ruby_smb 1.1.0 → 2.0.4

data/lib/ruby_smb/smb2/packet/tree_connect_response.rb

@@ -6,6 +6,14 @@ module RubySMB
       class TreeConnectResponse < RubySMB::GenericPacket
         COMMAND = RubySMB::SMB2::Commands::TREE_CONNECT
 
+        # Share Types
+        # Physical disk share
+        SMB2_SHARE_TYPE_DISK  = 0x01
+        # Named pipe share
+        SMB2_SHARE_TYPE_PIPE  = 0x02
+        # Printer share
+        SMB2_SHARE_TYPE_PRINT = 0x03
+
         endian :little
         smb2_header           :smb2_header
         uint16                :structure_size, label: 'Structure Size', initial_value: 16
@@ -20,32 +28,6 @@ module RubySMB
           smb2_header.flags.reply = 1
         end
 
-        # Returns the ACCESS_MASK for the Maximal Share Access Rights. The packet
-        # defaults this to a {RubySMB::SMB2::BitField::DirectoryAccessMask}. If it is anything other than
-        # a directory that has been connected to, it will re-cast it as a {RubySMB::SMB2::BitField::FileAccessMask}
-        #
-        # @return [RubySMB::SMB2::BitField::DirectoryAccessMask] if a directory was connected to
-        # @return [RubySMB::SMB2::BitField::FileAccessMask] if anything else was connected to
-        # @raise [RubySMB::Error::InvalidBitField] if ACCESS_MASK bit field is not valid
-        def access_rights
-          if is_directory?
-            maximal_access
-          else
-            mask = maximal_access.to_binary_s
-            begin
-              RubySMB::SMB2::BitField::FileAccessMask.read(mask)
-            rescue IOError
-              raise RubySMB::Error::InvalidBitField, 'Invalid ACCESS_MASK for the Maximal Share Access Rights'
-            end
-          end
-        end
-
-        # Checks if the remote Tree is a directory
-        #
-        # @return [Boolean]
-        def is_directory?
-          share_type == 0x01
-        end
       end
     end
   end

data/lib/ruby_smb/smb2/pipe.rb

@@ -17,6 +17,8 @@ module RubySMB
           extend RubySMB::Dcerpc::Srvsvc
         when 'winreg'
           extend RubySMB::Dcerpc::Winreg
+        when 'svcctl'
+          extend RubySMB::Dcerpc::Svcctl
         end
         super(tree: tree, response: response, name: name)
       end
@@ -40,13 +42,12 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::IoctlResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
 
         unless response.status_code == WindowsError::NTStatus::STATUS_BUFFER_OVERFLOW or response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
-          raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+          raise RubySMB::Error::UnexpectedStatusCode, response.status_code
         end
         response
       end
@@ -89,6 +90,7 @@ module RubySMB
         request = set_header_fields(RubySMB::SMB2::Packet::IoctlRequest.new(options))
         request.ctl_code = 0x0011C017
         request.flags.is_fsctl = 0x00000001
+        # TODO: handle fragmentation when the request size > MAX_XMIT_FRAG
         request.buffer = action.to_binary_s
 
         ioctl_raw_response = @tree.client.send_recv(request)
@@ -97,26 +99,12 @@ module RubySMB
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::IoctlRequest::COMMAND,
-            received_proto: ioctl_response.smb2_header.protocol,
-            received_cmd:   ioctl_response.smb2_header.command
+            packet:         ioctl_response
           )
         end
-        # TODO: improve the handling of STATUS_PENDING responses
-        if ioctl_response.status_code == WindowsError::NTStatus::STATUS_PENDING
-          sleep 1
-          ioctl_raw_response = @tree.client.dispatcher.recv_packet
-          ioctl_response = RubySMB::SMB2::Packet::IoctlResponse.read(ioctl_raw_response)
-          unless ioctl_response.valid?
-            raise RubySMB::Error::InvalidPacket.new(
-              expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
-              expected_cmd:   RubySMB::SMB2::Packet::IoctlRequest::COMMAND,
-              received_proto: ioctl_response.smb2_header.protocol,
-              received_cmd:   ioctl_response.smb2_header.command
-            )
-          end
-        elsif ![WindowsError::NTStatus::STATUS_SUCCESS,
+        unless [WindowsError::NTStatus::STATUS_SUCCESS,
                 WindowsError::NTStatus::STATUS_BUFFER_OVERFLOW].include?(ioctl_response.status_code)
-          raise RubySMB::Error::UnexpectedStatusCode, ioctl_response.status_code.name
+          raise RubySMB::Error::UnexpectedStatusCode, ioctl_response.status_code
         end
 
         raw_data = ioctl_response.output_data

data/lib/ruby_smb/smb2/smb2_header.rb

@@ -6,7 +6,7 @@ module RubySMB
       endian              :little
       bit32               :protocol,          label: 'Protocol ID Field',      initial_value: RubySMB::SMB2::SMB2_PROTOCOL_ID
       uint16              :structure_size,    label: 'Header Structure Size',  initial_value: 64
-      uint16              :credit_charge,     label: 'Credit Charge',          initial_value: 0
+      uint16              :credit_charge,     label: 'Credit Charge',          initial_value: 1
       nt_status           :nt_status,         label: 'NT Status',              initial_value: 0
       uint16              :command,           label: 'Command'
       uint16              :credits,           label: 'Credit Request/Response'

data/lib/ruby_smb/smb2/tree.rb

@@ -23,12 +23,18 @@ module RubySMB
       #   @return [Integer]
       attr_accessor :id
 
-      def initialize(client:, share:, response:)
-        @client             = client
-        @share              = share
-        @id                 = response.smb2_header.tree_id
-        @permissions        = response.maximal_access
-        @share_type         = response.share_type
+      # Whether or not the share associated with this tree connect needs to be encrypted (SMB 3.x)
+      # @!attribute [rw] tree_connect_encrypt_data
+      #   @return [Boolean]
+      attr_accessor :tree_connect_encrypt_data
+
+      def initialize(client:, share:, response:, encrypt: false)
+        @client              = client
+        @share               = share
+        @id                  = response.smb2_header.tree_id
+        @permissions         = response.maximal_access
+        @share_type          = response.share_type
+        @tree_connect_encrypt_data = encrypt
       end
 
       # Disconnects this Tree from the current session
@@ -38,19 +44,26 @@ module RubySMB
       def disconnect!
         request = RubySMB::SMB2::Packet::TreeDisconnectRequest.new
         request = set_header_fields(request)
-        raw_response = client.send_recv(request)
+        raw_response = client.send_recv(request, encrypt: @tree_connect_encrypt_data)
         response = RubySMB::SMB2::Packet::TreeDisconnectResponse.read(raw_response)
         unless response.valid?
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::TreeDisconnectResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
         response.status_code
       end
 
+      def open_pipe(opts)
+        # Make sure we don't modify the caller's hash options
+        opts = opts.dup
+        opts[:filename] = opts[:filename].dup
+        opts[:filename] = opts[:filename][1..-1] if opts[:filename].start_with? '\\'
+        open_file(opts)
+      end
+
       def open_file(filename:, attributes: nil, options: nil, disposition: RubySMB::Dispositions::FILE_OPEN,
                     impersonation: RubySMB::ImpersonationLevels::SEC_IMPERSONATE, read: true, write: false, delete: false)
 
@@ -96,26 +109,25 @@ module RubySMB
         create_request.create_disposition   = disposition
         create_request.name                 = filename
 
-        raw_response  = client.send_recv(create_request)
+        raw_response  = client.send_recv(create_request, encrypt: @tree_connect_encrypt_data)
         response      = RubySMB::SMB2::Packet::CreateResponse.read(raw_response)
         unless response.valid?
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::CreateResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
         unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
-          raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+          raise RubySMB::Error::UnexpectedStatusCode, response.status_code
         end
 
         case @share_type
-        when 0x01
-          RubySMB::SMB2::File.new(name: filename, tree: self, response: response)
-        when 0x02
+        when RubySMB::SMB2::Packet::TreeConnectResponse::SMB2_SHARE_TYPE_DISK
+          RubySMB::SMB2::File.new(name: filename, tree: self, response: response, encrypt: @tree_connect_encrypt_data)
+        when RubySMB::SMB2::Packet::TreeConnectResponse::SMB2_SHARE_TYPE_PIPE
           RubySMB::SMB2::Pipe.new(name: filename, tree: self, response: response)
-        # when 0x03
+        # when RubySMB::SMB2::TreeConnectResponse::SMB2_SHARE_TYPE_PRINT
         #   it's a printer!
         else
           raise RubySMB::Error::RubySMBError, 'Unsupported share type'
@@ -141,21 +153,27 @@ module RubySMB
         directory_request.file_information_class  = type::CLASS_LEVEL
         directory_request.file_id                 = file_id
         directory_request.name                    = pattern
-        directory_request.output_length           = 65_535
+
+        max_read = client.server_max_read_size
+        max_read = 65536 unless client.server_supports_multi_credit
+        credit_charge = 0
+        if client.server_supports_multi_credit
+          credit_charge = (max_read - 1) / 65536 + 1
+        end
+        directory_request.output_length = max_read
+        directory_request.smb2_header.credit_charge = credit_charge
 
         directory_request = set_header_fields(directory_request)
 
         files = []
-
         loop do
-          response            = client.send_recv(directory_request)
+          response            = client.send_recv(directory_request, encrypt: @tree_connect_encrypt_data)
           directory_response  = RubySMB::SMB2::Packet::QueryDirectoryResponse.read(response)
           unless directory_response.valid?
             raise RubySMB::Error::InvalidPacket.new(
               expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
               expected_cmd:   RubySMB::SMB2::Packet::QueryDirectoryResponse::COMMAND,
-              received_proto: directory_response.smb2_header.protocol,
-              received_cmd:   directory_response.smb2_header.command
+              packet:         directory_response
             )
           end
 
@@ -164,7 +182,7 @@ module RubySMB
           break if status_code == WindowsError::NTStatus::STATUS_NO_MORE_FILES
 
           unless status_code == WindowsError::NTStatus::STATUS_SUCCESS
-            raise RubySMB::Error::UnexpectedStatusCode, status_code.to_s
+            raise RubySMB::Error::UnexpectedStatusCode, status_code
           end
 
           files += directory_response.results(type)
@@ -193,18 +211,17 @@ module RubySMB
 
         create_request  = open_directory_packet(directory: directory, disposition: disposition,
                                                 impersonation: impersonation, read: read, write: write, delete: delete)
-        raw_response    = client.send_recv(create_request)
+        raw_response    = client.send_recv(create_request, encrypt: @tree_connect_encrypt_data)
         response = RubySMB::SMB2::Packet::CreateResponse.read(raw_response)
         unless response.valid?
           raise RubySMB::Error::InvalidPacket.new(
             expected_proto: RubySMB::SMB2::SMB2_PROTOCOL_ID,
             expected_cmd:   RubySMB::SMB2::Packet::CreateResponse::COMMAND,
-            received_proto: response.smb2_header.protocol,
-            received_cmd:   response.smb2_header.command
+            packet:         response
           )
         end
         unless response.status_code == WindowsError::NTStatus::STATUS_SUCCESS
-          raise RubySMB::Error::UnexpectedStatusCode, response.status_code.name
+          raise RubySMB::Error::UnexpectedStatusCode, response.status_code
         end
 
         response
@@ -250,7 +267,6 @@ module RubySMB
       # @return [RubySMB::SMB2::Packet] the modified packet.
       def set_header_fields(request)
         request.smb2_header.tree_id = id
-        request.smb2_header.credit_charge = 1
         request.smb2_header.credits = 256
         request
       end

data/lib/ruby_smb/version.rb

@@ -1,3 +1,3 @@
 module RubySMB
-  VERSION = '1.1.0'.freeze
+  VERSION = '2.0.4'.freeze
 end

data/ruby_smb.gemspec

@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
     spec.platform = Gem::Platform::RUBY
   end
 
