ static int fill_keyring(pam_handle_t *pa
- 			goto out_child;
- 		}
- 		if (rc) {
--			syslog(LOG_ERR, "Error adding passphrase key token to "
-+			ecryptfs_syslog(LOG_ERR, "Error adding passphrase key token to "
- 			       "user session keyring; rc = [%d]\n", rc);
- 			goto out_child;
- 		}
-@@ -447,7 +447,7 @@ out_child:
- 	}
- 	tmp_pid = waitpid(child_pid, NULL, 0);
- 	if (tmp_pid == -1)
--		syslog(LOG_WARNING,
-+		ecryptfs_syslog(LOG_WARNING,
- 		       "waitpid() returned with error condition\n"); 
- out:
- 	rc = seteuid(oeuid);
-@@ -506,33 +506,33 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
- 			homedir = pwd->pw_dir;
- 		}
- 	} else {
--		syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%d]\n", username, rc);
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error getting passwd info for user [%s]; rc = [%d]\n", username, rc);
- 		goto out;
- 	}
- 
- 	oeuid = geteuid();
- 	oegid = getegid();
- 	if ((ngids = getgroups(sizeof(groups)/sizeof(gid_t), groups)) < 0) {
--		syslog(LOG_ERR, "pam_ecryptfs: geteuid error");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: geteuid error");
- 		goto outnouid;
- 	}
- 
- 	if (setegid(gid) < 0 || setgroups(1, &gid) < 0 || seteuid(uid) < 0) {
--		syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
- 		goto out;
- 	}
- 
- 	if ((rc = pam_get_item(pamh, PAM_OLDAUTHTOK,
- 			       (const void **)&old_passphrase))
- 	    != PAM_SUCCESS) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error retrieving old passphrase; rc = [%d]\n", rc);
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error retrieving old passphrase; rc = [%d]\n", rc);
- 		goto out;
- 	}
- 	/* On the first pass, do nothing except check that we have a password */
- 	if ((flags & PAM_PRELIM_CHECK)) {
- 		if (!old_passphrase)
- 		{
--			syslog(LOG_WARNING, "pam_ecryptfs: PAM passphrase change module retrieved a NULL passphrase; nothing to do\n");
-+			ecryptfs_syslog(LOG_WARNING, "pam_ecryptfs: PAM passphrase change module retrieved a NULL passphrase; nothing to do\n");
- 			rc = PAM_AUTHTOK_RECOVER_ERR;
- 		}
- 		goto out;
-@@ -540,13 +540,13 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
- 	if ((rc = pam_get_item(pamh, PAM_AUTHTOK,
- 			       (const void **)&new_passphrase))
- 	    != PAM_SUCCESS) {
--		syslog(LOG_ERR, "pam_ecryptfs: Error retrieving new passphrase; rc = [%d]\n", rc);
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error retrieving new passphrase; rc = [%d]\n", rc);
- 		goto out;
- 	}
- 	if ((rc = asprintf(&wrapped_pw_filename, "%s/.ecryptfs/%s", homedir,
- 			   ECRYPTFS_DEFAULT_WRAPPED_PASSPHRASE_FILENAME))
- 	    == -1) {
--		syslog(LOG_ERR, "pam_ecryptfs: Unable to allocate memory\n");
-+		ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Unable to allocate memory\n");
- 		rc = -ENOMEM;
- 		goto out;
- 	}
-@@ -556,13 +556,13 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
- 		from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
- 	}
- 	if (wrap_passphrase_if_necessary(username, uid, wrapped_pw_filename, new_passphrase, salt) == 0) {
--		syslog(LOG_DEBUG, "pam_ecryptfs: Passphrase file wrapped");
-+		ecryptfs_syslog(LOG_DEBUG, "pam_ecryptfs: Passphrase file wrapped");
- 	} else {
- 		goto out;
- 	}
- 
