/*

 * gnome-keyring

 *

 * Copyright (C) 2010 Stefan Walter

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as

 * published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, see <http://www.gnu.org/licenses/>.

 */

#include "config.h"

#include "gck.h"

#include "gck-mock.h"

#include <p11-kit/pkcs11.h>

#include "pkcs11i.h"

#include <glib.h>

#include <string.h>

/*

 * This is *NOT* how you'd want to implement a PKCS#11 module. This

 * fake module simply provides enough for gck library to test against.

 * It doesn't pass any tests, or behave as expected from a PKCS#11 module.

 */

static gboolean initialized = FALSE;

static gchar *the_pin = NULL;

static gulong n_the_pin = 0;

static gboolean logged_in = FALSE;

static CK_USER_TYPE user_type = 0;

static CK_FUNCTION_LIST functionList;

typedef enum _Operation {

	OP_FIND = 1,

	OP_CRYPTO

} Operation;

typedef struct _Session {

	CK_SESSION_HANDLE handle;

	CK_SESSION_INFO info;

	GHashTable *objects;

	Operation operation;

	/* For find operations */

	GList *matches;

	/* For crypto operations */

	CK_OBJECT_HANDLE crypto_key;

	CK_ATTRIBUTE_TYPE crypto_method;

	CK_MECHANISM_TYPE crypto_mechanism;

	CK_BBOOL want_context_login;

	/* For 'signing' with CKM_MOCK_PREFIX */

	CK_BYTE sign_prefix[128];

	CK_ULONG n_sign_prefix;

} Session;

static guint unique_identifier = 100;

static GHashTable *the_sessions = NULL;

static GHashTable *the_objects = NULL;

enum {

	PRIVATE_KEY_CAPITALIZE = 3,

	PUBLIC_KEY_CAPITALIZE = 4,

	PRIVATE_KEY_PREFIX = 5,

	PUBLIC_KEY_PREFIX = 6

};

#define SIGNED_PREFIX "signed-prefix:"

static void

free_session (gpointer data)

{

	Session *sess = (Session*)data;

	if (sess)

		g_hash_table_destroy (sess->objects);

	g_free (sess);

}

static GckAttributes *

lookup_object (Session *session,

               CK_OBJECT_HANDLE hObject,

               GHashTable **table)

{

	GckAttributes *attrs;

	attrs = g_hash_table_lookup (the_objects, GUINT_TO_POINTER (hObject));

	if (attrs) {

		if (table)

			*table = the_objects;

		return attrs;

	}

	attrs = g_hash_table_lookup (session->objects, GUINT_TO_POINTER (hObject));

	if (attrs) {

		if (table)

			*table = session->objects;

		return attrs;

	}

	return NULL;

}

CK_OBJECT_HANDLE

gck_mock_module_add_object (GckAttributes *attrs)

{

	GckBuilder builder;

	gboolean token;

	guint handle;

	g_return_val_if_fail (the_objects, 0);

	handle = ++unique_identifier;

	if (gck_attributes_find_boolean (attrs, CKA_TOKEN, &token)) {

		g_return_val_if_fail (token == TRUE, 0);

		gck_attributes_ref_sink (attrs);

	} else {

		gck_builder_init (&builder);

		gck_builder_add_except (&builder, attrs, CKA_TOKEN, GCK_INVALID);

		gck_builder_add_boolean (&builder, CKA_TOKEN, TRUE);

		gck_attributes_unref (attrs);

		attrs = gck_attributes_ref_sink (gck_builder_end (&builder));

	}

	g_hash_table_insert (the_objects, GUINT_TO_POINTER (handle), attrs);

	return handle;

}

void

gck_mock_module_enumerate_objects (CK_SESSION_HANDLE handle, GckMockEnumerator func,

                                   gpointer user_data)

{

	GHashTableIter iter;

	gpointer key;

	gpointer value;

	Session *session;

	g_assert (the_objects);

	g_assert (func);

	/* Token objects */

	g_hash_table_iter_init (&iter, the_objects);

	while (g_hash_table_iter_next (&iter, &key, &value)) {

		if (!(func) (GPOINTER_TO_UINT (key), value, user_data))

			return;

