p11-kit: Managed PKCS#11 module loading

Support a new managed style module loading for PKCS#11 modules. This
allows us to better coordinate between multiple callers of the same
PKCS#11 modules and provide hooks into their behavior.

This meant redoing the public facing API. The old methods are now
deprecated, marked and documented as such.

10 files changed, 2769 insertions, 91 deletions

diff --git a/p11-kit/tests/Makefile.am b/p11-kit/tests/Makefile.am
index 715fca0..0c5c246 100644
--- a/p11-kit/tests/Makefile.am
+++ b/p11-kit/tests/Makefile.am
@@ -23,13 +23,17 @@ CHECK_PROGS = \
 	pin-test \
 	test-init \
 	test-modules \
+	test-deprecated \
+	test-proxy \
 	test-iter \
 	$(NULL)
 
 if WITH_FFI
 
 CHECK_PROGS += \
-	test-virtual
+	test-virtual \
+	test-managed \
+	$(NULL)
 
 endif
 
@@ -75,4 +79,6 @@ mock_four_la_LDFLAGS = $(mock_one_la_LDFLAGS)
 mock_four_la_LIBADD = $(mock_one_la_LIBADD)
 
 EXTRA_DIST = \
-	files
+	files \
+	test-mock.c \
+	$(NULL)
diff --git a/p11-kit/tests/files/system-pkcs11.conf b/p11-kit/tests/files/system-pkcs11.conf
index 20741e7..a3aa273 100644
--- a/p11-kit/tests/files/system-pkcs11.conf
+++ b/p11-kit/tests/files/system-pkcs11.conf
@@ -1,3 +1,6 @@
 
 # Merge in user config
-user-config: merge
\ No newline at end of file
+user-config: merge
+
+# Another option
+new: world
\ No newline at end of file
diff --git a/p11-kit/tests/files/user-modules/one.module b/p11-kit/tests/files/user-modules/one.module
index c371e4a..6f1a2e8 100644
--- a/p11-kit/tests/files/user-modules/one.module
+++ b/p11-kit/tests/files/user-modules/one.module
@@ -1,2 +1,3 @@
 
-setting: user1
\ No newline at end of file
+setting: user1
+managed: yes
\ No newline at end of file
diff --git a/p11-kit/tests/test-deprecated.c b/p11-kit/tests/test-deprecated.c
new file mode 100644
index 0000000..4509241
--- /dev/null
+++ b/p11-kit/tests/test-deprecated.c
@@ -0,0 +1,521 @@
+/*
+ * Copyright (c) 2011, Collabora Ltd.
+ * Copyright (c) 2012 Red Hat Inc
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *     * Redistributions of source code must retain the above
+ *       copyright notice, this list of conditions and the
+ *       following disclaimer.
+ *     * Redistributions in binary form must reproduce the
+ *       above copyright notice, this list of conditions and
+ *       the following disclaimer in the documentation and/or
+ *       other materials provided with the distribution.
+ *     * The names of contributors to this software may not be
+ *       used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * Author: Stef Walter <stefw@redhat.com>
+ */
+
+#define P11_KIT_NO_DEPRECATIONS
+
+#include "config.h"
+#include "CuTest.h"
+
+#include "dict.h"
+#include "library.h"
+#include "p11-kit.h"
+#include "private.h"
+#include "mock.h"
+
+#include <sys/types.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+static CK_FUNCTION_LIST_PTR_PTR
+initialize_and_get_modules (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR_PTR modules;
+	CK_RV rv;
+
+	rv = p11_kit_initialize_registered ();
+	CuAssertIntEquals (tc, CKR_OK, rv);
+	modules = p11_kit_registered_modules ();
+	CuAssertTrue (tc, modules != NULL && modules[0] != NULL);
+
+	return modules;
+}
+
+static void
+finalize_and_free_modules (CuTest *tc,
+                           CK_FUNCTION_LIST_PTR_PTR modules)
+{
+	CK_RV rv;
+
+	free (modules);
+	rv = p11_kit_finalize_registered ();
+	CuAssertIntEquals (tc, CKR_OK, rv);
+
+}
+
+static void
+test_no_duplicates (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR_PTR modules;
+	p11_dict *paths;
+	p11_dict *funcs;
+	char *path;
+	int i;
+
+	modules = initialize_and_get_modules (tc);
+	paths = p11_dict_new (p11_dict_str_hash, p11_dict_str_equal, NULL, NULL);
+	funcs = p11_dict_new (p11_dict_direct_hash, p11_dict_direct_equal, NULL, NULL);
+
+	/* The loaded modules should not contain duplicates */
+	for (i = 0; modules[i] != NULL; i++) {
+		path = p11_kit_registered_option (modules[i], "module");
+
+		if (p11_dict_get (funcs, modules[i]))
+			CuAssert (tc, "found duplicate function list pointer", 0);
+		if (p11_dict_get (paths, path))
+			CuAssert (tc, "found duplicate path name", 0);
+
+		if (!p11_dict_set (funcs, modules[i], ""))
+			CuAssert (tc, "shouldn't be reached", 0);
+		if (!p11_dict_set (paths, path, ""))
+			CuAssert (tc, "shouldn't be reached", 0);
+
+		free (path);
+	}
+
+	p11_dict_free (paths);
+	p11_dict_free (funcs);
+	finalize_and_free_modules (tc, modules);
+}
+
+static CK_FUNCTION_LIST_PTR
+lookup_module_with_name (CuTest *tc,
+                         CK_FUNCTION_LIST_PTR_PTR modules,
+                         const char *name)
+{
+	CK_FUNCTION_LIST_PTR match = NULL;
+	CK_FUNCTION_LIST_PTR module;
+	char *module_name;
+	int i;
+
+	for (i = 0; match == NULL && modules[i] != NULL; i++) {
+		module_name = p11_kit_registered_module_to_name (modules[i]);
+		CuAssertPtrNotNull (tc, module_name);
+		if (strcmp (module_name, name) == 0)
+			match = modules[i];
+		free (module_name);
+	}
+
+	/*
+	 * As a side effect, we should check that the results of this function
+	 * matches the above search.
+	 */
+	module = p11_kit_registered_name_to_module (name);
+	CuAssert(tc, "different result from p11_kit_registered_name_to_module()",
+	         module == match);
+
+	return match;
+}
+
+static void
+test_disable (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR_PTR modules;
+
+	/*
+	 * The module four should be present, as we don't match any prognames
+	 * that it has disabled.
+	 */
+
+	modules = initialize_and_get_modules (tc);
+	CuAssertTrue (tc, lookup_module_with_name (tc, modules, "four") != NULL);
+	finalize_and_free_modules (tc, modules);
+
+	/*
+	 * The module two shouldn't have been loaded, because in its config
+	 * file we have:
+	 *
+	 * disable-in: test-disable
+	 */
+
+	p11_kit_set_progname ("test-disable");
+
+	modules = initialize_and_get_modules (tc);
+	CuAssertTrue (tc, lookup_module_with_name (tc, modules, "four") == NULL);
+	finalize_and_free_modules (tc, modules);
+
+	p11_kit_set_progname (NULL);
+}
+
+static void
+test_disable_later (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR_PTR modules;
+	CK_RV rv;
+
+	/*
+	 * The module two shouldn't be matched, because in its config
+	 * file we have:
+	 *
+	 * disable-in: test-disable
+	 */
+
+	rv = p11_kit_initialize_registered ();
+	CuAssertIntEquals (tc, CKR_OK, rv);
+
+	p11_kit_set_progname ("test-disable");
+
+	modules = p11_kit_registered_modules ();
+	CuAssertTrue (tc, modules != NULL && modules[0] != NULL);
+
+	CuAssertTrue (tc, lookup_module_with_name (tc, modules, "two") == NULL);
+	finalize_and_free_modules (tc, modules);
+
+	p11_kit_set_progname (NULL);
+}
+
+static void
+test_enable (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR_PTR modules;
+
+	/*
+	 * The module three should not be present, as we don't match the current
+	 * program.
+	 */
+
+	modules = initialize_and_get_modules (tc);
+	CuAssertTrue (tc, lookup_module_with_name (tc, modules, "three") == NULL);
+	finalize_and_free_modules (tc, modules);
+
+	/*
+	 * The module three should be loaded here , because in its config
+	 * file we have:
+	 *
+	 * enable-in: test-enable
+	 */
+
+	p11_kit_set_progname ("test-enable");
+
+	modules = initialize_and_get_modules (tc);
+	CuAssertTrue (tc, lookup_module_with_name (tc, modules, "three") != NULL);
+	finalize_and_free_modules (tc, modules);
+
+	p11_kit_set_progname (NULL);
+}
+
+CK_FUNCTION_LIST module;
+
+#ifdef OS_UNIX
+
+#include <sys/wait.h>
+
+static CK_RV
+mock_C_Initialize__with_fork (CK_VOID_PTR init_args)
+{
+	struct timespec ts = { 0, 100 * 1000 * 1000 };
+	CK_RV rv;
+	pid_t child;
+	pid_t ret;
+	int status;
+
+	rv = mock_C_Initialize (init_args);
+	assert (rv == CKR_OK);
+
+	/* Fork during the initialization */
+	child = fork ();
+	if (child == 0) {
+		nanosleep (&ts, NULL);
+		exit (66);
+	}
+
+	ret = waitpid (child, &status, 0);
+	assert (ret == child);
+	assert (WIFEXITED (status));
+	assert (WEXITSTATUS (status) == 66);
+
+	return CKR_OK;
+}
+
+static void
+test_fork_initialization (CuTest *tc)
+{
+	CK_RV rv;
+
+	CuAssertTrue (tc, !mock_module_initialized ());
+
+	/* Build up our own function list */
+	memcpy (&module, &mock_module_no_slots, sizeof (CK_FUNCTION_LIST));
+	module.C_Initialize = mock_C_Initialize__with_fork;
+
+	rv = p11_kit_initialize_module (&module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = p11_kit_finalize_module (&module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertTrue (tc, !mock_module_initialized ());
+}
+
+#endif /* OS_UNIX */
+
+static CK_RV
+mock_C_Initialize__with_recursive (CK_VOID_PTR init_args)
+{
+	/* Recursively initialize, this is broken */
+	return p11_kit_initialize_module (&module);
+}
+
+static void
+test_recursive_initialization (CuTest *tc)
+{
+	CK_RV rv;
+
+	CuAssertTrue (tc, !mock_module_initialized ());
+
+	/* Build up our own function list */
+	memcpy (&module, &mock_module_no_slots, sizeof (CK_FUNCTION_LIST));
+	module.C_Initialize = mock_C_Initialize__with_recursive;
+
+	rv = p11_kit_initialize_module (&module);
+	CuAssertTrue (tc, rv == CKR_FUNCTION_FAILED);
+
+	CuAssertTrue (tc, !mock_module_initialized ());
+}
+
+static p11_mutex_t race_mutex;
+static int initialization_count = 0;
+static int finalization_count = 0;
+
+static CK_RV
+mock_C_Initialize__threaded_race (CK_VOID_PTR init_args)
+{
+	/* Atomically increment value */
+	p11_mutex_lock (&race_mutex);
+	initialization_count += 1;
+	p11_mutex_unlock (&race_mutex);
+
+	p11_sleep_ms (100);
+	return CKR_OK;
+}
+
+static CK_RV
+mock_C_Finalize__threaded_race (CK_VOID_PTR reserved)
+{
+	/* Atomically increment value */
+	p11_mutex_lock (&race_mutex);
+	finalization_count += 1;
+	p11_mutex_unlock (&race_mutex);
+
+	p11_sleep_ms (100);
+	return CKR_OK;
+}
+
+static void *
+initialization_thread (void *data)
+{
+	CuTest *tc = data;
+	CK_RV rv;
+
+	rv = p11_kit_initialize_module (&module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	return tc;
+}
+
+static void *
+finalization_thread (void *data)
+{
+	CuTest *tc = data;
+	CK_RV rv;
+
+	rv = p11_kit_finalize_module (&module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	return tc;
+}
+
+static void
+test_threaded_initialization (CuTest *tc)
+{
+	static const int num_threads = 2;
+	p11_thread_t threads[num_threads];
+	int ret;
+	int i;
+
+	CuAssertTrue (tc, !mock_module_initialized ());
+
+	/* Build up our own function list */
+	memcpy (&module, &mock_module_no_slots, sizeof (CK_FUNCTION_LIST));
+	module.C_Initialize = mock_C_Initialize__threaded_race;
+	module.C_Finalize = mock_C_Finalize__threaded_race;
+
+	initialization_count = 0;
+	finalization_count = 0;
+
+	for (i = 0; i < num_threads; i++) {
+		ret = p11_thread_create (&threads[i], initialization_thread, tc);
+		CuAssertIntEquals (tc, 0, ret);
+		CuAssertTrue (tc, threads[i] != 0);
+	}
+
+	for (i = 0; i < num_threads; i++) {
+		ret = p11_thread_join (threads[i]);
+		CuAssertIntEquals (tc, 0, ret);
+		threads[i] = 0;
+	}
+
+	for (i = 0; i < num_threads; i++) {
+		ret = p11_thread_create (&threads[i], finalization_thread, tc);
+		CuAssertIntEquals (tc, 0, ret);
+		CuAssertTrue (tc, threads[i] != 0);
+	}
+
+	for (i = 0; i < num_threads; i++) {
+		ret = p11_thread_join (threads[i]);
+		CuAssertIntEquals (tc, 0, ret);
+		threads[i] = 0;
+	}
+
+	/* C_Initialize should have been called exactly once */
+	CuAssertIntEquals (tc, 1, initialization_count);
+	CuAssertIntEquals (tc, 1, finalization_count);
+
+	CuAssertTrue (tc, !mock_module_initialized ());
+}
+
+static CK_RV
+mock_C_Initialize__test_mutexes (CK_VOID_PTR args)
+{
+	CK_C_INITIALIZE_ARGS_PTR init_args;
+	void *mutex = NULL;
+	CK_RV rv;
+
+	rv = mock_C_Initialize (NULL);
+	if (rv != CKR_OK)
+		return rv;
+
+	assert (args != NULL);
+	init_args = args;
+
+	rv = (init_args->CreateMutex) (&mutex);
+	assert (rv == CKR_OK);
+
+	rv = (init_args->LockMutex) (mutex);
+	assert (rv == CKR_OK);
+
+	rv = (init_args->UnlockMutex) (mutex);
+	assert (rv == CKR_OK);
+
+	rv = (init_args->DestroyMutex) (mutex);
+	assert (rv == CKR_OK);
+
+	return CKR_OK;
+}
+
+static void
+test_mutexes (CuTest *tc)
+{
+	CK_RV rv;
+
+	CuAssertTrue (tc, !mock_module_initialized ());
+
+	/* Build up our own function list */
+	memcpy (&module, &mock_module_no_slots, sizeof (CK_FUNCTION_LIST));
+	module.C_Initialize = mock_C_Initialize__test_mutexes;
+
+	rv = p11_kit_initialize_module (&module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = p11_kit_finalize_module (&module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertTrue (tc, !mock_module_initialized ());
+}
+
+static void
+test_load_and_initialize (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_INFO info;
+	CK_RV rv;
+	int ret;
+
+	rv = p11_kit_load_initialize_module (BUILDDIR "/.libs/mock-one" SHLEXT, &module);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertTrue (tc, module != NULL);
+
+	rv = (module->C_GetInfo) (&info);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	ret = memcmp (info.manufacturerID, "MOCK MANUFACTURER               ", 32);
+	CuAssertTrue (tc, ret == 0);
+
+	rv = p11_kit_finalize_module (module);
+	CuAssertTrue (tc, ret == CKR_OK);
+}
+
+int
+main (void)
+{
+	CuString *output = CuStringNew ();
+	CuSuite* suite = CuSuiteNew ();
+	int ret;
+
+	putenv ("P11_KIT_STRICT=1");
+	p11_mutex_init (&race_mutex);
+	mock_module_init ();
+	p11_library_init ();
+
+	SUITE_ADD_TEST (suite, test_no_duplicates);
+	SUITE_ADD_TEST (suite, test_disable);
+	SUITE_ADD_TEST (suite, test_disable_later);
+	SUITE_ADD_TEST (suite, test_enable);
+
+#ifdef OS_UNIX
+	SUITE_ADD_TEST (suite, test_fork_initialization);
+#endif
+
+	SUITE_ADD_TEST (suite, test_recursive_initialization);
+	SUITE_ADD_TEST (suite, test_threaded_initialization);
+	SUITE_ADD_TEST (suite, test_mutexes);
+	SUITE_ADD_TEST (suite, test_load_and_initialize);
+
+	p11_kit_be_quiet ();
+
+	CuSuiteRun (suite);
+	CuSuiteSummary (suite, output);
+	CuSuiteDetails (suite, output);
+	printf ("%s\n", output->buffer);
+	ret = suite->failCount;
+	CuSuiteDelete (suite);
+	CuStringDelete (output);
+	return ret;
+}
diff --git a/p11-kit/tests/test-init.c b/p11-kit/tests/test-init.c
index 7df4be9..f2347c8 100644
--- a/p11-kit/tests/test-init.c
+++ b/p11-kit/tests/test-init.c
@@ -38,6 +38,11 @@
 #include <sys/types.h>
 
