@Test
    @DisplayName("Signing enforced/optional adhere to flags and negotiation")
    void signingModes() throws Exception {
        // Enforced via constructor flag -> optional false, enforced true regardless of negotiation
        SmbTransportImpl enforced = new SmbTransportImpl(ctx, address, 445, null, 0, true);
        assertFalse(enforced.isSigningOptional());
        assertTrue(enforced.isSigningEnforced());

                        // if signing is not enforced, dont use connections that have signing enforced
                        // for purposes that dont require it.
                        if (log.isTraceEnabled()) {
                            log.debug("Cannot reuse, signing enforced on connection " + conn);
                        }
                        continue;

        assertFalse(session.isSignatureSetupRequired());

        // Case 2: no digest, signing enforced by transport -> true
        setField(session, "digest", null);
        when(transport.isSigningEnforced()).thenReturn(true);
        assertTrue(session.isSignatureSetupRequired());

        // Case 3: not enforced, rely on negotiate response flag
        when(transport.isSigningEnforced()).thenReturn(false);

    }

    @Test
    @DisplayName("Should create new connection when force signing differs")
    void testNoReuseWithDifferentSigning() throws Exception {
        // Given: An existing connection without signing enforced
        SmbTransportImpl initial = pool.getSmbTransport(ctx, address, 445, false, false);

        // Mock the negotiation response
        when(negotiationResponse.isSigningRequired()).thenReturn(false);

        assertFalse(signingPreferred, "Should delegate signing preferred setting");
        assertTrue(signingEnforced, "Should delegate signing enforced setting");
        assertTrue(ipcSigningEnforced, "Should delegate IPC signing enforced setting");
        assertTrue(firstExtendedSecurityCall, "First call should return true");
        assertFalse(secondExtendedSecurityCall, "Second call should return false");

        verify(transport).getDfsReferrals(eq(ctx), isNull(), eq("h"), eq("d"), eq(1));
    }

    // Signing modes: optional vs enforced
    @Test
    @DisplayName("isSigningOptional and isSigningEnforced reflect configuration")
    void signingModes() throws Exception {
        when(transport.isSigningOptional()).thenReturn(true);

                && !sess.getCredentials().isAnonymous() && sess.getDigest() == null) {
            throw new SmbException("IPC signing is enforced, but no signing is available");
        }

        this.service = rsvc;
        this.inDfs = response.isShareDfs();
        this.treeNum = TREE_CONN_COUNTER.incrementAndGet();

    protected boolean forceUnicode = false;
    /** Whether SMB signing is preferred but not required */
    protected boolean signingPreferred = false;
    /** Whether SMB signing is enforced (required) */
    protected boolean signingEnforced = false;
    /** Whether to enforce signing for IPC connections */
    protected boolean ipcSigningEnforced = true;
    /** Whether SMB3 encryption is enabled */
    protected boolean encryptionEnabled = false;

        if (!isReceived() || getStatus() != 0) {
            return false;
        }

        if (req.isSigningEnforced() && !isSigningEnabled()) {
            log.debug("Signing is enforced but server does not allow it");
            return false;
        }

        if (getDialectRevision() == Smb2Constants.SMB2_DIALECT_ANY) {
            log.debug("Server returned ANY dialect");

        // When
        boolean valid = response.isValid(mockContext, mockRequest);

        // Then
        assertFalse(valid);
    }

    @Test
    @DisplayName("Should fail validation when signing enforced but not enabled")
    void testIsValidSigningEnforcedButNotEnabled() throws Exception {
        // Given
        setResponseAsReceived(response);
        when(mockRequest.isSigningEnforced()).thenReturn(true);