	}

	/* session objects */

	if (handle) {

		session = g_hash_table_lookup (the_sessions, GUINT_TO_POINTER (handle));

		if (session) {

			g_hash_table_iter_init (&iter, session->objects);

			while (g_hash_table_iter_next (&iter, &key, &value)) {

				if (!(func) (GPOINTER_TO_UINT (key), value, user_data))

					return;

			}

		}

	}

}

typedef struct _FindObject {

	CK_ATTRIBUTE_PTR attrs;

	CK_ULONG n_attrs;

	CK_OBJECT_HANDLE object;

} FindObject;

static gboolean

enumerate_and_find_object (CK_OBJECT_HANDLE object, GckAttributes *attrs, gpointer user_data)

{

	FindObject *ctx = user_data;

	CK_ATTRIBUTE_PTR match;

	const GckAttribute *attr;

	CK_ULONG i;

	for (i = 0; i < ctx->n_attrs; ++i) {

		match = ctx->attrs + i;

		attr = gck_attributes_find (attrs, match->type);

		if (!attr)

			return TRUE; /* Continue */

		if (attr->length != match->ulValueLen ||

		    memcmp (attr->value, match->pValue, attr->length) != 0)

			return TRUE; /* Continue */

	}

	ctx->object = object;

	return FALSE; /* Stop iteration */

}

CK_OBJECT_HANDLE

gck_mock_module_find_object (CK_SESSION_HANDLE session, CK_ATTRIBUTE_PTR attrs, CK_ULONG n_attrs)

{

	FindObject ctx;

	ctx.attrs = attrs;

	ctx.n_attrs = n_attrs;

	ctx.object = 0;

	gck_mock_module_enumerate_objects (session, enumerate_and_find_object, &ctx;;

	return ctx.object;

}

static gboolean

enumerate_and_count_objects (CK_OBJECT_HANDLE object, GckAttributes *attrs, gpointer user_data)

{

	guint *n_objects = user_data;

	++(*n_objects);

	return TRUE; /* Continue */

}

guint

gck_mock_module_count_objects (CK_SESSION_HANDLE session)

{

	guint n_objects = 0;

	gck_mock_module_enumerate_objects (session, enumerate_and_count_objects, &n_objects);

	return n_objects;

}

static GckAttributes *

replace_attributes (GckAttributes *atts,

                    CK_ATTRIBUTE_PTR attrs,

                    CK_ULONG n_attrs)

{

	GckBuilder builder;

	CK_ULONG i;

	CK_ATTRIBUTE_PTR set;

	gulong *types;

	if (!n_attrs)

		return gck_attributes_ref_sink (atts);

	gck_builder_init (&builder);

	types = g_new0 (gulong, n_attrs);

	for (i = 0; i < n_attrs; ++i) {

		set = attrs + i;

		types[i] = set->type;

		gck_builder_add_data (&builder, set->type, set->pValue, set->ulValueLen);

	}

	gck_builder_add_exceptv (&builder, atts, types, n_attrs);

	g_free (types);

	return gck_attributes_ref_sink (gck_builder_end (&builder));

}

void

gck_mock_module_set_object (CK_OBJECT_HANDLE object, CK_ATTRIBUTE_PTR attrs,

                            CK_ULONG n_attrs)

{

	GckAttributes *atts;

	GckAttributes *replaced;

	g_return_if_fail (object != 0);

	g_return_if_fail (the_objects);

	atts = g_hash_table_lookup (the_objects, GUINT_TO_POINTER (object));

	g_return_if_fail (atts);

	if (!n_attrs)

		return;

	replaced = replace_attributes (atts, attrs, n_attrs);

	g_hash_table_replace (the_objects, GUINT_TO_POINTER (object), replaced);

}

void

gck_mock_module_set_pin (const gchar *password)

{

	g_free (the_pin);

	the_pin = g_strdup (password);

	n_the_pin = strlen (password);

}

CK_RV

gck_mock_C_Initialize (CK_VOID_PTR pInitArgs)

{

	GckBuilder builder;

	CK_ULONG value;

