ssl-test: Add tests for PKCS#11 pin protected cert

8 files changed, 5924 insertions, 51 deletions

diff --git a/tests/meson.build b/tests/meson.build
index cb056a30..fc1cb3f7 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -23,6 +23,23 @@ test_resources = gnome.compile_resources('soup-tests',
   install_dir : installed_tests_execdir,
 )
 
+if gnutls_dep.found()
+  mock_pkcs11_module = shared_module('mock-pkcs11',
+      sources: 'mock-pkcs11.c',
+      name_prefix: '',
+      gnu_symbol_visibility: 'hidden',
+      include_directories: include_directories('pkcs11'),
+      dependencies: [
+        gio_dep,
+        gnutls_dep,
+      ],
+      install: installed_tests_enabled,
+      install_dir: installed_tests_execdir
+    )
+else
+  mock_pkcs11_module = []
+endif
+
 configure_file(input : 'index.txt',
   output : 'index.txt',
   copy : true)
@@ -50,37 +67,42 @@ endif
 
 # ['name', is_parallel, extra_deps]
 tests = [
-  ['cache', true, []],
-  ['chunk-io', true, []],
-  ['coding', true, []],
-  ['context', true, []],
-  ['continue', true, []],
-  ['cookies', true, []],
-  ['date', true, []],
-  ['forms', true, []],
-  ['header-parsing', true, []],
-  ['http2-body-stream', true, []],
-  ['hsts', true, []],
-  ['hsts-db', true, []],
-  ['logger', true, []],
-  ['misc', true, []],
-  ['multipart', true, []],
-  ['no-ssl', true, []],
-  ['ntlm', true, []],
-  ['redirect', true, []],
-  ['request-body', true, []],
-  ['samesite', true, []],
-  ['session', true, []],
-  ['server-auth', true, []],
-  ['server', true, []],
-  ['sniffing', true, []],
-  ['socket', true, []],
-  ['ssl', true, []],
-  ['streaming', true, []],
-  ['timeout', true, []],
-  ['tld', true, []],
-  ['uri-parsing', true, []],
-  ['websocket', true, [libz_dep]]
+  {'name': 'cache'},
+  {'name': 'chunk-io'},
+  {'name': 'coding'},
+  {'name': 'context'},
+  {'name': 'continue'},
+  {'name': 'cookies'},
+  {'name': 'date'},
+  {'name': 'forms'},
+  {'name': 'header-parsing'},
+  {'name': 'http2-body-stream'},
+  {'name': 'hsts'},
+  {'name': 'hsts-db'},
+  {'name': 'logger'},
+  {'name': 'misc'},
+  {'name': 'multipart'},
+  {'name': 'no-ssl'},
+  {'name': 'ntlm'},
+  {'name': 'redirect'},
+  {'name': 'request-body'},
+  {'name': 'samesite'},
+  {'name': 'session'},
+  {'name': 'server-auth'},
+  {'name': 'server'},
+  {'name': 'sniffing'},
+  {'name': 'socket'},
+  {'name': 'ssl',
+   'dependencies': [gnutls_dep],
+   'depends': mock_pkcs11_module,
+   'c_args': '-DHAVE_GNUTLS=@0@'.format(gnutls_dep.found() ? 1 : 0),
+  },
+  {'name': 'streaming'},
+  {'name': 'timeout'},
+  {'name': 'tld'},
+  {'name': 'uri-parsing'},
+  {'name': 'websocket',
+   'dependencies': [libz_dep]},
 ]
 
 if quart_found
@@ -88,15 +110,11 @@ if quart_found
     output : 'http2-server.py',
     copy : true)
 
-  tests += [
-    ['http2', true, []],
-  ]
+  tests += [{'name': 'http2'}]
 endif
 
 if brotlidec_dep.found()
-  tests += [
-    ['brotli-decompressor', true, []],
-  ]
+  tests += [{'name': 'brotli-decompressor'}]
 
   if installed_tests_enabled
     install_data(
@@ -109,17 +127,18 @@ if brotlidec_dep.found()
 endif
 
 if unix_socket_dep.found()
-  tests += [
-    ['unix-socket', true, [ unix_socket_dep ]],
-  ]
+  tests += [{
+    'name': 'unix-socket',
+    'dependencies': [unix_socket_dep],
+  }]
 endif
 
 if have_apache
   tests += [
-    ['auth', false, []],
-    ['connection', false, []],
-    ['range', false, []],
-    ['proxy', false, []],
+    {'name': 'auth', 'parallel': false},
+    {'name': 'connection', 'parallel': false},
+    {'name': 'range', 'parallel': false},
+    {'name': 'proxy', 'parallel': false},
   ]
 
   configure_file(output : 'httpd.conf',
@@ -164,14 +183,14 @@ if have_autobahn
 endif
 
 foreach test: tests
-  test_name = '@0@-test'.format(test[0])
+  test_name = '@0@-test'.format(test['name'])
 
   if installed_tests_enabled
     test_conf = configuration_data()
     test_conf.set('installed_tests_dir', abs_installed_tests_execdir)
     test_conf.set('program', test_name)
     test_conf.set('env', '')
-    test_conf.set('type', test[1] ? 'session' : 'session-exclusive')
+    test_conf.set('type', test.get('parallel', true) ? 'session' : 'session-exclusive')
     configure_file(
       input : installed_tests_template_tap,
       output : test_name + '.test',
@@ -180,9 +199,11 @@ foreach test: tests
     )
   endif
 
