* domain-based DFS root shares to links for each
                 */
                Map<String, CacheEntry<DfsReferralDataInternal>> roots = domains.get(domain);
                if ( roots != null ) {
                    dr = getLinkReferral(tf, domain, root, path, now, roots);
                }

                if ( tf.getConfig().isDfsConvertToFQDN() && dr instanceof DfsReferralDataImpl ) {

        }
        /* domains that can contain DFS points to maps of roots for each
         */
        HashMap domains = getTrustedDomains(auth);
        if (domains != null) {
            domain = domain.toLowerCase();
            /* domain-based DFS root shares to links for each
             */
            HashMap roots = (HashMap)domains.get(domain);
            if (roots != null) {
                SmbTransport trans = null;

    @Test
    public void logonUserNoDomain () throws IOException {
        Assume.assumeTrue(getTestDomain().equalsIgnoreCase(getTestUserDomain()));
        // without a domain name, at this point we do not resolve the domain DFS roots
        Assume.assumeTrue(getProperties().get("test.share.dfsroot.url") == null);
        CIFSContext ctx = getContext();
        try ( SmbResource f = new SmbFile(
            getTestShareURL(),

//         * Lookup a DC in the target domain
//         * Ask the DC for a referral for the domain (e.g. "\example.com")
//         * Do NetrDfsEnumEx on the server returned in the referral to
//         * get roots in target domain
//         */
//
//        UniAddress dc = UniAddress.getByName(domainName);
//        SmbTransport trans = SmbTransport.getSmbTransport(dc, 0);

        map = new HashMap();

        if (dfs.isTrustedDomain(getServer(), auth)) {
            /* The server name is actually the name of a trusted
             * domain. Add DFS roots to the list.
             */
            try {
                entries = doDfsRootEnum();
                for (int ei = 0; ei < entries.length; ei++) {
                    e = entries[ei];

         * suggests MS doesn't compute the signature (correctly) for error responses
         * (perhaps for DOS reasons).
         */
        /*
         * Looks like the failure case also is just reflecting back the signature we sent
         */

        /**
         * Maybe this is related:
         * 

     */
    @Override
    public boolean verifySignature ( byte[] buffer, int i, int size ) {
        // observed too that signatures on error responses are sometimes wrong??
        // Looks like the failure case also is just reflecting back the signature we sent

        // with SMB3's negotiation validation it's no longer possible to ignore this (on the validation response)

        if ( tc.getDfs().isTrustedDomain(tc, locator.getServer()) ) {
            /*
             * The server name is actually the name of a trusted
             * domain. Add DFS roots to the list.
             */
            try {
                entries = doDfsRootEnum(tc, locator, locator.getAddress());
                for ( int ei = 0; ei < entries.length; ei++ ) {

    (For example, a function in a library to compute square roots has
    a purpose that is entirely well-defined independent of the
    application.  Therefore, Subsection 2d requires that any
    application-supplied function or table used by this function must
    be optional: if the application does not supply it, the square
    root function must still compute square roots.)

These requirements apply to the modified work as a whole.  If

                    request.setPath(dunc);
                }

                if ( !t.getShare().equals(dr.getShare()) ) {
                    // this should only happen for standalone roots or if the DC/domain root lookup failed
                    IOException last;
                    DfsReferralData start = dr;
                    do {
                        if ( log.isDebugEnabled() ) {