	CK_C_INITIALIZE_ARGS_PTR args;

	g_return_val_if_fail (initialized == FALSE, CKR_CRYPTOKI_ALREADY_INITIALIZED);

	args = (CK_C_INITIALIZE_ARGS_PTR)pInitArgs;

	if (args) {

		g_return_val_if_fail(

		              (args->CreateMutex == NULL && args->DestroyMutex == NULL &&

		               args->LockMutex == NULL && args->UnlockMutex == NULL) ||

		              (args->CreateMutex != NULL && args->DestroyMutex != NULL &&

		               args->LockMutex != NULL && args->UnlockMutex != NULL),

		               CKR_ARGUMENTS_BAD);

		/* Flags should allow OS locking and os threads */

		g_return_val_if_fail ((args->flags & CKF_OS_LOCKING_OK), CKR_CANT_LOCK);

		g_return_val_if_fail ((args->flags & CKF_LIBRARY_CANT_CREATE_OS_THREADS) == 0, CKR_NEED_TO_CREATE_THREADS);

	}

	the_pin = g_strdup ("booo");

	n_the_pin = strlen (the_pin);

	the_sessions = g_hash_table_new_full (g_direct_hash, g_direct_equal, NULL, free_session);

	the_objects = g_hash_table_new_full (g_direct_hash, g_direct_equal, NULL, (GDestroyNotify)gck_attributes_unref);

	/* Our token object */

	gck_builder_init (&builder);

	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_DATA);

	gck_builder_add_string (&builder, CKA_LABEL, "TEST LABEL");

	g_hash_table_insert (the_objects, GUINT_TO_POINTER (2),

	                     gck_attributes_ref_sink (gck_builder_end (&builder)));

	/* Private capitalize key */

	value = CKM_MOCK_CAPITALIZE;

	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PRIVATE_KEY);

	gck_builder_add_string (&builder, CKA_LABEL, "Private Capitalize Key");

	gck_builder_add_data (&builder, CKA_ALLOWED_MECHANISMS, (const guchar *)&value, sizeof (value));

	gck_builder_add_boolean (&builder, CKA_DECRYPT, CK_TRUE);

	gck_builder_add_boolean (&builder, CKA_PRIVATE, CK_TRUE);

	gck_builder_add_boolean (&builder, CKA_WRAP, CK_TRUE);

	gck_builder_add_boolean (&builder, CKA_UNWRAP, CK_TRUE);

	gck_builder_add_boolean (&builder, CKA_DERIVE, CK_TRUE);

	gck_builder_add_string (&builder, CKA_VALUE, "value");

	gck_builder_add_string (&builder, CKA_GNOME_UNIQUE, "unique1");

	g_hash_table_insert (the_objects, GUINT_TO_POINTER (PRIVATE_KEY_CAPITALIZE),

	                     gck_attributes_ref_sink (gck_builder_end (&builder)));

	/* Public capitalize key */

	value = CKM_MOCK_CAPITALIZE;

	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PUBLIC_KEY);

	gck_builder_add_string (&builder, CKA_LABEL, "Public Capitalize Key");

	gck_builder_add_data (&builder, CKA_ALLOWED_MECHANISMS, (const guchar *)&value, sizeof (value));

	gck_builder_add_boolean (&builder, CKA_ENCRYPT, CK_TRUE);

	gck_builder_add_boolean (&builder, CKA_PRIVATE, CK_FALSE);

	gck_builder_add_string (&builder, CKA_VALUE, "value");

	gck_builder_add_string (&builder, CKA_GNOME_UNIQUE, "unique2");

	g_hash_table_insert (the_objects, GUINT_TO_POINTER (PUBLIC_KEY_CAPITALIZE), gck_builder_end (&builder));

	/* Private prefix key */

	value = CKM_MOCK_PREFIX;