-  test_deps = [ libsoup_static_dep ] + test[2]
+  test_deps = [ libsoup_static_dep ] + test.get('dependencies', [])
   test_target = executable(test_name,
     sources : [ test_name + '.c', test_resources ],
+    c_args : test.get('c_args', []),
+    include_directories : test.get('includes', []),
     link_with : test_utils,
     dependencies : test_deps,
     install : installed_tests_enabled,
@@ -194,7 +215,8 @@ foreach test: tests
   test(test_name, test_target,
     args : ['--debug'],
     env : env,
-    is_parallel : test[1],
+    is_parallel : test.get('parallel', true),
+    depends : test.get('depends', []),
     timeout : 60,
     protocol : 'tap',
   )
diff --git a/tests/mock-pkcs11.c b/tests/mock-pkcs11.c
new file mode 100644
index 00000000..fc549d94
--- /dev/null
+++ b/tests/mock-pkcs11.c
@@ -0,0 +1,2866 @@
+/*
+ *  Copyright 2011-2016 The Pkcs11Interop Project
+ *  Copyright 2019 Igalia S.L.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+/*
+ *  Originally written for the Pkcs11Interop project by: Jaroslav IMRICH <jimrich@jimrich.sk>
+ */
+
+/*
+ * This file implements a PKCS #11 module to be loaded that returns a mock slot and objects.
+ *
+ * It is based on this project originally: https://github.com/Pkcs11Interop/pkcs11-mock
+ *
+ * Quite a few things have been changed since then though:
+ * - The CK defines just below use glib macros just out of convenience.
+ * - Logging was added just for ease of debugging.
+ * - Instead of hardcoded defines for objects this now has an array
+ *   of mock_objects that is easier to read and extend. The search behavior
+ *   of C_FindObjects was also updated to actually search through this.
+ * - The certificates/keys are real certificates/keys backed by gnutls
+ *   loading them in C_Initialize from glib-networkings normal test data.
+ *   This changes the behavior of many functions most notably including C_GetAttributeValue
+ *   and C_Sign to use them. Any function not used in a TLS handshake was largely
+ *   ignored and won't work.
+ */
+
+#undef G_LOG_DOMAIN
+#define G_LOG_DOMAIN "MockPKCS11"
+
+#include <gio/gio.h>
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include <gnutls/abstract.h>
+
+/* See http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html */
+#define CK_PTR *
+#define CK_DEFINE_FUNCTION(returnType, name) returnType G_MODULE_EXPORT name
+#define CK_DECLARE_FUNCTION(returnType, name) returnType G_MODULE_EXPORT name
+#define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType (* name)
+#define CK_CALLBACK_FUNCTION(returnType, name) returnType (* name)
+#define NULL_PTR NULL
+
+#include "pkcs11/pkcs11.h"
+
+
+#define IGNORE(P) (void)(P)
+
+#define MOCK_MANUFACTURER_ID "GLib-Networking"
+#define MOCK_MODEL "mock"
+#define PKCS11_MOCK_CK_TOKEN_INFO_MAX_PIN_LEN 256
+#define PKCS11_MOCK_CK_TOKEN_INFO_MIN_PIN_LEN 4
+
+static CK_INFO mock_info = {
+        .cryptokiVersion = { 2, 40 },
+        .manufacturerID = MOCK_MANUFACTURER_ID,
+        .libraryDescription = "Mock Module",
+};
+
+typedef struct {
+        CK_OBJECT_CLASS object_class;
+        CK_TOKEN_INFO info;
+        union {
+                gnutls_x509_crt_t cert;
+                gnutls_privkey_t key;
+        };
+} MockObject;
+
+static MockObject mock_objects[] = {
+        {
+                .object_class = CKO_CERTIFICATE,
+                .info = {
+                        .model = MOCK_MODEL,
+                        .label = "Mock Certificate",
+                        .serialNumber = "1",
+                        .manufacturerID = MOCK_MANUFACTURER_ID,
+                        .flags = CKF_TOKEN_INITIALIZED | CKF_WRITE_PROTECTED | CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED,
+                        .ulMaxSessionCount = 1,
+                },
+        },
+        {
+                .object_class = CKO_PRIVATE_KEY,
+                .info = {
+                        .model = MOCK_MODEL,
+                        .label = "Mock Private Key",
+                        .serialNumber = "2",
+                        .manufacturerID = MOCK_MANUFACTURER_ID,
+                        .flags = CKF_TOKEN_INITIALIZED | CKF_WRITE_PROTECTED | CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED,
+                        .ulMaxSessionCount = 1,
+                        .ulMaxPinLen = PKCS11_MOCK_CK_TOKEN_INFO_MAX_PIN_LEN,
+                        .ulMinPinLen = PKCS11_MOCK_CK_TOKEN_INFO_MIN_PIN_LEN,
+                },
+        }
+};
+
+typedef struct {
+        CK_SLOT_INFO info;
+        //CK_TOKEN_INFO_PTR tokens[2];
+} MockSlot;
+
+static const MockSlot mock_slots[] = {
+        {
+                .info = {
+                        .slotDescription = "Mock Slot",
+                        .manufacturerID = MOCK_MANUFACTURER_ID,
+                        .flags = CKF_TOKEN_PRESENT,
+                },
+        }
+};
+
+
+// FIXME: These are left overs that are unused
+#define PKCS11_MOCK_CK_OBJECT_HANDLE_DATA 1
+#define PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY 2
+#define PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY 3
+#define PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY 4
+#define PKCS11_MOCK_CK_SLOT_ID 0
+
+#define PKCS11_MOCK_CK_SESSION_ID 1
+
+typedef enum
+{
+        PKCS11_MOCK_CK_OPERATION_NONE,
+        PKCS11_MOCK_CK_OPERATION_FIND,
+        PKCS11_MOCK_CK_OPERATION_ENCRYPT,
+        PKCS11_MOCK_CK_OPERATION_DECRYPT,
+        PKCS11_MOCK_CK_OPERATION_DIGEST,
+        PKCS11_MOCK_CK_OPERATION_SIGN,
+        PKCS11_MOCK_CK_OPERATION_SIGN_RECOVER,
+        PKCS11_MOCK_CK_OPERATION_VERIFY,
+        PKCS11_MOCK_CK_OPERATION_VERIFY_RECOVER,
+        PKCS11_MOCK_CK_OPERATION_DIGEST_ENCRYPT,
+        PKCS11_MOCK_CK_OPERATION_DECRYPT_DIGEST,
+        PKCS11_MOCK_CK_OPERATION_SIGN_ENCRYPT,
+        PKCS11_MOCK_CK_OPERATION_DECRYPT_VERIFY
+} PKCS11_MOCK_CK_OPERATION;
+
+#define PKCS11_MOCK_CKO_ANYTHING -1 // We'll use -1 as a magic match all
+
+static CK_BBOOL pkcs11_mock_initialized = CK_FALSE;
+static CK_BBOOL pkcs11_mock_session_opened = CK_FALSE;
+static CK_ULONG pkcs11_mock_session_state = CKS_RO_PUBLIC_SESSION;
+static PKCS11_MOCK_CK_OPERATION pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+static CK_ULONG pkcs11_mock_sign_key = 0;
+static CK_LONG mock_search_template_class = PKCS11_MOCK_CKO_ANYTHING;
+static char *mock_search_template_label;
+static CK_ULONG mock_search_iterator = 0;
+static gboolean mock_logged_in_state = FALSE;
+static size_t mock_login_attempts = 0;
+static CK_ULONG mock_sign_algo = 0;
+
+static CK_FUNCTION_LIST pkcs11_mock_functions = 
+{
+        {2, 20},
+        &C_Initialize,
+        &C_Finalize,
+        &C_GetInfo,
+        &C_GetFunctionList,
+        &C_GetSlotList,
+        &C_GetSlotInfo,
+        &C_GetTokenInfo,
+        &C_GetMechanismList,
+        &C_GetMechanismInfo,
+        &C_InitToken,
+        &C_InitPIN,
+        &C_SetPIN,
+        &C_OpenSession,
+        &C_CloseSession,
+        &C_CloseAllSessions,
+        &C_GetSessionInfo,
+        &C_GetOperationState,
+        &C_SetOperationState,
+        &C_Login,
+        &C_Logout,
+        &C_CreateObject,
+        &C_CopyObject,
+        &C_DestroyObject,
+        &C_GetObjectSize,
+        &C_GetAttributeValue,
+        &C_SetAttributeValue,
+        &C_FindObjectsInit,
+        &C_FindObjects,
+        &C_FindObjectsFinal,
+        &C_EncryptInit,
+        &C_Encrypt,
+        &C_EncryptUpdate,
+        &C_EncryptFinal,
+        &C_DecryptInit,
+        &C_Decrypt,
+        &C_DecryptUpdate,
+        &C_DecryptFinal,
+        &C_DigestInit,
+        &C_Digest,
+        &C_DigestUpdate,
+        &C_DigestKey,
+        &C_DigestFinal,
+        &C_SignInit,
+        &C_Sign,
+        &C_SignUpdate,
+        &C_SignFinal,
+        &C_SignRecoverInit,
+        &C_SignRecover,
+        &C_VerifyInit,
+        &C_Verify,
+        &C_VerifyUpdate,
+        &C_VerifyFinal,
+        &C_VerifyRecoverInit,
+        &C_VerifyRecover,
+        &C_DigestEncryptUpdate,
+        &C_DecryptDigestUpdate,
+        &C_SignEncryptUpdate,
+        &C_DecryptVerifyUpdate,
+        &C_GenerateKey,
+        &C_GenerateKeyPair,
+        &C_WrapKey,
+        &C_UnwrapKey,
+        &C_DeriveKey,
+        &C_SeedRandom,
+        &C_GenerateRandom,
+        &C_GetFunctionStatus,
+        &C_CancelFunction,
+        &C_WaitForSlotEvent
+};
+
+
+/* Copy a string into a buffer without NUL termination and padded with ' ' */
+static void
+copy_padded_string(CK_UTF8CHAR_PTR dest, const CK_UTF8CHAR_PTR src, size_t dest_size)
+{
+        const size_t len = strlen((char*)src);
+
+        g_assert (len < dest_size);
+
+        memset(dest, ' ', dest_size);
+        memcpy(dest, src, len);
+}
+
+CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(CK_VOID_PTR pInitArgs)
+{
+        int status;
+        gnutls_datum_t data;
+        char *path;
+
+        if (CK_TRUE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_ALREADY_INITIALIZED;
+
+        IGNORE(pInitArgs);
+
+        path = g_test_build_filename(G_TEST_DIST, "test-cert.pem", NULL);
+        status = gnutls_load_file(path, &data);
+        g_debug("Loading %s - %s", path, gnutls_strerror(status));
+        g_assert(status == GNUTLS_E_SUCCESS);
+
+        status = gnutls_x509_crt_init(&mock_objects[0].cert);
+        g_assert(status == GNUTLS_E_SUCCESS);
+
+        status = gnutls_x509_crt_import(mock_objects[0].cert, &data, GNUTLS_X509_FMT_PEM);
+        g_assert(status == GNUTLS_E_SUCCESS);
+
+        gnutls_free(data.data);
+        g_free(path);
+
+        path = g_test_build_filename(G_TEST_DIST, "test-key.pem", NULL);
+        status = gnutls_load_file(path, &data);
+        g_debug("Loading %s - %s", path, gnutls_strerror(status));
+        g_assert(status == GNUTLS_E_SUCCESS);
+
+        status = gnutls_privkey_init(&mock_objects[1].key);
+        g_assert(status == GNUTLS_E_SUCCESS);
+
+        status = gnutls_privkey_import_x509_raw(mock_objects[1].key, &data, GNUTLS_X509_FMT_PEM, NULL, 0);
+        g_assert(status == GNUTLS_E_SUCCESS);
+
+        gnutls_free(data.data);
+        g_free(path);
+
+        pkcs11_mock_initialized = CK_TRUE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_Finalize)(CK_VOID_PTR pReserved)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        IGNORE(pReserved);
+
+        gnutls_x509_crt_deinit(mock_objects[0].cert);
+        gnutls_privkey_deinit(mock_objects[1].key);
+
+        pkcs11_mock_initialized = CK_FALSE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetInfo)(CK_INFO_PTR pInfo)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (NULL == pInfo)
+                return CKR_ARGUMENTS_BAD;
+
+        pInfo->cryptokiVersion = mock_info.cryptokiVersion;
+        copy_padded_string(pInfo->manufacturerID, mock_info.manufacturerID, sizeof(pInfo->manufacturerID));
+        pInfo->flags = 0;
+        copy_padded_string(pInfo->libraryDescription, mock_info.libraryDescription, sizeof(pInfo->libraryDescription));
+        pInfo->libraryVersion = mock_info.libraryVersion;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetFunctionList)(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
+{
+        if (NULL == ppFunctionList)
+                return CKR_ARGUMENTS_BAD;
+
+        *ppFunctionList = &pkcs11_mock_functions;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetSlotList)(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList, CK_ULONG_PTR pulCount)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        IGNORE(tokenPresent);
+
+        if (NULL == pulCount)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pSlotList)
+        {
+                *pulCount = 1;
+        }
+        else
+        {
+                if (0 == *pulCount)
+                        return CKR_BUFFER_TOO_SMALL;
+
+                pSlotList[0] = PKCS11_MOCK_CK_SLOT_ID;
+                *pulCount = 1;
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetSlotInfo)(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo)
+{
+        MockSlot mock_slot;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (slotID > G_N_ELEMENTS (mock_slots))
+                return CKR_SLOT_ID_INVALID;
+
+        if (NULL == pInfo)
+                return CKR_ARGUMENTS_BAD;
+
+        mock_slot = mock_slots[slotID];
+
+        copy_padded_string(pInfo->slotDescription, mock_slot.info.slotDescription, sizeof(pInfo->slotDescription));
+        copy_padded_string(pInfo->manufacturerID, mock_slot.info.manufacturerID, sizeof(pInfo->manufacturerID));
+        pInfo->flags = mock_slot.info.flags;
+        pInfo->hardwareVersion = mock_slot.info.hardwareVersion;
+        pInfo->firmwareVersion = mock_slot.info.firmwareVersion;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetTokenInfo)(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo)
+{
+        CK_TOKEN_INFO token;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (slotID > G_N_ELEMENTS (mock_slots))
+                return CKR_SLOT_ID_INVALID;
+
+        if (NULL == pInfo)
+                return CKR_ARGUMENTS_BAD;
+
+        token = mock_objects[slotID].info;
+
+        copy_padded_string(pInfo->label, token.label, sizeof(pInfo->label));
+        copy_padded_string(pInfo->manufacturerID, token.manufacturerID, sizeof(pInfo->manufacturerID));
+        copy_padded_string(pInfo->serialNumber, token.serialNumber, sizeof(pInfo->serialNumber));
+        copy_padded_string(pInfo->model, token.model, sizeof(pInfo->model));
+        pInfo->flags = token.flags;
+        pInfo->ulMaxSessionCount = token.ulMaxSessionCount;
+        pInfo->ulSessionCount = (CK_TRUE == pkcs11_mock_session_opened) ? 1 : 0;
+        pInfo->ulMaxRwSessionCount = token.ulMaxRwSessionCount;
+        pInfo->ulRwSessionCount = ((CK_TRUE == pkcs11_mock_session_opened) && ((CKS_RO_PUBLIC_SESSION != pkcs11_mock_session_state) || (CKS_RO_USER_FUNCTIONS != pkcs11_mock_session_state))) ? 1 : 0;
+        pInfo->ulMaxPinLen = token.ulMaxPinLen;
+        pInfo->ulMinPinLen = token.ulMinPinLen;
+        pInfo->ulTotalPublicMemory = token.ulTotalPublicMemory;
+        pInfo->ulFreePublicMemory = token.ulFreePublicMemory;
+        pInfo->ulTotalPrivateMemory = token.ulTotalPrivateMemory;
+        pInfo->ulFreePrivateMemory = token.ulFreePrivateMemory;
+        pInfo->hardwareVersion = token.hardwareVersion;
+        pInfo->firmwareVersion = token.firmwareVersion;
+        memset(pInfo->utcTime, ' ', sizeof(pInfo->utcTime));
+
+        // FIXME: Not picked up by gnutls
+        if (mock_login_attempts > 2)
+        {
+                pInfo->flags |= CKF_USER_PIN_COUNT_LOW;
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetMechanismList)(CK_SLOT_ID slotID, CK_MECHANISM_TYPE_PTR pMechanismList, CK_ULONG_PTR pulCount)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (slotID > G_N_ELEMENTS(mock_slots))
+                return CKR_SLOT_ID_INVALID;
+
+        if (NULL == pulCount)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pMechanismList)
+        {
+                *pulCount = 9;
+        }
+        else
+        {
+                if (9 > *pulCount)
+                        return CKR_BUFFER_TOO_SMALL;
+
+                pMechanismList[0] = CKM_RSA_PKCS_KEY_PAIR_GEN;
+                pMechanismList[1] = CKM_RSA_PKCS;
+                pMechanismList[2] = CKM_SHA1_RSA_PKCS;
+                pMechanismList[3] = CKM_RSA_PKCS_OAEP;
+                pMechanismList[4] = CKM_DES3_CBC;
+                pMechanismList[5] = CKM_DES3_KEY_GEN;
+                pMechanismList[6] = CKM_SHA_1;
+                pMechanismList[7] = CKM_XOR_BASE_AND_DATA;
+                pMechanismList[8] = CKM_AES_CBC;
+
+                *pulCount = 9;
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetMechanismInfo)(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type, CK_MECHANISM_INFO_PTR pInfo)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_SLOT_ID != slotID)
+                return CKR_SLOT_ID_INVALID;
+
+        if (NULL == pInfo)
+                return CKR_ARGUMENTS_BAD;
+
+        switch (type)
+        {
+                case CKM_RSA_PKCS_KEY_PAIR_GEN:
+                        pInfo->ulMinKeySize = 1024;
+                        pInfo->ulMaxKeySize = 1024;
+                        pInfo->flags = CKF_GENERATE_KEY_PAIR;
+                        break;
+
+                case CKM_RSA_PKCS:
+                        pInfo->ulMinKeySize = 1024;
+                        pInfo->ulMaxKeySize = 1024;
+                        pInfo->flags = CKF_ENCRYPT | CKF_DECRYPT | CKF_SIGN | CKF_SIGN_RECOVER | CKF_VERIFY | CKF_VERIFY_RECOVER | CKF_WRAP | CKF_UNWRAP;
+                        break;
+
+                case CKM_SHA1_RSA_PKCS:
+                        pInfo->ulMinKeySize = 1024;
+                        pInfo->ulMaxKeySize = 1024;
+                        pInfo->flags = CKF_SIGN | CKF_VERIFY;
+                        break;
+
+                case CKM_RSA_PKCS_OAEP:
+                        pInfo->ulMinKeySize = 1024;
+                        pInfo->ulMaxKeySize = 1024;
+                        pInfo->flags = CKF_ENCRYPT | CKF_DECRYPT;
+                        break;
+
+                case CKM_DES3_CBC:
+                        pInfo->ulMinKeySize = 192;
+                        pInfo->ulMaxKeySize = 192;
+                        pInfo->flags = CKF_ENCRYPT | CKF_DECRYPT;
+                        break;
+
+                case CKM_DES3_KEY_GEN:
+                        pInfo->ulMinKeySize = 192;
+                        pInfo->ulMaxKeySize = 192;
+                        pInfo->flags = CKF_GENERATE;
+                        break;
+
+                case CKM_SHA_1:
+                        pInfo->ulMinKeySize = 0;
+                        pInfo->ulMaxKeySize = 0;
+                        pInfo->flags = CKF_DIGEST;
+                        break;
+
+                case CKM_XOR_BASE_AND_DATA:
+                        pInfo->ulMinKeySize = 128;
+                        pInfo->ulMaxKeySize = 256;
+                        pInfo->flags = CKF_DERIVE;
+                        break;
+
+                case CKM_AES_CBC:
+                        pInfo->ulMinKeySize = 128;
+                        pInfo->ulMaxKeySize = 256;
+                        pInfo->flags = CKF_ENCRYPT | CKF_DECRYPT;
+                        break;
+
+                case CKM_RSA_PKCS_PSS:
+                        // FIXME: Made up key sizes
+                        pInfo->ulMinKeySize = 256;
+                        pInfo->ulMaxKeySize = 256;
+                        // Flags based on table here: http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/csd01/pkcs11-curr-v2.40-csd01.html
+                        pInfo->flags = CKF_SIGN | CKF_VERIFY;
+                        break;
+
+                default:
+                        return CKR_MECHANISM_INVALID;
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_InitToken)(CK_SLOT_ID slotID, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen, CK_UTF8CHAR_PTR pLabel)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_SLOT_ID != slotID)
+                return CKR_SLOT_ID_INVALID;
+
+        if (NULL == pPin)
+                return CKR_ARGUMENTS_BAD;
+
+        if ((ulPinLen < PKCS11_MOCK_CK_TOKEN_INFO_MIN_PIN_LEN) || (ulPinLen > PKCS11_MOCK_CK_TOKEN_INFO_MAX_PIN_LEN))
+                return CKR_PIN_LEN_RANGE;
+
+        if (NULL == pLabel)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CK_TRUE == pkcs11_mock_session_opened)
+                return CKR_SESSION_EXISTS;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_InitPIN)(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (CKS_RW_SO_FUNCTIONS != pkcs11_mock_session_state)
+                return CKR_USER_NOT_LOGGED_IN;
+
+        if (NULL == pPin)
+                return CKR_ARGUMENTS_BAD;
+
+        if ((ulPinLen < PKCS11_MOCK_CK_TOKEN_INFO_MIN_PIN_LEN) || (ulPinLen > PKCS11_MOCK_CK_TOKEN_INFO_MAX_PIN_LEN))
+                return CKR_PIN_LEN_RANGE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SetPIN)(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin, CK_ULONG ulOldLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewLen)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if ((CKS_RO_PUBLIC_SESSION == pkcs11_mock_session_state) || (CKS_RO_USER_FUNCTIONS == pkcs11_mock_session_state))
+                return CKR_SESSION_READ_ONLY;
+
+        if (NULL == pOldPin)
+                return CKR_ARGUMENTS_BAD;
+
+        if ((ulOldLen < PKCS11_MOCK_CK_TOKEN_INFO_MIN_PIN_LEN) || (ulOldLen > PKCS11_MOCK_CK_TOKEN_INFO_MAX_PIN_LEN))
+                return CKR_PIN_LEN_RANGE;
+
+        if (NULL == pNewPin)
+                return CKR_ARGUMENTS_BAD;
+
+        if ((ulNewLen < PKCS11_MOCK_CK_TOKEN_INFO_MIN_PIN_LEN) || (ulNewLen > PKCS11_MOCK_CK_TOKEN_INFO_MAX_PIN_LEN))
+                return CKR_PIN_LEN_RANGE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_OpenSession)(CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication, CK_NOTIFY Notify, CK_SESSION_HANDLE_PTR phSession)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (CK_TRUE == pkcs11_mock_session_opened)
+                return CKR_SESSION_COUNT;
+
+        if (PKCS11_MOCK_CK_SLOT_ID != slotID)
+                return CKR_SLOT_ID_INVALID;
+
+        if (!(flags & CKF_SERIAL_SESSION))
+                return CKR_SESSION_PARALLEL_NOT_SUPPORTED;
+
+        IGNORE(pApplication);
+
+        IGNORE(Notify);
+
+        if (NULL == phSession)
+                return CKR_ARGUMENTS_BAD;
+
+        pkcs11_mock_session_opened = CK_TRUE;
+        pkcs11_mock_session_state = (flags & CKF_RW_SESSION) ? CKS_RW_PUBLIC_SESSION : CKS_RO_PUBLIC_SESSION;
+        *phSession = PKCS11_MOCK_CK_SESSION_ID;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_CloseSession)(CK_SESSION_HANDLE hSession)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        pkcs11_mock_session_opened = CK_FALSE;
+        pkcs11_mock_session_state = CKS_RO_PUBLIC_SESSION;
+        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_CloseAllSessions)(CK_SLOT_ID slotID)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_SLOT_ID != slotID)
+                return CKR_SLOT_ID_INVALID;
+
+        pkcs11_mock_session_opened = CK_FALSE;
+        pkcs11_mock_session_state = CKS_RO_PUBLIC_SESSION;
+        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetSessionInfo)(CK_SESSION_HANDLE hSession, CK_SESSION_INFO_PTR pInfo)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pInfo)
+                return CKR_ARGUMENTS_BAD;
+
+        pInfo->slotID = PKCS11_MOCK_CK_SLOT_ID;
+        pInfo->state = pkcs11_mock_session_state;
+        pInfo->flags = CKF_SERIAL_SESSION;
+        if ((pkcs11_mock_session_state != CKS_RO_PUBLIC_SESSION) && (pkcs11_mock_session_state != CKS_RO_USER_FUNCTIONS))
+                pInfo->flags = pInfo->flags | CKF_RW_SESSION;
+        pInfo->ulDeviceError = 0;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetOperationState)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pOperationState, CK_ULONG_PTR pulOperationStateLen)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pulOperationStateLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pOperationState)
+        {
+                *pulOperationStateLen = 256;
+        }
+        else
+        {
+                if (256 > *pulOperationStateLen)
+                        return CKR_BUFFER_TOO_SMALL;
+
+                memset(pOperationState, 1, 256);
+                *pulOperationStateLen = 256;
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SetOperationState)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pOperationState, CK_ULONG ulOperationStateLen, CK_OBJECT_HANDLE hEncryptionKey, CK_OBJECT_HANDLE hAuthenticationKey)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pOperationState)
+                return CKR_ARGUMENTS_BAD;
+
+        if (256 != ulOperationStateLen)
+                return CKR_ARGUMENTS_BAD;
+
+        IGNORE(hEncryptionKey);
+
+        IGNORE(hAuthenticationKey);
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_Login)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen)
+{
+        // More hardcoding
+        const char *password = "ABC123";
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if ((CKU_SO != userType) && (CKU_USER != userType) && (CKU_CONTEXT_SPECIFIC != userType))
+                return CKR_USER_TYPE_INVALID;
+
+        if (NULL == pPin)
+                return CKR_ARGUMENTS_BAD;
+
+        if ((ulPinLen < PKCS11_MOCK_CK_TOKEN_INFO_MIN_PIN_LEN) || (ulPinLen > PKCS11_MOCK_CK_TOKEN_INFO_MAX_PIN_LEN))
+                return CKR_PIN_LEN_RANGE;
+
+        // FIXME: gnutls bug? It calls this before an operation
+        // if (pkcs11_mock_active_operation == PKCS11_MOCK_CK_OPERATION_NONE && CKU_CONTEXT_SPECIFIC != userType)
+        //         return CKR_OPERATION_NOT_INITIALIZED;
+
+        if (mock_logged_in_state == TRUE)
+                return CKR_USER_ALREADY_LOGGED_IN;
+
+        if (ulPinLen == strlen (password) && strncmp ((char*)pPin, password, ulPinLen) == 0)
+        {
+                mock_logged_in_state = TRUE;
+                mock_login_attempts = 0;
+                return CKR_OK;
+        }
+        else
+        {
+                mock_login_attempts += 1;
+                return CKR_PIN_INCORRECT;
+        }
+
+        // TODO: We don't test any of these states atm
+        // switch (pkcs11_mock_session_state)
+        // {
+        //         case CKS_RO_PUBLIC_SESSION:
+
+        //                 if (CKU_SO == userType)
+        //                         rv = CKR_SESSION_READ_ONLY_EXISTS;
+        //                 else
+        //                         pkcs11_mock_session_state = CKS_RO_USER_FUNCTIONS;
+
+        //                 break;
+
+        //         case CKS_RO_USER_FUNCTIONS:
+        //         case CKS_RW_USER_FUNCTIONS:
+
+        //                 rv = (CKU_SO == userType) ? CKR_USER_ANOTHER_ALREADY_LOGGED_IN : CKR_USER_ALREADY_LOGGED_IN;
+
+        //                 break;
+
+        //         case CKS_RW_PUBLIC_SESSION:
+
+        //                 pkcs11_mock_session_state = (CKU_SO == userType) ? CKS_RW_SO_FUNCTIONS : CKS_RW_USER_FUNCTIONS;
+
+        //                 break;
+
+        //         case CKS_RW_SO_FUNCTIONS:
+
+        //                 rv = (CKU_SO == userType) ? CKR_USER_ALREADY_LOGGED_IN : CKR_USER_ANOTHER_ALREADY_LOGGED_IN;
+
+        //                 break;
+        // }
+
+        // return rv;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_Logout)(CK_SESSION_HANDLE hSession)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (mock_logged_in_state == FALSE)
+                return CKR_USER_NOT_LOGGED_IN;
+
+        // if ((pkcs11_mock_session_state == CKS_RO_PUBLIC_SESSION) || (pkcs11_mock_session_state == CKS_RW_PUBLIC_SESSION))
+        //         return CKR_USER_NOT_LOGGED_IN;
+
+        mock_logged_in_state =  FALSE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_CreateObject)(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phObject)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pTemplate)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulCount)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == phObject)
+                return CKR_ARGUMENTS_BAD;
+
+        for (i = 0; i < ulCount; i++)
+        {
+                if (NULL == pTemplate[i].pValue)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                if (0 >= pTemplate[i].ulValueLen)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+        }
+
+        *phObject = PKCS11_MOCK_CK_OBJECT_HANDLE_DATA;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_CopyObject)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phNewObject)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (PKCS11_MOCK_CK_OBJECT_HANDLE_DATA != hObject)
+                return CKR_OBJECT_HANDLE_INVALID;
+
+        if (NULL == phNewObject)
+                return CKR_ARGUMENTS_BAD;
+
+        if ((NULL != pTemplate) && (0 >= ulCount))
+        {
+                for (i = 0; i < ulCount; i++)
+                {
+                        if (NULL == pTemplate[i].pValue)
+                                return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                        if (0 >= pTemplate[i].ulValueLen)
+                                return CKR_ATTRIBUTE_VALUE_INVALID;
+                }
+        }
+
+        *phNewObject = PKCS11_MOCK_CK_OBJECT_HANDLE_DATA;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DestroyObject)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if ((PKCS11_MOCK_CK_OBJECT_HANDLE_DATA != hObject) &&
+                (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hObject) &&
+                (PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY != hObject) &&
+                (PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY != hObject))
+                return CKR_OBJECT_HANDLE_INVALID;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetObjectSize)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject, CK_ULONG_PTR pulSize)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (hObject > G_N_ELEMENTS (mock_objects))
+                return CKR_OBJECT_HANDLE_INVALID;
+
+        if (NULL == pulSize)
+                return CKR_ARGUMENTS_BAD;
+
+        *pulSize = 0; // FIXME: mock_objects[hObject].size;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetAttributeValue)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount)
+{
+        CK_ULONG i = 0;
+        MockObject obj;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (hObject > G_N_ELEMENTS (mock_objects))
+                return CKR_OBJECT_HANDLE_INVALID;
+
+        if (NULL == pTemplate)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulCount)
+                return CKR_ARGUMENTS_BAD;
+
+        obj = mock_objects[hObject];
+
+        for (i = 0; i < ulCount; i++)
+        {
+                if (CKA_LABEL == pTemplate[i].type || CKA_ID == pTemplate[i].type)
+                {
+                        if (NULL != pTemplate[i].pValue)
+                        {
+                                if (pTemplate[i].ulValueLen < strlen((char*)obj.info.label))
+                                        return CKR_BUFFER_TOO_SMALL;
+                                else
+                                        memcpy(pTemplate[i].pValue, obj.info.label, strlen((char*)obj.info.label));
+                        }
+
+                        pTemplate[i].ulValueLen = strlen((char*)obj.info.label);
+                }
+                else if (CKA_EXTRACTABLE == pTemplate[i].type)
+                {
+                        *((CK_BBOOL *) pTemplate[i].pValue) = obj.object_class == CKO_CERTIFICATE ? CK_TRUE : CK_FALSE;
+                        pTemplate[i].ulValueLen = sizeof(CK_BBOOL);
+                }
+                else if (CKA_NEVER_EXTRACTABLE == pTemplate[i].type || CKA_SENSITIVE == pTemplate[i].type)
+                {
+                        *((CK_BBOOL *) pTemplate[i].pValue) = obj.object_class == CKO_PRIVATE_KEY ? CK_TRUE : CK_FALSE;
+                        pTemplate[i].ulValueLen = sizeof(CK_BBOOL);
+                }
+		else if (CKA_CERTIFICATE_CATEGORY == pTemplate[i].type)
+		{
+			CK_ULONG t;
+			if (pTemplate[i].ulValueLen < sizeof(CK_ULONG))
+				return CKR_BUFFER_TOO_SMALL;
+
+                        if (obj.object_class == CKO_CERTIFICATE)
+                                t = CK_CERTIFICATE_CATEGORY_AUTHORITY;
+                        else
+                                t = CK_CERTIFICATE_CATEGORY_UNSPECIFIED;
+
+			memcpy(pTemplate[i].pValue, &t, sizeof(CK_ULONG));
+		}
+                else if (CKA_SUBJECT == pTemplate[i].type)
+                {
+                        int status;
+                        gnutls_datum_t data;
+                        gnutls_x509_dn_t dn; /* Owned by cert */
+
+                        g_assert (obj.object_class == CKO_CERTIFICATE);
+
+                        status = gnutls_x509_crt_get_subject(obj.cert, &dn);
+                        g_assert(status == GNUTLS_E_SUCCESS);
+                        status = gnutls_x509_dn_get_str(dn, &data);
+                        g_assert(status == GNUTLS_E_SUCCESS);
+
+                        if (data.size > pTemplate[i].ulValueLen)
+                        {
+                                gnutls_free(data.data);
+                                pTemplate[i].ulValueLen = data.size;
+                                if (pTemplate[i].pValue != NULL) /* If NULL return OK */
+                                        return CKR_BUFFER_TOO_SMALL;
+                        }
+                        else
+                        {
+                                memcpy(pTemplate[i].pValue, data.data, data.size);
+                                pTemplate[i].ulValueLen = data.size;
+                                gnutls_free(data.data);
+                        }
+                }
+                else if (CKA_VALUE == pTemplate[i].type)
+                {
+                        if (obj.object_class == CKO_CERTIFICATE)
+                        {
+                                int status;
+                                gnutls_datum_t data;
+
+                                status = gnutls_x509_crt_export2(obj.cert, GNUTLS_X509_FMT_DER, &data);
+                                g_assert(status == GNUTLS_E_SUCCESS);
+
+                                if (data.size > pTemplate[i].ulValueLen)
+                                {
+                                        gnutls_free(data.data);
+                                        pTemplate[i].ulValueLen = data.size;
+                                        if (pTemplate[i].pValue != NULL) /* If NULL return OK */
+                                                return CKR_BUFFER_TOO_SMALL;
+                                }
+                                else
+                                {
+                                        memcpy(pTemplate[i].pValue, data.data, data.size);
+                                        gnutls_free(data.data);
+                                        pTemplate[i].ulValueLen = data.size;
+                                }
+                        }
+                        else
+                        {
+                                pTemplate[i].ulValueLen = CK_UNAVAILABLE_INFORMATION;
+                        }
+                }
+                else if (CKA_CLASS == pTemplate[i].type)
+                {
+                        if (NULL != pTemplate[i].pValue)
+                                *((CK_ULONG *) pTemplate[i].pValue) = obj.object_class;
+                        pTemplate[i].ulValueLen = sizeof (obj.object_class);
+                }
+                 else if (CKA_CERTIFICATE_TYPE == pTemplate[i].type)
+                {
+                        CK_CERTIFICATE_TYPE ret = CKC_X_509;
+
+			if (pTemplate[i].ulValueLen != sizeof(CK_CERTIFICATE_TYPE))
+				return CKR_ARGUMENTS_BAD;
+
+                        /* TODO: Test both TRUE and FALSE */
+			memcpy(pTemplate[i].pValue, &ret, sizeof(CK_CERTIFICATE_TYPE));
+                }
+		else if (CKA_KEY_TYPE == pTemplate[i].type)
+		{
+			CK_KEY_TYPE t;
+			if (pTemplate[i].ulValueLen != sizeof(CK_KEY_TYPE))
+				return CKR_ARGUMENTS_BAD;
+
+                        if (obj.object_class != CKO_PRIVATE_KEY)
+                                return CKR_ARGUMENTS_BAD;
+
+                        switch (gnutls_privkey_get_pk_algorithm (obj.key, NULL))
+                        {
+                                case GNUTLS_PK_RSA:
+                                        t = CKK_RSA;
+                                        break;