-  spec.required_ruby_version = '>= 2.3.0'
+  spec.required_ruby_version = '>= 2.5'
 
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'fivemat'
@@ -36,4 +36,6 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency 'rubyntlm'
   spec.add_runtime_dependency 'windows_error'
   spec.add_runtime_dependency 'bindata'
+  spec.add_runtime_dependency 'openssl-ccm'
+  spec.add_runtime_dependency 'openssl-cmac'
 end

data/spec/lib/ruby_smb/client_spec.rb

@@ -6,11 +6,68 @@ RSpec.describe RubySMB::Client do
   let(:username) { 'msfadmin' }
   let(:password) { 'msfpasswd' }
   subject(:client) { described_class.new(dispatcher, username: username, password: password) }
-  let(:smb1_client) { described_class.new(dispatcher, smb2: false, username: username, password: password) }
-  let(:smb2_client) { described_class.new(dispatcher, smb1: false, username: username, password: password) }
+  let(:smb1_client) { described_class.new(dispatcher, smb2: false, smb3: false, username: username, password: password) }
+  let(:smb2_client) { described_class.new(dispatcher, smb1: false, smb3: false, username: username, password: password) }
+  let(:smb3_client) { described_class.new(dispatcher, smb1: false, smb2: false, username: username, password: password) }
   let(:empty_packet) { RubySMB::SMB1::Packet::EmptyPacket.new }
   let(:error_packet) { RubySMB::SMB2::Packet::ErrorPacket.new }
 
+  it { is_expected.to respond_to :dispatcher }
+  it { is_expected.to respond_to :domain }
+  it { is_expected.to respond_to :local_workstation }
+  it { is_expected.to respond_to :ntlm_client }
+  it { is_expected.to respond_to :password }
+  it { is_expected.to respond_to :peer_native_os }
+  it { is_expected.to respond_to :peer_native_lm }
+  it { is_expected.to respond_to :primary_domain }
+  it { is_expected.to respond_to :default_name }
+  it { is_expected.to respond_to :default_domain }
+  it { is_expected.to respond_to :dns_host_name }
+  it { is_expected.to respond_to :dns_domain_name }
+  it { is_expected.to respond_to :dns_tree_name }
+  it { is_expected.to respond_to :os_version }
+  it { is_expected.to respond_to :dialect }
+  it { is_expected.to respond_to :sequence_counter }
+  it { is_expected.to respond_to :session_id }
+  it { is_expected.to respond_to :signing_required }
+  it { is_expected.to respond_to :smb1 }
+  it { is_expected.to respond_to :smb2 }
+  it { is_expected.to respond_to :smb3 }
+  it { is_expected.to respond_to :smb2_message_id }
+  it { is_expected.to respond_to :username }
+  it { is_expected.to respond_to :user_id }
+  it { is_expected.to respond_to :max_buffer_size }
+  it { is_expected.to respond_to :server_max_buffer_size }
+  it { is_expected.to respond_to :server_max_write_size }
+  it { is_expected.to respond_to :server_max_read_size }
+  it { is_expected.to respond_to :server_max_transact_size }
+  it { is_expected.to respond_to :preauth_integrity_hash_algorithm }
+  it { is_expected.to respond_to :preauth_integrity_hash_value }
+  it { is_expected.to respond_to :encryption_algorithm }
+  it { is_expected.to respond_to :client_encryption_key }
+  it { is_expected.to respond_to :server_encryption_key }
+  it { is_expected.to respond_to :session_encrypt_data }
+  it { is_expected.to respond_to :server_encryption_algorithms }
+  it { is_expected.to respond_to :server_compression_algorithms }
+  it { is_expected.to respond_to :negotiated_smb_version }
+  it { is_expected.to respond_to :session_key }
+  it { is_expected.to respond_to :tree_connects }
+  it { is_expected.to respond_to :open_files }
+  it { is_expected.to respond_to :use_ntlmv2 }
+  it { is_expected.to respond_to :usentlm2_session }
+  it { is_expected.to respond_to :send_lm }
+  it { is_expected.to respond_to :use_lanman_key }
+  it { is_expected.to respond_to :send_ntlm }
+  it { is_expected.to respond_to :spnopt }
+  it { is_expected.to respond_to :evasion_opts }
+  it { is_expected.to respond_to :native_os }
+  it { is_expected.to respond_to :native_lm }
+  it { is_expected.to respond_to :verify_signature }
+  it { is_expected.to respond_to :auth_user }
+  it { is_expected.to respond_to :last_file_id }
+  it { is_expected.to respond_to :pid }
+  it { is_expected.to respond_to :server_supports_multi_credit }
+
   describe '#initialize' do
     it 'should raise an ArgumentError without a valid dispatcher' do
       expect { described_class.new(nil) }.to raise_error(ArgumentError)
@@ -26,14 +83,21 @@ RSpec.describe RubySMB::Client do
 
     it 'accepts an argument to disable smb1 support' do
       expect(smb2_client.smb1).to be false
+      expect(smb3_client.smb1).to be false
     end
 
     it 'accepts an argument to disable smb2 support' do
       expect(smb1_client.smb2).to be false
+      expect(smb3_client.smb2).to be false
+    end
+
+    it 'accepts an argument to disable smb3 support' do
+      expect(smb1_client.smb3).to be false
+      expect(smb2_client.smb3).to be false
     end
 
-    it 'raises an exception if both SMB1 and SMB2 are disabled' do
-      expect { described_class.new(dispatcher, smb1: false, smb2: false, username: username, password: password) }.to raise_error(ArgumentError, 'You must enable at least one Protocol')
+    it 'raises an exception if SMB1, SMB2 and SMB3 are disabled' do
+      expect { described_class.new(dispatcher, smb1: false, smb2: false, smb3: false, username: username, password: password) }.to raise_error(ArgumentError, 'You must enable at least one Protocol')
     end
 
     it 'sets the username attribute' do
@@ -44,6 +108,11 @@ RSpec.describe RubySMB::Client do
       expect(client.password).to eq password
     end
 
+    it 'sets the session_encrypt_data attribute' do
+      client =  described_class.new(dispatcher, username: username, password: password, always_encrypt: true)
+      expect(client.session_encrypt_data).to eq true
+    end
+
     it 'creates an NTLM client' do
       expect(client.ntlm_client).to be_a Net::NTLM::Client
     end
@@ -58,7 +127,7 @@ RSpec.describe RubySMB::Client do
         expect(opt[:workstation]).to eq(local_workstation)
         expect(opt[:domain]).to eq(domain)
         flags = Net::NTLM::Client::DEFAULT_FLAGS |
-          Net::NTLM::FLAGS[:TARGET_INFO] | 0x02000000
+          Net::NTLM::FLAGS[:TARGET_INFO] | 0x02000000 ^ Net::NTLM::FLAGS[:OEM]
         expect(opt[:flags]).to eq(flags)
       end
 
@@ -74,30 +143,367 @@ RSpec.describe RubySMB::Client do
     it 'sets the max_buffer_size to MAX_BUFFER_SIZE' do
       expect(client.max_buffer_size).to eq RubySMB::Client::MAX_BUFFER_SIZE
     end
+
+    it 'sets the server_supports_multi_credit to false' do
+      expect(client.server_supports_multi_credit).to be false
+    end
+
+    it 'sets the pid to a random value' do
+      100.times do
+        previous_pid = client.pid
+        client = described_class.new(dispatcher, username: username, password: password)
+        expect(client.pid).to_not eq(previous_pid)
+      end
+    end
+  end
+
+  describe '#echo' do
+    let(:response) { double('Echo Response') }
+    before :example do
+      allow(response).to receive(:status_code).and_return(WindowsError::NTStatus::STATUS_SUCCESS)
+    end
+
+    context 'with SMB1' do
+      it 'calls #smb1_echo with the expected arguments' do
+        allow(smb1_client).to receive(:smb1_echo).and_return(response)
+        count = 3
+        data  = 'testing...'
+        smb1_client.echo(count: count, data: data)
+        expect(smb1_client).to have_received(:smb1_echo).with(count: count, data: data)
+      end
+    end
+
+    context 'with SMB2' do
+      it 'calls #smb2_echo without arguments' do
+        allow(smb2_client).to receive(:smb2_echo).and_return(response)
+        smb2_client.echo
+        expect(smb2_client).to have_received(:smb2_echo)
+      end
+    end
+
+    context 'with SMB3' do
+      it 'calls #smb2_echo without arguments' do
+        allow(smb3_client).to receive(:smb2_echo).and_return(response)
+        smb3_client.echo
+        expect(smb3_client).to have_received(:smb2_echo)
+      end
+    end
+
+    it 'returns the expected status code' do
+      allow(smb2_client).to receive(:smb2_echo).and_return(response)
+      expect(smb2_client.echo).to eq(WindowsError::NTStatus::STATUS_SUCCESS)
+    end
   end
 
   describe '#send_recv' do
     let(:smb1_request) { RubySMB::SMB1::Packet::TreeConnectRequest.new }
     let(:smb2_request) { RubySMB::SMB2::Packet::TreeConnectRequest.new }
+    let(:smb2_header)  { RubySMB::SMB2::SMB2Header.new }
 
     before(:each) do
-      expect(dispatcher).to receive(:send_packet).and_return(nil)
-      expect(dispatcher).to receive(:recv_packet).and_return('A')
+      allow(client).to receive(:is_status_pending?).and_return(false)
+      allow(dispatcher).to receive(:send_packet).and_return(nil)
+      allow(dispatcher).to receive(:recv_packet).and_return('A')
+      allow(RubySMB::SMB2::SMB2Header).to receive(:read).and_return(smb2_header)
     end
 
-    it 'checks the packet version' do
-      expect(smb1_request).to receive(:packet_smb_version).and_call_original
-      client.send_recv(smb1_request)
+    context 'when signing' do
+      it 'calls #smb1_sign if it is an SMB1 packet' do
+        expect(client).to receive(:smb1_sign).with(smb1_request).and_call_original
+        client.send_recv(smb1_request)
+      end
+
+      context 'with an SMB2 packet' do
+        it 'does not sign a SessionSetupRequest packet' do
+          allow(smb2_client).to receive(:is_status_pending?).and_return(false)
+          expect(smb2_client).to_not receive(:smb2_sign)
+          expect(smb2_client).to_not receive(:smb3_sign)
+          smb2_client.send_recv(RubySMB::SMB2::Packet::SessionSetupRequest.new)
+        end
+
+        it 'calls #smb2_sign if it is an SMB2 client' do
+          allow(smb2_client).to receive(:is_status_pending?).and_return(false)
+          expect(smb2_client).to receive(:smb2_sign).with(smb2_request).and_call_original
+          smb2_client.send_recv(smb2_request)
+        end
+
+        it 'calls #smb3_sign if it is an SMB3 client' do
+          allow(smb3_client).to receive(:is_status_pending?).and_return(false)
+          expect(smb3_client).to receive(:smb3_sign).with(smb2_request).and_call_original
+          smb3_client.send_recv(smb2_request)
+        end
+      end
     end
 