	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PRIVATE_KEY);

	gck_builder_add_string (&builder, CKA_LABEL, "Private prefix key");

	gck_builder_add_data (&builder, CKA_ALLOWED_MECHANISMS, (const guchar *)&value, sizeof (value));

	gck_builder_add_boolean (&builder, CKA_SIGN, CK_TRUE);

	gck_builder_add_boolean (&builder, CKA_PRIVATE, CK_TRUE);

	gck_builder_add_boolean (&builder, CKA_ALWAYS_AUTHENTICATE, CK_TRUE);

	gck_builder_add_string (&builder, CKA_VALUE, "value");

	gck_builder_add_string (&builder, CKA_GNOME_UNIQUE, "unique3");

	g_hash_table_insert (the_objects, GUINT_TO_POINTER (PRIVATE_KEY_PREFIX),

	                     gck_attributes_ref_sink (gck_builder_end (&builder)));

	/* Private prefix key */

	value = CKM_MOCK_PREFIX;

	gck_builder_add_ulong (&builder, CKA_CLASS, CKO_PUBLIC_KEY);

	gck_builder_add_string (&builder, CKA_LABEL, "Public prefix key");

	gck_builder_add_data (&builder, CKA_ALLOWED_MECHANISMS, (const guchar *)&value, sizeof (value));

	gck_builder_add_boolean (&builder, CKA_VERIFY, CK_TRUE);

	gck_builder_add_boolean (&builder, CKA_PRIVATE, CK_FALSE);

	gck_builder_add_string (&builder, CKA_VALUE, "value");

	gck_builder_add_string (&builder, CKA_GNOME_UNIQUE, "unique4");

	g_hash_table_insert (the_objects, GUINT_TO_POINTER (PUBLIC_KEY_PREFIX),

	                     gck_attributes_ref_sink (gck_builder_end (&builder)));

	logged_in = FALSE;

	initialized = TRUE;

	return CKR_OK;

}

CK_RV

gck_mock_validate_and_C_Initialize (CK_VOID_PTR pInitArgs)

{

	CK_C_INITIALIZE_ARGS_PTR args;

	void *mutex;

	CK_RV rv;

	args = (CK_C_INITIALIZE_ARGS_PTR)pInitArgs;

	if (args) {

		g_assert ((args->CreateMutex) (NULL) == CKR_ARGUMENTS_BAD && "CreateMutex succeeded wrong");

		g_assert ((args->DestroyMutex) (NULL) == CKR_MUTEX_BAD && "DestroyMutex succeeded wrong");

		g_assert ((args->LockMutex) (NULL) == CKR_MUTEX_BAD && "LockMutex succeeded wrong");

		g_assert ((args->UnlockMutex) (NULL) == CKR_MUTEX_BAD && "UnlockMutex succeeded wrong");

		/* Try to create an actual mutex */

		rv = (args->CreateMutex) (&mutex);

		g_assert (rv == CKR_OK && "CreateMutex g_assert_not_reacheded");

		g_assert (mutex != NULL && "CreateMutex created null mutex");

		/* Try and lock the mutex */

		rv = (args->LockMutex) (mutex);

		g_assert (rv == CKR_OK && "LockMutex g_assert_not_reacheded");

		/* Try and unlock the mutex */

		rv = (args->UnlockMutex) (mutex);

		g_assert (rv == CKR_OK && "UnlockMutex g_assert_not_reacheded");

		/* Try and destroy the mutex */

		rv = (args->DestroyMutex) (mutex);

		g_assert (rv == CKR_OK && "DestroyMutex g_assert_not_reacheded");

	}

	return gck_mock_C_Initialize (pInitArgs);

}

CK_RV

gck_mock_C_Finalize (CK_VOID_PTR pReserved)

{

	g_return_val_if_fail (pReserved == NULL, CKR_ARGUMENTS_BAD);

	g_return_val_if_fail (initialized == TRUE, CKR_CRYPTOKI_NOT_INITIALIZED);

	initialized = FALSE;

	logged_in = FALSE;

	g_hash_table_destroy (the_objects);

	the_objects = NULL;

	g_hash_table_destroy (the_sessions);

	the_sessions = NULL;

	g_free (the_pin);

	return CKR_OK;

}

static const CK_INFO TEST_INFO = {

	{ CRYPTOKI_VERSION_MAJOR, CRYPTOKI_VERSION_MINOR },

	"TEST MANUFACTURER              ",

	0,

	"TEST LIBRARY                   ",

	{ 45, 145 }

};

CK_RV

gck_mock_C_GetInfo (CK_INFO_PTR pInfo)