+                                case GNUTLS_PK_DSA:
+                                        t = CKK_DSA;
+                                        break;
+                                case GNUTLS_PK_DH:
+                                        t = CKK_DH;
+                                        break;
+                                case GNUTLS_PK_EC:
+                                        t = CKK_EC;
+                                        break;
+                                default:
+                                        pTemplate[i].ulValueLen = CK_UNAVAILABLE_INFORMATION;
+                                        return CKR_ATTRIBUTE_TYPE_INVALID;
+                        }
+
+			memcpy(pTemplate[i].pValue, &t, sizeof(CK_KEY_TYPE));
+		}
+		else if (CKA_ALWAYS_AUTHENTICATE == pTemplate[i].type)
+		{
+                        CK_BBOOL ret = CK_TRUE;
+
+			if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL))
+				return CKR_ARGUMENTS_BAD;
+
+                        /* TODO: Test both TRUE and FALSE */
+			memcpy(pTemplate[i].pValue, &ret, sizeof(CK_BBOOL));
+		}
+		else if (CKA_MODULUS == pTemplate[i].type && obj.object_class == CKO_PRIVATE_KEY)
+		{
+                        /* Hardcode RSA for now */
+                        gnutls_datum_t modulus;
+                        int status = gnutls_privkey_export_rsa_raw (obj.key, &modulus, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+                        g_assert (status == GNUTLS_E_SUCCESS);
+
+                        if (modulus.size > pTemplate[i].ulValueLen)
+                        {
+                                gnutls_free(modulus.data);
+                                pTemplate[i].ulValueLen = modulus.size;
+                                if (pTemplate[i].pValue != NULL) /* If NULL return OK */
+                                        return CKR_BUFFER_TOO_SMALL;
+                        }
+                        else
+                        {
+                                memcpy(pTemplate[i].pValue, modulus.data, modulus.size);
+                                gnutls_free(modulus.data);
+                                pTemplate[i].ulValueLen = modulus.size;
+                        }
+		}
+                else if (CKA_SIGN == pTemplate[i].type && obj.object_class == CKO_PRIVATE_KEY) /* Any key type in future */
+                {
+                        CK_BBOOL ret = CK_TRUE;
+
+			if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL))
+				return CKR_ARGUMENTS_BAD;
+
+			memcpy(pTemplate[i].pValue, &ret, sizeof(CK_BBOOL));
+                }
+                else
+                {
+                        return CKR_ATTRIBUTE_TYPE_INVALID;
+                }
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SetAttributeValue)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (hObject > G_N_ELEMENTS (mock_objects))
+        if ((PKCS11_MOCK_CK_OBJECT_HANDLE_DATA != hObject) &&
+                (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hObject) &&
+                (PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY != hObject) &&
+                (PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY != hObject))
+                return CKR_OBJECT_HANDLE_INVALID;
+
+        if (NULL == pTemplate)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulCount)
+                return CKR_ARGUMENTS_BAD;
+
+        for (i = 0; i < ulCount; i++)
+        {
+                if ((CKA_LABEL == pTemplate[i].type) || (CKA_VALUE == pTemplate[i].type))
+                {
+                        if (NULL == pTemplate[i].pValue)
+                                return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                        if (0 >= pTemplate[i].ulValueLen)
+                                return CKR_ATTRIBUTE_VALUE_INVALID;
+                }
+                else
+                {
+                        return CKR_ATTRIBUTE_TYPE_INVALID;
+                }
+        }
+
+        return CKR_OK;
+}
+
+CK_DEFINE_FUNCTION(CK_RV, C_FindObjectsInit)(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount)
+{
+        CK_ULONG i = 0;
+        CK_ULONG_PTR cka_class_value = NULL;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_NONE != pkcs11_mock_active_operation)
+                return CKR_OPERATION_ACTIVE;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pTemplate && ulCount != 0)
+                return CKR_ARGUMENTS_BAD;
+
+        mock_search_template_class = PKCS11_MOCK_CKO_ANYTHING;
+        g_clear_pointer (&mock_search_template_label, g_free);
+
+        for (i = 0; i < ulCount; i++)
+        {
+                if (NULL == pTemplate[i].pValue)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                if (0 >= pTemplate[i].ulValueLen)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                if (CKA_CLASS == pTemplate[i].type)
+                {
+                        if (sizeof(CK_ULONG) != pTemplate[i].ulValueLen)
+                                return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                        cka_class_value = (CK_ULONG_PTR) pTemplate[i].pValue;
+                        mock_search_template_class = *cka_class_value;
+                }
+                else if (CKA_LABEL == pTemplate[i].type)
+                {
+                        const char *cka_label_value = (char*)pTemplate[i].pValue;
+                        mock_search_template_label = g_strndup (cka_label_value, pTemplate[i].ulValueLen);
+                }
+                else
+                {
+                        g_info ("Ignoring search template for %lu", pTemplate[i].type);
+                }
+        }
+
+        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_FIND;
+        mock_search_iterator = 0;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_FindObjects)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE_PTR phObject, CK_ULONG ulMaxObjectCount, CK_ULONG_PTR pulObjectCount)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_FIND != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if ((NULL == phObject) && (0 < ulMaxObjectCount))
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulObjectCount)
+                return CKR_ARGUMENTS_BAD;
+
+        *pulObjectCount = 0;
+        for (; mock_search_iterator < G_N_ELEMENTS (mock_objects) && *pulObjectCount < ulMaxObjectCount; mock_search_iterator++)
+        {
+                if ((mock_search_template_class == PKCS11_MOCK_CKO_ANYTHING || mock_objects[mock_search_iterator].object_class == mock_search_template_class) &&
+                    (mock_search_template_label == NULL || g_strcmp0 ((char*)mock_objects[mock_search_iterator].info.label, mock_search_template_label) == 0))
+                {
+                        phObject[*pulObjectCount] = mock_search_iterator;
+                        *pulObjectCount = *pulObjectCount + 1;
+                }
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_FindObjectsFinal)(CK_SESSION_HANDLE hSession)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_FIND != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_EncryptInit)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_NONE != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_DIGEST != pkcs11_mock_active_operation) && 
+                (PKCS11_MOCK_CK_OPERATION_SIGN != pkcs11_mock_active_operation))
+                return CKR_OPERATION_ACTIVE;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        switch (pMechanism->mechanism)
+        {
+                case CKM_RSA_PKCS:
+
+                        if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                                return CKR_MECHANISM_PARAM_INVALID;
+
+                        if (PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY != hKey)
+                                return CKR_KEY_TYPE_INCONSISTENT;
+
+                        break;
+
+                case CKM_RSA_PKCS_OAEP:
+
+                        if ((NULL == pMechanism->pParameter) || (sizeof(CK_RSA_PKCS_OAEP_PARAMS) != pMechanism->ulParameterLen))
+                                return CKR_MECHANISM_PARAM_INVALID;
+
+                        if (PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY != hKey)
+                                return CKR_KEY_TYPE_INCONSISTENT;
+
+                        break;
+
+                case CKM_DES3_CBC:
+
+                        if ((NULL == pMechanism->pParameter) || (8 != pMechanism->ulParameterLen))
+                                return CKR_MECHANISM_PARAM_INVALID;
+
+                        if (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hKey)
+                                return CKR_KEY_TYPE_INCONSISTENT;
+
+                        break;
+
+                case CKM_AES_CBC:
+                        
+                        if ((NULL == pMechanism->pParameter) || (16 != pMechanism->ulParameterLen))
+                                return CKR_MECHANISM_PARAM_INVALID;
+
+                        if (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hKey)
+                                return CKR_KEY_TYPE_INCONSISTENT;
+
+                        break;
+
+                default:
+
+                        return CKR_MECHANISM_INVALID;
+        }
+
+        switch (pkcs11_mock_active_operation)
+        {
+                case PKCS11_MOCK_CK_OPERATION_NONE:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_ENCRYPT;
+                        break;
+                case PKCS11_MOCK_CK_OPERATION_DIGEST:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DIGEST_ENCRYPT;
+                        break;
+                case PKCS11_MOCK_CK_OPERATION_SIGN:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_SIGN_ENCRYPT;
+                        break;
+                default:
+                        return CKR_FUNCTION_FAILED;
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_Encrypt)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK_BYTE_PTR pEncryptedData, CK_ULONG_PTR pulEncryptedDataLen)
+{
+        CK_ULONG i = 0;
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_ENCRYPT != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pData)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulEncryptedDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pEncryptedData)
+        {
+                if (ulDataLen > *pulEncryptedDataLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulDataLen; i++)
+                                pEncryptedData[i] = pData[i] ^ 0xAB;
+
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                }
+        }
+
+        *pulEncryptedDataLen = ulDataLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_EncryptUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart, CK_ULONG_PTR pulEncryptedPartLen)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_ENCRYPT != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulEncryptedPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pEncryptedPart)
+        {
+                if (ulPartLen > *pulEncryptedPartLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulPartLen; i++)
+                                pEncryptedPart[i] = pPart[i] ^ 0xAB;
+                }
+        }
+
+        *pulEncryptedPartLen = ulPartLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_EncryptFinal)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pLastEncryptedPart, CK_ULONG_PTR pulLastEncryptedPartLen)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_ENCRYPT != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_DIGEST_ENCRYPT != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_SIGN_ENCRYPT != pkcs11_mock_active_operation))
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pulLastEncryptedPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pLastEncryptedPart)
+        {
+                switch (pkcs11_mock_active_operation)
+                {
+                        case PKCS11_MOCK_CK_OPERATION_ENCRYPT:
+                                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                                break;
+                        case PKCS11_MOCK_CK_OPERATION_DIGEST_ENCRYPT:
+                                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DIGEST;
+                                break;
+                        case PKCS11_MOCK_CK_OPERATION_SIGN_ENCRYPT:
+                                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_SIGN;
+                                break;
+                        default:
+                                return CKR_FUNCTION_FAILED;
+                }
+        }
+
+        *pulLastEncryptedPartLen = 0;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DecryptInit)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_NONE != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_DIGEST != pkcs11_mock_active_operation) && 
+                (PKCS11_MOCK_CK_OPERATION_VERIFY != pkcs11_mock_active_operation))
+                return CKR_OPERATION_ACTIVE;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        switch (pMechanism->mechanism)
+        {
+                case CKM_RSA_PKCS:
+
+                        if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                                return CKR_MECHANISM_PARAM_INVALID;
+
+                        if (PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY != hKey)
+                                return CKR_KEY_TYPE_INCONSISTENT;
+
+                        break;
+
+                case CKM_RSA_PKCS_OAEP:
+
+                        if ((NULL == pMechanism->pParameter) || (sizeof(CK_RSA_PKCS_OAEP_PARAMS) != pMechanism->ulParameterLen))
+                                return CKR_MECHANISM_PARAM_INVALID;
+
+                        if (PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY != hKey)
+                                return CKR_KEY_TYPE_INCONSISTENT;
+
+                        break;
+
+                case CKM_DES3_CBC:
+
+                        if ((NULL == pMechanism->pParameter) || (8 != pMechanism->ulParameterLen))
+                                return CKR_MECHANISM_PARAM_INVALID;
+
+                        if (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hKey)
+                                return CKR_KEY_TYPE_INCONSISTENT;
+
+                        break;
+
+                case CKM_AES_CBC:
+                        
+                        if ((NULL == pMechanism->pParameter) || (16 != pMechanism->ulParameterLen))
+                                return CKR_MECHANISM_PARAM_INVALID;
+
+                        if (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hKey)
+                                return CKR_KEY_TYPE_INCONSISTENT;
+
+                        break;
+
+                default:
+
+                        return CKR_MECHANISM_INVALID;
+        }
+
+        switch (pkcs11_mock_active_operation)
+        {
+                case PKCS11_MOCK_CK_OPERATION_NONE:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DECRYPT;
+                        break;
+                case PKCS11_MOCK_CK_OPERATION_DIGEST:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DECRYPT_DIGEST;
+                        break;
+                case PKCS11_MOCK_CK_OPERATION_VERIFY:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DECRYPT_VERIFY;
+                        break;
+                default:
+                        return CKR_FUNCTION_FAILED;
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_Decrypt)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData, CK_ULONG ulEncryptedDataLen, CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_DECRYPT != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pEncryptedData)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulEncryptedDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pData)
+        {
+                if (ulEncryptedDataLen > *pulDataLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulEncryptedDataLen; i++)
+                                pData[i] = pEncryptedData[i] ^ 0xAB;
+
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                }
+        }
+
+        *pulDataLen = ulEncryptedDataLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DecryptUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen, CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_DECRYPT != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pEncryptedPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulEncryptedPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pPart)
+        {
+                if (ulEncryptedPartLen > *pulPartLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulEncryptedPartLen; i++)
+                                pPart[i] = pEncryptedPart[i] ^ 0xAB;
+                }
+        }
+
+        *pulPartLen = ulEncryptedPartLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DecryptFinal)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pLastPart, CK_ULONG_PTR pulLastPartLen)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_DECRYPT != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_DECRYPT_DIGEST != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_DECRYPT_VERIFY != pkcs11_mock_active_operation))
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pulLastPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pLastPart)
+        {
+                switch (pkcs11_mock_active_operation)
+                {
+                        case PKCS11_MOCK_CK_OPERATION_DECRYPT:
+                                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                                break;
+                        case PKCS11_MOCK_CK_OPERATION_DECRYPT_DIGEST:
+                                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DIGEST;
+                                break;
+                        case PKCS11_MOCK_CK_OPERATION_DECRYPT_VERIFY:
+                                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_VERIFY;
+                                break;
+                        default:
+                                return CKR_FUNCTION_FAILED;
+                }
+        }
+
+        *pulLastPartLen = 0;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DigestInit)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_NONE != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_ENCRYPT != pkcs11_mock_active_operation) && 
+                (PKCS11_MOCK_CK_OPERATION_DECRYPT != pkcs11_mock_active_operation))
+                return CKR_OPERATION_ACTIVE;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CKM_SHA_1 != pMechanism->mechanism)
+                return CKR_MECHANISM_INVALID;
+
+        if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                return CKR_MECHANISM_PARAM_INVALID;
+
+        switch (pkcs11_mock_active_operation)
+        {
+                case PKCS11_MOCK_CK_OPERATION_NONE:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DIGEST;
+                        break;
+                case PKCS11_MOCK_CK_OPERATION_ENCRYPT:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DIGEST_ENCRYPT;
+                        break;
+                case PKCS11_MOCK_CK_OPERATION_DECRYPT:
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DECRYPT_DIGEST;
+                        break;
+                default:
+                        return CKR_FUNCTION_FAILED;
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_Digest)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK_BYTE_PTR pDigest, CK_ULONG_PTR pulDigestLen)
+{
+        CK_BYTE hash[20] = { 0x7B, 0x50, 0x2C, 0x3A, 0x1F, 0x48, 0xC8, 0x60, 0x9A, 0xE2, 0x12, 0xCD, 0xFB, 0x63, 0x9D, 0xEE, 0x39, 0x67, 0x3F, 0x5E };
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_DIGEST != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pData)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulDigestLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pDigest)
+        {
+                if (sizeof(hash) > *pulDigestLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        memcpy(pDigest, hash, sizeof(hash));
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                }
+        }
+
+        *pulDigestLen = sizeof(hash);
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DigestUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, CK_ULONG ulPartLen)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_DIGEST != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DigestKey)(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_DIGEST != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hKey)
+                return CKR_OBJECT_HANDLE_INVALID;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DigestFinal)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pDigest, CK_ULONG_PTR pulDigestLen)
+{
+        CK_BYTE hash[20] = { 0x7B, 0x50, 0x2C, 0x3A, 0x1F, 0x48, 0xC8, 0x60, 0x9A, 0xE2, 0x12, 0xCD, 0xFB, 0x63, 0x9D, 0xEE, 0x39, 0x67, 0x3F, 0x5E };
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_DIGEST != pkcs11_mock_active_operation) && 
+                (PKCS11_MOCK_CK_OPERATION_DIGEST_ENCRYPT != pkcs11_mock_active_operation) && 
+                (PKCS11_MOCK_CK_OPERATION_DECRYPT_DIGEST != pkcs11_mock_active_operation))
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pulDigestLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pDigest)
+        {
+                if (sizeof(hash) > *pulDigestLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        memcpy(pDigest, hash, sizeof(hash));
+
+                        switch (pkcs11_mock_active_operation)
+                        {
+                                case PKCS11_MOCK_CK_OPERATION_DIGEST:
+                                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                                        break;
+                                case PKCS11_MOCK_CK_OPERATION_DIGEST_ENCRYPT:
+                                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_ENCRYPT;
+                                        break;
+                                case PKCS11_MOCK_CK_OPERATION_DECRYPT_DIGEST:
+                                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DECRYPT;
+                                        break;
+                                default:
+                                        return CKR_FUNCTION_FAILED;
+                        }
+                }
+        }
+
+        *pulDigestLen = sizeof(hash);
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SignInit)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_NONE != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_ENCRYPT != pkcs11_mock_active_operation))
+                return CKR_OPERATION_ACTIVE;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (hKey > G_N_ELEMENTS(mock_objects) || mock_objects[hKey].object_class != CKO_PRIVATE_KEY)
+                return CKR_KEY_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        mock_sign_algo = pMechanism->mechanism;
+
+        // TODO: Hardcoded list
+        if (CKM_RSA_PKCS_PSS == pMechanism->mechanism)
+        {
+                CK_RSA_PKCS_PSS_PARAMS *params;
+
+                if ((NULL == pMechanism->pParameter) || (0 == pMechanism->ulParameterLen))
+                         return CKR_MECHANISM_PARAM_INVALID;
+
+                params = pMechanism->pParameter;
+
+                g_assert (params->hashAlg == CKM_SHA256);
+                g_assert (params->mgf == CKG_MGF1_SHA256);
+                // if (PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY != hKey)
+                //         return CKR_KEY_TYPE_INCONSISTENT;
+        }
+        else if (CKM_RSA_PKCS == pMechanism->mechanism)
+        {
+                // FIXME: Also assert SHA256?
+        }
+        else
+        {
+                g_assert_not_reached ();
+                return CKR_MECHANISM_INVALID;
+        }
+
+        if (PKCS11_MOCK_CK_OPERATION_NONE == pkcs11_mock_active_operation)
+                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_SIGN;
+        else
+                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_SIGN_ENCRYPT;
+
+        pkcs11_mock_sign_key = hKey;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_Sign)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen)
+{
+        const gnutls_datum_t data = {
+                .data = pData,
+                .size = ulDataLen,
+        };
+        gnutls_datum_t signature;
+        int status;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_SIGN != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pData)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulSignatureLen)
+                return CKR_ARGUMENTS_BAD;
+
+        // TODO: Handle user not logged in
+
+        // TODO: Hardcoded algo list
+        if (mock_sign_algo == CKM_RSA_PKCS_PSS)
+                status = gnutls_privkey_sign_hash2 (mock_objects[pkcs11_mock_sign_key].key, GNUTLS_SIGN_RSA_PSS_SHA256,
+                                                    GNUTLS_PRIVKEY_SIGN_FLAG_RSA_PSS, &data, &signature);
+        else if (mock_sign_algo == CKM_RSA_PKCS)
+                status = gnutls_privkey_sign_hash2 (mock_objects[pkcs11_mock_sign_key].key, GNUTLS_SIGN_RSA_SHA256,
+                                                    GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA, &data, &signature);
+        else
+                g_assert_not_reached ();
+
+        // g_assert (status == GNUTLS_E_SUCCESS);
+        if (status != GNUTLS_E_SUCCESS)
+                return CKR_FUNCTION_FAILED; // TODO: Best return code?
+
+        if (signature.size > *pulSignatureLen)
+        {
+                gnutls_free (signature.data);
+                *pulSignatureLen = signature.size;
+                if (pSignature != NULL)
+                        return CKR_BUFFER_TOO_SMALL;
+        }
+        else
+        {
+                // This is called twice, once with NULL to just query size
+                if (pSignature != NULL)
+                {
+                        memcpy (pSignature, signature.data, signature.size);
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                }
+                *pulSignatureLen = signature.size;
+                gnutls_free (signature.data);
+        }
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SignUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, CK_ULONG ulPartLen)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_SIGN != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SignFinal)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen)
+{
+        CK_BYTE signature[10] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09 };
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_SIGN != pkcs11_mock_active_operation) && 
+                (PKCS11_MOCK_CK_OPERATION_SIGN_ENCRYPT != pkcs11_mock_active_operation))
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pulSignatureLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pSignature)
+        {
+                if (sizeof(signature) > *pulSignatureLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        memcpy(pSignature, signature, sizeof(signature));
+
+                        if (PKCS11_MOCK_CK_OPERATION_SIGN == pkcs11_mock_active_operation)
+                                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                        else
+                                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_ENCRYPT;
+                }
+        }
+
+        *pulSignatureLen = sizeof(signature);
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SignRecoverInit)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_NONE != pkcs11_mock_active_operation)
+                return CKR_OPERATION_ACTIVE;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CKM_RSA_PKCS == pMechanism->mechanism)
+        {
+                if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                        return CKR_MECHANISM_PARAM_INVALID;
+
+                if (PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY != hKey)
+                        return CKR_KEY_TYPE_INCONSISTENT;
+        }
+        else
+        {
+                return CKR_MECHANISM_INVALID;
+        }
+
+        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_SIGN_RECOVER;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SignRecover)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_SIGN_RECOVER != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pData)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulSignatureLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pSignature)
+        {
+                if (ulDataLen > *pulSignatureLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulDataLen; i++)
+                                pSignature[i] = pData[i] ^ 0xAB;
+
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                }
+        }
+
+        *pulSignatureLen = ulDataLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_VerifyInit)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_NONE != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_DECRYPT != pkcs11_mock_active_operation))
+                return CKR_OPERATION_ACTIVE;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if ((CKM_RSA_PKCS == pMechanism->mechanism) || (CKM_SHA1_RSA_PKCS == pMechanism->mechanism))
+        {
+                if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                        return CKR_MECHANISM_PARAM_INVALID;
+
+                if (PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY != hKey)
+                        return CKR_KEY_TYPE_INCONSISTENT;
+        }
+        else
+        {
+                return CKR_MECHANISM_INVALID;
+        }
+
+        if (PKCS11_MOCK_CK_OPERATION_NONE == pkcs11_mock_active_operation)
+                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_VERIFY;
+        else
+                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DECRYPT_VERIFY;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_Verify)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen)
+{
+        CK_BYTE signature[10] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09 };
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_VERIFY != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pData)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pSignature)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulSignatureLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (sizeof(signature) != ulSignatureLen)
+                return CKR_SIGNATURE_LEN_RANGE;
+
+        if (0 != memcmp(pSignature, signature, sizeof(signature)))
+                return CKR_SIGNATURE_INVALID;
+
+        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_VerifyUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, CK_ULONG ulPartLen)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_VERIFY != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_VerifyFinal)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen)
+{
+        CK_BYTE signature[10] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09 };
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((PKCS11_MOCK_CK_OPERATION_VERIFY != pkcs11_mock_active_operation) &&
+                (PKCS11_MOCK_CK_OPERATION_DECRYPT_VERIFY != pkcs11_mock_active_operation))
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pSignature)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulSignatureLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (sizeof(signature) != ulSignatureLen)
+                return CKR_SIGNATURE_LEN_RANGE;
+
+        if (0 != memcmp(pSignature, signature, sizeof(signature)))
+                return CKR_SIGNATURE_INVALID;
+
+        if (PKCS11_MOCK_CK_OPERATION_VERIFY == pkcs11_mock_active_operation)
+                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+        else
+                pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_DECRYPT;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_VerifyRecoverInit)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_NONE != pkcs11_mock_active_operation)
+                return CKR_OPERATION_ACTIVE;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CKM_RSA_PKCS == pMechanism->mechanism)
+        {
+                if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                        return CKR_MECHANISM_PARAM_INVALID;
+
+                if (PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY != hKey)
+                        return CKR_KEY_TYPE_INCONSISTENT;
+        }
+        else
+        {
+                return CKR_MECHANISM_INVALID;
+        }
+
+        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_VERIFY_RECOVER;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_VerifyRecover)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen, CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_VERIFY_RECOVER != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pSignature)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulSignatureLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulDataLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pData)
+        {
+                if (ulSignatureLen > *pulDataLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulSignatureLen; i++)
+                                pData[i] = pSignature[i] ^ 0xAB;
+
+                        pkcs11_mock_active_operation = PKCS11_MOCK_CK_OPERATION_NONE;
+                }
+        }
+
+        *pulDataLen = ulSignatureLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DigestEncryptUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart, CK_ULONG_PTR pulEncryptedPartLen)
+{
+        CK_ULONG i = 0;
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_DIGEST_ENCRYPT != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulEncryptedPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pEncryptedPart)
+        {
+                if (ulPartLen > *pulEncryptedPartLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulPartLen; i++)
+                                pEncryptedPart[i] = pPart[i] ^ 0xAB;
+                }
+        }
+
+        *pulEncryptedPartLen = ulPartLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DecryptDigestUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen, CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_DECRYPT_DIGEST != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pEncryptedPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulEncryptedPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pPart)
+        {
+                if (ulEncryptedPartLen > *pulPartLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulEncryptedPartLen; i++)
+                                pPart[i] = pEncryptedPart[i] ^ 0xAB;
+                }
+        }
+
+        *pulPartLen = ulEncryptedPartLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SignEncryptUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart, CK_ULONG_PTR pulEncryptedPartLen)
+{
+        CK_ULONG i = 0;
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_SIGN_ENCRYPT != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulEncryptedPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pEncryptedPart)
+        {
+                if (ulPartLen > *pulEncryptedPartLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulPartLen; i++)
+                                pEncryptedPart[i] = pPart[i] ^ 0xAB;
+                }
+        }
+
+        *pulEncryptedPartLen = ulPartLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DecryptVerifyUpdate)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen, CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen)