-    it 'calls #smb1_sign if it is an SMB1 packet' do
-      expect(client).to receive(:smb1_sign).with(smb1_request).and_call_original
+    it 'sends the expected packet and gets the response' do
+      expect(dispatcher).to receive(:send_packet).with(smb1_request)
+      expect(dispatcher).to receive(:recv_packet)
       client.send_recv(smb1_request)
     end
 
-    it 'calls #smb2_sign if it is an SMB2 packet' do
-      expect(client).to receive(:smb2_sign).with(smb2_request).and_call_original
-      client.send_recv(smb2_request)
+    context 'with SMB1' do
+      it 'does not check if it is a STATUS_PENDING response' do
+        expect(smb1_client).to_not receive(:is_status_pending?)
+        smb1_client.send_recv(smb1_request)
+      end
+
+      it 'set the #uid SMB header when #user_id is defined' do
+        smb1_client.user_id = 333
+        smb1_client.send_recv(smb1_request)
+        expect(smb1_request.smb_header.uid).to eq(333)
+      end
+
+      it 'does not set the #uid SMB header when #user_id is not defined' do
+        smb1_client.send_recv(smb1_request)
+        expect(smb1_request.smb_header.uid).to eq(0)
+      end
+
+      it 'set the #pid SMB header when #pid is defined' do
+        smb1_client.pid = 333
+        smb1_client.send_recv(smb1_request)
+        expect(smb1_request.smb_header.pid_low).to eq(333)
+      end
+
+      it 'does not set the #pid SMB header when #pid is not defined' do
+        smb1_client.pid = nil
+        smb1_client.send_recv(smb1_request)
+        expect(smb1_request.smb_header.pid_low).to eq(0)
+      end
+    end
+
+    context 'with SMB2' do
+      context 'when receiving a STATUS_PENDING response' do
+        it 'waits 1 second and reads/decrypts again' do
+          allow(smb2_client).to receive(:is_status_pending?).and_return(true, false)
+          expect(smb2_client).to receive(:sleep).with(1)
+          expect(dispatcher).to receive(:recv_packet).twice
+          smb2_client.send_recv(smb2_request)
+        end
+      end
+    end
+
+    context 'with SMB3 and encryption' do
+      before :example do
+        smb3_client.dialect = '0x0300'
+        allow(smb3_client).to receive(:is_status_pending?).and_return(false)
+      end
+
+      context 'with a SessionSetupRequest' do
+        it 'does not encrypt/decrypt' do
+          request = RubySMB::SMB2::Packet::SessionSetupRequest.new
+          expect(smb3_client).to receive(:send_packet).with(request, encrypt: false)
+          expect(smb3_client).to receive(:recv_packet).with(encrypt: false)
+          smb3_client.send_recv(request)
+        end
+      end
+
+      context 'with a NegotiateRequest' do
+        it 'does not encrypt/decrypt' do
+          request = RubySMB::SMB2::Packet::NegotiateRequest.new
+          expect(smb3_client).to receive(:send_packet).with(request, encrypt: false)
+          expect(smb3_client).to receive(:recv_packet).with(encrypt: false)
+          smb3_client.send_recv(request)
+        end
+      end
+
+      it 'encrypts and decrypts' do
+        expect(smb3_client).to receive(:send_packet).with(smb2_request, encrypt: true)
+        expect(smb3_client).to receive(:recv_packet).with(encrypt: true)
+        smb3_client.send_recv(smb2_request)
+      end
+
+      context 'when receiving a STATUS_PENDING response' do
+        it 'waits 1 second and reads/decrypts again' do
+          allow(smb3_client).to receive(:is_status_pending?).and_return(true, false)
+          expect(smb3_client).to receive(:sleep).with(1)
+          expect(smb3_client).to receive(:send_packet).with(smb2_request, encrypt: true)
+          expect(smb3_client).to receive(:recv_packet).with(encrypt: true).twice
+          smb3_client.send_recv(smb2_request)
+        end
+      end
+    end
+
+    it 'increments the sequence counter if signing is required and the session key exist' do
+      allow(smb2_client).to receive(:is_status_pending?).and_return(false)
+      smb2_client.signing_required = true
+      smb2_client.session_key = 'key'
+      smb2_client.sequence_counter = 0
+      smb2_client.send_recv(smb2_request)
+      expect(smb2_client.sequence_counter).to eq(1)
+    end
+
+    it 'updates #smb2_message_id with SMB2 header #credit_charge if the server supports multi credits' do
+      allow(smb2_client).to receive(:is_status_pending?).and_return(false)
+      smb2_client.smb2_message_id = 0
+      smb2_client.server_supports_multi_credit = true
+      smb2_header.credit_charge = 5
+      smb2_client.send_recv(smb2_request)
+      expect(smb2_client.smb2_message_id).to eq(5)
+    end
+
+    it 'does not update #msb2_message_id with SMB2 header #credit_charge if the server does not support multi credits' do
+      allow(smb2_client).to receive(:is_status_pending?).and_return(false)
+      smb2_client.smb2_message_id = 0
+      smb2_client.server_supports_multi_credit = false
+      smb2_header.credit_charge = 5
+      smb2_client.send_recv(smb2_request)
+      expect(smb2_client.smb2_message_id).to eq(1)
+    end
+
+    it 'ignores errors thrown when parsing the SMB2 header' do
+      allow(RubySMB::SMB2::SMB2Header).to receive(:read).and_raise(IOError)
+      expect { smb2_client.send_recv(smb2_request) }.to_not raise_error
+    end
+  end
+
+  describe '#is_status_pending?' do
+    let(:response) {
+      res = RubySMB::SMB2::Packet::SessionSetupRequest.new
+      res.smb2_header.nt_status= WindowsError::NTStatus::STATUS_PENDING.value
+      res.smb2_header.flags.async_command = 1
+      res
+    }
+
+    it 'returns true when the response has a STATUS_PENDING status code and the async_command flag set' do
+      expect(client.is_status_pending?(response.smb2_header)).to be true
+    end
+
+    it 'returns false when the response has a STATUS_PENDING status code and the async_command flag not set' do
+      response.smb2_header.flags.async_command = 0
+      expect(client.is_status_pending?(response.smb2_header)).to be false
+    end
+
+    it 'returns false when the response has no STATUS_PENDING status code but the async_command flag set' do
+      response.smb2_header.nt_status= WindowsError::NTStatus::STATUS_SUCCESS.value
+      expect(client.is_status_pending?(response.smb2_header)).to be false
+    end
+  end
+
+  describe '#can_be_encrypted?' do
+    it 'returns true if the packet can be encrypted' do
+      packet = RubySMB::SMB2::Packet::TreeConnectRequest.new
+      expect(client.can_be_encrypted?(packet)).to be true
+    end
+
+    it 'returns false if it is an SMB1 packet' do
+      packet = RubySMB::SMB1::Packet::LogoffRequest.new
+      expect(client.can_be_encrypted?(packet)).to be false
+    end
+
+    [RubySMB::SMB2::Packet::SessionSetupRequest, RubySMB::SMB2::Packet::NegotiateRequest].each do |klass|
+      it "returns false if the packet is a #{klass}" do
+        packet = klass.new
+        expect(client.can_be_encrypted?(packet)).to be false
+      end
+    end
+  end
+
+  describe '#encryption_supported?' do
+    ['0x0300', '0x0302', '0x0311'].each do |dialect|
+      it "returns true if the dialect is #{dialect}" do
+        client.dialect = dialect
+        expect(client.encryption_supported?).to be true
+      end
+    end
+
+    it "returns false if the dialect does not support encryption" do
+      client.dialect = '0x0202'
+      expect(client.encryption_supported?).to be false
+    end
+  end
+
+  describe '#send_packet' do
+    let(:packet) { RubySMB::SMB2::Packet::SessionSetupRequest.new }
+    before :example do
+      allow(dispatcher).to receive(:send_packet)
+      client.dialect = '0x0300'
+    end
+
+    it 'does not encrypt the packet' do
+      expect(client).to_not receive(:smb3_encrypt)
+      client.send_packet(packet)
+    end
+
+    it 'sends the packet through the dispatcher' do
+      client.send_packet(packet)
+      expect(dispatcher).to have_received(:send_packet).with(packet)
+    end
+
+    context 'with encryption' do
+      it 'creates a Transform request' do
+        expect(client).to receive(:smb3_encrypt).with(packet.to_binary_s)
+        client.send_packet(packet, encrypt: true)
+      end
+
+      it 'raises an EncryptionError exception if an error occurs while encrypting' do
+        allow(client).to receive(:smb3_encrypt).and_raise(RubySMB::Error::RubySMBError.new('Error'))
+        expect { client.send_packet(packet, encrypt: true) }.to raise_error(
+          RubySMB::Error::EncryptionError,
+          "Error while encrypting #{packet.class.name} packet (SMB 0x0300): Error"
+        )
+      end
+
+      it 'sends the encrypted packet' do
+        encrypted_packet = double('Encrypted packet')
+        allow(client).to receive(:smb3_encrypt).and_return(encrypted_packet)
+        client.send_packet(packet, encrypt: true)
+        expect(dispatcher).to have_received(:send_packet).with(encrypted_packet)
+      end
+    end
+  end
+
+  describe '#recv_packet' do
+    let(:packet) { RubySMB::SMB2::Packet::SessionSetupRequest.new }
+    before :example do
+      allow(dispatcher).to receive(:recv_packet).and_return(packet.to_binary_s)
+      client.dialect = '0x0300'
+      allow(client).to receive(:smb3_decrypt)
+    end
+
+    it 'reads the response packet' do
+      client.recv_packet
+      expect(dispatcher).to have_received(:recv_packet)
+    end
+
+    it 'raises an CommunicationError exception if an error occurs while receiving the response' do
+      allow(dispatcher).to receive(:recv_packet).and_raise(RubySMB::Error::CommunicationError)
+      expect { client.recv_packet }.to raise_error(RubySMB::Error::CommunicationError)
+    end
+
+    context 'with encryption' do
+      it 'raises an EncryptionError exception if an error occurs while receiving the response' do
+        allow(dispatcher).to receive(:recv_packet).and_raise(RubySMB::Error::CommunicationError)
+        expect { client.recv_packet(encrypt: true) }.to raise_error(
+          RubySMB::Error::EncryptionError,
+          'Communication error with the remote host: RubySMB::Error::CommunicationError. '\
+          'The server supports encryption but was not able to handle the encrypted request.'
+        )
+      end
+
+      it 'parses the response as a Transform response packet' do
+        expect(RubySMB::SMB2::Packet::TransformHeader).to receive(:read).with(packet.to_binary_s)
+        client.recv_packet(encrypt: true)
+      end
+
+      it 'raises an InvalidPacket exception if an error occurs while parsing the response' do
+        allow(RubySMB::SMB2::Packet::TransformHeader).to receive(:read).and_raise(IOError)
+        expect { client.recv_packet(encrypt: true) }.to raise_error(RubySMB::Error::InvalidPacket, 'Not a SMB2 TransformHeader packet')
+      end
+
+      it 'decrypts the Transform response packet' do
+        transform = double('Transform header packet')
+        allow(RubySMB::SMB2::Packet::TransformHeader).to receive(:read).and_return(transform)
+        client.recv_packet(encrypt: true)
+        expect(client).to have_received(:smb3_decrypt).with(transform)
+      end
+
+      it 'raises an EncryptionError exception if an error occurs while decrypting' do
+        allow(client).to receive(:smb3_decrypt).and_raise(RubySMB::Error::RubySMBError)
+        expect { client.recv_packet(encrypt: true) }.to raise_error(
+          RubySMB::Error::EncryptionError,
+          'Error while decrypting RubySMB::SMB2::Packet::TransformHeader packet (SMB 0x0300}): RubySMB::Error::RubySMBError'
+        )
+      end
     end
   end
 
