diff --git a/configure.ac b/configure.ac

index 0840042..c9c9fdc 100644

--- a/configure.ac

+++ b/configure.ac

@@ -447,6 +447,9 @@ if test "$with_p11_kit" != "no"; then

 		if ! $PKG_CONFIG --atleast-version=0.22.0 p11-kit-1; then

 			with_buggy_p11_kit=yes

 		fi

+		if $PKG_CONFIG --atleast-version=0.23.1 p11-kit-1; then

+			AC_DEFINE([P11_KIT_HAS_PIN_VALUE], 1, [p11-kit supports p11_kit_uri_get_pin_value()])

+		fi

 	else

 	        with_p11_kit=no

 	        AC_MSG_WARN([[

diff --git a/lib/pkcs11.c b/lib/pkcs11.c

index f5cf99d..26d88e5 100644

--- a/lib/pkcs11.c

+++ b/lib/pkcs11.c

@@ -2367,6 +2367,25 @@ retrieve_pin(struct pin_info_st *pin_info, struct p11_kit_uri *info,

 	*pin = NULL;

+#ifdef P11_KIT_HAS_PIN_VALUE

+	/* First check for pin-value field */

+	pinfile = p11_kit_uri_get_pin_value(info);

+	if (pinfile != NULL) {

+		_gnutls_debug_log("p11: Using pin-value to retrieve PIN\n");

+		*pin = p11_kit_pin_new_for_string(pinfile);

+		if (*pin != NULL)

+			ret = 0;

+	} else { /* try pin-source */

+		/* Check if a pinfile is specified, and use that if possible */

+		pinfile = p11_kit_uri_get_pin_source(info);

+		if (pinfile != NULL) {

+			_gnutls_debug_log("p11: Using pin-source to retrieve PIN\n");

+			ret =

+			    retrieve_pin_from_source(pinfile, token_info, attempts,

+						     user_type, pin);

+		}

+	}

+#else

 	/* Check if a pinfile is specified, and use that if possible */

 	pinfile = p11_kit_uri_get_pinfile(info);

 	if (pinfile != NULL) {

@@ -2375,6 +2394,7 @@ retrieve_pin(struct pin_info_st *pin_info, struct p11_kit_uri *info,

 		    retrieve_pin_from_source(pinfile, token_info, attempts,

 					     user_type, pin);

 	}

+#endif

 	/* The global gnutls pin callback */

 	if (ret < 0)

diff --git a/tests/Makefile.am b/tests/Makefile.am

index 5b60899..20ed79c 100644

--- a/tests/Makefile.am

+++ b/tests/Makefile.am

@@ -36,7 +36,7 @@ EXTRA_DIST = suppressions.valgrind eagain-common.h test-chains.h \

 	certs/cert-rsa-2432.pem certs/ecc384.pem certs/ecc.pem \

 	certs/ca-ecc.pem certs/cert-ecc384.pem certs/cert-ecc.pem certs/ecc256.pem \

 	certs/ecc521.pem certs/rsa-2432.pem x509cert-dir/ca.pem \

-	cert-common.h pkcs11/softhsm.h

+	cert-common.h pkcs11/softhsm.h pkcs11/pkcs11-pubkey-import.c

 AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)

 AM_CPPFLAGS = \

@@ -113,7 +113,8 @@ pkcs11_import_url_privkey_LDADD = $(LDADD) $(LIBDL)

 ctests += pkcs11-cert-import-url-exts pkcs11-get-exts pkcs11-get-raw-issuer-exts \

 	pkcs11/pkcs11-chainverify pkcs11/pkcs11-get-issuer pkcs11/pkcs11-is-known \

-	pkcs11/pkcs11-combo pkcs11-import-url-privkey

+	pkcs11/pkcs11-combo pkcs11-import-url-privkey pkcs11/pkcs11-pubkey-import-rsa \

+	pkcs11/pkcs11-import-with-pin

 endif

 endif

diff --git a/tests/pkcs11/pkcs11-import-with-pin.c b/tests/pkcs11/pkcs11-import-with-pin.c

new file mode 100644

index 0000000..e435919

--- /dev/null

+++ b/tests/pkcs11/pkcs11-import-with-pin.c

@@ -0,0 +1,198 @@

+/*

+ * Copyright (C) 2017 Red Hat, Inc.

+ *

+ * Author: Nikos Mavrogiannopoulos

+ *

+ * This file is part of GnuTLS.

