samba - Feb 2017 - Packet Signing Options and a "PREFER_NO" option.

Hello, 


Mac users running OS X 10.12.x report that read and write speeds to SMB-mounted
network shares are very poor if packet signing is required (the default on OS X
since 10.11.something). Suggestions abound on the Internet that you can restore
good throughput by disabling packet signing on the Mac.  You do that by creating
or editing the /etc/nsmb.conf file and adding:


[default]
require_signing=no


Indeed, customers of my company's products have confirmed that disabling
packet signing "makes Samba great again". The problem is, disabling
packet signing seems to be an all or nothing proposition.  If you disable it on
OS X, apparently you can no longer connect to servers that require packet
signing including Windows Domain Controllers (I haven't tested this myself,
but that's what users report).  I realize that Samba.org has little (or
nothing) to do with Apple's SMB implementation. However, assuming there is
some discussion about this issue among the community of developers who work on
SMB implementations (at Microsoft, Apple, Samba.org, and elsewhere), I just want
to voice my opinion that it would be nice to have an option, on both the Server
and Client sides, that essentially says:  "Prefer NOT using signing, but
support it if either side requires it".  Reading the man pages for
smb.conf, I don't get the sense that such an option is possible.  AUTO means
that signing isn't required, but it WILL be used if both sides support it. 
MANDATORY means it MUST be used or else you won't connect.  DISABLED means
it will NEVER be used, even if one side requires it (in which case, I suppose
the connection will fail).  What might be helpful is a 4th option
"PREFER_NO" -- where both sides CAN support it but won't use it
unless one side requires it.


It seems a similar discussion came up in 2011 in a exchange between Stefan
(metze) Metzmacher and Andrew Bartlett 
(https://lists.samba.org/archive/samba-technical/2011-October/080119.html).  It
looks as if the end result was to not implement what Stefan had suggested.


Regards, 
Andy Liebman