assertEquals("D1guest", permissionHelper.encode("(deny){user}guest"));
        assertEquals("DRguest", permissionHelper.encode("(deny){role}guest"));
        assertEquals("D2guest", permissionHelper.encode("(deny){group}guest"));
        assertEquals("D1guest", permissionHelper.encode("(deny){USER}guest"));
        assertEquals("DRguest", permissionHelper.encode("(deny){ROLE}guest"));

    // Access Mode Encoding for desiredAccess
    static final int SHARING_COMPATIBILITY = 0x00;
    static final int SHARING_DENY_READ_WRITE_EXECUTE = 0x10;
    static final int SHARING_DENY_WRITE = 0x20;
    static final int SHARING_DENY_READ_EXECUTE = 0x30;
    static final int SHARING_DENY_NONE = 0x40;

    static final int DO_NOT_CACHE = 0x1000; // bit 12
    static final int WRITE_THROUGH = 0x4000; // bit 14

    private static final int SHARING_COMPATIBILITY           = 0x00;
    private static final int SHARING_DENY_READ_WRITE_EXECUTE = 0x10;
    private static final int SHARING_DENY_WRITE              = 0x20;
    private static final int SHARING_DENY_READ_EXECUTE       = 0x30;
    private static final int SHARING_DENY_NONE               = 0x40;

    private static final int DO_NOT_CACHE  = 0x1000; // bit 12

 * the operation and the desired access bits are compared to the SID
 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"

 * the operation and the desired access bits are compared to the SID
 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"

 * the operation and the desired access bits are compared to the SID
 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "stable-channel-default-policy-binding.istio.io"
spec:
  policyName: "stable-channel-default-policy.istio.io"
  validationActions: [Deny]

  services:
    "default/example.com":
      80: 8080
    "default/example2.com":
      80: 8080
policies:
  - action: Allow
    rules:
    - - - not_destination_ports:
          - 9999
    name: deny-9999
    namespace: default
    scope: Namespace
services:
- name: local
  namespace: default
  hostname: example.com
  vips:
    - /127.10.0.1
  ports:
    80: 8080
- name: remote

    if (JavaVersion.current().isJava9Compatible) {
        //allow ProjectBuilder to inject legacy types into the system classloader
        jvmArgs("--add-opens", "java.base/java.lang=ALL-UNNAMED")
        jvmArgs("--illegal-access=deny")
    }
    useJUnitPlatform()

	typedef [v1_enum] enum {
		SE_GROUP_MANDATORY          = 0x00000001,
		SE_GROUP_ENABLED_BY_DEFAULT = 0x00000002,
		SE_GROUP_ENABLED            = 0x00000004,
		SE_GROUP_OWNER              = 0x00000008,
		SE_GROUP_USE_FOR_DENY_ONLY  = 0x00000010,
		SE_GROUP_RESOURCE           = 0x20000000,
		SE_GROUP_LOGON_ID           = 0xC0000000
	} SamrGroupAttrs;

	typedef struct {
		uint32_t rid;
		SamrGroupAttrs attributes;
	} SamrRidWithAttribute;