- 	if (!old_passphrase || !new_passphrase || *new_passphrase == '\0') {
--		syslog(LOG_WARNING, "pam_ecryptfs: PAM passphrase change module retrieved at least one NULL passphrase; nothing to do\n");
-+		ecryptfs_syslog(LOG_WARNING, "pam_ecryptfs: PAM passphrase change module retrieved at least one NULL passphrase; nothing to do\n");
- 		rc = PAM_AUTHTOK_RECOVER_ERR;
- 		goto out;
- 	}
-@@ -572,7 +572,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
- 
- 		/* temp regain uid 0 to drop privs */
- 		if (seteuid(oeuid) < 0) {
--			syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
-+			ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: seteuid error");
- 			goto out_child;
- 		}
- 		/* setgroups() already called */
-@@ -582,20 +582,20 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand
- 		if ((rc = ecryptfs_unwrap_passphrase(passphrase,
- 						     wrapped_pw_filename,
- 						     old_passphrase, salt))) {
--			syslog(LOG_ERR, "pam_ecryptfs: Error attempting to unwrap passphrase; rc = [%d]\n", rc);
-+			ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error attempting to unwrap passphrase; rc = [%d]\n", rc);
- 			goto out_child;
- 		}
- 		if ((rc = ecryptfs_wrap_passphrase(wrapped_pw_filename,
- 						   new_passphrase, salt,
- 						   passphrase))) {
--			syslog(LOG_ERR, "pam_ecryptfs: Error attempting to wrap passphrase; rc = [%d]", rc);
-+			ecryptfs_syslog(LOG_ERR, "pam_ecryptfs: Error attempting to wrap passphrase; rc = [%d]", rc);
- 			goto out_child;
- 		}
- out_child:
- 		_exit(0);
- 	}
- 	if ((tmp_pid = waitpid(child_pid, NULL, 0)) == -1)
--		syslog(LOG_WARNING, "pam_ecryptfs: waitpid() returned with error condition\n");
-+		ecryptfs_syslog(LOG_WARNING, "pam_ecryptfs: waitpid() returned with error condition\n");
- 	free(wrapped_pw_filename);
- out:
- 
diff --git a/ecryptfs-utils-openssl11.patch b/ecryptfs-utils-openssl11.patch
new file mode 100644
index 0000000..b5ff7b6
--- /dev/null
+++ b/ecryptfs-utils-openssl11.patch
@@ -0,0 +1,166 @@
+=== modified file 'src/key_mod/ecryptfs_key_mod_openssl.c'
+--- src/key_mod/ecryptfs_key_mod_openssl.c	2013-10-25 19:45:09 +0000
++++ src/key_mod/ecryptfs_key_mod_openssl.c	2017-06-02 18:27:28 +0000
+@@ -41,6 +41,7 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <libgen.h>
++#include <openssl/bn.h>
+ #include <openssl/pem.h>
+ #include <openssl/rsa.h>
+ #include <openssl/err.h>
+@@ -55,6 +56,19 @@
+ 	char *passphrase;
+ };
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++static void RSA_get0_key(const RSA *r,
++                 const BIGNUM **n, const BIGNUM **e, const BIGNUM **d)
++{
++   if (n != NULL)
++       *n = r->n;
++   if (e != NULL)
++       *e = r->e;
++   if (d != NULL)
++       *d = r->d;
++}
++#endif
++
+ static void
+ ecryptfs_openssl_destroy_openssl_data(struct openssl_data *openssl_data)
+ {
+@@ -142,6 +156,7 @@
+ {
+ 	int len, nbits, ebits, i;
+ 	int nbytes, ebytes;
++	const BIGNUM *key_n, *key_e;
+ 	unsigned char *hash;
+ 	unsigned char *data = NULL;
+ 	int rc = 0;
+@@ -152,11 +167,13 @@
+ 		rc = -ENOMEM;
+ 		goto out;
+ 	}
+-	nbits = BN_num_bits(key->n);
++	RSA_get0_key(key, &key_n, NULL, NULL);
++	nbits = BN_num_bits(key_n);
+ 	nbytes = nbits / 8;
+ 	if (nbits % 8)
+ 		nbytes++;
+-	ebits = BN_num_bits(key->e);