+{
+        CK_ULONG i = 0;
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if (PKCS11_MOCK_CK_OPERATION_DECRYPT_VERIFY != pkcs11_mock_active_operation)
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pEncryptedPart)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulEncryptedPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pulPartLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pPart)
+        {
+                if (ulEncryptedPartLen > *pulPartLen)
+                {
+                        return CKR_BUFFER_TOO_SMALL;
+                }
+                else
+                {
+                        for (i = 0; i < ulEncryptedPartLen; i++)
+                                pPart[i] = pEncryptedPart[i] ^ 0xAB;
+                }
+        }
+
+        *pulPartLen = ulEncryptedPartLen;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GenerateKey)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phKey)
+{
+        CK_ULONG i = 0;
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CKM_DES3_KEY_GEN != pMechanism->mechanism)
+                return CKR_MECHANISM_INVALID;
+
+        if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                return CKR_MECHANISM_PARAM_INVALID;
+
+        if (NULL == pTemplate)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulCount)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == phKey)
+                return CKR_ARGUMENTS_BAD;
+
+        for (i = 0; i < ulCount; i++)
+        {
+                if (NULL == pTemplate[i].pValue)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                if (0 >= pTemplate[i].ulValueLen)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+        }
+
+        *phKey = PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GenerateKeyPair)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_ATTRIBUTE_PTR pPublicKeyTemplate, CK_ULONG ulPublicKeyAttributeCount, CK_ATTRIBUTE_PTR pPrivateKeyTemplate, CK_ULONG ulPrivateKeyAttributeCount, CK_OBJECT_HANDLE_PTR phPublicKey, CK_OBJECT_HANDLE_PTR phPrivateKey)
+{
+        CK_ULONG i = 0;
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CKM_RSA_PKCS_KEY_PAIR_GEN != pMechanism->mechanism)
+                return CKR_MECHANISM_INVALID;
+
+        if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                return CKR_MECHANISM_PARAM_INVALID;
+
+        if (NULL == pPublicKeyTemplate)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulPublicKeyAttributeCount)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pPrivateKeyTemplate)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulPrivateKeyAttributeCount)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == phPublicKey)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == phPrivateKey)
+                return CKR_ARGUMENTS_BAD;
+
+        for (i = 0; i < ulPublicKeyAttributeCount; i++)
+        {
+                if (NULL == pPublicKeyTemplate[i].pValue)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                if (0 >= pPublicKeyTemplate[i].ulValueLen)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+        }
+
+        for (i = 0; i < ulPrivateKeyAttributeCount; i++)
+        {
+                if (NULL == pPrivateKeyTemplate[i].pValue)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                if (0 >= pPrivateKeyTemplate[i].ulValueLen)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+        }
+
+        *phPublicKey = PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY;
+        *phPrivateKey = PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_WrapKey)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hWrappingKey, CK_OBJECT_HANDLE hKey, CK_BYTE_PTR pWrappedKey, CK_ULONG_PTR pulWrappedKeyLen)
+{
+        CK_BYTE wrappedKey[10] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09 };
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CKM_RSA_PKCS != pMechanism->mechanism)
+                return CKR_MECHANISM_INVALID;
+
+        if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                return CKR_MECHANISM_PARAM_INVALID;
+
+        if (PKCS11_MOCK_CK_OBJECT_HANDLE_PUBLIC_KEY != hWrappingKey)
+                return CKR_KEY_HANDLE_INVALID;
+
+        if (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hKey)
+                return CKR_KEY_HANDLE_INVALID;
+
+        if (NULL != pWrappedKey)
+        {
+                if (sizeof(wrappedKey) > *pulWrappedKeyLen)
+                        return CKR_BUFFER_TOO_SMALL;
+                else
+                        memcpy(pWrappedKey, wrappedKey, sizeof(wrappedKey));
+        }
+
+        *pulWrappedKeyLen = sizeof(wrappedKey);
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_UnwrapKey)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hUnwrappingKey, CK_BYTE_PTR pWrappedKey, CK_ULONG ulWrappedKeyLen, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey)
+{
+        CK_ULONG i = 0;
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CKM_RSA_PKCS != pMechanism->mechanism)
+                return CKR_MECHANISM_INVALID;
+
+        if ((NULL != pMechanism->pParameter) || (0 != pMechanism->ulParameterLen))
+                return CKR_MECHANISM_PARAM_INVALID;
+
+        if (PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY != hUnwrappingKey)
+                return CKR_KEY_HANDLE_INVALID;
+
+        if (NULL == pWrappedKey)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulWrappedKeyLen)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pTemplate)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulAttributeCount)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == phKey)
+                return CKR_ARGUMENTS_BAD;
+
+        for (i = 0; i < ulAttributeCount; i++)
+        {
+                if (NULL == pTemplate[i].pValue)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                if (0 >= pTemplate[i].ulValueLen)
+                        return CKR_ATTRIBUTE_VALUE_INVALID;
+        }
+
+        *phKey = PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_DeriveKey)(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hBaseKey, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey)
+{
+        CK_ULONG i = 0;
+
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pMechanism)
+                return CKR_ARGUMENTS_BAD;
+
+        if (CKM_XOR_BASE_AND_DATA != pMechanism->mechanism)
+                return CKR_MECHANISM_INVALID;
+
+        if ((NULL == pMechanism->pParameter) || (sizeof(CK_KEY_DERIVATION_STRING_DATA) != pMechanism->ulParameterLen))
+                return CKR_MECHANISM_PARAM_INVALID;
+
+        if (PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY != hBaseKey)
+                return CKR_OBJECT_HANDLE_INVALID;
+
+        if (NULL == phKey)
+                return CKR_ARGUMENTS_BAD;
+
+        if ((NULL != pTemplate) && (0 >= ulAttributeCount))
+        {
+                for (i = 0; i < ulAttributeCount; i++)
+                {
+                        if (NULL == pTemplate[i].pValue)
+                                return CKR_ATTRIBUTE_VALUE_INVALID;
+
+                        if (0 >= pTemplate[i].ulValueLen)
+                                return CKR_ATTRIBUTE_VALUE_INVALID;
+                }
+        }
+
+        *phKey = PKCS11_MOCK_CK_OBJECT_HANDLE_SECRET_KEY;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_SeedRandom)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSeed, CK_ULONG ulSeedLen)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == pSeed)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulSeedLen)
+                return CKR_ARGUMENTS_BAD;
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GenerateRandom)(CK_SESSION_HANDLE hSession, CK_BYTE_PTR RandomData, CK_ULONG ulRandomLen)
+{
+
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+
+        if (NULL == RandomData)
+                return CKR_ARGUMENTS_BAD;
+
+        if (0 >= ulRandomLen)
+                return CKR_ARGUMENTS_BAD;
+
+        memset(RandomData, 1, ulRandomLen);
+
+        return CKR_OK;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_GetFunctionStatus)(CK_SESSION_HANDLE hSession)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+        
+        return CKR_FUNCTION_NOT_PARALLEL;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_CancelFunction)(CK_SESSION_HANDLE hSession)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((CK_FALSE == pkcs11_mock_session_opened) || (PKCS11_MOCK_CK_SESSION_ID != hSession))
+                return CKR_SESSION_HANDLE_INVALID;
+        
+        return CKR_FUNCTION_NOT_PARALLEL;
+}
+
+
+CK_DEFINE_FUNCTION(CK_RV, C_WaitForSlotEvent)(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot, CK_VOID_PTR pReserved)
+{
+        if (CK_FALSE == pkcs11_mock_initialized)
+                return CKR_CRYPTOKI_NOT_INITIALIZED;
+
+        if ((0 != flags)  && (CKF_DONT_BLOCK != flags))
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL == pSlot)
+                return CKR_ARGUMENTS_BAD;
+
+        if (NULL != pReserved)
+                return CKR_ARGUMENTS_BAD;
+
+        return CKR_NO_EVENT;
+}
diff --git a/tests/pkcs11/pkcs11.h b/tests/pkcs11/pkcs11.h
new file mode 100644
index 00000000..f796560b
--- /dev/null
+++ b/tests/pkcs11/pkcs11.h
@@ -0,0 +1,252 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/*
+ * Copyright (C) 1994-1999 RSA Security Inc. Licence to copy this document
+ * is granted provided that it is identified as "RSA Security In.c Public-Key
+ * Cryptography Standards (PKCS)" in all material mentioning or referencing
+ * this document.
+ *
+ * The latest version of this header can be found at:
+ *    http://www.rsalabs.com/pkcs/pkcs-11/index.html
+ */
+#ifndef _PKCS11_H_
+#define _PKCS11_H_ 1
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Before including this file (pkcs11.h) (or pkcs11t.h by
+ * itself), 6 platform-specific macros must be defined.  These
+ * macros are described below, and typical definitions for them
+ * are also given.  Be advised that these definitions can depend
+ * on both the platform and the compiler used (and possibly also
+ * on whether a PKCS #11 library is linked statically or
+ * dynamically).
+ *
+ * In addition to defining these 6 macros, the packing convention
+ * for PKCS #11 structures should be set.  The PKCS #11
+ * convention on packing is that structures should be 1-byte
+ * aligned.
+ *
+ * In a Win32 environment, this might be done by using the
+ * following preprocessor directive before including pkcs11.h
+ * or pkcs11t.h:
+ *
+ * #pragma pack(push, cryptoki, 1)
+ *
+ * and using the following preprocessor directive after including
+ * pkcs11.h or pkcs11t.h:
+ *
+ * #pragma pack(pop, cryptoki)
+ *
+ * In a UNIX environment, you're on your own here.  You might
+ * not need to do anything.
+ *
+ *
+ * Now for the macros:
+ *
+ *
+ * 1. CK_PTR: The indirection string for making a pointer to an
+ * object.  It can be used like this:
+ *
+ * typedef CK_BYTE CK_PTR CK_BYTE_PTR;
+ *
+ * In a Win32 environment, it might be defined by
+ *
+ * #define CK_PTR *
+ *
+ * In a UNIX environment, it might be defined by
+ *
+ * #define CK_PTR *
+ *
+ *
+ * 2. CK_DEFINE_FUNCTION(returnType, name): A macro which makes
+ * an exportable PKCS #11 library function definition out of a
+ * return type and a function name.  It should be used in the
+ * following fashion to define the exposed PKCS #11 functions in
+ * a PKCS #11 library:
+ *
+ * CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(
+ *   CK_VOID_PTR pReserved
+ * )
+ * {
+ *   ...
+ * }
+ *
+ * For defining a function in a Win32 PKCS #11 .dll, it might be
+ * defined by
+ *
+ * #define CK_DEFINE_FUNCTION(returnType, name) \
+ *   returnType __declspec(dllexport) name
+ *
+ * In a UNIX environment, it might be defined by
+ *
+ * #define CK_DEFINE_FUNCTION(returnType, name) \
+ *   returnType name
+ *
+ *
+ * 3. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
+ * an importable PKCS #11 library function declaration out of a
+ * return type and a function name.  It should be used in the
+ * following fashion:
+ *
+ * extern CK_DECLARE_FUNCTION(CK_RV, C_Initialize)(
+ *   CK_VOID_PTR pReserved
+ * );
+ *
+ * For declaring a function in a Win32 PKCS #11 .dll, it might
+ * be defined by
+ *
+ * #define CK_DECLARE_FUNCTION(returnType, name) \
+ *   returnType __declspec(dllimport) name
+ *
+ * In a UNIX environment, it might be defined by
+ *
+ * #define CK_DECLARE_FUNCTION(returnType, name) \
+ *   returnType name
+ *
+ *
+ * 4. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
+ * which makes a PKCS #11 API function pointer declaration or
+ * function pointer type declaration out of a return type and a
+ * function name.  It should be used in the following fashion:
+ *
+ * // Define funcPtr to be a pointer to a PKCS #11 API function
+ * // taking arguments args and returning CK_RV.
+ * CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtr)(args);
+ *
+ * or
+ *
+ * // Define funcPtrType to be the type of a pointer to a
+ * // PKCS #11 API function taking arguments args and returning
+ * // CK_RV, and then define funcPtr to be a variable of type
+ * // funcPtrType.
+ * typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtrType)(args);
+ * funcPtrType funcPtr;
+ *
+ * For accessing functions in a Win32 PKCS #11 .dll, in might be
+ * defined by
+ *
+ * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
+ *   returnType __declspec(dllimport) (* name)
+ *
+ * In a UNIX environment, it might be defined by
+ *
+ * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
+ *   returnType (* name)
+ *
+ *
+ * 5. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
+ * a function pointer type for an application callback out of
+ * a return type for the callback and a name for the callback.
+ * It should be used in the following fashion:
+ *
+ * CK_CALLBACK_FUNCTION(CK_RV, myCallback)(args);
+ *
+ * to declare a function pointer, myCallback, to a callback
+ * which takes arguments args and returns a CK_RV.  It can also
+ * be used like this:
+ *
+ * typedef CK_CALLBACK_FUNCTION(CK_RV, myCallbackType)(args);
+ * myCallbackType myCallback;
+ *
+ * In a Win32 environment, it might be defined by
+ *
+ * #define CK_CALLBACK_FUNCTION(returnType, name) \
+ *   returnType (* name)
+ *
+ * In a UNIX environment, it might be defined by
+ *
+ * #define CK_CALLBACK_FUNCTION(returnType, name) \
+ *   returnType (* name)
+ *
+ *
+ * 6. NULL_PTR: This macro is the value of a NULL pointer.
+ *
+ * In any ANSI/ISO C environment (and in many others as well),
+ * this should be defined by
+ *
+ * #ifndef NULL_PTR
+ * #define NULL_PTR 0
+ * #endif
+ */
+
+/* All the various PKCS #11 types and #define'd values are in the
+ * file pkcs11t.h. */
+#include "pkcs11t.h"
+
+#define __PASTE(x, y) x##y
+
+/* packing defines */
+#include "pkcs11p.h"
+/* ==============================================================
+ * Define the "extern" form of all the entry points.
+ * ==============================================================
+ */
+
+#define CK_NEED_ARG_LIST 1
+#define CK_PKCS11_FUNCTION_INFO(name) \
+    CK_DECLARE_FUNCTION(CK_RV, name)
+
+/* pkcs11f.h has all the information about the PKCS #11
+ * function prototypes. */
+#include "pkcs11f.h"
+
+#undef CK_NEED_ARG_LIST
+#undef CK_PKCS11_FUNCTION_INFO
+
+/* ==============================================================
+ * Define the typedef form of all the entry points.  That is, for
+ * each PKCS #11 function C_XXX, define a type CK_C_XXX which is
+ * a pointer to that kind of function.
+ * ==============================================================
+ */
+
+#define CK_NEED_ARG_LIST 1
+#define CK_PKCS11_FUNCTION_INFO(name) \
+    typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_, name))
+
+/* pkcs11f.h has all the information about the PKCS #11
+ * function prototypes. */
+#include "pkcs11f.h"
+
+#undef CK_NEED_ARG_LIST
+#undef CK_PKCS11_FUNCTION_INFO
+
+/* ==============================================================
+ * Define structed vector of entry points.  A CK_FUNCTION_LIST
+ * contains a CK_VERSION indicating a library's PKCS #11 version
+ * and then a whole slew of function pointers to the routines in
+ * the library.  This type was declared, but not defined, in
+ * pkcs11t.h.
+ * ==============================================================
+ */
+
+#define CK_PKCS11_FUNCTION_INFO(name) \
+    __PASTE(CK_, name)                \
+    name;
+
+struct CK_FUNCTION_LIST {
+
+    CK_VERSION version; /* PKCS #11 version */
+
+/* Pile all the function pointers into the CK_FUNCTION_LIST. */
+/* pkcs11f.h has all the information about the PKCS #11
+ * function prototypes. */
+#include "pkcs11f.h"
+};
+
+#undef CK_PKCS11_FUNCTION_INFO
+
+#undef __PASTE
+
+/* unpack */
+#include "pkcs11u.h"
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
\ No newline at end of file
diff --git a/tests/pkcs11/pkcs11f.h b/tests/pkcs11/pkcs11f.h
new file mode 100644
index 00000000..eb742302
--- /dev/null
+++ b/tests/pkcs11/pkcs11f.h
@@ -0,0 +1,812 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/*
+ * Copyright (C) 1994-1999 RSA Security Inc. Licence to copy this document
+ * is granted provided that it is identified as "RSA Security In.c Public-Key
+ * Cryptography Standards (PKCS)" in all material mentioning or referencing
+ * this document.
+ */
+/* This function contains pretty much everything about all the */
+/* PKCS #11  function prototypes.  Because this information is */
+/* used for more than just declaring function prototypes, the */
+/* order of the functions appearing herein is important, and */
+/* should not be altered. */
+
+/* General-purpose */
+
+/* C_Initialize initializes the PKCS #11 library. */
+CK_PKCS11_FUNCTION_INFO(C_Initialize)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_VOID_PTR pInitArgs /* if this is not NULL_PTR, it gets
+                           * cast to CK_C_INITIALIZE_ARGS_PTR
+                           * and dereferenced */
+    );
+#endif
+
+/* C_Finalize indicates that an application is done with the
+ * PKCS #11 library. */
+CK_PKCS11_FUNCTION_INFO(C_Finalize)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_VOID_PTR pReserved /* reserved.  Should be NULL_PTR */
+    );
+#endif
+
+/* C_GetInfo returns general information about PKCS #11. */
+CK_PKCS11_FUNCTION_INFO(C_GetInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_INFO_PTR pInfo /* location that receives information */
+    );
+#endif
+
+/* C_GetFunctionList returns the function list. */
+CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_FUNCTION_LIST_PTR_PTR ppFunctionList /* receives pointer to
+                                             * function list */
+    );
+#endif
+
+/* Slot and token management */
+
+/* C_GetSlotList obtains a list of slots in the system. */
+CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_BBOOL tokenPresent,    /* only slots with tokens? */
+    CK_SLOT_ID_PTR pSlotList, /* receives array of slot IDs */
+    CK_ULONG_PTR pulCount     /* receives number of slots */
+    );
+#endif
+
+/* C_GetSlotInfo obtains information about a particular slot in
+ * the system. */
+CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SLOT_ID slotID,     /* the ID of the slot */
+    CK_SLOT_INFO_PTR pInfo /* receives the slot information */
+    );
+#endif
+
+/* C_GetTokenInfo obtains information about a particular token
+ * in the system. */
+CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SLOT_ID slotID,      /* ID of the token's slot */
+    CK_TOKEN_INFO_PTR pInfo /* receives the token information */
+    );
+#endif
+
+/* C_GetMechanismList obtains a list of mechanism types
+ * supported by a token. */
+CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SLOT_ID slotID,                    /* ID of token's slot */
+    CK_MECHANISM_TYPE_PTR pMechanismList, /* gets mech. array */
+    CK_ULONG_PTR pulCount                 /* gets # of mechs. */
+    );
+#endif
+
+/* C_GetMechanismInfo obtains information about a particular
+ * mechanism possibly supported by a token. */
+CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SLOT_ID slotID,          /* ID of the token's slot */
+    CK_MECHANISM_TYPE type,     /* type of mechanism */
+    CK_MECHANISM_INFO_PTR pInfo /* receives mechanism info */
+    );
+#endif
+
+/* C_InitToken initializes a token. */
+CK_PKCS11_FUNCTION_INFO(C_InitToken)
+#ifdef CK_NEED_ARG_LIST
+/* pLabel changed from CK_CHAR_PTR to CK_UTF8CHAR_PTR for v2.10 */
+(
+    CK_SLOT_ID slotID,     /* ID of the token's slot */
+    CK_UTF8CHAR_PTR pPin,  /* the SO's initial PIN */
+    CK_ULONG ulPinLen,     /* length in bytes of the PIN */
+    CK_UTF8CHAR_PTR pLabel /* 32-byte token label (blank padded) */
+    );
+#endif
+
+/* C_InitPIN initializes the normal user's PIN. */
+CK_PKCS11_FUNCTION_INFO(C_InitPIN)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_UTF8CHAR_PTR pPin,       /* the normal user's PIN */
+    CK_ULONG ulPinLen           /* length in bytes of the PIN */
+    );
+#endif
+
+/* C_SetPIN modifies the PIN of the user who is logged in. */
+CK_PKCS11_FUNCTION_INFO(C_SetPIN)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_UTF8CHAR_PTR pOldPin,    /* the old PIN */
+    CK_ULONG ulOldLen,          /* length of the old PIN */
+    CK_UTF8CHAR_PTR pNewPin,    /* the new PIN */
+    CK_ULONG ulNewLen           /* length of the new PIN */
+    );
+#endif
+
+/* Session management */
+
+/* C_OpenSession opens a session between an application and a
+ * token. */
+CK_PKCS11_FUNCTION_INFO(C_OpenSession)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SLOT_ID slotID,              /* the slot's ID */
+    CK_FLAGS flags,                 /* from CK_SESSION_INFO */
+    CK_VOID_PTR pApplication,       /* passed to callback */
+    CK_NOTIFY Notify,               /* callback function */
+    CK_SESSION_HANDLE_PTR phSession /* gets session handle */
+    );
+#endif
+
+/* C_CloseSession closes a session between an application and a
+ * token. */
+CK_PKCS11_FUNCTION_INFO(C_CloseSession)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession /* the session's handle */
+    );
+#endif
+
+/* C_CloseAllSessions closes all sessions with a token. */
+CK_PKCS11_FUNCTION_INFO(C_CloseAllSessions)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SLOT_ID slotID /* the token's slot */
+    );
+#endif
+
+/* C_GetSessionInfo obtains information about the session. */
+CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_SESSION_INFO_PTR pInfo   /* receives session info */
+    );
+#endif
+
+/* C_GetOperationState obtains the state of the cryptographic operation
+ * in a session. */
+CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,       /* session's handle */
+    CK_BYTE_PTR pOperationState,      /* gets state */
+    CK_ULONG_PTR pulOperationStateLen /* gets state length */
+    );
+#endif
+
+/* C_SetOperationState restores the state of the cryptographic
+ * operation in a session. */
+CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,         /* session's handle */
+    CK_BYTE_PTR pOperationState,        /* holds state */
+    CK_ULONG ulOperationStateLen,       /* holds state length */
+    CK_OBJECT_HANDLE hEncryptionKey,    /* en/decryption key */
+    CK_OBJECT_HANDLE hAuthenticationKey /* sign/verify key */
+    );
+#endif
+
+/* C_Login logs a user into a token. */
+CK_PKCS11_FUNCTION_INFO(C_Login)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_USER_TYPE userType,      /* the user type */
+    CK_UTF8CHAR_PTR pPin,       /* the user's PIN */
+    CK_ULONG ulPinLen           /* the length of the PIN */
+    );
+#endif
+
+/* C_Logout logs a user out from a token. */
+CK_PKCS11_FUNCTION_INFO(C_Logout)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession /* the session's handle */
+    );
+#endif
+
+/* Object management */
+
+/* C_CreateObject creates a new object. */
+CK_PKCS11_FUNCTION_INFO(C_CreateObject)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,   /* the session's handle */
+    CK_ATTRIBUTE_PTR pTemplate,   /* the object's template */
+    CK_ULONG ulCount,             /* attributes in template */
+    CK_OBJECT_HANDLE_PTR phObject /* gets new object's handle. */
+    );
+#endif
+
+/* C_CopyObject copies an object, creating a new object for the
+ * copy. */
+CK_PKCS11_FUNCTION_INFO(C_CopyObject)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,      /* the session's handle */
+    CK_OBJECT_HANDLE hObject,        /* the object's handle */
+    CK_ATTRIBUTE_PTR pTemplate,      /* template for new object */
+    CK_ULONG ulCount,                /* attributes in template */
+    CK_OBJECT_HANDLE_PTR phNewObject /* receives handle of copy */
+    );
+#endif
+
+/* C_DestroyObject destroys an object. */
+CK_PKCS11_FUNCTION_INFO(C_DestroyObject)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_OBJECT_HANDLE hObject    /* the object's handle */
+    );
+#endif
+
+/* C_GetObjectSize gets the size of an object in bytes. */
+CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_OBJECT_HANDLE hObject,   /* the object's handle */
+    CK_ULONG_PTR pulSize        /* receives size of object */
+    );
+#endif
+
+/* C_GetAttributeValue obtains the value of one or more object
+ * attributes. */
+CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_OBJECT_HANDLE hObject,   /* the object's handle */
+    CK_ATTRIBUTE_PTR pTemplate, /* specifies attrs; gets vals */
+    CK_ULONG ulCount            /* attributes in template */
+    );
+#endif
+
+/* C_SetAttributeValue modifies the value of one or more object
+ * attributes */
+CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_OBJECT_HANDLE hObject,   /* the object's handle */
+    CK_ATTRIBUTE_PTR pTemplate, /* specifies attrs and values */
+    CK_ULONG ulCount            /* attributes in template */
+    );
+#endif
+
+/* C_FindObjectsInit initializes a search for token and session
+ * objects that match a template. */
+CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_ATTRIBUTE_PTR pTemplate, /* attribute values to match */
+    CK_ULONG ulCount            /* attrs in search template */
+    );
+#endif
+
+/* C_FindObjects continues a search for token and session
+ * objects that match a template, obtaining additional object
+ * handles. */
+CK_PKCS11_FUNCTION_INFO(C_FindObjects)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,    /* session's handle */
+    CK_OBJECT_HANDLE_PTR phObject, /* gets obj. handles */
+    CK_ULONG ulMaxObjectCount,     /* max handles to get */
+    CK_ULONG_PTR pulObjectCount    /* actual # returned */
+    );
+#endif
+
+/* C_FindObjectsFinal finishes a search for token and session
+ * objects. */
+CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession /* the session's handle */
+    );
+#endif
+
+/* Encryption and decryption */
+
+/* C_EncryptInit initializes an encryption operation. */
+CK_PKCS11_FUNCTION_INFO(C_EncryptInit)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_MECHANISM_PTR pMechanism, /* the encryption mechanism */
+    CK_OBJECT_HANDLE hKey        /* handle of encryption key */
+    );
+#endif
+
+/* C_Encrypt encrypts single-part data. */
+CK_PKCS11_FUNCTION_INFO(C_Encrypt)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,      /* session's handle */
+    CK_BYTE_PTR pData,               /* the plaintext data */
+    CK_ULONG ulDataLen,              /* bytes of plaintext */
+    CK_BYTE_PTR pEncryptedData,      /* gets ciphertext */
+    CK_ULONG_PTR pulEncryptedDataLen /* gets c-text size */
+    );
+#endif
+
+/* C_EncryptUpdate continues a multiple-part encryption
+ * operation. */
+CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,      /* session's handle */
+    CK_BYTE_PTR pPart,               /* the plaintext data */
+    CK_ULONG ulPartLen,              /* plaintext data len */
+    CK_BYTE_PTR pEncryptedPart,      /* gets ciphertext */
+    CK_ULONG_PTR pulEncryptedPartLen /* gets c-text size */
+    );
+#endif
+
+/* C_EncryptFinal finishes a multiple-part encryption
+ * operation. */
+CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,          /* session handle */
+    CK_BYTE_PTR pLastEncryptedPart,      /* last c-text */
+    CK_ULONG_PTR pulLastEncryptedPartLen /* gets last size */
+    );
+#endif
+
+/* C_DecryptInit initializes a decryption operation. */
+CK_PKCS11_FUNCTION_INFO(C_DecryptInit)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_MECHANISM_PTR pMechanism, /* the decryption mechanism */
+    CK_OBJECT_HANDLE hKey        /* handle of decryption key */
+    );
+#endif
+
+/* C_Decrypt decrypts encrypted data in a single part. */
+CK_PKCS11_FUNCTION_INFO(C_Decrypt)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* session's handle */
+    CK_BYTE_PTR pEncryptedData,  /* ciphertext */
+    CK_ULONG ulEncryptedDataLen, /* ciphertext length */
+    CK_BYTE_PTR pData,           /* gets plaintext */
+    CK_ULONG_PTR pulDataLen      /* gets p-text size */
+    );
+#endif
+
+/* C_DecryptUpdate continues a multiple-part decryption
+ * operation. */
+CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* session's handle */
+    CK_BYTE_PTR pEncryptedPart,  /* encrypted data */
+    CK_ULONG ulEncryptedPartLen, /* input length */
+    CK_BYTE_PTR pPart,           /* gets plaintext */
+    CK_ULONG_PTR pulPartLen      /* p-text size */
+    );
+#endif
+
+/* C_DecryptFinal finishes a multiple-part decryption
+ * operation. */
+CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pLastPart,      /* gets plaintext */
+    CK_ULONG_PTR pulLastPartLen /* p-text size */
+    );
+#endif
+
+/* Message digesting */
+
+/* C_DigestInit initializes a message-digesting operation. */
+CK_PKCS11_FUNCTION_INFO(C_DigestInit)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_MECHANISM_PTR pMechanism /* the digesting mechanism */
+    );
+#endif
+
+/* C_Digest digests data in a single part. */
+CK_PKCS11_FUNCTION_INFO(C_Digest)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pData,          /* data to be digested */
+    CK_ULONG ulDataLen,         /* bytes of data to digest */
+    CK_BYTE_PTR pDigest,        /* gets the message digest */
+    CK_ULONG_PTR pulDigestLen   /* gets digest length */
+    );
+#endif
+
+/* C_DigestUpdate continues a multiple-part message-digesting
+ * operation. */
+CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pPart,          /* data to be digested */
+    CK_ULONG ulPartLen          /* bytes of data to be digested */
+    );
+#endif
+
+/* C_DigestKey continues a multi-part message-digesting
+ * operation, by digesting the value of a secret key as part of
+ * the data already digested. */
+CK_PKCS11_FUNCTION_INFO(C_DigestKey)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_OBJECT_HANDLE hKey       /* secret key to digest */
+    );
+#endif
+
+/* C_DigestFinal finishes a multiple-part message-digesting
+ * operation. */
+CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pDigest,        /* gets the message digest */
+    CK_ULONG_PTR pulDigestLen   /* gets byte count of digest */
+    );
+#endif
+
+/* Signing and MACing */
+
+/* C_SignInit initializes a signature (private key encryption)
+ * operation, where the signature is (will be) an appendix to
+ * the data, and plaintext cannot be recovered from the
+ *signature. */
+CK_PKCS11_FUNCTION_INFO(C_SignInit)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_MECHANISM_PTR pMechanism, /* the signature mechanism */
+    CK_OBJECT_HANDLE hKey        /* handle of signature key */
+    );
+#endif
+
+/* C_Sign signs (encrypts with private key) data in a single
+ * part, where the signature is (will be) an appendix to the
+ * data, and plaintext cannot be recovered from the signature. */
+CK_PKCS11_FUNCTION_INFO(C_Sign)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_BYTE_PTR pData,           /* the data to sign */
+    CK_ULONG ulDataLen,          /* count of bytes to sign */
+    CK_BYTE_PTR pSignature,      /* gets the signature */
+    CK_ULONG_PTR pulSignatureLen /* gets signature length */
+    );
+#endif
+
+/* C_SignUpdate continues a multiple-part signature operation,
+ * where the signature is (will be) an appendix to the data,
+ * and plaintext cannot be recovered from the signature. */
+CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pPart,          /* the data to sign */
+    CK_ULONG ulPartLen          /* count of bytes to sign */
+    );
+#endif
+
+/* C_SignFinal finishes a multiple-part signature operation,
+ * returning the signature. */
+CK_PKCS11_FUNCTION_INFO(C_SignFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_BYTE_PTR pSignature,      /* gets the signature */
+    CK_ULONG_PTR pulSignatureLen /* gets signature length */
+    );
+#endif
+
+/* C_SignRecoverInit initializes a signature operation, where
+ * the data can be recovered from the signature. */
+CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_MECHANISM_PTR pMechanism, /* the signature mechanism */
+    CK_OBJECT_HANDLE hKey        /* handle of the signature key */
+    );
+#endif
+
+/* C_SignRecover signs data in a single operation, where the
+ * data can be recovered from the signature. */
+CK_PKCS11_FUNCTION_INFO(C_SignRecover)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_BYTE_PTR pData,           /* the data to sign */
+    CK_ULONG ulDataLen,          /* count of bytes to sign */
+    CK_BYTE_PTR pSignature,      /* gets the signature */
+    CK_ULONG_PTR pulSignatureLen /* gets signature length */
+    );
+#endif
+
+/* Verifying signatures and MACs */
+
+/* C_VerifyInit initializes a verification operation, where the
+ * signature is an appendix to the data, and plaintext cannot
+ *  cannot be recovered from the signature (e.g. DSA). */
+CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_MECHANISM_PTR pMechanism, /* the verification mechanism */
+    CK_OBJECT_HANDLE hKey        /* verification key */
+    );
+#endif
+
+/* C_Verify verifies a signature in a single-part operation,
+ * where the signature is an appendix to the data, and plaintext
+ * cannot be recovered from the signature. */
+CK_PKCS11_FUNCTION_INFO(C_Verify)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pData,          /* signed data */
+    CK_ULONG ulDataLen,         /* length of signed data */
+    CK_BYTE_PTR pSignature,     /* signature */
+    CK_ULONG ulSignatureLen     /* signature length*/
+    );
+#endif
+
+/* C_VerifyUpdate continues a multiple-part verification
+ * operation, where the signature is an appendix to the data,
+ * and plaintext cannot be recovered from the signature. */
+CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pPart,          /* signed data */
+    CK_ULONG ulPartLen          /* length of signed data */
+    );
+#endif
+
+/* C_VerifyFinal finishes a multiple-part verification
+ * operation, checking the signature. */
+CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pSignature,     /* signature to verify */
+    CK_ULONG ulSignatureLen     /* signature length */
+    );
+#endif
+
+/* C_VerifyRecoverInit initializes a signature verification
+ * operation, where the data is recovered from the signature. */
+CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_MECHANISM_PTR pMechanism, /* the verification mechanism */
+    CK_OBJECT_HANDLE hKey        /* verification key */
+    );
+#endif
+
+/* C_VerifyRecover verifies a signature in a single-part
+ * operation, where the data is recovered from the signature. */
+CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pSignature,     /* signature to verify */
+    CK_ULONG ulSignatureLen,    /* signature length */
+    CK_BYTE_PTR pData,          /* gets signed data */
