private ZoneIdentityPermission BasicTestZone (SecurityZone zone, bool special)
		{
			ZoneIdentityPermission zip = new ZoneIdentityPermission (zone);
			Assert.AreEqual (zone, zip.SecurityZone, "SecurityZone");
			
			ZoneIdentityPermission copy = (ZoneIdentityPermission) zip.Copy ();
			Assert.IsTrue (Same (zip, copy), "Equals-Copy");
			Assert.IsTrue (zip.IsSubsetOf (copy), "IsSubset-1");
			Assert.IsTrue (copy.IsSubsetOf (zip), "IsSubset-2");
			if (special) {
				Assert.IsFalse (zip.IsSubsetOf (null), "IsSubset-Null");
			}
			
			IPermission intersect = zip.Intersect (copy);
			if (special) {
				Assert.IsTrue (intersect.IsSubsetOf (zip), "IsSubset-3");
				Assert.IsFalse (Object.ReferenceEquals (zip, intersect), "!ReferenceEquals1");
				Assert.IsTrue (intersect.IsSubsetOf (copy), "IsSubset-4");
				Assert.IsFalse (Object.ReferenceEquals (copy, intersect), "!ReferenceEquals2");
			}

			Assert.IsNull (zip.Intersect (null), "Intersect with null");

			intersect = zip.Intersect (new ZoneIdentityPermission (PermissionState.None));
			Assert.IsNull (intersect, "Intersect with PS.None");

			// note: can't be tested with PermissionState.Unrestricted

			// XML roundtrip
			SecurityElement se = zip.ToXml ();
			copy.FromXml (se);
			Assert.IsTrue (Same (zip, copy), "Equals-Xml");

			return zip;
		}

		public ZoneIdentityPermission (PermissionState state)
		{
			// false == do not allow Unrestricted for Identity Permissions
			CheckPermissionState (state, false);
			// default values
			zone = SecurityZone.NoZone;
		}

     /// <include file='doc\Zone.uex' path='docs/doc[@for="Zone.Zone"]/*' />
     public Zone(SecurityZone zone)
     {
         if (zone < SecurityZone.NoZone || zone > SecurityZone.Untrusted)
             throw new ArgumentException( Environment.GetResourceString( "Argument_IllegalZone" ) );
 
         m_zone = zone;
     }

	// Constructor.
	public ZoneIdentityPermission(PermissionState state)
			{
				if(state != PermissionState.None)
				{
					throw new ArgumentException(_("Arg_PermissionState"));
				}
				zone = SecurityZone.NoZone;
			}

	// Constructor.
	public Zone(SecurityZone zone)
			{
				if(((int)zone) < ((int)(SecurityZone.NoZone)) ||
				   ((int)zone) > ((int)(SecurityZone.Untrusted)))
				{
					throw new ArgumentException(_("Arg_SecurityZone"));
				}
				this.zone = zone;
			}

	public ZoneMembershipCondition(SecurityZone zone)
			{
				if(zone < SecurityZone.MyComputer ||
				   zone > SecurityZone.Untrusted)
				{
					throw new ArgumentException(_("Arg_SecurityZone"));
				}
				this.zone = zone;
			}

		public Zone (SecurityZone zone)
		{
			if (!Enum.IsDefined (typeof (SecurityZone), zone)) {
				string msg = String.Format (Locale.GetText ("Invalid zone {0}."), zone);
				throw new ArgumentException (msg, "zone");
			}

			this.zone = zone;
		}

        private void OnSerializing(StreamingContext ctx)
        { 

            if ((ctx.State & ~(StreamingContextStates.Clone|StreamingContextStates.CrossAppDomain)) != 0) 
            { 
                m_serializedPermission = ToXml().ToString(); //for the v2 and beyond case
                m_zone = SecurityZone; 

            }
        }

        public AppDomain CreateSandboxDomain(string name, string path, SecurityZone zone)
        {
            var setup = new AppDomainSetup { ApplicationBase = Common.ApiPath, PrivateBinPath = Path.GetFullPath(path) };

            var evidence = new Evidence();
            evidence.AddHostEvidence(new Zone(zone));
            var permissions = SecurityManager.GetStandardSandbox(evidence);

            var strongName = typeof(OSAEService).Assembly.Evidence.GetHostEvidence<StrongName>();

            return AppDomain.CreateDomain(name, null, setup);
        }

        private static void RunScenario(SecurityZone zone, bool fullyTrustEventSource, bool grantUnmanagedCodePermission)
        {
            Console.Write("Running scenario for zone '{0}', fully trusted EventSource {1}, unmanaged permission {2}: ", zone, fullyTrustEventSource, grantUnmanagedCodePermission);