@@ -240,6 +646,44 @@ RSpec.describe RubySMB::Client do
         expect {smb2_client.logoff!}.to raise_error(RubySMB::Error::InvalidPacket)
       end
     end
+
+    context 'with SMB3' do
+      let(:raw_response) { double('Raw response') }
+      let(:logoff_response) {
+        RubySMB::SMB2::Packet::LogoffResponse.new(smb_header: {:command => RubySMB::SMB2::Commands::LOGOFF} )
+      }
+      before :example do
+        allow(smb3_client).to receive(:send_recv).and_return(raw_response)
+        allow(RubySMB::SMB2::Packet::LogoffResponse).to receive(:read).and_return(logoff_response)
+        allow(smb3_client).to receive(:wipe_state!)
+      end
+
+      it 'creates a LogoffRequest packet' do
+        expect(RubySMB::SMB2::Packet::LogoffRequest).to receive(:new).and_call_original
+        smb3_client.logoff!
+      end
+
+      it 'calls #send_recv' do
+        expect(smb3_client).to receive(:send_recv)
+        smb3_client.logoff!
+      end
+
+      it 'reads the raw response as a LogoffResponse packet' do
+        expect(RubySMB::SMB2::Packet::LogoffResponse).to receive(:read).with(raw_response)
+        smb3_client.logoff!
+      end
+
+      it 'raise an InvalidPacket exception when the response is an error packet' do
+        allow(RubySMB::SMB2::Packet::LogoffResponse).to receive(:read).and_return(RubySMB::SMB2::Packet::ErrorPacket.new)
+        expect {smb3_client.logoff!}.to raise_error(RubySMB::Error::InvalidPacket)
+      end
+
+      it 'raise an InvalidPacket exception when the response is not a LOGOFF command' do
+        logoff_response.smb2_header.command = RubySMB::SMB2::Commands::ECHO
+        allow(RubySMB::SMB2::Packet::LogoffResponse).to receive(:read).and_return(logoff_response)
+        expect {smb3_client.logoff!}.to raise_error(RubySMB::Error::InvalidPacket)
+      end
+    end
   end
 
   context 'NetBIOS Session Service' do
@@ -310,7 +754,7 @@ RSpec.describe RubySMB::Client do
         expect(session_packet.session_header.session_packet_type).to eq RubySMB::Nbss::SESSION_REQUEST
         expect(session_packet.called_name).to eq called_name
         expect(session_packet.calling_name).to eq calling_name
-        expect(session_packet.session_header.packet_length).to eq(
+        expect(session_packet.session_header.stream_protocol_length).to eq(
           session_packet.called_name.to_binary_s.size + session_packet.calling_name.to_binary_s.size
         )
       end
@@ -365,7 +809,8 @@ RSpec.describe RubySMB::Client do
       smb1_extended_response.to_binary_s
     }
 
-    let(:smb2_response) { RubySMB::SMB2::Packet::NegotiateResponse.new }
+    let(:smb2_response) { RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x200) }
+    let(:smb3_response) { RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x300) }
 
     describe '#smb1_negotiate_request' do
       it 'returns an SMB1 Negotiate Request packet' do
@@ -373,33 +818,158 @@ RSpec.describe RubySMB::Client do
       end
 
       it 'sets the default SMB1 Dialect' do
-        expect(client.smb1_negotiate_request.dialects).to include(buffer_format: 2, dialect_string: RubySMB::Client::SMB1_DIALECT_SMB1_DEFAULT)
+        expect(client.smb1_negotiate_request.dialects).to include(
+          buffer_format: 2,
+          dialect_string: RubySMB::Client::SMB1_DIALECT_SMB1_DEFAULT
+        )
       end
 
       it 'sets the SMB2.02 dialect if SMB2 support is enabled' do
-        expect(client.smb1_negotiate_request.dialects).to include(buffer_format: 2, dialect_string: RubySMB::Client::SMB1_DIALECT_SMB2_DEFAULT)
+        expect(client.smb1_negotiate_request.dialects).to include(
+          buffer_format: 2,
+          dialect_string: RubySMB::Client::SMB1_DIALECT_SMB2_DEFAULT
+        )
       end
 
       it 'excludes the SMB2.02 Dialect if SMB2 support is disabled' do
-        expect(smb1_client.smb1_negotiate_request.dialects).to_not include(buffer_format: 2, dialect_string: RubySMB::Client::SMB1_DIALECT_SMB2_DEFAULT)
+        expect(smb1_client.smb1_negotiate_request.dialects).to_not include(
+          buffer_format: 2,
+          dialect_string: RubySMB::Client::SMB1_DIALECT_SMB2_DEFAULT
+        )
       end
 
       it 'excludes the default SMB1 Dialect if SMB1 support is disabled' do
-        expect(smb2_client.smb1_negotiate_request.dialects).to_not include(buffer_format: 2, dialect_string: RubySMB::Client::SMB1_DIALECT_SMB1_DEFAULT)
+        expect(smb2_client.smb1_negotiate_request.dialects).to_not include(
+          buffer_format: 2,
+          dialect_string: RubySMB::Client::SMB1_DIALECT_SMB1_DEFAULT
+        )
+      end
+
+      it 'sets the SMB wildcard dialect if SMB2 support is enabled' do
+        expect(client.smb1_negotiate_request.dialects).to include(
+          buffer_format: 2,
+          dialect_string: RubySMB::Client::SMB1_DIALECT_SMB2_WILDCARD
+        )
+      end
+
+      it 'sets the SMB wildcard dialect if SMB3 support is enabled' do
+        expect(smb3_client.smb1_negotiate_request.dialects).to include(
+          buffer_format: 2,
+          dialect_string: RubySMB::Client::SMB1_DIALECT_SMB2_WILDCARD
+        )
+      end
+
+      it 'excludes the SMB wildcard dialect if both SMB2 and SMB3 supports are disabled' do
+        expect(smb1_client.smb1_negotiate_request.dialects).to_not include(
+          buffer_format: 2,
+          dialect_string: RubySMB::Client::SMB1_DIALECT_SMB2_WILDCARD
+        )
       end
     end
 
-    describe '#smb2_negotiate_request' do
+    describe '#smb2_3_negotiate_request' do
       it 'return an SMB2 Negotiate Request packet' do
-        expect(client.smb2_negotiate_request).to be_a(RubySMB::SMB2::Packet::NegotiateRequest)
+        expect(client.smb2_3_negotiate_request).to be_a(RubySMB::SMB2::Packet::NegotiateRequest)
       end
 
-      it 'sets the default SMB2 Dialect' do
-        expect(client.smb2_negotiate_request.dialects).to include(RubySMB::Client::SMB2_DIALECT_DEFAULT)
+      it 'sets the default SMB2 Dialect if SMB2 support is enabled' do
+        expect(client.smb2_3_negotiate_request.dialects).to include(
+          *(RubySMB::Client::SMB2_DIALECT_DEFAULT.map {|d| d.to_i(16)})
+        )
+      end
+
+      it 'does not set the default SMB2 Dialect if SMB2 support is disabled' do
+        expect(smb3_client.smb2_3_negotiate_request.dialects).to_not include(
+          *(RubySMB::Client::SMB2_DIALECT_DEFAULT.map {|d| d.to_i(16)})
+        )
       end
 
       it 'sets the Message ID to 0' do
-        expect(client.smb2_negotiate_request.smb2_header.message_id).to eq 0
+        expect(client.smb2_3_negotiate_request.smb2_header.message_id).to eq 0
+      end
+
+      it 'adds SMB3 dialects if if SMB3 support is enabled' do
+        expect(client.smb2_3_negotiate_request.dialects).to include(
+          *(RubySMB::Client::SMB3_DIALECT_DEFAULT.map {|d| d.to_i(16)})
+        )
+      end
+
+      it 'does not set the default SMB3 Dialect if SMB3 support is disabled' do
+        expect(smb2_client.smb2_3_negotiate_request.dialects).to_not include(
+          *(RubySMB::Client::SMB3_DIALECT_DEFAULT.map {|d| d.to_i(16)})
+        )
+      end
+    end
+
+    describe '#add_smb3_to_negotiate_request' do
+      let(:negotiate_request) { RubySMB::SMB2::Packet::NegotiateRequest.new }
+
+      it 'adds the default SMB3 dialects' do
+        expect(client.add_smb3_to_negotiate_request(negotiate_request).dialects).to include(
+          *(RubySMB::Client::SMB3_DIALECT_DEFAULT.map {|d| d.to_i(16)})
+        )
+      end
+
+      it 'raises the expected exception when the dialects is not an array of strings' do
+        dialects = ['0x0300', 0x0302, '0x0311']
+        expect { client.add_smb3_to_negotiate_request(negotiate_request, dialects) }.to raise_error(ArgumentError)
+      end
+
+      it 'sets encryption capability flag' do
+        expect(client.add_smb3_to_negotiate_request(negotiate_request).capabilities.encryption).to eq(1)
+      end
+
+      context 'when the negotiate packet includes the 0x0311 dialect' do
+        before :example do
+          client.add_smb3_to_negotiate_request(negotiate_request, ['0x0311'])
+        end
+
+        it 'adds 3 Negotiate Contexts' do
+          expect(negotiate_request.negotiate_context_info.negotiate_context_count).to eq(3)
+        end
+
+        it 'adds a Preauth Integrity Negotiate Context with the expected hash algorithms' do
+          nc = negotiate_request.negotiate_context_list.select do |n|
+              n.context_type == RubySMB::SMB2::NegotiateContext::SMB2_PREAUTH_INTEGRITY_CAPABILITIES
+          end
+          expect(nc.length).to eq(1)
+          expect(nc.first.data.hash_algorithms).to eq([RubySMB::SMB2::PreauthIntegrityCapabilities::SHA_512])
+        end
+
+        it 'adds Encryption Negotiate Contexts with the expected encryption algorithms' do
+          nc = negotiate_request.negotiate_context_list.select do |n|
+              n.context_type == RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
+          end
+          expect(nc.length).to eq(1)
+          expect(nc.first.data.ciphers).to eq(
+            [
+              RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM,
+              RubySMB::SMB2::EncryptionCapabilities::AES_128_GCM
+            ]
+          )
+        end
+
+        it 'adds Compression Negotiate Contexts with the expected compression algorithms' do
+          nc = negotiate_request.negotiate_context_list.select do |n|
+              n.context_type == RubySMB::SMB2::NegotiateContext::SMB2_COMPRESSION_CAPABILITIES
+          end
+          expect(nc.length).to eq(1)
+          expect(nc.first.data.compression_algorithms).to eq(
+            [
+              RubySMB::SMB2::CompressionCapabilities::LZNT1,
+              RubySMB::SMB2::CompressionCapabilities::LZ77,
+              RubySMB::SMB2::CompressionCapabilities::LZ77_Huffman,
+              RubySMB::SMB2::CompressionCapabilities::Pattern_V1
+            ]
+          )
+        end
+      end
+
+      context 'when the negotiate packet does not include the 0x0311 dialect' do
+        it 'does not add any Negotiate Context' do
+          client.add_smb3_to_negotiate_request(negotiate_request, ['0x0300', '0x0302'])
+          expect(negotiate_request.negotiate_context_list?). to be false
+        end
       end
     end
 
