Update contrib/restricted/aws libraries to nixpkgs 24.05

commit_hash:f8083acb039e6005e820cdee77b84e0a6b6c6d6d

24 files changed, 3207 insertions, 3588 deletions

diff --git a/contrib/restricted/aws/aws-c-io/source/async_stream.c b/contrib/restricted/aws/aws-c-io/source/async_stream.c
new file mode 100644
index 00000000000..6422bb84705
--- /dev/null
+++ b/contrib/restricted/aws/aws-c-io/source/async_stream.c
@@ -0,0 +1,153 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0.
+ */
+
+#include <aws/io/async_stream.h>
+
+#include <aws/common/byte_buf.h>
+#include <aws/io/future.h>
+#include <aws/io/stream.h>
+
+void aws_async_input_stream_init_base(
+    struct aws_async_input_stream *stream,
+    struct aws_allocator *alloc,
+    const struct aws_async_input_stream_vtable *vtable,
+    void *impl) {
+
+    AWS_PRECONDITION(stream);
+    AWS_PRECONDITION(alloc);
+    AWS_PRECONDITION(vtable);
+    AWS_PRECONDITION(vtable->read);
+    AWS_PRECONDITION(vtable->destroy);
+
+    AWS_ZERO_STRUCT(*stream);
+    stream->alloc = alloc;
+    stream->vtable = vtable;
+    stream->impl = impl;
+    aws_ref_count_init(&stream->ref_count, stream, (aws_simple_completion_callback *)vtable->destroy);
+}
+
+struct aws_async_input_stream *aws_async_input_stream_acquire(struct aws_async_input_stream *stream) {
+    if (stream != NULL) {
+        aws_ref_count_acquire(&stream->ref_count);
+    }
+    return stream;
+}
+
+struct aws_async_input_stream *aws_async_input_stream_release(struct aws_async_input_stream *stream) {
+    if (stream) {
+        aws_ref_count_release(&stream->ref_count);
+    }
+    return NULL;
+}
+
+struct aws_future_bool *aws_async_input_stream_read(struct aws_async_input_stream *stream, struct aws_byte_buf *dest) {
+    AWS_PRECONDITION(stream);
+    AWS_PRECONDITION(dest);
+
+    /* Ensure the buffer has space available */
+    if (dest->len == dest->capacity) {
+        struct aws_future_bool *future = aws_future_bool_new(stream->alloc);
+        aws_future_bool_set_error(future, AWS_ERROR_SHORT_BUFFER);
+        return future;
+    }
+
+    struct aws_future_bool *future = stream->vtable->read(stream, dest);
+    AWS_POSTCONDITION(future != NULL);
+    return future;
+}
+
+/* Data to perform the aws_async_input_stream_read_to_fill() job */
+struct aws_async_input_stream_fill_job {
+    struct aws_allocator *alloc;
+    struct aws_async_input_stream *stream;
+    struct aws_byte_buf *dest;
+    /* Future for each read() step */
+    struct aws_future_bool *read_step_future;
+    /* Future to set when this fill job completes */
+    struct aws_future_bool *on_complete_future;
+};
+
+static void s_async_stream_fill_job_complete(
+    struct aws_async_input_stream_fill_job *fill_job,
+    bool eof,
+    int error_code) {
+
+    if (error_code) {
+        aws_future_bool_set_error(fill_job->on_complete_future, error_code);
+    } else {
+        aws_future_bool_set_result(fill_job->on_complete_future, eof);
+    }
+    aws_future_bool_release(fill_job->on_complete_future);
+    aws_async_input_stream_release(fill_job->stream);
+    aws_mem_release(fill_job->alloc, fill_job);
+}
+
+/* Call read() in a loop.
+ * It would be simpler to set a completion callback for each read() call,
+ * but this risks our call stack growing large if there are many small, synchronous, reads.
+ * So be complicated and loop until a read() ) call is actually async,
+ * and only then set the completion callback (which is this same function, where we resume looping). */
+static void s_async_stream_fill_job_loop(void *user_data) {
+    struct aws_async_input_stream_fill_job *fill_job = user_data;
+
+    while (true) {
+        /* Process read_step_future from previous iteration of loop.
+         * It's NULL the first time the job ever enters the loop.
+         * But it's set in subsequent runs of the loop,
+         * and when this is a read_step_future completion callback. */
+        if (fill_job->read_step_future) {
+            if (aws_future_bool_register_callback_if_not_done(
+                    fill_job->read_step_future, s_async_stream_fill_job_loop, fill_job)) {
+
+                /* not done, we'll resume this loop when callback fires */
+                return;
+            }
+
+            /* read_step_future is done */
+            int error_code = aws_future_bool_get_error(fill_job->read_step_future);
+            bool eof = error_code ? false : aws_future_bool_get_result(fill_job->read_step_future);
+            bool reached_capacity = fill_job->dest->len == fill_job->dest->capacity;
+            fill_job->read_step_future = aws_future_bool_release(fill_job->read_step_future); /* release and NULL */
+
+            if (error_code || eof || reached_capacity) {
+                /* job complete! */
+                s_async_stream_fill_job_complete(fill_job, eof, error_code);
+                return;
+            }
+        }
+
+        /* Kick off a read, which may or may not complete async */
+        fill_job->read_step_future = aws_async_input_stream_read(fill_job->stream, fill_job->dest);
+    }
+}
+
+struct aws_future_bool *aws_async_input_stream_read_to_fill(
+    struct aws_async_input_stream *stream,
+    struct aws_byte_buf *dest) {
+
+    AWS_PRECONDITION(stream);
+    AWS_PRECONDITION(dest);
+
+    struct aws_future_bool *future = aws_future_bool_new(stream->alloc);
+
+    /* Ensure the buffer has space available */
+    if (dest->len == dest->capacity) {
+        aws_future_bool_set_error(future, AWS_ERROR_SHORT_BUFFER);
+        return future;
+    }
+
+    /* Prepare for async job */
+    struct aws_async_input_stream_fill_job *fill_job =
+        aws_mem_calloc(stream->alloc, 1, sizeof(struct aws_async_input_stream_fill_job));
+    fill_job->alloc = stream->alloc;
+    fill_job->stream = aws_async_input_stream_acquire(stream);
+    fill_job->dest = dest;
+    fill_job->on_complete_future = aws_future_bool_acquire(future);
+
+    /* Kick off work */
+    s_async_stream_fill_job_loop(fill_job);
+
+    return future;
+}
diff --git a/contrib/restricted/aws/aws-c-io/source/bsd/kqueue_event_loop.c b/contrib/restricted/aws/aws-c-io/source/bsd/kqueue_event_loop.c
index 43130fa4971..33a517e7b9b 100644
--- a/contrib/restricted/aws/aws-c-io/source/bsd/kqueue_event_loop.c
+++ b/contrib/restricted/aws/aws-c-io/source/bsd/kqueue_event_loop.c
@@ -7,6 +7,7 @@
 
 #include <aws/io/logging.h>
 
+#include <aws/cal/cal.h>
 #include <aws/common/atomics.h>
 #include <aws/common/clock.h>
 #include <aws/common/mutex.h>
@@ -821,6 +822,12 @@ static int aws_event_loop_listen_for_io_events(int kq_fd, struct kevent kevents[
     return kevent(kq_fd, NULL /*changelist*/, 0 /*nchanges*/, kevents /*eventlist*/, MAX_EVENTS /*nevents*/, timeout);
 }
 
+static void s_aws_kqueue_cleanup_aws_lc_thread_local_state(void *user_data) {
+    (void)user_data;
+
+    aws_cal_thread_clean_up();
+}
+
 static void aws_event_loop_thread(void *user_data) {
     struct aws_event_loop *event_loop = user_data;
     AWS_LOGF_INFO(AWS_LS_IO_EVENT_LOOP, "id=%p: main loop started", (void *)event_loop);
@@ -852,6 +859,8 @@ static void aws_event_loop_thread(void *user_data) {
         DEFAULT_TIMEOUT_SEC,
         MAX_EVENTS);
 
+    aws_thread_current_at_exit(s_aws_kqueue_cleanup_aws_lc_thread_local_state, NULL);
+
     while (impl->thread_data.state == EVENT_THREAD_STATE_RUNNING) {
         int num_io_handle_events = 0;
         bool should_process_cross_thread_data = false;
diff --git a/contrib/restricted/aws/aws-c-io/source/channel.c b/contrib/restricted/aws/aws-c-io/source/channel.c
index b741513ccda..36a3975b2ea 100644
--- a/contrib/restricted/aws/aws-c-io/source/channel.c
+++ b/contrib/restricted/aws/aws-c-io/source/channel.c
@@ -743,7 +743,7 @@ int aws_channel_slot_insert_end(struct aws_channel *channel, struct aws_channel_
     }
 
     AWS_ASSERT(0);
-    return AWS_OP_ERR;
+    return aws_raise_error(AWS_ERROR_INVALID_STATE);
 }
 
 int aws_channel_slot_insert_left(struct aws_channel_slot *slot, struct aws_channel_slot *to_add) {
diff --git a/contrib/restricted/aws/aws-c-io/source/channel_bootstrap.c b/contrib/restricted/aws/aws-c-io/source/channel_bootstrap.c
index 4eac9174578..2ccd3873aca 100644
--- a/contrib/restricted/aws/aws-c-io/source/channel_bootstrap.c
+++ b/contrib/restricted/aws/aws-c-io/source/channel_bootstrap.c
@@ -118,7 +118,7 @@ struct client_connection_args {
     aws_client_bootstrap_on_channel_event_fn *shutdown_callback;
     struct client_channel_data channel_data;
     struct aws_socket_options outgoing_options;
-    uint16_t outgoing_port;
+    uint32_t outgoing_port;
     struct aws_string *host_name;
     void *user_data;
     uint8_t addresses_count;
@@ -182,10 +182,14 @@ static struct aws_event_loop *s_get_connection_event_loop(struct client_connecti
     return aws_event_loop_group_get_next_loop(args->bootstrap->event_loop_group);
 }
 
-static void s_connection_args_setup_callback(
+static void s_connect_args_setup_callback_safe(
     struct client_connection_args *args,
     int error_code,
     struct aws_channel *channel) {
+
+    AWS_FATAL_ASSERT(
+        (args->requested_event_loop == NULL) || aws_event_loop_thread_is_callers_thread(args->requested_event_loop));
+
     /* setup_callback is always called exactly once */
     AWS_FATAL_ASSERT(!args->setup_called);
 
@@ -200,6 +204,75 @@ static void s_connection_args_setup_callback(
     s_client_connection_args_release(args);
 }
 
+struct aws_connection_args_setup_callback_task {
+    struct aws_allocator *allocator;
+    struct aws_task task;
+    struct client_connection_args *args;
+    int error_code;
+    struct aws_channel *channel;
+};
+
+static void s_aws_connection_args_setup_callback_task_delete(struct aws_connection_args_setup_callback_task *task) {
+    if (task == NULL) {
+        return;
+    }
+
+    s_client_connection_args_release(task->args);
+    if (task->channel) {
+        aws_channel_release_hold(task->channel);
+    }
+
+    aws_mem_release(task->allocator, task);
+}
+
+void s_aws_connection_args_setup_callback_task_fn(struct aws_task *task, void *arg, enum aws_task_status status) {
+    (void)task;
+
+    struct aws_connection_args_setup_callback_task *callback_task = arg;
+
+    if (status == AWS_TASK_STATUS_RUN_READY) {
+        s_connect_args_setup_callback_safe(callback_task->args, callback_task->error_code, callback_task->channel);
+    }
+
+    s_aws_connection_args_setup_callback_task_delete(callback_task);
+}
+
+static struct aws_connection_args_setup_callback_task *s_aws_connection_args_setup_callback_task_new(
+    struct aws_allocator *allocator,
+    struct client_connection_args *args,
+    int error_code,
+    struct aws_channel *channel) {
+
+    struct aws_connection_args_setup_callback_task *task =
+        aws_mem_calloc(allocator, 1, sizeof(struct aws_connection_args_setup_callback_task));
+    task->allocator = allocator;
+    task->args = s_client_connection_args_acquire(args);
+    task->error_code = error_code;
+    task->channel = channel;
+    if (channel != NULL) {
+        aws_channel_acquire_hold(channel);
+    }
+
+    aws_task_init(
+        &task->task, s_aws_connection_args_setup_callback_task_fn, task, "safe connection args setup callback");
+
+    return task;
+}
+
+static void s_connection_args_setup_callback(
+    struct client_connection_args *args,
+    int error_code,
+    struct aws_channel *channel) {
+
+    if (args->requested_event_loop == NULL || aws_event_loop_thread_is_callers_thread(args->requested_event_loop)) {
+        s_connect_args_setup_callback_safe(args, error_code, channel);
+    } else {
+        struct aws_connection_args_setup_callback_task *callback_task =
+            s_aws_connection_args_setup_callback_task_new(args->bootstrap->allocator, args, error_code, channel);
+        aws_event_loop_schedule_task_now(args->requested_event_loop, &callback_task->task);
+    }
+}
+
 static void s_connection_args_creation_callback(struct client_connection_args *args, struct aws_channel *channel) {
 
     AWS_FATAL_ASSERT(channel != NULL);
@@ -567,10 +640,6 @@ static void s_attempt_connection(struct aws_task *task, void *arg, enum aws_task
     }
 
     struct aws_socket *outgoing_socket = aws_mem_acquire(allocator, sizeof(struct aws_socket));
-    if (!outgoing_socket) {
-        goto socket_alloc_failed;
-    }
-
     if (aws_socket_init(outgoing_socket, allocator, &task_data->options)) {
         goto socket_init_failed;
     }
@@ -592,19 +661,27 @@ socket_connect_failed:
     aws_socket_clean_up(outgoing_socket);
 socket_init_failed:
     aws_mem_release(allocator, outgoing_socket);
-socket_alloc_failed:
-    err_code = aws_last_error();
-    AWS_LOGF_ERROR(
-        AWS_LS_IO_CHANNEL_BOOTSTRAP,
-        "id=%p: failed to create socket with error %d",
-        (void *)task_data->args->bootstrap,
-        err_code);
 task_cancelled:
+    err_code = aws_last_error();
     task_data->args->failed_count++;
     /* if this is the last attempted connection and it failed, notify the user */
     if (task_data->args->failed_count == task_data->args->addresses_count) {
+        AWS_LOGF_ERROR(
+            AWS_LS_IO_CHANNEL_BOOTSTRAP,
+            "id=%p: Last attempt failed to create socket with error %d",
+            (void *)task_data->args->bootstrap,
+            err_code);
         s_connection_args_setup_callback(task_data->args, err_code, NULL);
+    } else {
+        AWS_LOGF_DEBUG(
+            AWS_LS_IO_CHANNEL_BOOTSTRAP,
+            "id=%p: Socket connect attempt %d/%d failed with error %d. More attempts ongoing...",
+            (void *)task_data->args->bootstrap,
+            task_data->args->failed_count,
+            task_data->args->addresses_count,
+            err_code);
     }
+
     s_client_connection_args_release(task_data->args);
 
 cleanup_task:
@@ -760,14 +837,14 @@ int aws_client_bootstrap_new_socket_channel(struct aws_socket_channel_bootstrap_
     }
 
     const char *host_name = options->host_name;
-    uint16_t port = options->port;
+    uint32_t port = options->port;
 
     AWS_LOGF_TRACE(
         AWS_LS_IO_CHANNEL_BOOTSTRAP,
-        "id=%p: attempting to initialize a new client channel to %s:%d",
+        "id=%p: attempting to initialize a new client channel to %s:%u",
         (void *)bootstrap,
         host_name,
-        (int)port);
+        port);
 
     aws_ref_count_init(
         &client_connection_args->ref_count,
@@ -1359,10 +1436,10 @@ struct aws_socket *aws_server_bootstrap_new_socket_listener(
     AWS_LOGF_INFO(
         AWS_LS_IO_CHANNEL_BOOTSTRAP,
         "id=%p: attempting to initialize a new "
-        "server socket listener for %s:%d",
+        "server socket listener for %s:%u",
         (void *)bootstrap_options->bootstrap,
         bootstrap_options->host_name,
-        (int)bootstrap_options->port);
+        bootstrap_options->port);
 
     aws_ref_count_init(
         &server_connection_args->ref_count,
diff --git a/contrib/restricted/aws/aws-c-io/source/event_loop.c b/contrib/restricted/aws/aws-c-io/source/event_loop.c
index 5870b87e8d8..1e7aef676cc 100644
--- a/contrib/restricted/aws/aws-c-io/source/event_loop.c
+++ b/contrib/restricted/aws/aws-c-io/source/event_loop.c
@@ -165,12 +165,16 @@ static struct aws_event_loop_group *s_event_loop_group_new(
 
     return el_group;
 
-on_error:
+on_error:;
+    /* cache the error code to prevent any potential side effects */
+    int cached_error_code = aws_last_error();
 
     aws_mem_release(alloc, usable_cpus);
     s_aws_event_loop_group_shutdown_sync(el_group);
     s_event_loop_group_thread_exit(el_group);
 
+    /* raise the cached error code */
+    aws_raise_error(cached_error_code);
     return NULL;
 }
 
@@ -398,7 +402,7 @@ int aws_event_loop_fetch_local_object(
         return AWS_OP_SUCCESS;
     }
 
-    return AWS_OP_ERR;
+    return aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
 }
 
 int aws_event_loop_put_local_object(struct aws_event_loop *event_loop, struct aws_event_loop_local_object *obj) {
diff --git a/contrib/restricted/aws/aws-c-io/source/exponential_backoff_retry_strategy.c b/contrib/restricted/aws/aws-c-io/source/exponential_backoff_retry_strategy.c
index 298cca9af1a..cf247226995 100644
--- a/contrib/restricted/aws/aws-c-io/source/exponential_backoff_retry_strategy.c
+++ b/contrib/restricted/aws/aws-c-io/source/exponential_backoff_retry_strategy.c
@@ -26,6 +26,7 @@ struct exponential_backoff_retry_token {
     struct aws_atomic_var last_backoff;
     size_t max_retries;
     uint64_t backoff_scale_factor_ns;
+    uint64_t maximum_backoff_ns;
     enum aws_exponential_backoff_jitter_mode jitter_mode;
     /* Let's not make this worse by constantly moving across threads if we can help it */
     struct aws_event_loop *bound_loop;
@@ -139,6 +140,8 @@ static int s_exponential_retry_acquire_token(
     backoff_retry_token->max_retries = exponential_backoff_strategy->config.max_retries;
     backoff_retry_token->backoff_scale_factor_ns = aws_timestamp_convert(
         exponential_backoff_strategy->config.backoff_scale_factor_ms, AWS_TIMESTAMP_MILLIS, AWS_TIMESTAMP_NANOS, NULL);
+    backoff_retry_token->maximum_backoff_ns = aws_timestamp_convert(
+        exponential_backoff_strategy->config.max_backoff_secs, AWS_TIMESTAMP_SECS, AWS_TIMESTAMP_NANOS, NULL);
     backoff_retry_token->jitter_mode = exponential_backoff_strategy->config.jitter_mode;
     backoff_retry_token->generate_random = exponential_backoff_strategy->config.generate_random;
     backoff_retry_token->generate_random_impl = exponential_backoff_strategy->config.generate_random_impl;
@@ -184,7 +187,8 @@ typedef uint64_t(compute_backoff_fn)(struct exponential_backoff_retry_token *tok
 
 static uint64_t s_compute_no_jitter(struct exponential_backoff_retry_token *token) {
     uint64_t retry_count = aws_min_u64(aws_atomic_load_int(&token->current_retry_count), 63);
-    return aws_mul_u64_saturating((uint64_t)1 << retry_count, token->backoff_scale_factor_ns);
+    uint64_t backoff_ns = aws_mul_u64_saturating((uint64_t)1 << retry_count, token->backoff_scale_factor_ns);
+    return aws_min_u64(backoff_ns, token->maximum_backoff_ns);
 }
 
 static uint64_t s_compute_full_jitter(struct exponential_backoff_retry_token *token) {
@@ -198,8 +202,8 @@ static uint64_t s_compute_deccorelated_jitter(struct exponential_backoff_retry_t
     if (!last_backoff_val) {
         return s_compute_full_jitter(token);
     }
-
-    return s_random_in_range(token->backoff_scale_factor_ns, aws_mul_u64_saturating(last_backoff_val, 3), token);
+    uint64_t backoff_ns = aws_min_u64(token->maximum_backoff_ns, aws_mul_u64_saturating(last_backoff_val, 3));
+    return s_random_in_range(token->backoff_scale_factor_ns, backoff_ns, token);
 }
 
 static compute_backoff_fn *s_backoff_compute_table[] = {
@@ -369,7 +373,11 @@ struct aws_retry_strategy *aws_retry_strategy_new_exponential_backoff(
     }
 
     if (!exponential_backoff_strategy->config.backoff_scale_factor_ms) {
-        exponential_backoff_strategy->config.backoff_scale_factor_ms = 25;
+        exponential_backoff_strategy->config.backoff_scale_factor_ms = 500;
+    }
+
+    if (!exponential_backoff_strategy->config.max_backoff_secs) {
+        exponential_backoff_strategy->config.max_backoff_secs = 20;
     }
 
     if (config->shutdown_options) {
diff --git a/contrib/restricted/aws/aws-c-io/source/future.c b/contrib/restricted/aws/aws-c-io/source/future.c
new file mode 100644
index 00000000000..be213184be6
--- /dev/null
+++ b/contrib/restricted/aws/aws-c-io/source/future.c
@@ -0,0 +1,543 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0.
+ */
+#include <aws/io/future.h>
+
+#include <aws/common/condition_variable.h>
+#include <aws/common/mutex.h>
+#include <aws/common/ref_count.h>
+#include <aws/common/task_scheduler.h>
+#include <aws/io/channel.h>
+#include <aws/io/event_loop.h>
+
+enum aws_future_type {
+    AWS_FUTURE_T_BY_VALUE,
+    AWS_FUTURE_T_BY_VALUE_WITH_CLEAN_UP,
+    AWS_FUTURE_T_POINTER,
+    AWS_FUTURE_T_POINTER_WITH_DESTROY,
+    AWS_FUTURE_T_POINTER_WITH_RELEASE,
+};
+
+struct aws_future_callback_data {
+    aws_future_callback_fn *fn;
+    void *user_data;
+    union aws_future_callback_union {
+        struct aws_event_loop *event_loop;
+        struct aws_channel *channel;
+    } u;
+    enum aws_future_callback_type {
+        AWS_FUTURE_IMMEDIATE_CALLBACK,
+        AWS_FUTURE_EVENT_LOOP_CALLBACK,
+        AWS_FUTURE_CHANNEL_CALLBACK,
+    } type;
+};
+
+/* When allocating aws_future<T> on the heap, we make 1 allocation containing:
+ * aws_future_impl followed by T */
+struct aws_future_impl {
+    struct aws_allocator *alloc;
+    struct aws_ref_count ref_count;
+    struct aws_mutex lock;
+    struct aws_condition_variable wait_cvar;
+    struct aws_future_callback_data callback;
+    union {
+        aws_future_impl_result_clean_up_fn *clean_up;
+        aws_future_impl_result_destroy_fn *destroy;
+        aws_future_impl_result_release_fn *release;
+    } result_dtor;
+    int error_code;
+    /* sum of bit fields should be 32 */
+#define BIT_COUNT_FOR_SIZEOF_RESULT 27
+    unsigned int sizeof_result : BIT_COUNT_FOR_SIZEOF_RESULT;
+    unsigned int type : 3; /* aws_future_type */
+    unsigned int is_done : 1;
+    unsigned int owns_result : 1;
+};
+
+static void s_future_impl_result_dtor(struct aws_future_impl *future, void *result_addr) {
+    switch (future->type) {
+        case AWS_FUTURE_T_BY_VALUE_WITH_CLEAN_UP: {
+            future->result_dtor.clean_up(result_addr);
+            break;
+        } break;
+
+        case AWS_FUTURE_T_POINTER_WITH_DESTROY: {
+            void *result = *(void **)result_addr;
+            if (result) {
+                future->result_dtor.destroy(result);
+            }
+        } break;
+
+        case AWS_FUTURE_T_POINTER_WITH_RELEASE: {
+            void *result = *(void **)result_addr;
+            if (result) {
+                future->result_dtor.release(result);
+            }
+        } break;
+
+        default:
+            break;
+    }
+}
+
+static void s_future_impl_destroy(void *user_data) {
+    struct aws_future_impl *future = user_data;
+    if (future->owns_result && !future->error_code) {
+        s_future_impl_result_dtor(future, aws_future_impl_get_result_address(future));
+    }
+    aws_condition_variable_clean_up(&future->wait_cvar);
+    aws_mutex_clean_up(&future->lock);
+    aws_mem_release(future->alloc, future);
+}
+
+static struct aws_future_impl *s_future_impl_new(struct aws_allocator *alloc, size_t sizeof_result) {
+    size_t total_size = sizeof(struct aws_future_impl) + sizeof_result;
+    struct aws_future_impl *future = aws_mem_calloc(alloc, 1, total_size);
+    future->alloc = alloc;
+
+    /* we store sizeof_result in a bit field, ensure the number will fit */
+    AWS_ASSERT(sizeof_result <= (UINT_MAX >> (32 - BIT_COUNT_FOR_SIZEOF_RESULT)));
+    future->sizeof_result = (unsigned int)sizeof_result;
+
+    aws_ref_count_init(&future->ref_count, future, s_future_impl_destroy);
+    aws_mutex_init(&future->lock);
+    aws_condition_variable_init(&future->wait_cvar);
+    return future;
+}
+
+struct aws_future_impl *aws_future_impl_new_by_value(struct aws_allocator *alloc, size_t sizeof_result) {
+    struct aws_future_impl *future = s_future_impl_new(alloc, sizeof_result);
+    future->type = AWS_FUTURE_T_BY_VALUE;
+    return future;
+}
+
+struct aws_future_impl *aws_future_impl_new_by_value_with_clean_up(
+    struct aws_allocator *alloc,
+    size_t sizeof_result,
+    aws_future_impl_result_clean_up_fn *result_clean_up) {
+
+    AWS_ASSERT(result_clean_up);
+    struct aws_future_impl *future = s_future_impl_new(alloc, sizeof_result);
+    future->type = AWS_FUTURE_T_BY_VALUE_WITH_CLEAN_UP;
+    future->result_dtor.clean_up = result_clean_up;
+    return future;
+}
+
+struct aws_future_impl *aws_future_impl_new_pointer(struct aws_allocator *alloc) {
+    struct aws_future_impl *future = s_future_impl_new(alloc, sizeof(void *));
+    future->type = AWS_FUTURE_T_POINTER;
+    return future;
+}
+
+struct aws_future_impl *aws_future_impl_new_pointer_with_destroy(
+    struct aws_allocator *alloc,
+    aws_future_impl_result_destroy_fn *result_destroy) {
+
+    AWS_ASSERT(result_destroy);
+    struct aws_future_impl *future = s_future_impl_new(alloc, sizeof(void *));
+    future->type = AWS_FUTURE_T_POINTER_WITH_DESTROY;
+    future->result_dtor.destroy = result_destroy;
+    return future;
+}
+
+struct aws_future_impl *aws_future_impl_new_pointer_with_release(
+    struct aws_allocator *alloc,
+    aws_future_impl_result_release_fn *result_release) {
+
+    AWS_ASSERT(result_release);
+    struct aws_future_impl *future = s_future_impl_new(alloc, sizeof(void *));
+    future->type = AWS_FUTURE_T_POINTER_WITH_RELEASE;
+    future->result_dtor.release = result_release;
+    return future;
+}
+
+struct aws_future_impl *aws_future_impl_release(struct aws_future_impl *future) {
+    if (future != NULL) {
+        aws_ref_count_release(&future->ref_count);
+    }
+    return NULL;
+}
+
+struct aws_future_impl *aws_future_impl_acquire(struct aws_future_impl *future) {
+    if (future != NULL) {
+        aws_ref_count_acquire(&future->ref_count);
+    }
+    return future;
+}
+
+bool aws_future_impl_is_done(const struct aws_future_impl *future) {
+    AWS_ASSERT(future);
+
+    /* this function is conceptually const, but we need to hold the lock a moment */
+    struct aws_mutex *mutable_lock = (struct aws_mutex *)&future->lock;
+
+    /* BEGIN CRITICAL SECTION */
+    aws_mutex_lock(mutable_lock);
+    bool is_done = future->is_done != 0;
+    aws_mutex_unlock(mutable_lock);
+    /* END CRITICAL SECTION */
+
+    return is_done;
+}
+
+int aws_future_impl_get_error(const struct aws_future_impl *future) {
+    AWS_ASSERT(future != NULL);
+    /* not bothering with lock, none of this can change after future is done */
+    AWS_FATAL_ASSERT(future->is_done && "Cannot get error before future is done");
+    return future->error_code;
+}
+
+void *aws_future_impl_get_result_address(const struct aws_future_impl *future) {
+    AWS_ASSERT(future != NULL);
+    /* not bothering with lock, none of this can change after future is done */
+    AWS_FATAL_ASSERT(future->is_done && "Cannot get result before future is done");
+    AWS_FATAL_ASSERT(!future->error_code && "Cannot get result from future that failed with an error");
+    AWS_FATAL_ASSERT(future->owns_result && "Result was already moved from future");
+
+    const struct aws_future_impl *address_of_memory_after_this_struct = future + 1;
+    void *result_addr = (void *)address_of_memory_after_this_struct;
+    return result_addr;
+}
+
+void aws_future_impl_get_result_by_move(struct aws_future_impl *future, void *dst_address) {
+    void *result_addr = aws_future_impl_get_result_address(future);
+    memcpy(dst_address, result_addr, future->sizeof_result);
+    memset(result_addr, 0, future->sizeof_result);
+    future->owns_result = false;
+}
+
+/* Data for invoking callback as a task on an event-loop */
+struct aws_future_event_loop_callback_job {
+    struct aws_allocator *alloc;
+    struct aws_task task;
+    struct aws_event_loop *event_loop;
+    aws_future_callback_fn *callback;
+    void *user_data;
+};
+
+static void s_future_impl_event_loop_callback_task(struct aws_task *task, void *arg, enum aws_task_status status) {
+    (void)task;
+    (void)status;
+    struct aws_future_event_loop_callback_job *job = arg;
+    job->callback(job->user_data);
+    // TODO: aws_event_loop_release(job->event_loop);
+    aws_mem_release(job->alloc, job);
+}
+
+/* Data for invoking callback as a task on an aws_channel */
+struct aws_future_channel_callback_job {
+    struct aws_allocator *alloc;
+    struct aws_channel_task task;
+    struct aws_channel *channel;
+    aws_future_callback_fn *callback;
+    void *user_data;
+};
+
+static void s_future_impl_channel_callback_task(struct aws_channel_task *task, void *arg, enum aws_task_status status) {
+    (void)task;
+    (void)status;
+    struct aws_future_channel_callback_job *job = arg;
+    job->callback(job->user_data);
+    aws_channel_release_hold(job->channel);
+    aws_mem_release(job->alloc, job);
+}
+
+static void s_future_impl_invoke_callback(struct aws_future_callback_data *callback, struct aws_allocator *alloc) {
+    AWS_ASSERT(callback->fn);
+
+    switch (callback->type) {
+        case AWS_FUTURE_IMMEDIATE_CALLBACK: {
+            callback->fn(callback->user_data);
+        } break;
+
+        case AWS_FUTURE_EVENT_LOOP_CALLBACK: {
+            /* Schedule the callback as a task on the event-loop */
+            struct aws_future_event_loop_callback_job *job =
+                aws_mem_calloc(alloc, 1, sizeof(struct aws_future_event_loop_callback_job));
+            job->alloc = alloc;
+            aws_task_init(&job->task, s_future_impl_event_loop_callback_task, job, "aws_future_event_loop_callback");
+            job->event_loop = callback->u.event_loop;
+            job->callback = callback->fn;
+            job->user_data = callback->user_data;
+
+            aws_event_loop_schedule_task_now(callback->u.event_loop, &job->task);
+        } break;
+
+        case AWS_FUTURE_CHANNEL_CALLBACK: {
+            /* Schedule the callback as a task on the channel */
+            struct aws_future_channel_callback_job *job =
+                aws_mem_calloc(alloc, 1, sizeof(struct aws_future_channel_callback_job));
+            job->alloc = alloc;
+            aws_channel_task_init(&job->task, s_future_impl_channel_callback_task, job, "aws_future_channel_callback");
+            job->channel = callback->u.channel;
+            job->callback = callback->fn;
+            job->user_data = callback->user_data;
+
+            aws_channel_schedule_task_now(callback->u.channel, &job->task);
+        } break;
+    }
+}
+
+static void s_future_impl_set_done(struct aws_future_impl *future, void *src_address, int error_code) {
+    bool is_error = error_code != 0;
+
+    /* BEGIN CRITICAL SECTION */
+    aws_mutex_lock(&future->lock);
+
+    struct aws_future_callback_data callback = future->callback;
+
+    bool first_time = !future->is_done;
+    if (first_time) {
+        future->is_done = true;
+        AWS_ZERO_STRUCT(future->callback);
+        if (is_error) {
+            future->error_code = error_code;
+        } else {
+            future->owns_result = true;
+            AWS_FATAL_ASSERT(src_address != NULL);
+            memcpy(aws_future_impl_get_result_address(future), src_address, future->sizeof_result);
+        }
+
+        aws_condition_variable_notify_all(&future->wait_cvar);
+    }
+
+    aws_mutex_unlock(&future->lock);
+    /* END CRITICAL SECTION */
+
+    if (first_time) {
+        /* if callback was registered, invoke it now, outside of critical section to avoid deadlock */
+        if (callback.fn != NULL) {
+            s_future_impl_invoke_callback(&callback, future->alloc);
+        }
+    } else if (!error_code) {
+        /* future was already done, so just destroy this newer result */
+        s_future_impl_result_dtor(future, src_address);
+    }
+}
+
+void aws_future_impl_set_error(struct aws_future_impl *future, int error_code) {
+    AWS_ASSERT(future);
+
+    /* handle recoverable usage error */
+    AWS_ASSERT(error_code != 0);
+    if (AWS_UNLIKELY(error_code == 0)) {
+        error_code = AWS_ERROR_UNKNOWN;
+    }
+
+    s_future_impl_set_done(future, NULL /*src_address*/, error_code);
+}
+
+void aws_future_impl_set_result_by_move(struct aws_future_impl *future, void *src_address) {
+    AWS_ASSERT(future);
+    AWS_ASSERT(src_address);
+    s_future_impl_set_done(future, src_address, 0 /*error_code*/);
+
+    /* the future takes ownership of the result.
+     * zero out memory at the src_address to reinforce this transfer of ownership. */
+    memset(src_address, 0, future->sizeof_result);
+}
+
+/* Returns true if callback was registered, or false if callback was ignored
+ * because the the future is already done and invoke_if_already_done==false */
+static bool s_future_impl_register_callback(
+    struct aws_future_impl *future,
+    struct aws_future_callback_data *callback,
+    bool invoke_if_already_done) {
+
+    /* BEGIN CRITICAL SECTION */
+    aws_mutex_lock(&future->lock);
+
+    AWS_FATAL_ASSERT(future->callback.fn == NULL && "Future done callback must only be set once");
+
+    bool already_done = future->is_done != 0;
+
+    /* if not done, store callback for later */
+    if (!already_done) {
+        future->callback = *callback;
+    }
+
+    aws_mutex_unlock(&future->lock);
+    /* END CRITICAL SECTION */
+
+    /* if already done, invoke callback now */
+    if (already_done && invoke_if_already_done) {
+        s_future_impl_invoke_callback(callback, future->alloc);
+    }
+
+    return !already_done || invoke_if_already_done;
+}
+
+void aws_future_impl_register_callback(
+    struct aws_future_impl *future,
+    aws_future_callback_fn *on_done,
+    void *user_data) {
+
+    AWS_ASSERT(future);
+    AWS_ASSERT(on_done);
+
+    struct aws_future_callback_data callback = {
+        .fn = on_done,
+        .user_data = user_data,
+        .type = AWS_FUTURE_IMMEDIATE_CALLBACK,
+    };
+    s_future_impl_register_callback(future, &callback, true /*invoke_if_already_done*/);
+}
+
+bool aws_future_impl_register_callback_if_not_done(
+    struct aws_future_impl *future,
+    aws_future_callback_fn *on_done,
+    void *user_data) {
+
+    AWS_ASSERT(future);
+    AWS_ASSERT(on_done);
+
+    struct aws_future_callback_data callback = {
+        .fn = on_done,
+        .user_data = user_data,
+        .type = AWS_FUTURE_IMMEDIATE_CALLBACK,
+    };
+    return s_future_impl_register_callback(future, &callback, false /*invoke_if_already_done*/);
+}
+
+void aws_future_impl_register_event_loop_callback(
+    struct aws_future_impl *future,
+    struct aws_event_loop *event_loop,
+    aws_future_callback_fn *on_done,
+    void *user_data) {
+
+    AWS_ASSERT(future);
+    AWS_ASSERT(event_loop);
+    AWS_ASSERT(on_done);
+
+    // TODO: aws_event_loop_acquire(event_loop);
+
+    struct aws_future_callback_data callback = {
+        .fn = on_done,
+        .user_data = user_data,
+        .type = AWS_FUTURE_EVENT_LOOP_CALLBACK,
+        .u = {.event_loop = event_loop},
+    };
+    s_future_impl_register_callback(future, &callback, true /*invoke_if_already_done*/);
+}
+
+void aws_future_impl_register_channel_callback(
+    struct aws_future_impl *future,
+    struct aws_channel *channel,
+    aws_future_callback_fn *on_done,
+    void *user_data) {
+
+    AWS_ASSERT(future);
+    AWS_ASSERT(channel);
+    AWS_ASSERT(on_done);
+
+    aws_channel_acquire_hold(channel);
+
+    struct aws_future_callback_data callback = {
+        .fn = on_done,
+        .user_data = user_data,
+        .type = AWS_FUTURE_CHANNEL_CALLBACK,
+        .u = {.channel = channel},
+    };
+    s_future_impl_register_callback(future, &callback, true /*invoke_if_already_done*/);
+}
+
+static bool s_future_impl_is_done_pred(void *user_data) {
+    struct aws_future_impl *future = user_data;
+    return future->is_done != 0;
+}
+
+bool aws_future_impl_wait(const struct aws_future_impl *future, uint64_t timeout_ns) {
+    AWS_ASSERT(future);
+
+    /* this function is conceptually const, but we need to use synchronization primitives */
+    struct aws_future_impl *mutable_future = (struct aws_future_impl *)future;
+
+    /* BEGIN CRITICAL SECTION */
+    aws_mutex_lock(&mutable_future->lock);
+
+    bool is_done = aws_condition_variable_wait_for_pred(
+                       &mutable_future->wait_cvar,
+                       &mutable_future->lock,
+                       (int64_t)timeout_ns,
+                       s_future_impl_is_done_pred,
+                       mutable_future) == AWS_OP_SUCCESS;
+
+    aws_mutex_unlock(&mutable_future->lock);
+    /* END CRITICAL SECTION */
+
+    return is_done;
+}
+
+// AWS_FUTURE_T_BY_VALUE_IMPLEMENTATION(aws_future_bool, bool)
+struct aws_future_bool *aws_future_bool_new(struct aws_allocator *alloc) {
+    return (struct aws_future_bool *)aws_future_impl_new_by_value(alloc, sizeof(_Bool));
+}
+void aws_future_bool_set_result(struct aws_future_bool *future, _Bool result) {
+    aws_future_impl_set_result_by_move((struct aws_future_impl *)future, &result);
+}
+_Bool aws_future_bool_get_result(const struct aws_future_bool *future) {
+    return *(_Bool *)aws_future_impl_get_result_address((const struct aws_future_impl *)future);
+}
+struct aws_future_bool *aws_future_bool_acquire(struct aws_future_bool *future) {
+    return (struct aws_future_bool *)aws_future_impl_acquire((struct aws_future_impl *)future);
+}
+struct aws_future_bool *aws_future_bool_release(struct aws_future_bool *future) {
+    return (struct aws_future_bool *)aws_future_impl_release((struct aws_future_impl *)future);
+}
+void aws_future_bool_set_error(struct aws_future_bool *future, int error_code) {
+    aws_future_impl_set_error((struct aws_future_impl *)future, error_code);
+}
+_Bool aws_future_bool_is_done(const struct aws_future_bool *future) {
+    return aws_future_impl_is_done((const struct aws_future_impl *)future);
+}
+int aws_future_bool_get_error(const struct aws_future_bool *future) {
+    return aws_future_impl_get_error((const struct aws_future_impl *)future);
+}
+void aws_future_bool_register_callback(
+    struct aws_future_bool *future,
+    aws_future_callback_fn *on_done,
+    void *user_data) {
+    aws_future_impl_register_callback((struct aws_future_impl *)future, on_done, user_data);
+}
+_Bool aws_future_bool_register_callback_if_not_done(
+    struct aws_future_bool *future,
+    aws_future_callback_fn *on_done,
+    void *user_data) {
+    return aws_future_impl_register_callback_if_not_done((struct aws_future_impl *)future, on_done, user_data);
+}
+void aws_future_bool_register_event_loop_callback(
+    struct aws_future_bool *future,
+    struct aws_event_loop *event_loop,
+    aws_future_callback_fn *on_done,
+    void *user_data) {
+    aws_future_impl_register_event_loop_callback((struct aws_future_impl *)future, event_loop, on_done, user_data);
+}
+void aws_future_bool_register_channel_callback(
+    struct aws_future_bool *future,
+    struct aws_channel *channel,
+    aws_future_callback_fn *on_done,
+    void *user_data) {
+    aws_future_impl_register_channel_callback((struct aws_future_impl *)future, channel, on_done, user_data);
+}
+_Bool aws_future_bool_wait(struct aws_future_bool *future, uint64_t timeout_ns) {
+    return aws_future_impl_wait((struct aws_future_impl *)future, timeout_ns);
+}
+
+AWS_FUTURE_T_BY_VALUE_IMPLEMENTATION(aws_future_size, size_t)
+
+/**
+ * aws_future<void>
+ */
+AWS_FUTURE_T_IMPLEMENTATION_BEGIN(aws_future_void)
+
+struct aws_future_void *aws_future_void_new(struct aws_allocator *alloc) {
+    /* Use aws_future<bool> under the hood, to avoid edge-cases with 0-sized result */
+    return (struct aws_future_void *)aws_future_bool_new(alloc);
+}
+
+void aws_future_void_set_result(struct aws_future_void *future) {
+    aws_future_bool_set_result((struct aws_future_bool *)future, false);
+}
+
+AWS_FUTURE_T_IMPLEMENTATION_END(aws_future_void)
diff --git a/contrib/restricted/aws/aws-c-io/source/io.c b/contrib/restricted/aws/aws-c-io/source/io.c
index 106ec0f9781..c47ce97a940 100644
--- a/contrib/restricted/aws/aws-c-io/source/io.c
+++ b/contrib/restricted/aws/aws-c-io/source/io.c
@@ -7,6 +7,7 @@
 #include <aws/io/logging.h>
 