+ *

+ * GnuTLS is free software; you can redistribute it and/or modify it

+ * under the terms of the GNU General Public License as published by

+ * the Free Software Foundation; either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * GnuTLS is distributed in the hope that it will be useful, but

+ * WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ * General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with GnuTLS; if not, write to the Free Software Foundation,

+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA

+ */

+

+#ifdef HAVE_CONFIG_H

+#include <config.h>

+#endif

+

+#include <stdio.h>

+#include <stdlib.h>

+#include <string.h>

+#include <assert.h>

+#include <unistd.h>

+

+#include <gnutls/gnutls.h>

+#include <gnutls/x509.h>

+#include <gnutls/abstract.h>

+

+#include "../utils.h"

+#include "softhsm.h"

+

+/* Tests whether a protected object is imported with PIN obtained using

+ * pin-value or pin-source. */

+

+#define CONFIG_NAME "softhsm-import-with-pin"

+#define CONFIG CONFIG_NAME".config"

+

+#include "../cert-common.h"

+

+#define PIN "1234"

+

+static const gnutls_datum_t testdata = {(void*)"test test", 9};

+

+static void tls_log_func(int level, const char *str)

+{

+	fprintf(stderr, "|<%d>| %s", level, str);

+}

+

+static

+int pin_func(void* userdata, int attempt, const char* url, const char *label,

+		unsigned flags, char *pin, size_t pin_max)

+{

+	if (attempt == 0) {

+		strcpy(pin, PIN);

+		return 0;

+	}

+	return -1;

+}

+

+static void write_pin(const char *file, const char *pin)

+{

+	FILE *fp = fopen(file, "w");

+	assert(fp != NULL);

+	fputs(pin, fp);

+	fclose(fp);

+}

+

+void doit()

+{

+	char buf[512];

+	int ret, pk;

+	const char *lib, *bin;

+	gnutls_x509_privkey_t key;

+	gnutls_datum_t tmp, sig;

+	gnutls_privkey_t pkey;

+	char file[TMPNAME_SIZE];

+

+#ifndef P11_KIT_HAS_PIN_VALUE

+	exit(77);

+#endif

+

+	bin = softhsm_bin();

+

+	lib = softhsm_lib();

+

+	ret = global_init();

+	if (ret != 0) {

+		fail("%d: %s\n", ret, gnutls_strerror(ret));

+		exit(1);

+	}

+

+	gnutls_pkcs11_set_pin_function(pin_func, NULL);

+	gnutls_global_set_log_function(tls_log_func);

+	if (debug)

+		gnutls_global_set_log_level(4711);

+

+	set_softhsm_conf(CONFIG);

+	snprintf(buf, sizeof(buf), "%s --init-token --slot 0 --label test --so-pin "PIN" --pin "PIN, bin);

+	system(buf);

+

+	ret = gnutls_pkcs11_add_provider(lib, "trusted");

+	if (ret < 0) {

+		fprintf(stderr, "add_provider: %s\n",

+			gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret = gnutls_x509_privkey_init(&key);

+	if (ret < 0) {

+		fprintf(stderr,

+			"gnutls_x509_privkey_init: %s\n",

+			gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret =

+	    gnutls_x509_privkey_import(key, &server_key,

+				   GNUTLS_X509_FMT_PEM);

+	if (ret < 0) {

+		fprintf(stderr,

+			"gnutls_x509_privkey_import: %s\n",

+			gnutls_strerror(ret));

+			exit(1);

+	}

+

+	/* initialize softhsm token */

+	ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test");

+	if (ret < 0) {

+		fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret = gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN, GNUTLS_PIN_USER);

+	if (ret < 0) {

+		fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret = gnutls_pkcs11_copy_x509_privkey(SOFTHSM_URL, key, "cert", GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT,

+					      GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE|GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE|GNUTLS_PKCS11_OBJ_FLAG_LOGIN);

+	if (ret < 0) {

+		fail("gnutls_pkcs11_copy_x509_privkey: %s\n", gnutls_strerror(ret));

+		exit(1);

+	}

+

+	gnutls_x509_privkey_deinit(key);

+	gnutls_pkcs11_set_pin_function(NULL, NULL);

+

+	assert(gnutls_privkey_init(&pkey) == 0);

+

+	/* Test 1

+	 * Try importing with pin-value */

+	ret = gnutls_privkey_import_pkcs11_url(pkey, SOFTHSM_URL";object=cert;object-type=private;pin-value="PIN);

+	if (ret < 0) {

+		fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));