@@ -414,10 +984,15 @@ RSpec.describe RubySMB::Client do
         client.negotiate_request
       end
 
-      it 'calls #smb2_negotiate_request if SMB2 is enabled' do
-        expect(smb2_client).to receive(:smb2_negotiate_request)
+      it 'calls #smb2_3_negotiate_request if SMB2 is enabled' do
+        expect(smb2_client).to receive(:smb2_3_negotiate_request)
         smb2_client.negotiate_request
       end
+
+      it 'calls #smb2_3_negotiate_request if SMB3 is enabled' do
+        expect(smb3_client).to receive(:smb2_3_negotiate_request)
+        smb3_client.negotiate_request
+      end
     end
 
     describe '#negotiate_response' do
@@ -464,12 +1039,28 @@ RSpec.describe RubySMB::Client do
         end
       end
 
-      context 'with SMB1 and SMB2 enabled' do
+      context 'with only SMB3' do
+        it 'returns a properly formed packet' do
+          expect(smb3_client.negotiate_response(smb2_response.to_binary_s)).to eq smb2_response
+        end
+
+        it 'raises an exception if the Response is invalid' do
+          expect { smb3_client.negotiate_response(random_junk) }.to raise_error(RubySMB::Error::InvalidPacket)
+        end
+
+        it 'considers the response invalid if it is not an actual Negotiate Response' do
+          bogus_response = smb2_response
+          bogus_response.smb2_header.command = RubySMB::SMB2::Commands::ECHO
+          expect { smb3_client.negotiate_response(bogus_response.to_binary_s) }.to raise_error(RubySMB::Error::InvalidPacket)
+        end
+      end
+
+      context 'with SMB1, SMB2 and SMB3 enabled' do
         it 'returns an SMB1 NegotiateResponse if it looks like SMB1' do
           expect(client.negotiate_response(smb1_extended_response_raw)).to eq smb1_extended_response
         end
 
-        it 'returns an SMB2 NegotiateResponse if it looks like SMB2' do
+        it 'returns an SMB2 NegotiateResponse if it looks like SMB2 or SMB3' do
           expect(client.negotiate_response(smb2_response.to_binary_s)).to eq smb2_response
         end
       end
@@ -477,9 +1068,10 @@ RSpec.describe RubySMB::Client do
 
     describe '#parse_negotiate_response' do
       context 'when SMB1 was Negotiated' do
-        it 'turns off SMB2 support' do
+        it 'turns off SMB2 and SMB3 support' do
           client.parse_negotiate_response(smb1_extended_response)
           expect(client.smb2).to be false
+          expect(client.smb3).to be false
         end
 
         it 'sets whether or not signing is required' do
@@ -502,12 +1094,18 @@ RSpec.describe RubySMB::Client do
         it 'returns the string \'SMB1\'' do
           expect(client.parse_negotiate_response(smb1_extended_response)).to eq ('SMB1')
         end
+
+        it 'sets #negotiated_smb_version to 1' do
+          client.parse_negotiate_response(smb1_extended_response)
+          expect(client.negotiated_smb_version).to eq(1)
+        end
       end
 
       context 'when SMB2 was negotiated' do
-        it 'turns off SMB1 support' do
+        it 'turns off SMB1 and SMB3 support' do
           client.parse_negotiate_response(smb2_response)
           expect(client.smb1).to be false
+          expect(client.smb3).to be false
         end
 
         it 'sets whether or not signing is required' do
@@ -525,10 +1123,142 @@ RSpec.describe RubySMB::Client do
         it 'returns the string \'SMB2\'' do
           expect(client.parse_negotiate_response(smb2_response)).to eq ('SMB2')
         end
+
+        it 'sets #server_supports_multi_credit to true when the response has #large_mtu capability set' do
+          smb2_response.capabilities.large_mtu = 1
+          client.parse_negotiate_response(smb2_response)
+          expect(client.server_supports_multi_credit).to be true
+        end
+
+        it 'sets #server_supports_multi_credit to false when the dialect is 0x0202' do
+          smb2_response.dialect_revision = 0x0202
+          smb2_response.capabilities.large_mtu = 1 # just to make sure it won't affect the result
+          client.parse_negotiate_response(smb2_response)
+          expect(client.server_supports_multi_credit).to be false
+        end
+      end
+
+      context 'when SMB3 was negotiated' do
+        it 'turns off SMB1 and SMB2 support' do
+          client.parse_negotiate_response(smb3_response)
+          expect(client.smb1).to be false
+          expect(client.smb2).to be false
+        end
+
+        it 'sets whether or not signing is required' do
+          smb3_response.security_mode.signing_required = 1
+          client.parse_negotiate_response(smb3_response)
+          expect(client.signing_required).to be true
+        end
+
+        it 'sets #dialect to the negotiated dialect' do
+          client.parse_negotiate_response(smb3_response)
+          expect(client.dialect).to eq '0x0300'
+        end
+
+        it 'returns the string \'SMB2\'' do
+          expect(client.parse_negotiate_response(smb3_response)).to eq ('SMB3')
+        end
+
+        it 'sets #server_supports_multi_credit to true when the response has #large_mtu capability set' do
+          smb3_response.capabilities.large_mtu = 1
+          client.parse_negotiate_response(smb3_response)
+          expect(client.server_supports_multi_credit).to be true
+        end
+
+        context 'when the server supports encryption' do
+          before :example do
+            smb3_response.capabilities.encryption = 1
+          end
+
+          it 'sets the expected encryption algorithm' do
+            client.parse_negotiate_response(smb3_response)
+            expect(client.encryption_algorithm).to eq(RubySMB::SMB2::EncryptionCapabilities::ENCRYPTION_ALGORITHM_MAP[RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM])
+          end
+
+          it 'keeps session encryption enabled if it was already' do
+            client.session_encrypt_data = true
+            client.parse_negotiate_response(smb3_response)
+            expect(client.session_encrypt_data).to be true
+          end
+
+          it 'keeps session encryption disabled if it was already' do
+            client.session_encrypt_data = false
+            client.parse_negotiate_response(smb3_response)
+            expect(client.session_encrypt_data).to be false
+          end
+        end
+
+        context 'when the server does not support encryption' do
+          before :example do
+            smb3_response.capabilities.encryption = 0
+          end
+
+          it 'disables session encryption if it was already enabled' do
+            client.session_encrypt_data = true
+            client.parse_negotiate_response(smb3_response)
+            expect(client.session_encrypt_data).to be false
+          end
+
+          it 'keeps session encryption disabled if it was already' do
+            client.session_encrypt_data = false
+            client.parse_negotiate_response(smb3_response)
+            expect(client.session_encrypt_data).to be false
+          end
+        end
+      end
+
+      context 'when the response contains the SMB2 wildcard revision number dialect' do
+        it 'only turns off SMB1 support' do
+          smb2_response = RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x02ff)
+          client.parse_negotiate_response(smb2_response)
+          expect(client.smb1).to be false
+          expect(client.smb2).to be true
+          expect(client.smb3).to be true
+        end
+      end
+
+      context 'when the negotiation failed' do
+        context 'with a STATUS_NOT_SUPPORTED status code' do
+          before :example do
+            error_packet.smb2_header.nt_status = WindowsError::NTStatus::STATUS_NOT_SUPPORTED.value
+          end
+
+          it 'raises the expected exception with SMB2' do
+            expect { smb2_client.parse_negotiate_response(error_packet) }.to raise_error(
+            RubySMB::Error::NegotiationFailure,
+            'Unable to negotiate with remote host, SMB2 not supported'
+            )
+          end
+
+          it 'raises the expected exception with SMB3' do
+            expect { smb3_client.parse_negotiate_response(error_packet) }.to raise_error(
+            RubySMB::Error::NegotiationFailure,
+            'Unable to negotiate with remote host, SMB3 not supported'
+            )
+          end
+        end
+
+        context 'with an unknown status code' do
+          it 'raises the expected exception' do
+            expect { client.parse_negotiate_response(empty_packet) }.to raise_error(
+            RubySMB::Error::NegotiationFailure,
+            'Unable to negotiate with remote host'
+            )
+          end
+        end
       end
     end
 
     describe '#negotiate' do
+      let(:request_packet) { client.smb1_negotiate_request }
+      before :example do
+        allow(client).to receive(:negotiate_request)
+        allow(client).to receive(:send_recv)
+        allow(client).to receive(:negotiate_response)
+        allow(client).to receive(:parse_negotiate_response)
+      end
+
       it 'calls the backing methods' do
         expect(client).to receive(:negotiate_request)
         expect(client).to receive(:send_recv)
@@ -537,18 +1267,247 @@ RSpec.describe RubySMB::Client do
         client.negotiate
       end
 
-      it 'sets the response-packet #dialects array with the dialects sent in the request' do
-        request_packet = client.smb1_negotiate_request
-        allow(client).to receive(:negotiate_request).and_return(request_packet)
-        allow(client).to receive(:send_recv)
-        allow(client).to receive(:negotiate_response).and_return(smb1_extended_response)
-        expect(smb1_extended_response).to receive(:dialects=).with(request_packet.dialects)
-        client.negotiate
+      context 'with SMB1' do
+        it 'sets the response-packet #dialects array with the dialects sent in the request' do
+          request_packet = client.smb1_negotiate_request
+          allow(client).to receive(:negotiate_request).and_return(request_packet)
+          allow(client).to receive(:negotiate_response).and_return(smb1_extended_response)
+          expect(smb1_extended_response).to receive(:dialects=).with(request_packet.dialects)
+          client.negotiate
+        end
       end
 
