}

        @Test
        @DisplayName("Should return salt correctly")
        void testGetSalt() {
            int[] hashAlgos = { 0x01 };
            byte[] salt = { 0x01, 0x02, 0x03, 0x04 };
            PreauthIntegrityNegotiateContext context = new PreauthIntegrityNegotiateContext(mockConfig, hashAlgos, salt);

            assertArrayEquals(salt, context.getSalt());

    @Test
    @DisplayName("Test preauth salt generation")
    public void testPreauthSaltGeneration() {
        byte[] salt1 = preauthService.generatePreauthSalt();
        byte[] salt2 = preauthService.generatePreauthSalt();

        assertNotNull(salt1);
        assertNotNull(salt2);
        assertEquals(32, salt1.length); // 32 bytes as per SMB 3.1.1 spec
        assertEquals(32, salt2.length);

        } finally {
            storage2.close();
        }

        // Clean up
        Arrays.fill(plaintext, '\0');
    }

    @Test
    public void testSaltRetrieval() throws Exception {
        byte[] salt = storage.getSalt();
        assertNotNull(salt, "Salt should not be null");
        assertEquals(32, salt.length, "Salt should be 32 bytes");

    }

    /**
     * Generates a new preauth salt for SMB 3.1.1 negotiation.
     *
     * @return a cryptographically secure random salt
     */
    public byte[] generatePreauthSalt() {
        byte[] salt = new byte[SALT_SIZE];
        secureRandom.nextBytes(salt);
        log.debug("Generated new preauth salt of {} bytes", salt.length);
        return salt;
    }

    /**

            int[] hashAlgos = { 1, 2 };
            byte[] salt = new byte[8];
            Arrays.fill(salt, (byte) 0xFF);

            context = new PreauthIntegrityNegotiateContext(mockConfig, hashAlgos, salt);

            // Encode at position 100
            int encoded = context.encode(buffer, 100);
            assertEquals(context.size(), encoded);

            // Verify salt is at correct position

        }
        if (salt == null || salt.length != SALT_SIZE) {
            throw new IllegalArgumentException("Invalid salt");
        }

        this.salt = salt.clone();
        this.masterKey = deriveKey(masterPassword, this.salt);

        // Clear the master password after use
        Arrays.fill(masterPassword, '\0');
    }

            byte[] buffer = new byte[] { 0x02, 0x00, // 2 hash algos
                    0x04, 0x00, // 4 bytes salt
                    0x01, 0x00, // SHA512
                    0x02, 0x00, // Another hash algo
                    0x0A, 0x0B, 0x0C, 0x0D // Salt
            };

            // Act
            int decodedSize = context.decode(buffer, 0, buffer.length);

            // Assert

        when(mockConfig.getMachineId()).thenReturn(testMachineId);
        when(mockConfig.getRandom()).thenReturn(mockRandom);
        when(mockContext.getConfig()).thenReturn(mockConfig);

        // Mock random for predictable salt generation
        doAnswer(invocation -> {
            byte[] buffer = invocation.getArgument(0);
            System.arraycopy(testSalt, 0, buffer, 0, Math.min(buffer.length, testSalt.length));
            return null;

        ctxOffset += 8; // Skip reserved

        // Hash algorithm count and salt length
        SMBUtil.writeInt2(1, buffer, ctxOffset);
        SMBUtil.writeInt2(32, buffer, ctxOffset + 2);
        SMBUtil.writeInt2(PreauthIntegrityNegotiateContext.HASH_ALGO_SHA512, buffer, ctxOffset + 4);
        ctxOffset += 6;

        // Salt (32 bytes)
        for (int i = 0; i < 32; i++) {
            buffer[ctxOffset + i] = (byte) i;

* GCI: Add two GCI specific metadata pairs ([#25105](https://github.com/kubernetes/kubernetes/pull/25105), [@andyzheng0831](https://github.com/andyzheng0831))
* Add an entry to the salt config to allow Debian jessie on GCE. ([#25123](https://github.com/kubernetes/kubernetes/pull/25123), [@jlewi](https://github.com/jlewi))