++	RSA_get0_key(key, NULL, &key_e, NULL);
++	ebits = BN_num_bits(key_e);
+ 	ebytes = ebits / 8;
+ 	if (ebits % 8)
+ 		ebytes++;
+@@ -179,11 +196,13 @@
+ 	data[i++] = '\02';
+ 	data[i++] = (nbits >> 8);
+ 	data[i++] = nbits;
+-	BN_bn2bin(key->n, &(data[i]));
++	RSA_get0_key(key, &key_n, NULL, NULL);
++	BN_bn2bin(key_n, &(data[i]));
+ 	i += nbytes;
+ 	data[i++] = (ebits >> 8);
+ 	data[i++] = ebits;
+-	BN_bn2bin(key->e, &(data[i]));
++	RSA_get0_key(key, NULL, &key_e, NULL);
++	BN_bn2bin(key_e, &(data[i]));
+ 	i += ebytes;
+ 	SHA1(data, len + 3, hash);
+ 	to_hex(sig, (char *)hash, ECRYPTFS_SIG_SIZE);
+@@ -278,7 +297,9 @@
+ 	BIO *in = NULL;
+ 	int rc;
+ 
++	#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	CRYPTO_malloc_init();
++	#endif
+ 	ERR_load_crypto_strings();
+ 	OpenSSL_add_all_algorithms();
+ 	ENGINE_load_builtin_engines();
+
+=== modified file 'src/key_mod/ecryptfs_key_mod_pkcs11_helper.c'
+--- src/key_mod/ecryptfs_key_mod_pkcs11_helper.c	2013-10-25 19:45:09 +0000
++++ src/key_mod/ecryptfs_key_mod_pkcs11_helper.c	2017-06-02 18:27:28 +0000
+@@ -41,6 +41,7 @@
+ #include <errno.h>
+ #include <stdlib.h>
+ #include <unistd.h>
++#include <openssl/bn.h>
+ #include <openssl/err.h>
+ #include <openssl/pem.h>
+ #include <openssl/x509.h>
+@@ -77,6 +78,19 @@
+ typedef const unsigned char *__pkcs11_openssl_d2i_t;
+ #endif
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++static void RSA_get0_key(const RSA *r,
++                 const BIGNUM **n, const BIGNUM **e, const BIGNUM **d)
++{
++   if (n != NULL)
++       *n = r->n;
++   if (e != NULL)
++       *e = r->e;
++   if (d != NULL)
++       *d = r->d;
++}
++#endif
++
+ /**
+  * ecryptfs_pkcs11h_deserialize
+  * @pkcs11h_data: The deserialized version of the key module data;
+@@ -282,7 +296,11 @@
+ 		goto out;
+ 	}
+ 	
++	#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	if (pubkey->type != EVP_PKEY_RSA) {
++	#else
++	if (EVP_PKEY_base_id(pubkey) != EVP_PKEY_RSA) {
++	#endif
+ 		syslog(LOG_ERR, "PKCS#11: Invalid public key algorithm");
+ 		rc = -EIO;
+ 		goto out;
+@@ -318,6 +336,7 @@
+ 	int nbytes, ebytes;
+ 	char *hash = NULL;
+ 	char *data = NULL;
++	const BIGNUM *rsa_n, *rsa_e;
+ 	int rc;
+ 
+ 	if ((rc = ecryptfs_pkcs11h_get_public_key(&rsa, blob))) {
+@@ -331,11 +350,13 @@
+ 		rc = -ENOMEM;
+ 		goto out;
+ 	}
+-	nbits = BN_num_bits(rsa->n);
++	RSA_get0_key(rsa, &rsa_n, NULL, NULL);
++	nbits = BN_num_bits(rsa_n);
+ 	nbytes = nbits / 8;
+ 	if (nbits % 8)
+ 		nbytes++;
+-	ebits = BN_num_bits(rsa->e);
++	RSA_get0_key(rsa, NULL, &rsa_e, NULL);
++	ebits = BN_num_bits(rsa_e);
+ 	ebytes = ebits / 8;
+ 	if (ebits % 8)
+ 		ebytes++;
+@@ -358,11 +379,13 @@
+ 	data[i++] = '\02';
+ 	data[i++] = (char)(nbits >> 8);
+ 	data[i++] = (char)nbits;
+-	BN_bn2bin(rsa->n, &(data[i]));
++	RSA_get0_key(rsa, &rsa_n, NULL, NULL);
++	BN_bn2bin(rsa_n, &(data[i]));
+ 	i += nbytes;
+ 	data[i++] = (char)(ebits >> 8);
+ 	data[i++] = (char)ebits;
+-	BN_bn2bin(rsa->e, &(data[i]));
++	RSA_get0_key(rsa, NULL, &rsa_e, NULL);
++	BN_bn2bin(rsa_e, &(data[i]));
+ 	i += ebytes;
+ 	SHA1(data, len + 3, hash);
+ 	to_hex(sig, hash, ECRYPTFS_SIG_SIZE);
+
diff --git a/ecryptfs-utils.spec b/ecryptfs-utils.spec
index 7c30d80..0adf55f 100644
--- a/ecryptfs-utils.spec
+++ b/ecryptfs-utils.spec
@@ -5,72 +5,74 @@
 