 #include <aws/cal/cal.h>
+#include <aws/io/private/tracing.h>
 
 #define AWS_DEFINE_ERROR_INFO_IO(CODE, STR) [(CODE)-0x0400] = AWS_DEFINE_ERROR_INFO(CODE, STR, "aws-c-io")
 
@@ -300,6 +301,11 @@ static struct aws_error_info s_errors[] = {
     AWS_DEFINE_ERROR_INFO_IO(
         AWS_IO_STREAM_GET_LENGTH_UNSUPPORTED,
         "Get length is not supported in the underlying I/O source."),
+    AWS_DEFINE_ERROR_INFO_IO(
+        AWS_IO_TLS_ERROR_READ_FAILURE,
+        "Failure during TLS read."),
+    AWS_DEFINE_ERROR_INFO_IO(AWS_ERROR_PEM_MALFORMED, "Malformed PEM object encountered."),
+
 };
 /* clang-format on */
 
@@ -336,7 +342,7 @@ static struct aws_log_subject_info s_io_log_subject_infos[] = {
         "standard-retry-strategy",
         "Subject for standard retry strategy"),
     DEFINE_LOG_SUBJECT_INFO(AWS_LS_IO_PKCS11, "pkcs11", "Subject for PKCS#11 library operations"),
-};
+    DEFINE_LOG_SUBJECT_INFO(AWS_LS_IO_PEM, "pem", "Subject for pem operations")};
 
 static struct aws_log_subject_info_list s_io_log_subject_list = {
     .subject_list = s_io_log_subject_infos,
@@ -356,6 +362,7 @@ void aws_io_library_init(struct aws_allocator *allocator) {
         aws_register_error_info(&s_list);
         aws_register_log_subject_info_list(&s_io_log_subject_list);
         aws_tls_init_static_state(allocator);
+        aws_io_tracing_init();
     }
 }
 
diff --git a/contrib/restricted/aws/aws-c-io/source/linux/epoll_event_loop.c b/contrib/restricted/aws/aws-c-io/source/linux/epoll_event_loop.c
index af1ed765df4..094a7836a99 100644
--- a/contrib/restricted/aws/aws-c-io/source/linux/epoll_event_loop.c
+++ b/contrib/restricted/aws/aws-c-io/source/linux/epoll_event_loop.c
@@ -5,11 +5,13 @@
 
 #include <aws/io/event_loop.h>
 
+#include <aws/cal/cal.h>
 #include <aws/common/atomics.h>
 #include <aws/common/clock.h>
 #include <aws/common/mutex.h>
 #include <aws/common/task_scheduler.h>
 #include <aws/common/thread.h>
+#include <aws/io/private/tracing.h>
 
 #include <aws/io/logging.h>
 
@@ -562,6 +564,12 @@ static int aws_event_loop_listen_for_io_events(int epoll_fd, struct epoll_event
     return epoll_wait(epoll_fd, events, MAX_EVENTS, timeout);
 }
 
+static void s_aws_epoll_cleanup_aws_lc_thread_local_state(void *user_data) {
+    (void)user_data;
+
+    aws_cal_thread_clean_up();
+}
+
 static void aws_event_loop_thread(void *args) {
     struct aws_event_loop *event_loop = args;
     AWS_LOGF_INFO(AWS_LS_IO_EVENT_LOOP, "id=%p: main loop started", (void *)event_loop);
@@ -576,6 +584,8 @@ static void aws_event_loop_thread(void *args) {
         return;
     }
 
+    aws_thread_current_at_exit(s_aws_epoll_cleanup_aws_lc_thread_local_state, NULL);
+
     int timeout = DEFAULT_TIMEOUT;
 
     struct epoll_event events[MAX_EVENTS];
@@ -606,6 +616,8 @@ static void aws_event_loop_thread(void *args) {
 
         AWS_LOGF_TRACE(
             AWS_LS_IO_EVENT_LOOP, "id=%p: wake up with %d events to process.", (void *)event_loop, event_count);
+
+        __itt_task_begin(io_tracing_domain, __itt_null, __itt_null, tracing_event_loop_events);
         for (int i = 0; i < event_count; ++i) {
             struct epoll_event_data *event_data = (struct epoll_event_data *)events[i].data.ptr;
 
@@ -636,9 +648,12 @@ static void aws_event_loop_thread(void *args) {
                     "id=%p: activity on fd %d, invoking handler.",
                     (void *)event_loop,
                     event_data->handle->data.fd);
+                __itt_task_begin(io_tracing_domain, __itt_null, __itt_null, tracing_event_loop_event);
                 event_data->on_event(event_loop, event_data->handle, event_mask, event_data->user_data);
+                __itt_task_end(io_tracing_domain);
             }
         }
+        __itt_task_end(io_tracing_domain);
 
         /* run scheduled tasks */
         s_process_task_pre_queue(event_loop);
@@ -647,7 +662,9 @@ static void aws_event_loop_thread(void *args) {
         event_loop->clock(&now_ns); /* if clock fails, now_ns will be 0 and tasks scheduled for a specific time
                                        will not be run. That's ok, we'll handle them next time around. */
         AWS_LOGF_TRACE(AWS_LS_IO_EVENT_LOOP, "id=%p: running scheduled tasks.", (void *)event_loop);
+        __itt_task_begin(io_tracing_domain, __itt_null, __itt_null, tracing_event_loop_run_tasks);
         aws_task_scheduler_run_all(&epoll_loop->scheduler, now_ns);
+        __itt_task_end(io_tracing_domain);
 
         /* set timeout for next epoll_wait() call.
          * if clock fails, or scheduler has no tasks, use default timeout */
diff --git a/contrib/restricted/aws/aws-c-io/source/pem.c b/contrib/restricted/aws/aws-c-io/source/pem.c
new file mode 100644
index 00000000000..154a32cd9ad
--- /dev/null
+++ b/contrib/restricted/aws/aws-c-io/source/pem.c
@@ -0,0 +1,436 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0.
+ */
+#include <aws/common/encoding.h>
+#include <aws/common/string.h>
+#include <aws/io/pem.h>
+#include <aws/io/private/pem_utils.h>
+
+#include <aws/io/logging.h>
+
+enum aws_pem_parse_state {
+    BEGIN,
+    ON_DATA,
+    END,
+};
+
+static const struct aws_byte_cursor begin_header = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----BEGIN");
+static const struct aws_byte_cursor end_header = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----END");
+static const struct aws_byte_cursor dashes = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----");
+
+int aws_sanitize_pem(struct aws_byte_buf *pem, struct aws_allocator *allocator) {
+    if (!pem->len) {
+        /* reject files with no PEM data */
+        return aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
+    }
+    struct aws_byte_buf clean_pem_buf;
+    if (aws_byte_buf_init(&clean_pem_buf, allocator, pem->len)) {
+        return AWS_OP_ERR;
+    }
+    struct aws_byte_cursor pem_cursor = aws_byte_cursor_from_buf(pem);
+    enum aws_pem_parse_state state = BEGIN;
+
+    for (size_t i = 0; i < pem_cursor.len; i++) {
+        /* parse through the pem once */
+        char current = *(pem_cursor.ptr + i);
+        switch (state) {
+            case BEGIN:
+                if (current == '-') {
+                    struct aws_byte_cursor compare_cursor = pem_cursor;
+                    compare_cursor.len = begin_header.len;
+                    compare_cursor.ptr += i;
+                    if (aws_byte_cursor_eq(&compare_cursor, &begin_header)) {
+                        state = ON_DATA;
+                        i--;
+                    }
+                }
+                break;
+            case ON_DATA:
+                /* start copying everything */
+                if (current == '-') {
+                    struct aws_byte_cursor compare_cursor = pem_cursor;
+                    compare_cursor.len = end_header.len;
+                    compare_cursor.ptr += i;
+                    if (aws_byte_cursor_eq(&compare_cursor, &end_header)) {
+                        /* Copy the end header string and start to search for the end part of a pem */
+                        state = END;
+                        aws_byte_buf_append(&clean_pem_buf, &end_header);
+                        i += (end_header.len - 1);
+                        break;
+                    }
+                }
+                aws_byte_buf_append_byte_dynamic(&clean_pem_buf, (uint8_t)current);
+                break;
+            case END:
+                if (current == '-') {
+                    struct aws_byte_cursor compare_cursor = pem_cursor;
+                    compare_cursor.len = dashes.len;
+                    compare_cursor.ptr += i;
+                    if (aws_byte_cursor_eq(&compare_cursor, &dashes)) {
+                        /* End part of a pem, copy the last 5 dashes and a new line, then ignore everything before next
+                         * begin header */
+                        state = BEGIN;
+                        aws_byte_buf_append(&clean_pem_buf, &dashes);
+                        i += (dashes.len - 1);
+                        aws_byte_buf_append_byte_dynamic(&clean_pem_buf, (uint8_t)'\n');
+                        break;
+                    }
+                }
+                aws_byte_buf_append_byte_dynamic(&clean_pem_buf, (uint8_t)current);
+                break;
+            default:
+                break;
+        }
+    }
+
+    if (clean_pem_buf.len == 0) {
+        /* No valid data remains after sanitization. File might have been the wrong format */
+        aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
+        goto error;
+    }
+
+    struct aws_byte_cursor clean_pem_cursor = aws_byte_cursor_from_buf(&clean_pem_buf);
+    aws_byte_buf_reset(pem, true);
+    aws_byte_buf_append_dynamic(pem, &clean_pem_cursor);
+    aws_byte_buf_clean_up(&clean_pem_buf);
+    return AWS_OP_SUCCESS;
+
+error:
+    aws_byte_buf_clean_up(&clean_pem_buf);
+    return AWS_OP_ERR;
+}
+
+/*
+ * Possible PEM object types. openssl/pem.h used as a source of truth for
+ * possible types.
+ */
+static struct aws_byte_cursor s_pem_type_x509_old_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("X509 CERTIFICATE");
+static struct aws_byte_cursor s_pem_type_x509_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("CERTIFICATE");
+static struct aws_byte_cursor s_pem_type_x509_trusted_cur =
+    AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("TRUSTED CERTIFICATE");
+static struct aws_byte_cursor s_pem_type_x509_req_old_cur =
+    AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("NEW CERTIFICATE REQUEST");
+static struct aws_byte_cursor s_pem_type_x509_req_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("CERTIFICATE REQUEST");
+static struct aws_byte_cursor s_pem_type_x509_crl_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("X509 CRL");
+static struct aws_byte_cursor s_pem_type_evp_pkey_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("ANY PRIVATE KEY");
+static struct aws_byte_cursor s_pem_type_public_pkcs8_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("PUBLIC KEY");
+static struct aws_byte_cursor s_pem_type_private_rsa_pkcs1_cur =
+    AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("RSA PRIVATE KEY");
+static struct aws_byte_cursor s_pem_type_public_rsa_pkcs1_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("RSA PUBLIC KEY");
+static struct aws_byte_cursor s_pem_type_private_dsa_pkcs1_cur =
+    AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("RSA PRIVATE KEY");
+static struct aws_byte_cursor s_pem_type_public_dsa_pkcs1_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("RSA PUBLIC KEY");
+static struct aws_byte_cursor s_pem_type_pkcs7_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("PKCS7");
+static struct aws_byte_cursor s_pem_type_pkcs7_signed_data_cur =
+    AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("PKCS #7 SIGNED DATA");
+static struct aws_byte_cursor s_pem_type_private_pkcs8_encrypted_cur =
+    AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("ENCRYPTED PRIVATE KEY");
+static struct aws_byte_cursor s_pem_type_private_pkcs8_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("PRIVATE KEY");
+static struct aws_byte_cursor s_pem_type_dh_parameters_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("DH PARAMETERS");
+static struct aws_byte_cursor s_pem_type_dh_parameters_x942_cur =
+    AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("X9.42 DH PARAMETERS");
+static struct aws_byte_cursor s_pem_type_ssl_session_parameters_cur =
+    AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("SSL SESSION PARAMETERS");
+static struct aws_byte_cursor s_pem_type_dsa_parameters_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("DSA PARAMETERS");
+static struct aws_byte_cursor s_pem_type_ecdsa_public_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("ECDSA PUBLIC KEY");
+static struct aws_byte_cursor s_pem_type_ec_parameters_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("EC PARAMETERS");
+static struct aws_byte_cursor s_pem_type_ec_private_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("EC PRIVATE KEY");
+static struct aws_byte_cursor s_pem_type_parameters_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("PARAMETERS");
+static struct aws_byte_cursor s_pem_type_cms_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("CMS");
+static struct aws_byte_cursor s_pem_type_sm2_parameters_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("SM2 PARAMETERS");
+
+void aws_pem_objects_clean_up(struct aws_array_list *pem_objects) {
+    for (size_t i = 0; i < aws_array_list_length(pem_objects); ++i) {
+        struct aws_pem_object *pem_obj_ptr = NULL;
+        aws_array_list_get_at_ptr(pem_objects, (void **)&pem_obj_ptr, i);
+
+        if (pem_obj_ptr != NULL) {
+            aws_byte_buf_clean_up_secure(&pem_obj_ptr->data);
+            aws_string_destroy(pem_obj_ptr->type_string);
+        }
+    }
+
+    aws_array_list_clear(pem_objects);
+    aws_array_list_clean_up(pem_objects);
+}
+
+enum aws_pem_object_type s_map_type_cur_to_type(struct aws_byte_cursor type_cur) {
+    /*
+     * Putting all those in a hash table might be a bit faster depending on
+     * hashing function cost, but it complicates code considerably for a
+     * potential small gain. PEM parsing is already slow due to multiple
+     * allocations and should not be used in perf critical places.
+     * So choosing dumb and easy approach over something more complicated and we
+     * can reevaluate decision in the future.
+     */
+    if (aws_byte_cursor_eq(&type_cur, &s_pem_type_x509_old_cur)) {
+        return AWS_PEM_TYPE_X509_OLD;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_x509_cur)) {
+        return AWS_PEM_TYPE_X509;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_x509_trusted_cur)) {
+        return AWS_PEM_TYPE_X509_TRUSTED;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_x509_req_old_cur)) {
+        return AWS_PEM_TYPE_X509_REQ_OLD;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_x509_req_cur)) {
+        return AWS_PEM_TYPE_X509_REQ;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_x509_crl_cur)) {
+        return AWS_PEM_TYPE_X509_CRL;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_evp_pkey_cur)) {
+        return AWS_PEM_TYPE_EVP_PKEY;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_public_pkcs8_cur)) {
+        return AWS_PEM_TYPE_PUBLIC_PKCS8;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_private_rsa_pkcs1_cur)) {
+        return AWS_PEM_TYPE_PRIVATE_RSA_PKCS1;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_public_rsa_pkcs1_cur)) {
+        return AWS_PEM_TYPE_PUBLIC_RSA_PKCS1;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_private_dsa_pkcs1_cur)) {
+        return AWS_PEM_TYPE_PRIVATE_DSA_PKCS1;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_public_dsa_pkcs1_cur)) {
+        return AWS_PEM_TYPE_PUBLIC_DSA_PKCS1;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_pkcs7_cur)) {
+        return AWS_PEM_TYPE_PKCS7;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_pkcs7_signed_data_cur)) {
+        return AWS_PEM_TYPE_PKCS7_SIGNED_DATA;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_private_pkcs8_encrypted_cur)) {
+        return AWS_PEM_TYPE_PRIVATE_PKCS8_ENCRYPTED;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_private_pkcs8_cur)) {
+        return AWS_PEM_TYPE_PRIVATE_PKCS8;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_dh_parameters_cur)) {
+        return AWS_PEM_TYPE_DH_PARAMETERS;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_dh_parameters_x942_cur)) {
+        return AWS_PEM_TYPE_DH_PARAMETERS_X942;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_ssl_session_parameters_cur)) {
+        return AWS_PEM_TYPE_SSL_SESSION_PARAMETERS;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_dsa_parameters_cur)) {
+        return AWS_PEM_TYPE_DSA_PARAMETERS;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_ecdsa_public_cur)) {
+        return AWS_PEM_TYPE_ECDSA_PUBLIC;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_ec_parameters_cur)) {
+        return AWS_PEM_TYPE_EC_PARAMETERS;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_ec_private_cur)) {
+        return AWS_PEM_TYPE_EC_PRIVATE;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_parameters_cur)) {
+        return AWS_PEM_TYPE_PARAMETERS;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_cms_cur)) {
+        return AWS_PEM_TYPE_CMS;
+    } else if (aws_byte_cursor_eq(&type_cur, &s_pem_type_sm2_parameters_cur)) {
+        return AWS_PEM_TYPE_SM2_PARAMETERS;
+    }
+
+    return AWS_PEM_TYPE_UNKNOWN;
+}
+
+static struct aws_byte_cursor s_begin_header_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----BEGIN");
+static struct aws_byte_cursor s_end_header_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----END");
+static struct aws_byte_cursor s_delim_cur = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----");
+
+int s_extract_header_type_cur(struct aws_byte_cursor cur, struct aws_byte_cursor *out) {
+    if (!aws_byte_cursor_starts_with(&cur, &s_begin_header_cur)) {
+        AWS_LOGF_ERROR(AWS_LS_IO_PEM, "Invalid PEM buffer: invalid begin token");
+        return aws_raise_error(AWS_ERROR_PEM_MALFORMED);
+    }
+
+    aws_byte_cursor_advance(&cur, s_begin_header_cur.len);
+    aws_byte_cursor_advance(&cur, 1); // space after begin
+
+    struct aws_byte_cursor type_cur = aws_byte_cursor_advance(&cur, cur.len - s_delim_cur.len);
+
+    if (!aws_byte_cursor_eq(&cur, &s_delim_cur)) {
+        AWS_LOGF_ERROR(AWS_LS_IO_PEM, "Invalid PEM buffer: invalid end token");
+        return aws_raise_error(AWS_ERROR_PEM_MALFORMED);
+    }
+
+    *out = type_cur;
+    return AWS_OP_SUCCESS;
+}
+
+static int s_convert_pem_to_raw_base64(
+    struct aws_allocator *allocator,
+    struct aws_byte_cursor pem,
+    struct aws_array_list *pem_objects) {
+
+    struct aws_array_list split_buffers;
+    if (aws_array_list_init_dynamic(&split_buffers, allocator, 16, sizeof(struct aws_byte_cursor))) {
+        return AWS_OP_ERR;
+    }
+
+    if (aws_byte_cursor_split_on_char(&pem, '\n', &split_buffers)) {
+        aws_array_list_clean_up(&split_buffers);
+        AWS_LOGF_ERROR(AWS_LS_IO_PEM, "Invalid PEM buffer: failed to split on newline");
+        return aws_raise_error(AWS_ERROR_PEM_MALFORMED);
+    }
+
+    enum aws_pem_parse_state state = BEGIN;
+    bool on_length_calc = true;
+    size_t current_obj_len = 0;
+    size_t current_obj_start_index = 0;
+    struct aws_byte_buf current_obj_buf;
+    AWS_ZERO_STRUCT(current_obj_buf);
+    struct aws_byte_cursor current_obj_type_cur;
+    AWS_ZERO_STRUCT(current_obj_type_cur);
+    enum aws_pem_object_type current_obj_type = AWS_PEM_TYPE_UNKNOWN;
+
+    size_t split_count = aws_array_list_length(&split_buffers);
+    size_t i = 0;
+
+    while (i < split_count) {
+        struct aws_byte_cursor *line_cur_ptr = NULL;
+        int error = aws_array_list_get_at_ptr(&split_buffers, (void **)&line_cur_ptr, i);
+        /* should never fail as we control array size and how we index into list */
+        AWS_FATAL_ASSERT(error == AWS_OP_SUCCESS);
+
+        /* Burn off the padding in the buffer first.
+         * Worst case we'll only have to do this once per line in the buffer. */
+        *line_cur_ptr = aws_byte_cursor_left_trim_pred(line_cur_ptr, aws_isspace);
+
+        /* And make sure remove any space from right side */
+        *line_cur_ptr = aws_byte_cursor_right_trim_pred(line_cur_ptr, aws_isspace);
+
+        switch (state) {
+            case BEGIN:
+                if (aws_byte_cursor_starts_with(line_cur_ptr, &s_begin_header_cur)) {
+                    if (s_extract_header_type_cur(*line_cur_ptr, &current_obj_type_cur)) {
+                        goto on_end_of_loop;
+                    }
+                    current_obj_type = s_map_type_cur_to_type(current_obj_type_cur);
+                    current_obj_start_index = i + 1;
+                    state = ON_DATA;
+                }
+                ++i;
+                break;
+            /* this loops through the lines containing data twice. First to figure out the length, a second
+             * time to actually copy the data. */
+            case ON_DATA:
+                /* Found end tag. */
+                if (aws_byte_cursor_starts_with(line_cur_ptr, &s_end_header_cur)) {
+                    if (on_length_calc) {
+                        on_length_calc = false;
+                        state = ON_DATA;
+                        i = current_obj_start_index;
+                        aws_byte_buf_init(&current_obj_buf, allocator, current_obj_len);
+
+                    } else {
+                        struct aws_pem_object pem_object = {
+                            .data = current_obj_buf,
+                            .type_string = aws_string_new_from_cursor(allocator, &current_obj_type_cur),
+                            .type = current_obj_type,
+                        };
+
+                        if (aws_array_list_push_back(pem_objects, &pem_object)) {
+                            goto on_end_of_loop;
+                        }
+                        state = BEGIN;
+                        on_length_calc = true;
+                        current_obj_len = 0;
+                        ++i;
+                        AWS_ZERO_STRUCT(current_obj_buf);
+                        AWS_ZERO_STRUCT(current_obj_type_cur);
+                        current_obj_type = AWS_PEM_TYPE_UNKNOWN;
+                    }
+                    /* actually on a line with data in it. */
+                } else {
+                    if (on_length_calc) {
+                        current_obj_len += line_cur_ptr->len;
+                    } else {
+                        if (aws_byte_buf_append(&current_obj_buf, line_cur_ptr)) {
+                            goto on_end_of_loop;
+                        }
+                    }
+                    ++i;
+                }
+                break;
+            default:
+                AWS_FATAL_ASSERT(false);
+        }
+    }
+
+/*
+ * Note: this function only hard error if nothing can be parsed out of file.
+ * Otherwise it succeeds and returns whatever was parsed successfully.
+ */
+on_end_of_loop:
+    aws_array_list_clean_up(&split_buffers);
+    aws_byte_buf_clean_up_secure(&current_obj_buf);
+
+    if (state == BEGIN && aws_array_list_length(pem_objects) > 0) {
+        return AWS_OP_SUCCESS;
+    }
+
+    AWS_LOGF_ERROR(AWS_LS_IO_PEM, "Invalid PEM buffer.");
+    aws_pem_objects_clean_up(pem_objects);
+    return aws_raise_error(AWS_ERROR_PEM_MALFORMED);
+}
+
+int aws_pem_objects_init_from_file_contents(
+    struct aws_array_list *pem_objects,
+    struct aws_allocator *allocator,
+    struct aws_byte_cursor pem_cursor) {
+    AWS_PRECONDITION(allocator);
+    AWS_PRECONDITION(pem_objects != NULL);
+
+    /* Init empty array list, ideally, the PEM should only has one key included. */
+    if (aws_array_list_init_dynamic(pem_objects, allocator, 1, sizeof(struct aws_pem_object))) {
+        return AWS_OP_ERR;
+    }
+
+    if (s_convert_pem_to_raw_base64(allocator, pem_cursor, pem_objects)) {
+        goto on_error;
+    }
+
+    for (size_t i = 0; i < aws_array_list_length(pem_objects); ++i) {
+        struct aws_pem_object *pem_obj_ptr = NULL;
+        aws_array_list_get_at_ptr(pem_objects, (void **)&pem_obj_ptr, i);
+        struct aws_byte_cursor byte_cur = aws_byte_cursor_from_buf(&pem_obj_ptr->data);
+
+        size_t decoded_len = 0;
+        if (aws_base64_compute_decoded_len(&byte_cur, &decoded_len)) {
+            AWS_LOGF_ERROR(AWS_LS_IO_PEM, "Failed to get length for decoded base64 pem object.");
+            aws_raise_error(AWS_ERROR_PEM_MALFORMED);
+            goto on_error;
+        }
+
+        struct aws_byte_buf decoded_buffer;
+        aws_byte_buf_init(&decoded_buffer, allocator, decoded_len);
+
+        if (aws_base64_decode(&byte_cur, &decoded_buffer)) {
+            AWS_LOGF_ERROR(AWS_LS_IO_PEM, "Failed to base 64 decode pem object.");
+            aws_raise_error(AWS_ERROR_PEM_MALFORMED);
+            aws_byte_buf_clean_up_secure(&decoded_buffer);
+            goto on_error;
+        }
+
+        aws_byte_buf_clean_up_secure(&pem_obj_ptr->data);
+        pem_obj_ptr->data = decoded_buffer;
+    }
+
+    return AWS_OP_SUCCESS;
+
+on_error:
+    aws_pem_objects_clean_up(pem_objects);
+    return AWS_OP_ERR;
+}
+
+int aws_pem_objects_init_from_file_path(
+    struct aws_array_list *pem_objects,
+    struct aws_allocator *allocator,
+    const char *filename) {
+
+    struct aws_byte_buf raw_file_buffer;
+    if (aws_byte_buf_init_from_file(&raw_file_buffer, allocator, filename)) {
+        AWS_LOGF_ERROR(AWS_LS_IO_PEM, "Failed to read file %s.", filename);
+        return AWS_OP_ERR;
+    }
+    AWS_ASSERT(raw_file_buffer.buffer);
+
+    struct aws_byte_cursor file_cursor = aws_byte_cursor_from_buf(&raw_file_buffer);
+    if (aws_pem_objects_init_from_file_contents(pem_objects, allocator, file_cursor)) {
+        aws_byte_buf_clean_up_secure(&raw_file_buffer);
+        AWS_LOGF_ERROR(AWS_LS_IO_PEM, "Failed to decode PEM file %s.", filename);
+        return AWS_OP_ERR;
+    }
+
+    aws_byte_buf_clean_up_secure(&raw_file_buffer);
+
+    return AWS_OP_SUCCESS;
+}
diff --git a/contrib/restricted/aws/aws-c-io/source/pem_utils.c b/contrib/restricted/aws/aws-c-io/source/pem_utils.c
deleted file mode 100644
index c3843ffd4ad..00000000000
--- a/contrib/restricted/aws/aws-c-io/source/pem_utils.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0.
- */
-#include <aws/common/string.h>
-#include <aws/io/private/pem_utils.h>
-
-enum aws_pem_util_state {
-    BEGIN,
-    ON_DATA,
-    END,
-};
-
-static const struct aws_byte_cursor begin_header = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----BEGIN");
-static const struct aws_byte_cursor end_header = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----END");
-static const struct aws_byte_cursor dashes = AWS_BYTE_CUR_INIT_FROM_STRING_LITERAL("-----");
-
-int aws_sanitize_pem(struct aws_byte_buf *pem, struct aws_allocator *allocator) {
-    if (!pem->len) {
-        /* reject files with no PEM data */
-        return aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
-    }
-    struct aws_byte_buf clean_pem_buf;
-    if (aws_byte_buf_init(&clean_pem_buf, allocator, pem->len)) {
-        return AWS_OP_ERR;
-    }
-    struct aws_byte_cursor pem_cursor = aws_byte_cursor_from_buf(pem);
-    int state = BEGIN;
-
-    for (size_t i = 0; i < pem_cursor.len; i++) {
-        /* parse through the pem once */
-        char current = *(pem_cursor.ptr + i);
-        switch (state) {
-            case BEGIN:
-                if (current == '-') {
-                    struct aws_byte_cursor compare_cursor = pem_cursor;
-                    compare_cursor.len = begin_header.len;
-                    compare_cursor.ptr += i;
-                    if (aws_byte_cursor_eq(&compare_cursor, &begin_header)) {
-                        state = ON_DATA;
-                        i--;
-                    }
-                }
-                break;
-            case ON_DATA:
-                /* start copying everything */
-                if (current == '-') {
-                    struct aws_byte_cursor compare_cursor = pem_cursor;
-                    compare_cursor.len = end_header.len;
-                    compare_cursor.ptr += i;
-                    if (aws_byte_cursor_eq(&compare_cursor, &end_header)) {
-                        /* Copy the end header string and start to search for the end part of a pem */
-                        state = END;
-                        aws_byte_buf_append(&clean_pem_buf, &end_header);
-                        i += (end_header.len - 1);
-                        break;
-                    }
-                }
-                aws_byte_buf_append_byte_dynamic(&clean_pem_buf, (uint8_t)current);
-                break;
-            case END:
-                if (current == '-') {
-                    struct aws_byte_cursor compare_cursor = pem_cursor;
-                    compare_cursor.len = dashes.len;
-                    compare_cursor.ptr += i;
-                    if (aws_byte_cursor_eq(&compare_cursor, &dashes)) {
-                        /* End part of a pem, copy the last 5 dashes and a new line, then ignore everything before next
-                         * begin header */
-                        state = BEGIN;
-                        aws_byte_buf_append(&clean_pem_buf, &dashes);
-                        i += (dashes.len - 1);
-                        aws_byte_buf_append_byte_dynamic(&clean_pem_buf, (uint8_t)'\n');
-                        break;
-                    }
-                }
-                aws_byte_buf_append_byte_dynamic(&clean_pem_buf, (uint8_t)current);
-                break;
-            default:
-                break;
-        }
-    }
-
-    if (clean_pem_buf.len == 0) {
-        /* No valid data remains after sanitization. File might have been the wrong format */
-        aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
-        goto error;
-    }
-
-    struct aws_byte_cursor clean_pem_cursor = aws_byte_cursor_from_buf(&clean_pem_buf);
-    aws_byte_buf_reset(pem, true);
-    aws_byte_buf_append_dynamic(pem, &clean_pem_cursor);
-    aws_byte_buf_clean_up(&clean_pem_buf);
-    return AWS_OP_SUCCESS;
-
-error:
-    aws_byte_buf_clean_up(&clean_pem_buf);
-    return AWS_OP_ERR;
-}
diff --git a/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11.h b/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11.h
index 0d78dd71136..dd3d3549f68 100644
--- a/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11.h
+++ b/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11.h
@@ -1,265 +1,1766 @@
-/* Copyright (c) OASIS Open 2016. All Rights Reserved./
- * /Distributed under the terms of the OASIS IPR Policy,
- * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
- * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
- * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
- */
-        
-/* Latest version of the specification:
- * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
+/* This file is in the Public Domain. */
+/* This file is based on: https://github.com/latchset/pkcs11-headers/blob/main/public-domain/2.40/pkcs11.h */
+/* This file has been modified from its original version by Amazon:
+ * - removed final semicolon from #define ULONGDEF, to avoid "extra-semi" warning
+ * - removed final semicolon from #define STRUCTDEF, to avoid "extra-semi" warning
  */
 
-#ifndef _PKCS11_H_
-#define _PKCS11_H_ 1
+#ifndef _PD_PKCS11_
+#define _PD_PKCS11_
+
+#define CRYPTOKI_VERSION_MAJOR 2
+#define CRYPTOKI_VERSION_MINOR 40
+#define CRYPTOKI_VERSION_AMENDMENT 0
+
+/* Basic types */
+typedef unsigned char CK_BBOOL;
+typedef unsigned char CK_BYTE;
+typedef unsigned char CK_CHAR;
+typedef unsigned char CK_UTF8CHAR;
+typedef unsigned long int CK_ULONG;
+
+typedef CK_BBOOL * CK_BBOOL_PTR;
+typedef CK_BYTE * CK_BYTE_PTR;
+typedef CK_CHAR * CK_CHAR_PTR;
+typedef CK_UTF8CHAR * CK_UTF8CHAR_PTR;
+typedef CK_ULONG * CK_ULONG_PTR;
+
+/* Basic defines */
+#define NULL_PTR ((void *)0)
+typedef void * CK_VOID_PTR;
+typedef void ** CK_VOID_PTR_PTR;
+
+#define CK_EFFECTIVELY_INFINITE 0UL
+#define CK_UNAVAILABLE_INFORMATION ~0UL
+#define CK_INVALID_HANDLE 0UL
+#define CK_TRUE 1
+#define CK_FALSE 0
+
+/* CK_ types in alphabetical order */
+#define ULONGDEF(__name__) \
+typedef CK_ULONG __name__; \
+typedef __name__ * __name__ ## _PTR
+
+ULONGDEF(CK_ATTRIBUTE_TYPE);
+ULONGDEF(CK_CERTIFICATE_CATEGORY);
+ULONGDEF(CK_CERTIFICATE_TYPE);
+ULONGDEF(CK_EC_KDF_TYPE);
+ULONGDEF(CK_EXTRACT_PARAMS);
+ULONGDEF(CK_FLAGS);
+ULONGDEF(CK_HW_FEATURE_TYPE);
+ULONGDEF(CK_JAVA_MIDP_SECURITY_DOMAIN);
+ULONGDEF(CK_KEY_TYPE);
+ULONGDEF(CK_MAC_GENERAL_PARAMS);
+ULONGDEF(CK_MECHANISM_TYPE);
+ULONGDEF(CK_NOTIFICATION);
+ULONGDEF(CK_OBJECT_CLASS);
+ULONGDEF(CK_OBJECT_HANDLE);
+ULONGDEF(CK_OTP_PARAM_TYPE);
+ULONGDEF(CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE);
+ULONGDEF(CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE);
+ULONGDEF(CK_RC2_PARAMS);
+ULONGDEF(CK_RSA_PKCS_MGF_TYPE);
+ULONGDEF(CK_RSA_PKCS_OAEP_SOURCE_TYPE);
+ULONGDEF(CK_RV);
+ULONGDEF(CK_SESSION_HANDLE);
+ULONGDEF(CK_SLOT_ID);
+ULONGDEF(CK_STATE);
+ULONGDEF(CK_USER_TYPE);
+ULONGDEF(CK_X9_42_DH_KDF_TYPE);
+
+/* domain specific values and constants */
+
+/* CK (certificate) */
+#define CK_CERTIFICATE_CATEGORY_UNSPECIFIED 0UL
+#define CK_CERTIFICATE_CATEGORY_TOKEN_USER 1UL
+#define CK_CERTIFICATE_CATEGORY_AUTHORITY 2UL
+#define CK_CERTIFICATE_CATEGORY_OTHER_ENTITY 3UL
+
+/* CK (OTP) */
+#define CK_OTP_VALUE 0UL
+#define CK_OTP_PIN 1UL
+#define CK_OTP_CHALLENGE 2UL
+#define CK_OTP_TIME 3UL
+#define CK_OTP_COUNTER 4UL
+#define CK_OTP_FLAGS 5UL
+#define CK_OTP_OUTPUT_LENGTH 6UL
+#define CK_OTP_OUTPUT_FORMAT 7UL
 
-#ifdef __cplusplus
-extern "C" {
+/* CK (OTP format) */
+#define CK_OTP_FORMAT_DECIMAL 0UL
+#define CK_OTP_FORMAT_HEXADECIMAL 1UL
+#define CK_OTP_FORMAT_ALPHANUMERIC 2UL
+#define CK_OTP_FORMAT_BINARY 3UL
+
+/* CK (OTP requirement) */
+#define CK_OTP_PARAM_IGNORED 0UL
+#define CK_OTP_PARAM_OPTIONAL 1UL
+#define CK_OTP_PARAM_MANDATORY 2UL
+
+/* CK (security) */
+#define CK_SECURITY_DOMAIN_UNSPECIFIED 0UL
+#define CK_SECURITY_DOMAIN_MANUFACTURER 1UL
+#define CK_SECURITY_DOMAIN_OPERATOR 2UL
+#define CK_SECURITY_DOMAIN_THIRD_PARTY 3UL
+
+/* CK (SP800 DKM) */
+#define CK_SP800_108_DKM_LENGTH_SUM_OF_KEYS 0x00000001UL
+#define CK_SP800_108_DKM_LENGTH_SUM_OF_SEGMENTS 0x00000002UL
+
+/* CKA */
+#define CKA_CLASS 0x00000000UL
+#define CKA_TOKEN 0x00000001UL
+#define CKA_PRIVATE 0x00000002UL
+#define CKA_LABEL 0x00000003UL
+#define CKA_APPLICATION 0x00000010UL
+#define CKA_VALUE 0x00000011UL
+#define CKA_OBJECT_ID 0x00000012UL
+#define CKA_CERTIFICATE_TYPE 0x00000080UL
+#define CKA_ISSUER 0x00000081UL
+#define CKA_SERIAL_NUMBER 0x00000082UL
+#define CKA_AC_ISSUER 0x00000083UL
+#define CKA_OWNER 0x00000084UL
+#define CKA_ATTR_TYPES 0x00000085UL
+#define CKA_TRUSTED 0x00000086UL
+#define CKA_CERTIFICATE_CATEGORY 0x00000087UL
+#define CKA_JAVA_MIDP_SECURITY_DOMAIN 0x00000088UL
+#define CKA_URL 0x00000089UL
+#define CKA_HASH_OF_SUBJECT_PUBLIC_KEY 0x0000008AUL
+#define CKA_HASH_OF_ISSUER_PUBLIC_KEY 0x0000008BUL
+#define CKA_NAME_HASH_ALGORITHM 0x0000008CUL
+#define CKA_CHECK_VALUE 0x00000090UL
+#define CKA_KEY_TYPE 0x00000100UL
+#define CKA_SUBJECT 0x00000101UL
+#define CKA_ID 0x00000102UL
+#define CKA_SENSITIVE 0x00000103UL
+#define CKA_ENCRYPT 0x00000104UL
+#define CKA_DECRYPT 0x00000105UL
+#define CKA_WRAP 0x00000106UL
+#define CKA_UNWRAP 0x00000107UL
+#define CKA_SIGN 0x00000108UL
+#define CKA_SIGN_RECOVER 0x00000109UL
+#define CKA_VERIFY 0x0000010AUL
+#define CKA_VERIFY_RECOVER 0x0000010BUL
+#define CKA_DERIVE 0x0000010CUL
+#define CKA_START_DATE 0x00000110UL
+#define CKA_END_DATE 0x00000111UL
+#define CKA_MODULUS 0x00000120UL
+#define CKA_MODULUS_BITS 0x00000121UL
+#define CKA_PUBLIC_EXPONENT 0x00000122UL
+#define CKA_PRIVATE_EXPONENT 0x00000123UL
+#define CKA_PRIME_1 0x00000124UL
+#define CKA_PRIME_2 0x00000125UL
+#define CKA_EXPONENT_1 0x00000126UL
+#define CKA_EXPONENT_2 0x00000127UL
+#define CKA_COEFFICIENT 0x00000128UL
+#define CKA_PUBLIC_KEY_INFO 0x00000129UL
+#define CKA_PRIME 0x00000130UL
+#define CKA_SUBPRIME 0x00000131UL
+#define CKA_BASE 0x00000132UL
+#define CKA_PRIME_BITS 0x00000133UL
+#define CKA_SUBPRIME_BITS 0x00000134UL
+#define CKA_SUB_PRIME_BITS 0x00000134UL
+#define CKA_VALUE_BITS 0x00000160UL
+#define CKA_VALUE_LEN 0x00000161UL
+#define CKA_EXTRACTABLE 0x00000162UL
+#define CKA_LOCAL 0x00000163UL
+#define CKA_NEVER_EXTRACTABLE 0x00000164UL
+#define CKA_ALWAYS_SENSITIVE 0x00000165UL
+#define CKA_KEY_GEN_MECHANISM 0x00000166UL
+#define CKA_MODIFIABLE 0x00000170UL
+#define CKA_COPYABLE 0x00000171UL
+#define CKA_DESTROYABLE 0x00000172UL
+#define CKA_EC_PARAMS 0x00000180UL
+#define CKA_EC_POINT 0x00000181UL
+#define CKA_ALWAYS_AUTHENTICATE 0x00000202UL
+#define CKA_WRAP_WITH_TRUSTED 0x00000210UL
+#define CKA_OTP_FORMAT 0x00000220UL
+#define CKA_OTP_LENGTH 0x00000221UL
+#define CKA_OTP_TIME_INTERVAL 0x00000222UL
+#define CKA_OTP_USER_FRIENDLY_MODE 0x00000223UL
+#define CKA_OTP_CHALLENGE_REQUIREMENT 0x00000224UL
+#define CKA_OTP_TIME_REQUIREMENT 0x00000225UL
+#define CKA_OTP_COUNTER_REQUIREMENT 0x00000226UL
+#define CKA_OTP_PIN_REQUIREMENT 0x00000227UL
+#define CKA_OTP_COUNTER 0x0000022EUL
+#define CKA_OTP_TIME 0x0000022FUL
+#define CKA_OTP_USER_IDENTIFIER 0x0000022AUL
+#define CKA_OTP_SERVICE_IDENTIFIER 0x0000022BUL
+#define CKA_OTP_SERVICE_LOGO 0x0000022CUL
+#define CKA_OTP_SERVICE_LOGO_TYPE 0x0000022DUL
+#define CKA_GOSTR3410_PARAMS 0x00000250UL
+#define CKA_GOSTR3411_PARAMS 0x00000251UL
+#define CKA_GOST28147_PARAMS 0x00000252UL
+#define CKA_HW_FEATURE_TYPE 0x00000300UL
+#define CKA_RESET_ON_INIT 0x00000301UL
+#define CKA_HAS_RESET 0x00000302UL
+#define CKA_PIXEL_X 0x00000400UL
+#define CKA_PIXEL_Y 0x00000401UL
+#define CKA_RESOLUTION 0x00000402UL
+#define CKA_CHAR_ROWS 0x00000403UL
+#define CKA_CHAR_COLUMNS 0x00000404UL
+#define CKA_COLOR 0x00000405UL
+#define CKA_BITS_PER_PIXEL 0x00000406UL
+#define CKA_CHAR_SETS 0x00000480UL
+#define CKA_ENCODING_METHODS 0x00000481UL
+#define CKA_MIME_TYPES 0x00000482UL
+#define CKA_MECHANISM_TYPE 0x00000500UL
+#define CKA_REQUIRED_CMS_ATTRIBUTES 0x00000501UL
+#define CKA_DEFAULT_CMS_ATTRIBUTES 0x00000502UL
+#define CKA_SUPPORTED_CMS_ATTRIBUTES 0x00000503UL
+#define CKA_VENDOR_DEFINED 0x80000000UL
+/* Array attributes */
+#define CKA_WRAP_TEMPLATE 0x40000211UL
+#define CKA_UNWRAP_TEMPLATE 0x40000212UL
+#define CKA_DERIVE_TEMPLATE 0x40000213UL
+#define CKA_ALLOWED_MECHANISMS 0x40000600UL
+/* Deprecated */
+#ifdef PKCS11_DEPRECATED
+#define CKA_ECDSA_PARAMS 0x00000180UL
+#define CKA_SECONDARY_AUTH 0x00000200UL
+#define CKA_AUTH_PIN_FLAGS 0x00000201UL
 #endif
 