+    CK_ULONG_PTR pulDataLen     /* gets signed data len */
+    );
+#endif
+
+/* Dual-function cryptographic operations */
+
+/* C_DigestEncryptUpdate continues a multiple-part digesting
+ * and encryption operation. */
+CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,      /* session's handle */
+    CK_BYTE_PTR pPart,               /* the plaintext data */
+    CK_ULONG ulPartLen,              /* plaintext length */
+    CK_BYTE_PTR pEncryptedPart,      /* gets ciphertext */
+    CK_ULONG_PTR pulEncryptedPartLen /* gets c-text length */
+    );
+#endif
+
+/* C_DecryptDigestUpdate continues a multiple-part decryption and
+ * digesting operation. */
+CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* session's handle */
+    CK_BYTE_PTR pEncryptedPart,  /* ciphertext */
+    CK_ULONG ulEncryptedPartLen, /* ciphertext length */
+    CK_BYTE_PTR pPart,           /* gets plaintext */
+    CK_ULONG_PTR pulPartLen      /* gets plaintext len */
+    );
+#endif
+
+/* C_SignEncryptUpdate continues a multiple-part signing and
+ * encryption operation. */
+CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,      /* session's handle */
+    CK_BYTE_PTR pPart,               /* the plaintext data */
+    CK_ULONG ulPartLen,              /* plaintext length */
+    CK_BYTE_PTR pEncryptedPart,      /* gets ciphertext */
+    CK_ULONG_PTR pulEncryptedPartLen /* gets c-text length */
+    );
+#endif
+
+/* C_DecryptVerifyUpdate continues a multiple-part decryption and
+ * verify operation. */
+CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* session's handle */
+    CK_BYTE_PTR pEncryptedPart,  /* ciphertext */
+    CK_ULONG ulEncryptedPartLen, /* ciphertext length */
+    CK_BYTE_PTR pPart,           /* gets plaintext */
+    CK_ULONG_PTR pulPartLen      /* gets p-text length */
+    );
+#endif
+
+/* Key management */
+
+/* C_GenerateKey generates a secret key, creating a new key
+ * object. */
+CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* the session's handle */
+    CK_MECHANISM_PTR pMechanism, /* key generation mech. */
+    CK_ATTRIBUTE_PTR pTemplate,  /* template for new key */
+    CK_ULONG ulCount,            /* # of attrs in template */
+    CK_OBJECT_HANDLE_PTR phKey   /* gets handle of new key */
+    );
+#endif
+
+/* C_GenerateKeyPair generates a public-key/private-key pair,
+ * creating new key objects. */
+CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,           /* session handle */
+    CK_MECHANISM_PTR pMechanism,          /* key-gen mech. */
+    CK_ATTRIBUTE_PTR pPublicKeyTemplate,  /* template for pub. key */
+    CK_ULONG ulPublicKeyAttributeCount,   /* # pub. attrs. */
+    CK_ATTRIBUTE_PTR pPrivateKeyTemplate, /* template for priv. key */
+    CK_ULONG ulPrivateKeyAttributeCount,  /* # priv. attrs. */
+    CK_OBJECT_HANDLE_PTR phPublicKey,     /* gets pub. key handle */
+    CK_OBJECT_HANDLE_PTR phPrivateKey     /* gets priv. key handle */
+    );
+#endif
+
+/* C_WrapKey wraps (i.e., encrypts) a key. */
+CK_PKCS11_FUNCTION_INFO(C_WrapKey)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,    /* the session's handle */
+    CK_MECHANISM_PTR pMechanism,   /* the wrapping mechanism */
+    CK_OBJECT_HANDLE hWrappingKey, /* wrapping key */
+    CK_OBJECT_HANDLE hKey,         /* key to be wrapped */
+    CK_BYTE_PTR pWrappedKey,       /* gets wrapped key */
+    CK_ULONG_PTR pulWrappedKeyLen  /* gets wrapped key size */
+    );
+#endif
+
+/* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
+ * key object. */
+CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,      /* session's handle */
+    CK_MECHANISM_PTR pMechanism,     /* unwrapping mech. */
+    CK_OBJECT_HANDLE hUnwrappingKey, /* unwrapping key */
+    CK_BYTE_PTR pWrappedKey,         /* the wrapped key */
+    CK_ULONG ulWrappedKeyLen,        /* wrapped key len */
+    CK_ATTRIBUTE_PTR pTemplate,      /* new key template */
+    CK_ULONG ulAttributeCount,       /* template length */
+    CK_OBJECT_HANDLE_PTR phKey       /* gets new handle */
+    );
+#endif
+
+/* C_DeriveKey derives a key from a base key, creating a new key
+ * object. */
+CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession,  /* session's handle */
+    CK_MECHANISM_PTR pMechanism, /* key deriv. mech. */
+    CK_OBJECT_HANDLE hBaseKey,   /* base key */
+    CK_ATTRIBUTE_PTR pTemplate,  /* new key template */
+    CK_ULONG ulAttributeCount,   /* template length */
+    CK_OBJECT_HANDLE_PTR phKey   /* gets new handle */
+    );
+#endif
+
+/* Random number generation */
+
+/* C_SeedRandom mixes additional seed material into the token's
+ * random number generator. */
+CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR pSeed,          /* the seed material */
+    CK_ULONG ulSeedLen          /* length of seed material */
+    );
+#endif
+
+/* C_GenerateRandom generates random data. */
+CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_BYTE_PTR RandomData,     /* receives the random data */
+    CK_ULONG ulRandomLen        /* # of bytes to generate */
+    );
+#endif
+
+/* Parallel function management */
+
+/* C_GetFunctionStatus is a legacy function; it obtains an
+ * updated status of a function running in parallel with an
+ * application. */
+CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession /* the session's handle */
+    );
+#endif
+
+/* C_CancelFunction is a legacy function; it cancels a function
+ * running in parallel. */
+CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_SESSION_HANDLE hSession /* the session's handle */
+    );
+#endif
+
+/* Functions added in for PKCS #11 Version 2.01 or later */
+
+/* C_WaitForSlotEvent waits for a slot event (token insertion,
+ * removal, etc.) to occur. */
+CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
+#ifdef CK_NEED_ARG_LIST
+(
+    CK_FLAGS flags,       /* blocking/nonblocking flag */
+    CK_SLOT_ID_PTR pSlot, /* location that receives the slot ID */
+    CK_VOID_PTR pRserved  /* reserved.  Should be NULL_PTR */
+    );
+#endif
\ No newline at end of file
diff --git a/tests/pkcs11/pkcs11p.h b/tests/pkcs11/pkcs11p.h
new file mode 100644
index 00000000..1c920135
--- /dev/null
+++ b/tests/pkcs11/pkcs11p.h
@@ -0,0 +1,24 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/*
+ * Copyright (C) 1994-1999 RSA Security Inc. Licence to copy this document
+ * is granted provided that it is identified as "RSA Security Inc. Public-Key
+ * Cryptography Standards (PKCS)" in all material mentioning or referencing
+ * this document.
+ */
+/* these data types are platform/implementation dependent. */
+/*
+ * Packing was removed from the shipped RSA header files, even
+ * though it's still needed. put in a central file to help merging..
+ */
+
+#if defined(_WIN32) || defined(_WINDOWS)
+#ifdef __clang__
+#pragma clang diagnostic ignored "-Wpragma-pack"
+#endif
+#ifdef _MSC_VER
+#pragma warning(disable : 4103)
+#endif
+#pragma pack(push, cryptoki, 1)
+#endif
diff --git a/tests/pkcs11/pkcs11t.h b/tests/pkcs11/pkcs11t.h
new file mode 100644
index 00000000..3d17fa7f
--- /dev/null
+++ b/tests/pkcs11/pkcs11t.h
@@ -0,0 +1,1799 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* License to copy and use this software is granted provided that it is
+ * identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
+ * (Cryptoki)" in all material mentioning or referencing this software.
+
+ * License is also granted to make and use derivative works provided that
+ * such works are identified as "derived from the RSA Security Inc. PKCS #11
+ * Cryptographic Token Interface (Cryptoki)" in all material mentioning or
+ * referencing the derived work.
+
+ * RSA Security Inc. makes no representations concerning either the
+ * merchantability of this software or the suitability of this software for
+ * any particular purpose. It is provided "as is" without express or implied
+ * warranty of any kind.
+ */
+
+#ifndef _PKCS11T_H_
+#define _PKCS11T_H_ 1
+
+#define CK_TRUE 1
+#define CK_FALSE 0
+
+#define CK_INVALID_SESSION 0
+
+/* an unsigned 8-bit value */
+typedef unsigned char CK_BYTE;
+
+/* an unsigned 8-bit character */
+typedef CK_BYTE CK_CHAR;
+
+/* an 8-bit UTF-8 character */
+typedef CK_BYTE CK_UTF8CHAR;
+
+/* a BYTE-sized Boolean flag */
+typedef CK_BYTE CK_BBOOL;
+
+/* an unsigned value, at least 32 bits long */
+typedef unsigned long int CK_ULONG;
+
+/* a signed value, the same size as a CK_ULONG */
+/* CK_LONG is new for v2.0 */
+typedef long int CK_LONG;
+
+/* at least 32 bits; each bit is a Boolean flag */
+typedef CK_ULONG CK_FLAGS;
+
+/* some special values for certain CK_ULONG variables */
+#define CK_UNAVAILABLE_INFORMATION (~0UL)
+#define CK_EFFECTIVELY_INFINITE 0
+
+typedef CK_BYTE CK_PTR CK_BYTE_PTR;
+typedef CK_CHAR CK_PTR CK_CHAR_PTR;
+typedef CK_UTF8CHAR CK_PTR CK_UTF8CHAR_PTR;
+typedef CK_ULONG CK_PTR CK_ULONG_PTR;
+typedef void CK_PTR CK_VOID_PTR;
+
+/* Pointer to a CK_VOID_PTR-- i.e., pointer to pointer to void */
+typedef CK_VOID_PTR CK_PTR CK_VOID_PTR_PTR;
+
+/* The following value is always invalid if used as a session */
+/* handle or object handle */
+#define CK_INVALID_HANDLE 0
+
+/* pack */
+#include "pkcs11p.h"
+
+typedef struct CK_VERSION {
+    CK_BYTE major; /* integer portion of version number */
+    CK_BYTE minor; /* 1/100ths portion of version number */
+} CK_VERSION;
+
+typedef CK_VERSION CK_PTR CK_VERSION_PTR;
+
+typedef struct CK_INFO {
+    /* manufacturerID and libraryDecription have been changed from
+   * CK_CHAR to CK_UTF8CHAR for v2.10 */
+    CK_VERSION cryptokiVersion;     /* PKCS #11 interface ver */
+    CK_UTF8CHAR manufacturerID[32]; /* blank padded */
+    CK_FLAGS flags;                 /* must be zero */
+
+    /* libraryDescription and libraryVersion are new for v2.0 */
+    CK_UTF8CHAR libraryDescription[32]; /* blank padded */
+    CK_VERSION libraryVersion;          /* version of library */
+} CK_INFO;
+
+typedef CK_INFO CK_PTR CK_INFO_PTR;
+
+/* CK_NOTIFICATION enumerates the types of notifications that
+ * PKCS #11 provides to an application */
+/* CK_NOTIFICATION has been changed from an enum to a CK_ULONG
+ * for v2.0 */
+typedef CK_ULONG CK_NOTIFICATION;
+#define CKN_SURRENDER 0
+
+typedef CK_ULONG CK_SLOT_ID;
+
+typedef CK_SLOT_ID CK_PTR CK_SLOT_ID_PTR;
+
+/* CK_SLOT_INFO provides information about a slot */
+typedef struct CK_SLOT_INFO {
+    /* slotDescription and manufacturerID have been changed from
+     * CK_CHAR to CK_UTF8CHAR for v2.10 */
+    CK_UTF8CHAR slotDescription[64]; /* blank padded */
+    CK_UTF8CHAR manufacturerID[32];  /* blank padded */
+    CK_FLAGS flags;
+
+    /* hardwareVersion and firmwareVersion are new for v2.0 */
+    CK_VERSION hardwareVersion; /* version of hardware */
+    CK_VERSION firmwareVersion; /* version of firmware */
+} CK_SLOT_INFO;
+
+/* flags: bit flags that provide capabilities of the slot
+ *      Bit Flag              Mask        Meaning
+ */
+#define CKF_TOKEN_PRESENT 0x00000001    /* a token is there */
+#define CKF_REMOVABLE_DEVICE 0x00000002 /* removable devices*/
+#define CKF_HW_SLOT 0x00000004          /* hardware slot */
+
+typedef CK_SLOT_INFO CK_PTR CK_SLOT_INFO_PTR;
+
+/* CK_TOKEN_INFO provides information about a token */
+typedef struct CK_TOKEN_INFO {
+    /* label, manufacturerID, and model have been changed from
+     * CK_CHAR to CK_UTF8CHAR for v2.10 */
+    CK_UTF8CHAR label[32];          /* blank padded */
+    CK_UTF8CHAR manufacturerID[32]; /* blank padded */
+    CK_UTF8CHAR model[16];          /* blank padded */
+    CK_CHAR serialNumber[16];       /* blank padded */
+    CK_FLAGS flags;                 /* see below */
+
+    /* ulMaxSessionCount, ulSessionCount, ulMaxRwSessionCount,
+     * ulRwSessionCount, ulMaxPinLen, and ulMinPinLen have all been
+     * changed from CK_USHORT to CK_ULONG for v2.0 */
+    CK_ULONG ulMaxSessionCount;    /* max open sessions */
+    CK_ULONG ulSessionCount;       /* sess. now open */
+    CK_ULONG ulMaxRwSessionCount;  /* max R/W sessions */
+    CK_ULONG ulRwSessionCount;     /* R/W sess. now open */
+    CK_ULONG ulMaxPinLen;          /* in bytes */
+    CK_ULONG ulMinPinLen;          /* in bytes */
+    CK_ULONG ulTotalPublicMemory;  /* in bytes */
+    CK_ULONG ulFreePublicMemory;   /* in bytes */
+    CK_ULONG ulTotalPrivateMemory; /* in bytes */
+    CK_ULONG ulFreePrivateMemory;  /* in bytes */
+
+    /* hardwareVersion, firmwareVersion, and time are new for
+     * v2.0 */
+    CK_VERSION hardwareVersion; /* version of hardware */
+    CK_VERSION firmwareVersion; /* version of firmware */
+    CK_CHAR utcTime[16];        /* time */
+} CK_TOKEN_INFO;
+
+/* The flags parameter is defined as follows:
+ *      Bit Flag                    Mask        Meaning
+ */
+#define CKF_RNG 0x00000001                  /* has random # \
+                                             * generator */
+#define CKF_WRITE_PROTECTED 0x00000002      /* token is \
+                                             * write-   \
+                                             * protected */
+#define CKF_LOGIN_REQUIRED 0x00000004       /* user must \
+                                             * login */
+#define CKF_USER_PIN_INITIALIZED 0x00000008 /* normal user's \
+                                             * PIN is set */
+
+/* CKF_RESTORE_KEY_NOT_NEEDED is new for v2.0.  If it is set,
+ * that means that *every* time the state of cryptographic
+ * operations of a session is successfully saved, all keys
+ * needed to continue those operations are stored in the state */
+#define CKF_RESTORE_KEY_NOT_NEEDED 0x00000020
+
+/* CKF_CLOCK_ON_TOKEN is new for v2.0.  If it is set, that means
+ * that the token has some sort of clock.  The time on that
+ * clock is returned in the token info structure */
+#define CKF_CLOCK_ON_TOKEN 0x00000040
+
+/* CKF_PROTECTED_AUTHENTICATION_PATH is new for v2.0.  If it is
+ * set, that means that there is some way for the user to login
+ * without sending a PIN through the PKCS #11 library itself */
+#define CKF_PROTECTED_AUTHENTICATION_PATH 0x00000100
+
+/* CKF_DUAL_CRYPTO_OPERATIONS is new for v2.0.  If it is true,
+ * that means that a single session with the token can perform
+ * dual simultaneous cryptographic operations (digest and
+ * encrypt; decrypt and digest; sign and encrypt; and decrypt
+ * and sign) */
+#define CKF_DUAL_CRYPTO_OPERATIONS 0x00000200
+
+/* CKF_TOKEN_INITIALIZED if new for v2.10. If it is true, the
+ * token has been initialized using C_InitializeToken or an
+ * equivalent mechanism outside the scope of PKCS #11.
+ * Calling C_InitializeToken when this flag is set will cause
+ * the token to be reinitialized. */
+#define CKF_TOKEN_INITIALIZED 0x00000400
+
+/* CKF_SECONDARY_AUTHENTICATION if new for v2.10. If it is
+ * true, the token supports secondary authentication for
+ * private key objects. This flag is deprecated in v2.11 and
+   onwards. */
+#define CKF_SECONDARY_AUTHENTICATION 0x00000800
+
+/* CKF_USER_PIN_COUNT_LOW if new for v2.10. If it is true, an
+ * incorrect user login PIN has been entered at least once
+ * since the last successful authentication. */
+#define CKF_USER_PIN_COUNT_LOW 0x00010000
+
+/* CKF_USER_PIN_FINAL_TRY if new for v2.10. If it is true,
+ * supplying an incorrect user PIN will it to become locked. */
+#define CKF_USER_PIN_FINAL_TRY 0x00020000
+
+/* CKF_USER_PIN_LOCKED if new for v2.10. If it is true, the
+ * user PIN has been locked. User login to the token is not
+ * possible. */
+#define CKF_USER_PIN_LOCKED 0x00040000
+
+/* CKF_USER_PIN_TO_BE_CHANGED if new for v2.10. If it is true,
+ * the user PIN value is the default value set by token
+ * initialization or manufacturing, or the PIN has been
+ * expired by the card. */
+#define CKF_USER_PIN_TO_BE_CHANGED 0x00080000
+
+/* CKF_SO_PIN_COUNT_LOW if new for v2.10. If it is true, an
+ * incorrect SO login PIN has been entered at least once since
+ * the last successful authentication. */
+#define CKF_SO_PIN_COUNT_LOW 0x00100000
+
+/* CKF_SO_PIN_FINAL_TRY if new for v2.10. If it is true,
+ * supplying an incorrect SO PIN will it to become locked. */
+#define CKF_SO_PIN_FINAL_TRY 0x00200000
+
+/* CKF_SO_PIN_LOCKED if new for v2.10. If it is true, the SO
+ * PIN has been locked. SO login to the token is not possible.
+ */
+#define CKF_SO_PIN_LOCKED 0x00400000
+
+/* CKF_SO_PIN_TO_BE_CHANGED if new for v2.10. If it is true,
+ * the SO PIN value is the default value set by token
+ * initialization or manufacturing, or the PIN has been
+ * expired by the card. */
+#define CKF_SO_PIN_TO_BE_CHANGED 0x00800000
+
+typedef CK_TOKEN_INFO CK_PTR CK_TOKEN_INFO_PTR;
+
+/* CK_SESSION_HANDLE is a PKCS #11-assigned value that
+ * identifies a session */
+typedef CK_ULONG CK_SESSION_HANDLE;
+
+typedef CK_SESSION_HANDLE CK_PTR CK_SESSION_HANDLE_PTR;
+
+/* CK_USER_TYPE enumerates the types of PKCS #11 users */
+/* CK_USER_TYPE has been changed from an enum to a CK_ULONG for
+ * v2.0 */
+typedef CK_ULONG CK_USER_TYPE;
+/* Security Officer */
+#define CKU_SO 0
+/* Normal user */
+#define CKU_USER 1
+/* Context specific (added in v2.20) */
+#define CKU_CONTEXT_SPECIFIC 2
+
+/* CK_STATE enumerates the session states */
+/* CK_STATE has been changed from an enum to a CK_ULONG for
+ * v2.0 */
+typedef CK_ULONG CK_STATE;
+#define CKS_RO_PUBLIC_SESSION 0
+#define CKS_RO_USER_FUNCTIONS 1
+#define CKS_RW_PUBLIC_SESSION 2
+#define CKS_RW_USER_FUNCTIONS 3
+#define CKS_RW_SO_FUNCTIONS 4
+
+/* CK_SESSION_INFO provides information about a session */
+typedef struct CK_SESSION_INFO {
+    CK_SLOT_ID slotID;
+    CK_STATE state;
+    CK_FLAGS flags; /* see below */
+
+    /* ulDeviceError was changed from CK_USHORT to CK_ULONG for
+     * v2.0 */
+    CK_ULONG ulDeviceError; /* device-dependent error code */
+} CK_SESSION_INFO;
+
+/* The flags are defined in the following table:
+ *      Bit Flag                Mask        Meaning
+ */
+#define CKF_RW_SESSION 0x00000002     /* session is r/w */
+#define CKF_SERIAL_SESSION 0x00000004 /* no parallel */
+
+typedef CK_SESSION_INFO CK_PTR CK_SESSION_INFO_PTR;
+
+/* CK_OBJECT_HANDLE is a token-specific identifier for an
+ * object  */
+typedef CK_ULONG CK_OBJECT_HANDLE;
+
+typedef CK_OBJECT_HANDLE CK_PTR CK_OBJECT_HANDLE_PTR;
+
+/* CK_OBJECT_CLASS is a value that identifies the classes (or
+ * types) of objects that PKCS #11 recognizes.  It is defined
+ * as follows: */
+/* CK_OBJECT_CLASS was changed from CK_USHORT to CK_ULONG for
+ * v2.0 */
+typedef CK_ULONG CK_OBJECT_CLASS;
+
+/* The following classes of objects are defined: */
+/* CKO_HW_FEATURE is new for v2.10 */
+/* CKO_DOMAIN_PARAMETERS is new for v2.11 */
+/* CKO_MECHANISM is new for v2.20 */
+#define CKO_DATA 0x00000000
+#define CKO_CERTIFICATE 0x00000001
+#define CKO_PUBLIC_KEY 0x00000002
+#define CKO_PRIVATE_KEY 0x00000003
+#define CKO_SECRET_KEY 0x00000004
+#define CKO_HW_FEATURE 0x00000005
+#define CKO_DOMAIN_PARAMETERS 0x00000006
+#define CKO_MECHANISM 0x00000007
+#define CKO_VENDOR_DEFINED 0x80000000
+
+typedef CK_OBJECT_CLASS CK_PTR CK_OBJECT_CLASS_PTR;
+
+/* CK_HW_FEATURE_TYPE is new for v2.10. CK_HW_FEATURE_TYPE is a
+ * value that identifies the hardware feature type of an object
+ * with CK_OBJECT_CLASS equal to CKO_HW_FEATURE. */
+typedef CK_ULONG CK_HW_FEATURE_TYPE;
+
+/* The following hardware feature types are defined */
+/* CKH_USER_INTERFACE is new for v2.20 */
+#define CKH_MONOTONIC_COUNTER 0x00000001
+#define CKH_CLOCK 0x00000002
+#define CKH_USER_INTERFACE 0x00000003
+#define CKH_VENDOR_DEFINED 0x80000000
+
+/* CK_KEY_TYPE is a value that identifies a key type */
+/* CK_KEY_TYPE was changed from CK_USHORT to CK_ULONG for v2.0 */
+typedef CK_ULONG CK_KEY_TYPE;
+
+/* the following key types are defined: */
+#define CKK_RSA 0x00000000
+#define CKK_DSA 0x00000001
+#define CKK_DH 0x00000002
+
+/* CKK_ECDSA and CKK_KEA are new for v2.0 */
+/* CKK_ECDSA is deprecated in v2.11, CKK_EC is preferred. */
+#define CKK_ECDSA 0x00000003
+#define CKK_EC 0x00000003
+#define CKK_X9_42_DH 0x00000004
+#define CKK_KEA 0x00000005
+
+#define CKK_GENERIC_SECRET 0x00000010
+#define CKK_RC2 0x00000011
+#define CKK_RC4 0x00000012
+#define CKK_DES 0x00000013
+#define CKK_DES2 0x00000014
+#define CKK_DES3 0x00000015
+
+/* all these key types are new for v2.0 */
+#define CKK_CAST 0x00000016
+#define CKK_CAST3 0x00000017
+/* CKK_CAST5 is deprecated in v2.11, CKK_CAST128 is preferred. */
+#define CKK_CAST5 0x00000018
+#define CKK_CAST128 0x00000018
+#define CKK_RC5 0x00000019
+#define CKK_IDEA 0x0000001A
+#define CKK_SKIPJACK 0x0000001B
+#define CKK_BATON 0x0000001C
+#define CKK_JUNIPER 0x0000001D
+#define CKK_CDMF 0x0000001E
+#define CKK_AES 0x0000001F
+
+/* BlowFish and TwoFish are new for v2.20 */
+#define CKK_BLOWFISH 0x00000020
+#define CKK_TWOFISH 0x00000021
+
+/* Camellia is proposed for v2.20 Amendment 3 */
+#define CKK_CAMELLIA 0x00000025
+
+#define CKK_SEED 0x00000026
+
+#define CKK_VENDOR_DEFINED 0x80000000
+
+/* CK_CERTIFICATE_TYPE is a value that identifies a certificate
+ * type */
+/* CK_CERTIFICATE_TYPE was changed from CK_USHORT to CK_ULONG
+ * for v2.0 */
+typedef CK_ULONG CK_CERTIFICATE_TYPE;
+
+#define CK_CERTIFICATE_CATEGORY_UNSPECIFIED 0UL
+#define CK_CERTIFICATE_CATEGORY_TOKEN_USER 1UL
+#define CK_CERTIFICATE_CATEGORY_AUTHORITY 2UL
+#define CK_CERTIFICATE_CATEGORY_OTHER_ENTITY 3UL
+
+/* The following certificate types are defined: */
+/* CKC_X_509_ATTR_CERT is new for v2.10 */
+/* CKC_WTLS is new for v2.20 */
+#define CKC_X_509 0x00000000
+#define CKC_X_509_ATTR_CERT 0x00000001
+#define CKC_WTLS 0x00000002
+#define CKC_VENDOR_DEFINED 0x80000000
+
+/* CK_ATTRIBUTE_TYPE is a value that identifies an attribute
+ * type */
+/* CK_ATTRIBUTE_TYPE was changed from CK_USHORT to CK_ULONG for
+ * v2.0 */
+typedef CK_ULONG CK_ATTRIBUTE_TYPE;
+
+/* The CKF_ARRAY_ATTRIBUTE flag identifies an attribute which
+   consists of an array of values. */
+#define CKF_ARRAY_ATTRIBUTE 0x40000000
+
+/* The following attribute types are defined: */
+#define CKA_CLASS 0x00000000
+#define CKA_TOKEN 0x00000001
+#define CKA_PRIVATE 0x00000002
+#define CKA_LABEL 0x00000003
+#define CKA_APPLICATION 0x00000010
+#define CKA_VALUE 0x00000011
+
+/* CKA_OBJECT_ID is new for v2.10 */
+#define CKA_OBJECT_ID 0x00000012
+
+#define CKA_CERTIFICATE_TYPE 0x00000080
+#define CKA_ISSUER 0x00000081
+#define CKA_SERIAL_NUMBER 0x00000082
+
+/* CKA_AC_ISSUER, CKA_OWNER, and CKA_ATTR_TYPES are new
+ * for v2.10 */
+#define CKA_AC_ISSUER 0x00000083
+#define CKA_OWNER 0x00000084
+#define CKA_ATTR_TYPES 0x00000085
+
+/* CKA_TRUSTED is new for v2.11 */
+#define CKA_TRUSTED 0x00000086
+
+/* CKA_CERTIFICATE_CATEGORY ...
+ * CKA_CHECK_VALUE are new for v2.20 */
+#define CKA_CERTIFICATE_CATEGORY 0x00000087
+#define CKA_JAVA_MIDP_SECURITY_DOMAIN 0x00000088
+#define CKA_URL 0x00000089
+#define CKA_HASH_OF_SUBJECT_PUBLIC_KEY 0x0000008A
+#define CKA_HASH_OF_ISSUER_PUBLIC_KEY 0x0000008B
+#define CKA_CHECK_VALUE 0x00000090
+
+#define CKA_KEY_TYPE 0x00000100
+#define CKA_SUBJECT 0x00000101
+#define CKA_ID 0x00000102
+#define CKA_SENSITIVE 0x00000103
+#define CKA_ENCRYPT 0x00000104
+#define CKA_DECRYPT 0x00000105
+#define CKA_WRAP 0x00000106
+#define CKA_UNWRAP 0x00000107
+#define CKA_SIGN 0x00000108
+#define CKA_SIGN_RECOVER 0x00000109
+#define CKA_VERIFY 0x0000010A
+#define CKA_VERIFY_RECOVER 0x0000010B
+#define CKA_DERIVE 0x0000010C
+#define CKA_START_DATE 0x00000110
+#define CKA_END_DATE 0x00000111
+#define CKA_MODULUS 0x00000120
+#define CKA_MODULUS_BITS 0x00000121
+#define CKA_PUBLIC_EXPONENT 0x00000122
+#define CKA_PRIVATE_EXPONENT 0x00000123
+#define CKA_PRIME_1 0x00000124
+#define CKA_PRIME_2 0x00000125
+#define CKA_EXPONENT_1 0x00000126
+#define CKA_EXPONENT_2 0x00000127
+#define CKA_COEFFICIENT 0x00000128
+/* CKA_PUBLIC_KEY_INFO is new for v2.40 */
+#define CKA_PUBLIC_KEY_INFO 0x00000129
+#define CKA_PRIME 0x00000130
+#define CKA_SUBPRIME 0x00000131
+#define CKA_BASE 0x00000132
+
+/* CKA_PRIME_BITS and CKA_SUB_PRIME_BITS are new for v2.11 */
+#define CKA_PRIME_BITS 0x00000133
+#define CKA_SUBPRIME_BITS 0x00000134
+#define CKA_SUB_PRIME_BITS CKA_SUBPRIME_BITS
+/* (To retain backwards-compatibility) */
+
+#define CKA_VALUE_BITS 0x00000160
+#define CKA_VALUE_LEN 0x00000161
+
+/* CKA_EXTRACTABLE, CKA_LOCAL, CKA_NEVER_EXTRACTABLE,
+ * CKA_ALWAYS_SENSITIVE, CKA_MODIFIABLE, CKA_ECDSA_PARAMS,
+ * and CKA_EC_POINT are new for v2.0 */
+#define CKA_EXTRACTABLE 0x00000162
+#define CKA_LOCAL 0x00000163
+#define CKA_NEVER_EXTRACTABLE 0x00000164
+#define CKA_ALWAYS_SENSITIVE 0x00000165
+
+/* CKA_KEY_GEN_MECHANISM is new for v2.11 */
+#define CKA_KEY_GEN_MECHANISM 0x00000166
+
+#define CKA_MODIFIABLE 0x00000170
+
+/* CKA_ECDSA_PARAMS is deprecated in v2.11,
+ * CKA_EC_PARAMS is preferred. */
+#define CKA_ECDSA_PARAMS 0x00000180
+#define CKA_EC_PARAMS 0x00000180
+
+#define CKA_EC_POINT 0x00000181
+
+/* CKA_SECONDARY_AUTH, CKA_AUTH_PIN_FLAGS,
+ * are new for v2.10. Deprecated in v2.11 and onwards. */
+#define CKA_SECONDARY_AUTH 0x00000200
+#define CKA_AUTH_PIN_FLAGS 0x00000201
+
+/* CKA_ALWAYS_AUTHENTICATE ...
+ * CKA_UNWRAP_TEMPLATE are new for v2.20 */
+#define CKA_ALWAYS_AUTHENTICATE 0x00000202
+
+#define CKA_WRAP_WITH_TRUSTED 0x00000210
+#define CKA_WRAP_TEMPLATE (CKF_ARRAY_ATTRIBUTE | 0x00000211)
+#define CKA_UNWRAP_TEMPLATE (CKF_ARRAY_ATTRIBUTE | 0x00000212)
+
+/* CKA_HW_FEATURE_TYPE, CKA_RESET_ON_INIT, and CKA_HAS_RESET
+ * are new for v2.10 */
+#define CKA_HW_FEATURE_TYPE 0x00000300
+#define CKA_RESET_ON_INIT 0x00000301
+#define CKA_HAS_RESET 0x00000302
+
+/* The following attributes are new for v2.20 */
+#define CKA_PIXEL_X 0x00000400
+#define CKA_PIXEL_Y 0x00000401
+#define CKA_RESOLUTION 0x00000402
+#define CKA_CHAR_ROWS 0x00000403
+#define CKA_CHAR_COLUMNS 0x00000404
+#define CKA_COLOR 0x00000405
+#define CKA_BITS_PER_PIXEL 0x00000406
+#define CKA_CHAR_SETS 0x00000480
+#define CKA_ENCODING_METHODS 0x00000481
+#define CKA_MIME_TYPES 0x00000482
+#define CKA_MECHANISM_TYPE 0x00000500
+#define CKA_REQUIRED_CMS_ATTRIBUTES 0x00000501
+#define CKA_DEFAULT_CMS_ATTRIBUTES 0x00000502
+#define CKA_SUPPORTED_CMS_ATTRIBUTES 0x00000503
+#define CKA_ALLOWED_MECHANISMS (CKF_ARRAY_ATTRIBUTE | 0x00000600)
+
+#define CKA_VENDOR_DEFINED 0x80000000
+
+/* CK_ATTRIBUTE is a structure that includes the type, length
+ * and value of an attribute */
+typedef struct CK_ATTRIBUTE {
+    CK_ATTRIBUTE_TYPE type;
+    CK_VOID_PTR pValue;
+
+    /* ulValueLen went from CK_USHORT to CK_ULONG for v2.0 */
+    CK_ULONG ulValueLen; /* in bytes */
+} CK_ATTRIBUTE;
+
+typedef CK_ATTRIBUTE CK_PTR CK_ATTRIBUTE_PTR;
+
+/* CK_DATE is a structure that defines a date */
+typedef struct CK_DATE {
+    CK_CHAR year[4];  /* the year ("1900" - "9999") */
+    CK_CHAR month[2]; /* the month ("01" - "12") */
+    CK_CHAR day[2];   /* the day   ("01" - "31") */
+} CK_DATE;
+
+/* CK_MECHANISM_TYPE is a value that identifies a mechanism
+ * type */
+/* CK_MECHANISM_TYPE was changed from CK_USHORT to CK_ULONG for
+ * v2.0 */
+typedef CK_ULONG CK_MECHANISM_TYPE;
+
+/* the following mechanism types are defined: */
+#define CKM_RSA_PKCS_KEY_PAIR_GEN 0x00000000
+#define CKM_RSA_PKCS 0x00000001
+#define CKM_RSA_9796 0x00000002
+#define CKM_RSA_X_509 0x00000003
+
+/* CKM_MD2_RSA_PKCS, CKM_MD5_RSA_PKCS, and CKM_SHA1_RSA_PKCS
+ * are new for v2.0.  They are mechanisms which hash and sign */
+#define CKM_MD2_RSA_PKCS 0x00000004
+#define CKM_MD5_RSA_PKCS 0x00000005
+#define CKM_SHA1_RSA_PKCS 0x00000006
+
+/* CKM_RIPEMD128_RSA_PKCS, CKM_RIPEMD160_RSA_PKCS, and
+ * CKM_RSA_PKCS_OAEP are new for v2.10 */
+#define CKM_RIPEMD128_RSA_PKCS 0x00000007
+#define CKM_RIPEMD160_RSA_PKCS 0x00000008
+#define CKM_RSA_PKCS_OAEP 0x00000009
+
+/* CKM_RSA_X9_31_KEY_PAIR_GEN, CKM_RSA_X9_31, CKM_SHA1_RSA_X9_31,
+ * CKM_RSA_PKCS_PSS, and CKM_SHA1_RSA_PKCS_PSS are new for v2.11 */
+#define CKM_RSA_X9_31_KEY_PAIR_GEN 0x0000000A
+#define CKM_RSA_X9_31 0x0000000B
+#define CKM_SHA1_RSA_X9_31 0x0000000C
+#define CKM_RSA_PKCS_PSS 0x0000000D
+#define CKM_SHA1_RSA_PKCS_PSS 0x0000000E
+
+#define CKM_DSA_KEY_PAIR_GEN 0x00000010
+#define CKM_DSA 0x00000011
+#define CKM_DSA_SHA1 0x00000012
+#define CKM_DH_PKCS_KEY_PAIR_GEN 0x00000020
+#define CKM_DH_PKCS_DERIVE 0x00000021
+
+/* CKM_X9_42_DH_KEY_PAIR_GEN, CKM_X9_42_DH_DERIVE,
+ * CKM_X9_42_DH_HYBRID_DERIVE, and CKM_X9_42_MQV_DERIVE are new for
+ * v2.11 */
+#define CKM_X9_42_DH_KEY_PAIR_GEN 0x00000030
+#define CKM_X9_42_DH_DERIVE 0x00000031
+#define CKM_X9_42_DH_HYBRID_DERIVE 0x00000032
+#define CKM_X9_42_MQV_DERIVE 0x00000033
+
+/* CKM_SHA256/384/512 are new for v2.20 */
+#define CKM_SHA256_RSA_PKCS 0x00000040
+#define CKM_SHA384_RSA_PKCS 0x00000041
+#define CKM_SHA512_RSA_PKCS 0x00000042
+#define CKM_SHA256_RSA_PKCS_PSS 0x00000043
+#define CKM_SHA384_RSA_PKCS_PSS 0x00000044
+#define CKM_SHA512_RSA_PKCS_PSS 0x00000045
+
+/* CKM_SHA224 new for v2.20 amendment 3 */
+#define CKM_SHA224_RSA_PKCS 0x00000046
+#define CKM_SHA224_RSA_PKCS_PSS 0x00000047
+
+#define CKM_RC2_KEY_GEN 0x00000100
+#define CKM_RC2_ECB 0x00000101
+#define CKM_RC2_CBC 0x00000102
+#define CKM_RC2_MAC 0x00000103
+
+/* CKM_RC2_MAC_GENERAL and CKM_RC2_CBC_PAD are new for v2.0 */
+#define CKM_RC2_MAC_GENERAL 0x00000104
+#define CKM_RC2_CBC_PAD 0x00000105
+
+#define CKM_RC4_KEY_GEN 0x00000110
+#define CKM_RC4 0x00000111
+#define CKM_DES_KEY_GEN 0x00000120
+#define CKM_DES_ECB 0x00000121
+#define CKM_DES_CBC 0x00000122
+#define CKM_DES_MAC 0x00000123
+
+/* CKM_DES_MAC_GENERAL and CKM_DES_CBC_PAD are new for v2.0 */
+#define CKM_DES_MAC_GENERAL 0x00000124
+#define CKM_DES_CBC_PAD 0x00000125
+
+#define CKM_DES2_KEY_GEN 0x00000130
+#define CKM_DES3_KEY_GEN 0x00000131
+#define CKM_DES3_ECB 0x00000132
+#define CKM_DES3_CBC 0x00000133
+#define CKM_DES3_MAC 0x00000134
+
+/* CKM_DES3_MAC_GENERAL, CKM_DES3_CBC_PAD, CKM_CDMF_KEY_GEN,
+ * CKM_CDMF_ECB, CKM_CDMF_CBC, CKM_CDMF_MAC,
+ * CKM_CDMF_MAC_GENERAL, and CKM_CDMF_CBC_PAD are new for v2.0 */
+#define CKM_DES3_MAC_GENERAL 0x00000135
+#define CKM_DES3_CBC_PAD 0x00000136
+#define CKM_CDMF_KEY_GEN 0x00000140
+#define CKM_CDMF_ECB 0x00000141
+#define CKM_CDMF_CBC 0x00000142
+#define CKM_CDMF_MAC 0x00000143
+#define CKM_CDMF_MAC_GENERAL 0x00000144
+#define CKM_CDMF_CBC_PAD 0x00000145
+
+/* the following four DES mechanisms are new for v2.20 */
+#define CKM_DES_OFB64 0x00000150
+#define CKM_DES_OFB8 0x00000151
+#define CKM_DES_CFB64 0x00000152
+#define CKM_DES_CFB8 0x00000153
+
+#define CKM_MD2 0x00000200
+
+/* CKM_MD2_HMAC and CKM_MD2_HMAC_GENERAL are new for v2.0 */
+#define CKM_MD2_HMAC 0x00000201
+#define CKM_MD2_HMAC_GENERAL 0x00000202
+
+#define CKM_MD5 0x00000210
+
+/* CKM_MD5_HMAC and CKM_MD5_HMAC_GENERAL are new for v2.0 */
+#define CKM_MD5_HMAC 0x00000211
+#define CKM_MD5_HMAC_GENERAL 0x00000212
+
+#define CKM_SHA_1 0x00000220
+
+/* CKM_SHA_1_HMAC and CKM_SHA_1_HMAC_GENERAL are new for v2.0 */
+#define CKM_SHA_1_HMAC 0x00000221
+#define CKM_SHA_1_HMAC_GENERAL 0x00000222
+
+/* CKM_RIPEMD128, CKM_RIPEMD128_HMAC,
+ * CKM_RIPEMD128_HMAC_GENERAL, CKM_RIPEMD160, CKM_RIPEMD160_HMAC,
+ * and CKM_RIPEMD160_HMAC_GENERAL are new for v2.10 */
+#define CKM_RIPEMD128 0x00000230
+#define CKM_RIPEMD128_HMAC 0x00000231
+#define CKM_RIPEMD128_HMAC_GENERAL 0x00000232
+#define CKM_RIPEMD160 0x00000240
+#define CKM_RIPEMD160_HMAC 0x00000241
+#define CKM_RIPEMD160_HMAC_GENERAL 0x00000242
+
+/* CKM_SHA256/384/512 are new for v2.20 */
+#define CKM_SHA256 0x00000250
+#define CKM_SHA256_HMAC 0x00000251
+#define CKM_SHA256_HMAC_GENERAL 0x00000252
+#define CKM_SHA384 0x00000260
+#define CKM_SHA384_HMAC 0x00000261
+#define CKM_SHA384_HMAC_GENERAL 0x00000262
+#define CKM_SHA512 0x00000270
+#define CKM_SHA512_HMAC 0x00000271
+#define CKM_SHA512_HMAC_GENERAL 0x00000272
+
+/* CKM_SHA224 new for v2.20 amendment 3 */
+#define CKM_SHA224 0x00000255
+#define CKM_SHA224_HMAC 0x00000256
+#define CKM_SHA224_HMAC_GENERAL 0x00000257
+
+/* All of the following mechanisms are new for v2.0 */
+/* Note that CAST128 and CAST5 are the same algorithm */
+#define CKM_CAST_KEY_GEN 0x00000300
+#define CKM_CAST_ECB 0x00000301
+#define CKM_CAST_CBC 0x00000302
+#define CKM_CAST_MAC 0x00000303
+#define CKM_CAST_MAC_GENERAL 0x00000304
+#define CKM_CAST_CBC_PAD 0x00000305
+#define CKM_CAST3_KEY_GEN 0x00000310
+#define CKM_CAST3_ECB 0x00000311
+#define CKM_CAST3_CBC 0x00000312
+#define CKM_CAST3_MAC 0x00000313
+#define CKM_CAST3_MAC_GENERAL 0x00000314
+#define CKM_CAST3_CBC_PAD 0x00000315
+#define CKM_CAST5_KEY_GEN 0x00000320
+#define CKM_CAST128_KEY_GEN 0x00000320
+#define CKM_CAST5_ECB 0x00000321
+#define CKM_CAST128_ECB 0x00000321
+#define CKM_CAST5_CBC 0x00000322
+#define CKM_CAST128_CBC 0x00000322
+#define CKM_CAST5_MAC 0x00000323
+#define CKM_CAST128_MAC 0x00000323
+#define CKM_CAST5_MAC_GENERAL 0x00000324
+#define CKM_CAST128_MAC_GENERAL 0x00000324
+#define CKM_CAST5_CBC_PAD 0x00000325
+#define CKM_CAST128_CBC_PAD 0x00000325
+#define CKM_RC5_KEY_GEN 0x00000330
+#define CKM_RC5_ECB 0x00000331
+#define CKM_RC5_CBC 0x00000332
+#define CKM_RC5_MAC 0x00000333
+#define CKM_RC5_MAC_GENERAL 0x00000334
+#define CKM_RC5_CBC_PAD 0x00000335
+#define CKM_IDEA_KEY_GEN 0x00000340
+#define CKM_IDEA_ECB 0x00000341
+#define CKM_IDEA_CBC 0x00000342
+#define CKM_IDEA_MAC 0x00000343
+#define CKM_IDEA_MAC_GENERAL 0x00000344
+#define CKM_IDEA_CBC_PAD 0x00000345
+#define CKM_GENERIC_SECRET_KEY_GEN 0x00000350
+#define CKM_CONCATENATE_BASE_AND_KEY 0x00000360
+#define CKM_CONCATENATE_BASE_AND_DATA 0x00000362
+#define CKM_CONCATENATE_DATA_AND_BASE 0x00000363
+#define CKM_XOR_BASE_AND_DATA 0x00000364
+#define CKM_EXTRACT_KEY_FROM_KEY 0x00000365
+#define CKM_SSL3_PRE_MASTER_KEY_GEN 0x00000370
+#define CKM_SSL3_MASTER_KEY_DERIVE 0x00000371
+#define CKM_SSL3_KEY_AND_MAC_DERIVE 0x00000372
+
+/* CKM_SSL3_MASTER_KEY_DERIVE_DH, CKM_TLS_PRE_MASTER_KEY_GEN,
+ * CKM_TLS_MASTER_KEY_DERIVE, CKM_TLS_KEY_AND_MAC_DERIVE, and
+ * CKM_TLS_MASTER_KEY_DERIVE_DH are new for v2.11 */
+#define CKM_SSL3_MASTER_KEY_DERIVE_DH 0x00000373
+#define CKM_TLS_PRE_MASTER_KEY_GEN 0x00000374
+#define CKM_TLS_MASTER_KEY_DERIVE 0x00000375
+#define CKM_TLS_KEY_AND_MAC_DERIVE 0x00000376
+#define CKM_TLS_MASTER_KEY_DERIVE_DH 0x00000377
+
+/* CKM_TLS_PRF is new for v2.20 */
+#define CKM_TLS_PRF 0x00000378
+
+#define CKM_SSL3_MD5_MAC 0x00000380
+#define CKM_SSL3_SHA1_MAC 0x00000381
+#define CKM_MD5_KEY_DERIVATION 0x00000390
+#define CKM_MD2_KEY_DERIVATION 0x00000391
+#define CKM_SHA1_KEY_DERIVATION 0x00000392
+
+/* CKM_SHA256/384/512 are new for v2.20 */
+#define CKM_SHA256_KEY_DERIVATION 0x00000393
+#define CKM_SHA384_KEY_DERIVATION 0x00000394
+#define CKM_SHA512_KEY_DERIVATION 0x00000395
+
+/* CKM_SHA224 new for v2.20 amendment 3 */
+#define CKM_SHA224_KEY_DERIVATION 0x00000396
+
+#define CKM_PBE_MD2_DES_CBC 0x000003A0
+#define CKM_PBE_MD5_DES_CBC 0x000003A1
+#define CKM_PBE_MD5_CAST_CBC 0x000003A2
+#define CKM_PBE_MD5_CAST3_CBC 0x000003A3
+#define CKM_PBE_MD5_CAST5_CBC 0x000003A4
+#define CKM_PBE_MD5_CAST128_CBC 0x000003A4
+#define CKM_PBE_SHA1_CAST5_CBC 0x000003A5
+#define CKM_PBE_SHA1_CAST128_CBC 0x000003A5
+#define CKM_PBE_SHA1_RC4_128 0x000003A6
+#define CKM_PBE_SHA1_RC4_40 0x000003A7
+#define CKM_PBE_SHA1_DES3_EDE_CBC 0x000003A8
+#define CKM_PBE_SHA1_DES2_EDE_CBC 0x000003A9
+#define CKM_PBE_SHA1_RC2_128_CBC 0x000003AA
+#define CKM_PBE_SHA1_RC2_40_CBC 0x000003AB
+
+/* CKM_PKCS5_PBKD2 is new for v2.10 */
+#define CKM_PKCS5_PBKD2 0x000003B0
+
+#define CKM_PBA_SHA1_WITH_SHA1_HMAC 0x000003C0
+
+/* WTLS mechanisms are new for v2.20 */
+#define CKM_WTLS_PRE_MASTER_KEY_GEN 0x000003D0
+#define CKM_WTLS_MASTER_KEY_DERIVE 0x000003D1
+#define CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC 0x000003D2
+#define CKM_WTLS_PRF 0x000003D3
+#define CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE 0x000003D4
+#define CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE 0x000003D5
+