{

	g_return_val_if_fail (pInfo, CKR_ARGUMENTS_BAD);

	memcpy (pInfo, &TEST_INFO, sizeof (*pInfo));

	return CKR_OK;

}

CK_RV

gck_mock_C_GetFunctionList (CK_FUNCTION_LIST_PTR_PTR list)

{

	g_return_val_if_fail (list, CKR_ARGUMENTS_BAD);

	*list = &functionList;

	return CKR_OK;

}

/*

 * Two slots

 *  ONE: token present

 *  TWO: token not present

 */

CK_RV

gck_mock_C_GetSlotList (CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList, CK_ULONG_PTR pulCount)

{

	CK_ULONG count;

	g_return_val_if_fail (pulCount, CKR_ARGUMENTS_BAD);

	count = tokenPresent ? 1 : 2;

	/* Application only wants to know the number of slots. */

	if (pSlotList == NULL) {

		*pulCount = count;

		return CKR_OK;

	}

	if (*pulCount < count)

		g_return_val_if_reached (CKR_BUFFER_TOO_SMALL);

	*pulCount = count;

	pSlotList[0] = GCK_MOCK_SLOT_ONE_ID;

	if (!tokenPresent)

		pSlotList[1] = GCK_MOCK_SLOT_TWO_ID;

	return CKR_OK;

}

/* Update gck-mock.h URIs when updating this */

static const CK_SLOT_INFO TEST_INFO_ONE = {

	"TEST SLOT                                                       ",

	"TEST MANUFACTURER              ",

	CKF_TOKEN_PRESENT | CKF_REMOVABLE_DEVICE,

	{ 55, 155 },

	{ 65, 165 },

};

/* Update gck-mock.h URIs when updating this */

static const CK_SLOT_INFO TEST_INFO_TWO = {

	"TEST SLOT                                                       ",

	"TEST MANUFACTURER              ",

	CKF_REMOVABLE_DEVICE,

	{ 55, 155 },

	{ 65, 165 },

};

CK_RV

gck_mock_C_GetSlotInfo (CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo)

{

	g_return_val_if_fail (pInfo, CKR_ARGUMENTS_BAD);

	if (slotID == GCK_MOCK_SLOT_ONE_ID) {

		memcpy (pInfo, &TEST_INFO_ONE, sizeof (*pInfo));

		return CKR_OK;

	} else if (slotID == GCK_MOCK_SLOT_TWO_ID) {

		memcpy (pInfo, &TEST_INFO_TWO, sizeof (*pInfo));

		return CKR_OK;

	} else {

		g_return_val_if_reached (CKR_SLOT_ID_INVALID);

	}

}

/* Update gck-mock.h URIs when updating this */

static const CK_TOKEN_INFO TEST_TOKEN_ONE = {

	"TEST LABEL                      ",

	"TEST MANUFACTURER               ",

	"TEST MODEL      ",

	"TEST SERIAL     ",

	CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_CLOCK_ON_TOKEN | CKF_TOKEN_INITIALIZED,

	1,

	2,

	3,

	4,

	5,

	6,

	7,

	8,

	9,

	10,

	{ 75, 175 },

	{ 85, 185 },

	{ '1', '9', '9', '9', '0', '5', '2', '5', '0', '9', '1', '9', '5', '9', '0', '0' }

};

CK_RV

gck_mock_C_GetTokenInfo (CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo)

{

	g_return_val_if_fail (pInfo != NULL, CKR_ARGUMENTS_BAD);

	if (slotID == GCK_MOCK_SLOT_ONE_ID) {

		memcpy (pInfo, &TEST_TOKEN_ONE, sizeof (*pInfo));

		return CKR_OK;

	} else if (slotID == GCK_MOCK_SLOT_TWO_ID) {

		return CKR_TOKEN_NOT_PRESENT;

	} else {

		g_return_val_if_reached (CKR_SLOT_ID_INVALID);

	}

}

CK_RV

gck_mock_fail_C_GetTokenInfo (CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo)

{

	return CKR_GENERAL_ERROR;

}

/*

 * TWO mechanisms:

