* @param maxAttemptsPerIp max attempts from single IP
     * @param maxGlobalAttemptsPerMinute max global attempts per minute
     * @param lockoutDuration duration to lock out account/IP
     * @param cleanupInterval interval for cleaning up old entries
     */
    public AuthenticationRateLimiter(int maxAttemptsPerAccount, int maxAttemptsPerIp, int maxGlobalAttemptsPerMinute,

    // Store session key and preauth hash for key rotation
    private byte[] sessionKey;
    private byte[] preauthIntegrityHash;
    private int rotationCount = 0;

    // Key rotation tracking - use atomic for lock-free operations
    private final AtomicLong bytesEncrypted = new AtomicLong(0);
    private long encryptionStartTime = System.currentTimeMillis();

    // Configurable key rotation limits with defaults

    }

    @Override
    public E element() {
      assertTrue(Thread.holdsLock(mutex));
      return delegate.element();
    }

    @Override
    public Iterator<E> iterator() {
      // We explicitly don't lock for iterator()
      assertFalse(Thread.holdsLock(mutex));
      return delegate.iterator();
    }

    @Override
    public int size() {
      assertTrue(Thread.holdsLock(mutex));
      return delegate.size();

  protected void shutDown() throws Exception {}

  /**
   * Invoked to request the service to stop.
   *
   * <p>By default this method does nothing.
   *
   * <p>Currently, this method is invoked while holding a lock. If an implementation of this method
   * blocks, it can prevent this service from changing state. If you need to performing a blocking
   * operation in order to trigger shutdown, consider instead registering a listener and

import static java.util.Arrays.asList;
import static org.junit.Assert.assertThrows;
import static org.mockito.ArgumentMatchers.isA;
import static org.mockito.Mockito.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

import com.google.common.base.Equivalence;
import com.google.common.collect.testing.features.CollectionFeature;
import com.google.common.collect.testing.features.CollectionSize;

    /** SMB2 read file command */
    protected static final short SMB2_READ = 0x0008;
    /** SMB2 write file command */
    protected static final short SMB2_WRITE = 0x0009;
    /** SMB2 lock file command */
    protected static final short SMB2_LOCK = 0x000A;
    /** SMB2 IO control command */
    protected static final short SMB2_IOCTL = 0x000B;
    /** SMB2 cancel command */

    /**
     * Reserve an opportunistic lock filter on the open
     */
    public static final int FILE_RESERVE_OPFILTER = 0x100000;
    /**
     * Open a reparse point and bypass normal reparse point processing
     */
    public static final int FILE_OPEN_REPARSE_POINT = 0x200000;
    /**
     * Open does not cause an opportunistic lock break for the file
     */

set FESS_MIN_MEM=%FESS_HEAP_SIZE%
set FESS_MAX_MEM=%FESS_HEAP_SIZE%
)

REM min and max heap sizes should be set to the same value to avoid
REM stop-the-world GC pauses during resize, and so that we can lock the
REM heap in memory on startup to prevent any of it from being swapped
REM out.
set FESS_JAVA_OPTS=%FESS_JAVA_OPTS% -Xms%FESS_MIN_MEM% -Xmx%FESS_MAX_MEM%

     *
     * <ol>
     *   <li>Update the {@link #servicesByState()}
     *   <li>Update the {@link #startupTimers}
     *   <li>Based on the new state queue listeners to run
     *   <li>Run the listeners (outside of the lock)
     * </ol>
     */
    void transitionService(Service service, State from, State to) {
      checkNotNull(service);
      checkArgument(from != to);
      monitor.enter();
      try {

     *
     * <ol>
     *   <li>Update the {@link #servicesByState()}
     *   <li>Update the {@link #startupTimers}
     *   <li>Based on the new state queue listeners to run
     *   <li>Run the listeners (outside of the lock)
     * </ol>
     */
    void transitionService(Service service, State from, State to) {
      checkNotNull(service);
      checkArgument(from != to);
      monitor.enter();
      try {