 #include "library.h"
+#include "mock.h"
+#include "modules.h"
+#include "p11-kit.h"
+#include "private.h"
+#include "virtual.h"
 
 #include <assert.h>
 #include <stdio.h>
@@ -46,11 +51,8 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "p11-kit/p11-kit.h"
-
-#include "mock.h"
-
-CK_FUNCTION_LIST module;
+static CK_FUNCTION_LIST module;
+static p11_mutex_t race_mutex;
 
 #ifdef OS_UNIX
 
@@ -86,21 +88,40 @@ mock_C_Initialize__with_fork (CK_VOID_PTR init_args)
 static void
 test_fork_initialization (CuTest *tc)
 {
+	CK_FUNCTION_LIST_PTR result;
 	CK_RV rv;
 
+	mock_module_reset ();
+
 	/* Build up our own function list */
 	memcpy (&module, &mock_module_no_slots, sizeof (CK_FUNCTION_LIST));
 	module.C_Initialize = mock_C_Initialize__with_fork;
 
-	rv = p11_kit_initialize_module (&module);
+	p11_lock ();
+
+	rv = p11_module_load_inlock_reentrant (&module, 0, &result);
 	CuAssertTrue (tc, rv == CKR_OK);
 
-	rv = p11_kit_finalize_module (&module);
+	p11_unlock ();
+
+	rv = p11_kit_module_initialize (result);
 	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = p11_kit_module_finalize (result);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	p11_lock ();
+
+	rv = p11_module_release_inlock_reentrant (result);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	p11_unlock ();
 }
 
 #endif /* OS_UNIX */
 
+static CK_FUNCTION_LIST *recursive_managed;
+
 static CK_RV
 mock_C_Initialize__with_recursive (CK_VOID_PTR init_args)
 {
@@ -109,8 +130,7 @@ mock_C_Initialize__with_recursive (CK_VOID_PTR init_args)
 	rv = mock_C_Initialize (init_args);
 	assert (rv == CKR_OK);
 
-	/* Recursively initialize, this is broken */
-	return p11_kit_initialize_module (&module);
+	return p11_kit_module_initialize (recursive_managed);
 }
 
 static void
@@ -122,16 +142,24 @@ test_recursive_initialization (CuTest *tc)
 	memcpy (&module, &mock_module_no_slots, sizeof (CK_FUNCTION_LIST));
 	module.C_Initialize = mock_C_Initialize__with_recursive;
 
-	rv = p11_kit_initialize_module (&module);
+	p11_kit_be_quiet ();
+
+	p11_lock ();
+
+	rv = p11_module_load_inlock_reentrant (&module, 0, &recursive_managed);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	p11_unlock ();
+
+	rv = p11_kit_module_initialize (recursive_managed);
 	CuAssertTrue (tc, rv == CKR_FUNCTION_FAILED);
+
+	p11_kit_be_loud ();
 }
 
-static p11_mutex_t race_mutex;
 static int initialization_count = 0;
 static int finalization_count = 0;
 
-#include "private.h"
-
 static CK_RV
 mock_C_Initialize__threaded_race (CK_VOID_PTR init_args)
 {
@@ -156,35 +184,44 @@ mock_C_Finalize__threaded_race (CK_VOID_PTR reserved)
 	return CKR_OK;
 }
 
+typedef struct {
+	CuTest *cu;
+	CK_FUNCTION_LIST_PTR module;
+} ThreadData;
+
 static void *
 initialization_thread (void *data)
 {
-	CuTest *tc = data;
+	ThreadData *td = data;
 	CK_RV rv;
 
-	rv = p11_kit_initialize_module (&module);
-	CuAssertTrue (tc, rv == CKR_OK);
+	assert (td->module != NULL);
+	rv = p11_kit_module_initialize (td->module);
+	CuAssertTrue (td->cu, rv == CKR_OK);
 
-	return tc;
+	return td->cu;
 }
 
 static void *
 finalization_thread (void *data)
 {
-	CuTest *tc = data;
+	ThreadData *td = data;
 	CK_RV rv;
 
-	rv = p11_kit_finalize_module (&module);
-	CuAssertTrue (tc, rv == CKR_OK);
+	assert (td->module != NULL);
+	rv = p11_kit_module_finalize (td->module);
+	CuAssertTrue (td->cu, rv == CKR_OK);
 
-	return tc;
+	return td->cu;
 }
 
 static void
 test_threaded_initialization (CuTest *tc)
 {
-	static const int num_threads = 2;
+	static const int num_threads = 1;
+	ThreadData data[num_threads];
 	p11_thread_t threads[num_threads];
+	CK_RV rv;
 	int ret;
 	int i;
 
@@ -193,11 +230,23 @@ test_threaded_initialization (CuTest *tc)
 	module.C_Initialize = mock_C_Initialize__threaded_race;
 	module.C_Finalize = mock_C_Finalize__threaded_race;
 
+	memset (&data, 0, sizeof (data));
 	initialization_count = 0;
 	finalization_count = 0;
 
+	p11_lock ();
+
 	for (i = 0; i < num_threads; i++) {
-		ret = p11_thread_create (&threads[i], initialization_thread, tc);
+		assert (data[i].module == NULL);
+		rv = p11_module_load_inlock_reentrant (&module, 0, &data[i].module);
+		CuAssertTrue (tc, rv == CKR_OK);
+	}
+
+	p11_unlock ();
+
+	for (i = 0; i < num_threads; i++) {
+		data[i].cu = tc;
+		ret = p11_thread_create (&threads[i], initialization_thread, data + i);
 		CuAssertIntEquals (tc, 0, ret);
 		CuAssertTrue (tc, threads[i] != 0);
 	}
@@ -209,7 +258,7 @@ test_threaded_initialization (CuTest *tc)
 	}
 
 	for (i = 0; i < num_threads; i++) {
-		ret = p11_thread_create (&threads[i], finalization_thread, tc);
+		ret = p11_thread_create (&threads[i], finalization_thread, data + i);
 		CuAssertIntEquals (tc, 0, ret);
 		CuAssertTrue (tc, threads[i] != 0);
 	}
@@ -220,6 +269,16 @@ test_threaded_initialization (CuTest *tc)
 		threads[i] = 0;
 	}
 