-/* Before including this file (pkcs11.h) (or pkcs11t.h by
- * itself), 5 platform-specific macros must be defined.  These
- * macros are described below, and typical definitions for them
- * are also given.  Be advised that these definitions can depend
- * on both the platform and the compiler used (and possibly also
- * on whether a Cryptoki library is linked statically or
- * dynamically).
- *
- * In addition to defining these 5 macros, the packing convention
- * for Cryptoki structures should be set.  The Cryptoki
- * convention on packing is that structures should be 1-byte
- * aligned.
- *
- * If you're using Microsoft Developer Studio 5.0 to produce
- * Win32 stuff, this might be done by using the following
- * preprocessor directive before including pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(push, cryptoki, 1)
- *
- * and using the following preprocessor directive after including
- * pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(pop, cryptoki)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to produce Win16 stuff, this might be done by using
- * the following preprocessor directive before including
- * pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(1)
- *
- * In a UNIX environment, you're on your own for this.  You might
- * not need to do (or be able to do!) anything.
- *
- *
- * Now for the macros:
- *
- *
- * 1. CK_PTR: The indirection string for making a pointer to an
- * object.  It can be used like this:
- *
- * typedef CK_BYTE CK_PTR CK_BYTE_PTR;
- *
- * If you're using Microsoft Developer Studio 5.0 to produce
- * Win32 stuff, it might be defined by:
- *
- * #define CK_PTR *
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to produce Win16 stuff, it might be defined by:
- *
- * #define CK_PTR far *
- *
- * In a typical UNIX environment, it might be defined by:
- *
- * #define CK_PTR *
- *
- *
- * 2. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
- * an importable Cryptoki library function declaration out of a
- * return type and a function name.  It should be used in the
- * following fashion:
- *
- * extern CK_DECLARE_FUNCTION(CK_RV, C_Initialize)(
- *   CK_VOID_PTR pReserved
- * );
- *
- * If you're using Microsoft Developer Studio 5.0 to declare a
- * function in a Win32 Cryptoki .dll, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType __declspec(dllimport) name
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to declare a function in a Win16 Cryptoki .dll, it
- * might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType __export _far _pascal name
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType name
- *
- *
- * 3. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
- * which makes a Cryptoki API function pointer declaration or
- * function pointer type declaration out of a return type and a
- * function name.  It should be used in the following fashion:
- *
- * // Define funcPtr to be a pointer to a Cryptoki API function
- * // taking arguments args and returning CK_RV.
- * CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtr)(args);
- *
- * or
- *
- * // Define funcPtrType to be the type of a pointer to a
- * // Cryptoki API function taking arguments args and returning
- * // CK_RV, and then define funcPtr to be a variable of type
- * // funcPtrType.
- * typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtrType)(args);
- * funcPtrType funcPtr;
- *
- * If you're using Microsoft Developer Studio 5.0 to access
- * functions in a Win32 Cryptoki .dll, in might be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType __declspec(dllimport) (* name)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to access functions in a Win16 Cryptoki .dll, it might
- * be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType __export _far _pascal (* name)
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType (* name)
- *
- *
- * 4. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
- * a function pointer type for an application callback out of
- * a return type for the callback and a name for the callback.
- * It should be used in the following fashion:
- *
- * CK_CALLBACK_FUNCTION(CK_RV, myCallback)(args);
- *
- * to declare a function pointer, myCallback, to a callback
- * which takes arguments args and returns a CK_RV.  It can also
- * be used like this:
- *
- * typedef CK_CALLBACK_FUNCTION(CK_RV, myCallbackType)(args);
- * myCallbackType myCallback;
- *
- * If you're using Microsoft Developer Studio 5.0 to do Win32
- * Cryptoki development, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType (* name)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to do Win16 development, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType _far _pascal (* name)
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType (* name)
- *
- *
- * 5. NULL_PTR: This macro is the value of a NULL pointer.
- *
- * In any ANSI/ISO C environment (and in many others as well),
- * this should best be defined by
- *
- * #ifndef NULL_PTR
- * #define NULL_PTR 0
- * #endif
- */
+/* CKC */
+#define CKC_X_509 0x00000000UL
+#define CKC_X_509_ATTR_CERT 0x00000001UL
+#define CKC_WTLS 0x00000002UL
+#define CKC_VENDOR_DEFINED 0x80000000UL
 
+/* CKD */
+#define CKD_NULL 0x00000001UL
+#define CKD_SHA1_KDF 0x00000002UL
+#define CKD_SHA1_KDF_ASN1 0x00000003UL
+#define CKD_SHA1_KDF_CONCATENATE 0x00000004UL
+#define CKD_SHA224_KDF 0x00000005UL
+#define CKD_SHA256_KDF 0x00000006UL
+#define CKD_SHA384_KDF 0x00000007UL
+#define CKD_SHA512_KDF 0x00000008UL
+#define CKD_CPDIVERSIFY_KDF 0x00000009UL
 
-/* All the various Cryptoki types and #define'd values are in the
- * file pkcs11t.h.
- */
-#include "pkcs11t.h"
+/* CFK (array attributes) */
+#define CKF_ARRAY_ATTRIBUTE 0x40000000UL
 
-#define __PASTE(x,y)      x##y
+/* CKF (capabilities) */
+#define CKF_LIBRARY_CANT_CREATE_OS_THREADS 0x00000001UL
+#define CKF_OS_LOCKING_OK 0x00000002UL
 
+/* CKF (mechanism) */
+#define CKF_HW 0x00000001UL
+#define CKF_ENCRYPT 0x00000100UL
+#define CKF_DECRYPT 0x00000200UL
+#define CKF_DIGEST 0x00000400UL
+#define CKF_SIGN 0x00000800UL
+#define CKF_SIGN_RECOVER 0x00001000UL
+#define CKF_VERIFY 0x00002000UL
+#define CKF_VERIFY_RECOVER 0x00004000UL
+#define CKF_GENERATE 0x00008000UL
+#define CKF_GENERATE_KEY_PAIR 0x00010000UL
+#define CKF_WRAP 0x00020000UL
+#define CKF_UNWRAP 0x00040000UL
+#define CKF_DERIVE 0x00080000UL
+#define CKF_EC_F_P 0x00100000UL
+#define CKF_EC_F_2M 0x00200000UL
+#define CKF_EC_ECPARAMETERS 0x00400000UL
+#define CKF_EC_NAMEDCURVE 0x00800000U
+#define CKF_EC_UNCOMPRESS 0x01000000UL
+#define CKF_EC_COMPRESS 0x02000000UL
+#define CKF_EXTENSION 0x80000000UL
 
-/* ==============================================================
- * Define the "extern" form of all the entry points.
- * ==============================================================
- */
+/* CKF (OTP) */
+#define CKF_NEXT_OTP 0x00000001UL
+#define CKF_EXCLUDE_TIME 0x00000002UL
+#define CKF_EXCLUDE_COUNTER 0x00000004UL
+#define CKF_EXCLUDE_CHALLENGE 0x00000008UL
+#define CKF_EXCLUDE_PIN 0x00000010UL
+#define CKF_USER_FRIENDLY_OTP 0x00000020UL
 
-#define CK_NEED_ARG_LIST  1
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  extern CK_DECLARE_FUNCTION(CK_RV, name)
+/* CKF (paramters to functions) */
+#define CKF_DONT_BLOCK 1
 
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes.
- */
-#include "pkcs11f.h"
+/* CKF (session) */
+#define CKF_RW_SESSION 0x00000002UL
+#define CKF_SERIAL_SESSION 0x00000004UL
 
-#undef CK_NEED_ARG_LIST
-#undef CK_PKCS11_FUNCTION_INFO
+/* CFK (slot) */
+#define CKF_TOKEN_PRESENT 0x00000001UL
+#define CKF_REMOVABLE_DEVICE 0x00000002UL
+#define CKF_HW_SLOT 0x00000004UL
 
+/* CKF (token) */
+#define CKF_RNG 0x00000001UL
+#define CKF_WRITE_PROTECTED 0x00000002UL
+#define CKF_LOGIN_REQUIRED 0x00000004UL
+#define CKF_USER_PIN_INITIALIZED 0x00000008UL
+#define CKF_RESTORE_KEY_NOT_NEEDED 0x00000020UL
+#define CKF_CLOCK_ON_TOKEN 0x00000040UL
+#define CKF_PROTECTED_AUTHENTICATION_PATH 0x00000100UL
+#define CKF_DUAL_CRYPTO_OPERATIONS 0x00000200UL
+#define CKF_TOKEN_INITIALIZED 0x00000400UL
+#define CKF_SECONDARY_AUTHENTICATION 0x00000800UL
+#define CKF_USER_PIN_COUNT_LOW 0x00010000UL
+#define CKF_USER_PIN_FINAL_TRY 0x00020000UL
+#define CKF_USER_PIN_LOCKED 0x00040000UL
+#define CKF_USER_PIN_TO_BE_CHANGED 0x00080000UL
+#define CKF_SO_PIN_COUNT_LOW 0x00100000UL
+#define CKF_SO_PIN_FINAL_TRY 0x00200000UL
+#define CKF_SO_PIN_LOCKED 0x00400000UL
+#define CKF_SO_PIN_TO_BE_CHANGED 0x00800000UL
+#define CKF_ERROR_STATE 0x01000000UL
 
-/* ==============================================================
- * Define the typedef form of all the entry points.  That is, for
- * each Cryptoki function C_XXX, define a type CK_C_XXX which is
- * a pointer to that kind of function.
- * ==============================================================
- */
+/* CKG (MFG) */
+#define CKG_MGF1_SHA1 0x00000001UL
+#define CKG_MGF1_SHA256 0x00000002UL
+#define CKG_MGF1_SHA384 0x00000003UL
+#define CKG_MGF1_SHA512 0x00000004UL
+#define CKG_MGF1_SHA224 0x00000005UL
 
-#define CK_NEED_ARG_LIST  1
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_,name))
+/* CKH */
+#define CKH_MONOTONIC_COUNTER 0x00000001UL
+#define CKH_CLOCK 0x00000002UL
+#define CKH_USER_INTERFACE 0x00000003UL
+#define CKH_VENDOR_DEFINED 0x80000000UL
 
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes.
- */
-#include "pkcs11f.h"
+/* CKK */
+#define CKK_RSA 0x00000000UL
+#define CKK_DSA 0x00000001UL
+#define CKK_DH 0x00000002UL
+#define CKK_EC 0x00000003UL
+#define CKK_X9_42_DH 0x00000004UL
+#define CKK_KEA 0x00000005UL
+#define CKK_GENERIC_SECRET 0x00000010UL
+#define CKK_RC2 0x00000011UL
+#define CKK_RC4 0x00000012UL
+#define CKK_DES 0x00000013UL
+#define CKK_DES2 0x00000014UL
+#define CKK_DES3 0x00000015UL
+#define CKK_CAST 0x00000016UL
+#define CKK_CAST3 0x00000017UL
+#define CKK_CAST128 0x00000018UL
+#define CKK_RC5 0x00000019UL
+#define CKK_IDEA 0x0000001AUL
+#define CKK_SKIPJACK 0x0000001BUL
+#define CKK_BATON 0x0000001CUL
+#define CKK_JUNIPER 0x0000001DUL
+#define CKK_CDMF 0x0000001EUL
+#define CKK_AES 0x0000001FUL
+#define CKK_BLOWFISH 0x00000020UL
+#define CKK_TWOFISH 0x00000021UL
+#define CKK_SECURID 0x00000022UL
+#define CKK_HOTP 0x00000023UL
+#define CKK_ACTI 0x00000024UL
+#define CKK_CAMELLIA 0x00000025UL
+#define CKK_ARIA 0x00000026UL
+#define CKK_MD5_HMAC 0x00000027UL
+#define CKK_SHA_1_HMAC 0x00000028UL
+#define CKK_RIPEMD128_HMAC 0x00000029UL
+#define CKK_RIPEMD160_HMAC 0x0000002AUL
+#define CKK_SHA256_HMAC 0x0000002BUL
+#define CKK_SHA384_HMAC 0x0000002CUL
+#define CKK_SHA512_HMAC 0x0000002DUL
+#define CKK_SHA224_HMAC 0x0000002EUL
+#define CKK_SEED 0x0000002FUL
+#define CKK_GOSTR3410 0x00000030UL
+#define CKK_GOSTR3411 0x00000031UL
+#define CKK_GOST28147 0x00000032UL
+#define CKK_VENDOR_DEFINED 0x80000000UL
+/* Deprecated */
+#ifdef PKCS11_DEPRECATED
+#define CKK_ECDSA 0x00000003UL
+#define CKK_CAST5 0x00000018UL
+#endif
 
-#undef CK_NEED_ARG_LIST
-#undef CK_PKCS11_FUNCTION_INFO
+/* CKM */
+#define CKM_RSA_PKCS_KEY_PAIR_GEN 0x00000000UL
+#define CKM_RSA_PKCS 0x00000001UL
+#define CKM_RSA_9796 0x00000002UL
+#define CKM_RSA_X_509 0x00000003UL
+#define CKM_MD2_RSA_PKCS 0x00000004UL
+#define CKM_MD5_RSA_PKCS 0x00000005UL
+#define CKM_SHA1_RSA_PKCS 0x00000006UL
+#define CKM_RIPEMD128_RSA_PKCS 0x00000007UL
+#define CKM_RIPEMD160_RSA_PKCS 0x00000008UL
+#define CKM_RSA_PKCS_OAEP 0x00000009UL
+#define CKM_RSA_X9_31_KEY_PAIR_GEN 0x0000000AUL
+#define CKM_RSA_X9_31 0x0000000BUL
+#define CKM_SHA1_RSA_X9_31 0x0000000CUL
+#define CKM_RSA_PKCS_PSS 0x0000000DUL
+#define CKM_SHA1_RSA_PKCS_PSS 0x0000000EUL
+#define CKM_DSA_KEY_PAIR_GEN 0x00000010UL
+#define CKM_DSA 0x00000011UL
+#define CKM_DSA_SHA1 0x00000012UL
+#define CKM_DSA_SHA224 0x00000013UL
+#define CKM_DSA_SHA256 0x00000014UL
+#define CKM_DSA_SHA384 0x00000015UL
+#define CKM_DSA_SHA512 0x00000016UL
+#define CKM_DH_PKCS_KEY_PAIR_GEN 0x00000020UL
+#define CKM_DH_PKCS_DERIVE 0x00000021UL
+#define CKM_X9_42_DH_KEY_PAIR_GEN 0x00000030UL
+#define CKM_X9_42_DH_DERIVE 0x00000031UL
+#define CKM_X9_42_DH_HYBRID_DERIVE 0x00000032UL
+#define CKM_X9_42_MQV_DERIVE 0x00000033UL
+#define CKM_SHA256_RSA_PKCS 0x00000040UL
+#define CKM_SHA384_RSA_PKCS 0x00000041UL
+#define CKM_SHA512_RSA_PKCS 0x00000042UL
+#define CKM_SHA256_RSA_PKCS_PSS 0x00000043UL
+#define CKM_SHA384_RSA_PKCS_PSS 0x00000044UL
+#define CKM_SHA512_RSA_PKCS_PSS 0x00000045UL
+#define CKM_SHA224_RSA_PKCS 0x00000046UL
+#define CKM_SHA224_RSA_PKCS_PSS 0x00000047UL
+#define CKM_SHA512_224 0x00000048UL
+#define CKM_SHA512_224_HMAC 0x00000049UL
+#define CKM_SHA512_224_HMAC_GENERAL 0x0000004AUL
+#define CKM_SHA512_224_KEY_DERIVATION 0x0000004BUL
+#define CKM_SHA512_256 0x0000004CUL
+#define CKM_SHA512_256_HMAC 0x0000004DUL
+#define CKM_SHA512_256_HMAC_GENERAL 0x0000004EUL
+#define CKM_SHA512_256_KEY_DERIVATION 0x0000004FUL
+#define CKM_SHA512_T 0x00000050UL
+#define CKM_SHA512_T_HMAC 0x00000051UL
+#define CKM_SHA512_T_HMAC_GENERAL 0x00000052UL
+#define CKM_SHA512_T_KEY_DERIVATION 0x00000053UL
+#define CKM_RC2_KEY_GEN 0x00000100UL
+#define CKM_RC2_ECB 0x00000101UL
+#define CKM_RC2_CBC 0x00000102UL
+#define CKM_RC2_MAC 0x00000103UL
+#define CKM_RC2_MAC_GENERAL 0x00000104UL
+#define CKM_RC2_CBC_PAD 0x00000105UL
+#define CKM_RC4_KEY_GEN 0x00000110UL
+#define CKM_RC4 0x00000111UL
+#define CKM_DES_KEY_GEN 0x00000120UL
+#define CKM_DES_ECB 0x00000121UL
+#define CKM_DES_CBC 0x00000122UL
+#define CKM_DES_MAC 0x00000123UL
+#define CKM_DES_MAC_GENERAL 0x00000124UL
+#define CKM_DES_CBC_PAD 0x00000125UL
+#define CKM_DES2_KEY_GEN 0x00000130UL
+#define CKM_DES3_KEY_GEN 0x00000131UL
+#define CKM_DES3_ECB 0x00000132UL
+#define CKM_DES3_CBC 0x00000133UL
+#define CKM_DES3_MAC 0x00000134UL
+#define CKM_DES3_MAC_GENERAL 0x00000135UL
+#define CKM_DES3_CBC_PAD 0x00000136UL
+#define CKM_DES3_CMAC_GENERAL 0x00000137UL
+#define CKM_DES3_CMAC 0x00000138UL
+#define CKM_CDMF_KEY_GEN 0x00000140UL
+#define CKM_CDMF_ECB 0x00000141UL
+#define CKM_CDMF_CBC 0x00000142UL
+#define CKM_CDMF_MAC 0x00000143UL
+#define CKM_CDMF_MAC_GENERAL 0x00000144UL
+#define CKM_CDMF_CBC_PAD 0x00000145UL
+#define CKM_DES_OFB64 0x00000150UL
+#define CKM_DES_OFB8 0x00000151UL
+#define CKM_DES_CFB64 0x00000152UL
+#define CKM_DES_CFB8 0x00000153UL
+#define CKM_MD2 0x00000200UL
+#define CKM_MD2_HMAC 0x00000201UL
+#define CKM_MD2_HMAC_GENERAL 0x00000202UL
+#define CKM_MD5 0x00000210UL
+#define CKM_MD5_HMAC 0x00000211UL
+#define CKM_MD5_HMAC_GENERAL 0x00000212UL
+#define CKM_SHA_1 0x00000220UL
+#define CKM_SHA_1_HMAC 0x00000221UL
+#define CKM_SHA_1_HMAC_GENERAL 0x00000222UL
+#define CKM_RIPEMD128 0x00000230UL
+#define CKM_RIPEMD128_HMAC 0x00000231UL
+#define CKM_RIPEMD128_HMAC_GENERAL 0x00000232UL
+#define CKM_RIPEMD160 0x00000240UL
+#define CKM_RIPEMD160_HMAC 0x00000241UL
+#define CKM_RIPEMD160_HMAC_GENERAL 0x00000242UL
+#define CKM_SHA256 0x00000250UL
+#define CKM_SHA256_HMAC 0x00000251UL
+#define CKM_SHA256_HMAC_GENERAL 0x00000252UL
+#define CKM_SHA224 0x00000255UL
+#define CKM_SHA224_HMAC 0x00000256UL
+#define CKM_SHA224_HMAC_GENERAL 0x00000257UL
+#define CKM_SHA384 0x00000260UL
+#define CKM_SHA384_HMAC 0x00000261UL
+#define CKM_SHA384_HMAC_GENERAL 0x00000262UL
+#define CKM_SHA512 0x00000270UL
+#define CKM_SHA512_HMAC 0x00000271UL
+#define CKM_SHA512_HMAC_GENERAL 0x00000272UL
+#define CKM_SECURID_KEY_GEN 0x00000280UL
+#define CKM_SECURID 0x00000282UL
+#define CKM_HOTP_KEY_GEN 0x00000290UL
+#define CKM_HOTP 0x00000291UL
+#define CKM_ACTI 0x000002A0UL
+#define CKM_ACTI_KEY_GEN 0x000002A1UL
+#define CKM_CAST_KEY_GEN 0x00000300UL
+#define CKM_CAST_ECB 0x00000301UL
+#define CKM_CAST_CBC 0x00000302UL
+#define CKM_CAST_MAC 0x00000303UL
+#define CKM_CAST_MAC_GENERAL 0x00000304UL
+#define CKM_CAST_CBC_PAD 0x00000305UL
+#define CKM_CAST3_KEY_GEN 0x00000310UL
+#define CKM_CAST3_ECB 0x00000311UL
+#define CKM_CAST3_CBC 0x00000312UL
+#define CKM_CAST3_MAC 0x00000313UL
+#define CKM_CAST3_MAC_GENERAL 0x00000314UL
+#define CKM_CAST3_CBC_PAD 0x00000315UL
+#define CKM_CAST128_KEY_GEN 0x00000320UL
+#define CKM_CAST5_ECB 0x00000321UL
+#define CKM_CAST128_ECB 0x00000321UL
+#define CKM_CAST128_MAC 0x00000323UL
+#define CKM_CAST128_CBC 0x00000322UL
+#define CKM_CAST128_MAC_GENERAL 0x00000324UL
+#define CKM_CAST128_CBC_PAD 0x00000325UL
+#define CKM_RC5_KEY_GEN 0x00000330UL
+#define CKM_RC5_ECB 0x00000331UL
+#define CKM_RC5_CBC 0x00000332UL
+#define CKM_RC5_MAC 0x00000333UL
+#define CKM_RC5_MAC_GENERAL 0x00000334UL
+#define CKM_RC5_CBC_PAD 0x00000335UL
+#define CKM_IDEA_KEY_GEN 0x00000340UL
+#define CKM_IDEA_ECB 0x00000341UL
+#define CKM_IDEA_CBC 0x00000342UL
+#define CKM_IDEA_MAC 0x00000343UL
+#define CKM_IDEA_MAC_GENERAL 0x00000344UL
+#define CKM_IDEA_CBC_PAD 0x00000345UL
+#define CKM_GENERIC_SECRET_KEY_GEN 0x00000350UL
+#define CKM_CONCATENATE_BASE_AND_KEY 0x00000360UL
+#define CKM_CONCATENATE_BASE_AND_DATA 0x00000362UL
+#define CKM_CONCATENATE_DATA_AND_BASE 0x00000363UL
+#define CKM_XOR_BASE_AND_DATA 0x00000364UL
+#define CKM_EXTRACT_KEY_FROM_KEY 0x00000365UL
+#define CKM_SSL3_PRE_MASTER_KEY_GEN 0x00000370UL
+#define CKM_SSL3_MASTER_KEY_DERIVE 0x00000371UL
+#define CKM_SSL3_KEY_AND_MAC_DERIVE 0x00000372UL
+#define CKM_SSL3_MASTER_KEY_DERIVE_DH 0x00000373UL
+#define CKM_TLS_PRE_MASTER_KEY_GEN 0x00000374UL
+#define CKM_TLS_MASTER_KEY_DERIVE 0x00000375UL
+#define CKM_TLS_KEY_AND_MAC_DERIVE 0x00000376UL
+#define CKM_TLS_MASTER_KEY_DERIVE_DH 0x00000377UL
+#define CKM_TLS_PRF 0x00000378UL
+#define CKM_SSL3_MD5_MAC 0x00000380UL
+#define CKM_SSL3_SHA1_MAC 0x00000381UL
+#define CKM_MD5_KEY_DERIVATION 0x00000390UL
+#define CKM_MD2_KEY_DERIVATION 0x00000391UL
+#define CKM_SHA1_KEY_DERIVATION 0x00000392UL
+#define CKM_SHA256_KEY_DERIVATION 0x00000393UL
+#define CKM_SHA384_KEY_DERIVATION 0x00000394UL
+#define CKM_SHA512_KEY_DERIVATION 0x00000395UL
+#define CKM_SHA224_KEY_DERIVATION 0x00000396UL
+#define CKM_PBE_MD2_DES_CBC 0x000003A0UL
+#define CKM_PBE_MD5_DES_CBC 0x000003A1UL
+#define CKM_PBE_MD5_CAST_CBC 0x000003A2UL
+#define CKM_PBE_MD5_CAST3_CBC 0x000003A3UL
+#define CKM_PBE_MD5_CAST128_CBC 0x000003A4UL
+#define CKM_PBE_SHA1_CAST128_CBC 0x000003A5UL
+#define CKM_PBE_SHA1_RC4_128 0x000003A6UL
+#define CKM_PBE_SHA1_RC4_40 0x000003A7UL
+#define CKM_PBE_SHA1_DES3_EDE_CBC 0x000003A8UL
+#define CKM_PBE_SHA1_DES2_EDE_CBC 0x000003A9UL
+#define CKM_PBE_SHA1_RC2_128_CBC 0x000003AAUL
+#define CKM_PBE_SHA1_RC2_40_CBC 0x000003ABUL
+#define CKM_PKCS5_PBKD2 0x000003B0UL
+#define CKM_PBA_SHA1_WITH_SHA1_HMAC 0x000003C0UL
+#define CKM_WTLS_PRE_MASTER_KEY_GEN 0x000003D0UL
+#define CKM_WTLS_MASTER_KEY_DERIVE 0x000003D1UL
+#define CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC 0x000003D2UL
+#define CKM_WTLS_PRF 0x000003D3UL
+#define CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE 0x000003D4UL
+#define CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE 0x000003D5UL
+#define CKM_TLS10_MAC_SERVER 0x000003D6UL
+#define CKM_TLS10_MAC_CLIENT 0x000003D7UL
+#define CKM_TLS12_MAC 0x000003D8UL
+#define CKM_TLS12_KDF 0x000003D9UL
+#define CKM_TLS12_MASTER_KEY_DERIVE 0x000003E0UL
+#define CKM_TLS12_KEY_AND_MAC_DERIVE 0x000003E1UL
+#define CKM_TLS12_MASTER_KEY_DERIVE_DH 0x000003E2UL
+#define CKM_TLS12_KEY_SAFE_DERIVE 0x000003E3UL
+#define CKM_TLS_MAC 0x000003E4UL
+#define CKM_TLS_KDF 0x000003E5UL
+#define CKM_KEY_WRAP_LYNKS 0x00000400UL
+#define CKM_KEY_WRAP_SET_OAEP 0x00000401UL
+#define CKM_CMS_SIG 0x00000500UL
+#define CKM_KIP_DERIVE 0x00000510UL
+#define CKM_KIP_WRAP 0x00000511UL
+#define CKM_KIP_MAC 0x00000512UL
+#define CKM_CAMELLIA_KEY_GEN 0x00000550UL
+#define CKM_CAMELLIA_ECB 0x00000551UL
+#define CKM_CAMELLIA_CBC 0x00000552UL
+#define CKM_CAMELLIA_MAC 0x00000553UL
+#define CKM_CAMELLIA_MAC_GENERAL 0x00000554UL
+#define CKM_CAMELLIA_CBC_PAD 0x00000555UL
+#define CKM_CAMELLIA_ECB_ENCRYPT_DATA 0x00000556UL
+#define CKM_CAMELLIA_CBC_ENCRYPT_DATA 0x00000557UL
+#define CKM_CAMELLIA_CTR 0x00000558UL
+#define CKM_ARIA_KEY_GEN 0x00000560UL
+#define CKM_ARIA_ECB 0x00000561UL
+#define CKM_ARIA_CBC 0x00000562UL
+#define CKM_ARIA_MAC 0x00000563UL
+#define CKM_ARIA_MAC_GENERAL 0x00000564UL
+#define CKM_ARIA_CBC_PAD 0x00000565UL
+#define CKM_ARIA_ECB_ENCRYPT_DATA 0x00000566UL
+#define CKM_ARIA_CBC_ENCRYPT_DATA 0x00000567UL
+#define CKM_SEED_KEY_GEN 0x00000650UL
+#define CKM_SEED_ECB 0x00000651UL
+#define CKM_SEED_CBC 0x00000652UL
+#define CKM_SEED_MAC 0x00000653UL
+#define CKM_SEED_MAC_GENERAL 0x00000654UL
+#define CKM_SEED_CBC_PAD 0x00000655UL
+#define CKM_SEED_ECB_ENCRYPT_DATA 0x00000656UL
+#define CKM_SEED_CBC_ENCRYPT_DATA 0x00000657UL
+#define CKM_SKIPJACK_KEY_GEN 0x00001000UL
+#define CKM_SKIPJACK_ECB64 0x00001001UL
+#define CKM_SKIPJACK_CBC64 0x00001002UL
+#define CKM_SKIPJACK_OFB64 0x00001003UL
+#define CKM_SKIPJACK_CFB64 0x00001004UL
+#define CKM_SKIPJACK_CFB32 0x00001005UL
+#define CKM_SKIPJACK_CFB16 0x00001006UL
+#define CKM_SKIPJACK_CFB8 0x00001007UL
+#define CKM_SKIPJACK_WRAP 0x00001008UL
+#define CKM_SKIPJACK_PRIVATE_WRAP 0x00001009UL
+#define CKM_SKIPJACK_RELAYX 0x0000100AUL
+#define CKM_KEA_KEY_PAIR_GEN 0x00001010UL
+#define CKM_KEA_KEY_DERIVE 0x00001011UL
+#define CKM_KEA_DERIVE 0x00001012UL
+#define CKM_FORTEZZA_TIMESTAMP 0x00001020UL
+#define CKM_BATON_KEY_GEN 0x00001030UL
+#define CKM_BATON_ECB128 0x00001031UL
+#define CKM_BATON_ECB96 0x00001032UL
+#define CKM_BATON_CBC128 0x00001033UL
+#define CKM_BATON_COUNTER 0x00001034UL
+#define CKM_BATON_SHUFFLE 0x00001035UL
+#define CKM_BATON_WRAP 0x00001036UL
+#define CKM_EC_KEY_PAIR_GEN 0x00001040UL
+#define CKM_ECDSA 0x00001041UL
+#define CKM_ECDSA_SHA1 0x00001042UL
+#define CKM_ECDSA_SHA224 0x00001043UL
+#define CKM_ECDSA_SHA256 0x00001044UL
+#define CKM_ECDSA_SHA384 0x00001045UL
+#define CKM_ECDSA_SHA512 0x00001046UL
+#define CKM_ECDH1_DERIVE 0x00001050UL
+#define CKM_ECDH1_COFACTOR_DERIVE 0x00001051UL
+#define CKM_ECMQV_DERIVE 0x00001052UL
+#define CKM_ECDH_AES_KEY_WRAP 0x00001053UL
+#define CKM_RSA_AES_KEY_WRAP 0x00001054UL
+#define CKM_JUNIPER_KEY_GEN 0x00001060UL
+#define CKM_JUNIPER_ECB128 0x00001061UL
+#define CKM_JUNIPER_CBC128 0x00001062UL
+#define CKM_JUNIPER_COUNTER 0x00001063UL
+#define CKM_JUNIPER_SHUFFLE 0x00001064UL
+#define CKM_JUNIPER_WRAP 0x00001065UL
+#define CKM_FASTHASH 0x00001070UL
+#define CKM_AES_KEY_GEN 0x00001080UL
+#define CKM_AES_ECB 0x00001081UL
+#define CKM_AES_CBC 0x00001082UL
+#define CKM_AES_MAC 0x00001083UL
+#define CKM_AES_MAC_GENERAL 0x00001084UL
+#define CKM_AES_CBC_PAD 0x00001085UL
+#define CKM_AES_CTR 0x00001086UL
+#define CKM_AES_GCM 0x00001087UL
+#define CKM_AES_CCM 0x00001088UL
+#define CKM_AES_CTS 0x00001089UL
+#define CKM_AES_CMAC 0x0000108AUL
+#define CKM_AES_CMAC_GENERAL 0x0000108BUL
+#define CKM_AES_XCBC_MAC 0x0000108CUL
+#define CKM_AES_XCBC_MAC_96 0x0000108DUL
+#define CKM_AES_GMAC 0x0000108EUL
+#define CKM_BLOWFISH_KEY_GEN 0x00001090UL
+#define CKM_BLOWFISH_CBC 0x00001091UL
+#define CKM_TWOFISH_KEY_GEN 0x00001092UL
+#define CKM_TWOFISH_CBC 0x00001093UL
+#define CKM_BLOWFISH_CBC_PAD 0x00001094UL
+#define CKM_TWOFISH_CBC_PAD 0x00001095UL
+#define CKM_DES_ECB_ENCRYPT_DATA 0x00001100UL
+#define CKM_DES_CBC_ENCRYPT_DATA 0x00001101UL
+#define CKM_DES3_ECB_ENCRYPT_DATA 0x00001102UL
+#define CKM_DES3_CBC_ENCRYPT_DATA 0x00001103UL
+#define CKM_AES_ECB_ENCRYPT_DATA 0x00001104UL
+#define CKM_AES_CBC_ENCRYPT_DATA 0x00001105UL
+#define CKM_GOSTR3410_KEY_PAIR_GEN 0x00001200UL
+#define CKM_GOSTR3410 0x00001201UL
+#define CKM_GOSTR3410_WITH_GOSTR3411 0x00001202UL
+#define CKM_GOSTR3410_KEY_WRAP 0x00001203UL
+#define CKM_GOSTR3410_DERIVE 0x00001204UL
+#define CKM_GOSTR3411 0x00001210UL
+#define CKM_GOSTR3411_HMAC 0x00001211UL
+#define CKM_GOST28147_KEY_GEN 0x00001220UL
+#define CKM_GOST28147_ECB 0x00001221UL
+#define CKM_GOST28147 0x00001222UL
+#define CKM_GOST28147_MAC 0x00001223UL
+#define CKM_GOST28147_KEY_WRAP 0x00001224UL
+#define CKM_DSA_PARAMETER_GEN 0x00002000UL
+#define CKM_DH_PKCS_PARAMETER_GEN 0x00002001UL
+#define CKM_X9_42_DH_PARAMETER_GEN 0x00002002UL
+#define CKM_DSA_PROBABILISTIC_PARAMETER_GEN 0x00002003UL
+#define CKM_DSA_PROBABLISTIC_PARAMETER_GEN 0x00002003UL
+#define CKM_DSA_SHAWE_TAYLOR_PARAMETER_GEN 0x00002004UL
+#define CKM_AES_OFB 0x00002104UL
+#define CKM_AES_CFB64 0x00002105UL
+#define CKM_AES_CFB8 0x00002106UL
+#define CKM_AES_CFB128 0x00002107UL
+#define CKM_AES_CFB1 0x00002108UL
+#define CKM_AES_KEY_WRAP 0x00002109UL
+#define CKM_AES_KEY_WRAP_PAD 0x0000210AUL
+#define CKM_RSA_PKCS_TPM_1_1 0x00004001UL
+#define CKM_RSA_PKCS_OAEP_TPM_1_1 0x00004002UL
+#define CKM_VENDOR_DEFINED             0x80000000UL
+/* Deprecated */
+#ifdef PKCS11_DEPRECATED
+#define CKM_CAST5_KEY_GEN 0x00000320UL
+#define CKM_CAST5_CBC 0x00000322UL
+#define CKM_CAST5_MAC 0x00000323UL
+#define CKM_CAST5_MAC_GENERAL 0x00000324UL
+#define CKM_CAST5_CBC_PAD 0x00000325UL
+#define CKM_PBE_MD5_CAST5_CBC 0x000003A4UL
+#define CKM_PBE_SHA1_CAST5_CBC 0x000003A5UL
+#define CKM_ECDSA_KEY_PAIR_GEN 0x00001040UL
+#endif
 
+/* CKN */
+#define CKN_SURRENDER 0UL
+#define CKN_OTP_CHANGED 1UL
 
-/* ==============================================================
- * Define structed vector of entry points.  A CK_FUNCTION_LIST
- * contains a CK_VERSION indicating a library's Cryptoki version
- * and then a whole slew of function pointers to the routines in
- * the library.  This type was declared, but not defined, in
- * pkcs11t.h.
- * ==============================================================
- */
+/* CKO */
+#define CKO_DATA 0x00000000UL
+#define CKO_CERTIFICATE 0x00000001UL
+#define CKO_PUBLIC_KEY 0x00000002UL
+#define CKO_PRIVATE_KEY 0x00000003UL
+#define CKO_SECRET_KEY 0x00000004UL
+#define CKO_HW_FEATURE 0x00000005UL
+#define CKO_DOMAIN_PARAMETERS 0x00000006UL
+#define CKO_MECHANISM 0x00000007UL
+#define CKO_OTP_KEY 0x00000008UL
+#define CKO_VENDOR_DEFINED 0x80000000UL
 
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  __PASTE(CK_,name) name;
+/* CKP (PBKD2) */
+#define CKP_PKCS5_PBKD2_HMAC_SHA1 0x00000001UL
+#define CKP_PKCS5_PBKD2_HMAC_GOSTR3411 0x00000002UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA224 0x00000003UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA256 0x00000004UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA384 0x00000005UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA512 0x00000006UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA512_224 0x00000007UL
+#define CKP_PKCS5_PBKD2_HMAC_SHA512_256 0x00000008UL
 