 *  CKM_MOCK_CAPITALIZE

 *  CKM_MOCK_PREFIX

 */

CK_RV

gck_mock_C_GetMechanismList (CK_SLOT_ID slotID, CK_MECHANISM_TYPE_PTR pMechanismList,

                             CK_ULONG_PTR pulCount)

{

	g_return_val_if_fail (slotID == GCK_MOCK_SLOT_ONE_ID, CKR_SLOT_ID_INVALID);

	g_return_val_if_fail (pulCount, CKR_ARGUMENTS_BAD);

	/* Application only wants to know the number of slots. */

	if (pMechanismList == NULL) {

		*pulCount = 2;

		return CKR_OK;

	}

	if (*pulCount != 2)

		g_return_val_if_reached (CKR_BUFFER_TOO_SMALL);

	pMechanismList[0] = CKM_MOCK_CAPITALIZE;

	pMechanismList[1] = CKM_MOCK_PREFIX;

	return CKR_OK;

}

static const CK_MECHANISM_INFO TEST_MECH_CAPITALIZE = {

	512, 4096, 0

};

static const CK_MECHANISM_INFO TEST_MECH_PREFIX = {

	2048, 2048, 0

};

CK_RV

gck_mock_C_GetMechanismInfo (CK_SLOT_ID slotID, CK_MECHANISM_TYPE type,

                             CK_MECHANISM_INFO_PTR pInfo)

{

	g_return_val_if_fail (slotID == GCK_MOCK_SLOT_ONE_ID, CKR_SLOT_ID_INVALID);

	g_return_val_if_fail (pInfo, CKR_ARGUMENTS_BAD);

	if (type == CKM_MOCK_CAPITALIZE) {

		memcpy (pInfo, &TEST_MECH_CAPITALIZE, sizeof (*pInfo));

		return CKR_OK;

	} else if (type == CKM_MOCK_PREFIX) {

		memcpy (pInfo, &TEST_MECH_PREFIX, sizeof (*pInfo));

		return CKR_OK;

	} else {

		g_return_val_if_reached (CKR_MECHANISM_INVALID);

	}

}

CK_RV

gck_mock_specific_args_C_InitToken (CK_SLOT_ID slotID, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen,

                                    CK_UTF8CHAR_PTR pLabel)

{

	g_return_val_if_fail (slotID == GCK_MOCK_SLOT_ONE_ID, CKR_SLOT_ID_INVALID);

	g_return_val_if_fail (pPin, CKR_PIN_INVALID);

	g_return_val_if_fail (strlen ("TEST PIN") == ulPinLen, CKR_PIN_INVALID);

	g_return_val_if_fail (strncmp ((gchar*)pPin, "TEST PIN", ulPinLen) == 0, CKR_PIN_INVALID);

	g_return_val_if_fail (pLabel != NULL, CKR_PIN_INVALID);

	g_return_val_if_fail (strcmp ((gchar*)pPin, "TEST LABEL") == 0, CKR_PIN_INVALID);

	g_free (the_pin);

	the_pin = g_strndup ((gchar*)pPin, ulPinLen);

	n_the_pin = ulPinLen;

	return CKR_OK;

}

CK_RV

gck_mock_unsupported_C_WaitForSlotEvent (CK_FLAGS flags, CK_SLOT_ID_PTR pSlot, CK_VOID_PTR pReserved)

{

	return CKR_FUNCTION_NOT_SUPPORTED;

}

CK_RV

gck_mock_C_OpenSession (CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication,

                        CK_NOTIFY Notify, CK_SESSION_HANDLE_PTR phSession)

{

	Session *sess;

	g_return_val_if_fail (slotID == GCK_MOCK_SLOT_ONE_ID || slotID == GCK_MOCK_SLOT_TWO_ID, CKR_SLOT_ID_INVALID);

	g_return_val_if_fail (phSession != NULL, CKR_ARGUMENTS_BAD);

	g_return_val_if_fail ((flags & CKF_SERIAL_SESSION) == CKF_SERIAL_SESSION, CKR_SESSION_PARALLEL_NOT_SUPPORTED);

	sess = g_new0 (Session, 1);

	sess->handle = ++unique_identifier;

	sess->info.flags = flags;

	sess->info.slotID = slotID;

	sess->info.state = 0;

	sess->info.ulDeviceError = 1414;

	sess->objects = g_hash_table_new_full (g_direct_hash, g_direct_equal, NULL, (GDestroyNotify)gck_attributes_unref);