+	p11_lock ();
+
+	for (i = 0; i < num_threads; i++) {
+		assert (data[i].module != NULL);
+		rv = p11_module_release_inlock_reentrant (data[i].module);
+		CuAssertTrue (tc, rv == CKR_OK);
+	}
+
+	p11_unlock ();
+
 	/* C_Initialize should have been called exactly once */
 	CuAssertIntEquals (tc, 1, initialization_count);
 	CuAssertIntEquals (tc, 1, finalization_count);
@@ -253,17 +312,22 @@ mock_C_Initialize__test_mutexes (CK_VOID_PTR args)
 static void
 test_mutexes (CuTest *tc)
 {
+	CK_FUNCTION_LIST_PTR result;
 	CK_RV rv;
 
 	/* Build up our own function list */
 	memcpy (&module, &mock_module_no_slots, sizeof (CK_FUNCTION_LIST));
 	module.C_Initialize = mock_C_Initialize__test_mutexes;
 
-	rv = p11_kit_initialize_module (&module);
+	p11_lock ();
+
+	rv = p11_module_load_inlock_reentrant (&module, 0, &result);
 	CuAssertTrue (tc, rv == CKR_OK);
 
-	rv = p11_kit_finalize_module (&module);
+	rv = p11_module_release_inlock_reentrant (result);
 	CuAssertTrue (tc, rv == CKR_OK);
+
+	p11_unlock ();
 }
 
 static void
@@ -274,18 +338,54 @@ test_load_and_initialize (CuTest *tc)
 	CK_RV rv;
 	int ret;
 
-	rv = p11_kit_load_initialize_module (BUILDDIR "/.libs/mock-one" SHLEXT, &module);
-	CuAssertTrue (tc, rv == CKR_OK);
+	module = p11_kit_module_load (BUILDDIR "/.libs/mock-one" SHLEXT, 0);
 	CuAssertTrue (tc, module != NULL);
 
+	rv = p11_kit_module_initialize (module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
 	rv = (module->C_GetInfo) (&info);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	ret = memcmp (info.manufacturerID, "MOCK MANUFACTURER               ", 32);
 	CuAssertTrue (tc, ret == 0);
 
-	rv = p11_kit_finalize_module (module);
-	CuAssertTrue (tc, ret == CKR_OK);
+	rv = p11_kit_module_finalize (module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	p11_kit_module_release (module);
+}
+
+static void
+test_initalize_fail (CuTest *tc)
+{
+	CK_FUNCTION_LIST failer;
+	CK_FUNCTION_LIST *modules[3] = { &mock_module_no_slots, &failer, NULL };
+	CK_RV rv;
+
+	memcpy (&failer, &mock_module, sizeof (CK_FUNCTION_LIST));
+	failer.C_Initialize = mock_C_Initialize__fails;
+
+	mock_module_reset ();
+	p11_kit_be_quiet ();
+
+	rv = p11_kit_modules_initialize (modules, NULL);
+	CuAssertIntEquals (tc, CKR_FUNCTION_FAILED, rv);
+
+	p11_kit_be_loud ();
+
+	/* Failed modules get removed from the list */
+	CuAssertPtrEquals (tc, &mock_module_no_slots, modules[0]);
+	CuAssertPtrEquals (tc, NULL, modules[1]);
+	CuAssertPtrEquals (tc, NULL, modules[2]);
+
+	p11_kit_modules_finalize (modules);
+}
+
+static void
+test_finalize_fail (CuTest *tc)
+{
+
 }
 
 int
@@ -300,14 +400,20 @@ main (void)
 	mock_module_init ();
 	p11_library_init ();
 
+	/* These only work when managed */
+	if (p11_virtual_can_wrap ()) {
+		SUITE_ADD_TEST (suite, test_recursive_initialization);
+		SUITE_ADD_TEST (suite, test_threaded_initialization);
+		SUITE_ADD_TEST (suite, test_mutexes);
+		SUITE_ADD_TEST (suite, test_load_and_initialize);
+
 #ifdef OS_UNIX
-	SUITE_ADD_TEST (suite, test_fork_initialization);
+		SUITE_ADD_TEST (suite, test_fork_initialization);
 #endif
+	}
 
-	SUITE_ADD_TEST (suite, test_recursive_initialization);
-	SUITE_ADD_TEST (suite, test_threaded_initialization);
-	SUITE_ADD_TEST (suite, test_mutexes);
-	SUITE_ADD_TEST (suite, test_load_and_initialize);
+	SUITE_ADD_TEST (suite, test_initalize_fail);
+	SUITE_ADD_TEST (suite, test_finalize_fail);
 
 	CuSuiteRun (suite);
 	CuSuiteSummary (suite, output);
diff --git a/p11-kit/tests/test-iter.c b/p11-kit/tests/test-iter.c
index 08e43b3..451f4be 100644
--- a/p11-kit/tests/test-iter.c
+++ b/p11-kit/tests/test-iter.c
@@ -52,13 +52,10 @@ static CK_FUNCTION_LIST_PTR_PTR
 initialize_and_get_modules (CuTest *tc)
 {
 	CK_FUNCTION_LIST_PTR_PTR modules;
-	CK_RV rv;
 
 	p11_message_quiet ();
 
-	rv = p11_kit_initialize_registered ();
-	CuAssertIntEquals (tc, CKR_OK, rv);
-	modules = p11_kit_registered_modules ();
+	modules = p11_kit_modules_load_and_initialize (0);
 	CuAssertTrue (tc, modules != NULL && modules[0] != NULL);
 
 	p11_message_loud ();
@@ -70,11 +67,8 @@ static void
 finalize_and_free_modules (CuTest *tc,
                            CK_FUNCTION_LIST_PTR_PTR modules)
 {
-	CK_RV rv;
-
-	free (modules);
-	rv = p11_kit_finalize_registered ();
-	CuAssertIntEquals (tc, CKR_OK, rv);
+	p11_kit_modules_finalize (modules);
+	p11_kit_modules_release (modules);
 }
 
 static int
@@ -282,7 +276,8 @@ test_with_session (CuTest *tc)
 	CK_RV rv;
 	int at;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	rv = mock_C_OpenSession (MOCK_SLOT_ONE_ID, CKF_SERIAL_SESSION, NULL, NULL, &session);
@@ -323,7 +318,7 @@ test_with_session (CuTest *tc)
 	rv = mock_module.C_CloseSession (session);
 	CuAssertTrue (tc, rv == CKR_OK);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -337,7 +332,8 @@ test_with_slot (CuTest *tc)
 	CK_RV rv;
 	int at;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	iter = p11_kit_iter_new (NULL);
@@ -369,7 +365,7 @@ test_with_slot (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = (mock_module.C_Finalize) (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -382,7 +378,8 @@ test_with_module (CuTest *tc)
 	CK_RV rv;
 	int at;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	iter = p11_kit_iter_new (NULL);
@@ -411,7 +408,7 @@ test_with_module (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -422,7 +419,8 @@ test_keep_session (CuTest *tc)
 	P11KitIter *iter;
 	CK_RV rv;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	iter = p11_kit_iter_new (NULL);
@@ -438,7 +436,7 @@ test_keep_session (CuTest *tc)
 	rv = mock_module.C_CloseSession (session);
 	CuAssertTrue (tc, rv == CKR_OK);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -750,7 +748,8 @@ test_getslotlist_fail_first (CuTest *tc)
 	CK_RV rv;
 	int at;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	memcpy (&module, &mock_module, sizeof (CK_FUNCTION_LIST));
@@ -770,7 +769,7 @@ test_getslotlist_fail_first (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -782,7 +781,8 @@ test_getslotlist_fail_late (CuTest *tc)
 	CK_RV rv;
 	int at;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	memcpy (&module, &mock_module, sizeof (CK_FUNCTION_LIST));
@@ -802,7 +802,7 @@ test_getslotlist_fail_late (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -814,7 +814,8 @@ test_open_session_fail (CuTest *tc)
 	CK_RV rv;
 	int at;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	memcpy (&module, &mock_module, sizeof (CK_FUNCTION_LIST));
@@ -834,7 +835,7 @@ test_open_session_fail (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -846,7 +847,8 @@ test_find_init_fail (CuTest *tc)
 	CK_RV rv;
 	int at;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	memcpy (&module, &mock_module, sizeof (CK_FUNCTION_LIST));
@@ -866,7 +868,7 @@ test_find_init_fail (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -878,7 +880,8 @@ test_find_objects_fail (CuTest *tc)
 	CK_RV rv;
 	int at;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	memcpy (&module, &mock_module, sizeof (CK_FUNCTION_LIST));
@@ -898,7 +901,7 @@ test_find_objects_fail (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -972,7 +975,8 @@ test_load_attributes_none (CuTest *tc)
 	CK_ATTRIBUTE *attrs;
 	CK_RV rv;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	memcpy (&module, &mock_module, sizeof (CK_FUNCTION_LIST));
@@ -991,7 +995,7 @@ test_load_attributes_none (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -1004,7 +1008,8 @@ test_load_attributes_fail_first (CuTest *tc)
 	CK_ATTRIBUTE *attrs;
 	CK_RV rv;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	memcpy (&module, &mock_module, sizeof (CK_FUNCTION_LIST));
@@ -1024,7 +1029,7 @@ test_load_attributes_fail_first (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
@@ -1037,7 +1042,8 @@ test_load_attributes_fail_late (CuTest *tc)
 	CK_ATTRIBUTE *attrs;
 	CK_RV rv;
 
-	rv = p11_kit_initialize_module (&mock_module);
+	mock_module_reset ();
+	rv = mock_module.C_Initialize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 
 	memcpy (&module, &mock_module, sizeof (CK_FUNCTION_LIST));
@@ -1057,7 +1063,7 @@ test_load_attributes_fail_late (CuTest *tc)
 
 	p11_kit_iter_free (iter);
 
-	rv = p11_kit_finalize_module (&mock_module);
+	rv = mock_module.C_Finalize (NULL);
 	CuAssertTrue (tc, rv == CKR_OK);
 }
 
