ipBlocks: ["1.2.3.4"]
      to:
        - operation:
            ports: ["80"]
    # rule[3] `from`: nil, `to`: nil, `when`: HTTP field.
    - when:
        - key: "request.headers[:method]"
          values: ["GET"]
    # rule[4] `from`: nil, `to`: nil, `when`: TCP field.
    - when:
        - key: "destination.port"
          values: ["80"]
    # rule[5] `from`: all fields, `to`: all fields, `when`: all fields.
    - from:

					&BaseEndpointInfo{ip: "10.0.1.3", port: 80, endpoint: "10.0.1.3:80", isLocal: true, ready: true, serving: true, terminating: false},
					&BaseEndpointInfo{ip: "10.0.1.4", port: 80, endpoint: "10.0.1.4:80", isLocal: true, ready: true, serving: true, terminating: false},

                rules:
                - destinationPort: 80
        principals:
        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-deny]-rule[5]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - destinationPort: 80
            - notRule:
                orRules:
                  rules:

DATA ·powrodataL51<> + 16(SB)/8, $0.24022650695910110361E+00
DATA ·powrodataL51<> + 24(SB)/8, $0.69314718055994686185E+00
DATA ·powrodataL51<> + 32(SB)/8, $0.96181291057109484809E-02
DATA ·powrodataL51<> + 40(SB)/8, $0.15403814778342868389E-03
DATA ·powrodataL51<> + 48(SB)/8, $0.55504108652095235601E-01
DATA ·powrodataL51<> + 56(SB)/8, $0.13333818813168698658E-02
DATA ·powrodataL51<> + 64(SB)/8, $0.68205322933914439200E-12

  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-default
  namespace: istio-system
spec:
  servers:
  - hosts:
    - '*/*.domain.example'
    port:
      name: default
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway

GLOBL sincosxadd<>+0(SB), RODATA, $8
DATA sincosxpi2l<>+0(SB)/8, $0.108285667392191389e-31
GLOBL sincosxpi2l<>+0(SB), RODATA, $8
DATA sincosxpi2m<>+0(SB)/8, $0.612323399573676480e-16
GLOBL sincosxpi2m<>+0(SB), RODATA, $8
DATA sincosxpi2h<>+0(SB)/8, $0.157079632679489656e+01
GLOBL sincosxpi2h<>+0(SB), RODATA, $8
DATA sincosrpi2<>+0(SB)/8, $0.636619772367581341e+00
GLOBL sincosrpi2<>+0(SB), RODATA, $8

NAME        VHOST NAME                 DOMAINS                 MATCH                  VIRTUAL SERVICE
http.80     httpbin.example.com:80     httpbin.example.com     PathPrefix:/get        http-0-istio-autogenerated-k8s-gateway.default
            backend                    *                       /healthz/ready*        

	if service.External() {
		return nil
	}

	// we make port 80 same as endpoint port, otherwise, it's distinct
	target := port.Port
	if target != 80 {
		target += 1000
	}

	return &model.ServiceInstance{
		Endpoint: &model.IstioEndpoint{
			Address:         MakeIP(service, version),
			EndpointPort:    uint32(target),

	"istio.io/istio/pkg/test/util/assert"
)

func TestGetByPort(t *testing.T) {
	ports := PortList{{
		Name: "http",
		Port: 80,
	}}

	if port, exists := ports.GetByPort(80); !exists || port == nil || port.Name != "http" {
		t.Errorf("GetByPort(80) => want http but got %v, %t", port, exists)
	}
	if port, exists := ports.GetByPort(88); exists || port != nil {

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: proxy-service-instance
spec:
  hosts:
  - example.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  resolution: STATIC
  endpoints:
  - address: 1.1.1.1
    labels:
      istio.io/benchmark: "true"
---