-      it 'raise the expected exception if an error occurs' do
-        allow(client).to receive(:send_recv).and_raise(RubySMB::Error::InvalidPacket)
-        expect { client.negotiate }.to raise_error(RubySMB::Error::NegotiationFailure)
+      context "with 0x0311 dialect" do
+        it 'calls #parse_negotiate_response and updates the preauth hash' do
+          client.dialect = '0x0311'
+          request_packet = client.smb2_3_negotiate_request
+          allow(client).to receive(:negotiate_request).and_return(request_packet)
+          allow(client).to receive(:negotiate_response).and_return(smb3_response)
+          expect(client).to receive(:parse_negotiate_response).with(smb3_response)
+          expect(client).to receive(:update_preauth_hash).with(request_packet)
+          expect(client).to receive(:update_preauth_hash).with(smb3_response)
+          client.negotiate
+        end
+      end
+
+      context 'with a wildcard revision number response' do
+        before :example do
+          client.dialect = '0x02ff'
+          allow(client).to receive(:smb2_message_id=) do
+            client.dialect = '0x0202'
+          end
+        end
+
+        it 'increments the message ID' do
+          expect(client).to receive(:smb2_message_id=).with(1)
+          client.negotiate
+        end
+
+        it 're-negotiates' do
+          expect(client).to receive(:negotiate_request).twice
+          expect(client).to receive(:send_recv).twice
+          expect(client).to receive(:negotiate_response).twice
+          expect(client).to receive(:parse_negotiate_response).twice
+          client.negotiate
+        end
+      end
+
+      context 'when an error occurs' do
+        before :example do
+          allow(client).to receive(:negotiate_request).and_return(request_packet)
+          allow(client).to receive(:send_recv).and_raise(RubySMB::Error::InvalidPacket)
+          client.smb1 = false
+          client.smb2 = false
+          client.smb3 = false
+        end
+
+        context 'with SMB1' do
+          let(:request_packet) { client.smb1_negotiate_request }
+
+          it 'raise the expected exception' do
+            client.smb1 = true
+            expect { client.negotiate }.to raise_error(
+              RubySMB::Error::NegotiationFailure,
+              "Unable to negotiate SMB1 with the remote host: RubySMB::Error::InvalidPacket"
+            )
+          end
+        end
+
+        context 'with SMB2' do
+          let(:request_packet) { client.smb2_3_negotiate_request }
+
+          it 'raise the expected exception' do
+            client.smb2 = true
+            expect { client.negotiate }.to raise_error(
+              RubySMB::Error::NegotiationFailure,
+              "Unable to negotiate SMB2 with the remote host: RubySMB::Error::InvalidPacket"
+            )
+          end
+        end
+
+        context 'with SMB3' do
+          let(:request_packet) { client.smb2_3_negotiate_request }
+
+          it 'raise the expected exception' do
+            client.smb3 = true
+            expect { client.negotiate }.to raise_error(
+              RubySMB::Error::NegotiationFailure,
+              "Unable to negotiate SMB3 with the remote host: RubySMB::Error::InvalidPacket"
+            )
+          end
+        end
+      end
+
+      describe '#parse_smb3_capabilities' do
+        let(:request_packet) { client.smb2_3_negotiate_request }
+        let(:smb3_response) { RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x311) }
+        let(:nc_encryption) do
+          nc = RubySMB::SMB2::NegotiateContext.new(
+            context_type: RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
+          )
+          nc.data.ciphers << RubySMB::SMB2::EncryptionCapabilities::AES_128_CCM
+          nc
+        end
+        let(:nc_integrity) do
+          nc = RubySMB::SMB2::NegotiateContext.new(
+            context_type: RubySMB::SMB2::NegotiateContext::SMB2_PREAUTH_INTEGRITY_CAPABILITIES
+          )
+          nc.data.hash_algorithms << RubySMB::SMB2::PreauthIntegrityCapabilities::SHA_512
+          nc
+        end
+
+        before :example do
+          allow(smb3_client).to receive(:update_preauth_hash)
+          smb3_response.add_negotiate_context(nc_encryption)
+          smb3_response.add_negotiate_context(nc_integrity)
+        end
+
+        context 'when selecting the integrity hash algorithm' do
+          context 'with one algorithm' do
+            it 'selects the expected algorithm' do
+              smb3_client.parse_smb3_capabilities(smb3_response)
+              expect(smb3_client.preauth_integrity_hash_algorithm).to eq('SHA512')
+            end
+          end
+
+          context 'with multiple algorithms' do
+            it 'selects the first algorithm' do
+              nc = smb3_response.find_negotiate_context(
+                RubySMB::SMB2::NegotiateContext::SMB2_PREAUTH_INTEGRITY_CAPABILITIES
+              )
+              nc.data.hash_algorithms << 3
+              smb3_client.parse_smb3_capabilities(smb3_response)
+              expect(smb3_client.preauth_integrity_hash_algorithm).to eq('SHA512')
+            end
+          end
+
+          context 'without integrity negotiate context' do
+            it 'raises the expected exception' do
+              smb3_response = RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x311)
+              smb3_response.add_negotiate_context(nc_encryption)
+              expect { smb3_client.parse_smb3_capabilities(smb3_response) }.to raise_error(
+                RubySMB::Error::EncryptionError,
+                'Unable to retrieve the Preauth Integrity Hash Algorithm from the Negotiate response'
+              )
+            end
+          end
+
+          context 'with an unknown integrity hash algorithm' do
+            it 'raises the expected exception' do
+              smb3_response = RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x311)
+              smb3_response.add_negotiate_context(nc_encryption)
+              nc = RubySMB::SMB2::NegotiateContext.new(
+                context_type: RubySMB::SMB2::NegotiateContext::SMB2_PREAUTH_INTEGRITY_CAPABILITIES
+              )
+              nc.data.hash_algorithms << 5
+              smb3_response.add_negotiate_context(nc)
+              expect { smb3_client.parse_smb3_capabilities(smb3_response) }.to raise_error(
+                RubySMB::Error::EncryptionError,
+                'Unable to retrieve the Preauth Integrity Hash Algorithm from the Negotiate response'
+              )
+            end
+          end
+        end
+
+        context 'when selecting the encryption algorithm' do
+          context 'with one algorithm' do
+            it 'selects the expected algorithm' do
+              smb3_client.parse_smb3_capabilities(smb3_response)
+              expect(smb3_client.encryption_algorithm).to eq('AES-128-CCM')
+            end
+          end
+
+          context 'with multiple algorithms' do
+            it 'selects the AES-128-GCM algorithm if included' do
+              nc = smb3_response.find_negotiate_context(
+                RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
+              )
+              nc.data.ciphers << RubySMB::SMB2::EncryptionCapabilities::AES_128_GCM
+              smb3_client.parse_smb3_capabilities(smb3_response)
+              expect(smb3_client.encryption_algorithm).to eq('AES-128-GCM')
+            end
+
+            it 'selects the first algorithm if AES-128-GCM is not included' do
+              nc = smb3_response.find_negotiate_context(
+                RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
+              )
+              nc.data.ciphers << 3
+              smb3_client.parse_smb3_capabilities(smb3_response)
+              expect(smb3_client.encryption_algorithm).to eq('AES-128-CCM')
+            end
+
+            it 'keep tracks of the server supported algorithms' do
+              nc = smb3_response.find_negotiate_context(
+                RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
+              )
+              nc.data.ciphers << RubySMB::SMB2::EncryptionCapabilities::AES_128_GCM
+              smb3_client.parse_smb3_capabilities(smb3_response)
+              expect(smb3_client.server_encryption_algorithms).to eq([1, 2])
+            end
+          end
+
+          context 'without encryption context' do
+            it 'raises the expected exception' do
+              smb3_response = RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x311)
+              smb3_response.add_negotiate_context(nc_integrity)
+              expect { smb3_client.parse_smb3_capabilities(smb3_response) }.to raise_error(
+                RubySMB::Error::EncryptionError,
+                'Unable to retrieve the encryption cipher list supported by the server from the Negotiate response'
+              )
+            end
+          end
+
+          context 'with an unknown encryption algorithm' do
+            it 'raises the expected exception' do
+              smb3_response = RubySMB::SMB2::Packet::NegotiateResponse.new(dialect_revision: 0x311)
+              smb3_response.add_negotiate_context(nc_integrity)
+              nc = RubySMB::SMB2::NegotiateContext.new(
+                context_type: RubySMB::SMB2::NegotiateContext::SMB2_ENCRYPTION_CAPABILITIES
+              )
+              nc.data.ciphers << 14
+              smb3_response.add_negotiate_context(nc)
+              expect { smb3_client.parse_smb3_capabilities(smb3_response) }.to raise_error(
+                RubySMB::Error::EncryptionError,
+                'Unable to retrieve the encryption cipher list supported by the server from the Negotiate response'
+              )
+            end
+          end
+        end
+
+        context 'when selecting the compression algorithm' do
+          it 'keep tracks of the server supported algorithms' do
+            nc = RubySMB::SMB2::NegotiateContext.new(
+              context_type: RubySMB::SMB2::NegotiateContext::SMB2_COMPRESSION_CAPABILITIES
+            )
+            nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::LZNT1
+            nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::LZ77
+            nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::LZ77_Huffman
+            nc.data.compression_algorithms << RubySMB::SMB2::CompressionCapabilities::Pattern_V1
+            smb3_response.add_negotiate_context(nc)
+            smb3_client.parse_smb3_capabilities(smb3_response)
+            expect(smb3_client.server_compression_algorithms).to eq([1, 2, 3, 4])
+          end
+        end
       end
     end
   end
@@ -875,6 +1834,39 @@ RSpec.describe RubySMB::Client do
           smb2_client.smb2_authenticate
           expect(smb2_client.os_version).to eq '6.1.7601'
         end
+
+        ['0x0202', '0x0210', '0x0300', '0x0302'].each do |dialect|
+          it "does not update the preauth hash with dialect #{dialect}" do
+            smb2_client.dialect = dialect
+            expect(smb2_client).to_not receive(:update_preauth_hash)
+            smb2_client.smb2_authenticate
+          end
+        end
+
+        it "updates the preauth hash with dialect 0x0311" do
+          smb2_client.dialect = '0x0311'
+          expect(smb2_client).to receive(:update_preauth_hash).with(response_packet)
+          smb2_client.smb2_authenticate
+        end
+
+        context 'when setting the session_encrypt_data parameter' do
+          before :example do
+            smb2_client.smb3 = true
+            smb2_client.session_encrypt_data = false
+          end
+
+          it 'sets the session_encrypt_data parameter to true if the server requires encryption' do
+            final_response_packet.session_flags.encrypt_data = 1
+            smb2_client.smb2_authenticate
+            expect(smb2_client.session_encrypt_data).to be true
+          end
+
+          it 'does not set the session_encrypt_data parameter if the server does not require encryption' do
+            final_response_packet.session_flags.encrypt_data = 0
+            smb2_client.smb2_authenticate
+            expect(smb2_client.session_encrypt_data).to be false
+          end
+        end
       end
 
       describe '#smb2_ntlmssp_negotiate_packet' do
@@ -890,20 +1882,34 @@ RSpec.describe RubySMB::Client do
           smb2_client.smb2_ntlmssp_negotiate_packet
         end
 
-        it 'sets the message ID in the packet header to 1' do
-          expect(smb2_client.smb2_ntlmssp_negotiate_packet.smb2_header.message_id).to eq 1
-        end
-
-        it 'increments client#smb2_message_id' do
-          expect { smb2_client.smb2_ntlmssp_negotiate_packet }.to change(smb2_client, :smb2_message_id).to(2)
+        it 'enables signing' do
+          expect(smb2_client.smb2_ntlmssp_negotiate_packet.security_mode.signing_enabled).to eq 1
         end
       end
 
       describe '#smb2_ntlmssp_negotiate' do
+        before :example do
+          allow(smb2_client).to receive(:smb2_ntlmssp_negotiate_packet).and_return(negotiate_packet)
+          allow(smb2_client).to receive(:send_recv)
+        end
+
         it 'sends the request packet and receives a response' do
-          expect(smb2_client).to receive(:smb2_ntlmssp_negotiate_packet).and_return(negotiate_packet)
-          expect(dispatcher).to receive(:send_packet).with(negotiate_packet)
-          expect(dispatcher).to receive(:recv_packet)
+          expect(smb2_client).to receive(:smb2_ntlmssp_negotiate_packet)
+          expect(smb2_client).to receive(:send_recv).with(negotiate_packet)
+          smb2_client.smb2_ntlmssp_negotiate
+        end
+
+        ['0x0202', '0x0210', '0x0300', '0x0302'].each do |dialect|
+          it "does not update the preauth hash with dialect #{dialect}" do
+            smb2_client.dialect = dialect
+            expect(smb2_client).to_not receive(:update_preauth_hash)
+            smb2_client.smb2_ntlmssp_negotiate
+          end
+        end
+
+        it "updates the preauth hash with dialect 0x0311" do
+          smb2_client.dialect = '0x0311'
+          expect(smb2_client).to receive(:update_preauth_hash).with(negotiate_packet)
           smb2_client.smb2_ntlmssp_negotiate
         end
       end
@@ -961,13 +1967,35 @@ RSpec.describe RubySMB::Client do
         it 'sets the session ID on the request packet' do
           expect(smb2_client.smb2_ntlmssp_auth_packet(type3_message, session_id).smb2_header.session_id).to eq session_id
         end
+
+        it 'enables signing' do
+          expect(smb2_client.smb2_ntlmssp_auth_packet(type3_message, session_id).security_mode.signing_enabled).to eq 1
+        end
       end
 