-struct CK_FUNCTION_LIST {
+/* CKR */
+#define CKR_OK 0x00000000UL
+#define CKR_CANCEL 0x00000001UL
+#define CKR_HOST_MEMORY 0x00000002UL
+#define CKR_SLOT_ID_INVALID 0x00000003UL
+#define CKR_GENERAL_ERROR 0x00000005UL
+#define CKR_FUNCTION_FAILED 0x00000006UL
+#define CKR_ARGUMENTS_BAD 0x00000007UL
+#define CKR_NO_EVENT 0x00000008UL
+#define CKR_NEED_TO_CREATE_THREADS 0x00000009UL
+#define CKR_CANT_LOCK 0x0000000AUL
+#define CKR_ATTRIBUTE_READ_ONLY 0x00000010UL
+#define CKR_ATTRIBUTE_SENSITIVE 0x00000011UL
+#define CKR_ATTRIBUTE_TYPE_INVALID 0x00000012UL
+#define CKR_ATTRIBUTE_VALUE_INVALID 0x00000013UL
+#define CKR_ACTION_PROHIBITED 0x0000001BUL
+#define CKR_DATA_INVALID 0x00000020UL
+#define CKR_DATA_LEN_RANGE 0x00000021UL
+#define CKR_DEVICE_ERROR 0x00000030UL
+#define CKR_DEVICE_MEMORY 0x00000031UL
+#define CKR_DEVICE_REMOVED 0x00000032UL
+#define CKR_ENCRYPTED_DATA_INVALID 0x00000040UL
+#define CKR_ENCRYPTED_DATA_LEN_RANGE 0x00000041UL
+#define CKR_FUNCTION_CANCELED 0x00000050UL
+#define CKR_FUNCTION_NOT_PARALLEL 0x00000051UL
+#define CKR_FUNCTION_NOT_SUPPORTED 0x00000054UL
+#define CKR_KEY_HANDLE_INVALID 0x00000060UL
+#define CKR_KEY_SIZE_RANGE 0x00000062UL
+#define CKR_KEY_TYPE_INCONSISTENT 0x00000063UL
+#define CKR_KEY_NOT_NEEDED 0x00000064UL
+#define CKR_KEY_CHANGED 0x00000065UL
+#define CKR_KEY_NEEDED 0x00000066UL
+#define CKR_KEY_INDIGESTIBLE 0x00000067UL
+#define CKR_KEY_FUNCTION_NOT_PERMITTED 0x00000068UL
+#define CKR_KEY_NOT_WRAPPABLE 0x00000069UL
+#define CKR_KEY_UNEXTRACTABLE 0x0000006AUL
+#define CKR_MECHANISM_INVALID 0x00000070UL
+#define CKR_MECHANISM_PARAM_INVALID 0x00000071UL
+#define CKR_OBJECT_HANDLE_INVALID 0x00000082UL
+#define CKR_OPERATION_ACTIVE 0x00000090UL
+#define CKR_OPERATION_NOT_INITIALIZED 0x00000091UL
+#define CKR_PIN_INCORRECT 0x000000A0UL
+#define CKR_PIN_INVALID 0x000000A1UL
+#define CKR_PIN_LEN_RANGE 0x000000A2UL
+#define CKR_PIN_EXPIRED 0x000000A3UL
+#define CKR_PIN_LOCKED 0x000000A4UL
+#define CKR_SESSION_CLOSED 0x000000B0UL
+#define CKR_SESSION_COUNT 0x000000B1UL
+#define CKR_SESSION_HANDLE_INVALID 0x000000B3UL
+#define CKR_SESSION_PARALLEL_NOT_SUPPORTED 0x000000B4UL
+#define CKR_SESSION_READ_ONLY 0x000000B5UL
+#define CKR_SESSION_EXISTS 0x000000B6UL
+#define CKR_SESSION_READ_ONLY_EXISTS 0x000000B7UL
+#define CKR_SESSION_READ_WRITE_SO_EXISTS 0x000000B8UL
+#define CKR_SIGNATURE_INVALID 0x000000C0UL
+#define CKR_SIGNATURE_LEN_RANGE 0x000000C1UL
+#define CKR_TEMPLATE_INCOMPLETE 0x000000D0UL
+#define CKR_TEMPLATE_INCONSISTENT 0x000000D1UL
+#define CKR_TOKEN_NOT_PRESENT 0x000000E0UL
+#define CKR_TOKEN_NOT_RECOGNIZED 0x000000E1UL
+#define CKR_TOKEN_WRITE_PROTECTED 0x000000E2UL
+#define CKR_UNWRAPPING_KEY_HANDLE_INVALID 0x000000F0UL
+#define CKR_UNWRAPPING_KEY_SIZE_RANGE 0x000000F1UL
+#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT 0x000000F2UL
+#define CKR_USER_ALREADY_LOGGED_IN 0x00000100UL
+#define CKR_USER_NOT_LOGGED_IN 0x00000101UL
+#define CKR_USER_PIN_NOT_INITIALIZED 0x00000102UL
+#define CKR_USER_TYPE_INVALID 0x00000103UL
+#define CKR_USER_ANOTHER_ALREADY_LOGGED_IN 0x00000104UL
+#define CKR_USER_TOO_MANY_TYPES 0x00000105UL
+#define CKR_WRAPPED_KEY_INVALID 0x00000110UL
+#define CKR_WRAPPED_KEY_LEN_RANGE 0x00000112UL
+#define CKR_WRAPPING_KEY_HANDLE_INVALID 0x00000113UL
+#define CKR_WRAPPING_KEY_SIZE_RANGE 0x00000114UL
+#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT 0x00000115UL
+#define CKR_RANDOM_SEED_NOT_SUPPORTED 0x00000120UL
+#define CKR_RANDOM_NO_RNG 0x00000121UL
+#define CKR_DOMAIN_PARAMS_INVALID 0x00000130UL
+#define CKR_CURVE_NOT_SUPPORTED 0x00000140UL
+#define CKR_BUFFER_TOO_SMALL 0x00000150UL
+#define CKR_SAVED_STATE_INVALID 0x00000160UL
+#define CKR_INFORMATION_SENSITIVE 0x00000170UL
+#define CKR_STATE_UNSAVEABLE 0x00000180UL
+#define CKR_CRYPTOKI_NOT_INITIALIZED 0x00000190UL
+#define CKR_CRYPTOKI_ALREADY_INITIALIZED 0x00000191UL
+#define CKR_MUTEX_BAD 0x000001A0UL
+#define CKR_MUTEX_NOT_LOCKED 0x000001A1UL
+#define CKR_NEW_PIN_MODE 0x000001B0UL
+#define CKR_NEXT_OTP 0x000001B1UL
+#define CKR_EXCEEDED_MAX_ITERATIONS 0x000001B5UL
+#define CKR_FIPS_SELF_TEST_FAILED 0x000001B6UL
+#define CKR_LIBRARY_LOAD_FAILED 0x000001B7UL
+#define CKR_PIN_TOO_WEAK 0x000001B8UL
+#define CKR_PUBLIC_KEY_INVALID 0x000001B9UL
+#define CKR_FUNCTION_REJECTED 0x00000200UL
+#define CKR_VENDOR_DEFINED 0x80000000UL
 
-  CK_VERSION    version;  /* Cryptoki version */
 
-/* Pile all the function pointers into the CK_FUNCTION_LIST. */
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes.
- */
-#include "pkcs11f.h"
+/* CKS */
+#define CKS_RO_PUBLIC_SESSION 0UL
+#define CKS_RO_USER_FUNCTIONS 1UL
+#define CKS_RW_PUBLIC_SESSION 2UL
+#define CKS_RW_USER_FUNCTIONS 3UL
+#define CKS_RW_SO_FUNCTIONS 4UL
+
+/* CKU */
+#define CKU_SO 0UL
+#define CKU_USER 1UL
+#define CKU_CONTEXT_SPECIFIC 2UL
+
+/* CKZ (data) */
+#define CKZ_DATA_SPECIFIED 0x00000001UL
+
+/* CKZ (salt) */
+#define CKZ_SALT_SPECIFIED 0x00000001UL
+
+/* Sundry structures type definition in alphabetical order */
+#define STRUCTDEF(__name__) \
+struct __name__; \
+typedef struct __name__ __name__; \
+typedef struct __name__ * __name__ ## _PTR; \
+typedef struct __name__ ** __name__ ## _PTR_PTR
+
+STRUCTDEF(CK_ATTRIBUTE);
+STRUCTDEF(CK_C_INITIALIZE_ARGS);
+STRUCTDEF(CK_DATE);
+STRUCTDEF(CK_FUNCTION_LIST);
+STRUCTDEF(CK_FUNCTION_LIST_3_0);
+STRUCTDEF(CK_INFO);
+STRUCTDEF(CK_MECHANISM);
+STRUCTDEF(CK_MECHANISM_INFO);
+STRUCTDEF(CK_SESSION_INFO);
+STRUCTDEF(CK_SLOT_INFO);
+STRUCTDEF(CK_TOKEN_INFO);
+STRUCTDEF(CK_VERSION);
+
+/* Function type definitions */
+typedef CK_RV (* CK_NOTIFY)(CK_SESSION_HANDLE, CK_NOTIFICATION, void *);
+typedef CK_RV (* CK_CREATEMUTEX)(void **);
+typedef CK_RV (* CK_DESTROYMUTEX)(void *);
+typedef CK_RV (* CK_LOCKMUTEX)(void *);
+typedef CK_RV (* CK_UNLOCKMUTEX)(void *);
 
+/* General Structure definitions */
+struct CK_ATTRIBUTE {
+    CK_ATTRIBUTE_TYPE type;
+    void * pValue;
+    CK_ULONG ulValueLen;
 };
 
-#undef CK_PKCS11_FUNCTION_INFO
+struct CK_C_INITIALIZE_ARGS {
+    CK_CREATEMUTEX CreateMutex;
+    CK_DESTROYMUTEX DestroyMutex;
+    CK_LOCKMUTEX LockMutex;
+    CK_UNLOCKMUTEX UnlockMutex;
+    CK_FLAGS flags;
+    void * pReserved;
+};
 
+struct CK_DATE{
+    CK_CHAR year[4];
+    CK_CHAR month[2];
+    CK_CHAR day[2];
+};
 
-#undef __PASTE
+struct CK_VERSION {
+    CK_BYTE major;
+    CK_BYTE minor;
+};
 
-#ifdef __cplusplus
-}
-#endif
+struct CK_INFO {
+    struct CK_VERSION cryptokiVersion;
+    CK_UTF8CHAR manufacturerID[32];
+    CK_FLAGS flags;
+    CK_UTF8CHAR libraryDescription[32];
+    struct CK_VERSION libraryVersion;
+};
+
+struct CK_MECHANISM {
+    CK_MECHANISM_TYPE mechanism;
+    void * pParameter;
+    CK_ULONG ulParameterLen;
+};
+
+struct CK_MECHANISM_INFO {
+    CK_ULONG ulMinKeySize;
+    CK_ULONG ulMaxKeySize;
+    CK_FLAGS flags;
+};
+
+struct CK_SESSION_INFO {
+    CK_SLOT_ID slotID;
+    CK_STATE state;
+    CK_FLAGS flags;
+    CK_ULONG ulDeviceError;
+};
+
+struct CK_SLOT_INFO {
+    CK_UTF8CHAR slotDescription[64];
+    CK_UTF8CHAR manufacturerID[32];
+    CK_FLAGS flags;
+    CK_VERSION hardwareVersion;
+    CK_VERSION firmwareVersion;
+};
+
+struct CK_TOKEN_INFO {
+    CK_UTF8CHAR label[32];
+    CK_UTF8CHAR manufacturerID[32];
+    CK_UTF8CHAR model[16];
+    CK_CHAR serialNumber[16];
+    CK_FLAGS flags;
+    CK_ULONG ulMaxSessionCount;
+    CK_ULONG ulSessionCount;
+    CK_ULONG ulMaxRwSessionCount;
+    CK_ULONG ulRwSessionCount;
+    CK_ULONG ulMaxPinLen;
+    CK_ULONG ulMinPinLen;
+    CK_ULONG ulTotalPublicMemory;
+    CK_ULONG ulFreePublicMemory;
+    CK_ULONG ulTotalPrivateMemory;
+    CK_ULONG ulFreePrivateMemory;
+    CK_VERSION hardwareVersion;
+    CK_VERSION firmwareVersion;
+    CK_CHAR utcTime[16];
+};
+
+/* Param Structure definitions in alphabetical order */
+STRUCTDEF(CK_AES_CBC_ENCRYPT_DATA_PARAMS);
+STRUCTDEF(CK_AES_CCM_PARAMS);
+STRUCTDEF(CK_AES_CTR_PARAMS);
+STRUCTDEF(CK_AES_GCM_PARAMS);
+STRUCTDEF(CK_ARIA_CBC_ENCRYPT_DATA_PARAMS);
+STRUCTDEF(CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS);
+STRUCTDEF(CK_CAMELLIA_CTR_PARAMS);
+STRUCTDEF(CK_CCM_PARAMS);
+STRUCTDEF(CK_CMS_SIG_PARAMS);
+STRUCTDEF(CK_DES_CBC_ENCRYPT_DATA_PARAMS);
+STRUCTDEF(CK_DSA_PARAMETER_GEN_PARAM);
+STRUCTDEF(CK_ECDH_AES_KEY_WRAP_PARAMS);
+STRUCTDEF(CK_ECDH1_DERIVE_PARAMS);
+STRUCTDEF(CK_ECDH2_DERIVE_PARAMS);
+STRUCTDEF(CK_ECMQV_DERIVE_PARAMS);
+STRUCTDEF(CK_GCM_PARAMS);
+STRUCTDEF(CK_GOSTR3410_DERIVE_PARAMS);
+STRUCTDEF(CK_GOSTR3410_KEY_WRAP_PARAMS);
+STRUCTDEF(CK_KEA_DERIVE_PARAMS);
+STRUCTDEF(CK_KEY_DERIVATION_STRING_DATA);
+STRUCTDEF(CK_KEY_WRAP_SET_OAEP_PARAMS);
+STRUCTDEF(CK_KIP_PARAMS);
+STRUCTDEF(CK_OTP_PARAM);
+STRUCTDEF(CK_OTP_PARAMS);
+STRUCTDEF(CK_OTP_SIGNATURE_INFO);
+STRUCTDEF(CK_PBE_PARAMS);
+STRUCTDEF(CK_PKCS5_PBKD2_PARAMS);
+STRUCTDEF(CK_PKCS5_PBKD2_PARAMS2);
+STRUCTDEF(CK_RC2_CBC_PARAMS);
+STRUCTDEF(CK_RC2_MAC_GENERAL_PARAMS);
+STRUCTDEF(CK_RC5_CBC_PARAMS);
+STRUCTDEF(CK_RC5_MAC_GENERAL_PARAMS);
+STRUCTDEF(CK_RC5_PARAMS);
+STRUCTDEF(CK_RSA_AES_KEY_WRAP_PARAMS);
+STRUCTDEF(CK_RSA_PKCS_OAEP_PARAMS);
+STRUCTDEF(CK_RSA_PKCS_PSS_PARAMS);
+STRUCTDEF(CK_SEED_CBC_ENCRYPT_DATA_PARAMS);
+STRUCTDEF(CK_SKIPJACK_PRIVATE_WRAP_PARAMS);
+STRUCTDEF(CK_SKIPJACK_RELAYX_PARAMS);
+STRUCTDEF(CK_X2RATCHET_INITIALIZE_PARAMS);
+STRUCTDEF(CK_X2RATCHET_RESPOND_PARAMS);
+STRUCTDEF(CK_X9_42_DH1_DERIVE_PARAMS);
+STRUCTDEF(CK_X9_42_DH2_DERIVE_PARAMS);
+STRUCTDEF(CK_X9_42_MQV_DERIVE_PARAMS);
+STRUCTDEF(specifiedParams);
+
+struct CK_AES_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE iv[16];
+    CK_BYTE * pData;
+    CK_ULONG length;
+};
+
+struct CK_AES_CCM_PARAMS {
+    CK_ULONG ulDataLen;
+    CK_BYTE * pNonce;
+    CK_ULONG ulNonceLen;
+    CK_BYTE * pAAD;
+    CK_ULONG ulAADLen;
+    CK_ULONG ulMACLen;
+};
+
+struct CK_AES_CTR_PARAMS {
+    CK_ULONG ulCounterBits;
+    CK_BYTE cb[16];
+};
+
+struct CK_AES_GCM_PARAMS {
+    CK_BYTE * pIv;
+    CK_ULONG ulIvLen;
+    CK_ULONG ulIvBits;
+    CK_BYTE * pAAD;
+    CK_ULONG ulAADLen;
+    CK_ULONG ulTagBits;
+};
+
+struct CK_ARIA_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE iv[16];
+    CK_BYTE * pData;
+    CK_ULONG length;
+};
+
+struct CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE iv[16];
+    CK_BYTE * pData;
+    CK_ULONG length;
+};
+
+struct CK_CAMELLIA_CTR_PARAMS {
+    CK_ULONG ulCounterBits;
+    CK_BYTE cb[16];
+};
+
+struct CK_CCM_PARAMS {
+    CK_ULONG ulDataLen;
+    CK_BYTE * pNonce;
+    CK_ULONG ulNonceLen;
+    CK_BYTE * pAAD;
+    CK_ULONG ulAADLen;
+    CK_ULONG ulMACLen;
+};
+
+struct CK_CMS_SIG_PARAMS {
+    CK_OBJECT_HANDLE certificateHandle;
+    CK_MECHANISM * pSigningMechanism;
+    CK_MECHANISM * pDigestMechanism;
+    CK_UTF8CHAR * pContentType;
+    CK_BYTE * pRequestedAttributes;
+    CK_ULONG ulRequestedAttributesLen;
+    CK_BYTE * pRequiredAttributes;
+    CK_ULONG ulRequiredAttributesLen;
+};
 
-#endif /* _PKCS11_H_ */
+struct CK_DES_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE iv[8];
+    CK_BYTE * pData;
+    CK_ULONG length;
+};
+
+struct CK_DSA_PARAMETER_GEN_PARAM {
+    CK_MECHANISM_TYPE hash;
+    CK_BYTE * pSeed;
+    CK_ULONG ulSeedLen;
+    CK_ULONG ulIndex;
+};
 