+/* TLS 1.2 mechanisms are new for v2.40 */
+#define CKM_TLS12_MASTER_KEY_DERIVE 0x000003E0
+#define CKM_TLS12_KEY_AND_MAC_DERIVE 0x000003E1
+#define CKM_TLS12_MASTER_KEY_DERIVE_DH 0x000003E2
+#define CKM_TLS12_KEY_SAFE_DERIVE 0x000003E3
+#define CKM_TLS12_MAC 0x000003E4
+#define CKM_TLS_MAC 0x000003E4
+#define CKM_TLS_KDF 0x000003E5
+
+#define CKM_KEY_WRAP_LYNKS 0x00000400
+#define CKM_KEY_WRAP_SET_OAEP 0x00000401
+
+/* CKM_CMS_SIG is new for v2.20 */
+#define CKM_CMS_SIG 0x00000500
+
+/* Fortezza mechanisms */
+#define CKM_SKIPJACK_KEY_GEN 0x00001000
+#define CKM_SKIPJACK_ECB64 0x00001001
+#define CKM_SKIPJACK_CBC64 0x00001002
+#define CKM_SKIPJACK_OFB64 0x00001003
+#define CKM_SKIPJACK_CFB64 0x00001004
+#define CKM_SKIPJACK_CFB32 0x00001005
+#define CKM_SKIPJACK_CFB16 0x00001006
+#define CKM_SKIPJACK_CFB8 0x00001007
+#define CKM_SKIPJACK_WRAP 0x00001008
+#define CKM_SKIPJACK_PRIVATE_WRAP 0x00001009
+#define CKM_SKIPJACK_RELAYX 0x0000100a
+#define CKM_KEA_KEY_PAIR_GEN 0x00001010
+#define CKM_KEA_KEY_DERIVE 0x00001011
+#define CKM_FORTEZZA_TIMESTAMP 0x00001020
+#define CKM_BATON_KEY_GEN 0x00001030
+#define CKM_BATON_ECB128 0x00001031
+#define CKM_BATON_ECB96 0x00001032
+#define CKM_BATON_CBC128 0x00001033
+#define CKM_BATON_COUNTER 0x00001034
+#define CKM_BATON_SHUFFLE 0x00001035
+#define CKM_BATON_WRAP 0x00001036
+
+/* CKM_ECDSA_KEY_PAIR_GEN is deprecated in v2.11,
+ * CKM_EC_KEY_PAIR_GEN is preferred */
+#define CKM_ECDSA_KEY_PAIR_GEN 0x00001040
+#define CKM_EC_KEY_PAIR_GEN 0x00001040
+
+#define CKM_ECDSA 0x00001041
+#define CKM_ECDSA_SHA1 0x00001042
+
+/* CKM_ECDH1_DERIVE, CKM_ECDH1_COFACTOR_DERIVE, and CKM_ECMQV_DERIVE
+ * are new for v2.11 */
+#define CKM_ECDH1_DERIVE 0x00001050
+#define CKM_ECDH1_COFACTOR_DERIVE 0x00001051
+#define CKM_ECMQV_DERIVE 0x00001052
+
+#define CKM_JUNIPER_KEY_GEN 0x00001060
+#define CKM_JUNIPER_ECB128 0x00001061
+#define CKM_JUNIPER_CBC128 0x00001062
+#define CKM_JUNIPER_COUNTER 0x00001063
+#define CKM_JUNIPER_SHUFFLE 0x00001064
+#define CKM_JUNIPER_WRAP 0x00001065
+#define CKM_FASTHASH 0x00001070
+
+/* CKM_AES_KEY_GEN, CKM_AES_ECB, CKM_AES_CBC, CKM_AES_MAC,
+ * CKM_AES_MAC_GENERAL, CKM_AES_CBC_PAD, CKM_DSA_PARAMETER_GEN,
+ * CKM_DH_PKCS_PARAMETER_GEN, and CKM_X9_42_DH_PARAMETER_GEN are
+ * new for v2.11 */
+#define CKM_AES_KEY_GEN 0x00001080
+#define CKM_AES_ECB 0x00001081
+#define CKM_AES_CBC 0x00001082
+#define CKM_AES_MAC 0x00001083
+#define CKM_AES_MAC_GENERAL 0x00001084
+#define CKM_AES_CBC_PAD 0x00001085
+/* new for v2.20 amendment 3 */
+#define CKM_AES_CTR 0x00001086
+/* new for v2.30 */
+#define CKM_AES_GCM 0x00001087
+#define CKM_AES_CCM 0x00001088
+#define CKM_AES_CTS 0x00001089
+#define CKM_AES_XCBC_MAC 0x0000108C
+#define CKM_AES_XCBC_MAC_96 0x0000108D
+
+/* BlowFish and TwoFish are new for v2.20 */
+#define CKM_BLOWFISH_KEY_GEN 0x00001090
+#define CKM_BLOWFISH_CBC 0x00001091
+#define CKM_TWOFISH_KEY_GEN 0x00001092
+#define CKM_TWOFISH_CBC 0x00001093
+
+/* Camellia is proposed for v2.20 Amendment 3 */
+#define CKM_CAMELLIA_KEY_GEN 0x00000550
+#define CKM_CAMELLIA_ECB 0x00000551
+#define CKM_CAMELLIA_CBC 0x00000552
+#define CKM_CAMELLIA_MAC 0x00000553
+#define CKM_CAMELLIA_MAC_GENERAL 0x00000554
+#define CKM_CAMELLIA_CBC_PAD 0x00000555
+#define CKM_CAMELLIA_ECB_ENCRYPT_DATA 0x00000556
+#define CKM_CAMELLIA_CBC_ENCRYPT_DATA 0x00000557
+
+#define CKM_SEED_KEY_GEN 0x00000650
+#define CKM_SEED_ECB 0x00000651
+#define CKM_SEED_CBC 0x00000652
+#define CKM_SEED_MAC 0x00000653
+#define CKM_SEED_MAC_GENERAL 0x00000654
+#define CKM_SEED_CBC_PAD 0x00000655
+#define CKM_SEED_ECB_ENCRYPT_DATA 0x00000656
+#define CKM_SEED_CBC_ENCRYPT_DATA 0x00000657
+
+/* CKM_xxx_ENCRYPT_DATA mechanisms are new for v2.20 */
+#define CKM_DES_ECB_ENCRYPT_DATA 0x00001100
+#define CKM_DES_CBC_ENCRYPT_DATA 0x00001101
+#define CKM_DES3_ECB_ENCRYPT_DATA 0x00001102
+#define CKM_DES3_CBC_ENCRYPT_DATA 0x00001103
+#define CKM_AES_ECB_ENCRYPT_DATA 0x00001104
+#define CKM_AES_CBC_ENCRYPT_DATA 0x00001105
+
+#define CKM_DSA_PARAMETER_GEN 0x00002000
+#define CKM_DH_PKCS_PARAMETER_GEN 0x00002001
+#define CKM_X9_42_DH_PARAMETER_GEN 0x00002002
+
+#define CKM_VENDOR_DEFINED 0x80000000
+
+typedef CK_MECHANISM_TYPE CK_PTR CK_MECHANISM_TYPE_PTR;
+
+/* CK_MECHANISM is a structure that specifies a particular
+ * mechanism  */
+typedef struct CK_MECHANISM {
+    CK_MECHANISM_TYPE mechanism;
+    CK_VOID_PTR pParameter;
+
+    /* ulParameterLen was changed from CK_USHORT to CK_ULONG for
+     * v2.0 */
+    CK_ULONG ulParameterLen; /* in bytes */
+} CK_MECHANISM;
+
+typedef CK_MECHANISM CK_PTR CK_MECHANISM_PTR;
+
+/* CK_MECHANISM_INFO provides information about a particular
+ * mechanism */
+typedef struct CK_MECHANISM_INFO {
+    CK_ULONG ulMinKeySize;
+    CK_ULONG ulMaxKeySize;
+    CK_FLAGS flags;
+} CK_MECHANISM_INFO;
+
+/* The flags are defined as follows:
+ *      Bit Flag               Mask        Meaning */
+#define CKF_HW 0x00000001 /* performed by HW */
+
+/* The flags CKF_ENCRYPT, CKF_DECRYPT, CKF_DIGEST, CKF_SIGN,
+ * CKG_SIGN_RECOVER, CKF_VERIFY, CKF_VERIFY_RECOVER,
+ * CKF_GENERATE, CKF_GENERATE_KEY_PAIR, CKF_WRAP, CKF_UNWRAP,
+ * and CKF_DERIVE are new for v2.0.  They specify whether or not
+ * a mechanism can be used for a particular task */
+#define CKF_ENCRYPT 0x00000100
+#define CKF_DECRYPT 0x00000200
+#define CKF_DIGEST 0x00000400
+#define CKF_SIGN 0x00000800
+#define CKF_SIGN_RECOVER 0x00001000
+#define CKF_VERIFY 0x00002000
+#define CKF_VERIFY_RECOVER 0x00004000
+#define CKF_GENERATE 0x00008000
+#define CKF_GENERATE_KEY_PAIR 0x00010000
+#define CKF_WRAP 0x00020000
+#define CKF_UNWRAP 0x00040000
+#define CKF_DERIVE 0x00080000
+
+/* CKF_EC_F_P, CKF_EC_F_2M, CKF_EC_ECPARAMETERS, CKF_EC_NAMEDCURVE,
+ * CKF_EC_UNCOMPRESS, and CKF_EC_COMPRESS are new for v2.11. They
+ * describe a token's EC capabilities not available in mechanism
+ * information. */
+#define CKF_EC_F_P 0x00100000
+#define CKF_EC_F_2M 0x00200000
+#define CKF_EC_ECPARAMETERS 0x00400000
+#define CKF_EC_NAMEDCURVE 0x00800000
+#define CKF_EC_UNCOMPRESS 0x01000000
+#define CKF_EC_COMPRESS 0x02000000
+
+#define CKF_EXTENSION 0x80000000 /* FALSE for this version */
+
+typedef CK_MECHANISM_INFO CK_PTR CK_MECHANISM_INFO_PTR;
+
+/* CK_RV is a value that identifies the return value of a
+ * PKCS #11 function */
+/* CK_RV was changed from CK_USHORT to CK_ULONG for v2.0 */
+typedef CK_ULONG CK_RV;
+
+#define CKR_OK 0x00000000
+#define CKR_CANCEL 0x00000001
+#define CKR_HOST_MEMORY 0x00000002
+#define CKR_SLOT_ID_INVALID 0x00000003
+
+/* CKR_FLAGS_INVALID was removed for v2.0 */
+
+/* CKR_GENERAL_ERROR and CKR_FUNCTION_FAILED are new for v2.0 */
+#define CKR_GENERAL_ERROR 0x00000005
+#define CKR_FUNCTION_FAILED 0x00000006
+
+/* CKR_ARGUMENTS_BAD, CKR_NO_EVENT, CKR_NEED_TO_CREATE_THREADS,
+ * and CKR_CANT_LOCK are new for v2.01 */
+#define CKR_ARGUMENTS_BAD 0x00000007
+#define CKR_NO_EVENT 0x00000008
+#define CKR_NEED_TO_CREATE_THREADS 0x00000009
+#define CKR_CANT_LOCK 0x0000000A
+
+#define CKR_ATTRIBUTE_READ_ONLY 0x00000010
+#define CKR_ATTRIBUTE_SENSITIVE 0x00000011
+#define CKR_ATTRIBUTE_TYPE_INVALID 0x00000012
+#define CKR_ATTRIBUTE_VALUE_INVALID 0x00000013
+#define CKR_DATA_INVALID 0x00000020
+#define CKR_DATA_LEN_RANGE 0x00000021
+#define CKR_DEVICE_ERROR 0x00000030
+#define CKR_DEVICE_MEMORY 0x00000031
+#define CKR_DEVICE_REMOVED 0x00000032
+#define CKR_ENCRYPTED_DATA_INVALID 0x00000040
+#define CKR_ENCRYPTED_DATA_LEN_RANGE 0x00000041
+#define CKR_FUNCTION_CANCELED 0x00000050
+#define CKR_FUNCTION_NOT_PARALLEL 0x00000051
+
+/* CKR_FUNCTION_NOT_SUPPORTED is new for v2.0 */
+#define CKR_FUNCTION_NOT_SUPPORTED 0x00000054
+
+#define CKR_KEY_HANDLE_INVALID 0x00000060
+
+/* CKR_KEY_SENSITIVE was removed for v2.0 */
+
+#define CKR_KEY_SIZE_RANGE 0x00000062
+#define CKR_KEY_TYPE_INCONSISTENT 0x00000063
+
+/* CKR_KEY_NOT_NEEDED, CKR_KEY_CHANGED, CKR_KEY_NEEDED,
+ * CKR_KEY_INDIGESTIBLE, CKR_KEY_FUNCTION_NOT_PERMITTED,
+ * CKR_KEY_NOT_WRAPPABLE, and CKR_KEY_UNEXTRACTABLE are new for
+ * v2.0 */
+#define CKR_KEY_NOT_NEEDED 0x00000064
+#define CKR_KEY_CHANGED 0x00000065
+#define CKR_KEY_NEEDED 0x00000066
+#define CKR_KEY_INDIGESTIBLE 0x00000067
+#define CKR_KEY_FUNCTION_NOT_PERMITTED 0x00000068
+#define CKR_KEY_NOT_WRAPPABLE 0x00000069
+#define CKR_KEY_UNEXTRACTABLE 0x0000006A
+
+#define CKR_MECHANISM_INVALID 0x00000070
+#define CKR_MECHANISM_PARAM_INVALID 0x00000071
+
+/* CKR_OBJECT_CLASS_INCONSISTENT and CKR_OBJECT_CLASS_INVALID
+ * were removed for v2.0 */
+#define CKR_OBJECT_HANDLE_INVALID 0x00000082
+#define CKR_OPERATION_ACTIVE 0x00000090
+#define CKR_OPERATION_NOT_INITIALIZED 0x00000091
+#define CKR_PIN_INCORRECT 0x000000A0
+#define CKR_PIN_INVALID 0x000000A1
+#define CKR_PIN_LEN_RANGE 0x000000A2
+
+/* CKR_PIN_EXPIRED and CKR_PIN_LOCKED are new for v2.0 */
+#define CKR_PIN_EXPIRED 0x000000A3
+#define CKR_PIN_LOCKED 0x000000A4
+
+#define CKR_SESSION_CLOSED 0x000000B0
+#define CKR_SESSION_COUNT 0x000000B1
+#define CKR_SESSION_HANDLE_INVALID 0x000000B3
+#define CKR_SESSION_PARALLEL_NOT_SUPPORTED 0x000000B4
+#define CKR_SESSION_READ_ONLY 0x000000B5
+#define CKR_SESSION_EXISTS 0x000000B6
+
+/* CKR_SESSION_READ_ONLY_EXISTS and
+ * CKR_SESSION_READ_WRITE_SO_EXISTS are new for v2.0 */
+#define CKR_SESSION_READ_ONLY_EXISTS 0x000000B7
+#define CKR_SESSION_READ_WRITE_SO_EXISTS 0x000000B8
+
+#define CKR_SIGNATURE_INVALID 0x000000C0
+#define CKR_SIGNATURE_LEN_RANGE 0x000000C1
+#define CKR_TEMPLATE_INCOMPLETE 0x000000D0
+#define CKR_TEMPLATE_INCONSISTENT 0x000000D1
+#define CKR_TOKEN_NOT_PRESENT 0x000000E0
+#define CKR_TOKEN_NOT_RECOGNIZED 0x000000E1
+#define CKR_TOKEN_WRITE_PROTECTED 0x000000E2
+#define CKR_UNWRAPPING_KEY_HANDLE_INVALID 0x000000F0
+#define CKR_UNWRAPPING_KEY_SIZE_RANGE 0x000000F1
+#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT 0x000000F2
+#define CKR_USER_ALREADY_LOGGED_IN 0x00000100
+#define CKR_USER_NOT_LOGGED_IN 0x00000101
+#define CKR_USER_PIN_NOT_INITIALIZED 0x00000102
+#define CKR_USER_TYPE_INVALID 0x00000103
+
+/* CKR_USER_ANOTHER_ALREADY_LOGGED_IN and CKR_USER_TOO_MANY_TYPES
+ * are new to v2.01 */
+#define CKR_USER_ANOTHER_ALREADY_LOGGED_IN 0x00000104
+#define CKR_USER_TOO_MANY_TYPES 0x00000105
+
+#define CKR_WRAPPED_KEY_INVALID 0x00000110
+#define CKR_WRAPPED_KEY_LEN_RANGE 0x00000112
+#define CKR_WRAPPING_KEY_HANDLE_INVALID 0x00000113
+#define CKR_WRAPPING_KEY_SIZE_RANGE 0x00000114
+#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT 0x00000115
+#define CKR_RANDOM_SEED_NOT_SUPPORTED 0x00000120
+
+/* These are new to v2.0 */
+#define CKR_RANDOM_NO_RNG 0x00000121
+
+/* These are new to v2.11 */
+#define CKR_DOMAIN_PARAMS_INVALID 0x00000130
+
+/* These are new to v2.0 */
+#define CKR_BUFFER_TOO_SMALL 0x00000150
+#define CKR_SAVED_STATE_INVALID 0x00000160
+#define CKR_INFORMATION_SENSITIVE 0x00000170
+#define CKR_STATE_UNSAVEABLE 0x00000180
+
+/* These are new to v2.01 */
+#define CKR_CRYPTOKI_NOT_INITIALIZED 0x00000190
+#define CKR_CRYPTOKI_ALREADY_INITIALIZED 0x00000191
+#define CKR_MUTEX_BAD 0x000001A0
+#define CKR_MUTEX_NOT_LOCKED 0x000001A1
+
+/* This is new to v2.20 */
+#define CKR_FUNCTION_REJECTED 0x00000200
+
+#define CKR_VENDOR_DEFINED 0x80000000
+
+/* CK_NOTIFY is an application callback that processes events */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_NOTIFY)(
+    CK_SESSION_HANDLE hSession, /* the session's handle */
+    CK_NOTIFICATION event,
+    CK_VOID_PTR pApplication /* passed to C_OpenSession */
+    );
+
+/* CK_FUNCTION_LIST is a structure holding a PKCS #11 spec
+ * version and pointers of appropriate types to all the
+ * PKCS #11 functions */
+/* CK_FUNCTION_LIST is new for v2.0 */
+typedef struct CK_FUNCTION_LIST CK_FUNCTION_LIST;
+
+typedef CK_FUNCTION_LIST CK_PTR CK_FUNCTION_LIST_PTR;
+
+typedef CK_FUNCTION_LIST_PTR CK_PTR CK_FUNCTION_LIST_PTR_PTR;
+
+/* CK_CREATEMUTEX is an application callback for creating a
+ * mutex object */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_CREATEMUTEX)(
+    CK_VOID_PTR_PTR ppMutex /* location to receive ptr to mutex */
+    );
+
+/* CK_DESTROYMUTEX is an application callback for destroying a
+ * mutex object */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_DESTROYMUTEX)(
+    CK_VOID_PTR pMutex /* pointer to mutex */
+    );
+
+/* CK_LOCKMUTEX is an application callback for locking a mutex */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_LOCKMUTEX)(
+    CK_VOID_PTR pMutex /* pointer to mutex */
+    );
+
+/* CK_UNLOCKMUTEX is an application callback for unlocking a
+ * mutex */
+typedef CK_CALLBACK_FUNCTION(CK_RV, CK_UNLOCKMUTEX)(
+    CK_VOID_PTR pMutex /* pointer to mutex */
+    );
+
+/* CK_C_INITIALIZE_ARGS provides the optional arguments to
+ * C_Initialize */
+typedef struct CK_C_INITIALIZE_ARGS {
+    CK_CREATEMUTEX CreateMutex;
+    CK_DESTROYMUTEX DestroyMutex;
+    CK_LOCKMUTEX LockMutex;
+    CK_UNLOCKMUTEX UnlockMutex;
+    CK_FLAGS flags;
+    /* The official PKCS #11 spec does not have a 'LibraryParameters' field, but
+     * a reserved field. NSS needs a way to pass instance-specific information
+     * to the library (like where to find its config files, etc). This
+     * information is usually provided by the installer and passed uninterpreted
+     * by NSS to the library, though NSS does know the specifics of the softoken
+     * version of this parameter. Most compliant PKCS#11 modules expect this
+     * parameter to be NULL, and will return CKR_ARGUMENTS_BAD from
+     * C_Initialize if Library parameters is supplied. */
+    CK_CHAR_PTR *LibraryParameters;
+    /* This field is only present if the LibraryParameters is not NULL. It must
+     * be NULL in all cases */
+    CK_VOID_PTR pReserved;
+} CK_C_INITIALIZE_ARGS;
+
+/* flags: bit flags that provide capabilities of the slot
+ *      Bit Flag                           Mask       Meaning
+ */
+#define CKF_LIBRARY_CANT_CREATE_OS_THREADS 0x00000001
+#define CKF_OS_LOCKING_OK 0x00000002
+
+typedef CK_C_INITIALIZE_ARGS CK_PTR CK_C_INITIALIZE_ARGS_PTR;
+
+/* additional flags for parameters to functions */
+
+/* CKF_DONT_BLOCK is for the function C_WaitForSlotEvent */
+#define CKF_DONT_BLOCK 1
+
+/* CK_RSA_PKCS_OAEP_MGF_TYPE is new for v2.10.
+ * CK_RSA_PKCS_OAEP_MGF_TYPE  is used to indicate the Message
+ * Generation Function (MGF) applied to a message block when
+ * formatting a message block for the PKCS #1 OAEP encryption
+ * scheme. */
+typedef CK_ULONG CK_RSA_PKCS_MGF_TYPE;
+
+typedef CK_RSA_PKCS_MGF_TYPE CK_PTR CK_RSA_PKCS_MGF_TYPE_PTR;
+
+/* The following MGFs are defined */
+/* CKG_MGF1_SHA256, CKG_MGF1_SHA384, and CKG_MGF1_SHA512
+ * are new for v2.20 */
+#define CKG_MGF1_SHA1 0x00000001
+#define CKG_MGF1_SHA256 0x00000002
+#define CKG_MGF1_SHA384 0x00000003
+#define CKG_MGF1_SHA512 0x00000004
+
+/* v2.20 amendment 3 */
+#define CKG_MGF1_SHA224 0x00000005
+
+/* CK_RSA_PKCS_OAEP_SOURCE_TYPE is new for v2.10.
+ * CK_RSA_PKCS_OAEP_SOURCE_TYPE  is used to indicate the source
+ * of the encoding parameter when formatting a message block
+ * for the PKCS #1 OAEP encryption scheme. */
+typedef CK_ULONG CK_RSA_PKCS_OAEP_SOURCE_TYPE;
+
+typedef CK_RSA_PKCS_OAEP_SOURCE_TYPE CK_PTR CK_RSA_PKCS_OAEP_SOURCE_TYPE_PTR;
+
+/* The following encoding parameter sources are defined */
+#define CKZ_DATA_SPECIFIED 0x00000001
+
+/* CK_RSA_PKCS_OAEP_PARAMS is new for v2.10.
+ * CK_RSA_PKCS_OAEP_PARAMS provides the parameters to the
+ * CKM_RSA_PKCS_OAEP mechanism. */
+typedef struct CK_RSA_PKCS_OAEP_PARAMS {
+    CK_MECHANISM_TYPE hashAlg;
+    CK_RSA_PKCS_MGF_TYPE mgf;
+    CK_RSA_PKCS_OAEP_SOURCE_TYPE source;
+    CK_VOID_PTR pSourceData;
+    CK_ULONG ulSourceDataLen;
+} CK_RSA_PKCS_OAEP_PARAMS;
+
+typedef CK_RSA_PKCS_OAEP_PARAMS CK_PTR CK_RSA_PKCS_OAEP_PARAMS_PTR;
+
+/* CK_RSA_PKCS_PSS_PARAMS is new for v2.11.
+ * CK_RSA_PKCS_PSS_PARAMS provides the parameters to the
+ * CKM_RSA_PKCS_PSS mechanism(s). */
+typedef struct CK_RSA_PKCS_PSS_PARAMS {
+    CK_MECHANISM_TYPE hashAlg;
+    CK_RSA_PKCS_MGF_TYPE mgf;
+    CK_ULONG sLen;
+} CK_RSA_PKCS_PSS_PARAMS;
+
+typedef CK_RSA_PKCS_PSS_PARAMS CK_PTR CK_RSA_PKCS_PSS_PARAMS_PTR;
+
+/* CK_EC_KDF_TYPE is new for v2.11. */
+typedef CK_ULONG CK_EC_KDF_TYPE;
+
+/* The following EC Key Derivation Functions are defined */
+#define CKD_NULL 0x00000001
+#define CKD_SHA1_KDF 0x00000002
+#define CKD_SHA224_KDF 0x00000005
+#define CKD_SHA256_KDF 0x00000006
+#define CKD_SHA384_KDF 0x00000007
+#define CKD_SHA512_KDF 0x00000008
+
+/* CK_ECDH1_DERIVE_PARAMS is new for v2.11.
+ * CK_ECDH1_DERIVE_PARAMS provides the parameters to the
+ * CKM_ECDH1_DERIVE and CKM_ECDH1_COFACTOR_DERIVE mechanisms,
+ * where each party contributes one key pair.
+ */
+typedef struct CK_ECDH1_DERIVE_PARAMS {
+    CK_EC_KDF_TYPE kdf;
+    CK_ULONG ulSharedDataLen;
+    CK_BYTE_PTR pSharedData;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE_PTR pPublicData;
+} CK_ECDH1_DERIVE_PARAMS;
+
+typedef CK_ECDH1_DERIVE_PARAMS CK_PTR CK_ECDH1_DERIVE_PARAMS_PTR;
+
+/* CK_ECDH2_DERIVE_PARAMS is new for v2.11.
+ * CK_ECDH2_DERIVE_PARAMS provides the parameters to the
+ * CKM_ECMQV_DERIVE mechanism, where each party contributes two key pairs. */
+typedef struct CK_ECDH2_DERIVE_PARAMS {
+    CK_EC_KDF_TYPE kdf;
+    CK_ULONG ulSharedDataLen;
+    CK_BYTE_PTR pSharedData;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE_PTR pPublicData;
+    CK_ULONG ulPrivateDataLen;
+    CK_OBJECT_HANDLE hPrivateData;
+    CK_ULONG ulPublicDataLen2;
+    CK_BYTE_PTR pPublicData2;
+} CK_ECDH2_DERIVE_PARAMS;
+
+typedef CK_ECDH2_DERIVE_PARAMS CK_PTR CK_ECDH2_DERIVE_PARAMS_PTR;
+
+typedef struct CK_ECMQV_DERIVE_PARAMS {
+    CK_EC_KDF_TYPE kdf;
+    CK_ULONG ulSharedDataLen;
+    CK_BYTE_PTR pSharedData;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE_PTR pPublicData;
+    CK_ULONG ulPrivateDataLen;
+    CK_OBJECT_HANDLE hPrivateData;
+    CK_ULONG ulPublicDataLen2;
+    CK_BYTE_PTR pPublicData2;
+    CK_OBJECT_HANDLE publicKey;
+} CK_ECMQV_DERIVE_PARAMS;
+
+typedef CK_ECMQV_DERIVE_PARAMS CK_PTR CK_ECMQV_DERIVE_PARAMS_PTR;
+
+/* Typedefs and defines for the CKM_X9_42_DH_KEY_PAIR_GEN and the
+ * CKM_X9_42_DH_PARAMETER_GEN mechanisms (new for PKCS #11 v2.11) */
+typedef CK_ULONG CK_X9_42_DH_KDF_TYPE;
+typedef CK_X9_42_DH_KDF_TYPE CK_PTR CK_X9_42_DH_KDF_TYPE_PTR;
+
+/* The following X9.42 DH key derivation functions are defined
+   (besides CKD_NULL already defined : */
+#define CKD_SHA1_KDF_ASN1 0x00000003
+#define CKD_SHA1_KDF_CONCATENATE 0x00000004
+
+/* CK_X9_42_DH1_DERIVE_PARAMS is new for v2.11.
+ * CK_X9_42_DH1_DERIVE_PARAMS provides the parameters to the
+ * CKM_X9_42_DH_DERIVE key derivation mechanism, where each party
+ * contributes one key pair */
+typedef struct CK_X9_42_DH1_DERIVE_PARAMS {
+    CK_X9_42_DH_KDF_TYPE kdf;
+    CK_ULONG ulOtherInfoLen;
+    CK_BYTE_PTR pOtherInfo;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE_PTR pPublicData;
+} CK_X9_42_DH1_DERIVE_PARAMS;
+
+typedef struct CK_X9_42_DH1_DERIVE_PARAMS CK_PTR CK_X9_42_DH1_DERIVE_PARAMS_PTR;
+
+/* CK_X9_42_DH2_DERIVE_PARAMS is new for v2.11.
+ * CK_X9_42_DH2_DERIVE_PARAMS provides the parameters to the
+ * CKM_X9_42_DH_HYBRID_DERIVE and CKM_X9_42_MQV_DERIVE key derivation
+ * mechanisms, where each party contributes two key pairs */
+typedef struct CK_X9_42_DH2_DERIVE_PARAMS {
+    CK_X9_42_DH_KDF_TYPE kdf;
+    CK_ULONG ulOtherInfoLen;
+    CK_BYTE_PTR pOtherInfo;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE_PTR pPublicData;
+    CK_ULONG ulPrivateDataLen;
+    CK_OBJECT_HANDLE hPrivateData;
+    CK_ULONG ulPublicDataLen2;
+    CK_BYTE_PTR pPublicData2;
+} CK_X9_42_DH2_DERIVE_PARAMS;
+
+typedef CK_X9_42_DH2_DERIVE_PARAMS CK_PTR CK_X9_42_DH2_DERIVE_PARAMS_PTR;
+
+typedef struct CK_X9_42_MQV_DERIVE_PARAMS {
+    CK_X9_42_DH_KDF_TYPE kdf;
+    CK_ULONG ulOtherInfoLen;
+    CK_BYTE_PTR pOtherInfo;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE_PTR pPublicData;
+    CK_ULONG ulPrivateDataLen;
+    CK_OBJECT_HANDLE hPrivateData;
+    CK_ULONG ulPublicDataLen2;
+    CK_BYTE_PTR pPublicData2;
+    CK_OBJECT_HANDLE publicKey;
+} CK_X9_42_MQV_DERIVE_PARAMS;
+
+typedef CK_X9_42_MQV_DERIVE_PARAMS CK_PTR CK_X9_42_MQV_DERIVE_PARAMS_PTR;
+
+/* CK_KEA_DERIVE_PARAMS provides the parameters to the
+ * CKM_KEA_DERIVE mechanism */
+/* CK_KEA_DERIVE_PARAMS is new for v2.0 */
+typedef struct CK_KEA_DERIVE_PARAMS {
+    CK_BBOOL isSender;
+    CK_ULONG ulRandomLen;
+    CK_BYTE_PTR pRandomA;
+    CK_BYTE_PTR pRandomB;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE_PTR pPublicData;
+} CK_KEA_DERIVE_PARAMS;
+
+typedef CK_KEA_DERIVE_PARAMS CK_PTR CK_KEA_DERIVE_PARAMS_PTR;
+
+/* CK_RC2_PARAMS provides the parameters to the CKM_RC2_ECB and
+ * CKM_RC2_MAC mechanisms.  An instance of CK_RC2_PARAMS just
+ * holds the effective keysize */
+typedef CK_ULONG CK_RC2_PARAMS;
+
+typedef CK_RC2_PARAMS CK_PTR CK_RC2_PARAMS_PTR;
+
+/* CK_RC2_CBC_PARAMS provides the parameters to the CKM_RC2_CBC
+ * mechanism */
+typedef struct CK_RC2_CBC_PARAMS {
+    /* ulEffectiveBits was changed from CK_USHORT to CK_ULONG for
+   * v2.0 */
+    CK_ULONG ulEffectiveBits; /* effective bits (1-1024) */
+
+    CK_BYTE iv[8]; /* IV for CBC mode */
+} CK_RC2_CBC_PARAMS;
+
+typedef CK_RC2_CBC_PARAMS CK_PTR CK_RC2_CBC_PARAMS_PTR;
+
+/* CK_RC2_MAC_GENERAL_PARAMS provides the parameters for the
+ * CKM_RC2_MAC_GENERAL mechanism */
+/* CK_RC2_MAC_GENERAL_PARAMS is new for v2.0 */
+typedef struct CK_RC2_MAC_GENERAL_PARAMS {
+    CK_ULONG ulEffectiveBits; /* effective bits (1-1024) */
+    CK_ULONG ulMacLength;     /* Length of MAC in bytes */
+} CK_RC2_MAC_GENERAL_PARAMS;
+
+typedef CK_RC2_MAC_GENERAL_PARAMS CK_PTR
+    CK_RC2_MAC_GENERAL_PARAMS_PTR;
+
+/* CK_RC5_PARAMS provides the parameters to the CKM_RC5_ECB and
+ * CKM_RC5_MAC mechanisms */
+/* CK_RC5_PARAMS is new for v2.0 */
+typedef struct CK_RC5_PARAMS {
+    CK_ULONG ulWordsize; /* wordsize in bits */
+    CK_ULONG ulRounds;   /* number of rounds */
+} CK_RC5_PARAMS;
+
+typedef CK_RC5_PARAMS CK_PTR CK_RC5_PARAMS_PTR;
+
+/* CK_RC5_CBC_PARAMS provides the parameters to the CKM_RC5_CBC
+ * mechanism */
+/* CK_RC5_CBC_PARAMS is new for v2.0 */
+typedef struct CK_RC5_CBC_PARAMS {
+    CK_ULONG ulWordsize; /* wordsize in bits */
+    CK_ULONG ulRounds;   /* number of rounds */
+    CK_BYTE_PTR pIv;     /* pointer to IV */
+    CK_ULONG ulIvLen;    /* length of IV in bytes */
+} CK_RC5_CBC_PARAMS;
+
+typedef CK_RC5_CBC_PARAMS CK_PTR CK_RC5_CBC_PARAMS_PTR;
+
+/* CK_RC5_MAC_GENERAL_PARAMS provides the parameters for the
+ * CKM_RC5_MAC_GENERAL mechanism */
+/* CK_RC5_MAC_GENERAL_PARAMS is new for v2.0 */
+typedef struct CK_RC5_MAC_GENERAL_PARAMS {
+    CK_ULONG ulWordsize;  /* wordsize in bits */
+    CK_ULONG ulRounds;    /* number of rounds */
+    CK_ULONG ulMacLength; /* Length of MAC in bytes */
+} CK_RC5_MAC_GENERAL_PARAMS;
+
+typedef CK_RC5_MAC_GENERAL_PARAMS CK_PTR
+    CK_RC5_MAC_GENERAL_PARAMS_PTR;
+
+/* CK_MAC_GENERAL_PARAMS provides the parameters to most block
+ * ciphers' MAC_GENERAL mechanisms.  Its value is the length of
+ * the MAC */
+/* CK_MAC_GENERAL_PARAMS is new for v2.0 */
+typedef CK_ULONG CK_MAC_GENERAL_PARAMS;
+
+typedef CK_MAC_GENERAL_PARAMS CK_PTR CK_MAC_GENERAL_PARAMS_PTR;
+
+/* CK_DES/AES_ECB/CBC_ENCRYPT_DATA_PARAMS are new for v2.20 */
+typedef struct CK_DES_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE iv[8];
+    CK_BYTE_PTR pData;
+    CK_ULONG length;
+} CK_DES_CBC_ENCRYPT_DATA_PARAMS;
+
+typedef CK_DES_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_DES_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+typedef struct CK_AES_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE iv[16];
+    CK_BYTE_PTR pData;
+    CK_ULONG length;
+} CK_AES_CBC_ENCRYPT_DATA_PARAMS;
+
+typedef CK_AES_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_AES_CBC_ENCRYPT_DATA_PARAMS_PTR;
+
+/* CK_AES_CTR_PARAMS is new for PKCS #11 v2.20 amendment 3 */
+typedef struct CK_AES_CTR_PARAMS {
+    CK_ULONG ulCounterBits;
+    CK_BYTE cb[16];
+} CK_AES_CTR_PARAMS;
+
+typedef CK_AES_CTR_PARAMS CK_PTR CK_AES_CTR_PARAMS_PTR;
+
+/* CK_GCM_PARAMS is new for version 2.30 */
+typedef struct CK_GCM_PARAMS {
+    CK_BYTE_PTR pIv;
+    CK_ULONG ulIvLen;
+    CK_BYTE_PTR pAAD;
+    CK_ULONG ulAADLen;
+    CK_ULONG ulTagBits;
+} CK_GCM_PARAMS;
+
+typedef CK_GCM_PARAMS CK_PTR CK_GCM_PARAMS_PTR;
+
+/* CK_CCM_PARAMS is new for version 2.30 */
+typedef struct CK_CCM_PARAMS {
+    CK_ULONG ulDataLen;
+    CK_BYTE_PTR pNonce;
+    CK_ULONG ulNonceLen;
+    CK_BYTE_PTR pAAD;
+    CK_ULONG ulAADLen;
+    CK_ULONG ulMACLen;
+} CK_CCM_PARAMS;
+
+typedef CK_CCM_PARAMS CK_PTR CK_CCM_PARAMS_PTR;
+
+/* CK_SKIPJACK_PRIVATE_WRAP_PARAMS provides the parameters to the
+ * CKM_SKIPJACK_PRIVATE_WRAP mechanism */
+/* CK_SKIPJACK_PRIVATE_WRAP_PARAMS is new for v2.0 */
+typedef struct CK_SKIPJACK_PRIVATE_WRAP_PARAMS {
+    CK_ULONG ulPasswordLen;
+    CK_BYTE_PTR pPassword;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE_PTR pPublicData;
+    CK_ULONG ulPAndGLen;
+    CK_ULONG ulQLen;
+    CK_ULONG ulRandomLen;
+    CK_BYTE_PTR pRandomA;
+    CK_BYTE_PTR pPrimeP;
+    CK_BYTE_PTR pBaseG;
+    CK_BYTE_PTR pSubprimeQ;
+} CK_SKIPJACK_PRIVATE_WRAP_PARAMS;
+
+typedef CK_SKIPJACK_PRIVATE_WRAP_PARAMS CK_PTR
+    CK_SKIPJACK_PRIVATE_WRAP_PTR;
+
+/* CK_SKIPJACK_RELAYX_PARAMS provides the parameters to the
+ * CKM_SKIPJACK_RELAYX mechanism */
+/* CK_SKIPJACK_RELAYX_PARAMS is new for v2.0 */
+typedef struct CK_SKIPJACK_RELAYX_PARAMS {
+    CK_ULONG ulOldWrappedXLen;
+    CK_BYTE_PTR pOldWrappedX;
+    CK_ULONG ulOldPasswordLen;
+    CK_BYTE_PTR pOldPassword;
+    CK_ULONG ulOldPublicDataLen;
+    CK_BYTE_PTR pOldPublicData;
+    CK_ULONG ulOldRandomLen;
+    CK_BYTE_PTR pOldRandomA;
+    CK_ULONG ulNewPasswordLen;
+    CK_BYTE_PTR pNewPassword;
+    CK_ULONG ulNewPublicDataLen;
+    CK_BYTE_PTR pNewPublicData;
+    CK_ULONG ulNewRandomLen;
+    CK_BYTE_PTR pNewRandomA;
+} CK_SKIPJACK_RELAYX_PARAMS;
+
+typedef CK_SKIPJACK_RELAYX_PARAMS CK_PTR
+    CK_SKIPJACK_RELAYX_PARAMS_PTR;
+
+typedef struct CK_PBE_PARAMS {
+    CK_BYTE_PTR pInitVector;
+    CK_UTF8CHAR_PTR pPassword;
+    CK_ULONG ulPasswordLen;
+    CK_BYTE_PTR pSalt;
+    CK_ULONG ulSaltLen;
+    CK_ULONG ulIteration;
+} CK_PBE_PARAMS;
+
+typedef CK_PBE_PARAMS CK_PTR CK_PBE_PARAMS_PTR;
+
+/* CK_KEY_WRAP_SET_OAEP_PARAMS provides the parameters to the
+ * CKM_KEY_WRAP_SET_OAEP mechanism */
+/* CK_KEY_WRAP_SET_OAEP_PARAMS is new for v2.0 */
+typedef struct CK_KEY_WRAP_SET_OAEP_PARAMS {
+    CK_BYTE bBC;     /* block contents byte */
+    CK_BYTE_PTR pX;  /* extra data */
+    CK_ULONG ulXLen; /* length of extra data in bytes */
+} CK_KEY_WRAP_SET_OAEP_PARAMS;
+
+typedef CK_KEY_WRAP_SET_OAEP_PARAMS CK_PTR
+    CK_KEY_WRAP_SET_OAEP_PARAMS_PTR;
+
+typedef struct CK_SSL3_RANDOM_DATA {
+    CK_BYTE_PTR pClientRandom;
+    CK_ULONG ulClientRandomLen;
+    CK_BYTE_PTR pServerRandom;
+    CK_ULONG ulServerRandomLen;
+} CK_SSL3_RANDOM_DATA;
+
+typedef struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS {
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_VERSION_PTR pVersion;
+} CK_SSL3_MASTER_KEY_DERIVE_PARAMS;
+
+typedef struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS CK_PTR
+    CK_SSL3_MASTER_KEY_DERIVE_PARAMS_PTR;
+
+typedef struct CK_SSL3_KEY_MAT_OUT {
+    CK_OBJECT_HANDLE hClientMacSecret;
+    CK_OBJECT_HANDLE hServerMacSecret;
+    CK_OBJECT_HANDLE hClientKey;
+    CK_OBJECT_HANDLE hServerKey;
+    CK_BYTE_PTR pIVClient;
+    CK_BYTE_PTR pIVServer;
+} CK_SSL3_KEY_MAT_OUT;
+
+typedef CK_SSL3_KEY_MAT_OUT CK_PTR CK_SSL3_KEY_MAT_OUT_PTR;
+
+typedef struct CK_SSL3_KEY_MAT_PARAMS {
+    CK_ULONG ulMacSizeInBits;
+    CK_ULONG ulKeySizeInBits;
+    CK_ULONG ulIVSizeInBits;
+    CK_BBOOL bIsExport; /* Unused. Must be set to CK_FALSE. */
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_SSL3_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
+} CK_SSL3_KEY_MAT_PARAMS;
+
+typedef CK_SSL3_KEY_MAT_PARAMS CK_PTR CK_SSL3_KEY_MAT_PARAMS_PTR;
+
+/* CK_TLS_PRF_PARAMS is new for version 2.20 */
+typedef struct CK_TLS_PRF_PARAMS {
+    CK_BYTE_PTR pSeed;
+    CK_ULONG ulSeedLen;
+    CK_BYTE_PTR pLabel;
+    CK_ULONG ulLabelLen;
+    CK_BYTE_PTR pOutput;
+    CK_ULONG_PTR pulOutputLen;
+} CK_TLS_PRF_PARAMS;
+
+typedef CK_TLS_PRF_PARAMS CK_PTR CK_TLS_PRF_PARAMS_PTR;
+
+/* TLS 1.2 is new for version 2.40 */
+typedef struct CK_TLS12_MASTER_KEY_DERIVE_PARAMS {
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_VERSION_PTR pVersion;
+    CK_MECHANISM_TYPE prfHashMechanism;
+} CK_TLS12_MASTER_KEY_DERIVE_PARAMS;
+
+typedef CK_TLS12_MASTER_KEY_DERIVE_PARAMS CK_PTR
+    CK_TLS12_MASTER_KEY_DERIVE_PARAMS_PTR;
+
+typedef struct CK_TLS12_KEY_MAT_PARAMS {
+    CK_ULONG ulMacSizeInBits;
+    CK_ULONG ulKeySizeInBits;
+    CK_ULONG ulIVSizeInBits;
+    CK_BBOOL bIsExport; /* Unused. Must be set to CK_FALSE. */
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_SSL3_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
+    CK_MECHANISM_TYPE prfHashMechanism;
+} CK_TLS12_KEY_MAT_PARAMS;
+
+typedef CK_TLS12_KEY_MAT_PARAMS CK_PTR CK_TLS12_KEY_MAT_PARAMS_PTR;
+
+typedef struct CK_TLS_KDF_PARAMS {
+    CK_MECHANISM_TYPE prfMechanism;
+    CK_BYTE_PTR pLabel;
+    CK_ULONG ulLabelLength;
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_BYTE_PTR pContextData;
+    CK_ULONG ulContextDataLength;
+} CK_TLS_KDF_PARAMS;
+
+typedef struct CK_TLS_MAC_PARAMS {
+    CK_MECHANISM_TYPE prfMechanism;
+    CK_ULONG ulMacLength;
+    CK_ULONG ulServerOrClient;
+} CK_TLS_MAC_PARAMS;
+
+typedef CK_TLS_MAC_PARAMS CK_PTR CK_TLS_MAC_PARAMS_PTR;
+
+/* WTLS is new for version 2.20 */
+typedef struct CK_WTLS_RANDOM_DATA {
+    CK_BYTE_PTR pClientRandom;
+    CK_ULONG ulClientRandomLen;
+    CK_BYTE_PTR pServerRandom;
+    CK_ULONG ulServerRandomLen;
+} CK_WTLS_RANDOM_DATA;
+
+typedef CK_WTLS_RANDOM_DATA CK_PTR CK_WTLS_RANDOM_DATA_PTR;
+
+typedef struct CK_WTLS_MASTER_KEY_DERIVE_PARAMS {
+    CK_MECHANISM_TYPE DigestMechanism;
+    CK_WTLS_RANDOM_DATA RandomInfo;
+    CK_BYTE_PTR pVersion;
+} CK_WTLS_MASTER_KEY_DERIVE_PARAMS;
+
+typedef CK_WTLS_MASTER_KEY_DERIVE_PARAMS CK_PTR
+    CK_WTLS_MASTER_KEY_DERIVE_PARAMS_PTR;
+
+typedef struct CK_WTLS_PRF_PARAMS {
+    CK_MECHANISM_TYPE DigestMechanism;
+    CK_BYTE_PTR pSeed;
+    CK_ULONG ulSeedLen;
+    CK_BYTE_PTR pLabel;
+    CK_ULONG ulLabelLen;
+    CK_BYTE_PTR pOutput;
+    CK_ULONG_PTR pulOutputLen;
+} CK_WTLS_PRF_PARAMS;
+
+typedef CK_WTLS_PRF_PARAMS CK_PTR CK_WTLS_PRF_PARAMS_PTR;
+
+typedef struct CK_WTLS_KEY_MAT_OUT {
+    CK_OBJECT_HANDLE hMacSecret;
+    CK_OBJECT_HANDLE hKey;
+    CK_BYTE_PTR pIV;
+} CK_WTLS_KEY_MAT_OUT;
+
+typedef CK_WTLS_KEY_MAT_OUT CK_PTR CK_WTLS_KEY_MAT_OUT_PTR;
+
+typedef struct CK_WTLS_KEY_MAT_PARAMS {
+    CK_MECHANISM_TYPE DigestMechanism;
+    CK_ULONG ulMacSizeInBits;
+    CK_ULONG ulKeySizeInBits;
+    CK_ULONG ulIVSizeInBits;
+    CK_ULONG ulSequenceNumber;
+    CK_BBOOL bIsExport; /* Unused. Must be set to CK_FALSE. */
+    CK_WTLS_RANDOM_DATA RandomInfo;
+    CK_WTLS_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
+} CK_WTLS_KEY_MAT_PARAMS;
+
+typedef CK_WTLS_KEY_MAT_PARAMS CK_PTR CK_WTLS_KEY_MAT_PARAMS_PTR;
+
+/* CMS is new for version 2.20 */
+typedef struct CK_CMS_SIG_PARAMS {
+    CK_OBJECT_HANDLE certificateHandle;
+    CK_MECHANISM_PTR pSigningMechanism;
+    CK_MECHANISM_PTR pDigestMechanism;
+    CK_UTF8CHAR_PTR pContentType;
+    CK_BYTE_PTR pRequestedAttributes;
+    CK_ULONG ulRequestedAttributesLen;
+    CK_BYTE_PTR pRequiredAttributes;
+    CK_ULONG ulRequiredAttributesLen;
+} CK_CMS_SIG_PARAMS;
+
+typedef CK_CMS_SIG_PARAMS CK_PTR CK_CMS_SIG_PARAMS_PTR;
+
+typedef struct CK_KEY_DERIVATION_STRING_DATA {
+    CK_BYTE_PTR pData;
+    CK_ULONG ulLen;
+} CK_KEY_DERIVATION_STRING_DATA;
+
+typedef CK_KEY_DERIVATION_STRING_DATA CK_PTR
+    CK_KEY_DERIVATION_STRING_DATA_PTR;
+
+/* The CK_EXTRACT_PARAMS is used for the
+ * CKM_EXTRACT_KEY_FROM_KEY mechanism.  It specifies which bit
+ * of the base key should be used as the first bit of the
+ * derived key */
+/* CK_EXTRACT_PARAMS is new for v2.0 */
+typedef CK_ULONG CK_EXTRACT_PARAMS;
+
+typedef CK_EXTRACT_PARAMS CK_PTR CK_EXTRACT_PARAMS_PTR;
+
+/* CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is new for v2.10.
+ * CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is used to
+ * indicate the Pseudo-Random Function (PRF) used to generate
+ * key bits using PKCS #5 PBKDF2. */
+typedef CK_ULONG CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE;
+
+typedef CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE CK_PTR CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE_PTR;
+
+/* The following PRFs are defined in PKCS #5 v2.1. */
+#define CKP_PKCS5_PBKD2_HMAC_SHA1 0x00000001
+#define CKP_PKCS5_PBKD2_HMAC_GOSTR3411 0x00000002
+#define CKP_PKCS5_PBKD2_HMAC_SHA224 0x00000003
+#define CKP_PKCS5_PBKD2_HMAC_SHA256 0x00000004
+#define CKP_PKCS5_PBKD2_HMAC_SHA384 0x00000005
+#define CKP_PKCS5_PBKD2_HMAC_SHA512 0x00000006
+#define CKP_PKCS5_PBKD2_HMAC_SHA512_224 0x00000007
+#define CKP_PKCS5_PBKD2_HMAC_SHA512_256 0x00000008
+
+/* CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is new for v2.10.
+ * CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is used to indicate the
+ * source of the salt value when deriving a key using PKCS #5
+ * PBKDF2. */
+typedef CK_ULONG CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE;
+
+typedef CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE CK_PTR CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE_PTR;
+
+/* The following salt value sources are defined in PKCS #5 v2.0. */
+#define CKZ_SALT_SPECIFIED 0x00000001
+
+/* CK_PKCS5_PBKD2_PARAMS is new for v2.10.
+ * CK_PKCS5_PBKD2_PARAMS is a structure that provides the
+ * parameters to the CKM_PKCS5_PBKD2 mechanism. */
+typedef struct CK_PKCS5_PBKD2_PARAMS {
+    CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
+    CK_VOID_PTR pSaltSourceData;
+    CK_ULONG ulSaltSourceDataLen;
+    CK_ULONG iterations;
+    CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
+    CK_VOID_PTR pPrfData;
+    CK_ULONG ulPrfDataLen;
+    CK_UTF8CHAR_PTR pPassword;
+    CK_ULONG_PTR ulPasswordLen;
+} CK_PKCS5_PBKD2_PARAMS;
+
+typedef CK_PKCS5_PBKD2_PARAMS CK_PTR CK_PKCS5_PBKD2_PARAMS_PTR;
+
+/* NSS Specific defines */
+
+/* defines that have been deprecated in 2.20, but maintained in our
+ * header file for backward compatibility */
+#define CKO_KG_PARAMETERS CKO_DOMAIN_PARAMETERS
+#define CKF_EC_FP CKF_EC_F_P
+/* new in v2.11 deprecated by 2.20 */
+#define CKR_KEY_PARAMS_INVALID 0x0000006B
+
+/* stuff that for historic reasons is in this header file but should have
+ * been in pkcs11n.h */
+#define CKK_INVALID_KEY_TYPE 0xffffffff
+
+/* undo packing */
+#include "pkcs11u.h"
+
+#endif
\ No newline at end of file
diff --git a/tests/pkcs11/pkcs11u.h b/tests/pkcs11/pkcs11u.h
new file mode 100644
index 00000000..a2ffb2cb
--- /dev/null
+++ b/tests/pkcs11/pkcs11u.h
@@ -0,0 +1,22 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/*
+ * Copyright (C) 1994-1999 RSA Security Inc. Licence to copy this document
+ * is granted provided that it is identified as "RSA Security Inc. Public-Key
+ * Cryptography Standards (PKCS)" in all material mentioning or referencing
+ * this document.
+ */
+/*
+ * reset any packing set by pkcs11p.h
+ */
+
+#if defined(_WIN32) || defined(_WINDOWS)
+#ifdef __clang__
+#pragma clang diagnostic ignored "-Wpragma-pack"
+#endif
+#ifdef _MSC_VER
+#pragma warning(disable : 4103)
+#endif
+#pragma pack(pop, cryptoki)
+#endif
\ No newline at end of file
diff --git a/tests/ssl-test.c b/tests/ssl-test.c
index 909b3a20..1a209892 100644
--- a/tests/ssl-test.c
+++ b/tests/ssl-test.c
@@ -3,6 +3,11 @@
 #include "test-utils.h"
 #include "soup-server-message-private.h"
 