+		exit(1);

+	}

+

+	/* check whether privkey is operational by signing */

+	assert(gnutls_privkey_sign_data(pkey, GNUTLS_DIG_SHA256, 0, &testdata, &sig) == 0);

+	gnutls_free(sig.data);

+	gnutls_privkey_deinit(pkey);

+

+	/* Test 2

+	 * Try importing with pin-source */

+	track_temp_files();

+	get_tmpname(file);

+

+	write_pin(file, PIN);

+

+

+	assert(gnutls_privkey_init(&pkey) == 0);

+	snprintf(buf, sizeof(buf), "%s;object=cert;object-type=private;pin-source=%s", SOFTHSM_URL, file);

+	ret = gnutls_privkey_import_pkcs11_url(pkey, buf);

+	if (ret < 0) {

+		fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));

+		exit(1);

+	}

+

+	/* check whether privkey is operational by signing */

+	assert(gnutls_privkey_sign_data(pkey, GNUTLS_DIG_SHA256, 0, &testdata, &sig) == 0);

+	gnutls_free(sig.data);

+	gnutls_privkey_deinit(pkey);

+

+	gnutls_global_deinit();

+	delete_temp_files();

+

+	remove(CONFIG);

+}

+

diff --git a/tests/pkcs11/pkcs11-pubkey-import-rsa.c b/tests/pkcs11/pkcs11-pubkey-import-rsa.c

new file mode 100644

index 0000000..d304c4f

--- /dev/null

+++ b/tests/pkcs11/pkcs11-pubkey-import-rsa.c

@@ -0,0 +1,41 @@

+/*

+ * Copyright (C) 2015 Nikos Mavrogiannopoulos

+ *

+ * Author: Nikos Mavrogiannopoulos

+ *

+ * This file is part of GnuTLS.

+ *

+ * GnuTLS is free software; you can redistribute it and/or modify it

+ * under the terms of the GNU General Public License as published by

+ * the Free Software Foundation; either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * GnuTLS is distributed in the hope that it will be useful, but

+ * WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ * General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with GnuTLS; if not, write to the Free Software Foundation,

+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA

+ */

+

+#ifdef HAVE_CONFIG_H

+#include <config.h>

+#endif

+

+#include <stdio.h>

+#include <stdlib.h>

+#include <string.h>

+#include <unistd.h>

+

+#define CONFIG_NAME "softhsm-pubkey-import-rsa"

+#define CONFIG CONFIG_NAME".config"

+

+#include "pkcs11-pubkey-import.c"

+

+void doit(void)

+{

+	success("Testing RSA key\n");

+	try(1);

+}

diff --git a/tests/pkcs11/pkcs11-pubkey-import.c b/tests/pkcs11/pkcs11-pubkey-import.c

new file mode 100644

index 0000000..7513aad

--- /dev/null

+++ b/tests/pkcs11/pkcs11-pubkey-import.c

@@ -0,0 +1,220 @@

+/*

+ * Copyright (C) 2015 Nikos Mavrogiannopoulos

+ *

+ * Author: Nikos Mavrogiannopoulos

+ *

+ * This file is part of GnuTLS.

+ *

+ * GnuTLS is free software; you can redistribute it and/or modify it

+ * under the terms of the GNU General Public License as published by

+ * the Free Software Foundation; either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * GnuTLS is distributed in the hope that it will be useful, but

+ * WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ * General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with GnuTLS; if not, write to the Free Software Foundation,

+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA

+ */

+

+#ifdef HAVE_CONFIG_H

+#include <config.h>

+#endif

+

+#include <stdio.h>

+#include <stdlib.h>

+#include <string.h>

+#include <assert.h>

+#include <unistd.h>

+

+#include <gnutls/gnutls.h>

+#include <gnutls/x509.h>

+#include <gnutls/abstract.h>

+

+#include "../utils.h"

+#include "softhsm.h"

+

+/* Tests whether gnutls_pubkey_import_privkey works well for 

+ * RSA keys under PKCS #11 */

+

+

+#include "../cert-common.h"

+

+#define PIN "1234"

+

+static const gnutls_datum_t testdata = {(void*)"test test", 9};

+

+static void tls_log_func(int level, const char *str)

+{

+	fprintf(stderr, "|<%d>| %s", level, str);

+}

+

+static

+int pin_func(void* userdata, int attempt, const char* url, const char *label,

+		unsigned flags, char *pin, size_t pin_max)