+struct CK_ECDH_AES_KEY_WRAP_PARAMS {
+    CK_ULONG ulAESKeyBits;
+    CK_EC_KDF_TYPE kdf;
+    CK_ULONG ulSharedDataLen;
+    CK_BYTE * pSharedData;
+};
+
+struct CK_ECDH1_DERIVE_PARAMS {
+    CK_EC_KDF_TYPE kdf;
+    CK_ULONG ulSharedDataLen;
+    CK_BYTE * pSharedData;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * pPublicData;
+};
+
+struct CK_ECDH2_DERIVE_PARAMS {
+    CK_EC_KDF_TYPE kdf;
+    CK_ULONG ulSharedDataLen;
+    CK_BYTE * pSharedData;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * pPublicData;
+    CK_ULONG ulPrivateDataLen;
+    CK_OBJECT_HANDLE hPrivateData;
+    CK_ULONG ulPublicDataLen2;
+    CK_BYTE * pPublicData2;
+};
+
+struct CK_ECMQV_DERIVE_PARAMS {
+    CK_EC_KDF_TYPE kdf;
+    CK_ULONG ulSharedDataLen;
+    CK_BYTE * pSharedData;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * pPublicData;
+    CK_ULONG ulPrivateDataLen;
+    CK_OBJECT_HANDLE hPrivateData;
+    CK_ULONG ulPublicDataLen2;
+    CK_BYTE * pPublicData2;
+    CK_OBJECT_HANDLE publicKey;
+};
+
+struct CK_GCM_PARAMS {
+    CK_BYTE * pIv;
+    CK_ULONG ulIvLen;
+    CK_ULONG ulIvBits;
+    CK_BYTE * pAAD;
+    CK_ULONG ulAADLen;
+    CK_ULONG ulTagBits;
+};
+
+struct CK_GOSTR3410_DERIVE_PARAMS {
+    CK_EC_KDF_TYPE kdf;
+    CK_BYTE * pPublicData;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * pUKM;
+    CK_ULONG ulUKMLen;
+};
+
+struct CK_GOSTR3410_KEY_WRAP_PARAMS {
+    CK_BYTE * pWrapOID;
+    CK_ULONG ulWrapOIDLen;
+    CK_BYTE * pUKM;
+    CK_ULONG ulUKMLen;
+    CK_OBJECT_HANDLE hKey;
+};
+
+struct CK_KEA_DERIVE_PARAMS {
+    CK_BBOOL isSender;
+    CK_ULONG ulRandomLen;
+    CK_BYTE * RandomA;
+    CK_BYTE * RandomB;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * PublicData;
+};
+
+struct CK_KEY_DERIVATION_STRING_DATA {
+    CK_BYTE * pData;
+    CK_ULONG ulLen;
+};
+
+struct CK_KEY_WRAP_SET_OAEP_PARAMS {
+    CK_BYTE bBC;
+    CK_BYTE * pX;
+    CK_ULONG ulXLen;
+};
+
+struct CK_KIP_PARAMS {
+    CK_MECHANISM * pMechanism;
+    CK_OBJECT_HANDLE hKey;
+    CK_BYTE * pSeed;
+    CK_ULONG ulSeedLen;
+};
+
+struct CK_OTP_PARAM {
+    CK_OTP_PARAM_TYPE type;
+    void * pValue;
+    CK_ULONG ulValueLen;
+};
+
+struct CK_OTP_PARAMS {
+    CK_OTP_PARAM * pParams;
+    CK_ULONG ulCount;
+};
+
+struct CK_OTP_SIGNATURE_INFO {
+    CK_OTP_PARAM * pParams;
+    CK_ULONG ulCount;
+};
+
+struct CK_PBE_PARAMS {
+    CK_BYTE * pInitVector;
+    CK_UTF8CHAR * pPassword;
+    CK_ULONG ulPasswordLen;
+    CK_BYTE * pSalt;
+    CK_ULONG ulSaltLen;
+    CK_ULONG ulIteration;
+};
+
+struct CK_PKCS5_PBKD2_PARAMS {
+    CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
+    void * pSaltSourceData;
+    CK_ULONG ulSaltSourceDataLen;
+    CK_ULONG iterations;
+    CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
+    void * pPrfData;
+    CK_ULONG ulPrfDataLen;
+    CK_UTF8CHAR * pPassword;
+    CK_ULONG * ulPasswordLen;
+};
+
+struct CK_PKCS5_PBKD2_PARAMS2 {
+    CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
+    void * pSaltSourceData;
+    CK_ULONG ulSaltSourceDataLen;
+    CK_ULONG iterations;
+    CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
+    void * pPrfData;
+    CK_ULONG ulPrfDataLen;
+    CK_UTF8CHAR * pPassword;
+    CK_ULONG ulPasswordLen;
+};
+
+struct CK_RC2_CBC_PARAMS {
+    CK_ULONG ulEffectiveBits;
+    CK_BYTE iv[8];
+};
+
+struct CK_RC2_MAC_GENERAL_PARAMS {
+    CK_ULONG ulEffectiveBits;
+    CK_ULONG ulMacLength;
+};
+
+struct CK_RC5_CBC_PARAMS {
+    CK_ULONG ulWordsize;
+    CK_ULONG ulRounds;
+    CK_BYTE * pIv;
+    CK_ULONG ulIvLen;
+};
+
+struct CK_RC5_MAC_GENERAL_PARAMS {
+    CK_ULONG ulWordsize;
+    CK_ULONG ulRounds;
+    CK_ULONG ulMacLength;
+};
+
+struct CK_RC5_PARAMS {
+    CK_ULONG ulWordsize;
+    CK_ULONG ulRounds;
+};
+
+struct CK_RSA_AES_KEY_WRAP_PARAMS {
+    CK_ULONG ulAESKeyBits;
+    CK_RSA_PKCS_OAEP_PARAMS * pOAEPParams;
+};
+
+struct CK_RSA_PKCS_OAEP_PARAMS {
+    CK_MECHANISM_TYPE hashAlg;
+    CK_RSA_PKCS_MGF_TYPE mgf;
+    CK_RSA_PKCS_OAEP_SOURCE_TYPE source;
+    void * pSourceData;
+    CK_ULONG ulSourceDataLen;
+};
+
+struct CK_RSA_PKCS_PSS_PARAMS {
+    CK_MECHANISM_TYPE hashAlg;
+    CK_RSA_PKCS_MGF_TYPE mgf;
+    CK_ULONG sLen;
+};
+
+struct CK_SEED_CBC_ENCRYPT_DATA_PARAMS {
+    CK_BYTE iv[16];
+    CK_BYTE * pData;
+    CK_ULONG length;
+};
+
+struct CK_SKIPJACK_PRIVATE_WRAP_PARAMS {
+    CK_ULONG ulPasswordLen;
+    CK_BYTE * pPassword;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * pPublicData;
+    CK_ULONG ulPAndGLen;
+    CK_ULONG ulQLen;
+    CK_ULONG ulRandomLen;
+    CK_BYTE * pRandomA;
+    CK_BYTE * pPrimeP;
+    CK_BYTE * pBaseG;
+    CK_BYTE * pSubprimeQ;
+};
+
+struct CK_SKIPJACK_RELAYX_PARAMS {
+    CK_ULONG ulOldWrappedXLen;
+    CK_BYTE * pOldWrappedX;
+    CK_ULONG ulOldPasswordLen;
+    CK_BYTE * pOldPassword;
+    CK_ULONG ulOldPublicDataLen;
+    CK_BYTE * pOldPublicData;
+    CK_ULONG ulOldRandomLen;
+    CK_BYTE * pOldRandomA;
+    CK_ULONG ulNewPasswordLen;
+    CK_BYTE * pNewPassword;
+    CK_ULONG ulNewPublicDataLen;
+    CK_BYTE * pNewPublicData;
+    CK_ULONG ulNewRandomLen;
+    CK_BYTE * pNewRandomA;
+};
+
+struct CK_X9_42_DH1_DERIVE_PARAMS {
+    CK_X9_42_DH_KDF_TYPE kdf;
+    CK_ULONG ulOtherInfoLen;
+    CK_BYTE * pOtherInfo;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * pPublicData;
+};
+
+struct CK_X9_42_DH2_DERIVE_PARAMS {
+    CK_X9_42_DH_KDF_TYPE kdf;
+    CK_ULONG ulOtherInfoLen;
+    CK_BYTE * pOtherInfo;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * pPublicData;
+    CK_ULONG ulPrivateDataLen;
+    CK_OBJECT_HANDLE hPrivateData;
+    CK_ULONG ulPublicDataLen2;
+    CK_BYTE * pPublicData2;
+};
+
+struct CK_X9_42_MQV_DERIVE_PARAMS {
+    CK_X9_42_DH_KDF_TYPE kdf;
+    CK_ULONG ulOtherInfoLen;
+    CK_BYTE * OtherInfo;
+    CK_ULONG ulPublicDataLen;
+    CK_BYTE * PublicData;
+    CK_ULONG ulPrivateDataLen;
+    CK_OBJECT_HANDLE hPrivateData;
+    CK_ULONG ulPublicDataLen2;
+    CK_BYTE * PublicData2;
+    CK_OBJECT_HANDLE publicKey;
+};
+
+/* TLS related structure definitions */
+STRUCTDEF(CK_SSL3_KEY_MAT_OUT);
+STRUCTDEF(CK_SSL3_KEY_MAT_PARAMS);
+STRUCTDEF(CK_SSL3_MASTER_KEY_DERIVE_PARAMS);
+STRUCTDEF(CK_SSL3_RANDOM_DATA);
+STRUCTDEF(CK_TLS_KDF_PARAMS);
+STRUCTDEF(CK_TLS_MAC_PARAMS);
+STRUCTDEF(CK_TLS_PRF_PARAMS);
+STRUCTDEF(CK_TLS12_KEY_MAT_PARAMS);
+STRUCTDEF(CK_TLS12_MASTER_KEY_DERIVE_PARAMS);
+STRUCTDEF(CK_WTLS_KEY_MAT_OUT);
+STRUCTDEF(CK_WTLS_KEY_MAT_PARAMS);
+STRUCTDEF(CK_WTLS_MASTER_KEY_DERIVE_PARAMS);
+STRUCTDEF(CK_WTLS_PRF_PARAMS);
+STRUCTDEF(CK_WTLS_RANDOM_DATA);
+
+struct CK_SSL3_KEY_MAT_OUT {
+    CK_OBJECT_HANDLE hClientMacSecret;
+    CK_OBJECT_HANDLE hServerMacSecret;
+    CK_OBJECT_HANDLE hClientKey;
+    CK_OBJECT_HANDLE hServerKey;
+    CK_BYTE * pIVClient;
+    CK_BYTE * pIVServer;
+};
+
+struct CK_SSL3_RANDOM_DATA {
+    CK_BYTE * pClientRandom;
+    CK_ULONG ulClientRandomLen;
+    CK_BYTE * pServerRandom;
+    CK_ULONG ulServerRandomLen;
+};
+
+struct CK_SSL3_KEY_MAT_PARAMS {
+    CK_ULONG ulMacSizeInBits;
+    CK_ULONG ulKeySizeInBits;
+    CK_ULONG ulIVSizeInBits;
+    CK_BBOOL bIsExport;
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_SSL3_KEY_MAT_OUT * pReturnedKeyMaterial;
+};
+
+struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS {
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_VERSION * pVersion;
+};
+
+struct CK_TLS_KDF_PARAMS {
+    CK_MECHANISM_TYPE prfMechanism;
+    CK_BYTE * pLabel;
+    CK_ULONG ulLabelLength;
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_BYTE * pContextData;
+    CK_ULONG ulContextDataLength;
+};
+
+struct CK_TLS_MAC_PARAMS {
+    CK_MECHANISM_TYPE prfHashMechanism;
+    CK_ULONG ulMacLength;
+    CK_ULONG ulServerOrClient;
+};
+
+struct CK_TLS_PRF_PARAMS {
+    CK_BYTE * pSeed;
+    CK_ULONG ulSeedLen;
+    CK_BYTE * pLabel;
+    CK_ULONG ulLabelLen;
+    CK_BYTE * pOutput;
+    CK_ULONG * pulOutputLen;
+};
+
+struct CK_TLS12_KEY_MAT_PARAMS {
+    CK_ULONG ulMacSizeInBits;
+    CK_ULONG ulKeySizeInBits;
+    CK_ULONG ulIVSizeInBits;
+    CK_BBOOL bIsExport;
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_SSL3_KEY_MAT_OUT * pReturnedKeyMaterial;
+    CK_MECHANISM_TYPE prfHashMechanism;
+};
+
+struct CK_TLS12_MASTER_KEY_DERIVE_PARAMS {
+    CK_SSL3_RANDOM_DATA RandomInfo;
+    CK_VERSION * pVersion;
+    CK_MECHANISM_TYPE prfHashMechanism;
+};
+
+struct CK_WTLS_KEY_MAT_OUT {
+    CK_OBJECT_HANDLE hMacSecret;
+    CK_OBJECT_HANDLE hKey;
+    CK_BYTE * pIV;
+};
+
+struct CK_WTLS_RANDOM_DATA {
+    CK_BYTE * pClientRandom;
+    CK_ULONG ulClientRandomLen;
+    CK_BYTE * pServerRandom;
+    CK_ULONG ulServerRandomLen;
+};
+
+struct CK_WTLS_KEY_MAT_PARAMS {
+    CK_MECHANISM_TYPE DigestMechanism;
+    CK_ULONG ulMacSizeInBits;
+    CK_ULONG ulKeySizeInBits;
+    CK_ULONG ulIVSizeInBits;
+    CK_ULONG ulSequenceNumber;
+    CK_BBOOL bIsExport;
+    CK_WTLS_RANDOM_DATA RandomInfo;
+    CK_WTLS_KEY_MAT_OUT * pReturnedKeyMaterial;
+};
+
+struct CK_WTLS_MASTER_KEY_DERIVE_PARAMS {
+    CK_MECHANISM_TYPE DigestMechanism;
+    CK_WTLS_RANDOM_DATA RandomInfo;
+    CK_BYTE * pVersion;
+};
+
+struct CK_WTLS_PRF_PARAMS {
+    CK_MECHANISM_TYPE DigestMechanism;
+    CK_BYTE * pSeed;
+    CK_ULONG ulSeedLen;
+    CK_BYTE * pLabel;
+    CK_ULONG ulLabelLen;
+    CK_BYTE * pOutput;
+    CK_ULONG * pulOutputLen;
+};
+
+/* PKCS11 Functions */
+extern CK_RV C_Initialize(void *);
+extern CK_RV C_Finalize(void *);
+extern CK_RV C_GetInfo(CK_INFO *);
+extern CK_RV C_GetFunctionList(CK_FUNCTION_LIST **);
+extern CK_RV C_GetSlotList(CK_BBOOL, CK_SLOT_ID *, CK_ULONG *);
+extern CK_RV C_GetSlotInfo(CK_SLOT_ID, CK_SLOT_INFO *);
+extern CK_RV C_GetTokenInfo(CK_SLOT_ID, CK_TOKEN_INFO *);
+extern CK_RV C_GetMechanismList(CK_SLOT_ID, CK_MECHANISM_TYPE *, CK_ULONG *);
+extern CK_RV C_GetMechanismInfo(CK_SLOT_ID, CK_MECHANISM_TYPE,
+                                CK_MECHANISM_INFO *);
+extern CK_RV C_InitToken(CK_SLOT_ID, CK_UTF8CHAR *, CK_ULONG, CK_UTF8CHAR *);
+extern CK_RV C_InitPIN(CK_SESSION_HANDLE, CK_UTF8CHAR *, CK_ULONG);
+extern CK_RV C_SetPIN(CK_SESSION_HANDLE, CK_UTF8CHAR *, CK_ULONG, CK_UTF8CHAR *,
+                      CK_ULONG);
+extern CK_RV C_OpenSession(CK_SLOT_ID, CK_FLAGS, void *, CK_NOTIFY,
+                           CK_SESSION_HANDLE *);
+extern CK_RV C_CloseSession(CK_SESSION_HANDLE);
+extern CK_RV C_CloseAllSessions(CK_SLOT_ID);
+extern CK_RV C_GetSessionInfo(CK_SESSION_HANDLE, CK_SESSION_INFO *);
+extern CK_RV C_GetOperationState(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+extern CK_RV C_SetOperationState(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                 CK_OBJECT_HANDLE, CK_OBJECT_HANDLE);
+extern CK_RV C_Login(CK_SESSION_HANDLE, CK_USER_TYPE, CK_UTF8CHAR *, CK_ULONG);
+extern CK_RV C_Logout(CK_SESSION_HANDLE);
+extern CK_RV C_CreateObject(CK_SESSION_HANDLE, CK_ATTRIBUTE *, CK_ULONG,
+                            CK_OBJECT_HANDLE *);
+extern CK_RV C_CopyObject(CK_SESSION_HANDLE, CK_OBJECT_HANDLE, CK_ATTRIBUTE *,
+                          CK_ULONG, CK_OBJECT_HANDLE *);
+extern CK_RV C_DestroyObject(CK_SESSION_HANDLE, CK_OBJECT_HANDLE);
+extern CK_RV C_GetObjectSize(CK_SESSION_HANDLE, CK_OBJECT_HANDLE, CK_ULONG *);
+extern CK_RV C_GetAttributeValue(CK_SESSION_HANDLE, CK_OBJECT_HANDLE,
+                                 CK_ATTRIBUTE *, CK_ULONG);
+extern CK_RV C_SetAttributeValue(CK_SESSION_HANDLE, CK_OBJECT_HANDLE,
+                                 CK_ATTRIBUTE *, CK_ULONG);
+extern CK_RV C_FindObjectsInit(CK_SESSION_HANDLE, CK_ATTRIBUTE *, CK_ULONG);
+extern CK_RV C_FindObjects(CK_SESSION_HANDLE, CK_OBJECT_HANDLE *, CK_ULONG,
+                           CK_ULONG *);
+extern CK_RV C_FindObjectsFinal(CK_SESSION_HANDLE);
+extern CK_RV C_EncryptInit(CK_SESSION_HANDLE, CK_MECHANISM *,
+                           CK_OBJECT_HANDLE);
+extern CK_RV C_Encrypt(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                       CK_ULONG *);
+extern CK_RV C_EncryptUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                             CK_BYTE *, CK_ULONG *);
+extern CK_RV C_EncryptFinal(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+extern CK_RV C_DecryptInit(CK_SESSION_HANDLE, CK_MECHANISM *,
+                           CK_OBJECT_HANDLE);
+extern CK_RV C_Decrypt(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                       CK_ULONG *);
+extern CK_RV C_DecryptUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                             CK_BYTE *, CK_ULONG *);
+extern CK_RV C_DecryptFinal(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+extern CK_RV C_DigestInit(CK_SESSION_HANDLE, CK_MECHANISM *);
+extern CK_RV C_Digest(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                      CK_ULONG *);
+extern CK_RV C_DigestUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+extern CK_RV C_DigestKey(CK_SESSION_HANDLE, CK_OBJECT_HANDLE);
+extern CK_RV C_DigestFinal(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+extern CK_RV C_SignInit(CK_SESSION_HANDLE, CK_MECHANISM *, CK_OBJECT_HANDLE);
+extern CK_RV C_Sign(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                    CK_ULONG *);
+extern CK_RV C_SignUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+extern CK_RV C_SignFinal(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+extern CK_RV C_SignRecoverInit(CK_SESSION_HANDLE, CK_MECHANISM *,
+                               CK_OBJECT_HANDLE);
+extern CK_RV C_SignRecover(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                           CK_ULONG *);
+extern CK_RV C_VerifyInit(CK_SESSION_HANDLE, CK_MECHANISM *,
+                          CK_OBJECT_HANDLE);
+extern CK_RV C_Verify(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                      CK_ULONG);
+extern CK_RV C_VerifyUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+extern CK_RV C_VerifyFinal(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+extern CK_RV C_VerifyRecoverInit(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                 CK_OBJECT_HANDLE);
+extern CK_RV C_VerifyRecover(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                             CK_BYTE *, CK_ULONG *);
+extern CK_RV C_DigestEncryptUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                   CK_BYTE *, CK_ULONG *);
+extern CK_RV C_DecryptDigestUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                   CK_BYTE *, CK_ULONG *);
+extern CK_RV C_SignEncryptUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                 CK_BYTE *, CK_ULONG *);
+extern CK_RV C_DecryptVerifyUpdate(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                   CK_BYTE *, CK_ULONG *);
+extern CK_RV C_GenerateKey(CK_SESSION_HANDLE, CK_MECHANISM *, CK_ATTRIBUTE *,
+                           CK_ULONG, CK_OBJECT_HANDLE *);
+extern CK_RV C_GenerateKeyPair(CK_SESSION_HANDLE, CK_MECHANISM *,
+                               CK_ATTRIBUTE *, CK_ULONG, CK_ATTRIBUTE *,
+                               CK_ULONG, CK_OBJECT_HANDLE *,
+                               CK_OBJECT_HANDLE *);
+extern CK_RV C_WrapKey(CK_SESSION_HANDLE, CK_MECHANISM *, CK_OBJECT_HANDLE,
+                       CK_OBJECT_HANDLE, CK_BYTE *, CK_ULONG *);
+extern CK_RV C_UnwrapKey(CK_SESSION_HANDLE, CK_MECHANISM *, CK_OBJECT_HANDLE,
+                         CK_BYTE *, CK_ULONG *, CK_ATTRIBUTE *, CK_ULONG,
+                         CK_OBJECT_HANDLE *);
+extern CK_RV C_DeriveKey(CK_SESSION_HANDLE, CK_MECHANISM *, CK_OBJECT_HANDLE,
+                         CK_ATTRIBUTE *, CK_ULONG, CK_OBJECT_HANDLE *);
+extern CK_RV C_SeedRandom(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+extern CK_RV C_GenerateRandom(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+extern CK_RV C_GetFunctionStatus(CK_SESSION_HANDLE);
+extern CK_RV C_CancelFunction(CK_SESSION_HANDLE);
+extern CK_RV C_WaitForSlotEvent(CK_FLAGS, CK_SLOT_ID *, void *);
+
+typedef CK_RV (* CK_C_Initialize)(void *);
+typedef CK_RV (* CK_C_Finalize)(void *);
+typedef CK_RV (* CK_C_GetInfo)(CK_INFO *);
+typedef CK_RV (* CK_C_GetFunctionList)(CK_FUNCTION_LIST **);
+typedef CK_RV (* CK_C_GetSlotList)(CK_BBOOL, CK_SLOT_ID *, CK_ULONG *);
+typedef CK_RV (* CK_C_GetSlotInfo)(CK_SLOT_ID, CK_SLOT_INFO *);
+typedef CK_RV (* CK_C_GetTokenInfo)(CK_SLOT_ID, CK_TOKEN_INFO *);
+typedef CK_RV (* CK_C_GetMechanismList)(CK_SLOT_ID, CK_MECHANISM_TYPE *,
+                                        CK_ULONG *);
+typedef CK_RV (* CK_C_GetMechanismInfo)(CK_SLOT_ID, CK_MECHANISM_TYPE,
+                                        CK_MECHANISM_INFO *);
+typedef CK_RV (* CK_C_InitToken)(CK_SLOT_ID, CK_UTF8CHAR *, CK_ULONG,
+                                 CK_UTF8CHAR *);
+typedef CK_RV (* CK_C_InitPIN)(CK_SESSION_HANDLE, CK_UTF8CHAR *, CK_ULONG);
+typedef CK_RV (* CK_C_SetPIN)(CK_SESSION_HANDLE, CK_UTF8CHAR *, CK_ULONG,
+                              CK_UTF8CHAR *, CK_ULONG);
+typedef CK_RV (* CK_C_OpenSession)(CK_SLOT_ID, CK_FLAGS, void *, CK_NOTIFY,
+                                   CK_SESSION_HANDLE *);
+typedef CK_RV (* CK_C_CloseSession)(CK_SESSION_HANDLE);
+typedef CK_RV (* CK_C_CloseAllSessions)(CK_SLOT_ID);
+typedef CK_RV (* CK_C_GetSessionInfo)(CK_SESSION_HANDLE, CK_SESSION_INFO *);
+typedef CK_RV (* CK_C_GetOperationState)(CK_SESSION_HANDLE, CK_BYTE *,
+                                         CK_ULONG *);
+typedef CK_RV (* CK_C_SetOperationState)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                         CK_OBJECT_HANDLE, CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_Login)(CK_SESSION_HANDLE, CK_USER_TYPE, CK_UTF8CHAR *,
+                             CK_ULONG);
+typedef CK_RV (* CK_C_Logout)(CK_SESSION_HANDLE);
+typedef CK_RV (* CK_C_CreateObject)(CK_SESSION_HANDLE, CK_ATTRIBUTE *, CK_ULONG,
+                                    CK_OBJECT_HANDLE *);
+typedef CK_RV (* CK_C_CopyObject)(CK_SESSION_HANDLE, CK_OBJECT_HANDLE,
+                                  CK_ATTRIBUTE *, CK_ULONG, CK_OBJECT_HANDLE *);
+typedef CK_RV (* CK_C_DestroyObject)(CK_SESSION_HANDLE, CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_GetObjectSize)(CK_SESSION_HANDLE, CK_OBJECT_HANDLE,
+                                     CK_ULONG *);
+typedef CK_RV (* CK_C_GetAttributeValue)(CK_SESSION_HANDLE, CK_OBJECT_HANDLE,
+                                         CK_ATTRIBUTE *, CK_ULONG);
+typedef CK_RV (* CK_C_SetAttributeValue)(CK_SESSION_HANDLE, CK_OBJECT_HANDLE,
+                                         CK_ATTRIBUTE *, CK_ULONG);
+typedef CK_RV (* CK_C_FindObjectsInit)(CK_SESSION_HANDLE, CK_ATTRIBUTE *,
+                                       CK_ULONG);
+typedef CK_RV (* CK_C_FindObjects)(CK_SESSION_HANDLE, CK_OBJECT_HANDLE *,
+                                   CK_ULONG, CK_ULONG *);
+typedef CK_RV (* CK_C_FindObjectsFinal)(CK_SESSION_HANDLE);
+typedef CK_RV (* CK_C_EncryptInit)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                   CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_Encrypt)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                               CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_EncryptUpdate)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                     CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_EncryptFinal)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_DecryptInit)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                   CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_Decrypt)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                               CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_DecryptUpdate)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                     CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_DecryptFinal)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_DigestInit)(CK_SESSION_HANDLE, CK_MECHANISM *);
+typedef CK_RV (* CK_C_Digest)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                              CK_ULONG *);
+typedef CK_RV (* CK_C_DigestUpdate)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+typedef CK_RV (* CK_C_DigestKey)(CK_SESSION_HANDLE, CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_DigestFinal)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_SignInit)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_Sign)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                            CK_ULONG *);
+typedef CK_RV (* CK_C_SignUpdate)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+typedef CK_RV (* CK_C_SignFinal)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_SignRecoverInit)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                       CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_SignRecover)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                   CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_VerifyInit)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                  CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_Verify)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG, CK_BYTE *,
+                              CK_ULONG);
+typedef CK_RV (* CK_C_VerifyUpdate)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+typedef CK_RV (* CK_C_VerifyFinal)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+typedef CK_RV (* CK_C_VerifyRecoverInit)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                 CK_OBJECT_HANDLE);
+typedef CK_RV (* CK_C_VerifyRecover)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                             CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_DigestEncryptUpdate)(CK_SESSION_HANDLE, CK_BYTE *,
+                                           CK_ULONG, CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_DecryptDigestUpdate)(CK_SESSION_HANDLE, CK_BYTE *,
+                                           CK_ULONG, CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_SignEncryptUpdate)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG,
+                                         CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_DecryptVerifyUpdate)(CK_SESSION_HANDLE, CK_BYTE *,
+                                           CK_ULONG, CK_BYTE *, CK_ULONG *);
+typedef CK_RV (* CK_C_GenerateKey)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                   CK_ATTRIBUTE *, CK_ULONG,
+                                   CK_OBJECT_HANDLE *);
+typedef CK_RV (* CK_C_GenerateKeyPair)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                       CK_ATTRIBUTE *, CK_ULONG, CK_ATTRIBUTE *,
+                                       CK_ULONG, CK_OBJECT_HANDLE *,
+                                       CK_OBJECT_HANDLE *);
+typedef CK_RV (* CK_C_WrapKey)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                               CK_OBJECT_HANDLE, CK_OBJECT_HANDLE, CK_BYTE *,
+                               CK_ULONG *);
+typedef CK_RV (* CK_C_UnwrapKey)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                 CK_OBJECT_HANDLE, CK_BYTE *, CK_ULONG,
+                                 CK_ATTRIBUTE *, CK_ULONG, CK_OBJECT_HANDLE *);
+typedef CK_RV (* CK_C_DeriveKey)(CK_SESSION_HANDLE, CK_MECHANISM *,
+                                 CK_OBJECT_HANDLE, CK_ATTRIBUTE *, CK_ULONG,
+                                 CK_OBJECT_HANDLE *);
+typedef CK_RV (* CK_C_SeedRandom)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+typedef CK_RV (* CK_C_GenerateRandom)(CK_SESSION_HANDLE, CK_BYTE *, CK_ULONG);
+typedef CK_RV (* CK_C_GetFunctionStatus)(CK_SESSION_HANDLE);
+typedef CK_RV (* CK_C_CancelFunction)(CK_SESSION_HANDLE);
+typedef CK_RV (* CK_C_WaitForSlotEvent)(CK_FLAGS, CK_SLOT_ID *, void *);
+
+struct CK_FUNCTION_LIST {
+    CK_VERSION version;
+    CK_C_Initialize C_Initialize;
+    CK_C_Finalize C_Finalize;
+    CK_C_GetInfo C_GetInfo;
+    CK_C_GetFunctionList C_GetFunctionList;
+    CK_C_GetSlotList C_GetSlotList;
+    CK_C_GetSlotInfo C_GetSlotInfo;
+    CK_C_GetTokenInfo C_GetTokenInfo;
+    CK_C_GetMechanismList C_GetMechanismList;
+    CK_C_GetMechanismInfo C_GetMechanismInfo;
+    CK_C_InitToken C_InitToken;
+    CK_C_InitPIN C_InitPIN;
+    CK_C_SetPIN C_SetPIN;
+    CK_C_OpenSession C_OpenSession;
+    CK_C_CloseSession C_CloseSession;
+    CK_C_CloseAllSessions C_CloseAllSessions;
+    CK_C_GetSessionInfo C_GetSessionInfo;
+    CK_C_GetOperationState C_GetOperationState;
+    CK_C_SetOperationState C_SetOperationState;
+    CK_C_Login C_Login;
+    CK_C_Logout C_Logout;
+    CK_C_CreateObject C_CreateObject;
+    CK_C_CopyObject C_CopyObject;
+    CK_C_DestroyObject C_DestroyObject;
+    CK_C_GetObjectSize C_GetObjectSize;
+    CK_C_GetAttributeValue C_GetAttributeValue;
+    CK_C_SetAttributeValue C_SetAttributeValue;
+    CK_C_FindObjectsInit C_FindObjectsInit;
+    CK_C_FindObjects C_FindObjects;
+    CK_C_FindObjectsFinal C_FindObjectsFinal;
+    CK_C_EncryptInit C_EncryptInit;
+    CK_C_Encrypt C_Encrypt;
+    CK_C_EncryptUpdate C_EncryptUpdate;
+    CK_C_EncryptFinal C_EncryptFinal;
+    CK_C_DecryptInit C_DecryptInit;
+    CK_C_Decrypt C_Decrypt;
+    CK_C_DecryptUpdate C_DecryptUpdate;
+    CK_C_DecryptFinal C_DecryptFinal;
+    CK_C_DigestInit C_DigestInit;
+    CK_C_Digest C_Digest;
+    CK_C_DigestUpdate C_DigestUpdate;
+    CK_C_DigestKey C_DigestKey;
+    CK_C_DigestFinal C_DigestFinal;
+    CK_C_SignInit C_SignInit;
+    CK_C_Sign C_Sign;
+    CK_C_SignUpdate C_SignUpdate;
+    CK_C_SignFinal C_SignFinal;
+    CK_C_SignRecoverInit C_SignRecoverInit;
+    CK_C_SignRecover C_SignRecover;
+    CK_C_VerifyInit C_VerifyInit;
+    CK_C_Verify C_Verify;
+    CK_C_VerifyUpdate C_VerifyUpdate;
+    CK_C_VerifyFinal C_VerifyFinal;
+    CK_C_VerifyRecoverInit C_VerifyRecoverInit;
+    CK_C_VerifyRecover C_VerifyRecover;
+    CK_C_DigestEncryptUpdate C_DigestEncryptUpdate;
+    CK_C_DecryptDigestUpdate C_DecryptDigestUpdate;
+    CK_C_SignEncryptUpdate C_SignEncryptUpdate;
+    CK_C_DecryptVerifyUpdate C_DecryptVerifyUpdate;
+    CK_C_GenerateKey C_GenerateKey;
+    CK_C_GenerateKeyPair C_GenerateKeyPair;
+    CK_C_WrapKey C_WrapKey;
+    CK_C_UnwrapKey C_UnwrapKey;
+    CK_C_DeriveKey C_DeriveKey;
+    CK_C_SeedRandom C_SeedRandom;
+    CK_C_GenerateRandom C_GenerateRandom;
+    CK_C_GetFunctionStatus C_GetFunctionStatus;
+    CK_C_CancelFunction C_CancelFunction;
+    CK_C_WaitForSlotEvent C_WaitForSlotEvent;
+};
+
+
+#endif
diff --git a/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11f.h b/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11f.h
deleted file mode 100644
index ed90affc5e3..00000000000
--- a/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11f.h
+++ /dev/null
@@ -1,939 +0,0 @@
-/* Copyright (c) OASIS Open 2016. All Rights Reserved./
- * /Distributed under the terms of the OASIS IPR Policy,
- * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
- * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
- * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
- */
-        
-/* Latest version of the specification:
- * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
- */
-
-/* This header file contains pretty much everything about all the
- * Cryptoki function prototypes.  Because this information is
- * used for more than just declaring function prototypes, the
- * order of the functions appearing herein is important, and
- * should not be altered.
- */
-
-/* General-purpose */
-
-/* C_Initialize initializes the Cryptoki library. */
-CK_PKCS11_FUNCTION_INFO(C_Initialize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_VOID_PTR   pInitArgs  /* if this is not NULL_PTR, it gets
-                            * cast to CK_C_INITIALIZE_ARGS_PTR
-                            * and dereferenced
-                            */
-);
-#endif
-
-
-/* C_Finalize indicates that an application is done with the
- * Cryptoki library.
- */
-CK_PKCS11_FUNCTION_INFO(C_Finalize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_VOID_PTR   pReserved  /* reserved.  Should be NULL_PTR */
-);
-#endif
-
-
-/* C_GetInfo returns general information about Cryptoki. */
-CK_PKCS11_FUNCTION_INFO(C_GetInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_INFO_PTR   pInfo  /* location that receives information */
-);
-#endif
-
-
-/* C_GetFunctionList returns the function list. */
-CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_FUNCTION_LIST_PTR_PTR ppFunctionList  /* receives pointer to
-                                            * function list
-                                            */
-);
-#endif
-
-
-
-/* Slot and token management */
-
-/* C_GetSlotList obtains a list of slots in the system. */
-CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_BBOOL       tokenPresent,  /* only slots with tokens */
-  CK_SLOT_ID_PTR pSlotList,     /* receives array of slot IDs */
-  CK_ULONG_PTR   pulCount       /* receives number of slots */
-);
-#endif
-
-
-/* C_GetSlotInfo obtains information about a particular slot in
- * the system.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID       slotID,  /* the ID of the slot */
-  CK_SLOT_INFO_PTR pInfo    /* receives the slot information */
-);
-#endif
-
-
-/* C_GetTokenInfo obtains information about a particular token
- * in the system.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID        slotID,  /* ID of the token's slot */
-  CK_TOKEN_INFO_PTR pInfo    /* receives the token information */
-);
-#endif
-
-
-/* C_GetMechanismList obtains a list of mechanism types
- * supported by a token.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,          /* ID of token's slot */
-  CK_MECHANISM_TYPE_PTR pMechanismList,  /* gets mech. array */
-  CK_ULONG_PTR          pulCount         /* gets # of mechs. */
-);
-#endif
-
-
-/* C_GetMechanismInfo obtains information about a particular
- * mechanism possibly supported by a token.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,  /* ID of the token's slot */
-  CK_MECHANISM_TYPE     type,    /* type of mechanism */
-  CK_MECHANISM_INFO_PTR pInfo    /* receives mechanism info */
-);
-#endif
-
-
-/* C_InitToken initializes a token. */
-CK_PKCS11_FUNCTION_INFO(C_InitToken)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID      slotID,    /* ID of the token's slot */
-  CK_UTF8CHAR_PTR pPin,      /* the SO's initial PIN */
-  CK_ULONG        ulPinLen,  /* length in bytes of the PIN */
-  CK_UTF8CHAR_PTR pLabel     /* 32-byte token label (blank padded) */
-);
-#endif
-
-
-/* C_InitPIN initializes the normal user's PIN. */
-CK_PKCS11_FUNCTION_INFO(C_InitPIN)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_UTF8CHAR_PTR   pPin,      /* the normal user's PIN */
-  CK_ULONG          ulPinLen   /* length in bytes of the PIN */
-);
-#endif
-
-
-/* C_SetPIN modifies the PIN of the user who is logged in. */
-CK_PKCS11_FUNCTION_INFO(C_SetPIN)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_UTF8CHAR_PTR   pOldPin,   /* the old PIN */
-  CK_ULONG          ulOldLen,  /* length of the old PIN */
-  CK_UTF8CHAR_PTR   pNewPin,   /* the new PIN */
-  CK_ULONG          ulNewLen   /* length of the new PIN */
-);
-#endif
-
-
-
-/* Session management */
-
-/* C_OpenSession opens a session between an application and a
- * token.
- */
-CK_PKCS11_FUNCTION_INFO(C_OpenSession)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,        /* the slot's ID */
-  CK_FLAGS              flags,         /* from CK_SESSION_INFO */
-  CK_VOID_PTR           pApplication,  /* passed to callback */
-  CK_NOTIFY             Notify,        /* callback function */
-  CK_SESSION_HANDLE_PTR phSession      /* gets session handle */
-);
-#endif
-
-
-/* C_CloseSession closes a session between an application and a
- * token.
- */
-CK_PKCS11_FUNCTION_INFO(C_CloseSession)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-/* C_CloseAllSessions closes all sessions with a token. */
-CK_PKCS11_FUNCTION_INFO(C_CloseAllSessions)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID     slotID  /* the token's slot */
-);
-#endif
-
-
-/* C_GetSessionInfo obtains information about the session. */
-CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE   hSession,  /* the session's handle */
-  CK_SESSION_INFO_PTR pInfo      /* receives session info */
-);
-#endif
-
-
-/* C_GetOperationState obtains the state of the cryptographic operation
- * in a session.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,             /* session's handle */
-  CK_BYTE_PTR       pOperationState,      /* gets state */
-  CK_ULONG_PTR      pulOperationStateLen  /* gets state length */
-);
-#endif
-
-
-/* C_SetOperationState restores the state of the cryptographic
- * operation in a session.
- */
-CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR      pOperationState,      /* holds state */
-  CK_ULONG         ulOperationStateLen,  /* holds state length */
-  CK_OBJECT_HANDLE hEncryptionKey,       /* en/decryption key */
-  CK_OBJECT_HANDLE hAuthenticationKey    /* sign/verify key */
-);
-#endif
-
-
-/* C_Login logs a user into a token. */
-CK_PKCS11_FUNCTION_INFO(C_Login)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_USER_TYPE      userType,  /* the user type */
-  CK_UTF8CHAR_PTR   pPin,      /* the user's PIN */
-  CK_ULONG          ulPinLen   /* the length of the PIN */
-);
-#endif
-
-
-/* C_Logout logs a user out from a token. */
-CK_PKCS11_FUNCTION_INFO(C_Logout)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-
-/* Object management */
-
-/* C_CreateObject creates a new object. */
-CK_PKCS11_FUNCTION_INFO(C_CreateObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,   /* the object's template */
-  CK_ULONG          ulCount,     /* attributes in template */
-  CK_OBJECT_HANDLE_PTR phObject  /* gets new object's handle. */
-);
-#endif
-
-
-/* C_CopyObject copies an object, creating a new object for the
- * copy.
- */
-CK_PKCS11_FUNCTION_INFO(C_CopyObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,    /* the session's handle */
-  CK_OBJECT_HANDLE     hObject,     /* the object's handle */
-  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new object */
-  CK_ULONG             ulCount,     /* attributes in template */
-  CK_OBJECT_HANDLE_PTR phNewObject  /* receives handle of copy */
-);
-#endif
-
-
-/* C_DestroyObject destroys an object. */
-CK_PKCS11_FUNCTION_INFO(C_DestroyObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hObject    /* the object's handle */
-);
-#endif
-
-
-/* C_GetObjectSize gets the size of an object in bytes. */
-CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,   /* the object's handle */
-  CK_ULONG_PTR      pulSize    /* receives size of object */
-);
-#endif
-
-
-/* C_GetAttributeValue obtains the value of one or more object
- * attributes.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs; gets vals */
-  CK_ULONG          ulCount     /* attributes in template */
-);
-#endif
-
-
-/* C_SetAttributeValue modifies the value of one or more object
- * attributes.
- */
-CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs and values */
-  CK_ULONG          ulCount     /* attributes in template */
-);
-#endif
-
-
-/* C_FindObjectsInit initializes a search for token and session
- * objects that match a template.
- */
-CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* attribute values to match */
-  CK_ULONG          ulCount     /* attrs in search template */
-);
-#endif
-
-
-/* C_FindObjects continues a search for token and session
- * objects that match a template, obtaining additional object
- * handles.
- */
-CK_PKCS11_FUNCTION_INFO(C_FindObjects)
-#ifdef CK_NEED_ARG_LIST
-(
- CK_SESSION_HANDLE    hSession,          /* session's handle */
- CK_OBJECT_HANDLE_PTR phObject,          /* gets obj. handles */
- CK_ULONG             ulMaxObjectCount,  /* max handles to get */
- CK_ULONG_PTR         pulObjectCount     /* actual # returned */
-);
-#endif
-
-
-/* C_FindObjectsFinal finishes a search for token and session
- * objects.
- */
-CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-
-/* Encryption and decryption */
-
-/* C_EncryptInit initializes an encryption operation. */
-CK_PKCS11_FUNCTION_INFO(C_EncryptInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the encryption mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of encryption key */
-);
-#endif
-
-
-/* C_Encrypt encrypts single-part data. */
-CK_PKCS11_FUNCTION_INFO(C_Encrypt)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pData,               /* the plaintext data */
-  CK_ULONG          ulDataLen,           /* bytes of plaintext */
-  CK_BYTE_PTR       pEncryptedData,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedDataLen  /* gets c-text size */
-);
-#endif
-
-
-/* C_EncryptUpdate continues a multiple-part encryption
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,           /* session's handle */
-  CK_BYTE_PTR       pPart,              /* the plaintext data */
-  CK_ULONG          ulPartLen,          /* plaintext data len */
-  CK_BYTE_PTR       pEncryptedPart,     /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen /* gets c-text size */
-);
-#endif
-
-
-/* C_EncryptFinal finishes a multiple-part encryption
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,                /* session handle */
-  CK_BYTE_PTR       pLastEncryptedPart,      /* last c-text */
-  CK_ULONG_PTR      pulLastEncryptedPartLen  /* gets last size */
-);
-#endif
-
-
-/* C_DecryptInit initializes a decryption operation. */
-CK_PKCS11_FUNCTION_INFO(C_DecryptInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the decryption mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of decryption key */
-);
-#endif
-
-
-/* C_Decrypt decrypts encrypted data in a single part. */
-CK_PKCS11_FUNCTION_INFO(C_Decrypt)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,           /* session's handle */
-  CK_BYTE_PTR       pEncryptedData,     /* ciphertext */
-  CK_ULONG          ulEncryptedDataLen, /* ciphertext length */
-  CK_BYTE_PTR       pData,              /* gets plaintext */
-  CK_ULONG_PTR      pulDataLen          /* gets p-text size */
-);
-#endif
-
-
-/* C_DecryptUpdate continues a multiple-part decryption
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* encrypted data */
-  CK_ULONG          ulEncryptedPartLen,  /* input length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* p-text size */
-);
-#endif
-
-
-/* C_DecryptFinal finishes a multiple-part decryption
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pLastPart,      /* gets plaintext */
-  CK_ULONG_PTR      pulLastPartLen  /* p-text size */
-);
-#endif
-
-
-
-/* Message digesting */
-
-/* C_DigestInit initializes a message-digesting operation. */
-CK_PKCS11_FUNCTION_INFO(C_DigestInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism  /* the digesting mechanism */
-);
-#endif
-
-
-/* C_Digest digests data in a single part. */
-CK_PKCS11_FUNCTION_INFO(C_Digest)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,     /* the session's handle */
-  CK_BYTE_PTR       pData,        /* data to be digested */
-  CK_ULONG          ulDataLen,    /* bytes of data to digest */
-  CK_BYTE_PTR       pDigest,      /* gets the message digest */
-  CK_ULONG_PTR      pulDigestLen  /* gets digest length */
-);
-#endif
-
-
-/* C_DigestUpdate continues a multiple-part message-digesting
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* data to be digested */
-  CK_ULONG          ulPartLen  /* bytes of data to be digested */
-);
-#endif
-
-
-/* C_DigestKey continues a multi-part message-digesting
- * operation, by digesting the value of a secret key as part of
- * the data already digested.
- */
-CK_PKCS11_FUNCTION_INFO(C_DigestKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hKey       /* secret key to digest */
-);
-#endif
-
-
-/* C_DigestFinal finishes a multiple-part message-digesting
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,     /* the session's handle */
-  CK_BYTE_PTR       pDigest,      /* gets the message digest */
-  CK_ULONG_PTR      pulDigestLen  /* gets byte count of digest */
-);
-#endif
-
-
-
-/* Signing and MACing */
-
-/* C_SignInit initializes a signature (private key encryption)
- * operation, where the signature is (will be) an appendix to
- * the data, and plaintext cannot be recovered from the
- * signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the signature mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of signature key */
-);
-#endif
-
-
-/* C_Sign signs (encrypts with private key) data in a single
- * part, where the signature is (will be) an appendix to the
- * data, and plaintext cannot be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_Sign)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pData,           /* the data to sign */
-  CK_ULONG          ulDataLen,       /* count of bytes to sign */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-/* C_SignUpdate continues a multiple-part signature operation,
- * where the signature is (will be) an appendix to the data,
- * and plaintext cannot be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* the data to sign */
-  CK_ULONG          ulPartLen  /* count of bytes to sign */
-);
-#endif
-
-
-/* C_SignFinal finishes a multiple-part signature operation,
- * returning the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-/* C_SignRecoverInit initializes a signature operation, where
- * the data can be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism, /* the signature mechanism */
-  CK_OBJECT_HANDLE  hKey        /* handle of the signature key */
-);
-#endif
-
-
-/* C_SignRecover signs data in a single operation, where the