+#if HAVE_GNUTLS
+#include <gnutls/gnutls.h>
+#include <gnutls/pkcs11.h>
+#endif
+
 GUri *uri;
 
 typedef struct {
@@ -217,8 +222,17 @@ request_certificate_cb (SoupMessage          *msg,
 typedef struct {
         SoupMessage *msg;
         GTlsCertificate *certificate;
+        GTlsPassword *tls_password;
+        const guchar *password;
 } SetCertificateAsyncData;
 
+static void
+set_certificate_async_data_free (SetCertificateAsyncData *data)
+{
+        g_clear_object (&data->tls_password);
+        g_free (data);
+}
+
 static gboolean
 set_certificate_idle_cb (SetCertificateAsyncData *data)
 {
@@ -234,12 +248,41 @@ request_certificate_async_cb (SoupMessage          *msg,
 {
         SetCertificateAsyncData *data;
 
-        data = g_new (SetCertificateAsyncData, 1);
+        data = g_new0 (SetCertificateAsyncData, 1);
         data->msg = msg;
         data->certificate = certificate;
         g_idle_add_full (G_PRIORITY_DEFAULT_IDLE,
                          (GSourceFunc)set_certificate_idle_cb,
-                         data, g_free);
+                         data,
+                         (GDestroyNotify)set_certificate_async_data_free);
+
+        return TRUE;
+}
+
+static gboolean
+set_certificate_password_idle_cb (SetCertificateAsyncData *data)
+{
+        g_tls_password_set_value (data->tls_password, data->password, -1);
+        soup_message_tls_client_certificate_password_request_complete (data->msg);
+
+        return FALSE;
+}
+
+static gboolean
+request_certificate_password_async_cb (SoupMessage  *msg,
+                                       GTlsPassword *password,
+                                       const guchar *pin)
+{
+        SetCertificateAsyncData *data;
+
+        data = g_new (SetCertificateAsyncData, 1);
+        data->msg = msg;
+        data->tls_password = g_object_ref (password);
+        data->password = pin;
+        g_idle_add_full (G_PRIORITY_DEFAULT_IDLE,
+                         (GSourceFunc)set_certificate_password_idle_cb,
+                         data,
+                         (GDestroyNotify)set_certificate_async_data_free);
 
