/**
 * Enhanced Pre-Authentication Integrity Service for SMB 3.1.1.
 *
 * Provides comprehensive pre-authentication integrity protection against
 * downgrade attacks by maintaining cryptographic hash chains of all
 * negotiation and session setup messages.
 */
public class PreauthIntegrityService {

    private static final Logger log = LoggerFactory.getLogger(PreauthIntegrityService.class);

    // Hash algorithm constants

     * @param skipAuthentication If true the negotiation is only done if it is
     * initiated by the client (MSIE post requests after successful NTLM SSP
     * authentication). If false and the user has not been authenticated yet
     * the client will be forced to send an authentication (server sends
     * HttpServletResponse.SC_UNAUTHORIZED).
     * @return True if the negotiation is complete, otherwise false

    <artifactId>jcifs</artifactId>
    <version>2.1.39</version>
</dependency>
```



## Features

### Protocol Support
The library supports a full range of SMB protocols with automatic negotiation:

**Supported Protocols:**
- **SMB1/CIFS**: Legacy support via `jcifs.smb1/` package
- **SMB 2.0.2**: Windows Vista+ (0x0202)
- **SMB 2.1**: Windows 7/Server 2008R2 (0x0210)

    /**
     * Constructs an SMB2 negotiate request with the specified configuration and security mode.
     *
     * @param config the configuration for this request
     * @param securityMode the security mode flags for negotiation
     */
    public Smb2NegotiateRequest(final Configuration config, final int securityMode) {
        super(config, SMB2_NEGOTIATE);
        this.securityMode = securityMode;

        if (!config.isDfsDisabled()) {

            log.debug("Secure negotiation does not apply");
            return;
        }

        final Smb2NegotiateResponse nego = (Smb2NegotiateResponse) trans.getNegotiateResponse();
        if (nego.getSelectedDialect().atLeast(DialectVersion.SMB311)) {
            // have preauth integrity instead
            log.debug("Secure negotiation does not apply, is SMB3.1");
            return;
        }

     *
     * @param req
     *            The servlet request
     * @param resp
     *            The servlet response
     * @param skipAuthentication
     *            If true the negotiation is only done if it is
     *            initiated by the client (MSIE post requests after successful NTLM SSP
     *            authentication). If false and the user has not been authenticated yet

    /**
     * Use SMB2 non-backward compatible negotiation style
     *
     * Property {@code jcifs.smb.client.useSMB2Negotiation} (boolean, default false)
     *
     * @return whether to use non-backward compatible protocol negotiation
     */
    boolean isUseSMB2OnlyNegotiation();

    /**
     * Enforce secure negotiation
     *

    /** Whether to use NT status codes instead of DOS error codes */
    protected boolean useNtStatus = true;
    /** Whether to use extended security negotiation */
    protected boolean useExtendedSecurity = true;
    /** Force use of extended security negotiation */
    protected boolean forceExtendedSecurity = false;
    /** Whether to negotiate only SMB2 or higher protocols */
    protected boolean smb2OnlyNegotiation = false;

    private static final Logger log = LoggerFactory.getLogger(NtlmContext.class);

    /**
     * The NTLMSSP OID (1.3.6.1.4.1.311.2.2.10) used in SPNEGO negotiation.
     */
    public static ASN1ObjectIdentifier NTLMSSP_OID;

    static {
        try {
            NTLMSSP_OID = new ASN1ObjectIdentifier("1.3.6.1.4.1.311.2.2.10");

        // Verify IPC signing is enforced (this is a security requirement)
        assertTrue("IPC signing should be enforced for security", config.isIpcSigningEnforced());
    }

    /**
     * Test secure negotiation requirement for SMB3
     */
    @Test
    public void testSecureNegotiateRequired() throws CIFSException {
        BaseConfiguration config = new BaseConfiguration(true);