diff --git a/p11-kit/tests/test-managed.c b/p11-kit/tests/test-managed.c
new file mode 100644
index 0000000..8a6a1e8
--- /dev/null
+++ b/p11-kit/tests/test-managed.c
@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2012 Red Hat Inc
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *     * Redistributions of source code must retain the above
+ *       copyright notice, this list of conditions and the
+ *       following disclaimer.
+ *     * Redistributions in binary form must reproduce the
+ *       above copyright notice, this list of conditions and
+ *       the following disclaimer in the documentation and/or
+ *       other materials provided with the distribution.
+ *     * The names of contributors to this software may not be
+ *       used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * Author: Stef Walter <stefw@redhat.com>
+ */
+
+#include "config.h"
+#include "CuTest.h"
+
+#include "dict.h"
+#include "library.h"
+#include "mock.h"
+#include "modules.h"
+#include "p11-kit.h"
+#include "virtual.h"
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+static CK_FUNCTION_LIST_PTR
+setup_mock_module (CuTest *tc,
+                   CK_SESSION_HANDLE *session)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_RV rv;
+
+	p11_lock ();
+
+	rv = p11_module_load_inlock_reentrant (&mock_module, 0, &module);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertPtrNotNull (tc, module);
+	CuAssertTrue (tc, p11_virtual_is_wrapper (module));
+
+	p11_unlock ();
+
+	rv = p11_kit_module_initialize (module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	if (session) {
+		rv = (module->C_OpenSession) (MOCK_SLOT_ONE_ID,
+		                              CKF_RW_SESSION | CKF_SERIAL_SESSION,
+		                              NULL, NULL, session);
+		CuAssertTrue (tc, rv == CKR_OK);
+	}
+
+	return module;
+}
+
+static void
+teardown_mock_module (CuTest *tc,
+                      CK_FUNCTION_LIST_PTR module)
+{
+	CK_RV rv;
+
+	rv = p11_kit_module_finalize (module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	p11_lock ();
+
+	rv = p11_module_release_inlock_reentrant (module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	p11_unlock ();
+}
+
+static CK_RV
+fail_C_Initialize (void *init_reserved)
+{
+	return CKR_FUNCTION_FAILED;
+}
+
+static void
+test_initialize_finalize (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = module->C_Initialize (NULL);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = module->C_Finalize (NULL);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_initialize_fail (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_FUNCTION_LIST base;
+	CK_RV rv;
+
+	memcpy (&base, &mock_module, sizeof (CK_FUNCTION_LIST));
+	base.C_Initialize = fail_C_Initialize;
+
+	p11_lock ();
+
+	rv = p11_module_load_inlock_reentrant (&base, 0, &module);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	p11_unlock ();
+
+	rv = p11_kit_module_initialize (module);
+	CuAssertTrue (tc, rv == CKR_FUNCTION_FAILED);
+}
+
+/* Bring in all the mock module tests */
+#include "test-mock.c"
+
+int
+main (void)
+{
+	CuString *output = CuStringNew ();
+	CuSuite* suite = CuSuiteNew ();
+	int ret;
+
+	putenv ("P11_KIT_STRICT=1");
+	mock_module_init ();
+	p11_library_init ();
+
+	SUITE_ADD_TEST (suite, test_initialize_finalize);
+	SUITE_ADD_TEST (suite, test_initialize_fail);
+	test_mock_add_tests (suite);
+
+	p11_kit_be_quiet ();
+
+	CuSuiteRun (suite);
+	CuSuiteSummary (suite, output);
+	CuSuiteDetails (suite, output);
+	printf ("%s\n", output->buffer);
+	ret = suite->failCount;
+	CuSuiteDelete (suite);
+	CuStringDelete (output);
+	return ret;
+}
diff --git a/p11-kit/tests/test-mock.c b/p11-kit/tests/test-mock.c
new file mode 100644
index 0000000..955174f
--- /dev/null
+++ b/p11-kit/tests/test-mock.c
@@ -0,0 +1,1687 @@
+/*
+ * Copyright (c) 2012 Stefan Walter
+ * Copyright (c) 2012-2013 Red Hat Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *     * Redistributions of source code must retain the above
+ *       copyright notice, this list of conditions and the
+ *       following disclaimer.
+ *     * Redistributions in binary form must reproduce the
+ *       above copyright notice, this list of conditions and
+ *       the following disclaimer in the documentation and/or
+ *       other materials provided with the distribution.
+ *     * The names of contributors to this software may not be
+ *       used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * Author: Stef Walter <stef@thewalter.net>
+ */
+
+#include "CuTest.h"
+
+#include "library.h"
+#include "mock.h"
+#include "p11-kit.h"
+
+#include <sys/types.h>
+#include <assert.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static void
+test_get_info (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_INFO info;
+	CK_RV rv;
+	char *string;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_GetInfo) (&info);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, CRYPTOKI_VERSION_MAJOR, info.cryptokiVersion.major);
+	CuAssertIntEquals (tc, CRYPTOKI_VERSION_MINOR, info.cryptokiVersion.minor);
+	string = p11_kit_space_strdup (info.manufacturerID, sizeof (info.manufacturerID));
+	CuAssertStrEquals (tc, "MOCK MANUFACTURER", string);
+	free (string);
+	string = p11_kit_space_strdup (info.libraryDescription, sizeof (info.libraryDescription));
+	CuAssertStrEquals (tc, "MOCK LIBRARY", string);
+	free (string);
+	CuAssertIntEquals (tc, 0, info.flags);
+	CuAssertIntEquals (tc, 45, info.libraryVersion.major);
+	CuAssertIntEquals (tc, 145, info.libraryVersion.minor);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_slot_list (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SLOT_ID slot_list[8];
+	CK_ULONG count;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	/* Normal module has 2 slots, one with token present */
+	rv = (module->C_GetSlotList) (CK_TRUE, NULL, &count);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, 1, count);
+	rv = (module->C_GetSlotList) (CK_FALSE, NULL, &count);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, 2, count);
+
+	count = 8;
+	rv = (module->C_GetSlotList) (CK_TRUE, slot_list, &count);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, 1, count);
+	CuAssertIntEquals (tc, MOCK_SLOT_ONE_ID, slot_list[0]);
+
+	count = 8;
+	rv = (module->C_GetSlotList) (CK_FALSE, slot_list, &count);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, 2, count);
+	CuAssertIntEquals (tc, MOCK_SLOT_ONE_ID, slot_list[0]);
+	CuAssertIntEquals (tc, MOCK_SLOT_TWO_ID, slot_list[1]);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_slot_info (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SLOT_INFO info;
+	char *string;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_GetSlotInfo) (MOCK_SLOT_ONE_ID, &info);
+	CuAssertTrue (tc, rv == CKR_OK);
+	string = p11_kit_space_strdup (info.slotDescription, sizeof (info.slotDescription));
+	CuAssertStrEquals (tc, "TEST SLOT", string);
+	free (string);
+	string = p11_kit_space_strdup (info.manufacturerID, sizeof (info.manufacturerID));
+	CuAssertStrEquals (tc, "TEST MANUFACTURER", string);
+	free (string);
+	CuAssertIntEquals (tc, CKF_TOKEN_PRESENT | CKF_REMOVABLE_DEVICE, info.flags);
+	CuAssertIntEquals (tc, 55, info.hardwareVersion.major);
+	CuAssertIntEquals (tc, 155, info.hardwareVersion.minor);
+	CuAssertIntEquals (tc, 65, info.firmwareVersion.major);
+	CuAssertIntEquals (tc, 165, info.firmwareVersion.minor);
+
+	rv = (module->C_GetSlotInfo) (MOCK_SLOT_TWO_ID, &info);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, CKF_REMOVABLE_DEVICE, info.flags);
+
+	rv = (module->C_GetSlotInfo) (0, &info);
+	CuAssertTrue (tc, rv == CKR_SLOT_ID_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_token_info (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_TOKEN_INFO info;
+	char *string;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_GetTokenInfo) (MOCK_SLOT_ONE_ID, &info);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	string = p11_kit_space_strdup (info.label, sizeof (info.label));
+	CuAssertStrEquals (tc, "TEST LABEL", string);
+	free (string);
+	string = p11_kit_space_strdup (info.manufacturerID, sizeof (info.manufacturerID));
+	CuAssertStrEquals (tc, "TEST MANUFACTURER", string);
+	free (string);
+	string = p11_kit_space_strdup (info.model, sizeof (info.model));
+	CuAssertStrEquals (tc, "TEST MODEL", string);
+	free (string);
+	string = p11_kit_space_strdup (info.serialNumber, sizeof (info.serialNumber));
+	CuAssertStrEquals (tc, "TEST SERIAL", string);
+	free (string);
+	CuAssertIntEquals (tc, CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_CLOCK_ON_TOKEN | CKF_TOKEN_INITIALIZED, info.flags);
+	CuAssertIntEquals (tc, 1, info.ulMaxSessionCount);
+	CuAssertIntEquals (tc, 2, info.ulSessionCount);
+	CuAssertIntEquals (tc, 3, info.ulMaxRwSessionCount);
+	CuAssertIntEquals (tc, 4, info.ulRwSessionCount);
+	CuAssertIntEquals (tc, 5, info.ulMaxPinLen);
+	CuAssertIntEquals (tc, 6, info.ulMinPinLen);
+	CuAssertIntEquals (tc, 7, info.ulTotalPublicMemory);
+	CuAssertIntEquals (tc, 8, info.ulFreePublicMemory);
+	CuAssertIntEquals (tc, 9, info.ulTotalPrivateMemory);
+	CuAssertIntEquals (tc, 10, info.ulFreePrivateMemory);
+	CuAssertIntEquals (tc, 75, info.hardwareVersion.major);
+	CuAssertIntEquals (tc, 175, info.hardwareVersion.minor);
+	CuAssertIntEquals (tc, 85, info.firmwareVersion.major);
+	CuAssertIntEquals (tc, 185, info.firmwareVersion.minor);
+	CuAssertTrue (tc, memcmp (info.utcTime, "1999052509195900", sizeof (info.utcTime)) == 0);
+
+	rv = (module->C_GetTokenInfo) (MOCK_SLOT_TWO_ID, &info);
+	CuAssertTrue (tc, rv == CKR_TOKEN_NOT_PRESENT);
+
+	rv = (module->C_GetTokenInfo) (0, &info);
+	CuAssertTrue (tc, rv == CKR_SLOT_ID_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_mechanism_list (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_MECHANISM_TYPE mechs[8];
+	CK_ULONG count;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_GetMechanismList) (MOCK_SLOT_ONE_ID, NULL, &count);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, 2, count);
+	rv = (module->C_GetMechanismList) (MOCK_SLOT_TWO_ID, NULL, &count);
+	CuAssertTrue (tc, rv == CKR_TOKEN_NOT_PRESENT);
+	rv = (module->C_GetMechanismList) (0, NULL, &count);
+	CuAssertTrue (tc, rv == CKR_SLOT_ID_INVALID);
+
+	count = 8;
+	rv = (module->C_GetMechanismList) (MOCK_SLOT_ONE_ID, mechs, &count);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, 2, count);
+	CuAssertIntEquals (tc, mechs[0], CKM_MOCK_CAPITALIZE);
+	CuAssertIntEquals (tc, mechs[1], CKM_MOCK_PREFIX);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_mechanism_info (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_MECHANISM_INFO info;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_GetMechanismInfo) (MOCK_SLOT_ONE_ID, CKM_MOCK_CAPITALIZE, &info);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, 512, info.ulMinKeySize);
+	CuAssertIntEquals (tc, 4096, info.ulMaxKeySize);
+	CuAssertIntEquals (tc, CKF_ENCRYPT | CKF_DECRYPT, info.flags);
+
+	rv = (module->C_GetMechanismInfo) (MOCK_SLOT_ONE_ID, CKM_MOCK_PREFIX, &info);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, 2048, info.ulMinKeySize);
+	CuAssertIntEquals (tc, 2048, info.ulMaxKeySize);
+	CuAssertIntEquals (tc, CKF_SIGN | CKF_VERIFY, info.flags);
+
+	rv = (module->C_GetMechanismInfo) (MOCK_SLOT_TWO_ID, CKM_MOCK_PREFIX, &info);
+	CuAssertTrue (tc, rv == CKR_TOKEN_NOT_PRESENT);
+	rv = (module->C_GetMechanismInfo) (MOCK_SLOT_ONE_ID, 0, &info);
+	CuAssertTrue (tc, rv == CKR_MECHANISM_INVALID);
+	rv = (module->C_GetMechanismInfo) (0, CKM_MOCK_PREFIX, &info);
+	CuAssertTrue (tc, rv == CKR_SLOT_ID_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_init_token (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_InitToken) (MOCK_SLOT_ONE_ID, (CK_UTF8CHAR_PTR)"TEST PIN", 8, (CK_UTF8CHAR_PTR)"TEST LABEL");
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_InitToken) (MOCK_SLOT_ONE_ID, (CK_UTF8CHAR_PTR)"OTHER", 5, (CK_UTF8CHAR_PTR)"TEST LABEL");
+	CuAssertTrue (tc, rv == CKR_PIN_INVALID);
+	rv = (module->C_InitToken) (MOCK_SLOT_TWO_ID, (CK_UTF8CHAR_PTR)"TEST PIN", 8, (CK_UTF8CHAR_PTR)"TEST LABEL");
+	CuAssertTrue (tc, rv == CKR_TOKEN_NOT_PRESENT);
+	rv = (module->C_InitToken) (0, (CK_UTF8CHAR_PTR)"TEST PIN", 8, (CK_UTF8CHAR_PTR)"TEST LABEL");