         return TRUE;
 }
@@ -252,7 +295,7 @@ do_tls_interaction_msg_test (gconstpointer data)
         SoupMessage *msg;
         GBytes *body;
         GTlsDatabase *tls_db;
-        GTlsCertificate *certificate, *wrong_certificate;
+        GTlsCertificate *certificate, *wrong_certificate, *pkcs11_certificate;
         GError *error = NULL;
 
         SOUP_TEST_SKIP_IF_NO_TLS;
@@ -348,11 +391,35 @@ do_tls_interaction_msg_test (gconstpointer data)
         g_clear_error (&error);
         g_object_unref (msg);
 
+        /* Using PKCS#11 works, and asks for a PIN */
+        pkcs11_certificate = g_tls_certificate_new_from_pkcs11_uris (
+                "pkcs11:model=mock;serial=1;token=Mock%20Certificate;id=%4D%6F%63%6B%20%43%65%72%74%69%66%69%63%61%74%65;object=Mock%20Certificate;type=cert",
+                "pkcs11:model=mock;serial=1;token=Mock%20Certificate;id=%4D%6F%63%6B%20%50%72%69%76%61%74%65%20%4B%65%79;object=Mock%20Private%20Key;type=private",
+                &error
+        );
+        g_assert_no_error (error);
+        g_assert_nonnull (pkcs11_certificate);
+        g_assert_true (G_IS_TLS_CERTIFICATE (pkcs11_certificate));
+        msg = soup_message_new_from_uri ("GET", uri);
+        soup_message_add_flags (msg, SOUP_MESSAGE_NEW_CONNECTION);
+        g_signal_connect (msg, "request-certificate",
+                          G_CALLBACK (request_certificate_async_cb),
+                          pkcs11_certificate);
+        g_signal_connect (msg, "request-certificate-password",
+                          G_CALLBACK (request_certificate_password_async_cb),
+                          "ABC123");
+        body = soup_test_session_async_send (session, msg, NULL, &error);
+        g_assert_no_error (error);
+        g_clear_error (&error);
+        g_bytes_unref (body);
+        g_object_unref (msg);
+
         g_signal_handlers_disconnect_by_data (server, tls_db);
 
         soup_test_session_abort_unref (session);
         g_object_unref (certificate);
         g_object_unref (wrong_certificate);
+        g_object_unref (pkcs11_certificate);
 }
 
 static void
@@ -376,6 +443,15 @@ main (int argc, char **argv)
 
 	test_init (argc, argv, NULL);
 
+#if HAVE_GNUTLS
+        char *module_path = soup_test_build_filename_abs (G_TEST_BUILT, "mock-pkcs11.so", NULL);
+        g_assert_true (g_file_test (module_path, G_FILE_TEST_EXISTS));
+
+        g_assert (gnutls_pkcs11_init (GNUTLS_PKCS11_FLAG_MANUAL, NULL) == GNUTLS_E_SUCCESS);
+        g_assert (gnutls_pkcs11_add_provider (module_path, NULL) == GNUTLS_E_SUCCESS);
+        g_free (module_path);
+#endif
+
 	if (tls_available) {
 		server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
 		soup_server_add_handler (server, NULL, server_handler, NULL, NULL);