            var evidence = new Evidence();
            evidence.AddHostEvidence(new Zone(zone));
            var permissionSet = SecurityManager.GetStandardSandbox(evidence);
            if (!permissionSet.IsUnrestricted() && grantUnmanagedCodePermission)
            {
                permissionSet.AddPermission(new SecurityPermission(SecurityPermissionFlag.UnmanagedCode));
            }

            var eventSourceAssemblyName = typeof(EventSource).Assembly.GetName();
            var fullyTrustedAssemblies =
                fullyTrustEventSource
                    ? new StrongName[]  
                    {
                        new StrongName(new StrongNamePublicKeyBlob(eventSourceAssemblyName.GetPublicKey()), eventSourceAssemblyName.Name, eventSourceAssemblyName.Version)
                    }
                    : new StrongName[0];

            var info = new AppDomainSetup { ApplicationBase = AppDomain.CurrentDomain.BaseDirectory };
            info.ApplicationTrust = new ApplicationTrust(permissionSet, fullyTrustedAssemblies);

            var appDomain =
                AppDomain.CreateDomain(
                    "partial trust",
                    evidence,
                    info);
            try
            {
                var tester = (LttADEventSourceTester)appDomain
                    .CreateInstanceAndUnwrap(
                        typeof(LttADEventSourceTester).Assembly.GetName().Name,
                        typeof(LttADEventSourceTester).FullName);
                tester.IsEventSourceAssmFullyTrusted = fullyTrustEventSource;
                tester.DoStuff(1);
                tester.DoStuff(2);
                tester.DoStuff(3);

                Assert.IsTrue(tester.IsStateValid, "EventSource ConstructionException as expected");
                Console.WriteLine("SUCCESS");
                Console.WriteLine();
            }
            finally
            {
                AppDomain.Unload(appDomain);
            }

            Console.WriteLine("==================================================================");
            Console.WriteLine();
        }

 //------------------------------------------------------
 //
 // PUBLIC CONSTRUCTORS
 //
 //------------------------------------------------------
 
 /// <include file='doc\ZoneIdentityPermission.uex' path='docs/doc[@for="ZoneIdentityPermission.ZoneIdentityPermission"]/*' />
 public ZoneIdentityPermission(PermissionState state)
 {
     if (state == PermissionState.Unrestricted)
     {
         throw new ArgumentException(Environment.GetResourceString("Argument_UnrestrictedIdentityPermission"));
     }
     else if (state == PermissionState.None)
     {
         m_zone = SecurityZone.NoZone;
     }
     else
     {
         throw new ArgumentException(Environment.GetResourceString("Argument_InvalidPermissionState"));
     }
 }

        private void OnDeserialized(StreamingContext ctx) 
        {
            if ((ctx.State & ~(StreamingContextStates.Clone|StreamingContextStates.CrossAppDomain)) != 0)
            {
                // v2.0 and beyond XML case 
                if (m_serializedPermission != null)
                { 
                    FromXml(SecurityElement.FromString(m_serializedPermission)); 
                    m_serializedPermission = null;
                } 
                else //v1.x case where we read the m_zone value
                {
                    SecurityZone = m_zone;
                    m_zone = SecurityZone.NoZone; 
                }
            } 
 

        } 

	// Convert an XML value into a permissions value.
	public override void FromXml(SecurityElement esd)
			{
				String value;
				if(esd == null)
				{
					throw new ArgumentNullException("esd");
				}
				if(esd.Attribute("version") != "1")
				{
					throw new ArgumentException(_("Arg_PermissionVersion"));
				}
				value = esd.Attribute("Zone");
				if(value != null)
				{
					zone = (SecurityZone)
						Enum.Parse(typeof(SecurityZone), value);
				}
				else
				{
					zone = SecurityZone.NoZone;
				}
			}

 protected SecurityException(SerializationInfo info, StreamingContext context) : base(info, context)
 {
     if (info == null)
     {
         throw new ArgumentNullException("info");
     }
     try
     {
         this.m_action = (SecurityAction) info.GetValue("Action", typeof(SecurityAction));
         this.m_permissionThatFailed = (string) info.GetValueNoThrow("FirstPermissionThatFailed", typeof(string));
         this.m_demanded = (string) info.GetValueNoThrow("Demanded", typeof(string));
         this.m_granted = (string) info.GetValueNoThrow("GrantedSet", typeof(string));
         this.m_refused = (string) info.GetValueNoThrow("RefusedSet", typeof(string));
         this.m_denied = (string) info.GetValueNoThrow("Denied", typeof(string));
         this.m_permitOnly = (string) info.GetValueNoThrow("PermitOnly", typeof(string));
         this.m_assemblyName = (AssemblyName) info.GetValueNoThrow("Assembly", typeof(AssemblyName));
         this.m_serializedMethodInfo = (byte[]) info.GetValueNoThrow("Method", typeof(byte[]));
         this.m_strMethodInfo = (string) info.GetValueNoThrow("Method_String", typeof(string));
         this.m_zone = (SecurityZone) info.GetValue("Zone", typeof(SecurityZone));
         this.m_url = (string) info.GetValueNoThrow("Url", typeof(string));
     }
     catch
     {
         this.m_action = (SecurityAction) 0;
         this.m_permissionThatFailed = "";
         this.m_demanded = "";
         this.m_granted = "";
         this.m_refused = "";
         this.m_denied = "";
         this.m_permitOnly = "";
         this.m_assemblyName = null;
         this.m_serializedMethodInfo = null;
         this.m_strMethodInfo = null;
         this.m_zone = SecurityZone.NoZone;
         this.m_url = "";
     }
 }