 Name: ecryptfs-utils
 Version: 111
-Release: 4%{?dist}
+Release: 5%{?dist}
 Summary: The eCryptfs mount helper and support libraries
-Group: System Environment/Base
 License: GPLv2+
 URL: https://launchpad.net/ecryptfs
+
 Source0: http://launchpad.net/ecryptfs/trunk/%{version}/+download/%{name}_%{version}.orig.tar.gz
 Source1: ecryptfs-mount-private.png
 
+### upstream patches
+# rhbz#1384023, openssl 1.1.x
+Patch1: https://code.launchpad.net/~jelle-vdwaa/ecryptfs/ecryptfs/+merge/319746/+preview-diff/792383/+files/preview.diff#/%{name}-openssl11.patch
+
+### downstream patches
 # rhbz#500829, do not use ubuntu/debian only service
-Patch2: ecryptfs-utils-75-nocryptdisks.patch
+Patch92: %{name}-75-nocryptdisks.patch
 
 # rhbz#553629, fix usage of salt together with file_passwd
-Patch3: ecryptfs-utils-83-fixsalt.patch
+Patch93: %{name}-83-fixsalt.patch
 
 # fedora/rhel specific, rhbz#486139, remove nss dependency from umount.ecryptfs
-Patch4: ecryptfs-utils-83-splitnss.patch
+Patch94: %{name}-83-splitnss.patch
 
 # rhbz#664474, fix unsigned < 0 test
-Patch5: ecryptfs-utils-84-fixsigness.patch
+Patch95: %{name}-84-fixsigness.patch
 
 # fix man pages
-Patch8: ecryptfs-utils-86-manpage.patch
+Patch98: %{name}-86-manpage.patch
 
 # autoload ecryptfs module in ecryptfs-setup-private when needed, rhbz#707608
-Patch9: ecryptfs-utils-87-autoload.patch
+Patch99: %{name}-87-autoload.patch
 
 # fedora/rhel specific, check for pam ecryptfs module before home migration
-Patch11: ecryptfs-utils-87-authconfig.patch
-
-# memcpy can't be used on overlaping areas
-Patch12: ecryptfs-utils-87-memcpyfix.patch
-
-# allow building with -Werror
-Patch999: ecryptfs-utils-75-werror.patch
+Patch911: %{name}-87-authconfig.patch
 
 # using return after fork() in pam module has some nasty side effects, rhbz#722445
-Patch14: ecryptfs-utils-87-fixpamfork.patch
+Patch914: %{name}-87-fixpamfork.patch
 
 # we need gid==ecryptfs in pam module before mount.ecryptfs_private execution
-Patch15: ecryptfs-utils-87-fixexecgid.patch
+Patch915: %{name}-87-fixexecgid.patch
 
 # do not use zombie process, it causes lock ups at least for ssh login
-Patch16: ecryptfs-utils-87-nozombies.patch
+Patch916: %{name}-87-nozombies.patch
 
 # if we do not use zombies, we have to store passphrase in pam_data and init keyring later
-Patch17: ecryptfs-utils-87-pamdata.patch
+Patch917: %{name}-87-pamdata.patch
 
 # patch17 needs propper const on some places
-Patch18: ecryptfs-utils-87-fixconst.patch
+Patch918: %{name}-87-fixconst.patch
 
-Patch19: ecryptfs-utils-87-syslog.patch
+Patch919: %{name}-87-syslog.patch
 
 # if e-m-p fails, check if user is member of ecryptfs group
-Patch21: ecryptfs-utils-96-groupcheck.patch
-Patch22: ecryptfs-utils-99-selinux.patch
+Patch921: %{name}-96-groupcheck.patch
+Patch922: %{name}-99-selinux.patch
 