- * data can be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignRecover)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pData,           /* the data to sign */
-  CK_ULONG          ulDataLen,       /* count of bytes to sign */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-
-/* Verifying signatures and MACs */
-
-/* C_VerifyInit initializes a verification operation, where the
- * signature is an appendix to the data, and plaintext cannot
- * cannot be recovered from the signature (e.g. DSA).
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
-  CK_OBJECT_HANDLE  hKey         /* verification key */
-);
-#endif
-
-
-/* C_Verify verifies a signature in a single-part operation,
- * where the signature is an appendix to the data, and plaintext
- * cannot be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_Verify)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pData,          /* signed data */
-  CK_ULONG          ulDataLen,      /* length of signed data */
-  CK_BYTE_PTR       pSignature,     /* signature */
-  CK_ULONG          ulSignatureLen  /* signature length*/
-);
-#endif
-
-
-/* C_VerifyUpdate continues a multiple-part verification
- * operation, where the signature is an appendix to the data,
- * and plaintext cannot be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* signed data */
-  CK_ULONG          ulPartLen  /* length of signed data */
-);
-#endif
-
-
-/* C_VerifyFinal finishes a multiple-part verification
- * operation, checking the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pSignature,     /* signature to verify */
-  CK_ULONG          ulSignatureLen  /* signature length */
-);
-#endif
-
-
-/* C_VerifyRecoverInit initializes a signature verification
- * operation, where the data is recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
-  CK_OBJECT_HANDLE  hKey         /* verification key */
-);
-#endif
-
-
-/* C_VerifyRecover verifies a signature in a single-part
- * operation, where the data is recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pSignature,      /* signature to verify */
-  CK_ULONG          ulSignatureLen,  /* signature length */
-  CK_BYTE_PTR       pData,           /* gets signed data */
-  CK_ULONG_PTR      pulDataLen       /* gets signed data len */
-);
-#endif
-
-
-
-/* Dual-function cryptographic operations */
-
-/* C_DigestEncryptUpdate continues a multiple-part digesting
- * and encryption operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pPart,               /* the plaintext data */
-  CK_ULONG          ulPartLen,           /* plaintext length */
-  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
-);
-#endif
-
-
-/* C_DecryptDigestUpdate continues a multiple-part decryption and
- * digesting operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
-  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* gets plaintext len */
-);
-#endif
-
-
-/* C_SignEncryptUpdate continues a multiple-part signing and
- * encryption operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pPart,               /* the plaintext data */
-  CK_ULONG          ulPartLen,           /* plaintext length */
-  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
-);
-#endif
-
-
-/* C_DecryptVerifyUpdate continues a multiple-part decryption and
- * verify operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
-  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* gets p-text length */
-);
-#endif
-
-
-
-/* Key management */
-
-/* C_GenerateKey generates a secret key, creating a new key
- * object.
- */
-CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,    /* the session's handle */
-  CK_MECHANISM_PTR     pMechanism,  /* key generation mech. */
-  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new key */
-  CK_ULONG             ulCount,     /* # of attrs in template */
-  CK_OBJECT_HANDLE_PTR phKey        /* gets handle of new key */
-);
-#endif
-
-
-/* C_GenerateKeyPair generates a public-key/private-key pair,
- * creating new key objects.
- */
-CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,                    /* session handle */
-  CK_MECHANISM_PTR     pMechanism,                  /* key-gen mech. */
-  CK_ATTRIBUTE_PTR     pPublicKeyTemplate,          /* template for pub. key */
-  CK_ULONG             ulPublicKeyAttributeCount,   /* # pub. attrs. */
-  CK_ATTRIBUTE_PTR     pPrivateKeyTemplate,         /* template for priv. key */
-  CK_ULONG             ulPrivateKeyAttributeCount,  /* # priv.  attrs. */
-  CK_OBJECT_HANDLE_PTR phPublicKey,                 /* gets pub. key handle */
-  CK_OBJECT_HANDLE_PTR phPrivateKey                 /* gets priv. key handle */
-);
-#endif
-
-
-/* C_WrapKey wraps (i.e., encrypts) a key. */
-CK_PKCS11_FUNCTION_INFO(C_WrapKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,      /* the wrapping mechanism */
-  CK_OBJECT_HANDLE  hWrappingKey,    /* wrapping key */
-  CK_OBJECT_HANDLE  hKey,            /* key to be wrapped */
-  CK_BYTE_PTR       pWrappedKey,     /* gets wrapped key */
-  CK_ULONG_PTR      pulWrappedKeyLen /* gets wrapped key size */
-);
-#endif
-
-
-/* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
- * key object.
- */
-CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,          /* session's handle */
-  CK_MECHANISM_PTR     pMechanism,        /* unwrapping mech. */
-  CK_OBJECT_HANDLE     hUnwrappingKey,    /* unwrapping key */
-  CK_BYTE_PTR          pWrappedKey,       /* the wrapped key */
-  CK_ULONG             ulWrappedKeyLen,   /* wrapped key len */
-  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
-  CK_ULONG             ulAttributeCount,  /* template length */
-  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
-);
-#endif
-
-
-/* C_DeriveKey derives a key from a base key, creating a new key
- * object.
- */
-CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,          /* session's handle */
-  CK_MECHANISM_PTR     pMechanism,        /* key deriv. mech. */
-  CK_OBJECT_HANDLE     hBaseKey,          /* base key */
-  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
-  CK_ULONG             ulAttributeCount,  /* template length */
-  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
-);
-#endif
-
-
-
-/* Random number generation */
-
-/* C_SeedRandom mixes additional seed material into the token's
- * random number generator.
- */
-CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pSeed,     /* the seed material */
-  CK_ULONG          ulSeedLen  /* length of seed material */
-);
-#endif
-
-
-/* C_GenerateRandom generates random data. */
-CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_BYTE_PTR       RandomData,  /* receives the random data */
-  CK_ULONG          ulRandomLen  /* # of bytes to generate */
-);
-#endif
-
-
-
-/* Parallel function management */
-
-/* C_GetFunctionStatus is a legacy function; it obtains an
- * updated status of a function running in parallel with an
- * application.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-/* C_CancelFunction is a legacy function; it cancels a function
- * running in parallel.
- */
-CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-/* C_WaitForSlotEvent waits for a slot event (token insertion,
- * removal, etc.) to occur.
- */
-CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_FLAGS flags,        /* blocking/nonblocking flag */
-  CK_SLOT_ID_PTR pSlot,  /* location that receives the slot ID */
-  CK_VOID_PTR pRserved   /* reserved.  Should be NULL_PTR */
-);
-#endif
-
diff --git a/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11t.h b/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11t.h
deleted file mode 100644
index c13e67cf55f..00000000000
--- a/contrib/restricted/aws/aws-c-io/source/pkcs11/v2.40/pkcs11t.h
+++ /dev/null
@@ -1,2003 +0,0 @@
-/* Copyright (c) OASIS Open 2016. All Rights Reserved./
- * /Distributed under the terms of the OASIS IPR Policy,
- * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
- * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
- * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
- */
-        
-/* Latest version of the specification:
- * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
- */
-
-/* See top of pkcs11.h for information about the macros that
- * must be defined and the structure-packing conventions that
- * must be set before including this file.
- */
-
-#ifndef _PKCS11T_H_
-#define _PKCS11T_H_ 1
-
-#define CRYPTOKI_VERSION_MAJOR          2
-#define CRYPTOKI_VERSION_MINOR          40
-#define CRYPTOKI_VERSION_AMENDMENT      0
-
-#define CK_TRUE         1
-#define CK_FALSE        0
-
-#ifndef CK_DISABLE_TRUE_FALSE
-#ifndef FALSE
-#define FALSE CK_FALSE
-#endif
-#ifndef TRUE
-#define TRUE CK_TRUE
-#endif
-#endif
-
-/* an unsigned 8-bit value */
-typedef unsigned char     CK_BYTE;
-
-/* an unsigned 8-bit character */
-typedef CK_BYTE           CK_CHAR;
-
-/* an 8-bit UTF-8 character */
-typedef CK_BYTE           CK_UTF8CHAR;
-
-/* a BYTE-sized Boolean flag */
-typedef CK_BYTE           CK_BBOOL;
-
-/* an unsigned value, at least 32 bits long */
-typedef unsigned long int CK_ULONG;
-
-/* a signed value, the same size as a CK_ULONG */
-typedef long int          CK_LONG;
-
-/* at least 32 bits; each bit is a Boolean flag */
-typedef CK_ULONG          CK_FLAGS;
-
-
-/* some special values for certain CK_ULONG variables */
-#define CK_UNAVAILABLE_INFORMATION      (~0UL)
-#define CK_EFFECTIVELY_INFINITE         0UL
-
-
-typedef CK_BYTE     CK_PTR   CK_BYTE_PTR;
-typedef CK_CHAR     CK_PTR   CK_CHAR_PTR;
-typedef CK_UTF8CHAR CK_PTR   CK_UTF8CHAR_PTR;
-typedef CK_ULONG    CK_PTR   CK_ULONG_PTR;
-typedef void        CK_PTR   CK_VOID_PTR;
-
-/* Pointer to a CK_VOID_PTR-- i.e., pointer to pointer to void */
-typedef CK_VOID_PTR CK_PTR CK_VOID_PTR_PTR;
-
-
-/* The following value is always invalid if used as a session
- * handle or object handle
- */
-#define CK_INVALID_HANDLE       0UL
-
-
-typedef struct CK_VERSION {
-  CK_BYTE       major;  /* integer portion of version number */
-  CK_BYTE       minor;  /* 1/100ths portion of version number */
-} CK_VERSION;
-
-typedef CK_VERSION CK_PTR CK_VERSION_PTR;
-
-
-typedef struct CK_INFO {
-  CK_VERSION    cryptokiVersion;     /* Cryptoki interface ver */
-  CK_UTF8CHAR   manufacturerID[32];  /* blank padded */
-  CK_FLAGS      flags;               /* must be zero */
-  CK_UTF8CHAR   libraryDescription[32];  /* blank padded */
-  CK_VERSION    libraryVersion;          /* version of library */
-} CK_INFO;
-
-typedef CK_INFO CK_PTR    CK_INFO_PTR;
-
-
-/* CK_NOTIFICATION enumerates the types of notifications that
- * Cryptoki provides to an application
- */
-typedef CK_ULONG CK_NOTIFICATION;
-#define CKN_SURRENDER           0UL
-#define CKN_OTP_CHANGED         1UL
-
-typedef CK_ULONG          CK_SLOT_ID;
-
-typedef CK_SLOT_ID CK_PTR CK_SLOT_ID_PTR;
-
-
-/* CK_SLOT_INFO provides information about a slot */
-typedef struct CK_SLOT_INFO {
-  CK_UTF8CHAR   slotDescription[64];  /* blank padded */
-  CK_UTF8CHAR   manufacturerID[32];   /* blank padded */
-  CK_FLAGS      flags;
-
-  CK_VERSION    hardwareVersion;  /* version of hardware */
-  CK_VERSION    firmwareVersion;  /* version of firmware */
-} CK_SLOT_INFO;
-
-/* flags: bit flags that provide capabilities of the slot
- *      Bit Flag              Mask        Meaning
- */
-#define CKF_TOKEN_PRESENT     0x00000001UL  /* a token is there */
-#define CKF_REMOVABLE_DEVICE  0x00000002UL  /* removable devices*/
-#define CKF_HW_SLOT           0x00000004UL  /* hardware slot */
-
-typedef CK_SLOT_INFO CK_PTR CK_SLOT_INFO_PTR;
-
-
-/* CK_TOKEN_INFO provides information about a token */
-typedef struct CK_TOKEN_INFO {
-  CK_UTF8CHAR   label[32];           /* blank padded */
-  CK_UTF8CHAR   manufacturerID[32];  /* blank padded */
-  CK_UTF8CHAR   model[16];           /* blank padded */
-  CK_CHAR       serialNumber[16];    /* blank padded */
-  CK_FLAGS      flags;               /* see below */
-
-  CK_ULONG      ulMaxSessionCount;     /* max open sessions */
-  CK_ULONG      ulSessionCount;        /* sess. now open */
-  CK_ULONG      ulMaxRwSessionCount;   /* max R/W sessions */
-  CK_ULONG      ulRwSessionCount;      /* R/W sess. now open */
-  CK_ULONG      ulMaxPinLen;           /* in bytes */
-  CK_ULONG      ulMinPinLen;           /* in bytes */
-  CK_ULONG      ulTotalPublicMemory;   /* in bytes */
-  CK_ULONG      ulFreePublicMemory;    /* in bytes */
-  CK_ULONG      ulTotalPrivateMemory;  /* in bytes */
-  CK_ULONG      ulFreePrivateMemory;   /* in bytes */
-  CK_VERSION    hardwareVersion;       /* version of hardware */
-  CK_VERSION    firmwareVersion;       /* version of firmware */
-  CK_CHAR       utcTime[16];           /* time */
-} CK_TOKEN_INFO;
-
-/* The flags parameter is defined as follows:
- *      Bit Flag                    Mask        Meaning
- */
-#define CKF_RNG                     0x00000001UL  /* has random # generator */
-#define CKF_WRITE_PROTECTED         0x00000002UL  /* token is write-protected */
-#define CKF_LOGIN_REQUIRED          0x00000004UL  /* user must login */
-#define CKF_USER_PIN_INITIALIZED    0x00000008UL  /* normal user's PIN is set */
-
-/* CKF_RESTORE_KEY_NOT_NEEDED.  If it is set,
- * that means that *every* time the state of cryptographic
- * operations of a session is successfully saved, all keys
- * needed to continue those operations are stored in the state
- */
-#define CKF_RESTORE_KEY_NOT_NEEDED  0x00000020UL
-
-/* CKF_CLOCK_ON_TOKEN.  If it is set, that means
- * that the token has some sort of clock.  The time on that
- * clock is returned in the token info structure
- */
-#define CKF_CLOCK_ON_TOKEN          0x00000040UL
-
-/* CKF_PROTECTED_AUTHENTICATION_PATH.  If it is
- * set, that means that there is some way for the user to login
- * without sending a PIN through the Cryptoki library itself
- */
-#define CKF_PROTECTED_AUTHENTICATION_PATH 0x00000100UL
-
-/* CKF_DUAL_CRYPTO_OPERATIONS.  If it is true,
- * that means that a single session with the token can perform
- * dual simultaneous cryptographic operations (digest and
- * encrypt; decrypt and digest; sign and encrypt; and decrypt
- * and sign)
- */
-#define CKF_DUAL_CRYPTO_OPERATIONS  0x00000200UL
-
-/* CKF_TOKEN_INITIALIZED. If it is true, the
- * token has been initialized using C_InitializeToken or an
- * equivalent mechanism outside the scope of PKCS #11.
- * Calling C_InitializeToken when this flag is set will cause
- * the token to be reinitialized.
- */
-#define CKF_TOKEN_INITIALIZED       0x00000400UL
-
-/* CKF_SECONDARY_AUTHENTICATION. If it is
- * true, the token supports secondary authentication for
- * private key objects.
- */
-#define CKF_SECONDARY_AUTHENTICATION  0x00000800UL
-
-/* CKF_USER_PIN_COUNT_LOW. If it is true, an
- * incorrect user login PIN has been entered at least once
- * since the last successful authentication.
- */
-#define CKF_USER_PIN_COUNT_LOW       0x00010000UL
-
-/* CKF_USER_PIN_FINAL_TRY. If it is true,
- * supplying an incorrect user PIN will it to become locked.
- */
-#define CKF_USER_PIN_FINAL_TRY       0x00020000UL
-
-/* CKF_USER_PIN_LOCKED. If it is true, the
- * user PIN has been locked. User login to the token is not
- * possible.
- */
-#define CKF_USER_PIN_LOCKED          0x00040000UL
-
-/* CKF_USER_PIN_TO_BE_CHANGED. If it is true,
- * the user PIN value is the default value set by token
- * initialization or manufacturing, or the PIN has been
- * expired by the card.
- */
-#define CKF_USER_PIN_TO_BE_CHANGED   0x00080000UL
-
-/* CKF_SO_PIN_COUNT_LOW. If it is true, an
- * incorrect SO login PIN has been entered at least once since
- * the last successful authentication.
- */
-#define CKF_SO_PIN_COUNT_LOW         0x00100000UL
-
-/* CKF_SO_PIN_FINAL_TRY. If it is true,
- * supplying an incorrect SO PIN will it to become locked.
- */
-#define CKF_SO_PIN_FINAL_TRY         0x00200000UL
-
-/* CKF_SO_PIN_LOCKED. If it is true, the SO
- * PIN has been locked. SO login to the token is not possible.
- */
-#define CKF_SO_PIN_LOCKED            0x00400000UL
-
-/* CKF_SO_PIN_TO_BE_CHANGED. If it is true,
- * the SO PIN value is the default value set by token
- * initialization or manufacturing, or the PIN has been
- * expired by the card.
- */
-#define CKF_SO_PIN_TO_BE_CHANGED     0x00800000UL
-
-#define CKF_ERROR_STATE              0x01000000UL
-
-typedef CK_TOKEN_INFO CK_PTR CK_TOKEN_INFO_PTR;
-
-
-/* CK_SESSION_HANDLE is a Cryptoki-assigned value that
- * identifies a session
- */
-typedef CK_ULONG          CK_SESSION_HANDLE;
-
-typedef CK_SESSION_HANDLE CK_PTR CK_SESSION_HANDLE_PTR;
-
-
-/* CK_USER_TYPE enumerates the types of Cryptoki users */
-typedef CK_ULONG          CK_USER_TYPE;
-/* Security Officer */
-#define CKU_SO                  0UL
-/* Normal user */
-#define CKU_USER                1UL
-/* Context specific */
-#define CKU_CONTEXT_SPECIFIC    2UL
-
-/* CK_STATE enumerates the session states */
-typedef CK_ULONG          CK_STATE;
-#define CKS_RO_PUBLIC_SESSION   0UL
-#define CKS_RO_USER_FUNCTIONS   1UL
-#define CKS_RW_PUBLIC_SESSION   2UL
-#define CKS_RW_USER_FUNCTIONS   3UL
-#define CKS_RW_SO_FUNCTIONS     4UL
-
-/* CK_SESSION_INFO provides information about a session */
-typedef struct CK_SESSION_INFO {
-  CK_SLOT_ID    slotID;
-  CK_STATE      state;
-  CK_FLAGS      flags;          /* see below */
-  CK_ULONG      ulDeviceError;  /* device-dependent error code */
-} CK_SESSION_INFO;
-
-/* The flags are defined in the following table:
- *      Bit Flag                Mask        Meaning
- */
-#define CKF_RW_SESSION          0x00000002UL /* session is r/w */
-#define CKF_SERIAL_SESSION      0x00000004UL /* no parallel    */
-
-typedef CK_SESSION_INFO CK_PTR CK_SESSION_INFO_PTR;
-
-
-/* CK_OBJECT_HANDLE is a token-specific identifier for an
- * object
- */
-typedef CK_ULONG          CK_OBJECT_HANDLE;
-
-typedef CK_OBJECT_HANDLE CK_PTR CK_OBJECT_HANDLE_PTR;
-
-
-/* CK_OBJECT_CLASS is a value that identifies the classes (or
- * types) of objects that Cryptoki recognizes.  It is defined
- * as follows:
- */
-typedef CK_ULONG          CK_OBJECT_CLASS;
-
-/* The following classes of objects are defined: */
-#define CKO_DATA              0x00000000UL
-#define CKO_CERTIFICATE       0x00000001UL
-#define CKO_PUBLIC_KEY        0x00000002UL
-#define CKO_PRIVATE_KEY       0x00000003UL
-#define CKO_SECRET_KEY        0x00000004UL
-#define CKO_HW_FEATURE        0x00000005UL
-#define CKO_DOMAIN_PARAMETERS 0x00000006UL
-#define CKO_MECHANISM         0x00000007UL
-#define CKO_OTP_KEY           0x00000008UL
-
-#define CKO_VENDOR_DEFINED    0x80000000UL
-
-typedef CK_OBJECT_CLASS CK_PTR CK_OBJECT_CLASS_PTR;
-
-/* CK_HW_FEATURE_TYPE is a value that identifies the hardware feature type
- * of an object with CK_OBJECT_CLASS equal to CKO_HW_FEATURE.
- */
-typedef CK_ULONG          CK_HW_FEATURE_TYPE;
-
-/* The following hardware feature types are defined */
-#define CKH_MONOTONIC_COUNTER  0x00000001UL
-#define CKH_CLOCK              0x00000002UL
-#define CKH_USER_INTERFACE     0x00000003UL
-#define CKH_VENDOR_DEFINED     0x80000000UL
-
-/* CK_KEY_TYPE is a value that identifies a key type */
-typedef CK_ULONG          CK_KEY_TYPE;
-
-/* the following key types are defined: */
-#define CKK_RSA                 0x00000000UL
-#define CKK_DSA                 0x00000001UL
-#define CKK_DH                  0x00000002UL
-#define CKK_ECDSA               0x00000003UL /* Deprecated */
-#define CKK_EC                  0x00000003UL
-#define CKK_X9_42_DH            0x00000004UL
-#define CKK_KEA                 0x00000005UL
-#define CKK_GENERIC_SECRET      0x00000010UL
-#define CKK_RC2                 0x00000011UL
-#define CKK_RC4                 0x00000012UL
-#define CKK_DES                 0x00000013UL
-#define CKK_DES2                0x00000014UL
-#define CKK_DES3                0x00000015UL
-#define CKK_CAST                0x00000016UL
-#define CKK_CAST3               0x00000017UL
-#define CKK_CAST5               0x00000018UL /* Deprecated */
-#define CKK_CAST128             0x00000018UL
-#define CKK_RC5                 0x00000019UL
-#define CKK_IDEA                0x0000001AUL
-#define CKK_SKIPJACK            0x0000001BUL
-#define CKK_BATON               0x0000001CUL
-#define CKK_JUNIPER             0x0000001DUL
-#define CKK_CDMF                0x0000001EUL
-#define CKK_AES                 0x0000001FUL
-#define CKK_BLOWFISH            0x00000020UL
-#define CKK_TWOFISH             0x00000021UL
-#define CKK_SECURID             0x00000022UL
-#define CKK_HOTP                0x00000023UL
-#define CKK_ACTI                0x00000024UL
-#define CKK_CAMELLIA            0x00000025UL
-#define CKK_ARIA                0x00000026UL
-
-#define CKK_MD5_HMAC            0x00000027UL
-#define CKK_SHA_1_HMAC          0x00000028UL
-#define CKK_RIPEMD128_HMAC      0x00000029UL
-#define CKK_RIPEMD160_HMAC      0x0000002AUL
-#define CKK_SHA256_HMAC         0x0000002BUL
-#define CKK_SHA384_HMAC         0x0000002CUL
-#define CKK_SHA512_HMAC         0x0000002DUL
-#define CKK_SHA224_HMAC         0x0000002EUL
-
-#define CKK_SEED                0x0000002FUL
-#define CKK_GOSTR3410           0x00000030UL
-#define CKK_GOSTR3411           0x00000031UL
-#define CKK_GOST28147           0x00000032UL
-
-
-
-#define CKK_VENDOR_DEFINED      0x80000000UL
-
-
-/* CK_CERTIFICATE_TYPE is a value that identifies a certificate
- * type
- */
-typedef CK_ULONG          CK_CERTIFICATE_TYPE;
-
-#define CK_CERTIFICATE_CATEGORY_UNSPECIFIED     0UL
-#define CK_CERTIFICATE_CATEGORY_TOKEN_USER      1UL
-#define CK_CERTIFICATE_CATEGORY_AUTHORITY       2UL
-#define CK_CERTIFICATE_CATEGORY_OTHER_ENTITY    3UL
-
-#define CK_SECURITY_DOMAIN_UNSPECIFIED     0UL
-#define CK_SECURITY_DOMAIN_MANUFACTURER    1UL
-#define CK_SECURITY_DOMAIN_OPERATOR        2UL
-#define CK_SECURITY_DOMAIN_THIRD_PARTY     3UL
-
-
-/* The following certificate types are defined: */
-#define CKC_X_509               0x00000000UL
-#define CKC_X_509_ATTR_CERT     0x00000001UL
-#define CKC_WTLS                0x00000002UL
-#define CKC_VENDOR_DEFINED      0x80000000UL
-
-
-/* CK_ATTRIBUTE_TYPE is a value that identifies an attribute
- * type
- */
-typedef CK_ULONG          CK_ATTRIBUTE_TYPE;
-
-/* The CKF_ARRAY_ATTRIBUTE flag identifies an attribute which
- * consists of an array of values.
- */
-#define CKF_ARRAY_ATTRIBUTE     0x40000000UL
-
-/* The following OTP-related defines relate to the CKA_OTP_FORMAT attribute */
-#define CK_OTP_FORMAT_DECIMAL           0UL
-#define CK_OTP_FORMAT_HEXADECIMAL       1UL
-#define CK_OTP_FORMAT_ALPHANUMERIC      2UL
-#define CK_OTP_FORMAT_BINARY            3UL
-
-/* The following OTP-related defines relate to the CKA_OTP_..._REQUIREMENT
- * attributes
- */
-#define CK_OTP_PARAM_IGNORED            0UL
-#define CK_OTP_PARAM_OPTIONAL           1UL
-#define CK_OTP_PARAM_MANDATORY          2UL
-
-/* The following attribute types are defined: */
-#define CKA_CLASS              0x00000000UL
-#define CKA_TOKEN              0x00000001UL
-#define CKA_PRIVATE            0x00000002UL
-#define CKA_LABEL              0x00000003UL
-#define CKA_APPLICATION        0x00000010UL
-#define CKA_VALUE              0x00000011UL
-#define CKA_OBJECT_ID          0x00000012UL
-#define CKA_CERTIFICATE_TYPE   0x00000080UL
-#define CKA_ISSUER             0x00000081UL
-#define CKA_SERIAL_NUMBER      0x00000082UL
-#define CKA_AC_ISSUER          0x00000083UL
-#define CKA_OWNER              0x00000084UL
-#define CKA_ATTR_TYPES         0x00000085UL
-#define CKA_TRUSTED            0x00000086UL
-#define CKA_CERTIFICATE_CATEGORY        0x00000087UL
-#define CKA_JAVA_MIDP_SECURITY_DOMAIN   0x00000088UL
-#define CKA_URL                         0x00000089UL
-#define CKA_HASH_OF_SUBJECT_PUBLIC_KEY  0x0000008AUL
-#define CKA_HASH_OF_ISSUER_PUBLIC_KEY   0x0000008BUL
-#define CKA_NAME_HASH_ALGORITHM         0x0000008CUL
-#define CKA_CHECK_VALUE                 0x00000090UL
-
-#define CKA_KEY_TYPE           0x00000100UL
-#define CKA_SUBJECT            0x00000101UL
-#define CKA_ID                 0x00000102UL
-#define CKA_SENSITIVE          0x00000103UL
-#define CKA_ENCRYPT            0x00000104UL
-#define CKA_DECRYPT            0x00000105UL
-#define CKA_WRAP               0x00000106UL
-#define CKA_UNWRAP             0x00000107UL
-#define CKA_SIGN               0x00000108UL
-#define CKA_SIGN_RECOVER       0x00000109UL
-#define CKA_VERIFY             0x0000010AUL
-#define CKA_VERIFY_RECOVER     0x0000010BUL
-#define CKA_DERIVE             0x0000010CUL
-#define CKA_START_DATE         0x00000110UL
-#define CKA_END_DATE           0x00000111UL
-#define CKA_MODULUS            0x00000120UL
-#define CKA_MODULUS_BITS       0x00000121UL
-#define CKA_PUBLIC_EXPONENT    0x00000122UL
-#define CKA_PRIVATE_EXPONENT   0x00000123UL
-#define CKA_PRIME_1            0x00000124UL
-#define CKA_PRIME_2            0x00000125UL
-#define CKA_EXPONENT_1         0x00000126UL
-#define CKA_EXPONENT_2         0x00000127UL
-#define CKA_COEFFICIENT        0x00000128UL
-#define CKA_PUBLIC_KEY_INFO    0x00000129UL
-#define CKA_PRIME              0x00000130UL
-#define CKA_SUBPRIME           0x00000131UL
-#define CKA_BASE               0x00000132UL
-
-#define CKA_PRIME_BITS         0x00000133UL
-#define CKA_SUBPRIME_BITS      0x00000134UL
-#define CKA_SUB_PRIME_BITS     CKA_SUBPRIME_BITS
-
-#define CKA_VALUE_BITS         0x00000160UL
-#define CKA_VALUE_LEN          0x00000161UL
-#define CKA_EXTRACTABLE        0x00000162UL
-#define CKA_LOCAL              0x00000163UL
-#define CKA_NEVER_EXTRACTABLE  0x00000164UL
-#define CKA_ALWAYS_SENSITIVE   0x00000165UL
-#define CKA_KEY_GEN_MECHANISM  0x00000166UL
-
-#define CKA_MODIFIABLE         0x00000170UL
-#define CKA_COPYABLE           0x00000171UL
-
-#define CKA_DESTROYABLE        0x00000172UL
-
-#define CKA_ECDSA_PARAMS       0x00000180UL /* Deprecated */
-#define CKA_EC_PARAMS          0x00000180UL
-
-#define CKA_EC_POINT           0x00000181UL
-
-#define CKA_SECONDARY_AUTH     0x00000200UL /* Deprecated */
-#define CKA_AUTH_PIN_FLAGS     0x00000201UL /* Deprecated */
-
-#define CKA_ALWAYS_AUTHENTICATE  0x00000202UL
-
-#define CKA_WRAP_WITH_TRUSTED    0x00000210UL
-#define CKA_WRAP_TEMPLATE        (CKF_ARRAY_ATTRIBUTE|0x00000211UL)
-#define CKA_UNWRAP_TEMPLATE      (CKF_ARRAY_ATTRIBUTE|0x00000212UL)
-#define CKA_DERIVE_TEMPLATE      (CKF_ARRAY_ATTRIBUTE|0x00000213UL)
-
-#define CKA_OTP_FORMAT                0x00000220UL
-#define CKA_OTP_LENGTH                0x00000221UL
-#define CKA_OTP_TIME_INTERVAL         0x00000222UL
-#define CKA_OTP_USER_FRIENDLY_MODE    0x00000223UL
-#define CKA_OTP_CHALLENGE_REQUIREMENT 0x00000224UL
-#define CKA_OTP_TIME_REQUIREMENT      0x00000225UL
-#define CKA_OTP_COUNTER_REQUIREMENT   0x00000226UL
-#define CKA_OTP_PIN_REQUIREMENT       0x00000227UL
-#define CKA_OTP_COUNTER               0x0000022EUL
-#define CKA_OTP_TIME                  0x0000022FUL
-#define CKA_OTP_USER_IDENTIFIER       0x0000022AUL
-#define CKA_OTP_SERVICE_IDENTIFIER    0x0000022BUL
-#define CKA_OTP_SERVICE_LOGO          0x0000022CUL
-#define CKA_OTP_SERVICE_LOGO_TYPE     0x0000022DUL
-
-#define CKA_GOSTR3410_PARAMS            0x00000250UL
-#define CKA_GOSTR3411_PARAMS            0x00000251UL
-#define CKA_GOST28147_PARAMS            0x00000252UL
-
-#define CKA_HW_FEATURE_TYPE             0x00000300UL
-#define CKA_RESET_ON_INIT               0x00000301UL
-#define CKA_HAS_RESET                   0x00000302UL
-
-#define CKA_PIXEL_X                     0x00000400UL
-#define CKA_PIXEL_Y                     0x00000401UL
-#define CKA_RESOLUTION                  0x00000402UL
-#define CKA_CHAR_ROWS                   0x00000403UL
-#define CKA_CHAR_COLUMNS                0x00000404UL
-#define CKA_COLOR                       0x00000405UL
-#define CKA_BITS_PER_PIXEL              0x00000406UL
-#define CKA_CHAR_SETS                   0x00000480UL
-#define CKA_ENCODING_METHODS            0x00000481UL
-#define CKA_MIME_TYPES                  0x00000482UL
-#define CKA_MECHANISM_TYPE              0x00000500UL
-#define CKA_REQUIRED_CMS_ATTRIBUTES     0x00000501UL
-#define CKA_DEFAULT_CMS_ATTRIBUTES      0x00000502UL
-#define CKA_SUPPORTED_CMS_ATTRIBUTES    0x00000503UL
-#define CKA_ALLOWED_MECHANISMS          (CKF_ARRAY_ATTRIBUTE|0x00000600UL)
-
-#define CKA_VENDOR_DEFINED              0x80000000UL
-
-/* CK_ATTRIBUTE is a structure that includes the type, length
- * and value of an attribute
- */
-typedef struct CK_ATTRIBUTE {
-  CK_ATTRIBUTE_TYPE type;
-  CK_VOID_PTR       pValue;
-  CK_ULONG          ulValueLen;  /* in bytes */
-} CK_ATTRIBUTE;
-
-typedef CK_ATTRIBUTE CK_PTR CK_ATTRIBUTE_PTR;
-
-/* CK_DATE is a structure that defines a date */
-typedef struct CK_DATE{
-  CK_CHAR       year[4];   /* the year ("1900" - "9999") */
-  CK_CHAR       month[2];  /* the month ("01" - "12") */
-  CK_CHAR       day[2];    /* the day   ("01" - "31") */
-} CK_DATE;
-
-
-/* CK_MECHANISM_TYPE is a value that identifies a mechanism
- * type
- */
-typedef CK_ULONG          CK_MECHANISM_TYPE;
-
-/* the following mechanism types are defined: */
-#define CKM_RSA_PKCS_KEY_PAIR_GEN      0x00000000UL
-#define CKM_RSA_PKCS                   0x00000001UL
-#define CKM_RSA_9796                   0x00000002UL
-#define CKM_RSA_X_509                  0x00000003UL
-
-#define CKM_MD2_RSA_PKCS               0x00000004UL
-#define CKM_MD5_RSA_PKCS               0x00000005UL
-#define CKM_SHA1_RSA_PKCS              0x00000006UL
-
-#define CKM_RIPEMD128_RSA_PKCS         0x00000007UL
-#define CKM_RIPEMD160_RSA_PKCS         0x00000008UL
-#define CKM_RSA_PKCS_OAEP              0x00000009UL
-
-#define CKM_RSA_X9_31_KEY_PAIR_GEN     0x0000000AUL
-#define CKM_RSA_X9_31                  0x0000000BUL
-#define CKM_SHA1_RSA_X9_31             0x0000000CUL
-#define CKM_RSA_PKCS_PSS               0x0000000DUL
-#define CKM_SHA1_RSA_PKCS_PSS          0x0000000EUL
-
-#define CKM_DSA_KEY_PAIR_GEN           0x00000010UL
-#define CKM_DSA                        0x00000011UL
-#define CKM_DSA_SHA1                   0x00000012UL
-#define CKM_DSA_SHA224                 0x00000013UL
-#define CKM_DSA_SHA256                 0x00000014UL
-#define CKM_DSA_SHA384                 0x00000015UL
-#define CKM_DSA_SHA512                 0x00000016UL
-
-#define CKM_DH_PKCS_KEY_PAIR_GEN       0x00000020UL
-#define CKM_DH_PKCS_DERIVE             0x00000021UL
-
-#define CKM_X9_42_DH_KEY_PAIR_GEN      0x00000030UL
-#define CKM_X9_42_DH_DERIVE            0x00000031UL
-#define CKM_X9_42_DH_HYBRID_DERIVE     0x00000032UL
-#define CKM_X9_42_MQV_DERIVE           0x00000033UL
-
-#define CKM_SHA256_RSA_PKCS            0x00000040UL
-#define CKM_SHA384_RSA_PKCS            0x00000041UL
-#define CKM_SHA512_RSA_PKCS            0x00000042UL
-#define CKM_SHA256_RSA_PKCS_PSS        0x00000043UL
-#define CKM_SHA384_RSA_PKCS_PSS        0x00000044UL
-#define CKM_SHA512_RSA_PKCS_PSS        0x00000045UL
-
-#define CKM_SHA224_RSA_PKCS            0x00000046UL
-#define CKM_SHA224_RSA_PKCS_PSS        0x00000047UL
-
-#define CKM_SHA512_224                 0x00000048UL
-#define CKM_SHA512_224_HMAC            0x00000049UL
-#define CKM_SHA512_224_HMAC_GENERAL    0x0000004AUL
-#define CKM_SHA512_224_KEY_DERIVATION  0x0000004BUL
-#define CKM_SHA512_256                 0x0000004CUL
-#define CKM_SHA512_256_HMAC            0x0000004DUL
-#define CKM_SHA512_256_HMAC_GENERAL    0x0000004EUL
-#define CKM_SHA512_256_KEY_DERIVATION  0x0000004FUL
-
-#define CKM_SHA512_T                   0x00000050UL
-#define CKM_SHA512_T_HMAC              0x00000051UL
-#define CKM_SHA512_T_HMAC_GENERAL      0x00000052UL
-#define CKM_SHA512_T_KEY_DERIVATION    0x00000053UL
-
-#define CKM_RC2_KEY_GEN                0x00000100UL
-#define CKM_RC2_ECB                    0x00000101UL
-#define CKM_RC2_CBC                    0x00000102UL
-#define CKM_RC2_MAC                    0x00000103UL
-
-#define CKM_RC2_MAC_GENERAL            0x00000104UL
-#define CKM_RC2_CBC_PAD                0x00000105UL
-
-#define CKM_RC4_KEY_GEN                0x00000110UL
-#define CKM_RC4                        0x00000111UL
-#define CKM_DES_KEY_GEN                0x00000120UL
-#define CKM_DES_ECB                    0x00000121UL
-#define CKM_DES_CBC                    0x00000122UL
-#define CKM_DES_MAC                    0x00000123UL
-
-#define CKM_DES_MAC_GENERAL            0x00000124UL
-#define CKM_DES_CBC_PAD                0x00000125UL
-
-#define CKM_DES2_KEY_GEN               0x00000130UL
-#define CKM_DES3_KEY_GEN               0x00000131UL
-#define CKM_DES3_ECB                   0x00000132UL
-#define CKM_DES3_CBC                   0x00000133UL
-#define CKM_DES3_MAC                   0x00000134UL
-
-#define CKM_DES3_MAC_GENERAL           0x00000135UL
-#define CKM_DES3_CBC_PAD               0x00000136UL
-#define CKM_DES3_CMAC_GENERAL          0x00000137UL
-#define CKM_DES3_CMAC                  0x00000138UL
-#define CKM_CDMF_KEY_GEN               0x00000140UL
-#define CKM_CDMF_ECB                   0x00000141UL
-#define CKM_CDMF_CBC                   0x00000142UL
-#define CKM_CDMF_MAC                   0x00000143UL
-#define CKM_CDMF_MAC_GENERAL           0x00000144UL
-#define CKM_CDMF_CBC_PAD               0x00000145UL
-
-#define CKM_DES_OFB64                  0x00000150UL
-#define CKM_DES_OFB8                   0x00000151UL
-#define CKM_DES_CFB64                  0x00000152UL
-#define CKM_DES_CFB8                   0x00000153UL
-
-#define CKM_MD2                        0x00000200UL
-
-#define CKM_MD2_HMAC                   0x00000201UL
-#define CKM_MD2_HMAC_GENERAL           0x00000202UL
-
-#define CKM_MD5                        0x00000210UL
-
-#define CKM_MD5_HMAC                   0x00000211UL
-#define CKM_MD5_HMAC_GENERAL           0x00000212UL
-
-#define CKM_SHA_1                      0x00000220UL
-
-#define CKM_SHA_1_HMAC                 0x00000221UL
-#define CKM_SHA_1_HMAC_GENERAL         0x00000222UL
-
-#define CKM_RIPEMD128                  0x00000230UL
-#define CKM_RIPEMD128_HMAC             0x00000231UL
-#define CKM_RIPEMD128_HMAC_GENERAL     0x00000232UL
-#define CKM_RIPEMD160                  0x00000240UL
-#define CKM_RIPEMD160_HMAC             0x00000241UL
-#define CKM_RIPEMD160_HMAC_GENERAL     0x00000242UL
-
-#define CKM_SHA256                     0x00000250UL
-#define CKM_SHA256_HMAC                0x00000251UL
-#define CKM_SHA256_HMAC_GENERAL        0x00000252UL
-#define CKM_SHA224                     0x00000255UL
-#define CKM_SHA224_HMAC                0x00000256UL
-#define CKM_SHA224_HMAC_GENERAL        0x00000257UL
-#define CKM_SHA384                     0x00000260UL
-#define CKM_SHA384_HMAC                0x00000261UL
-#define CKM_SHA384_HMAC_GENERAL        0x00000262UL
-#define CKM_SHA512                     0x00000270UL
-#define CKM_SHA512_HMAC                0x00000271UL
-#define CKM_SHA512_HMAC_GENERAL        0x00000272UL
-#define CKM_SECURID_KEY_GEN            0x00000280UL
-#define CKM_SECURID                    0x00000282UL
-#define CKM_HOTP_KEY_GEN               0x00000290UL
-#define CKM_HOTP                       0x00000291UL
-#define CKM_ACTI                       0x000002A0UL
-#define CKM_ACTI_KEY_GEN               0x000002A1UL
-
-#define CKM_CAST_KEY_GEN               0x00000300UL
-#define CKM_CAST_ECB                   0x00000301UL
-#define CKM_CAST_CBC                   0x00000302UL
-#define CKM_CAST_MAC                   0x00000303UL
-#define CKM_CAST_MAC_GENERAL           0x00000304UL
-#define CKM_CAST_CBC_PAD               0x00000305UL
-#define CKM_CAST3_KEY_GEN              0x00000310UL
-#define CKM_CAST3_ECB                  0x00000311UL
-#define CKM_CAST3_CBC                  0x00000312UL
-#define CKM_CAST3_MAC                  0x00000313UL
-#define CKM_CAST3_MAC_GENERAL          0x00000314UL
-#define CKM_CAST3_CBC_PAD              0x00000315UL
-/* Note that CAST128 and CAST5 are the same algorithm */
-#define CKM_CAST5_KEY_GEN              0x00000320UL
-#define CKM_CAST128_KEY_GEN            0x00000320UL
-#define CKM_CAST5_ECB                  0x00000321UL
-#define CKM_CAST128_ECB                0x00000321UL
-#define CKM_CAST5_CBC                  0x00000322UL /* Deprecated */
-#define CKM_CAST128_CBC                0x00000322UL
-#define CKM_CAST5_MAC                  0x00000323UL /* Deprecated */
-#define CKM_CAST128_MAC                0x00000323UL
-#define CKM_CAST5_MAC_GENERAL          0x00000324UL /* Deprecated */
-#define CKM_CAST128_MAC_GENERAL        0x00000324UL
-#define CKM_CAST5_CBC_PAD              0x00000325UL /* Deprecated */
-#define CKM_CAST128_CBC_PAD            0x00000325UL
-#define CKM_RC5_KEY_GEN                0x00000330UL
-#define CKM_RC5_ECB                    0x00000331UL
-#define CKM_RC5_CBC                    0x00000332UL
-#define CKM_RC5_MAC                    0x00000333UL
-#define CKM_RC5_MAC_GENERAL            0x00000334UL
-#define CKM_RC5_CBC_PAD                0x00000335UL
-#define CKM_IDEA_KEY_GEN               0x00000340UL
-#define CKM_IDEA_ECB                   0x00000341UL
-#define CKM_IDEA_CBC                   0x00000342UL
-#define CKM_IDEA_MAC                   0x00000343UL
-#define CKM_IDEA_MAC_GENERAL           0x00000344UL
-#define CKM_IDEA_CBC_PAD               0x00000345UL
-#define CKM_GENERIC_SECRET_KEY_GEN     0x00000350UL
-#define CKM_CONCATENATE_BASE_AND_KEY   0x00000360UL
-#define CKM_CONCATENATE_BASE_AND_DATA  0x00000362UL
-#define CKM_CONCATENATE_DATA_AND_BASE  0x00000363UL
-#define CKM_XOR_BASE_AND_DATA          0x00000364UL
-#define CKM_EXTRACT_KEY_FROM_KEY       0x00000365UL
-#define CKM_SSL3_PRE_MASTER_KEY_GEN    0x00000370UL
-#define CKM_SSL3_MASTER_KEY_DERIVE     0x00000371UL
-#define CKM_SSL3_KEY_AND_MAC_DERIVE    0x00000372UL
-
-#define CKM_SSL3_MASTER_KEY_DERIVE_DH  0x00000373UL
-#define CKM_TLS_PRE_MASTER_KEY_GEN     0x00000374UL
-#define CKM_TLS_MASTER_KEY_DERIVE      0x00000375UL
-#define CKM_TLS_KEY_AND_MAC_DERIVE     0x00000376UL
-#define CKM_TLS_MASTER_KEY_DERIVE_DH   0x00000377UL
-
-#define CKM_TLS_PRF                    0x00000378UL
-
-#define CKM_SSL3_MD5_MAC               0x00000380UL
-#define CKM_SSL3_SHA1_MAC              0x00000381UL
-#define CKM_MD5_KEY_DERIVATION         0x00000390UL
-#define CKM_MD2_KEY_DERIVATION         0x00000391UL
-#define CKM_SHA1_KEY_DERIVATION        0x00000392UL
-
-#define CKM_SHA256_KEY_DERIVATION      0x00000393UL
-#define CKM_SHA384_KEY_DERIVATION      0x00000394UL
-#define CKM_SHA512_KEY_DERIVATION      0x00000395UL
-#define CKM_SHA224_KEY_DERIVATION      0x00000396UL
-
-#define CKM_PBE_MD2_DES_CBC            0x000003A0UL
-#define CKM_PBE_MD5_DES_CBC            0x000003A1UL
-#define CKM_PBE_MD5_CAST_CBC           0x000003A2UL
-#define CKM_PBE_MD5_CAST3_CBC          0x000003A3UL
-#define CKM_PBE_MD5_CAST5_CBC          0x000003A4UL /* Deprecated */
-#define CKM_PBE_MD5_CAST128_CBC        0x000003A4UL
-#define CKM_PBE_SHA1_CAST5_CBC         0x000003A5UL /* Deprecated */
-#define CKM_PBE_SHA1_CAST128_CBC       0x000003A5UL
-#define CKM_PBE_SHA1_RC4_128           0x000003A6UL
-#define CKM_PBE_SHA1_RC4_40            0x000003A7UL
-#define CKM_PBE_SHA1_DES3_EDE_CBC      0x000003A8UL
-#define CKM_PBE_SHA1_DES2_EDE_CBC      0x000003A9UL
-#define CKM_PBE_SHA1_RC2_128_CBC       0x000003AAUL
-#define CKM_PBE_SHA1_RC2_40_CBC        0x000003ABUL
-
-#define CKM_PKCS5_PBKD2                0x000003B0UL
-
-#define CKM_PBA_SHA1_WITH_SHA1_HMAC    0x000003C0UL
-
-#define CKM_WTLS_PRE_MASTER_KEY_GEN         0x000003D0UL
-#define CKM_WTLS_MASTER_KEY_DERIVE          0x000003D1UL
-#define CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC   0x000003D2UL
-#define CKM_WTLS_PRF                        0x000003D3UL
-#define CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE  0x000003D4UL
-#define CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE  0x000003D5UL
-
-#define CKM_TLS10_MAC_SERVER                0x000003D6UL
-#define CKM_TLS10_MAC_CLIENT                0x000003D7UL
-#define CKM_TLS12_MAC                       0x000003D8UL
-#define CKM_TLS12_KDF                       0x000003D9UL
-#define CKM_TLS12_MASTER_KEY_DERIVE         0x000003E0UL
-#define CKM_TLS12_KEY_AND_MAC_DERIVE        0x000003E1UL
-#define CKM_TLS12_MASTER_KEY_DERIVE_DH      0x000003E2UL
-#define CKM_TLS12_KEY_SAFE_DERIVE           0x000003E3UL
-#define CKM_TLS_MAC                         0x000003E4UL
-#define CKM_TLS_KDF                         0x000003E5UL
-
-#define CKM_KEY_WRAP_LYNKS             0x00000400UL
-#define CKM_KEY_WRAP_SET_OAEP          0x00000401UL
-
-#define CKM_CMS_SIG                    0x00000500UL
-#define CKM_KIP_DERIVE                 0x00000510UL
-#define CKM_KIP_WRAP                   0x00000511UL
-#define CKM_KIP_MAC                    0x00000512UL
-
-#define CKM_CAMELLIA_KEY_GEN           0x00000550UL
-#define CKM_CAMELLIA_ECB               0x00000551UL
-#define CKM_CAMELLIA_CBC               0x00000552UL
-#define CKM_CAMELLIA_MAC               0x00000553UL
-#define CKM_CAMELLIA_MAC_GENERAL       0x00000554UL
-#define CKM_CAMELLIA_CBC_PAD           0x00000555UL
-#define CKM_CAMELLIA_ECB_ENCRYPT_DATA  0x00000556UL
-#define CKM_CAMELLIA_CBC_ENCRYPT_DATA  0x00000557UL
-#define CKM_CAMELLIA_CTR               0x00000558UL
-
-#define CKM_ARIA_KEY_GEN               0x00000560UL
-#define CKM_ARIA_ECB                   0x00000561UL
-#define CKM_ARIA_CBC                   0x00000562UL
-#define CKM_ARIA_MAC                   0x00000563UL
-#define CKM_ARIA_MAC_GENERAL           0x00000564UL
-#define CKM_ARIA_CBC_PAD               0x00000565UL
-#define CKM_ARIA_ECB_ENCRYPT_DATA      0x00000566UL
-#define CKM_ARIA_CBC_ENCRYPT_DATA      0x00000567UL
-
-#define CKM_SEED_KEY_GEN               0x00000650UL
-#define CKM_SEED_ECB                   0x00000651UL
