}


    protected void initProtocolVersions ( DialectVersion min, DialectVersion max ) {
        this.minVersion = min != null ? min : DialectVersion.SMB1;
        this.maxVersion = max != null ? max : DialectVersion.SMB210;

        if ( this.minVersion.atLeast(this.maxVersion) ) {
            this.maxVersion = this.minVersion;
        }
    }


    protected void initDisallowCompound ( String prop ) {

        prop2.setProperty("jcifs.smb.client.minVersion", "SMB311");
        PropertyConfiguration p2 = new PropertyConfiguration(prop2);
        assertEquals(DialectVersion.SMB311, p2.getMinimumVersion());
        assertEquals(DialectVersion.SMB311, p2.getMaximumVersion());

        Properties prop3 = new Properties();
        prop3.setProperty("jcifs.smb.client.minVersion", "SMB202");

                cfg.put("jcifs.smb.client.maxVersion", "SMB302");
                return cfg;
            }
        });

        MUTATIONS.put("smb31", new TestMutation() {

            @Override
            public Map<String, String> mutate ( Map<String, String> cfg ) {
                cfg.put("jcifs.smb.client.minVersion", "SMB311");

		mac.Write([]byte(path.Join(bucket, object))) // use path.Join for canonical 'bucket/object'
		unsealConfig = sio.Config{MinVersion: sio.Version20, Key: mac.Sum(nil), CipherSuites: fips.DARECiphers()}
	case InsecureSealAlgorithm:
		sha := sha256.New()
		sha.Write(extKey)
		sha.Write(sealedKey.IV[:])
		unsealConfig = sio.Config{MinVersion: sio.Version10, Key: sha.Sum(nil), CipherSuites: fips.DARECiphers()}
	}

		return nil, fmt.Errorf("failed to get application default credentials: %w", err)
	}

	return []grpc.DialOption{
		grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
			RootCAs:    systemRoots,
			MinVersion: tls.VersionTLS12,
		})),
		grpc.WithPerRPCCredentials(&meshAuthCredentials{
			k8sCreds: k8sCreds,
			gcpCreds: gcpCreds,
			project:  gcpProject,
		}),
	}, nil

	cfg.PathPrefix = env.Get(EnvEtcdPathPrefix, kvs.Get(PathPrefix))
	if etcdSecure {
		cfg.TLS = &tls.Config{
			RootCAs:                  rootCAs,
			PreferServerCipherSuites: true,
			MinVersion:               tls.VersionTLS12,
			NextProtos:               []string{"http/1.1", "h2"},
			ClientSessionCache:       tls.NewLRUClientSessionCache(64),
			CipherSuites:             fips.TLSCiphersBackwardCompatible(),

	return
}

// EncryptSinglePart encrypts an io.Reader which must be the
// body of a single-part PUT request.
func EncryptSinglePart(r io.Reader, key ObjectKey) io.Reader {
	r, err := sio.EncryptReader(r, sio.Config{MinVersion: sio.Version20, Key: key[:], CipherSuites: fips.DARECiphers()})
	if err != nil {
		logger.CriticalIf(context.Background(), errors.New("Unable to encrypt io.Reader using object key"))
	}
	return r
}

			if err != nil {
				return nil, err
			}
		}

		client, err := kms.NewClient(&kms.Config{
			Endpoints: endpoints,
			APIKey:    key,
			TLS: &tls.Config{
				MinVersion:         tls.VersionTLS12,
				ClientSessionCache: tls.NewLRUClientSessionCache(tlsClientSessionCacheSize),
				RootCAs:            rootCAs,
			},
		})
		if err != nil {
			return nil, err
		}

	crypto.S3.CreateMetadata(metadata, key.KeyID, key.Ciphertext, sealedKey)
	_, err = sio.Encrypt(outbuf, bytes.NewBuffer(input), sio.Config{Key: objectKey[:], MinVersion: sio.Version20, CipherSuites: fips.DARECiphers()})
	if err != nil {
		return output, metabytes, err
	}
	metabytes, err = json.Marshal(metadata)
	if err != nil {
		return
	}

        this.guestPassword = p.getProperty("jcifs.smb.client.guestPassword", "");

        String minVer = p.getProperty("jcifs.smb.client.minVersion");
        String maxVer = p.getProperty("jcifs.smb.client.maxVersion");

        if ( minVer != null || maxVer != null ) {
            initProtocolVersions(minVer, maxVer);
        }
        else {