	*phSession = sess->handle;

	g_hash_table_replace (the_sessions, GUINT_TO_POINTER (sess->handle), sess);

	return CKR_OK;

}

CK_RV

gck_mock_fail_C_OpenSession (CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication,

                             CK_NOTIFY Notify, CK_SESSION_HANDLE_PTR phSession)

{

	return CKR_GENERAL_ERROR;

}

CK_RV

gck_mock_C_CloseSession (CK_SESSION_HANDLE hSession)

{

	Session *session;

	session = g_hash_table_lookup (the_sessions, GUINT_TO_POINTER (hSession));

	g_return_val_if_fail (session, CKR_SESSION_HANDLE_INVALID);

	g_hash_table_remove (the_sessions, GUINT_TO_POINTER (hSession));

	return CKR_OK;

}

CK_RV

gck_mock_C_CloseAllSessions (CK_SLOT_ID slotID)

{

	g_return_val_if_fail (slotID == GCK_MOCK_SLOT_ONE_ID, CKR_SLOT_ID_INVALID);

	g_hash_table_remove_all (the_sessions);

	return CKR_OK;

}

CK_RV

gck_mock_C_GetFunctionStatus (CK_SESSION_HANDLE hSession)

{

	return CKR_FUNCTION_NOT_PARALLEL;

}

CK_RV

gck_mock_C_CancelFunction (CK_SESSION_HANDLE hSession)

{

	return CKR_FUNCTION_NOT_PARALLEL;

}

CK_RV

gck_mock_C_GetSessionInfo (CK_SESSION_HANDLE hSession, CK_SESSION_INFO_PTR pInfo)

{

	Session *session;

	g_return_val_if_fail (pInfo != NULL, CKR_ARGUMENTS_BAD);

	session = g_hash_table_lookup (the_sessions, GUINT_TO_POINTER (hSession));

	g_assert (session != NULL && "No such session found");

	if (!session)

		return CKR_SESSION_HANDLE_INVALID;

	if (logged_in) {

		if (session->info.flags & CKF_RW_SESSION)

			session->info.state = CKS_RW_USER_FUNCTIONS;

		else

			session->info.state = CKS_RO_USER_FUNCTIONS;

	} else {

		if (session->info.flags & CKF_RW_SESSION)

			session->info.state = CKS_RW_PUBLIC_SESSION;

		else

			session->info.state = CKS_RO_PUBLIC_SESSION;

	}

	memcpy (pInfo, &session->info, sizeof (*pInfo));

	return CKR_OK;

}

CK_RV

gck_mock_fail_C_GetSessionInfo (CK_SESSION_HANDLE hSession, CK_SESSION_INFO_PTR pInfo)

{

	return CKR_GENERAL_ERROR;

}

CK_RV

gck_mock_C_InitPIN (CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin,

                    CK_ULONG ulPinLen)

{

	Session *session;

	session = g_hash_table_lookup (the_sessions, GUINT_TO_POINTER (hSession));

	g_return_val_if_fail (session, CKR_SESSION_HANDLE_INVALID);

	g_free (the_pin);

	the_pin = g_strndup ((gchar*)pPin, ulPinLen);

	n_the_pin = ulPinLen;

	return CKR_OK;

}

CK_RV

gck_mock_C_SetPIN (CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin,

                   CK_ULONG ulOldLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewLen)

{

	Session *session;

	gboolean match;

	gchar *old;

	session = g_hash_table_lookup (the_sessions, GUINT_TO_POINTER (hSession));

	g_return_val_if_fail (session, CKR_SESSION_HANDLE_INVALID);

	old = g_strndup ((gchar*)pOldPin, ulOldLen);

	match = old && g_str_equal (old, the_pin);

	g_free (old);

	if (!match)

		return CKR_PIN_INCORRECT;

	g_free (the_pin);

	the_pin = g_strndup ((gchar*)pNewPin, ulNewLen);

	n_the_pin = ulNewLen;

	return CKR_OK;