-#define CKM_SEED_CBC                   0x00000652UL
-#define CKM_SEED_MAC                   0x00000653UL
-#define CKM_SEED_MAC_GENERAL           0x00000654UL
-#define CKM_SEED_CBC_PAD               0x00000655UL
-#define CKM_SEED_ECB_ENCRYPT_DATA      0x00000656UL
-#define CKM_SEED_CBC_ENCRYPT_DATA      0x00000657UL
-
-#define CKM_SKIPJACK_KEY_GEN           0x00001000UL
-#define CKM_SKIPJACK_ECB64             0x00001001UL
-#define CKM_SKIPJACK_CBC64             0x00001002UL
-#define CKM_SKIPJACK_OFB64             0x00001003UL
-#define CKM_SKIPJACK_CFB64             0x00001004UL
-#define CKM_SKIPJACK_CFB32             0x00001005UL
-#define CKM_SKIPJACK_CFB16             0x00001006UL
-#define CKM_SKIPJACK_CFB8              0x00001007UL
-#define CKM_SKIPJACK_WRAP              0x00001008UL
-#define CKM_SKIPJACK_PRIVATE_WRAP      0x00001009UL
-#define CKM_SKIPJACK_RELAYX            0x0000100aUL
-#define CKM_KEA_KEY_PAIR_GEN           0x00001010UL
-#define CKM_KEA_KEY_DERIVE             0x00001011UL
-#define CKM_KEA_DERIVE                 0x00001012UL
-#define CKM_FORTEZZA_TIMESTAMP         0x00001020UL
-#define CKM_BATON_KEY_GEN              0x00001030UL
-#define CKM_BATON_ECB128               0x00001031UL
-#define CKM_BATON_ECB96                0x00001032UL
-#define CKM_BATON_CBC128               0x00001033UL
-#define CKM_BATON_COUNTER              0x00001034UL
-#define CKM_BATON_SHUFFLE              0x00001035UL
-#define CKM_BATON_WRAP                 0x00001036UL
-
-#define CKM_ECDSA_KEY_PAIR_GEN         0x00001040UL /* Deprecated */
-#define CKM_EC_KEY_PAIR_GEN            0x00001040UL
-
-#define CKM_ECDSA                      0x00001041UL
-#define CKM_ECDSA_SHA1                 0x00001042UL
-#define CKM_ECDSA_SHA224               0x00001043UL
-#define CKM_ECDSA_SHA256               0x00001044UL
-#define CKM_ECDSA_SHA384               0x00001045UL
-#define CKM_ECDSA_SHA512               0x00001046UL
-
-#define CKM_ECDH1_DERIVE               0x00001050UL
-#define CKM_ECDH1_COFACTOR_DERIVE      0x00001051UL
-#define CKM_ECMQV_DERIVE               0x00001052UL
-
-#define CKM_ECDH_AES_KEY_WRAP          0x00001053UL
-#define CKM_RSA_AES_KEY_WRAP           0x00001054UL
-
-#define CKM_JUNIPER_KEY_GEN            0x00001060UL
-#define CKM_JUNIPER_ECB128             0x00001061UL
-#define CKM_JUNIPER_CBC128             0x00001062UL
-#define CKM_JUNIPER_COUNTER            0x00001063UL
-#define CKM_JUNIPER_SHUFFLE            0x00001064UL
-#define CKM_JUNIPER_WRAP               0x00001065UL
-#define CKM_FASTHASH                   0x00001070UL
-
-#define CKM_AES_KEY_GEN                0x00001080UL
-#define CKM_AES_ECB                    0x00001081UL
-#define CKM_AES_CBC                    0x00001082UL
-#define CKM_AES_MAC                    0x00001083UL
-#define CKM_AES_MAC_GENERAL            0x00001084UL
-#define CKM_AES_CBC_PAD                0x00001085UL
-#define CKM_AES_CTR                    0x00001086UL
-#define CKM_AES_GCM                    0x00001087UL
-#define CKM_AES_CCM                    0x00001088UL
-#define CKM_AES_CTS                    0x00001089UL
-#define CKM_AES_CMAC                   0x0000108AUL
-#define CKM_AES_CMAC_GENERAL           0x0000108BUL
-
-#define CKM_AES_XCBC_MAC               0x0000108CUL
-#define CKM_AES_XCBC_MAC_96            0x0000108DUL
-#define CKM_AES_GMAC                   0x0000108EUL
-
-#define CKM_BLOWFISH_KEY_GEN           0x00001090UL
-#define CKM_BLOWFISH_CBC               0x00001091UL
-#define CKM_TWOFISH_KEY_GEN            0x00001092UL
-#define CKM_TWOFISH_CBC                0x00001093UL
-#define CKM_BLOWFISH_CBC_PAD           0x00001094UL
-#define CKM_TWOFISH_CBC_PAD            0x00001095UL
-
-#define CKM_DES_ECB_ENCRYPT_DATA       0x00001100UL
-#define CKM_DES_CBC_ENCRYPT_DATA       0x00001101UL
-#define CKM_DES3_ECB_ENCRYPT_DATA      0x00001102UL
-#define CKM_DES3_CBC_ENCRYPT_DATA      0x00001103UL
-#define CKM_AES_ECB_ENCRYPT_DATA       0x00001104UL
-#define CKM_AES_CBC_ENCRYPT_DATA       0x00001105UL
-
-#define CKM_GOSTR3410_KEY_PAIR_GEN     0x00001200UL
-#define CKM_GOSTR3410                  0x00001201UL
-#define CKM_GOSTR3410_WITH_GOSTR3411   0x00001202UL
-#define CKM_GOSTR3410_KEY_WRAP         0x00001203UL
-#define CKM_GOSTR3410_DERIVE           0x00001204UL
-#define CKM_GOSTR3411                  0x00001210UL
-#define CKM_GOSTR3411_HMAC             0x00001211UL
-#define CKM_GOST28147_KEY_GEN          0x00001220UL
-#define CKM_GOST28147_ECB              0x00001221UL
-#define CKM_GOST28147                  0x00001222UL
-#define CKM_GOST28147_MAC              0x00001223UL
-#define CKM_GOST28147_KEY_WRAP         0x00001224UL
-
-#define CKM_DSA_PARAMETER_GEN          0x00002000UL
-#define CKM_DH_PKCS_PARAMETER_GEN      0x00002001UL
-#define CKM_X9_42_DH_PARAMETER_GEN     0x00002002UL
-#define CKM_DSA_PROBABLISTIC_PARAMETER_GEN    0x00002003UL
-#define CKM_DSA_SHAWE_TAYLOR_PARAMETER_GEN    0x00002004UL
-
-#define CKM_AES_OFB                    0x00002104UL
-#define CKM_AES_CFB64                  0x00002105UL
-#define CKM_AES_CFB8                   0x00002106UL
-#define CKM_AES_CFB128                 0x00002107UL
-
-#define CKM_AES_CFB1                   0x00002108UL
-#define CKM_AES_KEY_WRAP               0x00002109UL     /* WAS: 0x00001090 */
-#define CKM_AES_KEY_WRAP_PAD           0x0000210AUL     /* WAS: 0x00001091 */
-
-#define CKM_RSA_PKCS_TPM_1_1           0x00004001UL
-#define CKM_RSA_PKCS_OAEP_TPM_1_1      0x00004002UL
-
-#define CKM_VENDOR_DEFINED             0x80000000UL
-
-typedef CK_MECHANISM_TYPE CK_PTR CK_MECHANISM_TYPE_PTR;
-
-
-/* CK_MECHANISM is a structure that specifies a particular
- * mechanism
- */
-typedef struct CK_MECHANISM {
-  CK_MECHANISM_TYPE mechanism;
-  CK_VOID_PTR       pParameter;
-  CK_ULONG          ulParameterLen;  /* in bytes */
-} CK_MECHANISM;
-
-typedef CK_MECHANISM CK_PTR CK_MECHANISM_PTR;
-
-
-/* CK_MECHANISM_INFO provides information about a particular
- * mechanism
- */
-typedef struct CK_MECHANISM_INFO {
-    CK_ULONG    ulMinKeySize;
-    CK_ULONG    ulMaxKeySize;
-    CK_FLAGS    flags;
-} CK_MECHANISM_INFO;
-
-/* The flags are defined as follows:
- *      Bit Flag               Mask          Meaning */
-#define CKF_HW                 0x00000001UL  /* performed by HW */
-
-/* Specify whether or not a mechanism can be used for a particular task */
-#define CKF_ENCRYPT            0x00000100UL
-#define CKF_DECRYPT            0x00000200UL
-#define CKF_DIGEST             0x00000400UL
-#define CKF_SIGN               0x00000800UL
-#define CKF_SIGN_RECOVER       0x00001000UL
-#define CKF_VERIFY             0x00002000UL
-#define CKF_VERIFY_RECOVER     0x00004000UL
-#define CKF_GENERATE           0x00008000UL
-#define CKF_GENERATE_KEY_PAIR  0x00010000UL
-#define CKF_WRAP               0x00020000UL
-#define CKF_UNWRAP             0x00040000UL
-#define CKF_DERIVE             0x00080000UL
-
-/* Describe a token's EC capabilities not available in mechanism
- * information.
- */
-#define CKF_EC_F_P             0x00100000UL
-#define CKF_EC_F_2M            0x00200000UL
-#define CKF_EC_ECPARAMETERS    0x00400000UL
-#define CKF_EC_NAMEDCURVE      0x00800000UL
-#define CKF_EC_UNCOMPRESS      0x01000000UL
-#define CKF_EC_COMPRESS        0x02000000UL
-
-#define CKF_EXTENSION          0x80000000UL
-
-typedef CK_MECHANISM_INFO CK_PTR CK_MECHANISM_INFO_PTR;
-
-/* CK_RV is a value that identifies the return value of a
- * Cryptoki function
- */
-typedef CK_ULONG          CK_RV;
-
-#define CKR_OK                                0x00000000UL
-#define CKR_CANCEL                            0x00000001UL
-#define CKR_HOST_MEMORY                       0x00000002UL
-#define CKR_SLOT_ID_INVALID                   0x00000003UL
-
-#define CKR_GENERAL_ERROR                     0x00000005UL
-#define CKR_FUNCTION_FAILED                   0x00000006UL
-
-#define CKR_ARGUMENTS_BAD                     0x00000007UL
-#define CKR_NO_EVENT                          0x00000008UL
-#define CKR_NEED_TO_CREATE_THREADS            0x00000009UL
-#define CKR_CANT_LOCK                         0x0000000AUL
-
-#define CKR_ATTRIBUTE_READ_ONLY               0x00000010UL
-#define CKR_ATTRIBUTE_SENSITIVE               0x00000011UL
-#define CKR_ATTRIBUTE_TYPE_INVALID            0x00000012UL
-#define CKR_ATTRIBUTE_VALUE_INVALID           0x00000013UL
-
-#define CKR_ACTION_PROHIBITED                 0x0000001BUL
-
-#define CKR_DATA_INVALID                      0x00000020UL
-#define CKR_DATA_LEN_RANGE                    0x00000021UL
-#define CKR_DEVICE_ERROR                      0x00000030UL
-#define CKR_DEVICE_MEMORY                     0x00000031UL
-#define CKR_DEVICE_REMOVED                    0x00000032UL
-#define CKR_ENCRYPTED_DATA_INVALID            0x00000040UL
-#define CKR_ENCRYPTED_DATA_LEN_RANGE          0x00000041UL
-#define CKR_FUNCTION_CANCELED                 0x00000050UL
-#define CKR_FUNCTION_NOT_PARALLEL             0x00000051UL
-
-#define CKR_FUNCTION_NOT_SUPPORTED            0x00000054UL
-
-#define CKR_KEY_HANDLE_INVALID                0x00000060UL
-
-#define CKR_KEY_SIZE_RANGE                    0x00000062UL
-#define CKR_KEY_TYPE_INCONSISTENT             0x00000063UL
-
-#define CKR_KEY_NOT_NEEDED                    0x00000064UL
-#define CKR_KEY_CHANGED                       0x00000065UL
-#define CKR_KEY_NEEDED                        0x00000066UL
-#define CKR_KEY_INDIGESTIBLE                  0x00000067UL
-#define CKR_KEY_FUNCTION_NOT_PERMITTED        0x00000068UL
-#define CKR_KEY_NOT_WRAPPABLE                 0x00000069UL
-#define CKR_KEY_UNEXTRACTABLE                 0x0000006AUL
-
-#define CKR_MECHANISM_INVALID                 0x00000070UL
-#define CKR_MECHANISM_PARAM_INVALID           0x00000071UL
-
-#define CKR_OBJECT_HANDLE_INVALID             0x00000082UL
-#define CKR_OPERATION_ACTIVE                  0x00000090UL
-#define CKR_OPERATION_NOT_INITIALIZED         0x00000091UL
-#define CKR_PIN_INCORRECT                     0x000000A0UL
-#define CKR_PIN_INVALID                       0x000000A1UL
-#define CKR_PIN_LEN_RANGE                     0x000000A2UL
-
-#define CKR_PIN_EXPIRED                       0x000000A3UL
-#define CKR_PIN_LOCKED                        0x000000A4UL
-
-#define CKR_SESSION_CLOSED                    0x000000B0UL
-#define CKR_SESSION_COUNT                     0x000000B1UL
-#define CKR_SESSION_HANDLE_INVALID            0x000000B3UL
-#define CKR_SESSION_PARALLEL_NOT_SUPPORTED    0x000000B4UL
-#define CKR_SESSION_READ_ONLY                 0x000000B5UL
-#define CKR_SESSION_EXISTS                    0x000000B6UL
-
-#define CKR_SESSION_READ_ONLY_EXISTS          0x000000B7UL
-#define CKR_SESSION_READ_WRITE_SO_EXISTS      0x000000B8UL
-
-#define CKR_SIGNATURE_INVALID                 0x000000C0UL
-#define CKR_SIGNATURE_LEN_RANGE               0x000000C1UL
-#define CKR_TEMPLATE_INCOMPLETE               0x000000D0UL
-#define CKR_TEMPLATE_INCONSISTENT             0x000000D1UL
-#define CKR_TOKEN_NOT_PRESENT                 0x000000E0UL
-#define CKR_TOKEN_NOT_RECOGNIZED              0x000000E1UL
-#define CKR_TOKEN_WRITE_PROTECTED             0x000000E2UL
-#define CKR_UNWRAPPING_KEY_HANDLE_INVALID     0x000000F0UL
-#define CKR_UNWRAPPING_KEY_SIZE_RANGE         0x000000F1UL
-#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT  0x000000F2UL
-#define CKR_USER_ALREADY_LOGGED_IN            0x00000100UL
-#define CKR_USER_NOT_LOGGED_IN                0x00000101UL
-#define CKR_USER_PIN_NOT_INITIALIZED          0x00000102UL
-#define CKR_USER_TYPE_INVALID                 0x00000103UL
-
-#define CKR_USER_ANOTHER_ALREADY_LOGGED_IN    0x00000104UL
-#define CKR_USER_TOO_MANY_TYPES               0x00000105UL
-
-#define CKR_WRAPPED_KEY_INVALID               0x00000110UL
-#define CKR_WRAPPED_KEY_LEN_RANGE             0x00000112UL
-#define CKR_WRAPPING_KEY_HANDLE_INVALID       0x00000113UL
-#define CKR_WRAPPING_KEY_SIZE_RANGE           0x00000114UL
-#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT    0x00000115UL
-#define CKR_RANDOM_SEED_NOT_SUPPORTED         0x00000120UL
-
-#define CKR_RANDOM_NO_RNG                     0x00000121UL
-
-#define CKR_DOMAIN_PARAMS_INVALID             0x00000130UL
-
-#define CKR_CURVE_NOT_SUPPORTED               0x00000140UL
-
-#define CKR_BUFFER_TOO_SMALL                  0x00000150UL
-#define CKR_SAVED_STATE_INVALID               0x00000160UL
-#define CKR_INFORMATION_SENSITIVE             0x00000170UL
-#define CKR_STATE_UNSAVEABLE                  0x00000180UL
-
-#define CKR_CRYPTOKI_NOT_INITIALIZED          0x00000190UL
-#define CKR_CRYPTOKI_ALREADY_INITIALIZED      0x00000191UL
-#define CKR_MUTEX_BAD                         0x000001A0UL
-#define CKR_MUTEX_NOT_LOCKED                  0x000001A1UL
-
-#define CKR_NEW_PIN_MODE                      0x000001B0UL
-#define CKR_NEXT_OTP                          0x000001B1UL
-
-#define CKR_EXCEEDED_MAX_ITERATIONS           0x000001B5UL
-#define CKR_FIPS_SELF_TEST_FAILED             0x000001B6UL
-#define CKR_LIBRARY_LOAD_FAILED               0x000001B7UL
-#define CKR_PIN_TOO_WEAK                      0x000001B8UL
-#define CKR_PUBLIC_KEY_INVALID                0x000001B9UL
-
-#define CKR_FUNCTION_REJECTED                 0x00000200UL
-
-#define CKR_VENDOR_DEFINED                    0x80000000UL
-
-
-/* CK_NOTIFY is an application callback that processes events */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_NOTIFY)(
-  CK_SESSION_HANDLE hSession,     /* the session's handle */
-  CK_NOTIFICATION   event,
-  CK_VOID_PTR       pApplication  /* passed to C_OpenSession */
-);
-
-
-/* CK_FUNCTION_LIST is a structure holding a Cryptoki spec
- * version and pointers of appropriate types to all the
- * Cryptoki functions
- */
-typedef struct CK_FUNCTION_LIST CK_FUNCTION_LIST;
-
-typedef CK_FUNCTION_LIST CK_PTR CK_FUNCTION_LIST_PTR;
-
-typedef CK_FUNCTION_LIST_PTR CK_PTR CK_FUNCTION_LIST_PTR_PTR;
-
-
-/* CK_CREATEMUTEX is an application callback for creating a
- * mutex object
- */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_CREATEMUTEX)(
-  CK_VOID_PTR_PTR ppMutex  /* location to receive ptr to mutex */
-);
-
-
-/* CK_DESTROYMUTEX is an application callback for destroying a
- * mutex object
- */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_DESTROYMUTEX)(
-  CK_VOID_PTR pMutex  /* pointer to mutex */
-);
-
-
-/* CK_LOCKMUTEX is an application callback for locking a mutex */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_LOCKMUTEX)(
-  CK_VOID_PTR pMutex  /* pointer to mutex */
-);
-
-
-/* CK_UNLOCKMUTEX is an application callback for unlocking a
- * mutex
- */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_UNLOCKMUTEX)(
-  CK_VOID_PTR pMutex  /* pointer to mutex */
-);
-
-
-/* CK_C_INITIALIZE_ARGS provides the optional arguments to
- * C_Initialize
- */
-typedef struct CK_C_INITIALIZE_ARGS {
-  CK_CREATEMUTEX CreateMutex;
-  CK_DESTROYMUTEX DestroyMutex;
-  CK_LOCKMUTEX LockMutex;
-  CK_UNLOCKMUTEX UnlockMutex;
-  CK_FLAGS flags;
-  CK_VOID_PTR pReserved;
-} CK_C_INITIALIZE_ARGS;
-
-/* flags: bit flags that provide capabilities of the slot
- *      Bit Flag                           Mask       Meaning
- */
-#define CKF_LIBRARY_CANT_CREATE_OS_THREADS 0x00000001UL
-#define CKF_OS_LOCKING_OK                  0x00000002UL
-
-typedef CK_C_INITIALIZE_ARGS CK_PTR CK_C_INITIALIZE_ARGS_PTR;
-
-
-/* additional flags for parameters to functions */
-
-/* CKF_DONT_BLOCK is for the function C_WaitForSlotEvent */
-#define CKF_DONT_BLOCK     1
-
-/* CK_RSA_PKCS_MGF_TYPE  is used to indicate the Message
- * Generation Function (MGF) applied to a message block when
- * formatting a message block for the PKCS #1 OAEP encryption
- * scheme.
- */
-typedef CK_ULONG CK_RSA_PKCS_MGF_TYPE;
-
-typedef CK_RSA_PKCS_MGF_TYPE CK_PTR CK_RSA_PKCS_MGF_TYPE_PTR;
-
-/* The following MGFs are defined */
-#define CKG_MGF1_SHA1         0x00000001UL
-#define CKG_MGF1_SHA256       0x00000002UL
-#define CKG_MGF1_SHA384       0x00000003UL
-#define CKG_MGF1_SHA512       0x00000004UL
-#define CKG_MGF1_SHA224       0x00000005UL
-
-/* CK_RSA_PKCS_OAEP_SOURCE_TYPE  is used to indicate the source
- * of the encoding parameter when formatting a message block
- * for the PKCS #1 OAEP encryption scheme.
- */
-typedef CK_ULONG CK_RSA_PKCS_OAEP_SOURCE_TYPE;
-
-typedef CK_RSA_PKCS_OAEP_SOURCE_TYPE CK_PTR CK_RSA_PKCS_OAEP_SOURCE_TYPE_PTR;
-
-/* The following encoding parameter sources are defined */
-#define CKZ_DATA_SPECIFIED    0x00000001UL
-
-/* CK_RSA_PKCS_OAEP_PARAMS provides the parameters to the
- * CKM_RSA_PKCS_OAEP mechanism.
- */
-typedef struct CK_RSA_PKCS_OAEP_PARAMS {
-        CK_MECHANISM_TYPE hashAlg;
-        CK_RSA_PKCS_MGF_TYPE mgf;
-        CK_RSA_PKCS_OAEP_SOURCE_TYPE source;
-        CK_VOID_PTR pSourceData;
-        CK_ULONG ulSourceDataLen;
-} CK_RSA_PKCS_OAEP_PARAMS;
-
-typedef CK_RSA_PKCS_OAEP_PARAMS CK_PTR CK_RSA_PKCS_OAEP_PARAMS_PTR;
-
-/* CK_RSA_PKCS_PSS_PARAMS provides the parameters to the
- * CKM_RSA_PKCS_PSS mechanism(s).
- */
-typedef struct CK_RSA_PKCS_PSS_PARAMS {
-        CK_MECHANISM_TYPE    hashAlg;
-        CK_RSA_PKCS_MGF_TYPE mgf;
-        CK_ULONG             sLen;
-} CK_RSA_PKCS_PSS_PARAMS;
-
-typedef CK_RSA_PKCS_PSS_PARAMS CK_PTR CK_RSA_PKCS_PSS_PARAMS_PTR;
-
-typedef CK_ULONG CK_EC_KDF_TYPE;
-
-/* The following EC Key Derivation Functions are defined */
-#define CKD_NULL                 0x00000001UL
-#define CKD_SHA1_KDF             0x00000002UL
-
-/* The following X9.42 DH key derivation functions are defined */
-#define CKD_SHA1_KDF_ASN1        0x00000003UL
-#define CKD_SHA1_KDF_CONCATENATE 0x00000004UL
-#define CKD_SHA224_KDF           0x00000005UL
-#define CKD_SHA256_KDF           0x00000006UL
-#define CKD_SHA384_KDF           0x00000007UL
-#define CKD_SHA512_KDF           0x00000008UL
-#define CKD_CPDIVERSIFY_KDF      0x00000009UL
-
-
-/* CK_ECDH1_DERIVE_PARAMS provides the parameters to the
- * CKM_ECDH1_DERIVE and CKM_ECDH1_COFACTOR_DERIVE mechanisms,
- * where each party contributes one key pair.
- */
-typedef struct CK_ECDH1_DERIVE_PARAMS {
-  CK_EC_KDF_TYPE kdf;
-  CK_ULONG ulSharedDataLen;
-  CK_BYTE_PTR pSharedData;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-} CK_ECDH1_DERIVE_PARAMS;
-
-typedef CK_ECDH1_DERIVE_PARAMS CK_PTR CK_ECDH1_DERIVE_PARAMS_PTR;
-
-/*
- * CK_ECDH2_DERIVE_PARAMS provides the parameters to the
- * CKM_ECMQV_DERIVE mechanism, where each party contributes two key pairs.
- */
-typedef struct CK_ECDH2_DERIVE_PARAMS {
-  CK_EC_KDF_TYPE kdf;
-  CK_ULONG ulSharedDataLen;
-  CK_BYTE_PTR pSharedData;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-  CK_ULONG ulPrivateDataLen;
-  CK_OBJECT_HANDLE hPrivateData;
-  CK_ULONG ulPublicDataLen2;
-  CK_BYTE_PTR pPublicData2;
-} CK_ECDH2_DERIVE_PARAMS;
-
-typedef CK_ECDH2_DERIVE_PARAMS CK_PTR CK_ECDH2_DERIVE_PARAMS_PTR;
-
-typedef struct CK_ECMQV_DERIVE_PARAMS {
-  CK_EC_KDF_TYPE kdf;
-  CK_ULONG ulSharedDataLen;
-  CK_BYTE_PTR pSharedData;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-  CK_ULONG ulPrivateDataLen;
-  CK_OBJECT_HANDLE hPrivateData;
-  CK_ULONG ulPublicDataLen2;
-  CK_BYTE_PTR pPublicData2;
-  CK_OBJECT_HANDLE publicKey;
-} CK_ECMQV_DERIVE_PARAMS;
-
-typedef CK_ECMQV_DERIVE_PARAMS CK_PTR CK_ECMQV_DERIVE_PARAMS_PTR;
-
-/* Typedefs and defines for the CKM_X9_42_DH_KEY_PAIR_GEN and the
- * CKM_X9_42_DH_PARAMETER_GEN mechanisms
- */
-typedef CK_ULONG CK_X9_42_DH_KDF_TYPE;
-typedef CK_X9_42_DH_KDF_TYPE CK_PTR CK_X9_42_DH_KDF_TYPE_PTR;
-
-/* CK_X9_42_DH1_DERIVE_PARAMS provides the parameters to the
- * CKM_X9_42_DH_DERIVE key derivation mechanism, where each party
- * contributes one key pair
- */
-typedef struct CK_X9_42_DH1_DERIVE_PARAMS {
-  CK_X9_42_DH_KDF_TYPE kdf;
-  CK_ULONG ulOtherInfoLen;
-  CK_BYTE_PTR pOtherInfo;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-} CK_X9_42_DH1_DERIVE_PARAMS;
-
-typedef struct CK_X9_42_DH1_DERIVE_PARAMS CK_PTR CK_X9_42_DH1_DERIVE_PARAMS_PTR;
-
-/* CK_X9_42_DH2_DERIVE_PARAMS provides the parameters to the
- * CKM_X9_42_DH_HYBRID_DERIVE and CKM_X9_42_MQV_DERIVE key derivation
- * mechanisms, where each party contributes two key pairs
- */
-typedef struct CK_X9_42_DH2_DERIVE_PARAMS {
-  CK_X9_42_DH_KDF_TYPE kdf;
-  CK_ULONG ulOtherInfoLen;
-  CK_BYTE_PTR pOtherInfo;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-  CK_ULONG ulPrivateDataLen;
-  CK_OBJECT_HANDLE hPrivateData;
-  CK_ULONG ulPublicDataLen2;
-  CK_BYTE_PTR pPublicData2;
-} CK_X9_42_DH2_DERIVE_PARAMS;
-
-typedef CK_X9_42_DH2_DERIVE_PARAMS CK_PTR CK_X9_42_DH2_DERIVE_PARAMS_PTR;
-
-typedef struct CK_X9_42_MQV_DERIVE_PARAMS {
-  CK_X9_42_DH_KDF_TYPE kdf;
-  CK_ULONG ulOtherInfoLen;
-  CK_BYTE_PTR pOtherInfo;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-  CK_ULONG ulPrivateDataLen;
-  CK_OBJECT_HANDLE hPrivateData;
-  CK_ULONG ulPublicDataLen2;
-  CK_BYTE_PTR pPublicData2;
-  CK_OBJECT_HANDLE publicKey;
-} CK_X9_42_MQV_DERIVE_PARAMS;
-
-typedef CK_X9_42_MQV_DERIVE_PARAMS CK_PTR CK_X9_42_MQV_DERIVE_PARAMS_PTR;
-
-/* CK_KEA_DERIVE_PARAMS provides the parameters to the
- * CKM_KEA_DERIVE mechanism
- */
-typedef struct CK_KEA_DERIVE_PARAMS {
-  CK_BBOOL      isSender;
-  CK_ULONG      ulRandomLen;
-  CK_BYTE_PTR   pRandomA;
-  CK_BYTE_PTR   pRandomB;
-  CK_ULONG      ulPublicDataLen;
-  CK_BYTE_PTR   pPublicData;
-} CK_KEA_DERIVE_PARAMS;
-
-typedef CK_KEA_DERIVE_PARAMS CK_PTR CK_KEA_DERIVE_PARAMS_PTR;
-
-
-/* CK_RC2_PARAMS provides the parameters to the CKM_RC2_ECB and
- * CKM_RC2_MAC mechanisms.  An instance of CK_RC2_PARAMS just
- * holds the effective keysize
- */
-typedef CK_ULONG          CK_RC2_PARAMS;
-
-typedef CK_RC2_PARAMS CK_PTR CK_RC2_PARAMS_PTR;
-
-
-/* CK_RC2_CBC_PARAMS provides the parameters to the CKM_RC2_CBC
- * mechanism
- */
-typedef struct CK_RC2_CBC_PARAMS {
-  CK_ULONG      ulEffectiveBits;  /* effective bits (1-1024) */
-  CK_BYTE       iv[8];            /* IV for CBC mode */
-} CK_RC2_CBC_PARAMS;
-
-typedef CK_RC2_CBC_PARAMS CK_PTR CK_RC2_CBC_PARAMS_PTR;
-
-
-/* CK_RC2_MAC_GENERAL_PARAMS provides the parameters for the
- * CKM_RC2_MAC_GENERAL mechanism
- */
-typedef struct CK_RC2_MAC_GENERAL_PARAMS {
-  CK_ULONG      ulEffectiveBits;  /* effective bits (1-1024) */
-  CK_ULONG      ulMacLength;      /* Length of MAC in bytes */
-} CK_RC2_MAC_GENERAL_PARAMS;
-
-typedef CK_RC2_MAC_GENERAL_PARAMS CK_PTR \
-  CK_RC2_MAC_GENERAL_PARAMS_PTR;
-
-
-/* CK_RC5_PARAMS provides the parameters to the CKM_RC5_ECB and
- * CKM_RC5_MAC mechanisms
- */
-typedef struct CK_RC5_PARAMS {
-  CK_ULONG      ulWordsize;  /* wordsize in bits */
-  CK_ULONG      ulRounds;    /* number of rounds */
-} CK_RC5_PARAMS;
-
-typedef CK_RC5_PARAMS CK_PTR CK_RC5_PARAMS_PTR;
-
-
-/* CK_RC5_CBC_PARAMS provides the parameters to the CKM_RC5_CBC
- * mechanism
- */
-typedef struct CK_RC5_CBC_PARAMS {
-  CK_ULONG      ulWordsize;  /* wordsize in bits */
-  CK_ULONG      ulRounds;    /* number of rounds */
-  CK_BYTE_PTR   pIv;         /* pointer to IV */
-  CK_ULONG      ulIvLen;     /* length of IV in bytes */
-} CK_RC5_CBC_PARAMS;
-
-typedef CK_RC5_CBC_PARAMS CK_PTR CK_RC5_CBC_PARAMS_PTR;
-
-
-/* CK_RC5_MAC_GENERAL_PARAMS provides the parameters for the
- * CKM_RC5_MAC_GENERAL mechanism
- */
-typedef struct CK_RC5_MAC_GENERAL_PARAMS {
-  CK_ULONG      ulWordsize;   /* wordsize in bits */
-  CK_ULONG      ulRounds;     /* number of rounds */
-  CK_ULONG      ulMacLength;  /* Length of MAC in bytes */
-} CK_RC5_MAC_GENERAL_PARAMS;
-
-typedef CK_RC5_MAC_GENERAL_PARAMS CK_PTR \
-  CK_RC5_MAC_GENERAL_PARAMS_PTR;
-
-/* CK_MAC_GENERAL_PARAMS provides the parameters to most block
- * ciphers' MAC_GENERAL mechanisms.  Its value is the length of
- * the MAC
- */
-typedef CK_ULONG          CK_MAC_GENERAL_PARAMS;
-
-typedef CK_MAC_GENERAL_PARAMS CK_PTR CK_MAC_GENERAL_PARAMS_PTR;
-
-typedef struct CK_DES_CBC_ENCRYPT_DATA_PARAMS {
-  CK_BYTE      iv[8];
-  CK_BYTE_PTR  pData;
-  CK_ULONG     length;
-} CK_DES_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_DES_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_DES_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-typedef struct CK_AES_CBC_ENCRYPT_DATA_PARAMS {
-  CK_BYTE      iv[16];
-  CK_BYTE_PTR  pData;
-  CK_ULONG     length;
-} CK_AES_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_AES_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_AES_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-/* CK_SKIPJACK_PRIVATE_WRAP_PARAMS provides the parameters to the
- * CKM_SKIPJACK_PRIVATE_WRAP mechanism
- */
-typedef struct CK_SKIPJACK_PRIVATE_WRAP_PARAMS {
-  CK_ULONG      ulPasswordLen;
-  CK_BYTE_PTR   pPassword;
-  CK_ULONG      ulPublicDataLen;
-  CK_BYTE_PTR   pPublicData;
-  CK_ULONG      ulPAndGLen;
-  CK_ULONG      ulQLen;
-  CK_ULONG      ulRandomLen;
-  CK_BYTE_PTR   pRandomA;
-  CK_BYTE_PTR   pPrimeP;
-  CK_BYTE_PTR   pBaseG;
-  CK_BYTE_PTR   pSubprimeQ;
-} CK_SKIPJACK_PRIVATE_WRAP_PARAMS;
-
-typedef CK_SKIPJACK_PRIVATE_WRAP_PARAMS CK_PTR \
-  CK_SKIPJACK_PRIVATE_WRAP_PARAMS_PTR;
-
-
-/* CK_SKIPJACK_RELAYX_PARAMS provides the parameters to the
- * CKM_SKIPJACK_RELAYX mechanism
- */
-typedef struct CK_SKIPJACK_RELAYX_PARAMS {
-  CK_ULONG      ulOldWrappedXLen;
-  CK_BYTE_PTR   pOldWrappedX;
-  CK_ULONG      ulOldPasswordLen;
-  CK_BYTE_PTR   pOldPassword;
-  CK_ULONG      ulOldPublicDataLen;
-  CK_BYTE_PTR   pOldPublicData;
-  CK_ULONG      ulOldRandomLen;
-  CK_BYTE_PTR   pOldRandomA;
-  CK_ULONG      ulNewPasswordLen;
-  CK_BYTE_PTR   pNewPassword;
-  CK_ULONG      ulNewPublicDataLen;
-  CK_BYTE_PTR   pNewPublicData;
-  CK_ULONG      ulNewRandomLen;
-  CK_BYTE_PTR   pNewRandomA;
-} CK_SKIPJACK_RELAYX_PARAMS;
-
-typedef CK_SKIPJACK_RELAYX_PARAMS CK_PTR \
-  CK_SKIPJACK_RELAYX_PARAMS_PTR;
-
-
-typedef struct CK_PBE_PARAMS {
-  CK_BYTE_PTR      pInitVector;
-  CK_UTF8CHAR_PTR  pPassword;
-  CK_ULONG         ulPasswordLen;
-  CK_BYTE_PTR      pSalt;
-  CK_ULONG         ulSaltLen;
-  CK_ULONG         ulIteration;
-} CK_PBE_PARAMS;
-
-typedef CK_PBE_PARAMS CK_PTR CK_PBE_PARAMS_PTR;
-
-
-/* CK_KEY_WRAP_SET_OAEP_PARAMS provides the parameters to the
- * CKM_KEY_WRAP_SET_OAEP mechanism
- */
-typedef struct CK_KEY_WRAP_SET_OAEP_PARAMS {
-  CK_BYTE       bBC;     /* block contents byte */
-  CK_BYTE_PTR   pX;      /* extra data */
-  CK_ULONG      ulXLen;  /* length of extra data in bytes */
-} CK_KEY_WRAP_SET_OAEP_PARAMS;
-
-typedef CK_KEY_WRAP_SET_OAEP_PARAMS CK_PTR CK_KEY_WRAP_SET_OAEP_PARAMS_PTR;
-
-typedef struct CK_SSL3_RANDOM_DATA {
-  CK_BYTE_PTR  pClientRandom;
-  CK_ULONG     ulClientRandomLen;
-  CK_BYTE_PTR  pServerRandom;
-  CK_ULONG     ulServerRandomLen;
-} CK_SSL3_RANDOM_DATA;
-
-
-typedef struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS {
-  CK_SSL3_RANDOM_DATA RandomInfo;
-  CK_VERSION_PTR pVersion;
-} CK_SSL3_MASTER_KEY_DERIVE_PARAMS;
-
-typedef struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS CK_PTR \
-  CK_SSL3_MASTER_KEY_DERIVE_PARAMS_PTR;
-
-typedef struct CK_SSL3_KEY_MAT_OUT {
-  CK_OBJECT_HANDLE hClientMacSecret;
-  CK_OBJECT_HANDLE hServerMacSecret;
-  CK_OBJECT_HANDLE hClientKey;
-  CK_OBJECT_HANDLE hServerKey;
-  CK_BYTE_PTR      pIVClient;
-  CK_BYTE_PTR      pIVServer;
-} CK_SSL3_KEY_MAT_OUT;
-
-typedef CK_SSL3_KEY_MAT_OUT CK_PTR CK_SSL3_KEY_MAT_OUT_PTR;
-
-
-typedef struct CK_SSL3_KEY_MAT_PARAMS {
-  CK_ULONG                ulMacSizeInBits;
-  CK_ULONG                ulKeySizeInBits;
-  CK_ULONG                ulIVSizeInBits;
-  CK_BBOOL                bIsExport;
-  CK_SSL3_RANDOM_DATA     RandomInfo;
-  CK_SSL3_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
-} CK_SSL3_KEY_MAT_PARAMS;
-
-typedef CK_SSL3_KEY_MAT_PARAMS CK_PTR CK_SSL3_KEY_MAT_PARAMS_PTR;
-
-typedef struct CK_TLS_PRF_PARAMS {
-  CK_BYTE_PTR  pSeed;
-  CK_ULONG     ulSeedLen;
-  CK_BYTE_PTR  pLabel;
-  CK_ULONG     ulLabelLen;
-  CK_BYTE_PTR  pOutput;
-  CK_ULONG_PTR pulOutputLen;
-} CK_TLS_PRF_PARAMS;
-
-typedef CK_TLS_PRF_PARAMS CK_PTR CK_TLS_PRF_PARAMS_PTR;
-
-typedef struct CK_WTLS_RANDOM_DATA {
-  CK_BYTE_PTR pClientRandom;
-  CK_ULONG    ulClientRandomLen;
-  CK_BYTE_PTR pServerRandom;
-  CK_ULONG    ulServerRandomLen;
-} CK_WTLS_RANDOM_DATA;
-
-typedef CK_WTLS_RANDOM_DATA CK_PTR CK_WTLS_RANDOM_DATA_PTR;
-
-typedef struct CK_WTLS_MASTER_KEY_DERIVE_PARAMS {
-  CK_MECHANISM_TYPE   DigestMechanism;
-  CK_WTLS_RANDOM_DATA RandomInfo;
-  CK_BYTE_PTR         pVersion;
-} CK_WTLS_MASTER_KEY_DERIVE_PARAMS;
-
-typedef CK_WTLS_MASTER_KEY_DERIVE_PARAMS CK_PTR \
-  CK_WTLS_MASTER_KEY_DERIVE_PARAMS_PTR;
-
-typedef struct CK_WTLS_PRF_PARAMS {
-  CK_MECHANISM_TYPE DigestMechanism;
-  CK_BYTE_PTR       pSeed;
-  CK_ULONG          ulSeedLen;
-  CK_BYTE_PTR       pLabel;
-  CK_ULONG          ulLabelLen;
-  CK_BYTE_PTR       pOutput;
-  CK_ULONG_PTR      pulOutputLen;
-} CK_WTLS_PRF_PARAMS;
-
-typedef CK_WTLS_PRF_PARAMS CK_PTR CK_WTLS_PRF_PARAMS_PTR;
-
-typedef struct CK_WTLS_KEY_MAT_OUT {
-  CK_OBJECT_HANDLE hMacSecret;
-  CK_OBJECT_HANDLE hKey;
-  CK_BYTE_PTR      pIV;
-} CK_WTLS_KEY_MAT_OUT;
-
-typedef CK_WTLS_KEY_MAT_OUT CK_PTR CK_WTLS_KEY_MAT_OUT_PTR;
-
-typedef struct CK_WTLS_KEY_MAT_PARAMS {
-  CK_MECHANISM_TYPE       DigestMechanism;
-  CK_ULONG                ulMacSizeInBits;
-  CK_ULONG                ulKeySizeInBits;
-  CK_ULONG                ulIVSizeInBits;
-  CK_ULONG                ulSequenceNumber;
-  CK_BBOOL                bIsExport;
-  CK_WTLS_RANDOM_DATA     RandomInfo;
-  CK_WTLS_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
-} CK_WTLS_KEY_MAT_PARAMS;
-
-typedef CK_WTLS_KEY_MAT_PARAMS CK_PTR CK_WTLS_KEY_MAT_PARAMS_PTR;
-
-typedef struct CK_CMS_SIG_PARAMS {
-  CK_OBJECT_HANDLE      certificateHandle;
-  CK_MECHANISM_PTR      pSigningMechanism;
-  CK_MECHANISM_PTR      pDigestMechanism;
-  CK_UTF8CHAR_PTR       pContentType;
-  CK_BYTE_PTR           pRequestedAttributes;
-  CK_ULONG              ulRequestedAttributesLen;
-  CK_BYTE_PTR           pRequiredAttributes;
-  CK_ULONG              ulRequiredAttributesLen;
-} CK_CMS_SIG_PARAMS;
-
-typedef CK_CMS_SIG_PARAMS CK_PTR CK_CMS_SIG_PARAMS_PTR;
-
-typedef struct CK_KEY_DERIVATION_STRING_DATA {
-  CK_BYTE_PTR pData;
-  CK_ULONG    ulLen;
-} CK_KEY_DERIVATION_STRING_DATA;
-
-typedef CK_KEY_DERIVATION_STRING_DATA CK_PTR \
-  CK_KEY_DERIVATION_STRING_DATA_PTR;
-
-
-/* The CK_EXTRACT_PARAMS is used for the
- * CKM_EXTRACT_KEY_FROM_KEY mechanism.  It specifies which bit
- * of the base key should be used as the first bit of the
- * derived key
- */
-typedef CK_ULONG CK_EXTRACT_PARAMS;
-
-typedef CK_EXTRACT_PARAMS CK_PTR CK_EXTRACT_PARAMS_PTR;
-
-/* CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is used to
- * indicate the Pseudo-Random Function (PRF) used to generate
- * key bits using PKCS #5 PBKDF2.
- */
-typedef CK_ULONG CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE;
-
-typedef CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE CK_PTR \
-                        CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE_PTR;
-
-#define CKP_PKCS5_PBKD2_HMAC_SHA1          0x00000001UL
-#define CKP_PKCS5_PBKD2_HMAC_GOSTR3411     0x00000002UL
-#define CKP_PKCS5_PBKD2_HMAC_SHA224        0x00000003UL
-#define CKP_PKCS5_PBKD2_HMAC_SHA256        0x00000004UL
-#define CKP_PKCS5_PBKD2_HMAC_SHA384        0x00000005UL
-#define CKP_PKCS5_PBKD2_HMAC_SHA512        0x00000006UL
-#define CKP_PKCS5_PBKD2_HMAC_SHA512_224    0x00000007UL
-#define CKP_PKCS5_PBKD2_HMAC_SHA512_256    0x00000008UL
-
-/* CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is used to indicate the
- * source of the salt value when deriving a key using PKCS #5
- * PBKDF2.
- */
-typedef CK_ULONG CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE;
-
-typedef CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE CK_PTR \
-                        CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE_PTR;
-
-/* The following salt value sources are defined in PKCS #5 v2.0. */
-#define CKZ_SALT_SPECIFIED        0x00000001UL
-
-/* CK_PKCS5_PBKD2_PARAMS is a structure that provides the
- * parameters to the CKM_PKCS5_PBKD2 mechanism.
- */
-typedef struct CK_PKCS5_PBKD2_PARAMS {
-        CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE           saltSource;
-        CK_VOID_PTR                                pSaltSourceData;
-        CK_ULONG                                   ulSaltSourceDataLen;
-        CK_ULONG                                   iterations;
-        CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
-        CK_VOID_PTR                                pPrfData;
-        CK_ULONG                                   ulPrfDataLen;
-        CK_UTF8CHAR_PTR                            pPassword;
-        CK_ULONG_PTR                               ulPasswordLen;
-} CK_PKCS5_PBKD2_PARAMS;
-
-typedef CK_PKCS5_PBKD2_PARAMS CK_PTR CK_PKCS5_PBKD2_PARAMS_PTR;
-
-/* CK_PKCS5_PBKD2_PARAMS2 is a corrected version of the CK_PKCS5_PBKD2_PARAMS
- * structure that provides the parameters to the CKM_PKCS5_PBKD2 mechanism
- * noting that the ulPasswordLen field is a CK_ULONG and not a CK_ULONG_PTR.
- */
-typedef struct CK_PKCS5_PBKD2_PARAMS2 {
-        CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
-        CK_VOID_PTR pSaltSourceData;
-        CK_ULONG ulSaltSourceDataLen;
-        CK_ULONG iterations;
-        CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
-        CK_VOID_PTR pPrfData;
-        CK_ULONG ulPrfDataLen;
-        CK_UTF8CHAR_PTR pPassword;
-        CK_ULONG ulPasswordLen;
-} CK_PKCS5_PBKD2_PARAMS2;
-
-typedef CK_PKCS5_PBKD2_PARAMS2 CK_PTR CK_PKCS5_PBKD2_PARAMS2_PTR;
-
-typedef CK_ULONG CK_OTP_PARAM_TYPE;
-typedef CK_OTP_PARAM_TYPE CK_PARAM_TYPE; /* backward compatibility */
-
-typedef struct CK_OTP_PARAM {
-    CK_OTP_PARAM_TYPE type;
-    CK_VOID_PTR pValue;
-    CK_ULONG ulValueLen;
-} CK_OTP_PARAM;
-
-typedef CK_OTP_PARAM CK_PTR CK_OTP_PARAM_PTR;
-
-typedef struct CK_OTP_PARAMS {
-    CK_OTP_PARAM_PTR pParams;
-    CK_ULONG ulCount;
-} CK_OTP_PARAMS;
-
-typedef CK_OTP_PARAMS CK_PTR CK_OTP_PARAMS_PTR;
-
-typedef struct CK_OTP_SIGNATURE_INFO {
-    CK_OTP_PARAM_PTR pParams;
-    CK_ULONG ulCount;
-} CK_OTP_SIGNATURE_INFO;
-
-typedef CK_OTP_SIGNATURE_INFO CK_PTR CK_OTP_SIGNATURE_INFO_PTR;
-
-#define CK_OTP_VALUE          0UL
-#define CK_OTP_PIN            1UL
-#define CK_OTP_CHALLENGE      2UL
-#define CK_OTP_TIME           3UL
-#define CK_OTP_COUNTER        4UL
-#define CK_OTP_FLAGS          5UL
-#define CK_OTP_OUTPUT_LENGTH  6UL
-#define CK_OTP_OUTPUT_FORMAT  7UL
-
-#define CKF_NEXT_OTP          0x00000001UL
-#define CKF_EXCLUDE_TIME      0x00000002UL
-#define CKF_EXCLUDE_COUNTER   0x00000004UL
-#define CKF_EXCLUDE_CHALLENGE 0x00000008UL
-#define CKF_EXCLUDE_PIN       0x00000010UL
-#define CKF_USER_FRIENDLY_OTP 0x00000020UL
-
-typedef struct CK_KIP_PARAMS {
-    CK_MECHANISM_PTR  pMechanism;
-    CK_OBJECT_HANDLE  hKey;
-    CK_BYTE_PTR       pSeed;
-    CK_ULONG          ulSeedLen;
-} CK_KIP_PARAMS;
-
-typedef CK_KIP_PARAMS CK_PTR CK_KIP_PARAMS_PTR;
-
-typedef struct CK_AES_CTR_PARAMS {
-    CK_ULONG ulCounterBits;
-    CK_BYTE cb[16];
-} CK_AES_CTR_PARAMS;
-
-typedef CK_AES_CTR_PARAMS CK_PTR CK_AES_CTR_PARAMS_PTR;
-
-typedef struct CK_GCM_PARAMS {
-    CK_BYTE_PTR       pIv;
-    CK_ULONG          ulIvLen;
-    CK_ULONG          ulIvBits;
-    CK_BYTE_PTR       pAAD;
-    CK_ULONG          ulAADLen;
-    CK_ULONG          ulTagBits;
-} CK_GCM_PARAMS;
-
-typedef CK_GCM_PARAMS CK_PTR CK_GCM_PARAMS_PTR;
-
-typedef struct CK_CCM_PARAMS {
-    CK_ULONG          ulDataLen;
-    CK_BYTE_PTR       pNonce;
-    CK_ULONG          ulNonceLen;
-    CK_BYTE_PTR       pAAD;
-    CK_ULONG          ulAADLen;
-    CK_ULONG          ulMACLen;
-} CK_CCM_PARAMS;
-
-typedef CK_CCM_PARAMS CK_PTR CK_CCM_PARAMS_PTR;
-
-/* Deprecated. Use CK_GCM_PARAMS */
-typedef struct CK_AES_GCM_PARAMS {
-  CK_BYTE_PTR pIv;
-  CK_ULONG ulIvLen;
-  CK_ULONG ulIvBits;
-  CK_BYTE_PTR pAAD;
-  CK_ULONG ulAADLen;
-  CK_ULONG ulTagBits;
-} CK_AES_GCM_PARAMS;
-
-typedef CK_AES_GCM_PARAMS CK_PTR CK_AES_GCM_PARAMS_PTR;
-
-/* Deprecated. Use CK_CCM_PARAMS */
-typedef struct CK_AES_CCM_PARAMS {
-    CK_ULONG          ulDataLen;
-    CK_BYTE_PTR       pNonce;
-    CK_ULONG          ulNonceLen;
-    CK_BYTE_PTR       pAAD;
-    CK_ULONG          ulAADLen;
-    CK_ULONG          ulMACLen;
-} CK_AES_CCM_PARAMS;
-
-typedef CK_AES_CCM_PARAMS CK_PTR CK_AES_CCM_PARAMS_PTR;
-
-typedef struct CK_CAMELLIA_CTR_PARAMS {
-    CK_ULONG          ulCounterBits;
-    CK_BYTE           cb[16];
-} CK_CAMELLIA_CTR_PARAMS;
-
-typedef CK_CAMELLIA_CTR_PARAMS CK_PTR CK_CAMELLIA_CTR_PARAMS_PTR;
-
-typedef struct CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS {
-    CK_BYTE           iv[16];
-    CK_BYTE_PTR       pData;
-    CK_ULONG          length;
-} CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS CK_PTR \
-                                CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-typedef struct CK_ARIA_CBC_ENCRYPT_DATA_PARAMS {
-    CK_BYTE           iv[16];
-    CK_BYTE_PTR       pData;
-    CK_ULONG          length;
-} CK_ARIA_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_ARIA_CBC_ENCRYPT_DATA_PARAMS CK_PTR \
-                                CK_ARIA_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-typedef struct CK_DSA_PARAMETER_GEN_PARAM {
-    CK_MECHANISM_TYPE  hash;
-    CK_BYTE_PTR        pSeed;
-    CK_ULONG           ulSeedLen;
-    CK_ULONG           ulIndex;
-} CK_DSA_PARAMETER_GEN_PARAM;
-
-typedef CK_DSA_PARAMETER_GEN_PARAM CK_PTR CK_DSA_PARAMETER_GEN_PARAM_PTR;
-
-typedef struct CK_ECDH_AES_KEY_WRAP_PARAMS {
-    CK_ULONG           ulAESKeyBits;
-    CK_EC_KDF_TYPE     kdf;
-    CK_ULONG           ulSharedDataLen;
-    CK_BYTE_PTR        pSharedData;
-} CK_ECDH_AES_KEY_WRAP_PARAMS;
-
-typedef CK_ECDH_AES_KEY_WRAP_PARAMS CK_PTR CK_ECDH_AES_KEY_WRAP_PARAMS_PTR;
-
-typedef CK_ULONG CK_JAVA_MIDP_SECURITY_DOMAIN;
-
-typedef CK_ULONG CK_CERTIFICATE_CATEGORY;
-
-typedef struct CK_RSA_AES_KEY_WRAP_PARAMS {
-    CK_ULONG                      ulAESKeyBits;
-    CK_RSA_PKCS_OAEP_PARAMS_PTR   pOAEPParams;
-} CK_RSA_AES_KEY_WRAP_PARAMS;
-
-typedef CK_RSA_AES_KEY_WRAP_PARAMS CK_PTR CK_RSA_AES_KEY_WRAP_PARAMS_PTR;
-
-typedef struct CK_TLS12_MASTER_KEY_DERIVE_PARAMS {
-    CK_SSL3_RANDOM_DATA       RandomInfo;
-    CK_VERSION_PTR            pVersion;
-    CK_MECHANISM_TYPE         prfHashMechanism;
-} CK_TLS12_MASTER_KEY_DERIVE_PARAMS;
-
-typedef CK_TLS12_MASTER_KEY_DERIVE_PARAMS CK_PTR \
-                                CK_TLS12_MASTER_KEY_DERIVE_PARAMS_PTR;
-
-typedef struct CK_TLS12_KEY_MAT_PARAMS {
-    CK_ULONG                  ulMacSizeInBits;
-    CK_ULONG                  ulKeySizeInBits;
-    CK_ULONG                  ulIVSizeInBits;
-    CK_BBOOL                  bIsExport;
-    CK_SSL3_RANDOM_DATA       RandomInfo;
-    CK_SSL3_KEY_MAT_OUT_PTR   pReturnedKeyMaterial;
-    CK_MECHANISM_TYPE         prfHashMechanism;
-} CK_TLS12_KEY_MAT_PARAMS;
-
-typedef CK_TLS12_KEY_MAT_PARAMS CK_PTR CK_TLS12_KEY_MAT_PARAMS_PTR;
-
-typedef struct CK_TLS_KDF_PARAMS {
-    CK_MECHANISM_TYPE         prfMechanism;
-    CK_BYTE_PTR               pLabel;
-    CK_ULONG                  ulLabelLength;
-    CK_SSL3_RANDOM_DATA       RandomInfo;
-    CK_BYTE_PTR               pContextData;
-    CK_ULONG                  ulContextDataLength;
-} CK_TLS_KDF_PARAMS;
-
-typedef CK_TLS_KDF_PARAMS CK_PTR CK_TLS_KDF_PARAMS_PTR;
-
-typedef struct CK_TLS_MAC_PARAMS {
-    CK_MECHANISM_TYPE         prfHashMechanism;
-    CK_ULONG                  ulMacLength;
-    CK_ULONG                  ulServerOrClient;
-} CK_TLS_MAC_PARAMS;
-
-typedef CK_TLS_MAC_PARAMS CK_PTR CK_TLS_MAC_PARAMS_PTR;
-
-typedef struct CK_GOSTR3410_DERIVE_PARAMS {
-    CK_EC_KDF_TYPE            kdf;
-    CK_BYTE_PTR               pPublicData;
-    CK_ULONG                  ulPublicDataLen;
-    CK_BYTE_PTR               pUKM;
-    CK_ULONG                  ulUKMLen;
-} CK_GOSTR3410_DERIVE_PARAMS;
-
-typedef CK_GOSTR3410_DERIVE_PARAMS CK_PTR CK_GOSTR3410_DERIVE_PARAMS_PTR;
-
-typedef struct CK_GOSTR3410_KEY_WRAP_PARAMS {
-    CK_BYTE_PTR               pWrapOID;
-    CK_ULONG                  ulWrapOIDLen;
-    CK_BYTE_PTR               pUKM;
-    CK_ULONG                  ulUKMLen;
-    CK_OBJECT_HANDLE          hKey;
-} CK_GOSTR3410_KEY_WRAP_PARAMS;
-
-typedef CK_GOSTR3410_KEY_WRAP_PARAMS CK_PTR CK_GOSTR3410_KEY_WRAP_PARAMS_PTR;
-
-typedef struct CK_SEED_CBC_ENCRYPT_DATA_PARAMS {
-    CK_BYTE                   iv[16];
-    CK_BYTE_PTR               pData;
-    CK_ULONG                  length;
-} CK_SEED_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_SEED_CBC_ENCRYPT_DATA_PARAMS CK_PTR \
-                                        CK_SEED_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-#endif /* _PKCS11T_H_ */
-
diff --git a/contrib/restricted/aws/aws-c-io/source/pkcs11_lib.c b/contrib/restricted/aws/aws-c-io/source/pkcs11_lib.c
index 8047d118c79..41c74b7413b 100644
--- a/contrib/restricted/aws/aws-c-io/source/pkcs11_lib.c
+++ b/contrib/restricted/aws/aws-c-io/source/pkcs11_lib.c
@@ -1332,7 +1332,7 @@ int aws_pkcs11_lib_sign(
                 digest_alg,
                 signature_alg,
                 out_signature);
-        case CKK_ECDSA:
+        case CKK_EC:
             return s_pkcs11_sign_ecdsa(
                 pkcs11_lib,
                 session_handle,
diff --git a/contrib/restricted/aws/aws-c-io/source/pkcs11_private.h b/contrib/restricted/aws/aws-c-io/source/pkcs11_private.h
index 314c739199d..370beba7d7c 100644
--- a/contrib/restricted/aws/aws-c-io/source/pkcs11_private.h
+++ b/contrib/restricted/aws/aws-c-io/source/pkcs11_private.h
@@ -7,13 +7,6 @@
  */
 #include <aws/io/tls_channel_handler.h>
 