 # rhbz#868330
-Patch23: ecryptfs-utils-100-sudokeyring.patch
+Patch923: %{name}-100-sudokeyring.patch
 
 # for e-u < 112
-Patch24: ecryptfs-utils-111-cve_2016_5224.patch
+Patch924: %{name}-111-cve_2016_5224.patch
 
 # do not crash if no password is available #1339714
-Patch25: ecryptfs-utils-111-nopasswd.patch
+Patch925: %{name}-111-nopasswd.patch
+
+### patches for general cleanup, should be kept and executed after all others
+# allow building with -Werror
+Patch999: %{name}-75-werror.patch
 
-BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 Requires: keyutils, cryptsetup-luks, util-linux, gettext
 BuildRequires: libgcrypt-devel keyutils-libs-devel openssl-devel pam-devel
 BuildRequires: trousers-devel nss-devel desktop-file-utils intltool
@@ -83,11 +85,11 @@ kernel versions 2.6.19 and above. This package provides the mount
 helper and supporting libraries to perform key management and mount
 functions.
 
-Install ecryptfs-utils if you would like to mount eCryptfs.
+Install %{name} if you would like to mount eCryptfs.
 
 %package devel
 Summary: The eCryptfs userspace development package
-Group: System Environment/Base
+Requires: %{name} = %{version}-%{release}
 Requires: keyutils-libs-devel %{name} = %{version}-%{release}
 Requires: pkgconfig
 
@@ -96,58 +98,61 @@ Userspace development files for eCryptfs.
 
 %package python
 Summary: Python bindings for the eCryptfs utils
-Group: System Environment/Base
-Requires: ecryptfs-utils %{name} = %{version}-%{release}
+Requires: %{name} = %{version}-%{release}
 BuildRequires: python python-devel swig >= 1.3.31
 
 %description python
-The ecryptfs-utils-python package contains a module that permits 
+The %{name}-python package contains a module that permits 
 applications written in the Python programming language to use 
-the interface supplied by the ecryptfs-utils library.
+the interface supplied by the %{name} library.
 
 %prep
 %setup -q
-%patch2 -p1 -b .nocryptdisks
-%patch3 -p1 -b .fixsalt
-%patch4 -p1 -b .splitnss
-%patch5 -p1 -b .fixsigness
-%patch8 -p1 -b .manfix
-%patch9 -p1 -b .autoload
-%patch11 -p1 -b .authconfig
-#%patch12 -p1 -b .memcpyfix
+%patch1 -p0 -b .openssl11
+
+%patch92 -p1 -b .nocryptdisks
+%patch93 -p1 -b .fixsalt
+%patch94 -p1 -b .splitnss
+%patch95 -p1 -b .fixsigness
+%patch98 -p1 -b .manfix
+%patch99 -p1 -b .autoload
+%patch911 -p1 -b .authconfig
+%patch914 -p1 -b .fixpamfork
+%patch915 -p1 -b .fixexecgid
+%patch916 -p1 -b .nozombies
+%patch917 -p1 -b .pamdata
+%patch918 -p1 -b .fixconst
+%patch919 -p1 -b .syslog
+%patch921 -p1 -b .groupcheck
+%patch922 -p1 -b .selinux
+%patch923 -p1 -b .sudokeyring
+%patch924 -p1 -b .cve_2016_5224
+%patch925 -p1 -b .nopasswd
+
 %patch999 -p1 -b .werror
-%patch14 -p1 -b .fixpamfork
-%patch15 -p1 -b .fixexecgid
-%patch16 -p1 -b .nozombies
-%patch17 -p1 -b .pamdata
-%patch18 -p1 -b .fixconst
-%patch19 -p1 -b .syslog
-%patch21 -p1 -b .groupcheck
-%patch22 -p1 -b .selinux
-%patch23 -p1 -b .sudokeyring
-%patch24 -p1 -b .cve_2016_5224
-%patch25 -p1 -b .nopasswd
+
+sed -i -r 's:^_syslog\(LOG:ecryptfs_\0:' src/pam_ecryptfs/pam_ecryptfs.c
 
 %build
-%global _hardened_build 1
-export CFLAGS="$RPM_OPT_FLAGS -Werror -Wtype-limits -Wno-unused"
+# openssl 1.1 marks some functions as deprecated
+export CFLAGS="$RPM_OPT_FLAGS -Werror -Wtype-limits -Wno-unused -Wno-error=deprecated-declarations"
+
 #we're modifing Makefile.am
 autoreconf -fiv
 %configure --disable-rpath --enable-tspi --enable-nss --enable-pkcs11-helper --enable-tests
-make clean
+
 #disable rpath
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
 sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 
-make %{?_smp_mflags}
+%make_build
 
