- **AES-CCM/GCM Support**: Both AES-128-CCM (SMB 3.0/3.0.2) and AES-128-GCM (SMB 3.1.1) cipher suites
- **Encryption Context**: Per-session encryption state management
- **Key Derivation**: SMB3 KDF implementation with dialect-specific parameters
- **Pre-Authentication Integrity**: SMB 3.1.1 PAI for preventing downgrade attacks
- **Automatic Detection**: Encryption automatically enabled when servers require it

TFCI_OUTPUT_WIN_DOCKER_DIR='C:/drive_t'

# Docker on Windows doesn't support the `host` networking mode, and so
# port-forwarding is required for the container to detect it's running on GCE.
export IP_ADDR=$(powershell -command "(Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias 'vEthernet (nat)').IPAddress")

    }

    @Test
    @DisplayName("isSignatureSetupRequired depends on digest and negotiate flags")
    void testIsSignatureSetupRequired() throws Exception {
        SmbSessionImpl session = newSession();

        // Case 1: digest already set -> false
        SMBSigningDigest dg = mock(SMBSigningDigest.class);
        setField(session, "digest", dg);
        assertFalse(session.isSignatureSetupRequired());

import java.util.logging.Level;
import org.jspecify.annotations.Nullable;

/**
 * The {@code CycleDetectingLockFactory} creates {@link ReentrantLock} instances and {@link
 * ReentrantReadWriteLock} instances that detect potential deadlock by checking for cycles in lock
 * acquisition order.
 *
 * <p>Potential deadlocks detected when calling the {@code lock()}, {@code lockInterruptibly()}, or

</p>

<p>
The return value of <code>recover</code> is <code>nil</code> when the
goroutine is not panicking or <code>recover</code> was not called directly by a deferred function.
Conversely, if a goroutine is panicking and <code>recover</code> was called directly by a deferred function,
the return value of <code>recover</code> is guaranteed not to be <code>nil</code>.

        // are passed up. Mockito cannot directly verify super() calls without PowerMock,
        // which is not ideal for simple constructor tests.
        // The primary responsibility of this constructor is setting ptype and flags,
        // which are directly verifiable.
    }

/**
 * A generic JUnit test which tests {@code size()} operations on a collection. Can't be invoked
 * directly; please see {@link com.google.common.collect.testing.CollectionTestSuiteBuilder}.
 *
 * @author Kevin Bourrillion
 */
@GwtCompatible
@Ignore("test runners must not instantiate and run this directly, only via suites we build")
// @Ignore affects the Android test runner, which respects JUnit 4 annotations on JUnit 3 tests.

import org.junit.Ignore;

/**
 * A generic JUnit test which tests {@code size()} operations on a map. Can't be invoked directly;
 * please see {@link com.google.common.collect.testing.MapTestSuiteBuilder}.
 *
 * @author George van den Driessche
 */
@GwtCompatible
@Ignore("test runners must not instantiate and run this directly, only via suites we build")
// @Ignore affects the Android test runner, which respects JUnit 4 annotations on JUnit 3 tests.

     * log n) on average.
     *
     * <p>The online hash flooding detecting in RegularSetBuilderImpl.add can detect e.g. many
     * exactly matching hash codes, which would cause construction to take O(n^2), but can't detect
     * e.g. hash codes adversarially designed to go into ascending table locations, which keeps
     * construction O(n) (as desired) but then can have O(n) queries later.

                    md4.update(responseKeyNT);
                    final byte[] userSessionKey = md4.digest();

                    final HMACT64 hmac = new HMACT64(userSessionKey);
                    hmac.update(sessionNonce);
                    final byte[] ntlm2SessionKey = hmac.digest();

                    if ((getFlags() & NTLMSSP_NEGOTIATE_KEY_EXCH) != 0) {
                        masterKey = new byte[16];