-/* These defines must exist before the official PKCS#11 headers are included */
-#define CK_PTR *
-#define NULL_PTR 0
-#define CK_DEFINE_FUNCTION(returnType, name) returnType name
-#define CK_DECLARE_FUNCTION(returnType, name) returnType name
-#define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType(CK_PTR name)
-#define CK_CALLBACK_FUNCTION(returnType, name) returnType(CK_PTR name)
 #include "pkcs11/v2.40/pkcs11.h"
 
 /**
diff --git a/contrib/restricted/aws/aws-c-io/source/pkcs11_tls_op_handler.c b/contrib/restricted/aws/aws-c-io/source/pkcs11_tls_op_handler.c
index 6d155cbd9e5..0951d5c8787 100644
--- a/contrib/restricted/aws/aws-c-io/source/pkcs11_tls_op_handler.c
+++ b/contrib/restricted/aws/aws-c-io/source/pkcs11_tls_op_handler.c
@@ -183,10 +183,8 @@ struct aws_custom_key_op_handler *aws_pkcs11_tls_op_handler_new(
         goto done;
     }
 
-    if (pkcs_user_pin != NULL) {
-        if (aws_pkcs11_lib_login_user(pkcs11_handler->lib, pkcs11_handler->session_handle, pkcs_user_pin)) {
-            goto done;
-        }
+    if (aws_pkcs11_lib_login_user(pkcs11_handler->lib, pkcs11_handler->session_handle, pkcs_user_pin)) {
+        goto done;
     }
 
     if (aws_pkcs11_lib_find_private_key(
diff --git a/contrib/restricted/aws/aws-c-io/source/pki_utils.c b/contrib/restricted/aws/aws-c-io/source/pki_utils.c
deleted file mode 100644
index 2be52e80ceb..00000000000
--- a/contrib/restricted/aws/aws-c-io/source/pki_utils.c
+++ /dev/null
@@ -1,224 +0,0 @@
-/**
- * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0.
- */
-#include <aws/io/private/pki_utils.h>
-
-#include <aws/common/encoding.h>
-
-#include <aws/io/file_utils.h>
-#include <aws/io/logging.h>
-
-#include <ctype.h>
-#include <errno.h>
-#include <string.h>
-
-enum PEM_PARSE_STATE {
-    BEGIN,
-    ON_DATA,
-};
-
-void aws_cert_chain_clean_up(struct aws_array_list *cert_chain) {
-    for (size_t i = 0; i < aws_array_list_length(cert_chain); ++i) {
-        struct aws_byte_buf *decoded_buffer_ptr = NULL;
-        aws_array_list_get_at_ptr(cert_chain, (void **)&decoded_buffer_ptr, i);
-
-        if (decoded_buffer_ptr) {
-            aws_secure_zero(decoded_buffer_ptr->buffer, decoded_buffer_ptr->len);
-            aws_byte_buf_clean_up(decoded_buffer_ptr);
-        }
-    }
-
-    /* remember, we don't own it so we don't free it, just undo whatever mutations we've done at this point. */
-    aws_array_list_clear(cert_chain);
-}
-
-static int s_convert_pem_to_raw_base64(
-    struct aws_allocator *allocator,
-    const struct aws_byte_cursor *pem,
-    struct aws_array_list *cert_chain_or_key) {
-    enum PEM_PARSE_STATE state = BEGIN;
-
-    struct aws_byte_buf current_cert;
-    const char *begin_header = "-----BEGIN";
-    const char *end_header = "-----END";
-    size_t begin_header_len = strlen(begin_header);
-    size_t end_header_len = strlen(end_header);
-    bool on_length_calc = true;
-
-    struct aws_array_list split_buffers;
-    if (aws_array_list_init_dynamic(&split_buffers, allocator, 16, sizeof(struct aws_byte_cursor))) {
-        return AWS_OP_ERR;
-    }
-
-    if (aws_byte_cursor_split_on_char(pem, '\n', &split_buffers)) {
-        aws_array_list_clean_up(&split_buffers);
-        AWS_LOGF_ERROR(AWS_LS_IO_PKI, "static: Invalid PEM buffer: failed to split on newline");
-        return AWS_OP_ERR;
-    }
-
-    size_t split_count = aws_array_list_length(&split_buffers);
-    size_t i = 0;
-    size_t index_of_current_cert_start = 0;
-    size_t current_cert_len = 0;
-
-    while (i < split_count) {
-        struct aws_byte_cursor *current_cur_ptr = NULL;
-        aws_array_list_get_at_ptr(&split_buffers, (void **)&current_cur_ptr, i);
-
-        /* burn off the padding in the buffer first.
-         * Worst case we'll only have to do this once per line in the buffer. */
-        while (current_cur_ptr->len && aws_isspace(*current_cur_ptr->ptr)) {
-            aws_byte_cursor_advance(current_cur_ptr, 1);
-        }
-
-        /* handle CRLF on Windows by burning '\r' off the end of the buffer */
-        if (current_cur_ptr->len && (current_cur_ptr->ptr[current_cur_ptr->len - 1] == '\r')) {
-            current_cur_ptr->len--;
-        }
-
-        switch (state) {
-            case BEGIN:
-                if (current_cur_ptr->len > begin_header_len &&
-                    !strncmp((const char *)current_cur_ptr->ptr, begin_header, begin_header_len)) {
-                    state = ON_DATA;
-                    index_of_current_cert_start = i + 1;
-                }
-                ++i;
-                break;
-            /* this loops through the lines containing data twice. First to figure out the length, a second
-             * time to actually copy the data. */
-            case ON_DATA:
-                /* Found end tag. */
-                if (current_cur_ptr->len > end_header_len &&
-                    !strncmp((const char *)current_cur_ptr->ptr, end_header, end_header_len)) {
-                    if (on_length_calc) {
-                        on_length_calc = false;
-                        state = ON_DATA;
-                        i = index_of_current_cert_start;
-
-                        if (aws_byte_buf_init(&current_cert, allocator, current_cert_len)) {
-                            goto end_of_loop;
-                        }
-
-                    } else {
-                        if (aws_array_list_push_back(cert_chain_or_key, &current_cert)) {
-                            aws_secure_zero(&current_cert.buffer, current_cert.len);
-                            aws_byte_buf_clean_up(&current_cert);
-                            goto end_of_loop;
-                        }
-                        state = BEGIN;
-                        on_length_calc = true;
-                        current_cert_len = 0;
-                        ++i;
-                    }
-                    /* actually on a line with data in it. */
-                } else {
-                    if (!on_length_calc) {
-                        aws_byte_buf_write(&current_cert, current_cur_ptr->ptr, current_cur_ptr->len);
-                    } else {
-                        current_cert_len += current_cur_ptr->len;
-                    }
-                    ++i;
-                }
-                break;
-        }
-    }
-
-end_of_loop:
-    aws_array_list_clean_up(&split_buffers);
-
-    if (state == BEGIN && aws_array_list_length(cert_chain_or_key) > 0) {
-        return AWS_OP_SUCCESS;
-    }
-
-    AWS_LOGF_ERROR(AWS_LS_IO_PKI, "static: Invalid PEM buffer.");
-    aws_cert_chain_clean_up(cert_chain_or_key);
-    return aws_raise_error(AWS_IO_FILE_VALIDATION_FAILURE);
-}
-
-int aws_decode_pem_to_buffer_list(
-    struct aws_allocator *alloc,
-    const struct aws_byte_cursor *pem_cursor,
-    struct aws_array_list *cert_chain_or_key) {
-    AWS_ASSERT(aws_array_list_length(cert_chain_or_key) == 0);
-    struct aws_array_list base_64_buffer_list;
-
-    if (aws_array_list_init_dynamic(&base_64_buffer_list, alloc, 2, sizeof(struct aws_byte_buf))) {
-        return AWS_OP_ERR;
-    }
-
-    int err_code = AWS_OP_ERR;
-
-    if (s_convert_pem_to_raw_base64(alloc, pem_cursor, &base_64_buffer_list)) {
-        goto cleanup_base64_buffer_list;
-    }
-
-    for (size_t i = 0; i < aws_array_list_length(&base_64_buffer_list); ++i) {
-        size_t decoded_len = 0;
-        struct aws_byte_buf *byte_buf_ptr = NULL;
-        aws_array_list_get_at_ptr(&base_64_buffer_list, (void **)&byte_buf_ptr, i);
-        struct aws_byte_cursor byte_cur = aws_byte_cursor_from_buf(byte_buf_ptr);
-
-        if (aws_base64_compute_decoded_len(&byte_cur, &decoded_len)) {
-            aws_raise_error(AWS_IO_FILE_VALIDATION_FAILURE);
-            goto cleanup_all;
-        }
-
-        struct aws_byte_buf decoded_buffer;
-        if (aws_byte_buf_init(&decoded_buffer, alloc, decoded_len)) {
-            goto cleanup_all;
-        }
-
-        if (aws_base64_decode(&byte_cur, &decoded_buffer)) {
-            aws_raise_error(AWS_IO_FILE_VALIDATION_FAILURE);
-            aws_byte_buf_clean_up_secure(&decoded_buffer);
-            goto cleanup_all;
-        }
-
-        if (aws_array_list_push_back(cert_chain_or_key, &decoded_buffer)) {
-            aws_byte_buf_clean_up_secure(&decoded_buffer);
-            goto cleanup_all;
-        }
-    }
-
-    err_code = AWS_OP_SUCCESS;
-
-cleanup_all:
-    if (err_code != AWS_OP_SUCCESS) {
-        AWS_LOGF_ERROR(AWS_LS_IO_PKI, "static: Invalid PEM buffer.");
-        aws_cert_chain_clean_up(cert_chain_or_key);
-    }
-
-cleanup_base64_buffer_list:
-    aws_cert_chain_clean_up(&base_64_buffer_list);
-    aws_array_list_clean_up(&base_64_buffer_list);
-
-    return err_code;
-}
-
-int aws_read_and_decode_pem_file_to_buffer_list(
-    struct aws_allocator *alloc,
-    const char *filename,
-    struct aws_array_list *cert_chain_or_key) {
-
-    struct aws_byte_buf raw_file_buffer;
-    if (aws_byte_buf_init_from_file(&raw_file_buffer, alloc, filename)) {
-        AWS_LOGF_ERROR(AWS_LS_IO_PKI, "static: Failed to read file %s.", filename);
-        return AWS_OP_ERR;
-    }
-    AWS_ASSERT(raw_file_buffer.buffer);
-
-    struct aws_byte_cursor file_cursor = aws_byte_cursor_from_buf(&raw_file_buffer);
-    if (aws_decode_pem_to_buffer_list(alloc, &file_cursor, cert_chain_or_key)) {
-        aws_secure_zero(raw_file_buffer.buffer, raw_file_buffer.len);
-        aws_byte_buf_clean_up(&raw_file_buffer);
-        AWS_LOGF_ERROR(AWS_LS_IO_PKI, "static: Failed to decode PEM file %s.", filename);
-        return AWS_OP_ERR;
-    }
-
-    aws_secure_zero(raw_file_buffer.buffer, raw_file_buffer.len);
-    aws_byte_buf_clean_up(&raw_file_buffer);
-
-    return AWS_OP_SUCCESS;
-}
diff --git a/contrib/restricted/aws/aws-c-io/source/posix/socket.c b/contrib/restricted/aws/aws-c-io/source/posix/socket.c
index 7dc170ccea7..0dac9442c14 100644
--- a/contrib/restricted/aws/aws-c-io/source/posix/socket.c
+++ b/contrib/restricted/aws/aws-c-io/source/posix/socket.c
@@ -9,6 +9,7 @@
 #include <aws/common/condition_variable.h>
 #include <aws/common/mutex.h>
 #include <aws/common/string.h>
+#include <aws/common/uuid.h>
 
 #include <aws/io/event_loop.h>
 #include <aws/io/logging.h>
@@ -339,18 +340,7 @@ static int s_update_local_endpoint(struct aws_socket *socket) {
     } else if (address.ss_family == AF_VSOCK) {
         struct sockaddr_vm *s = (struct sockaddr_vm *)&address;
 
-        /* VSOCK port is 32bit, but aws_socket_endpoint.port is only 16bit.
-         * Hopefully this isn't an issue, since users can only pass in 16bit values.
-         * But if it becomes an issue, we'll need to make aws_socket_endpoint more flexible */
-        if (s->svm_port > UINT16_MAX) {
-            AWS_LOGF_ERROR(
-                AWS_LS_IO_SOCKET,
-                "id=%p fd=%d: aws_socket_endpoint can't deal with VSOCK port > UINT16_MAX",
-                (void *)socket,
-                socket->io_handle.data.fd);
-            return aws_raise_error(AWS_IO_SOCKET_INVALID_ADDRESS);
-        }
-        tmp_endpoint.port = (uint16_t)s->svm_port;
+        tmp_endpoint.port = s->svm_port;
 
         snprintf(tmp_endpoint.address, sizeof(tmp_endpoint.address), "%" PRIu32, s->svm_cid);
         return AWS_OP_SUCCESS;
@@ -383,7 +373,7 @@ static int s_on_connection_success(struct aws_socket *socket) {
 
     if (getsockopt(socket->io_handle.data.fd, SOL_SOCKET, SO_ERROR, &connect_result, &result_length) < 0) {
         int errno_value = errno; /* Always cache errno before potential side-effect */
-        AWS_LOGF_ERROR(
+        AWS_LOGF_DEBUG(
             AWS_LS_IO_SOCKET,
             "id=%p fd=%d: failed to determine connection error %d",
             (void *)socket,
@@ -396,7 +386,7 @@ static int s_on_connection_success(struct aws_socket *socket) {
     }
 
     if (connect_result) {
-        AWS_LOGF_ERROR(
+        AWS_LOGF_DEBUG(
             AWS_LS_IO_SOCKET,
             "id=%p fd=%d: connection error %d",
             (void *)socket,
@@ -436,7 +426,7 @@ static int s_on_connection_success(struct aws_socket *socket) {
 
 static void s_on_connection_error(struct aws_socket *socket, int error) {
     socket->state = ERROR;
-    AWS_LOGF_ERROR(AWS_LS_IO_SOCKET, "id=%p fd=%d: connection failure", (void *)socket, socket->io_handle.data.fd);
+    AWS_LOGF_DEBUG(AWS_LS_IO_SOCKET, "id=%p fd=%d: connection failure", (void *)socket, socket->io_handle.data.fd);
     if (socket->connection_result_fn) {
         socket->connection_result_fn(socket, error, socket->connect_accept_user_data);
     } else if (socket->accept_result_fn) {
@@ -641,18 +631,22 @@ int aws_socket_connect(
         return AWS_OP_ERR;
     }
 
+    if (aws_socket_validate_port_for_connect(remote_endpoint->port, socket->options.domain)) {
+        return AWS_OP_ERR;
+    }
+
     struct socket_address address;
     AWS_ZERO_STRUCT(address);
     socklen_t sock_size = 0;
     int pton_err = 1;
     if (socket->options.domain == AWS_SOCKET_IPV4) {
         pton_err = inet_pton(AF_INET, remote_endpoint->address, &address.sock_addr_types.addr_in.sin_addr);
-        address.sock_addr_types.addr_in.sin_port = htons(remote_endpoint->port);
+        address.sock_addr_types.addr_in.sin_port = htons((uint16_t)remote_endpoint->port);
         address.sock_addr_types.addr_in.sin_family = AF_INET;
         sock_size = sizeof(address.sock_addr_types.addr_in);
     } else if (socket->options.domain == AWS_SOCKET_IPV6) {
         pton_err = inet_pton(AF_INET6, remote_endpoint->address, &address.sock_addr_types.addr_in6.sin6_addr);
-        address.sock_addr_types.addr_in6.sin6_port = htons(remote_endpoint->port);
+        address.sock_addr_types.addr_in6.sin6_port = htons((uint16_t)remote_endpoint->port);
         address.sock_addr_types.addr_in6.sin6_family = AF_INET6;
         sock_size = sizeof(address.sock_addr_types.addr_in6);
     } else if (socket->options.domain == AWS_SOCKET_LOCAL) {
@@ -663,7 +657,7 @@ int aws_socket_connect(
     } else if (socket->options.domain == AWS_SOCKET_VSOCK) {
         pton_err = parse_cid(remote_endpoint->address, &address.sock_addr_types.vm_addr.svm_cid);
         address.sock_addr_types.vm_addr.svm_family = AF_VSOCK;
-        address.sock_addr_types.vm_addr.svm_port = (unsigned int)remote_endpoint->port;
+        address.sock_addr_types.vm_addr.svm_port = remote_endpoint->port;
         sock_size = sizeof(address.sock_addr_types.vm_addr);
 #endif
     } else {
@@ -673,23 +667,23 @@ int aws_socket_connect(
 
     if (pton_err != 1) {
         int errno_value = errno; /* Always cache errno before potential side-effect */
-        AWS_LOGF_ERROR(
+        AWS_LOGF_DEBUG(
             AWS_LS_IO_SOCKET,
-            "id=%p fd=%d: failed to parse address %s:%d.",
+            "id=%p fd=%d: failed to parse address %s:%u.",
             (void *)socket,
             socket->io_handle.data.fd,
             remote_endpoint->address,
-            (int)remote_endpoint->port);
+            remote_endpoint->port);
         return aws_raise_error(s_convert_pton_error(pton_err, errno_value));
     }
 
     AWS_LOGF_DEBUG(
         AWS_LS_IO_SOCKET,
-        "id=%p fd=%d: connecting to endpoint %s:%d.",
+        "id=%p fd=%d: connecting to endpoint %s:%u.",
         (void *)socket,
         socket->io_handle.data.fd,
         remote_endpoint->address,
-        (int)remote_endpoint->port);
+        remote_endpoint->port);
 
     socket->state = CONNECTING;
     socket->remote_endpoint = *remote_endpoint;
@@ -769,7 +763,7 @@ int aws_socket_connect(
                 (unsigned long long)timeout);
             aws_event_loop_schedule_task_future(event_loop, timeout_task, timeout);
         } else {
-            AWS_LOGF_ERROR(
+            AWS_LOGF_DEBUG(
                 AWS_LS_IO_SOCKET,
                 "id=%p fd=%d: connect failed with error code %d.",
                 (void *)socket,
@@ -805,13 +799,17 @@ int aws_socket_bind(struct aws_socket *socket, const struct aws_socket_endpoint
         return AWS_OP_ERR;
     }
 
+    if (aws_socket_validate_port_for_bind(local_endpoint->port, socket->options.domain)) {
+        return AWS_OP_ERR;
+    }
+
     AWS_LOGF_INFO(
         AWS_LS_IO_SOCKET,
-        "id=%p fd=%d: binding to %s:%d.",
+        "id=%p fd=%d: binding to %s:%u.",
         (void *)socket,
         socket->io_handle.data.fd,
         local_endpoint->address,
-        (int)local_endpoint->port);
+        local_endpoint->port);
 
     struct socket_address address;
     AWS_ZERO_STRUCT(address);
@@ -819,12 +817,12 @@ int aws_socket_bind(struct aws_socket *socket, const struct aws_socket_endpoint
     int pton_err = 1;
     if (socket->options.domain == AWS_SOCKET_IPV4) {
         pton_err = inet_pton(AF_INET, local_endpoint->address, &address.sock_addr_types.addr_in.sin_addr);
-        address.sock_addr_types.addr_in.sin_port = htons(local_endpoint->port);
+        address.sock_addr_types.addr_in.sin_port = htons((uint16_t)local_endpoint->port);
         address.sock_addr_types.addr_in.sin_family = AF_INET;
         sock_size = sizeof(address.sock_addr_types.addr_in);
     } else if (socket->options.domain == AWS_SOCKET_IPV6) {
         pton_err = inet_pton(AF_INET6, local_endpoint->address, &address.sock_addr_types.addr_in6.sin6_addr);
-        address.sock_addr_types.addr_in6.sin6_port = htons(local_endpoint->port);
+        address.sock_addr_types.addr_in6.sin6_port = htons((uint16_t)local_endpoint->port);
         address.sock_addr_types.addr_in6.sin6_family = AF_INET6;
         sock_size = sizeof(address.sock_addr_types.addr_in6);
     } else if (socket->options.domain == AWS_SOCKET_LOCAL) {
@@ -835,7 +833,7 @@ int aws_socket_bind(struct aws_socket *socket, const struct aws_socket_endpoint
     } else if (socket->options.domain == AWS_SOCKET_VSOCK) {
         pton_err = parse_cid(local_endpoint->address, &address.sock_addr_types.vm_addr.svm_cid);
         address.sock_addr_types.vm_addr.svm_family = AF_VSOCK;
-        address.sock_addr_types.vm_addr.svm_port = (unsigned int)local_endpoint->port;
+        address.sock_addr_types.vm_addr.svm_port = local_endpoint->port;
         sock_size = sizeof(address.sock_addr_types.vm_addr);
 #endif
     } else {
@@ -847,11 +845,11 @@ int aws_socket_bind(struct aws_socket *socket, const struct aws_socket_endpoint
         int errno_value = errno; /* Always cache errno before potential side-effect */
         AWS_LOGF_ERROR(
             AWS_LS_IO_SOCKET,
-            "id=%p fd=%d: failed to parse address %s:%d.",
+            "id=%p fd=%d: failed to parse address %s:%u.",
             (void *)socket,
             socket->io_handle.data.fd,
             local_endpoint->address,
-            (int)local_endpoint->port);
+            local_endpoint->port);
         return aws_raise_error(s_convert_pton_error(pton_err, errno_value));
     }
 
@@ -881,7 +879,7 @@ int aws_socket_bind(struct aws_socket *socket, const struct aws_socket_endpoint
 
     AWS_LOGF_DEBUG(
         AWS_LS_IO_SOCKET,
-        "id=%p fd=%d: successfully bound to %s:%d",
+        "id=%p fd=%d: successfully bound to %s:%u",
         (void *)socket,
         socket->io_handle.data.fd,
         socket->local_endpoint.address,
@@ -995,7 +993,7 @@ static void s_socket_accept_event(
 
             new_sock->local_endpoint = socket->local_endpoint;
             new_sock->state = CONNECTED_READ | CONNECTED_WRITE;
-            uint16_t port = 0;
+            uint32_t port = 0;
 
             /* get the info on the incoming socket's address */
             if (in_addr.ss_family == AF_INET) {
@@ -1894,7 +1892,7 @@ int aws_socket_get_error(struct aws_socket *socket) {
     socklen_t result_length = sizeof(connect_result);
 
     if (getsockopt(socket->io_handle.data.fd, SOL_SOCKET, SO_ERROR, &connect_result, &result_length) < 0) {
-        return AWS_OP_ERR;
+        return s_determine_socket_error(errno);
     }
 
     if (connect_result) {
@@ -1907,3 +1905,12 @@ int aws_socket_get_error(struct aws_socket *socket) {
 bool aws_socket_is_open(struct aws_socket *socket) {
     return socket->io_handle.data.fd >= 0;
 }
+
+void aws_socket_endpoint_init_local_address_for_test(struct aws_socket_endpoint *endpoint) {
+    struct aws_uuid uuid;
+    AWS_FATAL_ASSERT(aws_uuid_init(&uuid) == AWS_OP_SUCCESS);
+    char uuid_str[AWS_UUID_STR_LEN] = {0};
+    struct aws_byte_buf uuid_buf = aws_byte_buf_from_empty_array(uuid_str, sizeof(uuid_str));
+    AWS_FATAL_ASSERT(aws_uuid_to_str(&uuid, &uuid_buf) == AWS_OP_SUCCESS);
+    snprintf(endpoint->address, sizeof(endpoint->address), "testsock" PRInSTR ".sock", AWS_BYTE_BUF_PRI(uuid_buf));
+}
diff --git a/contrib/restricted/aws/aws-c-io/source/s2n/s2n_tls_channel_handler.c b/contrib/restricted/aws/aws-c-io/source/s2n/s2n_tls_channel_handler.c
index 4a7d8bf4507..80770b62be5 100644
--- a/contrib/restricted/aws/aws-c-io/source/s2n/s2n_tls_channel_handler.c
+++ b/contrib/restricted/aws/aws-c-io/source/s2n/s2n_tls_channel_handler.c
@@ -523,7 +523,7 @@ static int s_s2n_handler_process_read_message(
     AWS_LOGF_TRACE(
         AWS_LS_IO_TLS, "id=%p: Downstream window %llu", (void *)handler, (unsigned long long)downstream_window);
 
-    while (processed < downstream_window && blocked == S2N_NOT_BLOCKED) {
+    while (processed < downstream_window) {
 
         struct aws_io_message *outgoing_read_message = aws_channel_acquire_message_from_pool(
             slot->channel, AWS_IO_MESSAGE_APPLICATION_DATA, downstream_window - processed);
@@ -558,9 +558,24 @@ static int s_s2n_handler_process_read_message(
 
         if (read < 0) {
             aws_mem_release(outgoing_read_message->allocator, outgoing_read_message);
-            continue;
+
+            /* the socket blocked so exit from the loop */
+            if (s2n_error_get_type(s2n_errno) == S2N_ERR_T_BLOCKED) {
+                break;
+            }
+
+            /* the socket returned a fatal error so shut down */
+            AWS_LOGF_ERROR(
+                AWS_LS_IO_TLS,
+                "id=%p: S2N failed to read with error: %s (%s)",
+                (void *)handler,
+                s2n_strerror(s2n_errno, "EN"),
+                s2n_strerror_debug(s2n_errno, "EN"));
+            aws_channel_shutdown(slot->channel, AWS_IO_TLS_ERROR_READ_FAILURE);
+            return AWS_OP_SUCCESS;
         };
 
+        /* if read > 0 */
         processed += read;
         outgoing_read_message->message_data.len = (size_t)read;
 
@@ -1297,8 +1312,9 @@ struct aws_channel_handler *aws_tls_server_handler_new(
 
 static void s_s2n_ctx_destroy(struct s2n_ctx *s2n_ctx) {
     if (s2n_ctx != NULL) {
-        s2n_config_free(s2n_ctx->s2n_config);
-
+        if (s2n_ctx->s2n_config) {
+            s2n_config_free(s2n_ctx->s2n_config);
+        }
         if (s2n_ctx->custom_cert_chain_and_key) {
             s2n_cert_chain_and_key_free(s2n_ctx->custom_cert_chain_and_key);
         }
@@ -1372,20 +1388,22 @@ static struct aws_tls_ctx *s_tls_ctx_new(
         goto cleanup_s2n_config;
     }
 
+    const char *security_policy = NULL;
     if (options->custom_key_op_handler != NULL) {
-        /* PKCS#11 integration hasn't been tested with TLS 1.3, so don't use cipher preferences that allow 1.3 */
+        /* When custom_key_op_handler is set, don't use security policy that allow TLS 1.3.
+         * This hack is necessary until our PKCS#11 custom_key_op_handler supports RSA PSS */
         switch (options->minimum_tls_version) {
             case AWS_IO_SSLv3:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "CloudFront-SSL-v-3");
+                security_policy = "CloudFront-SSL-v-3";
                 break;
             case AWS_IO_TLSv1:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "CloudFront-TLS-1-0-2014");
+                security_policy = "CloudFront-TLS-1-0-2014";
                 break;
             case AWS_IO_TLSv1_1:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "ELBSecurityPolicy-TLS-1-1-2017-01");
+                security_policy = "ELBSecurityPolicy-TLS-1-1-2017-01";
                 break;
             case AWS_IO_TLSv1_2:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "ELBSecurityPolicy-TLS-1-2-Ext-2018-06");
+                security_policy = "ELBSecurityPolicy-TLS-1-2-Ext-2018-06";
                 break;
             case AWS_IO_TLSv1_3:
                 AWS_LOGF_ERROR(AWS_LS_IO_TLS, "TLS 1.3 with PKCS#11 is not supported yet.");
@@ -1393,28 +1411,29 @@ static struct aws_tls_ctx *s_tls_ctx_new(
                 goto cleanup_s2n_config;
             case AWS_IO_TLS_VER_SYS_DEFAULTS:
             default:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "ELBSecurityPolicy-TLS-1-1-2017-01");
+                security_policy = "ELBSecurityPolicy-TLS-1-1-2017-01";
         }
     } else {
+        /* No custom_key_op_handler is set, use normal security policies */
         switch (options->minimum_tls_version) {
             case AWS_IO_SSLv3:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "AWS-CRT-SDK-SSLv3.0");
+                security_policy = "AWS-CRT-SDK-SSLv3.0-2023";
                 break;
             case AWS_IO_TLSv1:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "AWS-CRT-SDK-TLSv1.0");
+                security_policy = "AWS-CRT-SDK-TLSv1.0-2023";
                 break;
             case AWS_IO_TLSv1_1:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "AWS-CRT-SDK-TLSv1.1");
+                security_policy = "AWS-CRT-SDK-TLSv1.1-2023";
                 break;
             case AWS_IO_TLSv1_2:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "AWS-CRT-SDK-TLSv1.2");
+                security_policy = "AWS-CRT-SDK-TLSv1.2-2023";
                 break;
             case AWS_IO_TLSv1_3:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "AWS-CRT-SDK-TLSv1.3");
+                security_policy = "AWS-CRT-SDK-TLSv1.3-2023";
                 break;
             case AWS_IO_TLS_VER_SYS_DEFAULTS:
             default:
-                s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "AWS-CRT-SDK-TLSv1.0");
+                security_policy = "AWS-CRT-SDK-TLSv1.0-2023";
         }
     }
 
@@ -1423,7 +1442,7 @@ static struct aws_tls_ctx *s_tls_ctx_new(
             /* No-Op, if the user configured a minimum_tls_version then a version-specific Cipher Preference was set */
             break;
         case AWS_IO_TLS_CIPHER_PREF_PQ_TLSv1_0_2021_05:
-            s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, "PQ-TLS-1-0-2021-05-26");
+            security_policy = "PQ-TLS-1-0-2021-05-26";
             break;
         default:
             AWS_LOGF_ERROR(AWS_LS_IO_TLS, "Unrecognized TLS Cipher Preference: %d", options->cipher_pref);
@@ -1431,6 +1450,18 @@ static struct aws_tls_ctx *s_tls_ctx_new(
             goto cleanup_s2n_config;
     }
 
+    AWS_ASSERT(security_policy != NULL);
+    if (s2n_config_set_cipher_preferences(s2n_ctx->s2n_config, security_policy)) {
+        AWS_LOGF_ERROR(
+            AWS_LS_IO_TLS,
+            "ctx: Failed setting security policy '%s' (newer S2N required?): %s (%s)",
+            security_policy,
+            s2n_strerror(s2n_errno, "EN"),
+            s2n_strerror_debug(s2n_errno, "EN"));
+        aws_raise_error(AWS_IO_TLS_CTX_ERROR);
+        goto cleanup_s2n_config;
+    }
+
     if (aws_tls_options_buf_is_set(&options->certificate) && aws_tls_options_buf_is_set(&options->private_key)) {
         AWS_LOGF_DEBUG(AWS_LS_IO_TLS, "ctx: Certificate and key have been set, setting them up now.");
 
diff --git a/contrib/restricted/aws/aws-c-io/source/socket_shared.c b/contrib/restricted/aws/aws-c-io/source/socket_shared.c
new file mode 100644
index 00000000000..63c640b4926
--- /dev/null
+++ b/contrib/restricted/aws/aws-c-io/source/socket_shared.c
@@ -0,0 +1,75 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0.
+ */
+#include <aws/io/socket.h>
+
+#include <aws/io/logging.h>
+
+/* common validation for connect() and bind() */
+static int s_socket_validate_port_for_domain(uint32_t port, enum aws_socket_domain domain) {
+    switch (domain) {
+        case AWS_SOCKET_IPV4:
+        case AWS_SOCKET_IPV6:
+            if (port > UINT16_MAX) {
+                AWS_LOGF_ERROR(
+                    AWS_LS_IO_SOCKET,
+                    "Invalid port=%u for %s. Cannot exceed 65535",
+                    port,
+                    domain == AWS_SOCKET_IPV4 ? "IPv4" : "IPv6");
+                return aws_raise_error(AWS_IO_SOCKET_INVALID_ADDRESS);
+            }
+            break;
+
+        case AWS_SOCKET_LOCAL:
+            /* port is ignored */
+            break;
+
+        case AWS_SOCKET_VSOCK:
+            /* any 32bit port is legal */
+            break;
+
+        default:
+            AWS_LOGF_ERROR(AWS_LS_IO_SOCKET, "Cannot validate port for unknown domain=%d", domain);
+            return aws_raise_error(AWS_IO_SOCKET_INVALID_ADDRESS);
+    }
+    return AWS_OP_SUCCESS;
+}
+
+int aws_socket_validate_port_for_connect(uint32_t port, enum aws_socket_domain domain) {
+    if (s_socket_validate_port_for_domain(port, domain)) {
+        return AWS_OP_ERR;
+    }
+
+    /* additional validation */
+    switch (domain) {
+        case AWS_SOCKET_IPV4:
+        case AWS_SOCKET_IPV6:
+            if (port == 0) {
+                AWS_LOGF_ERROR(
+                    AWS_LS_IO_SOCKET,
+                    "Invalid port=%u for %s connections. Must use 1-65535",
+                    port,
+                    domain == AWS_SOCKET_IPV4 ? "IPv4" : "IPv6");
+                return aws_raise_error(AWS_IO_SOCKET_INVALID_ADDRESS);
+            }
+            break;
+
+        case AWS_SOCKET_VSOCK:
+            if (port == (uint32_t)-1) {
+                AWS_LOGF_ERROR(
+                    AWS_LS_IO_SOCKET, "Invalid port for VSOCK connections. Cannot use VMADDR_PORT_ANY (-1U).");
+                return aws_raise_error(AWS_IO_SOCKET_INVALID_ADDRESS);
+            }
+            break;
+
+        default:
+            /* no extra validation */
+            break;
+    }
+    return AWS_OP_SUCCESS;
+}
+
+int aws_socket_validate_port_for_bind(uint32_t port, enum aws_socket_domain domain) {
+    return s_socket_validate_port_for_domain(port, domain);
+}
diff --git a/contrib/restricted/aws/aws-c-io/source/stream.c b/contrib/restricted/aws/aws-c-io/source/stream.c
index b8040946d23..ecc5652176e 100644
--- a/contrib/restricted/aws/aws-c-io/source/stream.c
+++ b/contrib/restricted/aws/aws-c-io/source/stream.c
@@ -7,6 +7,7 @@
 
 #include <aws/common/file.h>
 #include <aws/io/file_utils.h>
+#include <aws/io/private/tracing.h>
 
 #include <errno.h>
 
@@ -32,7 +33,9 @@ int aws_input_stream_read(struct aws_input_stream *stream, struct aws_byte_buf *
     const size_t safe_buf_capacity = dest->capacity - dest->len;
     struct aws_byte_buf safe_buf = aws_byte_buf_from_empty_array(safe_buf_start, safe_buf_capacity);
 
+    __itt_task_begin(io_tracing_domain, __itt_null, __itt_null, tracing_input_stream_read);
     int read_result = stream->vtable->read(stream, &safe_buf);
+    __itt_task_end(io_tracing_domain);
 
     /* Ensure the implementation did not commit forbidden acts upon the buffer */
     AWS_FATAL_ASSERT(
@@ -287,7 +290,7 @@ struct aws_input_stream *aws_input_stream_new_from_file(struct aws_allocator *al
 
     struct aws_input_stream_file_impl *impl = aws_mem_calloc(allocator, 1, sizeof(struct aws_input_stream_file_impl));
 
-    impl->file = aws_fopen(file_name, "r+b");
+    impl->file = aws_fopen(file_name, "rb");
     if (impl->file == NULL) {
         goto on_error;
     }
diff --git a/contrib/restricted/aws/aws-c-io/source/tls_channel_handler.c b/contrib/restricted/aws/aws-c-io/source/tls_channel_handler.c
index aa80459b723..5c6426872c2 100644
--- a/contrib/restricted/aws/aws-c-io/source/tls_channel_handler.c
+++ b/contrib/restricted/aws/aws-c-io/source/tls_channel_handler.c
@@ -199,7 +199,6 @@ int aws_tls_ctx_options_init_client_mtls_with_pkcs11(
     int custom_key_result = AWS_OP_ERR;
 
     if (pkcs11_handler == NULL) {
-        aws_raise_error(AWS_ERROR_INVALID_ARGUMENT);
         goto finish;
     }
 
@@ -441,6 +440,8 @@ int aws_tls_ctx_options_init_default_server(
 }
 
 int aws_tls_ctx_options_set_alpn_list(struct aws_tls_ctx_options *options, const char *alpn_list) {
+    aws_string_destroy(options->alpn_list);
+
     options->alpn_list = aws_string_new_from_c_str(options->allocator, alpn_list);
     if (!options->alpn_list) {
         return AWS_OP_ERR;
diff --git a/contrib/restricted/aws/aws-c-io/source/tracing.c b/contrib/restricted/aws/aws-c-io/source/tracing.c
new file mode 100644
index 00000000000..680e96613b9
--- /dev/null
+++ b/contrib/restricted/aws/aws-c-io/source/tracing.c
@@ -0,0 +1,20 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0.
+ */
+
+#include <aws/io/private/tracing.h>
+
+__itt_domain *io_tracing_domain;
+__itt_string_handle *tracing_input_stream_read;
+__itt_string_handle *tracing_event_loop_run_tasks;
+__itt_string_handle *tracing_event_loop_event;
+__itt_string_handle *tracing_event_loop_events;
+
+void aws_io_tracing_init(void) {
+    io_tracing_domain = __itt_domain_create("aws.c.io");
+    tracing_input_stream_read = __itt_string_handle_create("Read:InputStream");
+    tracing_event_loop_run_tasks = __itt_string_handle_create("RunTasks:EventLoop");
+    tracing_event_loop_event = __itt_string_handle_create("IOEvent:EventLoop");
+    tracing_event_loop_events = __itt_string_handle_create("IOEvents:EventLoop");
+}