}

CK_RV

gck_mock_unsupported_C_GetOperationState (CK_SESSION_HANDLE hSession, CK_BYTE_PTR pOperationState,

                                          CK_ULONG_PTR pulOperationStateLen)

{

	return CKR_FUNCTION_NOT_SUPPORTED;

}

CK_RV

gck_mock_unsupported_C_SetOperationState (CK_SESSION_HANDLE hSession, CK_BYTE_PTR pOperationState,

                                          CK_ULONG ulOperationStateLen, CK_OBJECT_HANDLE hEncryptionKey,

                                          CK_OBJECT_HANDLE hAuthenticationKey)

{

	return CKR_FUNCTION_NOT_SUPPORTED;

}

CK_RV

gck_mock_C_Login (CK_SESSION_HANDLE hSession, CK_USER_TYPE userType,

                  CK_UTF8CHAR_PTR pPin, CK_ULONG pPinLen)

{

	Session *session;

	g_return_val_if_fail (userType == CKU_SO ||

	                      userType == CKU_USER ||

	                      userType == CKU_CONTEXT_SPECIFIC,

	                      CKR_USER_TYPE_INVALID);

	session = g_hash_table_lookup (the_sessions, GUINT_TO_POINTER (hSession));

	g_return_val_if_fail (session != NULL, CKR_SESSION_HANDLE_INVALID);

	g_return_val_if_fail (logged_in == FALSE, CKR_USER_ALREADY_LOGGED_IN);

	if (!pPin)

		return CKR_PIN_INCORRECT;

	if (pPinLen != strlen (the_pin))

		return CKR_PIN_INCORRECT;

	if (strncmp ((gchar*)pPin, the_pin, pPinLen) != 0)

		return CKR_PIN_INCORRECT;

	if (userType == CKU_CONTEXT_SPECIFIC) {

		g_return_val_if_fail (session->want_context_login == TRUE, CKR_OPERATION_NOT_INITIALIZED);

		session->want_context_login = CK_FALSE;

	} else {

		logged_in = TRUE;

		user_type = userType;

	}

	return CKR_OK;

}

CK_RV

gck_mock_C_Logout (CK_SESSION_HANDLE hSession)

{

	Session *session;

	session = g_hash_table_lookup (the_sessions, GUINT_TO_POINTER (hSession));

	g_assert (session != NULL && "No such session found");

	if (!session)

		return CKR_SESSION_HANDLE_INVALID;

	g_assert (logged_in && "Not logged in");

	logged_in = FALSE;

	user_type = 0;

	return CKR_OK;

}

CK_RV

gck_mock_C_CreateObject (CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate,

                         CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phObject)

{

	GckBuilder builder;

	GckAttributes *attrs;

	Session *session;

	gboolean token, priv;

	CK_OBJECT_CLASS klass;

	CK_OBJECT_HANDLE object;

	const GckAttribute *attr;

	CK_ULONG i;

	g_return_val_if_fail (phObject, CKR_ARGUMENTS_BAD);

	session = g_hash_table_lookup (the_sessions, GUINT_TO_POINTER (hSession));

	g_return_val_if_fail (session, CKR_SESSION_HANDLE_INVALID);

	gck_builder_init (&builder);

	for (i = 0; i < ulCount; ++i)

		gck_builder_add_data (&builder, pTemplate[i].type, pTemplate[i].pValue, pTemplate[i].ulValueLen);

	attrs = gck_attributes_ref_sink (gck_builder_end (&builder));

	if (gck_attributes_find_boolean (attrs, CKA_PRIVATE, &priv) && priv) {

		if (!logged_in) {

			gck_attributes_unref (attrs);

			return CKR_USER_NOT_LOGGED_IN;

		}

	}

	/* In order to create a credential we must check CK_VALUE */

	if (gck_attributes_find_ulong (attrs, CKA_CLASS, &klass) && klass == CKO_G_CREDENTIAL) {

		if (gck_attributes_find_ulong (attrs, CKA_G_OBJECT, &object)) {

			attr = gck_attributes_find (attrs, CKA_VALUE);