 %install
-rm -rf $RPM_BUILD_ROOT
-make install DESTDIR=$RPM_BUILD_ROOT
-find $RPM_BUILD_ROOT/ -name '*.la' | xargs rm -f
+%make_install
+find $RPM_BUILD_ROOT/ -name '*.la' -print -delete
 rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}
-#install files Makefile forgot install
-install -m644 %{SOURCE1} $RPM_BUILD_ROOT%{_datadir}/%{name}/ecryptfs-mount-private.png
+#install files Makefile forgot to install
+install -p -m644 %{SOURCE1} $RPM_BUILD_ROOT%{_datadir}/%{name}/ecryptfs-mount-private.png
 printf "Encoding=UTF-8\n" >>$RPM_BUILD_ROOT/%{_datadir}/%{name}/ecryptfs-mount-private.desktop
 printf "Encoding=UTF-8\n" >>$RPM_BUILD_ROOT/%{_datadir}/%{name}/ecryptfs-setup-private.desktop
 printf "Icon=%{_datadir}/%{name}/ecryptfs-mount-private.png\n" >>$RPM_BUILD_ROOT/%{_datadir}/%{name}/ecryptfs-mount-private.desktop
@@ -195,12 +200,9 @@ if [ $1 -eq 0 ] ; then
     authconfig --disableecryptfs --update
 fi
 
-%clean
-rm -rf $RPM_BUILD_ROOT
-
 %files -f %{name}.lang
-%defattr(-,root,root,-)
-%doc README COPYING AUTHORS NEWS THANKS
+%license COPYING
+%doc README AUTHORS NEWS THANKS
 %doc doc/ecryptfs-faq.html
 %doc doc/ecryptfs-pkcs11-helper-doc.txt
 %{_sbindir}/mount.ecryptfs
@@ -260,23 +262,27 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man8/umount.ecryptfs.8.gz
 
 %files devel
-%defattr(-,root,root,-)
 %{_libdir}/libecryptfs.so
 %{_libdir}/pkgconfig/libecryptfs.pc
 %{_includedir}/ecryptfs.h
 
 %files python
-%defattr(-,root,root,-)
-%dir %{python_sitelib}/ecryptfs-utils
-%{python_sitelib}/ecryptfs-utils/libecryptfs.py
-%{python_sitelib}/ecryptfs-utils/libecryptfs.pyc
-%{python_sitelib}/ecryptfs-utils/libecryptfs.pyo
-%dir %{python_sitearch}/ecryptfs-utils
-%{python_sitearch}/ecryptfs-utils/_libecryptfs.so.0
-%{python_sitearch}/ecryptfs-utils/_libecryptfs.so.0.0.0
-%{python_sitearch}/ecryptfs-utils/_libecryptfs.so
+%dir %{python_sitelib}/%{name}
+%{python_sitelib}/%{name}/libecryptfs.py
+%{python_sitelib}/%{name}/libecryptfs.pyc
+%{python_sitelib}/%{name}/libecryptfs.pyo
+%dir %{python_sitearch}/%{name}
+%{python_sitearch}/%{name}/_libecryptfs.so.0
+%{python_sitearch}/%{name}/_libecryptfs.so.0.0.0
+%{python_sitearch}/%{name}/_libecryptfs.so
 
 %changelog
+* Sun Jun 04 2017 Raphael Groner <projects.rg@smart.ms> - 111-5
+- add patch for openssl 1.1.x, rhbz#1384023
+- mark patches of upstream and downstream
+- fix legacy patches to still work, drop obsolete patch for memcpyfix
+- general modernization according to guidelines, drop obsolete commands
+
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 111-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 
@@ -287,27 +293,27 @@ rm -rf $RPM_BUILD_ROOT
 - https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
 
 * Fri Jul 15 2016 Michal Hlavinka <mhlavink@redhat.com> - 111-1
-- ecryptfs-utils updated to 111
+- %{name} updated to 111
 - fix ecryptfs-setup-swap improperly configures encrypted swap when using GPT 
   partitioning on a NVMe or MMC drive (CVE-2016-6224, rhbz#1356828)
 