		private void ResolveEvidenceHost (SecurityZone zone, bool unrestricted, bool empty)
		{
			string prefix = zone.ToString () + "-";
			Evidence e = new Evidence ();
			e.AddHost (new Zone (zone));
			PermissionSet ps = SecurityManager.ResolvePolicy (e);
			// as 2.0 use Unrestricted for Identity permissions they have no need to be 
			// kept in resolved permission set
#if NET_2_0
			Assert.IsTrue ((unrestricted || (ps.Count > 0)), prefix + "Count");
#else
			Assert.IsTrue ((ps.Count > 0), prefix + "Count");
#endif
			Assert.AreEqual (empty, ps.IsEmpty (), prefix + "IsEmpty");
			Assert.AreEqual (unrestricted, ps.IsUnrestricted (), prefix + "IsUnrestricted");
#if NET_2_0
			if (unrestricted)
				Assert.IsNull (ps.GetPermission (typeof (ZoneIdentityPermission)), prefix + "GetPermission(ZoneIdentityPermission)");
			else
				Assert.IsNotNull (ps.GetPermission (typeof (ZoneIdentityPermission)), prefix + "GetPermission(ZoneIdentityPermission)");
#else
			Assert.IsNotNull (ps.GetPermission (typeof (ZoneIdentityPermission)), prefix + "GetPermission(ZoneIdentityPermission)");
#endif
		}

 private void OnSerialized(StreamingContext ctx)
 { 
     if ((ctx.State & ~(StreamingContextStates.Clone|StreamingContextStates.CrossAppDomain)) != 0) 
     {
         m_serializedPermission = null; 
         m_zone = SecurityZone.NoZone;
     }
 }

 public override void FromXml(SecurityElement esd) 
 { 
     m_zones = 0;
     CodeAccessPermission.ValidateElement( esd, this ); 
     String eZone = esd.Attribute( "Zone" );
     if (eZone != null)
         SecurityZone = (SecurityZone)Enum.Parse( typeof( SecurityZone ), eZone );
     if(esd.Children != null) 
     {
         foreach(SecurityElement child in esd.Children) 
         { 
             eZone = child.Attribute( "Zone" );
             int enm = (int)Enum.Parse( typeof( SecurityZone ), eZone ); 
             if(enm == (int)SecurityZone.NoZone)
                 continue;
             m_zones |= ((uint)1 << enm);
         } 
     }
 } 

		private void Resolve_Zone_Unrestricted_Attribute (SecurityZone zone, PolicyStatementAttribute attr)
		{
			IMembershipCondition mc = new ZoneMembershipCondition (zone);
			PolicyStatement ps = new PolicyStatement (new PermissionSet (PermissionState.Unrestricted));
			ps.Attributes = attr;
			PolicyLevel pl = PolicyLevel.CreateAppDomainLevel ();
			pl.RootCodeGroup = new UnionCodeGroup (mc, ps);

			Resolve_Zone (pl, SecurityZone.Internet, attr, (zone == SecurityZone.Internet), 0);
			Resolve_Zone (pl, SecurityZone.Intranet, attr, (zone == SecurityZone.Intranet), 0);
			Resolve_Zone (pl, SecurityZone.MyComputer, attr, (zone == SecurityZone.MyComputer), 0);
			Resolve_Zone (pl, SecurityZone.NoZone, attr, (zone == SecurityZone.NoZone), 0);
			Resolve_Zone (pl, SecurityZone.Trusted, attr, (zone == SecurityZone.Trusted), 0);
			Resolve_Zone (pl, SecurityZone.Untrusted, attr, (zone == SecurityZone.Untrusted), 0);
		}

 /// <internalonly/>
 int IBuiltInEvidence.InitFromBuffer( char[] buffer, int position )
 {
     m_url = null;
     m_zone = (SecurityZone)BuiltInEvidenceHelper.GetIntFromCharArray(buffer, position);
     return position + 2;
 }

 private static extern void GetLocationEvidence(SafePEFileHandle peFile, out SecurityZone zone, StringHandleOnStack retUrl);