       describe '#smb2_ntlmssp_authenticate' do
+        before :example do
+          allow(smb2_client).to receive(:smb2_ntlmssp_auth_packet).and_return(negotiate_packet)
+          allow(smb2_client).to receive(:send_recv)
+        end
+
         it 'sends the request packet and receives a response' do
-          expect(smb2_client).to receive(:smb2_ntlmssp_auth_packet).and_return(negotiate_packet)
-          expect(dispatcher).to receive(:send_packet).with(negotiate_packet)
-          expect(dispatcher).to receive(:recv_packet)
+          expect(smb2_client).to receive(:smb2_ntlmssp_auth_packet)
+          expect(smb2_client).to receive(:send_recv).with(negotiate_packet)
+          smb2_client.smb2_ntlmssp_authenticate(type3_message, session_id)
+        end
+
+        ['0x0202', '0x0210', '0x0300', '0x0302'].each do |dialect|
+          it "does not update the preauth hash with dialect #{dialect}" do
+            smb2_client.dialect = dialect
+            expect(smb2_client).to_not receive(:update_preauth_hash)
+            smb2_client.smb2_ntlmssp_authenticate(type3_message, session_id)
+          end
+        end
+
+        it "updates the preauth hash with dialect 0x0311" do
+          smb2_client.dialect = '0x0311'
+          expect(smb2_client).to receive(:update_preauth_hash).with(negotiate_packet)
           smb2_client.smb2_ntlmssp_authenticate(type3_message, session_id)
         end
       end
@@ -1103,6 +2131,108 @@ RSpec.describe RubySMB::Client do
         end
       end
     end
+
+    describe '#smb3_sign' do
+      context 'if signing is required and we have a session key' do
+        let(:request) {
+          packet = RubySMB::SMB2::Packet::SessionSetupRequest.new
+          packet.smb2_header.flags.signed = 1
+          packet.smb2_header.signature = "\x00" * 16
+          packet
+        }
+        let(:session_key) { 'Session Key' }
+        before :example do
+          smb3_client.session_key = session_key
+          smb3_client.signing_required = true
+        end
+
+        ['0x0300', '0x0302'].each do |dialect|
+          context "with #{dialect} dialect" do
+            it 'generates the signing key based on the session key and specific strings, and sign the packet with CMAC' do
+              smb3_client.dialect = dialect
+              fake_hash = "\x34\xc0\x40\xfe\x87\xcf\x49\x3d\x37\x87\x52\xd0\xd5\xf5\xfb\x86".b
+              signing_key = RubySMB::Crypto::KDF.counter_mode(session_key, "SMB2AESCMAC\x00", "SmbSign\x00")
+              expect(RubySMB::Crypto::KDF).to receive(:counter_mode).with(session_key, "SMB2AESCMAC\x00", "SmbSign\x00").and_call_original
+              expect(OpenSSL::CMAC).to receive(:digest).with('AES', signing_key, request.to_binary_s).and_call_original
+              expect(smb3_client.smb3_sign(request).smb2_header.signature).to eq fake_hash
+            end
+          end
+        end
+
+        context "with 0x0311 dialect" do
+          it 'generates the signing key based on the session key, the preauth integrity hash and specific strings, and sign the packet with CMAC' do
+            smb3_client.dialect = '0x0311'
+            preauth_integrity_hash_value = 'Preauth Integrity Hash'
+            fake_hash = "\x0e\x49\x6f\x8e\x74\x7c\xf2\xa0\x88\x5e\x9d\x54\xff\x0d\x0d\xfa".b
+            smb3_client.preauth_integrity_hash_value = preauth_integrity_hash_value
+            signing_key = RubySMB::Crypto::KDF.counter_mode(session_key, "SMBSigningKey\x00", preauth_integrity_hash_value)
+            expect(RubySMB::Crypto::KDF).to receive(:counter_mode).with(session_key, "SMBSigningKey\x00", preauth_integrity_hash_value).and_call_original
+            expect(OpenSSL::CMAC).to receive(:digest).with('AES', signing_key, request.to_binary_s).and_call_original
+            expect(smb3_client.smb3_sign(request).smb2_header.signature).to eq fake_hash
+          end
+        end
+
+        context 'with an incompatible dialect' do
+          it 'raises the expected exception' do
+            smb3_client.dialect = '0x0202'
+            expect { smb3_client.smb3_sign(request) }.to raise_error(
+              RubySMB::Error::SigningError,
+              'Dialect is incompatible with SMBv3 signing'
+            )
+          end
+        end
+      end
+
+      context 'if signing is not required but it is a TreeConnectRequest and we have a session key' do
+        let(:request) {
+          packet = RubySMB::SMB2::Packet::TreeConnectRequest.new
+          packet.smb2_header.flags.signed = 1
+          packet.smb2_header.signature = "\x00" * 16
+          packet
+        }
+        let(:session_key) { 'Session Key' }
+        before :example do
+          smb3_client.session_key = session_key
+          smb3_client.signing_required = false
+        end
+
+        ['0x0300', '0x0302'].each do |dialect|
+          context "with #{dialect} dialect" do
+            it 'generates the signing key based on the session key and specific strings, and sign the packet with CMAC' do
+              smb3_client.dialect = dialect
+              fake_hash = "\x34\x9e\x28\xb9\x50\x08\x34\x31\xc0\x83\x9d\xba\x56\xa5\x70\xa4".b
+              signing_key = RubySMB::Crypto::KDF.counter_mode(session_key, "SMB2AESCMAC\x00", "SmbSign\x00")
+              expect(RubySMB::Crypto::KDF).to receive(:counter_mode).with(session_key, "SMB2AESCMAC\x00", "SmbSign\x00").and_call_original
+              expect(OpenSSL::CMAC).to receive(:digest).with('AES', signing_key, request.to_binary_s).and_call_original
+              expect(smb3_client.smb3_sign(request).smb2_header.signature).to eq fake_hash
+            end
+          end
+        end
+
+        context "with 0x0311 dialect" do
+          it 'generates the signing key based on the session key, the preauth integrity hash and specific strings, and sign the packet with CMAC' do
+            smb3_client.dialect = '0x0311'
+            preauth_integrity_hash_value = 'Preauth Integrity Hash'
+            fake_hash = "\x83\xd9\x31\x39\x60\x46\xbe\x1e\x29\x34\xc8\xcf\x8c\x8e\xb4\x73".b
+            smb3_client.preauth_integrity_hash_value = preauth_integrity_hash_value
+            signing_key = RubySMB::Crypto::KDF.counter_mode(session_key, "SMBSigningKey\x00", preauth_integrity_hash_value)
+            expect(RubySMB::Crypto::KDF).to receive(:counter_mode).with(session_key, "SMBSigningKey\x00", preauth_integrity_hash_value).and_call_original
+            expect(OpenSSL::CMAC).to receive(:digest).with('AES', signing_key, request.to_binary_s).and_call_original
+            expect(smb3_client.smb3_sign(request).smb2_header.signature).to eq fake_hash
+          end
+        end
+
+        context 'with an incompatible dialect' do
+          it 'raises the expected exception' do
+            smb3_client.dialect = '0x0202'
+            expect { smb3_client.smb3_sign(request) }.to raise_error(
+              RubySMB::Error::SigningError,
+              'Dialect is incompatible with SMBv3 signing'
+            )
+          end
+        end
+      end
+    end
   end
 
   context '#increment_smb_message_id' do
@@ -1156,7 +2286,10 @@ RSpec.describe RubySMB::Client do
 
         it 'raises an UnexpectedStatusCode exception if we do not get STATUS_SUCCESS' do
           response.smb_header.nt_status = 0xc0000015
-          expect { smb1_client.smb1_tree_from_response(path, response) }.to raise_error(RubySMB::Error::UnexpectedStatusCode, 'STATUS_NONEXISTENT_SECTOR')
+          expect { smb1_client.smb1_tree_from_response(path, response) }.to raise_error(
+            RubySMB::Error::UnexpectedStatusCode,
+            'The server responded with an unexpected status code: STATUS_NONEXISTENT_SECTOR'
+          )
         end
 
         it 'creates a new Tree from itself, the share path, and the response packet' do
@@ -1177,11 +2310,14 @@ RSpec.describe RubySMB::Client do
       }
 
       describe '#smb2_tree_connect' do
-        it 'builds and sends a TreeconnectRequest for the supplied share' do
+        it 'builds and sends the expected TreeconnectRequest for the supplied share' do
           allow(RubySMB::SMB2::Packet::TreeConnectRequest).to receive(:new).and_return(request)
-          modified_request = request
-          modified_request.encode_path(path)
-          expect(smb2_client).to receive(:send_recv).with(modified_request).and_return(response.to_binary_s)
+          expect(smb2_client).to receive(:send_recv) do |req|
+            expect(req).to eq(request)
+            expect(req.smb2_header.tree_id).to eq(65_535)
+            expect(req.path).to eq(path.encode('UTF-16LE'))
+            response.to_binary_s
+          end
           smb2_client.smb2_tree_connect(path)
         end
 
@@ -1200,11 +2336,20 @@ RSpec.describe RubySMB::Client do
 
         it 'raises an UnexpectedStatusCode exception if we do not get STATUS_SUCCESS' do
           response.smb2_header.nt_status = 0xc0000015
-          expect { smb2_client.smb2_tree_from_response(path, response) }.to raise_error(RubySMB::Error::UnexpectedStatusCode, 'STATUS_NONEXISTENT_SECTOR')
+          expect { smb2_client.smb2_tree_from_response(path, response) }.to raise_error(
+            RubySMB::Error::UnexpectedStatusCode,
+            'The server responded with an unexpected status code: STATUS_NONEXISTENT_SECTOR'
+          )
         end
 
         it 'creates a new Tree from itself, the share path, and the response packet' do
-          expect(RubySMB::SMB2::Tree).to receive(:new).with(client: smb2_client, share: path, response: response)
+          expect(RubySMB::SMB2::Tree).to receive(:new).with(client: smb2_client, share: path, response: response, encrypt: false)
+          smb2_client.smb2_tree_from_response(path, response)
+        end
+
+        it 'creates a new with encryption set if the response requires it' do
+          response.share_flags.encrypt = 1
+          expect(RubySMB::SMB2::Tree).to receive(:new).with(client: smb2_client, share: path, response: response, encrypt: true)
           smb2_client.smb2_tree_from_response(path, response)
         end
       end
@@ -1214,7 +2359,7 @@ RSpec.describe RubySMB::Client do
         let(:named_pipe){ double("Named Pipe") }
 
         before :example do
-          allow(tree).to receive(:open_file).and_return(named_pipe)
+          allow(tree).to receive(:open_pipe).and_return(named_pipe)
           allow(named_pipe).to receive(:net_share_enum_all)
         end
 
@@ -1229,8 +2374,8 @@ RSpec.describe RubySMB::Client do
             smb1_client.net_share_enum_all(sock.peeraddr)
           end
 
-          it 'it calls the Tree #open_file method to open "srvsvc" named pipe' do
-            expect(tree).to receive(:open_file).with(filename: "srvsvc", write: true, read: true).and_return(named_pipe)
+          it 'it calls the Tree #open_pipe method to open "srvsvc" named pipe' do
+            expect(tree).to receive(:open_pipe).with(filename: "srvsvc", write: true, read: true).and_return(named_pipe)
             smb1_client.net_share_enum_all(sock.peeraddr)
           end
 