+	CuAssertTrue (tc, rv == CKR_SLOT_ID_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_wait_for_slot_event (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SLOT_ID slot;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_WaitForSlotEvent) (0, &slot, NULL);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, slot, MOCK_SLOT_TWO_ID);
+
+	rv = (module->C_WaitForSlotEvent) (CKF_DONT_BLOCK, &slot, NULL);
+	CuAssertTrue (tc, rv == CKR_NO_EVENT);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_open_close_session (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_OpenSession) (MOCK_SLOT_TWO_ID, CKF_SERIAL_SESSION, NULL, NULL, &session);
+	CuAssertTrue (tc, rv == CKR_TOKEN_NOT_PRESENT);
+	rv = (module->C_OpenSession) (0, CKF_SERIAL_SESSION, NULL, NULL, &session);
+	CuAssertTrue (tc, rv == CKR_SLOT_ID_INVALID);
+
+	rv = (module->C_OpenSession) (MOCK_SLOT_ONE_ID, CKF_SERIAL_SESSION, NULL, NULL, &session);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertTrue (tc, session != 0);
+
+	rv = (module->C_CloseSession) (session);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_CloseSession) (session);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_close_all_sessions (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_OpenSession) (MOCK_SLOT_ONE_ID, CKF_SERIAL_SESSION, NULL, NULL, &session);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertTrue (tc, session != 0);
+
+	rv = (module->C_CloseAllSessions) (MOCK_SLOT_ONE_ID);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_CloseSession) (session);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_function_status (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_GetFunctionStatus) (session);
+	CuAssertTrue (tc, rv == CKR_FUNCTION_NOT_PARALLEL);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_cancel_function (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_CancelFunction) (session);
+	CuAssertTrue (tc, rv == CKR_FUNCTION_NOT_PARALLEL);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_session_info (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_SESSION_INFO info;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, NULL);
+
+	rv = (module->C_GetSessionInfo) (0, &info);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_OpenSession) (MOCK_SLOT_ONE_ID, CKF_SERIAL_SESSION, NULL, NULL, &session);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertTrue (tc, session != 0);
+
+	rv = (module->C_GetSessionInfo) (session, &info);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, MOCK_SLOT_ONE_ID, info.slotID);
+	CuAssertIntEquals (tc, CKS_RO_PUBLIC_SESSION, info.state);
+	CuAssertIntEquals (tc, CKF_SERIAL_SESSION, info.flags);
+	CuAssertIntEquals (tc, 1414, info.ulDeviceError);
+
+	rv = (module->C_OpenSession) (MOCK_SLOT_ONE_ID, CKF_RW_SESSION | CKF_SERIAL_SESSION, NULL, NULL, &session);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertTrue (tc, session != 0);
+
+	rv = (module->C_GetSessionInfo) (session, &info);
+	CuAssertTrue (tc, rv == CKR_OK);
+	CuAssertIntEquals (tc, MOCK_SLOT_ONE_ID, info.slotID);
+	CuAssertIntEquals (tc, CKS_RW_PUBLIC_SESSION, info.state);
+	CuAssertIntEquals (tc, CKF_SERIAL_SESSION | CKF_RW_SESSION, info.flags);
+	CuAssertIntEquals (tc, 1414, info.ulDeviceError);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_init_pin (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_InitPIN) (0, (CK_UTF8CHAR_PTR)"TEST PIN", 8);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_InitPIN) (session, (CK_UTF8CHAR_PTR)"TEST PIN", 8);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_InitPIN) (session, (CK_UTF8CHAR_PTR)"OTHER", 5);
+	CuAssertTrue (tc, rv == CKR_PIN_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_set_pin (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_SetPIN) (0, (CK_UTF8CHAR_PTR)"booo", 4, (CK_UTF8CHAR_PTR)"TEST PIN", 8);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_SetPIN) (session, (CK_UTF8CHAR_PTR)"booo", 4, (CK_UTF8CHAR_PTR)"TEST PIN", 8);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_SetPIN) (session, (CK_UTF8CHAR_PTR)"other", 5, (CK_UTF8CHAR_PTR)"OTHER", 5);
+	CuAssertTrue (tc, rv == CKR_PIN_INCORRECT);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_operation_state (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_BYTE state[128];
+	CK_ULONG state_len;
+	CK_SESSION_HANDLE session = 0;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	state_len = sizeof (state);
+	rv = (module->C_GetOperationState) (0, state, &state_len);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	state_len = sizeof (state);
+	rv = (module->C_GetOperationState) (session, state, &state_len);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_SetOperationState) (session, state, state_len, 355, 455);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_SetOperationState) (0, state, state_len, 355, 455);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_login_logout (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_Login) (0, CKU_USER, (CK_UTF8CHAR_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_Login) (session, CKU_USER, (CK_UTF8CHAR_PTR)"bo", 2);
+	CuAssertTrue (tc, rv == CKR_PIN_INCORRECT);
+
+	rv = (module->C_Login) (session, CKU_USER, (CK_UTF8CHAR_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_Logout) (session);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_Logout) (session);
+	CuAssertTrue (tc, rv == CKR_USER_NOT_LOGGED_IN);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_attribute_value (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_ATTRIBUTE attrs[8];
+	char label[32];
+	CK_OBJECT_CLASS klass;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	attrs[0].type = CKA_CLASS;
+	attrs[0].pValue = &klass;
+	attrs[0].ulValueLen = sizeof (klass);
+	attrs[1].type = CKA_LABEL;
+	attrs[1].pValue = label;
+	attrs[1].ulValueLen = 2; /* too small */
+	attrs[2].type = CKA_BITS_PER_PIXEL;
+	attrs[2].pValue = NULL;
+	attrs[2].ulValueLen = 0;
+
+	rv = (module->C_GetAttributeValue) (session, MOCK_PRIVATE_KEY_CAPITALIZE, attrs, 3);
+	CuAssertTrue (tc, rv == CKR_USER_NOT_LOGGED_IN);
+
+	rv = (module->C_GetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 2);
+	CuAssertTrue (tc, rv == CKR_BUFFER_TOO_SMALL);
+
+	/* Get right size */
+	attrs[1].pValue = NULL;
+	attrs[1].ulValueLen = 0;
+
+	rv = (module->C_GetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 2);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_GetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 3);
+	CuAssertTrue (tc, rv == CKR_ATTRIBUTE_TYPE_INVALID);
+
+	CuAssertIntEquals (tc, CKO_PUBLIC_KEY, klass);
+	CuAssertIntEquals (tc, 21, attrs[1].ulValueLen);
+	CuAssertPtrEquals (tc, NULL, attrs[1].pValue);
+	attrs[1].pValue = label;
+	attrs[1].ulValueLen = sizeof (label);
+	CuAssertTrue (tc, (CK_ULONG)-1 == attrs[2].ulValueLen);
+	CuAssertPtrEquals (tc, NULL, attrs[2].pValue);
+
+	rv = (module->C_GetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 3);
+	CuAssertTrue (tc, rv == CKR_ATTRIBUTE_TYPE_INVALID);
+
+	CuAssertIntEquals (tc, CKO_PUBLIC_KEY, klass);
+	CuAssertIntEquals (tc, 21, attrs[1].ulValueLen);
+	CuAssertPtrEquals (tc, label, attrs[1].pValue);
+	CuAssertTrue (tc, memcmp (label, "Public Capitalize Key", attrs[1].ulValueLen) == 0);
+	CuAssertTrue (tc, (CK_ULONG)-1 == attrs[2].ulValueLen);
+	CuAssertPtrEquals (tc, NULL, attrs[2].pValue);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_set_attribute_value (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_ATTRIBUTE attrs[8];
+	char label[32];
+	CK_ULONG bits;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	strcpy (label, "Blahooo");
+	bits = 1555;
+
+	attrs[0].type = CKA_LABEL;
+	attrs[0].pValue = label;
+	attrs[0].ulValueLen = strlen (label);
+	attrs[1].type = CKA_BITS_PER_PIXEL;
+	attrs[1].pValue = &bits;
+	attrs[1].ulValueLen = sizeof (bits);
+
+	rv = (module->C_SetAttributeValue) (session, MOCK_PRIVATE_KEY_CAPITALIZE, attrs, 2);
+	CuAssertTrue (tc, rv == CKR_USER_NOT_LOGGED_IN);
+
+	rv = (module->C_SetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 2);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	memset (label, 0, sizeof (label));
+	bits = 0;
+
+	rv = (module->C_GetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 2);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, bits, 1555);
+	CuAssertIntEquals (tc, 7, attrs[0].ulValueLen);
+	CuAssertTrue (tc, memcmp (label, "Blahooo", attrs[0].ulValueLen) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_create_object (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_OBJECT_HANDLE object;
+	CK_ATTRIBUTE attrs[8];
+	char label[32];
+	CK_ULONG bits;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	strcpy (label, "Blahooo");
+	bits = 1555;
+
+	attrs[0].type = CKA_LABEL;
+	attrs[0].pValue = label;
+	attrs[0].ulValueLen = strlen (label);
+	attrs[1].type = CKA_BITS_PER_PIXEL;
+	attrs[1].pValue = &bits;
+	attrs[1].ulValueLen = sizeof (bits);
+
+	rv = (module->C_CreateObject) (0, attrs, 2, &object);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_CreateObject) (session, attrs, 2, &object);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	attrs[0].ulValueLen = sizeof (label);
+	memset (label, 0, sizeof (label));
+	bits = 0;
+
+	rv = (module->C_GetAttributeValue) (session, object, attrs, 2);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, bits, 1555);
+	CuAssertIntEquals (tc, 7, attrs[0].ulValueLen);
+	CuAssertTrue (tc, memcmp (label, "Blahooo", attrs[0].ulValueLen) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_copy_object (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_OBJECT_HANDLE object;
+	CK_ATTRIBUTE attrs[8];
+	char label[32];
+	CK_ULONG bits;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	bits = 1555;
+
+	attrs[0].type = CKA_BITS_PER_PIXEL;
+	attrs[0].pValue = &bits;
+	attrs[0].ulValueLen = sizeof (bits);
+
+	rv = (module->C_CopyObject) (session, 1333, attrs, 1, &object);
+	CuAssertTrue (tc, rv == CKR_OBJECT_HANDLE_INVALID);
+
+	rv = (module->C_CopyObject) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 1, &object);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	attrs[1].type = CKA_LABEL;
+	attrs[1].pValue = label;
+	attrs[1].ulValueLen = sizeof (label);
+	bits = 0;
+
+	rv = (module->C_GetAttributeValue) (session, object, attrs, 2);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, bits, 1555);
+	CuAssertIntEquals (tc, 21, attrs[1].ulValueLen);
+	CuAssertTrue (tc, memcmp (label, "Public Capitalize Key", attrs[1].ulValueLen) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_destroy_object (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_ATTRIBUTE attrs[8];
+	char label[32];
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	attrs[0].type = CKA_LABEL;
+	attrs[0].pValue = label;
+	attrs[0].ulValueLen = sizeof (label);
+
+	rv = (module->C_GetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 1);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_DestroyObject) (0, MOCK_PUBLIC_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_DestroyObject) (session, MOCK_PUBLIC_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_GetAttributeValue) (session, MOCK_PUBLIC_KEY_CAPITALIZE, attrs, 1);
+	CuAssertTrue (tc, rv == CKR_OBJECT_HANDLE_INVALID);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_get_object_size (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_ULONG size;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_GetObjectSize) (session, 1333, &size);
+	CuAssertTrue (tc, rv == CKR_OBJECT_HANDLE_INVALID);
+
+	rv = (module->C_GetObjectSize) (session, MOCK_PUBLIC_KEY_CAPITALIZE, &size);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	/* The number here is the length of all attributes added up */
+	CuAssertIntEquals (tc, sizeof (CK_ULONG) == 8 ? 44 : 36, size);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_find_objects (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_OBJECT_CLASS klass = CKO_PUBLIC_KEY;
+	CK_ATTRIBUTE attr = { CKA_CLASS, &klass, sizeof (klass) };
+	CK_OBJECT_HANDLE objects[16];
+	CK_ULONG count;
+	CK_ULONG i;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_FindObjectsInit) (0, &attr, 1);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_FindObjectsInit) (session, &attr, 1);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_FindObjects) (0, objects, 16, &count);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_FindObjects) (session, objects, 16, &count);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertTrue (tc, count < 16);
