}

    @Test
    @DisplayName("Should create new connection when force signing differs")
    void testNoReuseWithDifferentSigning() throws Exception {
        // Given: An existing connection without signing enforced
        SmbTransportImpl initial = pool.getSmbTransport(ctx, address, 445, false, false);

        // Mock the negotiation response
        when(negotiationResponse.isSigningRequired()).thenReturn(false);

        assertFalse(signingPreferred, "Should delegate signing preferred setting");
        assertTrue(signingEnforced, "Should delegate signing enforced setting");
        assertTrue(ipcSigningEnforced, "Should delegate IPC signing enforced setting");
        assertTrue(firstExtendedSecurityCall, "First call should return true");
        assertFalse(secondExtendedSecurityCall, "Second call should return false");

        verify(transport).getDfsReferrals(eq(ctx), isNull(), eq("h"), eq("d"), eq(1));
    }

    // Signing modes: optional vs enforced
    @Test
    @DisplayName("isSigningOptional and isSigningEnforced reflect configuration")
    void signingModes() throws Exception {
        when(transport.isSigningOptional()).thenReturn(true);

                && !sess.getCredentials().isAnonymous() && sess.getDigest() == null) {
            throw new SmbException("IPC signing is enforced, but no signing is available");
        }

        this.service = rsvc;
        this.inDfs = response.isShareDfs();
        this.treeNum = TREE_CONN_COUNTER.incrementAndGet();

    protected boolean forceUnicode = false;
    /** Whether SMB signing is preferred but not required */
    protected boolean signingPreferred = false;
    /** Whether SMB signing is enforced (required) */
    protected boolean signingEnforced = false;
    /** Whether to enforce signing for IPC connections */
    protected boolean ipcSigningEnforced = true;
    /** Whether SMB3 encryption is enabled */
    protected boolean encryptionEnabled = false;

        if (!isReceived() || getStatus() != 0) {
            return false;
        }

        if (req.isSigningEnforced() && !isSigningEnabled()) {
            log.debug("Signing is enforced but server does not allow it");
            return false;
        }

        if (getDialectRevision() == Smb2Constants.SMB2_DIALECT_ANY) {
            log.debug("Server returned ANY dialect");

        // When
        boolean valid = response.isValid(mockContext, mockRequest);

        // Then
        assertFalse(valid);
    }

    @Test
    @DisplayName("Should fail validation when signing enforced but not enabled")
    void testIsValidSigningEnforcedButNotEnabled() throws Exception {
        // Given
        setResponseAsReceived(response);
        when(mockRequest.isSigningEnforced()).thenReturn(true);

        final boolean serverEnableSig = resp.getResponse().isSigningEnabled();
        if (log.isDebugEnabled()) {
            log.debug("Signature negotiation enforced " + this.signingEnforced + " (server " + serverRequireSig + ") enabled "
                    + this.getContext().getConfig().isSigningEnabled() + " (server " + serverEnableSig + ")");
        }

     * @param tf the CIFS context to use
     * @param name the server name or address
     * @param port the port number
     * @param exclusive whether to acquire an unshared connection
     * @param forceSigning whether to enforce SMB signing
     * @return a connected transport
     * @throws UnknownHostException if the host cannot be resolved
     * @throws IOException if an I/O error occurs
     */

    /**
     * Enforce secure negotiation
     *
     * Property {@code jcifs.smb.client.requireSecureNegotiate} (boolean, default true)
     *
     * This does not provide any actual downgrade protection if SMB1 is allowed.
     *
     * It will also break connections with SMB2 servers that do not properly sign error responses.
     *
     * @return whether to enforce the use of secure negotiation.
     */