readParameterWordsWireFormat(buffer, bufferIndex + 4);

                /* The SMB_COM_NT_CREATE_ANDX response wordCount is wrong. There's an
                 * extra 16 bytes for some "Offline Files (CSC or Client Side Caching)"
                 * junk. We need to bump up the wordCount here so that this method returns
                 * the correct number of bytes for signing purposes. Otherwise we get a

         */
        public sid_t() {
            // Default constructor
        }

        /** The revision level of the SID structure */
        public byte revision;
        /** The number of sub-authorities in the SID */
        public byte sub_authority_count;
        /** The identifier authority value (6 bytes) */
        public byte[] identifier_authority;
        /** The array of sub-authority values */

/**
 * For initiating NTLM authentication (including NTLMv2). If you want to add NTLMv2 authentication support to something
 * this is what you want to use. See the code for details. Note that JCIFS does not implement the acceptor side of NTLM
 * authentication.
 *
 */
public class NtlmContext implements SSPContext {

    private static final String S2C_SIGN_CONSTANT = "session key to server-to-client signing key magic constant";

     * @return a hexadecimal string representation of the byte array
     */
    public static String toHexString(final byte[] src, final int srcIndex, int size) {
        final char[] c = new char[size];
        size = size % 2 == 0 ? size / 2 : size / 2 + 1;
        for (int i = 0, j = 0; i < size; i++) {
            c[j] = HEX_DIGITS[src[i] >> 4 & 0x0F];
            j++;

  private fun buildServerSslSocketFactory(): SSLSocketFactory {
    // The test uses JDK default SSL Context instead of the Platform provided one
    // as Conscrypt seems to have some differences, we only want to test client side here.
    return try {
      val keyManager =
        newKeyManager(
          null,
          serverCert,
          serverIntermediateCa.certificate,
        )
      val trustManager =

        SIDCacheImpl cache = Mockito.spy(new SIDCacheImpl(ctx));

        // Prepare SIDs, two need resolution, one already resolved
        SID s1 = sid("S-1-5-21-10-11-12-1001");
        SID s2 = sid("S-1-5-21-10-11-12-1002");
        SID s3 = sid("S-1-5-21-10-11-12-1003");
        jcifs.SID[] arr = new jcifs.SID[] { s1, s2, s3 };

        // First call should resolve two (offset=0,length=2)
        doAnswer(inv -> {

    // we should try the next route (if there is one).
    if (e is InterruptedIOException) {
      return e is SocketTimeoutException && !requestSendStarted
    }

    // Look for known client-side or negotiation errors that are unlikely to be fixed by trying
    // again with a different route.
    if (e is SSLHandshakeException) {
      // If the problem was a CertificateException from the X509TrustManager,

### When Things are Difficult

When things are great, everything is easier, so that doesn't need much instructions. But when things are difficult, here are some guidelines.

     * @return the owner group SID, <code>null</code> if not present
     * @throws IOException if an I/O error occurs
     */
    SID getOwnerGroup(boolean resolve) throws IOException;

    /**
     * Return the resolved owner user SID for this file or directory
     *
     * @return the owner user SID, <code>null</code> if not present
     * @throws IOException if an I/O error occurs
     */
    SID getOwnerUser() throws IOException;

                /*
                 * The SMB_COM_NT_CREATE_ANDX response wordCount is wrong. There's an
                 * extra 16 bytes for some "Offline Files (CSC or Client Side Caching)"
                 * junk. We need to bump up the wordCount here so that this method returns
                 * the correct number of bytes for signing purposes. Otherwise we get a