+
+	/* Make sure we get the capitalize public key */
+	for (i = 0; i < count; i++) {
+		if (objects[i] == MOCK_PUBLIC_KEY_CAPITALIZE)
+			break;
+	}
+	CuAssertTrue (tc, i != count);
+
+	/* Make sure we get the prefix public key */
+	for (i = 0; i < count; i++) {
+		if (objects[i] == MOCK_PUBLIC_KEY_PREFIX)
+			break;
+	}
+	CuAssertTrue (tc, i != count);
+
+	/* Make sure all public keys */
+	for (i = 0; i < count; i++) {
+		klass = (CK_ULONG)-1;
+		rv = (module->C_GetAttributeValue) (session, objects[i], &attr, 1);
+		CuAssertTrue (tc, rv == CKR_OK);
+		CuAssertIntEquals (tc, CKO_PUBLIC_KEY, klass);
+	}
+
+	rv = (module->C_FindObjectsFinal) (session);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_FindObjectsFinal) (session);
+	CuAssertTrue (tc, rv == CKR_OPERATION_NOT_INITIALIZED);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_encrypt (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_CAPITALIZE, NULL, 0 };
+	CK_BYTE data[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_EncryptInit) (session, &mech, MOCK_PUBLIC_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_KEY_HANDLE_INVALID);
+
+	rv = (module->C_EncryptInit) (session, &mech, MOCK_PUBLIC_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_Encrypt) (0, (CK_BYTE_PTR)"blah", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_Encrypt) (session, (CK_BYTE_PTR)"blah", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 4, length);
+	CuAssertTrue (tc, memcmp (data, "BLAH", 4) == 0);
+
+	rv = (module->C_EncryptInit) (session, &mech, MOCK_PUBLIC_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_EncryptUpdate) (0, (CK_BYTE_PTR)"blah", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_EncryptUpdate) (session, (CK_BYTE_PTR)"sLurm", 5, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 5, length);
+	CuAssertTrue (tc, memcmp (data, "SLURM", 5) == 0);
+
+	length = sizeof (data);
+	rv = (module->C_EncryptFinal) (0, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_EncryptFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_decrypt (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_CAPITALIZE, NULL, 0 };
+	CK_BYTE data[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_Login) (session, CKU_USER, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_DecryptInit) (session, &mech, MOCK_PRIVATE_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_KEY_HANDLE_INVALID);
+
+	rv = (module->C_DecryptInit) (session, &mech, MOCK_PRIVATE_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_Decrypt) (0, (CK_BYTE_PTR)"bLAH", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_Decrypt) (session, (CK_BYTE_PTR)"BLAh", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 4, length);
+	CuAssertTrue (tc, memcmp (data, "blah", 4) == 0);
+
+	rv = (module->C_DecryptInit) (session, &mech, MOCK_PRIVATE_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptUpdate) (0, (CK_BYTE_PTR)"blah", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptUpdate) (session, (CK_BYTE_PTR)"sLuRM", 5, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 5, length);
+	CuAssertTrue (tc, memcmp (data, "slurm", 5) == 0);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptFinal) (0, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_digest (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_COUNT, NULL, 0 };
+	CK_BYTE digest[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_DigestInit) (0, &mech);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_DigestInit) (session, &mech);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (digest);
+	rv = (module->C_Digest) (0, (CK_BYTE_PTR)"bLAH", 4, digest, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (digest);
+	rv = (module->C_Digest) (session, (CK_BYTE_PTR)"BLAh", 4, digest, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 1, length);
+	CuAssertTrue (tc, memcmp (digest, "4", 1) == 0);
+
+	rv = (module->C_DigestInit) (session, &mech);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_DigestUpdate) (0, (CK_BYTE_PTR)"blah", 4);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_DigestUpdate) (session, (CK_BYTE_PTR)"sLuRM", 5);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	/* Adds the the value of object handle to hash: 6 */
+	CuAssertIntEquals (tc, 6, MOCK_PUBLIC_KEY_PREFIX);
+	rv = (module->C_DigestKey) (session, MOCK_PUBLIC_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_DigestUpdate) (session, (CK_BYTE_PTR)"Other", 5);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (digest);
+	rv = (module->C_DigestFinal) (0, digest, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (digest);
+	rv = (module->C_DigestFinal) (session, digest, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 2, length);
+	CuAssertTrue (tc, memcmp (digest, "16", 2) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_sign (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_PREFIX, "prefix:", 7 };
+	CK_BYTE signature[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_Login) (session, CKU_USER, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_SignInit) (0, &mech, MOCK_PRIVATE_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_SignInit) (session, &mech, MOCK_PRIVATE_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_Login) (session, CKU_CONTEXT_SPECIFIC, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (signature);
+	rv = (module->C_Sign) (0, (CK_BYTE_PTR)"bLAH", 4, signature, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (signature);
+	rv = (module->C_Sign) (session, (CK_BYTE_PTR)"BLAh", 4, signature, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 13, length);
+	CuAssertTrue (tc, memcmp (signature, "prefix:value4", 13) == 0);
+
+	rv = (module->C_SignInit) (session, &mech, MOCK_PRIVATE_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_Login) (session, CKU_CONTEXT_SPECIFIC, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_SignUpdate) (0, (CK_BYTE_PTR)"blah", 4);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_SignUpdate) (session, (CK_BYTE_PTR)"sLuRM", 5);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_SignUpdate) (session, (CK_BYTE_PTR)"Other", 5);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (signature);
+	rv = (module->C_SignFinal) (0, signature, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (signature);
+	rv = (module->C_SignFinal) (session, signature, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 14, length);
+	CuAssertTrue (tc, memcmp (signature, "prefix:value10", 2) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_sign_recover (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_PREFIX, "prefix:", 7 };
+	CK_BYTE signature[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_Login) (session, CKU_USER, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_SignRecoverInit) (0, &mech, MOCK_PRIVATE_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_SignRecoverInit) (session, &mech, MOCK_PRIVATE_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_Login) (session, CKU_CONTEXT_SPECIFIC, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (signature);
+	rv = (module->C_SignRecover) (0, (CK_BYTE_PTR)"bLAH", 4, signature, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (signature);
+	rv = (module->C_SignRecover) (session, (CK_BYTE_PTR)"BLAh", 4, signature, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 16, length);
+	CuAssertTrue (tc, memcmp (signature, "prefix:valueBLAh", 16) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_verify (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_PREFIX, "prefix:", 7 };
+	CK_BYTE signature[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_VerifyInit) (0, &mech, MOCK_PUBLIC_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_VerifyInit) (session, &mech, MOCK_PUBLIC_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = 13;
+	memcpy (signature, "prefix:value4", length);
+	rv = (module->C_Verify) (0, (CK_BYTE_PTR)"bLAH", 4, signature, 5);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_Verify) (session, (CK_BYTE_PTR)"BLAh", 4, signature, length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_VerifyInit) (session, &mech, MOCK_PUBLIC_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_VerifyUpdate) (0, (CK_BYTE_PTR)"blah", 4);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_VerifyUpdate) (session, (CK_BYTE_PTR)"sLuRM", 5);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_VerifyUpdate) (session, (CK_BYTE_PTR)"Other", 5);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = 14;
+	memcpy (signature, "prefix:value10", length);
+
+	rv = (module->C_VerifyFinal) (session, signature, 5);
+	CuAssertTrue (tc, rv == CKR_SIGNATURE_LEN_RANGE);
+
+	rv = (module->C_VerifyFinal) (session, signature, length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_verify_recover (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_PREFIX, "prefix:", 7 };
+	CK_BYTE data[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_VerifyRecoverInit) (0, &mech, MOCK_PUBLIC_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_VerifyRecoverInit) (session, &mech, MOCK_PUBLIC_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_VerifyRecover) (0, (CK_BYTE_PTR)"prefix:valueBLah", 16, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_VerifyRecover) (session, (CK_BYTE_PTR)"prefix:valueBLah", 16, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 4, length);
+	CuAssertTrue (tc, memcmp (data, "BLah", 4) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_digest_encrypt (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_CAPITALIZE, NULL, 0 };
+	CK_MECHANISM dmech = { CKM_MOCK_COUNT, NULL, 0 };
+	CK_BYTE data[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_EncryptInit) (session, &mech, MOCK_PUBLIC_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_DigestInit) (session, &dmech);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_DigestEncryptUpdate) (0, (CK_BYTE_PTR)"blah", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_DigestEncryptUpdate) (session, (CK_BYTE_PTR)"blah", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 4, length);
+	CuAssertTrue (tc, memcmp (data, "BLAH", 4) == 0);
+
+	length = sizeof (data);
+	rv = (module->C_EncryptFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_DigestFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 1, length);
+	CuAssertTrue (tc, memcmp (data, "4", 1) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_decrypt_digest (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_CAPITALIZE, NULL, 0 };
+	CK_MECHANISM dmech = { CKM_MOCK_COUNT, NULL, 0 };
+	CK_BYTE data[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_Login) (session, CKU_USER, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_DecryptInit) (session, &mech, MOCK_PRIVATE_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_DigestInit) (session, &dmech);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptDigestUpdate) (0, (CK_BYTE_PTR)"BLAH", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptDigestUpdate) (session, (CK_BYTE_PTR)"BLAH", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 4, length);
+	CuAssertTrue (tc, memcmp (data, "blah", 4) == 0);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_DigestFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 1, length);
+	CuAssertTrue (tc, memcmp (data, "4", 1) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_sign_encrypt (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_CAPITALIZE, NULL, 0 };
+	CK_MECHANISM smech = { CKM_MOCK_PREFIX, "p:", 2 };
+	CK_BYTE data[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_Login) (session, CKU_USER, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_EncryptInit) (session, &mech, MOCK_PUBLIC_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_SignInit) (session, &smech, MOCK_PRIVATE_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_Login) (session, CKU_CONTEXT_SPECIFIC, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_SignEncryptUpdate) (0, (CK_BYTE_PTR)"blah", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_SignEncryptUpdate) (session, (CK_BYTE_PTR)"blah", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 4, length);
+	CuAssertTrue (tc, memcmp (data, "BLAH", 4) == 0);
+
+	length = sizeof (data);