+{

+	if (attempt == 0) {

+		strcpy(pin, PIN);

+		return 0;

+	}

+	return -1;

+}

+

+static void try(int rsa)

+{

+	char buf[128];

+	int ret, pk;

+	const char *lib, *bin;

+	gnutls_x509_crt_t crt;

+	gnutls_x509_privkey_t key;

+	gnutls_datum_t tmp, sig;

+	gnutls_privkey_t pkey;

+	gnutls_pubkey_t pubkey;

+	gnutls_pubkey_t pubkey2;

+

+#ifndef P11_KIT_HAS_PIN_VALUE

+	exit(77);

+#endif

+

+	bin = softhsm_bin();

+

+	lib = softhsm_lib();

+

+	ret = global_init();

+	if (ret != 0) {

+		fail("%d: %s\n", ret, gnutls_strerror(ret));

+		exit(1);

+	}

+

+	gnutls_pkcs11_set_pin_function(pin_func, NULL);

+	gnutls_global_set_log_function(tls_log_func);

+	if (debug)

+		gnutls_global_set_log_level(4711);

+

+	set_softhsm_conf(CONFIG);

+	snprintf(buf, sizeof(buf), "%s --init-token --slot 0 --label test --so-pin "PIN" --pin "PIN, bin);

+	system(buf);

+

+	ret = gnutls_pkcs11_add_provider(lib, "trusted");

+	if (ret < 0) {

+		fprintf(stderr, "gnutls_x509_crt_init: %s\n",

+			gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret = gnutls_x509_crt_init(&crt;;

+	if (ret < 0) {

+		fprintf(stderr,

+			"gnutls_x509_crt_init: %s\n",

+			gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret =

+	    gnutls_x509_crt_import(crt, rsa?&server_cert:&server_ecc_cert,

+				   GNUTLS_X509_FMT_PEM);

+	if (ret < 0) {

+		fprintf(stderr,

+			"gnutls_x509_crt_import: %s\n",

+			gnutls_strerror(ret));

+			exit(1);

+	}

+

+	if (debug) {

+		gnutls_x509_crt_print(crt,

+			      GNUTLS_CRT_PRINT_ONELINE,

+			      &tmp);

+

+		printf("\tCertificate: %.*s\n",

+		       tmp.size, tmp.data);

+		gnutls_free(tmp.data);

+	}

+

+	ret = gnutls_x509_privkey_init(&key);

+	if (ret < 0) {

+		fprintf(stderr,

+			"gnutls_x509_privkey_init: %s\n",

+			gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret =

+	    gnutls_x509_privkey_import(key, rsa?&server_key:&server_ecc_key,

+				   GNUTLS_X509_FMT_PEM);

+	if (ret < 0) {

+		fprintf(stderr,

+			"gnutls_x509_privkey_import: %s\n",

+			gnutls_strerror(ret));

+			exit(1);

+	}

+

+	/* initialize softhsm token */

+	ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test");

+	if (ret < 0) {

+		fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret = gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN, GNUTLS_PIN_USER);

+	if (ret < 0) {

+		fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret = gnutls_pkcs11_copy_x509_crt(SOFTHSM_URL, crt, "cert",

+					  GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE|GNUTLS_PKCS11_OBJ_FLAG_LOGIN);

+	if (ret < 0) {

+		fail("gnutls_pkcs11_copy_x509_crt: %s\n", gnutls_strerror(ret));

+		exit(1);

+	}

+

+	ret = gnutls_pkcs11_copy_x509_privkey(SOFTHSM_URL, key, "cert", GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT,

+					      GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE|GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE|GNUTLS_PKCS11_OBJ_FLAG_LOGIN);

+	if (ret < 0) {

+		fail("gnutls_pkcs11_copy_x509_privkey: %s\n", gnutls_strerror(ret));

+		exit(1);

+	}

+

+	gnutls_x509_crt_deinit(crt);

+	gnutls_x509_privkey_deinit(key);

+	gnutls_pkcs11_set_pin_function(NULL, NULL);

+

+	assert(gnutls_privkey_init(&pkey) == 0);

+

+	ret = gnutls_privkey_import_pkcs11_url(pkey, SOFTHSM_URL";object=cert;object-type=private;pin-value="PIN);

+	if (ret < 0) {

+		fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));

+		exit(1);

+	}

+

+	assert(gnutls_pubkey_init(&pubkey) == 0);

+	assert(gnutls_pubkey_import_privkey(pubkey, pkey, 0, 0) == 0);