@@ -1252,8 +2397,8 @@ RSpec.describe RubySMB::Client do
             smb2_client.net_share_enum_all(sock.peeraddr)
           end
 
-          it 'it calls the Tree #open_file method to open "srvsvc" named pipe' do
-            expect(tree).to receive(:open_file).with(filename: "srvsvc", write: true, read: true).and_return(named_pipe)
+          it 'it calls the Tree #open_pipe method to open "srvsvc" named pipe' do
+            expect(tree).to receive(:open_pipe).with(filename: "srvsvc", write: true, read: true).and_return(named_pipe)
             smb2_client.net_share_enum_all(sock.peeraddr)
           end
 
@@ -1301,7 +2446,7 @@ RSpec.describe RubySMB::Client do
       end
 
       it 'raise an InvalidPacket exception when the response is not valid' do
-        echo_response.smb_header.command = RubySMB::SMB1::Commands::SMB_COM_SESSION_SETUP
+        echo_response.smb_header.command = RubySMB::SMB1::Commands::SMB_COM_SESSION_SETUP_ANDX
         allow(smb1_client).to receive(:send_recv).and_return(echo_response.to_binary_s)
         expect { smb1_client.echo }.to raise_error(RubySMB::Error::InvalidPacket)
       end
@@ -1334,7 +2479,7 @@ RSpec.describe RubySMB::Client do
       before :example do
         allow(ipc_tree).to receive_messages(
           :share     => share,
-          :open_file => named_pipe
+          :open_pipe => named_pipe
         )
         allow(client).to receive(:tree_connect).and_return(ipc_tree)
       end
@@ -1356,9 +2501,9 @@ RSpec.describe RubySMB::Client do
         expect(client).to have_received(:tree_connect).with(share)
       end
 
-      it 'open \'winreg\' file on the IPC$ Tree' do
+      it 'open \'winreg\' pipe on the IPC$ Tree' do
         client.connect_to_winreg(host)
-        expect(ipc_tree).to have_received(:open_file).with(filename: "winreg", write: true, read: true)
+        expect(ipc_tree).to have_received(:open_pipe).with(filename: "winreg", write: true, read: true)
       end
 
       it 'returns the expected opened named pipe' do
@@ -1473,5 +2618,198 @@ RSpec.describe RubySMB::Client do
       end
     end
   end
+
+  describe '#update_preauth_hash' do
+    it 'raises an EncryptionError exception if the preauth integrity hash algorithm is not known' do
+      expect { client.update_preauth_hash('Test') }.to raise_error(
+        RubySMB::Error::EncryptionError,
+        'Cannot compute the Preauth Integrity Hash value: Preauth Integrity Hash Algorithm is nil'
+      )
+    end
+
+    it 'computes the hash value' do
+      packet = RubySMB::SMB2::Packet::EchoRequest.new
+      data = 'Previous hash'
+      algo = RubySMB::SMB2::PreauthIntegrityCapabilities::HASH_ALGORITM_MAP[
+        RubySMB::SMB2::PreauthIntegrityCapabilities::SHA_512
+      ]
+      client.preauth_integrity_hash_algorithm = algo
+      client.preauth_integrity_hash_value = data
+      hash = OpenSSL::Digest.digest(algo, data + packet.to_binary_s)
+      client.update_preauth_hash(packet)
+      expect(client.preauth_integrity_hash_value).to eq(hash)
+    end
+  end
+
+  context 'Encryption' do
+    describe '#smb3_encrypt' do
+      let(:transform_packet) { double('TransformHeader packet') }
+      let(:session_key) { "\x5c\x00\x4a\x3b\xf0\xa2\x4f\x75\x4c\xb2\x74\x0a\xcf\xc4\x8e\x1a".b }
+      let(:data) { RubySMB::SMB2::Packet::TreeConnectRequest.new.to_binary_s }
+
+      before :example do
+        allow(RubySMB::SMB2::Packet::TransformHeader).to receive(:new).and_return(transform_packet)
+        allow(transform_packet).to receive(:encrypt)
+        client.session_key = session_key
+      end
+
+      it 'does not generate a new client encryption key if it already exists' do
+        client.client_encryption_key = 'key'
+        expect(RubySMB::Crypto::KDF).to_not receive(:counter_mode)
+        expect(client.client_encryption_key).to eq('key')
+        client.smb3_encrypt(data)
+      end
+
+      ['0x0300', '0x0302'].each do |dialect|
+        context "with #{dialect} dialect" do
+          before :example do
+            client.dialect = dialect
+          end
+
+          it 'generates the client encryption key with the expected parameters' do
+            expect(RubySMB::Crypto::KDF).to receive(:counter_mode).with(
+              session_key,
+              "SMB2AESCCM\x00",
+              "ServerIn \x00"
+            ).and_call_original
+            client.smb3_encrypt(data)
+          end
+        end
+      end
+
+      context 'with 0x0311 dialect' do
+        it 'generates the client encryption key with the expected parameters' do
+          client.preauth_integrity_hash_value = ''
+          client.dialect = '0x0311'
+          expect(RubySMB::Crypto::KDF).to receive(:counter_mode).with(
+            session_key,
+            "SMBC2SCipherKey\x00",
+            ''
+          ).and_call_original
+          client.smb3_encrypt(data)
+        end
+      end
+
+      it 'raises the expected exception if the dialect is incompatible' do
+        client.dialect = '0x0202'
+        expect { client.smb3_encrypt(data) }.to raise_error(RubySMB::Error::EncryptionError)
+      end
+
+      it 'creates a TransformHeader packet and encrypt the data' do
+        client.dialect = '0x0300'
+        client.encryption_algorithm = 'AES-128-CCM'
+        client.session_id = 123
+        client.smb3_encrypt(data)
+        expect(RubySMB::SMB2::Packet::TransformHeader).to have_received(:new).with(flags: 1, session_id: 123)
+        expect(transform_packet).to have_received(:encrypt).with(data, client.client_encryption_key, algorithm: 'AES-128-CCM')
+      end
+
+      it 'generates the expected client encryption key with 0x0302 dialect' do
+        client.dialect = '0x0302'
+        expected_enc_key =
+          "\xa4\xfa\x23\xc1\xb0\x65\x84\xce\x47\x08\x5b\xe0\x64\x98\xd7\x87".b
+        client.smb3_encrypt(data)
+        expect(client.client_encryption_key).to eq expected_enc_key
+      end
+
+      it 'generates the expected client encryption key with 0x0311 dialect' do
+        client.dialect = '0x0311'
+        client.session_key =
+          "\x5c\x00\x4a\x3b\xf0\xa2\x4f\x75\x4c\xb2\x74\x0a\xcf\xc4\x8e\x1a".b
+        client.preauth_integrity_hash_value =
+          "\x57\x77\x7d\x47\xc2\xa9\xc8\x23\x6e\x8a\xfa\x39\xe8\x77\x2f\xb0\xb6"\
+          "\x01\xba\x85\x58\x77\xf5\x01\xa0\xf0\x31\x69\x6a\x64\x49\x1c\x61\xdb"\
+          "\x57\x34\x19\x1b\x80\x33\x9a\xfa\x1d\x6c\x3f\xca\x44\x68\x78\x5b\xb9"\
+          "\xda\x41\xfa\x83\xe5\xa9\x6f\xcf\x44\xbc\xe5\x26\x6e".b
+        expected_enc_key =
+          "\xc7\x4e\xfe\x4d\x15\x48\x5b\x0b\x71\x45\x49\x26\x8a\xd9\x6c\xaa".b
+        client.smb3_encrypt(data)
+        expect(client.client_encryption_key).to eq expected_enc_key
+      end
+    end
+
+    describe '#smb3_decrypt' do
+      let(:transform_packet) { double('TransformHeader packet') }
+      let(:session_key) { "\x5c\x00\x4a\x3b\xf0\xa2\x4f\x75\x4c\xb2\x74\x0a\xcf\xc4\x8e\x1a".b }
+
+      before :example do
+        allow(transform_packet).to receive(:decrypt)
+        client.session_key = session_key
+      end
+
+      it 'does not generate a new server encryption key if it already exists' do
+        client.server_encryption_key = 'key'
+        expect(RubySMB::Crypto::KDF).to_not receive(:counter_mode)
+        expect(client.server_encryption_key).to eq('key')
+        client.smb3_decrypt(transform_packet)
+      end
+
+      ['0x0300', '0x0302'].each do |dialect|
+        context "with #{dialect} dialect" do
+          before :example do
+            client.dialect = dialect
+          end
+
+          it 'generates the client encryption key with the expected parameters' do
+            expect(RubySMB::Crypto::KDF).to receive(:counter_mode).with(
+              session_key,
+              "SMB2AESCCM\x00",
+              "ServerOut\x00"
+            ).and_call_original
+            client.smb3_decrypt(transform_packet)
+          end
+        end
+      end
+
+      context 'with 0x0311 dialect' do
+        it 'generates the client encryption key with the expected parameters' do
+          client.preauth_integrity_hash_value = ''
+          client.dialect = '0x0311'
+          expect(RubySMB::Crypto::KDF).to receive(:counter_mode).with(
+            session_key,
+            "SMBS2CCipherKey\x00",
+            ''
+          ).and_call_original
+          client.smb3_decrypt(transform_packet)
+        end
+      end
+
+      it 'raises the expected exception if the dialect is incompatible' do
+        client.dialect = '0x0202'
+        expect { client.smb3_decrypt(transform_packet) }.to raise_error(RubySMB::Error::EncryptionError)
+      end
+
+      it 'creates a TransformHeader packet and encrypt the data' do
+        client.dialect = '0x0300'
+        client.encryption_algorithm = 'AES-128-CCM'
+        client.session_id = 123
+        client.smb3_decrypt(transform_packet)
+        expect(transform_packet).to have_received(:decrypt).with(client.server_encryption_key, algorithm: 'AES-128-CCM')
+      end
+
+      it 'generates the expected server encryption key with 0x0302 dialect' do
+        client.dialect = '0x0302'
+        expected_enc_key =
+          "\x65\x21\xd3\x6d\xe9\xe3\x5a\x66\x09\x61\xae\x3e\xc6\x49\x6b\xdf".b
+        client.smb3_decrypt(transform_packet)
+        expect(client.server_encryption_key).to eq expected_enc_key
+      end
+
+      it 'generates the expected server encryption key with 0x0311 dialect' do
+        client.dialect = '0x0311'
+        client.session_key =
+          "\x5c\x00\x4a\x3b\xf0\xa2\x4f\x75\x4c\xb2\x74\x0a\xcf\xc4\x8e\x1a".b
+        client.preauth_integrity_hash_value =
+          "\x57\x77\x7d\x47\xc2\xa9\xc8\x23\x6e\x8a\xfa\x39\xe8\x77\x2f\xb0\xb6"\
+          "\x01\xba\x85\x58\x77\xf5\x01\xa0\xf0\x31\x69\x6a\x64\x49\x1c\x61\xdb"\
+          "\x57\x34\x19\x1b\x80\x33\x9a\xfa\x1d\x6c\x3f\xca\x44\x68\x78\x5b\xb9"\
+          "\xda\x41\xfa\x83\xe5\xa9\x6f\xcf\x44\xbc\xe5\x26\x6e".b
+        expected_enc_key =
+          "\x8c\x2c\x31\x15\x66\xba\xa9\xab\xcf\xb2\x47\x8d\x72\xd5\xd7\x4a".b
+        client.smb3_decrypt(transform_packet)
+        expect(client.server_encryption_key).to eq expected_enc_key
+      end
+    end
+  end
 end