+	rv = (module->C_EncryptFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_SignFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 8, length);
+	CuAssertTrue (tc, memcmp (data, "p:value4", 1) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_decrypt_verify (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_CAPITALIZE, NULL, 0 };
+	CK_MECHANISM vmech = { CKM_MOCK_PREFIX, "p:", 2 };
+	CK_BYTE data[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_Login) (session, CKU_USER, (CK_BYTE_PTR)"booo", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_DecryptInit) (session, &mech, MOCK_PRIVATE_KEY_CAPITALIZE);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_VerifyInit) (session, &vmech, MOCK_PUBLIC_KEY_PREFIX);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptVerifyUpdate) (0, (CK_BYTE_PTR)"BLAH", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptVerifyUpdate) (session, (CK_BYTE_PTR)"BLAH", 4, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 4, length);
+	CuAssertTrue (tc, memcmp (data, "blah", 4) == 0);
+
+	length = sizeof (data);
+	rv = (module->C_DecryptFinal) (session, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_VerifyFinal) (session, (CK_BYTE_PTR)"p:value4", 8);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_generate_key (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_OBJECT_HANDLE object;
+	CK_MECHANISM mech = { CKM_MOCK_GENERATE, NULL, 0 };
+	CK_ATTRIBUTE attrs[8];
+	char label[32];
+	char value[64];
+	CK_ULONG bits;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	strcpy (label, "Blahooo");
+	bits = 1555;
+
+	attrs[0].type = CKA_LABEL;
+	attrs[0].pValue = label;
+	attrs[0].ulValueLen = strlen (label);
+	attrs[1].type = CKA_BITS_PER_PIXEL;
+	attrs[1].pValue = &bits;
+	attrs[1].ulValueLen = sizeof (bits);
+
+	rv = (module->C_GenerateKey) (session, &mech, attrs, 2, &object);
+	CuAssertTrue (tc, rv == CKR_MECHANISM_PARAM_INVALID);
+
+	mech.pParameter = "generate";
+	mech.ulParameterLen = 9;
+
+	rv = (module->C_GenerateKey) (session, &mech, attrs, 2, &object);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	attrs[0].ulValueLen = sizeof (label);
+	memset (label, 0, sizeof (label));
+	bits = 0;
+	attrs[2].type = CKA_VALUE;
+	attrs[2].pValue = value;
+	attrs[2].ulValueLen = sizeof (value);
+
+	rv = (module->C_GetAttributeValue) (session, object, attrs, 3);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, bits, 1555);
+	CuAssertIntEquals (tc, 7, attrs[0].ulValueLen);
+	CuAssertTrue (tc, memcmp (label, "Blahooo", attrs[0].ulValueLen) == 0);
+	CuAssertIntEquals (tc, 9, attrs[2].ulValueLen);
+	CuAssertTrue (tc, memcmp (value, "generated", attrs[2].ulValueLen) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_generate_key_pair (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_OBJECT_HANDLE pub_object;
+	CK_OBJECT_HANDLE priv_object;
+	CK_MECHANISM mech = { CKM_MOCK_GENERATE, "generated", 9 };
+	CK_ATTRIBUTE pub_attrs[8];
+	CK_ATTRIBUTE priv_attrs[8];
+	char pub_label[32];
+	char pub_value[64];
+	char priv_label[32];
+	char priv_value[64];
+	CK_ULONG pub_bits;
+	CK_ULONG priv_bits;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	strcpy (pub_label, "Blahooo");
+	pub_bits = 1555;
+	pub_attrs[0].type = CKA_LABEL;
+	pub_attrs[0].pValue = pub_label;
+	pub_attrs[0].ulValueLen = strlen (pub_label);
+	pub_attrs[1].type = CKA_BITS_PER_PIXEL;
+	pub_attrs[1].pValue = &pub_bits;
+	pub_attrs[1].ulValueLen = sizeof (pub_bits);
+
+	strcpy (priv_label, "Private");
+	priv_bits = 1666;
+	priv_attrs[0].type = CKA_LABEL;
+	priv_attrs[0].pValue = priv_label;
+	priv_attrs[0].ulValueLen = strlen (priv_label);
+	priv_attrs[1].type = CKA_BITS_PER_PIXEL;
+	priv_attrs[1].pValue = &priv_bits;
+	priv_attrs[1].ulValueLen = sizeof (priv_bits);
+
+	rv = (module->C_GenerateKeyPair) (0, &mech, pub_attrs, 2, priv_attrs, 2,
+	                                  &pub_object, &priv_object);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	mech.pParameter = "generate";
+	mech.ulParameterLen = 9;
+
+	rv = (module->C_GenerateKeyPair) (session, &mech, pub_attrs, 2, priv_attrs, 2,
+	                                  &pub_object, &priv_object);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	pub_bits = 0;
+	pub_attrs[0].ulValueLen = sizeof (pub_label);
+	memset (pub_label, 0, sizeof (pub_label));
+	pub_attrs[2].type = CKA_VALUE;
+	pub_attrs[2].pValue = pub_value;
+	pub_attrs[2].ulValueLen = sizeof (pub_value);
+
+	rv = (module->C_GetAttributeValue) (session, pub_object, pub_attrs, 3);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 1555, pub_bits);
+	CuAssertIntEquals (tc, 7, pub_attrs[0].ulValueLen);
+	CuAssertTrue (tc, memcmp (pub_label, "Blahooo", pub_attrs[0].ulValueLen) == 0);
+	CuAssertIntEquals (tc, 9, pub_attrs[2].ulValueLen);
+	CuAssertTrue (tc, memcmp (pub_value, "generated", pub_attrs[2].ulValueLen) == 0);
+
+	priv_bits = 0;
+	priv_attrs[0].ulValueLen = sizeof (priv_label);
+	memset (priv_label, 0, sizeof (priv_label));
+	priv_attrs[2].type = CKA_VALUE;
+	priv_attrs[2].pValue = priv_value;
+	priv_attrs[2].ulValueLen = sizeof (priv_value);
+
+	rv = (module->C_GetAttributeValue) (session, priv_object, priv_attrs, 3);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 1666, priv_bits);
+	CuAssertIntEquals (tc, 7, priv_attrs[0].ulValueLen);
+	CuAssertTrue (tc, memcmp (priv_label, "Private", priv_attrs[0].ulValueLen) == 0);
+	CuAssertIntEquals (tc, 9, priv_attrs[2].ulValueLen);
+	CuAssertTrue (tc, memcmp (priv_value, "generated", priv_attrs[2].ulValueLen) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_wrap_key (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_MECHANISM mech = { CKM_MOCK_WRAP, NULL, 0 };
+	CK_BYTE data[128];
+	CK_ULONG length;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	length = sizeof (data);
+	rv = (module->C_WrapKey) (session, &mech, MOCK_PUBLIC_KEY_PREFIX, MOCK_PUBLIC_KEY_PREFIX, data, &length);
+	CuAssertTrue (tc, rv == CKR_MECHANISM_PARAM_INVALID);
+
+	mech.pParameter = "wrap";
+	mech.ulParameterLen = 4;
+
+	rv = (module->C_WrapKey) (session, &mech, MOCK_PUBLIC_KEY_PREFIX, MOCK_PUBLIC_KEY_PREFIX, data, &length);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, 5, length);
+	CuAssertTrue (tc, memcmp (data, "value", 5) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_unwrap_key (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_OBJECT_HANDLE object;
+	CK_MECHANISM mech = { CKM_MOCK_WRAP, NULL, 0 };
+	CK_ATTRIBUTE attrs[8];
+	char label[32];
+	char value[64];
+	CK_ULONG bits;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	strcpy (label, "Blahooo");
+	bits = 1555;
+
+	attrs[0].type = CKA_LABEL;
+	attrs[0].pValue = label;
+	attrs[0].ulValueLen = strlen (label);
+	attrs[1].type = CKA_BITS_PER_PIXEL;
+	attrs[1].pValue = &bits;
+	attrs[1].ulValueLen = sizeof (bits);
+
+	rv = (module->C_UnwrapKey) (session, &mech, MOCK_PUBLIC_KEY_PREFIX,
+	                            (CK_BYTE_PTR)"wheee", 5, attrs, 2, &object);
+	CuAssertTrue (tc, rv == CKR_MECHANISM_PARAM_INVALID);
+
+	mech.pParameter = "wrap";
+	mech.ulParameterLen = 4;
+
+	rv = (module->C_UnwrapKey) (session, &mech, MOCK_PUBLIC_KEY_PREFIX,
+	                            (CK_BYTE_PTR)"wheee", 5, attrs, 2, &object);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	attrs[0].ulValueLen = sizeof (label);
+	memset (label, 0, sizeof (label));
+	bits = 0;
+	attrs[2].type = CKA_VALUE;
+	attrs[2].pValue = value;
+	attrs[2].ulValueLen = sizeof (value);
+
+	rv = (module->C_GetAttributeValue) (session, object, attrs, 3);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, bits, 1555);
+	CuAssertIntEquals (tc, 7, attrs[0].ulValueLen);
+	CuAssertTrue (tc, memcmp (label, "Blahooo", attrs[0].ulValueLen) == 0);
+	CuAssertIntEquals (tc, 5, attrs[2].ulValueLen);
+	CuAssertTrue (tc, memcmp (value, "wheee", attrs[2].ulValueLen) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_derive_key (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_OBJECT_HANDLE object;
+	CK_MECHANISM mech = { CKM_MOCK_DERIVE, NULL, 0 };
+	CK_ATTRIBUTE attrs[8];
+	char label[32];
+	char value[64];
+	CK_ULONG bits;
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	strcpy (label, "Blahooo");
+	bits = 1555;
+
+	attrs[0].type = CKA_LABEL;
+	attrs[0].pValue = label;
+	attrs[0].ulValueLen = strlen (label);
+	attrs[1].type = CKA_BITS_PER_PIXEL;
+	attrs[1].pValue = &bits;
+	attrs[1].ulValueLen = sizeof (bits);
+
+	rv = (module->C_DeriveKey) (session, &mech, MOCK_PUBLIC_KEY_PREFIX,
+	                                attrs, 2, &object);
+	CuAssertTrue (tc, rv == CKR_MECHANISM_PARAM_INVALID);
+
+	mech.pParameter = "derive";
+	mech.ulParameterLen = 6;
+
+	rv = (module->C_DeriveKey) (session, &mech, MOCK_PUBLIC_KEY_PREFIX,
+	                            attrs, 2, &object);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	attrs[0].ulValueLen = sizeof (label);
+	memset (label, 0, sizeof (label));
+	bits = 0;
+	attrs[2].type = CKA_VALUE;
+	attrs[2].pValue = value;
+	attrs[2].ulValueLen = sizeof (value);
+
+	rv = (module->C_GetAttributeValue) (session, object, attrs, 3);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertIntEquals (tc, bits, 1555);
+	CuAssertIntEquals (tc, 7, attrs[0].ulValueLen);
+	CuAssertTrue (tc, memcmp (label, "Blahooo", attrs[0].ulValueLen) == 0);
+	CuAssertIntEquals (tc, 7, attrs[2].ulValueLen);
+	CuAssertTrue (tc, memcmp (value, "derived", attrs[2].ulValueLen) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_random (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR module;
+	CK_SESSION_HANDLE session = 0;
+	CK_BYTE data[10];
+	CK_RV rv;
+
+	module = setup_mock_module (tc, &session);
+
+	rv = (module->C_SeedRandom) (0, (CK_BYTE_PTR)"seed", 4);
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_SeedRandom) (session, (CK_BYTE_PTR)"seed", 4);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = (module->C_GenerateRandom) (0, data, sizeof (data));
+	CuAssertTrue (tc, rv == CKR_SESSION_HANDLE_INVALID);
+
+	rv = (module->C_GenerateRandom) (session, data, sizeof (data));
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	CuAssertTrue (tc, memcmp (data, "seedseedse", sizeof (data)) == 0);
+
+	teardown_mock_module (tc, module);
+}
+
+static void
+test_mock_add_tests (CuSuite *suite)
+{
+	SUITE_ADD_TEST (suite, test_get_info);
+	SUITE_ADD_TEST (suite, test_get_slot_list);
+	SUITE_ADD_TEST (suite, test_get_slot_info);
+	SUITE_ADD_TEST (suite, test_get_token_info);
+	SUITE_ADD_TEST (suite, test_get_mechanism_list);
+	SUITE_ADD_TEST (suite, test_get_mechanism_info);
+	SUITE_ADD_TEST (suite, test_init_token);
+	SUITE_ADD_TEST (suite, test_wait_for_slot_event);
+	SUITE_ADD_TEST (suite, test_open_close_session);
+	SUITE_ADD_TEST (suite, test_close_all_sessions);
+	SUITE_ADD_TEST (suite, test_get_function_status);
+	SUITE_ADD_TEST (suite, test_cancel_function);
+	SUITE_ADD_TEST (suite, test_get_session_info);
+	SUITE_ADD_TEST (suite, test_init_pin);
+	SUITE_ADD_TEST (suite, test_set_pin);
+	SUITE_ADD_TEST (suite, test_operation_state);
+	SUITE_ADD_TEST (suite, test_login_logout);
+	SUITE_ADD_TEST (suite, test_get_attribute_value);
+	SUITE_ADD_TEST (suite, test_set_attribute_value);
+	SUITE_ADD_TEST (suite, test_create_object);
+	SUITE_ADD_TEST (suite, test_copy_object);
+	SUITE_ADD_TEST (suite, test_destroy_object);
+	SUITE_ADD_TEST (suite, test_get_object_size);
+	SUITE_ADD_TEST (suite, test_find_objects);
+	SUITE_ADD_TEST (suite, test_encrypt);
+	SUITE_ADD_TEST (suite, test_decrypt);
+	SUITE_ADD_TEST (suite, test_digest);
+	SUITE_ADD_TEST (suite, test_sign);
+	SUITE_ADD_TEST (suite, test_sign_recover);
+	SUITE_ADD_TEST (suite, test_verify);
+	SUITE_ADD_TEST (suite, test_verify_recover);
+	SUITE_ADD_TEST (suite, test_digest_encrypt);
+	SUITE_ADD_TEST (suite, test_decrypt_digest);
+	SUITE_ADD_TEST (suite, test_sign_encrypt);
+	SUITE_ADD_TEST (suite, test_decrypt_verify);
+	SUITE_ADD_TEST (suite, test_generate_key);
+	SUITE_ADD_TEST (suite, test_generate_key_pair);
+	SUITE_ADD_TEST (suite, test_wrap_key);
+	SUITE_ADD_TEST (suite, test_unwrap_key);
+	SUITE_ADD_TEST (suite, test_derive_key);
+	SUITE_ADD_TEST (suite, test_random);
+}
diff --git a/p11-kit/tests/test-modules.c b/p11-kit/tests/test-modules.c
index 3a6e968..d6b4753 100644
--- a/p11-kit/tests/test-modules.c
+++ b/p11-kit/tests/test-modules.c
@@ -50,11 +50,8 @@ static CK_FUNCTION_LIST_PTR_PTR
 initialize_and_get_modules (CuTest *tc)
 {
 	CK_FUNCTION_LIST_PTR_PTR modules;
-	CK_RV rv;
 