+

+	pk = gnutls_pubkey_get_pk_algorithm(pubkey, NULL);

+

+	/* check whether privkey and pubkey are operational

+	 * by signing and verifying */

+	assert(gnutls_privkey_sign_data(pkey, GNUTLS_DIG_SHA256, 0, &testdata, &sig) == 0);

+

+	/* verify against the raw pubkey */

+	assert(gnutls_pubkey_init(&pubkey2) == 0);

+	assert(gnutls_pubkey_import_x509_raw(pubkey2, rsa?&server_cert:&server_ecc_cert, GNUTLS_X509_FMT_PEM, 0) == 0);

+	assert(gnutls_pubkey_verify_data2(pubkey2, gnutls_pk_to_sign(pk, GNUTLS_DIG_SHA256), 0, &testdata, &sig) >= 0);

+

+	/* verify against the pubkey in PKCS #11 */

+	assert(gnutls_pubkey_verify_data2(pubkey, gnutls_pk_to_sign(pk, GNUTLS_DIG_SHA256), 0, &testdata, &sig) >= 0);

+

+	gnutls_free(sig.data);

+

+	gnutls_pubkey_deinit(pubkey2);

+	gnutls_pubkey_deinit(pubkey);

+	gnutls_privkey_deinit(pkey);

+

+	gnutls_global_deinit();

+

+	remove(CONFIG);

+}

+

diff --git a/tests/utils.c b/tests/utils.c

index 65ceafd..37345a6 100644

--- a/tests/utils.c

+++ b/tests/utils.c

@@ -30,6 +30,7 @@

 #include <time.h>

 #include <unistd.h>

 #include <errno.h>

+#include <assert.h>

 #ifndef _WIN32

 # include <netinet/in.h>

 # include <sys/socket.h>

@@ -39,6 +40,8 @@

 # include <winbase.h>  

 #endif

 #endif

+#include <gnutls/gnutls.h>

+#include <gnutls/crypto.h>

 #include "utils.h"

@@ -183,3 +186,74 @@ int main(int argc, char *argv[])

 	return error_count ? 1 : 0;

 }

+

+struct tmp_file_st {

+	char file[TMPNAME_SIZE];

+	struct tmp_file_st *next;

+};

+

+static struct tmp_file_st *temp_files = (void*)-1;

+

+static void append(const char *file)

+{

+	struct tmp_file_st *p;

+

+	if (temp_files == (void*)-1)

+		return;

+

+	p = calloc(1, sizeof(*p));

+

+	assert(p != NULL);

+	strcpy(p->file, file);

+	p->next = temp_files;

+	temp_files = p;

+}

+

+char *get_tmpname(char s[TMPNAME_SIZE])

+{

+	unsigned char rnd[6];

+	static char _s[TMPNAME_SIZE];

+	int ret;

+	char *p;

+	const char *path;

+

+	ret = gnutls_rnd(GNUTLS_RND_NONCE, rnd, sizeof(rnd));

+	if (ret < 0)

+		return NULL;

+

+	path = getenv("builddir");

+	if (path == NULL)

+		path = ".";

+

+	if (s == NULL)

+		p = _s;

+	else

+		p = s;

+

+	snprintf(p, TMPNAME_SIZE, "%s/tmpfile-%02x%02x%02x%02x%02x%02x.tmp", path, (unsigned)rnd[0], (unsigned)rnd[1],

+		(unsigned)rnd[2], (unsigned)rnd[3], (unsigned)rnd[4], (unsigned)rnd[5]);

+

+	append(p);

+

+	return p;

+}

+

+void track_temp_files(void)

+{

+	temp_files = NULL;

+}

+

+void delete_temp_files(void)

+{

+	struct tmp_file_st *p = temp_files;

+	struct tmp_file_st *next;

+

+	if (p == (void*)-1)

+		return;

+

+	while(p != NULL) {

+		next = p->next;

+		free(p);

+		p = next;

+	}

+}

diff --git a/tests/utils.h b/tests/utils.h

index 8f3ac3f..5c0afe7 100644

--- a/tests/utils.h

+++ b/tests/utils.h

@@ -61,4 +61,9 @@ extern void binprint(const void *str, size_t len);

 extern void doit(void);

 void sec_sleep(int sec);

+#define TMPNAME_SIZE 128

+char *get_tmpname(char s[TMPNAME_SIZE]);

+void track_temp_files(void);

+void delete_temp_files(void);

+

 #endif				/* UTILS_H */