 * Mon Feb 29 2016 Michal Hlavinka <mhlavink@redhat.com> - 110-1
-- ecryptfs-utils updated to 110
+- %{name} updated to 110
 
 * Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 109-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
 
 * Tue Jan 26 2016 Michal Hlavinka <mhlavink@redhat.com> - 109-1
-- ecryptfs-utils updated to 109
+- %{name} updated to 109
 
 * Tue Aug 11 2015 Michal Hlavinka <mhlavink@redhat.com> - 108-1
-- ecryptfs-utils updated to 108
+- %{name} updated to 108
 
 * Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 106-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
 
 * Mon Mar 30 2015 Michal Hlavinka <mhlavink@redhat.com> - 106-1
-- ecryptfs-utils updated to 106
+- %{name} updated to 106
 
 * Mon Jan 26 2015 Michal Hlavinka <mhlavink@redhat.com> - 104-3
 - fix pam sigsegv (#1184645)
@@ -316,7 +322,7 @@ rm -rf $RPM_BUILD_ROOT
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
 
 * Wed Jul 23 2014 Michal Hlavinka <mhlavink@redhat.com> - 104-1
-- ecryptfs-utils updated to 104
+- %{name} updated to 104
 
 * Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 103-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
@@ -331,10 +337,10 @@ rm -rf $RPM_BUILD_ROOT
 - make executables hardened (#965505)
 
 * Wed Jan 30 2013 Michal Hlavinka <mhlavink@redhat.com> - 103-1
-- ecryptfs-utils updated to 103
+- %{name} updated to 103
 
 * Mon Oct 29 2012 Michal Hlavinka <mhlavink@redhat.com> - 101-1
-- ecryptfs-utils updated to 101
+- %{name} updated to 101
 
 * Thu Oct 25 2012 Michal Hlavinka <mhlavink@redhat.com> - 100-6
 - home migration did not work under sudo (#868330)
@@ -352,10 +358,10 @@ rm -rf $RPM_BUILD_ROOT
 - fix Werror messages in new build environment
 
 * Fri Aug 03 2012 Michal Hlavinka <mhlavink@redhat.com> - 100-1
-- ecryptfs-utils updated to 100
+- %{name} updated to 100
 
 * Tue Jul 24 2012 Michal Hlavinka <mhlavink@redhat.com> - 99-1
-- ecryptfs-utils updated to 99
+- %{name} updated to 99
 - fixes: suid helper does not restrict mounting filesystems with 
   nosuid, nodev leading to possible privilege escalation (CVE-2012-3409)
 
@@ -363,7 +369,7 @@ rm -rf $RPM_BUILD_ROOT
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
 
 * Mon Jun 25 2012 Michal Hlavinka <mhlavink@redhat.com> - 97-1
-- ecryptfs-utils updated to 97
+- %{name} updated to 97
 
 * Mon Jun 04 2012 Michal Hlavinka <mhlavink@redhat.com> - 96-3
 - for file name encryption support check, module must be loaded already
@@ -372,7 +378,7 @@ rm -rf $RPM_BUILD_ROOT
 - when ecryptfs-mount-fails, check if user is member of ecryptfs group
 
 * Mon Feb 20 2012 Michal Hlavinka <mhlavink@redhat.com> - 96-1
-- ecryptfs-utils updated to 96
+- %{name} updated to 96
 
 * Mon Feb 13 2012 Michal Hlavinka <mhlavink@redhat.com> - 95-3
 - blowfish and twofish support check did not work with on 3.2.x kernels (#785036)
@@ -445,7 +451,7 @@ rm -rf $RPM_BUILD_ROOT
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
 
 * Tue Feb 01 2011 Michal Hlavinka <mhlavink@redhat.com> - 85-1
-- ecryptfs-utils updated to 85
+- %{name} updated to 85
 
 * Tue Jan 11 2011 Dan Horák <dan[at]danny.cz> - 84-3
 - fix build on arches where char is unsigned by default
@@ -454,7 +460,7 @@ rm -rf $RPM_BUILD_ROOT
 - fix unsigned < 0 test (#664474)
 
 * Mon Dec 20 2010 Michal Hlavinka <mhlavink@redhat.com> - 84-1
-- ecryptfs-utils updated to 84
+- %{name} updated to 84
 
 * Wed Sep 29 2010 jkeating - 83-9
 - Rebuilt for gcc bug 634757