-	rv = p11_kit_initialize_registered ();
-	CuAssertIntEquals (tc, CKR_OK, rv);
-	modules = p11_kit_registered_modules ();
+	modules = p11_kit_modules_load_and_initialize (0);
 	CuAssertTrue (tc, modules != NULL && modules[0] != NULL);
 
 	return modules;
@@ -64,11 +61,7 @@ static void
 finalize_and_free_modules (CuTest *tc,
                            CK_FUNCTION_LIST_PTR_PTR modules)
 {
-	CK_RV rv;
-
-	free (modules);
-	rv = p11_kit_finalize_registered ();
-	CuAssertIntEquals (tc, CKR_OK, rv);
+	p11_kit_modules_finalize_and_release (modules);
 }
 
 static void
@@ -86,7 +79,7 @@ test_no_duplicates (CuTest *tc)
 
 	/* The loaded modules should not contain duplicates */
 	for (i = 0; modules[i] != NULL; i++) {
-		path = p11_kit_registered_option (modules[i], "module");
+		path = p11_kit_config_option (modules[i], "module");
 
 		if (p11_dict_get (funcs, modules[i]))
 			CuAssert (tc, "found duplicate function list pointer", 0);
@@ -117,7 +110,7 @@ lookup_module_with_name (CuTest *tc,
 	int i;
 
 	for (i = 0; match == NULL && modules[i] != NULL; i++) {
-		module_name = p11_kit_registered_module_to_name (modules[i]);
+		module_name = p11_kit_module_get_name (modules[i]);
 		CuAssertPtrNotNull (tc, module_name);
 		if (strcmp (module_name, name) == 0)
 			match = modules[i];
@@ -128,8 +121,8 @@ lookup_module_with_name (CuTest *tc,
 	 * As a side effect, we should check that the results of this function
 	 * matches the above search.
 	 */
-	module = p11_kit_registered_name_to_module (name);
-	CuAssert(tc, "different result from p11_kit_registered_name_to_module()",
+	module = p11_kit_module_for_name (modules, name);
+	CuAssert(tc, "different result from p11_kit_module_for_name ()",
 	         module == match);
 
 	return match;
@@ -169,7 +162,6 @@ static void
 test_disable_later (CuTest *tc)
 {
 	CK_FUNCTION_LIST_PTR_PTR modules;
-	CK_RV rv;
 
 	/*
 	 * The module two shouldn't be matched, because in its config
@@ -178,12 +170,9 @@ test_disable_later (CuTest *tc)
 	 * disable-in: test-disable
 	 */
 
-	rv = p11_kit_initialize_registered ();
-	CuAssertIntEquals (tc, CKR_OK, rv);
-
 	p11_kit_set_progname ("test-disable");
 
-	modules = p11_kit_registered_modules ();
+	modules = p11_kit_modules_load_and_initialize (0);
 	CuAssertTrue (tc, modules != NULL && modules[0] != NULL);
 
 	CuAssertTrue (tc, lookup_module_with_name (tc, modules, "two") == NULL);
@@ -246,7 +235,7 @@ test_priority (CuTest *tc)
 
 	/* The loaded modules should not contain duplicates */
 	for (i = 0; modules[i] != NULL; i++) {
-		name = p11_kit_registered_module_to_name (modules[i]);
+		name = p11_kit_module_get_name (modules[i]);
 		CuAssertPtrNotNull (tc, name);
 
 		/* Either one of these can be loaded, as this is a duplicate module */
@@ -263,6 +252,100 @@ test_priority (CuTest *tc)
 	finalize_and_free_modules (tc, modules);
 }
 
+static void
+test_module_name (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR_PTR modules;
+	CK_FUNCTION_LIST_PTR module;
+	char *name;
+
+	/*
+	 * The module three should not be present, as we don't match the current
+	 * program.
+	 */
+
+	modules = initialize_and_get_modules (tc);
+
+	module = p11_kit_module_for_name (modules, "one");
+	CuAssertPtrNotNull (tc, module);
+	name = p11_kit_module_get_name (module);
+	CuAssertStrEquals (tc, "one", name);
+	free (name);
+
+	module = p11_kit_module_for_name (modules, "invalid");
+	CuAssertPtrEquals (tc, NULL, module);
+
+	module = p11_kit_module_for_name (NULL, "one");
+	CuAssertPtrEquals (tc, NULL, module);
+
+	finalize_and_free_modules (tc, modules);
+}
+
+static void
+test_module_flags (CuTest *tc)
+{
+	CK_FUNCTION_LIST **modules;
+	CK_FUNCTION_LIST **unmanaged;
+	int flags;
+
+	/*
+	 * The module three should not be present, as we don't match the current
+	 * program.
+	 */
+
+	modules = initialize_and_get_modules (tc);
+
+	flags = p11_kit_module_get_flags (modules[0]);
+	CuAssertIntEquals (tc, 0, flags);
+
+	unmanaged = p11_kit_modules_load (NULL, P11_KIT_MODULE_UNMANAGED);
+	CuAssertTrue (tc, unmanaged != NULL && unmanaged[0] != NULL);
+
+	flags = p11_kit_module_get_flags (unmanaged[0]);
+	CuAssertIntEquals (tc, P11_KIT_MODULE_UNMANAGED, flags);
+
+	finalize_and_free_modules (tc, modules);
+	p11_kit_modules_release (unmanaged);
+}
+
+static void
+test_config_option (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR_PTR modules;
+	CK_FUNCTION_LIST_PTR module;
+	char *value;
+
+	/*
+	 * The module three should not be present, as we don't match the current
+	 * program.
+	 */
+
+	modules = initialize_and_get_modules (tc);
+
+	value = p11_kit_config_option (NULL, "new");
+	CuAssertStrEquals (tc, "world", value);
+	free (value);
+
+	module = p11_kit_module_for_name (modules, "one");
+	CuAssertPtrNotNull (tc, module);
+
+	value = p11_kit_config_option (module, "setting");
+	CuAssertStrEquals (tc, "user1", value);
+	free (value);
+
+	value = p11_kit_config_option (NULL, "invalid");
+	CuAssertPtrEquals (tc, NULL, value);
+
+	value = p11_kit_config_option (module, "invalid");
+	CuAssertPtrEquals (tc, NULL, value);
+
+	/* Invalid but non-NULL module pointer */
+	value = p11_kit_config_option (module + 1, "setting");
+	CuAssertPtrEquals (tc, NULL, value);
+
+	finalize_and_free_modules (tc, modules);
+}
+
 int
 main (void)
 {
@@ -278,6 +361,9 @@ main (void)
 	SUITE_ADD_TEST (suite, test_disable_later);
 	SUITE_ADD_TEST (suite, test_enable);
 	SUITE_ADD_TEST (suite, test_priority);
+	SUITE_ADD_TEST (suite, test_module_name);
+	SUITE_ADD_TEST (suite, test_module_flags);
+	SUITE_ADD_TEST (suite, test_config_option);
 
 	p11_kit_be_quiet ();
 
diff --git a/p11-kit/tests/test-proxy.c b/p11-kit/tests/test-proxy.c
new file mode 100644
index 0000000..99b2431
--- /dev/null
+++ b/p11-kit/tests/test-proxy.c
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2013 Red Hat Inc
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *     * Redistributions of source code must retain the above
+ *       copyright notice, this list of conditions and the
+ *       following disclaimer.
+ *     * Redistributions in binary form must reproduce the
+ *       above copyright notice, this list of conditions and
+ *       the following disclaimer in the documentation and/or
+ *       other materials provided with the distribution.
+ *     * The names of contributors to this software may not be
+ *       used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * Author: Stef Walter <stefw@redhat.com>
+ */
+
+#define CRYPTOKI_EXPORTS
+
+#include "config.h"
+#include "CuTest.h"
+
+#include "library.h"
+#include "pkcs11.h"
+#include "p11-kit.h"
+
+#include <sys/types.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+/* This is the proxy module entry point in proxy.c, and linked to this test */
+CK_RV C_GetFunctionList (CK_FUNCTION_LIST_PTR_PTR list);
+
+static void
+test_initialize_finalize (CuTest *tc)
+{
+	CK_FUNCTION_LIST_PTR proxy;
+	CK_RV rv;
+
+	rv = C_GetFunctionList (&proxy);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = proxy->C_Initialize (NULL);
+	CuAssertTrue (tc, rv == CKR_OK);
+
+	rv = proxy->C_Finalize (NULL);
+	CuAssertTrue (tc, rv == CKR_OK);
+}
+
+int
+main (void)
+{
+	CuString *output = CuStringNew ();
+	CuSuite* suite = CuSuiteNew ();
+	int ret;
+
+	putenv ("P11_KIT_STRICT=1");
+	p11_library_init ();
+	p11_kit_be_quiet ();
+
+	SUITE_ADD_TEST (suite, test_initialize_finalize);
+
+	CuSuiteRun (suite);
+	CuSuiteSummary (suite, output);
+	CuSuiteDetails (suite, output);
+	printf ("%s\n", output->buffer);
+	ret = suite->failCount;
+	CuSuiteDelete (suite);
+	CuStringDelete (output);
+	return ret;
+}